275 files changed, 3189 insertions, 1625 deletions
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 5d9248526d78..4770de5707b9 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -348,7 +348,6 @@ source "drivers/acpi/apei/Kconfig"
 config ACPI_EXTLOG
        tristate "Extended Error Log support"
        depends on X86_MCE && X86_LOCAL_APIC
-        select EFI
        select UEFI_CPER
        default n
        help
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 8711e3797165..3c2e4aa529c4 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -207,7 +207,7 @@ static int acpi_ac_probe(struct platform_device *pdev)
                goto end;
        result = acpi_install_notify_handler(ACPI_HANDLE(&pdev->dev),
-                        ACPI_DEVICE_NOTIFY, acpi_ac_notify_handler, ac);
+                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler, ac);
        if (result) {
                power_supply_unregister(&ac->charger);
                goto end;
@@ -255,7 +255,7 @@ static int acpi_ac_remove(struct platform_device *pdev)
                return -EINVAL;
        acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev),
-                        ACPI_DEVICE_NOTIFY, acpi_ac_notify_handler);
+                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler);
        ac = platform_get_drvdata(pdev);
        if (ac->charger.dev)
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 6745fe137b9e..e60390597372 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -162,6 +162,7 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
        { "80860F14", (unsigned long)&byt_sdio_dev_desc },
        { "80860F41", (unsigned long)&byt_i2c_dev_desc },
        { "INT33B2", },
+        { "INT33FC", },
        { "INT3430", (unsigned long)&lpt_dev_desc },
        { "INT3431", (unsigned long)&lpt_dev_desc },
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index 786294bb682c..3650b2183227 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -2,7 +2,6 @@ config ACPI_APEI
        bool "ACPI Platform Error Interface (APEI)"
        select MISC_FILESYSTEMS
        select PSTORE
-        select EFI
        select UEFI_CPER
        depends on X86
        help
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 26311f23c824..cb1d557fc22c 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -942,6 +942,7 @@ static int erst_clearer(enum pstore_type_id type, u64 id, int count,
 static struct pstore_info erst_info = {
        .owner          = THIS_MODULE,
        .name           = "erst",
+        .flags          = PSTORE_FLAGS_FRAGILE,
        .open           = erst_open_pstore,
        .close          = erst_close_pstore,
        .read           = erst_reader,
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index fbf1aceda8b8..5876a49dfd38 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -62,6 +62,7 @@ MODULE_AUTHOR("Alexey Starikovskiy <astarikovskiy@suse.de>");
 MODULE_DESCRIPTION("ACPI Battery Driver");
 MODULE_LICENSE("GPL");
+static int battery_bix_broken_package;
 static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
@@ -416,7 +417,12 @@ static int acpi_battery_get_info(struct acpi_battery *battery)
                ACPI_EXCEPTION((AE_INFO, status, "Evaluating %s", name));
                return -ENODEV;
        }
-        if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags))
+        if (battery_bix_broken_package)
+                result = extract_package(battery, buffer.pointer,
+                                extended_info_offsets + 1,
+                                ARRAY_SIZE(extended_info_offsets) - 1);
+        else if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags))
                result = extract_package(battery, buffer.pointer,
                                extended_info_offsets,
                                ARRAY_SIZE(extended_info_offsets));
@@ -754,6 +760,17 @@ static int battery_notify(struct notifier_block *nb,
        return 0;
 }
+static struct dmi_system_id bat_dmi_table[] = {
+        {
+                .ident = "NEC LZ750/LS",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-LZ750LS"),
+                },
+        },
+        {},
+};
 static int acpi_battery_add(struct acpi_device *device)
 {
        int result = 0;
@@ -846,6 +863,9 @@ static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
 {
        if (acpi_disabled)
                return;
+        if (dmi_check_system(bat_dmi_table))
+                battery_bix_broken_package = 1;
        acpi_bus_register_driver(&acpi_battery_driver);
 }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index bba9b72e25f8..0710004055c8 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -156,6 +156,16 @@ int acpi_bus_get_private_data(acpi_handle handle, void **data)
 }
 EXPORT_SYMBOL(acpi_bus_get_private_data);
+void acpi_bus_no_hotplug(acpi_handle handle)
+{
+        struct acpi_device *adev = NULL;
+        acpi_bus_get_device(handle, &adev);
+        if (adev)
+                adev->flags.no_hotplug = true;
+}
+EXPORT_SYMBOL_GPL(acpi_bus_no_hotplug);
 static void acpi_print_osc_error(acpi_handle handle,
        struct acpi_osc_context *context, char *error)
 {
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 14f1e9506338..e3a92a6da39a 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -427,6 +427,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
          .driver_data = board_ahci_yes_fbs },                  /* 88se9128 */
        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9125),
          .driver_data = board_ahci_yes_fbs },                  /* 88se9125 */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_MARVELL_EXT, 0x9178,
+                         PCI_VENDOR_ID_MARVELL_EXT, 0x9170),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9170 */
        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
          .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
@@ -1238,15 +1241,6 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (rc)
                return rc;
-        /* AHCI controllers often implement SFF compatible interface.
-         * Grab all PCI BARs just in case.
-         */
-        rc = pcim_iomap_regions_request_all(pdev, 1 << ahci_pci_bar, DRV_NAME);
-        if (rc == -EBUSY)
-                pcim_pin_device(pdev);
-        if (rc)
-                return rc;
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
            (pdev->device == 0x2652 || pdev->device == 0x2653)) {
                u8 map;
@@ -1263,6 +1257,15 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                }
        }
+        /* AHCI controllers often implement SFF compatible interface.
+         * Grab all PCI BARs just in case.
+         */
+        rc = pcim_iomap_regions_request_all(pdev, 1 << ahci_pci_bar, DRV_NAME);
+        if (rc == -EBUSY)
+                pcim_pin_device(pdev);
+        if (rc)
+                return rc;
        hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL);
        if (!hpriv)
                return -ENOMEM;
diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
index ae2d73fe321e..3e23e9941dad 100644
--- a/drivers/ata/ahci_imx.c
+++ b/drivers/ata/ahci_imx.c
@@ -113,7 +113,7 @@ static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
        /*
         * set PHY Paremeters, two steps to configure the GPR13,
         * one write for rest of parameters, mask of first write
-         * is 0x07fffffd, and the other one write for setting
+         * is 0x07ffffff, and the other one write for setting
         * the mpll_clk_en.
         */
        regmap_update_bits(imxpriv->gpr, 0x34, IMX6Q_GPR13_SATA_RX_EQ_VAL_MASK
@@ -124,6 +124,7 @@ static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
                        | IMX6Q_GPR13_SATA_TX_ATTEN_MASK
                        | IMX6Q_GPR13_SATA_TX_BOOST_MASK
                        | IMX6Q_GPR13_SATA_TX_LVL_MASK
+                        | IMX6Q_GPR13_SATA_MPLL_CLK_EN
                        | IMX6Q_GPR13_SATA_TX_EDGE_RATE
                        , IMX6Q_GPR13_SATA_RX_EQ_VAL_3_0_DB
                        | IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA2M
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 75b93678bbcd..1393a5890ed5 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2149,9 +2149,16 @@ static int ata_dev_config_ncq(struct ata_device *dev,
                                    "failed to get NCQ Send/Recv Log Emask 0x%x\n",
                                    err_mask);
                } else {
+                        u8 *cmds = dev->ncq_send_recv_cmds;
                        dev->flags |= ATA_DFLAG_NCQ_SEND_RECV;
-                        memcpy(dev->ncq_send_recv_cmds, ap->sector_buf,
+                        memcpy(cmds, ap->sector_buf, ATA_LOG_NCQ_SEND_RECV_SIZE);
-                                ATA_LOG_NCQ_SEND_RECV_SIZE);
+                        if (dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM) {
+                                ata_dev_dbg(dev, "disabling queued TRIM support\n");
+                                cmds[ATA_LOG_NCQ_SEND_RECV_DSM_OFFSET] &=
+                                        ~ATA_LOG_NCQ_SEND_RECV_DSM_TRIM;
+                        }
                }
        }
@@ -4156,6 +4163,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "ST3320[68]13AS",     "SD1[5-9]",     ATA_HORKAGE_NONCQ |
                                                ATA_HORKAGE_FIRMWARE_WARN },
+        /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+        { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
        /* Blacklist entries taken from Silicon Image 3124/3132
           Windows driver .inf file - also several Linux problem reports */
        { "HTS541060G9SA00",    "MB3OC60D",     ATA_HORKAGE_NONCQ, },
@@ -4202,6 +4212,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "PIONEER DVD-RW  DVR-212D",   NULL,   ATA_HORKAGE_NOSETXFER },
        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
+        /* devices that don't properly handle queued TRIM commands */
+        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
        /* End Marker */
        { }
 };
@@ -6519,6 +6533,7 @@ static int __init ata_parse_force_one(char **cur,
                { "norst",      .lflags         = ATA_LFLAG_NO_HRST | ATA_LFLAG_NO_SRST },
                { "rstonce",    .lflags         = ATA_LFLAG_RST_ONCE },
                { "atapi_dmadir", .horkage_on   = ATA_HORKAGE_ATAPI_DMADIR },
+                { "disable",    .horkage_on     = ATA_HORKAGE_DISABLE },
        };
        char *start = *cur, *p = *cur;
        char *id, *val, *endp;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index ab58556d347c..377eb889f555 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3872,6 +3872,27 @@ void ata_scsi_hotplug(struct work_struct *work)
                return;
        }
+        /*
+         * XXX - UGLY HACK
+         *
+         * The block layer suspend/resume path is fundamentally broken due
+         * to freezable kthreads and workqueue and may deadlock if a block
+         * device gets removed while resume is in progress.  I don't know
+         * what the solution is short of removing freezable kthreads and
+         * workqueues altogether.
+         *
+         * The following is an ugly hack to avoid kicking off device
+         * removal while freezer is active.  This is a joke but does avoid
+         * this particular deadlock scenario.
+         *
+         * https://bugzilla.kernel.org/show_bug.cgi?id=62801
+         * http://marc.info/?l=linux-kernel&m=138695698516487
+         */
+#ifdef CONFIG_FREEZER
+        while (pm_freezing)
+                msleep(10);
+#endif
        DPRINTK("ENTER\n");
        mutex_lock(&ap->scsi_scan_mutex);
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index fe3ca0989b14..1ad2f62d34b9 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -83,6 +83,10 @@ static struct pci_driver sis_pci_driver = {
        .id_table               = sis_pci_tbl,
        .probe                  = sis_init_one,
        .remove                 = ata_pci_remove_one,
+#ifdef CONFIG_PM
+        .suspend                = ata_pci_device_suspend,
+        .resume                 = ata_pci_device_resume,
+#endif
 };
 static struct scsi_host_template sis_sht = {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index f370fc13aea5..83a598ebb65a 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -1,4 +1,5 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/sched.h>
 #include <linux/fs.h>
@@ -65,7 +66,7 @@ enum {
        NULL_Q_MQ               = 2,
 };
-static int submit_queues = 1;
+static int submit_queues;
 module_param(submit_queues, int, S_IRUGO);
 MODULE_PARM_DESC(submit_queues, "Number of submission queues");
@@ -101,9 +102,9 @@ static int hw_queue_depth = 64;
 module_param(hw_queue_depth, int, S_IRUGO);
 MODULE_PARM_DESC(hw_queue_depth, "Queue depth for each hardware queue. Default: 64");
-static bool use_per_node_hctx = true;
+static bool use_per_node_hctx = false;
 module_param(use_per_node_hctx, bool, S_IRUGO);
-MODULE_PARM_DESC(use_per_node_hctx, "Use per-node allocation for hardware context queues. Default: true");
+MODULE_PARM_DESC(use_per_node_hctx, "Use per-node allocation for hardware context queues. Default: false");
 static void put_tag(struct nullb_queue *nq, unsigned int tag)
 {
@@ -346,8 +347,37 @@ static int null_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *rq)
 static struct blk_mq_hw_ctx *null_alloc_hctx(struct blk_mq_reg *reg, unsigned int hctx_index)
 {
-        return kzalloc_node(sizeof(struct blk_mq_hw_ctx), GFP_KERNEL,
+        int b_size = DIV_ROUND_UP(reg->nr_hw_queues, nr_online_nodes);
-                                hctx_index);
+        int tip = (reg->nr_hw_queues % nr_online_nodes);
+        int node = 0, i, n;
+        /*
+         * Split submit queues evenly wrt to the number of nodes. If uneven,
+         * fill the first buckets with one extra, until the rest is filled with
+         * no extra.
+         */
+        for (i = 0, n = 1; i < hctx_index; i++, n++) {
+                if (n % b_size == 0) {
+                        n = 0;
+                        node++;
+                        tip--;
+                        if (!tip)
+                                b_size = reg->nr_hw_queues / nr_online_nodes;
+                }
+        }
+        /*
+         * A node might not be online, therefore map the relative node id to the
+         * real node id.
+         */
+        for_each_online_node(n) {
+                if (!node)
+                        break;
+                node--;
+        }
+        return kzalloc_node(sizeof(struct blk_mq_hw_ctx), GFP_KERNEL, n);
 }
 static void null_free_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_index)
@@ -355,16 +385,24 @@ static void null_free_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_index)
        kfree(hctx);
 }
+static void null_init_queue(struct nullb *nullb, struct nullb_queue *nq)
+{
+        BUG_ON(!nullb);
+        BUG_ON(!nq);
+        init_waitqueue_head(&nq->wait);
+        nq->queue_depth = nullb->queue_depth;
+}
 static int null_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
                          unsigned int index)
 {
        struct nullb *nullb = data;
        struct nullb_queue *nq = &nullb->queues[index];
-        init_waitqueue_head(&nq->wait);
-        nq->queue_depth = nullb->queue_depth;
-        nullb->nr_queues++;
        hctx->driver_data = nq;
+        null_init_queue(nullb, nq);
+        nullb->nr_queues++;
        return 0;
 }
@@ -387,10 +425,7 @@ static void null_del_dev(struct nullb *nullb)
        list_del_init(&nullb->list);
        del_gendisk(nullb->disk);
-        if (queue_mode == NULL_Q_MQ)
+        blk_cleanup_queue(nullb->q);
-                blk_mq_free_queue(nullb->q);
-        else
-                blk_cleanup_queue(nullb->q);
        put_disk(nullb->disk);
        kfree(nullb);
 }
@@ -417,13 +452,13 @@ static int setup_commands(struct nullb_queue *nq)
        nq->cmds = kzalloc(nq->queue_depth * sizeof(*cmd), GFP_KERNEL);
        if (!nq->cmds)
-                return 1;
+                return -ENOMEM;
        tag_size = ALIGN(nq->queue_depth, BITS_PER_LONG) / BITS_PER_LONG;
        nq->tag_map = kzalloc(tag_size * sizeof(unsigned long), GFP_KERNEL);
        if (!nq->tag_map) {
                kfree(nq->cmds);
-                return 1;
+                return -ENOMEM;
        }
        for (i = 0; i < nq->queue_depth; i++) {
@@ -454,33 +489,37 @@ static void cleanup_queues(struct nullb *nullb)
 static int setup_queues(struct nullb *nullb)
 {
-        struct nullb_queue *nq;
+        nullb->queues = kzalloc(submit_queues * sizeof(struct nullb_queue),
-        int i;
+                                                                GFP_KERNEL);
-        nullb->queues = kzalloc(submit_queues * sizeof(*nq), GFP_KERNEL);
        if (!nullb->queues)
-                return 1;
+                return -ENOMEM;
        nullb->nr_queues = 0;
        nullb->queue_depth = hw_queue_depth;
-        if (queue_mode == NULL_Q_MQ)
+        return 0;
-                return 0;
+}
+static int init_driver_queues(struct nullb *nullb)
+{
+        struct nullb_queue *nq;
+        int i, ret = 0;
        for (i = 0; i < submit_queues; i++) {
                nq = &nullb->queues[i];
-                init_waitqueue_head(&nq->wait);
-                nq->queue_depth = hw_queue_depth;
+                null_init_queue(nullb, nq);
-                if (setup_commands(nq))
-                        break;
+                ret = setup_commands(nq);
+                if (ret)
+                        goto err_queue;
                nullb->nr_queues++;
        }
-        if (i == submit_queues)
+        return 0;
-                return 0;
+err_queue:
        cleanup_queues(nullb);
-        return 1;
+        return ret;
 }
 static int null_add_dev(void)
@@ -518,11 +557,13 @@ static int null_add_dev(void)
        } else if (queue_mode == NULL_Q_BIO) {
                nullb->q = blk_alloc_queue_node(GFP_KERNEL, home_node);
                blk_queue_make_request(nullb->q, null_queue_bio);
+                init_driver_queues(nullb);
        } else {
                nullb->q = blk_init_queue_node(null_request_fn, &nullb->lock, home_node);
                blk_queue_prep_rq(nullb->q, null_rq_prep_fn);
                if (nullb->q)
                        blk_queue_softirq_done(nullb->q, null_softirq_done_fn);
+                init_driver_queues(nullb);
        }
        if (!nullb->q)
@@ -534,10 +575,7 @@ static int null_add_dev(void)
        disk = nullb->disk = alloc_disk_node(1, home_node);
        if (!disk) {
 queue_fail:
-                if (queue_mode == NULL_Q_MQ)
+                blk_cleanup_queue(nullb->q);
-                        blk_mq_free_queue(nullb->q);
-                else
-                        blk_cleanup_queue(nullb->q);
                cleanup_queues(nullb);
 err:
                kfree(nullb);
@@ -579,7 +617,13 @@ static int __init null_init(void)
        }
 #endif
-        if (submit_queues > nr_cpu_ids)
+        if (queue_mode == NULL_Q_MQ && use_per_node_hctx) {
+                if (submit_queues < nr_online_nodes) {
+                        pr_warn("null_blk: submit_queues param is set to %u.",
+                                                        nr_online_nodes);
+                        submit_queues = nr_online_nodes;
+                }
+        } else if (submit_queues > nr_cpu_ids)
                submit_queues = nr_cpu_ids;
        else if (!submit_queues)
                submit_queues = 1;
diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c
index 9199c93be926..eb6e1e0e8db2 100644
--- a/drivers/block/skd_main.c
+++ b/drivers/block/skd_main.c
@@ -5269,7 +5269,7 @@ const char *skd_skdev_state_to_str(enum skd_drvr_state state)
        }
 }
-const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
+static const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
 {
        switch (state) {
        case SKD_MSG_STATE_IDLE:
@@ -5281,7 +5281,7 @@ const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
        }
 }
-const char *skd_skreq_state_to_str(enum skd_req_state state)
+static const char *skd_skreq_state_to_str(enum skd_req_state state)
 {
        switch (state) {
        case SKD_REQ_STATE_IDLE:
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 6bfc1bb318f6..dceb85f8d9a8 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -87,6 +87,7 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x0CF3, 0xE004) },
        { USB_DEVICE(0x0CF3, 0xE005) },
        { USB_DEVICE(0x0930, 0x0219) },
+        { USB_DEVICE(0x0930, 0x0220) },
        { USB_DEVICE(0x0489, 0xe057) },
        { USB_DEVICE(0x13d3, 0x3393) },
        { USB_DEVICE(0x0489, 0xe04e) },
@@ -129,6 +130,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c0ff34f2d2df..3980fd18f6ea 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -154,6 +154,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
index 8e562dc65601..e1f3337a0cf9 100644
--- a/drivers/char/tpm/tpm_ppi.c
+++ b/drivers/char/tpm/tpm_ppi.c
@@ -27,15 +27,18 @@ static char *tpm_device_name = "TPM";
 static acpi_status ppi_callback(acpi_handle handle, u32 level, void *context,
                                void **return_value)
 {
-        acpi_status status;
+        acpi_status status = AE_OK;
        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-        status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
-        if (strstr(buffer.pointer, context) != NULL) {
+        if (ACPI_SUCCESS(acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer))) {
-                *return_value = handle;
+                if (strstr(buffer.pointer, context) != NULL) {
+                        *return_value = handle;
+                        status = AE_CTRL_TERMINATE;
+                }
                kfree(buffer.pointer);
-                return AE_CTRL_TERMINATE;
        }
-        return AE_OK;
+        return status;
 }
 static inline void ppi_assign_params(union acpi_object params[4],
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index 8d3009e44fba..5543b7df8e16 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -87,7 +87,7 @@ static unsigned int _get_table_val(const struct clk_div_table *table,
        return 0;
 }
-static unsigned int _get_val(struct clk_divider *divider, u8 div)
+static unsigned int _get_val(struct clk_divider *divider, unsigned int div)
 {
        if (divider->flags & CLK_DIVIDER_ONE_BASED)
                return div;
diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 7be41e676a64..00a3abe103a5 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -60,7 +60,7 @@ static int s2mps11_clk_prepare(struct clk_hw *hw)
        struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
        int ret;
-        ret = regmap_update_bits(s2mps11->iodev->regmap,
+        ret = regmap_update_bits(s2mps11->iodev->regmap_pmic,
                                S2MPS11_REG_RTC_CTRL,
                                 s2mps11->mask, s2mps11->mask);
        if (!ret)
@@ -74,7 +74,7 @@ static void s2mps11_clk_unprepare(struct clk_hw *hw)
        struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
        int ret;
-        ret = regmap_update_bits(s2mps11->iodev->regmap, S2MPS11_REG_RTC_CTRL,
+        ret = regmap_update_bits(s2mps11->iodev->regmap_pmic, S2MPS11_REG_RTC_CTRL,
                           s2mps11->mask, ~s2mps11->mask);
        if (!ret)
@@ -174,7 +174,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
                s2mps11_clk->hw.init = &s2mps11_clks_init[i];
                s2mps11_clk->mask = 1 << i;
-                ret = regmap_read(s2mps11_clk->iodev->regmap,
+                ret = regmap_read(s2mps11_clk->iodev->regmap_pmic,
                                  S2MPS11_REG_RTC_CTRL, &val);
                if (ret < 0)
                        goto err_reg;
diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c
index 39b40aaede2b..68e515d093d8 100644
--- a/drivers/clk/samsung/clk-exynos-audss.c
+++ b/drivers/clk/samsung/clk-exynos-audss.c
@@ -26,17 +26,17 @@ static struct clk_onecell_data clk_data;
 #define ASS_CLK_DIV 0x4
 #define ASS_CLK_GATE 0x8
+/* list of all parent clock list */
+static const char *mout_audss_p[] = { "fin_pll", "fout_epll" };
+static const char *mout_i2s_p[] = { "mout_audss", "cdclk0", "sclk_audio0" };
+#ifdef CONFIG_PM_SLEEP
 static unsigned long reg_save[][2] = {
        {ASS_CLK_SRC,  0},
        {ASS_CLK_DIV,  0},
        {ASS_CLK_GATE, 0},
 };
-/* list of all parent clock list */
-static const char *mout_audss_p[] = { "fin_pll", "fout_epll" };
-static const char *mout_i2s_p[] = { "mout_audss", "cdclk0", "sclk_audio0" };
-#ifdef CONFIG_PM_SLEEP
 static int exynos_audss_clk_suspend(void)
 {
        int i;
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index ad5ff50c5f28..1a7c1b929c69 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -39,7 +39,7 @@
 #define SRC_TOP1                0xc214
 #define SRC_CAM                 0xc220
 #define SRC_TV                  0xc224
-#define SRC_MFC                 0xcc28
+#define SRC_MFC                 0xc228
 #define SRC_G3D                 0xc22c
 #define E4210_SRC_IMAGE         0xc230
 #define SRC_LCD0                0xc234
diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c
index adf32343c9f9..e52359cf9b6f 100644
--- a/drivers/clk/samsung/clk-exynos5250.c
+++ b/drivers/clk/samsung/clk-exynos5250.c
@@ -25,6 +25,7 @@
 #define MPLL_LOCK               0x4000
 #define MPLL_CON0               0x4100
 #define SRC_CORE1               0x4204
+#define GATE_IP_ACP             0x8800
 #define CPLL_LOCK               0x10020
 #define EPLL_LOCK               0x10030
 #define VPLL_LOCK               0x10040
@@ -75,7 +76,6 @@
 #define SRC_CDREX               0x20200
 #define PLL_DIV2_SEL            0x20a24
 #define GATE_IP_DISP1           0x10928
-#define GATE_IP_ACP             0x10000
 /* list of PLLs to be registered */
 enum exynos5250_plls {
@@ -120,7 +120,8 @@ enum exynos5250_clks {
        spi2, i2s1, i2s2, pcm1, pcm2, pwm, spdif, ac97, hsi2c0, hsi2c1, hsi2c2,
        hsi2c3, chipid, sysreg, pmu, cmu_top, cmu_core, cmu_mem, tzpc0, tzpc1,
        tzpc2, tzpc3, tzpc4, tzpc5, tzpc6, tzpc7, tzpc8, tzpc9, hdmi_cec, mct,
-        wdt, rtc, tmu, fimd1, mie1, dsim0, dp, mixer, hdmi, g2d,
+        wdt, rtc, tmu, fimd1, mie1, dsim0, dp, mixer, hdmi, g2d, mdma0,
+        smmu_mdma0,
        /* mux clocks */
        mout_hdmi = 1024,
@@ -354,8 +355,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(smmu_gscl2, "smmu_gscl2", "aclk266", GATE_IP_GSCL, 9, 0, 0),
        GATE(smmu_gscl3, "smmu_gscl3", "aclk266", GATE_IP_GSCL, 10, 0, 0),
        GATE(mfc, "mfc", "aclk333", GATE_IP_MFC, 0, 0, 0),
-        GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 1, 0, 0),
+        GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 2, 0, 0),
-        GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 2, 0, 0),
+        GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 1, 0, 0),
        GATE(rotator, "rotator", "aclk266", GATE_IP_GEN, 1, 0, 0),
        GATE(jpeg, "jpeg", "aclk166", GATE_IP_GEN, 2, 0, 0),
        GATE(mdma1, "mdma1", "aclk266", GATE_IP_GEN, 4, 0, 0),
@@ -406,7 +407,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(hsi2c2, "hsi2c2", "aclk66", GATE_IP_PERIC, 30, 0, 0),
        GATE(hsi2c3, "hsi2c3", "aclk66", GATE_IP_PERIC, 31, 0, 0),
        GATE(chipid, "chipid", "aclk66", GATE_IP_PERIS, 0, 0, 0),
-        GATE(sysreg, "sysreg", "aclk66", GATE_IP_PERIS, 1, 0, 0),
+        GATE(sysreg, "sysreg", "aclk66",
+                        GATE_IP_PERIS, 1, CLK_IGNORE_UNUSED, 0),
        GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, CLK_IGNORE_UNUSED, 0),
        GATE(tzpc0, "tzpc0", "aclk66", GATE_IP_PERIS, 6, 0, 0),
        GATE(tzpc1, "tzpc1", "aclk66", GATE_IP_PERIS, 7, 0, 0),
@@ -492,6 +494,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(mixer, "mixer", "mout_aclk200_disp1", GATE_IP_DISP1, 5, 0, 0),
        GATE(hdmi, "hdmi", "mout_aclk200_disp1", GATE_IP_DISP1, 6, 0, 0),
        GATE(g2d, "g2d", "aclk200", GATE_IP_ACP, 3, 0, 0),
+        GATE(mdma0, "mdma0", "aclk266", GATE_IP_ACP, 1, 0, 0),
+        GATE(smmu_mdma0, "smmu_mdma0", "aclk266", GATE_IP_ACP, 5, 0, 0),
 };
 static struct samsung_pll_rate_table vpll_24mhz_tbl[] __initdata = {
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 5c07a56962db..634c4d6dd45a 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -75,6 +75,7 @@ config CLKSRC_DBX500_PRCMU_SCHED_CLOCK
 config CLKSRC_EFM32
        bool "Clocksource for Energy Micro's EFM32 SoCs" if !ARCH_EFM32
        depends on OF && ARM && (ARCH_EFM32 || COMPILE_TEST)
+        select CLKSRC_MMIO
        default ARCH_EFM32
        help
          Support to use the timers of EFM32 SoCs as clock source and clock
diff --git a/drivers/clocksource/clksrc-of.c b/drivers/clocksource/clksrc-of.c
index 35639cf4e5a2..b9ddd9e3a2f5 100644
--- a/drivers/clocksource/clksrc-of.c
+++ b/drivers/clocksource/clksrc-of.c
@@ -35,6 +35,5 @@ void __init clocksource_of_init(void)
                init_func = match->data;
                init_func(np);
-                of_node_put(np);
        }
 }
diff --git a/drivers/clocksource/dw_apb_timer_of.c b/drivers/clocksource/dw_apb_timer_of.c
index 45ba8aecc729..2a2ea2717f3a 100644
--- a/drivers/clocksource/dw_apb_timer_of.c
+++ b/drivers/clocksource/dw_apb_timer_of.c
@@ -108,12 +108,11 @@ static void __init add_clocksource(struct device_node *source_timer)
 static u64 read_sched_clock(void)
 {
-        return __raw_readl(sched_io_base);
+        return ~__raw_readl(sched_io_base);
 }
 static const struct of_device_id sptimer_ids[] __initconst = {
        { .compatible = "picochip,pc3x2-rtc" },
-        { .compatible = "snps,dw-apb-timer-sp" },
        { /* Sentinel */ },
 };
@@ -151,4 +150,6 @@ static void __init dw_apb_timer_init(struct device_node *timer)
        num_called++;
 }
 CLOCKSOURCE_OF_DECLARE(pc3x2_timer, "picochip,pc3x2-timer", dw_apb_timer_init);
-CLOCKSOURCE_OF_DECLARE(apb_timer, "snps,dw-apb-timer-osc", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer_osc, "snps,dw-apb-timer-osc", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer_sp, "snps,dw-apb-timer-sp", dw_apb_timer_init);
+CLOCKSOURCE_OF_DECLARE(apb_timer, "snps,dw-apb-timer", dw_apb_timer_init);
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index 2fb4695a28d8..a4f6119aafd8 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -179,6 +179,9 @@ static void __init sun4i_timer_init(struct device_node *node)
        writel(TIMER_CTL_CLK_SRC(TIMER_CTL_CLK_SRC_OSC24M),
               timer_base + TIMER_CTL_REG(0));
+        /* Make sure timer is stopped before playing with interrupts */
+        sun4i_clkevt_time_stop(0);
        ret = setup_irq(irq, &sun4i_timer_irq);
        if (ret)
                pr_warn("failed to setup irq %d\n", irq);
diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
index d8e47e502785..4e7f6802e840 100644
--- a/drivers/clocksource/time-armada-370-xp.c
+++ b/drivers/clocksource/time-armada-370-xp.c
@@ -256,11 +256,6 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
        ticks_per_jiffy = (timer_clk + HZ / 2) / HZ;
        /*
-         * Set scale and timer for sched_clock.
-         */
-        sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
-        /*
         * Setup free-running clocksource timer (interrupts
         * disabled).
         */
@@ -270,6 +265,11 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
        timer_ctrl_clrset(0, TIMER0_EN | TIMER0_RELOAD_EN |
                             TIMER0_DIV(TIMER_DIVIDER_SHIFT));
+        /*
+         * Set scale and timer for sched_clock.
+         */
+        sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
        clocksource_mmio_init(timer_base + TIMER0_VAL_OFF,
                              "armada_370_xp_clocksource",
                              timer_clk, 300, 32, clocksource_mmio_readl_down);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 02d534da22dd..8d19f7c06010 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -828,14 +828,17 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
        int ret = 0;
        memcpy(&new_policy, policy, sizeof(*policy));
+        /* Use the default policy if its valid. */
+        if (cpufreq_driver->setpolicy)
+                cpufreq_parse_governor(policy->governor->name,
+                                        &new_policy.policy, NULL);
        /* assure that the starting sequence is run in cpufreq_set_policy */
        policy->governor = NULL;
        /* set default policy */
        ret = cpufreq_set_policy(policy, &new_policy);
-        policy->user_policy.policy = policy->policy;
-        policy->user_policy.governor = policy->governor;
        if (ret) {
                pr_debug("setting policy failed\n");
                if (cpufreq_driver->exit)
@@ -845,8 +848,7 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
 #ifdef CONFIG_HOTPLUG_CPU
 static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
-                                  unsigned int cpu, struct device *dev,
+                                  unsigned int cpu, struct device *dev)
-                                  bool frozen)
 {
        int ret = 0;
        unsigned long flags;
@@ -877,11 +879,7 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
                }
        }
-        /* Don't touch sysfs links during light-weight init */
+        return sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
-        if (!frozen)
-                ret = sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
-        return ret;
 }
 #endif
@@ -926,6 +924,27 @@ err_free_policy:
        return NULL;
 }
+static void cpufreq_policy_put_kobj(struct cpufreq_policy *policy)
+{
+        struct kobject *kobj;
+        struct completion *cmp;
+        down_read(&policy->rwsem);
+        kobj = &policy->kobj;
+        cmp = &policy->kobj_unregister;
+        up_read(&policy->rwsem);
+        kobject_put(kobj);
+        /*
+         * We need to make sure that the underlying kobj is
+         * actually not referenced anymore by anybody before we
+         * proceed with unloading.
+         */
+        pr_debug("waiting for dropping of refcount\n");
+        wait_for_completion(cmp);
+        pr_debug("wait complete\n");
+}
 static void cpufreq_policy_free(struct cpufreq_policy *policy)
 {
        free_cpumask_var(policy->related_cpus);
@@ -986,7 +1005,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
        list_for_each_entry(tpolicy, &cpufreq_policy_list, policy_list) {
                if (cpumask_test_cpu(cpu, tpolicy->related_cpus)) {
                        read_unlock_irqrestore(&cpufreq_driver_lock, flags);
-                        ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev, frozen);
+                        ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev);
                        up_read(&cpufreq_rwsem);
                        return ret;
                }
@@ -994,15 +1013,17 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
        read_unlock_irqrestore(&cpufreq_driver_lock, flags);
 #endif
-        if (frozen)
+        /*
-                /* Restore the saved policy when doing light-weight init */
+         * Restore the saved policy when doing light-weight init and fall back
-                policy = cpufreq_policy_restore(cpu);
+         * to the full init if that fails.
-        else
+         */
+        policy = frozen ? cpufreq_policy_restore(cpu) : NULL;
+        if (!policy) {
+                frozen = false;
                policy = cpufreq_policy_alloc();
+                if (!policy)
-        if (!policy)
+                        goto nomem_out;
-                goto nomem_out;
+        }
        /*
         * In the resume path, since we restore a saved policy, the assignment
@@ -1047,8 +1068,10 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
         */
        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
-        policy->user_policy.min = policy->min;
+        if (!frozen) {
-        policy->user_policy.max = policy->max;
+                policy->user_policy.min = policy->min;
+                policy->user_policy.max = policy->max;
+        }
        blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
                                     CPUFREQ_START, policy);
@@ -1079,6 +1102,11 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
        cpufreq_init_policy(policy);
+        if (!frozen) {
+                policy->user_policy.policy = policy->policy;
+                policy->user_policy.governor = policy->governor;
+        }
        kobject_uevent(&policy->kobj, KOBJ_ADD);
        up_read(&cpufreq_rwsem);
@@ -1096,7 +1124,13 @@ err_get_freq:
        if (cpufreq_driver->exit)
                cpufreq_driver->exit(policy);
 err_set_policy_cpu:
+        if (frozen) {
+                /* Do not leave stale fallback data behind. */
+                per_cpu(cpufreq_cpu_data_fallback, cpu) = NULL;
+                cpufreq_policy_put_kobj(policy);
+        }
        cpufreq_policy_free(policy);
 nomem_out:
        up_read(&cpufreq_rwsem);
@@ -1118,7 +1152,7 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
 }
 static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
-                                           unsigned int old_cpu, bool frozen)
+                                           unsigned int old_cpu)
 {
        struct device *cpu_dev;
        int ret;
@@ -1126,10 +1160,6 @@ static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
        /* first sibling now owns the new sysfs dir */
        cpu_dev = get_cpu_device(cpumask_any_but(policy->cpus, old_cpu));
-        /* Don't touch sysfs files during light-weight tear-down */
-        if (frozen)
-                return cpu_dev->id;
        sysfs_remove_link(&cpu_dev->kobj, "cpufreq");
        ret = kobject_move(&policy->kobj, &cpu_dev->kobj);
        if (ret) {
@@ -1196,7 +1226,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
                if (!frozen)
                        sysfs_remove_link(&dev->kobj, "cpufreq");
        } else if (cpus > 1) {
-                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu, frozen);
+                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu);
                if (new_cpu >= 0) {
                        update_policy_cpu(policy, new_cpu);
@@ -1218,8 +1248,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
        int ret;
        unsigned long flags;
        struct cpufreq_policy *policy;
-        struct kobject *kobj;
-        struct completion *cmp;
        read_lock_irqsave(&cpufreq_driver_lock, flags);
        policy = per_cpu(cpufreq_cpu_data, cpu);
@@ -1249,22 +1277,8 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
                        }
                }
-                if (!frozen) {
+                if (!frozen)
-                        down_read(&policy->rwsem);
+                        cpufreq_policy_put_kobj(policy);
-                        kobj = &policy->kobj;
-                        cmp = &policy->kobj_unregister;
-                        up_read(&policy->rwsem);
-                        kobject_put(kobj);
-                        /*
-                         * We need to make sure that the underlying kobj is
-                         * actually not referenced anymore by anybody before we
-                         * proceed with unloading.
-                         */
-                        pr_debug("waiting for dropping of refcount\n");
-                        wait_for_completion(cmp);
-                        pr_debug("wait complete\n");
-                }
                /*
                 * Perform the ->exit() even during light-weight tear-down,
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 5f1cbae36961..d51f17ed691e 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -581,7 +581,8 @@ static void intel_pstate_timer_func(unsigned long __data)
 }
 #define ICPU(model, policy) \
-        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)&policy }
+        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_APERFMPERF,\
+                        (unsigned long)&policy }
 static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
        ICPU(0x2a, core_params),
@@ -614,6 +615,11 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
        cpu = all_cpu_data[cpunum];
        intel_pstate_get_cpu_pstates(cpu);
+        if (!cpu->pstate.current_pstate) {
+                all_cpu_data[cpunum] = NULL;
+                kfree(cpu);
+                return -ENODATA;
+        }
        cpu->cpu = cpunum;
diff --git a/drivers/cpuidle/cpuidle-calxeda.c b/drivers/cpuidle/cpuidle-calxeda.c
index 36795639df0d..6e51114057d0 100644
--- a/drivers/cpuidle/cpuidle-calxeda.c
+++ b/drivers/cpuidle/cpuidle-calxeda.c
@@ -65,7 +65,7 @@ static struct cpuidle_driver calxeda_idle_driver = {
        .state_count = 2,
 };
-static int __init calxeda_cpuidle_probe(struct platform_device *pdev)
+static int calxeda_cpuidle_probe(struct platform_device *pdev)
 {
        return cpuidle_register(&calxeda_idle_driver, NULL);
 }
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 9dd6e01eac33..f757a0f428bd 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1410,14 +1410,12 @@ static const struct platform_device_info ixp_dev_info __initdata = {
 static int __init ixp_module_init(void)
 {
        int num = ARRAY_SIZE(ixp4xx_algos);
-        int i, err ;
+        int i, err;
        pdev = platform_device_register_full(&ixp_dev_info);
        if (IS_ERR(pdev))
                return PTR_ERR(pdev);
-        dev = &pdev->dev;
        spin_lock_init(&desc_lock);
        spin_lock_init(&emerg_lock);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 446687cc2334..c823daaf9043 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -62,6 +62,7 @@ config INTEL_IOATDMA
        tristate "Intel I/OAT DMA support"
        depends on PCI && X86
        select DMA_ENGINE
+        select DMA_ENGINE_RAID
        select DCA
        help
          Enable support for the Intel(R) I/OAT DMA engine present
@@ -112,6 +113,7 @@ config MV_XOR
        bool "Marvell XOR engine support"
        depends on PLAT_ORION
        select DMA_ENGINE
+        select DMA_ENGINE_RAID
        select ASYNC_TX_ENABLE_CHANNEL_SWITCH
        ---help---
          Enable support for the Marvell XOR engine.
@@ -187,6 +189,7 @@ config AMCC_PPC440SPE_ADMA
        tristate "AMCC PPC440SPe ADMA support"
        depends on 440SPe || 440SP
        select DMA_ENGINE
+        select DMA_ENGINE_RAID
        select ARCH_HAS_ASYNC_TX_FIND_CHANNEL
        select ASYNC_TX_ENABLE_CHANNEL_SWITCH
        help
@@ -352,6 +355,7 @@ config NET_DMA
        bool "Network: TCP receive copy offload"
        depends on DMA_ENGINE && NET
        default (INTEL_IOATDMA || FSL_DMA)
+        depends on BROKEN
        help
          This enables the use of DMA engines in the network stack to
          offload receive copy-to-user operations, freeing CPU cycles.
@@ -377,4 +381,7 @@ config DMATEST
          Simple DMA test client. Say N unless you're debugging a
          DMA Device driver.
+config DMA_ENGINE_RAID
+        bool
 endif
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index f31d647acdfa..2787aba60c6b 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -347,10 +347,6 @@ static struct device *chan2dev(struct dma_chan *chan)
 {
        return &chan->dev->device;
 }
-static struct device *chan2parent(struct dma_chan *chan)
-{
-        return chan->dev->device.parent;
-}
 #if defined(VERBOSE_DEBUG)
 static void vdbg_dump_regs(struct at_dma_chan *atchan)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index ea806bdc12ef..ef63b9058f3c 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -912,7 +912,7 @@ struct dmaengine_unmap_pool {
 #define __UNMAP_POOL(x) { .size = x, .name = "dmaengine-unmap-" __stringify(x) }
 static struct dmaengine_unmap_pool unmap_pool[] = {
        __UNMAP_POOL(2),
-        #if IS_ENABLED(CONFIG_ASYNC_TX_DMA)
+        #if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
        __UNMAP_POOL(16),
        __UNMAP_POOL(128),
        __UNMAP_POOL(256),
@@ -1054,7 +1054,7 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
        dma_cookie_t cookie;
        unsigned long flags;
-        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOIO);
+        unmap = dmaengine_get_unmap_data(dev->dev, 2, GFP_NOWAIT);
        if (!unmap)
                return -ENOMEM;
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 20f9a3aaf926..9dfcaf5c1288 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -539,9 +539,9 @@ static int dmatest_func(void *data)
                um->len = params->buf_size;
                for (i = 0; i < src_cnt; i++) {
-                        unsigned long buf = (unsigned long) thread->srcs[i];
+                        void *buf = thread->srcs[i];
                        struct page *pg = virt_to_page(buf);
-                        unsigned pg_off = buf & ~PAGE_MASK;
+                        unsigned pg_off = (unsigned long) buf & ~PAGE_MASK;
                        um->addr[i] = dma_map_page(dev->dev, pg, pg_off,
                                                   um->len, DMA_TO_DEVICE);
@@ -559,9 +559,9 @@ static int dmatest_func(void *data)
                /* map with DMA_BIDIRECTIONAL to force writeback/invalidate */
                dsts = &um->addr[src_cnt];
                for (i = 0; i < dst_cnt; i++) {
-                        unsigned long buf = (unsigned long) thread->dsts[i];
+                        void *buf = thread->dsts[i];
                        struct page *pg = virt_to_page(buf);
-                        unsigned pg_off = buf & ~PAGE_MASK;
+                        unsigned pg_off = (unsigned long) buf & ~PAGE_MASK;
                        dsts[i] = dma_map_page(dev->dev, pg, pg_off, um->len,
                                               DMA_BIDIRECTIONAL);
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 7086a16a55f2..f157c6f76b32 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -86,11 +86,6 @@ static void set_desc_cnt(struct fsldma_chan *chan,
        hw->count = CPU_TO_DMA(chan, count, 32);
 }
-static u32 get_desc_cnt(struct fsldma_chan *chan, struct fsl_desc_sw *desc)
-{
-        return DMA_TO_CPU(chan, desc->hw.count, 32);
-}
 static void set_desc_src(struct fsldma_chan *chan,
                         struct fsl_dma_ld_hw *hw, dma_addr_t src)
 {
@@ -101,16 +96,6 @@ static void set_desc_src(struct fsldma_chan *chan,
        hw->src_addr = CPU_TO_DMA(chan, snoop_bits | src, 64);
 }
-static dma_addr_t get_desc_src(struct fsldma_chan *chan,
-                               struct fsl_desc_sw *desc)
-{
-        u64 snoop_bits;
-        snoop_bits = ((chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
-                ? ((u64)FSL_DMA_SATR_SREADTYPE_SNOOP_READ << 32) : 0;
-        return DMA_TO_CPU(chan, desc->hw.src_addr, 64) & ~snoop_bits;
-}
 static void set_desc_dst(struct fsldma_chan *chan,
                         struct fsl_dma_ld_hw *hw, dma_addr_t dst)
 {
@@ -121,16 +106,6 @@ static void set_desc_dst(struct fsldma_chan *chan,
        hw->dst_addr = CPU_TO_DMA(chan, snoop_bits | dst, 64);
 }
-static dma_addr_t get_desc_dst(struct fsldma_chan *chan,
-                               struct fsl_desc_sw *desc)
-{
-        u64 snoop_bits;
-        snoop_bits = ((chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_85XX)
-                ? ((u64)FSL_DMA_DATR_DWRITETYPE_SNOOP_WRITE << 32) : 0;
-        return DMA_TO_CPU(chan, desc->hw.dst_addr, 64) & ~snoop_bits;
-}
 static void set_desc_next(struct fsldma_chan *chan,
                          struct fsl_dma_ld_hw *hw, dma_addr_t next)
 {
@@ -408,7 +383,7 @@ static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
        struct fsl_desc_sw *desc = tx_to_fsl_desc(tx);
        struct fsl_desc_sw *child;
        unsigned long flags;
-        dma_cookie_t cookie;
+        dma_cookie_t cookie = -EINVAL;
        spin_lock_irqsave(&chan->desc_lock, flags);
@@ -854,10 +829,6 @@ static void fsldma_cleanup_descriptor(struct fsldma_chan *chan,
                                      struct fsl_desc_sw *desc)
 {
        struct dma_async_tx_descriptor *txd = &desc->async_tx;
-        struct device *dev = chan->common.device->dev;
-        dma_addr_t src = get_desc_src(chan, desc);
-        dma_addr_t dst = get_desc_dst(chan, desc);
-        u32 len = get_desc_cnt(chan, desc);
        /* Run the link descriptor callback function */
        if (txd->callback) {
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 1a49c777607c..87529181efcc 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -817,7 +817,15 @@ int ioat_dma_self_test(struct ioatdma_device *device)
        }
        dma_src = dma_map_single(dev, src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
+        if (dma_mapping_error(dev, dma_src)) {
+                dev_err(dev, "mapping src buffer failed\n");
+                goto free_resources;
+        }
        dma_dest = dma_map_single(dev, dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
+        if (dma_mapping_error(dev, dma_dest)) {
+                dev_err(dev, "mapping dest buffer failed\n");
+                goto unmap_src;
+        }
        flags = DMA_PREP_INTERRUPT;
        tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
                                                   IOAT_TEST_SIZE, flags);
@@ -855,8 +863,9 @@ int ioat_dma_self_test(struct ioatdma_device *device)
        }
 unmap_dma:
-        dma_unmap_single(dev, dma_src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
        dma_unmap_single(dev, dma_dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
+unmap_src:
+        dma_unmap_single(dev, dma_src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
 free_resources:
        dma->device_free_chan_resources(dma_chan);
 out:
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 7807f0ef4e20..53fb0c8365b0 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -54,12 +54,6 @@ static void mv_desc_init(struct mv_xor_desc_slot *desc, unsigned long flags)
        hw_desc->desc_command = (1 << 31);
 }
-static u32 mv_desc_get_dest_addr(struct mv_xor_desc_slot *desc)
-{
-        struct mv_xor_desc *hw_desc = desc->hw_desc;
-        return hw_desc->phy_dest_addr;
-}
 static void mv_desc_set_byte_count(struct mv_xor_desc_slot *desc,
                                   u32 byte_count)
 {
@@ -787,7 +781,6 @@ static void mv_xor_issue_pending(struct dma_chan *chan)
 /*
 * Perform a transaction to verify the HW works.
 */
-#define MV_XOR_TEST_SIZE 2000
 static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
 {
@@ -797,20 +790,21 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
        struct dma_chan *dma_chan;
        dma_cookie_t cookie;
        struct dma_async_tx_descriptor *tx;
+        struct dmaengine_unmap_data *unmap;
        int err = 0;
-        src = kmalloc(sizeof(u8) * MV_XOR_TEST_SIZE, GFP_KERNEL);
+        src = kmalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
        if (!src)
                return -ENOMEM;
-        dest = kzalloc(sizeof(u8) * MV_XOR_TEST_SIZE, GFP_KERNEL);
+        dest = kzalloc(sizeof(u8) * PAGE_SIZE, GFP_KERNEL);
        if (!dest) {
                kfree(src);
                return -ENOMEM;
        }
        /* Fill in src buffer */
-        for (i = 0; i < MV_XOR_TEST_SIZE; i++)
+        for (i = 0; i < PAGE_SIZE; i++)
                ((u8 *) src)[i] = (u8)i;
        dma_chan = &mv_chan->dmachan;
@@ -819,14 +813,26 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
                goto out;
        }
-        dest_dma = dma_map_single(dma_chan->device->dev, dest,
+        unmap = dmaengine_get_unmap_data(dma_chan->device->dev, 2, GFP_KERNEL);
-                                  MV_XOR_TEST_SIZE, DMA_FROM_DEVICE);
+        if (!unmap) {
+                err = -ENOMEM;
+                goto free_resources;
+        }
+        src_dma = dma_map_page(dma_chan->device->dev, virt_to_page(src), 0,
+                                 PAGE_SIZE, DMA_TO_DEVICE);
+        unmap->to_cnt = 1;
+        unmap->addr[0] = src_dma;
-        src_dma = dma_map_single(dma_chan->device->dev, src,
+        dest_dma = dma_map_page(dma_chan->device->dev, virt_to_page(dest), 0,
-                                 MV_XOR_TEST_SIZE, DMA_TO_DEVICE);
+                                  PAGE_SIZE, DMA_FROM_DEVICE);
+        unmap->from_cnt = 1;
+        unmap->addr[1] = dest_dma;
+        unmap->len = PAGE_SIZE;
        tx = mv_xor_prep_dma_memcpy(dma_chan, dest_dma, src_dma,
-                                    MV_XOR_TEST_SIZE, 0);
+                                    PAGE_SIZE, 0);
        cookie = mv_xor_tx_submit(tx);
        mv_xor_issue_pending(dma_chan);
        async_tx_ack(tx);
@@ -841,8 +847,8 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
        }
        dma_sync_single_for_cpu(dma_chan->device->dev, dest_dma,
-                                MV_XOR_TEST_SIZE, DMA_FROM_DEVICE);
+                                PAGE_SIZE, DMA_FROM_DEVICE);
-        if (memcmp(src, dest, MV_XOR_TEST_SIZE)) {
+        if (memcmp(src, dest, PAGE_SIZE)) {
                dev_err(dma_chan->device->dev,
                        "Self-test copy failed compare, disabling\n");
                err = -ENODEV;
@@ -850,6 +856,7 @@ static int mv_xor_memcpy_self_test(struct mv_xor_chan *mv_chan)
        }
 free_resources:
+        dmaengine_unmap_put(unmap);
        mv_xor_free_chan_resources(dma_chan);
 out:
        kfree(src);
@@ -867,13 +874,15 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
        dma_addr_t dma_srcs[MV_XOR_NUM_SRC_TEST];
        dma_addr_t dest_dma;
        struct dma_async_tx_descriptor *tx;
+        struct dmaengine_unmap_data *unmap;
        struct dma_chan *dma_chan;
        dma_cookie_t cookie;
        u8 cmp_byte = 0;
        u32 cmp_word;
        int err = 0;
+        int src_count = MV_XOR_NUM_SRC_TEST;
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
+        for (src_idx = 0; src_idx < src_count; src_idx++) {
                xor_srcs[src_idx] = alloc_page(GFP_KERNEL);
                if (!xor_srcs[src_idx]) {
                        while (src_idx--)
@@ -890,13 +899,13 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
        }
        /* Fill in src buffers */
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
+        for (src_idx = 0; src_idx < src_count; src_idx++) {
                u8 *ptr = page_address(xor_srcs[src_idx]);
                for (i = 0; i < PAGE_SIZE; i++)
                        ptr[i] = (1 << src_idx);
        }
-        for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++)
+        for (src_idx = 0; src_idx < src_count; src_idx++)
                cmp_byte ^= (u8) (1 << src_idx);
        cmp_word = (cmp_byte << 24) | (cmp_byte << 16) |
@@ -910,16 +919,29 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
                goto out;
        }
+        unmap = dmaengine_get_unmap_data(dma_chan->device->dev, src_count + 1,
+                                         GFP_KERNEL);
+        if (!unmap) {
+                err = -ENOMEM;
+                goto free_resources;
+        }
        /* test xor */
-        dest_dma = dma_map_page(dma_chan->device->dev, dest, 0, PAGE_SIZE,
+        for (i = 0; i < src_count; i++) {
-                                DMA_FROM_DEVICE);
+                unmap->addr[i] = dma_map_page(dma_chan->device->dev, xor_srcs[i],
+                                              0, PAGE_SIZE, DMA_TO_DEVICE);
+                dma_srcs[i] = unmap->addr[i];
+                unmap->to_cnt++;
+        }
-        for (i = 0; i < MV_XOR_NUM_SRC_TEST; i++)
+        unmap->addr[src_count] = dma_map_page(dma_chan->device->dev, dest, 0, PAGE_SIZE,
-                dma_srcs[i] = dma_map_page(dma_chan->device->dev, xor_srcs[i],
+                                      DMA_FROM_DEVICE);
-                                           0, PAGE_SIZE, DMA_TO_DEVICE);
+        dest_dma = unmap->addr[src_count];
+        unmap->from_cnt = 1;
+        unmap->len = PAGE_SIZE;
        tx = mv_xor_prep_dma_xor(dma_chan, dest_dma, dma_srcs,
-                                 MV_XOR_NUM_SRC_TEST, PAGE_SIZE, 0);
+                                 src_count, PAGE_SIZE, 0);
        cookie = mv_xor_tx_submit(tx);
        mv_xor_issue_pending(dma_chan);
@@ -948,9 +970,10 @@ mv_xor_xor_self_test(struct mv_xor_chan *mv_chan)
        }
 free_resources:
+        dmaengine_unmap_put(unmap);
        mv_xor_free_chan_resources(dma_chan);
 out:
-        src_idx = MV_XOR_NUM_SRC_TEST;
+        src_idx = src_count;
        while (src_idx--)
                __free_page(xor_srcs[src_idx]);
        __free_page(dest);
@@ -1176,6 +1199,7 @@ static int mv_xor_probe(struct platform_device *pdev)
                int i = 0;
                for_each_child_of_node(pdev->dev.of_node, np) {
+                        struct mv_xor_chan *chan;
                        dma_cap_mask_t cap_mask;
                        int irq;
@@ -1193,21 +1217,21 @@ static int mv_xor_probe(struct platform_device *pdev)
                                goto err_channel_add;
                        }
-                        xordev->channels[i] =
+                        chan = mv_xor_channel_add(xordev, pdev, i,
-                                mv_xor_channel_add(xordev, pdev, i,
+                                                  cap_mask, irq);
-                                                   cap_mask, irq);
+                        if (IS_ERR(chan)) {
-                        if (IS_ERR(xordev->channels[i])) {
+                                ret = PTR_ERR(chan);
-                                ret = PTR_ERR(xordev->channels[i]);
-                                xordev->channels[i] = NULL;
                                irq_dispose_mapping(irq);
                                goto err_channel_add;
                        }
+                        xordev->channels[i] = chan;
                        i++;
                }
        } else if (pdata && pdata->channels) {
                for (i = 0; i < MV_XOR_MAX_CHANNELS; i++) {
                        struct mv_xor_channel_data *cd;
+                        struct mv_xor_chan *chan;
                        int irq;
                        cd = &pdata->channels[i];
@@ -1222,13 +1246,14 @@ static int mv_xor_probe(struct platform_device *pdev)
                                goto err_channel_add;
                        }
-                        xordev->channels[i] =
+                        chan = mv_xor_channel_add(xordev, pdev, i,
-                                mv_xor_channel_add(xordev, pdev, i,
+                                                  cd->cap_mask, irq);
-                                                   cd->cap_mask, irq);
+                        if (IS_ERR(chan)) {
-                        if (IS_ERR(xordev->channels[i])) {
+                                ret = PTR_ERR(chan);
-                                ret = PTR_ERR(xordev->channels[i]);
                                goto err_channel_add;
                        }
+                        xordev->channels[i] = chan;
                }
        }
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index cdf0483b8f2d..536632f6479c 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2492,12 +2492,9 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
 static inline void _init_desc(struct dma_pl330_desc *desc)
 {
-        desc->pchan = NULL;
        desc->req.x = &desc->px;
        desc->req.token = desc;
        desc->rqcfg.swap = SWAP_NO;
-        desc->rqcfg.privileged = 0;
-        desc->rqcfg.insnaccess = 0;
        desc->rqcfg.scctl = SCCTRL0;
        desc->rqcfg.dcctl = DCCTRL0;
        desc->req.cfg = &desc->rqcfg;
@@ -2517,7 +2514,7 @@ static int add_desc(struct dma_pl330_dmac *pdmac, gfp_t flg, int count)
        if (!pdmac)
                return 0;
-        desc = kmalloc(count * sizeof(*desc), flg);
+        desc = kcalloc(count, sizeof(*desc), flg);
        if (!desc)
                return 0;
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index 8da48c6b2a38..8bba298535b0 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -533,29 +533,6 @@ static void ppc440spe_desc_init_memcpy(struct ppc440spe_adma_desc_slot *desc,
 }
 /**
- * ppc440spe_desc_init_memset - initialize the descriptor for MEMSET operation
- */
-static void ppc440spe_desc_init_memset(struct ppc440spe_adma_desc_slot *desc,
-                                        int value, unsigned long flags)
-{
-        struct dma_cdb *hw_desc = desc->hw_desc;
-        memset(desc->hw_desc, 0, sizeof(struct dma_cdb));
-        desc->hw_next = NULL;
-        desc->src_cnt = 1;
-        desc->dst_cnt = 1;
-        if (flags & DMA_PREP_INTERRUPT)
-                set_bit(PPC440SPE_DESC_INT, &desc->flags);
-        else
-                clear_bit(PPC440SPE_DESC_INT, &desc->flags);
-        hw_desc->sg1u = hw_desc->sg1l = cpu_to_le32((u32)value);
-        hw_desc->sg3u = hw_desc->sg3l = cpu_to_le32((u32)value);
-        hw_desc->opc = DMA_CDB_OPC_DFILL128;
-}
-/**
 * ppc440spe_desc_set_src_addr - set source address into the descriptor
 */
 static void ppc440spe_desc_set_src_addr(struct ppc440spe_adma_desc_slot *desc,
@@ -1504,8 +1481,6 @@ static dma_cookie_t ppc440spe_adma_run_tx_complete_actions(
                struct ppc440spe_adma_chan *chan,
                dma_cookie_t cookie)
 {
-        int i;
        BUG_ON(desc->async_tx.cookie < 0);
        if (desc->async_tx.cookie > 0) {
                cookie = desc->async_tx.cookie;
@@ -3898,7 +3873,7 @@ static void ppc440spe_adma_init_capabilities(struct ppc440spe_adma_device *adev)
                        ppc440spe_adma_prep_dma_interrupt;
        }
        pr_info("%s: AMCC(R) PPC440SP(E) ADMA Engine: "
-          "( %s%s%s%s%s%s%s)\n",
+          "( %s%s%s%s%s%s)\n",
          dev_name(adev->dev),
          dma_has_cap(DMA_PQ, adev->common.cap_mask) ? "pq " : "",
          dma_has_cap(DMA_PQ_VAL, adev->common.cap_mask) ? "pq_val " : "",
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index bae6c29f5502..17686caf64d5 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -406,7 +406,6 @@ txx9dmac_descriptor_complete(struct txx9dmac_chan *dc,
        dma_async_tx_callback callback;
        void *param;
        struct dma_async_tx_descriptor *txd = &desc->txd;
-        struct txx9dmac_slave *ds = dc->chan.private;
        dev_vdbg(chan2dev(&dc->chan), "descriptor %u %p complete\n",
                 txd->cookie, desc);
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index b0bb056458a3..281029daf98c 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1623,7 +1623,6 @@ static struct scsi_host_template scsi_driver_template = {
        .cmd_per_lun            = 1,
        .can_queue              = 1,
        .sdev_attrs             = sbp2_scsi_sysfs_attrs,
-        .no_write_same          = 1,
 };
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/firmware/Makefile b/drivers/firmware/Makefile
index 299fad6b5867..5373dc5b6011 100644
--- a/drivers/firmware/Makefile
+++ b/drivers/firmware/Makefile
@@ -14,3 +14,4 @@ obj-$(CONFIG_FIRMWARE_MEMMAP)	+= memmap.o
 obj-$(CONFIG_GOOGLE_FIRMWARE)   += google/
 obj-$(CONFIG_EFI)               += efi/
+obj-$(CONFIG_UEFI_CPER)         += efi/
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index 3150aa4874e8..6aecbc86ec94 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -36,7 +36,7 @@ config EFI_VARS_PSTORE_DEFAULT_DISABLE
          backend for pstore by default. This setting can be overridden
          using the efivars module's pstore_disable parameter.
-config UEFI_CPER
-        def_bool n
 endmenu
+config UEFI_CPER
+        bool
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
index 9ba156d3c775..6c2a41ec21ba 100644
--- a/drivers/firmware/efi/Makefile
+++ b/drivers/firmware/efi/Makefile
@@ -1,7 +1,7 @@
 #
 # Makefile for linux kernel
 #
-obj-y                                   += efi.o vars.o
+obj-$(CONFIG_EFI)                       += efi.o vars.o
 obj-$(CONFIG_EFI_VARS)                  += efivars.o
 obj-$(CONFIG_EFI_VARS_PSTORE)           += efi-pstore.o
 obj-$(CONFIG_UEFI_CPER)                 += cper.o
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 743fd426f21b..4b9dc836dcf9 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -356,6 +356,7 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
 static struct pstore_info efi_pstore_info = {
        .owner          = THIS_MODULE,
        .name           = "efi",
+        .flags          = PSTORE_FLAGS_FRAGILE,
        .open           = efi_pstore_open,
        .close          = efi_pstore_close,
        .read           = efi_pstore_read,
diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
index 7b37300973db..2baf0ddf7e02 100644
--- a/drivers/gpio/gpio-msm-v2.c
+++ b/drivers/gpio/gpio-msm-v2.c
@@ -252,7 +252,7 @@ static void msm_gpio_irq_mask(struct irq_data *d)
        spin_lock_irqsave(&tlmm_lock, irq_flags);
        writel(TARGET_PROC_NONE, GPIO_INTR_CFG_SU(gpio));
-        clear_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
+        clear_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
        __clear_bit(gpio, msm_gpio.enabled_irqs);
        spin_unlock_irqrestore(&tlmm_lock, irq_flags);
 }
@@ -264,7 +264,7 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
        spin_lock_irqsave(&tlmm_lock, irq_flags);
        __set_bit(gpio, msm_gpio.enabled_irqs);
-        set_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
+        set_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
        writel(TARGET_PROC_SCORPION, GPIO_INTR_CFG_SU(gpio));
        spin_unlock_irqrestore(&tlmm_lock, irq_flags);
 }
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index fe088a30567a..8b7e719a68c3 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -169,7 +169,8 @@ static irqreturn_t gpio_rcar_irq_handler(int irq, void *dev_id)
        u32 pending;
        unsigned int offset, irqs_handled = 0;
-        while ((pending = gpio_rcar_read(p, INTDT))) {
+        while ((pending = gpio_rcar_read(p, INTDT) &
+                          gpio_rcar_read(p, INTMSK))) {
                offset = __ffs(pending);
                gpio_rcar_write(p, INTCLR, BIT(offset));
                generic_handle_irq(irq_find_mapping(p->irq_domain, offset));
diff --git a/drivers/gpio/gpio-twl4030.c b/drivers/gpio/gpio-twl4030.c
index b97d6a6577b9..f9996899c1f2 100644
--- a/drivers/gpio/gpio-twl4030.c
+++ b/drivers/gpio/gpio-twl4030.c
@@ -300,7 +300,7 @@ static int twl_direction_in(struct gpio_chip *chip, unsigned offset)
        if (offset < TWL4030_GPIO_MAX)
                ret = twl4030_set_gpio_direction(offset, 1);
        else
-                ret = -EINVAL;
+                ret = -EINVAL;  /* LED outputs can't be set as input */
        if (!ret)
                priv->direction &= ~BIT(offset);
@@ -354,11 +354,20 @@ static void twl_set(struct gpio_chip *chip, unsigned offset, int value)
 static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
 {
        struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
-        int ret = -EINVAL;
+        int ret = 0;
        mutex_lock(&priv->mutex);
-        if (offset < TWL4030_GPIO_MAX)
+        if (offset < TWL4030_GPIO_MAX) {
                ret = twl4030_set_gpio_direction(offset, 0);
+                if (ret) {
+                        mutex_unlock(&priv->mutex);
+                        return ret;
+                }
+        }
+        /*
+         *  LED gpios i.e. offset >= TWL4030_GPIO_MAX are always output
+         */
        priv->direction |= BIT(offset);
        mutex_unlock(&priv->mutex);
diff --git a/drivers/gpu/drm/armada/armada_drm.h b/drivers/gpu/drm/armada/armada_drm.h
index eef09ec9a5ff..a72cae03b99b 100644
--- a/drivers/gpu/drm/armada/armada_drm.h
+++ b/drivers/gpu/drm/armada/armada_drm.h
@@ -103,6 +103,7 @@ void armada_drm_queue_unref_work(struct drm_device *,
 extern const struct drm_mode_config_funcs armada_drm_mode_config_funcs;
 int armada_fbdev_init(struct drm_device *);
+void armada_fbdev_lastclose(struct drm_device *);
 void armada_fbdev_fini(struct drm_device *);
 int armada_overlay_plane_create(struct drm_device *, unsigned long);
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index 4f2b28354915..62d0ff3efddf 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -321,6 +321,11 @@ static struct drm_ioctl_desc armada_ioctls[] = {
                DRM_UNLOCKED),
 };
+static void armada_drm_lastclose(struct drm_device *dev)
+{
+        armada_fbdev_lastclose(dev);
+}
 static const struct file_operations armada_drm_fops = {
        .owner                  = THIS_MODULE,
        .llseek                 = no_llseek,
@@ -337,7 +342,7 @@ static struct drm_driver armada_drm_driver = {
        .open                   = NULL,
        .preclose               = NULL,
        .postclose              = NULL,
-        .lastclose              = NULL,
+        .lastclose              = armada_drm_lastclose,
        .unload                 = armada_drm_unload,
        .get_vblank_counter     = drm_vblank_count,
        .enable_vblank          = armada_drm_enable_vblank,
diff --git a/drivers/gpu/drm/armada/armada_fbdev.c b/drivers/gpu/drm/armada/armada_fbdev.c
index dd5ea77dac96..948cb14c561e 100644
--- a/drivers/gpu/drm/armada/armada_fbdev.c
+++ b/drivers/gpu/drm/armada/armada_fbdev.c
@@ -105,9 +105,9 @@ static int armada_fb_create(struct drm_fb_helper *fbh,
        drm_fb_helper_fill_fix(info, dfb->fb.pitches[0], dfb->fb.depth);
        drm_fb_helper_fill_var(info, fbh, sizes->fb_width, sizes->fb_height);
-        DRM_DEBUG_KMS("allocated %dx%d %dbpp fb: 0x%08x\n",
+        DRM_DEBUG_KMS("allocated %dx%d %dbpp fb: 0x%08llx\n",
-                dfb->fb.width, dfb->fb.height,
+                dfb->fb.width, dfb->fb.height, dfb->fb.bits_per_pixel,
-                dfb->fb.bits_per_pixel, obj->phys_addr);
+                (unsigned long long)obj->phys_addr);
        return 0;
@@ -177,6 +177,16 @@ int armada_fbdev_init(struct drm_device *dev)
        return ret;
 }
+void armada_fbdev_lastclose(struct drm_device *dev)
+{
+        struct armada_private *priv = dev->dev_private;
+        drm_modeset_lock_all(dev);
+        if (priv->fbdev)
+                drm_fb_helper_restore_fbdev_mode(priv->fbdev);
+        drm_modeset_unlock_all(dev);
+}
 void armada_fbdev_fini(struct drm_device *dev)
 {
        struct armada_private *priv = dev->dev_private;
@@ -192,11 +202,11 @@ void armada_fbdev_fini(struct drm_device *dev)
                        framebuffer_release(info);
                }
+                drm_fb_helper_fini(fbh);
                if (fbh->fb)
                        fbh->fb->funcs->destroy(fbh->fb);
-                drm_fb_helper_fini(fbh);
                priv->fbdev = NULL;
        }
 }
diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c
index 9f2356bae7fd..887816f43476 100644
--- a/drivers/gpu/drm/armada/armada_gem.c
+++ b/drivers/gpu/drm/armada/armada_gem.c
@@ -172,8 +172,9 @@ armada_gem_linear_back(struct drm_device *dev, struct armada_gem_object *obj)
                obj->dev_addr = obj->linear->start;
        }
-        DRM_DEBUG_DRIVER("obj %p phys %#x dev %#x\n",
+        DRM_DEBUG_DRIVER("obj %p phys %#llx dev %#llx\n", obj,
-                         obj, obj->phys_addr, obj->dev_addr);
+                         (unsigned long long)obj->phys_addr,
+                         (unsigned long long)obj->dev_addr);
        return 0;
 }
@@ -557,7 +558,6 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf)
                         * refcount on the gem object itself.
                         */
                        drm_gem_object_reference(obj);
-                        dma_buf_put(buf);
                        return obj;
                }
        }
@@ -573,6 +573,7 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf)
        }
        dobj->obj.import_attach = attach;
+        get_dma_buf(buf);
        /*
         * Don't call dma_buf_map_attachment() here - it maps the
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 0a1e4a5f4234..8835dcddfac3 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -68,6 +68,8 @@
 #define EDID_QUIRK_DETAILED_SYNC_PP             (1 << 6)
 /* Force reduced-blanking timings for detailed modes */
 #define EDID_QUIRK_FORCE_REDUCED_BLANKING       (1 << 7)
+/* Force 8bpc */
+#define EDID_QUIRK_FORCE_8BPC                   (1 << 8)
 struct detailed_mode_closure {
        struct drm_connector *connector;
@@ -128,6 +130,9 @@ static struct edid_quirk {
        /* Medion MD 30217 PG */
        { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+        /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
+        { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
 };
 /*
@@ -3435,6 +3440,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
        drm_add_display_info(edid, &connector->display_info);
+        if (quirks & EDID_QUIRK_FORCE_8BPC)
+                connector->display_info.bpc = 8;
        return num_modes;
 }
 EXPORT_SYMBOL(drm_add_edid_modes);
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index f53d5246979c..66dd3a001cf1 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -566,11 +566,11 @@ err_unload:
        if (dev->driver->unload)
                dev->driver->unload(dev);
 err_primary_node:
-        drm_put_minor(dev->primary);
+        drm_unplug_minor(dev->primary);
 err_render_node:
-        drm_put_minor(dev->render);
+        drm_unplug_minor(dev->render);
 err_control_node:
-        drm_put_minor(dev->control);
+        drm_unplug_minor(dev->control);
 err_agp:
        if (dev->driver->bus->agp_destroy)
                dev->driver->bus->agp_destroy(dev);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 0cab2d045135..5c648425c1e0 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -83,6 +83,14 @@ void i915_update_dri1_breadcrumb(struct drm_device *dev)
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct drm_i915_master_private *master_priv;
+        /*
+         * The dri breadcrumb update races against the drm master disappearing.
+         * Instead of trying to fix this (this is by far not the only ums issue)
+         * just don't do the update in kms mode.
+         */
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                return;
        if (dev->primary->master) {
                master_priv = dev->primary->master->driver_priv;
                if (master_priv->sarea_priv)
@@ -1490,16 +1498,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        spin_lock_init(&dev_priv->uncore.lock);
        spin_lock_init(&dev_priv->mm.object_stat_lock);
        mutex_init(&dev_priv->dpio_lock);
-        mutex_init(&dev_priv->rps.hw_lock);
        mutex_init(&dev_priv->modeset_restore_lock);
-        mutex_init(&dev_priv->pc8.lock);
+        intel_pm_setup(dev);
-        dev_priv->pc8.requirements_met = false;
-        dev_priv->pc8.gpu_idle = false;
-        dev_priv->pc8.irqs_disabled = false;
-        dev_priv->pc8.enabled = false;
-        dev_priv->pc8.disable_count = 2; /* requirements_met + gpu_idle */
-        INIT_DELAYED_WORK(&dev_priv->pc8.enable_work, hsw_enable_pc8_work);
        intel_display_crc_init(dev);
@@ -1603,7 +1604,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        }
        intel_irq_init(dev);
-        intel_pm_init(dev);
        intel_uncore_sanitize(dev);
        /* Try to make sure MCHBAR is enabled before poking at it */
@@ -1848,8 +1848,10 @@ void i915_driver_lastclose(struct drm_device * dev)
 void i915_driver_preclose(struct drm_device * dev, struct drm_file *file_priv)
 {
+        mutex_lock(&dev->struct_mutex);
        i915_gem_context_close(dev, file_priv);
        i915_gem_release(dev, file_priv);
+        mutex_unlock(&dev->struct_mutex);
 }
 void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 2e367a1c6a64..5b7b7e06cb3a 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -651,6 +651,7 @@ static int __i915_drm_thaw(struct drm_device *dev, bool restore_gtt_mappings)
                intel_modeset_init_hw(dev);
                drm_modeset_lock_all(dev);
+                drm_mode_config_reset(dev);
                intel_modeset_setup_hw_state(dev, true);
                drm_modeset_unlock_all(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index ccdbecca070d..90fcccba17b0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1755,8 +1755,13 @@ struct drm_i915_file_private {
 #define IS_MOBILE(dev)          (INTEL_INFO(dev)->is_mobile)
 #define IS_HSW_EARLY_SDV(dev)   (IS_HASWELL(dev) && \
                                 ((dev)->pdev->device & 0xFF00) == 0x0C00)
-#define IS_ULT(dev)             (IS_HASWELL(dev) && \
+#define IS_BDW_ULT(dev)         (IS_BROADWELL(dev) && \
+                                 (((dev)->pdev->device & 0xf) == 0x2  || \
+                                 ((dev)->pdev->device & 0xf) == 0x6 || \
+                                 ((dev)->pdev->device & 0xf) == 0xe))
+#define IS_HSW_ULT(dev)         (IS_HASWELL(dev) && \
                                 ((dev)->pdev->device & 0xFF00) == 0x0A00)
+#define IS_ULT(dev)             (IS_HSW_ULT(dev) || IS_BDW_ULT(dev))
 #define IS_HSW_GT3(dev)         (IS_HASWELL(dev) && \
                                 ((dev)->pdev->device & 0x00F0) == 0x0020)
 #define IS_PRELIMINARY_HW(intel_info) ((intel_info)->is_preliminary)
@@ -1901,9 +1906,7 @@ void i915_queue_hangcheck(struct drm_device *dev);
 void i915_handle_error(struct drm_device *dev, bool wedged);
 extern void intel_irq_init(struct drm_device *dev);
-extern void intel_pm_init(struct drm_device *dev);
 extern void intel_hpd_init(struct drm_device *dev);
-extern void intel_pm_init(struct drm_device *dev);
 extern void intel_uncore_sanitize(struct drm_device *dev);
 extern void intel_uncore_early_sanitize(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 621c7c67a643..76d3d1ab73c6 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2343,15 +2343,24 @@ static void i915_gem_free_request(struct drm_i915_gem_request *request)
        kfree(request);
 }
-static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
+static void i915_gem_reset_ring_status(struct drm_i915_private *dev_priv,
-                                      struct intel_ring_buffer *ring)
+                                       struct intel_ring_buffer *ring)
 {
-        u32 completed_seqno;
+        u32 completed_seqno = ring->get_seqno(ring, false);
-        u32 acthd;
+        u32 acthd = intel_ring_get_active_head(ring);
+        struct drm_i915_gem_request *request;
+        list_for_each_entry(request, &ring->request_list, list) {
+                if (i915_seqno_passed(completed_seqno, request->seqno))
+                        continue;
-        acthd = intel_ring_get_active_head(ring);
+                i915_set_reset_status(ring, request, acthd);
-        completed_seqno = ring->get_seqno(ring, false);
+        }
+}
+static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
+                                        struct intel_ring_buffer *ring)
+{
        while (!list_empty(&ring->request_list)) {
                struct drm_i915_gem_request *request;
@@ -2359,9 +2368,6 @@ static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
                                           struct drm_i915_gem_request,
                                           list);
-                if (request->seqno > completed_seqno)
-                        i915_set_reset_status(ring, request, acthd);
                i915_gem_free_request(request);
        }
@@ -2403,8 +2409,16 @@ void i915_gem_reset(struct drm_device *dev)
        struct intel_ring_buffer *ring;
        int i;
+        /*
+         * Before we free the objects from the requests, we need to inspect
+         * them for finding the guilty party. As the requests only borrow
+         * their reference to the objects, the inspection must be done first.
+         */
+        for_each_ring(ring, dev_priv, i)
+                i915_gem_reset_ring_status(dev_priv, ring);
        for_each_ring(ring, dev_priv, i)
-                i915_gem_reset_ring_lists(dev_priv, ring);
+                i915_gem_reset_ring_cleanup(dev_priv, ring);
        i915_gem_cleanup_ringbuffer(dev);
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 72a3df32292f..b0f42b9ca037 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -347,10 +347,8 @@ void i915_gem_context_close(struct drm_device *dev, struct drm_file *file)
 {
        struct drm_i915_file_private *file_priv = file->driver_priv;
-        mutex_lock(&dev->struct_mutex);
        idr_for_each(&file_priv->context_idr, context_idr_cleanup, NULL);
        idr_destroy(&file_priv->context_idr);
-        mutex_unlock(&dev->struct_mutex);
 }
 static struct i915_hw_context *
@@ -423,11 +421,21 @@ static int do_switch(struct i915_hw_context *to)
        if (ret)
                return ret;
-        /* Clear this page out of any CPU caches for coherent swap-in/out. Note
+        /*
+         * Pin can switch back to the default context if we end up calling into
+         * evict_everything - as a last ditch gtt defrag effort that also
+         * switches to the default context. Hence we need to reload from here.
+         */
+        from = ring->last_context;
+        /*
+         * Clear this page out of any CPU caches for coherent swap-in/out. Note
         * that thanks to write = false in this call and us not setting any gpu
         * write domains when putting a context object onto the active list
         * (when switching away from it), this won't block.
-         * XXX: We need a real interface to do this instead of trickery. */
+         *
+         * XXX: We need a real interface to do this instead of trickery.
+         */
        ret = i915_gem_object_set_to_gtt_domain(to->obj, false);
        if (ret) {
                i915_gem_object_unpin(to->obj);
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index b7376533633d..8f3adc7d0dc8 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -88,6 +88,7 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
        } else
                drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
+search_again:
        /* First see if there is a large enough contiguous idle region... */
        list_for_each_entry(vma, &vm->inactive_list, mm_list) {
                if (mark_free(vma, &unwind_list))
@@ -115,10 +116,17 @@ none:
                list_del_init(&vma->exec_list);
        }
-        /* We expect the caller to unpin, evict all and try again, or give up.
+        /* Can we unpin some objects such as idle hw contents,
-         * So calling i915_gem_evict_vm() is unnecessary.
+         * or pending flips?
         */
-        return -ENOSPC;
+        ret = nonblocking ? -ENOSPC : i915_gpu_idle(dev);
+        if (ret)
+                return ret;
+        /* Only idle the GPU and repeat the search once */
+        i915_gem_retire_requests(dev);
+        nonblocking = true;
+        goto search_again;
 found:
        /* drm_mm doesn't allow any other other operations while
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index b7e787fb4649..a3ba9a8cd687 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -93,7 +93,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
 {
        struct drm_i915_gem_object *obj;
        struct list_head objects;
-        int i, ret = 0;
+        int i, ret;
        INIT_LIST_HEAD(&objects);
        spin_lock(&file->table_lock);
@@ -106,7 +106,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
                        DRM_DEBUG("Invalid object handle %d at index %d\n",
                                   exec[i].handle, i);
                        ret = -ENOENT;
-                        goto out;
+                        goto err;
                }
                if (!list_empty(&obj->obj_exec_link)) {
@@ -114,7 +114,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
                        DRM_DEBUG("Object %p [handle %d, index %d] appears more than once in object list\n",
                                   obj, exec[i].handle, i);
                        ret = -EINVAL;
-                        goto out;
+                        goto err;
                }
                drm_gem_object_reference(&obj->base);
@@ -123,9 +123,13 @@ eb_lookup_vmas(struct eb_vmas *eb,
        spin_unlock(&file->table_lock);
        i = 0;
-        list_for_each_entry(obj, &objects, obj_exec_link) {
+        while (!list_empty(&objects)) {
                struct i915_vma *vma;
+                obj = list_first_entry(&objects,
+                                       struct drm_i915_gem_object,
+                                       obj_exec_link);
                /*
                 * NOTE: We can leak any vmas created here when something fails
                 * later on. But that's no issue since vma_unbind can deal with
@@ -138,10 +142,12 @@ eb_lookup_vmas(struct eb_vmas *eb,
                if (IS_ERR(vma)) {
                        DRM_DEBUG("Failed to lookup VMA\n");
                        ret = PTR_ERR(vma);
-                        goto out;
+                        goto err;
                }
+                /* Transfer ownership from the objects list to the vmas list. */
                list_add_tail(&vma->exec_list, &eb->vmas);
+                list_del_init(&obj->obj_exec_link);
                vma->exec_entry = &exec[i];
                if (eb->and < 0) {
@@ -155,16 +161,22 @@ eb_lookup_vmas(struct eb_vmas *eb,
                ++i;
        }
+        return 0;
-out:
+err:
        while (!list_empty(&objects)) {
                obj = list_first_entry(&objects,
                                       struct drm_i915_gem_object,
                                       obj_exec_link);
                list_del_init(&obj->obj_exec_link);
-                if (ret)
+                drm_gem_object_unreference(&obj->base);
-                        drm_gem_object_unreference(&obj->base);
        }
+        /*
+         * Objects already transfered to the vmas list will be unreferenced by
+         * eb_destroy.
+         */
        return ret;
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 38cb8d44a013..d3c3b5b15824 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -337,8 +337,8 @@ static void gen8_ppgtt_cleanup(struct i915_address_space *vm)
                kfree(ppgtt->gen8_pt_dma_addr[i]);
        }
-        __free_pages(ppgtt->gen8_pt_pages, ppgtt->num_pt_pages << PAGE_SHIFT);
+        __free_pages(ppgtt->gen8_pt_pages, get_order(ppgtt->num_pt_pages << PAGE_SHIFT));
-        __free_pages(ppgtt->pd_pages, ppgtt->num_pd_pages << PAGE_SHIFT);
+        __free_pages(ppgtt->pd_pages, get_order(ppgtt->num_pd_pages << PAGE_SHIFT));
 }
 /**
@@ -906,14 +906,12 @@ static void gen8_ggtt_insert_entries(struct i915_address_space *vm,
                WARN_ON(readq(&gtt_entries[i-1])
                        != gen8_pte_encode(addr, level, true));
-#if 0 /* TODO: Still needed on GEN8? */
        /* This next bit makes the above posting read even more important. We
         * want to flush the TLBs only after we're certain all the PTE updates
         * have finished.
         */
        I915_WRITE(GFX_FLSH_CNTL_GEN6, GFX_FLSH_CNTL_EN);
        POSTING_READ(GFX_FLSH_CNTL_GEN6);
-#endif
 }
 /*
@@ -1241,6 +1239,11 @@ static inline unsigned int gen8_get_total_gtt_size(u16 bdw_gmch_ctl)
        bdw_gmch_ctl &= BDW_GMCH_GGMS_MASK;
        if (bdw_gmch_ctl)
                bdw_gmch_ctl = 1 << bdw_gmch_ctl;
+        if (bdw_gmch_ctl > 4) {
+                WARN_ON(!i915_preliminary_hw_support);
+                return 4<<20;
+        }
        return bdw_gmch_ctl << 20;
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 080f6fd4e839..769b864465a9 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6303,7 +6303,7 @@ static void assert_can_disable_lcpll(struct drm_i915_private *dev_priv)
        uint32_t val;
        list_for_each_entry(crtc, &dev->mode_config.crtc_list, base.head)
-                WARN(crtc->base.enabled, "CRTC for pipe %c enabled\n",
+                WARN(crtc->active, "CRTC for pipe %c enabled\n",
                     pipe_name(crtc->pipe));
        WARN(I915_READ(HSW_PWR_WELL_DRIVER), "Power well on\n");
@@ -9135,7 +9135,7 @@ intel_pipe_config_compare(struct drm_device *dev,
        if (IS_G4X(dev) || INTEL_INFO(dev)->gen >= 5)
                PIPE_CONF_CHECK_I(pipe_bpp);
-        if (!IS_HASWELL(dev)) {
+        if (!HAS_DDI(dev)) {
                PIPE_CONF_CHECK_CLOCK_FUZZY(adjusted_mode.crtc_clock);
                PIPE_CONF_CHECK_CLOCK_FUZZY(port_clock);
        }
@@ -10541,11 +10541,20 @@ static struct intel_quirk intel_quirks[] = {
        /* Sony Vaio Y cannot use SSC on LVDS */
        { 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
-        /*
+        /* Acer Aspire 5734Z must invert backlight brightness */
-         * All GM45 Acer (and its brands eMachines and Packard Bell) laptops
+        { 0x2a42, 0x1025, 0x0459, quirk_invert_brightness },
-         * seem to use inverted backlight PWM.
-         */
+        /* Acer/eMachines G725 */
-        { 0x2a42, 0x1025, PCI_ANY_ID, quirk_invert_brightness },
+        { 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
+        /* Acer/eMachines e725 */
+        { 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
+        /* Acer/Packard Bell NCL20 */
+        { 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
+        /* Acer Aspire 4736Z */
+        { 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
        /* Dell XPS13 HD Sandy Bridge */
        { 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
@@ -11036,8 +11045,6 @@ void intel_modeset_setup_hw_state(struct drm_device *dev,
        }
        intel_modeset_check_state(dev);
-        drm_mode_config_reset(dev);
 }
 void intel_modeset_gem_init(struct drm_device *dev)
@@ -11046,7 +11053,10 @@ void intel_modeset_gem_init(struct drm_device *dev)
        intel_setup_overlay(dev);
+        drm_modeset_lock_all(dev);
+        drm_mode_config_reset(dev);
        intel_modeset_setup_hw_state(dev, false);
+        drm_modeset_unlock_all(dev);
 }
 void intel_modeset_cleanup(struct drm_device *dev)
@@ -11125,14 +11135,15 @@ void intel_connector_attach_encoder(struct intel_connector *connector,
 int intel_modeset_vga_set_state(struct drm_device *dev, bool state)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        unsigned reg = INTEL_INFO(dev)->gen >= 6 ? SNB_GMCH_CTRL : INTEL_GMCH_CTRL;
        u16 gmch_ctrl;
-        pci_read_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, &gmch_ctrl);
+        pci_read_config_word(dev_priv->bridge_dev, reg, &gmch_ctrl);
        if (state)
                gmch_ctrl &= ~INTEL_GMCH_VGA_DISABLE;
        else
                gmch_ctrl |= INTEL_GMCH_VGA_DISABLE;
-        pci_write_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, gmch_ctrl);
+        pci_write_config_word(dev_priv->bridge_dev, reg, gmch_ctrl);
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index a18e88b3e425..79f91f26e288 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -821,6 +821,7 @@ void intel_update_sprite_watermarks(struct drm_plane *plane,
                                    uint32_t sprite_width, int pixel_size,
                                    bool enabled, bool scaled);
 void intel_init_pm(struct drm_device *dev);
+void intel_pm_setup(struct drm_device *dev);
 bool intel_fbc_enabled(struct drm_device *dev);
 void intel_update_fbc(struct drm_device *dev);
 void intel_gpu_ips_init(struct drm_i915_private *dev_priv);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index f161ac02c4f6..e6f782d1c669 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -451,7 +451,9 @@ static u32 intel_panel_get_backlight(struct drm_device *dev,
        spin_lock_irqsave(&dev_priv->backlight.lock, flags);
-        if (HAS_PCH_SPLIT(dev)) {
+        if (IS_BROADWELL(dev)) {
+                val = I915_READ(BLC_PWM_PCH_CTL2) & BACKLIGHT_DUTY_CYCLE_MASK;
+        } else if (HAS_PCH_SPLIT(dev)) {
                val = I915_READ(BLC_PWM_CPU_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
        } else {
                if (IS_VALLEYVIEW(dev))
@@ -479,6 +481,13 @@ static u32 intel_panel_get_backlight(struct drm_device *dev,
        return val;
 }
+static void intel_bdw_panel_set_backlight(struct drm_device *dev, u32 level)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 val = I915_READ(BLC_PWM_PCH_CTL2) & ~BACKLIGHT_DUTY_CYCLE_MASK;
+        I915_WRITE(BLC_PWM_PCH_CTL2, val | level);
+}
 static void intel_pch_panel_set_backlight(struct drm_device *dev, u32 level)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -496,7 +505,9 @@ static void intel_panel_actually_set_backlight(struct drm_device *dev,
        DRM_DEBUG_DRIVER("set backlight PWM = %d\n", level);
        level = intel_panel_compute_brightness(dev, pipe, level);
-        if (HAS_PCH_SPLIT(dev))
+        if (IS_BROADWELL(dev))
+                return intel_bdw_panel_set_backlight(dev, level);
+        else if (HAS_PCH_SPLIT(dev))
                return intel_pch_panel_set_backlight(dev, level);
        if (is_backlight_combination_mode(dev)) {
@@ -666,7 +677,16 @@ void intel_panel_enable_backlight(struct intel_connector *connector)
                POSTING_READ(reg);
                I915_WRITE(reg, tmp | BLM_PWM_ENABLE);
-                if (HAS_PCH_SPLIT(dev) &&
+                if (IS_BROADWELL(dev)) {
+                        /*
+                         * Broadwell requires PCH override to drive the PCH
+                         * backlight pin. The above will configure the CPU
+                         * backlight pin, which we don't plan to use.
+                         */
+                        tmp = I915_READ(BLC_PWM_PCH_CTL1);
+                        tmp |= BLM_PCH_OVERRIDE_ENABLE | BLM_PCH_PWM_ENABLE;
+                        I915_WRITE(BLC_PWM_PCH_CTL1, tmp);
+                } else if (HAS_PCH_SPLIT(dev) &&
                    !(dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)) {
                        tmp = I915_READ(BLC_PWM_PCH_CTL1);
                        tmp |= BLM_PCH_PWM_ENABLE;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 6e0d5e075b15..26c29c173221 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5685,8 +5685,11 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        bool is_enabled, enable_requested;
+        unsigned long irqflags;
        uint32_t tmp;
+        WARN_ON(dev_priv->pc8.enabled);
        tmp = I915_READ(HSW_PWR_WELL_DRIVER);
        is_enabled = tmp & HSW_PWR_WELL_STATE_ENABLED;
        enable_requested = tmp & HSW_PWR_WELL_ENABLE_REQUEST;
@@ -5702,9 +5705,24 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
                                      HSW_PWR_WELL_STATE_ENABLED), 20))
                                DRM_ERROR("Timeout enabling power well\n");
                }
+                if (IS_BROADWELL(dev)) {
+                        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
+                        I915_WRITE(GEN8_DE_PIPE_IMR(PIPE_B),
+                                   dev_priv->de_irq_mask[PIPE_B]);
+                        I915_WRITE(GEN8_DE_PIPE_IER(PIPE_B),
+                                   ~dev_priv->de_irq_mask[PIPE_B] |
+                                   GEN8_PIPE_VBLANK);
+                        I915_WRITE(GEN8_DE_PIPE_IMR(PIPE_C),
+                                   dev_priv->de_irq_mask[PIPE_C]);
+                        I915_WRITE(GEN8_DE_PIPE_IER(PIPE_C),
+                                   ~dev_priv->de_irq_mask[PIPE_C] |
+                                   GEN8_PIPE_VBLANK);
+                        POSTING_READ(GEN8_DE_PIPE_IER(PIPE_C));
+                        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
+                }
        } else {
                if (enable_requested) {
-                        unsigned long irqflags;
                        enum pipe p;
                        I915_WRITE(HSW_PWR_WELL_DRIVER, 0);
@@ -5731,16 +5749,24 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
 static void __intel_power_well_get(struct drm_device *dev,
                                   struct i915_power_well *power_well)
 {
-        if (!power_well->count++)
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (!power_well->count++) {
+                hsw_disable_package_c8(dev_priv);
                __intel_set_power_well(dev, true);
+        }
 }
 static void __intel_power_well_put(struct drm_device *dev,
                                   struct i915_power_well *power_well)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
        WARN_ON(!power_well->count);
-        if (!--power_well->count && i915_disable_power_well)
+        if (!--power_well->count && i915_disable_power_well) {
                __intel_set_power_well(dev, false);
+                hsw_enable_package_c8(dev_priv);
+        }
 }
 void intel_display_power_get(struct drm_device *dev,
@@ -6130,10 +6156,19 @@ int vlv_freq_opcode(int ddr_freq, int val)
        return val;
 }
-void intel_pm_init(struct drm_device *dev)
+void intel_pm_setup(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        mutex_init(&dev_priv->rps.hw_lock);
+        mutex_init(&dev_priv->pc8.lock);
+        dev_priv->pc8.requirements_met = false;
+        dev_priv->pc8.gpu_idle = false;
+        dev_priv->pc8.irqs_disabled = false;
+        dev_priv->pc8.enabled = false;
+        dev_priv->pc8.disable_count = 2; /* requirements_met + gpu_idle */
+        INIT_DELAYED_WORK(&dev_priv->pc8.enable_work, hsw_enable_pc8_work);
        INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                          intel_gen6_powersave_work);
 }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index b620337e6d67..c2f09d456300 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -965,6 +965,7 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
        } else if (IS_GEN6(ring->dev)) {
                mmio = RING_HWS_PGA_GEN6(ring->mmio_base);
        } else {
+                /* XXX: gen8 returns to sanity */
                mmio = RING_HWS_PGA(ring->mmio_base);
        }
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index 0b02078a0b84..25cbe073c388 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -784,6 +784,7 @@ static int gen6_do_reset(struct drm_device *dev)
 int intel_gpu_reset(struct drm_device *dev)
 {
        switch (INTEL_INFO(dev)->gen) {
+        case 8:
        case 7:
        case 6: return gen6_do_reset(dev);
        case 5: return ironlake_do_reset(dev);
diff --git a/drivers/gpu/drm/nouveau/core/core/subdev.c b/drivers/gpu/drm/nouveau/core/core/subdev.c
index 48f06378d3f9..2ea5568b6cf5 100644
--- a/drivers/gpu/drm/nouveau/core/core/subdev.c
+++ b/drivers/gpu/drm/nouveau/core/core/subdev.c
@@ -104,11 +104,8 @@ nouveau_subdev_create_(struct nouveau_object *parent,
        if (parent) {
                struct nouveau_device *device = nv_device(parent);
-                int subidx = nv_hclass(subdev) & 0xff;
                subdev->debug = nouveau_dbgopt(device->dbgopt, subname);
                subdev->mmio  = nv_subdev(device)->mmio;
-                device->subdev[subidx] = *pobject;
        }
        return 0;
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/base.c b/drivers/gpu/drm/nouveau/core/engine/device/base.c
index 9135b25a29d0..dd01c6c435d6 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/base.c
@@ -268,6 +268,8 @@ nouveau_devobj_ctor(struct nouveau_object *parent,
                if (ret)
                        return ret;
+                device->subdev[i] = devobj->subdev[i];
                /* note: can't init *any* subdevs until devinit has been run
                 * due to not knowing exactly what the vbios init tables will
                 * mess with.  devinit also can't be run until all of its
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
index 8d06eef2b9ee..dbc5e33de94f 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
@@ -161,7 +161,7 @@ nvc0_identify(struct nouveau_device *device)
                device->oclass[NVDEV_SUBDEV_THERM  ] = &nva3_therm_oclass;
                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                device->oclass[NVDEV_SUBDEV_DEVINIT] = &nvc0_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nvc3_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nvc0_mc_oclass;
                device->oclass[NVDEV_SUBDEV_BUS    ] =  nvc0_bus_oclass;
                device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                device->oclass[NVDEV_SUBDEV_FB     ] =  nvc0_fb_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
index 434bb4b0fa2e..5c8a63dc506a 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
@@ -334,7 +334,7 @@ nvc0_graph_mthd(struct nvc0_graph_priv *priv, struct nvc0_graph_mthd *mthds)
        while ((mthd = &mthds[i++]) && (init = mthd->init)) {
                u32  addr = 0x80000000 | mthd->oclass;
                for (data = 0; init->count; init++) {
-                        if (data != init->data) {
+                        if (init == mthd->init || data != init->data) {
                                nv_wr32(priv, 0x40448c, init->data);
                                data = init->data;
                        }
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/fb.h b/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
index 8541aa382ff2..d89dbdf39b0d 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
@@ -75,6 +75,11 @@ struct nouveau_fb {
 static inline struct nouveau_fb *
 nouveau_fb(void *obj)
 {
+        /* fbram uses this before device subdev pointer is valid */
+        if (nv_iclass(obj, NV_SUBDEV_CLASS) &&
+            nv_subidx(obj) == NVDEV_SUBDEV_FB)
+                return obj;
        return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_FB];
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
index 420908cb82b6..df1b1b423093 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
@@ -365,13 +365,13 @@ static u16
 init_script(struct nouveau_bios *bios, int index)
 {
        struct nvbios_init init = { .bios = bios };
-        u16 data;
+        u16 bmp_ver = bmp_version(bios), data;
-        if (bmp_version(bios) && bmp_version(bios) < 0x0510) {
+        if (bmp_ver && bmp_ver < 0x0510) {
-                if (index > 1)
+                if (index > 1 || bmp_ver < 0x0100)
                        return 0x0000;
-                data = bios->bmp_offset + (bios->version.major < 2 ? 14 : 18);
+                data = bios->bmp_offset + (bmp_ver < 0x0200 ? 14 : 18);
                return nv_ro16(bios, data + (index * 2));
        }
@@ -1294,7 +1294,11 @@ init_jump(struct nvbios_init *init)
        u16 offset = nv_ro16(bios, init->offset + 1);
        trace("JUMP\t0x%04x\n", offset);
-        init->offset = offset;
+        if (init_exec(init))
+                init->offset = offset;
+        else
+                init->offset += 3;
 }
 /**
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 6828d81ed7b9..900fae01793e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -447,6 +447,8 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
        if (ret)
                goto done;
+        info->offset = ntfy->node->offset;
 done:
        if (ret)
                nouveau_abi16_ntfy_fini(chan, ntfy);
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 95c740454049..ba0183fb84f3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -51,6 +51,7 @@ static struct nouveau_dsm_priv {
        bool dsm_detected;
        bool optimus_detected;
        acpi_handle dhandle;
+        acpi_handle other_handle;
        acpi_handle rom_handle;
 } nouveau_dsm_priv;
@@ -260,9 +261,10 @@ static int nouveau_dsm_pci_probe(struct pci_dev *pdev)
        if (!dhandle)
                return false;
-        if (!acpi_has_method(dhandle, "_DSM"))
+        if (!acpi_has_method(dhandle, "_DSM")) {
+                nouveau_dsm_priv.other_handle = dhandle;
                return false;
+        }
        if (nouveau_test_dsm(dhandle, nouveau_dsm, NOUVEAU_DSM_POWER))
                retval |= NOUVEAU_DSM_HAS_MUX;
@@ -338,6 +340,16 @@ static bool nouveau_dsm_detect(void)
                printk(KERN_INFO "VGA switcheroo: detected DSM switching method %s handle\n",
                        acpi_method_name);
                nouveau_dsm_priv.dsm_detected = true;
+                /*
+                 * On some systems hotplug events are generated for the device
+                 * being switched off when _DSM is executed.  They cause ACPI
+                 * hotplug to trigger and attempt to remove the device from
+                 * the system, which causes it to break down.  Prevent that from
+                 * happening by setting the no_hotplug flag for the involved
+                 * ACPI device objects.
+                 */
+                acpi_bus_no_hotplug(nouveau_dsm_priv.dhandle);
+                acpi_bus_no_hotplug(nouveau_dsm_priv.other_handle);
                ret = true;
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 29c3efdfc7dd..25ea82f8def3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -610,7 +610,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        ret = nouveau_fence_sync(fence, chan);
        nouveau_fence_unref(&fence);
        if (ret)
-                return ret;
+                goto fail_free;
        if (new_bo != old_bo) {
                ret = nouveau_bo_pin(new_bo, TTM_PL_FLAG_VRAM);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 7a3759f1c41a..98a22e6e27a1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -858,6 +858,12 @@ static int nouveau_pmops_runtime_suspend(struct device *dev)
        if (nouveau_runtime_pm == 0)
                return -EINVAL;
+        /* are we optimus enabled? */
+        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
+                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+                return -EINVAL;
+        }
        nv_debug_level(SILENT);
        drm_kms_helper_poll_disable(drm_dev);
        vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_OFF);
diff --git a/drivers/gpu/drm/qxl/Kconfig b/drivers/gpu/drm/qxl/Kconfig
index 037d324bf58f..66ac0ff95f5a 100644
--- a/drivers/gpu/drm/qxl/Kconfig
+++ b/drivers/gpu/drm/qxl/Kconfig
@@ -8,5 +8,6 @@ config DRM_QXL
        select DRM_KMS_HELPER
        select DRM_KMS_FB_HELPER
        select DRM_TTM
+        select CRC32
        help
                QXL virtual GPU for Spice virtualization desktop integration. Do not enable this driver unless your distro ships a corresponding X.org QXL driver that can handle kernel modesetting.
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 5e827c29d194..d70aafb83307 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -24,7 +24,7 @@
 */
-#include "linux/crc32.h"
+#include <linux/crc32.h>
 #include "qxl_drv.h"
 #include "qxl_object.h"
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 80a20120e625..0b9621c9aeea 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1143,31 +1143,53 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
        }
        if (tiling_flags & RADEON_TILING_MACRO) {
-                if (rdev->family >= CHIP_BONAIRE)
+                evergreen_tiling_fields(tiling_flags, &bankw, &bankh, &mtaspect, &tile_split);
-                        tmp = rdev->config.cik.tile_config;
-                else if (rdev->family >= CHIP_TAHITI)
-                        tmp = rdev->config.si.tile_config;
-                else if (rdev->family >= CHIP_CAYMAN)
-                        tmp = rdev->config.cayman.tile_config;
-                else
-                        tmp = rdev->config.evergreen.tile_config;
-                switch ((tmp & 0xf0) >> 4) {
+                /* Set NUM_BANKS. */
-                case 0: /* 4 banks */
+                if (rdev->family >= CHIP_BONAIRE) {
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_4_BANK);
+                        unsigned tileb, index, num_banks, tile_split_bytes;
-                        break;
-                case 1: /* 8 banks */
+                        /* Calculate the macrotile mode index. */
-                default:
+                        tile_split_bytes = 64 << tile_split;
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_8_BANK);
+                        tileb = 8 * 8 * target_fb->bits_per_pixel / 8;
-                        break;
+                        tileb = min(tile_split_bytes, tileb);
-                case 2: /* 16 banks */
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_16_BANK);
+                        for (index = 0; tileb > 64; index++) {
-                        break;
+                                tileb >>= 1;
+                        }
+                        if (index >= 16) {
+                                DRM_ERROR("Wrong screen bpp (%u) or tile split (%u)\n",
+                                          target_fb->bits_per_pixel, tile_split);
+                                return -EINVAL;
+                        }
+                        num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
+                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(num_banks);
+                } else {
+                        /* SI and older. */
+                        if (rdev->family >= CHIP_TAHITI)
+                                tmp = rdev->config.si.tile_config;
+                        else if (rdev->family >= CHIP_CAYMAN)
+                                tmp = rdev->config.cayman.tile_config;
+                        else
+                                tmp = rdev->config.evergreen.tile_config;
+                        switch ((tmp & 0xf0) >> 4) {
+                        case 0: /* 4 banks */
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_4_BANK);
+                                break;
+                        case 1: /* 8 banks */
+                        default:
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_8_BANK);
+                                break;
+                        case 2: /* 16 banks */
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_16_BANK);
+                                break;
+                        }
                }
                fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_2D_TILED_THIN1);
-                evergreen_tiling_fields(tiling_flags, &bankw, &bankh, &mtaspect, &tile_split);
                fb_format |= EVERGREEN_GRPH_TILE_SPLIT(tile_split);
                fb_format |= EVERGREEN_GRPH_BANK_WIDTH(bankw);
                fb_format |= EVERGREEN_GRPH_BANK_HEIGHT(bankh);
@@ -1180,23 +1202,18 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_1D_TILED_THIN1);
        if (rdev->family >= CHIP_BONAIRE) {
-                u32 num_pipe_configs = rdev->config.cik.max_tile_pipes;
+                /* Read the pipe config from the 2D TILED SCANOUT mode.
-                u32 num_rb = rdev->config.cik.max_backends_per_se;
+                 * It should be the same for the other modes too, but not all
-                if (num_pipe_configs > 8)
+                 * modes set the pipe config field. */
-                        num_pipe_configs = 8;
+                u32 pipe_config = (rdev->config.cik.tile_mode_array[10] >> 6) & 0x1f;
-                if (num_pipe_configs == 8)
-                        fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P8_32x32_16x16);
+                fb_format |= CIK_GRPH_PIPE_CONFIG(pipe_config);
-                else if (num_pipe_configs == 4) {
-                        if (num_rb == 4)
-                                fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P4_16x16);
-                        else if (num_rb < 4)
-                                fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P4_8x16);
-                } else if (num_pipe_configs == 2)
-                        fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P2);
        } else if ((rdev->family == CHIP_TAHITI) ||
                   (rdev->family == CHIP_PITCAIRN))
                fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P8_32x32_8x16);
-        else if (rdev->family == CHIP_VERDE)
+        else if ((rdev->family == CHIP_VERDE) ||
+                 (rdev->family == CHIP_OLAND) ||
+                 (rdev->family == CHIP_HAINAN)) /* for completeness.  HAINAN has no display hw */
                fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P4_8x16);
        switch (radeon_crtc->crtc_id) {
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index b43a3a3c9067..e950fabd7f5e 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3057,7 +3057,7 @@ static u32 cik_create_bitmask(u32 bit_width)
 * Returns the disabled RB bitmask.
 */
 static u32 cik_get_rb_disabled(struct radeon_device *rdev,
-                              u32 max_rb_num, u32 se_num,
+                              u32 max_rb_num_per_se,
                              u32 sh_per_se)
 {
        u32 data, mask;
@@ -3071,7 +3071,7 @@ static u32 cik_get_rb_disabled(struct radeon_device *rdev,
        data >>= BACKEND_DISABLE_SHIFT;
-        mask = cik_create_bitmask(max_rb_num / se_num / sh_per_se);
+        mask = cik_create_bitmask(max_rb_num_per_se / sh_per_se);
        return data & mask;
 }
@@ -3088,7 +3088,7 @@ static u32 cik_get_rb_disabled(struct radeon_device *rdev,
 */
 static void cik_setup_rb(struct radeon_device *rdev,
                         u32 se_num, u32 sh_per_se,
-                         u32 max_rb_num)
+                         u32 max_rb_num_per_se)
 {
        int i, j;
        u32 data, mask;
@@ -3098,7 +3098,7 @@ static void cik_setup_rb(struct radeon_device *rdev,
        for (i = 0; i < se_num; i++) {
                for (j = 0; j < sh_per_se; j++) {
                        cik_select_se_sh(rdev, i, j);
-                        data = cik_get_rb_disabled(rdev, max_rb_num, se_num, sh_per_se);
+                        data = cik_get_rb_disabled(rdev, max_rb_num_per_se, sh_per_se);
                        if (rdev->family == CHIP_HAWAII)
                                disabled_rbs |= data << ((i * sh_per_se + j) * HAWAII_RB_BITMAP_WIDTH_PER_SH);
                        else
@@ -3108,12 +3108,14 @@ static void cik_setup_rb(struct radeon_device *rdev,
        cik_select_se_sh(rdev, 0xffffffff, 0xffffffff);
        mask = 1;
-        for (i = 0; i < max_rb_num; i++) {
+        for (i = 0; i < max_rb_num_per_se * se_num; i++) {
                if (!(disabled_rbs & mask))
                        enabled_rbs |= mask;
                mask <<= 1;
        }
+        rdev->config.cik.backend_enable_mask = enabled_rbs;
        for (i = 0; i < se_num; i++) {
                cik_select_se_sh(rdev, i, 0xffffffff);
                data = 0;
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 0300727a4f70..d08b83c6267b 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -458,7 +458,7 @@ int cik_copy_dma(struct radeon_device *rdev,
                radeon_ring_write(ring, 0); /* src/dst endian swap */
                radeon_ring_write(ring, src_offset & 0xffffffff);
                radeon_ring_write(ring, upper_32_bits(src_offset) & 0xffffffff);
-                radeon_ring_write(ring, dst_offset & 0xfffffffc);
+                radeon_ring_write(ring, dst_offset & 0xffffffff);
                radeon_ring_write(ring, upper_32_bits(dst_offset) & 0xffffffff);
                src_offset += cur_size_in_bytes;
                dst_offset += cur_size_in_bytes;
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index de86493cbc44..713a5d359901 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -174,7 +174,7 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
                return;
        }
@@ -235,7 +235,7 @@ void dce6_afmt_write_sad_regs(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
                return;
        }
@@ -308,7 +308,9 @@ int dce6_audio_init(struct radeon_device *rdev)
        rdev->audio.enabled = true;
        if (ASIC_IS_DCE8(rdev))
-                rdev->audio.num_pins = 7;
+                rdev->audio.num_pins = 6;
+        else if (ASIC_IS_DCE61(rdev))
+                rdev->audio.num_pins = 4;
        else
                rdev->audio.num_pins = 6;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index aa695c4feb3d..0c6d5cef4cf1 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -118,7 +118,7 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
                return;
        }
@@ -173,7 +173,7 @@ static void evergreen_hdmi_write_sad_regs(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
                return;
        }
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 11aab2ab54ce..f59a9e9fccf8 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -895,6 +895,10 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                    (rdev->pdev->device == 0x999C)) {
                        rdev->config.cayman.max_simds_per_se = 6;
                        rdev->config.cayman.max_backends_per_se = 2;
+                        rdev->config.cayman.max_hw_contexts = 8;
+                        rdev->config.cayman.sx_max_export_size = 256;
+                        rdev->config.cayman.sx_max_export_pos_size = 64;
+                        rdev->config.cayman.sx_max_export_smx_size = 192;
                } else if ((rdev->pdev->device == 0x9903) ||
                           (rdev->pdev->device == 0x9904) ||
                           (rdev->pdev->device == 0x990A) ||
@@ -905,6 +909,10 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                           (rdev->pdev->device == 0x999D)) {
                        rdev->config.cayman.max_simds_per_se = 4;
                        rdev->config.cayman.max_backends_per_se = 2;
+                        rdev->config.cayman.max_hw_contexts = 8;
+                        rdev->config.cayman.sx_max_export_size = 256;
+                        rdev->config.cayman.sx_max_export_pos_size = 64;
+                        rdev->config.cayman.sx_max_export_smx_size = 192;
                } else if ((rdev->pdev->device == 0x9919) ||
                           (rdev->pdev->device == 0x9990) ||
                           (rdev->pdev->device == 0x9991) ||
@@ -915,9 +923,17 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                           (rdev->pdev->device == 0x99A0)) {
                        rdev->config.cayman.max_simds_per_se = 3;
                        rdev->config.cayman.max_backends_per_se = 1;
+                        rdev->config.cayman.max_hw_contexts = 4;
+                        rdev->config.cayman.sx_max_export_size = 128;
+                        rdev->config.cayman.sx_max_export_pos_size = 32;
+                        rdev->config.cayman.sx_max_export_smx_size = 96;
                } else {
                        rdev->config.cayman.max_simds_per_se = 2;
                        rdev->config.cayman.max_backends_per_se = 1;
+                        rdev->config.cayman.max_hw_contexts = 4;
+                        rdev->config.cayman.sx_max_export_size = 128;
+                        rdev->config.cayman.sx_max_export_pos_size = 32;
+                        rdev->config.cayman.sx_max_export_smx_size = 96;
                }
                rdev->config.cayman.max_texture_channel_caches = 2;
                rdev->config.cayman.max_gprs = 256;
@@ -925,10 +941,6 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                rdev->config.cayman.max_gs_threads = 32;
                rdev->config.cayman.max_stack_entries = 512;
                rdev->config.cayman.sx_num_of_sets = 8;
-                rdev->config.cayman.sx_max_export_size = 256;
-                rdev->config.cayman.sx_max_export_pos_size = 64;
-                rdev->config.cayman.sx_max_export_smx_size = 192;
-                rdev->config.cayman.max_hw_contexts = 8;
                rdev->config.cayman.sq_num_cf_insts = 2;
                rdev->config.cayman.sc_prim_fifo_size = 0x40;
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b1f990d0eaa1..45e1f447bc79 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1940,7 +1940,7 @@ struct si_asic {
        unsigned sc_earlyz_tile_fifo_size;
        unsigned num_tile_pipes;
-        unsigned num_backends_per_se;
+        unsigned backend_enable_mask;
        unsigned backend_disable_mask_per_asic;
        unsigned backend_map;
        unsigned num_texture_channel_caches;
@@ -1970,7 +1970,7 @@ struct cik_asic {
        unsigned sc_earlyz_tile_fifo_size;
        unsigned num_tile_pipes;
-        unsigned num_backends_per_se;
+        unsigned backend_enable_mask;
        unsigned backend_disable_mask_per_asic;
        unsigned backend_map;
        unsigned num_texture_channel_caches;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index e354ce94cdd1..c0425bb6223a 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -2021,7 +2021,7 @@ static struct radeon_asic ci_asic = {
                .hdmi_setmode = &evergreen_hdmi_setmode,
        },
        .copy = {
-                .blit = NULL,
+                .blit = &cik_copy_cpdma,
                .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                .dma = &cik_copy_dma,
                .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
@@ -2122,7 +2122,7 @@ static struct radeon_asic kv_asic = {
                .hdmi_setmode = &evergreen_hdmi_setmode,
        },
        .copy = {
-                .blit = NULL,
+                .blit = &cik_copy_cpdma,
                .blit_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                .dma = &cik_copy_dma,
                .dma_ring_index = R600_RING_TYPE_DMA_INDEX,
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 9d302eaeea15..485848f889f5 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -33,6 +33,7 @@ static struct radeon_atpx_priv {
        bool atpx_detected;
        /* handle for device - and atpx */
        acpi_handle dhandle;
+        acpi_handle other_handle;
        struct radeon_atpx atpx;
 } radeon_atpx_priv;
@@ -451,9 +452,10 @@ static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
                return false;
        status = acpi_get_handle(dhandle, "ATPX", &atpx_handle);
-        if (ACPI_FAILURE(status))
+        if (ACPI_FAILURE(status)) {
+                radeon_atpx_priv.other_handle = dhandle;
                return false;
+        }
        radeon_atpx_priv.dhandle = dhandle;
        radeon_atpx_priv.atpx.handle = atpx_handle;
        return true;
@@ -530,6 +532,16 @@ static bool radeon_atpx_detect(void)
                printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
                       acpi_method_name);
                radeon_atpx_priv.atpx_detected = true;
+                /*
+                 * On some systems hotplug events are generated for the device
+                 * being switched off when ATPX is executed.  They cause ACPI
+                 * hotplug to trigger and attempt to remove the device from
+                 * the system, which causes it to break down.  Prevent that from
+                 * happening by setting the no_hotplug flag for the involved
+                 * ACPI device objects.
+                 */
+                acpi_bus_no_hotplug(radeon_atpx_priv.dhandle);
+                acpi_bus_no_hotplug(radeon_atpx_priv.other_handle);
                return true;
        }
        return false;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 9f5ff28864f6..db39ea36bf22 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -77,9 +77,10 @@
 *   2.33.0 - Add SI tiling mode array query
 *   2.34.0 - Add CIK tiling mode array query
 *   2.35.0 - Add CIK macrotile mode array query
+ *   2.36.0 - Fix CIK DCE tiling setup
 */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        35
+#define KMS_DRIVER_MINOR        36
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
@@ -508,15 +509,6 @@ static const struct file_operations radeon_driver_kms_fops = {
 #endif
 };
-static void
-radeon_pci_shutdown(struct pci_dev *pdev)
-{
-        struct drm_device *dev = pci_get_drvdata(pdev);
-        radeon_driver_unload_kms(dev);
-}
 static struct drm_driver kms_driver = {
        .driver_features =
            DRIVER_USE_AGP |
@@ -586,7 +578,6 @@ static struct pci_driver radeon_kms_pci_driver = {
        .probe = radeon_pci_probe,
        .remove = radeon_pci_remove,
        .driver.pm = &radeon_pm_ops,
-        .shutdown = radeon_pci_shutdown,
 };
 static int __init radeon_init(void)
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 55d0b474bd37..21d593c0ecaf 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -461,6 +461,15 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
        case RADEON_INFO_SI_CP_DMA_COMPUTE:
                *value = 1;
                break;
+        case RADEON_INFO_SI_BACKEND_ENABLED_MASK:
+                if (rdev->family >= CHIP_BONAIRE) {
+                        *value = rdev->config.cik.backend_enable_mask;
+                } else if (rdev->family >= CHIP_TAHITI) {
+                        *value = rdev->config.si.backend_enable_mask;
+                } else {
+                        DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
+                }
+                break;
        default:
                DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 373d088bac66..b9c0529b4a2e 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -473,7 +473,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                return -EINVAL;
        }
-        if ((start >> 28) != (end >> 28)) {
+        if ((start >> 28) != ((end - 1) >> 28)) {
                DRM_ERROR("reloc %LX-%LX crossing 256MB boundary!\n",
                          start, end);
                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 1c560629575a..e7dab069cccf 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -162,6 +162,16 @@ static void rs690_mc_init(struct radeon_device *rdev)
        base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
        base = G_000100_MC_FB_START(base) << 16;
        rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+        /* Some boards seem to be configured for 128MB of sideport memory,
+         * but really only have 64MB.  Just skip the sideport and use
+         * UMA memory.
+         */
+        if (rdev->mc.igp_sideport_enabled &&
+            (rdev->mc.real_vram_size == (384 * 1024 * 1024))) {
+                base += 128 * 1024 * 1024;
+                rdev->mc.real_vram_size -= 128 * 1024 * 1024;
+                rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
+        }
        /* Use K8 direct mapping for fast fb access. */ 
        rdev->fastfb_working = false;
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 913b025ae9b3..374499db20c7 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2328,6 +2328,12 @@ void rv770_get_engine_memory_ss(struct radeon_device *rdev)
        pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
                                                       ASIC_INTERNAL_MEMORY_SS, 0);
+        /* disable ss, causes hangs on some cayman boards */
+        if (rdev->family == CHIP_CAYMAN) {
+                pi->sclk_ss = false;
+                pi->mclk_ss = false;
+        }
        if (pi->sclk_ss || pi->mclk_ss)
                pi->dynamic_ss = true;
        else
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index a36736dab5e0..85e1edfaa3be 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2811,7 +2811,7 @@ static void si_setup_spi(struct radeon_device *rdev,
 }
 static u32 si_get_rb_disabled(struct radeon_device *rdev,
-                              u32 max_rb_num, u32 se_num,
+                              u32 max_rb_num_per_se,
                              u32 sh_per_se)
 {
        u32 data, mask;
@@ -2825,14 +2825,14 @@ static u32 si_get_rb_disabled(struct radeon_device *rdev,
        data >>= BACKEND_DISABLE_SHIFT;
-        mask = si_create_bitmask(max_rb_num / se_num / sh_per_se);
+        mask = si_create_bitmask(max_rb_num_per_se / sh_per_se);
        return data & mask;
 }
 static void si_setup_rb(struct radeon_device *rdev,
                        u32 se_num, u32 sh_per_se,
-                        u32 max_rb_num)
+                        u32 max_rb_num_per_se)
 {
        int i, j;
        u32 data, mask;
@@ -2842,19 +2842,21 @@ static void si_setup_rb(struct radeon_device *rdev,
        for (i = 0; i < se_num; i++) {
                for (j = 0; j < sh_per_se; j++) {
                        si_select_se_sh(rdev, i, j);
-                        data = si_get_rb_disabled(rdev, max_rb_num, se_num, sh_per_se);
+                        data = si_get_rb_disabled(rdev, max_rb_num_per_se, sh_per_se);
                        disabled_rbs |= data << ((i * sh_per_se + j) * TAHITI_RB_BITMAP_WIDTH_PER_SH);
                }
        }
        si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
        mask = 1;
-        for (i = 0; i < max_rb_num; i++) {
+        for (i = 0; i < max_rb_num_per_se * se_num; i++) {
                if (!(disabled_rbs & mask))
                        enabled_rbs |= mask;
                mask <<= 1;
        }
+        rdev->config.si.backend_enable_mask = enabled_rbs;
        for (i = 0; i < se_num; i++) {
                si_select_se_sh(rdev, i, 0xffffffff);
                data = 0;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 15b86a94949d..406152152315 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -353,7 +353,8 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
         * Don't move nonexistent data. Clear destination instead.
         */
        if (old_iomap == NULL &&
-            (ttm == NULL || ttm->state == tt_unpopulated)) {
+            (ttm == NULL || (ttm->state == tt_unpopulated &&
+                             !(ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)))) {
                memset_io(new_iomap, 0, new_mem->num_pages*PAGE_SIZE);
                goto out2;
        }
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index b249ab9b1eb2..6440eeac22d2 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -169,9 +169,9 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        }
        page_offset = ((address - vma->vm_start) >> PAGE_SHIFT) +
-            drm_vma_node_start(&bo->vma_node) - vma->vm_pgoff;
+                vma->vm_pgoff - drm_vma_node_start(&bo->vma_node);
-        page_last = vma_pages(vma) +
+        page_last = vma_pages(vma) + vma->vm_pgoff -
-            drm_vma_node_start(&bo->vma_node) - vma->vm_pgoff;
+                drm_vma_node_start(&bo->vma_node);
        if (unlikely(page_offset >= bo->num_pages)) {
                retval = VM_FAULT_SIGBUS;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index a51f48e3e917..45d5b5ab6ca9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -68,6 +68,9 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
                                  SVGA_FIFO_3D_HWVERSION));
                break;
        }
+        case DRM_VMW_PARAM_MAX_SURF_MEMORY:
+                param->value = dev_priv->memory_size;
+                break;
        default:
                DRM_ERROR("Illegal vmwgfx get param request: %d\n",
                          param->param);
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 92d1206482a6..797ed29a36ea 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -123,7 +123,7 @@ static struct cpuidle_state *cpuidle_state_table;
 * which is also the index into the MWAIT hint array.
 * Thus C0 is a dummy.
 */
-static struct cpuidle_state nehalem_cstates[] __initdata = {
+static struct cpuidle_state nehalem_cstates[] = {
        {
                .name = "C1-NHM",
                .desc = "MWAIT 0x00",
@@ -156,7 +156,7 @@ static struct cpuidle_state nehalem_cstates[] __initdata = {
                .enter = NULL }
 };
-static struct cpuidle_state snb_cstates[] __initdata = {
+static struct cpuidle_state snb_cstates[] = {
        {
                .name = "C1-SNB",
                .desc = "MWAIT 0x00",
@@ -196,7 +196,7 @@ static struct cpuidle_state snb_cstates[] __initdata = {
                .enter = NULL }
 };
-static struct cpuidle_state ivb_cstates[] __initdata = {
+static struct cpuidle_state ivb_cstates[] = {
        {
                .name = "C1-IVB",
                .desc = "MWAIT 0x00",
@@ -236,7 +236,7 @@ static struct cpuidle_state ivb_cstates[] __initdata = {
                .enter = NULL }
 };
-static struct cpuidle_state hsw_cstates[] __initdata = {
+static struct cpuidle_state hsw_cstates[] = {
        {
                .name = "C1-HSW",
                .desc = "MWAIT 0x00",
@@ -297,7 +297,7 @@ static struct cpuidle_state hsw_cstates[] __initdata = {
                .enter = NULL }
 };
-static struct cpuidle_state atom_cstates[] __initdata = {
+static struct cpuidle_state atom_cstates[] = {
        {
                .name = "C1E-ATM",
                .desc = "MWAIT 0x00",
@@ -329,7 +329,7 @@ static struct cpuidle_state atom_cstates[] __initdata = {
        {
                .enter = NULL }
 };
-static struct cpuidle_state avn_cstates[] __initdata = {
+static struct cpuidle_state avn_cstates[] = {
        {
                .name = "C1-AVN",
                .desc = "MWAIT 0x00",
@@ -344,6 +344,8 @@ static struct cpuidle_state avn_cstates[] __initdata = {
                .exit_latency = 15,
                .target_residency = 45,
                .enter = &intel_idle },
+        {
+                .enter = NULL }
 };
 /**
@@ -377,6 +379,9 @@ static int intel_idle(struct cpuidle_device *dev,
        if (!current_set_polling_and_test()) {
+                if (this_cpu_has(X86_FEATURE_CLFLUSH_MONITOR))
+                        clflush((void *)&current_thread_info()->flags);
                __monitor((void *)&current_thread_info()->flags, 0, 0);
                smp_mb();
                if (!need_resched())
diff --git a/drivers/iio/adc/ad7887.c b/drivers/iio/adc/ad7887.c
index acb7f90359a3..749a6cadab8b 100644
--- a/drivers/iio/adc/ad7887.c
+++ b/drivers/iio/adc/ad7887.c
@@ -200,7 +200,13 @@ static const struct ad7887_chip_info ad7887_chip_info_tbl[] = {
                        .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                        .address = 1,
                        .scan_index = 1,
-                        .scan_type = IIO_ST('u', 12, 16, 0),
+                        .scan_type = {
+                                .sign = 'u',
+                                .realbits = 12,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                        },
                },
                .channel[1] = {
                        .type = IIO_VOLTAGE,
@@ -210,7 +216,13 @@ static const struct ad7887_chip_info ad7887_chip_info_tbl[] = {
                        .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                        .address = 0,
                        .scan_index = 0,
-                        .scan_type = IIO_ST('u', 12, 16, 0),
+                        .scan_type = {
+                                .sign = 'u',
+                                .realbits = 12,
+                                .storagebits = 16,
+                                .shift = 0,
+                                .endianness = IIO_BE,
+                        },
                },
                .channel[2] = IIO_CHAN_SOFT_TIMESTAMP(2),
                .int_vref_mv = 2500,
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index 3fb7757a1028..368660dfe135 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -651,7 +651,12 @@ static const struct iio_chan_spec adis16448_channels[] = {
                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                .address = ADIS16448_BARO_OUT,
                .scan_index = ADIS16400_SCAN_BARO,
-                .scan_type = IIO_ST('s', 16, 16, 0),
+                .scan_type = {
+                        .sign = 's',
+                        .realbits = 16,
+                        .storagebits = 16,
+                        .endianness = IIO_BE,
+                },
        },
        ADIS16400_TEMP_CHAN(ADIS16448_TEMP_OUT, 12),
        IIO_CHAN_SOFT_TIMESTAMP(11)
diff --git a/drivers/iio/light/cm36651.c b/drivers/iio/light/cm36651.c
index 21df57130018..0922e39b0ea9 100644
--- a/drivers/iio/light/cm36651.c
+++ b/drivers/iio/light/cm36651.c
@@ -387,7 +387,7 @@ static int cm36651_read_int_time(struct cm36651_data *cm36651,
                return -EINVAL;
        }
-        return IIO_VAL_INT_PLUS_MICRO;
+        return IIO_VAL_INT;
 }
 static int cm36651_write_int_time(struct cm36651_data *cm36651,
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index c47c2034ca71..0717940ec3b5 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -181,9 +181,16 @@ static void add_ref(struct iw_cm_id *cm_id)
 static void rem_ref(struct iw_cm_id *cm_id)
 {
        struct iwcm_id_private *cm_id_priv;
+        int cb_destroy;
        cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
-        if (iwcm_deref_id(cm_id_priv) &&
-            test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags)) {
+        /*
+         * Test bit before deref in case the cm_id gets freed on another
+         * thread.
+         */
+        cb_destroy = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
+        if (iwcm_deref_id(cm_id_priv) && cb_destroy) {
                BUG_ON(!list_empty(&cm_id_priv->work_list));
                free_cm_id(cm_id_priv);
        }
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index bdc842e9faef..a283274a5a09 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -49,12 +49,20 @@
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
        do {                                                            \
-                (udata)->inbuf  = (void __user *) (ibuf);               \
+                (udata)->inbuf  = (const void __user *) (ibuf);         \
                (udata)->outbuf = (void __user *) (obuf);               \
                (udata)->inlen  = (ilen);                               \
                (udata)->outlen = (olen);                               \
        } while (0)
+#define INIT_UDATA_BUF_OR_NULL(udata, ibuf, obuf, ilen, olen)                   \
+        do {                                                                    \
+                (udata)->inbuf  = (ilen) ? (const void __user *) (ibuf) : NULL; \
+                (udata)->outbuf = (olen) ? (void __user *) (obuf) : NULL;       \
+                (udata)->inlen  = (ilen);                                       \
+                (udata)->outlen = (olen);                                       \
+        } while (0)
 /*
 * Our lifetime rules for these structs are the following:
 *
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 65f6e7dc380c..f1cc83855af6 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2593,6 +2593,9 @@ out_put:
 static int kern_spec_to_ib_spec(struct ib_uverbs_flow_spec *kern_spec,
                                union ib_flow_spec *ib_spec)
 {
+        if (kern_spec->reserved)
+                return -EINVAL;
        ib_spec->type = kern_spec->type;
        switch (ib_spec->type) {
@@ -2646,6 +2649,9 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
        void *ib_spec;
        int i;
+        if (ucore->inlen < sizeof(cmd))
+                return -EINVAL;
        if (ucore->outlen < sizeof(resp))
                return -ENOSPC;
@@ -2671,6 +2677,10 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
            (cmd.flow_attr.num_of_specs * sizeof(struct ib_uverbs_flow_spec)))
                return -EINVAL;
+        if (cmd.flow_attr.reserved[0] ||
+            cmd.flow_attr.reserved[1])
+                return -EINVAL;
        if (cmd.flow_attr.num_of_specs) {
                kern_flow_attr = kmalloc(sizeof(*kern_flow_attr) + cmd.flow_attr.size,
                                         GFP_KERNEL);
@@ -2731,6 +2741,7 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
        if (cmd.flow_attr.size || (i != flow_attr->num_of_specs)) {
                pr_warn("create flow failed, flow %d: %d bytes left from uverb cmd\n",
                        i, cmd.flow_attr.size);
+                err = -EINVAL;
                goto err_free;
        }
        flow_id = ib_create_flow(qp, flow_attr, IB_FLOW_DOMAIN_USER);
@@ -2791,10 +2802,16 @@ int ib_uverbs_ex_destroy_flow(struct ib_uverbs_file *file,
        struct ib_uobject               *uobj;
        int                             ret;
+        if (ucore->inlen < sizeof(cmd))
+                return -EINVAL;
        ret = ib_copy_from_udata(&cmd, ucore, sizeof(cmd));
        if (ret)
                return ret;
+        if (cmd.comp_mask)
+                return -EINVAL;
        uobj = idr_write_uobj(&ib_uverbs_rule_idr, cmd.flow_handle,
                              file->ucontext);
        if (!uobj)
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 34386943ebcf..08219fb3338b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -668,25 +668,30 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                if ((hdr.in_words + ex_hdr.provider_in_words) * 8 != count)
                        return -EINVAL;
+                if (ex_hdr.cmd_hdr_reserved)
+                        return -EINVAL;
                if (ex_hdr.response) {
                        if (!hdr.out_words && !ex_hdr.provider_out_words)
                                return -EINVAL;
+                        if (!access_ok(VERIFY_WRITE,
+                                       (void __user *) (unsigned long) ex_hdr.response,
+                                       (hdr.out_words + ex_hdr.provider_out_words) * 8))
+                                return -EFAULT;
                } else {
                        if (hdr.out_words || ex_hdr.provider_out_words)
                                return -EINVAL;
                }
-                INIT_UDATA(&ucore,
+                INIT_UDATA_BUF_OR_NULL(&ucore, buf, (unsigned long) ex_hdr.response,
-                           (hdr.in_words) ? buf : 0,
+                                       hdr.in_words * 8, hdr.out_words * 8);
-                           (unsigned long)ex_hdr.response,
-                           hdr.in_words * 8,
+                INIT_UDATA_BUF_OR_NULL(&uhw,
-                           hdr.out_words * 8);
+                                       buf + ucore.inlen,
+                                       (unsigned long) ex_hdr.response + ucore.outlen,
-                INIT_UDATA(&uhw,
+                                       ex_hdr.provider_in_words * 8,
-                           (ex_hdr.provider_in_words) ? buf + ucore.inlen : 0,
+                                       ex_hdr.provider_out_words * 8);
-                           (ex_hdr.provider_out_words) ? (unsigned long)ex_hdr.response + ucore.outlen : 0,
-                           ex_hdr.provider_in_words * 8,
-                           ex_hdr.provider_out_words * 8);
                err = uverbs_ex_cmd_table[command](file,
                                                   &ucore,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 12fef76c791c..45126879ad28 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -524,50 +524,6 @@ static int send_abort(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
 }
-#define VLAN_NONE 0xfff
-#define FILTER_SEL_VLAN_NONE 0xffff
-#define FILTER_SEL_WIDTH_P_FC (3+1) /* port uses 3 bits, FCoE one bit */
-#define FILTER_SEL_WIDTH_VIN_P_FC \
-        (6 + 7 + FILTER_SEL_WIDTH_P_FC) /* 6 bits are unused, VF uses 7 bits*/
-#define FILTER_SEL_WIDTH_TAG_P_FC \
-        (3 + FILTER_SEL_WIDTH_VIN_P_FC) /* PF uses 3 bits */
-#define FILTER_SEL_WIDTH_VLD_TAG_P_FC (1 + FILTER_SEL_WIDTH_TAG_P_FC)
-static unsigned int select_ntuple(struct c4iw_dev *dev, struct dst_entry *dst,
-                                  struct l2t_entry *l2t)
-{
-        unsigned int ntuple = 0;
-        u32 viid;
-        switch (dev->rdev.lldi.filt_mode) {
-        /* default filter mode */
-        case HW_TPL_FR_MT_PR_IV_P_FC:
-                if (l2t->vlan == VLAN_NONE)
-                        ntuple |= FILTER_SEL_VLAN_NONE << FILTER_SEL_WIDTH_P_FC;
-                else {
-                        ntuple |= l2t->vlan << FILTER_SEL_WIDTH_P_FC;
-                        ntuple |= 1 << FILTER_SEL_WIDTH_TAG_P_FC;
-                }
-                ntuple |= l2t->lport << S_PORT | IPPROTO_TCP <<
-                          FILTER_SEL_WIDTH_VLD_TAG_P_FC;
-                break;
-        case HW_TPL_FR_MT_PR_OV_P_FC: {
-                viid = cxgb4_port_viid(l2t->neigh->dev);
-                ntuple |= FW_VIID_VIN_GET(viid) << FILTER_SEL_WIDTH_P_FC;
-                ntuple |= FW_VIID_PFN_GET(viid) << FILTER_SEL_WIDTH_VIN_P_FC;
-                ntuple |= FW_VIID_VIVLD_GET(viid) << FILTER_SEL_WIDTH_TAG_P_FC;
-                ntuple |= l2t->lport << S_PORT | IPPROTO_TCP <<
-                          FILTER_SEL_WIDTH_VLD_TAG_P_FC;
-                break;
-        }
-        default:
-                break;
-        }
-        return ntuple;
-}
 static int send_connect(struct c4iw_ep *ep)
 {
        struct cpl_act_open_req *req;
@@ -641,8 +597,9 @@ static int send_connect(struct c4iw_ep *ep)
                        req->local_ip = la->sin_addr.s_addr;
                        req->peer_ip = ra->sin_addr.s_addr;
                        req->opt0 = cpu_to_be64(opt0);
-                        req->params = cpu_to_be32(select_ntuple(ep->com.dev,
+                        req->params = cpu_to_be32(cxgb4_select_ntuple(
-                                                ep->dst, ep->l2t));
+                                                ep->com.dev->rdev.lldi.ports[0],
+                                                ep->l2t));
                        req->opt2 = cpu_to_be32(opt2);
                } else {
                        req6 = (struct cpl_act_open_req6 *)skb_put(skb, wrlen);
@@ -662,9 +619,9 @@ static int send_connect(struct c4iw_ep *ep)
                        req6->peer_ip_lo = *((__be64 *)
                                                (ra6->sin6_addr.s6_addr + 8));
                        req6->opt0 = cpu_to_be64(opt0);
-                        req6->params = cpu_to_be32(
+                        req6->params = cpu_to_be32(cxgb4_select_ntuple(
-                                        select_ntuple(ep->com.dev, ep->dst,
+                                                ep->com.dev->rdev.lldi.ports[0],
-                                                      ep->l2t));
+                                                ep->l2t));
                        req6->opt2 = cpu_to_be32(opt2);
                }
        } else {
@@ -681,8 +638,9 @@ static int send_connect(struct c4iw_ep *ep)
                        t5_req->peer_ip = ra->sin_addr.s_addr;
                        t5_req->opt0 = cpu_to_be64(opt0);
                        t5_req->params = cpu_to_be64(V_FILTER_TUPLE(
-                                                select_ntuple(ep->com.dev,
+                                                     cxgb4_select_ntuple(
-                                                ep->dst, ep->l2t)));
+                                             ep->com.dev->rdev.lldi.ports[0],
+                                             ep->l2t)));
                        t5_req->opt2 = cpu_to_be32(opt2);
                } else {
                        t5_req6 = (struct cpl_t5_act_open_req6 *)
@@ -703,7 +661,9 @@ static int send_connect(struct c4iw_ep *ep)
                                                (ra6->sin6_addr.s6_addr + 8));
                        t5_req6->opt0 = cpu_to_be64(opt0);
                        t5_req6->params = (__force __be64)cpu_to_be32(
-                                select_ntuple(ep->com.dev, ep->dst, ep->l2t));
+                                                        cxgb4_select_ntuple(
+                                                ep->com.dev->rdev.lldi.ports[0],
+                                                ep->l2t));
                        t5_req6->opt2 = cpu_to_be32(opt2);
                }
        }
@@ -1630,7 +1590,8 @@ static void send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid)
        memset(req, 0, sizeof(*req));
        req->op_compl = htonl(V_WR_OP(FW_OFLD_CONNECTION_WR));
        req->len16_pkd = htonl(FW_WR_LEN16(DIV_ROUND_UP(sizeof(*req), 16)));
-        req->le.filter = cpu_to_be32(select_ntuple(ep->com.dev, ep->dst,
+        req->le.filter = cpu_to_be32(cxgb4_select_ntuple(
+                                     ep->com.dev->rdev.lldi.ports[0],
                                     ep->l2t));
        sin = (struct sockaddr_in *)&ep->com.local_addr;
        req->le.lport = sin->sin_port;
@@ -2938,7 +2899,8 @@ int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
        /*
         * Allocate a server TID.
         */
-        if (dev->rdev.lldi.enable_fw_ofld_conn)
+        if (dev->rdev.lldi.enable_fw_ofld_conn &&
+            ep->com.local_addr.ss_family == AF_INET)
                ep->stid = cxgb4_alloc_sftid(dev->rdev.lldi.tids,
                                             cm_id->local_addr.ss_family, ep);
        else
@@ -3323,9 +3285,7 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
        /*
         * Calculate the server tid from filter hit index from cpl_rx_pkt.
         */
-        stid = (__force int) cpu_to_be32((__force u32) rss->hash_val)
+        stid = (__force int) cpu_to_be32((__force u32) rss->hash_val);
-                                          - dev->rdev.lldi.tids->sftid_base
-                                          + dev->rdev.lldi.tids->nstids;
        lep = (struct c4iw_ep *)lookup_stid(dev->rdev.lldi.tids, stid);
        if (!lep) {
@@ -3397,7 +3357,9 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
        window = (__force u16) htons((__force u16)tcph->window);
        /* Calcuate filter portion for LE region. */
-        filter = (__force unsigned int) cpu_to_be32(select_ntuple(dev, dst, e));
+        filter = (__force unsigned int) cpu_to_be32(cxgb4_select_ntuple(
+                                                    dev->rdev.lldi.ports[0],
+                                                    e));
        /*
         * Synthesize the cpl_pass_accept_req. We have everything except the
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 4cb8eb24497c..84e45006451c 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -173,7 +173,7 @@ static int _c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len,
        return ret;
 }
-int _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
+static int _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
 {
        u32 remain = len;
        u32 dmalen;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
index c29b5c838833..cdc7df4fdb8a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
@@ -31,6 +31,7 @@
 */
 #include <linux/netdevice.h>
+#include <linux/if_arp.h>      /* For ARPHRD_xxx */
 #include <linux/module.h>
 #include <net/rtnetlink.h>
 #include "ipoib.h"
@@ -103,7 +104,7 @@ static int ipoib_new_child_link(struct net *src_net, struct net_device *dev,
                return -EINVAL;
        pdev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
-        if (!pdev)
+        if (!pdev || pdev->type != ARPHRD_INFINIBAND)
                return -ENODEV;
        ppriv = netdev_priv(pdev);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 6be57c38638d..9804fca6bf06 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -207,7 +207,9 @@ isert_free_rx_descriptors(struct isert_conn *isert_conn)
        isert_conn->conn_rx_descs = NULL;
 }
+static void isert_cq_tx_work(struct work_struct *);
 static void isert_cq_tx_callback(struct ib_cq *, void *);
+static void isert_cq_rx_work(struct work_struct *);
 static void isert_cq_rx_callback(struct ib_cq *, void *);
 static int
@@ -259,26 +261,36 @@ isert_create_device_ib_res(struct isert_device *device)
                cq_desc[i].device = device;
                cq_desc[i].cq_index = i;
+                INIT_WORK(&cq_desc[i].cq_rx_work, isert_cq_rx_work);
                device->dev_rx_cq[i] = ib_create_cq(device->ib_device,
                                                isert_cq_rx_callback,
                                                isert_cq_event_callback,
                                                (void *)&cq_desc[i],
                                                ISER_MAX_RX_CQ_LEN, i);
-                if (IS_ERR(device->dev_rx_cq[i]))
+                if (IS_ERR(device->dev_rx_cq[i])) {
+                        ret = PTR_ERR(device->dev_rx_cq[i]);
+                        device->dev_rx_cq[i] = NULL;
                        goto out_cq;
+                }
+                INIT_WORK(&cq_desc[i].cq_tx_work, isert_cq_tx_work);
                device->dev_tx_cq[i] = ib_create_cq(device->ib_device,
                                                isert_cq_tx_callback,
                                                isert_cq_event_callback,
                                                (void *)&cq_desc[i],
                                                ISER_MAX_TX_CQ_LEN, i);
-                if (IS_ERR(device->dev_tx_cq[i]))
+                if (IS_ERR(device->dev_tx_cq[i])) {
+                        ret = PTR_ERR(device->dev_tx_cq[i]);
+                        device->dev_tx_cq[i] = NULL;
                        goto out_cq;
+                }
-                if (ib_req_notify_cq(device->dev_rx_cq[i], IB_CQ_NEXT_COMP))
+                ret = ib_req_notify_cq(device->dev_rx_cq[i], IB_CQ_NEXT_COMP);
+                if (ret)
                        goto out_cq;
-                if (ib_req_notify_cq(device->dev_tx_cq[i], IB_CQ_NEXT_COMP))
+                ret = ib_req_notify_cq(device->dev_tx_cq[i], IB_CQ_NEXT_COMP);
+                if (ret)
                        goto out_cq;
        }
@@ -1724,7 +1736,6 @@ isert_cq_tx_callback(struct ib_cq *cq, void *context)
 {
        struct isert_cq_desc *cq_desc = (struct isert_cq_desc *)context;
-        INIT_WORK(&cq_desc->cq_tx_work, isert_cq_tx_work);
        queue_work(isert_comp_wq, &cq_desc->cq_tx_work);
 }
@@ -1768,7 +1779,6 @@ isert_cq_rx_callback(struct ib_cq *cq, void *context)
 {
        struct isert_cq_desc *cq_desc = (struct isert_cq_desc *)context;
-        INIT_WORK(&cq_desc->cq_rx_work, isert_cq_rx_work);
        queue_work(isert_rx_wq, &cq_desc->cq_rx_work);
 }
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 846ccdd905b1..d2965e4b3224 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1871,6 +1871,10 @@ void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int
                break;
        case EV_ABS:
+                input_alloc_absinfo(dev);
+                if (!dev->absinfo)
+                        return;
                __set_bit(code, dev->absbit);
                break;
diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index 75762d6ff3ba..aa127ba392a4 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -455,7 +455,18 @@ static void zforce_complete(struct zforce_ts *ts, int cmd, int result)
        }
 }
-static irqreturn_t zforce_interrupt(int irq, void *dev_id)
+static irqreturn_t zforce_irq(int irq, void *dev_id)
+{
+        struct zforce_ts *ts = dev_id;
+        struct i2c_client *client = ts->client;
+        if (ts->suspended && device_may_wakeup(&client->dev))
+                pm_wakeup_event(&client->dev, 500);
+        return IRQ_WAKE_THREAD;
+}
+static irqreturn_t zforce_irq_thread(int irq, void *dev_id)
 {
        struct zforce_ts *ts = dev_id;
        struct i2c_client *client = ts->client;
@@ -465,12 +476,10 @@ static irqreturn_t zforce_interrupt(int irq, void *dev_id)
        u8 *payload;
        /*
-         * When suspended, emit a wakeup signal if necessary and return.
+         * When still suspended, return.
         * Due to the level-interrupt we will get re-triggered later.
         */
        if (ts->suspended) {
-                if (device_may_wakeup(&client->dev))
-                        pm_wakeup_event(&client->dev, 500);
                msleep(20);
                return IRQ_HANDLED;
        }
@@ -763,8 +772,8 @@ static int zforce_probe(struct i2c_client *client,
         * Therefore we can trigger the interrupt anytime it is low and do
         * not need to limit it to the interrupt edge.
         */
-        ret = devm_request_threaded_irq(&client->dev, client->irq, NULL,
+        ret = devm_request_threaded_irq(&client->dev, client->irq,
-                                        zforce_interrupt,
+                                        zforce_irq, zforce_irq_thread,
                                        IRQF_TRIGGER_LOW | IRQF_ONESHOT,
                                        input_dev->name, ts);
        if (ret) {
diff --git a/drivers/irqchip/irq-renesas-intc-irqpin.c b/drivers/irqchip/irq-renesas-intc-irqpin.c
index 82cec63a9011..3ee78f02e5d7 100644
--- a/drivers/irqchip/irq-renesas-intc-irqpin.c
+++ b/drivers/irqchip/irq-renesas-intc-irqpin.c
@@ -149,8 +149,9 @@ static void intc_irqpin_read_modify_write(struct intc_irqpin_priv *p,
 static void intc_irqpin_mask_unmask_prio(struct intc_irqpin_priv *p,
                                         int irq, int do_mask)
 {
-        int bitfield_width = 4; /* PRIO assumed to have fixed bitfield width */
+        /* The PRIO register is assumed to be 32-bit with fixed 4-bit fields. */
-        int shift = (7 - irq) * bitfield_width; /* PRIO assumed to be 32-bit */
+        int bitfield_width = 4;
+        int shift = 32 - (irq + 1) * bitfield_width;
        intc_irqpin_read_modify_write(p, INTC_IRQPIN_REG_PRIO,
                                      shift, bitfield_width,
@@ -159,8 +160,9 @@ static void intc_irqpin_mask_unmask_prio(struct intc_irqpin_priv *p,
 static int intc_irqpin_set_sense(struct intc_irqpin_priv *p, int irq, int value)
 {
+        /* The SENSE register is assumed to be 32-bit. */
        int bitfield_width = p->config.sense_bitfield_width;
-        int shift = (7 - irq) * bitfield_width; /* SENSE assumed to be 32-bit */
+        int shift = 32 - (irq + 1) * bitfield_width;
        dev_dbg(&p->pdev->dev, "sense irq = %d, mode = %d\n", irq, value);
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 497bd026c237..4a4825528188 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -1643,10 +1643,6 @@ setup_hfcpci(struct IsdnCard *card)
        int i;
        struct pci_dev *tmp_hfcpci = NULL;
-#ifdef __BIG_ENDIAN
-#error "not running on big endian machines now"
-#endif
        strcpy(tmp, hfcpci_revision);
        printk(KERN_INFO "HiSax: HFC-PCI driver Rev. %s\n", HiSax_getrev(tmp));
diff --git a/drivers/isdn/hisax/telespci.c b/drivers/isdn/hisax/telespci.c
index f6ab63aa6995..33eeb4602c7e 100644
--- a/drivers/isdn/hisax/telespci.c
+++ b/drivers/isdn/hisax/telespci.c
@@ -290,10 +290,6 @@ int setup_telespci(struct IsdnCard *card)
        struct IsdnCardState *cs = card->cs;
        char tmp[64];
-#ifdef __BIG_ENDIAN
-#error "not running on big endian machines now"
-#endif
        strcpy(tmp, telespci_revision);
        printk(KERN_INFO "HiSax: Teles/PCI driver Rev. %s\n", HiSax_getrev(tmp));
        if (cs->typ != ISDN_CTYPE_TELESPCI)
diff --git a/drivers/leds/leds-lp5521.c b/drivers/leds/leds-lp5521.c
index 05188351711d..a97263e902ff 100644
--- a/drivers/leds/leds-lp5521.c
+++ b/drivers/leds/leds-lp5521.c
@@ -244,18 +244,12 @@ static int lp5521_update_program_memory(struct lp55xx_chip *chip,
        if (i % 2)
                goto err;
-        mutex_lock(&chip->lock);
        for (i = 0; i < LP5521_PROGRAM_LENGTH; i++) {
                ret = lp55xx_write(chip, addr[idx] + i, pattern[i]);
-                if (ret) {
+                if (ret)
-                        mutex_unlock(&chip->lock);
                        return -EINVAL;
-                }
        }
-        mutex_unlock(&chip->lock);
        return size;
 err:
@@ -427,15 +421,17 @@ static ssize_t store_engine_load(struct device *dev,
 {
        struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev));
        struct lp55xx_chip *chip = led->chip;
+        int ret;
        mutex_lock(&chip->lock);
        chip->engine_idx = nr;
        lp5521_load_engine(chip);
+        ret = lp5521_update_program_memory(chip, buf, len);
        mutex_unlock(&chip->lock);
-        return lp5521_update_program_memory(chip, buf, len);
+        return ret;
 }
 store_load(1)
 store_load(2)
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index 6b553d9f4266..fd9ab5f61441 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -337,18 +337,12 @@ static int lp5523_update_program_memory(struct lp55xx_chip *chip,
        if (i % 2)
                goto err;
-        mutex_lock(&chip->lock);
        for (i = 0; i < LP5523_PROGRAM_LENGTH; i++) {
                ret = lp55xx_write(chip, LP5523_REG_PROG_MEM + i, pattern[i]);
-                if (ret) {
+                if (ret)
-                        mutex_unlock(&chip->lock);
                        return -EINVAL;
-                }
        }
-        mutex_unlock(&chip->lock);
        return size;
 err:
@@ -548,15 +542,17 @@ static ssize_t store_engine_load(struct device *dev,
 {
        struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev));
        struct lp55xx_chip *chip = led->chip;
+        int ret;
        mutex_lock(&chip->lock);
        chip->engine_idx = nr;
        lp5523_load_engine_and_select_page(chip);
+        ret = lp5523_update_program_memory(chip, buf, len);
        mutex_unlock(&chip->lock);
-        return lp5523_update_program_memory(chip, buf, len);
+        return ret;
 }
 store_load(1)
 store_load(2)
diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
index 2b46bf1d7e40..4c9852d92b0a 100644
--- a/drivers/md/bcache/alloc.c
+++ b/drivers/md/bcache/alloc.c
@@ -421,9 +421,11 @@ out:
        if (watermark <= WATERMARK_METADATA) {
                SET_GC_MARK(b, GC_MARK_METADATA);
+                SET_GC_MOVE(b, 0);
                b->prio = BTREE_PRIO;
        } else {
                SET_GC_MARK(b, GC_MARK_RECLAIMABLE);
+                SET_GC_MOVE(b, 0);
                b->prio = INITIAL_PRIO;
        }
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 4beb55a0ff30..754f43177483 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -197,7 +197,7 @@ struct bucket {
        uint8_t         disk_gen;
        uint8_t         last_gc; /* Most out of date gen in the btree */
        uint8_t         gc_gen;
-        uint16_t        gc_mark;
+        uint16_t        gc_mark; /* Bitfield used by GC. See below for field */
 };
 /*
@@ -209,7 +209,8 @@ BITMASK(GC_MARK,	 struct bucket, gc_mark, 0, 2);
 #define GC_MARK_RECLAIMABLE     0
 #define GC_MARK_DIRTY           1
 #define GC_MARK_METADATA        2
-BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 14);
+BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 13);
+BITMASK(GC_MOVE, struct bucket, gc_mark, 15, 1);
 #include "journal.h"
 #include "stats.h"
@@ -372,14 +373,14 @@ struct cached_dev {
        unsigned char           writeback_percent;
        unsigned                writeback_delay;
-        int                     writeback_rate_change;
-        int64_t                 writeback_rate_derivative;
        uint64_t                writeback_rate_target;
+        int64_t                 writeback_rate_proportional;
+        int64_t                 writeback_rate_derivative;
+        int64_t                 writeback_rate_change;
        unsigned                writeback_rate_update_seconds;
        unsigned                writeback_rate_d_term;
        unsigned                writeback_rate_p_term_inverse;
-        unsigned                writeback_rate_d_smooth;
 };
 enum alloc_watermarks {
@@ -445,7 +446,6 @@ struct cache {
         * call prio_write() to keep gens from wrapping.
         */
        uint8_t                 need_save_prio;
-        unsigned                gc_move_threshold;
        /*
         * If nonzero, we know we aren't going to find any buckets to invalidate
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 5e2765aadce1..31bb53fcc67a 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1561,6 +1561,28 @@ size_t bch_btree_gc_finish(struct cache_set *c)
                SET_GC_MARK(PTR_BUCKET(c, &c->uuid_bucket, i),
                            GC_MARK_METADATA);
+        /* don't reclaim buckets to which writeback keys point */
+        rcu_read_lock();
+        for (i = 0; i < c->nr_uuids; i++) {
+                struct bcache_device *d = c->devices[i];
+                struct cached_dev *dc;
+                struct keybuf_key *w, *n;
+                unsigned j;
+                if (!d || UUID_FLASH_ONLY(&c->uuids[i]))
+                        continue;
+                dc = container_of(d, struct cached_dev, disk);
+                spin_lock(&dc->writeback_keys.lock);
+                rbtree_postorder_for_each_entry_safe(w, n,
+                                        &dc->writeback_keys.keys, node)
+                        for (j = 0; j < KEY_PTRS(&w->key); j++)
+                                SET_GC_MARK(PTR_BUCKET(c, &w->key, j),
+                                            GC_MARK_DIRTY);
+                spin_unlock(&dc->writeback_keys.lock);
+        }
+        rcu_read_unlock();
        for_each_cache(ca, c, i) {
                uint64_t *i;
@@ -1817,7 +1839,8 @@ static bool fix_overlapping_extents(struct btree *b, struct bkey *insert,
                        if (KEY_START(k) > KEY_START(insert) + sectors_found)
                                goto check_failed;
-                        if (KEY_PTRS(replace_key) != KEY_PTRS(k))
+                        if (KEY_PTRS(k) != KEY_PTRS(replace_key) ||
+                            KEY_DIRTY(k) != KEY_DIRTY(replace_key))
                                goto check_failed;
                        /* skip past gen */
@@ -2217,7 +2240,7 @@ struct btree_insert_op {
        struct bkey     *replace_key;
 };
-int btree_insert_fn(struct btree_op *b_op, struct btree *b)
+static int btree_insert_fn(struct btree_op *b_op, struct btree *b)
 {
        struct btree_insert_op *op = container_of(b_op,
                                        struct btree_insert_op, op);
diff --git a/drivers/md/bcache/movinggc.c b/drivers/md/bcache/movinggc.c
index 7c1275e66025..f2f0998c4a91 100644
--- a/drivers/md/bcache/movinggc.c
+++ b/drivers/md/bcache/movinggc.c
@@ -25,10 +25,9 @@ static bool moving_pred(struct keybuf *buf, struct bkey *k)
        unsigned i;
        for (i = 0; i < KEY_PTRS(k); i++) {
-                struct cache *ca = PTR_CACHE(c, k, i);
                struct bucket *g = PTR_BUCKET(c, k, i);
-                if (GC_SECTORS_USED(g) < ca->gc_move_threshold)
+                if (GC_MOVE(g))
                        return true;
        }
@@ -65,11 +64,16 @@ static void write_moving_finish(struct closure *cl)
 static void read_moving_endio(struct bio *bio, int error)
 {
+        struct bbio *b = container_of(bio, struct bbio, bio);
        struct moving_io *io = container_of(bio->bi_private,
                                            struct moving_io, cl);
        if (error)
                io->op.error = error;
+        else if (!KEY_DIRTY(&b->key) &&
+                 ptr_stale(io->op.c, &b->key, 0)) {
+                io->op.error = -EINTR;
+        }
        bch_bbio_endio(io->op.c, bio, error, "reading data to move");
 }
@@ -141,6 +145,11 @@ static void read_moving(struct cache_set *c)
                if (!w)
                        break;
+                if (ptr_stale(c, &w->key, 0)) {
+                        bch_keybuf_del(&c->moving_gc_keys, w);
+                        continue;
+                }
                io = kzalloc(sizeof(struct moving_io) + sizeof(struct bio_vec)
                             * DIV_ROUND_UP(KEY_SIZE(&w->key), PAGE_SECTORS),
                             GFP_KERNEL);
@@ -184,7 +193,8 @@ static bool bucket_cmp(struct bucket *l, struct bucket *r)
 static unsigned bucket_heap_top(struct cache *ca)
 {
-        return GC_SECTORS_USED(heap_peek(&ca->heap));
+        struct bucket *b;
+        return (b = heap_peek(&ca->heap)) ? GC_SECTORS_USED(b) : 0;
 }
 void bch_moving_gc(struct cache_set *c)
@@ -226,9 +236,8 @@ void bch_moving_gc(struct cache_set *c)
                        sectors_to_move -= GC_SECTORS_USED(b);
                }
-                ca->gc_move_threshold = bucket_heap_top(ca);
+                while (heap_pop(&ca->heap, b, bucket_cmp))
+                        SET_GC_MOVE(b, 1);
-                pr_debug("threshold %u", ca->gc_move_threshold);
        }
        mutex_unlock(&c->bucket_lock);
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index dec15cd2d797..c57bfa071a57 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1676,7 +1676,7 @@ err:
 static bool can_attach_cache(struct cache *ca, struct cache_set *c)
 {
        return ca->sb.block_size        == c->sb.block_size &&
-                ca->sb.bucket_size      == c->sb.block_size &&
+                ca->sb.bucket_size      == c->sb.bucket_size &&
                ca->sb.nr_in_set        == c->sb.nr_in_set;
 }
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 80d4c2bee18a..a1f85612f0b3 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -83,7 +83,6 @@ rw_attribute(writeback_rate);
 rw_attribute(writeback_rate_update_seconds);
 rw_attribute(writeback_rate_d_term);
 rw_attribute(writeback_rate_p_term_inverse);
-rw_attribute(writeback_rate_d_smooth);
 read_attribute(writeback_rate_debug);
 read_attribute(stripe_size);
@@ -129,31 +128,41 @@ SHOW(__bch_cached_dev)
        var_printf(writeback_running,   "%i");
        var_print(writeback_delay);
        var_print(writeback_percent);
-        sysfs_print(writeback_rate,     dc->writeback_rate.rate);
+        sysfs_hprint(writeback_rate,    dc->writeback_rate.rate << 9);
        var_print(writeback_rate_update_seconds);
        var_print(writeback_rate_d_term);
        var_print(writeback_rate_p_term_inverse);
-        var_print(writeback_rate_d_smooth);
        if (attr == &sysfs_writeback_rate_debug) {
+                char rate[20];
                char dirty[20];
-                char derivative[20];
                char target[20];
-                bch_hprint(dirty,
+                char proportional[20];
-                           bcache_dev_sectors_dirty(&dc->disk) << 9);
+                char derivative[20];
-                bch_hprint(derivative,  dc->writeback_rate_derivative << 9);
+                char change[20];
+                s64 next_io;
+                bch_hprint(rate,        dc->writeback_rate.rate << 9);
+                bch_hprint(dirty,       bcache_dev_sectors_dirty(&dc->disk) << 9);
                bch_hprint(target,      dc->writeback_rate_target << 9);
+                bch_hprint(proportional,dc->writeback_rate_proportional << 9);
+                bch_hprint(derivative,  dc->writeback_rate_derivative << 9);
+                bch_hprint(change,      dc->writeback_rate_change << 9);
+                next_io = div64_s64(dc->writeback_rate.next - local_clock(),
+                                    NSEC_PER_MSEC);
                return sprintf(buf,
-                               "rate:\t\t%u\n"
+                               "rate:\t\t%s/sec\n"
-                               "change:\t\t%i\n"
                               "dirty:\t\t%s\n"
+                               "target:\t\t%s\n"
+                               "proportional:\t%s\n"
                               "derivative:\t%s\n"
-                               "target:\t\t%s\n",
+                               "change:\t\t%s/sec\n"
-                               dc->writeback_rate.rate,
+                               "next io:\t%llims\n",
-                               dc->writeback_rate_change,
+                               rate, dirty, target, proportional,
-                               dirty, derivative, target);
+                               derivative, change, next_io);
        }
        sysfs_hprint(dirty_data,
@@ -189,6 +198,7 @@ STORE(__cached_dev)
        struct kobj_uevent_env *env;
 #define d_strtoul(var)          sysfs_strtoul(var, dc->var)
+#define d_strtoul_nonzero(var)  sysfs_strtoul_clamp(var, dc->var, 1, INT_MAX)
 #define d_strtoi_h(var)         sysfs_hatoi(var, dc->var)
        sysfs_strtoul(data_csum,        dc->disk.data_csum);
@@ -197,16 +207,15 @@ STORE(__cached_dev)
        d_strtoul(writeback_metadata);
        d_strtoul(writeback_running);
        d_strtoul(writeback_delay);
-        sysfs_strtoul_clamp(writeback_rate,
-                            dc->writeback_rate.rate, 1, 1000000);
        sysfs_strtoul_clamp(writeback_percent, dc->writeback_percent, 0, 40);
-        d_strtoul(writeback_rate_update_seconds);
+        sysfs_strtoul_clamp(writeback_rate,
+                            dc->writeback_rate.rate, 1, INT_MAX);
+        d_strtoul_nonzero(writeback_rate_update_seconds);
        d_strtoul(writeback_rate_d_term);
-        d_strtoul(writeback_rate_p_term_inverse);
+        d_strtoul_nonzero(writeback_rate_p_term_inverse);
-        sysfs_strtoul_clamp(writeback_rate_p_term_inverse,
-                            dc->writeback_rate_p_term_inverse, 1, INT_MAX);
-        d_strtoul(writeback_rate_d_smooth);
        d_strtoi_h(sequential_cutoff);
        d_strtoi_h(readahead);
@@ -313,7 +322,6 @@ static struct attribute *bch_cached_dev_files[] = {
        &sysfs_writeback_rate_update_seconds,
        &sysfs_writeback_rate_d_term,
        &sysfs_writeback_rate_p_term_inverse,
-        &sysfs_writeback_rate_d_smooth,
        &sysfs_writeback_rate_debug,
        &sysfs_dirty_data,
        &sysfs_stripe_size,
diff --git a/drivers/md/bcache/util.c b/drivers/md/bcache/util.c
index 462214eeacbe..bb37618e7664 100644
--- a/drivers/md/bcache/util.c
+++ b/drivers/md/bcache/util.c
@@ -209,7 +209,13 @@ uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done)
 {
        uint64_t now = local_clock();
-        d->next += div_u64(done, d->rate);
+        d->next += div_u64(done * NSEC_PER_SEC, d->rate);
+        if (time_before64(now + NSEC_PER_SEC, d->next))
+                d->next = now + NSEC_PER_SEC;
+        if (time_after64(now - NSEC_PER_SEC * 2, d->next))
+                d->next = now - NSEC_PER_SEC * 2;
        return time_after64(d->next, now)
                ? div_u64(d->next - now, NSEC_PER_SEC / HZ)
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index 362c4b3f8b4a..1030c6020e98 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -110,7 +110,7 @@ do {									\
        _r;                                                             \
 })
-#define heap_peek(h)    ((h)->size ? (h)->data[0] : NULL)
+#define heap_peek(h)    ((h)->used ? (h)->data[0] : NULL)
 #define heap_full(h)    ((h)->used == (h)->size)
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 99053b1251be..6c44fe059c27 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -30,38 +30,40 @@ static void __update_writeback_rate(struct cached_dev *dc)
        /* PD controller */
-        int change = 0;
-        int64_t error;
        int64_t dirty = bcache_dev_sectors_dirty(&dc->disk);
        int64_t derivative = dirty - dc->disk.sectors_dirty_last;
+        int64_t proportional = dirty - target;
+        int64_t change;
        dc->disk.sectors_dirty_last = dirty;
-        derivative *= dc->writeback_rate_d_term;
+        /* Scale to sectors per second */
-        derivative = clamp(derivative, -dirty, dirty);
-        derivative = ewma_add(dc->disk.sectors_dirty_derivative, derivative,
+        proportional *= dc->writeback_rate_update_seconds;
-                              dc->writeback_rate_d_smooth, 0);
+        proportional = div_s64(proportional, dc->writeback_rate_p_term_inverse);
-        /* Avoid divide by zero */
+        derivative = div_s64(derivative, dc->writeback_rate_update_seconds);
-        if (!target)
-                goto out;
-        error = div64_s64((dirty + derivative - target) << 8, target);
+        derivative = ewma_add(dc->disk.sectors_dirty_derivative, derivative,
+                              (dc->writeback_rate_d_term /
+                               dc->writeback_rate_update_seconds) ?: 1, 0);
+        derivative *= dc->writeback_rate_d_term;
+        derivative = div_s64(derivative, dc->writeback_rate_p_term_inverse);
-        change = div_s64((dc->writeback_rate.rate * error) >> 8,
+        change = proportional + derivative;
-                         dc->writeback_rate_p_term_inverse);
        /* Don't increase writeback rate if the device isn't keeping up */
        if (change > 0 &&
            time_after64(local_clock(),
-                         dc->writeback_rate.next + 10 * NSEC_PER_MSEC))
+                         dc->writeback_rate.next + NSEC_PER_MSEC))
                change = 0;
        dc->writeback_rate.rate =
-                clamp_t(int64_t, dc->writeback_rate.rate + change,
+                clamp_t(int64_t, (int64_t) dc->writeback_rate.rate + change,
                        1, NSEC_PER_MSEC);
-out:
+        dc->writeback_rate_proportional = proportional;
        dc->writeback_rate_derivative = derivative;
        dc->writeback_rate_change = change;
        dc->writeback_rate_target = target;
@@ -87,15 +89,11 @@ static void update_writeback_rate(struct work_struct *work)
 static unsigned writeback_delay(struct cached_dev *dc, unsigned sectors)
 {
-        uint64_t ret;
        if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) ||
            !dc->writeback_percent)
                return 0;
-        ret = bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
+        return bch_next_delay(&dc->writeback_rate, sectors);
-        return min_t(uint64_t, ret, HZ);
 }
 struct dirty_io {
@@ -241,7 +239,7 @@ static void read_dirty(struct cached_dev *dc)
                if (KEY_START(&w->key) != dc->last_read ||
                    jiffies_to_msecs(delay) > 50)
                        while (!kthread_should_stop() && delay)
-                                delay = schedule_timeout_interruptible(delay);
+                                delay = schedule_timeout_uninterruptible(delay);
                dc->last_read   = KEY_OFFSET(&w->key);
@@ -438,7 +436,7 @@ static int bch_writeback_thread(void *arg)
                        while (delay &&
                               !kthread_should_stop() &&
                               !test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags))
-                                delay = schedule_timeout_interruptible(delay);
+                                delay = schedule_timeout_uninterruptible(delay);
                }
        }
@@ -476,6 +474,8 @@ void bch_sectors_dirty_init(struct cached_dev *dc)
        bch_btree_map_keys(&op.op, dc->disk.c, &KEY(op.inode, 0, 0),
                           sectors_dirty_init_fn, 0);
+        dc->disk.sectors_dirty_last = bcache_dev_sectors_dirty(&dc->disk);
 }
 int bch_cached_dev_writeback_init(struct cached_dev *dc)
@@ -490,18 +490,15 @@ int bch_cached_dev_writeback_init(struct cached_dev *dc)
        dc->writeback_delay             = 30;
        dc->writeback_rate.rate         = 1024;
-        dc->writeback_rate_update_seconds = 30;
+        dc->writeback_rate_update_seconds = 5;
-        dc->writeback_rate_d_term       = 16;
+        dc->writeback_rate_d_term       = 30;
-        dc->writeback_rate_p_term_inverse = 64;
+        dc->writeback_rate_p_term_inverse = 6000;
-        dc->writeback_rate_d_smooth     = 8;
        dc->writeback_thread = kthread_create(bch_writeback_thread, dc,
                                              "bcache_writeback");
        if (IS_ERR(dc->writeback_thread))
                return PTR_ERR(dc->writeback_thread);
-        set_task_state(dc->writeback_thread, TASK_INTERRUPTIBLE);
        INIT_DELAYED_WORK(&dc->writeback_rate_update, update_writeback_rate);
        schedule_delayed_work(&dc->writeback_rate_update,
                              dc->writeback_rate_update_seconds * HZ);
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index 6841d6805fd6..41ab5e34d2ac 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -245,7 +245,7 @@ static int pcf50633_probe(struct i2c_client *client,
        for (i = 0; i < PCF50633_NUM_REGULATORS; i++) {
                struct platform_device *pdev;
-                pdev = platform_device_alloc("pcf50633-regltr", i);
+                pdev = platform_device_alloc("pcf50633-regulator", i);
                if (!pdev) {
                        dev_err(pcf->dev, "Cannot create regulator %d\n", i);
                        continue;
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index 11e20afbdcac..705698fd2c7e 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -1228,8 +1228,14 @@ static void rtsx_pci_remove(struct pci_dev *pcidev)
        pcr->remove_pci = true;
-        cancel_delayed_work(&pcr->carddet_work);
+        /* Disable interrupts at the pcr level */
-        cancel_delayed_work(&pcr->idle_work);
+        spin_lock_irq(&pcr->lock);
+        rtsx_pci_writel(pcr, RTSX_BIER, 0);
+        pcr->bier = 0;
+        spin_unlock_irq(&pcr->lock);
+        cancel_delayed_work_sync(&pcr->carddet_work);
+        cancel_delayed_work_sync(&pcr->idle_work);
        mfd_remove_devices(&pcidev->dev);
diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
index d210d131fef2..0f55589a56b8 100644
--- a/drivers/mtd/maps/pxa2xx-flash.c
+++ b/drivers/mtd/maps/pxa2xx-flash.c
@@ -73,7 +73,7 @@ static int pxa2xx_flash_probe(struct platform_device *pdev)
                return -ENOMEM;
        }
        info->map.cached =
-                ioremap_cached(info->map.phys, info->map.size);
+                ioremap_cache(info->map.phys, info->map.size);
        if (!info->map.cached)
                printk(KERN_WARNING "Failed to ioremap cached %s\n",
                       info->map.name);
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 187b1b7772ef..4ced59436558 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2201,20 +2201,25 @@ void bond_3ad_adapter_speed_changed(struct slave *slave)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("Warning: %s: speed changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
+        __get_state_machine_lock(port);
        port->actor_admin_port_key &= ~AD_SPEED_KEY_BITS;
        port->actor_oper_port_key = port->actor_admin_port_key |=
                (__get_link_speed(port) << 1);
        pr_debug("Port %d changed speed\n", port->actor_port_number);
-        // there is no need to reselect a new aggregator, just signal the
+        /* there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /**
@@ -2229,20 +2234,25 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("%s: Warning: duplex changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
+        __get_state_machine_lock(port);
        port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
        port->actor_oper_port_key = port->actor_admin_port_key |=
                __get_duplex(port);
        pr_debug("Port %d changed duplex\n", port->actor_port_number);
-        // there is no need to reselect a new aggregator, just signal the
+        /* there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /**
@@ -2258,15 +2268,21 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("Warning: %s: link status changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
-        // on link down we are zeroing duplex and speed since some of the adaptors(ce1000.lan) report full duplex/speed instead of N/A(duplex) / 0(speed)
+        __get_state_machine_lock(port);
-        // on link up we are forcing recheck on the duplex and speed since some of he adaptors(ce1000.lan) report
+        /* on link down we are zeroing duplex and speed since
+         * some of the adaptors(ce1000.lan) report full duplex/speed
+         * instead of N/A(duplex) / 0(speed).
+         *
+         * on link up we are forcing recheck on the duplex and speed since
+         * some of he adaptors(ce1000.lan) report.
+         */
        if (link == BOND_LINK_UP) {
                port->is_enabled = true;
                port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
@@ -2282,10 +2298,15 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
                port->actor_oper_port_key = (port->actor_admin_port_key &=
                                             ~AD_SPEED_KEY_BITS);
        }
-        //BOND_PRINT_DBG(("Port %d changed link status to %s", port->actor_port_number, ((link == BOND_LINK_UP)?"UP":"DOWN")));
+        pr_debug("Port %d changed link status to %s",
-        // there is no need to reselect a new aggregator, just signal the
+                port->actor_port_number,
-        // state machines to reinitialize
+                (link == BOND_LINK_UP) ? "UP" : "DOWN");
+        /* there is no need to reselect a new aggregator, just signal the
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /*
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 398e299ee1bd..4b8c58b0ec24 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3732,7 +3732,8 @@ static inline int bond_slave_override(struct bonding *bond,
 }
-static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb,
+                             void *accel_priv)
 {
        /*
         * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 5f9a7ad9b964..8aeec0b4601a 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -625,6 +625,7 @@ static int ems_usb_start(struct ems_usb *dev)
                        usb_unanchor_urb(urb);
                        usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,
                                          urb->transfer_dma);
+                        usb_free_urb(urb);
                        break;
                }
@@ -798,8 +799,8 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
         * allowed (MAX_TX_URBS).
         */
        if (!context) {
-                usb_unanchor_urb(urb);
                usb_free_coherent(dev->udev, size, buf, urb->transfer_dma);
+                usb_free_urb(urb);
                netdev_warn(netdev, "couldn't find free context\n");
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 8ee9d1556e6e..263dd921edc4 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -927,6 +927,9 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
        /* set LED in default state (end of init phase) */
        pcan_usb_pro_set_led(dev, 0, 1);
+        kfree(bi);
+        kfree(fi);
        return 0;
 err_out:
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index b2ffad1304d2..248baf6273fb 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -565,6 +565,8 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
        /* Make sure pointer to data buffer is set */
        wmb();
+        skb_tx_timestamp(skb);
        *info = cpu_to_le32(FOR_EMAC | FIRST_OR_LAST_MASK | len);
        /* Increment index to point to the next BD */
@@ -579,8 +581,6 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
        arc_reg_set(priv, R_STATUS, TXPL_MASK);
-        skb_tx_timestamp(skb);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index a36a760ada28..29801750f239 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -145,9 +145,11 @@ static void atl1c_reset_pcie(struct atl1c_hw *hw, u32 flag)
         * Mask some pcie error bits
         */
        pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
-        pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &data);
+        if (pos) {
-        data &= ~(PCI_ERR_UNC_DLP | PCI_ERR_UNC_FCP);
+                pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &data);
-        pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, data);
+                data &= ~(PCI_ERR_UNC_DLP | PCI_ERR_UNC_FCP);
+                pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, data);
+        }
        /* clear error status */
        pcie_capability_write_word(pdev, PCI_EXP_DEVSTA,
                        PCI_EXP_DEVSTA_NFED |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index a1f66e2c9a86..ec6119089b82 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -520,10 +520,12 @@ struct bnx2x_fastpath {
 #define BNX2X_FP_STATE_IDLE                   0
 #define BNX2X_FP_STATE_NAPI             (1 << 0)    /* NAPI owns this FP */
 #define BNX2X_FP_STATE_POLL             (1 << 1)    /* poll owns this FP */
-#define BNX2X_FP_STATE_NAPI_YIELD       (1 << 2)    /* NAPI yielded this FP */
+#define BNX2X_FP_STATE_DISABLED         (1 << 2)
-#define BNX2X_FP_STATE_POLL_YIELD       (1 << 3)    /* poll yielded this FP */
+#define BNX2X_FP_STATE_NAPI_YIELD       (1 << 3)    /* NAPI yielded this FP */
+#define BNX2X_FP_STATE_POLL_YIELD       (1 << 4)    /* poll yielded this FP */
+#define BNX2X_FP_OWNED  (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
 #define BNX2X_FP_YIELD  (BNX2X_FP_STATE_NAPI_YIELD | BNX2X_FP_STATE_POLL_YIELD)
-#define BNX2X_FP_LOCKED (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
+#define BNX2X_FP_LOCKED (BNX2X_FP_OWNED | BNX2X_FP_STATE_DISABLED)
 #define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
        /* protect state */
        spinlock_t lock;
@@ -613,7 +615,7 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
 {
        bool rc = true;
-        spin_lock(&fp->lock);
+        spin_lock_bh(&fp->lock);
        if (fp->state & BNX2X_FP_LOCKED) {
                WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
                fp->state |= BNX2X_FP_STATE_NAPI_YIELD;
@@ -622,7 +624,7 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
                /* we don't care if someone yielded */
                fp->state = BNX2X_FP_STATE_NAPI;
        }
-        spin_unlock(&fp->lock);
+        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -631,14 +633,16 @@ static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
 {
        bool rc = false;
-        spin_lock(&fp->lock);
+        spin_lock_bh(&fp->lock);
        WARN_ON(fp->state &
                (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_NAPI_YIELD));
        if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
                rc = true;
-        fp->state = BNX2X_FP_STATE_IDLE;
-        spin_unlock(&fp->lock);
+        /* state ==> idle, unless currently disabled */
+        fp->state &= BNX2X_FP_STATE_DISABLED;
+        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -669,7 +673,9 @@ static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
        if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
                rc = true;
-        fp->state = BNX2X_FP_STATE_IDLE;
+        /* state ==> idle, unless currently disabled */
+        fp->state &= BNX2X_FP_STATE_DISABLED;
        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -677,9 +683,23 @@ static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
 /* true if a socket is polling, even if it did not get the lock */
 static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
-        WARN_ON(!(fp->state & BNX2X_FP_LOCKED));
+        WARN_ON(!(fp->state & BNX2X_FP_OWNED));
        return fp->state & BNX2X_FP_USER_PEND;
 }
+/* false if fp is currently owned */
+static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+{
+        int rc = true;
+        spin_lock_bh(&fp->lock);
+        if (fp->state & BNX2X_FP_OWNED)
+                rc = false;
+        fp->state |= BNX2X_FP_STATE_DISABLED;
+        spin_unlock_bh(&fp->lock);
+        return rc;
+}
 #else
 static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
 {
@@ -709,6 +729,10 @@ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
        return false;
 }
+static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+{
+        return true;
+}
 #endif /* CONFIG_NET_RX_BUSY_POLL */
 /* Use 2500 as a mini-jumbo MTU for FCoE */
@@ -1250,7 +1274,10 @@ struct bnx2x_slowpath {
         * Therefore, if they would have been defined in the same union,
         * data can get corrupted.
         */
-        struct afex_vif_list_ramrod_data func_afex_rdata;
+        union {
+                struct afex_vif_list_ramrod_data        viflist_data;
+                struct function_update_data             func_update;
+        } func_afex_rdata;
        /* used by dmae command executer */
        struct dmae_command             dmae[MAX_DMAE_C];
@@ -2499,4 +2526,6 @@ void bnx2x_set_local_cmng(struct bnx2x *bp);
 #define MCPR_SCRATCH_BASE(bp) \
        (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
+#define E1H_MAX_MF_SB_COUNT (HC_SB_MAX_SB_E1X/(E1HVN_MAX * PORT_MAX))
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ec96130533cc..bf811565ee24 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -160,6 +160,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        struct sk_buff *skb = tx_buf->skb;
        u16 bd_idx = TX_BD(tx_buf->first_bd), new_cons;
        int nbd;
+        u16 split_bd_len = 0;
        /* prefetch skb end pointer to speedup dev_kfree_skb() */
        prefetch(&skb->end);
@@ -167,10 +168,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        DP(NETIF_MSG_TX_DONE, "fp[%d]: pkt_idx %d  buff @(%p)->skb %p\n",
           txdata->txq_index, idx, tx_buf, skb);
-        /* unmap first bd */
        tx_start_bd = &txdata->tx_desc_ring[bd_idx].start_bd;
-        dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
-                         BD_UNMAP_LEN(tx_start_bd), DMA_TO_DEVICE);
        nbd = le16_to_cpu(tx_start_bd->nbd) - 1;
 #ifdef BNX2X_STOP_ON_ERROR
@@ -188,12 +186,19 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        --nbd;
        bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
-        /* ...and the TSO split header bd since they have no mapping */
+        /* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
        if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
+                tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
+                split_bd_len = BD_UNMAP_LEN(tx_data_bd);
                --nbd;
                bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
        }
+        /* unmap first bd */
+        dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
+                         BD_UNMAP_LEN(tx_start_bd) + split_bd_len,
+                         DMA_TO_DEVICE);
        /* now free frags */
        while (nbd > 0) {
@@ -1790,26 +1795,22 @@ static void bnx2x_napi_disable_cnic(struct bnx2x *bp)
 {
        int i;
-        local_bh_disable();
        for_each_rx_queue_cnic(bp, i) {
                napi_disable(&bnx2x_fp(bp, i, napi));
-                while (!bnx2x_fp_lock_napi(&bp->fp[i]))
+                while (!bnx2x_fp_ll_disable(&bp->fp[i]))
-                        mdelay(1);
+                        usleep_range(1000, 2000);
        }
-        local_bh_enable();
 }
 static void bnx2x_napi_disable(struct bnx2x *bp)
 {
        int i;
-        local_bh_disable();
        for_each_eth_queue(bp, i) {
                napi_disable(&bnx2x_fp(bp, i, napi));
-                while (!bnx2x_fp_lock_napi(&bp->fp[i]))
+                while (!bnx2x_fp_ll_disable(&bp->fp[i]))
-                        mdelay(1);
+                        usleep_range(1000, 2000);
        }
-        local_bh_enable();
 }
 void bnx2x_netif_start(struct bnx2x *bp)
@@ -1832,7 +1833,8 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
                bnx2x_napi_disable_cnic(bp);
 }
-u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
+u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+                       void *accel_priv)
 {
        struct bnx2x *bp = netdev_priv(dev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index da8fcaa74495..41f3ca5ad972 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -524,7 +524,8 @@ int bnx2x_set_vf_mac(struct net_device *dev, int queue, u8 *mac);
 int bnx2x_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos);
 /* select_queue callback */
-u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb);
+u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+                       void *accel_priv);
 static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
                                        struct bnx2x_fastpath *fp,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 20dcc02431ca..11fc79585491 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -3865,6 +3865,19 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                bnx2x_warpcore_enable_AN_KR2(phy, params, vars);
        } else {
+                /* Enable Auto-Detect to support 1G over CL37 as well */
+                bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                                 MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X1, 0x10);
+                /* Force cl48 sync_status LOW to avoid getting stuck in CL73
+                 * parallel-detect loop when CL73 and CL37 are enabled.
+                 */
+                CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
+                                  MDIO_AER_BLOCK_AER_REG, 0);
+                bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                                 MDIO_WC_REG_RXB_ANA_RX_CONTROL_PCI, 0x0800);
+                bnx2x_set_aer_mmd(params, phy);
                bnx2x_disable_kr2(params, vars, phy);
        }
@@ -8120,17 +8133,20 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                                *edc_mode = EDC_MODE_ACTIVE_DAC;
                        else
                                check_limiting_mode = 1;
-                } else if (copper_module_type &
+                } else {
-                        SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
+                        *edc_mode = EDC_MODE_PASSIVE_DAC;
+                        /* Even in case PASSIVE_DAC indication is not set,
+                         * treat it as a passive DAC cable, since some cables
+                         * don't have this indication.
+                         */
+                        if (copper_module_type &
+                            SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
                                DP(NETIF_MSG_LINK,
                                   "Passive Copper cable detected\n");
-                                *edc_mode =
+                        } else {
-                                      EDC_MODE_PASSIVE_DAC;
+                                DP(NETIF_MSG_LINK,
-                } else {
+                                   "Unknown copper-cable-type\n");
-                        DP(NETIF_MSG_LINK,
+                        }
-                           "Unknown copper-cable-type 0x%x !!!\n",
-                           copper_module_type);
-                        return -EINVAL;
                }
                break;
        }
@@ -10825,9 +10841,9 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
                           (1<<11));
        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
+             (phy->speed_cap_mask &
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
+              PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
-                        (phy->req_line_speed == SPEED_1000)) {
+            (phy->req_line_speed == SPEED_1000)) {
                an_1000_val |= (1<<8);
                autoneg_val |= (1<<9 | 1<<12);
                if (phy->req_duplex == DUPLEX_FULL)
@@ -10843,30 +10859,32 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
                        0x09,
                        &an_1000_val);
-        /* Set 100 speed advertisement */
+        /* Advertise 10/100 link speed */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+        if (phy->req_line_speed == SPEED_AUTO_NEG) {
-                        (phy->speed_cap_mask &
+                if (phy->speed_cap_mask &
-                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF) {
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF)))) {
+                        an_10_100_val |= (1<<5);
-                an_10_100_val |= (1<<7);
+                        autoneg_val |= (1<<9 | 1<<12);
-                /* Enable autoneg and restart autoneg for legacy speeds */
+                        DP(NETIF_MSG_LINK, "Advertising 10M-HD\n");
-                autoneg_val |= (1<<9 | 1<<12);
+                }
+                if (phy->speed_cap_mask &
-                if (phy->req_duplex == DUPLEX_FULL)
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) {
-                        an_10_100_val |= (1<<8);
-                DP(NETIF_MSG_LINK, "Advertising 100M\n");
-        }
-        /* Set 10 speed advertisement */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
-                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)))) {
-                an_10_100_val |= (1<<5);
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
                        an_10_100_val |= (1<<6);
-                DP(NETIF_MSG_LINK, "Advertising 10M\n");
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-FD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF) {
+                        an_10_100_val |= (1<<7);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-HD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL) {
+                        an_10_100_val |= (1<<8);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-FD\n");
+                }
        }
        /* Only 10/100 are allowed to work in FORCE mode */
@@ -13342,6 +13360,10 @@ static u8 bnx2x_analyze_link_error(struct link_params *params,
        DP(NETIF_MSG_LINK, "Link changed:[%x %x]->%x\n", vars->link_up,
           old_status, status);
+        /* Do not touch the link in case physical link down */
+        if ((vars->phy_flags & PHY_PHYSICAL_LINK_FLAG) == 0)
+                return 1;
        /* a. Update shmem->link_status accordingly
         * b. Update link_vars->link_up
         */
@@ -13550,7 +13572,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
         */
        not_kr2_device = (((base_page & 0x8000) == 0) ||
                          (((base_page & 0x8000) &&
-                            ((next_page & 0xe0) == 0x2))));
+                            ((next_page & 0xe0) == 0x20))));
        /* In case KR2 is already disabled, check if we need to re-enable it */
        if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 814d0eca9b33..8b3107b2fcc1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -11447,9 +11447,9 @@ static int bnx2x_get_hwinfo(struct bnx2x *bp)
                }
        }
-        /* adjust igu_sb_cnt to MF for E1x */
+        /* adjust igu_sb_cnt to MF for E1H */
-        if (CHIP_IS_E1x(bp) && IS_MF(bp))
+        if (CHIP_IS_E1H(bp) && IS_MF(bp))
-                bp->igu_sb_cnt /= E1HVN_MAX;
+                bp->igu_sb_cnt = min_t(u8, bp->igu_sb_cnt, E1H_MAX_MF_SB_COUNT);
        /* port info */
        bnx2x_get_port_hwinfo(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index 3efbb35267c8..14ffb6e56e59 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -7179,6 +7179,7 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_WC_REG_RX1_PCI_CTRL                        0x80ca
 #define MDIO_WC_REG_RX2_PCI_CTRL                        0x80da
 #define MDIO_WC_REG_RX3_PCI_CTRL                        0x80ea
+#define MDIO_WC_REG_RXB_ANA_RX_CONTROL_PCI              0x80fa
 #define MDIO_WC_REG_XGXSBLK2_UNICORE_MODE_10G           0x8104
 #define MDIO_WC_REG_XGXS_STATUS3                        0x8129
 #define MDIO_WC_REG_PAR_DET_10G_STATUS                  0x8130
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 32c92abf5094..18438a504d57 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -2038,6 +2038,7 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
        struct bnx2x_vlan_mac_ramrod_params p;
        struct bnx2x_exe_queue_obj *exeq = &o->exe_queue;
        struct bnx2x_exeq_elem *exeq_pos, *exeq_pos_n;
+        unsigned long flags;
        int read_lock;
        int rc = 0;
@@ -2046,8 +2047,9 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
        spin_lock_bh(&exeq->lock);
        list_for_each_entry_safe(exeq_pos, exeq_pos_n, &exeq->exe_queue, link) {
-                if (exeq_pos->cmd_data.vlan_mac.vlan_mac_flags ==
+                flags = exeq_pos->cmd_data.vlan_mac.vlan_mac_flags;
-                    *vlan_mac_flags) {
+                if (BNX2X_VLAN_MAC_CMP_FLAGS(flags) ==
+                    BNX2X_VLAN_MAC_CMP_FLAGS(*vlan_mac_flags)) {
                        rc = exeq->remove(bp, exeq->owner, exeq_pos);
                        if (rc) {
                                BNX2X_ERR("Failed to remove command\n");
@@ -2080,7 +2082,9 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
                return read_lock;
        list_for_each_entry(pos, &o->head, link) {
-                if (pos->vlan_mac_flags == *vlan_mac_flags) {
+                flags = pos->vlan_mac_flags;
+                if (BNX2X_VLAN_MAC_CMP_FLAGS(flags) ==
+                    BNX2X_VLAN_MAC_CMP_FLAGS(*vlan_mac_flags)) {
                        p.user_req.vlan_mac_flags = pos->vlan_mac_flags;
                        memcpy(&p.user_req.u, &pos->u, sizeof(pos->u));
                        rc = bnx2x_config_vlan_mac(bp, &p);
@@ -4382,8 +4386,11 @@ int bnx2x_config_rss(struct bnx2x *bp,
        struct bnx2x_raw_obj *r = &o->raw;
        /* Do nothing if only driver cleanup was requested */
-        if (test_bit(RAMROD_DRV_CLR_ONLY, &p->ramrod_flags))
+        if (test_bit(RAMROD_DRV_CLR_ONLY, &p->ramrod_flags)) {
+                DP(BNX2X_MSG_SP, "Not configuring RSS ramrod_flags=%lx\n",
+                   p->ramrod_flags);
                return 0;
+        }
        r->set_pending(r);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
index 658f4e33abf9..6a53c15c85a3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
@@ -266,6 +266,13 @@ enum {
        BNX2X_DONT_CONSUME_CAM_CREDIT,
        BNX2X_DONT_CONSUME_CAM_CREDIT_DEST,
 };
+/* When looking for matching filters, some flags are not interesting */
+#define BNX2X_VLAN_MAC_CMP_MASK (1 << BNX2X_UC_LIST_MAC | \
+                                 1 << BNX2X_ETH_MAC | \
+                                 1 << BNX2X_ISCSI_ETH_MAC | \
+                                 1 << BNX2X_NETQ_ETH_MAC)
+#define BNX2X_VLAN_MAC_CMP_FLAGS(flags) \
+        ((flags) & BNX2X_VLAN_MAC_CMP_MASK)
 struct bnx2x_vlan_mac_ramrod_params {
        /* Object to run the command from */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 2e46c28fc601..e7845e5be1c7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1209,6 +1209,11 @@ static void bnx2x_vfop_rxmode(struct bnx2x *bp, struct bnx2x_virtf *vf)
                /* next state */
                vfop->state = BNX2X_VFOP_RXMODE_DONE;
+                /* record the accept flags in vfdb so hypervisor can modify them
+                 * if necessary
+                 */
+                bnx2x_vfq(vf, ramrod->cl_id - vf->igu_base_id, accept_flags) =
+                        ramrod->rx_accept_flags;
                vfop->rc = bnx2x_config_rx_mode(bp, ramrod);
                bnx2x_vfop_finalize(vf, vfop->rc, VFOP_DONE);
 op_err:
@@ -1224,39 +1229,43 @@ op_pending:
        return;
 }
+static void bnx2x_vf_prep_rx_mode(struct bnx2x *bp, u8 qid,
+                                  struct bnx2x_rx_mode_ramrod_params *ramrod,
+                                  struct bnx2x_virtf *vf,
+                                  unsigned long accept_flags)
+{
+        struct bnx2x_vf_queue *vfq = vfq_get(vf, qid);
+        memset(ramrod, 0, sizeof(*ramrod));
+        ramrod->cid = vfq->cid;
+        ramrod->cl_id = vfq_cl_id(vf, vfq);
+        ramrod->rx_mode_obj = &bp->rx_mode_obj;
+        ramrod->func_id = FW_VF_HANDLE(vf->abs_vfid);
+        ramrod->rx_accept_flags = accept_flags;
+        ramrod->tx_accept_flags = accept_flags;
+        ramrod->pstate = &vf->filter_state;
+        ramrod->state = BNX2X_FILTER_RX_MODE_PENDING;
+        set_bit(BNX2X_FILTER_RX_MODE_PENDING, &vf->filter_state);
+        set_bit(RAMROD_RX, &ramrod->ramrod_flags);
+        set_bit(RAMROD_TX, &ramrod->ramrod_flags);
+        ramrod->rdata = bnx2x_vf_sp(bp, vf, rx_mode_rdata.e2);
+        ramrod->rdata_mapping = bnx2x_vf_sp_map(bp, vf, rx_mode_rdata.e2);
+}
 int bnx2x_vfop_rxmode_cmd(struct bnx2x *bp,
                          struct bnx2x_virtf *vf,
                          struct bnx2x_vfop_cmd *cmd,
                          int qid, unsigned long accept_flags)
 {
-        struct bnx2x_vf_queue *vfq = vfq_get(vf, qid);
        struct bnx2x_vfop *vfop = bnx2x_vfop_add(bp, vf);
        if (vfop) {
                struct bnx2x_rx_mode_ramrod_params *ramrod =
                        &vf->op_params.rx_mode;
-                memset(ramrod, 0, sizeof(*ramrod));
+                bnx2x_vf_prep_rx_mode(bp, qid, ramrod, vf, accept_flags);
-                /* Prepare ramrod parameters */
-                ramrod->cid = vfq->cid;
-                ramrod->cl_id = vfq_cl_id(vf, vfq);
-                ramrod->rx_mode_obj = &bp->rx_mode_obj;
-                ramrod->func_id = FW_VF_HANDLE(vf->abs_vfid);
-                ramrod->rx_accept_flags = accept_flags;
-                ramrod->tx_accept_flags = accept_flags;
-                ramrod->pstate = &vf->filter_state;
-                ramrod->state = BNX2X_FILTER_RX_MODE_PENDING;
-                set_bit(BNX2X_FILTER_RX_MODE_PENDING, &vf->filter_state);
-                set_bit(RAMROD_RX, &ramrod->ramrod_flags);
-                set_bit(RAMROD_TX, &ramrod->ramrod_flags);
-                ramrod->rdata =
-                        bnx2x_vf_sp(bp, vf, rx_mode_rdata.e2);
-                ramrod->rdata_mapping =
-                        bnx2x_vf_sp_map(bp, vf, rx_mode_rdata.e2);
                bnx2x_vfop_opset(BNX2X_VFOP_RXMODE_CONFIG,
                                 bnx2x_vfop_rxmode, cmd->done);
@@ -3202,13 +3211,16 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                bnx2x_iov_static_resc(bp, vf);
        }
-        /* prepare msix vectors in VF configuration space */
+        /* prepare msix vectors in VF configuration space - the value in the
+         * PCI configuration space should be the index of the last entry,
+         * namely one less than the actual size of the table
+         */
        for (vf_idx = first_vf; vf_idx < first_vf + req_vfs; vf_idx++) {
                bnx2x_pretend_func(bp, HW_VF_HANDLE(bp, vf_idx));
                REG_WR(bp, PCICFG_OFFSET + GRC_CONFIG_REG_VF_MSIX_CONTROL,
-                       num_vf_queues);
+                       num_vf_queues - 1);
                DP(BNX2X_MSG_IOV, "set msix vec num in VF %d cfg space to %d\n",
-                   vf_idx, num_vf_queues);
+                   vf_idx, num_vf_queues - 1);
        }
        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
@@ -3436,10 +3448,18 @@ out:
 int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
 {
+        struct bnx2x_queue_state_params q_params = {NULL};
+        struct bnx2x_vlan_mac_ramrod_params ramrod_param;
+        struct bnx2x_queue_update_params *update_params;
+        struct pf_vf_bulletin_content *bulletin = NULL;
+        struct bnx2x_rx_mode_ramrod_params rx_ramrod;
        struct bnx2x *bp = netdev_priv(dev);
-        int rc, q_logical_state;
+        struct bnx2x_vlan_mac_obj *vlan_obj;
+        unsigned long vlan_mac_flags = 0;
+        unsigned long ramrod_flags = 0;
        struct bnx2x_virtf *vf = NULL;
-        struct pf_vf_bulletin_content *bulletin = NULL;
+        unsigned long accept_flags;
+        int rc;
        /* sanity and init */
        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
@@ -3457,104 +3477,118 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
        /* update PF's copy of the VF's bulletin. No point in posting the vlan
         * to the VF since it doesn't have anything to do with it. But it useful
         * to store it here in case the VF is not up yet and we can only
-         * configure the vlan later when it does.
+         * configure the vlan later when it does. Treat vlan id 0 as remove the
+         * Host tag.
         */
-        bulletin->valid_bitmap |= 1 << VLAN_VALID;
+        if (vlan > 0)
+                bulletin->valid_bitmap |= 1 << VLAN_VALID;
+        else
+                bulletin->valid_bitmap &= ~(1 << VLAN_VALID);
        bulletin->vlan = vlan;
        /* is vf initialized and queue set up? */
-        q_logical_state =
+        if (vf->state != VF_ENABLED ||
-                bnx2x_get_q_logical_state(bp, &bnx2x_leading_vfq(vf, sp_obj));
+            bnx2x_get_q_logical_state(bp, &bnx2x_leading_vfq(vf, sp_obj)) !=
-        if (vf->state == VF_ENABLED &&
+            BNX2X_Q_LOGICAL_STATE_ACTIVE)
-            q_logical_state == BNX2X_Q_LOGICAL_STATE_ACTIVE) {
+                return rc;
-                /* configure the vlan in device on this vf's queue */
-                unsigned long ramrod_flags = 0;
-                unsigned long vlan_mac_flags = 0;
-                struct bnx2x_vlan_mac_obj *vlan_obj =
-                        &bnx2x_leading_vfq(vf, vlan_obj);
-                struct bnx2x_vlan_mac_ramrod_params ramrod_param;
-                struct bnx2x_queue_state_params q_params = {NULL};
-                struct bnx2x_queue_update_params *update_params;
-                rc = validate_vlan_mac(bp, &bnx2x_leading_vfq(vf, mac_obj));
+        /* configure the vlan in device on this vf's queue */
-                if (rc)
+        vlan_obj = &bnx2x_leading_vfq(vf, vlan_obj);
-                        return rc;
+        rc = validate_vlan_mac(bp, &bnx2x_leading_vfq(vf, mac_obj));
-                memset(&ramrod_param, 0, sizeof(ramrod_param));
+        if (rc)
+                return rc;
-                /* must lock vfpf channel to protect against vf flows */
+        /* must lock vfpf channel to protect against vf flows */
-                bnx2x_lock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
+        bnx2x_lock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
-                /* remove existing vlans */
+        /* remove existing vlans */
-                __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
-                rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_mac_flags,
+        rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_mac_flags,
-                                          &ramrod_flags);
+                                  &ramrod_flags);
-                if (rc) {
+        if (rc) {
-                        BNX2X_ERR("failed to delete vlans\n");
+                BNX2X_ERR("failed to delete vlans\n");
-                        rc = -EINVAL;
+                rc = -EINVAL;
-                        goto out;
+                goto out;
-                }
+        }
+        /* need to remove/add the VF's accept_any_vlan bit */
+        accept_flags = bnx2x_leading_vfq(vf, accept_flags);
+        if (vlan)
+                clear_bit(BNX2X_ACCEPT_ANY_VLAN, &accept_flags);
+        else
+                set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept_flags);
+        bnx2x_vf_prep_rx_mode(bp, LEADING_IDX, &rx_ramrod, vf,
+                              accept_flags);
+        bnx2x_leading_vfq(vf, accept_flags) = accept_flags;
+        bnx2x_config_rx_mode(bp, &rx_ramrod);
+        /* configure the new vlan to device */
+        memset(&ramrod_param, 0, sizeof(ramrod_param));
+        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+        ramrod_param.vlan_mac_obj = vlan_obj;
+        ramrod_param.ramrod_flags = ramrod_flags;
+        set_bit(BNX2X_DONT_CONSUME_CAM_CREDIT,
+                &ramrod_param.user_req.vlan_mac_flags);
+        ramrod_param.user_req.u.vlan.vlan = vlan;
+        ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
+        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
+        if (rc) {
+                BNX2X_ERR("failed to configure vlan\n");
+                rc =  -EINVAL;
+                goto out;
+        }
-                /* send queue update ramrod to configure default vlan and silent
+        /* send queue update ramrod to configure default vlan and silent
-                 * vlan removal
+         * vlan removal
+         */
+        __set_bit(RAMROD_COMP_WAIT, &q_params.ramrod_flags);
+        q_params.cmd = BNX2X_Q_CMD_UPDATE;
+        q_params.q_obj = &bnx2x_leading_vfq(vf, sp_obj);
+        update_params = &q_params.params.update;
+        __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN_CHNG,
+                  &update_params->update_flags);
+        __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM_CHNG,
+                  &update_params->update_flags);
+        if (vlan == 0) {
+                /* if vlan is 0 then we want to leave the VF traffic
+                 * untagged, and leave the incoming traffic untouched
+                 * (i.e. do not remove any vlan tags).
                 */
-                __set_bit(RAMROD_COMP_WAIT, &q_params.ramrod_flags);
+                __clear_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
-                q_params.cmd = BNX2X_Q_CMD_UPDATE;
+                            &update_params->update_flags);
-                q_params.q_obj = &bnx2x_leading_vfq(vf, sp_obj);
+                __clear_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                update_params = &q_params.params.update;
+                            &update_params->update_flags);
-                __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN_CHNG,
+        } else {
+                /* configure default vlan to vf queue and set silent
+                 * vlan removal (the vf remains unaware of this vlan).
+                 */
+                __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
                          &update_params->update_flags);
-                __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM_CHNG,
+                __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
                          &update_params->update_flags);
+                update_params->def_vlan = vlan;
+                update_params->silent_removal_value =
+                        vlan & VLAN_VID_MASK;
+                update_params->silent_removal_mask = VLAN_VID_MASK;
+        }
-                if (vlan == 0) {
+        /* Update the Queue state */
-                        /* if vlan is 0 then we want to leave the VF traffic
+        rc = bnx2x_queue_state_change(bp, &q_params);
-                         * untagged, and leave the incoming traffic untouched
+        if (rc) {
-                         * (i.e. do not remove any vlan tags).
+                BNX2X_ERR("Failed to configure default VLAN\n");
-                         */
+                goto out;
-                        __clear_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
+        }
-                                    &update_params->update_flags);
-                        __clear_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                                    &update_params->update_flags);
-                } else {
-                        /* configure the new vlan to device */
-                        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
-                        ramrod_param.vlan_mac_obj = vlan_obj;
-                        ramrod_param.ramrod_flags = ramrod_flags;
-                        ramrod_param.user_req.u.vlan.vlan = vlan;
-                        ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
-                        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
-                        if (rc) {
-                                BNX2X_ERR("failed to configure vlan\n");
-                                rc =  -EINVAL;
-                                goto out;
-                        }
-                        /* configure default vlan to vf queue and set silent
-                         * vlan removal (the vf remains unaware of this vlan).
-                         */
-                        update_params = &q_params.params.update;
-                        __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
-                                  &update_params->update_flags);
-                        __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                                  &update_params->update_flags);
-                        update_params->def_vlan = vlan;
-                }
-                /* Update the Queue state */
-                rc = bnx2x_queue_state_change(bp, &q_params);
-                if (rc) {
-                        BNX2X_ERR("Failed to configure default VLAN\n");
-                        goto out;
-                }
-                /* clear the flag indicating that this VF needs its vlan
+        /* clear the flag indicating that this VF needs its vlan
-                 * (will only be set if the HV configured the Vlan before vf was
+         * (will only be set if the HV configured the Vlan before vf was
-                 * up and we were called because the VF came up later
+         * up and we were called because the VF came up later
-                 */
+         */
 out:
-                vf->cfg_flags &= ~VF_CFG_VLAN;
+        vf->cfg_flags &= ~VF_CFG_VLAN;
-                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
+        bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
-        }
        return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 1ff6a9366629..8c213fa52174 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -74,6 +74,7 @@ struct bnx2x_vf_queue {
        /* VLANs object */
        struct bnx2x_vlan_mac_obj       vlan_obj;
        atomic_t vlan_count;            /* 0 means vlan-0 is set  ~ untagged */
+        unsigned long accept_flags;     /* last accept flags configured */
        /* Queue Slow-path State object */
        struct bnx2x_queue_sp_obj       sp_obj;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index efa8a151d789..0756d7dabdd5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -208,7 +208,7 @@ static int bnx2x_get_vf_id(struct bnx2x *bp, u32 *vf_id)
                return -EINVAL;
        }
-        BNX2X_ERR("valid ME register value: 0x%08x\n", me_reg);
+        DP(BNX2X_MSG_IOV, "valid ME register value: 0x%08x\n", me_reg);
        *vf_id = (me_reg & ME_REG_VF_NUM_MASK) >> ME_REG_VF_NUM_SHIFT;
@@ -1598,6 +1598,8 @@ static void bnx2x_vfop_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                if (msg->flags & VFPF_SET_Q_FILTERS_RX_MASK_CHANGED) {
                        unsigned long accept = 0;
+                        struct pf_vf_bulletin_content *bulletin =
+                                BP_VF_BULLETIN(bp, vf->index);
                        /* covert VF-PF if mask to bnx2x accept flags */
                        if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_MATCHED_UNICAST)
@@ -1617,9 +1619,11 @@ static void bnx2x_vfop_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                                __set_bit(BNX2X_ACCEPT_BROADCAST, &accept);
                        /* A packet arriving the vf's mac should be accepted
-                         * with any vlan
+                         * with any vlan, unless a vlan has already been
+                         * configured.
                         */
-                        __set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept);
+                        if (!(bulletin->valid_bitmap & (1 << VLAN_VALID)))
+                                __set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept);
                        /* set rx-mode */
                        rc = bnx2x_vfop_rxmode_cmd(bp, vf, &cmd,
@@ -1710,6 +1714,21 @@ static void bnx2x_vf_mbx_set_q_filters(struct bnx2x *bp,
                        goto response;
                }
        }
+        /* if vlan was set by hypervisor we don't allow guest to config vlan */
+        if (bulletin->valid_bitmap & 1 << VLAN_VALID) {
+                int i;
+                /* search for vlan filters */
+                for (i = 0; i < filters->n_mac_vlan_filters; i++) {
+                        if (filters->filters[i].flags &
+                            VFPF_Q_FILTER_VLAN_TAG_VALID) {
+                                BNX2X_ERR("VF[%d] attempted to configure vlan but one was already set by Hypervisor. Aborting request\n",
+                                          vf->abs_vfid);
+                                vf->op_rc = -EPERM;
+                                goto response;
+                        }
+                }
+        }
        /* verify vf_qid */
        if (filters->vf_qid > vf_rxq_count(vf))
@@ -1805,6 +1824,9 @@ static void bnx2x_vf_mbx_update_rss(struct bnx2x *bp, struct bnx2x_virtf *vf,
        vf_op_params->rss_result_mask = rss_tlv->rss_result_mask;
        /* flags handled individually for backward/forward compatability */
+        vf_op_params->rss_flags = 0;
+        vf_op_params->ramrod_flags = 0;
        if (rss_tlv->rss_flags & VFPF_RSS_MODE_DISABLED)
                __set_bit(BNX2X_RSS_MODE_DISABLED, &vf_op_params->rss_flags);
        if (rss_tlv->rss_flags & VFPF_RSS_MODE_REGULAR)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index f3dd93b4aeaa..15a66e4b1f57 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7622,7 +7622,7 @@ static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
 {
        u32 base = (u32) mapping & 0xffffffff;
-        return (base > 0xffffdcc0) && (base + len + 8 < base);
+        return base + len + 8 < base;
 }
 /* Test for TSO DMA buffers that cross into regions which are within MSS bytes
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 6c9308850453..56e0415f8cdf 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -228,6 +228,25 @@ struct tp_params {
        uint32_t dack_re;            /* DACK timer resolution */
        unsigned short tx_modq[NCHAN];  /* channel to modulation queue map */
+        u32 vlan_pri_map;               /* cached TP_VLAN_PRI_MAP */
+        u32 ingress_config;             /* cached TP_INGRESS_CONFIG */
+        /* TP_VLAN_PRI_MAP Compressed Filter Tuple field offsets.  This is a
+         * subset of the set of fields which may be present in the Compressed
+         * Filter Tuple portion of filters and TCP TCB connections.  The
+         * fields which are present are controlled by the TP_VLAN_PRI_MAP.
+         * Since a variable number of fields may or may not be present, their
+         * shifted field positions within the Compressed Filter Tuple may
+         * vary, or not even be present if the field isn't selected in
+         * TP_VLAN_PRI_MAP.  Since some of these fields are needed in various
+         * places we store their offsets here, or a -1 if the field isn't
+         * present.
+         */
+        int vlan_shift;
+        int vnic_shift;
+        int port_shift;
+        int protocol_shift;
 };
 struct vpd_params {
@@ -926,6 +945,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
               const u8 *fw_data, unsigned int fw_size,
               struct fw_hdr *card_fw, enum dev_state state, int *reset);
 int t4_prep_adapter(struct adapter *adapter);
+int t4_init_tp_params(struct adapter *adap);
+int t4_filter_field_shift(const struct adapter *adap, int filter_sel);
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf);
 void t4_fatal_err(struct adapter *adapter);
 int t4_config_rss_range(struct adapter *adapter, int mbox, unsigned int viid,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index d6b12e035a7d..fff02ed1295e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2986,7 +2986,14 @@ int cxgb4_alloc_stid(struct tid_info *t, int family, void *data)
        if (stid >= 0) {
                t->stid_tab[stid].data = data;
                stid += t->stid_base;
-                t->stids_in_use++;
+                /* IPv6 requires max of 520 bits or 16 cells in TCAM
+                 * This is equivalent to 4 TIDs. With CLIP enabled it
+                 * needs 2 TIDs.
+                 */
+                if (family == PF_INET)
+                        t->stids_in_use++;
+                else
+                        t->stids_in_use += 4;
        }
        spin_unlock_bh(&t->stid_lock);
        return stid;
@@ -3012,7 +3019,8 @@ int cxgb4_alloc_sftid(struct tid_info *t, int family, void *data)
        }
        if (stid >= 0) {
                t->stid_tab[stid].data = data;
-                stid += t->stid_base;
+                stid -= t->nstids;
+                stid += t->sftid_base;
                t->stids_in_use++;
        }
        spin_unlock_bh(&t->stid_lock);
@@ -3024,14 +3032,24 @@ EXPORT_SYMBOL(cxgb4_alloc_sftid);
 */
 void cxgb4_free_stid(struct tid_info *t, unsigned int stid, int family)
 {
-        stid -= t->stid_base;
+        /* Is it a server filter TID? */
+        if (t->nsftids && (stid >= t->sftid_base)) {
+                stid -= t->sftid_base;
+                stid += t->nstids;
+        } else {
+                stid -= t->stid_base;
+        }
        spin_lock_bh(&t->stid_lock);
        if (family == PF_INET)
                __clear_bit(stid, t->stid_bmap);
        else
                bitmap_release_region(t->stid_bmap, stid, 2);
        t->stid_tab[stid].data = NULL;
-        t->stids_in_use--;
+        if (family == PF_INET)
+                t->stids_in_use--;
+        else
+                t->stids_in_use -= 4;
        spin_unlock_bh(&t->stid_lock);
 }
 EXPORT_SYMBOL(cxgb4_free_stid);
@@ -3134,6 +3152,7 @@ static int tid_init(struct tid_info *t)
        size_t size;
        unsigned int stid_bmap_size;
        unsigned int natids = t->natids;
+        struct adapter *adap = container_of(t, struct adapter, tids);
        stid_bmap_size = BITS_TO_LONGS(t->nstids + t->nsftids);
        size = t->ntids * sizeof(*t->tid_tab) +
@@ -3167,6 +3186,11 @@ static int tid_init(struct tid_info *t)
                t->afree = t->atid_tab;
        }
        bitmap_zero(t->stid_bmap, t->nstids + t->nsftids);
+        /* Reserve stid 0 for T4/T5 adapters */
+        if (!t->stid_base &&
+            (is_t4(adap->params.chip) || is_t5(adap->params.chip)))
+                __set_bit(0, t->stid_bmap);
        return 0;
 }
@@ -3731,7 +3755,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
        lli.ucq_density = 1 << QUEUESPERPAGEPF0_GET(
                        t4_read_reg(adap, SGE_INGRESS_QUEUES_PER_PAGE_PF) >>
                        (adap->fn * 4));
-        lli.filt_mode = adap->filter_mode;
+        lli.filt_mode = adap->params.tp.vlan_pri_map;
        /* MODQ_REQ_MAP sets queues 0-3 to chan 0-3 */
        for (i = 0; i < NCHAN; i++)
                lli.tx_modq[i] = i;
@@ -4179,7 +4203,7 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
        adap = netdev2adap(dev);
        /* Adjust stid to correct filter index */
-        stid -= adap->tids.nstids;
+        stid -= adap->tids.sftid_base;
        stid += adap->tids.nftids;
        /* Check to make sure the filter requested is writable ...
@@ -4205,12 +4229,17 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
                        f->fs.val.lip[i] = val[i];
                        f->fs.mask.lip[i] = ~0;
                }
-                if (adap->filter_mode & F_PORT) {
+                if (adap->params.tp.vlan_pri_map & F_PORT) {
                        f->fs.val.iport = port;
                        f->fs.mask.iport = mask;
                }
        }
+        if (adap->params.tp.vlan_pri_map & F_PROTOCOL) {
+                f->fs.val.proto = IPPROTO_TCP;
+                f->fs.mask.proto = ~0;
+        }
        f->fs.dirsteer = 1;
        f->fs.iq = queue;
        /* Mark filter as locked */
@@ -4237,7 +4266,7 @@ int cxgb4_remove_server_filter(const struct net_device *dev, unsigned int stid,
        adap = netdev2adap(dev);
        /* Adjust stid to correct filter index */
-        stid -= adap->tids.nstids;
+        stid -= adap->tids.sftid_base;
        stid += adap->tids.nftids;
        f = &adap->tids.ftid_tab[stid];
@@ -5092,7 +5121,7 @@ static int adap_init0(struct adapter *adap)
        enum dev_state state;
        u32 params[7], val[7];
        struct fw_caps_config_cmd caps_cmd;
-        int reset = 1, j;
+        int reset = 1;
        /*
         * Contact FW, advertising Master capability (and potentially forcing
@@ -5434,21 +5463,11 @@ static int adap_init0(struct adapter *adap)
        /*
         * These are finalized by FW initialization, load their values now.
         */
-        v = t4_read_reg(adap, TP_TIMER_RESOLUTION);
-        adap->params.tp.tre = TIMERRESOLUTION_GET(v);
-        adap->params.tp.dack_re = DELAYEDACKRESOLUTION_GET(v);
        t4_read_mtu_tbl(adap, adap->params.mtus, NULL);
        t4_load_mtus(adap, adap->params.mtus, adap->params.a_wnd,
                     adap->params.b_wnd);
-        /* MODQ_REQ_MAP defaults to setting queues 0-3 to chan 0-3 */
+        t4_init_tp_params(adap);
-        for (j = 0; j < NCHAN; j++)
-                adap->params.tp.tx_modq[j] = j;
-        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
-                         &adap->filter_mode, 1,
-                         TP_VLAN_PRI_MAP);
        adap->flags |= FW_OK;
        return 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
index 6f21f2451c30..4dd0a82533e4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
@@ -131,7 +131,14 @@ static inline void *lookup_atid(const struct tid_info *t, unsigned int atid)
 static inline void *lookup_stid(const struct tid_info *t, unsigned int stid)
 {
-        stid -= t->stid_base;
+        /* Is it a server filter TID? */
+        if (t->nsftids && (stid >= t->sftid_base)) {
+                stid -= t->sftid_base;
+                stid += t->nstids;
+        } else {
+                stid -= t->stid_base;
+        }
        return stid < (t->nstids + t->nsftids) ? t->stid_tab[stid].data : NULL;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
index 29878098101e..cb05be905def 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
@@ -45,6 +45,7 @@
 #include "l2t.h"
 #include "t4_msg.h"
 #include "t4fw_api.h"
+#include "t4_regs.h"
 #define VLAN_NONE 0xfff
@@ -411,6 +412,40 @@ done:
 }
 EXPORT_SYMBOL(cxgb4_l2t_get);
+u64 cxgb4_select_ntuple(struct net_device *dev,
+                        const struct l2t_entry *l2t)
+{
+        struct adapter *adap = netdev2adap(dev);
+        struct tp_params *tp = &adap->params.tp;
+        u64 ntuple = 0;
+        /* Initialize each of the fields which we care about which are present
+         * in the Compressed Filter Tuple.
+         */
+        if (tp->vlan_shift >= 0 && l2t->vlan != VLAN_NONE)
+                ntuple |= (F_FT_VLAN_VLD | l2t->vlan) << tp->vlan_shift;
+        if (tp->port_shift >= 0)
+                ntuple |= (u64)l2t->lport << tp->port_shift;
+        if (tp->protocol_shift >= 0)
+                ntuple |= (u64)IPPROTO_TCP << tp->protocol_shift;
+        if (tp->vnic_shift >= 0) {
+                u32 viid = cxgb4_port_viid(dev);
+                u32 vf = FW_VIID_VIN_GET(viid);
+                u32 pf = FW_VIID_PFN_GET(viid);
+                u32 vld = FW_VIID_VIVLD_GET(viid);
+                ntuple |= (u64)(V_FT_VNID_ID_VF(vf) |
+                                V_FT_VNID_ID_PF(pf) |
+                                V_FT_VNID_ID_VLD(vld)) << tp->vnic_shift;
+        }
+        return ntuple;
+}
+EXPORT_SYMBOL(cxgb4_select_ntuple);
 /*
 * Called when address resolution fails for an L2T entry to handle packets
 * on the arpq head.  If a packet specifies a failure handler it is invoked,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.h b/drivers/net/ethernet/chelsio/cxgb4/l2t.h
index 108c0f1fce1c..85eb5c71358d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.h
@@ -98,7 +98,8 @@ int cxgb4_l2t_send(struct net_device *dev, struct sk_buff *skb,
 struct l2t_entry *cxgb4_l2t_get(struct l2t_data *d, struct neighbour *neigh,
                                const struct net_device *physdev,
                                unsigned int priority);
+u64 cxgb4_select_ntuple(struct net_device *dev,
+                        const struct l2t_entry *l2t);
 void t4_l2t_update(struct adapter *adap, struct neighbour *neigh);
 struct l2t_entry *t4_l2t_alloc_switching(struct l2t_data *d);
 int t4_l2t_set_switching(struct adapter *adap, struct l2t_entry *e, u16 vlan,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index cc380c36e1a8..cc3511a5cd0c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2581,7 +2581,7 @@ static int t4_sge_init_soft(struct adapter *adap)
        #undef READ_FL_BUF
        if (fl_small_pg != PAGE_SIZE ||
-            (fl_large_pg != 0 && (fl_large_pg <= fl_small_pg ||
+            (fl_large_pg != 0 && (fl_large_pg < fl_small_pg ||
                                  (fl_large_pg & (fl_large_pg-1)) != 0))) {
                dev_err(adap->pdev_dev, "bad SGE FL page buffer sizes [%d, %d]\n",
                        fl_small_pg, fl_large_pg);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 74a6fce5a15a..e1413eacdbd2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3808,6 +3808,109 @@ int t4_prep_adapter(struct adapter *adapter)
        return 0;
 }
+/**
+ *      t4_init_tp_params - initialize adap->params.tp
+ *      @adap: the adapter
+ *
+ *      Initialize various fields of the adapter's TP Parameters structure.
+ */
+int t4_init_tp_params(struct adapter *adap)
+{
+        int chan;
+        u32 v;
+        v = t4_read_reg(adap, TP_TIMER_RESOLUTION);
+        adap->params.tp.tre = TIMERRESOLUTION_GET(v);
+        adap->params.tp.dack_re = DELAYEDACKRESOLUTION_GET(v);
+        /* MODQ_REQ_MAP defaults to setting queues 0-3 to chan 0-3 */
+        for (chan = 0; chan < NCHAN; chan++)
+                adap->params.tp.tx_modq[chan] = chan;
+        /* Cache the adapter's Compressed Filter Mode and global Incress
+         * Configuration.
+         */
+        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
+                         &adap->params.tp.vlan_pri_map, 1,
+                         TP_VLAN_PRI_MAP);
+        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
+                         &adap->params.tp.ingress_config, 1,
+                         TP_INGRESS_CONFIG);
+        /* Now that we have TP_VLAN_PRI_MAP cached, we can calculate the field
+         * shift positions of several elements of the Compressed Filter Tuple
+         * for this adapter which we need frequently ...
+         */
+        adap->params.tp.vlan_shift = t4_filter_field_shift(adap, F_VLAN);
+        adap->params.tp.vnic_shift = t4_filter_field_shift(adap, F_VNIC_ID);
+        adap->params.tp.port_shift = t4_filter_field_shift(adap, F_PORT);
+        adap->params.tp.protocol_shift = t4_filter_field_shift(adap,
+                                                               F_PROTOCOL);
+        /* If TP_INGRESS_CONFIG.VNID == 0, then TP_VLAN_PRI_MAP.VNIC_ID
+         * represents the presense of an Outer VLAN instead of a VNIC ID.
+         */
+        if ((adap->params.tp.ingress_config & F_VNIC) == 0)
+                adap->params.tp.vnic_shift = -1;
+        return 0;
+}
+/**
+ *      t4_filter_field_shift - calculate filter field shift
+ *      @adap: the adapter
+ *      @filter_sel: the desired field (from TP_VLAN_PRI_MAP bits)
+ *
+ *      Return the shift position of a filter field within the Compressed
+ *      Filter Tuple.  The filter field is specified via its selection bit
+ *      within TP_VLAN_PRI_MAL (filter mode).  E.g. F_VLAN.
+ */
+int t4_filter_field_shift(const struct adapter *adap, int filter_sel)
+{
+        unsigned int filter_mode = adap->params.tp.vlan_pri_map;
+        unsigned int sel;
+        int field_shift;
+        if ((filter_mode & filter_sel) == 0)
+                return -1;
+        for (sel = 1, field_shift = 0; sel < filter_sel; sel <<= 1) {
+                switch (filter_mode & sel) {
+                case F_FCOE:
+                        field_shift += W_FT_FCOE;
+                        break;
+                case F_PORT:
+                        field_shift += W_FT_PORT;
+                        break;
+                case F_VNIC_ID:
+                        field_shift += W_FT_VNIC_ID;
+                        break;
+                case F_VLAN:
+                        field_shift += W_FT_VLAN;
+                        break;
+                case F_TOS:
+                        field_shift += W_FT_TOS;
+                        break;
+                case F_PROTOCOL:
+                        field_shift += W_FT_PROTOCOL;
+                        break;
+                case F_ETHERTYPE:
+                        field_shift += W_FT_ETHERTYPE;
+                        break;
+                case F_MACMATCH:
+                        field_shift += W_FT_MACMATCH;
+                        break;
+                case F_MPSHITTYPE:
+                        field_shift += W_FT_MPSHITTYPE;
+                        break;
+                case F_FRAGMENTATION:
+                        field_shift += W_FT_FRAGMENTATION;
+                        break;
+                }
+        }
+        return field_shift;
+}
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
 {
        u8 addr[6];
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index 0a8205d69d2c..4082522d8140 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -1171,10 +1171,50 @@
 #define A_TP_TX_SCHED_PCMD 0x25
+#define S_VNIC    11
+#define V_VNIC(x) ((x) << S_VNIC)
+#define F_VNIC    V_VNIC(1U)
+#define S_FRAGMENTATION    9
+#define V_FRAGMENTATION(x) ((x) << S_FRAGMENTATION)
+#define F_FRAGMENTATION    V_FRAGMENTATION(1U)
+#define S_MPSHITTYPE    8
+#define V_MPSHITTYPE(x) ((x) << S_MPSHITTYPE)
+#define F_MPSHITTYPE    V_MPSHITTYPE(1U)
+#define S_MACMATCH    7
+#define V_MACMATCH(x) ((x) << S_MACMATCH)
+#define F_MACMATCH    V_MACMATCH(1U)
+#define S_ETHERTYPE    6
+#define V_ETHERTYPE(x) ((x) << S_ETHERTYPE)
+#define F_ETHERTYPE    V_ETHERTYPE(1U)
+#define S_PROTOCOL    5
+#define V_PROTOCOL(x) ((x) << S_PROTOCOL)
+#define F_PROTOCOL    V_PROTOCOL(1U)
+#define S_TOS    4
+#define V_TOS(x) ((x) << S_TOS)
+#define F_TOS    V_TOS(1U)
+#define S_VLAN    3
+#define V_VLAN(x) ((x) << S_VLAN)
+#define F_VLAN    V_VLAN(1U)
+#define S_VNIC_ID    2
+#define V_VNIC_ID(x) ((x) << S_VNIC_ID)
+#define F_VNIC_ID    V_VNIC_ID(1U)
 #define S_PORT    1
 #define V_PORT(x) ((x) << S_PORT)
 #define F_PORT    V_PORT(1U)
+#define S_FCOE    0
+#define V_FCOE(x) ((x) << S_FCOE)
+#define F_FCOE    V_FCOE(1U)
 #define NUM_MPS_CLS_SRAM_L_INSTANCES 336
 #define NUM_MPS_T5_CLS_SRAM_L_INSTANCES 512
@@ -1213,4 +1253,37 @@
 #define V_CHIPID(x) ((x) << S_CHIPID)
 #define G_CHIPID(x) (((x) >> S_CHIPID) & M_CHIPID)
+/* TP_VLAN_PRI_MAP controls which subset of fields will be present in the
+ * Compressed Filter Tuple for LE filters.  Each bit set in TP_VLAN_PRI_MAP
+ * selects for a particular field being present.  These fields, when present
+ * in the Compressed Filter Tuple, have the following widths in bits.
+ */
+#define W_FT_FCOE                       1
+#define W_FT_PORT                       3
+#define W_FT_VNIC_ID                    17
+#define W_FT_VLAN                       17
+#define W_FT_TOS                        8
+#define W_FT_PROTOCOL                   8
+#define W_FT_ETHERTYPE                  16
+#define W_FT_MACMATCH                   9
+#define W_FT_MPSHITTYPE                 3
+#define W_FT_FRAGMENTATION              1
+/* Some of the Compressed Filter Tuple fields have internal structure.  These
+ * bit shifts/masks describe those structures.  All shifts are relative to the
+ * base position of the fields within the Compressed Filter Tuple
+ */
+#define S_FT_VLAN_VLD                   16
+#define V_FT_VLAN_VLD(x)                ((x) << S_FT_VLAN_VLD)
+#define F_FT_VLAN_VLD                   V_FT_VLAN_VLD(1U)
+#define S_FT_VNID_ID_VF                 0
+#define V_FT_VNID_ID_VF(x)              ((x) << S_FT_VNID_ID_VF)
+#define S_FT_VNID_ID_PF                 7
+#define V_FT_VNID_ID_PF(x)              ((x) << S_FT_VNID_ID_PF)
+#define S_FT_VNID_ID_VLD                16
+#define V_FT_VNID_ID_VLD(x)             ((x) << S_FT_VNID_ID_VLD)
 #endif /* __T4_REGS_H */
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 5878df619b53..4ccaf9af6fc9 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -104,6 +104,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define BE3_MAX_RSS_QS          16
 #define BE3_MAX_TX_QS           16
 #define BE3_MAX_EVT_QS          16
+#define BE3_SRIOV_MAX_EVT_QS    8
 #define MAX_RX_QS               32
 #define MAX_EVT_QS              32
@@ -480,7 +481,7 @@ struct be_adapter {
        struct list_head entry;
        u32 flash_status;
-        struct completion flash_compl;
+        struct completion et_cmd_compl;
        struct be_resources res;        /* resources available for the func */
        u16 num_vfs;                    /* Number of VFs provisioned by PF */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index e0e8bc1ef14c..94c35c8d799d 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -141,11 +141,17 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
                subsystem = resp_hdr->subsystem;
        }
+        if (opcode == OPCODE_LOWLEVEL_LOOPBACK_TEST &&
+            subsystem == CMD_SUBSYSTEM_LOWLEVEL) {
+                complete(&adapter->et_cmd_compl);
+                return 0;
+        }
        if (((opcode == OPCODE_COMMON_WRITE_FLASHROM) ||
             (opcode == OPCODE_COMMON_WRITE_OBJECT)) &&
            (subsystem == CMD_SUBSYSTEM_COMMON)) {
                adapter->flash_status = compl_status;
-                complete(&adapter->flash_compl);
+                complete(&adapter->et_cmd_compl);
        }
        if (compl_status == MCC_STATUS_SUCCESS) {
@@ -2017,6 +2023,9 @@ int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
                        0x3ea83c02, 0x4a110304};
        int status;
+        if (!(be_if_cap_flags(adapter) & BE_IF_FLAGS_RSS))
+                return 0;
        if (mutex_lock_interruptible(&adapter->mbox_lock))
                return -1;
@@ -2160,7 +2169,7 @@ int lancer_cmd_write_object(struct be_adapter *adapter, struct be_dma_mem *cmd,
        be_mcc_notify(adapter);
        spin_unlock_bh(&adapter->mcc_lock);
-        if (!wait_for_completion_timeout(&adapter->flash_compl,
+        if (!wait_for_completion_timeout(&adapter->et_cmd_compl,
                                         msecs_to_jiffies(60000)))
                status = -1;
        else
@@ -2255,8 +2264,8 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
        be_mcc_notify(adapter);
        spin_unlock_bh(&adapter->mcc_lock);
-        if (!wait_for_completion_timeout(&adapter->flash_compl,
+        if (!wait_for_completion_timeout(&adapter->et_cmd_compl,
-                        msecs_to_jiffies(40000)))
+                                         msecs_to_jiffies(40000)))
                status = -1;
        else
                status = adapter->flash_status;
@@ -2367,6 +2376,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 {
        struct be_mcc_wrb *wrb;
        struct be_cmd_req_loopback_test *req;
+        struct be_cmd_resp_loopback_test *resp;
        int status;
        spin_lock_bh(&adapter->mcc_lock);
@@ -2381,8 +2391,8 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
        be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
                        OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req), wrb, NULL);
-        req->hdr.timeout = cpu_to_le32(4);
+        req->hdr.timeout = cpu_to_le32(15);
        req->pattern = cpu_to_le64(pattern);
        req->src_port = cpu_to_le32(port_num);
        req->dest_port = cpu_to_le32(port_num);
@@ -2390,12 +2400,15 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
        req->num_pkts = cpu_to_le32(num_pkts);
        req->loopback_type = cpu_to_le32(loopback_type);
-        status = be_mcc_notify_wait(adapter);
+        be_mcc_notify(adapter);
-        if (!status) {
-                struct be_cmd_resp_loopback_test *resp = embedded_payload(wrb);
+        spin_unlock_bh(&adapter->mcc_lock);
-                status = le32_to_cpu(resp->status);
-        }
+        wait_for_completion(&adapter->et_cmd_compl);
+        resp = embedded_payload(wrb);
+        status = le32_to_cpu(resp->status);
+        return status;
 err:
        spin_unlock_bh(&adapter->mcc_lock);
        return status;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 0fde69d5cb6a..bf40fdaecfa3 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2744,13 +2744,16 @@ static int be_rx_qs_create(struct be_adapter *adapter)
                if (!BEx_chip(adapter))
                        adapter->rss_flags |= RSS_ENABLE_UDP_IPV4 |
                                                RSS_ENABLE_UDP_IPV6;
+        } else {
+                /* Disable RSS, if only default RX Q is created */
+                adapter->rss_flags = RSS_ENABLE_NONE;
+        }
-                rc = be_cmd_rss_config(adapter, rsstable, adapter->rss_flags,
+        rc = be_cmd_rss_config(adapter, rsstable, adapter->rss_flags,
-                                       128);
+                               128);
-                if (rc) {
+        if (rc) {
-                        adapter->rss_flags = 0;
+                adapter->rss_flags = RSS_ENABLE_NONE;
-                        return rc;
+                return rc;
-                }
        }
        /* First time posting */
@@ -3124,11 +3127,11 @@ static void BEx_get_resources(struct be_adapter *adapter,
 {
        struct pci_dev *pdev = adapter->pdev;
        bool use_sriov = false;
+        int max_vfs;
-        if (BE3_chip(adapter) && sriov_want(adapter)) {
+        max_vfs = pci_sriov_get_totalvfs(pdev);
-                int max_vfs;
-                max_vfs = pci_sriov_get_totalvfs(pdev);
+        if (BE3_chip(adapter) && sriov_want(adapter)) {
                res->max_vfs = max_vfs > 0 ? min(MAX_VFS, max_vfs) : 0;
                use_sriov = res->max_vfs;
        }
@@ -3159,7 +3162,11 @@ static void BEx_get_resources(struct be_adapter *adapter,
                                           BE3_MAX_RSS_QS : BE2_MAX_RSS_QS;
        res->max_rx_qs = res->max_rss_qs + 1;
-        res->max_evt_qs = be_physfn(adapter) ? BE3_MAX_EVT_QS : 1;
+        if (be_physfn(adapter))
+                res->max_evt_qs = (max_vfs > 0) ?
+                                        BE3_SRIOV_MAX_EVT_QS : BE3_MAX_EVT_QS;
+        else
+                res->max_evt_qs = 1;
        res->if_cap_flags = BE_IF_CAP_FLAGS_WANT;
        if (!(adapter->function_caps & BE_FUNCTION_CAPS_RSS))
@@ -4205,7 +4212,7 @@ static int be_ctrl_init(struct be_adapter *adapter)
        spin_lock_init(&adapter->mcc_lock);
        spin_lock_init(&adapter->mcc_cq_lock);
-        init_completion(&adapter->flash_compl);
+        init_completion(&adapter->et_cmd_compl);
        pci_save_state(adapter->pdev);
        return 0;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index e7c8b749c5a5..50bb71c663e2 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -428,6 +428,8 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        /* If this was the last BD in the ring, start at the beginning again. */
        bdp = fec_enet_get_nextdesc(bdp, fep);
+        skb_tx_timestamp(skb);
        fep->cur_tx = bdp;
        if (fep->cur_tx == fep->dirty_tx)
@@ -436,8 +438,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        /* Trigger transmission start */
        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
-        skb_tx_timestamp(skb);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/intel/e1000e/80003es2lan.c b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
index 895450e9bb3c..ff2d806eaef7 100644
--- a/drivers/net/ethernet/intel/e1000e/80003es2lan.c
+++ b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
@@ -718,8 +718,11 @@ static s32 e1000_reset_hw_80003es2lan(struct e1000_hw *hw)
        e1000_release_phy_80003es2lan(hw);
        /* Disable IBIST slave mode (far-end loopback) */
-        e1000_read_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+        ret_val =
-                                        &kum_reg_data);
+            e1000_read_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+                                            &kum_reg_data);
+        if (ret_val)
+                return ret_val;
        kum_reg_data |= E1000_KMRNCTRLSTA_IBIST_DISABLE;
        e1000_write_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
                                         kum_reg_data);
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 8d3945ab7334..c30d41d6e426 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6174,7 +6174,7 @@ static int __e1000_resume(struct pci_dev *pdev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
 static int e1000_suspend(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
@@ -6193,7 +6193,7 @@ static int e1000_resume(struct device *dev)
        return __e1000_resume(pdev);
 }
-#endif /* CONFIG_PM_SLEEP */
+#endif /* CONFIG_PM */
 #ifdef CONFIG_PM_RUNTIME
 static int e1000_runtime_suspend(struct device *dev)
diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
index da2be59505c0..20e71f4ca426 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -1757,19 +1757,23 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
                 * it across the board.
                 */
                ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
-                if (ret_val)
+                if (ret_val) {
                        /* If the first read fails, another entity may have
                         * ownership of the resources, wait and try again to
                         * see if they have relinquished the resources yet.
                         */
-                        udelay(usec_interval);
+                        if (usec_interval >= 1000)
+                                msleep(usec_interval / 1000);
+                        else
+                                udelay(usec_interval);
+                }
                ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
                if (ret_val)
                        break;
                if (phy_status & BMSR_LSTATUS)
                        break;
                if (usec_interval >= 1000)
-                        mdelay(usec_interval / 1000);
+                        msleep(usec_interval / 1000);
                else
                        udelay(usec_interval);
        }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index cc06854296a3..5bcc870f8367 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6827,12 +6827,20 @@ static inline int ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, u16 size)
        return __ixgbe_maybe_stop_tx(tx_ring, size);
 }
-#ifdef IXGBE_FCOE
+static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
-static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
+                              void *accel_priv)
 {
+        struct ixgbe_fwd_adapter *fwd_adapter = accel_priv;
+#ifdef IXGBE_FCOE
        struct ixgbe_adapter *adapter;
        struct ixgbe_ring_feature *f;
        int txq;
+#endif
+        if (fwd_adapter)
+                return skb->queue_mapping + fwd_adapter->tx_base_queue;
+#ifdef IXGBE_FCOE
        /*
         * only execute the code below if protocol is FCoE
@@ -6858,9 +6866,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
                txq -= f->indices;
        return txq + f->offset;
+#else
+        return __netdev_pick_tx(dev, skb);
+#endif
 }
-#endif
 netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
                          struct ixgbe_adapter *adapter,
                          struct ixgbe_ring *tx_ring)
@@ -7629,27 +7639,11 @@ static void ixgbe_fwd_del(struct net_device *pdev, void *priv)
        kfree(fwd_adapter);
 }
-static netdev_tx_t ixgbe_fwd_xmit(struct sk_buff *skb,
-                                  struct net_device *dev,
-                                  void *priv)
-{
-        struct ixgbe_fwd_adapter *fwd_adapter = priv;
-        unsigned int queue;
-        struct ixgbe_ring *tx_ring;
-        queue = skb->queue_mapping + fwd_adapter->tx_base_queue;
-        tx_ring = fwd_adapter->real_adapter->tx_ring[queue];
-        return __ixgbe_xmit_frame(skb, dev, tx_ring);
-}
 static const struct net_device_ops ixgbe_netdev_ops = {
        .ndo_open               = ixgbe_open,
        .ndo_stop               = ixgbe_close,
        .ndo_start_xmit         = ixgbe_xmit_frame,
-#ifdef IXGBE_FCOE
        .ndo_select_queue       = ixgbe_select_queue,
-#endif
        .ndo_set_rx_mode        = ixgbe_set_rx_mode,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_set_mac_address    = ixgbe_set_mac,
@@ -7689,7 +7683,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
        .ndo_bridge_getlink     = ixgbe_ndo_bridge_getlink,
        .ndo_dfwd_add_station   = ixgbe_fwd_add,
        .ndo_dfwd_del_station   = ixgbe_fwd_del,
-        .ndo_dfwd_start_xmit    = ixgbe_fwd_xmit,
 };
 /**
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index d6f0c0d8cf11..72084f70adbb 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -291,7 +291,9 @@ static int ixgbe_pci_sriov_disable(struct pci_dev *dev)
 {
        struct ixgbe_adapter *adapter = pci_get_drvdata(dev);
        int err;
+#ifdef CONFIG_PCI_IOV
        u32 current_flags = adapter->flags;
+#endif
        err = ixgbe_disable_sriov(adapter);
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 6a6c1f76d8e0..ec94a20d7099 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -619,7 +619,8 @@ ltq_etop_set_multicast_list(struct net_device *dev)
 }
 static u16
-ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb)
+ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      void *accel_priv)
 {
        /* we are currently only using the first queue */
        return 0;
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index 7354960b583b..c4eeb69a5bee 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -92,6 +92,12 @@ static int orion_mdio_wait_ready(struct mii_bus *bus)
                        if (time_is_before_jiffies(end))
                                ++timedout;
                } else {
+                        /* wait_event_timeout does not guarantee a delay of at
+                         * least one whole jiffie, so timeout must be no less
+                         * than two.
+                         */
+                        if (timeout < 2)
+                                timeout = 2;
                        wait_event_timeout(dev->smi_busy_wait,
                                           orion_mdio_smi_is_done(dev),
                                           timeout);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index f54ebd5a1702..a7fcd593b2db 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -592,7 +592,8 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, struct sk_buff *sk
        }
 }
-u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb)
+u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
+                         void *accel_priv)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
        u16 rings_p_up = priv->num_tx_rings_p_up;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index f3758de59c05..d5758adceaa2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -714,7 +714,8 @@ int mlx4_en_set_cq_moder(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 int mlx4_en_arm_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 void mlx4_en_tx_irq(struct mlx4_cq *mcq);
-u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb);
+u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
+                         void *accel_priv);
 netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev);
 int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 7692dfd4f262..cc68657f0536 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -1604,13 +1604,13 @@ netxen_process_lro(struct netxen_adapter *adapter,
        u32 seq_number;
        u8 vhdr_len = 0;
-        if (unlikely(ring > adapter->max_rds_rings))
+        if (unlikely(ring >= adapter->max_rds_rings))
                return NULL;
        rds_ring = &recv_ctx->rds_rings[ring];
        index = netxen_get_lro_sts_refhandle(sts_data0);
-        if (unlikely(index > rds_ring->num_desc))
+        if (unlikely(index >= rds_ring->num_desc))
                return NULL;
        buffer = &rds_ring->rx_buf_arr[index];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 631ea0ac1cd8..f2a7c7166e24 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -487,6 +487,7 @@ struct qlcnic_hardware_context {
        struct qlcnic_mailbox *mailbox;
        u8 extend_lb_time;
        u8 phys_port_id[ETH_ALEN];
+        u8 lb_mode;
 };
 struct qlcnic_adapter_stats {
@@ -578,6 +579,8 @@ struct qlcnic_host_tx_ring {
        dma_addr_t phys_addr;
        dma_addr_t hw_cons_phys_addr;
        struct netdev_queue *txq;
+        /* Lock to protect Tx descriptors cleanup */
+        spinlock_t tx_clean_lock;
 } ____cacheline_internodealigned_in_smp;
 /*
@@ -808,6 +811,7 @@ struct qlcnic_mac_list_s {
 #define QLCNIC_ILB_MODE         0x1
 #define QLCNIC_ELB_MODE         0x2
+#define QLCNIC_LB_MODE_MASK     0x3
 #define QLCNIC_LINKEVENT        0x1
 #define QLCNIC_LB_RESPONSE      0x2
@@ -1093,7 +1097,6 @@ struct qlcnic_adapter {
        struct qlcnic_filter_hash rx_fhash;
        struct list_head vf_mc_list;
-        spinlock_t tx_clean_lock;
        spinlock_t mac_learn_lock;
        /* spinlock for catching rcv filters for eswitch traffic */
        spinlock_t rx_mac_learn_lock;
@@ -1708,6 +1711,7 @@ int qlcnic_83xx_init_mailbox_work(struct qlcnic_adapter *);
 void qlcnic_83xx_detach_mailbox_work(struct qlcnic_adapter *);
 void qlcnic_83xx_reinit_mbx_work(struct qlcnic_mailbox *mbx);
 void qlcnic_83xx_free_mailbox(struct qlcnic_mailbox *mbx);
+void qlcnic_update_stats(struct qlcnic_adapter *);
 /* Adapter hardware abstraction */
 struct qlcnic_hardware_ops {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index b1cb0ffb15c7..f776f99f7915 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -447,8 +447,9 @@ irqreturn_t qlcnic_83xx_intr(int irq, void *data)
        qlcnic_83xx_poll_process_aen(adapter);
-        if (ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
+        if (ahw->diag_test) {
-                ahw->diag_cnt++;
+                if (ahw->diag_test == QLCNIC_INTERRUPT_TEST)
+                        ahw->diag_cnt++;
                qlcnic_83xx_enable_legacy_msix_mbx_intr(adapter);
                return IRQ_HANDLED;
        }
@@ -1345,11 +1346,6 @@ static int qlcnic_83xx_diag_alloc_res(struct net_device *netdev, int test,
        }
        if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                /* disable and free mailbox interrupt */
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        qlcnic_83xx_enable_mbx_poll(adapter);
-                        qlcnic_83xx_free_mbx_intr(adapter);
-                }
                adapter->ahw->loopback_state = 0;
                adapter->ahw->hw_ops->setup_link_event(adapter, 1);
        }
@@ -1363,33 +1359,20 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
 {
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        struct qlcnic_host_sds_ring *sds_ring;
-        int ring, err;
+        int ring;
        clear_bit(__QLCNIC_DEV_UP, &adapter->state);
        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                for (ring = 0; ring < adapter->drv_sds_rings; ring++) {
                        sds_ring = &adapter->recv_ctx->sds_rings[ring];
-                        qlcnic_83xx_disable_intr(adapter, sds_ring);
+                        if (adapter->flags & QLCNIC_MSIX_ENABLED)
-                        if (!(adapter->flags & QLCNIC_MSIX_ENABLED))
+                                qlcnic_83xx_disable_intr(adapter, sds_ring);
-                                qlcnic_83xx_enable_mbx_poll(adapter);
                }
        }
        qlcnic_fw_destroy_ctx(adapter);
        qlcnic_detach(adapter);
-        if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        err = qlcnic_83xx_setup_mbx_intr(adapter);
-                        qlcnic_83xx_disable_mbx_poll(adapter);
-                        if (err) {
-                                dev_err(&adapter->pdev->dev,
-                                        "%s: failed to setup mbx interrupt\n",
-                                        __func__);
-                                goto out;
-                        }
-                }
-        }
        adapter->ahw->diag_test = 0;
        adapter->drv_sds_rings = drv_sds_rings;
@@ -1399,9 +1382,6 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
        if (netif_running(netdev))
                __qlcnic_up(adapter, netdev);
-        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST &&
-            !(adapter->flags & QLCNIC_MSIX_ENABLED))
-                qlcnic_83xx_disable_mbx_poll(adapter);
 out:
        netif_device_attach(netdev);
 }
@@ -1704,12 +1684,6 @@ int qlcnic_83xx_loopback_test(struct net_device *netdev, u8 mode)
                }
        } while ((adapter->ahw->linkup && ahw->has_link_events) != 1);
-        /* Make sure carrier is off and queue is stopped during loopback */
-        if (netif_running(netdev)) {
-                netif_carrier_off(netdev);
-                netif_tx_stop_all_queues(netdev);
-        }
        ret = qlcnic_do_lb_test(adapter, mode);
        qlcnic_83xx_clear_lb_mode(adapter, mode);
@@ -2141,6 +2115,7 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
        ahw->link_autoneg = MSB(MSW(data[3]));
        ahw->module_type = MSB(LSW(data[3]));
        ahw->has_link_events = 1;
+        ahw->lb_mode = data[4] & QLCNIC_LB_MODE_MASK;
        qlcnic_advert_link_change(adapter, link_status);
 }
@@ -3754,6 +3729,19 @@ static void qlcnic_83xx_decode_mbx_rsp(struct qlcnic_adapter *adapter,
        return;
 }
+static inline void qlcnic_dump_mailbox_registers(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 offset;
+        offset = QLCRDX(ahw, QLCNIC_DEF_INT_MASK);
+        dev_info(&adapter->pdev->dev, "Mbx interrupt mask=0x%x, Mbx interrupt enable=0x%x, Host mbx control=0x%x, Fw mbx control=0x%x",
+                 readl(ahw->pci_base0 + offset),
+                 QLCRDX(ahw, QLCNIC_MBX_INTR_ENBL),
+                 QLCRDX(ahw, QLCNIC_HOST_MBX_CTRL),
+                 QLCRDX(ahw, QLCNIC_FW_MBX_CTRL));
+}
 static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
 {
        struct qlcnic_mailbox *mbx = container_of(work, struct qlcnic_mailbox,
@@ -3798,6 +3786,8 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
                                __func__, cmd->cmd_op, cmd->type, ahw->pci_func,
                                ahw->op_mode);
                        clear_bit(QLC_83XX_MBX_READY, &mbx->status);
+                        qlcnic_dump_mailbox_registers(adapter);
+                        qlcnic_83xx_get_mbx_data(adapter, cmd);
                        qlcnic_dump_mbx(adapter, cmd);
                        qlcnic_83xx_idc_request_reset(adapter,
                                                      QLCNIC_FORCE_FW_DUMP_KEY);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 4cae6caa6bfa..a6a33508e401 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -662,4 +662,5 @@ pci_ers_result_t qlcnic_83xx_io_error_detected(struct pci_dev *,
                                               pci_channel_state_t);
 pci_ers_result_t qlcnic_83xx_io_slot_reset(struct pci_dev *);
 void qlcnic_83xx_io_resume(struct pci_dev *);
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *);
 #endif
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 89208e5b25d6..918e18ddf038 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -740,6 +740,7 @@ static int qlcnic_83xx_idc_unknown_state(struct qlcnic_adapter *adapter)
        adapter->ahw->idc.err_code = -EIO;
        dev_err(&adapter->pdev->dev,
                "%s: Device in unknown state\n", __func__);
+        clear_bit(__QLCNIC_RESETTING, &adapter->state);
        return 0;
 }
@@ -818,7 +819,6 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        struct qlcnic_mailbox *mbx = ahw->mailbox;
        int ret = 0;
-        u32 owner;
        u32 val;
        /* Perform NIC configuration based ready state entry actions */
@@ -848,9 +848,9 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
                        set_bit(__QLCNIC_RESETTING, &adapter->state);
                        qlcnic_83xx_idc_enter_need_reset_state(adapter, 1);
                }  else {
-                        owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                        netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
-                        if (ahw->pci_func == owner)
+                                    __func__);
-                                qlcnic_dump_fw(adapter);
+                        qlcnic_83xx_idc_enter_failed_state(adapter, 1);
                }
                return -EIO;
        }
@@ -948,13 +948,26 @@ static int qlcnic_83xx_idc_need_quiesce_state(struct qlcnic_adapter *adapter)
        return 0;
 }
-static int qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
+static void qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
 {
-        dev_err(&adapter->pdev->dev, "%s: please restart!!\n", __func__);
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 val, owner;
+        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                if (ahw->pci_func == owner) {
+                        qlcnic_83xx_stop_hw(adapter);
+                        qlcnic_dump_fw(adapter);
+                }
+        }
+        netdev_warn(adapter->netdev, "%s: Reboot will be required to recover the adapter!!\n",
+                    __func__);
        clear_bit(__QLCNIC_RESETTING, &adapter->state);
-        adapter->ahw->idc.err_code = -EIO;
+        ahw->idc.err_code = -EIO;
-        return 0;
+        return;
 }
 static int qlcnic_83xx_idc_quiesce_state(struct qlcnic_adapter *adapter)
@@ -1063,12 +1076,6 @@ void qlcnic_83xx_idc_poll_dev_state(struct work_struct *work)
        adapter->ahw->idc.prev_state = adapter->ahw->idc.curr_state;
        qlcnic_83xx_periodic_tasks(adapter);
-        /* Do not reschedule if firmaware is in hanged state and auto
-         * recovery is disabled
-         */
-        if ((adapter->flags & QLCNIC_FW_HANG) && !qlcnic_auto_fw_reset)
-                return;
        /* Re-schedule the function */
        if (test_bit(QLC_83XX_MODULE_LOADED, &adapter->ahw->idc.status))
                qlcnic_schedule_work(adapter, qlcnic_83xx_idc_poll_dev_state,
@@ -1219,10 +1226,10 @@ void qlcnic_83xx_idc_request_reset(struct qlcnic_adapter *adapter, u32 key)
        }
        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
-        if ((val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) ||
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
-            !qlcnic_auto_fw_reset) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
-                dev_err(&adapter->pdev->dev,
+                            __func__);
-                        "%s:failed, device in non reset mode\n", __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 0);
                qlcnic_83xx_unlock_driver(adapter);
                return;
        }
@@ -1254,24 +1261,24 @@ static int qlcnic_83xx_copy_bootloader(struct qlcnic_adapter *adapter)
        if (size & 0xF)
                size = (size + 16) & ~0xF;
-        p_cache = kzalloc(size, GFP_KERNEL);
+        p_cache = vzalloc(size);
        if (p_cache == NULL)
                return -ENOMEM;
        ret = qlcnic_83xx_lockless_flash_read32(adapter, src, p_cache,
                                                size / sizeof(u32));
        if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                return ret;
        }
        /* 16 byte write to MS memory */
        ret = qlcnic_83xx_ms_mem_write128(adapter, dest, (u32 *)p_cache,
                                          size / 16);
        if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                return ret;
        }
-        kfree(p_cache);
+        vfree(p_cache);
        return ret;
 }
@@ -1939,7 +1946,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
        p_dev->ahw->reset.seq_index = index;
 }
-static void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
 {
        p_dev->ahw->reset.seq_index = 0;
@@ -1994,6 +2001,14 @@ static int qlcnic_83xx_restart_hw(struct qlcnic_adapter *adapter)
        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
        if (!(val & QLC_83XX_IDC_GRACEFULL_RESET))
                qlcnic_dump_fw(adapter);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                            __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 1);
+                return err;
+        }
        qlcnic_83xx_init_hw(adapter);
        if (qlcnic_83xx_copy_bootloader(adapter))
@@ -2073,8 +2088,8 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
                ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
                ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
-                adapter->max_sds_rings = ahw->max_rx_ques;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
-                adapter->max_tx_rings = ahw->max_tx_ques;
+                adapter->max_tx_rings = QLCNIC_MAX_TX_RINGS;
        } else {
                return -EIO;
        }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index b36c02fafcfd..6b08194aa0d4 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -167,27 +167,35 @@ static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
 #define QLCNIC_TEST_LEN ARRAY_SIZE(qlcnic_gstrings_test)
-static inline int qlcnic_82xx_statistics(void)
+static inline int qlcnic_82xx_statistics(struct qlcnic_adapter *adapter)
 {
-        return ARRAY_SIZE(qlcnic_device_gstrings_stats) +
+        return ARRAY_SIZE(qlcnic_gstrings_stats) +
-               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings);
+               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings) +
+               QLCNIC_TX_STATS_LEN * adapter->drv_tx_rings;
 }
-static inline int qlcnic_83xx_statistics(void)
+static inline int qlcnic_83xx_statistics(struct qlcnic_adapter *adapter)
 {
-        return ARRAY_SIZE(qlcnic_83xx_tx_stats_strings) +
+        return ARRAY_SIZE(qlcnic_gstrings_stats) +
+               ARRAY_SIZE(qlcnic_83xx_tx_stats_strings) +
               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings) +
-               ARRAY_SIZE(qlcnic_83xx_rx_stats_strings);
+               ARRAY_SIZE(qlcnic_83xx_rx_stats_strings) +
+               QLCNIC_TX_STATS_LEN * adapter->drv_tx_rings;
 }
 static int qlcnic_dev_statistics_len(struct qlcnic_adapter *adapter)
 {
-        if (qlcnic_82xx_check(adapter))
+        int len = -1;
-                return qlcnic_82xx_statistics();
-        else if (qlcnic_83xx_check(adapter))
+        if (qlcnic_82xx_check(adapter)) {
-                return qlcnic_83xx_statistics();
+                len = qlcnic_82xx_statistics(adapter);
-        else
+                if (adapter->flags & QLCNIC_ESWITCH_ENABLED)
-                return -1;
+                        len += ARRAY_SIZE(qlcnic_device_gstrings_stats);
+        } else if (qlcnic_83xx_check(adapter)) {
+                len = qlcnic_83xx_statistics(adapter);
+        }
+        return len;
 }
 #define QLCNIC_TX_INTR_NOT_CONFIGURED   0X78563412
@@ -667,30 +675,25 @@ qlcnic_set_ringparam(struct net_device *dev,
 static int qlcnic_validate_ring_count(struct qlcnic_adapter *adapter,
                                      u8 rx_ring, u8 tx_ring)
 {
+        if (rx_ring == 0 || tx_ring == 0)
+                return -EINVAL;
        if (rx_ring != 0) {
                if (rx_ring > adapter->max_sds_rings) {
-                        netdev_err(adapter->netdev, "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
+                        netdev_err(adapter->netdev,
+                                   "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
                                   rx_ring, adapter->max_sds_rings);
                        return -EINVAL;
                }
        }
         if (tx_ring != 0) {
-                if (qlcnic_82xx_check(adapter) &&
+                if (tx_ring > adapter->max_tx_rings) {
-                    (tx_ring > adapter->max_tx_rings)) {
                        netdev_err(adapter->netdev,
                                   "Invalid ring count, Tx ring count %d should not be greater than max %d driver Tx rings.\n",
                                   tx_ring, adapter->max_tx_rings);
                        return -EINVAL;
                }
-                if (qlcnic_83xx_check(adapter) &&
-                    (tx_ring > QLCNIC_SINGLE_RING)) {
-                        netdev_err(adapter->netdev,
-                                   "Invalid ring count, Tx ring count %d should not be greater than %d driver Tx rings.\n",
-                                   tx_ring, QLCNIC_SINGLE_RING);
-                         return -EINVAL;
-                }
        }
        return 0;
@@ -925,18 +928,13 @@ static int qlcnic_eeprom_test(struct net_device *dev)
 static int qlcnic_get_sset_count(struct net_device *dev, int sset)
 {
-        int len;
        struct qlcnic_adapter *adapter = netdev_priv(dev);
        switch (sset) {
        case ETH_SS_TEST:
                return QLCNIC_TEST_LEN;
        case ETH_SS_STATS:
-                len = qlcnic_dev_statistics_len(adapter) + QLCNIC_STATS_LEN;
+                return qlcnic_dev_statistics_len(adapter);
-                if ((adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
-                    qlcnic_83xx_check(adapter))
-                        return len;
-                return qlcnic_82xx_statistics();
        default:
                return -EOPNOTSUPP;
        }
@@ -948,6 +946,7 @@ static int qlcnic_irq_test(struct net_device *netdev)
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        struct qlcnic_cmd_args cmd;
        int ret, drv_sds_rings = adapter->drv_sds_rings;
+        int drv_tx_rings = adapter->drv_tx_rings;
        if (qlcnic_83xx_check(adapter))
                return qlcnic_83xx_interrupt_test(netdev);
@@ -980,6 +979,7 @@ free_diag_res:
 clear_diag_irq:
        adapter->drv_sds_rings = drv_sds_rings;
+        adapter->drv_tx_rings = drv_tx_rings;
        clear_bit(__QLCNIC_RESETTING, &adapter->state);
        return ret;
@@ -1270,7 +1270,7 @@ static u64 *qlcnic_fill_stats(u64 *data, void *stats, int type)
        return data;
 }
-static void qlcnic_update_stats(struct qlcnic_adapter *adapter)
+void qlcnic_update_stats(struct qlcnic_adapter *adapter)
 {
        struct qlcnic_host_tx_ring *tx_ring;
        int ring;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index e9c21e5d0ca9..c4262c23ed7c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -134,6 +134,8 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter,
        struct qlcnic_skb_frag *buffrag;
        int i, j;
+        spin_lock(&tx_ring->tx_clean_lock);
        cmd_buf = tx_ring->cmd_buf_arr;
        for (i = 0; i < tx_ring->num_desc; i++) {
                buffrag = cmd_buf->frag_array;
@@ -157,6 +159,8 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter,
                }
                cmd_buf++;
        }
+        spin_unlock(&tx_ring->tx_clean_lock);
 }
 void qlcnic_free_sw_resources(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 0149c9495347..ad1531ae3aa8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -687,17 +687,15 @@ void qlcnic_advert_link_change(struct qlcnic_adapter *adapter, int linkup)
        if (adapter->ahw->linkup && !linkup) {
                netdev_info(netdev, "NIC Link is down\n");
                adapter->ahw->linkup = 0;
-                if (netif_running(netdev)) {
+                netif_carrier_off(netdev);
-                        netif_carrier_off(netdev);
-                        netif_tx_stop_all_queues(netdev);
-                }
        } else if (!adapter->ahw->linkup && linkup) {
+                /* Do not advertise Link up if the port is in loopback mode */
+                if (qlcnic_83xx_check(adapter) && adapter->ahw->lb_mode)
+                        return;
                netdev_info(netdev, "NIC Link is up\n");
                adapter->ahw->linkup = 1;
-                if (netif_running(netdev)) {
+                netif_carrier_on(netdev);
-                        netif_carrier_on(netdev);
-                        netif_wake_queue(netdev);
-                }
        }
 }
@@ -784,7 +782,7 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
        struct net_device *netdev = adapter->netdev;
        struct qlcnic_skb_frag *frag;
-        if (!spin_trylock(&adapter->tx_clean_lock))
+        if (!spin_trylock(&tx_ring->tx_clean_lock))
                return 1;
        sw_consumer = tx_ring->sw_consumer;
@@ -813,8 +811,9 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
                        break;
        }
+        tx_ring->sw_consumer = sw_consumer;
        if (count && netif_running(netdev)) {
-                tx_ring->sw_consumer = sw_consumer;
                smp_mb();
                if (netif_tx_queue_stopped(tx_ring->txq) &&
                    netif_carrier_ok(netdev)) {
@@ -840,7 +839,8 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
         */
        hw_consumer = le32_to_cpu(*(tx_ring->hw_consumer));
        done = (sw_consumer == hw_consumer);
-        spin_unlock(&adapter->tx_clean_lock);
+        spin_unlock(&tx_ring->tx_clean_lock);
        return done;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 05c1eef8df13..550791b8fbae 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1178,6 +1178,7 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
        } else {
                adapter->ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                adapter->max_tx_rings = QLCNIC_MAX_HW_TX_RINGS;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
                adapter->flags &= ~QLCNIC_ESWITCH_ENABLED;
        }
@@ -1755,7 +1756,6 @@ void __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
        if (qlcnic_sriov_vf_check(adapter))
                qlcnic_sriov_cleanup_async_list(&adapter->ahw->sriov->bc);
        smp_mb();
-        spin_lock(&adapter->tx_clean_lock);
        netif_carrier_off(netdev);
        adapter->ahw->linkup = 0;
        netif_tx_disable(netdev);
@@ -1776,7 +1776,6 @@ void __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
        for (ring = 0; ring < adapter->drv_tx_rings; ring++)
                qlcnic_release_tx_buffers(adapter, &adapter->tx_ring[ring]);
-        spin_unlock(&adapter->tx_clean_lock);
 }
 /* Usage: During suspend and firmware recovery module */
@@ -1940,7 +1939,6 @@ int qlcnic_diag_alloc_res(struct net_device *netdev, int test)
        qlcnic_detach(adapter);
        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
-        adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
        adapter->ahw->diag_test = test;
        adapter->ahw->linkup = 0;
@@ -2172,6 +2170,7 @@ int qlcnic_alloc_tx_rings(struct qlcnic_adapter *adapter,
                }
                memset(cmd_buf_arr, 0, TX_BUFF_RINGSIZE(tx_ring));
                tx_ring->cmd_buf_arr = cmd_buf_arr;
+                spin_lock_init(&tx_ring->tx_clean_lock);
        }
        if (qlcnic_83xx_check(adapter) ||
@@ -2299,7 +2298,6 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        rwlock_init(&adapter->ahw->crb_lock);
        mutex_init(&adapter->ahw->mem_lock);
-        spin_lock_init(&adapter->tx_clean_lock);
        INIT_LIST_HEAD(&adapter->mac_list);
        qlcnic_register_dcb(adapter);
@@ -2782,6 +2780,9 @@ static struct net_device_stats *qlcnic_get_stats(struct net_device *netdev)
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        struct net_device_stats *stats = &netdev->stats;
+        if (test_bit(__QLCNIC_DEV_UP, &adapter->state))
+                qlcnic_update_stats(adapter);
        stats->rx_packets = adapter->stats.rx_pkts + adapter->stats.lro_pkts;
        stats->tx_packets = adapter->stats.xmitfinished;
        stats->rx_bytes = adapter->stats.rxbytes + adapter->stats.lrobytes;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 686f460b1502..024f8161d2fe 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -75,7 +75,6 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
        num_vfs = sriov->num_vfs;
        max = num_vfs + 1;
        info->bit_offsets = 0xffff;
-        info->max_tx_ques = res->num_tx_queues / max;
        info->max_rx_mcast_mac_filters = res->num_rx_mcast_mac_filters;
        num_vf_macs = QLCNIC_SRIOV_VF_MAX_MAC;
@@ -86,6 +85,7 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
                info->max_tx_mac_filters = temp;
                info->min_tx_bw = 0;
                info->max_tx_bw = MAX_BW;
+                info->max_tx_ques = res->num_tx_queues - sriov->num_vfs;
        } else {
                id = qlcnic_sriov_func_to_index(adapter, func);
                if (id < 0)
@@ -95,6 +95,7 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
                info->max_tx_bw = vp->max_tx_bw;
                info->max_rx_ucast_mac_filters = num_vf_macs;
                info->max_tx_mac_filters = num_vf_macs;
+                info->max_tx_ques = QLCNIC_SINGLE_RING;
        }
        info->max_rx_ip_addr = res->num_destip / max;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8a7a23a84ac5..797b56a0efc4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -622,17 +622,15 @@ static int stmmac_init_ptp(struct stmmac_priv *priv)
        if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
                return -EOPNOTSUPP;
-        if (netif_msg_hw(priv)) {
+        priv->adv_ts = 0;
-                if (priv->dma_cap.time_stamp) {
+        if (priv->dma_cap.atime_stamp && priv->extend_desc)
-                        pr_debug("IEEE 1588-2002 Time Stamp supported\n");
+                priv->adv_ts = 1;
-                        priv->adv_ts = 0;
-                }
+        if (netif_msg_hw(priv) && priv->dma_cap.time_stamp)
-                if (priv->dma_cap.atime_stamp && priv->extend_desc) {
+                pr_debug("IEEE 1588-2002 Time Stamp supported\n");
-                        pr_debug
-                            ("IEEE 1588-2008 Advanced Time Stamp supported\n");
+        if (netif_msg_hw(priv) && priv->adv_ts)
-                        priv->adv_ts = 1;
+                pr_debug("IEEE 1588-2008 Advanced Time Stamp supported\n");
-                }
-        }
        priv->hw->ptp = &stmmac_ptp;
        priv->hwts_tx_en = 0;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index b8b0eeed0f92..7680581ebe12 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -56,7 +56,7 @@ static int stmmac_adjust_freq(struct ptp_clock_info *ptp, s32 ppb)
        priv->hw->ptp->config_addend(priv->ioaddr, addend);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->ptp_lock, flags);
        return 0;
 }
@@ -91,7 +91,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
        priv->hw->ptp->adjust_systime(priv->ioaddr, sec, nsec, neg_adj);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->ptp_lock, flags);
        return 0;
 }
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 5120d9ce1dd4..5330fd298705 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -740,6 +740,8 @@ static void _cpsw_adjust_link(struct cpsw_slave *slave,
                /* set speed_in input in case RMII mode is used in 100Mbps */
                if (phy->speed == 100)
                        mac_control |= BIT(15);
+                else if (phy->speed == 10)
+                        mac_control |= BIT(18); /* In Band mode */
                *link = true;
        } else {
@@ -2106,7 +2108,7 @@ static int cpsw_probe(struct platform_device *pdev)
        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                for (i = res->start; i <= res->end; i++) {
                        if (devm_request_irq(&pdev->dev, i, cpsw_interrupt, 0,
-                                             dev_name(priv->dev), priv)) {
+                                             dev_name(&pdev->dev), priv)) {
                                dev_err(priv->dev, "error attaching irq\n");
                                goto clean_ale_ret;
                        }
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 628b736e5ae7..0e9fb3301b11 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2080,7 +2080,8 @@ static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
 }
 /* Return subqueue id on this core (one per core). */
-static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb,
+                                 void *accel_priv)
 {
        return smp_processor_id();
 }
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 3169252613fa..5d78c1d08abd 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
        case HDLCDRVCTL_CALIBRATE:
                if(!capable(CAP_SYS_RAWIO))
                        return -EPERM;
+                if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+                        return -EINVAL;
                s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
                return 0;
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 1971411574db..61dd2447e1bb 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                break;
        case SIOCYAMGCFG:
+                memset(&yi, 0, sizeof(yi));
                yi.cfg.mask = 0xffffffff;
                yi.cfg.iobase = yp->iobase;
                yi.cfg.irq = yp->irq;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 524f713f6017..71baeb3ed905 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -261,9 +261,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
        struct sk_buff *skb;
        net = ((struct netvsc_device *)hv_get_drvdata(device_obj))->ndev;
-        if (!net) {
+        if (!net || net->reg_state != NETREG_REGISTERED) {
-                netdev_err(net, "got receive callback but net device"
-                        " not initialized yet\n");
                packet->status = NVSP_STAT_FAIL;
                return 0;
        }
@@ -327,7 +325,6 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
                return -EINVAL;
        nvdev->start_remove = true;
-        cancel_delayed_work_sync(&ndevctx->dwork);
        cancel_work_sync(&ndevctx->work);
        netif_tx_disable(ndev);
        rndis_filter_device_remove(hdev);
@@ -436,19 +433,11 @@ static int netvsc_probe(struct hv_device *dev,
        SET_ETHTOOL_OPS(net, &ethtool_ops);
        SET_NETDEV_DEV(net, &dev->device);
-        ret = register_netdev(net);
-        if (ret != 0) {
-                pr_err("Unable to register netdev.\n");
-                free_netdev(net);
-                goto out;
-        }
        /* Notify the netvsc driver of the new device */
        device_info.ring_size = ring_size;
        ret = rndis_filter_device_add(dev, &device_info);
        if (ret != 0) {
                netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
-                unregister_netdev(net);
                free_netdev(net);
                hv_set_drvdata(dev, NULL);
                return ret;
@@ -457,7 +446,13 @@ static int netvsc_probe(struct hv_device *dev,
        netif_carrier_on(net);
-out:
+        ret = register_netdev(net);
+        if (ret != 0) {
+                pr_err("Unable to register netdev.\n");
+                rndis_filter_device_remove(dev);
+                free_netdev(net);
+        }
        return ret;
 }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index acf93798dc67..bc8faaec33f5 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -299,7 +299,7 @@ netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
        if (vlan->fwd_priv) {
                skb->dev = vlan->lowerdev;
-                ret = dev_hard_start_xmit(skb, skb->dev, NULL, vlan->fwd_priv);
+                ret = dev_queue_xmit_accel(skb, vlan->fwd_priv);
        } else {
                ret = macvlan_queue_xmit(skb, dev);
        }
@@ -338,6 +338,8 @@ static const struct header_ops macvlan_hard_header_ops = {
        .cache_update   = eth_header_cache_update,
 };
+static struct rtnl_link_ops macvlan_link_ops;
 static int macvlan_open(struct net_device *dev)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
@@ -353,7 +355,8 @@ static int macvlan_open(struct net_device *dev)
                goto hash_add;
        }
-        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD) {
+        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD &&
+            dev->rtnl_link_ops == &macvlan_link_ops) {
                vlan->fwd_priv =
                      lowerdev->netdev_ops->ndo_dfwd_add_station(lowerdev, dev);
@@ -362,10 +365,8 @@ static int macvlan_open(struct net_device *dev)
                 */
                if (IS_ERR_OR_NULL(vlan->fwd_priv)) {
                        vlan->fwd_priv = NULL;
-                } else {
+                } else
-                        dev->features &= ~NETIF_F_LLTX;
                        return 0;
-                }
        }
        err = -EBUSY;
@@ -690,8 +691,18 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
                                              netdev_features_t features)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
+        netdev_features_t mask;
+        features |= NETIF_F_ALL_FOR_ALL;
+        features &= (vlan->set_features | ~MACVLAN_FEATURES);
+        mask = features;
+        features = netdev_increment_features(vlan->lowerdev->features,
+                                             features,
+                                             mask);
+        features |= NETIF_F_LLTX;
-        return features & (vlan->set_features | ~MACVLAN_FEATURES);
+        return features;
 }
 static const struct ethtool_ops macvlan_ethtool_ops = {
@@ -1019,9 +1030,8 @@ static int macvlan_device_event(struct notifier_block *unused,
                break;
        case NETDEV_FEAT_CHANGE:
                list_for_each_entry(vlan, &port->vlans, list) {
-                        vlan->dev->features = dev->features & MACVLAN_FEATURES;
                        vlan->dev->gso_max_size = dev->gso_max_size;
-                        netdev_features_change(vlan->dev);
+                        netdev_update_features(vlan->dev);
                }
                break;
        case NETDEV_UNREGISTER:
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 36c6994436b7..98434b84f041 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -565,10 +565,8 @@ int phy_start_interrupts(struct phy_device *phydev)
        int err = 0;
        atomic_set(&phydev->irq_disable, 0);
-        if (request_irq(phydev->irq, phy_interrupt,
+        if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
-                                IRQF_SHARED,
+                        phydev) < 0) {
-                                "phy_interrupt",
-                                phydev) < 0) {
                pr_warn("%s: Can't get IRQ %d (PHY)\n",
                        phydev->bus->name, phydev->irq);
                phydev->irq = PHY_POLL;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 736050d6b451..b75ae5bde673 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1647,7 +1647,8 @@ static netdev_tx_t team_xmit(struct sk_buff *skb, struct net_device *dev)
        return NETDEV_TX_OK;
 }
-static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb,
+                             void *accel_priv)
 {
        /*
         * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7c8343a4f918..ecec8029c5e8 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -348,7 +348,8 @@ unlock:
 * different rxq no. here. If we could not get rxhash, then we would
 * hope the rxq no. may help here.
 */
-static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
        struct tun_struct *tun = netdev_priv(dev);
        struct tun_flow_entry *e;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 85e4a01670f0..47b0f732b0b1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -276,12 +276,12 @@ config USB_NET_CDC_MBIM
          module will be called cdc_mbim.
 config USB_NET_DM9601
-        tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
+        tristate "Davicom DM96xx based USB 10/100 ethernet devices"
        depends on USB_USBNET
        select CRC32
        help
-          This option adds support for Davicom DM9601 based USB 1.1
+          This option adds support for Davicom DM9601/DM9620/DM9621A
-          10/100 Ethernet adapters.
+          based USB 10/100 Ethernet adapters.
 config USB_NET_SR9700
        tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index c6867f926cff..14aa48fa8d7e 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -1,5 +1,5 @@
 /*
- * Davicom DM9601 USB 1.1 10/100Mbps ethernet devices
+ * Davicom DM96xx USB 10/100Mbps ethernet devices
 *
 * Peter Korsgaard <jacmet@sunsite.dk>
 *
@@ -364,7 +364,12 @@ static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
        dev->net->ethtool_ops = &dm9601_ethtool_ops;
        dev->net->hard_header_len += DM_TX_OVERHEAD;
        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
-        dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD;
+        /* dm9620/21a require room for 4 byte padding, even in dm9601
+         * mode, so we need +1 to be able to receive full size
+         * ethernet frames.
+         */
+        dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD + 1;
        dev->mii.dev = dev->net;
        dev->mii.mdio_read = dm9601_mdio_read;
@@ -468,7 +473,7 @@ static int dm9601_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                                       gfp_t flags)
 {
-        int len;
+        int len, pad;
        /* format:
           b1: packet length low
@@ -476,12 +481,23 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
           b3..n: packet data
        */
-        len = skb->len;
+        len = skb->len + DM_TX_OVERHEAD;
+        /* workaround for dm962x errata with tx fifo getting out of
+         * sync if a USB bulk transfer retry happens right after a
+         * packet with odd / maxpacket length by adding up to 3 bytes
+         * padding.
+         */
+        while ((len & 1) || !(len % dev->maxpacket))
+                len++;
-        if (skb_headroom(skb) < DM_TX_OVERHEAD) {
+        len -= DM_TX_OVERHEAD; /* hw header doesn't count as part of length */
+        pad = len - skb->len;
+        if (skb_headroom(skb) < DM_TX_OVERHEAD || skb_tailroom(skb) < pad) {
                struct sk_buff *skb2;
-                skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, 0, flags);
+                skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, pad, flags);
                dev_kfree_skb_any(skb);
                skb = skb2;
                if (!skb)
@@ -490,10 +506,10 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
        __skb_push(skb, DM_TX_OVERHEAD);
-        /* usbnet adds padding if length is a multiple of packet size
+        if (pad) {
-           if so, adjust length value in header */
+                memset(skb->data + skb->len, 0, pad);
-        if ((skb->len % dev->maxpacket) == 0)
+                __skb_put(skb, pad);
-                len++;
+        }
        skb->data[0] = len;
        skb->data[1] = len >> 8;
@@ -543,7 +559,7 @@ static int dm9601_link_reset(struct usbnet *dev)
 }
 static const struct driver_info dm9601_info = {
-        .description    = "Davicom DM9601 USB Ethernet",
+        .description    = "Davicom DM96xx USB 10/100 Ethernet",
        .flags          = FLAG_ETHER | FLAG_LINK_INTR,
        .bind           = dm9601_bind,
        .rx_fixup       = dm9601_rx_fixup,
@@ -594,6 +610,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0a46, 0x9620),    /* DM9620 USB to Fast Ethernet Adapter */
         .driver_info = (unsigned long)&dm9601_info,
         },
+        {
+         USB_DEVICE(0x0a46, 0x9621),    /* DM9621A USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
        {},                     // END
 };
@@ -612,5 +632,5 @@ static struct usb_driver dm9601_driver = {
 module_usb_driver(dm9601_driver);
 MODULE_AUTHOR("Peter Korsgaard <jacmet@sunsite.dk>");
-MODULE_DESCRIPTION("Davicom DM9601 USB 1.1 ethernet devices");
+MODULE_DESCRIPTION("Davicom DM96xx USB 10/100 ethernet devices");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 86292e6aaf49..1a482344b3f5 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -185,7 +185,6 @@ enum rx_ctrl_state{
 #define BM_REQUEST_TYPE (0xa1)
 #define B_NOTIFICATION  (0x20)
 #define W_VALUE         (0x0)
-#define W_INDEX         (0x2)
 #define W_LENGTH        (0x2)
 #define B_OVERRUN       (0x1<<6)
@@ -1487,6 +1486,7 @@ static void tiocmget_intr_callback(struct urb *urb)
        struct uart_icount *icount;
        struct hso_serial_state_notification *serial_state_notification;
        struct usb_device *usb;
+        int if_num;
        /* Sanity checks */
        if (!serial)
@@ -1495,15 +1495,24 @@ static void tiocmget_intr_callback(struct urb *urb)
                handle_usb_error(status, __func__, serial->parent);
                return;
        }
+        /* tiocmget is only supported on HSO_PORT_MODEM */
        tiocmget = serial->tiocmget;
        if (!tiocmget)
                return;
+        BUG_ON((serial->parent->port_spec & HSO_PORT_MASK) != HSO_PORT_MODEM);
        usb = serial->parent->usb;
+        if_num = serial->parent->interface->altsetting->desc.bInterfaceNumber;
+        /* wIndex should be the USB interface number of the port to which the
+         * notification applies, which should always be the Modem port.
+         */
        serial_state_notification = &tiocmget->serial_state_notification;
        if (serial_state_notification->bmRequestType != BM_REQUEST_TYPE ||
            serial_state_notification->bNotification != B_NOTIFICATION ||
            le16_to_cpu(serial_state_notification->wValue) != W_VALUE ||
-            le16_to_cpu(serial_state_notification->wIndex) != W_INDEX ||
+            le16_to_cpu(serial_state_notification->wIndex) != if_num ||
            le16_to_cpu(serial_state_notification->wLength) != W_LENGTH) {
                dev_warn(&usb->dev,
                         "hso received invalid serial state notification\n");
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index 03832d3780aa..f54637828574 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -117,7 +117,6 @@ enum {
 struct mcs7830_data {
        u8 multi_filter[8];
        u8 config;
-        u8 link_counter;
 };
 static const char driver_name[] = "MOSCHIP usb-ethernet driver";
@@ -561,26 +560,16 @@ static void mcs7830_status(struct usbnet *dev, struct urb *urb)
 {
        u8 *buf = urb->transfer_buffer;
        bool link, link_changed;
-        struct mcs7830_data *data = mcs7830_get_data(dev);
        if (urb->actual_length < 16)
                return;
-        link = !(buf[1] & 0x20);
+        link = !(buf[1] == 0x20);
        link_changed = netif_carrier_ok(dev->net) != link;
        if (link_changed) {
-                data->link_counter++;
+                usbnet_link_change(dev, link, 0);
-                /*
+                netdev_dbg(dev->net, "Link Status is: %d\n", link);
-                   track link state 20 times to guard against erroneous
+        }
-                   link state changes reported sometimes by the chip
-                 */
-                if (data->link_counter > 20) {
-                        data->link_counter = 0;
-                        usbnet_link_change(dev, link, 0);
-                        netdev_dbg(dev->net, "Link Status is: %d\n", link);
-                }
-        } else
-                data->link_counter = 0;
 }
 static const struct driver_info moschip_info = {
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d208f8604981..5d776447d9c3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1797,16 +1797,17 @@ static int virtnet_restore(struct virtio_device *vdev)
        if (err)
                return err;
-        if (netif_running(vi->dev))
+        if (netif_running(vi->dev)) {
+                for (i = 0; i < vi->curr_queue_pairs; i++)
+                        if (!try_fill_recv(&vi->rq[i], GFP_KERNEL))
+                                schedule_delayed_work(&vi->refill, 0);
                for (i = 0; i < vi->max_queue_pairs; i++)
                        virtnet_napi_enable(&vi->rq[i]);
+        }
        netif_device_attach(vi->dev);
-        for (i = 0; i < vi->curr_queue_pairs; i++)
-                if (!try_fill_recv(&vi->rq[i], GFP_KERNEL))
-                        schedule_delayed_work(&vi->refill, 0);
        mutex_lock(&vi->config_lock);
        vi->config_enable = true;
        mutex_unlock(&vi->config_lock);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 249e01c5600c..ed384fee76ac 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2440,7 +2440,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
                /* update header length based on lower device */
                dev->hard_header_len = lowerdev->hard_header_len +
                                       (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
-        }
+        } else if (use_ipv6)
+                vxlan->flags |= VXLAN_F_IPV6;
        if (data[IFLA_VXLAN_TOS])
                vxlan->tos  = nla_get_u8(data[IFLA_VXLAN_TOS]);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index 8d78253c26ce..a366d6b4626f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                                mask2 |= ATH9K_INT_CST;
                        if (isr2 & AR_ISR_S2_TSFOOR)
                                mask2 |= ATH9K_INT_TSFOOR;
+                        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                                REG_WRITE(ah, AR_ISR_S2, isr2);
+                                isr &= ~AR_ISR_BCNMISC;
+                        }
                }
-                isr = REG_READ(ah, AR_ISR_RAC);
+                if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)
+                        isr = REG_READ(ah, AR_ISR_RAC);
                if (isr == 0xffffffff) {
                        *masked = 0;
                        return false;
@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                        *masked |= ATH9K_INT_TX;
-                        s0_s = REG_READ(ah, AR_ISR_S0_S);
+                        if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
+                                s0_s = REG_READ(ah, AR_ISR_S0_S);
+                                s1_s = REG_READ(ah, AR_ISR_S1_S);
+                        } else {
+                                s0_s = REG_READ(ah, AR_ISR_S0);
+                                REG_WRITE(ah, AR_ISR_S0, s0_s);
+                                s1_s = REG_READ(ah, AR_ISR_S1);
+                                REG_WRITE(ah, AR_ISR_S1, s1_s);
+                                isr &= ~(AR_ISR_TXOK |
+                                         AR_ISR_TXDESC |
+                                         AR_ISR_TXERR |
+                                         AR_ISR_TXEOL);
+                        }
                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK);
                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC);
-                        s1_s = REG_READ(ah, AR_ISR_S1_S);
                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR);
                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL);
                }
@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                *masked |= mask2;
        }
-        if (AR_SREV_9100(ah))
+        if (!AR_SREV_9100(ah) && (isr & AR_ISR_GENTMR)) {
-                return true;
-        if (isr & AR_ISR_GENTMR) {
                u32 s5_s;
-                s5_s = REG_READ(ah, AR_ISR_S5_S);
+                if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
+                        s5_s = REG_READ(ah, AR_ISR_S5_S);
+                } else {
+                        s5_s = REG_READ(ah, AR_ISR_S5);
+                }
                ah->intr_gen_timer_trigger =
                                MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                if ((s5_s & AR_ISR_S5_TIM_TIMER) &&
                    !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
                        *masked |= ATH9K_INT_TIM_TIMER;
+                if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                        REG_WRITE(ah, AR_ISR_S5, s5_s);
+                        isr &= ~AR_ISR_GENTMR;
+                }
        }
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                REG_WRITE(ah, AR_ISR, isr);
+                REG_READ(ah, AR_ISR);
+        }
+        if (AR_SREV_9100(ah))
+                return true;
        if (sync_cause) {
                ath9k_debug_sync_cause(common, sync_cause);
                fatal_int =
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 9a2657fdd9cc..608d739d1378 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -127,21 +127,26 @@ static void ath9k_htc_bssid_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
        struct ath9k_vif_iter_data *iter_data = data;
        int i;
-        for (i = 0; i < ETH_ALEN; i++)
+        if (iter_data->hw_macaddr != NULL) {
-                iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+                for (i = 0; i < ETH_ALEN; i++)
+                        iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+        } else {
+                iter_data->hw_macaddr = mac;
+        }
 }
-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
+static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv,
                                     struct ieee80211_vif *vif)
 {
        struct ath_common *common = ath9k_hw_common(priv->ah);
        struct ath9k_vif_iter_data iter_data;
        /*
-         * Use the hardware MAC address as reference, the hardware uses it
+         * Pick the MAC address of the first interface as the new hardware
-         * together with the BSSID mask when matching addresses.
+         * MAC address. The hardware will use it together with the BSSID mask
+         * when matching addresses.
         */
-        iter_data.hw_macaddr = common->macaddr;
+        iter_data.hw_macaddr = NULL;
        memset(&iter_data.mask, 0xff, ETH_ALEN);
        if (vif)
@@ -153,6 +158,10 @@ static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
                ath9k_htc_bssid_iter, &iter_data);
        memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
+        if (iter_data.hw_macaddr)
+                memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
        ath_hw_setbssidmask(common);
 }
@@ -1063,7 +1072,7 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
                goto out;
        }
-        ath9k_htc_set_bssid_mask(priv, vif);
+        ath9k_htc_set_mac_bssid_mask(priv, vif);
        priv->vif_slot |= (1 << avp->index);
        priv->nvifs++;
@@ -1128,7 +1137,7 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
        ath9k_htc_set_opmode(priv);
-        ath9k_htc_set_bssid_mask(priv, vif);
+        ath9k_htc_set_mac_bssid_mask(priv, vif);
        /*
         * Stop ANI only if there are no associated station interfaces.
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 74f452c7b166..21aa09e0e825 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -965,8 +965,9 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
        struct ath_common *common = ath9k_hw_common(ah);
        /*
-         * Use the hardware MAC address as reference, the hardware uses it
+         * Pick the MAC address of the first interface as the new hardware
-         * together with the BSSID mask when matching addresses.
+         * MAC address. The hardware will use it together with the BSSID mask
+         * when matching addresses.
         */
        memset(iter_data, 0, sizeof(*iter_data));
        memset(&iter_data->mask, 0xff, ETH_ALEN);
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 86605027c41d..e6272546395a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -357,21 +357,27 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x500A, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5420, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5090, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5190, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index c72438bb2faf..a1b32ee9594a 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2011,7 +2011,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
           (hwsim_flags & HWSIM_TX_STAT_ACK)) {
                if (skb->len >= 16) {
                        hdr = (struct ieee80211_hdr *) skb->data;
-                        mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
+                        mac80211_hwsim_monitor_ack(data2->channel,
                                                   hdr->addr2);
                }
                txi->flags |= IEEE80211_TX_STAT_ACK;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 78e8a6666cc6..8bb8988c435c 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -746,7 +746,8 @@ static struct net_device_stats *mwifiex_get_stats(struct net_device *dev)
 }
 static u16
-mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb)
+mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb,
+                                void *accel_priv)
 {
        skb->priority = cfg80211_classify8021d(skb);
        return mwifiex_1d_to_wmm_queue[skb->priority];
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 0f494444bcd1..5a53195d016b 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -740,6 +740,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
        };
        int index = rtlpci->rx_ring[rx_queue_idx].idx;
+        if (rtlpci->driver_is_goingto_unload)
+                return;
        /*RX NORMAL PKT */
        while (count--) {
                /*rx descriptor */
@@ -1636,6 +1638,7 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
         */
        set_hal_stop(rtlhal);
+        rtlpci->driver_is_goingto_unload = true;
        rtlpriv->cfg->ops->disable_interrupt(hw);
        cancel_work_sync(&rtlpriv->works.lps_change_work);
@@ -1653,7 +1656,6 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
        ppsc->rfchange_inprogress = true;
        spin_unlock_irqrestore(&rtlpriv->locks.rf_ps_lock, flags);
-        rtlpci->driver_is_goingto_unload = true;
        rtlpriv->cfg->ops->hw_disable(hw);
        /* some things are not needed if firmware not available */
        if (!rtlpriv->max_fw_size)
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 08ae01b41c83..c47794b9d42f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -101,6 +101,13 @@ struct xenvif_rx_meta {
 #define MAX_PENDING_REQS 256
+/* It's possible for an skb to have a maximal number of frags
+ * but still be less than MAX_BUFFER_OFFSET in size. Thus the
+ * worst-case number of copy operations is MAX_SKB_FRAGS per
+ * ring slot.
+ */
+#define MAX_GRANT_COPY_OPS (MAX_SKB_FRAGS * XEN_NETIF_RX_RING_SIZE)
 struct xenvif {
        /* Unique identifier for this interface. */
        domid_t          domid;
@@ -143,13 +150,13 @@ struct xenvif {
         */
        RING_IDX rx_req_cons_peek;
-        /* Given MAX_BUFFER_OFFSET of 4096 the worst case is that each
+        /* This array is allocated seperately as it is large */
-         * head/fragment page uses 2 copy operations because it
+        struct gnttab_copy *grant_copy_op;
-         * straddles two buffers in the frontend.
-         */
-        struct gnttab_copy grant_copy_op[2*XEN_NETIF_RX_RING_SIZE];
-        struct xenvif_rx_meta meta[2*XEN_NETIF_RX_RING_SIZE];
+        /* We create one meta structure per ring request we consume, so
+         * the maximum number is the same as the ring size.
+         */
+        struct xenvif_rx_meta meta[XEN_NETIF_RX_RING_SIZE];
        u8               fe_dev_addr[6];
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 870f1fa58370..fff8cddfed81 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -34,6 +34,7 @@
 #include <linux/ethtool.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_vlan.h>
+#include <linux/vmalloc.h>
 #include <xen/events.h>
 #include <asm/xen/hypercall.h>
@@ -307,6 +308,15 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
        SET_NETDEV_DEV(dev, parent);
        vif = netdev_priv(dev);
+        vif->grant_copy_op = vmalloc(sizeof(struct gnttab_copy) *
+                                     MAX_GRANT_COPY_OPS);
+        if (vif->grant_copy_op == NULL) {
+                pr_warn("Could not allocate grant copy space for %s\n", name);
+                free_netdev(dev);
+                return ERR_PTR(-ENOMEM);
+        }
        vif->domid  = domid;
        vif->handle = handle;
        vif->can_sg = 1;
@@ -487,6 +497,7 @@ void xenvif_free(struct xenvif *vif)
        unregister_netdev(vif->dev);
+        vfree(vif->grant_copy_op);
        free_netdev(vif->dev);
        module_put(THIS_MODULE);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index e884ee1fe7ed..78425554a537 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -608,7 +608,7 @@ void xenvif_rx_action(struct xenvif *vif)
        if (!npo.copy_prod)
                return;
-        BUG_ON(npo.copy_prod > ARRAY_SIZE(vif->grant_copy_op));
+        BUG_ON(npo.copy_prod > MAX_GRANT_COPY_OPS);
        gnttab_batch_copy(vif->grant_copy_op, npo.copy_prod);
        while ((skb = __skb_dequeue(&rxq)) != NULL) {
@@ -1197,6 +1197,9 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
        err = -EPROTO;
+        if (fragment)
+                goto out;
        switch (ip_hdr(skb)->protocol) {
        case IPPROTO_TCP:
                err = maybe_pull_tail(skb,
@@ -1206,8 +1209,10 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                        goto out;
                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
                        goto out;
+                }
                if (recalculate_partial_csum)
                        tcp_hdr(skb)->check =
@@ -1224,8 +1229,10 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                        goto out;
                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check)))
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
                        goto out;
+                }
                if (recalculate_partial_csum)
                        udp_hdr(skb)->check =
@@ -1347,8 +1354,10 @@ static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                        goto out;
                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
                        goto out;
+                }
                if (recalculate_partial_csum)
                        tcp_hdr(skb)->check =
@@ -1365,8 +1374,10 @@ static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                        goto out;
                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check)))
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
                        goto out;
+                }
                if (recalculate_partial_csum)
                        udp_hdr(skb)->check =
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index de6f8990246f..c6973f101a3e 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -20,7 +20,7 @@ config OF_SELFTEST
        depends on OF_IRQ
        help
          This option builds in test cases for the device tree infrastructure
-          that are executed one at boot time, and the results dumped to the
+          that are executed once at boot time, and the results dumped to the
          console.
          If unsure, say N here, but this option is safe to enable.
diff --git a/drivers/of/address.c b/drivers/of/address.c
index 4b9317bdb81c..d3dd41c840f1 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -69,14 +69,6 @@ static u64 of_bus_default_map(__be32 *addr, const __be32 *range,
                 (unsigned long long)cp, (unsigned long long)s,
                 (unsigned long long)da);
-        /*
-         * If the number of address cells is larger than 2 we assume the
-         * mapping doesn't specify a physical address. Rather, the address
-         * specifies an identifier that must match exactly.
-         */
-        if (na > 2 && memcmp(range, addr, na * 4) != 0)
-                return OF_BAD_ADDR;
        if (da < cp || da >= (cp + s))
                return OF_BAD_ADDR;
        return da - cp;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 2fa024b97c43..758b4f8b30b7 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -922,8 +922,16 @@ void __init unflatten_device_tree(void)
 */
 void __init unflatten_and_copy_device_tree(void)
 {
-        int size = __be32_to_cpu(initial_boot_params->totalsize);
+        int size;
-        void *dt = early_init_dt_alloc_memory_arch(size,
+        void *dt;
+        if (!initial_boot_params) {
+                pr_warn("No valid device tree found, continuing without\n");
+                return;
+        }
+        size = __be32_to_cpu(initial_boot_params->totalsize);
+        dt = early_init_dt_alloc_memory_arch(size,
                __alignof__(struct boot_param_header));
        if (dt) {
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 786b0b47fae4..27212402c532 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -165,7 +165,6 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
                if (of_get_property(ipar, "interrupt-controller", NULL) !=
                                NULL) {
                        pr_debug(" -> got it !\n");
-                        of_node_put(old);
                        return 0;
                }
@@ -250,8 +249,7 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
                 * Successfully parsed an interrrupt-map translation; copy new
                 * interrupt specifier into the out_irq structure
                 */
-                of_node_put(out_irq->np);
+                out_irq->np = newpar;
-                out_irq->np = of_node_get(newpar);
                match_array = imap - newaddrsize - newintsize;
                for (i = 0; i < newintsize; i++)
@@ -268,7 +266,6 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
        }
 fail:
        of_node_put(ipar);
-        of_node_put(out_irq->np);
        of_node_put(newpar);
        return -EINVAL;
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 1cf605f67673..e86439283a5d 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -279,7 +279,9 @@ static acpi_status register_slot(acpi_handle handle, u32 lvl, void *data,
        status = acpi_evaluate_integer(handle, "_ADR", NULL, &adr);
        if (ACPI_FAILURE(status)) {
-                acpi_handle_warn(handle, "can't evaluate _ADR (%#x)\n", status);
+                if (status != AE_NOT_FOUND)
+                        acpi_handle_warn(handle,
+                                "can't evaluate _ADR (%#x)\n", status);
                return AE_OK;
        }
@@ -643,6 +645,24 @@ static void disable_slot(struct acpiphp_slot *slot)
        slot->flags &= (~SLOT_ENABLED);
 }
+static bool acpiphp_no_hotplug(acpi_handle handle)
+{
+        struct acpi_device *adev = NULL;
+        acpi_bus_get_device(handle, &adev);
+        return adev && adev->flags.no_hotplug;
+}
+static bool slot_no_hotplug(struct acpiphp_slot *slot)
+{
+        struct acpiphp_func *func;
+        list_for_each_entry(func, &slot->funcs, sibling)
+                if (acpiphp_no_hotplug(func_to_handle(func)))
+                        return true;
+        return false;
+}
 /**
 * get_slot_status - get ACPI slot status
@@ -701,7 +721,8 @@ static void trim_stale_devices(struct pci_dev *dev)
                unsigned long long sta;
                status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
-                alive = ACPI_SUCCESS(status) && sta == ACPI_STA_ALL;
+                alive = (ACPI_SUCCESS(status) && sta == ACPI_STA_ALL)
+                        || acpiphp_no_hotplug(handle);
        }
        if (!alive) {
                u32 v;
@@ -741,8 +762,9 @@ static void acpiphp_check_bridge(struct acpiphp_bridge *bridge)
                struct pci_dev *dev, *tmp;
                mutex_lock(&slot->crit_sect);
-                /* wake up all functions */
+                if (slot_no_hotplug(slot)) {
-                if (get_slot_status(slot) == ACPI_STA_ALL) {
+                        ; /* do nothing */
+                } else if (get_slot_status(slot) == ACPI_STA_ALL) {
                        /* remove stale devices if any */
                        list_for_each_entry_safe(dev, tmp, &bus->devices,
                                                 bus_list)
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 577074efbe62..f7ebdba14bde 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -330,29 +330,32 @@ static int acpi_pci_find_device(struct device *dev, acpi_handle *handle)
 static void pci_acpi_setup(struct device *dev)
 {
        struct pci_dev *pci_dev = to_pci_dev(dev);
-        acpi_handle handle = ACPI_HANDLE(dev);
+        struct acpi_device *adev = ACPI_COMPANION(dev);
-        struct acpi_device *adev;
-        if (acpi_bus_get_device(handle, &adev) || !adev->wakeup.flags.valid)
+        if (!adev)
+                return;
+        pci_acpi_add_pm_notifier(adev, pci_dev);
+        if (!adev->wakeup.flags.valid)
                return;
        device_set_wakeup_capable(dev, true);
        acpi_pci_sleep_wake(pci_dev, false);
-        pci_acpi_add_pm_notifier(adev, pci_dev);
        if (adev->wakeup.flags.run_wake)
                device_set_run_wake(dev, true);
 }
 static void pci_acpi_cleanup(struct device *dev)
 {
-        acpi_handle handle = ACPI_HANDLE(dev);
+        struct acpi_device *adev = ACPI_COMPANION(dev);
-        struct acpi_device *adev;
+        if (!adev)
+                return;
-        if (!acpi_bus_get_device(handle, &adev) && adev->wakeup.flags.valid) {
+        pci_acpi_remove_pm_notifier(adev);
+        if (adev->wakeup.flags.valid) {
                device_set_wakeup_capable(dev, false);
                device_set_run_wake(dev, false);
-                pci_acpi_remove_pm_notifier(adev);
        }
 }
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index a344f3d52361..330ef2d06567 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -24,8 +24,8 @@ config PHY_EXYNOS_MIPI_VIDEO
 config OMAP_USB2
        tristate "OMAP USB2 PHY Driver"
        depends on ARCH_OMAP2PLUS
+        depends on USB_PHY
        select GENERIC_PHY
-        select USB_PHY
        select OMAP_CONTROL_USB
        help
          Enable this to support the transceiver that is part of SOC. This
@@ -36,8 +36,8 @@ config OMAP_USB2
 config TWL4030_USB
        tristate "TWL4030 USB Transceiver Driver"
        depends on TWL4030_CORE && REGULATOR_TWL4030 && USB_MUSB_OMAP2PLUS
+        depends on USB_PHY
        select GENERIC_PHY
-        select USB_PHY
        help
          Enable this to support the USB OTG transceiver on TWL4030
          family chips (including the TWL5030 and TPS659x0 devices).
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 03cf8fb81554..58e0e9739028 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -437,23 +437,18 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
        int id;
        struct phy *phy;
-        if (!dev) {
+        if (WARN_ON(!dev))
-                dev_WARN(dev, "no device provided for PHY\n");
+                return ERR_PTR(-EINVAL);
-                ret = -EINVAL;
-                goto err0;
-        }
        phy = kzalloc(sizeof(*phy), GFP_KERNEL);
-        if (!phy) {
+        if (!phy)
-                ret = -ENOMEM;
+                return ERR_PTR(-ENOMEM);
-                goto err0;
-        }
        id = ida_simple_get(&phy_ida, 0, 0, GFP_KERNEL);
        if (id < 0) {
                dev_err(dev, "unable to get id\n");
                ret = id;
-                goto err0;
+                goto free_phy;
        }
        device_initialize(&phy->dev);
@@ -468,11 +463,11 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
        ret = dev_set_name(&phy->dev, "phy-%s.%d", dev_name(dev), id);
        if (ret)
-                goto err1;
+                goto put_dev;
        ret = device_add(&phy->dev);
        if (ret)
-                goto err1;
+                goto put_dev;
        if (pm_runtime_enabled(dev)) {
                pm_runtime_enable(&phy->dev);
@@ -481,12 +476,11 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
        return phy;
-err1:
+put_dev:
-        ida_remove(&phy_ida, phy->id);
        put_device(&phy->dev);
+        ida_remove(&phy_ida, phy->id);
+free_phy:
        kfree(phy);
-err0:
        return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(phy_create);
diff --git a/drivers/pinctrl/pinctrl-baytrail.c b/drivers/pinctrl/pinctrl-baytrail.c
index 2832576d8b12..114f5ef4b73a 100644
--- a/drivers/pinctrl/pinctrl-baytrail.c
+++ b/drivers/pinctrl/pinctrl-baytrail.c
@@ -512,6 +512,7 @@ static const struct dev_pm_ops byt_gpio_pm_ops = {
 static const struct acpi_device_id byt_gpio_acpi_match[] = {
        { "INT33B2", 0 },
+        { "INT33FC", 0 },
        { }
 };
 MODULE_DEVICE_TABLE(acpi, byt_gpio_acpi_match);
diff --git a/drivers/pinctrl/sh-pfc/sh_pfc.h b/drivers/pinctrl/sh-pfc/sh_pfc.h
index 11bd0d970a52..e2142956a8e5 100644
--- a/drivers/pinctrl/sh-pfc/sh_pfc.h
+++ b/drivers/pinctrl/sh-pfc/sh_pfc.h
@@ -254,7 +254,7 @@ struct sh_pfc_soc_info {
 #define PINMUX_GPIO(_pin)                                               \
        [GPIO_##_pin] = {                                               \
                .pin = (u16)-1,                                         \
-                .name = __stringify(name),                              \
+                .name = __stringify(GPIO_##_pin),                       \
                .enum_id = _pin##_DATA,                                 \
        }
diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig
index 5e2054afe840..85ad58c6da17 100644
--- a/drivers/power/Kconfig
+++ b/drivers/power/Kconfig
@@ -196,6 +196,7 @@ config BATTERY_MAX17040
 config BATTERY_MAX17042
        tristate "Maxim MAX17042/17047/17050/8997/8966 Fuel Gauge"
        depends on I2C
+        select REGMAP_I2C
        help
          MAX17042 is fuel-gauge systems for lithium-ion (Li+) batteries
          in handheld and portable equipment. The MAX17042 is configured
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 00e667296360..557af943b2f5 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -511,6 +511,10 @@ int power_supply_register(struct device *parent, struct power_supply *psy)
        dev_set_drvdata(dev, psy);
        psy->dev = dev;
+        rc = dev_set_name(dev, "%s", psy->name);
+        if (rc)
+                goto dev_set_name_failed;
        INIT_WORK(&psy->changed_work, power_supply_changed_work);
        rc = power_supply_check_supplies(psy);
@@ -524,10 +528,6 @@ int power_supply_register(struct device *parent, struct power_supply *psy)
        if (rc)
                goto wakeup_init_failed;
-        rc = kobject_set_name(&dev->kobj, "%s", psy->name);
-        if (rc)
-                goto kobject_set_name_failed;
        rc = device_add(dev);
        if (rc)
                goto device_add_failed;
@@ -553,11 +553,11 @@ create_triggers_failed:
 register_cooler_failed:
        psy_unregister_thermal(psy);
 register_thermal_failed:
-wakeup_init_failed:
        device_del(dev);
-kobject_set_name_failed:
 device_add_failed:
+wakeup_init_failed:
 check_supplies_failed:
+dev_set_name_failed:
        put_device(dev);
 success:
        return rc;
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index 2a786c504460..3c6768378a94 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -833,6 +833,11 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
        return 0;
 }
+static const struct x86_cpu_id energy_unit_quirk_ids[] = {
+        { X86_VENDOR_INTEL, 6, 0x37},/* VLV */
+        {}
+};
 static int rapl_check_unit(struct rapl_package *rp, int cpu)
 {
        u64 msr_val;
@@ -853,8 +858,11 @@ static int rapl_check_unit(struct rapl_package *rp, int cpu)
         * time unit: 1/time_unit_divisor Seconds
         */
        value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit_divisor = 1 << value;
+        /* some CPUs have different way to calculate energy unit */
+        if (x86_match_cpu(energy_unit_quirk_ids))
+                rp->energy_unit_divisor = 1000000 / (1 << value);
+        else
+                rp->energy_unit_divisor = 1 << value;
        value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
        rp->power_unit_divisor = 1 << value;
@@ -941,6 +949,7 @@ static void package_power_limit_irq_restore(int package_id)
 static const struct x86_cpu_id rapl_ids[] = {
        { X86_VENDOR_INTEL, 6, 0x2a},/* SNB */
        { X86_VENDOR_INTEL, 6, 0x2d},/* SNB EP */
+        { X86_VENDOR_INTEL, 6, 0x37},/* VLV */
        { X86_VENDOR_INTEL, 6, 0x3a},/* IVB */
        { X86_VENDOR_INTEL, 6, 0x45},/* HSW */
        /* TODO: Add more CPU IDs after testing */
diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
index b4a445e7f78d..77711d4bd377 100644
--- a/drivers/regulator/Kconfig
+++ b/drivers/regulator/Kconfig
@@ -70,6 +70,14 @@ config REGULATOR_88PM8607
        help
          This driver supports 88PM8607 voltage regulator chips.
+config REGULATOR_ACT8865
+        tristate "Active-semi act8865 voltage regulator"
+        depends on I2C
+        select REGMAP_I2C
+        help
+          This driver controls a active-semi act8865 voltage output
+          regulator via I2C bus.
 config REGULATOR_AD5398
        tristate "Analog Devices AD5398/AD5821 regulators"
        depends on I2C
@@ -249,6 +257,13 @@ config REGULATOR_LP8788
        help
          This driver supports LP8788 voltage regulator chip.
+config REGULATOR_MAX14577
+        tristate "Maxim 14577 regulator"
+        depends on MFD_MAX14577
+        help
+          This driver controls a Maxim 14577 regulator via I2C bus.
+          The regulators include safeout LDO and current regulator 'CHARGER'.
 config REGULATOR_MAX1586
        tristate "Maxim 1586/1587 voltage regulator"
        depends on I2C
diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
index 01c597ea1744..979f9ddcf259 100644
--- a/drivers/regulator/Makefile
+++ b/drivers/regulator/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_REGULATOR_88PM8607) += 88pm8607.o
 obj-$(CONFIG_REGULATOR_AAT2870) += aat2870-regulator.o
 obj-$(CONFIG_REGULATOR_AB3100) += ab3100.o
 obj-$(CONFIG_REGULATOR_AB8500)  += ab8500-ext.o ab8500.o
+obj-$(CONFIG_REGULATOR_ACT8865) += act8865-regulator.o
 obj-$(CONFIG_REGULATOR_AD5398) += ad5398.o
 obj-$(CONFIG_REGULATOR_ANATOP) += anatop-regulator.o
 obj-$(CONFIG_REGULATOR_ARIZONA) += arizona-micsupp.o arizona-ldo1.o
@@ -35,6 +36,7 @@ obj-$(CONFIG_REGULATOR_LP872X) += lp872x.o
 obj-$(CONFIG_REGULATOR_LP8788) += lp8788-buck.o
 obj-$(CONFIG_REGULATOR_LP8788) += lp8788-ldo.o
 obj-$(CONFIG_REGULATOR_LP8755) += lp8755.o
+obj-$(CONFIG_REGULATOR_MAX14577) += max14577.o
 obj-$(CONFIG_REGULATOR_MAX1586) += max1586.o
 obj-$(CONFIG_REGULATOR_MAX8649) += max8649.o
 obj-$(CONFIG_REGULATOR_MAX8660) += max8660.o
diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c
index 603f192e84f1..c625468c7f2c 100644
--- a/drivers/regulator/ab8500.c
+++ b/drivers/regulator/ab8500.c
@@ -2998,37 +2998,6 @@ static void abx500_get_regulator_info(struct ab8500 *ab8500)
        }
 }
-static int ab8500_regulator_init_registers(struct platform_device *pdev,
-                                           int id, int mask, int value)
-{
-        struct ab8500_reg_init *reg_init = abx500_regulator.init;
-        int err;
-        BUG_ON(value & ~mask);
-        BUG_ON(mask & ~reg_init[id].mask);
-        /* initialize register */
-        err = abx500_mask_and_set_register_interruptible(
-                &pdev->dev,
-                reg_init[id].bank,
-                reg_init[id].addr,
-                mask, value);
-        if (err < 0) {
-                dev_err(&pdev->dev,
-                        "Failed to initialize 0x%02x, 0x%02x.\n",
-                        reg_init[id].bank,
-                        reg_init[id].addr);
-                return err;
-        }
-        dev_vdbg(&pdev->dev,
-                 "  init: 0x%02x, 0x%02x, 0x%02x, 0x%02x\n",
-                 reg_init[id].bank,
-                 reg_init[id].addr,
-                 mask, value);
-        return 0;
-}
 static int ab8500_regulator_register(struct platform_device *pdev,
                                     struct regulator_init_data *init_data,
                                     int id, struct device_node *np)
@@ -3036,7 +3005,6 @@ static int ab8500_regulator_register(struct platform_device *pdev,
        struct ab8500 *ab8500 = dev_get_drvdata(pdev->dev.parent);
        struct ab8500_regulator_info *info = NULL;
        struct regulator_config config = { };
-        int err;
        /* assign per-regulator data */
        info = &abx500_regulator.info[id];
@@ -3058,17 +3026,12 @@ static int ab8500_regulator_register(struct platform_device *pdev,
        }
        /* register regulator with framework */
-        info->regulator = regulator_register(&info->desc, &config);
+        info->regulator = devm_regulator_register(&pdev->dev, &info->desc,
+                                                &config);
        if (IS_ERR(info->regulator)) {
-                err = PTR_ERR(info->regulator);
                dev_err(&pdev->dev, "failed to register regulator %s\n",
                        info->desc.name);
-                /* when we fail, un-register all earlier regulators */
+                return PTR_ERR(info->regulator);
-                while (--id >= 0) {
-                        info = &abx500_regulator.info[id];
-                        regulator_unregister(info->regulator);
-                }
-                return err;
        }
        return 0;
@@ -3095,9 +3058,7 @@ static int ab8500_regulator_probe(struct platform_device *pdev)
 {
        struct ab8500 *ab8500 = dev_get_drvdata(pdev->dev.parent);
        struct device_node *np = pdev->dev.of_node;
-        struct ab8500_platform_data *ppdata;
+        int err;
-        struct ab8500_regulator_platform_data *pdata;
-        int i, err;
        if (!ab8500) {
                dev_err(&pdev->dev, "null mfd parent\n");
@@ -3106,83 +3067,20 @@ static int ab8500_regulator_probe(struct platform_device *pdev)
        abx500_get_regulator_info(ab8500);
-        if (np) {
+        err = of_regulator_match(&pdev->dev, np,
-                err = of_regulator_match(&pdev->dev, np,
+                                 abx500_regulator.match,
-                                         abx500_regulator.match,
+                                 abx500_regulator.match_size);
-                                         abx500_regulator.match_size);
+        if (err < 0) {
-                if (err < 0) {
+                dev_err(&pdev->dev,
-                        dev_err(&pdev->dev,
+                        "Error parsing regulator init data: %d\n", err);
-                                "Error parsing regulator init data: %d\n", err);
-                        return err;
-                }
-                err = ab8500_regulator_of_probe(pdev, np);
-                return err;
-        }
-        ppdata = dev_get_platdata(ab8500->dev);
-        if (!ppdata) {
-                dev_err(&pdev->dev, "null parent pdata\n");
-                return -EINVAL;
-        }
-        pdata = ppdata->regulator;
-        if (!pdata) {
-                dev_err(&pdev->dev, "null pdata\n");
-                return -EINVAL;
-        }
-        /* make sure the platform data has the correct size */
-        if (pdata->num_regulator != abx500_regulator.info_size) {
-                dev_err(&pdev->dev, "Configuration error: size mismatch.\n");
-                return -EINVAL;
-        }
-        /* initialize debug (initial state is recorded with this call) */
-        err = ab8500_regulator_debug_init(pdev);
-        if (err)
                return err;
-        /* initialize registers */
-        for (i = 0; i < pdata->num_reg_init; i++) {
-                int id, mask, value;
-                id = pdata->reg_init[i].id;
-                mask = pdata->reg_init[i].mask;
-                value = pdata->reg_init[i].value;
-                /* check for configuration errors */
-                BUG_ON(id >= abx500_regulator.init_size);
-                err = ab8500_regulator_init_registers(pdev, id, mask, value);
-                if (err < 0)
-                        return err;
        }
+        return ab8500_regulator_of_probe(pdev, np);
-        /* register all regulators */
-        for (i = 0; i < abx500_regulator.info_size; i++) {
-                err = ab8500_regulator_register(pdev, &pdata->regulator[i],
-                                                i, NULL);
-                if (err < 0)
-                        return err;
-        }
-        return 0;
 }
 static int ab8500_regulator_remove(struct platform_device *pdev)
 {
-        int i, err;
+        int err;
-        for (i = 0; i < abx500_regulator.info_size; i++) {
-                struct ab8500_regulator_info *info = NULL;
-                info = &abx500_regulator.info[i];
-                dev_vdbg(rdev_get_dev(info->regulator),
-                        "%s-remove\n", info->desc.name);
-                regulator_unregister(info->regulator);
-        }
        /* remove regulator debug */
        err = ab8500_regulator_debug_exit(pdev);
diff --git a/drivers/regulator/act8865-regulator.c b/drivers/regulator/act8865-regulator.c
new file mode 100644
index 000000000000..084cc0819a52
--- /dev/null
+++ b/drivers/regulator/act8865-regulator.c
@@ -0,0 +1,349 @@
+/*
+ * act8865-regulator.c - Voltage regulation for the active-semi ACT8865
+ * http://www.active-semi.com/sheets/ACT8865_Datasheet.pdf
+ *
+ * Copyright (C) 2013 Atmel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/act8865.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/regulator/of_regulator.h>
+#include <linux/regmap.h>
+/*
+ * ACT8865 Global Register Map.
+ */
+#define ACT8865_SYS_MODE        0x00
+#define ACT8865_SYS_CTRL        0x01
+#define ACT8865_DCDC1_VSET1     0x20
+#define ACT8865_DCDC1_VSET2     0x21
+#define ACT8865_DCDC1_CTRL      0x22
+#define ACT8865_DCDC2_VSET1     0x30
+#define ACT8865_DCDC2_VSET2     0x31
+#define ACT8865_DCDC2_CTRL      0x32
+#define ACT8865_DCDC3_VSET1     0x40
+#define ACT8865_DCDC3_VSET2     0x41
+#define ACT8865_DCDC3_CTRL      0x42
+#define ACT8865_LDO1_VSET       0x50
+#define ACT8865_LDO1_CTRL       0x51
+#define ACT8865_LDO2_VSET       0x54
+#define ACT8865_LDO2_CTRL       0x55
+#define ACT8865_LDO3_VSET       0x60
+#define ACT8865_LDO3_CTRL       0x61
+#define ACT8865_LDO4_VSET       0x64
+#define ACT8865_LDO4_CTRL       0x65
+/*
+ * Field Definitions.
+ */
+#define ACT8865_ENA             0x80    /* ON - [7] */
+#define ACT8865_VSEL_MASK       0x3F    /* VSET - [5:0] */
+/*
+ * ACT8865 voltage number
+ */
+#define ACT8865_VOLTAGE_NUM     64
+struct act8865 {
+        struct regulator_dev *rdev[ACT8865_REG_NUM];
+        struct regmap *regmap;
+};
+static const struct regmap_config act8865_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+};
+static const struct regulator_linear_range act8865_volatge_ranges[] = {
+        REGULATOR_LINEAR_RANGE(600000, 0, 23, 25000),
+        REGULATOR_LINEAR_RANGE(1200000, 24, 47, 50000),
+        REGULATOR_LINEAR_RANGE(2400000, 48, 63, 100000),
+};
+static struct regulator_ops act8865_ops = {
+        .list_voltage           = regulator_list_voltage_linear_range,
+        .map_voltage            = regulator_map_voltage_linear_range,
+        .get_voltage_sel        = regulator_get_voltage_sel_regmap,
+        .set_voltage_sel        = regulator_set_voltage_sel_regmap,
+        .enable                 = regulator_enable_regmap,
+        .disable                = regulator_disable_regmap,
+        .is_enabled             = regulator_is_enabled_regmap,
+};
+static const struct regulator_desc act8865_reg[] = {
+        {
+                .name = "DCDC_REG1",
+                .id = ACT8865_ID_DCDC1,
+                .ops = &act8865_ops,
+                .type = REGULATOR_VOLTAGE,
+                .n_voltages = ACT8865_VOLTAGE_NUM,
+                .linear_ranges = act8865_volatge_ranges,
+                .n_linear_ranges = ARRAY_SIZE(act8865_volatge_ranges),
+                .vsel_reg = ACT8865_DCDC1_VSET1,
+                .vsel_mask = ACT8865_VSEL_MASK,
+                .enable_reg = ACT8865_DCDC1_CTRL,
+                .enable_mask = ACT8865_ENA,
+                .owner = THIS_MODULE,
+        },
+        {
+                .name = "DCDC_REG2",
+                .id = ACT8865_ID_DCDC2,
+                .ops = &act8865_ops,
+                .type = REGULATOR_VOLTAGE,
+                .n_voltages = ACT8865_VOLTAGE_NUM,
+                .linear_ranges = act8865_volatge_ranges,
+                .n_linear_ranges = ARRAY_SIZE(act8865_volatge_ranges),
+                .vsel_reg = ACT8865_DCDC2_VSET1,
+                .vsel_mask = ACT8865_VSEL_MASK,
+                .enable_reg = ACT8865_DCDC2_CTRL,
+                .enable_mask = ACT8865_ENA,
+                .owner = THIS_MODULE,
+        },
+        {
+                .name = "DCDC_REG3",
+                .id = ACT8865_ID_DCDC3,
+                .ops = &act8865_ops,
+                .type = REGULATOR_VOLTAGE,
+                .n_voltages = ACT8865_VOLTAGE_NUM,
+                .linear_ranges = act8865_volatge_ranges,
+                .n_linear_ranges = ARRAY_SIZE(act8865_volatge_ranges),
+                .vsel_reg = ACT8865_DCDC3_VSET1,
+                .vsel_mask = ACT8865_VSEL_MASK,
+                .enable_reg = ACT8865_DCDC3_CTRL,
+                .enable_mask = ACT8865_ENA,
+                .owner = THIS_MODULE,
+        },
+        {
+                .name = "LDO_REG1",
+                .id = ACT8865_ID_LDO1,
+                .ops = &act8865_ops,
+                .type = REGULATOR_VOLTAGE,
+                .n_voltages = ACT8865_VOLTAGE_NUM,
+                .linear_ranges = act8865_volatge_ranges,
+                .n_linear_ranges = ARRAY_SIZE(act8865_volatge_ranges),
+                .vsel_reg = ACT8865_LDO1_VSET,
+                .vsel_mask = ACT8865_VSEL_MASK,
+                .enable_reg = ACT8865_LDO1_CTRL,
+                .enable_mask = ACT8865_ENA,
+                .owner = THIS_MODULE,
+        },
+        {
+                .name = "LDO_REG2",
+                .id = ACT8865_ID_LDO2,
+                .ops = &act8865_ops,
+                .type = REGULATOR_VOLTAGE,
+                .n_voltages = ACT8865_VOLTAGE_NUM,
+                .linear_ranges = act8865_volatge_ranges,
+                .n_linear_ranges = ARRAY_SIZE(act8865_volatge_ranges),
+                .vsel_reg = ACT8865_LDO2_VSET,
+                .vsel_mask = ACT8865_VSEL_MASK,
+                .enable_reg = ACT8865_LDO2_CTRL,
+                .enable_mask = ACT8865_ENA,
+                .owner = THIS_MODULE,
+        },
+        {
+                .name = "LDO_REG3",
+                .id = ACT8865_ID_LDO3,
+                .ops = &act8865_ops,
+                .type = REGULATOR_VOLTAGE,
+                .n_voltages = ACT8865_VOLTAGE_NUM,
+                .linear_ranges = act8865_volatge_ranges,
+                .n_linear_ranges = ARRAY_SIZE(act8865_volatge_ranges),
+                .vsel_reg = ACT8865_LDO3_VSET,
+                .vsel_mask = ACT8865_VSEL_MASK,
+                .enable_reg = ACT8865_LDO3_CTRL,
+                .enable_mask = ACT8865_ENA,
+                .owner = THIS_MODULE,
+        },
+        {
+                .name = "LDO_REG4",
+                .id = ACT8865_ID_LDO4,
+                .ops = &act8865_ops,
+                .type = REGULATOR_VOLTAGE,
+                .n_voltages = ACT8865_VOLTAGE_NUM,
+                .linear_ranges = act8865_volatge_ranges,
+                .n_linear_ranges = ARRAY_SIZE(act8865_volatge_ranges),
+                .vsel_reg = ACT8865_LDO4_VSET,
+                .vsel_mask = ACT8865_VSEL_MASK,
+                .enable_reg = ACT8865_LDO4_CTRL,
+                .enable_mask = ACT8865_ENA,
+                .owner = THIS_MODULE,
+        },
+};
+#ifdef CONFIG_OF
+static const struct of_device_id act8865_dt_ids[] = {
+        { .compatible = "active-semi,act8865" },
+        { }
+};
+MODULE_DEVICE_TABLE(of, act8865_dt_ids);
+static struct of_regulator_match act8865_matches[] = {
+        [ACT8865_ID_DCDC1]      = { .name = "DCDC_REG1"},
+        [ACT8865_ID_DCDC2]      = { .name = "DCDC_REG2"},
+        [ACT8865_ID_DCDC3]      = { .name = "DCDC_REG3"},
+        [ACT8865_ID_LDO1]       = { .name = "LDO_REG1"},
+        [ACT8865_ID_LDO2]       = { .name = "LDO_REG2"},
+        [ACT8865_ID_LDO3]       = { .name = "LDO_REG3"},
+        [ACT8865_ID_LDO4]       = { .name = "LDO_REG4"},
+};
+static int act8865_pdata_from_dt(struct device *dev,
+                                 struct device_node **of_node,
+                                 struct act8865_platform_data *pdata)
+{
+        int matched, i;
+        struct device_node *np;
+        struct act8865_regulator_data *regulator;
+        np = of_find_node_by_name(dev->of_node, "regulators");
+        if (!np) {
+                dev_err(dev, "missing 'regulators' subnode in DT\n");
+                return -EINVAL;
+        }
+        matched = of_regulator_match(dev, np,
+                                act8865_matches, ARRAY_SIZE(act8865_matches));
+        if (matched <= 0)
+                return matched;
+        pdata->regulators = devm_kzalloc(dev,
+                                sizeof(struct act8865_regulator_data) *
+                                ARRAY_SIZE(act8865_matches), GFP_KERNEL);
+        if (!pdata->regulators) {
+                dev_err(dev, "%s: failed to allocate act8865 registor\n",
+                                                __func__);
+                return -ENOMEM;
+        }
+        pdata->num_regulators = matched;
+        regulator = pdata->regulators;
+        for (i = 0; i < ARRAY_SIZE(act8865_matches); i++) {
+                regulator->id = i;
+                regulator->name = act8865_matches[i].name;
+                regulator->platform_data = act8865_matches[i].init_data;
+                of_node[i] = act8865_matches[i].of_node;
+                regulator++;
+        }
+        return 0;
+}
+#else
+static inline int act8865_pdata_from_dt(struct device *dev,
+                                        struct device_node **of_node,
+                                        struct act8865_platform_data *pdata)
+{
+        return 0;
+}
+#endif
+static int act8865_pmic_probe(struct i2c_client *client,
+                           const struct i2c_device_id *i2c_id)
+{
+        struct regulator_dev **rdev;
+        struct device *dev = &client->dev;
+        struct act8865_platform_data *pdata = dev_get_platdata(dev);
+        struct regulator_config config = { };
+        struct act8865 *act8865;
+        struct device_node *of_node[ACT8865_REG_NUM];
+        int i, id;
+        int ret = -EINVAL;
+        int error;
+        if (dev->of_node && !pdata) {
+                const struct of_device_id *id;
+                struct act8865_platform_data pdata_of;
+                id = of_match_device(of_match_ptr(act8865_dt_ids), dev);
+                if (!id)
+                        return -ENODEV;
+                ret = act8865_pdata_from_dt(dev, of_node, &pdata_of);
+                if (ret < 0)
+                        return ret;
+                pdata = &pdata_of;
+        }
+        if (pdata->num_regulators > ACT8865_REG_NUM) {
+                dev_err(dev, "Too many regulators found!\n");
+                return -EINVAL;
+        }
+        act8865 = devm_kzalloc(dev, sizeof(struct act8865), GFP_KERNEL);
+        if (!act8865)
+                return -ENOMEM;
+        rdev = act8865->rdev;
+        act8865->regmap = devm_regmap_init_i2c(client, &act8865_regmap_config);
+        if (IS_ERR(act8865->regmap)) {
+                error = PTR_ERR(act8865->regmap);
+                dev_err(&client->dev, "Failed to allocate register map: %d\n",
+                        error);
+                return error;
+        }
+        /* Finally register devices */
+        for (i = 0; i < ACT8865_REG_NUM; i++) {
+                id = pdata->regulators[i].id;
+                config.dev = dev;
+                config.init_data = pdata->regulators[i].platform_data;
+                config.of_node = of_node[i];
+                config.driver_data = act8865;
+                config.regmap = act8865->regmap;
+                rdev[i] = devm_regulator_register(&client->dev,
+                                                &act8865_reg[i], &config);
+                if (IS_ERR(rdev[i])) {
+                        dev_err(dev, "failed to register %s\n",
+                                act8865_reg[id].name);
+                        return PTR_ERR(rdev[i]);
+                }
+        }
+        i2c_set_clientdata(client, act8865);
+        return 0;
+}
+static const struct i2c_device_id act8865_ids[] = {
+        { "act8865", 0 },
+        { },
+};
+MODULE_DEVICE_TABLE(i2c, act8865_ids);
+static struct i2c_driver act8865_pmic_driver = {
+        .driver = {
+                .name   = "act8865",
+                .owner  = THIS_MODULE,
+        },
+        .probe          = act8865_pmic_probe,
+        .id_table       = act8865_ids,
+};
+module_i2c_driver(act8865_pmic_driver);
+MODULE_DESCRIPTION("active-semi act8865 voltage regulator driver");
+MODULE_AUTHOR("Wenyou Yang <wenyou.yang@atmel.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index c734d0980826..862e63e451d0 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -122,10 +122,8 @@ static int anatop_regulator_probe(struct platform_device *pdev)
        if (!sreg)
                return -ENOMEM;
        sreg->initdata = initdata;
-        sreg->name = kstrdup(of_get_property(np, "regulator-name", NULL),
+        sreg->name = of_get_property(np, "regulator-name", NULL);
-                             GFP_KERNEL);
        rdesc = &sreg->rdesc;
-        memset(rdesc, 0, sizeof(*rdesc));
        rdesc->name = sreg->name;
        rdesc->ops = &anatop_rops;
        rdesc->type = REGULATOR_VOLTAGE;
@@ -143,37 +141,37 @@ static int anatop_regulator_probe(struct platform_device *pdev)
                                   &sreg->control_reg);
        if (ret) {
                dev_err(dev, "no anatop-reg-offset property set\n");
-                goto anatop_probe_end;
+                return ret;
        }
        ret = of_property_read_u32(np, "anatop-vol-bit-width",
                                   &sreg->vol_bit_width);
        if (ret) {
                dev_err(dev, "no anatop-vol-bit-width property set\n");
-                goto anatop_probe_end;
+                return ret;
        }
        ret = of_property_read_u32(np, "anatop-vol-bit-shift",
                                   &sreg->vol_bit_shift);
        if (ret) {
                dev_err(dev, "no anatop-vol-bit-shift property set\n");
-                goto anatop_probe_end;
+                return ret;
        }
        ret = of_property_read_u32(np, "anatop-min-bit-val",
                                   &sreg->min_bit_val);
        if (ret) {
                dev_err(dev, "no anatop-min-bit-val property set\n");
-                goto anatop_probe_end;
+                return ret;
        }
        ret = of_property_read_u32(np, "anatop-min-voltage",
                                   &sreg->min_voltage);
        if (ret) {
                dev_err(dev, "no anatop-min-voltage property set\n");
-                goto anatop_probe_end;
+                return ret;
        }
        ret = of_property_read_u32(np, "anatop-max-voltage",
                                   &sreg->max_voltage);
        if (ret) {
                dev_err(dev, "no anatop-max-voltage property set\n");
-                goto anatop_probe_end;
+                return ret;
        }
        /* read LDO ramp up setting, only for core reg */
@@ -204,27 +202,11 @@ static int anatop_regulator_probe(struct platform_device *pdev)
        if (IS_ERR(rdev)) {
                dev_err(dev, "failed to register %s\n",
                        rdesc->name);
-                ret = PTR_ERR(rdev);
+                return PTR_ERR(rdev);
-                goto anatop_probe_end;
        }
        platform_set_drvdata(pdev, rdev);
-anatop_probe_end:
-        if (ret)
-                kfree(sreg->name);
-        return ret;
-}
-static int anatop_regulator_remove(struct platform_device *pdev)
-{
-        struct regulator_dev *rdev = platform_get_drvdata(pdev);
-        struct anatop_regulator *sreg = rdev_get_drvdata(rdev);
-        const char *name = sreg->name;
-        kfree(name);
        return 0;
 }
@@ -240,7 +222,6 @@ static struct platform_driver anatop_regulator_driver = {
                .of_match_table = of_anatop_regulator_match_tbl,
        },
        .probe  = anatop_regulator_probe,
-        .remove = anatop_regulator_remove,
 };
 static int __init anatop_regulator_init(void)
@@ -259,3 +240,4 @@ MODULE_AUTHOR("Nancy Chen <Nancy.Chen@freescale.com>");
 MODULE_AUTHOR("Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>");
 MODULE_DESCRIPTION("ANATOP Regulator driver");
 MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:anatop_regulator");
diff --git a/drivers/regulator/arizona-micsupp.c b/drivers/regulator/arizona-micsupp.c
index fd3154d86901..034ece707083 100644
--- a/drivers/regulator/arizona-micsupp.c
+++ b/drivers/regulator/arizona-micsupp.c
@@ -28,8 +28,6 @@
 #include <linux/mfd/arizona/pdata.h>
 #include <linux/mfd/arizona/registers.h>
-#define ARIZONA_MICSUPP_MAX_SELECTOR 0x1f
 struct arizona_micsupp {
        struct regulator_dev *regulator;
        struct arizona *arizona;
@@ -40,42 +38,6 @@ struct arizona_micsupp {
        struct work_struct check_cp_work;
 };
-static int arizona_micsupp_list_voltage(struct regulator_dev *rdev,
-                                        unsigned int selector)
-{
-        if (selector > ARIZONA_MICSUPP_MAX_SELECTOR)
-                return -EINVAL;
-        if (selector == ARIZONA_MICSUPP_MAX_SELECTOR)
-                return 3300000;
-        else
-                return (selector * 50000) + 1700000;
-}
-static int arizona_micsupp_map_voltage(struct regulator_dev *rdev,
-                                       int min_uV, int max_uV)
-{
-        unsigned int voltage;
-        int selector;
-        if (min_uV < 1700000)
-                min_uV = 1700000;
-        if (min_uV > 3200000)
-                selector = ARIZONA_MICSUPP_MAX_SELECTOR;
-        else
-                selector = DIV_ROUND_UP(min_uV - 1700000, 50000);
-        if (selector < 0)
-                return -EINVAL;
-        voltage = arizona_micsupp_list_voltage(rdev, selector);
-        if (voltage < min_uV || voltage > max_uV)
-                return -EINVAL;
-        return selector;
-}
 static void arizona_micsupp_check_cp(struct work_struct *work)
 {
        struct arizona_micsupp *micsupp =
@@ -145,8 +107,8 @@ static struct regulator_ops arizona_micsupp_ops = {
        .disable = arizona_micsupp_disable,
        .is_enabled = regulator_is_enabled_regmap,
-        .list_voltage = arizona_micsupp_list_voltage,
+        .list_voltage = regulator_list_voltage_linear_range,
-        .map_voltage = arizona_micsupp_map_voltage,
+        .map_voltage = regulator_map_voltage_linear_range,
        .get_voltage_sel = regulator_get_voltage_sel_regmap,
        .set_voltage_sel = regulator_set_voltage_sel_regmap,
@@ -155,11 +117,16 @@ static struct regulator_ops arizona_micsupp_ops = {
        .set_bypass = arizona_micsupp_set_bypass,
 };
+static const struct regulator_linear_range arizona_micsupp_ranges[] = {
+        REGULATOR_LINEAR_RANGE(1700000, 0,    0x1e, 50000),
+        REGULATOR_LINEAR_RANGE(3300000, 0x1f, 0x1f, 0),
+};
 static const struct regulator_desc arizona_micsupp = {
        .name = "MICVDD",
        .supply_name = "CPVDD",
        .type = REGULATOR_VOLTAGE,
-        .n_voltages = ARIZONA_MICSUPP_MAX_SELECTOR + 1,
+        .n_voltages = 32,
        .ops = &arizona_micsupp_ops,
        .vsel_reg = ARIZONA_LDO2_CONTROL_1,
@@ -169,6 +136,9 @@ static const struct regulator_desc arizona_micsupp = {
        .bypass_reg = ARIZONA_MIC_CHARGE_PUMP_1,
        .bypass_mask = ARIZONA_CPMIC_BYPASS,
+        .linear_ranges = arizona_micsupp_ranges,
+        .n_linear_ranges = ARRAY_SIZE(arizona_micsupp_ranges),
        .enable_time = 3000,
        .owner = THIS_MODULE,
diff --git a/drivers/regulator/as3722-regulator.c b/drivers/regulator/as3722-regulator.c
index b9f1d24c6812..8b17d786cb71 100644
--- a/drivers/regulator/as3722-regulator.c
+++ b/drivers/regulator/as3722-regulator.c
@@ -99,7 +99,6 @@ static const struct as3722_register_mapping as3722_reg_lookup[] = {
                .sleep_ctrl_mask = AS3722_SD0_EXT_ENABLE_MASK,
                .control_reg = AS3722_SD0_CONTROL_REG,
                .mode_mask = AS3722_SD0_MODE_FAST,
-                .n_voltages = AS3722_SD0_VSEL_MAX + 1,
        },
        {
                .regulator_id = AS3722_REGULATOR_ID_SD1,
@@ -112,7 +111,6 @@ static const struct as3722_register_mapping as3722_reg_lookup[] = {
                .sleep_ctrl_mask = AS3722_SD1_EXT_ENABLE_MASK,
                .control_reg = AS3722_SD1_CONTROL_REG,
                .mode_mask = AS3722_SD1_MODE_FAST,
-                .n_voltages = AS3722_SD0_VSEL_MAX + 1,
        },
        {
                .regulator_id = AS3722_REGULATOR_ID_SD2,
@@ -181,7 +179,6 @@ static const struct as3722_register_mapping as3722_reg_lookup[] = {
                .sleep_ctrl_mask = AS3722_SD6_EXT_ENABLE_MASK,
                .control_reg = AS3722_SD6_CONTROL_REG,
                .mode_mask = AS3722_SD6_MODE_FAST,
-                .n_voltages = AS3722_SD0_VSEL_MAX + 1,
        },
        {
                .regulator_id = AS3722_REGULATOR_ID_LDO0,
@@ -595,6 +592,22 @@ static int as3722_sd016_set_current_limit(struct regulator_dev *rdev,
        return as3722_update_bits(as3722, reg, mask, val);
 }
+static bool as3722_sd0_is_low_voltage(struct as3722_regulators *as3722_regs)
+{
+        int err;
+        unsigned val;
+        err = as3722_read(as3722_regs->as3722, AS3722_FUSE7_REG, &val);
+        if (err < 0) {
+                dev_err(as3722_regs->dev, "Reg 0x%02x read failed: %d\n",
+                        AS3722_FUSE7_REG, err);
+                return false;
+        }
+        if (val & AS3722_FUSE7_SD0_LOW_VOLTAGE)
+                return true;
+        return false;
+}
 static const struct regulator_linear_range as3722_sd2345_ranges[] = {
        REGULATOR_LINEAR_RANGE(612500, 0x01, 0x40, 12500),
        REGULATOR_LINEAR_RANGE(1425000, 0x41, 0x70, 25000),
@@ -820,9 +833,19 @@ static int as3722_regulator_probe(struct platform_device *pdev)
                                ops = &as3722_sd016_extcntrl_ops;
                        else
                                ops = &as3722_sd016_ops;
-                        as3722_regs->desc[id].min_uV = 610000;
+                        if (id == AS3722_REGULATOR_ID_SD0 &&
+                            as3722_sd0_is_low_voltage(as3722_regs)) {
+                                as3722_regs->desc[id].n_voltages =
+                                        AS3722_SD0_VSEL_LOW_VOL_MAX + 1;
+                                as3722_regs->desc[id].min_uV = 410000;
+                        } else {
+                                as3722_regs->desc[id].n_voltages =
+                                        AS3722_SD0_VSEL_MAX + 1,
+                                as3722_regs->desc[id].min_uV = 610000;
+                        }
                        as3722_regs->desc[id].uV_step = 10000;
                        as3722_regs->desc[id].linear_min_sel = 1;
+                        as3722_regs->desc[id].enable_time = 600;
                        break;
                case AS3722_REGULATOR_ID_SD2:
                case AS3722_REGULATOR_ID_SD3:
@@ -842,9 +865,6 @@ static int as3722_regulator_probe(struct platform_device *pdev)
                                ops = &as3722_ldo_extcntrl_ops;
                        else
                                ops = &as3722_ldo_ops;
-                        as3722_regs->desc[id].min_uV = 825000;
-                        as3722_regs->desc[id].uV_step = 25000;
-                        as3722_regs->desc[id].linear_min_sel = 1;
                        as3722_regs->desc[id].enable_time = 500;
                        as3722_regs->desc[id].linear_ranges = as3722_ldo_ranges;
                        as3722_regs->desc[id].n_linear_ranges =
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index d85f31385b24..b38a6b669e8c 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1334,9 +1334,8 @@ static struct regulator *_regulator_get(struct device *dev, const char *id,
         * If we have return value from dev_lookup fail, we do not expect to
         * succeed, so, quit with appropriate error value
         */
-        if (ret && ret != -ENODEV) {
+        if (ret && ret != -ENODEV)
                goto out;
-        }
        if (!devname)
                devname = "deviceless";
@@ -1351,7 +1350,8 @@ static struct regulator *_regulator_get(struct device *dev, const char *id,
                rdev = dummy_regulator_rdev;
                goto found;
-        } else {
+        /* Don't log an error when called from regulator_get_optional() */
+        } else if (!have_full_constraints() || exclusive) {
                dev_err(dev, "dummy supplies not allowed\n");
        }
@@ -2244,7 +2244,7 @@ int regulator_is_supported_voltage(struct regulator *regulator,
        if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE)) {
                ret = regulator_get_voltage(regulator);
                if (ret >= 0)
-                        return (min_uV <= ret && ret <= max_uV);
+                        return min_uV <= ret && ret <= max_uV;
                else
                        return ret;
        }
@@ -2416,7 +2416,7 @@ int regulator_set_voltage(struct regulator *regulator, int min_uV, int max_uV)
        ret = regulator_check_voltage(rdev, &min_uV, &max_uV);
        if (ret < 0)
                goto out;
-        
        /* restore original values in case of error */
        old_min_uV = regulator->min_uV;
        old_max_uV = regulator->max_uV;
@@ -2430,7 +2430,7 @@ int regulator_set_voltage(struct regulator *regulator, int min_uV, int max_uV)
        ret = _regulator_do_set_voltage(rdev, min_uV, max_uV);
        if (ret < 0)
                goto out2;
-        
 out:
        mutex_unlock(&rdev->mutex);
        return ret;
@@ -3835,9 +3835,8 @@ static int __init regulator_init_complete(void)
                         * goes wrong. */
                        rdev_info(rdev, "disabling\n");
                        ret = ops->disable(rdev);
-                        if (ret != 0) {
+                        if (ret != 0)
                                rdev_err(rdev, "couldn't disable: %d\n", ret);
-                        }
                } else {
                        /* The intention is that in future we will
                         * assume that full constraints are provided
diff --git a/drivers/regulator/db8500-prcmu.c b/drivers/regulator/db8500-prcmu.c
index a53c11a529d5..846acf240e48 100644
--- a/drivers/regulator/db8500-prcmu.c
+++ b/drivers/regulator/db8500-prcmu.c
@@ -431,17 +431,11 @@ static int db8500_regulator_register(struct platform_device *pdev,
        config.of_node = np;
        /* register with the regulator framework */
-        info->rdev = regulator_register(&info->desc, &config);
+        info->rdev = devm_regulator_register(&pdev->dev, &info->desc, &config);
        if (IS_ERR(info->rdev)) {
                err = PTR_ERR(info->rdev);
                dev_err(&pdev->dev, "failed to register %s: err %i\n",
                        info->desc.name, err);
-                /* if failing, unregister all earlier regulators */
-                while (--id >= 0) {
-                        info = &dbx500_regulator_info[id];
-                        regulator_unregister(info->rdev);
-                }
                return err;
        }
@@ -530,20 +524,8 @@ static int db8500_regulator_probe(struct platform_device *pdev)
 static int db8500_regulator_remove(struct platform_device *pdev)
 {
-        int i;
        ux500_regulator_debug_exit();
-        for (i = 0; i < ARRAY_SIZE(dbx500_regulator_info); i++) {
-                struct dbx500_regulator_info *info;
-                info = &dbx500_regulator_info[i];
-                dev_vdbg(rdev_get_dev(info->rdev),
-                        "regulator-%s-remove\n", info->desc.name);
-                regulator_unregister(info->rdev);
-        }
        return 0;
 }
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index 234960dc9607..c0a1d00b78c9 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -203,17 +203,18 @@ of_get_gpio_regulator_config(struct device *dev, struct device_node *np)
        }
        config->nr_states = i;
+        config->type = REGULATOR_VOLTAGE;
        ret = of_property_read_string(np, "regulator-type", &regtype);
-        if (ret < 0) {
+        if (ret >= 0) {
-                dev_err(dev, "Missing 'regulator-type' property\n");
+                if (!strncmp("voltage", regtype, 7))
-                return ERR_PTR(-EINVAL);
+                        config->type = REGULATOR_VOLTAGE;
+                else if (!strncmp("current", regtype, 7))
+                        config->type = REGULATOR_CURRENT;
+                else
+                        dev_warn(dev, "Unknown regulator-type '%s'\n",
+                                 regtype);
        }
-        if (!strncmp("voltage", regtype, 7))
-                config->type = REGULATOR_VOLTAGE;
-        else if (!strncmp("current", regtype, 7))
-                config->type = REGULATOR_CURRENT;
        return config;
 }
diff --git a/drivers/regulator/lp3971.c b/drivers/regulator/lp3971.c
index 947c05ffe0ab..3b1102b75071 100644
--- a/drivers/regulator/lp3971.c
+++ b/drivers/regulator/lp3971.c
@@ -25,8 +25,6 @@ struct lp3971 {
        struct device *dev;
        struct mutex io_lock;
        struct i2c_client *i2c;
-        int num_regulators;
-        struct regulator_dev **rdev;
 };
 static u8 lp3971_reg_read(struct lp3971 *lp3971, u8 reg);
@@ -383,42 +381,27 @@ static int setup_regulators(struct lp3971 *lp3971,
 {
        int i, err;
-        lp3971->num_regulators = pdata->num_regulators;
-        lp3971->rdev = kcalloc(pdata->num_regulators,
-                                sizeof(struct regulator_dev *), GFP_KERNEL);
-        if (!lp3971->rdev) {
-                err = -ENOMEM;
-                goto err_nomem;
-        }
        /* Instantiate the regulators */
        for (i = 0; i < pdata->num_regulators; i++) {
                struct regulator_config config = { };
                struct lp3971_regulator_subdev *reg = &pdata->regulators[i];
+                struct regulator_dev *rdev;
                config.dev = lp3971->dev;
                config.init_data = reg->initdata;
                config.driver_data = lp3971;
-                lp3971->rdev[i] = regulator_register(&regulators[reg->id],
+                rdev = devm_regulator_register(lp3971->dev,
-                                                     &config);
+                                               &regulators[reg->id], &config);
-                if (IS_ERR(lp3971->rdev[i])) {
+                if (IS_ERR(rdev)) {
-                        err = PTR_ERR(lp3971->rdev[i]);
+                        err = PTR_ERR(rdev);
                        dev_err(lp3971->dev, "regulator init failed: %d\n",
                                err);
-                        goto error;
+                        return err;
                }
        }
        return 0;
-error:
-        while (--i >= 0)
-                regulator_unregister(lp3971->rdev[i]);
-        kfree(lp3971->rdev);
-        lp3971->rdev = NULL;
-err_nomem:
-        return err;
 }
 static int lp3971_i2c_probe(struct i2c_client *i2c,
@@ -460,19 +443,6 @@ static int lp3971_i2c_probe(struct i2c_client *i2c,
        return 0;
 }
-static int lp3971_i2c_remove(struct i2c_client *i2c)
-{
-        struct lp3971 *lp3971 = i2c_get_clientdata(i2c);
-        int i;
-        for (i = 0; i < lp3971->num_regulators; i++)
-                regulator_unregister(lp3971->rdev[i]);
-        kfree(lp3971->rdev);
-        return 0;
-}
 static const struct i2c_device_id lp3971_i2c_id[] = {
        { "lp3971", 0 },
        { }
@@ -485,7 +455,6 @@ static struct i2c_driver lp3971_i2c_driver = {
                .owner = THIS_MODULE,
        },
        .probe    = lp3971_i2c_probe,
-        .remove   = lp3971_i2c_remove,
        .id_table = lp3971_i2c_id,
 };
diff --git a/drivers/regulator/lp3972.c b/drivers/regulator/lp3972.c
index 093e6f44ff8a..aea485afcc1a 100644
--- a/drivers/regulator/lp3972.c
+++ b/drivers/regulator/lp3972.c
@@ -22,8 +22,6 @@ struct lp3972 {
        struct device *dev;
        struct mutex io_lock;
        struct i2c_client *i2c;
-        int num_regulators;
-        struct regulator_dev **rdev;
 };
 /* LP3972 Control Registers */
@@ -478,41 +476,27 @@ static int setup_regulators(struct lp3972 *lp3972,
 {
        int i, err;
-        lp3972->num_regulators = pdata->num_regulators;
-        lp3972->rdev = kcalloc(pdata->num_regulators,
-                                sizeof(struct regulator_dev *), GFP_KERNEL);
-        if (!lp3972->rdev) {
-                err = -ENOMEM;
-                goto err_nomem;
-        }
        /* Instantiate the regulators */
        for (i = 0; i < pdata->num_regulators; i++) {
                struct lp3972_regulator_subdev *reg = &pdata->regulators[i];
                struct regulator_config config = { };
+                struct regulator_dev *rdev;
                config.dev = lp3972->dev;
                config.init_data = reg->initdata;
                config.driver_data = lp3972;
-                lp3972->rdev[i] = regulator_register(&regulators[reg->id],
+                rdev = devm_regulator_register(lp3972->dev,
-                                                     &config);
+                                               &regulators[reg->id], &config);
-                if (IS_ERR(lp3972->rdev[i])) {
+                if (IS_ERR(rdev)) {
-                        err = PTR_ERR(lp3972->rdev[i]);
+                        err = PTR_ERR(rdev);
                        dev_err(lp3972->dev, "regulator init failed: %d\n",
                                err);
-                        goto error;
+                        return err;
                }
        }
        return 0;
-error:
-        while (--i >= 0)
-                regulator_unregister(lp3972->rdev[i]);
-        kfree(lp3972->rdev);
-        lp3972->rdev = NULL;
-err_nomem:
-        return err;
 }
 static int lp3972_i2c_probe(struct i2c_client *i2c,
@@ -557,18 +541,6 @@ static int lp3972_i2c_probe(struct i2c_client *i2c,
        return 0;
 }
-static int lp3972_i2c_remove(struct i2c_client *i2c)
-{
-        struct lp3972 *lp3972 = i2c_get_clientdata(i2c);
-        int i;
-        for (i = 0; i < lp3972->num_regulators; i++)
-                regulator_unregister(lp3972->rdev[i]);
-        kfree(lp3972->rdev);
-        return 0;
-}
 static const struct i2c_device_id lp3972_i2c_id[] = {
        { "lp3972", 0 },
        { }
@@ -581,7 +553,6 @@ static struct i2c_driver lp3972_i2c_driver = {
                .owner = THIS_MODULE,
        },
        .probe    = lp3972_i2c_probe,
-        .remove   = lp3972_i2c_remove,
        .id_table = lp3972_i2c_id,
 };
diff --git a/drivers/regulator/max14577.c b/drivers/regulator/max14577.c
new file mode 100644
index 000000000000..b1078ba3f393
--- /dev/null
+++ b/drivers/regulator/max14577.c
@@ -0,0 +1,273 @@
+/*
+ * max14577.c - Regulator driver for the Maxim 14577
+ *
+ * Copyright (C) 2013 Samsung Electronics
+ * Krzysztof Kozlowski <k.kozlowski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/mfd/max14577.h>
+#include <linux/mfd/max14577-private.h>
+#include <linux/regulator/of_regulator.h>
+struct max14577_regulator {
+        struct device *dev;
+        struct max14577 *max14577;
+        struct regulator_dev **regulators;
+};
+static int max14577_reg_is_enabled(struct regulator_dev *rdev)
+{
+        int rid = rdev_get_id(rdev);
+        struct regmap *rmap = rdev->regmap;
+        u8 reg_data;
+        switch (rid) {
+        case MAX14577_CHARGER:
+                max14577_read_reg(rmap, MAX14577_CHG_REG_CHG_CTRL2, &reg_data);
+                if ((reg_data & CHGCTRL2_MBCHOSTEN_MASK) == 0)
+                        return 0;
+                max14577_read_reg(rmap, MAX14577_CHG_REG_STATUS3, &reg_data);
+                if ((reg_data & STATUS3_CGMBC_MASK) == 0)
+                        return 0;
+                /* MBCHOSTEN and CGMBC are on */
+                return 1;
+        default:
+                return -EINVAL;
+        }
+}
+static int max14577_reg_get_current_limit(struct regulator_dev *rdev)
+{
+        u8 reg_data;
+        struct regmap *rmap = rdev->regmap;
+        if (rdev_get_id(rdev) != MAX14577_CHARGER)
+                return -EINVAL;
+        max14577_read_reg(rmap, MAX14577_CHG_REG_CHG_CTRL4, &reg_data);
+        if ((reg_data & CHGCTRL4_MBCICHWRCL_MASK) == 0)
+                return MAX14577_REGULATOR_CURRENT_LIMIT_MIN;
+        reg_data = ((reg_data & CHGCTRL4_MBCICHWRCH_MASK) >>
+                        CHGCTRL4_MBCICHWRCH_SHIFT);
+        return MAX14577_REGULATOR_CURRENT_LIMIT_HIGH_START +
+                reg_data * MAX14577_REGULATOR_CURRENT_LIMIT_HIGH_STEP;
+}
+static int max14577_reg_set_current_limit(struct regulator_dev *rdev,
+                int min_uA, int max_uA)
+{
+        int i, current_bits = 0xf;
+        u8 reg_data;
+        if (rdev_get_id(rdev) != MAX14577_CHARGER)
+                return -EINVAL;
+        if (min_uA > MAX14577_REGULATOR_CURRENT_LIMIT_MAX ||
+                        max_uA < MAX14577_REGULATOR_CURRENT_LIMIT_MIN)
+                return -EINVAL;
+        if (max_uA < MAX14577_REGULATOR_CURRENT_LIMIT_HIGH_START) {
+                /* Less than 200 mA, so set 90mA (turn only Low Bit off) */
+                u8 reg_data = 0x0 << CHGCTRL4_MBCICHWRCL_SHIFT;
+                return max14577_update_reg(rdev->regmap,
+                                MAX14577_CHG_REG_CHG_CTRL4,
+                                CHGCTRL4_MBCICHWRCL_MASK, reg_data);
+        }
+        /* max_uA is in range: <LIMIT_HIGH_START, inifinite>, so search for
+         * valid current starting from LIMIT_MAX. */
+        for (i = MAX14577_REGULATOR_CURRENT_LIMIT_MAX;
+                        i >= MAX14577_REGULATOR_CURRENT_LIMIT_HIGH_START;
+                        i -= MAX14577_REGULATOR_CURRENT_LIMIT_HIGH_STEP) {
+                if (i <= max_uA)
+                        break;
+                current_bits--;
+        }
+        BUG_ON(current_bits < 0); /* Cannot happen */
+        /* Turn Low Bit on (use range 200mA-950 mA) */
+        reg_data = 0x1 << CHGCTRL4_MBCICHWRCL_SHIFT;
+        /* and set proper High Bits */
+        reg_data |= current_bits << CHGCTRL4_MBCICHWRCH_SHIFT;
+        return max14577_update_reg(rdev->regmap, MAX14577_CHG_REG_CHG_CTRL4,
+                        CHGCTRL4_MBCICHWRCL_MASK | CHGCTRL4_MBCICHWRCH_MASK,
+                        reg_data);
+}
+static struct regulator_ops max14577_safeout_ops = {
+        .is_enabled             = regulator_is_enabled_regmap,
+        .enable                 = regulator_enable_regmap,
+        .disable                = regulator_disable_regmap,
+        .list_voltage           = regulator_list_voltage_linear,
+};
+static struct regulator_ops max14577_charger_ops = {
+        .is_enabled             = max14577_reg_is_enabled,
+        .enable                 = regulator_enable_regmap,
+        .disable                = regulator_disable_regmap,
+        .get_current_limit      = max14577_reg_get_current_limit,
+        .set_current_limit      = max14577_reg_set_current_limit,
+};
+static const struct regulator_desc supported_regulators[] = {
+        [MAX14577_SAFEOUT] = {
+                .name           = "SAFEOUT",
+                .id             = MAX14577_SAFEOUT,
+                .ops            = &max14577_safeout_ops,
+                .type           = REGULATOR_VOLTAGE,
+                .owner          = THIS_MODULE,
+                .n_voltages     = 1,
+                .min_uV         = MAX14577_REGULATOR_SAFEOUT_VOLTAGE,
+                .enable_reg     = MAX14577_REG_CONTROL2,
+                .enable_mask    = CTRL2_SFOUTORD_MASK,
+        },
+        [MAX14577_CHARGER] = {
+                .name           = "CHARGER",
+                .id             = MAX14577_CHARGER,
+                .ops            = &max14577_charger_ops,
+                .type           = REGULATOR_CURRENT,
+                .owner          = THIS_MODULE,
+                .enable_reg     = MAX14577_CHG_REG_CHG_CTRL2,
+                .enable_mask    = CHGCTRL2_MBCHOSTEN_MASK,
+        },
+};
+#ifdef CONFIG_OF
+static struct of_regulator_match max14577_regulator_matches[] = {
+        { .name = "SAFEOUT", },
+        { .name = "CHARGER", },
+};
+static int max14577_regulator_dt_parse_pdata(struct platform_device *pdev)
+{
+        int ret;
+        struct device_node *np;
+        np = of_get_child_by_name(pdev->dev.parent->of_node, "regulators");
+        if (!np) {
+                dev_err(&pdev->dev, "Failed to get child OF node for regulators\n");
+                return -EINVAL;
+        }
+        ret = of_regulator_match(&pdev->dev, np, max14577_regulator_matches,
+                        MAX14577_REG_MAX);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Error parsing regulator init data: %d\n", ret);
+                return ret;
+        }
+        return 0;
+}
+static inline struct regulator_init_data *match_init_data(int index)
+{
+        return max14577_regulator_matches[index].init_data;
+}
+static inline struct device_node *match_of_node(int index)
+{
+        return max14577_regulator_matches[index].of_node;
+}
+#else /* CONFIG_OF */
+static int max14577_regulator_dt_parse_pdata(struct platform_device *pdev)
+{
+        return 0;
+}
+static inline struct regulator_init_data *match_init_data(int index)
+{
+        return NULL;
+}
+static inline struct device_node *match_of_node(int index)
+{
+        return NULL;
+}
+#endif /* CONFIG_OF */
+static int max14577_regulator_probe(struct platform_device *pdev)
+{
+        struct max14577 *max14577 = dev_get_drvdata(pdev->dev.parent);
+        struct max14577_platform_data *pdata = dev_get_platdata(max14577->dev);
+        int i, ret;
+        struct regulator_config config = {};
+        ret = max14577_regulator_dt_parse_pdata(pdev);
+        if (ret)
+                return ret;
+        config.dev = &pdev->dev;
+        config.regmap = max14577->regmap;
+        for (i = 0; i < ARRAY_SIZE(supported_regulators); i++) {
+                struct regulator_dev *regulator;
+                /*
+                 * Index of supported_regulators[] is also the id and must
+                 * match index of pdata->regulators[].
+                 */
+                if (pdata && pdata->regulators) {
+                        config.init_data = pdata->regulators[i].initdata;
+                        config.of_node = pdata->regulators[i].of_node;
+                } else {
+                        config.init_data = match_init_data(i);
+                        config.of_node = match_of_node(i);
+                }
+                regulator = devm_regulator_register(&pdev->dev,
+                                &supported_regulators[i], &config);
+                if (IS_ERR(regulator)) {
+                        ret = PTR_ERR(regulator);
+                        dev_err(&pdev->dev,
+                                        "Regulator init failed for ID %d with error: %d\n",
+                                        i, ret);
+                        return ret;
+                }
+        }
+        return ret;
+}
+static struct platform_driver max14577_regulator_driver = {
+        .driver = {
+                   .owner = THIS_MODULE,
+                   .name = "max14577-regulator",
+                   },
+        .probe  = max14577_regulator_probe,
+};
+static int __init max14577_regulator_init(void)
+{
+        BUILD_BUG_ON(MAX14577_REGULATOR_CURRENT_LIMIT_HIGH_START +
+                        MAX14577_REGULATOR_CURRENT_LIMIT_HIGH_STEP * 0xf !=
+                        MAX14577_REGULATOR_CURRENT_LIMIT_MAX);
+        BUILD_BUG_ON(ARRAY_SIZE(supported_regulators) != MAX14577_REG_MAX);
+        return platform_driver_register(&max14577_regulator_driver);
+}
+subsys_initcall(max14577_regulator_init);
+static void __exit max14577_regulator_exit(void)
+{
+        platform_driver_unregister(&max14577_regulator_driver);
+}
+module_exit(max14577_regulator_exit);
+MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski@samsung.com>");
+MODULE_DESCRIPTION("MAXIM 14577 regulator driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:max14577-regulator");
diff --git a/drivers/regulator/max77693.c b/drivers/regulator/max77693.c
index feb20bf4ccab..5fb899f461d0 100644
--- a/drivers/regulator/max77693.c
+++ b/drivers/regulator/max77693.c
@@ -138,6 +138,7 @@ static struct regulator_ops max77693_charger_ops = {
        .n_voltages     = 4,                                    \
        .ops            = &max77693_safeout_ops,                \
        .type           = REGULATOR_VOLTAGE,                    \
+        .owner          = THIS_MODULE,                          \
        .volt_table     = max77693_safeout_table,               \
        .vsel_reg       = MAX77693_CHG_REG_SAFEOUT_CTRL,        \
        .vsel_mask      = SAFEOUT_CTRL_SAFEOUT##_num##_MASK,    \
diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
index 96c9f80d9550..f374fa57220f 100644
--- a/drivers/regulator/mc13892-regulator.c
+++ b/drivers/regulator/mc13892-regulator.c
@@ -274,25 +274,25 @@ static struct mc13xxx_regulator mc13892_regulators[] = {
        MC13892_SW_DEFINE(SW4, SWITCHERS3, SWITCHERS3, mc13892_sw),
        MC13892_FIXED_DEFINE(SWBST, SWITCHERS5, mc13892_swbst),
        MC13892_FIXED_DEFINE(VIOHI, REGULATORMODE0, mc13892_viohi),
-        MC13892_DEFINE_REGU(VPLL, REGULATORMODE0, REGULATORSETTING0,    \
+        MC13892_DEFINE_REGU(VPLL, REGULATORMODE0, REGULATORSETTING0,
                mc13892_vpll),
-        MC13892_DEFINE_REGU(VDIG, REGULATORMODE0, REGULATORSETTING0,    \
+        MC13892_DEFINE_REGU(VDIG, REGULATORMODE0, REGULATORSETTING0,
                mc13892_vdig),
-        MC13892_DEFINE_REGU(VSD, REGULATORMODE1, REGULATORSETTING1,     \
+        MC13892_DEFINE_REGU(VSD, REGULATORMODE1, REGULATORSETTING1,
                mc13892_vsd),
-        MC13892_DEFINE_REGU(VUSB2, REGULATORMODE0, REGULATORSETTING0,   \
+        MC13892_DEFINE_REGU(VUSB2, REGULATORMODE0, REGULATORSETTING0,
                mc13892_vusb2),
-        MC13892_DEFINE_REGU(VVIDEO, REGULATORMODE1, REGULATORSETTING1,  \
+        MC13892_DEFINE_REGU(VVIDEO, REGULATORMODE1, REGULATORSETTING1,
                mc13892_vvideo),
-        MC13892_DEFINE_REGU(VAUDIO, REGULATORMODE1, REGULATORSETTING1,  \
+        MC13892_DEFINE_REGU(VAUDIO, REGULATORMODE1, REGULATORSETTING1,
                mc13892_vaudio),
-        MC13892_DEFINE_REGU(VCAM, REGULATORMODE1, REGULATORSETTING0,    \
+        MC13892_DEFINE_REGU(VCAM, REGULATORMODE1, REGULATORSETTING0,
                mc13892_vcam),
-        MC13892_DEFINE_REGU(VGEN1, REGULATORMODE0, REGULATORSETTING0,   \
+        MC13892_DEFINE_REGU(VGEN1, REGULATORMODE0, REGULATORSETTING0,
                mc13892_vgen1),
-        MC13892_DEFINE_REGU(VGEN2, REGULATORMODE0, REGULATORSETTING0,   \
+        MC13892_DEFINE_REGU(VGEN2, REGULATORMODE0, REGULATORSETTING0,
                mc13892_vgen2),
-        MC13892_DEFINE_REGU(VGEN3, REGULATORMODE1, REGULATORSETTING0,   \
+        MC13892_DEFINE_REGU(VGEN3, REGULATORMODE1, REGULATORSETTING0,
                mc13892_vgen3),
        MC13892_FIXED_DEFINE(VUSB, USB1, mc13892_vusb),
        MC13892_GPO_DEFINE(GPO1, POWERMISC, mc13892_gpo),
@@ -476,8 +476,8 @@ static int mc13892_sw_regulator_set_voltage_sel(struct regulator_dev *rdev,
        }
        mc13xxx_lock(priv->mc13xxx);
-        ret = mc13xxx_reg_rmw(priv->mc13xxx, mc13892_regulators[id].vsel_reg, mask,
+        ret = mc13xxx_reg_rmw(priv->mc13xxx, mc13892_regulators[id].vsel_reg,
-                              reg_value);
+                              mask, reg_value);
        mc13xxx_unlock(priv->mc13xxx);
        return ret;
diff --git a/drivers/regulator/pcf50633-regulator.c b/drivers/regulator/pcf50633-regulator.c
index d7da1c15a6da..134f90ec9ca1 100644
--- a/drivers/regulator/pcf50633-regulator.c
+++ b/drivers/regulator/pcf50633-regulator.c
@@ -105,7 +105,7 @@ static int pcf50633_regulator_probe(struct platform_device *pdev)
 static struct platform_driver pcf50633_regulator_driver = {
        .driver = {
-                .name = "pcf50633-regltr",
+                .name = "pcf50633-regulator",
        },
        .probe = pcf50633_regulator_probe,
 };
diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index f68e5d5a011e..ab174f20ca11 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -326,7 +326,7 @@ static int pfuze_identify(struct pfuze_chip *pfuze_chip)
        if (ret)
                return ret;
        dev_info(pfuze_chip->dev,
-                 "Full lay: %x, Metal lay: %x\n",
+                 "Full layer: %x, Metal layer: %x\n",
                 (value & 0xf0) >> 4, value & 0x0f);
        ret = regmap_read(pfuze_chip->regmap, PFUZE100_FABID, &value);
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 333677d68d0e..9e61922d8230 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -438,7 +438,7 @@ common_reg:
        platform_set_drvdata(pdev, s2mps11);
        config.dev = &pdev->dev;
-        config.regmap = iodev->regmap;
+        config.regmap = iodev->regmap_pmic;
        config.driver_data = s2mps11;
        for (i = 0; i < S2MPS11_REGULATOR_MAX; i++) {
                if (!reg_np) {
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 3f4ca4e09a4c..34629ea913d4 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -942,7 +942,7 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
                return rc;
        }
-        tp->screen = tty3270_alloc_screen(tp->view.cols, tp->view.rows);
+        tp->screen = tty3270_alloc_screen(tp->view.rows, tp->view.cols);
        if (IS_ERR(tp->screen)) {
                rc = PTR_ERR(tp->screen);
                raw3270_put_view(&tp->view);
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 596480022b0a..38a1257e76e1 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -471,7 +471,7 @@ static void qlt_schedule_sess_for_deletion(struct qla_tgt_sess *sess,
                schedule_delayed_work(&tgt->sess_del_work, 0);
        else
                schedule_delayed_work(&tgt->sess_del_work,
-                    jiffies - sess->expires);
+                    sess->expires - jiffies);
 }
 /* ha->hardware_lock supposed to be held on entry */
@@ -550,13 +550,14 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
        struct scsi_qla_host *vha = tgt->vha;
        struct qla_hw_data *ha = vha->hw;
        struct qla_tgt_sess *sess;
-        unsigned long flags;
+        unsigned long flags, elapsed;
        spin_lock_irqsave(&ha->hardware_lock, flags);
        while (!list_empty(&tgt->del_sess_list)) {
                sess = list_entry(tgt->del_sess_list.next, typeof(*sess),
                    del_list_entry);
-                if (time_after_eq(jiffies, sess->expires)) {
+                elapsed = jiffies;
+                if (time_after_eq(elapsed, sess->expires)) {
                        qlt_undelete_sess(sess);
                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf004,
@@ -566,7 +567,7 @@ static void qlt_del_sess_work_fn(struct delayed_work *work)
                        ha->tgt.tgt_ops->put_sess(sess);
                } else {
                        schedule_delayed_work(&tgt->sess_del_work,
-                            jiffies - sess->expires);
+                            sess->expires - elapsed);
                        break;
                }
        }
@@ -4290,6 +4291,7 @@ int qlt_lport_register(struct qla_tgt_func_tmpl *qla_tgt_ops, u64 wwpn,
                if (rc != 0) {
                        ha->tgt.tgt_ops = NULL;
                        ha->tgt.target_lport_ptr = NULL;
+                        scsi_host_put(host);
                }
                mutex_unlock(&qla_tgt_mutex);
                return rc;
diff --git a/drivers/staging/bcm/Bcmnet.c b/drivers/staging/bcm/Bcmnet.c
index 53fee2f9a498..8dfdd2732bdc 100644
--- a/drivers/staging/bcm/Bcmnet.c
+++ b/drivers/staging/bcm/Bcmnet.c
@@ -39,7 +39,8 @@ static INT bcm_close(struct net_device *dev)
        return 0;
 }
-static u16 bcm_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 bcm_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
        return ClassifyPacket(netdev_priv(dev), skb);
 }
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index 8f02bf66e20b..4964d2a2fc7d 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -446,7 +446,7 @@ int comedi_load_firmware(struct comedi_device *dev,
                release_firmware(fw);
        }
-        return ret;
+        return ret < 0 ? ret : 0;
 }
 EXPORT_SYMBOL_GPL(comedi_load_firmware);
diff --git a/drivers/staging/comedi/drivers/8255_pci.c b/drivers/staging/comedi/drivers/8255_pci.c
index 432e3f9c3301..c55f234b29e6 100644
--- a/drivers/staging/comedi/drivers/8255_pci.c
+++ b/drivers/staging/comedi/drivers/8255_pci.c
@@ -63,7 +63,8 @@ enum pci_8255_boardid {
        BOARD_ADLINK_PCI7296,
        BOARD_CB_PCIDIO24,
        BOARD_CB_PCIDIO24H,
-        BOARD_CB_PCIDIO48H,
+        BOARD_CB_PCIDIO48H_OLD,
+        BOARD_CB_PCIDIO48H_NEW,
        BOARD_CB_PCIDIO96H,
        BOARD_NI_PCIDIO96,
        BOARD_NI_PCIDIO96B,
@@ -106,11 +107,16 @@ static const struct pci_8255_boardinfo pci_8255_boards[] = {
                .dio_badr       = 2,
                .n_8255         = 1,
        },
-        [BOARD_CB_PCIDIO48H] = {
+        [BOARD_CB_PCIDIO48H_OLD] = {
                .name           = "cb_pci-dio48h",
                .dio_badr       = 1,
                .n_8255         = 2,
        },
+        [BOARD_CB_PCIDIO48H_NEW] = {
+                .name           = "cb_pci-dio48h",
+                .dio_badr       = 2,
+                .n_8255         = 2,
+        },
        [BOARD_CB_PCIDIO96H] = {
                .name           = "cb_pci-dio96h",
                .dio_badr       = 2,
@@ -263,7 +269,10 @@ static DEFINE_PCI_DEVICE_TABLE(pci_8255_pci_table) = {
        { PCI_VDEVICE(ADLINK, 0x7296), BOARD_ADLINK_PCI7296 },
        { PCI_VDEVICE(CB, 0x0028), BOARD_CB_PCIDIO24 },
        { PCI_VDEVICE(CB, 0x0014), BOARD_CB_PCIDIO24H },
-        { PCI_VDEVICE(CB, 0x000b), BOARD_CB_PCIDIO48H },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, 0x0000, 0x0000),
+          .driver_data = BOARD_CB_PCIDIO48H_OLD },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, PCI_VENDOR_ID_CB, 0x000b),
+          .driver_data = BOARD_CB_PCIDIO48H_NEW },
        { PCI_VDEVICE(CB, 0x0017), BOARD_CB_PCIDIO96H },
        { PCI_VDEVICE(NI, 0x0160), BOARD_NI_PCIDIO96 },
        { PCI_VDEVICE(NI, 0x1630), BOARD_NI_PCIDIO96B },
diff --git a/drivers/staging/iio/magnetometer/hmc5843.c b/drivers/staging/iio/magnetometer/hmc5843.c
index 99421f90d189..0485d7f39867 100644
--- a/drivers/staging/iio/magnetometer/hmc5843.c
+++ b/drivers/staging/iio/magnetometer/hmc5843.c
@@ -451,7 +451,12 @@ done:
                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE) |  \
                        BIT(IIO_CHAN_INFO_SAMP_FREQ),                   \
                .scan_index = idx,                                      \
-                .scan_type = IIO_ST('s', 16, 16, IIO_BE),               \
+                .scan_type = {                                          \
+                        .sign = 's',                                    \
+                        .realbits = 16,                                 \
+                        .storagebits = 16,                              \
+                        .endianness = IIO_BE,                           \
+                },                                                      \
        }
 static const struct iio_chan_spec hmc5843_channels[] = {
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 6bd015ac9d68..96e4eee344ef 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -88,8 +88,9 @@ static int imx_drm_driver_unload(struct drm_device *drm)
        imx_drm_device_put();
-        drm_mode_config_cleanup(imxdrm->drm);
+        drm_vblank_cleanup(imxdrm->drm);
        drm_kms_helper_poll_fini(imxdrm->drm);
+        drm_mode_config_cleanup(imxdrm->drm);
        return 0;
 }
@@ -199,8 +200,8 @@ static void imx_drm_driver_preclose(struct drm_device *drm,
        if (!file->is_master)
                return;
-        for (i = 0; i < 4; i++)
+        for (i = 0; i < MAX_CRTC; i++)
-                imx_drm_disable_vblank(drm , i);
+                imx_drm_disable_vblank(drm, i);
 }
 static const struct file_operations imx_drm_driver_fops = {
@@ -376,8 +377,6 @@ static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
        struct imx_drm_device *imxdrm = __imx_drm_device();
        int ret;
-        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
-                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
        ret = drm_mode_crtc_set_gamma_size(imx_drm_crtc->crtc, 256);
        if (ret)
                return ret;
@@ -385,6 +384,9 @@ static int imx_drm_crtc_register(struct imx_drm_crtc *imx_drm_crtc)
        drm_crtc_helper_add(imx_drm_crtc->crtc,
                        imx_drm_crtc->imx_drm_helper_funcs.crtc_helper_funcs);
+        drm_crtc_init(imxdrm->drm, imx_drm_crtc->crtc,
+                        imx_drm_crtc->imx_drm_helper_funcs.crtc_funcs);
        drm_mode_group_reinit(imxdrm->drm);
        return 0;
@@ -428,11 +430,11 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
        ret = drm_mode_group_init_legacy_group(imxdrm->drm,
                        &imxdrm->drm->primary->mode_group);
        if (ret)
-                goto err_init;
+                goto err_kms;
        ret = drm_vblank_init(imxdrm->drm, MAX_CRTC);
        if (ret)
-                goto err_init;
+                goto err_kms;
        /*
         * with vblank_disable_allowed = true, vblank interrupt will be disabled
@@ -441,12 +443,19 @@ static int imx_drm_driver_load(struct drm_device *drm, unsigned long flags)
         */
        imxdrm->drm->vblank_disable_allowed = true;
-        if (!imx_drm_device_get())
+        if (!imx_drm_device_get()) {
                ret = -EINVAL;
+                goto err_vblank;
+        }
-        ret = 0;
+        mutex_unlock(&imxdrm->mutex);
+        return 0;
-err_init:
+err_vblank:
+        drm_vblank_cleanup(drm);
+err_kms:
+        drm_kms_helper_poll_fini(drm);
+        drm_mode_config_cleanup(drm);
        mutex_unlock(&imxdrm->mutex);
        return ret;
@@ -492,6 +501,15 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
        mutex_lock(&imxdrm->mutex);
+        /*
+         * The vblank arrays are dimensioned by MAX_CRTC - we can't
+         * pass IDs greater than this to those functions.
+         */
+        if (imxdrm->pipes >= MAX_CRTC) {
+                ret = -EINVAL;
+                goto err_busy;
+        }
        if (imxdrm->drm->open_count) {
                ret = -EBUSY;
                goto err_busy;
@@ -528,6 +546,7 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
        return 0;
 err_register:
+        list_del(&imx_drm_crtc->list);
        kfree(imx_drm_crtc);
 err_alloc:
 err_busy:
diff --git a/drivers/staging/imx-drm/imx-tve.c b/drivers/staging/imx-drm/imx-tve.c
index 680f4c8fa081..2c44fef8d58b 100644
--- a/drivers/staging/imx-drm/imx-tve.c
+++ b/drivers/staging/imx-drm/imx-tve.c
@@ -114,7 +114,6 @@ struct imx_tve {
        struct drm_encoder encoder;
        struct imx_drm_encoder *imx_drm_encoder;
        struct device *dev;
-        spinlock_t enable_lock; /* serializes tve_enable/disable */
        spinlock_t lock;        /* register lock */
        bool enabled;
        int mode;
@@ -146,10 +145,8 @@ __releases(&tve->lock)
 static void tve_enable(struct imx_tve *tve)
 {
-        unsigned long flags;
        int ret;
-        spin_lock_irqsave(&tve->enable_lock, flags);
        if (!tve->enabled) {
                tve->enabled = true;
                clk_prepare_enable(tve->clk);
@@ -169,23 +166,18 @@ static void tve_enable(struct imx_tve *tve)
                             TVE_CD_SM_IEN |
                             TVE_CD_LM_IEN |
                             TVE_CD_MON_END_IEN);
-        spin_unlock_irqrestore(&tve->enable_lock, flags);
 }
 static void tve_disable(struct imx_tve *tve)
 {
-        unsigned long flags;
        int ret;
-        spin_lock_irqsave(&tve->enable_lock, flags);
        if (tve->enabled) {
                tve->enabled = false;
                ret = regmap_update_bits(tve->regmap, TVE_COM_CONF_REG,
                                         TVE_IPU_CLK_EN | TVE_EN, 0);
                clk_disable_unprepare(tve->clk);
        }
-        spin_unlock_irqrestore(&tve->enable_lock, flags);
 }
 static int tve_setup_tvout(struct imx_tve *tve)
@@ -601,7 +593,6 @@ static int imx_tve_probe(struct platform_device *pdev)
        tve->dev = &pdev->dev;
        spin_lock_init(&tve->lock);
-        spin_lock_init(&tve->enable_lock);
        ddc_node = of_parse_phandle(np, "ddc", 0);
        if (ddc_node) {
diff --git a/drivers/staging/imx-drm/ipu-v3/ipu-common.c b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
index 7a22ce619ed2..97ca6924dbb3 100644
--- a/drivers/staging/imx-drm/ipu-v3/ipu-common.c
+++ b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
@@ -996,35 +996,35 @@ static const struct ipu_platform_reg client_reg[] = {
        },
 };
+static DEFINE_MUTEX(ipu_client_id_mutex);
 static int ipu_client_id;
-static int ipu_add_subdevice_pdata(struct device *dev,
-                const struct ipu_platform_reg *reg)
-{
-        struct platform_device *pdev;
-        pdev = platform_device_register_data(dev, reg->name, ipu_client_id++,
-                        &reg->pdata, sizeof(struct ipu_platform_reg));
-        return PTR_ERR_OR_ZERO(pdev);
-}
 static int ipu_add_client_devices(struct ipu_soc *ipu)
 {
-        int ret;
+        struct device *dev = ipu->dev;
-        int i;
+        unsigned i;
+        int id, ret;
+        mutex_lock(&ipu_client_id_mutex);
+        id = ipu_client_id;
+        ipu_client_id += ARRAY_SIZE(client_reg);
+        mutex_unlock(&ipu_client_id_mutex);
        for (i = 0; i < ARRAY_SIZE(client_reg); i++) {
                const struct ipu_platform_reg *reg = &client_reg[i];
-                ret = ipu_add_subdevice_pdata(ipu->dev, reg);
+                struct platform_device *pdev;
-                if (ret)
+                pdev = platform_device_register_data(dev, reg->name,
+                        id++, &reg->pdata, sizeof(reg->pdata));
+                if (IS_ERR(pdev))
                        goto err_register;
        }
        return 0;
 err_register:
-        platform_device_unregister_children(to_platform_device(ipu->dev));
+        platform_device_unregister_children(to_platform_device(dev));
        return ret;
 }
diff --git a/drivers/staging/netlogic/xlr_net.c b/drivers/staging/netlogic/xlr_net.c
index 235d2b1ec593..eedffed17e39 100644
--- a/drivers/staging/netlogic/xlr_net.c
+++ b/drivers/staging/netlogic/xlr_net.c
@@ -306,7 +306,8 @@ static netdev_tx_t xlr_net_start_xmit(struct sk_buff *skb,
        return NETDEV_TX_OK;
 }
-static u16 xlr_net_select_queue(struct net_device *ndev, struct sk_buff *skb)
+static u16 xlr_net_select_queue(struct net_device *ndev, struct sk_buff *skb,
+                                void *accel_priv)
 {
        return (u16)smp_processor_id();
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/os_intfs.c b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
index 17659bb04bef..dd69e344e409 100644
--- a/drivers/staging/rtl8188eu/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
@@ -652,7 +652,8 @@ static unsigned int rtw_classify8021d(struct sk_buff *skb)
        return dscp >> 5;
 }
-static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
        struct adapter  *padapter = rtw_netdev_priv(dev);
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index d70e9119e906..00867190413c 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -465,6 +465,7 @@ int iscsit_del_np(struct iscsi_np *np)
                 */
                send_sig(SIGINT, np->np_thread, 1);
                kthread_stop(np->np_thread);
+                np->np_thread = NULL;
        }
        np->np_transport->iscsit_free_np(np);
@@ -823,24 +824,22 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
        if (((hdr->flags & ISCSI_FLAG_CMD_READ) ||
             (hdr->flags & ISCSI_FLAG_CMD_WRITE)) && !hdr->data_length) {
                /*
-                 * Vmware ESX v3.0 uses a modified Cisco Initiator (v3.4.2)
+                 * From RFC-3720 Section 10.3.1:
-                 * that adds support for RESERVE/RELEASE.  There is a bug
+                 *
-                 * add with this new functionality that sets R/W bits when
+                 * "Either or both of R and W MAY be 1 when either the
-                 * neither CDB carries any READ or WRITE datapayloads.
+                 *  Expected Data Transfer Length and/or Bidirectional Read
+                 *  Expected Data Transfer Length are 0"
+                 *
+                 * For this case, go ahead and clear the unnecssary bits
+                 * to avoid any confusion with ->data_direction.
                 */
-                if ((hdr->cdb[0] == 0x16) || (hdr->cdb[0] == 0x17)) {
+                hdr->flags &= ~ISCSI_FLAG_CMD_READ;
-                        hdr->flags &= ~ISCSI_FLAG_CMD_READ;
+                hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
-                        hdr->flags &= ~ISCSI_FLAG_CMD_WRITE;
-                        goto done;
-                }
-                pr_err("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
+                pr_warn("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE"
                        " set when Expected Data Transfer Length is 0 for"
-                        " CDB: 0x%02x. Bad iSCSI Initiator.\n", hdr->cdb[0]);
+                        " CDB: 0x%02x, Fixing up flags\n", hdr->cdb[0]);
-                return iscsit_add_reject_cmd(cmd,
-                                             ISCSI_REASON_BOOKMARK_INVALID, buf);
        }
-done:
        if (!(hdr->flags & ISCSI_FLAG_CMD_READ) &&
            !(hdr->flags & ISCSI_FLAG_CMD_WRITE) && (hdr->data_length != 0)) {
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index e3318edb233d..1c0088fe9e99 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -474,7 +474,8 @@ static ssize_t __iscsi_##prefix##_store_##name(				\
                                                                        \
        if (!capable(CAP_SYS_ADMIN))                                    \
                return -EPERM;                                          \
-                                                                        \
+        if (count >= sizeof(auth->name))                                \
+                return -EINVAL;                                         \
        snprintf(auth->name, sizeof(auth->name), "%s", page);           \
        if (!strncmp("NULL", auth->name, 4))                            \
                auth->naf_flags &= ~flags;                              \
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 4eb93b2b6473..e29279e6b577 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1403,11 +1403,6 @@ old_sess_out:
 out:
        stop = kthread_should_stop();
-        if (!stop && signal_pending(current)) {
-                spin_lock_bh(&np->np_thread_lock);
-                stop = (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN);
-                spin_unlock_bh(&np->np_thread_lock);
-        }
        /* Wait for another socket.. */
        if (!stop)
                return 1;
@@ -1415,7 +1410,6 @@ exit:
        iscsi_stop_login_thread_timer(np);
        spin_lock_bh(&np->np_thread_lock);
        np->np_thread_state = ISCSI_NP_THREAD_EXIT;
-        np->np_thread = NULL;
        spin_unlock_bh(&np->np_thread_lock);
        return 0;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 207b340498a3..d06de84b069b 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1106,6 +1106,11 @@ int se_dev_set_block_size(struct se_device *dev, u32 block_size)
        dev->dev_attrib.block_size = block_size;
        pr_debug("dev[%p]: SE Device block_size changed to %u\n",
                        dev, block_size);
+        if (dev->dev_attrib.max_bytes_per_io)
+                dev->dev_attrib.hw_max_sectors =
+                        dev->dev_attrib.max_bytes_per_io / block_size;
        return 0;
 }
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 0e34cda3271e..78241a53b555 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -66,9 +66,8 @@ static int fd_attach_hba(struct se_hba *hba, u32 host_id)
        pr_debug("CORE_HBA[%d] - TCM FILEIO HBA Driver %s on Generic"
                " Target Core Stack %s\n", hba->hba_id, FD_VERSION,
                TARGET_CORE_MOD_VERSION);
-        pr_debug("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic"
+        pr_debug("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic\n",
-                " MaxSectors: %u\n",
+                hba->hba_id, fd_host->fd_host_id);
-                hba->hba_id, fd_host->fd_host_id, FD_MAX_SECTORS);
        return 0;
 }
@@ -220,7 +219,8 @@ static int fd_configure_device(struct se_device *dev)
        }
        dev->dev_attrib.hw_block_size = fd_dev->fd_block_size;
-        dev->dev_attrib.hw_max_sectors = FD_MAX_SECTORS;
+        dev->dev_attrib.max_bytes_per_io = FD_MAX_BYTES;
+        dev->dev_attrib.hw_max_sectors = FD_MAX_BYTES / fd_dev->fd_block_size;
        dev->dev_attrib.hw_queue_depth = FD_MAX_DEVICE_QUEUE_DEPTH;
        if (fd_dev->fbd_flags & FDBD_HAS_BUFFERED_IO_WCE) {
diff --git a/drivers/target/target_core_file.h b/drivers/target/target_core_file.h
index 37ffc5bd2399..d7772c167685 100644
--- a/drivers/target/target_core_file.h
+++ b/drivers/target/target_core_file.h
@@ -7,7 +7,10 @@
 #define FD_DEVICE_QUEUE_DEPTH   32
 #define FD_MAX_DEVICE_QUEUE_DEPTH 128
 #define FD_BLOCKSIZE            512
-#define FD_MAX_SECTORS          2048
+/*
+ * Limited by the number of iovecs (2048) per vfs_[writev,readv] call
+ */
+#define FD_MAX_BYTES            8388608
 #define RRF_EMULATE_CDB         0x01
 #define RRF_GOT_LBA             0x02
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index f697f8baec54..2a573de19a9f 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -278,7 +278,6 @@ struct se_node_acl *core_tpg_check_initiator_node_acl(
        snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
        acl->se_tpg = tpg;
        acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX);
-        spin_lock_init(&acl->stats_lock);
        acl->dynamic_node_acl = 1;
        tpg->se_tpg_tfo->set_default_node_attributes(acl);
@@ -406,7 +405,6 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
        snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
        acl->se_tpg = tpg;
        acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX);
-        spin_lock_init(&acl->stats_lock);
        tpg->se_tpg_tfo->set_default_node_attributes(acl);
@@ -658,15 +656,9 @@ static int core_tpg_setup_virtual_lun0(struct se_portal_group *se_tpg)
        spin_lock_init(&lun->lun_sep_lock);
        init_completion(&lun->lun_ref_comp);
-        ret = percpu_ref_init(&lun->lun_ref, core_tpg_lun_ref_release);
-        if (ret < 0)
-                return ret;
        ret = core_tpg_post_addlun(se_tpg, lun, lun_access, dev);
-        if (ret < 0) {
+        if (ret < 0)
-                percpu_ref_cancel_init(&lun->lun_ref);
                return ret;
-        }
        return 0;
 }
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 268b62768f2b..34aacaaae14a 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -93,6 +93,7 @@ struct n_tty_data {
        size_t canon_head;
        size_t echo_head;
        size_t echo_commit;
+        size_t echo_mark;
        DECLARE_BITMAP(char_map, 256);
        /* private to n_tty_receive_overrun (single-threaded) */
@@ -336,6 +337,7 @@ static void reset_buffer_flags(struct n_tty_data *ldata)
 {
        ldata->read_head = ldata->canon_head = ldata->read_tail = 0;
        ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0;
+        ldata->echo_mark = 0;
        ldata->line_start = 0;
        ldata->erasing = 0;
@@ -787,6 +789,7 @@ static void commit_echoes(struct tty_struct *tty)
        size_t head;
        head = ldata->echo_head;
+        ldata->echo_mark = head;
        old = ldata->echo_commit - ldata->echo_tail;
        /* Process committed echoes if the accumulated # of bytes
@@ -811,10 +814,11 @@ static void process_echoes(struct tty_struct *tty)
        size_t echoed;
        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
-            ldata->echo_commit == ldata->echo_tail)
+            ldata->echo_mark == ldata->echo_tail)
                return;
        mutex_lock(&ldata->output_lock);
+        ldata->echo_commit = ldata->echo_mark;
        echoed = __process_echoes(tty);
        mutex_unlock(&ldata->output_lock);
@@ -822,6 +826,7 @@ static void process_echoes(struct tty_struct *tty)
                tty->ops->flush_chars(tty);
 }
+/* NB: echo_mark and echo_head should be equivalent here */
 static void flush_echoes(struct tty_struct *tty)
 {
        struct n_tty_data *ldata = tty->disc_data;
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 4658e3e0ec42..06525f10e364 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -96,7 +96,8 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
        if (offset == UART_LCR) {
                int tries = 1000;
                while (tries--) {
-                        if (value == p->serial_in(p, UART_LCR))
+                        unsigned int lcr = p->serial_in(p, UART_LCR);
+                        if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
                                return;
                        dw8250_force_idle(p);
                        writeb(value, p->membase + (UART_LCR << p->regshift));
@@ -132,7 +133,8 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
        if (offset == UART_LCR) {
                int tries = 1000;
                while (tries--) {
-                        if (value == p->serial_in(p, UART_LCR))
+                        unsigned int lcr = p->serial_in(p, UART_LCR);
+                        if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
                                return;
                        dw8250_force_idle(p);
                        writel(value, p->membase + (UART_LCR << p->regshift));
@@ -455,6 +457,8 @@ MODULE_DEVICE_TABLE(of, dw8250_of_match);
 static const struct acpi_device_id dw8250_acpi_match[] = {
        { "INT33C4", 0 },
        { "INT33C5", 0 },
+        { "INT3434", 0 },
+        { "INT3435", 0 },
        { "80860F0A", 0 },
        { },
 };
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index e46e9f3f19b9..f619ad5b5eae 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -240,6 +240,7 @@ static irqreturn_t xuartps_isr(int irq, void *dev_id)
                                        continue;
                        }
+#ifdef SUPPORT_SYSRQ
                        /*
                         * uart_handle_sysrq_char() doesn't work if
                         * spinlocked, for some reason
@@ -253,6 +254,7 @@ static irqreturn_t xuartps_isr(int irq, void *dev_id)
                                }
                                spin_lock(&port->lock);
                        }
+#endif
                        port->icount.rx++;
diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
index 22fad8ad5ac2..d8a55e87877f 100644
--- a/drivers/tty/tty_ldsem.c
+++ b/drivers/tty/tty_ldsem.c
@@ -86,11 +86,21 @@ static inline long ldsem_atomic_update(long delta, struct ld_semaphore *sem)
        return atomic_long_add_return(delta, (atomic_long_t *)&sem->count);
 }
+/*
+ * ldsem_cmpxchg() updates @*old with the last-known sem->count value.
+ * Returns 1 if count was successfully changed; @*old will have @new value.
+ * Returns 0 if count was not changed; @*old will have most recent sem->count
+ */
 static inline int ldsem_cmpxchg(long *old, long new, struct ld_semaphore *sem)
 {
-        long tmp = *old;
+        long tmp = atomic_long_cmpxchg(&sem->count, *old, new);
-        *old = atomic_long_cmpxchg(&sem->count, *old, new);
+        if (tmp == *old) {
-        return *old == tmp;
+                *old = new;
+                return 1;
+        } else {
+                *old = tmp;
+                return 0;
+        }
 }
 /*
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 5d8981c5235e..6e73f8cd60e5 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -642,6 +642,10 @@ static int ci_hdrc_probe(struct platform_device *pdev)
                        : CI_ROLE_GADGET;
        }
+        /* only update vbus status for peripheral */
+        if (ci->role == CI_ROLE_GADGET)
+                ci_handle_vbus_change(ci);
        ret = ci_role_start(ci, ci->role);
        if (ret) {
                dev_err(dev, "can't start %s role\n", ci_role(ci)->name);
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 59e6020ea753..526cd77563d8 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -88,7 +88,8 @@ static int host_start(struct ci_hdrc *ci)
        return ret;
 disable_reg:
-        regulator_disable(ci->platdata->reg_vbus);
+        if (ci->platdata->reg_vbus)
+                regulator_disable(ci->platdata->reg_vbus);
 put_hcd:
        usb_put_hcd(hcd);
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index b34c81969cba..69d20fbb38a2 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1795,9 +1795,6 @@ static int udc_start(struct ci_hdrc *ci)
        pm_runtime_no_callbacks(&ci->gadget.dev);
        pm_runtime_enable(&ci->gadget.dev);
-        /* Update ci->vbus_active */
-        ci_handle_vbus_change(ci);
        return retval;
 destroy_eps:
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 4d387596f3f0..0b23a8639311 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -854,13 +854,11 @@ static int wdm_manage_power(struct usb_interface *intf, int on)
 {
        /* need autopm_get/put here to ensure the usbcore sees the new value */
        int rv = usb_autopm_get_interface(intf);
-        if (rv < 0)
-                goto err;
        intf->needs_remote_wakeup = on;
-        usb_autopm_put_interface(intf);
+        if (!rv)
-err:
+                usb_autopm_put_interface(intf);
-        return rv;
+        return 0;
 }
 static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 74f9cf02da07..a49217ae3533 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -455,9 +455,6 @@ static int dwc3_probe(struct platform_device *pdev)
        if (IS_ERR(regs))
                return PTR_ERR(regs);
-        usb_phy_set_suspend(dwc->usb2_phy, 0);
-        usb_phy_set_suspend(dwc->usb3_phy, 0);
        spin_lock_init(&dwc->lock);
        platform_set_drvdata(pdev, dwc);
@@ -488,6 +485,9 @@ static int dwc3_probe(struct platform_device *pdev)
                goto err0;
        }
+        usb_phy_set_suspend(dwc->usb2_phy, 0);
+        usb_phy_set_suspend(dwc->usb3_phy, 0);
        ret = dwc3_event_buffers_setup(dwc);
        if (ret) {
                dev_err(dwc->dev, "failed to setup event buffers\n");
@@ -569,6 +569,8 @@ err2:
        dwc3_event_buffers_cleanup(dwc);
 err1:
+        usb_phy_set_suspend(dwc->usb2_phy, 1);
+        usb_phy_set_suspend(dwc->usb3_phy, 1);
        dwc3_core_exit(dwc);
 err0:
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 418444ebb1b8..8c356af79409 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -136,23 +136,27 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
        struct ohci_hcd *ohci;
        int retval;
        struct usb_hcd *hcd = NULL;
+        struct device *dev = &pdev->dev;
-        if (pdev->num_resources != 2) {
+        struct resource *res;
-                pr_debug("hcd probe: invalid num_resources");
+        int irq;
-                return -ENODEV;
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_dbg(dev, "hcd probe: missing memory resource\n");
+                return -ENXIO;
        }
-        if ((pdev->resource[0].flags != IORESOURCE_MEM)
+        irq = platform_get_irq(pdev, 0);
-                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+        if (irq < 0) {
-                pr_debug("hcd probe: invalid resource type\n");
+                dev_dbg(dev, "hcd probe: missing irq resource\n");
-                return -ENODEV;
+                return irq;
        }
        hcd = usb_create_hcd(driver, &pdev->dev, "at91");
        if (!hcd)
                return -ENOMEM;
-        hcd->rsrc_start = pdev->resource[0].start;
+        hcd->rsrc_start = res->start;
-        hcd->rsrc_len = resource_size(&pdev->resource[0]);
+        hcd->rsrc_len = resource_size(res);
        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
                pr_debug("request_mem_region failed\n");
@@ -199,7 +203,7 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
        ohci->num_ports = board->ports;
        at91_start_hc(pdev);
-        retval = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_SHARED);
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
        if (retval == 0)
                return retval;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index b8dffd59eb25..73f5208714a4 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -128,7 +128,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 * any other sleep) on Haswell machines with LPT and LPT-LP
                 * with the new Intel BIOS
                 */
-                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+                /* Limit the quirk to only known vendors, as this triggers
+                 * yet another BIOS bug on some other machines
+                 * https://bugzilla.kernel.org/show_bug.cgi?id=66171
+                 */
+                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
+                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
        }
        if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                        pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 08e2f39027ec..2b41c636a52a 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -19,8 +19,9 @@ config AB8500_USB
          in host mode, low speed.
 config FSL_USB2_OTG
-        bool "Freescale USB OTG Transceiver Driver"
+        tristate "Freescale USB OTG Transceiver Driver"
        depends on USB_EHCI_FSL && USB_FSL_USB2 && PM_RUNTIME
+        depends on USB
        select USB_OTG
        select USB_PHY
        help
@@ -29,6 +30,7 @@ config FSL_USB2_OTG
 config ISP1301_OMAP
        tristate "Philips ISP1301 with OMAP OTG"
        depends on I2C && ARCH_OMAP_OTG
+        depends on USB
        select USB_PHY
        help
          If you say yes here you get support for the Philips ISP1301
diff --git a/drivers/usb/phy/phy-tegra-usb.c b/drivers/usb/phy/phy-tegra-usb.c
index 82232acf1ab6..bbe4f8e6e8d7 100644
--- a/drivers/usb/phy/phy-tegra-usb.c
+++ b/drivers/usb/phy/phy-tegra-usb.c
@@ -876,7 +876,7 @@ static int utmi_phy_probe(struct tegra_usb_phy *tegra_phy,
        tegra_phy->pad_regs = devm_ioremap(&pdev->dev, res->start,
                resource_size(res));
-        if (!tegra_phy->regs) {
+        if (!tegra_phy->pad_regs) {
                dev_err(&pdev->dev, "Failed to remap UTMI Pad regs\n");
                return -ENOMEM;
        }
diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 30e8a61552d4..bad57ce77ba5 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -127,7 +127,8 @@ static inline int twl6030_writeb(struct twl6030_usb *twl, u8 module,
 static inline u8 twl6030_readb(struct twl6030_usb *twl, u8 module, u8 address)
 {
-        u8 data, ret = 0;
+        u8 data;
+        int ret;
        ret = twl_i2c_read_u8(module, &data, address);
        if (ret >= 0)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 496b7e39d5be..cc7a24154490 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb);
 #define ZTE_PRODUCT_MF628                       0x0015
 #define ZTE_PRODUCT_MF626                       0x0031
 #define ZTE_PRODUCT_MC2718                      0xffe8
+#define ZTE_PRODUCT_AC2726                      0xfff1
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -1453,6 +1454,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
        { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
        { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
        { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
diff --git a/drivers/usb/serial/zte_ev.c b/drivers/usb/serial/zte_ev.c
index fca4c752a4ed..eae2c873b39f 100644
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -281,8 +281,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x19d2, 0xfffd) },
        { USB_DEVICE(0x19d2, 0xfffc) },
        { USB_DEVICE(0x19d2, 0xfffb) },
-        /* AC2726, AC8710_V3 */
+        /* AC8710_V3 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfff1, 0xff, 0xff, 0xff) },
        { USB_DEVICE(0x19d2, 0xfff6) },
        { USB_DEVICE(0x19d2, 0xfff7) },
        { USB_DEVICE(0x19d2, 0xfff8) },
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index c444654fc33f..5c4a95b516cf 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -285,7 +285,7 @@ static void update_balloon_size(struct virtio_balloon *vb)
 {
        __le32 actual = cpu_to_le32(vb->num_pages);
-        virtio_cwrite(vb->vdev, struct virtio_balloon_config, num_pages,
+        virtio_cwrite(vb->vdev, struct virtio_balloon_config, actual,
                      &actual);
 }
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 55ea73f7c70b..4c02e2b94103 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -350,17 +350,19 @@ static enum bp_state increase_reservation(unsigned long nr_pages)
                pfn = page_to_pfn(page);
-                set_phys_to_machine(pfn, frame_list[i]);
 #ifdef CONFIG_XEN_HAVE_PVMMU
-                /* Link back into the page tables if not highmem. */
+                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                if (xen_pv_domain() && !PageHighMem(page)) {
+                        set_phys_to_machine(pfn, frame_list[i]);
-                        int ret;
-                        ret = HYPERVISOR_update_va_mapping(
+                        /* Link back into the page tables if not highmem. */
-                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                        if (!PageHighMem(page)) {
-                                mfn_pte(frame_list[i], PAGE_KERNEL),
+                                int ret;
-                                0);
+                                ret = HYPERVISOR_update_va_mapping(
-                        BUG_ON(ret);
+                                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                                mfn_pte(frame_list[i], PAGE_KERNEL),
+                                                0);
+                                BUG_ON(ret);
+                        }
                }
 #endif
@@ -378,7 +380,6 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
        enum bp_state state = BP_DONE;
        unsigned long  pfn, i;
        struct page   *page;
-        struct page   *scratch_page;
        int ret;
        struct xen_memory_reservation reservation = {
                .address_bits = 0,
@@ -411,27 +412,29 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                scrub_page(page);
+#ifdef CONFIG_XEN_HAVE_PVMMU
                /*
                 * Ballooned out frames are effectively replaced with
                 * a scratch frame.  Ensure direct mappings and the
                 * p2m are consistent.
                 */
-                scratch_page = get_balloon_scratch_page();
-#ifdef CONFIG_XEN_HAVE_PVMMU
-                if (xen_pv_domain() && !PageHighMem(page)) {
-                        ret = HYPERVISOR_update_va_mapping(
-                                (unsigned long)__va(pfn << PAGE_SHIFT),
-                                pfn_pte(page_to_pfn(scratch_page),
-                                        PAGE_KERNEL_RO), 0);
-                        BUG_ON(ret);
-                }
-#endif
                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
                        unsigned long p;
+                        struct page   *scratch_page = get_balloon_scratch_page();
+                        if (!PageHighMem(page)) {
+                                ret = HYPERVISOR_update_va_mapping(
+                                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                                pfn_pte(page_to_pfn(scratch_page),
+                                                        PAGE_KERNEL_RO), 0);
+                                BUG_ON(ret);
+                        }
                        p = page_to_pfn(scratch_page);
                        __set_phys_to_machine(pfn, pfn_to_mfn(p));
+                        put_balloon_scratch_page();
                }
-                put_balloon_scratch_page();
+#endif
                balloon_append(pfn_to_page(pfn));
        }
@@ -627,15 +630,17 @@ static int __init balloon_init(void)
        if (!xen_domain())
                return -ENODEV;
-        for_each_online_cpu(cpu)
+        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-        {
+                for_each_online_cpu(cpu)
-                per_cpu(balloon_scratch_page, cpu) = alloc_page(GFP_KERNEL);
+                {
-                if (per_cpu(balloon_scratch_page, cpu) == NULL) {
+                        per_cpu(balloon_scratch_page, cpu) = alloc_page(GFP_KERNEL);
-                        pr_warn("Failed to allocate balloon_scratch_page for cpu %d\n", cpu);
+                        if (per_cpu(balloon_scratch_page, cpu) == NULL) {
-                        return -ENOMEM;
+                                pr_warn("Failed to allocate balloon_scratch_page for cpu %d\n", cpu);
+                                return -ENOMEM;
+                        }
                }
+                register_cpu_notifier(&balloon_cpu_notifier);
        }
-        register_cpu_notifier(&balloon_cpu_notifier);
        pr_info("Initialising balloon driver\n");
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 028387192b60..aa846a48f400 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1176,7 +1176,8 @@ static int gnttab_setup(void)
                gnttab_shared.addr = xen_remap(xen_hvm_resume_frames,
                                                PAGE_SIZE * max_nr_gframes);
                if (gnttab_shared.addr == NULL) {
-                        pr_warn("Failed to ioremap gnttab share frames!\n");
+                        pr_warn("Failed to ioremap gnttab share frames (addr=0x%08lx)!\n",
+                                        xen_hvm_resume_frames);
                        return -ENOMEM;
                }
        }
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 8e74590fa1bb..569a13b9e856 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -533,12 +533,17 @@ static void privcmd_close(struct vm_area_struct *vma)
 {
        struct page **pages = vma->vm_private_data;
        int numpgs = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        int rc;
        if (!xen_feature(XENFEAT_auto_translated_physmap) || !numpgs || !pages)
                return;
-        xen_unmap_domain_mfn_range(vma, numpgs, pages);
+        rc = xen_unmap_domain_mfn_range(vma, numpgs, pages);
-        free_xenballooned_pages(numpgs, pages);
+        if (rc == 0)
+                free_xenballooned_pages(numpgs, pages);
+        else
+                pr_crit("unable to unmap MFN range: leaking %d pages. rc=%d\n",
+                        numpgs, rc);
        kfree(pages);
 }