751 files changed, 13623 insertions, 4982 deletions

diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index d0f3265fb85d..b23fe37f67c0 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -144,7 +144,7 @@ config ACPI_VIDEO
 
 config ACPI_FAN
         tristate "Fan"
-        select THERMAL
+        depends on THERMAL
         default y
         help
           This driver supports ACPI fan devices, allowing user-mode
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index 505d4d79fe3e..c3b2fcb729f3 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -43,6 +43,7 @@ acpi-y				+= pci_root.o pci_link.o pci_irq.o
 acpi-y                          += acpi_lpss.o
 acpi-y                          += acpi_platform.o
 acpi-y                          += acpi_pnp.o
+acpi-y                          += int340x_thermal.o
 acpi-y                          += power.o
 acpi-y                          += event.o
 acpi-y                          += sysfs.o
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index 2bf9082f7523..6ba8beb6b9d2 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -16,6 +16,7 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
 
 #include "internal.h"
@@ -102,6 +103,7 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev)
         pdevinfo.res = resources;
         pdevinfo.num_res = count;
         pdevinfo.acpi_node.companion = adev;
+        pdevinfo.dma_mask = DMA_BIT_MASK(32);
         pdev = platform_device_register_full(&pdevinfo);
         if (IS_ERR(pdev))
                 dev_err(&adev->dev, "platform device creation failed: %ld\n",
@@ -113,3 +115,4 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev)
         kfree(resources);
         return pdev;
 }
+EXPORT_SYMBOL_GPL(acpi_create_platform_device);
diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h
index 2ad2351a9833..c318d3e27893 100644
--- a/drivers/acpi/acpica/achware.h
+++ b/drivers/acpi/acpica/achware.h
@@ -127,7 +127,7 @@ acpi_hw_clear_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
 
 acpi_status
 acpi_hw_get_gpe_status(struct acpi_gpe_event_info *gpe_event_info,
-                       acpi_event_status * event_status);
+                       acpi_event_status *event_status);
 
 acpi_status acpi_hw_disable_all_gpes(void);
 
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 2747279fbe3c..c00e7e41ad75 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -413,8 +413,8 @@ struct acpi_gpe_handler_info {
         acpi_gpe_handler address;       /* Address of handler, if any */
         void *context;          /* Context to be passed to handler */
         struct acpi_namespace_node *method_node;        /* Method node for this GPE level (saved) */
-        u8 original_flags;      /* Original (pre-handler) GPE info */
-        u8 originally_enabled;  /* True if GPE was originally enabled */
+        u8 original_flags;      /* Original (pre-handler) GPE info */
+        u8 originally_enabled;  /* True if GPE was originally enabled */
 };
 
 /* Notify info for implicit notify, multiple device objects */
diff --git a/drivers/acpi/acpica/actables.h b/drivers/acpi/acpica/actables.h
index f14882788eee..1afe46e44dac 100644
--- a/drivers/acpi/acpica/actables.h
+++ b/drivers/acpi/acpica/actables.h
@@ -49,6 +49,8 @@ acpi_status acpi_allocate_root_table(u32 initial_table_count);
 /*
  * tbxfroot - Root pointer utilities
  */
+u32 acpi_tb_get_rsdp_length(struct acpi_table_rsdp *rsdp);
+
 acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp);
 
 u8 *acpi_tb_scan_memory_for_rsdp(u8 *start_address, u32 length);
diff --git a/drivers/acpi/acpica/amlresrc.h b/drivers/acpi/acpica/amlresrc.h
index f3f834408441..3a0beeb86ba5 100644
--- a/drivers/acpi/acpica/amlresrc.h
+++ b/drivers/acpi/acpica/amlresrc.h
@@ -117,6 +117,12 @@ struct asl_resource_node {
         struct asl_resource_node *next;
 };
 
+struct asl_resource_info {
+        union acpi_parse_object *descriptor_type_op;    /* Resource descriptor parse node */
+        union acpi_parse_object *mapping_op;    /* Used for mapfile support */
+        u32 current_byte_offset;        /* Offset in resource template */
+};
+
 /* Macros used to generate AML resource length fields */
 
 #define ACPI_AML_SIZE_LARGE(r)      (sizeof (r) - sizeof (struct aml_resource_large_header))
@@ -449,4 +455,32 @@ union aml_resource {
         u8 byte_item;
 };
 
+/* Interfaces used by both the disassembler and compiler */
+
+void
+mp_save_gpio_info(union acpi_parse_object *op,
+                  union aml_resource *resource,
+                  u32 pin_count, u16 *pin_list, char *device_name);
+
+void
+mp_save_serial_info(union acpi_parse_object *op,
+                    union aml_resource *resource, char *device_name);
+
+char *mp_get_hid_from_parse_tree(struct acpi_namespace_node *hid_node);
+
+char *mp_get_hid_via_namestring(char *device_name);
+
+char *mp_get_connection_info(union acpi_parse_object *op,
+                             u32 pin_index,
+                             struct acpi_namespace_node **target_node,
+                             char **target_name);
+
+char *mp_get_parent_device_hid(union acpi_parse_object *op,
+                               struct acpi_namespace_node **target_node,
+                               char **parent_device_name);
+
+char *mp_get_ddn_value(char *device_name);
+
+char *mp_get_hid_value(struct acpi_namespace_node *device_node);
+
 #endif
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index e4ba4dec86af..2095dfb72bcb 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -100,13 +100,14 @@ acpi_ev_update_gpe_enable_mask(struct acpi_gpe_event_info *gpe_event_info)
  *
  * FUNCTION:    acpi_ev_enable_gpe
  *
- * PARAMETERS:  gpe_event_info  - GPE to enable
+ * PARAMETERS:  gpe_event_info          - GPE to enable
  *
  * RETURN:      Status
  *
  * DESCRIPTION: Clear a GPE of stale events and enable it.
  *
  ******************************************************************************/
+
 acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
 {
         acpi_status status;
@@ -125,6 +126,7 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
         }
 
         /* Clear the GPE (of stale events) */
+
         status = acpi_hw_clear_gpe(gpe_event_info);
         if (ACPI_FAILURE(status)) {
                 return_ACPI_STATUS(status);
@@ -136,7 +138,6 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
         return_ACPI_STATUS(status);
 }
 
-
 /*******************************************************************************
  *
  * FUNCTION:    acpi_ev_add_gpe_reference
@@ -212,7 +213,7 @@ acpi_ev_remove_gpe_reference(struct acpi_gpe_event_info *gpe_event_info)
                 if (ACPI_SUCCESS(status)) {
                         status =
                             acpi_hw_low_set_gpe(gpe_event_info,
-                                                     ACPI_GPE_DISABLE);
+                                                ACPI_GPE_DISABLE);
                 }
 
                 if (ACPI_FAILURE(status)) {
@@ -334,7 +335,7 @@ struct acpi_gpe_event_info *acpi_ev_get_gpe_event_info(acpi_handle gpe_device,
  *
  ******************************************************************************/
 
-u32 acpi_ev_gpe_detect(struct acpi_gpe_xrupt_info * gpe_xrupt_list)
+u32 acpi_ev_gpe_detect(struct acpi_gpe_xrupt_info *gpe_xrupt_list)
 {
         acpi_status status;
         struct acpi_gpe_block_info *gpe_block;
@@ -427,7 +428,7 @@ u32 acpi_ev_gpe_detect(struct acpi_gpe_xrupt_info * gpe_xrupt_list)
 
                         /* Check if there is anything active at all in this register */
 
-                        enabled_status_byte = (u8) (status_reg & enable_reg);
+                        enabled_status_byte = (u8)(status_reg & enable_reg);
                         if (!enabled_status_byte) {
 
                                 /* No active GPEs in this register, move on */
@@ -450,7 +451,7 @@ u32 acpi_ev_gpe_detect(struct acpi_gpe_xrupt_info * gpe_xrupt_list)
                                             acpi_ev_gpe_dispatch(gpe_block->
                                                                  node,
                                                                  &gpe_block->
-                                                event_info[((acpi_size) i * ACPI_GPE_REGISTER_WIDTH) + j], j + gpe_register_info->base_gpe_number);
+                                                                 event_info[((acpi_size) i * ACPI_GPE_REGISTER_WIDTH) + j], j + gpe_register_info->base_gpe_number);
                                 }
                         }
                 }
@@ -636,7 +637,7 @@ static void ACPI_SYSTEM_XFACE acpi_ev_asynch_enable_gpe(void *context)
  *
  ******************************************************************************/
 
-acpi_status acpi_ev_finish_gpe(struct acpi_gpe_event_info *gpe_event_info)
+acpi_status acpi_ev_finish_gpe(struct acpi_gpe_event_info * gpe_event_info)
 {
         acpi_status status;
 
@@ -666,9 +667,9 @@ acpi_status acpi_ev_finish_gpe(struct acpi_gpe_event_info *gpe_event_info)
  *
  * FUNCTION:    acpi_ev_gpe_dispatch
  *
- * PARAMETERS:  gpe_device      - Device node. NULL for GPE0/GPE1
- *              gpe_event_info  - Info for this GPE
- *              gpe_number      - Number relative to the parent GPE block
+ * PARAMETERS:  gpe_device          - Device node. NULL for GPE0/GPE1
+ *              gpe_event_info      - Info for this GPE
+ *              gpe_number          - Number relative to the parent GPE block
  *
  * RETURN:      INTERRUPT_HANDLED or INTERRUPT_NOT_HANDLED
  *
@@ -681,7 +682,7 @@ acpi_status acpi_ev_finish_gpe(struct acpi_gpe_event_info *gpe_event_info)
 
 u32
 acpi_ev_gpe_dispatch(struct acpi_namespace_node *gpe_device,
-                    struct acpi_gpe_event_info *gpe_event_info, u32 gpe_number)
+                     struct acpi_gpe_event_info *gpe_event_info, u32 gpe_number)
 {
         acpi_status status;
         u32 return_value;
diff --git a/drivers/acpi/acpica/evgpeinit.c b/drivers/acpi/acpica/evgpeinit.c
index 49fc7effd961..7be928379879 100644
--- a/drivers/acpi/acpica/evgpeinit.c
+++ b/drivers/acpi/acpica/evgpeinit.c
@@ -424,6 +424,7 @@ acpi_ev_match_gpe_method(acpi_handle obj_handle,
         }
 
         /* Disable the GPE in case it's been enabled already. */
+
         (void)acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_DISABLE);
 
         /*
diff --git a/drivers/acpi/acpica/evxface.c b/drivers/acpi/acpica/evxface.c
index 11e5803b8b41..55a58f3ec8df 100644
--- a/drivers/acpi/acpica/evxface.c
+++ b/drivers/acpi/acpica/evxface.c
@@ -786,18 +786,26 @@ acpi_install_gpe_handler(acpi_handle gpe_device,
         handler->method_node = gpe_event_info->dispatch.method_node;
         handler->original_flags = (u8)(gpe_event_info->flags &
                                        (ACPI_GPE_XRUPT_TYPE_MASK |
-                                        ACPI_GPE_DISPATCH_MASK));
+                                        ACPI_GPE_DISPATCH_MASK));
 
         /*
          * If the GPE is associated with a method, it may have been enabled
          * automatically during initialization, in which case it has to be
          * disabled now to avoid spurious execution of the handler.
          */
-
-        if ((handler->original_flags & ACPI_GPE_DISPATCH_METHOD)
-            && gpe_event_info->runtime_count) {
-                handler->originally_enabled = 1;
+        if (((handler->original_flags & ACPI_GPE_DISPATCH_METHOD) ||
+             (handler->original_flags & ACPI_GPE_DISPATCH_NOTIFY)) &&
+            gpe_event_info->runtime_count) {
+                handler->originally_enabled = TRUE;
                 (void)acpi_ev_remove_gpe_reference(gpe_event_info);
+
+                /* Sanity check of original type against new type */
+
+                if (type !=
+                    (u32)(gpe_event_info->flags & ACPI_GPE_XRUPT_TYPE_MASK)) {
+                        ACPI_WARNING((AE_INFO,
+                                      "GPE type mismatch (level/edge)"));
+                }
         }
 
         /* Install the handler */
@@ -808,7 +816,7 @@ acpi_install_gpe_handler(acpi_handle gpe_device,
 
         gpe_event_info->flags &=
             ~(ACPI_GPE_XRUPT_TYPE_MASK | ACPI_GPE_DISPATCH_MASK);
-        gpe_event_info->flags |= (u8) (type | ACPI_GPE_DISPATCH_HANDLER);
+        gpe_event_info->flags |= (u8)(type | ACPI_GPE_DISPATCH_HANDLER);
 
         acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
 
@@ -893,7 +901,7 @@ acpi_remove_gpe_handler(acpi_handle gpe_device,
 
         gpe_event_info->dispatch.method_node = handler->method_node;
         gpe_event_info->flags &=
-                ~(ACPI_GPE_XRUPT_TYPE_MASK | ACPI_GPE_DISPATCH_MASK);
+            ~(ACPI_GPE_XRUPT_TYPE_MASK | ACPI_GPE_DISPATCH_MASK);
         gpe_event_info->flags |= handler->original_flags;
 
         /*
@@ -901,7 +909,8 @@ acpi_remove_gpe_handler(acpi_handle gpe_device,
          * enabled, it should be enabled at this point to restore the
          * post-initialization configuration.
          */
-        if ((handler->original_flags & ACPI_GPE_DISPATCH_METHOD) &&
+        if (((handler->original_flags & ACPI_GPE_DISPATCH_METHOD) ||
+             (handler->original_flags & ACPI_GPE_DISPATCH_NOTIFY)) &&
             handler->originally_enabled) {
                 (void)acpi_ev_add_gpe_reference(gpe_event_info);
         }
@@ -946,7 +955,7 @@ ACPI_EXPORT_SYMBOL(acpi_remove_gpe_handler)
  * handle is returned.
  *
  ******************************************************************************/
-acpi_status acpi_acquire_global_lock(u16 timeout, u32 * handle)
+acpi_status acpi_acquire_global_lock(u16 timeout, u32 *handle)
 {
         acpi_status status;
 
diff --git a/drivers/acpi/acpica/evxfevnt.c b/drivers/acpi/acpica/evxfevnt.c
index e286640ad4ff..bb8cbf5961bf 100644
--- a/drivers/acpi/acpica/evxfevnt.c
+++ b/drivers/acpi/acpica/evxfevnt.c
@@ -324,8 +324,9 @@ ACPI_EXPORT_SYMBOL(acpi_clear_event)
  ******************************************************************************/
 acpi_status acpi_get_event_status(u32 event, acpi_event_status * event_status)
 {
-        acpi_status status = AE_OK;
-        u32 value;
+        acpi_status status;
+        acpi_event_status local_event_status = 0;
+        u32 in_byte;
 
         ACPI_FUNCTION_TRACE(acpi_get_event_status);
 
@@ -339,29 +340,40 @@ acpi_status acpi_get_event_status(u32 event, acpi_event_status * event_status)
                 return_ACPI_STATUS(AE_BAD_PARAMETER);
         }
 
-        /* Get the status of the requested fixed event */
+        /* Fixed event currently can be dispatched? */
+
+        if (acpi_gbl_fixed_event_handlers[event].handler) {
+                local_event_status |= ACPI_EVENT_FLAG_HAS_HANDLER;
+        }
+
+        /* Fixed event currently enabled? */
 
         status =
             acpi_read_bit_register(acpi_gbl_fixed_event_info[event].
-                              enable_register_id, &value);
-        if (ACPI_FAILURE(status))
+                                   enable_register_id, &in_byte);
+        if (ACPI_FAILURE(status)) {
                 return_ACPI_STATUS(status);
+        }
 
-        *event_status = value;
+        if (in_byte) {
+                local_event_status |= ACPI_EVENT_FLAG_ENABLED;
+        }
+
+        /* Fixed event currently active? */
 
         status =
             acpi_read_bit_register(acpi_gbl_fixed_event_info[event].
-                              status_register_id, &value);
-        if (ACPI_FAILURE(status))
+                                   status_register_id, &in_byte);
+        if (ACPI_FAILURE(status)) {
                 return_ACPI_STATUS(status);
+        }
 
-        if (value)
-                *event_status |= ACPI_EVENT_FLAG_SET;
-
-        if (acpi_gbl_fixed_event_handlers[event].handler)
-                *event_status |= ACPI_EVENT_FLAG_HANDLE;
+        if (in_byte) {
+                local_event_status |= ACPI_EVENT_FLAG_SET;
+        }
 
-        return_ACPI_STATUS(status);
+        (*event_status) = local_event_status;
+        return_ACPI_STATUS(AE_OK);
 }
 
 ACPI_EXPORT_SYMBOL(acpi_get_event_status)
diff --git a/drivers/acpi/acpica/evxfgpe.c b/drivers/acpi/acpica/evxfgpe.c
index 56710a03c9b0..e889a5304abd 100644
--- a/drivers/acpi/acpica/evxfgpe.c
+++ b/drivers/acpi/acpica/evxfgpe.c
@@ -106,8 +106,8 @@ ACPI_EXPORT_SYMBOL(acpi_update_all_gpes)
  *
  * FUNCTION:    acpi_enable_gpe
  *
- * PARAMETERS:  gpe_device      - Parent GPE Device. NULL for GPE0/GPE1
- *              gpe_number      - GPE level within the GPE block
+ * PARAMETERS:  gpe_device          - Parent GPE Device. NULL for GPE0/GPE1
+ *              gpe_number          - GPE level within the GPE block
  *
  * RETURN:      Status
  *
@@ -115,7 +115,6 @@ ACPI_EXPORT_SYMBOL(acpi_update_all_gpes)
  *              hardware-enabled.
  *
  ******************************************************************************/
-
 acpi_status acpi_enable_gpe(acpi_handle gpe_device, u32 gpe_number)
 {
         acpi_status status = AE_BAD_PARAMETER;
@@ -490,8 +489,8 @@ ACPI_EXPORT_SYMBOL(acpi_clear_gpe)
  *
  * FUNCTION:    acpi_get_gpe_status
  *
- * PARAMETERS:  gpe_device      - Parent GPE Device. NULL for GPE0/GPE1
- *              gpe_number      - GPE level within the GPE block
+ * PARAMETERS:  gpe_device          - Parent GPE Device. NULL for GPE0/GPE1
+ *              gpe_number          - GPE level within the GPE block
  *              event_status        - Where the current status of the event
  *                                    will be returned
  *
@@ -524,9 +523,6 @@ acpi_get_gpe_status(acpi_handle gpe_device,
 
         status = acpi_hw_get_gpe_status(gpe_event_info, event_status);
 
-        if (gpe_event_info->flags & ACPI_GPE_DISPATCH_MASK)
-                *event_status |= ACPI_EVENT_FLAG_HANDLE;
-
 unlock_and_exit:
         acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
         return_ACPI_STATUS(status);
diff --git a/drivers/acpi/acpica/hwgpe.c b/drivers/acpi/acpica/hwgpe.c
index ea62d40fd161..48ac7b7b59cd 100644
--- a/drivers/acpi/acpica/hwgpe.c
+++ b/drivers/acpi/acpica/hwgpe.c
@@ -202,7 +202,7 @@ acpi_status acpi_hw_clear_gpe(struct acpi_gpe_event_info * gpe_event_info)
 
 acpi_status
 acpi_hw_get_gpe_status(struct acpi_gpe_event_info * gpe_event_info,
-                       acpi_event_status * event_status)
+                       acpi_event_status *event_status)
 {
         u32 in_byte;
         u32 register_bit;
@@ -216,6 +216,13 @@ acpi_hw_get_gpe_status(struct acpi_gpe_event_info * gpe_event_info,
                 return (AE_BAD_PARAMETER);
         }
 
+        /* GPE currently handled? */
+
+        if ((gpe_event_info->flags & ACPI_GPE_DISPATCH_MASK) !=
+            ACPI_GPE_DISPATCH_NONE) {
+                local_event_status |= ACPI_EVENT_FLAG_HAS_HANDLER;
+        }
+
         /* Get the info block for the entire GPE register */
 
         gpe_register_info = gpe_event_info->register_info;
diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
index 65ab8fed3d5e..43a54af2b548 100644
--- a/drivers/acpi/acpica/tbxfroot.c
+++ b/drivers/acpi/acpica/tbxfroot.c
@@ -50,6 +50,36 @@ ACPI_MODULE_NAME("tbxfroot")
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_tb_get_rsdp_length
+ *
+ * PARAMETERS:  rsdp                - Pointer to RSDP
+ *
+ * RETURN:      Table length
+ *
+ * DESCRIPTION: Get the length of the RSDP
+ *
+ ******************************************************************************/
+u32 acpi_tb_get_rsdp_length(struct acpi_table_rsdp *rsdp)
+{
+
+        if (!ACPI_VALIDATE_RSDP_SIG(rsdp->signature)) {
+
+                /* BAD Signature */
+
+                return (0);
+        }
+
+        /* "Length" field is available if table version >= 2 */
+
+        if (rsdp->revision >= 2) {
+                return (rsdp->length);
+        } else {
+                return (ACPI_RSDP_CHECKSUM_LENGTH);
+        }
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_tb_validate_rsdp
  *
  * PARAMETERS:  rsdp                - Pointer to unvalidated RSDP
@@ -59,7 +89,8 @@ ACPI_MODULE_NAME("tbxfroot")
  * DESCRIPTION: Validate the RSDP (ptr)
  *
  ******************************************************************************/
-acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp)
+
+acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp * rsdp)
 {
 
         /*
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index ed122e17636e..7556e7c4a055 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -290,6 +290,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3446"),
                 },
         },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "Dell Vostro 3546",
+        .matches = {
+                    DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                    DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3546"),
+                },
+        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index bea6896be122..7db193160766 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -343,6 +343,7 @@ int acpi_device_update_power(struct acpi_device *device, int *state_p)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(acpi_device_update_power);
 
 int acpi_bus_update_power(acpi_handle handle, int *state_p)
 {
@@ -710,7 +711,7 @@ int acpi_pm_device_run_wake(struct device *phys_dev, bool enable)
                 return -ENODEV;
         }
 
-        return acpi_device_wakeup(adev, enable, ACPI_STATE_S0);
+        return acpi_device_wakeup(adev, ACPI_STATE_S0, enable);
 }
 EXPORT_SYMBOL(acpi_pm_device_run_wake);
 #endif /* CONFIG_PM_RUNTIME */
@@ -877,7 +878,7 @@ int acpi_dev_suspend_late(struct device *dev)
                 return 0;
 
         target_state = acpi_target_system_state();
-        wakeup = device_may_wakeup(dev);
+        wakeup = device_may_wakeup(dev) && acpi_device_can_wakeup(adev);
         error = acpi_device_wakeup(adev, target_state, wakeup);
         if (wakeup && error)
                 return error;
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index cb6066c809ea..5f9b74b9b71f 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -126,14 +126,16 @@ static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
 static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
 static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
 static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
+static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */
 
 /* --------------------------------------------------------------------------
-                             Transaction Management
-   -------------------------------------------------------------------------- */
+ *                           Transaction Management
+ * -------------------------------------------------------------------------- */
 
 static inline u8 acpi_ec_read_status(struct acpi_ec *ec)
 {
         u8 x = inb(ec->command_addr);
+
         pr_debug("EC_SC(R) = 0x%2.2x "
                  "SCI_EVT=%d BURST=%d CMD=%d IBF=%d OBF=%d\n",
                  x,
@@ -148,6 +150,7 @@ static inline u8 acpi_ec_read_status(struct acpi_ec *ec)
 static inline u8 acpi_ec_read_data(struct acpi_ec *ec)
 {
         u8 x = inb(ec->data_addr);
+
         pr_debug("EC_DATA(R) = 0x%2.2x\n", x);
         return x;
 }
@@ -164,10 +167,32 @@ static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
         outb(data, ec->data_addr);
 }
 
+#ifdef DEBUG
+static const char *acpi_ec_cmd_string(u8 cmd)
+{
+        switch (cmd) {
+        case 0x80:
+                return "RD_EC";
+        case 0x81:
+                return "WR_EC";
+        case 0x82:
+                return "BE_EC";
+        case 0x83:
+                return "BD_EC";
+        case 0x84:
+                return "QR_EC";
+        }
+        return "UNKNOWN";
+}
+#else
+#define acpi_ec_cmd_string(cmd)         "UNDEF"
+#endif
+
 static int ec_transaction_completed(struct acpi_ec *ec)
 {
         unsigned long flags;
         int ret = 0;
+
         spin_lock_irqsave(&ec->lock, flags);
         if (ec->curr && (ec->curr->flags & ACPI_EC_COMMAND_COMPLETE))
                 ret = 1;
@@ -181,7 +206,8 @@ static bool advance_transaction(struct acpi_ec *ec)
         u8 status;
         bool wakeup = false;
 
-        pr_debug("===== %s =====\n", in_interrupt() ? "IRQ" : "TASK");
+        pr_debug("===== %s (%d) =====\n",
+                 in_interrupt() ? "IRQ" : "TASK", smp_processor_id());
         status = acpi_ec_read_status(ec);
         t = ec->curr;
         if (!t)
@@ -198,7 +224,8 @@ static bool advance_transaction(struct acpi_ec *ec)
                                 if (t->rlen == t->ri) {
                                         t->flags |= ACPI_EC_COMMAND_COMPLETE;
                                         if (t->command == ACPI_EC_COMMAND_QUERY)
-                                                pr_debug("hardware QR_EC completion\n");
+                                                pr_debug("***** Command(%s) hardware completion *****\n",
+                                                         acpi_ec_cmd_string(t->command));
                                         wakeup = true;
                                 }
                         } else
@@ -210,18 +237,14 @@ static bool advance_transaction(struct acpi_ec *ec)
                 }
                 return wakeup;
         } else {
-                /*
-                 * There is firmware refusing to respond QR_EC when SCI_EVT
-                 * is not set, for which case, we complete the QR_EC
-                 * without issuing it to the firmware.
-                 * https://bugzilla.kernel.org/show_bug.cgi?id=86211
-                 */
-                if (!(status & ACPI_EC_FLAG_SCI) &&
+                if (EC_FLAGS_QUERY_HANDSHAKE &&
+                    !(status & ACPI_EC_FLAG_SCI) &&
                     (t->command == ACPI_EC_COMMAND_QUERY)) {
                         t->flags |= ACPI_EC_COMMAND_POLL;
                         t->rdata[t->ri++] = 0x00;
                         t->flags |= ACPI_EC_COMMAND_COMPLETE;
-                        pr_debug("software QR_EC completion\n");
+                        pr_debug("***** Command(%s) software completion *****\n",
+                                 acpi_ec_cmd_string(t->command));
                         wakeup = true;
                 } else if ((status & ACPI_EC_FLAG_IBF) == 0) {
                         acpi_ec_write_cmd(ec, t->command);
@@ -264,6 +287,7 @@ static int ec_poll(struct acpi_ec *ec)
 {
         unsigned long flags;
         int repeat = 5; /* number of command restarts */
+
         while (repeat--) {
                 unsigned long delay = jiffies +
                         msecs_to_jiffies(ec_delay);
@@ -296,18 +320,25 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
 {
         unsigned long tmp;
         int ret = 0;
+
         if (EC_FLAGS_MSI)
                 udelay(ACPI_EC_MSI_UDELAY);
         /* start transaction */
         spin_lock_irqsave(&ec->lock, tmp);
         /* following two actions should be kept atomic */
         ec->curr = t;
+        pr_debug("***** Command(%s) started *****\n",
+                 acpi_ec_cmd_string(t->command));
         start_transaction(ec);
+        if (ec->curr->command == ACPI_EC_COMMAND_QUERY) {
+                clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+                pr_debug("***** Event stopped *****\n");
+        }
         spin_unlock_irqrestore(&ec->lock, tmp);
         ret = ec_poll(ec);
         spin_lock_irqsave(&ec->lock, tmp);
-        if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
-                clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
+        pr_debug("***** Command(%s) stopped *****\n",
+                 acpi_ec_cmd_string(t->command));
         ec->curr = NULL;
         spin_unlock_irqrestore(&ec->lock, tmp);
         return ret;
@@ -317,6 +348,7 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
 {
         int status;
         u32 glk;
+
         if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))
                 return -EINVAL;
         if (t->rdata)
@@ -333,8 +365,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
                         goto unlock;
                 }
         }
-        pr_debug("transaction start (cmd=0x%02x, addr=0x%02x)\n",
-                        t->command, t->wdata ? t->wdata[0] : 0);
         /* disable GPE during transaction if storm is detected */
         if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
                 /* It has to be disabled, so that it doesn't trigger. */
@@ -355,7 +385,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
                         t->irq_count);
                 set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
         }
-        pr_debug("transaction end\n");
         if (ec->global_lock)
                 acpi_release_global_lock(glk);
 unlock:
@@ -383,7 +412,7 @@ static int acpi_ec_burst_disable(struct acpi_ec *ec)
                                 acpi_ec_transaction(ec, &t) : 0;
 }
 
-static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 * data)
+static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)
 {
         int result;
         u8 d;
@@ -419,10 +448,9 @@ int ec_read(u8 addr, u8 *val)
         if (!err) {
                 *val = temp_data;
                 return 0;
-        } else
-                return err;
+        }
+        return err;
 }
-
 EXPORT_SYMBOL(ec_read);
 
 int ec_write(u8 addr, u8 val)
@@ -436,22 +464,21 @@ int ec_write(u8 addr, u8 val)
 
         return err;
 }
-
 EXPORT_SYMBOL(ec_write);
 
 int ec_transaction(u8 command,
-                   const u8 * wdata, unsigned wdata_len,
-                   u8 * rdata, unsigned rdata_len)
+                   const u8 *wdata, unsigned wdata_len,
+                   u8 *rdata, unsigned rdata_len)
 {
         struct transaction t = {.command = command,
                                 .wdata = wdata, .rdata = rdata,
                                 .wlen = wdata_len, .rlen = rdata_len};
+
         if (!first_ec)
                 return -ENODEV;
 
         return acpi_ec_transaction(first_ec, &t);
 }
-
 EXPORT_SYMBOL(ec_transaction);
 
 /* Get the handle to the EC device */
@@ -461,7 +488,6 @@ acpi_handle ec_get_handle(void)
                 return NULL;
         return first_ec->handle;
 }
-
 EXPORT_SYMBOL(ec_get_handle);
 
 /*
@@ -525,13 +551,14 @@ void acpi_ec_unblock_transactions_early(void)
                 clear_bit(EC_FLAGS_BLOCKED, &first_ec->flags);
 }
 
-static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 * data)
+static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 *data)
 {
         int result;
         u8 d;
         struct transaction t = {.command = ACPI_EC_COMMAND_QUERY,
                                 .wdata = NULL, .rdata = &d,
                                 .wlen = 0, .rlen = 1};
+
         if (!ec || !data)
                 return -EINVAL;
         /*
@@ -557,6 +584,7 @@ int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
 {
         struct acpi_ec_query_handler *handler =
             kzalloc(sizeof(struct acpi_ec_query_handler), GFP_KERNEL);
+
         if (!handler)
                 return -ENOMEM;
 
@@ -569,12 +597,12 @@ int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
         mutex_unlock(&ec->mutex);
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(acpi_ec_add_query_handler);
 
 void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit)
 {
         struct acpi_ec_query_handler *handler, *tmp;
+
         mutex_lock(&ec->mutex);
         list_for_each_entry_safe(handler, tmp, &ec->list, node) {
                 if (query_bit == handler->query_bit) {
@@ -584,20 +612,20 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit)
         }
         mutex_unlock(&ec->mutex);
 }
-
 EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler);
 
 static void acpi_ec_run(void *cxt)
 {
         struct acpi_ec_query_handler *handler = cxt;
+
         if (!handler)
                 return;
-        pr_debug("start query execution\n");
+        pr_debug("##### Query(0x%02x) started #####\n", handler->query_bit);
         if (handler->func)
                 handler->func(handler->data);
         else if (handler->handle)
                 acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
-        pr_debug("stop query execution\n");
+        pr_debug("##### Query(0x%02x) stopped #####\n", handler->query_bit);
         kfree(handler);
 }
 
@@ -620,8 +648,8 @@ static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data)
                         if (!copy)
                                 return -ENOMEM;
                         memcpy(copy, handler, sizeof(*copy));
-                        pr_debug("push query execution (0x%2x) on queue\n",
-                                value);
+                        pr_debug("##### Query(0x%02x) scheduled #####\n",
+                                 handler->query_bit);
                         return acpi_os_execute((copy->func) ?
                                 OSL_NOTIFY_HANDLER : OSL_GPE_HANDLER,
                                 acpi_ec_run, copy);
@@ -633,6 +661,7 @@ static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data)
 static void acpi_ec_gpe_query(void *ec_cxt)
 {
         struct acpi_ec *ec = ec_cxt;
+
         if (!ec)
                 return;
         mutex_lock(&ec->mutex);
@@ -644,7 +673,7 @@ static int ec_check_sci(struct acpi_ec *ec, u8 state)
 {
         if (state & ACPI_EC_FLAG_SCI) {
                 if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags)) {
-                        pr_debug("push gpe query to the queue\n");
+                        pr_debug("***** Event started *****\n");
                         return acpi_os_execute(OSL_NOTIFY_HANDLER,
                                 acpi_ec_gpe_query, ec);
                 }
@@ -667,8 +696,8 @@ static u32 acpi_ec_gpe_handler(acpi_handle gpe_device,
 }
 
 /* --------------------------------------------------------------------------
-                             Address Space Management
-   -------------------------------------------------------------------------- */
+ *                           Address Space Management
+ * -------------------------------------------------------------------------- */
 
 static acpi_status
 acpi_ec_space_handler(u32 function, acpi_physical_address address,
@@ -699,27 +728,26 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,
         switch (result) {
         case -EINVAL:
                 return AE_BAD_PARAMETER;
-                break;
         case -ENODEV:
                 return AE_NOT_FOUND;
-                break;
         case -ETIME:
                 return AE_TIME;
-                break;
         default:
                 return AE_OK;
         }
 }
 
 /* --------------------------------------------------------------------------
-                               Driver Interface
-   -------------------------------------------------------------------------- */
+ *                             Driver Interface
+ * -------------------------------------------------------------------------- */
+
 static acpi_status
 ec_parse_io_ports(struct acpi_resource *resource, void *context);
 
 static struct acpi_ec *make_acpi_ec(void)
 {
         struct acpi_ec *ec = kzalloc(sizeof(struct acpi_ec), GFP_KERNEL);
+
         if (!ec)
                 return NULL;
         ec->flags = 1 << EC_FLAGS_QUERY_PENDING;
@@ -742,9 +770,8 @@ acpi_ec_register_query_methods(acpi_handle handle, u32 level,
 
         status = acpi_get_name(handle, ACPI_SINGLE_NAME, &buffer);
 
-        if (ACPI_SUCCESS(status) && sscanf(node_name, "_Q%x", &value) == 1) {
+        if (ACPI_SUCCESS(status) && sscanf(node_name, "_Q%x", &value) == 1)
                 acpi_ec_add_query_handler(ec, value, handle, NULL, NULL);
-        }
         return AE_OK;
 }
 
@@ -753,7 +780,6 @@ ec_parse_device(acpi_handle handle, u32 Level, void *context, void **retval)
 {
         acpi_status status;
         unsigned long long tmp = 0;
-
         struct acpi_ec *ec = context;
 
         /* clear addr values, ec_parse_io_ports depend on it */
@@ -781,6 +807,7 @@ ec_parse_device(acpi_handle handle, u32 Level, void *context, void **retval)
 static int ec_install_handlers(struct acpi_ec *ec)
 {
         acpi_status status;
+
         if (test_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags))
                 return 0;
         status = acpi_install_gpe_handler(NULL, ec->gpe,
@@ -981,6 +1008,18 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
 }
 
 /*
+ * Acer EC firmware refuses to respond QR_EC when SCI_EVT is not set, for
+ * which case, we complete the QR_EC without issuing it to the firmware.
+ * https://bugzilla.kernel.org/show_bug.cgi?id=86211
+ */
+static int ec_flag_query_handshake(const struct dmi_system_id *id)
+{
+        pr_debug("Detected the EC firmware requiring QR_EC issued when SCI_EVT set\n");
+        EC_FLAGS_QUERY_HANDSHAKE = 1;
+        return 0;
+}
+
+/*
  * On some hardware it is necessary to clear events accumulated by the EC during
  * sleep. These ECs stop reporting GPEs until they are manually polled, if too
  * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
@@ -1054,6 +1093,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
         {
         ec_clear_on_resume, "Samsung hardware", {
         DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
+        {
+        ec_flag_query_handshake, "Acer hardware", {
+        DMI_MATCH(DMI_SYS_VENDOR, "Acer"), }, NULL},
         {},
 };
 
@@ -1078,7 +1120,8 @@ int __init acpi_ec_ecdt_probe(void)
                 boot_ec->data_addr = ecdt_ptr->data.address;
                 boot_ec->gpe = ecdt_ptr->gpe;
                 boot_ec->handle = ACPI_ROOT_OBJECT;
-                acpi_get_handle(ACPI_ROOT_OBJECT, ecdt_ptr->id, &boot_ec->handle);
+                acpi_get_handle(ACPI_ROOT_OBJECT, ecdt_ptr->id,
+                                &boot_ec->handle);
                 /* Don't trust ECDT, which comes from ASUSTek */
                 if (!EC_FLAGS_VALIDATE_ECDT)
                         goto install;
@@ -1162,6 +1205,5 @@ static void __exit acpi_ec_exit(void)
 {
 
         acpi_bus_unregister_driver(&acpi_ec_driver);
-        return;
 }
 #endif  /* 0 */
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 5328b1090e08..caf9b76b7ef8 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -30,22 +30,19 @@
 #include <linux/uaccess.h>
 #include <linux/thermal.h>
 #include <linux/acpi.h>
-
-#define ACPI_FAN_CLASS                  "fan"
-#define ACPI_FAN_FILE_STATE             "state"
-
-#define _COMPONENT              ACPI_FAN_COMPONENT
-ACPI_MODULE_NAME("fan");
+#include <linux/platform_device.h>
+#include <linux/sort.h>
 
 MODULE_AUTHOR("Paul Diefenbaugh");
 MODULE_DESCRIPTION("ACPI Fan Driver");
 MODULE_LICENSE("GPL");
 
-static int acpi_fan_add(struct acpi_device *device);
-static int acpi_fan_remove(struct acpi_device *device);
+static int acpi_fan_probe(struct platform_device *pdev);
+static int acpi_fan_remove(struct platform_device *pdev);
 
 static const struct acpi_device_id fan_device_ids[] = {
         {"PNP0C0B", 0},
+        {"INT3404", 0},
         {"", 0},
 };
 MODULE_DEVICE_TABLE(acpi, fan_device_ids);
@@ -64,37 +61,100 @@ static struct dev_pm_ops acpi_fan_pm = {
 #define FAN_PM_OPS_PTR NULL
 #endif
 
-static struct acpi_driver acpi_fan_driver = {
-        .name = "fan",
-        .class = ACPI_FAN_CLASS,
-        .ids = fan_device_ids,
-        .ops = {
-                .add = acpi_fan_add,
-                .remove = acpi_fan_remove,
-                },
-        .drv.pm = FAN_PM_OPS_PTR,
+struct acpi_fan_fps {
+        u64 control;
+        u64 trip_point;
+        u64 speed;
+        u64 noise_level;
+        u64 power;
+};
+
+struct acpi_fan_fif {
+        u64 revision;
+        u64 fine_grain_ctrl;
+        u64 step_size;
+        u64 low_speed_notification;
+};
+
+struct acpi_fan {
+        bool acpi4;
+        struct acpi_fan_fif fif;
+        struct acpi_fan_fps *fps;
+        int fps_count;
+        struct thermal_cooling_device *cdev;
+};
+
+static struct platform_driver acpi_fan_driver = {
+        .probe = acpi_fan_probe,
+        .remove = acpi_fan_remove,
+        .driver = {
+                .name = "acpi-fan",
+                .acpi_match_table = fan_device_ids,
+                .pm = FAN_PM_OPS_PTR,
+        },
 };
 
 /* thermal cooling device callbacks */
 static int fan_get_max_state(struct thermal_cooling_device *cdev, unsigned long
                              *state)
 {
-        /* ACPI fan device only support two states: ON/OFF */
-        *state = 1;
+        struct acpi_device *device = cdev->devdata;
+        struct acpi_fan *fan = acpi_driver_data(device);
+
+        if (fan->acpi4)
+                *state = fan->fps_count - 1;
+        else
+                *state = 1;
         return 0;
 }
 
-static int fan_get_cur_state(struct thermal_cooling_device *cdev, unsigned long
-                             *state)
+static int fan_get_state_acpi4(struct acpi_device *device, unsigned long *state)
+{
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+        struct acpi_fan *fan = acpi_driver_data(device);
+        union acpi_object *obj;
+        acpi_status status;
+        int control, i;
+
+        status = acpi_evaluate_object(device->handle, "_FST", NULL, &buffer);
+        if (ACPI_FAILURE(status)) {
+                dev_err(&device->dev, "Get fan state failed\n");
+                return status;
+        }
+
+        obj = buffer.pointer;
+        if (!obj || obj->type != ACPI_TYPE_PACKAGE ||
+            obj->package.count != 3 ||
+            obj->package.elements[1].type != ACPI_TYPE_INTEGER) {
+                dev_err(&device->dev, "Invalid _FST data\n");
+                status = -EINVAL;
+                goto err;
+        }
+
+        control = obj->package.elements[1].integer.value;
+        for (i = 0; i < fan->fps_count; i++) {
+                if (control == fan->fps[i].control)
+                        break;
+        }
+        if (i == fan->fps_count) {
+                dev_dbg(&device->dev, "Invalid control value returned\n");
+                status = -EINVAL;
+                goto err;
+        }
+
+        *state = i;
+
+err:
+        kfree(obj);
+        return status;
+}
+
+static int fan_get_state(struct acpi_device *device, unsigned long *state)
 {
-        struct acpi_device *device = cdev->devdata;
         int result;
         int acpi_state = ACPI_STATE_D0;
 
-        if (!device)
-                return -EINVAL;
-
-        result = acpi_bus_update_power(device->handle, &acpi_state);
+        result = acpi_device_update_power(device, &acpi_state);
         if (result)
                 return result;
 
@@ -103,21 +163,57 @@ static int fan_get_cur_state(struct thermal_cooling_device *cdev, unsigned long
         return 0;
 }
 
-static int
-fan_set_cur_state(struct thermal_cooling_device *cdev, unsigned long state)
+static int fan_get_cur_state(struct thermal_cooling_device *cdev, unsigned long
+                             *state)
 {
         struct acpi_device *device = cdev->devdata;
-        int result;
+        struct acpi_fan *fan = acpi_driver_data(device);
 
-        if (!device || (state != 0 && state != 1))
+        if (fan->acpi4)
+                return fan_get_state_acpi4(device, state);
+        else
+                return fan_get_state(device, state);
+}
+
+static int fan_set_state(struct acpi_device *device, unsigned long state)
+{
+        if (state != 0 && state != 1)
                 return -EINVAL;
 
-        result = acpi_bus_set_power(device->handle,
-                                state ? ACPI_STATE_D0 : ACPI_STATE_D3_COLD);
+        return acpi_device_set_power(device,
+                                     state ? ACPI_STATE_D0 : ACPI_STATE_D3_COLD);
+}
 
-        return result;
+static int fan_set_state_acpi4(struct acpi_device *device, unsigned long state)
+{
+        struct acpi_fan *fan = acpi_driver_data(device);
+        acpi_status status;
+
+        if (state >= fan->fps_count)
+                return -EINVAL;
+
+        status = acpi_execute_simple_method(device->handle, "_FSL",
+                                            fan->fps[state].control);
+        if (ACPI_FAILURE(status)) {
+                dev_dbg(&device->dev, "Failed to set state by _FSL\n");
+                return status;
+        }
+
+        return 0;
 }
 
+static int
+fan_set_cur_state(struct thermal_cooling_device *cdev, unsigned long state)
+{
+        struct acpi_device *device = cdev->devdata;
+        struct acpi_fan *fan = acpi_driver_data(device);
+
+        if (fan->acpi4)
+                return fan_set_state_acpi4(device, state);
+        else
+                return fan_set_state(device, state);
+ }
+
 static const struct thermal_cooling_device_ops fan_cooling_ops = {
         .get_max_state = fan_get_max_state,
         .get_cur_state = fan_get_cur_state,
@@ -129,21 +225,125 @@ static const struct thermal_cooling_device_ops fan_cooling_ops = {
  * --------------------------------------------------------------------------
 */
 
-static int acpi_fan_add(struct acpi_device *device)
+static bool acpi_fan_is_acpi4(struct acpi_device *device)
 {
-        int result = 0;
-        struct thermal_cooling_device *cdev;
+        return acpi_has_method(device->handle, "_FIF") &&
+               acpi_has_method(device->handle, "_FPS") &&
+               acpi_has_method(device->handle, "_FSL") &&
+               acpi_has_method(device->handle, "_FST");
+}
 
-        if (!device)
-                return -EINVAL;
+static int acpi_fan_get_fif(struct acpi_device *device)
+{
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+        struct acpi_fan *fan = acpi_driver_data(device);
+        struct acpi_buffer format = { sizeof("NNNN"), "NNNN" };
+        struct acpi_buffer fif = { sizeof(fan->fif), &fan->fif };
+        union acpi_object *obj;
+        acpi_status status;
+
+        status = acpi_evaluate_object(device->handle, "_FIF", NULL, &buffer);
+        if (ACPI_FAILURE(status))
+                return status;
+
+        obj = buffer.pointer;
+        if (!obj || obj->type != ACPI_TYPE_PACKAGE) {
+                dev_err(&device->dev, "Invalid _FIF data\n");
+                status = -EINVAL;
+                goto err;
+        }
 
-        strcpy(acpi_device_name(device), "Fan");
-        strcpy(acpi_device_class(device), ACPI_FAN_CLASS);
+        status = acpi_extract_package(obj, &format, &fif);
+        if (ACPI_FAILURE(status)) {
+                dev_err(&device->dev, "Invalid _FIF element\n");
+                status = -EINVAL;
+        }
 
-        result = acpi_bus_update_power(device->handle, NULL);
-        if (result) {
-                dev_err(&device->dev, "Setting initial power state\n");
-                goto end;
+err:
+        kfree(obj);
+        return status;
+}
+
+static int acpi_fan_speed_cmp(const void *a, const void *b)
+{
+        const struct acpi_fan_fps *fps1 = a;
+        const struct acpi_fan_fps *fps2 = b;
+        return fps1->speed - fps2->speed;
+}
+
+static int acpi_fan_get_fps(struct acpi_device *device)
+{
+        struct acpi_fan *fan = acpi_driver_data(device);
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+        union acpi_object *obj;
+        acpi_status status;
+        int i;
+
+        status = acpi_evaluate_object(device->handle, "_FPS", NULL, &buffer);
+        if (ACPI_FAILURE(status))
+                return status;
+
+        obj = buffer.pointer;
+        if (!obj || obj->type != ACPI_TYPE_PACKAGE || obj->package.count < 2) {
+                dev_err(&device->dev, "Invalid _FPS data\n");
+                status = -EINVAL;
+                goto err;
+        }
+
+        fan->fps_count = obj->package.count - 1; /* minus revision field */
+        fan->fps = devm_kzalloc(&device->dev,
+                                fan->fps_count * sizeof(struct acpi_fan_fps),
+                                GFP_KERNEL);
+        if (!fan->fps) {
+                dev_err(&device->dev, "Not enough memory\n");
+                status = -ENOMEM;
+                goto err;
+        }
+        for (i = 0; i < fan->fps_count; i++) {
+                struct acpi_buffer format = { sizeof("NNNNN"), "NNNNN" };
+                struct acpi_buffer fps = { sizeof(fan->fps[i]), &fan->fps[i] };
+                status = acpi_extract_package(&obj->package.elements[i + 1],
+                                              &format, &fps);
+                if (ACPI_FAILURE(status)) {
+                        dev_err(&device->dev, "Invalid _FPS element\n");
+                        break;
+                }
+        }
+
+        /* sort the state array according to fan speed in increase order */
+        sort(fan->fps, fan->fps_count, sizeof(*fan->fps),
+             acpi_fan_speed_cmp, NULL);
+
+err:
+        kfree(obj);
+        return status;
+}
+
+static int acpi_fan_probe(struct platform_device *pdev)
+{
+        int result = 0;
+        struct thermal_cooling_device *cdev;
+        struct acpi_fan *fan;
+        struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
+
+        fan = devm_kzalloc(&pdev->dev, sizeof(*fan), GFP_KERNEL);
+        if (!fan) {
+                dev_err(&device->dev, "No memory for fan\n");
+                return -ENOMEM;
+        }
+        device->driver_data = fan;
+        platform_set_drvdata(pdev, fan);
+
+        if (acpi_fan_is_acpi4(device)) {
+                if (acpi_fan_get_fif(device) || acpi_fan_get_fps(device))
+                        goto end;
+                fan->acpi4 = true;
+        } else {
+                result = acpi_device_update_power(device, NULL);
+                if (result) {
+                        dev_err(&device->dev, "Setting initial power state\n");
+                        goto end;
+                }
         }
 
         cdev = thermal_cooling_device_register("Fan", device,
@@ -153,44 +353,32 @@ static int acpi_fan_add(struct acpi_device *device)
                 goto end;
         }
 
-        dev_dbg(&device->dev, "registered as cooling_device%d\n", cdev->id);
+        dev_dbg(&pdev->dev, "registered as cooling_device%d\n", cdev->id);
 
-        device->driver_data = cdev;
-        result = sysfs_create_link(&device->dev.kobj,
+        fan->cdev = cdev;
+        result = sysfs_create_link(&pdev->dev.kobj,
                                    &cdev->device.kobj,
                                    "thermal_cooling");
         if (result)
-                dev_err(&device->dev, "Failed to create sysfs link "
-                        "'thermal_cooling'\n");
+                dev_err(&pdev->dev, "Failed to create sysfs link 'thermal_cooling'\n");
 
         result = sysfs_create_link(&cdev->device.kobj,
-                                   &device->dev.kobj,
+                                   &pdev->dev.kobj,
                                    "device");
         if (result)
-                dev_err(&device->dev, "Failed to create sysfs link 'device'\n");
-
-        dev_info(&device->dev, "ACPI: %s [%s] (%s)\n",
-               acpi_device_name(device), acpi_device_bid(device),
-               !device->power.state ? "on" : "off");
+                dev_err(&pdev->dev, "Failed to create sysfs link 'device'\n");
 
 end:
         return result;
 }
 
-static int acpi_fan_remove(struct acpi_device *device)
+static int acpi_fan_remove(struct platform_device *pdev)
 {
-        struct thermal_cooling_device *cdev;
-
-        if (!device)
-                return -EINVAL;
-
-        cdev =  acpi_driver_data(device);
-        if (!cdev)
-                return -EINVAL;
+        struct acpi_fan *fan = platform_get_drvdata(pdev);
 
-        sysfs_remove_link(&device->dev.kobj, "thermal_cooling");
-        sysfs_remove_link(&cdev->device.kobj, "device");
-        thermal_cooling_device_unregister(cdev);
+        sysfs_remove_link(&pdev->dev.kobj, "thermal_cooling");
+        sysfs_remove_link(&fan->cdev->device.kobj, "device");
+        thermal_cooling_device_unregister(fan->cdev);
 
         return 0;
 }
@@ -198,10 +386,11 @@ static int acpi_fan_remove(struct acpi_device *device)
 #ifdef CONFIG_PM_SLEEP
 static int acpi_fan_suspend(struct device *dev)
 {
-        if (!dev)
-                return -EINVAL;
+        struct acpi_fan *fan = dev_get_drvdata(dev);
+        if (fan->acpi4)
+                return 0;
 
-        acpi_bus_set_power(to_acpi_device(dev)->handle, ACPI_STATE_D0);
+        acpi_device_set_power(ACPI_COMPANION(dev), ACPI_STATE_D0);
 
         return AE_OK;
 }
@@ -209,11 +398,12 @@ static int acpi_fan_suspend(struct device *dev)
 static int acpi_fan_resume(struct device *dev)
 {
         int result;
+        struct acpi_fan *fan = dev_get_drvdata(dev);
 
-        if (!dev)
-                return -EINVAL;
+        if (fan->acpi4)
+                return 0;
 
-        result = acpi_bus_update_power(to_acpi_device(dev)->handle, NULL);
+        result = acpi_device_update_power(ACPI_COMPANION(dev), NULL);
         if (result)
                 dev_err(dev, "Error updating fan power state\n");
 
@@ -221,4 +411,4 @@ static int acpi_fan_resume(struct device *dev)
 }
 #endif
 
-module_acpi_driver(acpi_fan_driver);
+module_platform_driver(acpi_fan_driver);
diff --git a/drivers/acpi/int340x_thermal.c b/drivers/acpi/int340x_thermal.c
new file mode 100644
index 000000000000..a27d31d1ba24
--- /dev/null
+++ b/drivers/acpi/int340x_thermal.c
@@ -0,0 +1,51 @@
+/*
+ * ACPI support for int340x thermal drivers
+ *
+ * Copyright (C) 2014, Intel Corporation
+ * Authors: Zhang Rui <rui.zhang@intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/acpi.h>
+#include <linux/module.h>
+
+#include "internal.h"
+
+#define DO_ENUMERATION 0x01
+static const struct acpi_device_id int340x_thermal_device_ids[] = {
+        {"INT3400", DO_ENUMERATION },
+        {"INT3401"},
+        {"INT3402"},
+        {"INT3403"},
+        {"INT3404"},
+        {"INT3406"},
+        {"INT3407"},
+        {"INT3408"},
+        {"INT3409"},
+        {"INT340A"},
+        {"INT340B"},
+        {""},
+};
+
+static int int340x_thermal_handler_attach(struct acpi_device *adev,
+                                        const struct acpi_device_id *id)
+{
+#if defined(CONFIG_INT340X_THERMAL) || defined(CONFIG_INT340X_THERMAL_MODULE)
+        if (id->driver_data == DO_ENUMERATION)
+                acpi_create_platform_device(adev);
+#endif
+        return 1;
+}
+
+static struct acpi_scan_handler int340x_thermal_handler = {
+        .ids = int340x_thermal_device_ids,
+        .attach = int340x_thermal_handler_attach,
+};
+
+void __init acpi_int340x_thermal_init(void)
+{
+        acpi_scan_add_handler(&int340x_thermal_handler);
+}
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 4c5cf77e7576..447f6d679b29 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -31,6 +31,7 @@ void acpi_pci_link_init(void);
 void acpi_processor_init(void);
 void acpi_platform_init(void);
 void acpi_pnp_init(void);
+void acpi_int340x_thermal_init(void);
 int acpi_sysfs_init(void);
 void acpi_container_init(void);
 void acpi_memory_hotplug_init(void);
@@ -103,8 +104,6 @@ int acpi_power_get_inferred_state(struct acpi_device *device, int *state);
 int acpi_power_on_resources(struct acpi_device *device, int state);
 int acpi_power_transition(struct acpi_device *device, int state);
 
-int acpi_device_update_power(struct acpi_device *device, int *state_p);
-
 int acpi_wakeup_device_init(void);
 
 #ifdef CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC
@@ -168,13 +167,6 @@ static inline void suspend_nvs_restore(void) {}
 #endif
 
 /*--------------------------------------------------------------------------
-                                Platform bus support
-  -------------------------------------------------------------------------- */
-struct platform_device;
-
-struct platform_device *acpi_create_platform_device(struct acpi_device *adev);
-
-/*--------------------------------------------------------------------------
                                         Video
   -------------------------------------------------------------------------- */
 #if defined(CONFIG_ACPI_VIDEO) || defined(CONFIG_ACPI_VIDEO_MODULE)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ae44d8654c82..0476e90b2091 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -142,6 +142,53 @@ static int create_modalias(struct acpi_device *acpi_dev, char *modalias,
 }
 
 /*
+ * acpi_companion_match() - Can we match via ACPI companion device
+ * @dev: Device in question
+ *
+ * Check if the given device has an ACPI companion and if that companion has
+ * a valid list of PNP IDs, and if the device is the first (primary) physical
+ * device associated with it.
+ *
+ * If multiple physical devices are attached to a single ACPI companion, we need
+ * to be careful.  The usage scenario for this kind of relationship is that all
+ * of the physical devices in question use resources provided by the ACPI
+ * companion.  A typical case is an MFD device where all the sub-devices share
+ * the parent's ACPI companion.  In such cases we can only allow the primary
+ * (first) physical device to be matched with the help of the companion's PNP
+ * IDs.
+ *
+ * Additional physical devices sharing the ACPI companion can still use
+ * resources available from it but they will be matched normally using functions
+ * provided by their bus types (and analogously for their modalias).
+ */
+static bool acpi_companion_match(const struct device *dev)
+{
+        struct acpi_device *adev;
+        bool ret;
+
+        adev = ACPI_COMPANION(dev);
+        if (!adev)
+                return false;
+
+        if (list_empty(&adev->pnp.ids))
+                return false;
+
+        mutex_lock(&adev->physical_node_lock);
+        if (list_empty(&adev->physical_node_list)) {
+                ret = false;
+        } else {
+                const struct acpi_device_physical_node *node;
+
+                node = list_first_entry(&adev->physical_node_list,
+                                        struct acpi_device_physical_node, node);
+                ret = node->dev == dev;
+        }
+        mutex_unlock(&adev->physical_node_lock);
+
+        return ret;
+}
+
+/*
  * Creates uevent modalias field for ACPI enumerated devices.
  * Because the other buses does not support ACPI HIDs & CIDs.
  * e.g. for a device with hid:IBM0001 and cid:ACPI0001 you get:
@@ -149,20 +196,14 @@ static int create_modalias(struct acpi_device *acpi_dev, char *modalias,
  */
 int acpi_device_uevent_modalias(struct device *dev, struct kobj_uevent_env *env)
 {
-        struct acpi_device *acpi_dev;
         int len;
 
-        acpi_dev = ACPI_COMPANION(dev);
-        if (!acpi_dev)
-                return -ENODEV;
-
-        /* Fall back to bus specific way of modalias exporting */
-        if (list_empty(&acpi_dev->pnp.ids))
+        if (!acpi_companion_match(dev))
                 return -ENODEV;
 
         if (add_uevent_var(env, "MODALIAS="))
                 return -ENOMEM;
-        len = create_modalias(acpi_dev, &env->buf[env->buflen - 1],
+        len = create_modalias(ACPI_COMPANION(dev), &env->buf[env->buflen - 1],
                                 sizeof(env->buf) - env->buflen);
         if (len <= 0)
                 return len;
@@ -179,18 +220,12 @@ EXPORT_SYMBOL_GPL(acpi_device_uevent_modalias);
  */
 int acpi_device_modalias(struct device *dev, char *buf, int size)
 {
-        struct acpi_device *acpi_dev;
         int len;
 
-        acpi_dev = ACPI_COMPANION(dev);
-        if (!acpi_dev)
+        if (!acpi_companion_match(dev))
                 return -ENODEV;
 
-        /* Fall back to bus specific way of modalias exporting */
-        if (list_empty(&acpi_dev->pnp.ids))
-                return -ENODEV;
-
-        len = create_modalias(acpi_dev, buf, size -1);
+        len = create_modalias(ACPI_COMPANION(dev), buf, size -1);
         if (len <= 0)
                 return len;
         buf[len++] = '\n';
@@ -853,6 +888,9 @@ const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
         if (!ids || !handle || acpi_bus_get_device(handle, &adev))
                 return NULL;
 
+        if (!acpi_companion_match(dev))
+                return NULL;
+
         return __acpi_match_device(adev, ids);
 }
 EXPORT_SYMBOL_GPL(acpi_match_device);
@@ -1470,7 +1508,7 @@ static void acpi_wakeup_gpe_init(struct acpi_device *device)
         if (ACPI_FAILURE(status))
                 return;
 
-        wakeup->flags.run_wake = !!(event_status & ACPI_EVENT_FLAG_HANDLE);
+        wakeup->flags.run_wake = !!(event_status & ACPI_EVENT_FLAG_HAS_HANDLER);
 }
 
 static void acpi_bus_get_wakeup_device_flags(struct acpi_device *device)
@@ -2315,6 +2353,7 @@ int __init acpi_scan_init(void)
         acpi_container_init();
         acpi_memory_hotplug_init();
         acpi_pnp_init();
+        acpi_int340x_thermal_init();
 
         mutex_lock(&acpi_scan_lock);
         /*
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 38cb9782d4b8..13e577c80201 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -537,7 +537,7 @@ static ssize_t counter_show(struct kobject *kobj,
         if (result)
                 goto end;
 
-        if (!(status & ACPI_EVENT_FLAG_HANDLE))
+        if (!(status & ACPI_EVENT_FLAG_HAS_HANDLER))
                 size += sprintf(buf + size, "   invalid");
         else if (status & ACPI_EVENT_FLAG_ENABLED)
                 size += sprintf(buf + size, "   enabled");
@@ -581,7 +581,7 @@ static ssize_t counter_set(struct kobject *kobj,
         if (result)
                 goto end;
 
-        if (!(status & ACPI_EVENT_FLAG_HANDLE)) {
+        if (!(status & ACPI_EVENT_FLAG_HAS_HANDLER)) {
                 printk(KERN_WARNING PREFIX
                        "Can not change Invalid GPE/Fixed Event status\n");
                 return -EINVAL;
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 112817e963e0..d24fa1964eb8 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -528,7 +528,6 @@ static void acpi_thermal_check(void *data)
 }
 
 /* sys I/F for generic thermal sysfs support */
-#define KELVIN_TO_MILLICELSIUS(t, off) (((t) - (off)) * 100)
 
 static int thermal_get_temp(struct thermal_zone_device *thermal,
                             unsigned long *temp)
@@ -543,7 +542,8 @@ static int thermal_get_temp(struct thermal_zone_device *thermal,
         if (result)
                 return result;
 
-        *temp = KELVIN_TO_MILLICELSIUS(tz->temperature, tz->kelvin_offset);
+        *temp = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(tz->temperature,
+                                                        tz->kelvin_offset);
         return 0;
 }
 
@@ -647,7 +647,7 @@ static int thermal_get_trip_temp(struct thermal_zone_device *thermal,
 
         if (tz->trips.critical.flags.valid) {
                 if (!trip) {
-                        *temp = KELVIN_TO_MILLICELSIUS(
+                        *temp = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(
                                 tz->trips.critical.temperature,
                                 tz->kelvin_offset);
                         return 0;
@@ -657,7 +657,7 @@ static int thermal_get_trip_temp(struct thermal_zone_device *thermal,
 
         if (tz->trips.hot.flags.valid) {
                 if (!trip) {
-                        *temp = KELVIN_TO_MILLICELSIUS(
+                        *temp = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(
                                 tz->trips.hot.temperature,
                                 tz->kelvin_offset);
                         return 0;
@@ -667,7 +667,7 @@ static int thermal_get_trip_temp(struct thermal_zone_device *thermal,
 
         if (tz->trips.passive.flags.valid) {
                 if (!trip) {
-                        *temp = KELVIN_TO_MILLICELSIUS(
+                        *temp = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(
                                 tz->trips.passive.temperature,
                                 tz->kelvin_offset);
                         return 0;
@@ -678,7 +678,7 @@ static int thermal_get_trip_temp(struct thermal_zone_device *thermal,
         for (i = 0; i < ACPI_THERMAL_MAX_ACTIVE &&
                 tz->trips.active[i].flags.valid; i++) {
                 if (!trip) {
-                        *temp = KELVIN_TO_MILLICELSIUS(
+                        *temp = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(
                                 tz->trips.active[i].temperature,
                                 tz->kelvin_offset);
                         return 0;
@@ -694,7 +694,7 @@ static int thermal_get_crit_temp(struct thermal_zone_device *thermal,
         struct acpi_thermal *tz = thermal->devdata;
 
         if (tz->trips.critical.flags.valid) {
-                *temperature = KELVIN_TO_MILLICELSIUS(
+                *temperature = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(
                                 tz->trips.critical.temperature,
                                 tz->kelvin_offset);
                 return 0;
@@ -714,8 +714,8 @@ static int thermal_get_trend(struct thermal_zone_device *thermal,
 
         if (type == THERMAL_TRIP_ACTIVE) {
                 unsigned long trip_temp;
-                unsigned long temp = KELVIN_TO_MILLICELSIUS(tz->temperature,
-                                                        tz->kelvin_offset);
+                unsigned long temp = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(
+                                        tz->temperature, tz->kelvin_offset);
                 if (thermal_get_trip_temp(thermal, trip, &trip_temp))
                         return -EINVAL;
 
diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index 834f35c4bf8d..371ac12d25b1 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -149,6 +149,21 @@ acpi_extract_package(union acpi_object *package,
                                 break;
                         }
                         break;
+                case ACPI_TYPE_LOCAL_REFERENCE:
+                        switch (format_string[i]) {
+                        case 'R':
+                                size_required += sizeof(void *);
+                                tail_offset += sizeof(void *);
+                                break;
+                        default:
+                                printk(KERN_WARNING PREFIX "Invalid package element"
+                                              " [%d] got reference,"
+                                              " expecting [%c]\n",
+                                              i, format_string[i]);
+                                return AE_BAD_DATA;
+                                break;
+                        }
+                        break;
 
                 case ACPI_TYPE_PACKAGE:
                 default:
@@ -247,7 +262,18 @@ acpi_extract_package(union acpi_object *package,
                                 break;
                         }
                         break;
-
+                case ACPI_TYPE_LOCAL_REFERENCE:
+                        switch (format_string[i]) {
+                        case 'R':
+                                *(void **)head =
+                                    (void *)element->reference.handle;
+                                head += sizeof(void *);
+                                break;
+                        default:
+                                /* Should never get here */
+                                break;
+                        }
+                        break;
                 case ACPI_TYPE_PACKAGE:
                         /* TBD: handle nested packages... */
                 default:
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 807a88a0f394..9d75ead2a1f9 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1164,7 +1164,8 @@ static bool acpi_video_device_in_dod(struct acpi_video_device *device)
                 return true;
 
         for (i = 0; i < video->attached_count; i++) {
-                if (video->attached_array[i].bind_info == device)
+                if ((video->attached_array[i].value.int_val & 0xfff) ==
+                    (device->device_id & 0xfff))
                         return true;
         }
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 5f039f191067..49f1e6890587 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -60,6 +60,7 @@ enum board_ids {
         /* board IDs by feature in alphabetical order */
         board_ahci,
         board_ahci_ign_iferr,
+        board_ahci_nomsi,
         board_ahci_noncq,
         board_ahci_nosntf,
         board_ahci_yes_fbs,
@@ -121,6 +122,13 @@ static const struct ata_port_info ahci_port_info[] = {
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &ahci_ops,
         },
+        [board_ahci_nomsi] = {
+                AHCI_HFLAGS     (AHCI_HFLAG_NO_MSI),
+                .flags          = AHCI_FLAG_COMMON,
+                .pio_mask       = ATA_PIO4,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &ahci_ops,
+        },
         [board_ahci_noncq] = {
                 AHCI_HFLAGS     (AHCI_HFLAG_NO_NCQ),
                 .flags          = AHCI_FLAG_COMMON,
@@ -313,6 +321,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
         { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
         { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */
+        { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
+        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -475,10 +491,11 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
 
         /*
-         * Samsung SSDs found on some macbooks.  NCQ times out.
-         * https://bugzilla.kernel.org/show_bug.cgi?id=60731
+         * Samsung SSDs found on some macbooks.  NCQ times out if MSI is
+         * enabled.  https://bugzilla.kernel.org/show_bug.cgi?id=60731
          */
-        { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq },
+        { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi },
+        { PCI_VDEVICE(SAMSUNG, 0xa800), board_ahci_nomsi },
 
         /* Enmotus */
         { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
@@ -514,12 +531,9 @@ MODULE_PARM_DESC(marvell_enable, "Marvell SATA via AHCI (1 = enabled)");
 static void ahci_pci_save_initial_config(struct pci_dev *pdev,
                                          struct ahci_host_priv *hpriv)
 {
-        unsigned int force_port_map = 0;
-        unsigned int mask_port_map = 0;
-
         if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
                 dev_info(&pdev->dev, "JMB361 has only one port\n");
-                force_port_map = 1;
+                hpriv->force_port_map = 1;
         }
 
         /*
@@ -529,9 +543,9 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
          */
         if (hpriv->flags & AHCI_HFLAG_MV_PATA) {
                 if (pdev->device == 0x6121)
-                        mask_port_map = 0x3;
+                        hpriv->mask_port_map = 0x3;
                 else
-                        mask_port_map = 0xf;
+                        hpriv->mask_port_map = 0xf;
                 dev_info(&pdev->dev,
                           "Disabling your PATA port. Use the boot option 'ahci.marvell_enable=0' to avoid this.\n");
         }
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 5eb61c9e63da..97683e45ab04 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1778,16 +1778,15 @@ static void ahci_handle_port_interrupt(struct ata_port *ap,
         }
 }
 
-static void ahci_update_intr_status(struct ata_port *ap)
+static void ahci_port_intr(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
-        struct ahci_port_priv *pp = ap->private_data;
         u32 status;
 
         status = readl(port_mmio + PORT_IRQ_STAT);
         writel(status, port_mmio + PORT_IRQ_STAT);
 
-        atomic_or(status, &pp->intr_status);
+        ahci_handle_port_interrupt(ap, port_mmio, status);
 }
 
 static irqreturn_t ahci_port_thread_fn(int irq, void *dev_instance)
@@ -1808,34 +1807,6 @@ static irqreturn_t ahci_port_thread_fn(int irq, void *dev_instance)
         return IRQ_HANDLED;
 }
 
-irqreturn_t ahci_thread_fn(int irq, void *dev_instance)
-{
-        struct ata_host *host = dev_instance;
-        struct ahci_host_priv *hpriv = host->private_data;
-        u32 irq_masked = hpriv->port_map;
-        unsigned int i;
-
-        for (i = 0; i < host->n_ports; i++) {
-                struct ata_port *ap;
-
-                if (!(irq_masked & (1 << i)))
-                        continue;
-
-                ap = host->ports[i];
-                if (ap) {
-                        ahci_port_thread_fn(irq, ap);
-                        VPRINTK("port %u\n", i);
-                } else {
-                        VPRINTK("port %u (no irq)\n", i);
-                        if (ata_ratelimit())
-                                dev_warn(host->dev,
-                                         "interrupt on disabled port %u\n", i);
-                }
-        }
-
-        return IRQ_HANDLED;
-}
-
 static irqreturn_t ahci_multi_irqs_intr(int irq, void *dev_instance)
 {
         struct ata_port *ap = dev_instance;
@@ -1875,6 +1846,8 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
 
         irq_masked = irq_stat & hpriv->port_map;
 
+        spin_lock(&host->lock);
+
         for (i = 0; i < host->n_ports; i++) {
                 struct ata_port *ap;
 
@@ -1883,7 +1856,7 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
 
                 ap = host->ports[i];
                 if (ap) {
-                        ahci_update_intr_status(ap);
+                        ahci_port_intr(ap);
                         VPRINTK("port %u\n", i);
                 } else {
                         VPRINTK("port %u (no irq)\n", i);
@@ -1906,9 +1879,11 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
          */
         writel(irq_stat, mmio + HOST_IRQ_STAT);
 
+        spin_unlock(&host->lock);
+
         VPRINTK("EXIT\n");
 
-        return handled ? IRQ_WAKE_THREAD : IRQ_NONE;
+        return IRQ_RETVAL(handled);
 }
 
 unsigned int ahci_qc_issue(struct ata_queued_cmd *qc)
@@ -2320,8 +2295,13 @@ static int ahci_port_start(struct ata_port *ap)
          */
         pp->intr_mask = DEF_PORT_IRQ;
 
-        spin_lock_init(&pp->lock);
-        ap->lock = &pp->lock;
+        /*
+         * Switch to per-port locking in case each port has its own MSI vector.
+         */
+        if ((hpriv->flags & AHCI_HFLAG_MULTI_MSI)) {
+                spin_lock_init(&pp->lock);
+                ap->lock = &pp->lock;
+        }
 
         ap->private_data = pp;
 
@@ -2482,31 +2462,6 @@ out_free_irqs:
         return rc;
 }
 
-static int ahci_host_activate_single_irq(struct ata_host *host, int irq,
-                                         struct scsi_host_template *sht)
-{
-        int i, rc;
-
-        rc = ata_host_start(host);
-        if (rc)
-                return rc;
-
-        rc = devm_request_threaded_irq(host->dev, irq, ahci_single_irq_intr,
-                                       ahci_thread_fn, IRQF_SHARED,
-                                       dev_driver_string(host->dev), host);
-        if (rc)
-                return rc;
-
-        for (i = 0; i < host->n_ports; i++)
-                ata_port_desc(host->ports[i], "irq %d", irq);
-
-        rc = ata_host_register(host, sht);
-        if (rc)
-                devm_free_irq(host->dev, irq, host);
-
-        return rc;
-}
-
 /**
  *      ahci_host_activate - start AHCI host, request IRQs and register it
  *      @host: target ATA host
@@ -2532,7 +2487,8 @@ int ahci_host_activate(struct ata_host *host, int irq,
         if (hpriv->flags & AHCI_HFLAG_MULTI_MSI)
                 rc = ahci_host_activate_multi_irqs(host, irq, sht);
         else
-                rc = ahci_host_activate_single_irq(host, irq, sht);
+                rc = ata_host_activate(host, irq, ahci_single_irq_intr,
+                                       IRQF_SHARED, sht);
         return rc;
 }
 EXPORT_SYMBOL_GPL(ahci_host_activate);
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 07bc7e4dbd04..65071591b143 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1488,7 +1488,7 @@ static int sata_fsl_probe(struct platform_device *ofdev)
         host_priv->csr_base = csr_base;
 
         irq = irq_of_parse_and_map(ofdev->dev.of_node, 0);
-        if (irq < 0) {
+        if (!irq) {
                 dev_err(&ofdev->dev, "invalid irq from platform\n");
                 goto error_exit_with_cleanup;
         }
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 61eb6d77dac7..ea1fbc1d4c5f 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -146,6 +146,7 @@
 enum sata_rcar_type {
         RCAR_GEN1_SATA,
         RCAR_GEN2_SATA,
+        RCAR_R8A7790_ES1_SATA,
 };
 
 struct sata_rcar_priv {
@@ -763,6 +764,9 @@ static void sata_rcar_setup_port(struct ata_host *host)
         ap->udma_mask   = ATA_UDMA6;
         ap->flags       |= ATA_FLAG_SATA;
 
+        if (priv->type == RCAR_R8A7790_ES1_SATA)
+                ap->flags       |= ATA_FLAG_NO_DIPM;
+
         ioaddr->cmd_addr = base + SDATA_REG;
         ioaddr->ctl_addr = base + SSDEVCON_REG;
         ioaddr->scr_addr = base + SCRSSTS_REG;
@@ -792,6 +796,7 @@ static void sata_rcar_init_controller(struct ata_host *host)
                 sata_rcar_gen1_phy_init(priv);
                 break;
         case RCAR_GEN2_SATA:
+        case RCAR_R8A7790_ES1_SATA:
                 sata_rcar_gen2_phy_init(priv);
                 break;
         default:
@@ -838,9 +843,17 @@ static struct of_device_id sata_rcar_match[] = {
                 .data = (void *)RCAR_GEN2_SATA
         },
         {
+                .compatible = "renesas,sata-r8a7790-es1",
+                .data = (void *)RCAR_R8A7790_ES1_SATA
+        },
+        {
                 .compatible = "renesas,sata-r8a7791",
                 .data = (void *)RCAR_GEN2_SATA
         },
+        {
+                .compatible = "renesas,sata-r8a7793",
+                .data = (void *)RCAR_GEN2_SATA
+        },
         { },
 };
 MODULE_DEVICE_TABLE(of, sata_rcar_match);
@@ -849,7 +862,9 @@ static const struct platform_device_id sata_rcar_id_table[] = {
         { "sata_rcar", RCAR_GEN1_SATA }, /* Deprecated by "sata-r8a7779" */
         { "sata-r8a7779", RCAR_GEN1_SATA },
         { "sata-r8a7790", RCAR_GEN2_SATA },
+        { "sata-r8a7790-es1", RCAR_R8A7790_ES1_SATA },
         { "sata-r8a7791", RCAR_GEN2_SATA },
+        { "sata-r8a7793", RCAR_GEN2_SATA },
         { },
 };
 MODULE_DEVICE_TABLE(platform, sata_rcar_id_table);
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 7652e8dc188f..21b0bc6a9c96 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1225,11 +1225,13 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
         card->config_regs = pci_iomap(dev, 0, CONFIG_RAM_SIZE);
         if (!card->config_regs) {
                 dev_warn(&dev->dev, "Failed to ioremap config registers\n");
+                err = -ENOMEM;
                 goto out_release_regions;
         }
         card->buffers = pci_iomap(dev, 1, DATA_RAM_SIZE);
         if (!card->buffers) {
                 dev_warn(&dev->dev, "Failed to ioremap data buffers\n");
+                err = -ENOMEM;
                 goto out_unmap_config;
         }
 
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 61a33f4ba608..df04227d00cf 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -171,20 +171,23 @@ config WANT_DEV_COREDUMP
           Drivers should "select" this option if they desire to use the
           device coredump mechanism.
 
-config DISABLE_DEV_COREDUMP
-        bool "Disable device coredump" if EXPERT
+config ALLOW_DEV_COREDUMP
+        bool "Allow device coredump" if EXPERT
+        default y
         help
-          Disable the device coredump mechanism despite drivers wanting to
-          use it; this allows for more sensitive systems or systems that
-          don't want to ever access the information to not have the code,
-          nor keep any data.
+          This option controls if the device coredump mechanism is available or
+          not; if disabled, the mechanism will be omitted even if drivers that
+          can use it are enabled.
+          Say 'N' for more sensitive systems or systems that don't want
+          to ever access the information to not have the code, nor keep any
+          data.
 
-          If unsure, say N.
+          If unsure, say Y.
 
 config DEV_COREDUMP
         bool
         default y if WANT_DEV_COREDUMP
-        depends on !DISABLE_DEV_COREDUMP
+        depends on ALLOW_DEV_COREDUMP
 
 config DEBUG_DRIVER
         bool "Driver Core verbose debug messages"
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 14d162952c3b..842d04707de6 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -724,12 +724,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj)
         return &dir->kobj;
 }
 
+static DEFINE_MUTEX(gdp_mutex);
 
 static struct kobject *get_device_parent(struct device *dev,
                                          struct device *parent)
 {
         if (dev->class) {
-                static DEFINE_MUTEX(gdp_mutex);
                 struct kobject *kobj = NULL;
                 struct kobject *parent_kobj;
                 struct kobject *k;
@@ -793,7 +793,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
             glue_dir->kset != &dev->class->p->glue_dirs)
                 return;
 
+        mutex_lock(&gdp_mutex);
         kobject_put(glue_dir);
+        mutex_unlock(&gdp_mutex);
 }
 
 static void cleanup_device_parent(struct device *dev)
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 473ff4892401..950fff9ce453 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -223,9 +223,10 @@ bool dma_release_from_contiguous(struct device *dev, struct page *pages,
 #undef pr_fmt
 #define pr_fmt(fmt) fmt
 
-static void rmem_cma_device_init(struct reserved_mem *rmem, struct device *dev)
+static int rmem_cma_device_init(struct reserved_mem *rmem, struct device *dev)
 {
         dev_set_cma_area(dev, rmem->priv);
+        return 0;
 }
 
 static void rmem_cma_device_release(struct reserved_mem *rmem,
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 40bc2f4072cc..fb83d4acd400 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -361,9 +361,19 @@ static int __pm_genpd_save_device(struct pm_domain_data *pdd,
         struct device *dev = pdd->dev;
         int ret = 0;
 
-        if (gpd_data->need_restore)
+        if (gpd_data->need_restore > 0)
                 return 0;
 
+        /*
+         * If the value of the need_restore flag is still unknown at this point,
+         * we trust that pm_genpd_poweroff() has verified that the device is
+         * already runtime PM suspended.
+         */
+        if (gpd_data->need_restore < 0) {
+                gpd_data->need_restore = 1;
+                return 0;
+        }
+
         mutex_unlock(&genpd->lock);
 
         genpd_start_dev(genpd, dev);
@@ -373,7 +383,7 @@ static int __pm_genpd_save_device(struct pm_domain_data *pdd,
         mutex_lock(&genpd->lock);
 
         if (!ret)
-                gpd_data->need_restore = true;
+                gpd_data->need_restore = 1;
 
         return ret;
 }
@@ -389,12 +399,17 @@ static void __pm_genpd_restore_device(struct pm_domain_data *pdd,
 {
         struct generic_pm_domain_data *gpd_data = to_gpd_data(pdd);
         struct device *dev = pdd->dev;
-        bool need_restore = gpd_data->need_restore;
+        int need_restore = gpd_data->need_restore;
 
-        gpd_data->need_restore = false;
+        gpd_data->need_restore = 0;
         mutex_unlock(&genpd->lock);
 
         genpd_start_dev(genpd, dev);
+
+        /*
+         * Call genpd_restore_dev() for recently added devices too (need_restore
+         * is negative then).
+         */
         if (need_restore)
                 genpd_restore_dev(genpd, dev);
 
@@ -603,6 +618,7 @@ static void genpd_power_off_work_fn(struct work_struct *work)
 static int pm_genpd_runtime_suspend(struct device *dev)
 {
         struct generic_pm_domain *genpd;
+        struct generic_pm_domain_data *gpd_data;
         bool (*stop_ok)(struct device *__dev);
         int ret;
 
@@ -628,6 +644,16 @@ static int pm_genpd_runtime_suspend(struct device *dev)
                 return 0;
 
         mutex_lock(&genpd->lock);
+
+        /*
+         * If we have an unknown state of the need_restore flag, it means none
+         * of the runtime PM callbacks has been invoked yet. Let's update the
+         * flag to reflect that the current state is active.
+         */
+        gpd_data = to_gpd_data(dev->power.subsys_data->domain_data);
+        if (gpd_data->need_restore < 0)
+                gpd_data->need_restore = 0;
+
         genpd->in_progress++;
         pm_genpd_poweroff(genpd);
         genpd->in_progress--;
@@ -1437,12 +1463,12 @@ int __pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
         spin_unlock_irq(&dev->power.lock);
 
         if (genpd->attach_dev)
-                genpd->attach_dev(dev);
+                genpd->attach_dev(genpd, dev);
 
         mutex_lock(&gpd_data->lock);
         gpd_data->base.dev = dev;
         list_add_tail(&gpd_data->base.list_node, &genpd->dev_list);
-        gpd_data->need_restore = genpd->status == GPD_STATE_POWER_OFF;
+        gpd_data->need_restore = -1;
         gpd_data->td.constraint_changed = true;
         gpd_data->td.effective_constraint_ns = -1;
         mutex_unlock(&gpd_data->lock);
@@ -1499,7 +1525,7 @@ int pm_genpd_remove_device(struct generic_pm_domain *genpd,
         genpd->max_off_time_changed = true;
 
         if (genpd->detach_dev)
-                genpd->detach_dev(dev);
+                genpd->detach_dev(genpd, dev);
 
         spin_lock_irq(&dev->power.lock);
 
@@ -1546,7 +1572,7 @@ void pm_genpd_dev_need_restore(struct device *dev, bool val)
 
         psd = dev_to_psd(dev);
         if (psd && psd->domain_data)
-                to_gpd_data(psd->domain_data)->need_restore = val;
+                to_gpd_data(psd->domain_data)->need_restore = val ? 1 : 0;
 
         spin_unlock_irqrestore(&dev->power.lock, flags);
 }
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 44973196d3fd..9717d5f20139 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1266,6 +1266,8 @@ int dpm_suspend_late(pm_message_t state)
         }
         mutex_unlock(&dpm_list_mtx);
         async_synchronize_full();
+        if (!error)
+                error = async_error;
         if (error) {
                 suspend_stats.failed_suspend_late++;
                 dpm_save_failed_step(SUSPEND_SUSPEND_LATE);
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index 1e5ac0a79696..cd9161a8b3a1 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -275,7 +275,7 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
 static const struct pci_device_id bcma_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4313) },
-        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },  /* 0xa8d8 */
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) },
@@ -285,7 +285,8 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
-        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) },  /* 0xA8DB */
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) },  /* 0xa8db, BCM43217 (sic!) */
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43228) },  /* 0xa8dc */
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, bcma_pci_bridge_tbl);
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index d1656c2f70af..1000955ce09d 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -132,7 +132,7 @@ static bool bcma_is_core_needed_early(u16 core_id)
         return false;
 }
 
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && defined(CONFIG_OF_ADDRESS)
 static struct device_node *bcma_of_find_child_device(struct platform_device *parent,
                                                      struct bcma_device *core)
 {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 2671a3f02f0c..8001e812018b 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -450,14 +450,10 @@ static int init_driver_queues(struct nullb *nullb)
 
                 ret = setup_commands(nq);
                 if (ret)
-                        goto err_queue;
+                        return ret;
                 nullb->nr_queues++;
         }
-
         return 0;
-err_queue:
-        cleanup_queues(nullb);
-        return ret;
 }
 
 static int null_add_dev(void)
@@ -507,7 +503,9 @@ static int null_add_dev(void)
                         goto out_cleanup_queues;
                 }
                 blk_queue_make_request(nullb->q, null_queue_bio);
-                init_driver_queues(nullb);
+                rv = init_driver_queues(nullb);
+                if (rv)
+                        goto out_cleanup_blk_queue;
         } else {
                 nullb->q = blk_init_queue_node(null_request_fn, &nullb->lock, home_node);
                 if (!nullb->q) {
@@ -516,7 +514,9 @@ static int null_add_dev(void)
                 }
                 blk_queue_prep_rq(nullb->q, null_rq_prep_fn);
                 blk_queue_softirq_done(nullb->q, null_softirq_done_fn);
-                init_driver_queues(nullb);
+                rv = init_driver_queues(nullb);
+                if (rv)
+                        goto out_cleanup_blk_queue;
         }
 
         nullb->q->queuedata = nullb;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 0a54c588e433..27b71a0b72d0 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -342,7 +342,6 @@ struct rbd_device {
 
         struct list_head        rq_queue;       /* incoming rq queue */
         spinlock_t              lock;           /* queue, flags, open_count */
-        struct workqueue_struct *rq_wq;
         struct work_struct      rq_work;
 
         struct rbd_image_header header;
@@ -402,6 +401,8 @@ static struct kmem_cache	*rbd_segment_name_cache;
 static int rbd_major;
 static DEFINE_IDA(rbd_dev_id_ida);
 
+static struct workqueue_struct *rbd_wq;
+
 /*
  * Default to false for now, as single-major requires >= 0.75 version of
  * userspace rbd utility.
@@ -3452,7 +3453,7 @@ static void rbd_request_fn(struct request_queue *q)
         }
 
         if (queued)
-                queue_work(rbd_dev->rq_wq, &rbd_dev->rq_work);
+                queue_work(rbd_wq, &rbd_dev->rq_work);
 }
 
 /*
@@ -3532,7 +3533,7 @@ static int rbd_obj_read_sync(struct rbd_device *rbd_dev,
         page_count = (u32) calc_pages_for(offset, length);
         pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
         if (IS_ERR(pages))
-                ret = PTR_ERR(pages);
+                return PTR_ERR(pages);
 
         ret = -ENOMEM;
         obj_request = rbd_obj_request_create(object_name, offset, length,
@@ -5242,16 +5243,9 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
         set_capacity(rbd_dev->disk, rbd_dev->mapping.size / SECTOR_SIZE);
         set_disk_ro(rbd_dev->disk, rbd_dev->mapping.read_only);
 
-        rbd_dev->rq_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0,
-                                         rbd_dev->disk->disk_name);
-        if (!rbd_dev->rq_wq) {
-                ret = -ENOMEM;
-                goto err_out_mapping;
-        }
-
         ret = rbd_bus_add_dev(rbd_dev);
         if (ret)
-                goto err_out_workqueue;
+                goto err_out_mapping;
 
         /* Everything's ready.  Announce the disk to the world. */
 
@@ -5263,9 +5257,6 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
 
         return ret;
 
-err_out_workqueue:
-        destroy_workqueue(rbd_dev->rq_wq);
-        rbd_dev->rq_wq = NULL;
 err_out_mapping:
         rbd_dev_mapping_clear(rbd_dev);
 err_out_disk:
@@ -5512,7 +5503,6 @@ static void rbd_dev_device_release(struct device *dev)
 {
         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
 
-        destroy_workqueue(rbd_dev->rq_wq);
         rbd_free_disk(rbd_dev);
         clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
         rbd_dev_mapping_clear(rbd_dev);
@@ -5716,11 +5706,21 @@ static int __init rbd_init(void)
         if (rc)
                 return rc;
 
+        /*
+         * The number of active work items is limited by the number of
+         * rbd devices, so leave @max_active at default.
+         */
+        rbd_wq = alloc_workqueue(RBD_DRV_NAME, WQ_MEM_RECLAIM, 0);
+        if (!rbd_wq) {
+                rc = -ENOMEM;
+                goto err_out_slab;
+        }
+
         if (single_major) {
                 rbd_major = register_blkdev(0, RBD_DRV_NAME);
                 if (rbd_major < 0) {
                         rc = rbd_major;
-                        goto err_out_slab;
+                        goto err_out_wq;
                 }
         }
 
@@ -5738,6 +5738,8 @@ static int __init rbd_init(void)
 err_out_blkdev:
         if (single_major)
                 unregister_blkdev(rbd_major, RBD_DRV_NAME);
+err_out_wq:
+        destroy_workqueue(rbd_wq);
 err_out_slab:
         rbd_slab_exit();
         return rc;
@@ -5749,6 +5751,7 @@ static void __exit rbd_exit(void)
         rbd_sysfs_cleanup();
         if (single_major)
                 unregister_blkdev(rbd_major, RBD_DRV_NAME);
+        destroy_workqueue(rbd_wq);
         rbd_slab_exit();
 }
 
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 756b8ec00f16..0ebadf93b6c5 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -69,8 +69,6 @@ struct vdc_port {
         u8                      vdisk_mtype;
 
         char                    disk_name[32];
-
-        struct vio_disk_vtoc    label;
 };
 
 static inline struct vdc_port *to_vdc_port(struct vio_driver_state *vio)
@@ -710,13 +708,6 @@ static int probe_disk(struct vdc_port *port)
         if (comp.err)
                 return comp.err;
 
-        err = generic_request(port, VD_OP_GET_VTOC,
-                              &port->label, sizeof(port->label));
-        if (err < 0) {
-                printk(KERN_ERR PFX "VD_OP_GET_VTOC returns error %d\n", err);
-                return err;
-        }
-
         if (vdc_version_supported(port, 1, 1)) {
                 /* vdisk_size should be set during the handshake, if it wasn't
                  * then the underlying disk is reserved by another system
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 0e63e8aa8279..3920ee45aa59 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -99,11 +99,12 @@ static ssize_t mem_used_total_show(struct device *dev,
 {
         u64 val = 0;
         struct zram *zram = dev_to_zram(dev);
-        struct zram_meta *meta = zram->meta;
 
         down_read(&zram->init_lock);
-        if (init_done(zram))
+        if (init_done(zram)) {
+                struct zram_meta *meta = zram->meta;
                 val = zs_get_total_pages(meta->mem_pool);
+        }
         up_read(&zram->init_lock);
 
         return scnprintf(buf, PAGE_SIZE, "%llu\n", val << PAGE_SHIFT);
@@ -173,16 +174,17 @@ static ssize_t mem_used_max_store(struct device *dev,
         int err;
         unsigned long val;
         struct zram *zram = dev_to_zram(dev);
-        struct zram_meta *meta = zram->meta;
 
         err = kstrtoul(buf, 10, &val);
         if (err || val != 0)
                 return -EINVAL;
 
         down_read(&zram->init_lock);
-        if (init_done(zram))
+        if (init_done(zram)) {
+                struct zram_meta *meta = zram->meta;
                 atomic_long_set(&zram->stats.max_used_pages,
                                 zs_get_total_pages(meta->mem_pool));
+        }
         up_read(&zram->init_lock);
 
         return len;
@@ -558,7 +560,8 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         }
 
         if (page_zero_filled(uncmem)) {
-                kunmap_atomic(user_mem);
+                if (user_mem)
+                        kunmap_atomic(user_mem);
                 /* Free memory associated with this sector now. */
                 bit_spin_lock(ZRAM_ACCESS, &meta->table[index].value);
                 zram_free_page(zram, index);
diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
index 6226aa08c36a..bcf86f91800a 100644
--- a/drivers/char/hw_random/pseries-rng.c
+++ b/drivers/char/hw_random/pseries-rng.c
@@ -25,18 +25,21 @@
 #include <asm/vio.h>
 
 
-static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
+static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
 {
+        u64 buffer[PLPAR_HCALL_BUFSIZE];
+        size_t size = max < 8 ? max : 8;
         int rc;
 
-        rc = plpar_hcall(H_RANDOM, (unsigned long *)data);
+        rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer);
         if (rc != H_SUCCESS) {
                 pr_err_ratelimited("H_RANDOM call failed %d\n", rc);
                 return -EIO;
         }
+        memcpy(data, buffer, size);
 
         /* The hypervisor interface returns 64 bits */
-        return 8;
+        return size;
 }
 
 /**
@@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)
 
 static struct hwrng pseries_rng = {
         .name           = KBUILD_MODNAME,
-        .data_read      = pseries_rng_data_read,
+        .read           = pseries_rng_read,
 };
 
 static int __init pseries_rng_probe(struct vio_dev *dev,
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 82759cef9043..04645c09fe5e 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1106,7 +1106,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
         __mix_pool_bytes(r, hash.w, sizeof(hash.w));
         spin_unlock_irqrestore(&r->lock, flags);
 
-        memset(workspace, 0, sizeof(workspace));
+        memzero_explicit(workspace, sizeof(workspace));
 
         /*
          * In case the hash function has some recognizable output
@@ -1118,7 +1118,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
         hash.w[2] ^= rol32(hash.w[2], 16);
 
         memcpy(out, &hash, EXTRACT_SIZE);
-        memset(&hash, 0, sizeof(hash));
+        memzero_explicit(&hash, sizeof(hash));
 }
 
 /*
@@ -1175,7 +1175,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
         }
 
         /* Wipe data just returned from memory */
-        memset(tmp, 0, sizeof(tmp));
+        memzero_explicit(tmp, sizeof(tmp));
 
         return ret;
 }
@@ -1218,7 +1218,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
         }
 
         /* Wipe data just returned from memory */
-        memset(tmp, 0, sizeof(tmp));
+        memzero_explicit(tmp, sizeof(tmp));
 
         return ret;
 }
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 0102dc788608..a24891b97547 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -285,7 +285,7 @@ static long raw_ctl_compat_ioctl(struct file *file, unsigned int cmd,
 
 static const struct file_operations raw_fops = {
         .read           = new_sync_read,
-        .read_iter      = generic_file_read_iter,
+        .read_iter      = blkdev_read_iter,
         .write          = new_sync_write,
         .write_iter     = blkdev_write_iter,
         .fsync          = blkdev_fsync,
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index bfa640023e64..cf7a561fad7c 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1449,8 +1449,6 @@ static int add_port(struct ports_device *portdev, u32 id)
         spin_lock_init(&port->outvq_lock);
         init_waitqueue_head(&port->waitqueue);
 
-        virtio_device_ready(portdev->vdev);
-
         /* Fill the in_vq with buffers so the host can send us data. */
         nr_added_bufs = fill_queue(port->in_vq, &port->inbuf_lock);
         if (!nr_added_bufs) {
@@ -2026,6 +2024,8 @@ static int virtcons_probe(struct virtio_device *vdev)
         spin_lock_init(&portdev->ports_lock);
         INIT_LIST_HEAD(&portdev->ports);
 
+        virtio_device_ready(portdev->vdev);
+
         if (multiport) {
                 unsigned int nr_added_bufs;
 
diff --git a/drivers/clk/at91/clk-usb.c b/drivers/clk/at91/clk-usb.c
index 24b5b020753a..a23ac0c724f0 100644
--- a/drivers/clk/at91/clk-usb.c
+++ b/drivers/clk/at91/clk-usb.c
@@ -52,29 +52,26 @@ static unsigned long at91sam9x5_clk_usb_recalc_rate(struct clk_hw *hw,
 
         tmp = pmc_read(pmc, AT91_PMC_USB);
         usbdiv = (tmp & AT91_PMC_OHCIUSBDIV) >> SAM9X5_USB_DIV_SHIFT;
-        return parent_rate / (usbdiv + 1);
+
+        return DIV_ROUND_CLOSEST(parent_rate, (usbdiv + 1));
 }
 
 static long at91sam9x5_clk_usb_round_rate(struct clk_hw *hw, unsigned long rate,
                                           unsigned long *parent_rate)
 {
         unsigned long div;
-        unsigned long bestrate;
-        unsigned long tmp;
+
+        if (!rate)
+                return -EINVAL;
 
         if (rate >= *parent_rate)
                 return *parent_rate;
 
-        div = *parent_rate / rate;
-        if (div >= SAM9X5_USB_MAX_DIV)
-                return *parent_rate / (SAM9X5_USB_MAX_DIV + 1);
-
-        bestrate = *parent_rate / div;
-        tmp = *parent_rate / (div + 1);
-        if (bestrate - rate > rate - tmp)
-                bestrate = tmp;
+        div = DIV_ROUND_CLOSEST(*parent_rate, rate);
+        if (div > SAM9X5_USB_MAX_DIV + 1)
+                div = SAM9X5_USB_MAX_DIV + 1;
 
-        return bestrate;
+        return DIV_ROUND_CLOSEST(*parent_rate, div);
 }
 
 static int at91sam9x5_clk_usb_set_parent(struct clk_hw *hw, u8 index)
@@ -106,9 +103,13 @@ static int at91sam9x5_clk_usb_set_rate(struct clk_hw *hw, unsigned long rate,
         u32 tmp;
         struct at91sam9x5_clk_usb *usb = to_at91sam9x5_clk_usb(hw);
         struct at91_pmc *pmc = usb->pmc;
-        unsigned long div = parent_rate / rate;
+        unsigned long div;
+
+        if (!rate)
+                return -EINVAL;
 
-        if (parent_rate % rate || div < 1 || div >= SAM9X5_USB_MAX_DIV)
+        div = DIV_ROUND_CLOSEST(parent_rate, rate);
+        if (div > SAM9X5_USB_MAX_DIV + 1 || !div)
                 return -EINVAL;
 
         tmp = pmc_read(pmc, AT91_PMC_USB) & ~AT91_PMC_OHCIUSBDIV;
@@ -253,7 +254,7 @@ static long at91rm9200_clk_usb_round_rate(struct clk_hw *hw, unsigned long rate,
 
                 tmp_parent_rate = rate * usb->divisors[i];
                 tmp_parent_rate = __clk_round_rate(parent, tmp_parent_rate);
-                tmprate = tmp_parent_rate / usb->divisors[i];
+                tmprate = DIV_ROUND_CLOSEST(tmp_parent_rate, usb->divisors[i]);
                 if (tmprate < rate)
                         tmpdiff = rate - tmprate;
                 else
@@ -281,10 +282,10 @@ static int at91rm9200_clk_usb_set_rate(struct clk_hw *hw, unsigned long rate,
         struct at91_pmc *pmc = usb->pmc;
         unsigned long div;
 
-        if (!rate || parent_rate % rate)
+        if (!rate)
                 return -EINVAL;
 
-        div = parent_rate / rate;
+        div = DIV_ROUND_CLOSEST(parent_rate, rate);
 
         for (i = 0; i < RM9200_USB_DIV_TAB_SIZE; i++) {
                 if (usb->divisors[i] == div) {
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index 18a9de29df0e..c0a842b335c5 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -263,6 +263,14 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
         if (!rate)
                 rate = 1;
 
+        /* if read only, just return current value */
+        if (divider->flags & CLK_DIVIDER_READ_ONLY) {
+                bestdiv = readl(divider->reg) >> divider->shift;
+                bestdiv &= div_mask(divider);
+                bestdiv = _get_div(divider, bestdiv);
+                return bestdiv;
+        }
+
         maxdiv = _get_maxdiv(divider);
 
         if (!(__clk_get_flags(hw->clk) & CLK_SET_RATE_PARENT)) {
@@ -361,11 +369,6 @@ const struct clk_ops clk_divider_ops = {
 };
 EXPORT_SYMBOL_GPL(clk_divider_ops);
 
-const struct clk_ops clk_divider_ro_ops = {
-        .recalc_rate = clk_divider_recalc_rate,
-};
-EXPORT_SYMBOL_GPL(clk_divider_ro_ops);
-
 static struct clk *_register_divider(struct device *dev, const char *name,
                 const char *parent_name, unsigned long flags,
                 void __iomem *reg, u8 shift, u8 width,
@@ -391,10 +394,7 @@ static struct clk *_register_divider(struct device *dev, const char *name,
         }
 
         init.name = name;
-        if (clk_divider_flags & CLK_DIVIDER_READ_ONLY)
-                init.ops = &clk_divider_ro_ops;
-        else
-                init.ops = &clk_divider_ops;
+        init.ops = &clk_divider_ops;
         init.flags = flags | CLK_IS_BASIC;
         init.parent_names = (parent_name ? &parent_name: NULL);
         init.num_parents = (parent_name ? 1 : 0);
diff --git a/drivers/clk/pxa/clk-pxa27x.c b/drivers/clk/pxa/clk-pxa27x.c
index b345cc791e5d..88b9fe13fa44 100644
--- a/drivers/clk/pxa/clk-pxa27x.c
+++ b/drivers/clk/pxa/clk-pxa27x.c
@@ -322,7 +322,7 @@ static unsigned long clk_pxa27x_memory_get_rate(struct clk_hw *hw,
         unsigned long ccsr = CCSR;
 
         osc_forced = ccsr & (1 << CCCR_CPDIS_BIT);
-        a = cccr & CCCR_A_BIT;
+        a = cccr & (1 << CCCR_A_BIT);
         l  = ccsr & CCSR_L_MASK;
 
         if (osc_forced || a)
@@ -341,7 +341,7 @@ static u8 clk_pxa27x_memory_get_parent(struct clk_hw *hw)
         unsigned long ccsr = CCSR;
 
         osc_forced = ccsr & (1 << CCCR_CPDIS_BIT);
-        a = cccr & CCCR_A_BIT;
+        a = cccr & (1 << CCCR_A_BIT);
         if (osc_forced)
                 return PXA_MEM_13Mhz;
         if (a)
diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c
index dab988ab8cf1..157139a5c1ca 100644
--- a/drivers/clk/qcom/mmcc-apq8084.c
+++ b/drivers/clk/qcom/mmcc-apq8084.c
@@ -3122,7 +3122,7 @@ static struct clk_regmap *mmcc_apq8084_clocks[] = {
         [ESC1_CLK_SRC] = &esc1_clk_src.clkr,
         [HDMI_CLK_SRC] = &hdmi_clk_src.clkr,
         [VSYNC_CLK_SRC] = &vsync_clk_src.clkr,
-        [RBCPR_CLK_SRC] = &rbcpr_clk_src.clkr,
+        [MMSS_RBCPR_CLK_SRC] = &rbcpr_clk_src.clkr,
         [RBBMTIMER_CLK_SRC] = &rbbmtimer_clk_src.clkr,
         [MAPLE_CLK_SRC] = &maple_clk_src.clkr,
         [VDP_CLK_SRC] = &vdp_clk_src.clkr,
diff --git a/drivers/clk/rockchip/clk.c b/drivers/clk/rockchip/clk.c
index 1e68bff481b8..880a266f0143 100644
--- a/drivers/clk/rockchip/clk.c
+++ b/drivers/clk/rockchip/clk.c
@@ -90,9 +90,7 @@ static struct clk *rockchip_clk_register_branch(const char *name,
                 div->width = div_width;
                 div->lock = lock;
                 div->table = div_table;
-                div_ops = (div_flags & CLK_DIVIDER_READ_ONLY)
-                                                ? &clk_divider_ro_ops
-                                                : &clk_divider_ops;
+                div_ops = &clk_divider_ops;
         }
 
         clk = clk_register_composite(NULL, name, parent_names, num_parents,
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 2133f9d59d06..43005d4d3348 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -660,11 +660,11 @@ static bool __init
 arch_timer_probed(int type, const struct of_device_id *matches)
 {
         struct device_node *dn;
-        bool probed = false;
+        bool probed = true;
 
         dn = of_find_matching_node(NULL, matches);
-        if (dn && of_device_is_available(dn) && (arch_timers_present & type))
-                probed = true;
+        if (dn && of_device_is_available(dn) && !(arch_timers_present & type))
+                probed = false;
         of_node_put(dn);
 
         return probed;
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index efb17c3ee120..f4a9c0058b4d 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -182,6 +182,12 @@ static void __init sun4i_timer_init(struct device_node *node)
         /* Make sure timer is stopped before playing with interrupts */
         sun4i_clkevt_time_stop(0);
 
+        sun4i_clockevent.cpumask = cpu_possible_mask;
+        sun4i_clockevent.irq = irq;
+
+        clockevents_config_and_register(&sun4i_clockevent, rate,
+                                        TIMER_SYNC_TICKS, 0xffffffff);
+
         ret = setup_irq(irq, &sun4i_timer_irq);
         if (ret)
                 pr_warn("failed to setup irq %d\n", irq);
@@ -189,12 +195,6 @@ static void __init sun4i_timer_init(struct device_node *node)
         /* Enable timer0 interrupt */
         val = readl(timer_base + TIMER_IRQ_EN_REG);
         writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
-
-        sun4i_clockevent.cpumask = cpu_possible_mask;
-        sun4i_clockevent.irq = irq;
-
-        clockevents_config_and_register(&sun4i_clockevent, rate,
-                                        TIMER_SYNC_TICKS, 0xffffffff);
 }
 CLOCKSOURCE_OF_DECLARE(sun4i, "allwinner,sun4i-a10-timer",
                        sun4i_timer_init);
diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
index 6bbb8b913446..f657c571b18e 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
@@ -18,6 +18,7 @@
 #include <linux/cpu.h>
 #include <linux/cpu_cooling.h>
 #include <linux/cpufreq.h>
+#include <linux/cpufreq-dt.h>
 #include <linux/cpumask.h>
 #include <linux/err.h>
 #include <linux/module.h>
@@ -146,8 +147,8 @@ try_again:
                         goto try_again;
                 }
 
-                dev_warn(cpu_dev, "failed to get cpu%d regulator: %ld\n",
-                         cpu, PTR_ERR(cpu_reg));
+                dev_dbg(cpu_dev, "no regulator for cpu%d: %ld\n",
+                        cpu, PTR_ERR(cpu_reg));
         }
 
         cpu_clk = clk_get(cpu_dev, NULL);
@@ -165,8 +166,8 @@ try_again:
                 if (ret == -EPROBE_DEFER)
                         dev_dbg(cpu_dev, "cpu%d clock not ready, retry\n", cpu);
                 else
-                        dev_err(cpu_dev, "failed to get cpu%d clock: %d\n", ret,
-                                cpu);
+                        dev_err(cpu_dev, "failed to get cpu%d clock: %d\n", cpu,
+                                ret);
         } else {
                 *cdev = cpu_dev;
                 *creg = cpu_reg;
@@ -178,6 +179,7 @@ try_again:
 
 static int cpufreq_init(struct cpufreq_policy *policy)
 {
+        struct cpufreq_dt_platform_data *pd;
         struct cpufreq_frequency_table *freq_table;
         struct thermal_cooling_device *cdev;
         struct device_node *np;
@@ -185,6 +187,7 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         struct device *cpu_dev;
         struct regulator *cpu_reg;
         struct clk *cpu_clk;
+        unsigned long min_uV = ~0, max_uV = 0;
         unsigned int transition_latency;
         int ret;
 
@@ -204,16 +207,10 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         /* OPPs might be populated at runtime, don't check for error here */
         of_init_opp_table(cpu_dev);
 
-        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
-        if (ret) {
-                dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
-                goto out_put_node;
-        }
-
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv) {
                 ret = -ENOMEM;
-                goto out_free_table;
+                goto out_put_node;
         }
 
         of_property_read_u32(np, "voltage-tolerance", &priv->voltage_tolerance);
@@ -222,30 +219,51 @@ static int cpufreq_init(struct cpufreq_policy *policy)
                 transition_latency = CPUFREQ_ETERNAL;
 
         if (!IS_ERR(cpu_reg)) {
-                struct dev_pm_opp *opp;
-                unsigned long min_uV, max_uV;
-                int i;
+                unsigned long opp_freq = 0;
 
                 /*
-                 * OPP is maintained in order of increasing frequency, and
-                 * freq_table initialised from OPP is therefore sorted in the
-                 * same order.
+                 * Disable any OPPs where the connected regulator isn't able to
+                 * provide the specified voltage and record minimum and maximum
+                 * voltage levels.
                  */
-                for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++)
-                        ;
-                rcu_read_lock();
-                opp = dev_pm_opp_find_freq_exact(cpu_dev,
-                                freq_table[0].frequency * 1000, true);
-                min_uV = dev_pm_opp_get_voltage(opp);
-                opp = dev_pm_opp_find_freq_exact(cpu_dev,
-                                freq_table[i-1].frequency * 1000, true);
-                max_uV = dev_pm_opp_get_voltage(opp);
-                rcu_read_unlock();
+                while (1) {
+                        struct dev_pm_opp *opp;
+                        unsigned long opp_uV, tol_uV;
+
+                        rcu_read_lock();
+                        opp = dev_pm_opp_find_freq_ceil(cpu_dev, &opp_freq);
+                        if (IS_ERR(opp)) {
+                                rcu_read_unlock();
+                                break;
+                        }
+                        opp_uV = dev_pm_opp_get_voltage(opp);
+                        rcu_read_unlock();
+
+                        tol_uV = opp_uV * priv->voltage_tolerance / 100;
+                        if (regulator_is_supported_voltage(cpu_reg, opp_uV,
+                                                           opp_uV + tol_uV)) {
+                                if (opp_uV < min_uV)
+                                        min_uV = opp_uV;
+                                if (opp_uV > max_uV)
+                                        max_uV = opp_uV;
+                        } else {
+                                dev_pm_opp_disable(cpu_dev, opp_freq);
+                        }
+
+                        opp_freq++;
+                }
+
                 ret = regulator_set_voltage_time(cpu_reg, min_uV, max_uV);
                 if (ret > 0)
                         transition_latency += ret * 1000;
         }
 
+        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
+        if (ret) {
+                pr_err("failed to init cpufreq table: %d\n", ret);
+                goto out_free_priv;
+        }
+
         /*
          * For now, just loading the cooling device;
          * thermal DT code takes care of matching them.
@@ -265,9 +283,18 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         policy->driver_data = priv;
 
         policy->clk = cpu_clk;
-        ret = cpufreq_generic_init(policy, freq_table, transition_latency);
-        if (ret)
+        ret = cpufreq_table_validate_and_show(policy, freq_table);
+        if (ret) {
+                dev_err(cpu_dev, "%s: invalid frequency table: %d\n", __func__,
+                        ret);
                 goto out_cooling_unregister;
+        }
+
+        policy->cpuinfo.transition_latency = transition_latency;
+
+        pd = cpufreq_get_driver_data();
+        if (!pd || !pd->independent_clocks)
+                cpumask_setall(policy->cpus);
 
         of_node_put(np);
 
@@ -275,9 +302,9 @@ static int cpufreq_init(struct cpufreq_policy *policy)
 
 out_cooling_unregister:
         cpufreq_cooling_unregister(priv->cdev);
-        kfree(priv);
-out_free_table:
         dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+out_free_priv:
+        kfree(priv);
 out_put_node:
         of_node_put(np);
 out_put_reg_clk:
@@ -335,6 +362,8 @@ static int dt_cpufreq_probe(struct platform_device *pdev)
         if (!IS_ERR(cpu_reg))
                 regulator_put(cpu_reg);
 
+        dt_cpufreq_driver.driver_data = dev_get_platdata(&pdev->dev);
+
         ret = cpufreq_register_driver(&dt_cpufreq_driver);
         if (ret)
                 dev_err(cpu_dev, "failed register driver: %d\n", ret);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 24bf76fba141..4473eba1d6b0 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -512,7 +512,18 @@ show_one(cpuinfo_max_freq, cpuinfo.max_freq);
 show_one(cpuinfo_transition_latency, cpuinfo.transition_latency);
 show_one(scaling_min_freq, min);
 show_one(scaling_max_freq, max);
-show_one(scaling_cur_freq, cur);
+
+static ssize_t show_scaling_cur_freq(
+        struct cpufreq_policy *policy, char *buf)
+{
+        ssize_t ret;
+
+        if (cpufreq_driver && cpufreq_driver->setpolicy && cpufreq_driver->get)
+                ret = sprintf(buf, "%u\n", cpufreq_driver->get(policy->cpu));
+        else
+                ret = sprintf(buf, "%u\n", policy->cur);
+        return ret;
+}
 
 static int cpufreq_set_policy(struct cpufreq_policy *policy,
                                 struct cpufreq_policy *new_policy);
@@ -906,11 +917,11 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy,
                 if (ret)
                         goto err_out_kobj_put;
         }
-        if (has_target()) {
-                ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
-                if (ret)
-                        goto err_out_kobj_put;
-        }
+
+        ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
+        if (ret)
+                goto err_out_kobj_put;
+
         if (cpufreq_driver->bios_limit) {
                 ret = sysfs_create_file(&policy->kobj, &bios_limit.attr);
                 if (ret)
@@ -1011,7 +1022,8 @@ static struct cpufreq_policy *cpufreq_policy_restore(unsigned int cpu)
 
         read_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
-        policy->governor = NULL;
+        if (policy)
+                policy->governor = NULL;
 
         return policy;
 }
@@ -1731,6 +1743,21 @@ const char *cpufreq_get_current_driver(void)
 }
 EXPORT_SYMBOL_GPL(cpufreq_get_current_driver);
 
+/**
+ *      cpufreq_get_driver_data - return current driver data
+ *
+ *      Return the private data of the currently loaded cpufreq
+ *      driver, or NULL if no cpufreq driver is loaded.
+ */
+void *cpufreq_get_driver_data(void)
+{
+        if (cpufreq_driver)
+                return cpufreq_driver->driver_data;
+
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(cpufreq_get_driver_data);
+
 /*********************************************************************
  *                     NOTIFIER LISTS INTERFACE                      *
  *********************************************************************/
diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
index ec399ad2f059..1608f7105c9f 100644
--- a/drivers/cpufreq/highbank-cpufreq.c
+++ b/drivers/cpufreq/highbank-cpufreq.c
@@ -19,7 +19,7 @@
 #include <linux/cpu.h>
 #include <linux/err.h>
 #include <linux/of.h>
-#include <linux/mailbox.h>
+#include <linux/pl320-ipc.h>
 #include <linux/platform_device.h>
 
 #define HB_CPUFREQ_CHANGE_NOTE  0x80000001
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 0668b389c516..27bb6d3877ed 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -52,6 +52,17 @@ static inline int32_t div_fp(int32_t x, int32_t y)
         return div_s64((int64_t)x << FRAC_BITS, y);
 }
 
+static inline int ceiling_fp(int32_t x)
+{
+        int mask, ret;
+
+        ret = fp_toint(x);
+        mask = (1 << FRAC_BITS) - 1;
+        if (x & mask)
+                ret += 1;
+        return ret;
+}
+
 struct sample {
         int32_t core_pct_busy;
         u64 aperf;
@@ -64,6 +75,7 @@ struct pstate_data {
         int     current_pstate;
         int     min_pstate;
         int     max_pstate;
+        int     scaling;
         int     turbo_pstate;
 };
 
@@ -113,6 +125,7 @@ struct pstate_funcs {
         int (*get_max)(void);
         int (*get_min)(void);
         int (*get_turbo)(void);
+        int (*get_scaling)(void);
         void (*set)(struct cpudata*, int pstate);
         void (*get_vid)(struct cpudata *);
 };
@@ -138,6 +151,7 @@ struct perf_limits {
 
 static struct perf_limits limits = {
         .no_turbo = 0,
+        .turbo_disabled = 0,
         .max_perf_pct = 100,
         .max_perf = int_tofp(1),
         .min_perf_pct = 0,
@@ -218,6 +232,18 @@ static inline void intel_pstate_reset_all_pid(void)
         }
 }
 
+static inline void update_turbo_state(void)
+{
+        u64 misc_en;
+        struct cpudata *cpu;
+
+        cpu = all_cpu_data[0];
+        rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
+        limits.turbo_disabled =
+                (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE ||
+                 cpu->pstate.max_pstate == cpu->pstate.turbo_pstate);
+}
+
 /************************** debugfs begin ************************/
 static int pid_param_set(void *data, u64 val)
 {
@@ -274,6 +300,20 @@ static void __init intel_pstate_debug_expose_params(void)
                 return sprintf(buf, "%u\n", limits.object);             \
         }
 
+static ssize_t show_no_turbo(struct kobject *kobj,
+                             struct attribute *attr, char *buf)
+{
+        ssize_t ret;
+
+        update_turbo_state();
+        if (limits.turbo_disabled)
+                ret = sprintf(buf, "%u\n", limits.turbo_disabled);
+        else
+                ret = sprintf(buf, "%u\n", limits.no_turbo);
+
+        return ret;
+}
+
 static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
                               const char *buf, size_t count)
 {
@@ -283,11 +323,14 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
         ret = sscanf(buf, "%u", &input);
         if (ret != 1)
                 return -EINVAL;
-        limits.no_turbo = clamp_t(int, input, 0 , 1);
+
+        update_turbo_state();
         if (limits.turbo_disabled) {
                 pr_warn("Turbo disabled by BIOS or unavailable on processor\n");
-                limits.no_turbo = limits.turbo_disabled;
+                return -EPERM;
         }
+        limits.no_turbo = clamp_t(int, input, 0, 1);
+
         return count;
 }
 
@@ -323,7 +366,6 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
         return count;
 }
 
-show_one(no_turbo, no_turbo);
 show_one(max_perf_pct, max_perf_pct);
 show_one(min_perf_pct, min_perf_pct);
 
@@ -394,7 +436,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
                 cpudata->vid.ratio);
 
         vid_fp = clamp_t(int32_t, vid_fp, cpudata->vid.min, cpudata->vid.max);
-        vid = fp_toint(vid_fp);
+        vid = ceiling_fp(vid_fp);
 
         if (pstate > cpudata->pstate.max_pstate)
                 vid = cpudata->vid.turbo;
@@ -404,6 +446,22 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
         wrmsrl(MSR_IA32_PERF_CTL, val);
 }
 
+#define BYT_BCLK_FREQS 5
+static int byt_freq_table[BYT_BCLK_FREQS] = { 833, 1000, 1333, 1167, 800};
+
+static int byt_get_scaling(void)
+{
+        u64 value;
+        int i;
+
+        rdmsrl(MSR_FSB_FREQ, value);
+        i = value & 0x3;
+
+        BUG_ON(i > BYT_BCLK_FREQS);
+
+        return byt_freq_table[i] * 100;
+}
+
 static void byt_get_vid(struct cpudata *cpudata)
 {
         u64 value;
@@ -449,6 +507,11 @@ static int core_get_turbo_pstate(void)
         return ret;
 }
 
+static inline int core_get_scaling(void)
+{
+        return 100000;
+}
+
 static void core_set_pstate(struct cpudata *cpudata, int pstate)
 {
         u64 val;
@@ -473,6 +536,7 @@ static struct cpu_defaults core_params = {
                 .get_max = core_get_max_pstate,
                 .get_min = core_get_min_pstate,
                 .get_turbo = core_get_turbo_pstate,
+                .get_scaling = core_get_scaling,
                 .set = core_set_pstate,
         },
 };
@@ -491,6 +555,7 @@ static struct cpu_defaults byt_params = {
                 .get_min = byt_get_min_pstate,
                 .get_turbo = byt_get_turbo_pstate,
                 .set = byt_set_pstate,
+                .get_scaling = byt_get_scaling,
                 .get_vid = byt_get_vid,
         },
 };
@@ -501,7 +566,7 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
         int max_perf_adj;
         int min_perf;
 
-        if (limits.no_turbo)
+        if (limits.no_turbo || limits.turbo_disabled)
                 max_perf = cpu->pstate.max_pstate;
 
         max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf), limits.max_perf));
@@ -516,6 +581,8 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
 {
         int max_perf, min_perf;
 
+        update_turbo_state();
+
         intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
 
         pstate = clamp_t(int, pstate, min_perf, max_perf);
@@ -523,7 +590,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
         if (pstate == cpu->pstate.current_pstate)
                 return;
 
-        trace_cpu_frequency(pstate * 100000, cpu->cpu);
+        trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
 
         cpu->pstate.current_pstate = pstate;
 
@@ -535,6 +602,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
         cpu->pstate.min_pstate = pstate_funcs.get_min();
         cpu->pstate.max_pstate = pstate_funcs.get_max();
         cpu->pstate.turbo_pstate = pstate_funcs.get_turbo();
+        cpu->pstate.scaling = pstate_funcs.get_scaling();
 
         if (pstate_funcs.get_vid)
                 pstate_funcs.get_vid(cpu);
@@ -550,7 +618,9 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu)
         core_pct = div64_u64(core_pct, int_tofp(sample->mperf));
 
         sample->freq = fp_toint(
-                mul_fp(int_tofp(cpu->pstate.max_pstate * 1000), core_pct));
+                mul_fp(int_tofp(
+                        cpu->pstate.max_pstate * cpu->pstate.scaling / 100),
+                        core_pct));
 
         sample->core_pct_busy = (int32_t)core_pct;
 }
@@ -671,7 +741,9 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
 {
         struct cpudata *cpu;
 
-        all_cpu_data[cpunum] = kzalloc(sizeof(struct cpudata), GFP_KERNEL);
+        if (!all_cpu_data[cpunum])
+                all_cpu_data[cpunum] = kzalloc(sizeof(struct cpudata),
+                                               GFP_KERNEL);
         if (!all_cpu_data[cpunum])
                 return -ENOMEM;
 
@@ -714,9 +786,10 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
                 limits.min_perf_pct = 100;
                 limits.min_perf = int_tofp(1);
+                limits.max_policy_pct = 100;
                 limits.max_perf_pct = 100;
                 limits.max_perf = int_tofp(1);
-                limits.no_turbo = limits.turbo_disabled;
+                limits.no_turbo = 0;
                 return 0;
         }
         limits.min_perf_pct = (policy->min * 100) / policy->cpuinfo.max_freq;
@@ -751,15 +824,12 @@ static void intel_pstate_stop_cpu(struct cpufreq_policy *policy)
 
         del_timer_sync(&all_cpu_data[cpu_num]->timer);
         intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
-        kfree(all_cpu_data[cpu_num]);
-        all_cpu_data[cpu_num] = NULL;
 }
 
 static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu;
         int rc;
-        u64 misc_en;
 
         rc = intel_pstate_init_cpu(policy->cpu);
         if (rc)
@@ -767,23 +837,18 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
 
         cpu = all_cpu_data[policy->cpu];
 
-        rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
-        if (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE ||
-            cpu->pstate.max_pstate == cpu->pstate.turbo_pstate) {
-                limits.turbo_disabled = 1;
-                limits.no_turbo = 1;
-        }
         if (limits.min_perf_pct == 100 && limits.max_perf_pct == 100)
                 policy->policy = CPUFREQ_POLICY_PERFORMANCE;
         else
                 policy->policy = CPUFREQ_POLICY_POWERSAVE;
 
-        policy->min = cpu->pstate.min_pstate * 100000;
-        policy->max = cpu->pstate.turbo_pstate * 100000;
+        policy->min = cpu->pstate.min_pstate * cpu->pstate.scaling;
+        policy->max = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
 
         /* cpuinfo and default policy values */
-        policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000;
-        policy->cpuinfo.max_freq = cpu->pstate.turbo_pstate * 100000;
+        policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling;
+        policy->cpuinfo.max_freq =
+                cpu->pstate.turbo_pstate * cpu->pstate.scaling;
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         cpumask_set_cpu(policy->cpu, policy->cpus);
 
@@ -841,6 +906,7 @@ static void copy_cpu_funcs(struct pstate_funcs *funcs)
         pstate_funcs.get_max   = funcs->get_max;
         pstate_funcs.get_min   = funcs->get_min;
         pstate_funcs.get_turbo = funcs->get_turbo;
+        pstate_funcs.get_scaling = funcs->get_scaling;
         pstate_funcs.set       = funcs->set;
         pstate_funcs.get_vid   = funcs->get_vid;
 }
diff --git a/drivers/cpuidle/Kconfig.mips b/drivers/cpuidle/Kconfig.mips
index 0e70ee28a5ca..4102be01d06a 100644
--- a/drivers/cpuidle/Kconfig.mips
+++ b/drivers/cpuidle/Kconfig.mips
@@ -3,7 +3,7 @@
 #
 config MIPS_CPS_CPUIDLE
         bool "CPU Idle driver for MIPS CPS platforms"
-        depends on CPU_IDLE
+        depends on CPU_IDLE && MIPS_CPS
         depends on SYS_SUPPORTS_MIPS_CPS
         select ARCH_NEEDS_CPU_IDLE_COUPLED if MIPS_MT
         select GENERIC_CLOCKEVENTS_BROADCAST if SMP
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index a64be578dab2..7d3a3497dd4c 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -163,7 +163,8 @@ static int powernv_add_idle_states(void)
         int nr_idle_states = 1; /* Snooze */
         int dt_idle_states;
         const __be32 *idle_state_flags;
-        u32 len_flags, flags;
+        const __be32 *idle_state_latency;
+        u32 len_flags, flags, latency_ns;
         int i;
 
         /* Currently we have snooze statically defined */
@@ -180,18 +181,32 @@ static int powernv_add_idle_states(void)
                 return nr_idle_states;
         }
 
+        idle_state_latency = of_get_property(power_mgt,
+                        "ibm,cpu-idle-state-latencies-ns", NULL);
+        if (!idle_state_latency) {
+                pr_warn("DT-PowerMgmt: missing ibm,cpu-idle-state-latencies-ns\n");
+                return nr_idle_states;
+        }
+
         dt_idle_states = len_flags / sizeof(u32);
 
         for (i = 0; i < dt_idle_states; i++) {
 
                 flags = be32_to_cpu(idle_state_flags[i]);
+
+                /* Cpuidle accepts exit_latency in us and we estimate
+                 * target residency to be 10x exit_latency
+                 */
+                latency_ns = be32_to_cpu(idle_state_latency[i]);
                 if (flags & IDLE_USE_INST_NAP) {
                         /* Add NAP state */
                         strcpy(powernv_states[nr_idle_states].name, "Nap");
                         strcpy(powernv_states[nr_idle_states].desc, "Nap");
                         powernv_states[nr_idle_states].flags = CPUIDLE_FLAG_TIME_VALID;
-                        powernv_states[nr_idle_states].exit_latency = 10;
-                        powernv_states[nr_idle_states].target_residency = 100;
+                        powernv_states[nr_idle_states].exit_latency =
+                                        ((unsigned int)latency_ns) / 1000;
+                        powernv_states[nr_idle_states].target_residency =
+                                        ((unsigned int)latency_ns / 100);
                         powernv_states[nr_idle_states].enter = &nap_loop;
                         nr_idle_states++;
                 }
@@ -202,8 +217,10 @@ static int powernv_add_idle_states(void)
                         strcpy(powernv_states[nr_idle_states].desc, "FastSleep");
                         powernv_states[nr_idle_states].flags =
                                 CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TIMER_STOP;
-                        powernv_states[nr_idle_states].exit_latency = 300;
-                        powernv_states[nr_idle_states].target_residency = 1000000;
+                        powernv_states[nr_idle_states].exit_latency =
+                                        ((unsigned int)latency_ns) / 1000;
+                        powernv_states[nr_idle_states].target_residency =
+                                        ((unsigned int)latency_ns / 100);
                         powernv_states[nr_idle_states].enter = &fastsleep_loop;
                         nr_idle_states++;
                 }
diff --git a/drivers/crypto/caam/key_gen.c b/drivers/crypto/caam/key_gen.c
index 871703c49d2c..e1eaf4ff9762 100644
--- a/drivers/crypto/caam/key_gen.c
+++ b/drivers/crypto/caam/key_gen.c
@@ -48,23 +48,29 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
         u32 *desc;
         struct split_key_result result;
         dma_addr_t dma_addr_in, dma_addr_out;
-        int ret = 0;
+        int ret = -ENOMEM;
 
         desc = kmalloc(CAAM_CMD_SZ * 6 + CAAM_PTR_SZ * 2, GFP_KERNEL | GFP_DMA);
         if (!desc) {
                 dev_err(jrdev, "unable to allocate key input memory\n");
-                return -ENOMEM;
+                return ret;
         }
 
-        init_job_desc(desc, 0);
-
         dma_addr_in = dma_map_single(jrdev, (void *)key_in, keylen,
                                      DMA_TO_DEVICE);
         if (dma_mapping_error(jrdev, dma_addr_in)) {
                 dev_err(jrdev, "unable to map key input memory\n");
-                kfree(desc);
-                return -ENOMEM;
+                goto out_free;
         }
+
+        dma_addr_out = dma_map_single(jrdev, key_out, split_key_pad_len,
+                                      DMA_FROM_DEVICE);
+        if (dma_mapping_error(jrdev, dma_addr_out)) {
+                dev_err(jrdev, "unable to map key output memory\n");
+                goto out_unmap_in;
+        }
+
+        init_job_desc(desc, 0);
         append_key(desc, dma_addr_in, keylen, CLASS_2 | KEY_DEST_CLASS_REG);
 
         /* Sets MDHA up into an HMAC-INIT */
@@ -81,13 +87,6 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
          * FIFO_STORE with the explicit split-key content store
          * (0x26 output type)
          */
-        dma_addr_out = dma_map_single(jrdev, key_out, split_key_pad_len,
-                                      DMA_FROM_DEVICE);
-        if (dma_mapping_error(jrdev, dma_addr_out)) {
-                dev_err(jrdev, "unable to map key output memory\n");
-                kfree(desc);
-                return -ENOMEM;
-        }
         append_fifo_store(desc, dma_addr_out, split_key_len,
                           LDST_CLASS_2_CCB | FIFOST_TYPE_SPLIT_KEK);
 
@@ -115,10 +114,10 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
 
         dma_unmap_single(jrdev, dma_addr_out, split_key_pad_len,
                          DMA_FROM_DEVICE);
+out_unmap_in:
         dma_unmap_single(jrdev, dma_addr_in, keylen, DMA_TO_DEVICE);
-
+out_free:
         kfree(desc);
-
         return ret;
 }
 EXPORT_SYMBOL(gen_split_key);
diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
index 9282381b03ce..fe7b3f06f6e6 100644
--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
@@ -198,8 +198,7 @@ struct adf_accel_dev {
         struct dentry *debugfs_dir;
         struct list_head list;
         struct module *owner;
-        uint8_t accel_id;
-        uint8_t numa_node;
         struct adf_accel_pci accel_pci_dev;
+        uint8_t accel_id;
 } __packed;
 #endif
diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c
index 5f3fa45348b4..9dd2cb72a4e8 100644
--- a/drivers/crypto/qat/qat_common/adf_transport.c
+++ b/drivers/crypto/qat/qat_common/adf_transport.c
@@ -419,9 +419,10 @@ static int adf_init_bank(struct adf_accel_dev *accel_dev,
                 WRITE_CSR_RING_BASE(csr_addr, bank_num, i, 0);
                 ring = &bank->rings[i];
                 if (hw_data->tx_rings_mask & (1 << i)) {
-                        ring->inflights = kzalloc_node(sizeof(atomic_t),
-                                                       GFP_KERNEL,
-                                                       accel_dev->numa_node);
+                        ring->inflights =
+                                kzalloc_node(sizeof(atomic_t),
+                                             GFP_KERNEL,
+                                             dev_to_node(&GET_DEV(accel_dev)));
                         if (!ring->inflights)
                                 goto err;
                 } else {
@@ -469,13 +470,14 @@ int adf_init_etr_data(struct adf_accel_dev *accel_dev)
         int i, ret;
 
         etr_data = kzalloc_node(sizeof(*etr_data), GFP_KERNEL,
-                                accel_dev->numa_node);
+                                dev_to_node(&GET_DEV(accel_dev)));
         if (!etr_data)
                 return -ENOMEM;
 
         num_banks = GET_MAX_BANKS(accel_dev);
         size = num_banks * sizeof(struct adf_etr_bank_data);
-        etr_data->banks = kzalloc_node(size, GFP_KERNEL, accel_dev->numa_node);
+        etr_data->banks = kzalloc_node(size, GFP_KERNEL,
+                                       dev_to_node(&GET_DEV(accel_dev)));
         if (!etr_data->banks) {
                 ret = -ENOMEM;
                 goto err_bank;
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index f2e2f158cfbe..9e9619cd4a79 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -596,7 +596,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
         if (unlikely(!n))
                 return -EINVAL;
 
-        bufl = kmalloc_node(sz, GFP_ATOMIC, inst->accel_dev->numa_node);
+        bufl = kmalloc_node(sz, GFP_ATOMIC,
+                            dev_to_node(&GET_DEV(inst->accel_dev)));
         if (unlikely(!bufl))
                 return -ENOMEM;
 
@@ -605,6 +606,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
                 goto err;
 
         for_each_sg(assoc, sg, assoc_n, i) {
+                if (!sg->length)
+                        continue;
                 bufl->bufers[bufs].addr = dma_map_single(dev,
                                                          sg_virt(sg),
                                                          sg->length,
@@ -640,7 +643,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
                 struct qat_alg_buf *bufers;
 
                 buflout = kmalloc_node(sz, GFP_ATOMIC,
-                                       inst->accel_dev->numa_node);
+                                       dev_to_node(&GET_DEV(inst->accel_dev)));
                 if (unlikely(!buflout))
                         goto err;
                 bloutp = dma_map_single(dev, buflout, sz, DMA_TO_DEVICE);
diff --git a/drivers/crypto/qat/qat_common/qat_crypto.c b/drivers/crypto/qat/qat_common/qat_crypto.c
index 0d59bcb50de1..828f2a686aab 100644
--- a/drivers/crypto/qat/qat_common/qat_crypto.c
+++ b/drivers/crypto/qat/qat_common/qat_crypto.c
@@ -109,12 +109,14 @@ struct qat_crypto_instance *qat_crypto_get_instance_node(int node)
 
         list_for_each(itr, adf_devmgr_get_head()) {
                 accel_dev = list_entry(itr, struct adf_accel_dev, list);
-                if (accel_dev->numa_node == node && adf_dev_started(accel_dev))
+                if ((node == dev_to_node(&GET_DEV(accel_dev)) ||
+                        dev_to_node(&GET_DEV(accel_dev)) < 0)
+                                && adf_dev_started(accel_dev))
                         break;
                 accel_dev = NULL;
         }
         if (!accel_dev) {
-                pr_err("QAT: Could not find device on give node\n");
+                pr_err("QAT: Could not find device on node %d\n", node);
                 accel_dev = adf_devmgr_get_first();
         }
         if (!accel_dev || !adf_dev_started(accel_dev))
@@ -164,7 +166,7 @@ static int qat_crypto_create_instances(struct adf_accel_dev *accel_dev)
 
         for (i = 0; i < num_inst; i++) {
                 inst = kzalloc_node(sizeof(*inst), GFP_KERNEL,
-                                    accel_dev->numa_node);
+                                    dev_to_node(&GET_DEV(accel_dev)));
                 if (!inst)
                         goto err;
 
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_admin.c b/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
index 978d6c56639d..53c491b59f07 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
@@ -108,7 +108,7 @@ int adf_init_admin_comms(struct adf_accel_dev *accel_dev)
         uint64_t reg_val;
 
         admin = kzalloc_node(sizeof(*accel_dev->admin), GFP_KERNEL,
-                             accel_dev->numa_node);
+                             dev_to_node(&GET_DEV(accel_dev)));
         if (!admin)
                 return -ENOMEM;
         admin->virt_addr = dma_zalloc_coherent(&GET_DEV(accel_dev), PAGE_SIZE,
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
index 0d0435a41be9..948f66be262b 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
@@ -119,21 +119,6 @@ static void adf_cleanup_accel(struct adf_accel_dev *accel_dev)
         kfree(accel_dev);
 }
 
-static uint8_t adf_get_dev_node_id(struct pci_dev *pdev)
-{
-        unsigned int bus_per_cpu = 0;
-        struct cpuinfo_x86 *c = &cpu_data(num_online_cpus() - 1);
-
-        if (!c->phys_proc_id)
-                return 0;
-
-        bus_per_cpu = 256 / (c->phys_proc_id + 1);
-
-        if (bus_per_cpu != 0)
-                return pdev->bus->number / bus_per_cpu;
-        return 0;
-}
-
 static int qat_dev_start(struct adf_accel_dev *accel_dev)
 {
         int cpus = num_online_cpus();
@@ -235,7 +220,6 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         void __iomem *pmisc_bar_addr = NULL;
         char name[ADF_DEVICE_NAME_LENGTH];
         unsigned int i, bar_nr;
-        uint8_t node;
         int ret;
 
         switch (ent->device) {
@@ -246,12 +230,19 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
-        node = adf_get_dev_node_id(pdev);
-        accel_dev = kzalloc_node(sizeof(*accel_dev), GFP_KERNEL, node);
+        if (num_possible_nodes() > 1 && dev_to_node(&pdev->dev) < 0) {
+                /* If the accelerator is connected to a node with no memory
+                 * there is no point in using the accelerator since the remote
+                 * memory transaction will be very slow. */
+                dev_err(&pdev->dev, "Invalid NUMA configuration.\n");
+                return -EINVAL;
+        }
+
+        accel_dev = kzalloc_node(sizeof(*accel_dev), GFP_KERNEL,
+                                 dev_to_node(&pdev->dev));
         if (!accel_dev)
                 return -ENOMEM;
 
-        accel_dev->numa_node = node;
         INIT_LIST_HEAD(&accel_dev->crypto_list);
 
         /* Add accel device to accel table.
@@ -264,7 +255,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         accel_dev->owner = THIS_MODULE;
         /* Allocate and configure device configuration structure */
-        hw_data = kzalloc_node(sizeof(*hw_data), GFP_KERNEL, node);
+        hw_data = kzalloc_node(sizeof(*hw_data), GFP_KERNEL,
+                               dev_to_node(&pdev->dev));
         if (!hw_data) {
                 ret = -ENOMEM;
                 goto out_err;
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
index 67ec61e51185..d96ee21b9b77 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
@@ -168,7 +168,7 @@ static int adf_isr_alloc_msix_entry_table(struct adf_accel_dev *accel_dev)
         uint32_t msix_num_entries = hw_data->num_banks + 1;
 
         entries = kzalloc_node(msix_num_entries * sizeof(*entries),
-                               GFP_KERNEL, accel_dev->numa_node);
+                               GFP_KERNEL, dev_to_node(&GET_DEV(accel_dev)));
         if (!entries)
                 return -ENOMEM;
 
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 123f578d6dd3..4cfaaa5a49be 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -1107,52 +1107,14 @@ bool edma_filter_fn(struct dma_chan *chan, void *param)
 }
 EXPORT_SYMBOL(edma_filter_fn);
 
-static struct platform_device *pdev0, *pdev1;
-
-static const struct platform_device_info edma_dev_info0 = {
-        .name = "edma-dma-engine",
-        .id = 0,
-        .dma_mask = DMA_BIT_MASK(32),
-};
-
-static const struct platform_device_info edma_dev_info1 = {
-        .name = "edma-dma-engine",
-        .id = 1,
-        .dma_mask = DMA_BIT_MASK(32),
-};
-
 static int edma_init(void)
 {
-        int ret = platform_driver_register(&edma_driver);
-
-        if (ret == 0) {
-                pdev0 = platform_device_register_full(&edma_dev_info0);
-                if (IS_ERR(pdev0)) {
-                        platform_driver_unregister(&edma_driver);
-                        ret = PTR_ERR(pdev0);
-                        goto out;
-                }
-        }
-
-        if (!of_have_populated_dt() && EDMA_CTLRS == 2) {
-                pdev1 = platform_device_register_full(&edma_dev_info1);
-                if (IS_ERR(pdev1)) {
-                        platform_driver_unregister(&edma_driver);
-                        platform_device_unregister(pdev0);
-                        ret = PTR_ERR(pdev1);
-                }
-        }
-
-out:
-        return ret;
+        return platform_driver_register(&edma_driver);
 }
 subsys_initcall(edma_init);
 
 static void __exit edma_exit(void)
 {
-        platform_device_unregister(pdev0);
-        if (pdev1)
-                platform_device_unregister(pdev1);
         platform_driver_unregister(&edma_driver);
 }
 module_exit(edma_exit);
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 4839bfa74a10..19a99743cf52 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -271,7 +271,7 @@ struct pl330_config {
 #define DMAC_MODE_NS    (1 << 0)
         unsigned int    mode;
         unsigned int    data_bus_width:10; /* In number of bits */
-        unsigned int    data_buf_dep:10;
+        unsigned int    data_buf_dep:11;
         unsigned int    num_chan:4;
         unsigned int    num_peri:6;
         u32             peri_ns;
@@ -2336,7 +2336,7 @@ static inline int get_burst_len(struct dma_pl330_desc *desc, size_t len)
         int burst_len;
 
         burst_len = pl330->pcfg.data_bus_width / 8;
-        burst_len *= pl330->pcfg.data_buf_dep;
+        burst_len *= pl330->pcfg.data_buf_dep / pl330->pcfg.num_chan;
         burst_len >>= desc->rqcfg.brst_size;
 
         /* src/dst_burst_len can't be more than 16 */
@@ -2459,16 +2459,25 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
         /* Select max possible burst size */
         burst = pl330->pcfg.data_bus_width / 8;
 
-        while (burst > 1) {
-                if (!(len % burst))
-                        break;
+        /*
+         * Make sure we use a burst size that aligns with all the memcpy
+         * parameters because our DMA programming algorithm doesn't cope with
+         * transfers which straddle an entry in the DMA device's MFIFO.
+         */
+        while ((src | dst | len) & (burst - 1))
                 burst /= 2;
-        }
 
         desc->rqcfg.brst_size = 0;
         while (burst != (1 << desc->rqcfg.brst_size))
                 desc->rqcfg.brst_size++;
 
+        /*
+         * If burst size is smaller than bus width then make sure we only
+         * transfer one at a time to avoid a burst stradling an MFIFO entry.
+         */
+        if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
+                desc->rqcfg.brst_len = 1;
+
         desc->rqcfg.brst_len = get_burst_len(desc, len);
 
         desc->txd.flags = flags;
@@ -2732,7 +2741,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 
 
         dev_info(&adev->dev,
-                "Loaded driver for PL330 DMAC-%d\n", adev->periphid);
+                "Loaded driver for PL330 DMAC-%x\n", adev->periphid);
         dev_info(&adev->dev,
                 "\tDBUFF-%ux%ubytes Num_Chans-%u Num_Peri-%u Num_Events-%u\n",
                 pcfg->data_buf_dep, pcfg->data_bus_width / 8, pcfg->num_chan,
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 3aa10b328254..91292f5513ff 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -230,30 +230,25 @@ static inline void sun6i_dma_dump_chan_regs(struct sun6i_dma_dev *sdev,
                 readl(pchan->base + DMA_CHAN_CUR_PARA));
 }
 
-static inline int convert_burst(u32 maxburst, u8 *burst)
+static inline s8 convert_burst(u32 maxburst)
 {
         switch (maxburst) {
         case 1:
-                *burst = 0;
-                break;
+                return 0;
         case 8:
-                *burst = 2;
-                break;
+                return 2;
         default:
                 return -EINVAL;
         }
-
-        return 0;
 }
 
-static inline int convert_buswidth(enum dma_slave_buswidth addr_width, u8 *width)
+static inline s8 convert_buswidth(enum dma_slave_buswidth addr_width)
 {
         if ((addr_width < DMA_SLAVE_BUSWIDTH_1_BYTE) ||
             (addr_width > DMA_SLAVE_BUSWIDTH_4_BYTES))
                 return -EINVAL;
 
-        *width = addr_width >> 1;
-        return 0;
+        return addr_width >> 1;
 }
 
 static void *sun6i_dma_lli_add(struct sun6i_dma_lli *prev,
@@ -284,26 +279,25 @@ static inline int sun6i_dma_cfg_lli(struct sun6i_dma_lli *lli,
                                     struct dma_slave_config *config)
 {
         u8 src_width, dst_width, src_burst, dst_burst;
-        int ret;
 
         if (!config)
                 return -EINVAL;
 
-        ret = convert_burst(config->src_maxburst, &src_burst);
-        if (ret)
-                return ret;
+        src_burst = convert_burst(config->src_maxburst);
+        if (src_burst)
+                return src_burst;
 
-        ret = convert_burst(config->dst_maxburst, &dst_burst);
-        if (ret)
-                return ret;
+        dst_burst = convert_burst(config->dst_maxburst);
+        if (dst_burst)
+                return dst_burst;
 
-        ret = convert_buswidth(config->src_addr_width, &src_width);
-        if (ret)
-                return ret;
+        src_width = convert_buswidth(config->src_addr_width);
+        if (src_width)
+                return src_width;
 
-        ret = convert_buswidth(config->dst_addr_width, &dst_width);
-        if (ret)
-                return ret;
+        dst_width = convert_buswidth(config->dst_addr_width);
+        if (dst_width)
+                return dst_width;
 
         lli->cfg = DMA_CHAN_CFG_SRC_BURST(src_burst) |
                 DMA_CHAN_CFG_SRC_WIDTH(src_width) |
@@ -542,11 +536,10 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
 {
         struct sun6i_dma_dev *sdev = to_sun6i_dma_dev(chan->device);
         struct sun6i_vchan *vchan = to_sun6i_vchan(chan);
-        struct dma_slave_config *sconfig = &vchan->cfg;
         struct sun6i_dma_lli *v_lli;
         struct sun6i_desc *txd;
         dma_addr_t p_lli;
-        int ret;
+        s8 burst, width;
 
         dev_dbg(chan2dev(chan),
                 "%s; chan: %d, dest: %pad, src: %pad, len: %zu. flags: 0x%08lx\n",
@@ -565,14 +558,21 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
                 goto err_txd_free;
         }
 
-        ret = sun6i_dma_cfg_lli(v_lli, src, dest, len, sconfig);
-        if (ret)
-                goto err_dma_free;
+        v_lli->src = src;
+        v_lli->dst = dest;
+        v_lli->len = len;
+        v_lli->para = NORMAL_WAIT;
 
+        burst = convert_burst(8);
+        width = convert_buswidth(DMA_SLAVE_BUSWIDTH_4_BYTES);
         v_lli->cfg |= DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) |
                 DMA_CHAN_CFG_DST_DRQ(DRQ_SDRAM) |
                 DMA_CHAN_CFG_DST_LINEAR_MODE |
-                DMA_CHAN_CFG_SRC_LINEAR_MODE;
+                DMA_CHAN_CFG_SRC_LINEAR_MODE |
+                DMA_CHAN_CFG_SRC_BURST(burst) |
+                DMA_CHAN_CFG_SRC_WIDTH(width) |
+                DMA_CHAN_CFG_DST_BURST(burst) |
+                DMA_CHAN_CFG_DST_WIDTH(width);
 
         sun6i_dma_lli_add(NULL, v_lli, p_lli, txd);
 
@@ -580,8 +580,6 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
 
         return vchan_tx_prep(&vchan->vc, &txd->vd, flags);
 
-err_dma_free:
-        dma_pool_free(sdev->pool, v_lli, p_lli);
 err_txd_free:
         kfree(txd);
         return NULL;
@@ -915,6 +913,7 @@ static int sun6i_dma_probe(struct platform_device *pdev)
         sdc->slave.device_prep_dma_memcpy       = sun6i_dma_prep_dma_memcpy;
         sdc->slave.device_control               = sun6i_dma_control;
         sdc->slave.chancnt                      = NR_MAX_VCHANS;
+        sdc->slave.copy_align                   = 4;
 
         sdc->slave.dev = &pdev->dev;
 
diff --git a/drivers/edac/cpc925_edac.c b/drivers/edac/cpc925_edac.c
index df6575f1430d..682288ced4ac 100644
--- a/drivers/edac/cpc925_edac.c
+++ b/drivers/edac/cpc925_edac.c
@@ -562,7 +562,7 @@ static void cpc925_mc_check(struct mem_ctl_info *mci)
 
         if (apiexcp & UECC_EXCP_DETECTED) {
                 cpc925_mc_printk(mci, KERN_INFO, "DRAM UECC Fault\n");
-                edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1,
+                edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1,
                                      pfn, offset, 0,
                                      csrow, -1, -1,
                                      mci->ctl_name, "");
diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
index 3cda79bc8b00..ece3aef16bb1 100644
--- a/drivers/edac/e7xxx_edac.c
+++ b/drivers/edac/e7xxx_edac.c
@@ -226,7 +226,7 @@ static void process_ce(struct mem_ctl_info *mci, struct e7xxx_error_info *info)
 static void process_ce_no_info(struct mem_ctl_info *mci)
 {
         edac_dbg(3, "\n");
-        edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, 0, 0, 0, -1, -1, -1,
+        edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, 0, 0, 0, -1, -1, -1,
                              "e7xxx CE log register overflow", "");
 }
 
diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
index 022a70273ada..aa98b136f5d0 100644
--- a/drivers/edac/i3200_edac.c
+++ b/drivers/edac/i3200_edac.c
@@ -242,11 +242,11 @@ static void i3200_process_error_info(struct mem_ctl_info *mci,
                                              -1, -1,
                                              "i3000 UE", "");
                 } else if (log & I3200_ECCERRLOG_CE) {
-                        edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1,
+                        edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1,
                                              0, 0, eccerrlog_syndrome(log),
                                              eccerrlog_row(channel, log),
                                              -1, -1,
-                                             "i3000 UE", "");
+                                             "i3000 CE", "");
                 }
         }
 }
diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
index 3382f6344e42..4382343a7c60 100644
--- a/drivers/edac/i82860_edac.c
+++ b/drivers/edac/i82860_edac.c
@@ -124,7 +124,7 @@ static int i82860_process_error_info(struct mem_ctl_info *mci,
                                      dimm->location[0], dimm->location[1], -1,
                                      "i82860 UE", "");
         else
-                edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1,
+                edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1,
                                      info->eap, 0, info->derrsyn,
                                      dimm->location[0], dimm->location[1], -1,
                                      "i82860 CE", "");
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 5d997a33907e..2a3973a7c441 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1637,8 +1637,7 @@ static int dispatch_ioctl(struct client *client,
             _IOC_SIZE(cmd) > sizeof(buffer))
                 return -ENOTTY;
 
-        if (_IOC_DIR(cmd) == _IOC_READ)
-                memset(&buffer, 0, _IOC_SIZE(cmd));
+        memset(&buffer, 0, sizeof(buffer));
 
         if (_IOC_DIR(cmd) & _IOC_WRITE)
                 if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 64ecbb501c50..8590099ac148 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -41,6 +41,28 @@ struct efi __read_mostly efi = {
 };
 EXPORT_SYMBOL(efi);
 
+static bool disable_runtime;
+static int __init setup_noefi(char *arg)
+{
+        disable_runtime = true;
+        return 0;
+}
+early_param("noefi", setup_noefi);
+
+bool efi_runtime_disabled(void)
+{
+        return disable_runtime;
+}
+
+static int __init parse_efi_cmdline(char *str)
+{
+        if (parse_option_str(str, "noruntime"))
+                disable_runtime = true;
+
+        return 0;
+}
+early_param("efi", parse_efi_cmdline);
+
 static struct kobject *efi_kobj;
 static struct kobject *efivars_kobj;
 
@@ -423,3 +445,60 @@ int __init efi_get_fdt_params(struct efi_fdt_params *params, int verbose)
         return ret;
 }
 #endif /* CONFIG_EFI_PARAMS_FROM_FDT */
+
+static __initdata char memory_type_name[][20] = {
+        "Reserved",
+        "Loader Code",
+        "Loader Data",
+        "Boot Code",
+        "Boot Data",
+        "Runtime Code",
+        "Runtime Data",
+        "Conventional Memory",
+        "Unusable Memory",
+        "ACPI Reclaim Memory",
+        "ACPI Memory NVS",
+        "Memory Mapped I/O",
+        "MMIO Port Space",
+        "PAL Code"
+};
+
+char * __init efi_md_typeattr_format(char *buf, size_t size,
+                                     const efi_memory_desc_t *md)
+{
+        char *pos;
+        int type_len;
+        u64 attr;
+
+        pos = buf;
+        if (md->type >= ARRAY_SIZE(memory_type_name))
+                type_len = snprintf(pos, size, "[type=%u", md->type);
+        else
+                type_len = snprintf(pos, size, "[%-*s",
+                                    (int)(sizeof(memory_type_name[0]) - 1),
+                                    memory_type_name[md->type]);
+        if (type_len >= size)
+                return buf;
+
+        pos += type_len;
+        size -= type_len;
+
+        attr = md->attribute;
+        if (attr & ~(EFI_MEMORY_UC | EFI_MEMORY_WC | EFI_MEMORY_WT |
+                     EFI_MEMORY_WB | EFI_MEMORY_UCE | EFI_MEMORY_WP |
+                     EFI_MEMORY_RP | EFI_MEMORY_XP | EFI_MEMORY_RUNTIME))
+                snprintf(pos, size, "|attr=0x%016llx]",
+                         (unsigned long long)attr);
+        else
+                snprintf(pos, size, "|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",
+                         attr & EFI_MEMORY_RUNTIME ? "RUN" : "",
+                         attr & EFI_MEMORY_XP      ? "XP"  : "",
+                         attr & EFI_MEMORY_RP      ? "RP"  : "",
+                         attr & EFI_MEMORY_WP      ? "WP"  : "",
+                         attr & EFI_MEMORY_UCE     ? "UCE" : "",
+                         attr & EFI_MEMORY_WB      ? "WB"  : "",
+                         attr & EFI_MEMORY_WT      ? "WT"  : "",
+                         attr & EFI_MEMORY_WC      ? "WC"  : "",
+                         attr & EFI_MEMORY_UC      ? "UC"  : "");
+        return buf;
+}
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index 480339b6b110..75ee05964cbc 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -226,6 +226,10 @@ unsigned long __init efi_entry(void *handle, efi_system_table_t *sys_table,
                 goto fail_free_image;
         }
 
+        status = efi_parse_options(cmdline_ptr);
+        if (status != EFI_SUCCESS)
+                pr_efi_err(sys_table, "Failed to parse EFI cmdline options\n");
+
         /*
          * Unauthenticated device tree data is a security hazard, so
          * ignore 'dtb=' unless UEFI Secure Boot is disabled.
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 32d5cca30f49..a920fec8fe88 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -15,8 +15,23 @@
 
 #include "efistub.h"
 
+/*
+ * Some firmware implementations have problems reading files in one go.
+ * A read chunk size of 1MB seems to work for most platforms.
+ *
+ * Unfortunately, reading files in chunks triggers *other* bugs on some
+ * platforms, so we provide a way to disable this workaround, which can
+ * be done by passing "efi=nochunk" on the EFI boot stub command line.
+ *
+ * If you experience issues with initrd images being corrupt it's worth
+ * trying efi=nochunk, but chunking is enabled by default because there
+ * are far more machines that require the workaround than those that
+ * break with it enabled.
+ */
 #define EFI_READ_CHUNK_SIZE     (1024 * 1024)
 
+static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE;
+
 struct file_info {
         efi_file_handle_t *handle;
         u64 size;
@@ -281,6 +296,49 @@ void efi_free(efi_system_table_t *sys_table_arg, unsigned long size,
         efi_call_early(free_pages, addr, nr_pages);
 }
 
+/*
+ * Parse the ASCII string 'cmdline' for EFI options, denoted by the efi=
+ * option, e.g. efi=nochunk.
+ *
+ * It should be noted that efi= is parsed in two very different
+ * environments, first in the early boot environment of the EFI boot
+ * stub, and subsequently during the kernel boot.
+ */
+efi_status_t efi_parse_options(char *cmdline)
+{
+        char *str;
+
+        /*
+         * If no EFI parameters were specified on the cmdline we've got
+         * nothing to do.
+         */
+        str = strstr(cmdline, "efi=");
+        if (!str)
+                return EFI_SUCCESS;
+
+        /* Skip ahead to first argument */
+        str += strlen("efi=");
+
+        /*
+         * Remember, because efi= is also used by the kernel we need to
+         * skip over arguments we don't understand.
+         */
+        while (*str) {
+                if (!strncmp(str, "nochunk", 7)) {
+                        str += strlen("nochunk");
+                        __chunk_size = -1UL;
+                }
+
+                /* Group words together, delimited by "," */
+                while (*str && *str != ',')
+                        str++;
+
+                if (*str == ',')
+                        str++;
+        }
+
+        return EFI_SUCCESS;
+}
 
 /*
  * Check the cmdline for a LILO-style file= arguments.
@@ -423,8 +481,8 @@ efi_status_t handle_cmdline_files(efi_system_table_t *sys_table_arg,
                         size = files[j].size;
                         while (size) {
                                 unsigned long chunksize;
-                                if (size > EFI_READ_CHUNK_SIZE)
-                                        chunksize = EFI_READ_CHUNK_SIZE;
+                                if (size > __chunk_size)
+                                        chunksize = __chunk_size;
                                 else
                                         chunksize = size;
 
diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index 10daa4bbb258..228bbf910461 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -14,11 +14,80 @@
  * This file is released under the GPLv2.
  */
 
+#include <linux/bug.h>
 #include <linux/efi.h>
-#include <linux/spinlock.h>             /* spinlock_t */
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
 #include <asm/efi.h>
 
 /*
+ * According to section 7.1 of the UEFI spec, Runtime Services are not fully
+ * reentrant, and there are particular combinations of calls that need to be
+ * serialized. (source: UEFI Specification v2.4A)
+ *
+ * Table 31. Rules for Reentry Into Runtime Services
+ * +------------------------------------+-------------------------------+
+ * | If previous call is busy in        | Forbidden to call             |
+ * +------------------------------------+-------------------------------+
+ * | Any                                | SetVirtualAddressMap()        |
+ * +------------------------------------+-------------------------------+
+ * | ConvertPointer()                   | ConvertPointer()              |
+ * +------------------------------------+-------------------------------+
+ * | SetVariable()                      | ResetSystem()                 |
+ * | UpdateCapsule()                    |                               |
+ * | SetTime()                          |                               |
+ * | SetWakeupTime()                    |                               |
+ * | GetNextHighMonotonicCount()        |                               |
+ * +------------------------------------+-------------------------------+
+ * | GetVariable()                      | GetVariable()                 |
+ * | GetNextVariableName()              | GetNextVariableName()         |
+ * | SetVariable()                      | SetVariable()                 |
+ * | QueryVariableInfo()                | QueryVariableInfo()           |
+ * | UpdateCapsule()                    | UpdateCapsule()               |
+ * | QueryCapsuleCapabilities()         | QueryCapsuleCapabilities()    |
+ * | GetNextHighMonotonicCount()        | GetNextHighMonotonicCount()   |
+ * +------------------------------------+-------------------------------+
+ * | GetTime()                          | GetTime()                     |
+ * | SetTime()                          | SetTime()                     |
+ * | GetWakeupTime()                    | GetWakeupTime()               |
+ * | SetWakeupTime()                    | SetWakeupTime()               |
+ * +------------------------------------+-------------------------------+
+ *
+ * Due to the fact that the EFI pstore may write to the variable store in
+ * interrupt context, we need to use a spinlock for at least the groups that
+ * contain SetVariable() and QueryVariableInfo(). That leaves little else, as
+ * none of the remaining functions are actually ever called at runtime.
+ * So let's just use a single spinlock to serialize all Runtime Services calls.
+ */
+static DEFINE_SPINLOCK(efi_runtime_lock);
+
+/*
+ * Some runtime services calls can be reentrant under NMI, even if the table
+ * above says they are not. (source: UEFI Specification v2.4A)
+ *
+ * Table 32. Functions that may be called after Machine Check, INIT and NMI
+ * +----------------------------+------------------------------------------+
+ * | Function                   | Called after Machine Check, INIT and NMI |
+ * +----------------------------+------------------------------------------+
+ * | GetTime()                  | Yes, even if previously busy.            |
+ * | GetVariable()              | Yes, even if previously busy             |
+ * | GetNextVariableName()      | Yes, even if previously busy             |
+ * | QueryVariableInfo()        | Yes, even if previously busy             |
+ * | SetVariable()              | Yes, even if previously busy             |
+ * | UpdateCapsule()            | Yes, even if previously busy             |
+ * | QueryCapsuleCapabilities() | Yes, even if previously busy             |
+ * | ResetSystem()              | Yes, even if previously busy             |
+ * +----------------------------+------------------------------------------+
+ *
+ * In order to prevent deadlocks under NMI, the wrappers for these functions
+ * may only grab the efi_runtime_lock or rtc_lock spinlocks if !efi_in_nmi().
+ * However, not all of the services listed are reachable through NMI code paths,
+ * so the the special handling as suggested by the UEFI spec is only implemented
+ * for QueryVariableInfo() and SetVariable(), as these can be reached in NMI
+ * context through efi_pstore_write().
+ */
+
+/*
  * As per commit ef68c8f87ed1 ("x86: Serialize EFI time accesses on rtc_lock"),
  * the EFI specification requires that callers of the time related runtime
  * functions serialize with other CMOS accesses in the kernel, as the EFI time
@@ -32,7 +101,9 @@ static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
         efi_status_t status;
 
         spin_lock_irqsave(&rtc_lock, flags);
+        spin_lock(&efi_runtime_lock);
         status = efi_call_virt(get_time, tm, tc);
+        spin_unlock(&efi_runtime_lock);
         spin_unlock_irqrestore(&rtc_lock, flags);
         return status;
 }
@@ -43,7 +114,9 @@ static efi_status_t virt_efi_set_time(efi_time_t *tm)
         efi_status_t status;
 
         spin_lock_irqsave(&rtc_lock, flags);
+        spin_lock(&efi_runtime_lock);
         status = efi_call_virt(set_time, tm);
+        spin_unlock(&efi_runtime_lock);
         spin_unlock_irqrestore(&rtc_lock, flags);
         return status;
 }
@@ -56,7 +129,9 @@ static efi_status_t virt_efi_get_wakeup_time(efi_bool_t *enabled,
         efi_status_t status;
 
         spin_lock_irqsave(&rtc_lock, flags);
+        spin_lock(&efi_runtime_lock);
         status = efi_call_virt(get_wakeup_time, enabled, pending, tm);
+        spin_unlock(&efi_runtime_lock);
         spin_unlock_irqrestore(&rtc_lock, flags);
         return status;
 }
@@ -67,7 +142,9 @@ static efi_status_t virt_efi_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
         efi_status_t status;
 
         spin_lock_irqsave(&rtc_lock, flags);
+        spin_lock(&efi_runtime_lock);
         status = efi_call_virt(set_wakeup_time, enabled, tm);
+        spin_unlock(&efi_runtime_lock);
         spin_unlock_irqrestore(&rtc_lock, flags);
         return status;
 }
@@ -78,14 +155,27 @@ static efi_status_t virt_efi_get_variable(efi_char16_t *name,
                                           unsigned long *data_size,
                                           void *data)
 {
-        return efi_call_virt(get_variable, name, vendor, attr, data_size, data);
+        unsigned long flags;
+        efi_status_t status;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+        status = efi_call_virt(get_variable, name, vendor, attr, data_size,
+                               data);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+        return status;
 }
 
 static efi_status_t virt_efi_get_next_variable(unsigned long *name_size,
                                                efi_char16_t *name,
                                                efi_guid_t *vendor)
 {
-        return efi_call_virt(get_next_variable, name_size, name, vendor);
+        unsigned long flags;
+        efi_status_t status;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+        status = efi_call_virt(get_next_variable, name_size, name, vendor);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+        return status;
 }
 
 static efi_status_t virt_efi_set_variable(efi_char16_t *name,
@@ -94,24 +184,61 @@ static efi_status_t virt_efi_set_variable(efi_char16_t *name,
                                           unsigned long data_size,
                                           void *data)
 {
-        return efi_call_virt(set_variable, name, vendor, attr, data_size, data);
+        unsigned long flags;
+        efi_status_t status;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+        status = efi_call_virt(set_variable, name, vendor, attr, data_size,
+                               data);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+        return status;
 }
 
+static efi_status_t
+virt_efi_set_variable_nonblocking(efi_char16_t *name, efi_guid_t *vendor,
+                                  u32 attr, unsigned long data_size,
+                                  void *data)
+{
+        unsigned long flags;
+        efi_status_t status;
+
+        if (!spin_trylock_irqsave(&efi_runtime_lock, flags))
+                return EFI_NOT_READY;
+
+        status = efi_call_virt(set_variable, name, vendor, attr, data_size,
+                               data);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+        return status;
+}
+
+
 static efi_status_t virt_efi_query_variable_info(u32 attr,
                                                  u64 *storage_space,
                                                  u64 *remaining_space,
                                                  u64 *max_variable_size)
 {
+        unsigned long flags;
+        efi_status_t status;
+
         if (efi.runtime_version < EFI_2_00_SYSTEM_TABLE_REVISION)
                 return EFI_UNSUPPORTED;
 
-        return efi_call_virt(query_variable_info, attr, storage_space,
-                             remaining_space, max_variable_size);
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+        status = efi_call_virt(query_variable_info, attr, storage_space,
+                               remaining_space, max_variable_size);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+        return status;
 }
 
 static efi_status_t virt_efi_get_next_high_mono_count(u32 *count)
 {
-        return efi_call_virt(get_next_high_mono_count, count);
+        unsigned long flags;
+        efi_status_t status;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+        status = efi_call_virt(get_next_high_mono_count, count);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+        return status;
 }
 
 static void virt_efi_reset_system(int reset_type,
@@ -119,17 +246,27 @@ static void virt_efi_reset_system(int reset_type,
                                   unsigned long data_size,
                                   efi_char16_t *data)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&efi_runtime_lock, flags);
         __efi_call_virt(reset_system, reset_type, status, data_size, data);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
 }
 
 static efi_status_t virt_efi_update_capsule(efi_capsule_header_t **capsules,
                                             unsigned long count,
                                             unsigned long sg_list)
 {
+        unsigned long flags;
+        efi_status_t status;
+
         if (efi.runtime_version < EFI_2_00_SYSTEM_TABLE_REVISION)
                 return EFI_UNSUPPORTED;
 
-        return efi_call_virt(update_capsule, capsules, count, sg_list);
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+        status = efi_call_virt(update_capsule, capsules, count, sg_list);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+        return status;
 }
 
 static efi_status_t virt_efi_query_capsule_caps(efi_capsule_header_t **capsules,
@@ -137,11 +274,17 @@ static efi_status_t virt_efi_query_capsule_caps(efi_capsule_header_t **capsules,
                                                 u64 *max_size,
                                                 int *reset_type)
 {
+        unsigned long flags;
+        efi_status_t status;
+
         if (efi.runtime_version < EFI_2_00_SYSTEM_TABLE_REVISION)
                 return EFI_UNSUPPORTED;
 
-        return efi_call_virt(query_capsule_caps, capsules, count, max_size,
-                             reset_type);
+        spin_lock_irqsave(&efi_runtime_lock, flags);
+        status = efi_call_virt(query_capsule_caps, capsules, count, max_size,
+                               reset_type);
+        spin_unlock_irqrestore(&efi_runtime_lock, flags);
+        return status;
 }
 
 void efi_native_runtime_setup(void)
@@ -153,6 +296,7 @@ void efi_native_runtime_setup(void)
         efi.get_variable = virt_efi_get_variable;
         efi.get_next_variable = virt_efi_get_next_variable;
         efi.set_variable = virt_efi_set_variable;
+        efi.set_variable_nonblocking = virt_efi_set_variable_nonblocking;
         efi.get_next_high_mono_count = virt_efi_get_next_high_mono_count;
         efi.reset_system = virt_efi_reset_system;
         efi.query_variable_info = virt_efi_query_variable_info;
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 5abe943e3404..70a0fb10517f 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -321,11 +321,11 @@ static unsigned long var_name_strnsize(efi_char16_t *variable_name,
  * Print a warning when duplicate EFI variables are encountered and
  * disable the sysfs workqueue since the firmware is buggy.
  */
-static void dup_variable_bug(efi_char16_t *s16, efi_guid_t *vendor_guid,
+static void dup_variable_bug(efi_char16_t *str16, efi_guid_t *vendor_guid,
                              unsigned long len16)
 {
         size_t i, len8 = len16 / sizeof(efi_char16_t);
-        char *s8;
+        char *str8;
 
         /*
          * Disable the workqueue since the algorithm it uses for
@@ -334,16 +334,16 @@ static void dup_variable_bug(efi_char16_t *s16, efi_guid_t *vendor_guid,
          */
         efivar_wq_enabled = false;
 
-        s8 = kzalloc(len8, GFP_KERNEL);
-        if (!s8)
+        str8 = kzalloc(len8, GFP_KERNEL);
+        if (!str8)
                 return;
 
         for (i = 0; i < len8; i++)
-                s8[i] = s16[i];
+                str8[i] = str16[i];
 
         printk(KERN_WARNING "efivars: duplicate variable: %s-%pUl\n",
-               s8, vendor_guid);
-        kfree(s8);
+               str8, vendor_guid);
+        kfree(str8);
 }
 
 /**
@@ -595,6 +595,39 @@ int efivar_entry_set(struct efivar_entry *entry, u32 attributes,
 }
 EXPORT_SYMBOL_GPL(efivar_entry_set);
 
+/*
+ * efivar_entry_set_nonblocking - call set_variable_nonblocking()
+ *
+ * This function is guaranteed to not block and is suitable for calling
+ * from crash/panic handlers.
+ *
+ * Crucially, this function will not block if it cannot acquire
+ * __efivars->lock. Instead, it returns -EBUSY.
+ */
+static int
+efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
+                             u32 attributes, unsigned long size, void *data)
+{
+        const struct efivar_operations *ops = __efivars->ops;
+        unsigned long flags;
+        efi_status_t status;
+
+        if (!spin_trylock_irqsave(&__efivars->lock, flags))
+                return -EBUSY;
+
+        status = check_var_size(attributes, size + ucs2_strsize(name, 1024));
+        if (status != EFI_SUCCESS) {
+                spin_unlock_irqrestore(&__efivars->lock, flags);
+                return -ENOSPC;
+        }
+
+        status = ops->set_variable_nonblocking(name, &vendor, attributes,
+                                               size, data);
+
+        spin_unlock_irqrestore(&__efivars->lock, flags);
+        return efi_status_to_err(status);
+}
+
 /**
  * efivar_entry_set_safe - call set_variable() if enough space in firmware
  * @name: buffer containing the variable name
@@ -622,6 +655,20 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
         if (!ops->query_variable_store)
                 return -ENOSYS;
 
+        /*
+         * If the EFI variable backend provides a non-blocking
+         * ->set_variable() operation and we're in a context where we
+         * cannot block, then we need to use it to avoid live-locks,
+         * since the implication is that the regular ->set_variable()
+         * will block.
+         *
+         * If no ->set_variable_nonblocking() is provided then
+         * ->set_variable() is assumed to be non-blocking.
+         */
+        if (!block && ops->set_variable_nonblocking)
+                return efivar_entry_set_nonblocking(name, vendor, attributes,
+                                                    size, data);
+
         if (!block) {
                 if (!spin_trylock_irqsave(&__efivars->lock, flags))
                         return -EBUSY;
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 9a0cc09e6653..e4a1490b42c2 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -260,7 +260,7 @@ static void armada_drm_vblank_off(struct armada_crtc *dcrtc)
          * Tell the DRM core that vblank IRQs aren't going to happen for
          * a while.  This cleans up any pending vblank events for us.
          */
-        drm_vblank_off(dev, dcrtc->num);
+        drm_crtc_vblank_off(&dcrtc->crtc);
 
         /* Handle any pending flip event. */
         spin_lock_irq(&dev->event_lock);
@@ -289,6 +289,8 @@ static void armada_drm_crtc_dpms(struct drm_crtc *crtc, int dpms)
                 armada_drm_crtc_update(dcrtc);
                 if (dpms_blanked(dpms))
                         armada_drm_vblank_off(dcrtc);
+                else
+                        drm_crtc_vblank_on(&dcrtc->crtc);
         }
 }
 
@@ -526,7 +528,7 @@ static int armada_drm_crtc_mode_set(struct drm_crtc *crtc,
         /* Wait for pending flips to complete */
         wait_event(dcrtc->frame_wait, !dcrtc->frame_work);
 
-        drm_vblank_pre_modeset(crtc->dev, dcrtc->num);
+        drm_crtc_vblank_off(crtc);
 
         crtc->mode = *adj;
 
@@ -617,7 +619,7 @@ static int armada_drm_crtc_mode_set(struct drm_crtc *crtc,
 
         armada_drm_crtc_update(dcrtc);
 
-        drm_vblank_post_modeset(crtc->dev, dcrtc->num);
+        drm_crtc_vblank_on(crtc);
         armada_drm_crtc_finish_fb(dcrtc, old_fb, dpms_blanked(dcrtc->dpms));
 
         return 0;
@@ -945,18 +947,15 @@ static int armada_drm_crtc_page_flip(struct drm_crtc *crtc,
         armada_reg_queue_end(work->regs, i);
 
         /*
-         * Hold the old framebuffer for the work - DRM appears to drop our
-         * reference to the old framebuffer in drm_mode_page_flip_ioctl().
+         * Ensure that we hold a reference on the new framebuffer.
+         * This has to match the behaviour in mode_set.
          */
-        drm_framebuffer_reference(work->old_fb);
+        drm_framebuffer_reference(fb);
 
         ret = armada_drm_crtc_queue_frame_work(dcrtc, work);
         if (ret) {
-                /*
-                 * Undo our reference above; DRM does not drop the reference
-                 * to this object on error, so that's okay.
-                 */
-                drm_framebuffer_unreference(work->old_fb);
+                /* Undo our reference above */
+                drm_framebuffer_unreference(fb);
                 kfree(work);
                 return ret;
         }
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index f672e6ad8afa..908e5316eac4 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -190,6 +190,7 @@ static int armada_drm_load(struct drm_device *dev, unsigned long flags)
         if (ret)
                 goto err_comp;
 
+        dev->irq_enabled = true;
         dev->vblank_disable_allowed = 1;
 
         ret = armada_fbdev_init(dev);
@@ -331,7 +332,7 @@ static struct drm_driver armada_drm_driver = {
         .desc                   = "Armada SoC DRM",
         .date                   = "20120730",
         .driver_features        = DRIVER_GEM | DRIVER_MODESET |
-                                  DRIVER_PRIME,
+                                  DRIVER_HAVE_IRQ | DRIVER_PRIME,
         .ioctls                 = armada_ioctls,
         .fops                   = &armada_drm_fops,
 };
diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c
index e705335101a5..c2a1cba1e984 100644
--- a/drivers/gpu/drm/cirrus/cirrus_drv.c
+++ b/drivers/gpu/drm/cirrus/cirrus_drv.c
@@ -32,6 +32,8 @@ static struct drm_driver driver;
 static const struct pci_device_id pciidlist[] = {
         { PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5446, 0x1af4, 0x1100, 0,
           0, 0 },
+        { PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5446, PCI_VENDOR_ID_XEN,
+          0x0001, 0, 0, 0 },
         {0,}
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_dp_core.c b/drivers/gpu/drm/exynos/exynos_dp_core.c
index cd50ece31601..6adb1e5cfb08 100644
--- a/drivers/gpu/drm/exynos/exynos_dp_core.c
+++ b/drivers/gpu/drm/exynos/exynos_dp_core.c
@@ -1355,13 +1355,8 @@ static void exynos_dp_unbind(struct device *dev, struct device *master,
                                 void *data)
 {
         struct exynos_drm_display *display = dev_get_drvdata(dev);
-        struct exynos_dp_device *dp = display->ctx;
-        struct drm_encoder *encoder = dp->encoder;
 
         exynos_dp_dpms(display, DRM_MODE_DPMS_OFF);
-
-        exynos_dp_connector_destroy(&dp->connector);
-        encoder->funcs->destroy(encoder);
 }
 
 static const struct component_ops exynos_dp_ops = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 8e38e9f8e542..45026e693225 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -71,13 +71,16 @@ static void exynos_drm_crtc_dpms(struct drm_crtc *crtc, int mode)
                                 !atomic_read(&exynos_crtc->pending_flip),
                                 HZ/20))
                         atomic_set(&exynos_crtc->pending_flip, 0);
-                drm_vblank_off(crtc->dev, exynos_crtc->pipe);
+                drm_crtc_vblank_off(crtc);
         }
 
         if (manager->ops->dpms)
                 manager->ops->dpms(manager, mode);
 
         exynos_crtc->dpms = mode;
+
+        if (mode == DRM_MODE_DPMS_ON)
+                drm_crtc_vblank_on(crtc);
 }
 
 static void exynos_drm_crtc_prepare(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dpi.c b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
index 96c87db388fb..3dc678ed9949 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dpi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
@@ -338,14 +338,10 @@ err_del_component:
 
 int exynos_dpi_remove(struct device *dev)
 {
-        struct drm_encoder *encoder = exynos_dpi_display.encoder;
         struct exynos_dpi *ctx = exynos_dpi_display.ctx;
 
         exynos_dpi_dpms(&exynos_dpi_display, DRM_MODE_DPMS_OFF);
 
-        exynos_dpi_connector_destroy(&ctx->connector);
-        encoder->funcs->destroy(encoder);
-
         if (ctx->panel)
                 drm_panel_detach(ctx->panel);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 443a2069858a..e5c4c6c8c967 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -87,16 +87,12 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
 
                 plane = exynos_plane_init(dev, possible_crtcs,
                                           DRM_PLANE_TYPE_OVERLAY);
-                if (IS_ERR(plane))
-                        goto err_mode_config_cleanup;
-        }
-
-        /* init kms poll for handling hpd */
-        drm_kms_helper_poll_init(dev);
+                if (!IS_ERR(plane))
+                        continue;
 
-        ret = drm_vblank_init(dev, MAX_CRTC);
-        if (ret)
+                ret = PTR_ERR(plane);
                 goto err_mode_config_cleanup;
+        }
 
         /* setup possible_clones. */
         exynos_drm_encoder_setup(dev);
@@ -106,15 +102,16 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
         /* Try to bind all sub drivers. */
         ret = component_bind_all(dev->dev, dev);
         if (ret)
-                goto err_cleanup_vblank;
+                goto err_mode_config_cleanup;
 
-        /* Probe non kms sub drivers and virtual display driver. */
-        ret = exynos_drm_device_subdrv_probe(dev);
+        ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
         if (ret)
                 goto err_unbind_all;
 
-        /* force connectors detection */
-        drm_helper_hpd_irq_event(dev);
+        /* Probe non kms sub drivers and virtual display driver. */
+        ret = exynos_drm_device_subdrv_probe(dev);
+        if (ret)
+                goto err_cleanup_vblank;
 
         /*
          * enable drm irq mode.
@@ -133,12 +130,18 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
          */
         dev->vblank_disable_allowed = true;
 
+        /* init kms poll for handling hpd */
+        drm_kms_helper_poll_init(dev);
+
+        /* force connectors detection */
+        drm_helper_hpd_irq_event(dev);
+
         return 0;
 
-err_unbind_all:
-        component_unbind_all(dev->dev, dev);
 err_cleanup_vblank:
         drm_vblank_cleanup(dev);
+err_unbind_all:
+        component_unbind_all(dev->dev, dev);
 err_mode_config_cleanup:
         drm_mode_config_cleanup(dev);
         drm_release_iommu_mapping(dev);
@@ -155,8 +158,8 @@ static int exynos_drm_unload(struct drm_device *dev)
         exynos_drm_fbdev_fini(dev);
         drm_kms_helper_poll_fini(dev);
 
-        component_unbind_all(dev->dev, dev);
         drm_vblank_cleanup(dev);
+        component_unbind_all(dev->dev, dev);
         drm_mode_config_cleanup(dev);
         drm_release_iommu_mapping(dev);
 
@@ -191,8 +194,12 @@ static int exynos_drm_resume(struct drm_device *dev)
 
         drm_modeset_lock_all(dev);
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                if (connector->funcs->dpms)
-                        connector->funcs->dpms(connector, connector->dpms);
+                if (connector->funcs->dpms) {
+                        int dpms = connector->dpms;
+
+                        connector->dpms = DRM_MODE_DPMS_OFF;
+                        connector->funcs->dpms(connector, dpms);
+                }
         }
         drm_modeset_unlock_all(dev);
 
@@ -488,6 +495,12 @@ static struct component_match *exynos_drm_match_add(struct device *dev)
 
         mutex_lock(&drm_component_lock);
 
+        /* Do not retry to probe if there is no any kms driver regitered. */
+        if (list_empty(&drm_component_list)) {
+                mutex_unlock(&drm_component_lock);
+                return ERR_PTR(-ENODEV);
+        }
+
         list_for_each_entry(cdev, &drm_component_list, list) {
                 /*
                  * Add components to master only in case that crtc and
@@ -578,10 +591,21 @@ static int exynos_drm_platform_probe(struct platform_device *pdev)
                 goto err_unregister_mixer_drv;
 #endif
 
+        match = exynos_drm_match_add(&pdev->dev);
+        if (IS_ERR(match)) {
+                ret = PTR_ERR(match);
+                goto err_unregister_hdmi_drv;
+        }
+
+        ret = component_master_add_with_match(&pdev->dev, &exynos_drm_ops,
+                                                match);
+        if (ret < 0)
+                goto err_unregister_hdmi_drv;
+
 #ifdef CONFIG_DRM_EXYNOS_G2D
         ret = platform_driver_register(&g2d_driver);
         if (ret < 0)
-                goto err_unregister_hdmi_drv;
+                goto err_del_component_master;
 #endif
 
 #ifdef CONFIG_DRM_EXYNOS_FIMC
@@ -612,23 +636,9 @@ static int exynos_drm_platform_probe(struct platform_device *pdev)
                 goto err_unregister_ipp_drv;
 #endif
 
-        match = exynos_drm_match_add(&pdev->dev);
-        if (IS_ERR(match)) {
-                ret = PTR_ERR(match);
-                goto err_unregister_resources;
-        }
-
-        ret = component_master_add_with_match(&pdev->dev, &exynos_drm_ops,
-                                                match);
-        if (ret < 0)
-                goto err_unregister_resources;
-
         return ret;
 
-err_unregister_resources:
-
 #ifdef CONFIG_DRM_EXYNOS_IPP
-        exynos_platform_device_ipp_unregister();
 err_unregister_ipp_drv:
         platform_driver_unregister(&ipp_driver);
 err_unregister_gsc_drv:
@@ -651,9 +661,11 @@ err_unregister_g2d_drv:
 
 #ifdef CONFIG_DRM_EXYNOS_G2D
         platform_driver_unregister(&g2d_driver);
-err_unregister_hdmi_drv:
+err_del_component_master:
 #endif
+        component_master_del(&pdev->dev, &exynos_drm_ops);
 
+err_unregister_hdmi_drv:
 #ifdef CONFIG_DRM_EXYNOS_HDMI
         platform_driver_unregister(&hdmi_driver);
 err_unregister_mixer_drv:
@@ -734,6 +746,18 @@ static int exynos_drm_init(void)
 {
         int ret;
 
+        /*
+         * Register device object only in case of Exynos SoC.
+         *
+         * Below codes resolves temporarily infinite loop issue incurred
+         * by Exynos drm driver when using multi-platform kernel.
+         * So these codes will be replaced with more generic way later.
+         */
+        if (!of_machine_is_compatible("samsung,exynos3") &&
+                        !of_machine_is_compatible("samsung,exynos4") &&
+                        !of_machine_is_compatible("samsung,exynos5"))
+                return -ENODEV;
+
         exynos_drm_pdev = platform_device_register_simple("exynos-drm", -1,
                                                                 NULL, 0);
         if (IS_ERR(exynos_drm_pdev))
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 24741d8758e8..acf7e9e39dcd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1660,13 +1660,9 @@ static void exynos_dsi_unbind(struct device *dev, struct device *master,
                                 void *data)
 {
         struct exynos_dsi *dsi = exynos_dsi_display.ctx;
-        struct drm_encoder *encoder = dsi->encoder;
 
         exynos_dsi_dpms(&exynos_dsi_display, DRM_MODE_DPMS_OFF);
 
-        exynos_dsi_connector_destroy(&dsi->connector);
-        encoder->funcs->destroy(encoder);
-
         mipi_dsi_host_unregister(&dsi->dsi_host);
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index df7a77d3eff8..6ff8599f6cbf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -302,9 +302,12 @@ static void g2d_fini_cmdlist(struct g2d_data *g2d)
         struct exynos_drm_subdrv *subdrv = &g2d->subdrv;
 
         kfree(g2d->cmdlist_node);
-        dma_free_attrs(subdrv->drm_dev->dev, G2D_CMDLIST_POOL_SIZE,
-                        g2d->cmdlist_pool_virt,
-                        g2d->cmdlist_pool, &g2d->cmdlist_dma_attrs);
+
+        if (g2d->cmdlist_pool_virt && g2d->cmdlist_pool) {
+                dma_free_attrs(subdrv->drm_dev->dev, G2D_CMDLIST_POOL_SIZE,
+                                g2d->cmdlist_pool_virt,
+                                g2d->cmdlist_pool, &g2d->cmdlist_dma_attrs);
+        }
 }
 
 static struct g2d_cmdlist_node *g2d_get_cmdlist(struct g2d_data *g2d)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index d565207040a2..50faf913e574 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -630,7 +630,6 @@ static int vidi_remove(struct platform_device *pdev)
 {
         struct exynos_drm_manager *mgr = platform_get_drvdata(pdev);
         struct vidi_context *ctx = mgr->ctx;
-        struct drm_encoder *encoder = ctx->encoder;
 
         if (ctx->raw_edid != (struct edid *)fake_edid_info) {
                 kfree(ctx->raw_edid);
@@ -639,9 +638,6 @@ static int vidi_remove(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        encoder->funcs->destroy(encoder);
-        drm_connector_cleanup(&ctx->connector);
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 7910fb37d9bb..563a19e62eb2 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2312,12 +2312,6 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
 
 static void hdmi_unbind(struct device *dev, struct device *master, void *data)
 {
-        struct exynos_drm_display *display = get_hdmi_display(dev);
-        struct drm_encoder *encoder = display->encoder;
-        struct hdmi_context *hdata = display->ctx;
-
-        hdmi_connector_destroy(&hdata->connector);
-        encoder->funcs->destroy(encoder);
 }
 
 static const struct component_ops hdmi_component_ops = {
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 1403b01e8216..318ade9bb5af 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1670,15 +1670,17 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                 goto out_regs;
 
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                ret = i915_kick_out_vgacon(dev_priv);
+                /* WARNING: Apparently we must kick fbdev drivers before vgacon,
+                 * otherwise the vga fbdev driver falls over. */
+                ret = i915_kick_out_firmware_fb(dev_priv);
                 if (ret) {
-                        DRM_ERROR("failed to remove conflicting VGA console\n");
+                        DRM_ERROR("failed to remove conflicting framebuffer drivers\n");
                         goto out_gtt;
                 }
 
-                ret = i915_kick_out_firmware_fb(dev_priv);
+                ret = i915_kick_out_vgacon(dev_priv);
                 if (ret) {
-                        DRM_ERROR("failed to remove conflicting framebuffer drivers\n");
+                        DRM_ERROR("failed to remove conflicting VGA console\n");
                         goto out_gtt;
                 }
         }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 055d5e7fbf12..2318b4c7a8f8 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -986,6 +986,15 @@ static int i915_pm_freeze(struct device *dev)
         return i915_drm_freeze(drm_dev);
 }
 
+static int i915_pm_freeze_late(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        struct drm_i915_private *dev_priv = drm_dev->dev_private;
+
+        return intel_suspend_complete(dev_priv);
+}
+
 static int i915_pm_thaw_early(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -1570,6 +1579,7 @@ static const struct dev_pm_ops i915_pm_ops = {
         .resume_early = i915_pm_resume_early,
         .resume = i915_pm_resume,
         .freeze = i915_pm_freeze,
+        .freeze_late = i915_pm_freeze_late,
         .thaw_early = i915_pm_thaw_early,
         .thaw = i915_pm_thaw,
         .poweroff = i915_pm_poweroff,
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index b672b843fd5e..728938f02341 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1902,6 +1902,22 @@ static void bdw_setup_private_ppat(struct drm_i915_private *dev_priv)
               GEN8_PPAT(6, GEN8_PPAT_WB | GEN8_PPAT_LLCELLC | GEN8_PPAT_AGE(2)) |
               GEN8_PPAT(7, GEN8_PPAT_WB | GEN8_PPAT_LLCELLC | GEN8_PPAT_AGE(3));
 
+        if (!USES_PPGTT(dev_priv->dev))
+                /* Spec: "For GGTT, there is NO pat_sel[2:0] from the entry,
+                 * so RTL will always use the value corresponding to
+                 * pat_sel = 000".
+                 * So let's disable cache for GGTT to avoid screen corruptions.
+                 * MOCS still can be used though.
+                 * - System agent ggtt writes (i.e. cpu gtt mmaps) already work
+                 * before this patch, i.e. the same uncached + snooping access
+                 * like on gen6/7 seems to be in effect.
+                 * - So this just fixes blitter/render access. Again it looks
+                 * like it's not just uncached access, but uncached + snooping.
+                 * So we can still hold onto all our assumptions wrt cpu
+                 * clflushing on LLC machines.
+                 */
+                pat = GEN8_PPAT(0, GEN8_PPAT_UC);
+
         /* XXX: spec defines this as 2 distinct registers. It's unclear if a 64b
          * write would work. */
         I915_WRITE(GEN8_PRIVATE_PAT, pat);
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 2cefb597df6d..2b1eaa29ada4 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -364,22 +364,9 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                  * has to also include the unfenced register the GPU uses
                  * whilst executing a fenced command for an untiled object.
                  */
-
-                obj->map_and_fenceable =
-                        !i915_gem_obj_ggtt_bound(obj) ||
-                        (i915_gem_obj_ggtt_offset(obj) +
-                         obj->base.size <= dev_priv->gtt.mappable_end &&
-                         i915_gem_object_fence_ok(obj, args->tiling_mode));
-
-                /* Rebind if we need a change of alignment */
-                if (!obj->map_and_fenceable) {
-                        u32 unfenced_align =
-                                i915_gem_get_gtt_alignment(dev, obj->base.size,
-                                                            args->tiling_mode,
-                                                            false);
-                        if (i915_gem_obj_ggtt_offset(obj) & (unfenced_align - 1))
-                                ret = i915_gem_object_ggtt_unbind(obj);
-                }
+                if (obj->map_and_fenceable &&
+                    !i915_gem_object_fence_ok(obj, args->tiling_mode))
+                        ret = i915_gem_object_ggtt_unbind(obj);
 
                 if (ret == 0) {
                         obj->fence_dirty =
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 3201986bf25e..f66392b6e287 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1711,7 +1711,7 @@ static irqreturn_t gen8_gt_irq_handler(struct drm_device *dev,
 #define HPD_STORM_DETECT_PERIOD 1000
 #define HPD_STORM_THRESHOLD 5
 
-static int ilk_port_to_hotplug_shift(enum port port)
+static int pch_port_to_hotplug_shift(enum port port)
 {
         switch (port) {
         case PORT_A:
@@ -1727,7 +1727,7 @@ static int ilk_port_to_hotplug_shift(enum port port)
         }
 }
 
-static int g4x_port_to_hotplug_shift(enum port port)
+static int i915_port_to_hotplug_shift(enum port port)
 {
         switch (port) {
         case PORT_A:
@@ -1785,12 +1785,12 @@ static inline void intel_hpd_irq_handler(struct drm_device *dev,
                 if (port && dev_priv->hpd_irq_port[port]) {
                         bool long_hpd;
 
-                        if (IS_G4X(dev)) {
-                                dig_shift = g4x_port_to_hotplug_shift(port);
-                                long_hpd = (hotplug_trigger >> dig_shift) & PORTB_HOTPLUG_LONG_DETECT;
-                        } else {
-                                dig_shift = ilk_port_to_hotplug_shift(port);
+                        if (HAS_PCH_SPLIT(dev)) {
+                                dig_shift = pch_port_to_hotplug_shift(port);
                                 long_hpd = (dig_hotplug_reg >> dig_shift) & PORTB_HOTPLUG_LONG_DETECT;
+                        } else {
+                                dig_shift = i915_port_to_hotplug_shift(port);
+                                long_hpd = (hotplug_trigger >> dig_shift) & PORTB_HOTPLUG_LONG_DETECT;
                         }
 
                         DRM_DEBUG_DRIVER("digital hpd port %c - %s\n",
@@ -3458,12 +3458,13 @@ static void gen8_irq_reset(struct drm_device *dev)
 void gen8_irq_power_well_post_enable(struct drm_i915_private *dev_priv)
 {
         unsigned long irqflags;
+        uint32_t extra_ier = GEN8_PIPE_VBLANK | GEN8_PIPE_FIFO_UNDERRUN;
 
         spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
         GEN8_IRQ_INIT_NDX(DE_PIPE, PIPE_B, dev_priv->de_irq_mask[PIPE_B],
-                          ~dev_priv->de_irq_mask[PIPE_B]);
+                          ~dev_priv->de_irq_mask[PIPE_B] | extra_ier);
         GEN8_IRQ_INIT_NDX(DE_PIPE, PIPE_C, dev_priv->de_irq_mask[PIPE_C],
-                          ~dev_priv->de_irq_mask[PIPE_C]);
+                          ~dev_priv->de_irq_mask[PIPE_C] | extra_ier);
         spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 507370513f3d..9cb5c95d5898 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -73,9 +73,6 @@ static const uint32_t intel_cursor_formats[] = {
         DRM_FORMAT_ARGB8888,
 };
 
-#define DIV_ROUND_CLOSEST_ULL(ll, d)    \
-({ unsigned long long _tmp = (ll)+(d)/2; do_div(_tmp, d); _tmp; })
-
 static void intel_increase_pllclock(struct drm_device *dev,
                                     enum pipe pipe);
 static void intel_crtc_update_cursor(struct drm_crtc *crtc, bool on);
@@ -4328,7 +4325,6 @@ static void ironlake_crtc_disable(struct drm_crtc *crtc)
                 ironlake_fdi_disable(crtc);
 
                 ironlake_disable_pch_transcoder(dev_priv, pipe);
-                intel_set_pch_fifo_underrun_reporting(dev, pipe, true);
 
                 if (HAS_PCH_CPT(dev)) {
                         /* disable TRANS_DP_CTL */
@@ -4392,7 +4388,6 @@ static void haswell_crtc_disable(struct drm_crtc *crtc)
 
         if (intel_crtc->config.has_pch_encoder) {
                 lpt_disable_pch_transcoder(dev_priv);
-                intel_set_pch_fifo_underrun_reporting(dev, TRANSCODER_A, true);
                 intel_ddi_fdi_disable(crtc);
         }
 
@@ -4588,7 +4583,7 @@ static void vlv_update_cdclk(struct drm_device *dev)
          * BSpec erroneously claims we should aim for 4MHz, but
          * in fact 1MHz is the correct frequency.
          */
-        I915_WRITE(GMBUSFREQ_VLV, dev_priv->vlv_cdclk_freq);
+        I915_WRITE(GMBUSFREQ_VLV, DIV_ROUND_UP(dev_priv->vlv_cdclk_freq, 1000));
 }
 
 /* Adjust CDclk dividers to allow high res or save power if possible */
@@ -9411,6 +9406,10 @@ static bool page_flip_finished(struct intel_crtc *crtc)
         struct drm_device *dev = crtc->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
 
+        if (i915_reset_in_progress(&dev_priv->gpu_error) ||
+            crtc->reset_counter != atomic_read(&dev_priv->gpu_error.reset_counter))
+                return true;
+
         /*
          * The relevant registers doen't exist on pre-ctg.
          * As the flip done interrupt doesn't trigger for mmio
@@ -12357,27 +12356,36 @@ static void intel_setup_outputs(struct drm_device *dev)
                 if (I915_READ(PCH_DP_D) & DP_DETECTED)
                         intel_dp_init(dev, PCH_DP_D, PORT_D);
         } else if (IS_VALLEYVIEW(dev)) {
-                if (I915_READ(VLV_DISPLAY_BASE + GEN4_HDMIB) & SDVO_DETECTED) {
+                /*
+                 * The DP_DETECTED bit is the latched state of the DDC
+                 * SDA pin at boot. However since eDP doesn't require DDC
+                 * (no way to plug in a DP->HDMI dongle) the DDC pins for
+                 * eDP ports may have been muxed to an alternate function.
+                 * Thus we can't rely on the DP_DETECTED bit alone to detect
+                 * eDP ports. Consult the VBT as well as DP_DETECTED to
+                 * detect eDP ports.
+                 */
+                if (I915_READ(VLV_DISPLAY_BASE + GEN4_HDMIB) & SDVO_DETECTED)
                         intel_hdmi_init(dev, VLV_DISPLAY_BASE + GEN4_HDMIB,
                                         PORT_B);
-                        if (I915_READ(VLV_DISPLAY_BASE + DP_B) & DP_DETECTED)
-                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_B, PORT_B);
-                }
+                if (I915_READ(VLV_DISPLAY_BASE + DP_B) & DP_DETECTED ||
+                    intel_dp_is_edp(dev, PORT_B))
+                        intel_dp_init(dev, VLV_DISPLAY_BASE + DP_B, PORT_B);
 
-                if (I915_READ(VLV_DISPLAY_BASE + GEN4_HDMIC) & SDVO_DETECTED) {
+                if (I915_READ(VLV_DISPLAY_BASE + GEN4_HDMIC) & SDVO_DETECTED)
                         intel_hdmi_init(dev, VLV_DISPLAY_BASE + GEN4_HDMIC,
                                         PORT_C);
-                        if (I915_READ(VLV_DISPLAY_BASE + DP_C) & DP_DETECTED)
-                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_C, PORT_C);
-                }
+                if (I915_READ(VLV_DISPLAY_BASE + DP_C) & DP_DETECTED ||
+                    intel_dp_is_edp(dev, PORT_C))
+                        intel_dp_init(dev, VLV_DISPLAY_BASE + DP_C, PORT_C);
 
                 if (IS_CHERRYVIEW(dev)) {
-                        if (I915_READ(VLV_DISPLAY_BASE + CHV_HDMID) & SDVO_DETECTED) {
+                        if (I915_READ(VLV_DISPLAY_BASE + CHV_HDMID) & SDVO_DETECTED)
                                 intel_hdmi_init(dev, VLV_DISPLAY_BASE + CHV_HDMID,
                                                 PORT_D);
-                                if (I915_READ(VLV_DISPLAY_BASE + DP_D) & DP_DETECTED)
-                                        intel_dp_init(dev, VLV_DISPLAY_BASE + DP_D, PORT_D);
-                        }
+                        /* eDP not supported on port D, so don't check VBT */
+                        if (I915_READ(VLV_DISPLAY_BASE + DP_D) & DP_DETECTED)
+                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_D, PORT_D);
                 }
 
                 intel_dsi_init(dev);
@@ -12879,6 +12887,9 @@ static struct intel_quirk intel_quirks[] = {
         /* Acer C720 Chromebook (Core i3 4005U) */
         { 0x0a16, 0x1025, 0x0a11, quirk_backlight_present },
 
+        /* Apple Macbook 2,1 (Core 2 T7400) */
+        { 0x27a2, 0x8086, 0x7270, quirk_backlight_present },
+
         /* Toshiba CB35 Chromebook (Celeron 2955U) */
         { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index f6a3fdd5589e..4bcd91757321 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2806,6 +2806,13 @@ intel_dp_dpcd_read_wake(struct drm_dp_aux *aux, unsigned int offset,
         ssize_t ret;
         int i;
 
+        /*
+         * Sometime we just get the same incorrect byte repeated
+         * over the entire buffer. Doing just one throw away read
+         * initially seems to "solve" it.
+         */
+        drm_dp_dpcd_read(aux, DP_DPCD_REV, buffer, 1);
+
         for (i = 0; i < 3; i++) {
                 ret = drm_dp_dpcd_read(aux, offset, buffer, size);
                 if (ret == size)
@@ -3724,9 +3731,10 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)
                 }
         }
 
-        /* Training Pattern 3 support */
+        /* Training Pattern 3 support, both source and sink */
         if (intel_dp->dpcd[DP_DPCD_REV] >= 0x12 &&
-            intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED) {
+            intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED &&
+            (IS_HASWELL(dev_priv) || INTEL_INFO(dev_priv)->gen >= 8)) {
                 intel_dp->use_tps3 = true;
                 DRM_DEBUG_KMS("Displayport TPS3 supported\n");
         } else
@@ -4442,6 +4450,7 @@ static void intel_dp_encoder_suspend(struct intel_encoder *intel_encoder)
          * vdd might still be enabled do to the delayed vdd off.
          * Make sure vdd is actually turned off here.
          */
+        cancel_delayed_work_sync(&intel_dp->panel_vdd_work);
         pps_lock(intel_dp);
         edp_panel_vdd_off_sync(intel_dp);
         pps_unlock(intel_dp);
@@ -4491,6 +4500,18 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
         if (intel_dig_port->base.type != INTEL_OUTPUT_EDP)
                 intel_dig_port->base.type = INTEL_OUTPUT_DISPLAYPORT;
 
+        if (long_hpd && intel_dig_port->base.type == INTEL_OUTPUT_EDP) {
+                /*
+                 * vdd off can generate a long pulse on eDP which
+                 * would require vdd on to handle it, and thus we
+                 * would end up in an endless cycle of
+                 * "vdd off -> long hpd -> vdd on -> detect -> vdd off -> ..."
+                 */
+                DRM_DEBUG_KMS("ignoring long hpd on eDP port %c\n",
+                              port_name(intel_dig_port->port));
+                return false;
+        }
+
         DRM_DEBUG_KMS("got hpd irq on port %c - %s\n",
                       port_name(intel_dig_port->port),
                       long_hpd ? "long" : "short");
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 07ce04683c30..ba715229a540 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -35,6 +35,9 @@
 #include <drm/drm_fb_helper.h>
 #include <drm/drm_dp_mst_helper.h>
 
+#define DIV_ROUND_CLOSEST_ULL(ll, d)    \
+({ unsigned long long _tmp = (ll)+(d)/2; do_div(_tmp, d); _tmp; })
+
 /**
  * _wait_for - magic (register) wait macro
  *
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index a6bd1422e38f..c0bbf2172446 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -899,6 +899,17 @@ void intel_lvds_init(struct drm_device *dev)
         int pipe;
         u8 pin;
 
+        /*
+         * Unlock registers and just leave them unlocked. Do this before
+         * checking quirk lists to avoid bogus WARNINGs.
+         */
+        if (HAS_PCH_SPLIT(dev)) {
+                I915_WRITE(PCH_PP_CONTROL,
+                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+        } else {
+                I915_WRITE(PP_CONTROL,
+                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
+        }
         if (!intel_lvds_supported(dev))
                 return;
 
@@ -1097,17 +1108,6 @@ out:
         lvds_encoder->a3_power = I915_READ(lvds_encoder->reg) &
                                  LVDS_A3_POWER_MASK;
 
-        /*
-         * Unlock registers and just
-         * leave them unlocked
-         */
-        if (HAS_PCH_SPLIT(dev)) {
-                I915_WRITE(PCH_PP_CONTROL,
-                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
-        } else {
-                I915_WRITE(PP_CONTROL,
-                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
-        }
         lvds_connector->lid_notifier.notifier_call = intel_lid_notify;
         if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) {
                 DRM_DEBUG_KMS("lid notifier registration failed\n");
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 18784470a760..41b3be217493 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -419,9 +419,8 @@ static uint32_t scale(uint32_t source_val,
         source_val = clamp(source_val, source_min, source_max);
 
         /* avoid overflows */
-        target_val = (uint64_t)(source_val - source_min) *
-                (target_max - target_min);
-        do_div(target_val, source_max - source_min);
+        target_val = DIV_ROUND_CLOSEST_ULL((uint64_t)(source_val - source_min) *
+                        (target_max - target_min), source_max - source_min);
         target_val += target_min;
 
         return target_val;
@@ -1099,12 +1098,25 @@ static u32 get_backlight_min_vbt(struct intel_connector *connector)
         struct drm_device *dev = connector->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_panel *panel = &connector->panel;
+        int min;
 
         WARN_ON(panel->backlight.max == 0);
 
+        /*
+         * XXX: If the vbt value is 255, it makes min equal to max, which leads
+         * to problems. There are such machines out there. Either our
+         * interpretation is wrong or the vbt has bogus data. Or both. Safeguard
+         * against this by letting the minimum be at most (arbitrarily chosen)
+         * 25% of the max.
+         */
+        min = clamp_t(int, dev_priv->vbt.backlight.min_brightness, 0, 64);
+        if (min != dev_priv->vbt.backlight.min_brightness) {
+                DRM_DEBUG_KMS("clamping VBT min backlight %d/255 to %d/255\n",
+                              dev_priv->vbt.backlight.min_brightness, min);
+        }
+
         /* vbt value is a coefficient in range [0..255] */
-        return scale(dev_priv->vbt.backlight.min_brightness, 0, 255,
-                     0, panel->backlight.max);
+        return scale(min, 0, 255, 0, panel->backlight.max);
 }
 
 static int bdw_setup_backlight(struct intel_connector *connector)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index c27b6140bfd1..ad2fd605f76b 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5469,11 +5469,6 @@ static void gen6_init_clock_gating(struct drm_device *dev)
         I915_WRITE(_3D_CHICKEN,
                    _MASKED_BIT_ENABLE(_3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB));
 
-        /* WaSetupGtModeTdRowDispatch:snb */
-        if (IS_SNB_GT1(dev))
-                I915_WRITE(GEN6_GT_MODE,
-                           _MASKED_BIT_ENABLE(GEN6_TD_FOUR_ROW_DISPATCH_DISABLE));
-
         /* WaDisable_RenderCache_OperationalFlush:snb */
         I915_WRITE(CACHE_MODE_0, _MASKED_BIT_DISABLE(RC_OP_FLUSH_ENABLE));
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
index cd05677ad4b7..72a40f95d048 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
@@ -218,7 +218,6 @@ nvc0_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_ENGINE_BSP    ] = &nvc0_bsp_oclass;
                 device->oclass[NVDEV_ENGINE_PPP    ] = &nvc0_ppp_oclass;
                 device->oclass[NVDEV_ENGINE_COPY0  ] = &nvc0_copy0_oclass;
-                device->oclass[NVDEV_ENGINE_COPY1  ] = &nvc0_copy1_oclass;
                 device->oclass[NVDEV_ENGINE_DISP   ] =  nva3_disp_oclass;
                 device->oclass[NVDEV_ENGINE_PERFMON] = &nvc0_perfmon_oclass;
                 break;
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv04.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv04.c
index 5ae6a43893b5..1931057f9962 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv04.c
@@ -551,8 +551,8 @@ nv04_fifo_intr(struct nouveau_subdev *subdev)
                         }
 
                         if (status & 0x40000000) {
-                                nouveau_fifo_uevent(&priv->base);
                                 nv_wr32(priv, 0x002100, 0x40000000);
+                                nouveau_fifo_uevent(&priv->base);
                                 status &= ~0x40000000;
                         }
                 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nvc0.c
index 1fe1f8fbda0c..074d434c3077 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nvc0.c
@@ -740,6 +740,8 @@ nvc0_fifo_intr_engine_unit(struct nvc0_fifo_priv *priv, int engn)
         u32 inte = nv_rd32(priv, 0x002628);
         u32 unkn;
 
+        nv_wr32(priv, 0x0025a8 + (engn * 0x04), intr);
+
         for (unkn = 0; unkn < 8; unkn++) {
                 u32 ints = (intr >> (unkn * 0x04)) & inte;
                 if (ints & 0x1) {
@@ -751,8 +753,6 @@ nvc0_fifo_intr_engine_unit(struct nvc0_fifo_priv *priv, int engn)
                         nv_mask(priv, 0x002628, ints, 0);
                 }
         }
-
-        nv_wr32(priv, 0x0025a8 + (engn * 0x04), intr);
 }
 
 static void
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
index d2f0fd39c145..f8734eb74eaa 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
@@ -952,8 +952,8 @@ nve0_fifo_intr(struct nouveau_subdev *subdev)
         }
 
         if (stat & 0x80000000) {
-                nve0_fifo_intr_engine(priv);
                 nv_wr32(priv, 0x002100, 0x80000000);
+                nve0_fifo_intr_engine(priv);
                 stat &= ~0x80000000;
         }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv50.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv50.c
index 552fdbd45ebe..1d0e33fb5f61 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv50.c
@@ -113,6 +113,8 @@
 #define IS_NVA3F(x) (((x) > 0xa0 && (x) < 0xaa) || (x) == 0xaf)
 #define IS_NVAAF(x) ((x) >= 0xaa && (x) <= 0xac)
 
+#include <subdev/fb.h>
+
 /*
  * This code deals with PGRAPH contexts on NV50 family cards. Like NV40, it's
  * the GPU itself that does context-switching, but it needs a special
@@ -569,8 +571,12 @@ nv50_graph_construct_mmio(struct nouveau_grctx *ctx)
                         gr_def(ctx, 0x407d08, 0x00010040);
                 else if (device->chipset < 0xa0)
                         gr_def(ctx, 0x407d08, 0x00390040);
-                else
-                        gr_def(ctx, 0x407d08, 0x003d0040);
+                else {
+                        if (nouveau_fb(device)->ram->type != NV_MEM_TYPE_GDDR5)
+                                gr_def(ctx, 0x407d08, 0x003d0040);
+                        else
+                                gr_def(ctx, 0x407d08, 0x003c0040);
+                }
                 gr_def(ctx, 0x407d0c, 0x00000022);
         }
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c b/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
index a16024a74771..fde42e4d1b56 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
@@ -27,6 +27,20 @@ struct gk20a_fb_priv {
 };
 
 static int
+gk20a_fb_init(struct nouveau_object *object)
+{
+        struct gk20a_fb_priv *priv = (void *)object;
+        int ret;
+
+        ret = nouveau_fb_init(&priv->base);
+        if (ret)
+                return ret;
+
+        nv_mask(priv, 0x100c80, 0x00000001, 0x00000000); /* 128KiB lpg */
+        return 0;
+}
+
+static int
 gk20a_fb_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
              struct nouveau_oclass *oclass, void *data, u32 size,
              struct nouveau_object **pobject)
@@ -48,7 +62,7 @@ gk20a_fb_oclass = &(struct nouveau_fb_impl) {
         .base.ofuncs = &(struct nouveau_ofuncs) {
                 .ctor = gk20a_fb_ctor,
                 .dtor = _nouveau_fb_dtor,
-                .init = _nouveau_fb_init,
+                .init = gk20a_fb_init,
                 .fini = _nouveau_fb_fini,
         },
         .memtype = nvc0_fb_memtype_valid,
diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.c b/drivers/gpu/drm/nouveau/nouveau_chan.c
index 589dbb582da2..fd3dbd59d73e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_chan.c
+++ b/drivers/gpu/drm/nouveau/nouveau_chan.c
@@ -400,15 +400,20 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device,
                     struct nouveau_channel **pchan)
 {
         struct nouveau_cli *cli = (void *)nvif_client(&device->base);
+        bool super;
         int ret;
 
+        /* hack until fencenv50 is fixed, and agp access relaxed */
+        super = cli->base.super;
+        cli->base.super = true;
+
         ret = nouveau_channel_ind(drm, device, handle, arg0, pchan);
         if (ret) {
                 NV_PRINTK(debug, cli, "ib channel create, %d\n", ret);
                 ret = nouveau_channel_dma(drm, device, handle, pchan);
                 if (ret) {
                         NV_PRINTK(debug, cli, "dma channel create, %d\n", ret);
-                        return ret;
+                        goto done;
                 }
         }
 
@@ -416,8 +421,9 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device,
         if (ret) {
                 NV_PRINTK(error, cli, "channel failed to initialise, %d\n", ret);
                 nouveau_channel_del(pchan);
-                return ret;
         }
 
-        return 0;
+done:
+        cli->base.super = super;
+        return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 57238076049f..62b97c4eef8d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -629,7 +629,6 @@ int nouveau_pmops_suspend(struct device *dev)
 
         pci_save_state(pdev);
         pci_disable_device(pdev);
-        pci_ignore_hotplug(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
         return 0;
 }
@@ -933,6 +932,7 @@ static int nouveau_pmops_runtime_suspend(struct device *dev)
         ret = nouveau_do_suspend(drm_dev, true);
         pci_save_state(pdev);
         pci_disable_device(pdev);
+        pci_ignore_hotplug(pdev);
         pci_set_power_state(pdev, PCI_D3cold);
         drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
         return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 515cd9aebb99..f32a434724e3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -52,20 +52,24 @@ nouveau_fctx(struct nouveau_fence *fence)
         return container_of(fence->base.lock, struct nouveau_fence_chan, lock);
 }
 
-static void
+static int
 nouveau_fence_signal(struct nouveau_fence *fence)
 {
+        int drop = 0;
+
         fence_signal_locked(&fence->base);
         list_del(&fence->head);
+        rcu_assign_pointer(fence->channel, NULL);
 
         if (test_bit(FENCE_FLAG_USER_BITS, &fence->base.flags)) {
                 struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
 
                 if (!--fctx->notify_ref)
-                        nvif_notify_put(&fctx->notify);
+                        drop = 1;
         }
 
         fence_put(&fence->base);
+        return drop;
 }
 
 static struct nouveau_fence *
@@ -88,16 +92,23 @@ nouveau_fence_context_del(struct nouveau_fence_chan *fctx)
 {
         struct nouveau_fence *fence;
 
-        nvif_notify_fini(&fctx->notify);
-
         spin_lock_irq(&fctx->lock);
         while (!list_empty(&fctx->pending)) {
                 fence = list_entry(fctx->pending.next, typeof(*fence), head);
 
-                nouveau_fence_signal(fence);
-                fence->channel = NULL;
+                if (nouveau_fence_signal(fence))
+                        nvif_notify_put(&fctx->notify);
         }
         spin_unlock_irq(&fctx->lock);
+
+        nvif_notify_fini(&fctx->notify);
+        fctx->dead = 1;
+
+        /*
+         * Ensure that all accesses to fence->channel complete before freeing
+         * the channel.
+         */
+        synchronize_rcu();
 }
 
 static void
@@ -112,21 +123,23 @@ nouveau_fence_context_free(struct nouveau_fence_chan *fctx)
         kref_put(&fctx->fence_ref, nouveau_fence_context_put);
 }
 
-static void
+static int
 nouveau_fence_update(struct nouveau_channel *chan, struct nouveau_fence_chan *fctx)
 {
         struct nouveau_fence *fence;
-
+        int drop = 0;
         u32 seq = fctx->read(chan);
 
         while (!list_empty(&fctx->pending)) {
                 fence = list_entry(fctx->pending.next, typeof(*fence), head);
 
                 if ((int)(seq - fence->base.seqno) < 0)
-                        return;
+                        break;
 
-                nouveau_fence_signal(fence);
+                drop |= nouveau_fence_signal(fence);
         }
+
+        return drop;
 }
 
 static int
@@ -135,18 +148,21 @@ nouveau_fence_wait_uevent_handler(struct nvif_notify *notify)
         struct nouveau_fence_chan *fctx =
                 container_of(notify, typeof(*fctx), notify);
         unsigned long flags;
+        int ret = NVIF_NOTIFY_KEEP;
 
         spin_lock_irqsave(&fctx->lock, flags);
         if (!list_empty(&fctx->pending)) {
                 struct nouveau_fence *fence;
+                struct nouveau_channel *chan;
 
                 fence = list_entry(fctx->pending.next, typeof(*fence), head);
-                nouveau_fence_update(fence->channel, fctx);
+                chan = rcu_dereference_protected(fence->channel, lockdep_is_held(&fctx->lock));
+                if (nouveau_fence_update(fence->channel, fctx))
+                        ret = NVIF_NOTIFY_DROP;
         }
         spin_unlock_irqrestore(&fctx->lock, flags);
 
-        /* Always return keep here. NVIF refcount is handled with nouveau_fence_update */
-        return NVIF_NOTIFY_KEEP;
+        return ret;
 }
 
 void
@@ -262,7 +278,10 @@ nouveau_fence_emit(struct nouveau_fence *fence, struct nouveau_channel *chan)
         if (!ret) {
                 fence_get(&fence->base);
                 spin_lock_irq(&fctx->lock);
-                nouveau_fence_update(chan, fctx);
+
+                if (nouveau_fence_update(chan, fctx))
+                        nvif_notify_put(&fctx->notify);
+
                 list_add_tail(&fence->head, &fctx->pending);
                 spin_unlock_irq(&fctx->lock);
         }
@@ -276,13 +295,16 @@ nouveau_fence_done(struct nouveau_fence *fence)
         if (fence->base.ops == &nouveau_fence_ops_legacy ||
             fence->base.ops == &nouveau_fence_ops_uevent) {
                 struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
+                struct nouveau_channel *chan;
                 unsigned long flags;
 
                 if (test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags))
                         return true;
 
                 spin_lock_irqsave(&fctx->lock, flags);
-                nouveau_fence_update(fence->channel, fctx);
+                chan = rcu_dereference_protected(fence->channel, lockdep_is_held(&fctx->lock));
+                if (chan && nouveau_fence_update(chan, fctx))
+                        nvif_notify_put(&fctx->notify);
                 spin_unlock_irqrestore(&fctx->lock, flags);
         }
         return fence_is_signaled(&fence->base);
@@ -387,12 +409,18 @@ nouveau_fence_sync(struct nouveau_bo *nvbo, struct nouveau_channel *chan, bool e
 
         if (fence && (!exclusive || !fobj || !fobj->shared_count)) {
                 struct nouveau_channel *prev = NULL;
+                bool must_wait = true;
 
                 f = nouveau_local_fence(fence, chan->drm);
-                if (f)
-                        prev = f->channel;
+                if (f) {
+                        rcu_read_lock();
+                        prev = rcu_dereference(f->channel);
+                        if (prev && (prev == chan || fctx->sync(f, prev, chan) == 0))
+                                must_wait = false;
+                        rcu_read_unlock();
+                }
 
-                if (!prev || (prev != chan && (ret = fctx->sync(f, prev, chan))))
+                if (must_wait)
                         ret = fence_wait(fence, intr);
 
                 return ret;
@@ -403,19 +431,22 @@ nouveau_fence_sync(struct nouveau_bo *nvbo, struct nouveau_channel *chan, bool e
 
         for (i = 0; i < fobj->shared_count && !ret; ++i) {
                 struct nouveau_channel *prev = NULL;
+                bool must_wait = true;
 
                 fence = rcu_dereference_protected(fobj->shared[i],
                                                 reservation_object_held(resv));
 
                 f = nouveau_local_fence(fence, chan->drm);
-                if (f)
-                        prev = f->channel;
+                if (f) {
+                        rcu_read_lock();
+                        prev = rcu_dereference(f->channel);
+                        if (prev && (prev == chan || fctx->sync(f, prev, chan) == 0))
+                                must_wait = false;
+                        rcu_read_unlock();
+                }
 
-                if (!prev || (prev != chan && (ret = fctx->sync(f, prev, chan))))
+                if (must_wait)
                         ret = fence_wait(fence, intr);
-
-                if (ret)
-                        break;
         }
 
         return ret;
@@ -463,7 +494,7 @@ static const char *nouveau_fence_get_timeline_name(struct fence *f)
         struct nouveau_fence *fence = from_fence(f);
         struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
 
-        return fence->channel ? fctx->name : "dead channel";
+        return !fctx->dead ? fctx->name : "dead channel";
 }
 
 /*
@@ -476,9 +507,16 @@ static bool nouveau_fence_is_signaled(struct fence *f)
 {
         struct nouveau_fence *fence = from_fence(f);
         struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
-        struct nouveau_channel *chan = fence->channel;
+        struct nouveau_channel *chan;
+        bool ret = false;
+
+        rcu_read_lock();
+        chan = rcu_dereference(fence->channel);
+        if (chan)
+                ret = (int)(fctx->read(chan) - fence->base.seqno) >= 0;
+        rcu_read_unlock();
 
-        return (int)(fctx->read(chan) - fence->base.seqno) >= 0;
+        return ret;
 }
 
 static bool nouveau_fence_no_signaling(struct fence *f)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h
index 943b0b17b1fc..96e461c6f68f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -14,7 +14,7 @@ struct nouveau_fence {
 
         bool sysmem;
 
-        struct nouveau_channel *channel;
+        struct nouveau_channel __rcu *channel;
         unsigned long timeout;
 };
 
@@ -47,7 +47,7 @@ struct nouveau_fence_chan {
         char name[32];
 
         struct nvif_notify notify;
-        int notify_ref;
+        int notify_ref, dead;
 };
 
 struct nouveau_fence_priv {
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index ae873d1a8d46..eb8b36714fa1 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -791,6 +791,22 @@ nv50_crtc_set_scale(struct nouveau_crtc *nv_crtc, bool update)
 }
 
 static int
+nv50_crtc_set_raster_vblank_dmi(struct nouveau_crtc *nv_crtc, u32 usec)
+{
+        struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
+        u32 *push;
+
+        push = evo_wait(mast, 8);
+        if (!push)
+                return -ENOMEM;
+
+        evo_mthd(push, 0x0828 + (nv_crtc->index * 0x400), 1);
+        evo_data(push, usec);
+        evo_kick(push, mast);
+        return 0;
+}
+
+static int
 nv50_crtc_set_color_vibrance(struct nouveau_crtc *nv_crtc, bool update)
 {
         struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
@@ -1104,14 +1120,14 @@ nv50_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *umode,
                         evo_mthd(push, 0x0804 + (nv_crtc->index * 0x400), 2);
                         evo_data(push, 0x00800000 | mode->clock);
                         evo_data(push, (ilace == 2) ? 2 : 0);
-                        evo_mthd(push, 0x0810 + (nv_crtc->index * 0x400), 8);
+                        evo_mthd(push, 0x0810 + (nv_crtc->index * 0x400), 6);
                         evo_data(push, 0x00000000);
                         evo_data(push, (vactive << 16) | hactive);
                         evo_data(push, ( vsynce << 16) | hsynce);
                         evo_data(push, (vblanke << 16) | hblanke);
                         evo_data(push, (vblanks << 16) | hblanks);
                         evo_data(push, (vblan2e << 16) | vblan2s);
-                        evo_data(push, vblankus);
+                        evo_mthd(push, 0x082c + (nv_crtc->index * 0x400), 1);
                         evo_data(push, 0x00000000);
                         evo_mthd(push, 0x0900 + (nv_crtc->index * 0x400), 2);
                         evo_data(push, 0x00000311);
@@ -1141,6 +1157,11 @@ nv50_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *umode,
         nv_connector = nouveau_crtc_connector_get(nv_crtc);
         nv50_crtc_set_dither(nv_crtc, false);
         nv50_crtc_set_scale(nv_crtc, false);
+
+        /* G94 only accepts this after setting scale */
+        if (nv50_vers(mast) < GF110_DISP_CORE_CHANNEL_DMA)
+                nv50_crtc_set_raster_vblank_dmi(nv_crtc, vblankus);
+
         nv50_crtc_set_color_vibrance(nv_crtc, false);
         nv50_crtc_set_image(nv_crtc, crtc->primary->fb, x, y, false);
         return 0;
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index af9e78546688..0d1396266857 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -572,7 +572,6 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
         struct qxl_framebuffer *qfb;
         struct qxl_bo *bo, *old_bo = NULL;
         struct qxl_crtc *qcrtc = to_qxl_crtc(crtc);
-        uint32_t width, height, base_offset;
         bool recreate_primary = false;
         int ret;
         int surf_id;
@@ -602,9 +601,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
         if (qcrtc->index == 0)
                 recreate_primary = true;
 
-        width = mode->hdisplay;
-        height = mode->vdisplay;
-        base_offset = 0;
+        if (bo->surf.stride * bo->surf.height > qdev->vram_size) {
+                DRM_ERROR("Mode doesn't fit in vram size (vgamem)");
+                return -EINVAL;
+        }
 
         ret = qxl_bo_reserve(bo, false);
         if (ret != 0)
@@ -618,10 +618,10 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
         if (recreate_primary) {
                 qxl_io_destroy_primary(qdev);
                 qxl_io_log(qdev,
-                           "recreate primary: %dx%d (was %dx%d,%d,%d)\n",
-                           width, height, bo->surf.width,
-                           bo->surf.height, bo->surf.stride, bo->surf.format);
-                qxl_io_create_primary(qdev, base_offset, bo);
+                           "recreate primary: %dx%d,%d,%d\n",
+                           bo->surf.width, bo->surf.height,
+                           bo->surf.stride, bo->surf.format);
+                qxl_io_create_primary(qdev, 0, bo);
                 bo->is_primary = true;
         }
 
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 15da7ef344a4..ec1593a6a561 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1217,7 +1217,7 @@ free:
         return ret;
 }
 
-int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uint32_t * params)
 {
         int r;
 
@@ -1238,6 +1238,15 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
         return r;
 }
 
+int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+{
+        int r;
+        mutex_lock(&ctx->scratch_mutex);
+        r = atom_execute_table_scratch_unlocked(ctx, index, params);
+        mutex_unlock(&ctx->scratch_mutex);
+        return r;
+}
+
 static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
 
 static void atom_index_iio(struct atom_context *ctx, int base)
diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index feba6b8d36b3..6d014ddb6b78 100644
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -125,6 +125,7 @@ struct card_info {
 struct atom_context {
         struct card_info *card;
         struct mutex mutex;
+        struct mutex scratch_mutex;
         void *bios;
         uint32_t cmd_table, data_table;
         uint16_t *iio;
@@ -145,6 +146,7 @@ extern int atom_debug;
 
 struct atom_context *atom_parse(struct card_info *, void *);
 int atom_execute_table(struct atom_context *, int, uint32_t *);
+int atom_execute_table_scratch_unlocked(struct atom_context *, int, uint32_t *);
 int atom_asic_init(struct atom_context *);
 void atom_destroy(struct atom_context *);
 bool atom_parse_data_header(struct atom_context *ctx, int index, uint16_t *size,
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 95d5d4ab3335..11ba9d21b89b 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -100,6 +100,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
         memset(&args, 0, sizeof(args));
 
         mutex_lock(&chan->mutex);
+        mutex_lock(&rdev->mode_info.atom_context->scratch_mutex);
 
         base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1);
 
@@ -113,7 +114,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
         if (ASIC_IS_DCE4(rdev))
                 args.v2.ucHPD_ID = chan->rec.hpd;
 
-        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+        atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
         *ack = args.v1.ucReplyStatus;
 
@@ -147,6 +148,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
 
         r = recv_bytes;
 done:
+        mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex);
         mutex_unlock(&chan->mutex);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
index 9c570fb15b8c..4157780585a0 100644
--- a/drivers/gpu/drm/radeon/atombios_i2c.c
+++ b/drivers/gpu/drm/radeon/atombios_i2c.c
@@ -48,6 +48,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
         memset(&args, 0, sizeof(args));
 
         mutex_lock(&chan->mutex);
+        mutex_lock(&rdev->mode_info.atom_context->scratch_mutex);
 
         base = (unsigned char *)rdev->mode_info.atom_context->scratch;
 
@@ -82,7 +83,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
         args.ucSlaveAddr = slave_addr << 1;
         args.ucLineNumber = chan->rec.i2c_id;
 
-        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+        atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
         /* error */
         if (args.ucStatus != HW_ASSISTED_I2C_STATUS_SUCCESS) {
@@ -95,6 +96,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
                 radeon_atom_copy_swap(buf, base, num, false);
 
 done:
+        mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex);
         mutex_unlock(&chan->mutex);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 300d971187c4..0b2929de9f41 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -24,6 +24,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "btcd.h"
 #include "r600_dpm.h"
 #include "cypress_dpm.h"
@@ -1170,6 +1171,23 @@ static const struct radeon_blacklist_clocks btc_blacklist_clocks[] =
         { 25000, 30000, RADEON_SCLK_UP }
 };
 
+void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                     u32 *max_clock)
+{
+        u32 i, clock = 0;
+
+        if ((table == NULL) || (table->count == 0)) {
+                *max_clock = clock;
+                return;
+        }
+
+        for (i = 0; i < table->count; i++) {
+                if (clock < table->entries[i].clk)
+                        clock = table->entries[i].clk;
+        }
+        *max_clock = clock;
+}
+
 void btc_apply_voltage_dependency_rules(struct radeon_clock_voltage_dependency_table *table,
                                         u32 clock, u16 max_voltage, u16 *voltage)
 {
diff --git a/drivers/gpu/drm/radeon/btc_dpm.h b/drivers/gpu/drm/radeon/btc_dpm.h
index 1a15e0e41950..3b6f12b7760b 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.h
+++ b/drivers/gpu/drm/radeon/btc_dpm.h
@@ -46,6 +46,8 @@ void btc_adjust_clock_combinations(struct radeon_device *rdev,
                                    struct rv7xx_pl *pl);
 void btc_apply_voltage_dependency_rules(struct radeon_clock_voltage_dependency_table *table,
                                         u32 clock, u16 max_voltage, u16 *voltage);
+void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                     u32 *max_clock);
 void btc_apply_voltage_delta_rules(struct radeon_device *rdev,
                                    u16 max_vddc, u16 max_vddci,
                                    u16 *vddc, u16 *vddci);
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index f5c8c0445a94..11a55e9dad7f 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -24,6 +24,7 @@
 #include <linux/firmware.h>
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "radeon_ucode.h"
 #include "cikd.h"
 #include "r600_dpm.h"
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 377afa504d2b..89c01fa6dd8e 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4313,8 +4313,8 @@ static int cik_cp_gfx_start(struct radeon_device *rdev)
         /* init the CE partitions.  CE only used for gfx on CIK */
         radeon_ring_write(ring, PACKET3(PACKET3_SET_BASE, 2));
         radeon_ring_write(ring, PACKET3_BASE_INDEX(CE_PARTITION_BASE));
-        radeon_ring_write(ring, 0xc000);
-        radeon_ring_write(ring, 0xc000);
+        radeon_ring_write(ring, 0x8000);
+        radeon_ring_write(ring, 0x8000);
 
         /* setup clear context state */
         radeon_ring_write(ring, PACKET3(PACKET3_PREAMBLE_CNTL, 0));
@@ -9447,6 +9447,9 @@ void dce8_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index c77dad1a4576..d748963af08b 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -611,16 +611,19 @@ int cik_sdma_ring_test(struct radeon_device *rdev,
 {
         unsigned i;
         int r;
-        void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
+        unsigned index;
         u32 tmp;
+        u64 gpu_addr;
 
-        if (!ptr) {
-                DRM_ERROR("invalid vram scratch pointer\n");
-                return -EINVAL;
-        }
+        if (ring->idx == R600_RING_TYPE_DMA_INDEX)
+                index = R600_WB_DMA_RING_TEST_OFFSET;
+        else
+                index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
+
+        gpu_addr = rdev->wb.gpu_addr + index;
 
         tmp = 0xCAFEDEAD;
-        writel(tmp, ptr);
+        rdev->wb.wb[index/4] = cpu_to_le32(tmp);
 
         r = radeon_ring_lock(rdev, ring, 5);
         if (r) {
@@ -628,14 +631,14 @@ int cik_sdma_ring_test(struct radeon_device *rdev,
                 return r;
         }
         radeon_ring_write(ring, SDMA_PACKET(SDMA_OPCODE_WRITE, SDMA_WRITE_SUB_OPCODE_LINEAR, 0));
-        radeon_ring_write(ring, rdev->vram_scratch.gpu_addr & 0xfffffffc);
-        radeon_ring_write(ring, upper_32_bits(rdev->vram_scratch.gpu_addr));
+        radeon_ring_write(ring, lower_32_bits(gpu_addr));
+        radeon_ring_write(ring, upper_32_bits(gpu_addr));
         radeon_ring_write(ring, 1); /* number of DWs to follow */
         radeon_ring_write(ring, 0xDEADBEEF);
         radeon_ring_unlock_commit(rdev, ring, false);
 
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = readl(ptr);
+                tmp = le32_to_cpu(rdev->wb.wb[index/4]);
                 if (tmp == 0xDEADBEEF)
                         break;
                 DRM_UDELAY(1);
@@ -664,17 +667,20 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
 {
         struct radeon_ib ib;
         unsigned i;
+        unsigned index;
         int r;
-        void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
         u32 tmp = 0;
+        u64 gpu_addr;
 
-        if (!ptr) {
-                DRM_ERROR("invalid vram scratch pointer\n");
-                return -EINVAL;
-        }
+        if (ring->idx == R600_RING_TYPE_DMA_INDEX)
+                index = R600_WB_DMA_RING_TEST_OFFSET;
+        else
+                index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
+
+        gpu_addr = rdev->wb.gpu_addr + index;
 
         tmp = 0xCAFEDEAD;
-        writel(tmp, ptr);
+        rdev->wb.wb[index/4] = cpu_to_le32(tmp);
 
         r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
         if (r) {
@@ -683,8 +689,8 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         }
 
         ib.ptr[0] = SDMA_PACKET(SDMA_OPCODE_WRITE, SDMA_WRITE_SUB_OPCODE_LINEAR, 0);
-        ib.ptr[1] = rdev->vram_scratch.gpu_addr & 0xfffffffc;
-        ib.ptr[2] = upper_32_bits(rdev->vram_scratch.gpu_addr);
+        ib.ptr[1] = lower_32_bits(gpu_addr);
+        ib.ptr[2] = upper_32_bits(gpu_addr);
         ib.ptr[3] = 1;
         ib.ptr[4] = 0xDEADBEEF;
         ib.length_dw = 5;
@@ -701,7 +707,7 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
                 return r;
         }
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = readl(ptr);
+                tmp = le32_to_cpu(rdev->wb.wb[index/4]);
                 if (tmp == 0xDEADBEEF)
                         break;
                 DRM_UDELAY(1);
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index 47d31e915758..9aad0327e4d1 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -24,6 +24,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "evergreend.h"
 #include "r600_dpm.h"
 #include "cypress_dpm.h"
diff --git a/drivers/gpu/drm/radeon/dce3_1_afmt.c b/drivers/gpu/drm/radeon/dce3_1_afmt.c
index 950af153f30e..2fe8cfc966d9 100644
--- a/drivers/gpu/drm/radeon/dce3_1_afmt.c
+++ b/drivers/gpu/drm/radeon/dce3_1_afmt.c
@@ -32,7 +32,7 @@ static void dce3_2_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         struct drm_connector *connector;
         struct radeon_connector *radeon_connector = NULL;
         u32 tmp;
-        u8 *sadb;
+        u8 *sadb = NULL;
         int sad_count;
 
         list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
@@ -49,8 +49,8 @@ static void dce3_2_afmt_write_speaker_allocation(struct drm_encoder *encoder)
 
         sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
         if (sad_count < 0) {
-                DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
-                return;
+                DRM_DEBUG("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
+                sad_count = 0;
         }
 
         /* program the speaker allocation */
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index c0bbf68dbc27..f312edf4d50e 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -155,7 +155,7 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         struct drm_connector *connector;
         struct radeon_connector *radeon_connector = NULL;
         u32 offset, tmp;
-        u8 *sadb;
+        u8 *sadb = NULL;
         int sad_count;
 
         if (!dig || !dig->afmt || !dig->afmt->pin)
@@ -176,9 +176,9 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         }
 
         sad_count = drm_edid_to_speaker_allocation(radeon_connector_edid(connector), &sadb);
-        if (sad_count <= 0) {
-                DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
-                return;
+        if (sad_count < 0) {
+                DRM_DEBUG("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
+                sad_count = 0;
         }
 
         /* program the speaker allocation */
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index a31f1ca40c6a..85995b4e3338 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2345,6 +2345,9 @@ void evergreen_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
@@ -2552,6 +2555,7 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
                                         WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                         tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
                                         WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                                 }
                         } else {
                                 tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
@@ -3005,7 +3009,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         u32 vgt_cache_invalidation;
         u32 hdp_host_path_cntl, tmp;
         u32 disabled_rb_mask;
-        int i, j, num_shader_engines, ps_thread_count;
+        int i, j, ps_thread_count;
 
         switch (rdev->family) {
         case CHIP_CYPRESS:
@@ -3303,8 +3307,6 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         rdev->config.evergreen.tile_config |=
                 ((gb_addr_config & 0x30000000) >> 28) << 12;
 
-        num_shader_engines = (gb_addr_config & NUM_SHADER_ENGINES(3) >> 12) + 1;
-
         if ((rdev->family >= CHIP_CEDAR) && (rdev->family <= CHIP_HEMLOCK)) {
                 u32 efuse_straps_4;
                 u32 efuse_straps_3;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index 2514d659b1ba..53abd9b17a50 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -133,7 +133,7 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         struct drm_connector *connector;
         struct radeon_connector *radeon_connector = NULL;
         u32 tmp;
-        u8 *sadb;
+        u8 *sadb = NULL;
         int sad_count;
 
         list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
@@ -149,9 +149,9 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         }
 
         sad_count = drm_edid_to_speaker_allocation(radeon_connector_edid(connector), &sadb);
-        if (sad_count <= 0) {
-                DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
-                return;
+        if (sad_count < 0) {
+                DRM_DEBUG("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
+                sad_count = 0;
         }
 
         /* program the speaker allocation */
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 1dd976f447fa..9b42001295ba 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2725,7 +2725,11 @@ int kv_dpm_init(struct radeon_device *rdev)
 
         pi->sram_end = SMC_RAM_END;
 
-        pi->enable_nb_dpm = true;
+        /* Enabling nb dpm on an asrock system prevents dpm from working */
+        if (rdev->pdev->subsystem_vendor == 0x1849)
+                pi->enable_nb_dpm = false;
+        else
+                pi->enable_nb_dpm = true;
 
         pi->caps_power_containment = true;
         pi->caps_cac = true;
@@ -2740,10 +2744,19 @@ int kv_dpm_init(struct radeon_device *rdev)
         pi->caps_sclk_ds = true;
         pi->enable_auto_thermal_throttling = true;
         pi->disable_nb_ps3_in_battery = false;
-        if (radeon_bapm == 0)
+        if (radeon_bapm == -1) {
+                /* There are stability issues reported on with
+                 * bapm enabled on an asrock system.
+                 */
+                if (rdev->pdev->subsystem_vendor == 0x1849)
+                        pi->bapm_enable = false;
+                else
+                        pi->bapm_enable = true;
+        } else if (radeon_bapm == 0) {
                 pi->bapm_enable = false;
-        else
+        } else {
                 pi->bapm_enable = true;
+        }
         pi->voltage_drop_t = 0;
         pi->caps_sclk_throttle_low_notification = false;
         pi->caps_fps = false; /* true? */
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 715b181c6243..6d2f16cf2c1c 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -23,6 +23,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "nid.h"
 #include "r600_dpm.h"
 #include "ni_dpm.h"
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 10f8be0ee173..b53b31a7b76f 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3207,6 +3207,9 @@ void r100_bandwidth_update(struct radeon_device *rdev)
         uint32_t pixel_bytes1 = 0;
         uint32_t pixel_bytes2 = 0;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled) {
diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
index 100189ec5fa8..cf0df45d455e 100644
--- a/drivers/gpu/drm/radeon/r600_dma.c
+++ b/drivers/gpu/drm/radeon/r600_dma.c
@@ -232,16 +232,19 @@ int r600_dma_ring_test(struct radeon_device *rdev,
 {
         unsigned i;
         int r;
-        void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
+        unsigned index;
         u32 tmp;
+        u64 gpu_addr;
 
-        if (!ptr) {
-                DRM_ERROR("invalid vram scratch pointer\n");
-                return -EINVAL;
-        }
+        if (ring->idx == R600_RING_TYPE_DMA_INDEX)
+                index = R600_WB_DMA_RING_TEST_OFFSET;
+        else
+                index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
+
+        gpu_addr = rdev->wb.gpu_addr + index;
 
         tmp = 0xCAFEDEAD;
-        writel(tmp, ptr);
+        rdev->wb.wb[index/4] = cpu_to_le32(tmp);
 
         r = radeon_ring_lock(rdev, ring, 4);
         if (r) {
@@ -249,13 +252,13 @@ int r600_dma_ring_test(struct radeon_device *rdev,
                 return r;
         }
         radeon_ring_write(ring, DMA_PACKET(DMA_PACKET_WRITE, 0, 0, 1));
-        radeon_ring_write(ring, rdev->vram_scratch.gpu_addr & 0xfffffffc);
-        radeon_ring_write(ring, upper_32_bits(rdev->vram_scratch.gpu_addr) & 0xff);
+        radeon_ring_write(ring, lower_32_bits(gpu_addr));
+        radeon_ring_write(ring, upper_32_bits(gpu_addr) & 0xff);
         radeon_ring_write(ring, 0xDEADBEEF);
         radeon_ring_unlock_commit(rdev, ring, false);
 
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = readl(ptr);
+                tmp = le32_to_cpu(rdev->wb.wb[index/4]);
                 if (tmp == 0xDEADBEEF)
                         break;
                 DRM_UDELAY(1);
@@ -335,17 +338,17 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
 {
         struct radeon_ib ib;
         unsigned i;
+        unsigned index;
         int r;
-        void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
         u32 tmp = 0;
+        u64 gpu_addr;
 
-        if (!ptr) {
-                DRM_ERROR("invalid vram scratch pointer\n");
-                return -EINVAL;
-        }
+        if (ring->idx == R600_RING_TYPE_DMA_INDEX)
+                index = R600_WB_DMA_RING_TEST_OFFSET;
+        else
+                index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
 
-        tmp = 0xCAFEDEAD;
-        writel(tmp, ptr);
+        gpu_addr = rdev->wb.gpu_addr + index;
 
         r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
         if (r) {
@@ -354,8 +357,8 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         }
 
         ib.ptr[0] = DMA_PACKET(DMA_PACKET_WRITE, 0, 0, 1);
-        ib.ptr[1] = rdev->vram_scratch.gpu_addr & 0xfffffffc;
-        ib.ptr[2] = upper_32_bits(rdev->vram_scratch.gpu_addr) & 0xff;
+        ib.ptr[1] = lower_32_bits(gpu_addr);
+        ib.ptr[2] = upper_32_bits(gpu_addr) & 0xff;
         ib.ptr[3] = 0xDEADBEEF;
         ib.length_dw = 4;
 
@@ -371,7 +374,7 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
                 return r;
         }
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = readl(ptr);
+                tmp = le32_to_cpu(rdev->wb.wb[index/4]);
                 if (tmp == 0xDEADBEEF)
                         break;
                 DRM_UDELAY(1);
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index 9c61b74ef441..b5c73df8e202 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -24,6 +24,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "r600d.h"
 #include "r600_dpm.h"
 #include "atom.h"
@@ -1255,7 +1256,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                                         (mode_info->atom_context->bios + data_offset +
                                          le16_to_cpu(ext_hdr->usPowerTuneTableOffset));
                                 rdev->pm.dpm.dyn_state.cac_tdp_table->maximum_power_delivery_limit =
-                                        ppt->usMaximumPowerDeliveryLimit;
+                                        le16_to_cpu(ppt->usMaximumPowerDeliveryLimit);
                                 pt = &ppt->power_tune_table;
                         } else {
                                 ATOM_PPLIB_POWERTUNE_Table *ppt = (ATOM_PPLIB_POWERTUNE_Table *)
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index f7c4b226a284..a9717b3fbf1b 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1133,6 +1133,8 @@ struct radeon_wb {
 #define R600_WB_EVENT_OFFSET     3072
 #define CIK_WB_CP1_WPTR_OFFSET     3328
 #define CIK_WB_CP2_WPTR_OFFSET     3584
+#define R600_WB_DMA_RING_TEST_OFFSET 3588
+#define CAYMAN_WB_DMA1_RING_TEST_OFFSET 3592
 
 /**
  * struct radeon_pm - power management datas
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 6a03624fadaa..63ccb8fa799c 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -658,12 +658,10 @@ bool radeon_get_bios(struct radeon_device *rdev)
                 r = igp_read_bios_from_vram(rdev);
         if (r == false)
                 r = radeon_read_bios(rdev);
-        if (r == false) {
+        if (r == false)
                 r = radeon_read_disabled_bios(rdev);
-        }
-        if (r == false) {
+        if (r == false)
                 r = radeon_read_platform_bios(rdev);
-        }
         if (r == false || rdev->bios == NULL) {
                 DRM_ERROR("Unable to locate a BIOS ROM\n");
                 rdev->bios = NULL;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 300c4b3d4669..26baa9c05f6c 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -322,6 +322,12 @@ static void radeon_connector_get_edid(struct drm_connector *connector)
         }
 
         if (!radeon_connector->edid) {
+                /* don't fetch the edid from the vbios if ddc fails and runpm is
+                 * enabled so we report disconnected.
+                 */
+                if ((rdev->flags & RADEON_IS_PX) && (radeon_runtime_pm != 0))
+                        return;
+
                 if (rdev->is_atom_bios) {
                         /* some laptops provide a hardcoded edid in rom for LCDs */
                         if (((connector->connector_type == DRM_MODE_CONNECTOR_LVDS) ||
@@ -826,6 +832,8 @@ static int radeon_lvds_mode_valid(struct drm_connector *connector,
 static enum drm_connector_status
 radeon_lvds_detect(struct drm_connector *connector, bool force)
 {
+        struct drm_device *dev = connector->dev;
+        struct radeon_device *rdev = dev->dev_private;
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder = radeon_best_single_encoder(connector);
         enum drm_connector_status ret = connector_status_disconnected;
@@ -842,7 +850,11 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
                 /* check if panel is valid */
                 if (native_mode->hdisplay >= 320 && native_mode->vdisplay >= 240)
                         ret = connector_status_connected;
-
+                /* don't fetch the edid from the vbios if ddc fails and runpm is
+                 * enabled so we report disconnected.
+                 */
+                if ((rdev->flags & RADEON_IS_PX) && (radeon_runtime_pm != 0))
+                        ret = connector_status_disconnected;
         }
 
         /* check for edid as well */
@@ -1589,6 +1601,11 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                         /* check if panel is valid */
                         if (native_mode->hdisplay >= 320 && native_mode->vdisplay >= 240)
                                 ret = connector_status_connected;
+                        /* don't fetch the edid from the vbios if ddc fails and runpm is
+                         * enabled so we report disconnected.
+                         */
+                        if ((rdev->flags & RADEON_IS_PX) && (radeon_runtime_pm != 0))
+                                ret = connector_status_disconnected;
                 }
                 /* eDP is always DP */
                 radeon_dig_connector->dp_sink_type = CONNECTOR_OBJECT_ID_DISPLAYPORT;
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 1c893447d7cd..6f377de099f9 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -251,22 +251,19 @@ static int radeon_cs_get_ring(struct radeon_cs_parser *p, u32 ring, s32 priority
 
 static int radeon_cs_sync_rings(struct radeon_cs_parser *p)
 {
-        int i, r = 0;
+        struct radeon_cs_reloc *reloc;
+        int r;
 
-        for (i = 0; i < p->nrelocs; i++) {
+        list_for_each_entry(reloc, &p->validated, tv.head) {
                 struct reservation_object *resv;
 
-                if (!p->relocs[i].robj)
-                        continue;
-
-                resv = p->relocs[i].robj->tbo.resv;
+                resv = reloc->robj->tbo.resv;
                 r = radeon_semaphore_sync_resv(p->rdev, p->ib.semaphore, resv,
-                                               p->relocs[i].tv.shared);
-
+                                               reloc->tv.shared);
                 if (r)
-                        break;
+                        return r;
         }
-        return r;
+        return 0;
 }
 
 /* XXX: note that this is called from the legacy UMS CS ioctl as well */
@@ -450,7 +447,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error, bo
         kfree(parser->track);
         kfree(parser->relocs);
         kfree(parser->relocs_ptr);
-        kfree(parser->vm_bos);
+        drm_free_large(parser->vm_bos);
         for (i = 0; i < parser->nchunks; i++)
                 drm_free_large(parser->chunks[i].kdata);
         kfree(parser->chunks);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index f41cc1538e48..995a8b1770dd 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -952,6 +952,7 @@ int radeon_atombios_init(struct radeon_device *rdev)
         }
 
         mutex_init(&rdev->mode_info.atom_context->mutex);
+        mutex_init(&rdev->mode_info.atom_context->scratch_mutex);
         radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
         atom_allocate_fb_scratch(rdev->mode_info.atom_context);
         return 0;
@@ -1130,7 +1131,7 @@ static void radeon_check_arguments(struct radeon_device *rdev)
         if (radeon_vm_block_size == -1) {
 
                 /* Total bits covered by PD + PTs */
-                unsigned bits = ilog2(radeon_vm_size) + 17;
+                unsigned bits = ilog2(radeon_vm_size) + 18;
 
                 /* Make sure the PD is 4K in size up to 8GB address space.
                    Above that split equal between PD and PTs */
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 9a19e52cc655..6b670b0bc47b 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -179,6 +179,9 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder,
                     (rdev->pdev->subsystem_vendor == 0x1734) &&
                     (rdev->pdev->subsystem_device == 0x1107))
                         use_bl = false;
+                /* disable native backlight control on older asics */
+                else if (rdev->family < CHIP_R600)
+                        use_bl = false;
                 else
                         use_bl = true;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 7784911d78ef..00fc59762e0d 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -185,6 +185,16 @@ static bool radeon_msi_ok(struct radeon_device *rdev)
         if (rdev->flags & RADEON_IS_AGP)
                 return false;
 
+        /*
+         * Older chips have a HW limitation, they can only generate 40 bits
+         * of address for "64-bit" MSIs which breaks on some platforms, notably
+         * IBM POWER servers, so we limit them
+         */
+        if (rdev->family < CHIP_BONAIRE) {
+                dev_info(rdev->dev, "radeon: MSI limited to 32-bit\n");
+                rdev->pdev->no_64bit_msi = 1;
+        }
+
         /* force MSI on */
         if (radeon_msi == 1)
                 return true;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 8309b11e674d..03586763ee86 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -795,6 +795,8 @@ int radeon_get_vblank_timestamp_kms(struct drm_device *dev, int crtc,
 
         /* Get associated drm_crtc: */
         drmcrtc = &rdev->mode_info.crtcs[crtc]->base;
+        if (!drmcrtc)
+                return -EINVAL;
 
         /* Helper routine in DRM core does all the work: */
         return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error,
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 99a960a4f302..4c0d786d5c7a 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -213,6 +213,13 @@ int radeon_bo_create(struct radeon_device *rdev,
         if (!(rdev->flags & RADEON_IS_PCIE))
                 bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
 
+#ifdef CONFIG_X86_32
+        /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
+         * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
+         */
+        bo->flags &= ~RADEON_GEM_GTT_WC;
+#endif
+
         radeon_ttm_placement_from_domain(bo, domain);
         /* Kernel allocation are uninterruptible */
         down_read(&rdev->pm.mclk_lock);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 3d17af34afa7..2456f69efd23 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -314,7 +314,7 @@ unsigned radeon_ring_backup(struct radeon_device *rdev, struct radeon_ring *ring
         }
 
         /* and then save the content of the ring */
-        *data = kmalloc_array(size, sizeof(uint32_t), GFP_KERNEL);
+        *data = drm_malloc_ab(size, sizeof(uint32_t));
         if (!*data) {
                 mutex_unlock(&rdev->ring_lock);
                 return 0;
@@ -356,7 +356,7 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
         }
 
         radeon_ring_unlock_commit(rdev, ring, false);
-        kfree(data);
+        drm_free_large(data);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index 4532cc76a0a6..dfde266529e2 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -132,8 +132,8 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
         struct radeon_cs_reloc *list;
         unsigned i, idx;
 
-        list = kmalloc_array(vm->max_pde_used + 2,
-                             sizeof(struct radeon_cs_reloc), GFP_KERNEL);
+        list = drm_malloc_ab(vm->max_pde_used + 2,
+                             sizeof(struct radeon_cs_reloc));
         if (!list)
                 return NULL;
 
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 5f6db4629aaa..9acb1c3c005b 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -879,6 +879,9 @@ void rs600_bandwidth_update(struct radeon_device *rdev)
         u32 d1mode_priority_a_cnt, d2mode_priority_a_cnt;
         /* FIXME: implement full support */
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3462b64369bf..0a2d36e81108 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -579,6 +579,9 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
         u32 d1mode_priority_a_cnt, d1mode_priority_b_cnt;
         u32 d2mode_priority_a_cnt, d2mode_priority_b_cnt;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/rs780_dpm.c b/drivers/gpu/drm/radeon/rs780_dpm.c
index 02f7710de470..9031f4b69824 100644
--- a/drivers/gpu/drm/radeon/rs780_dpm.c
+++ b/drivers/gpu/drm/radeon/rs780_dpm.c
@@ -24,6 +24,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "rs780d.h"
 #include "r600_dpm.h"
 #include "rs780_dpm.h"
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 8a477bf1fdb3..c55d653aaf5f 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -1277,6 +1277,9 @@ void rv515_bandwidth_update(struct radeon_device *rdev)
         struct drm_display_mode *mode0 = NULL;
         struct drm_display_mode *mode1 = NULL;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/rv6xx_dpm.c b/drivers/gpu/drm/radeon/rv6xx_dpm.c
index e7045b085715..6a5c233361e9 100644
--- a/drivers/gpu/drm/radeon/rv6xx_dpm.c
+++ b/drivers/gpu/drm/radeon/rv6xx_dpm.c
@@ -24,6 +24,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "rv6xxd.h"
 #include "r600_dpm.h"
 #include "rv6xx_dpm.h"
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 3c76e1dcdf04..755a8f96fe46 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -24,6 +24,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "rv770d.h"
 #include "r600_dpm.h"
 #include "rv770_dpm.h"
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index eeea5b6a1775..7d5083dc4acb 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2384,6 +2384,9 @@ void dce6_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 9e4d5d7d348f..676e6c2ba90a 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -23,6 +23,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "sid.h"
 #include "r600_dpm.h"
 #include "si_dpm.h"
@@ -2916,6 +2917,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
         bool disable_sclk_switching = false;
         u32 mclk, sclk;
         u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
         int i;
 
         if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -2949,6 +2951,29 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                 }
         }
 
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
+
         /* XXX validate the min clocks required for display */
 
         if (disable_mclk_switching) {
@@ -6231,7 +6256,7 @@ static void si_parse_pplib_clock_info(struct radeon_device *rdev,
         if ((rps->class2 & ATOM_PPLIB_CLASSIFICATION2_ULV) &&
             index == 0) {
                 /* XXX disable for A0 tahiti */
-                si_pi->ulv.supported = true;
+                si_pi->ulv.supported = false;
                 si_pi->ulv.pl = *pl;
                 si_pi->ulv.one_pcie_lane_in_ulv = false;
                 si_pi->ulv.volt_change_delay = SISLANDS_ULVVOLTAGECHANGEDELAY_DFLT;
diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index 3f0e8d7b8dbe..1f8a8833e1be 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -23,6 +23,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "sumod.h"
 #include "r600_dpm.h"
 #include "cypress_dpm.h"
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 57f780053b3e..b4ec5c4e7969 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -23,6 +23,7 @@
 
 #include "drmP.h"
 #include "radeon.h"
+#include "radeon_asic.h"
 #include "trinityd.h"
 #include "r600_dpm.h"
 #include "trinity_dpm.h"
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index 6553fd238685..054a79f143ae 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -736,7 +736,6 @@ static const struct drm_crtc_funcs tegra_crtc_funcs = {
 
 static void tegra_crtc_disable(struct drm_crtc *crtc)
 {
-        struct tegra_dc *dc = to_tegra_dc(crtc);
         struct drm_device *drm = crtc->dev;
         struct drm_plane *plane;
 
@@ -752,7 +751,7 @@ static void tegra_crtc_disable(struct drm_crtc *crtc)
                 }
         }
 
-        drm_vblank_off(drm, dc->pipe);
+        drm_crtc_vblank_off(crtc);
 }
 
 static bool tegra_crtc_mode_fixup(struct drm_crtc *crtc,
@@ -841,8 +840,6 @@ static int tegra_crtc_mode_set(struct drm_crtc *crtc,
         u32 value;
         int err;
 
-        drm_vblank_pre_modeset(crtc->dev, dc->pipe);
-
         err = tegra_crtc_setup_clk(crtc, mode);
         if (err) {
                 dev_err(dc->dev, "failed to setup clock for CRTC: %d\n", err);
@@ -896,6 +893,8 @@ static void tegra_crtc_prepare(struct drm_crtc *crtc)
         unsigned int syncpt;
         unsigned long value;
 
+        drm_crtc_vblank_off(crtc);
+
         /* hardware initialization */
         reset_control_deassert(dc->rst);
         usleep_range(10000, 20000);
@@ -943,7 +942,7 @@ static void tegra_crtc_commit(struct drm_crtc *crtc)
         value = GENERAL_ACT_REQ | WIN_A_ACT_REQ;
         tegra_dc_writel(dc, value, DC_CMD_STATE_CONTROL);
 
-        drm_vblank_post_modeset(crtc->dev, dc->pipe);
+        drm_crtc_vblank_on(crtc);
 }
 
 static void tegra_crtc_load_lut(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 8f5cec67c47d..d395b0bef73b 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -709,6 +709,7 @@ out:
 
 static int ttm_mem_evict_first(struct ttm_bo_device *bdev,
                                 uint32_t mem_type,
+                                const struct ttm_place *place,
                                 bool interruptible,
                                 bool no_wait_gpu)
 {
@@ -720,8 +721,21 @@ static int ttm_mem_evict_first(struct ttm_bo_device *bdev,
         spin_lock(&glob->lru_lock);
         list_for_each_entry(bo, &man->lru, lru) {
                 ret = __ttm_bo_reserve(bo, false, true, false, NULL);
-                if (!ret)
+                if (!ret) {
+                        if (place && (place->fpfn || place->lpfn)) {
+                                /* Don't evict this BO if it's outside of the
+                                 * requested placement range
+                                 */
+                                if (place->fpfn >= (bo->mem.start + bo->mem.size) ||
+                                    (place->lpfn && place->lpfn <= bo->mem.start)) {
+                                        __ttm_bo_unreserve(bo);
+                                        ret = -EBUSY;
+                                        continue;
+                                }
+                        }
+
                         break;
+                }
         }
 
         if (ret) {
@@ -782,7 +796,7 @@ static int ttm_bo_mem_force_space(struct ttm_buffer_object *bo,
                         return ret;
                 if (mem->mm_node)
                         break;
-                ret = ttm_mem_evict_first(bdev, mem_type,
+                ret = ttm_mem_evict_first(bdev, mem_type, place,
                                           interruptible, no_wait_gpu);
                 if (unlikely(ret != 0))
                         return ret;
@@ -994,9 +1008,9 @@ static bool ttm_bo_mem_compat(struct ttm_placement *placement,
 
         for (i = 0; i < placement->num_placement; i++) {
                 const struct ttm_place *heap = &placement->placement[i];
-                if (mem->mm_node && heap->lpfn != 0 &&
+                if (mem->mm_node &&
                     (mem->start < heap->fpfn ||
-                     mem->start + mem->num_pages > heap->lpfn))
+                     (heap->lpfn != 0 && (mem->start + mem->num_pages) > heap->lpfn)))
                         continue;
 
                 *new_flags = heap->flags;
@@ -1007,9 +1021,9 @@ static bool ttm_bo_mem_compat(struct ttm_placement *placement,
 
         for (i = 0; i < placement->num_busy_placement; i++) {
                 const struct ttm_place *heap = &placement->busy_placement[i];
-                if (mem->mm_node && heap->lpfn != 0 &&
+                if (mem->mm_node &&
                     (mem->start < heap->fpfn ||
-                     mem->start + mem->num_pages > heap->lpfn))
+                     (heap->lpfn != 0 && (mem->start + mem->num_pages) > heap->lpfn)))
                         continue;
 
                 *new_flags = heap->flags;
@@ -1233,7 +1247,7 @@ static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
         spin_lock(&glob->lru_lock);
         while (!list_empty(&man->lru)) {
                 spin_unlock(&glob->lru_lock);
-                ret = ttm_mem_evict_first(bdev, mem_type, false, false);
+                ret = ttm_mem_evict_first(bdev, mem_type, NULL, false, false);
                 if (ret) {
                         if (allow_errors) {
                                 return ret;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
index bfeb4b1f2acf..21e9b7f8dad0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
@@ -246,7 +246,8 @@ int vmw_cmdbuf_res_remove(struct vmw_cmdbuf_res_manager *man,
         struct drm_hash_item *hash;
         int ret;
 
-        ret = drm_ht_find_item(&man->resources, user_key, &hash);
+        ret = drm_ht_find_item(&man->resources, user_key | (res_type << 24),
+                               &hash);
         if (likely(ret != 0))
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 7197af157313..25f3c250fd98 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -688,7 +688,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_err0;
         }
 
-        if (unlikely(dev_priv->prim_bb_mem < dev_priv->vram_size))
+        /*
+         * Limit back buffer size to VRAM size.  Remove this once
+         * screen targets are implemented.
+         */
+        if (dev_priv->prim_bb_mem > dev_priv->vram_size)
                 dev_priv->prim_bb_mem = dev_priv->vram_size;
 
         mutex_unlock(&dev_priv->hw_mutex);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index d2bc2b03d4c6..941a7bc0b791 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -187,7 +187,7 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
          * can do this since the caller in the drm core doesn't check anything
          * which is protected by any looks.
          */
-        drm_modeset_unlock(&crtc->mutex);
+        drm_modeset_unlock_crtc(crtc);
         drm_modeset_lock_all(dev_priv->dev);
 
         /* A lot of the code assumes this */
@@ -252,7 +252,7 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
         ret = 0;
 out:
         drm_modeset_unlock_all(dev_priv->dev);
-        drm_modeset_lock(&crtc->mutex, NULL);
+        drm_modeset_lock_crtc(crtc);
 
         return ret;
 }
@@ -273,7 +273,7 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
          * can do this since the caller in the drm core doesn't check anything
          * which is protected by any looks.
          */
-        drm_modeset_unlock(&crtc->mutex);
+        drm_modeset_unlock_crtc(crtc);
         drm_modeset_lock_all(dev_priv->dev);
 
         vmw_cursor_update_position(dev_priv, shown,
@@ -281,7 +281,7 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
                                    du->cursor_y + du->hotspot_y);
 
         drm_modeset_unlock_all(dev_priv->dev);
-        drm_modeset_lock(&crtc->mutex, NULL);
+        drm_modeset_lock_crtc(crtc);
 
         return 0;
 }
@@ -1950,6 +1950,14 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
         };
         int i;
+        u32 assumed_bpp = 2;
+
+        /*
+         * If using screen objects, then assume 32-bpp because that's what the
+         * SVGA device is assuming
+         */
+        if (dev_priv->sou_priv)
+                assumed_bpp = 4;
 
         /* Add preferred mode */
         {
@@ -1960,8 +1968,9 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                 mode->vdisplay = du->pref_height;
                 vmw_guess_mode_timing(mode);
 
-                if (vmw_kms_validate_mode_vram(dev_priv, mode->hdisplay * 2,
-                                               mode->vdisplay)) {
+                if (vmw_kms_validate_mode_vram(dev_priv,
+                                                mode->hdisplay * assumed_bpp,
+                                                mode->vdisplay)) {
                         drm_mode_probed_add(connector, mode);
                 } else {
                         drm_mode_destroy(dev, mode);
@@ -1983,7 +1992,8 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                     bmode->vdisplay > max_height)
                         continue;
 
-                if (!vmw_kms_validate_mode_vram(dev_priv, bmode->hdisplay * 2,
+                if (!vmw_kms_validate_mode_vram(dev_priv,
+                                                bmode->hdisplay * assumed_bpp,
                                                 bmode->vdisplay))
                         continue;
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 73bd9e2e42bc..3402033fa52a 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1659,6 +1659,7 @@ void hid_disconnect(struct hid_device *hdev)
                 hdev->hiddev_disconnect(hdev);
         if (hdev->claimed & HID_CLAIMED_HIDRAW)
                 hidraw_disconnect(hdev);
+        hdev->claimed = 0;
 }
 EXPORT_SYMBOL_GPL(hid_disconnect);
 
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 84c3cb15ccdd..8bf61d295ffd 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -946,6 +946,12 @@ static const char *keys[KEY_MAX + 1] = {
         [KEY_BRIGHTNESS_MIN] = "BrightnessMin",
         [KEY_BRIGHTNESS_MAX] = "BrightnessMax",
         [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto",
+        [KEY_KBDINPUTASSIST_PREV] = "KbdInputAssistPrev",
+        [KEY_KBDINPUTASSIST_NEXT] = "KbdInputAssistNext",
+        [KEY_KBDINPUTASSIST_PREVGROUP] = "KbdInputAssistPrevGroup",
+        [KEY_KBDINPUTASSIST_NEXTGROUP] = "KbdInputAssistNextGroup",
+        [KEY_KBDINPUTASSIST_ACCEPT] = "KbdInputAssistAccept",
+        [KEY_KBDINPUTASSIST_CANCEL] = "KbdInputAssistCancel",
 };
 
 static const char *relatives[REL_MAX + 1] = {
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index cd9c9e96cf0e..7c863738e419 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -298,6 +298,9 @@
 
 #define USB_VENDOR_ID_ELAN              0x04f3
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN  0x0089
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B     0x009b
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103     0x0103
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F     0x016f
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 2df7fddbd119..725f22ca47fc 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -695,7 +695,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                         break;
 
                 case 0x5b: /* TransducerSerialNumber */
-                        set_bit(MSC_SERIAL, input->mscbit);
+                        usage->type = EV_MSC;
+                        usage->code = MSC_SERIAL;
+                        bit = input->mscbit;
+                        max = MSC_MAX;
                         break;
 
                 default:  goto unknown;
@@ -862,6 +865,13 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x28b: map_key_clear(KEY_FORWARDMAIL);     break;
                 case 0x28c: map_key_clear(KEY_SEND);            break;
 
+                case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV);             break;
+                case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT);             break;
+                case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP);                break;
+                case 0x2ca: map_key_clear(KEY_KBDINPUTASSIST_NEXTGROUP);                break;
+                case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT);   break;
+                case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL);   break;
+
                 default:    goto ignore;
                 }
                 break;
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index f3cb5b0a4345..552671ee7c5d 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -71,6 +71,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index fcdbde4ec692..3057dfc7e3bc 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -234,7 +234,7 @@ static const struct pci_device_id fam15h_power_id_table[] = {
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
-        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) },
         {}
 };
 MODULE_DEVICE_TABLE(pci, fam15h_power_id_table);
diff --git a/drivers/hwmon/g762.c b/drivers/hwmon/g762.c
index 6aac695b1688..9b55e673b67c 100644
--- a/drivers/hwmon/g762.c
+++ b/drivers/hwmon/g762.c
@@ -1084,10 +1084,8 @@ static int g762_probe(struct i2c_client *client, const struct i2c_device_id *id)
         if (ret)
                 goto clock_dis;
 
-        data->hwmon_dev = devm_hwmon_device_register_with_groups(dev,
-                                                                 client->name,
-                                                                 data,
-                                                                 g762_groups);
+        data->hwmon_dev = hwmon_device_register_with_groups(dev, client->name,
+                                                            data, g762_groups);
         if (IS_ERR(data->hwmon_dev)) {
                 ret = PTR_ERR(data->hwmon_dev);
                 goto clock_dis;
diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
index d2bf2c97ae70..6a30eeea94be 100644
--- a/drivers/hwmon/ibmpowernv.c
+++ b/drivers/hwmon/ibmpowernv.c
@@ -181,7 +181,7 @@ static int __init populate_attr_groups(struct platform_device *pdev)
 
         opal = of_find_node_by_path("/ibm,opal/sensors");
         if (!opal) {
-                dev_err(&pdev->dev, "Opal node 'sensors' not found\n");
+                dev_dbg(&pdev->dev, "Opal node 'sensors' not found\n");
                 return -ENODEV;
         }
 
@@ -335,7 +335,9 @@ static int __init ibmpowernv_init(void)
 
         err = platform_driver_probe(&ibmpowernv_driver, ibmpowernv_probe);
         if (err) {
-                pr_err("Platfrom driver probe failed\n");
+                if (err != -ENODEV)
+                        pr_err("Platform driver probe failed (%d)\n", err);
+
                 goto exit_device_del;
         }
 
diff --git a/drivers/hwmon/menf21bmc_hwmon.c b/drivers/hwmon/menf21bmc_hwmon.c
index c92229d321c9..afc6b58eaa62 100644
--- a/drivers/hwmon/menf21bmc_hwmon.c
+++ b/drivers/hwmon/menf21bmc_hwmon.c
@@ -21,6 +21,7 @@
 #include <linux/jiffies.h>
 #include <linux/slab.h>
 #include <linux/i2c.h>
+#include <linux/err.h>
 
 #define DRV_NAME  "menf21bmc_hwmon"
 
diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
index 823c877a1ec0..1991d9032c38 100644
--- a/drivers/hwmon/pwm-fan.c
+++ b/drivers/hwmon/pwm-fan.c
@@ -161,10 +161,17 @@ static int pwm_fan_suspend(struct device *dev)
 static int pwm_fan_resume(struct device *dev)
 {
         struct pwm_fan_ctx *ctx = dev_get_drvdata(dev);
+        unsigned long duty;
+        int ret;
 
-        if (ctx->pwm_value)
-                return pwm_enable(ctx->pwm);
-        return 0;
+        if (ctx->pwm_value == 0)
+                return 0;
+
+        duty = DIV_ROUND_UP(ctx->pwm_value * (ctx->pwm->period - 1), MAX_PWM);
+        ret = pwm_config(ctx->pwm, duty, ctx->pwm->period);
+        if (ret)
+                return ret;
+        return pwm_enable(ctx->pwm);
 }
 #endif
 
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 65ef9664d5da..899bede81b31 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -12,11 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.
  * ------------------------------------------------------------------------- */
 
 /* With some changes from Frodo Looijaard <frodol@dds.nl>, Kyösti Mälkki
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 8b10f88b13d9..580dbf05c148 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -12,11 +12,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- *  MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/algos/i2c-algo-pcf.c b/drivers/i2c/algos/i2c-algo-pcf.c
index 34370090b753..270d84bfc2c6 100644
--- a/drivers/i2c/algos/i2c-algo-pcf.c
+++ b/drivers/i2c/algos/i2c-algo-pcf.c
@@ -14,11 +14,6 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- *  MA 02110-1301 USA.
- *
  * With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi> and
  * Frodo Looijaard <frodol@dds.nl>, and also from Martin Bailey
  * <mbailey@littlefeet-inc.com>
diff --git a/drivers/i2c/algos/i2c-algo-pcf.h b/drivers/i2c/algos/i2c-algo-pcf.h
index 1ec703ee788d..262ee801975b 100644
--- a/drivers/i2c/algos/i2c-algo-pcf.h
+++ b/drivers/i2c/algos/i2c-algo-pcf.h
@@ -12,12 +12,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.                                                  */
+    GNU General Public License for more details.                        */
 /* -------------------------------------------------------------------- */
 
 /* With some changes from Frodo Looijaard <frodol@dds.nl> */
diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
index 451e305f7971..4f2d78868281 100644
--- a/drivers/i2c/busses/i2c-ali1535.c
+++ b/drivers/i2c/busses/i2c-ali1535.c
@@ -14,10 +14,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c
index 2fa21ce9682b..45c5c4883022 100644
--- a/drivers/i2c/busses/i2c-ali15x3.c
+++ b/drivers/i2c/busses/i2c-ali15x3.c
@@ -12,10 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
index 41fc6837fb8b..65e324054970 100644
--- a/drivers/i2c/busses/i2c-amd756-s4882.c
+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
  
 /*
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index a16f72891358..6c7113d990f8 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index 917d54588d95..e05a672db3e5 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -434,7 +434,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 }
         }
 
-        ret = wait_for_completion_io_timeout(&dev->cmd_complete,
+        ret = wait_for_completion_timeout(&dev->cmd_complete,
                                              dev->adapter.timeout);
         if (ret == 0) {
                 dev_err(dev->dev, "controller timed out\n");
diff --git a/drivers/i2c/busses/i2c-au1550.c b/drivers/i2c/busses/i2c-au1550.c
index 8762458ca7da..6f8c0756e350 100644
--- a/drivers/i2c/busses/i2c-au1550.c
+++ b/drivers/i2c/busses/i2c-au1550.c
@@ -21,10 +21,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/delay.h>
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 63f3f03ecc9b..c604f4c3ac0d 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -111,6 +111,8 @@
 #define CDNS_I2C_DIVA_MAX       4
 #define CDNS_I2C_DIVB_MAX       64
 
+#define CDNS_I2C_TIMEOUT_MAX    0xFF
+
 #define cdns_i2c_readreg(offset)       readl_relaxed(id->membase + offset)
 #define cdns_i2c_writereg(val, offset) writel_relaxed(val, id->membase + offset)
 
@@ -852,6 +854,15 @@ static int cdns_i2c_probe(struct platform_device *pdev)
                 goto err_clk_dis;
         }
 
+        /*
+         * Cadence I2C controller has a bug wherein it generates
+         * invalid read transaction after HW timeout in master receiver mode.
+         * HW timeout is not used by this driver and the interrupt is disabled.
+         * But the feature itself cannot be disabled. Hence maximum value
+         * is written to this register to reduce the chances of error.
+         */
+        cdns_i2c_writereg(CDNS_I2C_TIMEOUT_MAX, CDNS_I2C_TIME_OUT_OFFSET);
+
         dev_info(&pdev->dev, "%u kHz mmio %08lx irq %d\n",
                  id->i2c_clk / 1000, (unsigned long)r_mem->start, id->irq);
 
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index f3b89a4698b6..5bdbc71698d0 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -23,10 +23,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 4d9614719128..01f0cd87a4a5 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -17,10 +17,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
@@ -411,11 +407,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
         if (dev->cmd_err & DAVINCI_I2C_STR_NACK) {
                 if (msg->flags & I2C_M_IGNORE_NAK)
                         return msg->len;
-                if (stop) {
-                        w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
-                        w |= DAVINCI_I2C_MDR_STP;
-                        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
-                }
+                w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
+                w |= DAVINCI_I2C_MDR_STP;
+                davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
                 return -EREMOTEIO;
         }
         return -EIO;
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 3c20e4bd6dd1..23628b7bfb8d 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
@@ -363,7 +359,7 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
         }
 
         /* Configure Tx/Rx FIFO threshold levels */
-        dw_writel(dev, dev->tx_fifo_depth - 1, DW_IC_TX_TL);
+        dw_writel(dev, dev->tx_fifo_depth / 2, DW_IC_TX_TL);
         dw_writel(dev, 0, DW_IC_RX_TL);
 
         /* configure the i2c master */
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index d66b6cbc9edc..5a410ef17abd 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c
index d31d313ab4f7..acb40f95db78 100644
--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
+++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
@@ -19,10 +19,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index a7431150acf7..373dd4d47765 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index a44ea13d1434..76e699f9ed97 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -9,10 +9,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-elektor.c b/drivers/i2c/busses/i2c-elektor.c
index 485497066ed7..92e8c0ce1625 100644
--- a/drivers/i2c/busses/i2c-elektor.c
+++ b/drivers/i2c/busses/i2c-elektor.c
@@ -12,11 +12,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.                */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 /* With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi> and even
diff --git a/drivers/i2c/busses/i2c-hydra.c b/drivers/i2c/busses/i2c-hydra.c
index 14d2b76de25f..b7864cf42a72 100644
--- a/drivers/i2c/busses/i2c-hydra.c
+++ b/drivers/i2c/busses/i2c-hydra.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 7cfc183b3d63..6ab4f1cb21f3 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index c48e46af670a..e9fb7cf78612 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -11,11 +11,6 @@
  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *      GNU General Public License for more details.
  *
- *      You should have received a copy of the GNU General Public License
- *      along with this program; if not, write to the Free Software
- *      Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
- *      USA.
- *
  * Author:
  *      Darius Augulis, Teltonika Inc.
  *
diff --git a/drivers/i2c/busses/i2c-iop3xx.h b/drivers/i2c/busses/i2c-iop3xx.h
index 097e270955d0..2d6929c2bd92 100644
--- a/drivers/i2c/busses/i2c-iop3xx.h
+++ b/drivers/i2c/busses/i2c-iop3xx.h
@@ -11,11 +11,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.                */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 
diff --git a/drivers/i2c/busses/i2c-isch.c b/drivers/i2c/busses/i2c-isch.c
index cf99dbf21fd1..113293d275f6 100644
--- a/drivers/i2c/busses/i2c-isch.c
+++ b/drivers/i2c/busses/i2c-isch.c
@@ -14,10 +14,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index 3f6ecbfb9a56..f2b0ff011631 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -14,10 +14,6 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
  * The full GNU General Public License is included in this distribution
  * in the file called LICENSE.GPL.
  *
diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
index b170bdffb5de..88eda09e73c0 100644
--- a/drivers/i2c/busses/i2c-nforce2-s4985.c
+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 /*
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index ee3a76c7ae97..70b3c9158509 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -17,10 +17,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 0dffb0e62c3b..277a2288d4a8 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -22,10 +22,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/module.h>
@@ -926,14 +922,12 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                 if (stat & OMAP_I2C_STAT_NACK) {
                         err |= OMAP_I2C_STAT_NACK;
                         omap_i2c_ack_stat(dev, OMAP_I2C_STAT_NACK);
-                        break;
                 }
 
                 if (stat & OMAP_I2C_STAT_AL) {
                         dev_err(dev->dev, "Arbitration lost\n");
                         err |= OMAP_I2C_STAT_AL;
                         omap_i2c_ack_stat(dev, OMAP_I2C_STAT_AL);
-                        break;
                 }
 
                 /*
@@ -958,11 +952,13 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                         if (dev->fifo_size)
                                 num_bytes = dev->buf_len;
 
-                        omap_i2c_receive_data(dev, num_bytes, true);
-
-                        if (dev->errata & I2C_OMAP_ERRATA_I207)
+                        if (dev->errata & I2C_OMAP_ERRATA_I207) {
                                 i2c_omap_errata_i207(dev, stat);
+                                num_bytes = (omap_i2c_read_reg(dev,
+                                        OMAP_I2C_BUFSTAT_REG) >> 8) & 0x3F;
+                        }
 
+                        omap_i2c_receive_data(dev, num_bytes, true);
                         omap_i2c_ack_stat(dev, OMAP_I2C_STAT_RDR);
                         continue;
                 }
diff --git a/drivers/i2c/busses/i2c-parport-light.c b/drivers/i2c/busses/i2c-parport-light.c
index 62f55fe624cb..d1f625f923c7 100644
--- a/drivers/i2c/busses/i2c-parport-light.c
+++ b/drivers/i2c/busses/i2c-parport-light.c
@@ -18,10 +18,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index a27aae2d6757..a1fac5aa9bae 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -18,10 +18,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-parport.h b/drivers/i2c/busses/i2c-parport.h
index e572f3aac0f7..4e1294536805 100644
--- a/drivers/i2c/busses/i2c-parport.h
+++ b/drivers/i2c/busses/i2c-parport.h
@@ -12,10 +12,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #define PORT_DATA       0
diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c
index 7a9dce43e115..df1dbc92a024 100644
--- a/drivers/i2c/busses/i2c-pasemi.c
+++ b/drivers/i2c/busses/i2c-pasemi.c
@@ -11,10 +11,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
  */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index 323f061a3163..e0eb4ca0102e 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -12,10 +12,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index a6f54ba27e2a..67cbec6796a0 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -11,10 +11,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c
index 8564768fee32..177834e2d841 100644
--- a/drivers/i2c/busses/i2c-pmcmsp.c
+++ b/drivers/i2c/busses/i2c-pmcmsp.c
@@ -18,10 +18,6 @@
  *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
  *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
index 01e967763c2a..60a53c169ed2 100644
--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -14,10 +14,6 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
 
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-
 */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index e3b0337faeb7..65244774bfa3 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -14,10 +14,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 8b5e79cb4468..4855188747c9 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -14,10 +14,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 0fe505d7abe9..2b6219d86b0f 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-simtec.c b/drivers/i2c/busses/i2c-simtec.c
index 964e5c6f84ab..15ac8395dcd3 100644
--- a/drivers/i2c/busses/i2c-simtec.c
+++ b/drivers/i2c/busses/i2c-simtec.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index ac9bc33acef4..7d58a40faf2d 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -11,10 +11,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /* Note: we assume there can only be one SIS5595 with one SMBus interface */
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index c6366733008d..1e6805b5cef2 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -10,10 +10,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-sis96x.c b/drivers/i2c/busses/i2c-sis96x.c
index 8dc2fc5f74ff..44b904426073 100644
--- a/drivers/i2c/busses/i2c-sis96x.c
+++ b/drivers/i2c/busses/i2c-sis96x.c
@@ -10,10 +10,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-taos-evm.c b/drivers/i2c/busses/i2c-taos-evm.c
index 10855a0b7e7f..4c7fc2d47014 100644
--- a/drivers/i2c/busses/i2c-taos-evm.c
+++ b/drivers/i2c/busses/i2c-taos-evm.c
@@ -13,10 +13,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 
 #include <linux/delay.h>
diff --git a/drivers/i2c/busses/i2c-via.c b/drivers/i2c/busses/i2c-via.c
index f4a1ed757612..59b1d233ca7b 100644
--- a/drivers/i2c/busses/i2c-via.c
+++ b/drivers/i2c/busses/i2c-via.c
@@ -12,10 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
index 6841200b6e50..0ee2646f3b00 100644
--- a/drivers/i2c/busses/i2c-viapro.c
+++ b/drivers/i2c/busses/i2c-viapro.c
@@ -13,10 +13,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index ade9223912d3..cc65ea0b818f 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
  *
  * This code was implemented by Mocean Laboratories AB when porting linux
  * to the automotive development board Russellville. The copyright holder
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index ff3f5747e43b..5153354b1a6b 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -17,10 +17,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
diff --git a/drivers/i2c/i2c-boardinfo.c b/drivers/i2c/i2c-boardinfo.c
index f24cc64e2e8c..90e322959303 100644
--- a/drivers/i2c/i2c-boardinfo.c
+++ b/drivers/i2c/i2c-boardinfo.c
@@ -10,11 +10,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 2f90ac6a7f79..f43b4e11647a 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -10,12 +10,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.                                                       */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 /* With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi>.
@@ -670,6 +665,9 @@ static int i2c_device_remove(struct device *dev)
                 status = driver->remove(client);
         }
 
+        if (dev->of_node)
+                irq_dispose_mapping(client->irq);
+
         dev_pm_domain_detach(&client->dev, true);
         return status;
 }
diff --git a/drivers/i2c/i2c-core.h b/drivers/i2c/i2c-core.h
index 18a8fd21d2c2..17700bfddcf5 100644
--- a/drivers/i2c/i2c-core.h
+++ b/drivers/i2c/i2c-core.h
@@ -10,11 +10,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/rwsem.h>
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 80b47e8ce030..71c7a3975b62 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -14,11 +14,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.
 */
 
 /* Note that this is a complete rewrite of Simon Vogl's i2c-dev module.
diff --git a/drivers/i2c/i2c-smbus.c b/drivers/i2c/i2c-smbus.c
index fc99f0d6b4a5..9ebf9cb4ad7a 100644
--- a/drivers/i2c/i2c-smbus.c
+++ b/drivers/i2c/i2c-smbus.c
@@ -13,11 +13,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c
index d241aa295d96..af2a94e1140b 100644
--- a/drivers/i2c/i2c-stub.c
+++ b/drivers/i2c/i2c-stub.c
@@ -13,10 +13,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #define DEBUG 1
diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
index 22c096ce39ad..513bd6d14293 100644
--- a/drivers/iio/accel/bmc150-accel.c
+++ b/drivers/iio/accel/bmc150-accel.c
@@ -44,6 +44,9 @@
 
 #define BMC150_ACCEL_REG_INT_STATUS_2           0x0B
 #define BMC150_ACCEL_ANY_MOTION_MASK            0x07
+#define BMC150_ACCEL_ANY_MOTION_BIT_X           BIT(0)
+#define BMC150_ACCEL_ANY_MOTION_BIT_Y           BIT(1)
+#define BMC150_ACCEL_ANY_MOTION_BIT_Z           BIT(2)
 #define BMC150_ACCEL_ANY_MOTION_BIT_SIGN        BIT(3)
 
 #define BMC150_ACCEL_REG_PMU_LPW                0x11
@@ -92,9 +95,9 @@
 #define BMC150_ACCEL_SLOPE_THRES_MASK           0xFF
 
 /* Slope duration in terms of number of samples */
-#define BMC150_ACCEL_DEF_SLOPE_DURATION 2
+#define BMC150_ACCEL_DEF_SLOPE_DURATION         1
 /* in terms of multiples of g's/LSB, based on range */
-#define BMC150_ACCEL_DEF_SLOPE_THRESHOLD        5
+#define BMC150_ACCEL_DEF_SLOPE_THRESHOLD        1
 
 #define BMC150_ACCEL_REG_XOUT_L         0x02
 
@@ -536,6 +539,9 @@ static int bmc150_accel_set_power_state(struct bmc150_accel_data *data, bool on)
         if (ret < 0) {
                 dev_err(&data->client->dev,
                         "Failed: bmc150_accel_set_power_state for %d\n", on);
+                if (on)
+                        pm_runtime_put_noidle(&data->client->dev);
+
                 return ret;
         }
 
@@ -811,6 +817,7 @@ static int bmc150_accel_write_event_config(struct iio_dev *indio_dev,
 
         ret =  bmc150_accel_setup_any_motion_interrupt(data, state);
         if (ret < 0) {
+                bmc150_accel_set_power_state(data, false);
                 mutex_unlock(&data->mutex);
                 return ret;
         }
@@ -846,7 +853,7 @@ static const struct attribute_group bmc150_accel_attrs_group = {
 
 static const struct iio_event_spec bmc150_accel_event = {
                 .type = IIO_EV_TYPE_ROC,
-                .dir = IIO_EV_DIR_RISING | IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_EITHER,
                 .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                  BIT(IIO_EV_INFO_ENABLE) |
                                  BIT(IIO_EV_INFO_PERIOD)
@@ -1054,6 +1061,7 @@ static int bmc150_accel_data_rdy_trigger_set_state(struct iio_trigger *trig,
         else
                 ret = bmc150_accel_setup_new_data_interrupt(data, state);
         if (ret < 0) {
+                bmc150_accel_set_power_state(data, false);
                 mutex_unlock(&data->mutex);
                 return ret;
         }
@@ -1092,12 +1100,26 @@ static irqreturn_t bmc150_accel_event_handler(int irq, void *private)
         else
                 dir = IIO_EV_DIR_RISING;
 
-        if (ret & BMC150_ACCEL_ANY_MOTION_MASK)
+        if (ret & BMC150_ACCEL_ANY_MOTION_BIT_X)
+                iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ACCEL,
+                                                        0,
+                                                        IIO_MOD_X,
+                                                        IIO_EV_TYPE_ROC,
+                                                        dir),
+                                                        data->timestamp);
+        if (ret & BMC150_ACCEL_ANY_MOTION_BIT_Y)
                 iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ACCEL,
                                                         0,
-                                                        IIO_MOD_X_OR_Y_OR_Z,
+                                                        IIO_MOD_Y,
                                                         IIO_EV_TYPE_ROC,
-                                                        IIO_EV_DIR_EITHER),
+                                                        dir),
+                                                        data->timestamp);
+        if (ret & BMC150_ACCEL_ANY_MOTION_BIT_Z)
+                iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ACCEL,
+                                                        0,
+                                                        IIO_MOD_Z,
+                                                        IIO_EV_TYPE_ROC,
+                                                        dir),
                                                         data->timestamp);
 ack_intr_status:
         if (!data->dready_trigger_on)
@@ -1354,10 +1376,14 @@ static int bmc150_accel_runtime_suspend(struct device *dev)
 {
         struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
         struct bmc150_accel_data *data = iio_priv(indio_dev);
+        int ret;
 
         dev_dbg(&data->client->dev,  __func__);
+        ret = bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_SUSPEND, 0);
+        if (ret < 0)
+                return -EAGAIN;
 
-        return bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_SUSPEND, 0);
+        return 0;
 }
 
 static int bmc150_accel_runtime_resume(struct device *dev)
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 98909a9e284e..320aa72c0349 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -269,6 +269,8 @@ static int kxcjk1013_set_range(struct kxcjk1013_data *data, int range_index)
                 return ret;
         }
 
+        ret &= ~(KXCJK1013_REG_CTRL1_BIT_GSEL0 |
+                 KXCJK1013_REG_CTRL1_BIT_GSEL1);
         ret |= (KXCJK1013_scale_table[range_index].gsel_0 << 3);
         ret |= (KXCJK1013_scale_table[range_index].gsel_1 << 4);
 
@@ -894,7 +896,7 @@ static const struct attribute_group kxcjk1013_attrs_group = {
 
 static const struct iio_event_spec kxcjk1013_event = {
                 .type = IIO_EV_TYPE_THRESH,
-                .dir = IIO_EV_DIR_RISING | IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_EITHER,
                 .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                  BIT(IIO_EV_INFO_ENABLE) |
                                  BIT(IIO_EV_INFO_PERIOD)
diff --git a/drivers/iio/adc/men_z188_adc.c b/drivers/iio/adc/men_z188_adc.c
index b58d6302521f..d095efe1ba14 100644
--- a/drivers/iio/adc/men_z188_adc.c
+++ b/drivers/iio/adc/men_z188_adc.c
@@ -152,6 +152,7 @@ static void men_z188_remove(struct mcb_device *dev)
 
 static const struct mcb_device_id men_z188_ids[] = {
         { .device = 0xbc },
+        { }
 };
 MODULE_DEVICE_TABLE(mcb, men_z188_ids);
 
diff --git a/drivers/iio/common/st_sensors/st_sensors_buffer.c b/drivers/iio/common/st_sensors/st_sensors_buffer.c
index 1665c8e4b62b..e18bc6782256 100644
--- a/drivers/iio/common/st_sensors/st_sensors_buffer.c
+++ b/drivers/iio/common/st_sensors/st_sensors_buffer.c
@@ -71,7 +71,7 @@ int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf)
                                 goto st_sensors_free_memory;
                         }
 
-                        for (i = 0; i < n * num_data_channels; i++) {
+                        for (i = 0; i < n * byte_for_channel; i++) {
                                 if (i < n)
                                         buf[i] = rx_array[i];
                                 else
diff --git a/drivers/iio/gyro/bmg160.c b/drivers/iio/gyro/bmg160.c
index 1f967e0d688e..d2fa526740ca 100644
--- a/drivers/iio/gyro/bmg160.c
+++ b/drivers/iio/gyro/bmg160.c
@@ -67,6 +67,9 @@
 #define BMG160_REG_INT_EN_0             0x15
 #define BMG160_DATA_ENABLE_INT          BIT(7)
 
+#define BMG160_REG_INT_EN_1             0x16
+#define BMG160_INT1_BIT_OD              BIT(1)
+
 #define BMG160_REG_XOUT_L               0x02
 #define BMG160_AXIS_TO_REG(axis)        (BMG160_REG_XOUT_L + (axis * 2))
 
@@ -82,6 +85,9 @@
 
 #define BMG160_REG_INT_STATUS_2 0x0B
 #define BMG160_ANY_MOTION_MASK          0x07
+#define BMG160_ANY_MOTION_BIT_X         BIT(0)
+#define BMG160_ANY_MOTION_BIT_Y         BIT(1)
+#define BMG160_ANY_MOTION_BIT_Z         BIT(2)
 
 #define BMG160_REG_TEMP         0x08
 #define BMG160_TEMP_CENTER_VAL          23
@@ -222,6 +228,19 @@ static int bmg160_chip_init(struct bmg160_data *data)
         data->slope_thres = ret;
 
         /* Set default interrupt mode */
+        ret = i2c_smbus_read_byte_data(data->client, BMG160_REG_INT_EN_1);
+        if (ret < 0) {
+                dev_err(&data->client->dev, "Error reading reg_int_en_1\n");
+                return ret;
+        }
+        ret &= ~BMG160_INT1_BIT_OD;
+        ret = i2c_smbus_write_byte_data(data->client,
+                                        BMG160_REG_INT_EN_1, ret);
+        if (ret < 0) {
+                dev_err(&data->client->dev, "Error writing reg_int_en_1\n");
+                return ret;
+        }
+
         ret = i2c_smbus_write_byte_data(data->client,
                                         BMG160_REG_INT_RST_LATCH,
                                         BMG160_INT_MODE_LATCH_INT |
@@ -250,6 +269,9 @@ static int bmg160_set_power_state(struct bmg160_data *data, bool on)
         if (ret < 0) {
                 dev_err(&data->client->dev,
                         "Failed: bmg160_set_power_state for %d\n", on);
+                if (on)
+                        pm_runtime_put_noidle(&data->client->dev);
+
                 return ret;
         }
 #endif
@@ -705,6 +727,7 @@ static int bmg160_write_event_config(struct iio_dev *indio_dev,
 
         ret =  bmg160_setup_any_motion_interrupt(data, state);
         if (ret < 0) {
+                bmg160_set_power_state(data, false);
                 mutex_unlock(&data->mutex);
                 return ret;
         }
@@ -743,7 +766,7 @@ static const struct attribute_group bmg160_attrs_group = {
 
 static const struct iio_event_spec bmg160_event = {
                 .type = IIO_EV_TYPE_ROC,
-                .dir = IIO_EV_DIR_RISING | IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_EITHER,
                 .mask_shared_by_type = BIT(IIO_EV_INFO_VALUE) |
                                        BIT(IIO_EV_INFO_ENABLE)
 };
@@ -871,6 +894,7 @@ static int bmg160_data_rdy_trigger_set_state(struct iio_trigger *trig,
         else
                 ret = bmg160_setup_new_data_interrupt(data, state);
         if (ret < 0) {
+                bmg160_set_power_state(data, false);
                 mutex_unlock(&data->mutex);
                 return ret;
         }
@@ -908,10 +932,24 @@ static irqreturn_t bmg160_event_handler(int irq, void *private)
         else
                 dir = IIO_EV_DIR_FALLING;
 
-        if (ret & BMG160_ANY_MOTION_MASK)
+        if (ret & BMG160_ANY_MOTION_BIT_X)
                 iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ANGL_VEL,
                                                         0,
-                                                        IIO_MOD_X_OR_Y_OR_Z,
+                                                        IIO_MOD_X,
+                                                        IIO_EV_TYPE_ROC,
+                                                        dir),
+                                                        data->timestamp);
+        if (ret & BMG160_ANY_MOTION_BIT_Y)
+                iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ANGL_VEL,
+                                                        0,
+                                                        IIO_MOD_Y,
+                                                        IIO_EV_TYPE_ROC,
+                                                        dir),
+                                                        data->timestamp);
+        if (ret & BMG160_ANY_MOTION_BIT_Z)
+                iio_push_event(indio_dev, IIO_MOD_EVENT_CODE(IIO_ANGL_VEL,
+                                                        0,
+                                                        IIO_MOD_Z,
                                                         IIO_EV_TYPE_ROC,
                                                         dir),
                                                         data->timestamp);
@@ -1169,8 +1207,15 @@ static int bmg160_runtime_suspend(struct device *dev)
 {
         struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
         struct bmg160_data *data = iio_priv(indio_dev);
+        int ret;
+
+        ret = bmg160_set_mode(data, BMG160_MODE_SUSPEND);
+        if (ret < 0) {
+                dev_err(&data->client->dev, "set mode failed\n");
+                return -EAGAIN;
+        }
 
-        return bmg160_set_mode(data, BMG160_MODE_SUSPEND);
+        return 0;
 }
 
 static int bmg160_runtime_resume(struct device *dev)
diff --git a/drivers/iio/light/tsl4531.c b/drivers/iio/light/tsl4531.c
index a15006efa137..0763b8632573 100644
--- a/drivers/iio/light/tsl4531.c
+++ b/drivers/iio/light/tsl4531.c
@@ -230,9 +230,12 @@ static int tsl4531_resume(struct device *dev)
         return i2c_smbus_write_byte_data(to_i2c_client(dev), TSL4531_CONTROL,
                 TSL4531_MODE_NORMAL);
 }
-#endif
 
 static SIMPLE_DEV_PM_OPS(tsl4531_pm_ops, tsl4531_suspend, tsl4531_resume);
+#define TSL4531_PM_OPS (&tsl4531_pm_ops)
+#else
+#define TSL4531_PM_OPS NULL
+#endif
 
 static const struct i2c_device_id tsl4531_id[] = {
         { "tsl4531", 0 },
@@ -243,7 +246,7 @@ MODULE_DEVICE_TABLE(i2c, tsl4531_id);
 static struct i2c_driver tsl4531_driver = {
         .driver = {
                 .name   = TSL4531_DRV_NAME,
-                .pm     = &tsl4531_pm_ops,
+                .pm     = TSL4531_PM_OPS,
                 .owner  = THIS_MODULE,
         },
         .probe  = tsl4531_probe,
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 5e780ef206f3..8349cc0fdf66 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -330,7 +330,7 @@ static int as3935_probe(struct spi_device *spi)
                 return -EINVAL;
         }
 
-        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(st));
+        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
         if (!indio_dev)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index bda5994ceb68..8b72cf392b34 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1173,18 +1173,24 @@ static struct ib_flow *mlx4_ib_create_flow(struct ib_qp *qp,
                 err = __mlx4_ib_create_flow(qp, flow_attr, domain, type[i],
                                             &mflow->reg_id[i]);
                 if (err)
-                        goto err_free;
+                        goto err_create_flow;
                 i++;
         }
 
         if (i < ARRAY_SIZE(type) && flow_attr->type == IB_FLOW_ATTR_NORMAL) {
                 err = mlx4_ib_tunnel_steer_add(qp, flow_attr, &mflow->reg_id[i]);
                 if (err)
-                        goto err_free;
+                        goto err_create_flow;
+                i++;
         }
 
         return &mflow->ibflow;
 
+err_create_flow:
+        while (i) {
+                (void)__mlx4_ib_destroy_flow(to_mdev(qp->device)->dev, mflow->reg_id[i]);
+                i--;
+        }
 err_free:
         kfree(mflow);
         return ERR_PTR(err);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 0bea5776bcbc..10641b7816f4 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -115,9 +115,12 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
         attr.cap.max_recv_wr = ISERT_QP_MAX_RECV_DTOS;
         /*
          * FIXME: Use devattr.max_sge - 2 for max_send_sge as
-         * work-around for RDMA_READ..
+         * work-around for RDMA_READs with ConnectX-2.
+         *
+         * Also, still make sure to have at least two SGEs for
+         * outgoing control PDU responses.
          */
-        attr.cap.max_send_sge = device->dev_attr.max_sge - 2;
+        attr.cap.max_send_sge = max(2, device->dev_attr.max_sge - 2);
         isert_conn->max_sge = attr.cap.max_send_sge;
 
         attr.cap.max_recv_sge = 1;
@@ -225,12 +228,16 @@ isert_create_device_ib_res(struct isert_device *device)
         struct isert_cq_desc *cq_desc;
         struct ib_device_attr *dev_attr;
         int ret = 0, i, j;
+        int max_rx_cqe, max_tx_cqe;
 
         dev_attr = &device->dev_attr;
         ret = isert_query_device(ib_dev, dev_attr);
         if (ret)
                 return ret;
 
+        max_rx_cqe = min(ISER_MAX_RX_CQ_LEN, dev_attr->max_cqe);
+        max_tx_cqe = min(ISER_MAX_TX_CQ_LEN, dev_attr->max_cqe);
+
         /* asign function handlers */
         if (dev_attr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS &&
             dev_attr->device_cap_flags & IB_DEVICE_SIGNATURE_HANDOVER) {
@@ -272,7 +279,7 @@ isert_create_device_ib_res(struct isert_device *device)
                                                 isert_cq_rx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
-                                                ISER_MAX_RX_CQ_LEN, i);
+                                                max_rx_cqe, i);
                 if (IS_ERR(device->dev_rx_cq[i])) {
                         ret = PTR_ERR(device->dev_rx_cq[i]);
                         device->dev_rx_cq[i] = NULL;
@@ -284,7 +291,7 @@ isert_create_device_ib_res(struct isert_device *device)
                                                 isert_cq_tx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
-                                                ISER_MAX_TX_CQ_LEN, i);
+                                                max_tx_cqe, i);
                 if (IS_ERR(device->dev_tx_cq[i])) {
                         ret = PTR_ERR(device->dev_tx_cq[i]);
                         device->dev_tx_cq[i] = NULL;
@@ -803,14 +810,25 @@ wake_up:
         complete(&isert_conn->conn_wait);
 }
 
-static void
+static int
 isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
 {
-        struct isert_conn *isert_conn = (struct isert_conn *)cma_id->context;
+        struct isert_conn *isert_conn;
+
+        if (!cma_id->qp) {
+                struct isert_np *isert_np = cma_id->context;
+
+                isert_np->np_cm_id = NULL;
+                return -1;
+        }
+
+        isert_conn = (struct isert_conn *)cma_id->context;
 
         isert_conn->disconnect = disconnect;
         INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
         schedule_work(&isert_conn->conn_logout_work);
+
+        return 0;
 }
 
 static int
@@ -825,6 +843,9 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         switch (event->event) {
         case RDMA_CM_EVENT_CONNECT_REQUEST:
                 ret = isert_connect_request(cma_id, event);
+                if (ret)
+                        pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
+                                event->event, ret);
                 break;
         case RDMA_CM_EVENT_ESTABLISHED:
                 isert_connected_handler(cma_id);
@@ -834,7 +855,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
                 disconnect = true;
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
-                isert_disconnected_handler(cma_id, disconnect);
+                ret = isert_disconnected_handler(cma_id, disconnect);
                 break;
         case RDMA_CM_EVENT_CONNECT_ERROR:
         default:
@@ -842,12 +863,6 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 break;
         }
 
-        if (ret != 0) {
-                pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
-                       event->event, ret);
-                dump_stack();
-        }
-
         return ret;
 }
 
@@ -2185,7 +2200,7 @@ isert_put_response(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
                 isert_cmd->tx_desc.num_sge = 2;
         }
 
-        isert_init_send_wr(isert_conn, isert_cmd, send_wr, true);
+        isert_init_send_wr(isert_conn, isert_cmd, send_wr, false);
 
         pr_debug("Posting SCSI Response IB_WR_SEND >>>>>>>>>>>>>>>>>>>>>>\n");
 
@@ -2871,7 +2886,7 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
                                      &isert_cmd->tx_desc.iscsi_header);
                 isert_init_tx_hdrs(isert_conn, &isert_cmd->tx_desc);
                 isert_init_send_wr(isert_conn, isert_cmd,
-                                   &isert_cmd->tx_desc.send_wr, true);
+                                   &isert_cmd->tx_desc.send_wr, false);
                 isert_cmd->rdma_wr.s_send_wr.next = &isert_cmd->tx_desc.send_wr;
                 wr->send_wr_num += 1;
         }
@@ -3140,7 +3155,7 @@ isert_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
 
 accept_wait:
         ret = down_interruptible(&isert_np->np_sem);
-        if (max_accept > 5)
+        if (ret || max_accept > 5)
                 return -ENODEV;
 
         spin_lock_bh(&np->np_thread_lock);
@@ -3190,7 +3205,8 @@ isert_free_np(struct iscsi_np *np)
 {
         struct isert_np *isert_np = (struct isert_np *)np->np_context;
 
-        rdma_destroy_id(isert_np->np_cm_id);
+        if (isert_np->np_cm_id)
+                rdma_destroy_id(isert_np->np_cm_id);
 
         np->np_context = NULL;
         kfree(isert_np);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 7206547c13ce..dc829682701a 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -2092,6 +2092,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
         if (!qp_init)
                 goto out;
 
+retry:
         ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch,
                               ch->rq_size + srp_sq_size, 0);
         if (IS_ERR(ch->cq)) {
@@ -2115,6 +2116,13 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
         ch->qp = ib_create_qp(sdev->pd, qp_init);
         if (IS_ERR(ch->qp)) {
                 ret = PTR_ERR(ch->qp);
+                if (ret == -ENOMEM) {
+                        srp_sq_size /= 2;
+                        if (srp_sq_size >= MIN_SRPT_SQ_SIZE) {
+                                ib_destroy_cq(ch->cq);
+                                goto retry;
+                        }
+                }
                 printk(KERN_ERR "failed to create_qp ret= %d\n", ret);
                 goto err_destroy_cq;
         }
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index bc203485716d..8afa28e4570e 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -421,7 +421,7 @@ static int evdev_open(struct inode *inode, struct file *file)
 
  err_free_client:
         evdev_detach_client(evdev, client);
-        kfree(client);
+        kvfree(client);
         return error;
 }
 
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 2ed7905a068f..fc55f0d15b70 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1179,9 +1179,19 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                 }
 
                 ep_irq_in = &intf->cur_altsetting->endpoint[1].desc;
-                usb_fill_bulk_urb(xpad->bulk_out, udev,
-                                usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress),
-                                xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad);
+                if (usb_endpoint_is_bulk_out(ep_irq_in)) {
+                        usb_fill_bulk_urb(xpad->bulk_out, udev,
+                                          usb_sndbulkpipe(udev,
+                                                          ep_irq_in->bEndpointAddress),
+                                          xpad->bdata, XPAD_PKT_LEN,
+                                          xpad_bulk_out, xpad);
+                } else {
+                        usb_fill_int_urb(xpad->bulk_out, udev,
+                                         usb_sndintpipe(udev,
+                                                        ep_irq_in->bEndpointAddress),
+                                         xpad->bdata, XPAD_PKT_LEN,
+                                         xpad_bulk_out, xpad, 0);
+                }
 
                 /*
                  * Submit the int URB immediately rather than waiting for open
diff --git a/drivers/input/keyboard/opencores-kbd.c b/drivers/input/keyboard/opencores-kbd.c
index 62abe2c16670..f8502bb29176 100644
--- a/drivers/input/keyboard/opencores-kbd.c
+++ b/drivers/input/keyboard/opencores-kbd.c
@@ -70,7 +70,7 @@ static int opencores_kbd_probe(struct platform_device *pdev)
 
         opencores_kbd->addr = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(opencores_kbd->addr))
-                error = PTR_ERR(opencores_kbd->addr);
+                return PTR_ERR(opencores_kbd->addr);
 
         input->name = pdev->name;
         input->phys = "opencores-kbd/input0";
diff --git a/drivers/input/keyboard/stmpe-keypad.c b/drivers/input/keyboard/stmpe-keypad.c
index c6727dda68f2..ef5e67fb567e 100644
--- a/drivers/input/keyboard/stmpe-keypad.c
+++ b/drivers/input/keyboard/stmpe-keypad.c
@@ -86,7 +86,7 @@ static const struct stmpe_keypad_variant stmpe_keypad_variants[] = {
                 .max_cols               = 8,
                 .max_rows               = 12,
                 .col_gpios              = 0x0000ff,     /* GPIO 0 - 7*/
-                .row_gpios              = 0x1fef00,     /* GPIO 8-14, 16-20 */
+                .row_gpios              = 0x1f7f00,     /* GPIO 8-14, 16-20 */
         },
         [STMPE2403] = {
                 .auto_increment         = true,
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 719410feb84b..afed8e2b2f94 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1381,7 +1381,7 @@ static ssize_t ims_pcu_ofn_reg_addr_store(struct device *dev,
         pcu->ofn_reg_addr = value;
         mutex_unlock(&pcu->cmd_mutex);
 
-        return error ?: count;
+        return count;
 }
 
 static DEVICE_ATTR(reg_addr, S_IRUGO | S_IWUSR,
diff --git a/drivers/input/misc/max77693-haptic.c b/drivers/input/misc/max77693-haptic.c
index 7b1fde93799e..ef6a9d650d69 100644
--- a/drivers/input/misc/max77693-haptic.c
+++ b/drivers/input/misc/max77693-haptic.c
@@ -194,7 +194,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
                                        struct ff_effect *effect)
 {
         struct max77693_haptic *haptic = input_get_drvdata(dev);
-        uint64_t period_mag_multi;
+        u64 period_mag_multi;
 
         haptic->magnitude = effect->u.rumble.strong_magnitude;
         if (!haptic->magnitude)
@@ -205,8 +205,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
          * The formula to convert magnitude to pwm_duty as follows:
          * - pwm_duty = (magnitude * pwm_period) / MAX_MAGNITUDE(0xFFFF)
          */
-        period_mag_multi = (int64_t)(haptic->pwm_dev->period *
-                                                haptic->magnitude);
+        period_mag_multi = (u64)haptic->pwm_dev->period * haptic->magnitude;
         haptic->pwm_duty = (unsigned int)(period_mag_multi >>
                                                 MAX_MAGNITUDE_SHIFT);
 
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index 735604753568..e097f1ab427f 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -55,7 +55,7 @@ static int soc_button_lookup_gpio(struct device *dev, int acpi_index)
         struct gpio_desc *desc;
         int gpio;
 
-        desc = gpiod_get_index(dev, KBUILD_MODNAME, acpi_index);
+        desc = gpiod_get_index(dev, KBUILD_MODNAME, acpi_index, GPIOD_ASIS);
         if (IS_ERR(desc))
                 return PTR_ERR(desc);
 
diff --git a/drivers/input/misc/twl4030-pwrbutton.c b/drivers/input/misc/twl4030-pwrbutton.c
index fb3b63b2f85c..8400a1a34d87 100644
--- a/drivers/input/misc/twl4030-pwrbutton.c
+++ b/drivers/input/misc/twl4030-pwrbutton.c
@@ -85,6 +85,7 @@ static int twl4030_pwrbutton_probe(struct platform_device *pdev)
         }
 
         platform_set_drvdata(pdev, pwr);
+        device_init_wakeup(&pdev->dev, true);
 
         return 0;
 }
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 2b0ae8cc8e51..d125a019383f 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1156,7 +1156,13 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
 {
         struct alps_data *priv = psmouse->private;
 
-        if ((psmouse->packet[0] & 0xc8) == 0x08) { /* PS/2 packet */
+        /*
+         * Check if we are dealing with a bare PS/2 packet, presumably from
+         * a device connected to the external PS/2 port. Because bare PS/2
+         * protocol does not have enough constant bits to self-synchronize
+         * properly we only do this if the device is fully synchronized.
+         */
+        if (!psmouse->out_of_sync_cnt && (psmouse->packet[0] & 0xc8) == 0x08) {
                 if (psmouse->pktcnt == 3) {
                         alps_report_bare_ps2_packet(psmouse, psmouse->packet,
                                                     true);
@@ -1180,12 +1186,27 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
         }
 
         /* Bytes 2 - pktsize should have 0 in the highest bit */
-        if ((priv->proto_version < ALPS_PROTO_V5) &&
+        if (priv->proto_version < ALPS_PROTO_V5 &&
             psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
             (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
                 psmouse_dbg(psmouse, "refusing packet[%i] = %x\n",
                             psmouse->pktcnt - 1,
                             psmouse->packet[psmouse->pktcnt - 1]);
+
+                if (priv->proto_version == ALPS_PROTO_V3 &&
+                    psmouse->pktcnt == psmouse->pktsize) {
+                        /*
+                         * Some Dell boxes, such as Latitude E6440 or E7440
+                         * with closed lid, quite often smash last byte of
+                         * otherwise valid packet with 0xff. Given that the
+                         * next packet is very likely to be valid let's
+                         * report PSMOUSE_FULL_PACKET but not process data,
+                         * rather than reporting PSMOUSE_BAD_DATA and
+                         * filling the logs.
+                         */
+                        return PSMOUSE_FULL_PACKET;
+                }
+
                 return PSMOUSE_BAD_DATA;
         }
 
@@ -2389,6 +2410,9 @@ int alps_init(struct psmouse *psmouse)
         /* We are having trouble resyncing ALPS touchpads so disable it for now */
         psmouse->resync_time = 0;
 
+        /* Allow 2 invalid packets without resetting device */
+        psmouse->resetafter = psmouse->pktsize * 2;
+
         return 0;
 
 init_fail:
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 06fc6e76ffbe..f2b978026407 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -428,14 +428,6 @@ static void elantech_report_trackpoint(struct psmouse *psmouse,
         int x, y;
         u32 t;
 
-        if (dev_WARN_ONCE(&psmouse->ps2dev.serio->dev,
-                          !tp_dev,
-                          psmouse_fmt("Unexpected trackpoint message\n"))) {
-                if (etd->debug == 1)
-                        elantech_packet_dump(psmouse);
-                return;
-        }
-
         t = get_unaligned_le32(&packet[0]);
 
         switch (t & ~7U) {
@@ -563,6 +555,7 @@ static void elantech_input_sync_v4(struct psmouse *psmouse)
         } else {
                 input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
                 input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
+                input_report_key(dev, BTN_MIDDLE, packet[0] & 0x04);
         }
 
         input_mt_report_pointer_emulation(dev, true);
@@ -792,6 +785,9 @@ static int elantech_packet_check_v4(struct psmouse *psmouse)
         unsigned char packet_type = packet[3] & 0x03;
         bool sanity_check;
 
+        if (etd->tp_dev && (packet[3] & 0x0f) == 0x06)
+                return PACKET_TRACKPOINT;
+
         /*
          * Sanity check based on the constant bits of a packet.
          * The constant bits change depending on the value of
@@ -877,10 +873,19 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
 
         case 4:
                 packet_type = elantech_packet_check_v4(psmouse);
-                if (packet_type == PACKET_UNKNOWN)
+                switch (packet_type) {
+                case PACKET_UNKNOWN:
                         return PSMOUSE_BAD_DATA;
 
-                elantech_report_absolute_v4(psmouse, packet_type);
+                case PACKET_TRACKPOINT:
+                        elantech_report_trackpoint(psmouse, packet_type);
+                        break;
+
+                default:
+                        elantech_report_absolute_v4(psmouse, packet_type);
+                        break;
+                }
+
                 break;
         }
 
@@ -1120,6 +1125,22 @@ static void elantech_set_buttonpad_prop(struct psmouse *psmouse)
 }
 
 /*
+ * Some hw_version 4 models do have a middle button
+ */
+static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                /* Fujitsu H730 has a middle button */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
+                },
+        },
+#endif
+        { }
+};
+
+/*
  * Set the appropriate event bits for the input subsystem
  */
 static int elantech_set_input_params(struct psmouse *psmouse)
@@ -1138,6 +1159,8 @@ static int elantech_set_input_params(struct psmouse *psmouse)
         __clear_bit(EV_REL, dev->evbit);
 
         __set_bit(BTN_LEFT, dev->keybit);
+        if (dmi_check_system(elantech_dmi_has_middle_button))
+                __set_bit(BTN_MIDDLE, dev->keybit);
         __set_bit(BTN_RIGHT, dev->keybit);
 
         __set_bit(BTN_TOUCH, dev->keybit);
@@ -1299,6 +1322,7 @@ ELANTECH_INT_ATTR(reg_25, 0x25);
 ELANTECH_INT_ATTR(reg_26, 0x26);
 ELANTECH_INT_ATTR(debug, 0);
 ELANTECH_INT_ATTR(paritycheck, 0);
+ELANTECH_INT_ATTR(crc_enabled, 0);
 
 static struct attribute *elantech_attrs[] = {
         &psmouse_attr_reg_07.dattr.attr,
@@ -1313,6 +1337,7 @@ static struct attribute *elantech_attrs[] = {
         &psmouse_attr_reg_26.dattr.attr,
         &psmouse_attr_debug.dattr.attr,
         &psmouse_attr_paritycheck.dattr.attr,
+        &psmouse_attr_crc_enabled.dattr.attr,
         NULL
 };
 
@@ -1439,6 +1464,22 @@ static int elantech_reconnect(struct psmouse *psmouse)
 }
 
 /*
+ * Some hw_version 4 models do not work with crc_disabled
+ */
+static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                /* Fujitsu H730 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
+                },
+        },
+#endif
+        { }
+};
+
+/*
  * Some hw_version 3 models go into error state when we try to set
  * bit 3 and/or bit 1 of r10.
  */
@@ -1513,7 +1554,8 @@ static int elantech_set_properties(struct elantech_data *etd)
          * The signatures of v3 and v4 packets change depending on the
          * value of this hardware flag.
          */
-        etd->crc_enabled = ((etd->fw_version & 0x4000) == 0x4000);
+        etd->crc_enabled = (etd->fw_version & 0x4000) == 0x4000 ||
+                           dmi_check_system(elantech_dmi_force_crc_enabled);
 
         /* Enable real hardware resolution on hw_version 3 ? */
         etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 26994f6a2b2a..95a3a6e2faf6 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1536,16 +1536,9 @@ static int psmouse_reconnect(struct serio *serio)
 {
         struct psmouse *psmouse = serio_get_drvdata(serio);
         struct psmouse *parent = NULL;
-        struct serio_driver *drv = serio->drv;
         unsigned char type;
         int rc = -1;
 
-        if (!drv || !psmouse) {
-                psmouse_dbg(psmouse,
-                            "reconnect request, but serio is disconnected, ignoring...\n");
-                return -1;
-        }
-
         mutex_lock(&psmouse_mutex);
 
         if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 9031a0a28ea4..f9472920d986 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -135,14 +135,18 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
                 1232, 5710, 1156, 4696
         },
         {
-                (const char * const []){"LEN0034", "LEN0036", "LEN2002",
-                                        "LEN2004", NULL},
+                (const char * const []){"LEN0034", "LEN0036", "LEN0039",
+                                        "LEN2002", "LEN2004", NULL},
                 1024, 5112, 2024, 4832
         },
         {
                 (const char * const []){"LEN2001", NULL},
                 1024, 5022, 2508, 4832
         },
+        {
+                (const char * const []){"LEN2006", NULL},
+                1264, 5675, 1171, 4688
+        },
         { }
 };
 
@@ -163,6 +167,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0036", /* T440 */
         "LEN0037",
         "LEN0038",
+        "LEN0039", /* T440s */
         "LEN0041",
         "LEN0042", /* Yoga */
         "LEN0045",
diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
index 38298232124f..abd494411e69 100644
--- a/drivers/input/mouse/vsxxxaa.c
+++ b/drivers/input/mouse/vsxxxaa.c
@@ -128,7 +128,7 @@ static void vsxxxaa_drop_bytes(struct vsxxxaa *mouse, int num)
         if (num >= mouse->count) {
                 mouse->count = 0;
         } else {
-                memmove(mouse->buf, mouse->buf + num - 1, BUFLEN - num);
+                memmove(mouse->buf, mouse->buf + num, BUFLEN - num);
                 mouse->count -= num;
         }
 }
diff --git a/drivers/input/serio/altera_ps2.c b/drivers/input/serio/altera_ps2.c
index cce69d6b9587..58781c8a8aec 100644
--- a/drivers/input/serio/altera_ps2.c
+++ b/drivers/input/serio/altera_ps2.c
@@ -37,7 +37,7 @@ static irqreturn_t altera_ps2_rxint(int irq, void *dev_id)
 {
         struct ps2if *ps2if = dev_id;
         unsigned int status;
-        int handled = IRQ_NONE;
+        irqreturn_t handled = IRQ_NONE;
 
         while ((status = readl(ps2if->base)) & 0xffff0000) {
                 serio_interrupt(ps2if->io, status & 0xff, 0);
@@ -74,7 +74,7 @@ static void altera_ps2_close(struct serio *io)
 {
         struct ps2if *ps2if = io->port_data;
 
-        writel(0, ps2if->base); /* disable rx irq */
+        writel(0, ps2if->base + 4); /* disable rx irq */
 }
 
 /*
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index a0bcbb64d06d..faeeb1372462 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -207,17 +207,282 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
 };
 
 /*
- * Some laptops do implement active multiplexing mode correctly;
- * unfortunately they are in minority.
+ * Some Fujitsu notebooks are having trouble with touchpads if
+ * active multiplexing mode is activated. Luckily they don't have
+ * external PS/2 ports so we can safely disable it.
+ * ... apparently some Toshibas don't like MUX mode either and
+ * die horrible death on reboot.
  */
-static const struct dmi_system_id __initconst i8042_dmi_mux_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+        {
+                /* Fujitsu Lifebook P7010/P7010D */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "P7010"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook P7010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "0000000000"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook P5020D */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook P Series"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook S2000 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S Series"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook S6230 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"),
+                },
+        },
+        {
+                /* Fujitsu T70H */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "FMVLT70H"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Lifebook T3010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T3010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Lifebook E4010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E4010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Amilo Pro 2010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pro V2010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Amilo Pro 2030 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
+                },
+        },
+        {
+                /*
+                 * No data is coming from the touchscreen unless KBC
+                 * is in legacy mode.
+                 */
+                /* Panasonic CF-29 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Matsushita"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CF-29"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion DV4017EA -
+                 * errors on MUX ports are reported without raising AUXDATA
+                 * causing "spurious NAK" messages.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EA032EA#ABF)"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion ZT1000 -
+                 * like DV4017EA does not raise AUXERR for errors on MUX ports.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion Notebook PC"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "HP Pavilion Notebook ZT1000"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion DV4270ca -
+                 * like DV4017EA does not raise AUXERR for errors on MUX ports.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EH476UA#ABL)"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P10"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "EQUIUM A110"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
+                },
+        },
+        {
+                /* Sharp Actius MM20 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "SHARP"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-MM20 Series"),
+                },
+        },
+        {
+                /* Sony Vaio FS-115b */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FS115B"),
+                },
+        },
+        {
+                /*
+                 * Sony Vaio FZ-240E -
+                 * reset and GET ID commands issued via KBD port are
+                 * sometimes being delivered to AUX3.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FZ240E"),
+                },
+        },
         {
                 /*
-                 * Panasonic CF-18 needs to be in MUX mode since the
-                 * touchscreen is on serio3 and it also has touchpad.
+                 * Most (all?) VAIOs do not have external PS/2 ports nor
+                 * they implement active multiplexing properly, and
+                 * MUX discovery usually messes up keyboard/touchpad.
                  */
                 .matches = {
-                        DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_BOARD_NAME, "VAIO"),
+                },
+        },
+        {
+                /* Amoi M636/A737 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Amoi Electronics CO.,LTD."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "M636/A737 platform"),
+                },
+        },
+        {
+                /* Lenovo 3000 n100 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
+                },
+        },
+        {
+                /* Acer Aspire 5710 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5710"),
+                },
+        },
+        {
+                /* Gericom Bellagio */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N34AS6"),
+                },
+        },
+        {
+                /* IBM 2656 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "IBM"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "2656"),
+                },
+        },
+        {
+                /* Dell XPS M1530 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS M1530"),
+                },
+        },
+        {
+                /* Compal HEL80I */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "COMPAL"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HEL80I"),
+                },
+        },
+        {
+                /* Dell Vostro 1510 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
+                },
+        },
+        {
+                /* Acer Aspire 5536 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+                },
+        },
+        {
+                /* Dell Vostro V13 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
+                },
+        },
+        {
+                /* Newer HP Pavilion dv4 models */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+                },
+        },
+        {
+                /* Asus X450LCP */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X450LCP"),
+                },
+        },
+        {
+                /* Avatar AVIU-145A6 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
                 },
         },
         { }
@@ -364,6 +629,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
                 },
         },
         {
+                /* Fujitsu A544 laptop */
+                /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"),
+                },
+        },
+        {
+                /* Fujitsu AH544 laptop */
+                /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"),
+                },
+        },
+        {
                 /* Fujitsu U574 laptop */
                 /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
                 .matches = {
@@ -740,8 +1021,8 @@ static int __init i8042_platform_init(void)
         if (dmi_check_system(i8042_dmi_noloop_table))
                 i8042_noloop = true;
 
-        if (dmi_check_system(i8042_dmi_mux_table))
-                i8042_nomux = false;
+        if (dmi_check_system(i8042_dmi_nomux_table))
+                i8042_nomux = true;
 
         if (dmi_check_system(i8042_dmi_notimeout_table))
                 i8042_notimeout = true;
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 9a97c2b10926..f5a98af3b325 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -39,7 +39,7 @@ static bool i8042_noaux;
 module_param_named(noaux, i8042_noaux, bool, 0);
 MODULE_PARM_DESC(noaux, "Do not probe or use AUX (mouse) port.");
 
-static bool i8042_nomux = true;
+static bool i8042_nomux;
 module_param_named(nomux, i8042_nomux, bool, 0);
 MODULE_PARM_DESC(nomux, "Do not check whether an active multiplexing controller is present.");
 
diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
index d0ef91fc87d1..b1ae77995968 100644
--- a/drivers/input/touchscreen/wm97xx-core.c
+++ b/drivers/input/touchscreen/wm97xx-core.c
@@ -70,11 +70,11 @@
  * Documentation/input/input-programming.txt for more details.
  */
 
-static int abs_x[3] = {350, 3900, 5};
+static int abs_x[3] = {150, 4000, 5};
 module_param_array(abs_x, int, NULL, 0);
 MODULE_PARM_DESC(abs_x, "Touchscreen absolute X min, max, fuzz");
 
-static int abs_y[3] = {320, 3750, 40};
+static int abs_y[3] = {200, 4000, 40};
 module_param_array(abs_y, int, NULL, 0);
 MODULE_PARM_DESC(abs_y, "Touchscreen absolute Y min, max, fuzz");
 
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 3e238cd049e6..6a2e168c3ab0 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -43,6 +43,7 @@
 #define ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS     (0x34)
 #define ARMADA_370_XP_INT_SOURCE_CTL(irq)       (0x100 + irq*4)
 #define ARMADA_370_XP_INT_SOURCE_CPU_MASK       0xF
+#define ARMADA_370_XP_INT_IRQ_FIQ_MASK(cpuid)   ((BIT(0) | BIT(8)) << cpuid)
 
 #define ARMADA_370_XP_CPU_INTACK_OFFS           (0x44)
 #define ARMADA_375_PPI_CAUSE                    (0x10)
@@ -406,19 +407,29 @@ static void armada_370_xp_mpic_handle_cascade_irq(unsigned int irq,
                                                   struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_get_chip(irq);
-        unsigned long irqmap, irqn;
+        unsigned long irqmap, irqn, irqsrc, cpuid;
         unsigned int cascade_irq;
 
         chained_irq_enter(chip, desc);
 
         irqmap = readl_relaxed(per_cpu_int_base + ARMADA_375_PPI_CAUSE);
-
-        if (irqmap & BIT(0)) {
-                armada_370_xp_handle_msi_irq(NULL, true);
-                irqmap &= ~BIT(0);
-        }
+        cpuid = cpu_logical_map(smp_processor_id());
 
         for_each_set_bit(irqn, &irqmap, BITS_PER_LONG) {
+                irqsrc = readl_relaxed(main_int_base +
+                                       ARMADA_370_XP_INT_SOURCE_CTL(irqn));
+
+                /* Check if the interrupt is not masked on current CPU.
+                 * Test IRQ (0-1) and FIQ (8-9) mask bits.
+                 */
+                if (!(irqsrc & ARMADA_370_XP_INT_IRQ_FIQ_MASK(cpuid)))
+                        continue;
+
+                if (irqn == 1) {
+                        armada_370_xp_handle_msi_irq(NULL, true);
+                        continue;
+                }
+
                 cascade_irq = irq_find_mapping(armada_370_xp_mpic_domain, irqn);
                 generic_handle_irq(cascade_irq);
         }
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index 6ae3cdee0681..cc4f9d80122e 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -217,8 +217,9 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
         }
 
         ret = irq_alloc_domain_generic_chips(domain, 32, 1, name,
-                                             handle_level_irq, 0, 0,
-                                             IRQCHIP_SKIP_SET_WAKE);
+                                             handle_fasteoi_irq,
+                                             IRQ_NOREQUEST | IRQ_NOPROBE |
+                                             IRQ_NOAUTOEN, 0, 0);
         if (ret)
                 goto err_domain_remove;
 
@@ -230,7 +231,6 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
                 gc->unused = 0;
                 gc->wake_enabled = ~0;
                 gc->chip_types[0].type = IRQ_TYPE_SENSE_MASK;
-                gc->chip_types[0].handler = handle_fasteoi_irq;
                 gc->chip_types[0].chip.irq_eoi = irq_gc_eoi;
                 gc->chip_types[0].chip.irq_set_wake = irq_gc_set_wake;
                 gc->chip_types[0].chip.irq_shutdown = aic_common_shutdown;
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index b9f4fb808e49..5fb38a2ac226 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -101,9 +101,9 @@ static int bcm7120_l2_intc_init_one(struct device_node *dn,
         int parent_irq;
 
         parent_irq = irq_of_parse_and_map(dn, irq);
-        if (parent_irq < 0) {
+        if (!parent_irq) {
                 pr_err("failed to map interrupt %d\n", irq);
-                return parent_irq;
+                return -EINVAL;
         }
 
         data->irq_map_mask |= be32_to_cpup(map_mask + irq);
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index c15c840987d2..14691a4cb84c 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -135,9 +135,9 @@ int __init brcmstb_l2_intc_of_init(struct device_node *np,
         __raw_writel(0xffffffff, data->base + CPU_CLEAR);
 
         data->parent_irq = irq_of_parse_and_map(np, 0);
-        if (data->parent_irq < 0) {
+        if (!data->parent_irq) {
                 pr_err("failed to find parent interrupt\n");
-                ret = data->parent_irq;
+                ret = -EINVAL;
                 goto out_unmap;
         }
 
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index aa29198fca3e..7440c58b8e6f 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -9,26 +9,21 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/module.h>
-#include <linux/kernel.h>
+#include <linux/ctype.h>
+#include <linux/device.h>
+#include <linux/err.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/leds.h>
 #include <linux/list.h>
+#include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
-#include <linux/device.h>
 #include <linux/timer.h>
-#include <linux/err.h>
-#include <linux/ctype.h>
-#include <linux/leds.h>
 #include "leds.h"
 
 static struct class *leds_class;
 
-static void led_update_brightness(struct led_classdev *led_cdev)
-{
-        if (led_cdev->brightness_get)
-                led_cdev->brightness = led_cdev->brightness_get(led_cdev);
-}
-
 static ssize_t brightness_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
@@ -59,14 +54,14 @@ static ssize_t brightness_store(struct device *dev,
 }
 static DEVICE_ATTR_RW(brightness);
 
-static ssize_t led_max_brightness_show(struct device *dev,
+static ssize_t max_brightness_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
         struct led_classdev *led_cdev = dev_get_drvdata(dev);
 
         return sprintf(buf, "%u\n", led_cdev->max_brightness);
 }
-static DEVICE_ATTR(max_brightness, 0444, led_max_brightness_show, NULL);
+static DEVICE_ATTR_RO(max_brightness);
 
 #ifdef CONFIG_LEDS_TRIGGERS
 static DEVICE_ATTR(trigger, 0644, led_trigger_show, led_trigger_store);
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
index 71b40d3bf776..aaa8eba9099f 100644
--- a/drivers/leds/led-core.c
+++ b/drivers/leds/led-core.c
@@ -12,10 +12,11 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/leds.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <linux/rwsem.h>
-#include <linux/leds.h>
 #include "leds.h"
 
 DECLARE_RWSEM(leds_list_lock);
@@ -126,3 +127,19 @@ void led_set_brightness(struct led_classdev *led_cdev,
         __led_set_brightness(led_cdev, brightness);
 }
 EXPORT_SYMBOL(led_set_brightness);
+
+int led_update_brightness(struct led_classdev *led_cdev)
+{
+        int ret = 0;
+
+        if (led_cdev->brightness_get) {
+                ret = led_cdev->brightness_get(led_cdev);
+                if (ret >= 0) {
+                        led_cdev->brightness = ret;
+                        return 0;
+                }
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL(led_update_brightness);
diff --git a/drivers/leds/leds-gpio-register.c b/drivers/leds/leds-gpio-register.c
index 1c4ed5510f35..75717ba68ae0 100644
--- a/drivers/leds/leds-gpio-register.c
+++ b/drivers/leds/leds-gpio-register.c
@@ -7,9 +7,9 @@
  * Free Software Foundation.
  */
 #include <linux/err.h>
+#include <linux/leds.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
-#include <linux/leds.h>
 
 /**
  * gpio_led_register_device - register a gpio-led device
@@ -28,6 +28,9 @@ struct platform_device *__init gpio_led_register_device(
         struct platform_device *ret;
         struct gpio_led_platform_data _pdata = *pdata;
 
+        if (!pdata->num_leds)
+                return ERR_PTR(-EINVAL);
+
         _pdata.leds = kmemdup(pdata->leds,
                         pdata->num_leds * sizeof(*pdata->leds), GFP_KERNEL);
         if (!_pdata.leds)
diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c
index 57ff20fecf57..b4518c8751c8 100644
--- a/drivers/leds/leds-gpio.c
+++ b/drivers/leds/leds-gpio.c
@@ -10,17 +10,17 @@
  * published by the Free Software Foundation.
  *
  */
-#include <linux/kernel.h>
-#include <linux/platform_device.h>
+#include <linux/err.h>
 #include <linux/gpio.h>
+#include <linux/kernel.h>
 #include <linux/leds.h>
+#include <linux/module.h>
 #include <linux/of.h>
-#include <linux/of_platform.h>
 #include <linux/of_gpio.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/workqueue.h>
-#include <linux/module.h>
-#include <linux/err.h>
 
 struct gpio_led_data {
         struct led_classdev cdev;
@@ -36,7 +36,7 @@ struct gpio_led_data {
 
 static void gpio_led_work(struct work_struct *work)
 {
-        struct gpio_led_data    *led_dat =
+        struct gpio_led_data *led_dat =
                 container_of(work, struct gpio_led_data, work);
 
         if (led_dat->blinking) {
@@ -235,14 +235,12 @@ static struct gpio_leds_priv *gpio_leds_create_of(struct platform_device *pdev)
 }
 #endif /* CONFIG_OF_GPIO */
 
-
 static int gpio_led_probe(struct platform_device *pdev)
 {
         struct gpio_led_platform_data *pdata = dev_get_platdata(&pdev->dev);
         struct gpio_leds_priv *priv;
         int i, ret = 0;
 
-
         if (pdata && pdata->num_leds) {
                 priv = devm_kzalloc(&pdev->dev,
                                 sizeof_gpio_leds_priv(pdata->num_leds),
diff --git a/drivers/leds/leds-lp3944.c b/drivers/leds/leds-lp3944.c
index 8e1abdcd4c9d..53144fb96167 100644
--- a/drivers/leds/leds-lp3944.c
+++ b/drivers/leds/leds-lp3944.c
@@ -335,7 +335,8 @@ static int lp3944_configure(struct i2c_client *client,
                         }
 
                         /* to expose the default value to userspace */
-                        led->ldev.brightness = led->status;
+                        led->ldev.brightness =
+                                        (enum led_brightness) led->status;
 
                         /* Set the default led status */
                         err = lp3944_led_set(led, led->status);
diff --git a/drivers/leds/trigger/ledtrig-gpio.c b/drivers/leds/trigger/ledtrig-gpio.c
index 35812e3a37f2..c86c41826476 100644
--- a/drivers/leds/trigger/ledtrig-gpio.c
+++ b/drivers/leds/trigger/ledtrig-gpio.c
@@ -48,7 +48,7 @@ static void gpio_trig_work(struct work_struct *work)
         if (!gpio_data->gpio)
                 return;
 
-        tmp = gpio_get_value(gpio_data->gpio);
+        tmp = gpio_get_value_cansleep(gpio_data->gpio);
         if (gpio_data->inverted)
                 tmp = !tmp;
 
diff --git a/drivers/mailbox/Makefile b/drivers/mailbox/Makefile
index 6d184dbcaca8..94ed7cefb14d 100644
--- a/drivers/mailbox/Makefile
+++ b/drivers/mailbox/Makefile
@@ -1,3 +1,7 @@
+# Generic MAILBOX API
+
+obj-$(CONFIG_MAILBOX)           += mailbox.o
+
 obj-$(CONFIG_PL320_MBOX)        += pl320-ipc.o
 
 obj-$(CONFIG_OMAP2PLUS_MBOX)    += omap-mailbox.o
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
new file mode 100644
index 000000000000..afcb430508ec
--- /dev/null
+++ b/drivers/mailbox/mailbox.c
@@ -0,0 +1,465 @@
+/*
+ * Mailbox: Common code for Mailbox controllers and users
+ *
+ * Copyright (C) 2013-2014 Linaro Ltd.
+ * Author: Jassi Brar <jassisinghbrar@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/mutex.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/bitops.h>
+#include <linux/mailbox_client.h>
+#include <linux/mailbox_controller.h>
+
+#define TXDONE_BY_IRQ   BIT(0) /* controller has remote RTR irq */
+#define TXDONE_BY_POLL  BIT(1) /* controller can read status of last TX */
+#define TXDONE_BY_ACK   BIT(2) /* S/W ACK recevied by Client ticks the TX */
+
+static LIST_HEAD(mbox_cons);
+static DEFINE_MUTEX(con_mutex);
+
+static int add_to_rbuf(struct mbox_chan *chan, void *mssg)
+{
+        int idx;
+        unsigned long flags;
+
+        spin_lock_irqsave(&chan->lock, flags);
+
+        /* See if there is any space left */
+        if (chan->msg_count == MBOX_TX_QUEUE_LEN) {
+                spin_unlock_irqrestore(&chan->lock, flags);
+                return -ENOBUFS;
+        }
+
+        idx = chan->msg_free;
+        chan->msg_data[idx] = mssg;
+        chan->msg_count++;
+
+        if (idx == MBOX_TX_QUEUE_LEN - 1)
+                chan->msg_free = 0;
+        else
+                chan->msg_free++;
+
+        spin_unlock_irqrestore(&chan->lock, flags);
+
+        return idx;
+}
+
+static void msg_submit(struct mbox_chan *chan)
+{
+        unsigned count, idx;
+        unsigned long flags;
+        void *data;
+        int err;
+
+        spin_lock_irqsave(&chan->lock, flags);
+
+        if (!chan->msg_count || chan->active_req)
+                goto exit;
+
+        count = chan->msg_count;
+        idx = chan->msg_free;
+        if (idx >= count)
+                idx -= count;
+        else
+                idx += MBOX_TX_QUEUE_LEN - count;
+
+        data = chan->msg_data[idx];
+
+        /* Try to submit a message to the MBOX controller */
+        err = chan->mbox->ops->send_data(chan, data);
+        if (!err) {
+                chan->active_req = data;
+                chan->msg_count--;
+        }
+exit:
+        spin_unlock_irqrestore(&chan->lock, flags);
+}
+
+static void tx_tick(struct mbox_chan *chan, int r)
+{
+        unsigned long flags;
+        void *mssg;
+
+        spin_lock_irqsave(&chan->lock, flags);
+        mssg = chan->active_req;
+        chan->active_req = NULL;
+        spin_unlock_irqrestore(&chan->lock, flags);
+
+        /* Submit next message */
+        msg_submit(chan);
+
+        /* Notify the client */
+        if (mssg && chan->cl->tx_done)
+                chan->cl->tx_done(chan->cl, mssg, r);
+
+        if (chan->cl->tx_block)
+                complete(&chan->tx_complete);
+}
+
+static void poll_txdone(unsigned long data)
+{
+        struct mbox_controller *mbox = (struct mbox_controller *)data;
+        bool txdone, resched = false;
+        int i;
+
+        for (i = 0; i < mbox->num_chans; i++) {
+                struct mbox_chan *chan = &mbox->chans[i];
+
+                if (chan->active_req && chan->cl) {
+                        resched = true;
+                        txdone = chan->mbox->ops->last_tx_done(chan);
+                        if (txdone)
+                                tx_tick(chan, 0);
+                }
+        }
+
+        if (resched)
+                mod_timer(&mbox->poll, jiffies +
+                                msecs_to_jiffies(mbox->txpoll_period));
+}
+
+/**
+ * mbox_chan_received_data - A way for controller driver to push data
+ *                              received from remote to the upper layer.
+ * @chan: Pointer to the mailbox channel on which RX happened.
+ * @mssg: Client specific message typecasted as void *
+ *
+ * After startup and before shutdown any data received on the chan
+ * is passed on to the API via atomic mbox_chan_received_data().
+ * The controller should ACK the RX only after this call returns.
+ */
+void mbox_chan_received_data(struct mbox_chan *chan, void *mssg)
+{
+        /* No buffering the received data */
+        if (chan->cl->rx_callback)
+                chan->cl->rx_callback(chan->cl, mssg);
+}
+EXPORT_SYMBOL_GPL(mbox_chan_received_data);
+
+/**
+ * mbox_chan_txdone - A way for controller driver to notify the
+ *                      framework that the last TX has completed.
+ * @chan: Pointer to the mailbox chan on which TX happened.
+ * @r: Status of last TX - OK or ERROR
+ *
+ * The controller that has IRQ for TX ACK calls this atomic API
+ * to tick the TX state machine. It works only if txdone_irq
+ * is set by the controller.
+ */
+void mbox_chan_txdone(struct mbox_chan *chan, int r)
+{
+        if (unlikely(!(chan->txdone_method & TXDONE_BY_IRQ))) {
+                dev_err(chan->mbox->dev,
+                       "Controller can't run the TX ticker\n");
+                return;
+        }
+
+        tx_tick(chan, r);
+}
+EXPORT_SYMBOL_GPL(mbox_chan_txdone);
+
+/**
+ * mbox_client_txdone - The way for a client to run the TX state machine.
+ * @chan: Mailbox channel assigned to this client.
+ * @r: Success status of last transmission.
+ *
+ * The client/protocol had received some 'ACK' packet and it notifies
+ * the API that the last packet was sent successfully. This only works
+ * if the controller can't sense TX-Done.
+ */
+void mbox_client_txdone(struct mbox_chan *chan, int r)
+{
+        if (unlikely(!(chan->txdone_method & TXDONE_BY_ACK))) {
+                dev_err(chan->mbox->dev, "Client can't run the TX ticker\n");
+                return;
+        }
+
+        tx_tick(chan, r);
+}
+EXPORT_SYMBOL_GPL(mbox_client_txdone);
+
+/**
+ * mbox_client_peek_data - A way for client driver to pull data
+ *                      received from remote by the controller.
+ * @chan: Mailbox channel assigned to this client.
+ *
+ * A poke to controller driver for any received data.
+ * The data is actually passed onto client via the
+ * mbox_chan_received_data()
+ * The call can be made from atomic context, so the controller's
+ * implementation of peek_data() must not sleep.
+ *
+ * Return: True, if controller has, and is going to push after this,
+ *          some data.
+ *         False, if controller doesn't have any data to be read.
+ */
+bool mbox_client_peek_data(struct mbox_chan *chan)
+{
+        if (chan->mbox->ops->peek_data)
+                return chan->mbox->ops->peek_data(chan);
+
+        return false;
+}
+EXPORT_SYMBOL_GPL(mbox_client_peek_data);
+
+/**
+ * mbox_send_message -  For client to submit a message to be
+ *                              sent to the remote.
+ * @chan: Mailbox channel assigned to this client.
+ * @mssg: Client specific message typecasted.
+ *
+ * For client to submit data to the controller destined for a remote
+ * processor. If the client had set 'tx_block', the call will return
+ * either when the remote receives the data or when 'tx_tout' millisecs
+ * run out.
+ *  In non-blocking mode, the requests are buffered by the API and a
+ * non-negative token is returned for each queued request. If the request
+ * is not queued, a negative token is returned. Upon failure or successful
+ * TX, the API calls 'tx_done' from atomic context, from which the client
+ * could submit yet another request.
+ * The pointer to message should be preserved until it is sent
+ * over the chan, i.e, tx_done() is made.
+ * This function could be called from atomic context as it simply
+ * queues the data and returns a token against the request.
+ *
+ * Return: Non-negative integer for successful submission (non-blocking mode)
+ *      or transmission over chan (blocking mode).
+ *      Negative value denotes failure.
+ */
+int mbox_send_message(struct mbox_chan *chan, void *mssg)
+{
+        int t;
+
+        if (!chan || !chan->cl)
+                return -EINVAL;
+
+        t = add_to_rbuf(chan, mssg);
+        if (t < 0) {
+                dev_err(chan->mbox->dev, "Try increasing MBOX_TX_QUEUE_LEN\n");
+                return t;
+        }
+
+        msg_submit(chan);
+
+        if (chan->txdone_method == TXDONE_BY_POLL)
+                poll_txdone((unsigned long)chan->mbox);
+
+        if (chan->cl->tx_block && chan->active_req) {
+                unsigned long wait;
+                int ret;
+
+                if (!chan->cl->tx_tout) /* wait forever */
+                        wait = msecs_to_jiffies(3600000);
+                else
+                        wait = msecs_to_jiffies(chan->cl->tx_tout);
+
+                ret = wait_for_completion_timeout(&chan->tx_complete, wait);
+                if (ret == 0) {
+                        t = -EIO;
+                        tx_tick(chan, -EIO);
+                }
+        }
+
+        return t;
+}
+EXPORT_SYMBOL_GPL(mbox_send_message);
+
+/**
+ * mbox_request_channel - Request a mailbox channel.
+ * @cl: Identity of the client requesting the channel.
+ * @index: Index of mailbox specifier in 'mboxes' property.
+ *
+ * The Client specifies its requirements and capabilities while asking for
+ * a mailbox channel. It can't be called from atomic context.
+ * The channel is exclusively allocated and can't be used by another
+ * client before the owner calls mbox_free_channel.
+ * After assignment, any packet received on this channel will be
+ * handed over to the client via the 'rx_callback'.
+ * The framework holds reference to the client, so the mbox_client
+ * structure shouldn't be modified until the mbox_free_channel returns.
+ *
+ * Return: Pointer to the channel assigned to the client if successful.
+ *              ERR_PTR for request failure.
+ */
+struct mbox_chan *mbox_request_channel(struct mbox_client *cl, int index)
+{
+        struct device *dev = cl->dev;
+        struct mbox_controller *mbox;
+        struct of_phandle_args spec;
+        struct mbox_chan *chan;
+        unsigned long flags;
+        int ret;
+
+        if (!dev || !dev->of_node) {
+                pr_debug("%s: No owner device node\n", __func__);
+                return ERR_PTR(-ENODEV);
+        }
+
+        mutex_lock(&con_mutex);
+
+        if (of_parse_phandle_with_args(dev->of_node, "mboxes",
+                                       "#mbox-cells", index, &spec)) {
+                dev_dbg(dev, "%s: can't parse \"mboxes\" property\n", __func__);
+                mutex_unlock(&con_mutex);
+                return ERR_PTR(-ENODEV);
+        }
+
+        chan = NULL;
+        list_for_each_entry(mbox, &mbox_cons, node)
+                if (mbox->dev->of_node == spec.np) {
+                        chan = mbox->of_xlate(mbox, &spec);
+                        break;
+                }
+
+        of_node_put(spec.np);
+
+        if (!chan || chan->cl || !try_module_get(mbox->dev->driver->owner)) {
+                dev_dbg(dev, "%s: mailbox not free\n", __func__);
+                mutex_unlock(&con_mutex);
+                return ERR_PTR(-EBUSY);
+        }
+
+        spin_lock_irqsave(&chan->lock, flags);
+        chan->msg_free = 0;
+        chan->msg_count = 0;
+        chan->active_req = NULL;
+        chan->cl = cl;
+        init_completion(&chan->tx_complete);
+
+        if (chan->txdone_method == TXDONE_BY_POLL && cl->knows_txdone)
+                chan->txdone_method |= TXDONE_BY_ACK;
+
+        spin_unlock_irqrestore(&chan->lock, flags);
+
+        ret = chan->mbox->ops->startup(chan);
+        if (ret) {
+                dev_err(dev, "Unable to startup the chan (%d)\n", ret);
+                mbox_free_channel(chan);
+                chan = ERR_PTR(ret);
+        }
+
+        mutex_unlock(&con_mutex);
+        return chan;
+}
+EXPORT_SYMBOL_GPL(mbox_request_channel);
+
+/**
+ * mbox_free_channel - The client relinquishes control of a mailbox
+ *                      channel by this call.
+ * @chan: The mailbox channel to be freed.
+ */
+void mbox_free_channel(struct mbox_chan *chan)
+{
+        unsigned long flags;
+
+        if (!chan || !chan->cl)
+                return;
+
+        chan->mbox->ops->shutdown(chan);
+
+        /* The queued TX requests are simply aborted, no callbacks are made */
+        spin_lock_irqsave(&chan->lock, flags);
+        chan->cl = NULL;
+        chan->active_req = NULL;
+        if (chan->txdone_method == (TXDONE_BY_POLL | TXDONE_BY_ACK))
+                chan->txdone_method = TXDONE_BY_POLL;
+
+        module_put(chan->mbox->dev->driver->owner);
+        spin_unlock_irqrestore(&chan->lock, flags);
+}
+EXPORT_SYMBOL_GPL(mbox_free_channel);
+
+static struct mbox_chan *
+of_mbox_index_xlate(struct mbox_controller *mbox,
+                    const struct of_phandle_args *sp)
+{
+        int ind = sp->args[0];
+
+        if (ind >= mbox->num_chans)
+                return NULL;
+
+        return &mbox->chans[ind];
+}
+
+/**
+ * mbox_controller_register - Register the mailbox controller
+ * @mbox:       Pointer to the mailbox controller.
+ *
+ * The controller driver registers its communication channels
+ */
+int mbox_controller_register(struct mbox_controller *mbox)
+{
+        int i, txdone;
+
+        /* Sanity check */
+        if (!mbox || !mbox->dev || !mbox->ops || !mbox->num_chans)
+                return -EINVAL;
+
+        if (mbox->txdone_irq)
+                txdone = TXDONE_BY_IRQ;
+        else if (mbox->txdone_poll)
+                txdone = TXDONE_BY_POLL;
+        else /* It has to be ACK then */
+                txdone = TXDONE_BY_ACK;
+
+        if (txdone == TXDONE_BY_POLL) {
+                mbox->poll.function = &poll_txdone;
+                mbox->poll.data = (unsigned long)mbox;
+                init_timer(&mbox->poll);
+        }
+
+        for (i = 0; i < mbox->num_chans; i++) {
+                struct mbox_chan *chan = &mbox->chans[i];
+
+                chan->cl = NULL;
+                chan->mbox = mbox;
+                chan->txdone_method = txdone;
+                spin_lock_init(&chan->lock);
+        }
+
+        if (!mbox->of_xlate)
+                mbox->of_xlate = of_mbox_index_xlate;
+
+        mutex_lock(&con_mutex);
+        list_add_tail(&mbox->node, &mbox_cons);
+        mutex_unlock(&con_mutex);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mbox_controller_register);
+
+/**
+ * mbox_controller_unregister - Unregister the mailbox controller
+ * @mbox:       Pointer to the mailbox controller.
+ */
+void mbox_controller_unregister(struct mbox_controller *mbox)
+{
+        int i;
+
+        if (!mbox)
+                return;
+
+        mutex_lock(&con_mutex);
+
+        list_del(&mbox->node);
+
+        for (i = 0; i < mbox->num_chans; i++)
+                mbox_free_channel(&mbox->chans[i]);
+
+        if (mbox->txdone_poll)
+                del_timer_sync(&mbox->poll);
+
+        mutex_unlock(&con_mutex);
+}
+EXPORT_SYMBOL_GPL(mbox_controller_unregister);
diff --git a/drivers/mailbox/pl320-ipc.c b/drivers/mailbox/pl320-ipc.c
index d873cbae2fbb..f3755e0aa935 100644
--- a/drivers/mailbox/pl320-ipc.c
+++ b/drivers/mailbox/pl320-ipc.c
@@ -26,7 +26,7 @@
 #include <linux/device.h>
 #include <linux/amba/bus.h>
 
-#include <linux/mailbox.h>
+#include <linux/pl320-ipc.h>
 
 #define IPCMxSOURCE(m)          ((m) * 0x40)
 #define IPCMxDSET(m)            (((m) * 0x40) + 0x004)
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 825ca1f87639..afe79719ea32 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1434,9 +1434,9 @@ static void drop_buffers(struct dm_bufio_client *c)
 
 /*
  * Test if the buffer is unused and too old, and commit it.
- * At if noio is set, we must not do any I/O because we hold
- * dm_bufio_clients_lock and we would risk deadlock if the I/O gets rerouted to
- * different bufio client.
+ * And if GFP_NOFS is used, we must not do any I/O because we hold
+ * dm_bufio_clients_lock and we would risk deadlock if the I/O gets
+ * rerouted to different bufio client.
  */
 static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
                                 unsigned long max_jiffies)
@@ -1444,7 +1444,7 @@ static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
         if (jiffies - b->last_accessed < max_jiffies)
                 return 0;
 
-        if (!(gfp & __GFP_IO)) {
+        if (!(gfp & __GFP_FS)) {
                 if (test_bit(B_READING, &b->state) ||
                     test_bit(B_WRITING, &b->state) ||
                     test_bit(B_DIRTY, &b->state))
@@ -1486,7 +1486,7 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
         unsigned long freed;
 
         c = container_of(shrink, struct dm_bufio_client, shrinker);
-        if (sc->gfp_mask & __GFP_IO)
+        if (sc->gfp_mask & __GFP_FS)
                 dm_bufio_lock(c);
         else if (!dm_bufio_trylock(c))
                 return SHRINK_STOP;
@@ -1503,7 +1503,7 @@ dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
         unsigned long count;
 
         c = container_of(shrink, struct dm_bufio_client, shrinker);
-        if (sc->gfp_mask & __GFP_IO)
+        if (sc->gfp_mask & __GFP_FS)
                 dm_bufio_lock(c);
         else if (!dm_bufio_trylock(c))
                 return 0;
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 4857fa4a5484..07c0fa0fa284 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -789,8 +789,7 @@ struct dm_raid_superblock {
         __le32 layout;
         __le32 stripe_sectors;
 
-        __u8 pad[452];          /* Round struct to 512 bytes. */
-                                /* Always set to 0 when writing. */
+        /* Remainder of a logical block is zero-filled when writing (see super_sync()). */
 } __packed;
 
 static int read_disk_sb(struct md_rdev *rdev, int size)
@@ -827,7 +826,7 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev)
                     test_bit(Faulty, &(rs->dev[i].rdev.flags)))
                         failed_devices |= (1ULL << i);
 
-        memset(sb, 0, sizeof(*sb));
+        memset(sb + 1, 0, rdev->sb_size - sizeof(*sb));
 
         sb->magic = cpu_to_le32(DM_RAID_MAGIC);
         sb->features = cpu_to_le32(0);  /* No features yet */
@@ -862,7 +861,11 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
         uint64_t events_sb, events_refsb;
 
         rdev->sb_start = 0;
-        rdev->sb_size = sizeof(*sb);
+        rdev->sb_size = bdev_logical_block_size(rdev->meta_bdev);
+        if (rdev->sb_size < sizeof(*sb) || rdev->sb_size > PAGE_SIZE) {
+                DMERR("superblock size of a logical block is no longer valid");
+                return -EINVAL;
+        }
 
         ret = read_disk_sb(rdev, rdev->sb_size);
         if (ret)
@@ -1169,8 +1172,12 @@ static void configure_discard_support(struct dm_target *ti, struct raid_set *rs)
         raid456 = (rs->md.level == 4 || rs->md.level == 5 || rs->md.level == 6);
 
         for (i = 0; i < rs->md.raid_disks; i++) {
-                struct request_queue *q = bdev_get_queue(rs->dev[i].rdev.bdev);
+                struct request_queue *q;
+
+                if (!rs->dev[i].rdev.bdev)
+                        continue;
 
+                q = bdev_get_queue(rs->dev[i].rdev.bdev);
                 if (!q || !blk_queue_discard(q))
                         return;
 
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index d1600d2aa2e2..f8b37d4c05d8 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -159,8 +159,10 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 sc->stripes_shift = __ffs(stripes);
 
         r = dm_set_target_max_io_len(ti, chunk_size);
-        if (r)
+        if (r) {
+                kfree(sc);
                 return r;
+        }
 
         ti->num_flush_bios = stripes;
         ti->num_discard_bios = stripes;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 4843801173fe..0f86d802b533 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1936,6 +1936,14 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                 return DM_MAPIO_SUBMITTED;
         }
 
+        /*
+         * We must hold the virtual cell before doing the lookup, otherwise
+         * there's a race with discard.
+         */
+        build_virtual_key(tc->td, block, &key);
+        if (dm_bio_detain(tc->pool->prison, &key, bio, &cell1, &cell_result))
+                return DM_MAPIO_SUBMITTED;
+
         r = dm_thin_find_block(td, block, 0, &result);
 
         /*
@@ -1959,13 +1967,10 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                          * shared flag will be set in their case.
                          */
                         thin_defer_bio(tc, bio);
+                        cell_defer_no_holder_no_free(tc, &cell1);
                         return DM_MAPIO_SUBMITTED;
                 }
 
-                build_virtual_key(tc->td, block, &key);
-                if (dm_bio_detain(tc->pool->prison, &key, bio, &cell1, &cell_result))
-                        return DM_MAPIO_SUBMITTED;
-
                 build_data_key(tc->td, result.block, &key);
                 if (dm_bio_detain(tc->pool->prison, &key, bio, &cell2, &cell_result)) {
                         cell_defer_no_holder_no_free(tc, &cell1);
@@ -1986,6 +1991,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                          * of doing so.
                          */
                         handle_unserviceable_bio(tc->pool, bio);
+                        cell_defer_no_holder_no_free(tc, &cell1);
                         return DM_MAPIO_SUBMITTED;
                 }
                 /* fall through */
@@ -1996,6 +2002,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                  * provide the hint to load the metadata into cache.
                  */
                 thin_defer_bio(tc, bio);
+                cell_defer_no_holder_no_free(tc, &cell1);
                 return DM_MAPIO_SUBMITTED;
 
         default:
@@ -2005,6 +2012,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                  * pool is switched to fail-io mode.
                  */
                 bio_io_error(bio);
+                cell_defer_no_holder_no_free(tc, &cell1);
                 return DM_MAPIO_SUBMITTED;
         }
 }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4dfa15da9cb8..9233c71138f1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5121,6 +5121,7 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
                 printk("md: %s still in use.\n",mdname(mddev));
                 if (did_freeze) {
                         clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                         md_wakeup_thread(mddev->thread);
                 }
                 err = -EBUSY;
@@ -5135,6 +5136,8 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
                 mddev->ro = 1;
                 set_disk_ro(mddev->gendisk, 1);
                 clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+                md_wakeup_thread(mddev->thread);
                 sysfs_notify_dirent_safe(mddev->sysfs_state);
                 err = 0;
         }
@@ -5178,6 +5181,7 @@ static int do_md_stop(struct mddev *mddev, int mode,
                 mutex_unlock(&mddev->open_mutex);
                 if (did_freeze) {
                         clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                         md_wakeup_thread(mddev->thread);
                 }
                 return -EBUSY;
diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h
index 37d367bb9aa8..bf2b80d5c470 100644
--- a/drivers/md/persistent-data/dm-btree-internal.h
+++ b/drivers/md/persistent-data/dm-btree-internal.h
@@ -42,6 +42,12 @@ struct btree_node {
 } __packed;
 
 
+/*
+ * Locks a block using the btree node validator.
+ */
+int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
+                 struct dm_block **result);
+
 void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
                   struct dm_btree_value_type *vt);
 
diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c
index cf9fd676ae44..1b5e13ec7f96 100644
--- a/drivers/md/persistent-data/dm-btree-spine.c
+++ b/drivers/md/persistent-data/dm-btree-spine.c
@@ -92,7 +92,7 @@ struct dm_block_validator btree_node_validator = {
 
 /*----------------------------------------------------------------*/
 
-static int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
+int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
                  struct dm_block **result)
 {
         return dm_tm_read_lock(info->tm, b, &btree_node_validator, result);
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 416060c25709..200ac12a1d40 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -847,22 +847,26 @@ EXPORT_SYMBOL_GPL(dm_btree_find_lowest_key);
  * FIXME: We shouldn't use a recursive algorithm when we have limited stack
  * space.  Also this only works for single level trees.
  */
-static int walk_node(struct ro_spine *s, dm_block_t block,
+static int walk_node(struct dm_btree_info *info, dm_block_t block,
                      int (*fn)(void *context, uint64_t *keys, void *leaf),
                      void *context)
 {
         int r;
         unsigned i, nr;
+        struct dm_block *node;
         struct btree_node *n;
         uint64_t keys;
 
-        r = ro_step(s, block);
-        n = ro_node(s);
+        r = bn_read_lock(info, block, &node);
+        if (r)
+                return r;
+
+        n = dm_block_data(node);
 
         nr = le32_to_cpu(n->header.nr_entries);
         for (i = 0; i < nr; i++) {
                 if (le32_to_cpu(n->header.flags) & INTERNAL_NODE) {
-                        r = walk_node(s, value64(n, i), fn, context);
+                        r = walk_node(info, value64(n, i), fn, context);
                         if (r)
                                 goto out;
                 } else {
@@ -874,7 +878,7 @@ static int walk_node(struct ro_spine *s, dm_block_t block,
         }
 
 out:
-        ro_pop(s);
+        dm_tm_unlock(info->tm, node);
         return r;
 }
 
@@ -882,15 +886,7 @@ int dm_btree_walk(struct dm_btree_info *info, dm_block_t root,
                   int (*fn)(void *context, uint64_t *keys, void *leaf),
                   void *context)
 {
-        int r;
-        struct ro_spine spine;
-
         BUG_ON(info->levels > 1);
-
-        init_ro_spine(&spine, info);
-        r = walk_node(&spine, root, fn, context);
-        exit_ro_spine(&spine);
-
-        return r;
+        return walk_node(info, root, fn, context);
 }
 EXPORT_SYMBOL_GPL(dm_btree_walk);
diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c
index 97afee672d07..4418119cf707 100644
--- a/drivers/media/common/saa7146/saa7146_core.c
+++ b/drivers/media/common/saa7146/saa7146_core.c
@@ -364,6 +364,9 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
                 goto out;
         }
 
+        /* create a nice device name */
+        sprintf(dev->name, "saa7146 (%d)", saa7146_num);
+
         DEB_EE("pci:%p\n", pci);
 
         err = pci_enable_device(pci);
@@ -438,9 +441,6 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
 
         /* the rest + print status message */
 
-        /* create a nice device name */
-        sprintf(dev->name, "saa7146 (%d)", saa7146_num);
-
         pr_info("found saa7146 @ mem %p (revision %d, irq %d) (0x%04x,0x%04x)\n",
                 dev->mem, dev->revision, pci->irq,
                 pci->subsystem_vendor, pci->subsystem_device);
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index b8579ee68bd6..2cf30576bf39 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -962,6 +962,11 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe)
         case SYS_ATSC:
                 c->modulation = VSB_8;
                 break;
+        case SYS_ISDBS:
+                c->symbol_rate = 28860000;
+                c->rolloff = ROLLOFF_35;
+                c->bandwidth_hz = c->symbol_rate / 100 * 135;
+                break;
         default:
                 c->modulation = QAM_AUTO;
                 break;
@@ -2072,6 +2077,7 @@ static int dtv_set_frontend(struct dvb_frontend *fe)
                 break;
         case SYS_DVBS:
         case SYS_TURBO:
+        case SYS_ISDBS:
                 rolloff = 135;
                 break;
         case SYS_DVBS2:
diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
index 335daeff91b9..9d0d0347758f 100644
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -864,6 +864,13 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
         memcpy(&state->frontend.ops, &ds3000_ops,
                         sizeof(struct dvb_frontend_ops));
         state->frontend.demodulator_priv = state;
+
+        /*
+         * Some devices like T480 starts with voltage on. Be sure
+         * to turn voltage off during init, as this can otherwise
+         * interfere with Unicable SCR systems.
+         */
+        ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF);
         return &state->frontend;
 
 error3:
diff --git a/drivers/media/dvb-frontends/sp2.c b/drivers/media/dvb-frontends/sp2.c
index 9b684d5c8f91..15bf4318cb74 100644
--- a/drivers/media/dvb-frontends/sp2.c
+++ b/drivers/media/dvb-frontends/sp2.c
@@ -266,7 +266,7 @@ int sp2_ci_poll_slot_status(struct dvb_ca_en50221 *en50221,
         return s->status;
 }
 
-int sp2_init(struct sp2 *s)
+static int sp2_init(struct sp2 *s)
 {
         int ret = 0;
         u8 buf;
@@ -348,7 +348,7 @@ err:
         return ret;
 }
 
-int sp2_exit(struct i2c_client *client)
+static int sp2_exit(struct i2c_client *client)
 {
         struct sp2 *s;
 
diff --git a/drivers/media/dvb-frontends/tc90522.c b/drivers/media/dvb-frontends/tc90522.c
index d9905fb52f84..b35d65c9cc05 100644
--- a/drivers/media/dvb-frontends/tc90522.c
+++ b/drivers/media/dvb-frontends/tc90522.c
@@ -216,32 +216,30 @@ static int tc90522s_get_frontend(struct dvb_frontend *fe)
         c->delivery_system = SYS_ISDBS;
 
         layers = 0;
-        ret = reg_read(state, 0xe8, val, 3);
+        ret = reg_read(state, 0xe6, val, 5);
         if (ret == 0) {
-                int slots;
                 u8 v;
 
+                c->stream_id = val[0] << 8 | val[1];
+
                 /* high/single layer */
-                v = (val[0] & 0x70) >> 4;
+                v = (val[2] & 0x70) >> 4;
                 c->modulation = (v == 7) ? PSK_8 : QPSK;
                 c->fec_inner = fec_conv_sat[v];
                 c->layer[0].fec = c->fec_inner;
                 c->layer[0].modulation = c->modulation;
-                c->layer[0].segment_count = val[1] & 0x3f; /* slots */
+                c->layer[0].segment_count = val[3] & 0x3f; /* slots */
 
                 /* low layer */
-                v = (val[0] & 0x07);
+                v = (val[2] & 0x07);
                 c->layer[1].fec = fec_conv_sat[v];
                 if (v == 0)  /* no low layer */
                         c->layer[1].segment_count = 0;
                 else
-                        c->layer[1].segment_count = val[2] & 0x3f; /* slots */
+                        c->layer[1].segment_count = val[4] & 0x3f; /* slots */
                 /* actually, BPSK if v==1, but not defined in fe_modulation_t */
                 c->layer[1].modulation = QPSK;
                 layers = (v > 0) ? 2 : 1;
-
-                slots =  c->layer[0].segment_count +  c->layer[1].segment_count;
-                c->symbol_rate = 28860000 * slots / 48;
         }
 
         /* statistics */
@@ -363,7 +361,7 @@ static int tc90522t_get_frontend(struct dvb_frontend *fe)
                 u8 v;
 
                 c->isdbt_partial_reception = val[0] & 0x01;
-                c->isdbt_sb_mode = (val[0] & 0xc0) == 0x01;
+                c->isdbt_sb_mode = (val[0] & 0xc0) == 0x40;
 
                 /* layer A */
                 v = (val[2] & 0x78) >> 3;
diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
index 932ed9be9ff3..b10aaeda2bb4 100644
--- a/drivers/media/i2c/smiapp/smiapp-core.c
+++ b/drivers/media/i2c/smiapp/smiapp-core.c
@@ -2190,7 +2190,7 @@ static int smiapp_set_selection(struct v4l2_subdev *subdev,
                 ret = smiapp_set_compose(subdev, fh, sel);
                 break;
         default:
-                BUG();
+                ret = -EINVAL;
         }
 
         mutex_unlock(&sensor->mutex);
diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
index 331eddac7222..3bd386c371f7 100644
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -1078,7 +1078,7 @@ static __le32 *cx23885_risc_field(__le32 *rp, struct scatterlist *sglist,
         for (line = 0; line < lines; line++) {
                 while (offset && offset >= sg_dma_len(sg)) {
                         offset -= sg_dma_len(sg);
-                        sg++;
+                        sg = sg_next(sg);
                 }
 
                 if (lpi && line > 0 && !(line % lpi))
@@ -1101,14 +1101,14 @@ static __le32 *cx23885_risc_field(__le32 *rp, struct scatterlist *sglist,
                         *(rp++) = cpu_to_le32(0); /* bits 63-32 */
                         todo -= (sg_dma_len(sg)-offset);
                         offset = 0;
-                        sg++;
+                        sg = sg_next(sg);
                         while (todo > sg_dma_len(sg)) {
                                 *(rp++) = cpu_to_le32(RISC_WRITE|
                                                     sg_dma_len(sg));
                                 *(rp++) = cpu_to_le32(sg_dma_address(sg));
                                 *(rp++) = cpu_to_le32(0); /* bits 63-32 */
                                 todo -= sg_dma_len(sg);
-                                sg++;
+                                sg = sg_next(sg);
                         }
                         *(rp++) = cpu_to_le32(RISC_WRITE|RISC_EOL|todo);
                         *(rp++) = cpu_to_le32(sg_dma_address(sg));
diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
index 13734b8c7917..4cb90317ff45 100644
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -1600,6 +1600,7 @@ static int dvb_register(struct cx23885_tsport *port)
                                 break;
 
                         /* attach tuner */
+                        memset(&m88ts2022_config, 0, sizeof(m88ts2022_config));
                         m88ts2022_config.fe = fe0->dvb.frontend;
                         m88ts2022_config.clock = 27000000;
                         memset(&info, 0, sizeof(struct i2c_board_info));
@@ -1635,6 +1636,7 @@ static int dvb_register(struct cx23885_tsport *port)
                 /* port c - terrestrial/cable */
                 case 2:
                         /* attach frontend */
+                        memset(&si2168_config, 0, sizeof(si2168_config));
                         si2168_config.i2c_adapter = &adapter;
                         si2168_config.fe = &fe0->dvb.frontend;
                         si2168_config.ts_mode = SI2168_TS_SERIAL;
@@ -1654,6 +1656,7 @@ static int dvb_register(struct cx23885_tsport *port)
                         port->i2c_client_demod = client_demod;
 
                         /* attach tuner */
+                        memset(&si2157_config, 0, sizeof(si2157_config));
                         si2157_config.fe = fe0->dvb.frontend;
                         memset(&info, 0, sizeof(struct i2c_board_info));
                         strlcpy(info.type, "si2157", I2C_NAME_SIZE);
diff --git a/drivers/media/pci/solo6x10/solo6x10-core.c b/drivers/media/pci/solo6x10/solo6x10-core.c
index 172583d736fe..8cbe6b49f4c2 100644
--- a/drivers/media/pci/solo6x10/solo6x10-core.c
+++ b/drivers/media/pci/solo6x10/solo6x10-core.c
@@ -105,11 +105,8 @@ static irqreturn_t solo_isr(int irq, void *data)
         if (!status)
                 return IRQ_NONE;
 
-        if (status & ~solo_dev->irq_mask) {
-                solo_reg_write(solo_dev, SOLO_IRQ_STAT,
-                               status & ~solo_dev->irq_mask);
-                status &= solo_dev->irq_mask;
-        }
+        /* Acknowledge all interrupts immediately */
+        solo_reg_write(solo_dev, SOLO_IRQ_STAT, status);
 
         if (status & SOLO_IRQ_PCI_ERR)
                 solo_p2m_error_isr(solo_dev);
@@ -132,9 +129,6 @@ static irqreturn_t solo_isr(int irq, void *data)
         if (status & SOLO_IRQ_G723)
                 solo_g723_isr(solo_dev);
 
-        /* Clear all interrupts handled */
-        solo_reg_write(solo_dev, SOLO_IRQ_STAT, status);
-
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/media/pci/tw68/Kconfig b/drivers/media/pci/tw68/Kconfig
index 5425ba1e320d..95d5d5202048 100644
--- a/drivers/media/pci/tw68/Kconfig
+++ b/drivers/media/pci/tw68/Kconfig
@@ -1,7 +1,6 @@
 config VIDEO_TW68
         tristate "Techwell tw68x Video For Linux"
         depends on VIDEO_DEV && PCI && VIDEO_V4L2
-        select I2C_ALGOBIT
         select VIDEOBUF2_DMA_SG
         ---help---
           Support for Techwell tw68xx based frame grabber boards.
diff --git a/drivers/media/pci/tw68/tw68-core.c b/drivers/media/pci/tw68/tw68-core.c
index a6fb48cf7aae..63f0b64057cb 100644
--- a/drivers/media/pci/tw68/tw68-core.c
+++ b/drivers/media/pci/tw68/tw68-core.c
@@ -306,7 +306,7 @@ static int tw68_initdev(struct pci_dev *pci_dev,
 
         /* get irq */
         err = devm_request_irq(&pci_dev->dev, pci_dev->irq, tw68_irq,
-                          IRQF_SHARED | IRQF_DISABLED, dev->name, dev);
+                          IRQF_SHARED, dev->name, dev);
         if (err < 0) {
                 pr_err("%s: can't get IRQ %d\n",
                        dev->name, pci_dev->irq);
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index bee9074ebc13..3aac88f1d54a 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -166,7 +166,7 @@ config VIDEO_MEM2MEM_DEINTERLACE
 config VIDEO_SAMSUNG_S5P_G2D
         tristate "Samsung S5P and EXYNOS4 G2D 2d graphics accelerator driver"
         depends on VIDEO_DEV && VIDEO_V4L2
-        depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         depends on HAS_DMA
         select VIDEOBUF2_DMA_CONTIG
         select V4L2_MEM2MEM_DEV
@@ -178,7 +178,7 @@ config VIDEO_SAMSUNG_S5P_G2D
 config VIDEO_SAMSUNG_S5P_JPEG
         tristate "Samsung S5P/Exynos3250/Exynos4 JPEG codec driver"
         depends on VIDEO_DEV && VIDEO_V4L2
-        depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         depends on HAS_DMA
         select VIDEOBUF2_DMA_CONTIG
         select V4L2_MEM2MEM_DEV
@@ -189,7 +189,7 @@ config VIDEO_SAMSUNG_S5P_JPEG
 config VIDEO_SAMSUNG_S5P_MFC
         tristate "Samsung S5P MFC Video Codec"
         depends on VIDEO_DEV && VIDEO_V4L2
-        depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         depends on HAS_DMA
         select VIDEOBUF2_DMA_CONTIG
         default n
diff --git a/drivers/media/platform/exynos4-is/Kconfig b/drivers/media/platform/exynos4-is/Kconfig
index 77c951237744..b7b2e472240a 100644
--- a/drivers/media/platform/exynos4-is/Kconfig
+++ b/drivers/media/platform/exynos4-is/Kconfig
@@ -2,7 +2,7 @@
 config VIDEO_SAMSUNG_EXYNOS4_IS
         bool "Samsung S5P/EXYNOS4 SoC series Camera Subsystem driver"
         depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
-        depends on (PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST)
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         depends on OF && COMMON_CLK
         help
           Say Y here to enable camera host interface devices for
diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
index b70fd996d794..aee92d908e49 100644
--- a/drivers/media/platform/exynos4-is/fimc-core.c
+++ b/drivers/media/platform/exynos4-is/fimc-core.c
@@ -832,6 +832,7 @@ err:
         return -ENXIO;
 }
 
+#if defined(CONFIG_PM_RUNTIME) || defined(CONFIG_PM_SLEEP)
 static int fimc_m2m_suspend(struct fimc_dev *fimc)
 {
         unsigned long flags;
@@ -870,6 +871,7 @@ static int fimc_m2m_resume(struct fimc_dev *fimc)
 
         return 0;
 }
+#endif /* CONFIG_PM_RUNTIME || CONFIG_PM_SLEEP */
 
 static const struct of_device_id fimc_of_match[];
 
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index e525a7c8d885..6fcc7f072ace 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -893,7 +893,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,
                                unsigned long buffer, unsigned long size,
                                struct s5p_jpeg_ctx *ctx)
 {
-        int c, components, notfound;
+        int c, components = 0, notfound;
         unsigned int height, width, word, subsampling = 0;
         long length;
         struct s5p_jpeg_buffer jpeg_buffer;
@@ -2632,6 +2632,7 @@ static int s5p_jpeg_remove(struct platform_device *pdev)
         return 0;
 }
 
+#if defined(CONFIG_PM_RUNTIME) || defined(CONFIG_PM_SLEEP)
 static int s5p_jpeg_runtime_suspend(struct device *dev)
 {
         struct s5p_jpeg *jpeg = dev_get_drvdata(dev);
@@ -2681,7 +2682,9 @@ static int s5p_jpeg_runtime_resume(struct device *dev)
 
         return 0;
 }
+#endif /* CONFIG_PM_RUNTIME || CONFIG_PM_SLEEP */
 
+#ifdef CONFIG_PM_SLEEP
 static int s5p_jpeg_suspend(struct device *dev)
 {
         if (pm_runtime_suspended(dev))
@@ -2697,6 +2700,7 @@ static int s5p_jpeg_resume(struct device *dev)
 
         return s5p_jpeg_runtime_resume(dev);
 }
+#endif
 
 static const struct dev_pm_ops s5p_jpeg_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(s5p_jpeg_suspend, s5p_jpeg_resume)
diff --git a/drivers/media/platform/s5p-tv/Kconfig b/drivers/media/platform/s5p-tv/Kconfig
index a9d56f8936b4..beb180e71ba0 100644
--- a/drivers/media/platform/s5p-tv/Kconfig
+++ b/drivers/media/platform/s5p-tv/Kconfig
@@ -9,7 +9,7 @@
 config VIDEO_SAMSUNG_S5P_TV
         bool "Samsung TV driver for S5P platform"
         depends on PM_RUNTIME
-        depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         default n
         ---help---
           Say Y here to enable selecting the TV output devices for
diff --git a/drivers/media/platform/vivid/Kconfig b/drivers/media/platform/vivid/Kconfig
index d71139a2ae00..c3090932f06d 100644
--- a/drivers/media/platform/vivid/Kconfig
+++ b/drivers/media/platform/vivid/Kconfig
@@ -1,8 +1,11 @@
 config VIDEO_VIVID
         tristate "Virtual Video Test Driver"
-        depends on VIDEO_DEV && VIDEO_V4L2 && !SPARC32 && !SPARC64
+        depends on VIDEO_DEV && VIDEO_V4L2 && !SPARC32 && !SPARC64 && FB
         select FONT_SUPPORT
         select FONT_8x16
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
         select VIDEOBUF2_VMALLOC
         default n
         ---help---
diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 2c61a62ab48b..686c3c2ad05b 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -100,11 +100,9 @@ MODULE_PARM_DESC(ccs_out_mode, " output crop/compose/scale mode:\n"
                            "\t\t    bit 0=crop, 1=compose, 2=scale,\n"
                            "\t\t    -1=user-controlled (default)");
 
-static unsigned multiplanar[VIVID_MAX_DEVS];
+static unsigned multiplanar[VIVID_MAX_DEVS] = { [0 ... (VIVID_MAX_DEVS - 1)] = 1 };
 module_param_array(multiplanar, uint, NULL, 0444);
-MODULE_PARM_DESC(multiplanar, " 0 (default) is alternating single and multiplanar devices,\n"
-                              "\t\t    1 is single planar devices,\n"
-                              "\t\t    2 is multiplanar devices");
+MODULE_PARM_DESC(multiplanar, " 1 (default) creates a single planar device, 2 creates a multiplanar device.");
 
 /* Default: video + vbi-cap (raw and sliced) + radio rx + radio tx + sdr + vbi-out + vid-out */
 static unsigned node_types[VIVID_MAX_DEVS] = { [0 ... (VIVID_MAX_DEVS - 1)] = 0x1d3d };
@@ -669,10 +667,7 @@ static int __init vivid_create_instance(int inst)
         /* start detecting feature set */
 
         /* do we use single- or multi-planar? */
-        if (multiplanar[inst] == 0)
-                dev->multiplanar = inst & 1;
-        else
-                dev->multiplanar = multiplanar[inst] > 1;
+        dev->multiplanar = multiplanar[inst] > 1;
         v4l2_info(&dev->v4l2_dev, "using %splanar format API\n",
                         dev->multiplanar ? "multi" : "single ");
 
diff --git a/drivers/media/platform/vivid/vivid-tpg.c b/drivers/media/platform/vivid/vivid-tpg.c
index 0c6fa53fa646..cbcd6250e7b2 100644
--- a/drivers/media/platform/vivid/vivid-tpg.c
+++ b/drivers/media/platform/vivid/vivid-tpg.c
@@ -136,7 +136,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
                 tpg->black_line[plane] = vzalloc(max_w * pixelsz);
                 if (!tpg->black_line[plane])
                         return -ENOMEM;
-                tpg->random_line[plane] = vzalloc(max_w * pixelsz);
+                tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz);
                 if (!tpg->random_line[plane])
                         return -ENOMEM;
         }
diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
index 6f28f6e02ea5..704397f3c106 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -1256,7 +1256,7 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
                 fmerr("Unable to read firmware(%s) content\n", fw_name);
                 return ret;
         }
-        fmdbg("Firmware(%s) length : %d bytes\n", fw_name, fw_entry->size);
+        fmdbg("Firmware(%s) length : %zu bytes\n", fw_name, fw_entry->size);
 
         fw_data = (void *)fw_entry->data;
         fw_len = fw_entry->size;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index b8837dd39bb2..65f80b8b9f7a 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -1678,7 +1678,8 @@ static void imon_incoming_packet(struct imon_context *ictx,
                 if (press_type == 0)
                         rc_keyup(ictx->rdev);
                 else {
-                        if (ictx->rc_type == RC_BIT_RC6_MCE)
+                        if (ictx->rc_type == RC_BIT_RC6_MCE ||
+                            ictx->rc_type == RC_BIT_OTHER)
                                 rc_keydown(ictx->rdev,
                                            ictx->rc_type == RC_BIT_RC6_MCE ? RC_TYPE_RC6_MCE : RC_TYPE_OTHER,
                                            ictx->rc_scancode, ictx->rc_toggle);
diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index 08bbd4f508cd..b0df62961c14 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -297,7 +297,7 @@ static int hix5hd2_ir_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int hix5hd2_ir_suspend(struct device *dev)
 {
         struct hix5hd2_ir_priv *priv = dev_get_drvdata(dev);
diff --git a/drivers/media/rc/ir-rc5-decoder.c b/drivers/media/rc/ir-rc5-decoder.c
index 2ef763928ca4..84fa6e9b59a1 100644
--- a/drivers/media/rc/ir-rc5-decoder.c
+++ b/drivers/media/rc/ir-rc5-decoder.c
@@ -53,7 +53,7 @@ static int ir_rc5_decode(struct rc_dev *dev, struct ir_raw_event ev)
         u32 scancode;
         enum rc_type protocol;
 
-        if (!(dev->enabled_protocols & (RC_BIT_RC5 | RC_BIT_RC5X)))
+        if (!(dev->enabled_protocols & (RC_BIT_RC5 | RC_BIT_RC5X | RC_BIT_RC5_SZ)))
                 return 0;
 
         if (!is_timing_event(ev)) {
diff --git a/drivers/media/rc/ir-rc6-decoder.c b/drivers/media/rc/ir-rc6-decoder.c
index f1f098e22f7e..d16bc67af732 100644
--- a/drivers/media/rc/ir-rc6-decoder.c
+++ b/drivers/media/rc/ir-rc6-decoder.c
@@ -259,8 +259,8 @@ again:
                         case 32:
                                 if ((scancode & RC6_6A_LCC_MASK) == RC6_6A_MCE_CC) {
                                         protocol = RC_TYPE_RC6_MCE;
-                                        scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
                                         toggle = !!(scancode & RC6_6A_MCE_TOGGLE_MASK);
+                                        scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
                                 } else {
                                         protocol = RC_BIT_RC6_6A_32;
                                         toggle = 0;
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index e8fff2add265..b732ac6a26d8 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -262,7 +262,6 @@ int ir_raw_event_register(struct rc_dev *dev)
                 return -ENOMEM;
 
         dev->raw->dev = dev;
-        dev->enabled_protocols = ~0;
         dev->change_protocol = change_protocol;
         rc = kfifo_alloc(&dev->raw->kfifo,
                          sizeof(struct ir_raw_event) * MAX_IR_EVENT_SIZE,
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index a7991c7d010a..8d3b74c5a717 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1421,6 +1421,8 @@ int rc_register_device(struct rc_dev *dev)
 
         if (dev->change_protocol) {
                 u64 rc_type = (1 << rc_map->rc_type);
+                if (dev->driver_type == RC_DRIVER_IR_RAW)
+                        rc_type |= RC_BIT_LIRC;
                 rc = dev->change_protocol(dev, &rc_type);
                 if (rc < 0)
                         goto out_raw;
diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
index e44c8aba6074..803a0e63d47e 100644
--- a/drivers/media/tuners/xc5000.c
+++ b/drivers/media/tuners/xc5000.c
@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)
 
         if (priv) {
                 cancel_delayed_work(&priv->timer_sleep);
-                hybrid_tuner_release_state(priv);
                 if (priv->firmware)
                         release_firmware(priv->firmware);
+                hybrid_tuner_release_state(priv);
         }
 
         mutex_unlock(&xc5000_list_mutex);
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 00758c83eec7..1896ab218b11 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -193,8 +193,8 @@ static int af9035_wr_reg_mask(struct dvb_usb_device *d, u32 reg, u8 val,
         return af9035_wr_regs(d, reg, &val, 1);
 }
 
-static int af9035_add_i2c_dev(struct dvb_usb_device *d, char *type, u8 addr,
-                void *platform_data, struct i2c_adapter *adapter)
+static int af9035_add_i2c_dev(struct dvb_usb_device *d, const char *type,
+                u8 addr, void *platform_data, struct i2c_adapter *adapter)
 {
         int ret, num;
         struct state *state = d_to_priv(d);
@@ -221,7 +221,7 @@ static int af9035_add_i2c_dev(struct dvb_usb_device *d, char *type, u8 addr,
                 goto err;
         }
 
-        request_module(board_info.type);
+        request_module("%s", board_info.type);
 
         /* register I2C device */
         client = i2c_new_device(adapter, &board_info);
diff --git a/drivers/media/usb/dvb-usb-v2/anysee.c b/drivers/media/usb/dvb-usb-v2/anysee.c
index d3c5f230e97a..ae917c042a52 100644
--- a/drivers/media/usb/dvb-usb-v2/anysee.c
+++ b/drivers/media/usb/dvb-usb-v2/anysee.c
@@ -630,8 +630,8 @@ error:
         return ret;
 }
 
-static int anysee_add_i2c_dev(struct dvb_usb_device *d, char *type, u8 addr,
-                void *platform_data)
+static int anysee_add_i2c_dev(struct dvb_usb_device *d, const char *type,
+                u8 addr, void *platform_data)
 {
         int ret, num;
         struct anysee_state *state = d_to_priv(d);
@@ -659,7 +659,7 @@ static int anysee_add_i2c_dev(struct dvb_usb_device *d, char *type, u8 addr,
                 goto err;
         }
 
-        request_module(board_info.type);
+        request_module("%s", board_info.type);
 
         /* register I2C device */
         client = i2c_new_device(adapter, &board_info);
diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index b5e52fe7957a..901cf2b952d7 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -504,7 +504,7 @@ EXPORT_SYMBOL_GPL(em28xx_audio_analog_set);
 int em28xx_audio_setup(struct em28xx *dev)
 {
         int vid1, vid2, feat, cfg;
-        u32 vid;
+        u32 vid = 0;
         u8 i2s_samplerates;
 
         if (dev->chip_id == CHIP_ID_EM2870 ||
diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
index 581f6dad4ca9..23f8f6afa2e0 100644
--- a/drivers/media/usb/em28xx/em28xx-input.c
+++ b/drivers/media/usb/em28xx/em28xx-input.c
@@ -712,8 +712,10 @@ static int em28xx_ir_init(struct em28xx *dev)
         em28xx_info("Registering input extension\n");
 
         ir = kzalloc(sizeof(*ir), GFP_KERNEL);
+        if (!ir)
+                return -ENOMEM;
         rc = rc_allocate_device();
-        if (!ir || !rc)
+        if (!rc)
                 goto error;
 
         /* record handles to ourself */
diff --git a/drivers/media/usb/hackrf/hackrf.c b/drivers/media/usb/hackrf/hackrf.c
index 328b5ba47a0a..fd1fa412e094 100644
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -932,7 +932,7 @@ static int hackrf_set_bandwidth(struct hackrf_dev *dev)
         dev->bandwidth->val = bandwidth;
         dev->bandwidth->cur.val = bandwidth;
 
-        dev_dbg(dev->dev, "bandwidth selected=%d\n", bandwidth_lut[i].freq);
+        dev_dbg(dev->dev, "bandwidth selected=%d\n", bandwidth);
 
         u16tmp = 0;
         u16tmp |= ((bandwidth >> 0) & 0xff) << 0;
diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
index ccc00099b261..1c0dbf428a3a 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -632,7 +632,7 @@ static void s2255_fillbuff(struct s2255_vc *vc,
                         break;
                 case V4L2_PIX_FMT_JPEG:
                 case V4L2_PIX_FMT_MJPEG:
-                        buf->vb.v4l2_buf.length = jpgsize;
+                        vb2_set_plane_payload(&buf->vb, 0, jpgsize);
                         memcpy(vbuf, tmpbuf, jpgsize);
                         break;
                 case V4L2_PIX_FMT_YUV422P:
diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index 68bc9615660e..9bfa041e3316 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
         if (usbvision->remove_pending) {
                 printk(KERN_INFO "%s: Final disconnect\n", __func__);
                 usbvision_release(usbvision);
+                return 0;
         }
         mutex_unlock(&usbvision->v4l2_lock);
 
@@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
         if (usbvision->remove_pending) {
                 printk(KERN_INFO "%s: Final disconnect\n", __func__);
                 usbvision_release(usbvision);
+                return err_code;
         }
 
         mutex_unlock(&usbvision->v4l2_lock);
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 60a8e2c3631e..378ae02e593b 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -318,7 +318,6 @@ static int uvc_v4l2_set_format(struct uvc_streaming *stream,
         stream->ctrl = probe;
         stream->cur_format = format;
         stream->cur_frame = frame;
-        stream->frame_size = fmt->fmt.pix.sizeimage;
 
 done:
         mutex_unlock(&stream->mutex);
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 9ace520bb079..df81b9c4faf1 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1143,7 +1143,7 @@ static int uvc_video_encode_data(struct uvc_streaming *stream,
 static void uvc_video_validate_buffer(const struct uvc_streaming *stream,
                                       struct uvc_buffer *buf)
 {
-        if (stream->frame_size != buf->bytesused &&
+        if (stream->ctrl.dwMaxVideoFrameSize != buf->bytesused &&
             !(stream->cur_format->flags & UVC_FMT_FLAG_COMPRESSED))
                 buf->error = 1;
 }
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 6f676c29ec09..864ada740360 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -457,7 +457,6 @@ struct uvc_streaming {
         struct uvc_format *def_format;
         struct uvc_format *cur_format;
         struct uvc_frame *cur_frame;
-        size_t frame_size;
 
         /* Protect access to ctrl, cur_format, cur_frame and hardware video
          * probe control.
diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
index bf80f0f7dfb8..e02353e340dd 100644
--- a/drivers/media/v4l2-core/videobuf-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
@@ -305,6 +305,15 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
         /* Try to remap memory */
         size = vma->vm_end - vma->vm_start;
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+
+        /* the "vm_pgoff" is just used in v4l2 to find the
+         * corresponding buffer data structure which is allocated
+         * earlier and it does not mean the offset from the physical
+         * buffer start address as usual. So set it to 0 to pass
+         * the sanity check in vm_iomap_memory().
+         */
+        vma->vm_pgoff = 0;
+
         retval = vm_iomap_memory(vma, mem->dma_handle, size);
         if (retval) {
                 dev_err(q->dev, "mmap: remap failed with error %d. ",
diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index cf008f45968c..711773e8e64b 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -240,7 +240,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
                 goto err_irq_charger;
         }
 
-        ret = regmap_add_irq_chip(max77693->regmap, max77693->irq,
+        ret = regmap_add_irq_chip(max77693->regmap_muic, max77693->irq,
                                 IRQF_ONESHOT | IRQF_SHARED |
                                 IRQF_TRIGGER_FALLING, 0,
                                 &max77693_muic_irq_chip,
@@ -250,6 +250,17 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
                 goto err_irq_muic;
         }
 
+        /* Unmask interrupts from all blocks in interrupt source register */
+        ret = regmap_update_bits(max77693->regmap,
+                                MAX77693_PMIC_REG_INTSRC_MASK,
+                                SRC_IRQ_ALL, (unsigned int)~SRC_IRQ_ALL);
+        if (ret < 0) {
+                dev_err(max77693->dev,
+                        "Could not unmask interrupts in INTSRC: %d\n",
+                        ret);
+                goto err_intsrc;
+        }
+
         pm_runtime_set_active(max77693->dev);
 
         ret = mfd_add_devices(max77693->dev, -1, max77693_devs,
@@ -261,6 +272,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 
 err_mfd:
         mfd_remove_devices(max77693->dev);
+err_intsrc:
         regmap_del_irq_chip(max77693->irq, max77693->irq_data_muic);
 err_irq_muic:
         regmap_del_irq_chip(max77693->irq, max77693->irq_data_charger);
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index f2643c221d34..30f7ca89a0e6 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -947,6 +947,7 @@ static void rtsx_pci_idle_work(struct work_struct *work)
         mutex_unlock(&pcr->pcr_mutex);
 }
 
+#ifdef CONFIG_PM
 static void rtsx_pci_power_off(struct rtsx_pcr *pcr, u8 pm_state)
 {
         if (pcr->ops->turn_off_led)
@@ -961,6 +962,7 @@ static void rtsx_pci_power_off(struct rtsx_pcr *pcr, u8 pm_state)
         if (pcr->ops->force_power_down)
                 pcr->ops->force_power_down(pcr, pm_state);
 }
+#endif
 
 static int rtsx_pci_init_hw(struct rtsx_pcr *pcr)
 {
diff --git a/drivers/mfd/stmpe.h b/drivers/mfd/stmpe.h
index 2d045f26f193..bee0abf82040 100644
--- a/drivers/mfd/stmpe.h
+++ b/drivers/mfd/stmpe.h
@@ -269,7 +269,7 @@ int stmpe_remove(struct stmpe *stmpe);
 #define STMPE24XX_REG_CHIP_ID           0x80
 #define STMPE24XX_REG_IEGPIOR_LSB       0x18
 #define STMPE24XX_REG_ISGPIOR_MSB       0x19
-#define STMPE24XX_REG_GPMR_LSB          0xA5
+#define STMPE24XX_REG_GPMR_LSB          0xA4
 #define STMPE24XX_REG_GPSR_LSB          0x85
 #define STMPE24XX_REG_GPCR_LSB          0x88
 #define STMPE24XX_REG_GPDR_LSB          0x8B
diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
index cf92a6d1c532..50f9091bcd38 100644
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -44,6 +44,15 @@ static u8 twl4030_start_script_address = 0x2b;
 #define PWR_DEVSLP              BIT(1)
 #define PWR_DEVOFF              BIT(0)
 
+/* Register bits for CFG_P1_TRANSITION (also for P2 and P3) */
+#define STARTON_SWBUG           BIT(7)  /* Start on watchdog */
+#define STARTON_VBUS            BIT(5)  /* Start on VBUS */
+#define STARTON_VBAT            BIT(4)  /* Start on battery insert */
+#define STARTON_RTC             BIT(3)  /* Start on RTC */
+#define STARTON_USB             BIT(2)  /* Start on USB host */
+#define STARTON_CHG             BIT(1)  /* Start on charger */
+#define STARTON_PWON            BIT(0)  /* Start on PWRON button */
+
 #define SEQ_OFFSYNC             (1 << 0)
 
 #define PHY_TO_OFF_PM_MASTER(p)         (p - 0x36)
@@ -606,6 +615,44 @@ twl4030_power_configure_resources(const struct twl4030_power_data *pdata)
         return 0;
 }
 
+static int twl4030_starton_mask_and_set(u8 bitmask, u8 bitvalues)
+{
+        u8 regs[3] = { TWL4030_PM_MASTER_CFG_P1_TRANSITION,
+                       TWL4030_PM_MASTER_CFG_P2_TRANSITION,
+                       TWL4030_PM_MASTER_CFG_P3_TRANSITION, };
+        u8 val;
+        int i, err;
+
+        err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, TWL4030_PM_MASTER_KEY_CFG1,
+                               TWL4030_PM_MASTER_PROTECT_KEY);
+        if (err)
+                goto relock;
+        err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
+                               TWL4030_PM_MASTER_KEY_CFG2,
+                               TWL4030_PM_MASTER_PROTECT_KEY);
+        if (err)
+                goto relock;
+
+        for (i = 0; i < sizeof(regs); i++) {
+                err = twl_i2c_read_u8(TWL_MODULE_PM_MASTER,
+                                      &val, regs[i]);
+                if (err)
+                        break;
+                val = (~bitmask & val) | (bitmask & bitvalues);
+                err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
+                                       val, regs[i]);
+                if (err)
+                        break;
+        }
+
+        if (err)
+                pr_err("TWL4030 Register access failed: %i\n", err);
+
+relock:
+        return twl_i2c_write_u8(TWL_MODULE_PM_MASTER, 0,
+                                TWL4030_PM_MASTER_PROTECT_KEY);
+}
+
 /*
  * In master mode, start the power off sequence.
  * After a successful execution, TWL shuts down the power to the SoC
@@ -615,6 +662,11 @@ void twl4030_power_off(void)
 {
         int err;
 
+        /* Disable start on charger or VBUS as it can break poweroff */
+        err = twl4030_starton_mask_and_set(STARTON_VBUS | STARTON_CHG, 0);
+        if (err)
+                pr_err("TWL4030 Unable to configure start-up\n");
+
         err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, PWR_DEVOFF,
                                TWL4030_PM_MASTER_P1_SW_EVENTS);
         if (err)
diff --git a/drivers/mfd/viperboard.c b/drivers/mfd/viperboard.c
index e00f5340ed87..3c2b8f9e3c84 100644
--- a/drivers/mfd/viperboard.c
+++ b/drivers/mfd/viperboard.c
@@ -93,8 +93,9 @@ static int vprbrd_probe(struct usb_interface *interface,
                  version >> 8, version & 0xff,
                  vb->usb_dev->bus->busnum, vb->usb_dev->devnum);
 
-        ret = mfd_add_devices(&interface->dev, -1, vprbrd_devs,
-                                ARRAY_SIZE(vprbrd_devs), NULL, 0, NULL);
+        ret = mfd_add_devices(&interface->dev, PLATFORM_DEVID_AUTO,
+                                vprbrd_devs, ARRAY_SIZE(vprbrd_devs), NULL, 0,
+                                NULL);
         if (ret != 0) {
                 dev_err(&interface->dev, "Failed to add mfd devices to core.");
                 goto error;
diff --git a/drivers/misc/cxl/fault.c b/drivers/misc/cxl/fault.c
index 69506ebd4d07..c99e896604ee 100644
--- a/drivers/misc/cxl/fault.c
+++ b/drivers/misc/cxl/fault.c
@@ -21,60 +21,64 @@
 
 #include "cxl.h"
 
-static struct cxl_sste* find_free_sste(struct cxl_sste *primary_group,
-                                       bool sec_hash,
-                                       struct cxl_sste *secondary_group,
-                                       unsigned int *lru)
+static bool sste_matches(struct cxl_sste *sste, struct copro_slb *slb)
 {
-        unsigned int i, entry;
-        struct cxl_sste *sste, *group = primary_group;
-
-        for (i = 0; i < 2; i++) {
-                for (entry = 0; entry < 8; entry++) {
-                        sste = group + entry;
-                        if (!(be64_to_cpu(sste->esid_data) & SLB_ESID_V))
-                                return sste;
-                }
-                if (!sec_hash)
-                        break;
-                group = secondary_group;
+        return ((sste->vsid_data == cpu_to_be64(slb->vsid)) &&
+                (sste->esid_data == cpu_to_be64(slb->esid)));
+}
+
+/*
+ * This finds a free SSTE for the given SLB, or returns NULL if it's already in
+ * the segment table.
+ */
+static struct cxl_sste* find_free_sste(struct cxl_context *ctx,
+                                       struct copro_slb *slb)
+{
+        struct cxl_sste *primary, *sste, *ret = NULL;
+        unsigned int mask = (ctx->sst_size >> 7) - 1; /* SSTP0[SegTableSize] */
+        unsigned int entry;
+        unsigned int hash;
+
+        if (slb->vsid & SLB_VSID_B_1T)
+                hash = (slb->esid >> SID_SHIFT_1T) & mask;
+        else /* 256M */
+                hash = (slb->esid >> SID_SHIFT) & mask;
+
+        primary = ctx->sstp + (hash << 3);
+
+        for (entry = 0, sste = primary; entry < 8; entry++, sste++) {
+                if (!ret && !(be64_to_cpu(sste->esid_data) & SLB_ESID_V))
+                        ret = sste;
+                if (sste_matches(sste, slb))
+                        return NULL;
         }
+        if (ret)
+                return ret;
+
         /* Nothing free, select an entry to cast out */
-        if (sec_hash && (*lru & 0x8))
-                sste = secondary_group + (*lru & 0x7);
-        else
-                sste = primary_group + (*lru & 0x7);
-        *lru = (*lru + 1) & 0xf;
+        ret = primary + ctx->sst_lru;
+        ctx->sst_lru = (ctx->sst_lru + 1) & 0x7;
 
-        return sste;
+        return ret;
 }
 
 static void cxl_load_segment(struct cxl_context *ctx, struct copro_slb *slb)
 {
         /* mask is the group index, we search primary and secondary here. */
-        unsigned int mask = (ctx->sst_size >> 7)-1; /* SSTP0[SegTableSize] */
-        bool sec_hash = 1;
         struct cxl_sste *sste;
-        unsigned int hash;
         unsigned long flags;
 
-
-        sec_hash = !!(cxl_p1n_read(ctx->afu, CXL_PSL_SR_An) & CXL_PSL_SR_An_SC);
-
-        if (slb->vsid & SLB_VSID_B_1T)
-                hash = (slb->esid >> SID_SHIFT_1T) & mask;
-        else /* 256M */
-                hash = (slb->esid >> SID_SHIFT) & mask;
-
         spin_lock_irqsave(&ctx->sste_lock, flags);
-        sste = find_free_sste(ctx->sstp + (hash << 3), sec_hash,
-                              ctx->sstp + ((~hash & mask) << 3), &ctx->sst_lru);
+        sste = find_free_sste(ctx, slb);
+        if (!sste)
+                goto out_unlock;
 
         pr_devel("CXL Populating SST[%li]: %#llx %#llx\n",
                         sste - ctx->sstp, slb->vsid, slb->esid);
 
         sste->vsid_data = cpu_to_be64(slb->vsid);
         sste->esid_data = cpu_to_be64(slb->esid);
+out_unlock:
         spin_unlock_irqrestore(&ctx->sste_lock, flags);
 }
 
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 623286a77114..d47532e8f4f1 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -417,7 +417,7 @@ static int attach_afu_directed(struct cxl_context *ctx, u64 wed, u64 amr)
         ctx->elem->haurp = 0; /* disable */
         ctx->elem->sdr = cpu_to_be64(mfspr(SPRN_SDR1));
 
-        sr = CXL_PSL_SR_An_SC;
+        sr = 0;
         if (ctx->master)
                 sr |= CXL_PSL_SR_An_MP;
         if (mfspr(SPRN_LPCR) & LPCR_TC)
@@ -508,7 +508,7 @@ static int attach_dedicated(struct cxl_context *ctx, u64 wed, u64 amr)
         u64 sr;
         int rc;
 
-        sr = CXL_PSL_SR_An_SC;
+        sr = 0;
         set_endian(sr);
         if (ctx->master)
                 sr |= CXL_PSL_SR_An_MP;
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 03c53b72a2d6..270d58a4c43d 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -311,7 +311,8 @@ int mmc_of_parse(struct mmc_host *host)
         struct device_node *np;
         u32 bus_width;
         int len, ret;
-        bool cap_invert, gpio_invert;
+        bool cd_cap_invert, cd_gpio_invert = false;
+        bool ro_cap_invert, ro_gpio_invert = false;
 
         if (!host->parent || !host->parent->of_node)
                 return 0;
@@ -359,16 +360,13 @@ int mmc_of_parse(struct mmc_host *host)
         if (of_find_property(np, "non-removable", &len)) {
                 host->caps |= MMC_CAP_NONREMOVABLE;
         } else {
-                if (of_property_read_bool(np, "cd-inverted"))
-                        cap_invert = true;
-                else
-                        cap_invert = false;
+                cd_cap_invert = of_property_read_bool(np, "cd-inverted");
 
                 if (of_find_property(np, "broken-cd", &len))
                         host->caps |= MMC_CAP_NEEDS_POLL;
 
                 ret = mmc_gpiod_request_cd(host, "cd", 0, true,
-                                           0, &gpio_invert);
+                                           0, &cd_gpio_invert);
                 if (ret) {
                         if (ret == -EPROBE_DEFER)
                                 return ret;
@@ -391,17 +389,14 @@ int mmc_of_parse(struct mmc_host *host)
                  * both inverted, the end result is that the CD line is
                  * not inverted.
                  */
-                if (cap_invert ^ gpio_invert)
+                if (cd_cap_invert ^ cd_gpio_invert)
                         host->caps2 |= MMC_CAP2_CD_ACTIVE_HIGH;
         }
 
         /* Parse Write Protection */
-        if (of_property_read_bool(np, "wp-inverted"))
-                cap_invert = true;
-        else
-                cap_invert = false;
+        ro_cap_invert = of_property_read_bool(np, "wp-inverted");
 
-        ret = mmc_gpiod_request_ro(host, "wp", 0, false, 0, &gpio_invert);
+        ret = mmc_gpiod_request_ro(host, "wp", 0, false, 0, &ro_gpio_invert);
         if (ret) {
                 if (ret == -EPROBE_DEFER)
                         goto out;
@@ -414,7 +409,7 @@ int mmc_of_parse(struct mmc_host *host)
                 dev_info(host->parent, "Got WP GPIO\n");
 
         /* See the comment on CD inversion above */
-        if (cap_invert ^ gpio_invert)
+        if (ro_cap_invert ^ ro_gpio_invert)
                 host->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
 
         if (of_find_property(np, "cap-sd-highspeed", &len))
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index a7543ba3e190..3096f3ded3ad 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -2590,6 +2590,8 @@ static void cfi_intelext_resume(struct mtd_info *mtd)
 
                 /* Go to known state. Chip may have been power cycled */
                 if (chip->state == FL_PM_SUSPENDED) {
+                        /* Refresh LH28F640BF Partition Config. Register */
+                        fixup_LH28F640BF(mtd);
                         map_write(map, CMD(0xFF), cfi->chips[i].start);
                         chip->oldstate = chip->state = FL_READY;
                         wake_up(&chip->wq);
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index dcda6287228d..ed827cf894e4 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -193,10 +193,10 @@ static int m25p_probe(struct spi_device *spi)
 {
         struct mtd_part_parser_data     ppdata;
         struct flash_platform_data      *data;
-        const struct spi_device_id *id = NULL;
         struct m25p *flash;
         struct spi_nor *nor;
         enum read_mode mode = SPI_NOR_NORMAL;
+        char *flash_name = NULL;
         int ret;
 
         data = dev_get_platdata(&spi->dev);
@@ -236,13 +236,11 @@ static int m25p_probe(struct spi_device *spi)
          * If that's the case, respect "type" and ignore a "name".
          */
         if (data && data->type)
-                id = spi_nor_match_id(data->type);
+                flash_name = data->type;
+        else
+                flash_name = spi->modalias;
 
-        /* If we didn't get name from platform, simply use "modalias". */
-        if (!id)
-                id = spi_get_device_id(spi);
-
-        ret = spi_nor_scan(nor, id, mode);
+        ret = spi_nor_scan(nor, flash_name, mode);
         if (ret)
                 return ret;
 
@@ -263,12 +261,62 @@ static int m25p_remove(struct spi_device *spi)
 }
 
 
+/*
+ * XXX This needs to be kept in sync with spi_nor_ids.  We can't share
+ * it with spi-nor, because if this is built as a module then modpost
+ * won't be able to read it and add appropriate aliases.
+ */
+static const struct spi_device_id m25p_ids[] = {
+        {"at25fs010"},  {"at25fs040"},  {"at25df041a"}, {"at25df321a"},
+        {"at25df641"},  {"at26f004"},   {"at26df081a"}, {"at26df161a"},
+        {"at26df321"},  {"at45db081d"},
+        {"en25f32"},    {"en25p32"},    {"en25q32b"},   {"en25p64"},
+        {"en25q64"},    {"en25qh128"},  {"en25qh256"},
+        {"f25l32pa"},
+        {"mr25h256"},   {"mr25h10"},
+        {"gd25q32"},    {"gd25q64"},
+        {"160s33b"},    {"320s33b"},    {"640s33b"},
+        {"mx25l2005a"}, {"mx25l4005a"}, {"mx25l8005"},  {"mx25l1606e"},
+        {"mx25l3205d"}, {"mx25l3255e"}, {"mx25l6405d"}, {"mx25l12805d"},
+        {"mx25l12855e"},{"mx25l25635e"},{"mx25l25655e"},{"mx66l51235l"},
+        {"mx66l1g55g"},
+        {"n25q064"},    {"n25q128a11"}, {"n25q128a13"}, {"n25q256a"},
+        {"n25q512a"},   {"n25q512ax3"}, {"n25q00"},
+        {"pm25lv512"},  {"pm25lv010"},  {"pm25lq032"},
+        {"s25sl032p"},  {"s25sl064p"},  {"s25fl256s0"}, {"s25fl256s1"},
+        {"s25fl512s"},  {"s70fl01gs"},  {"s25sl12800"}, {"s25sl12801"},
+        {"s25fl129p0"}, {"s25fl129p1"}, {"s25sl004a"},  {"s25sl008a"},
+        {"s25sl016a"},  {"s25sl032a"},  {"s25sl064a"},  {"s25fl008k"},
+        {"s25fl016k"},  {"s25fl064k"},
+        {"sst25vf040b"},{"sst25vf080b"},{"sst25vf016b"},{"sst25vf032b"},
+        {"sst25vf064c"},{"sst25wf512"}, {"sst25wf010"}, {"sst25wf020"},
+        {"sst25wf040"},
+        {"m25p05"},     {"m25p10"},     {"m25p20"},     {"m25p40"},
+        {"m25p80"},     {"m25p16"},     {"m25p32"},     {"m25p64"},
+        {"m25p128"},    {"n25q032"},
+        {"m25p05-nonjedec"},    {"m25p10-nonjedec"},    {"m25p20-nonjedec"},
+        {"m25p40-nonjedec"},    {"m25p80-nonjedec"},    {"m25p16-nonjedec"},
+        {"m25p32-nonjedec"},    {"m25p64-nonjedec"},    {"m25p128-nonjedec"},
+        {"m45pe10"},    {"m45pe80"},    {"m45pe16"},
+        {"m25pe20"},    {"m25pe80"},    {"m25pe16"},
+        {"m25px16"},    {"m25px32"},    {"m25px32-s0"}, {"m25px32-s1"},
+        {"m25px64"},
+        {"w25x10"},     {"w25x20"},     {"w25x40"},     {"w25x80"},
+        {"w25x16"},     {"w25x32"},     {"w25q32"},     {"w25q32dw"},
+        {"w25x64"},     {"w25q64"},     {"w25q128"},    {"w25q80"},
+        {"w25q80bl"},   {"w25q128"},    {"w25q256"},    {"cat25c11"},
+        {"cat25c03"},   {"cat25c09"},   {"cat25c17"},   {"cat25128"},
+        { },
+};
+MODULE_DEVICE_TABLE(spi, m25p_ids);
+
+
 static struct spi_driver m25p80_driver = {
         .driver = {
                 .name   = "m25p80",
                 .owner  = THIS_MODULE,
         },
-        .id_table       = spi_nor_ids,
+        .id_table       = m25p_ids,
         .probe  = m25p_probe,
         .remove = m25p_remove,
 
diff --git a/drivers/mtd/nand/omap_elm.c b/drivers/mtd/nand/omap_elm.c
index b4f61c7fc161..058531044ceb 100644
--- a/drivers/mtd/nand/omap_elm.c
+++ b/drivers/mtd/nand/omap_elm.c
@@ -115,7 +115,7 @@ int elm_config(struct device *dev, enum bch_ecc bch_type,
 
         if (!info) {
                 dev_err(dev, "Unable to configure elm - device not probed?\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
         /* ELM cannot detect ECC errors for chunks > 1KB */
         if (ecc_step_size > ((ELM_ECC_SIZE + 1) / 2)) {
diff --git a/drivers/mtd/spi-nor/fsl-quadspi.c b/drivers/mtd/spi-nor/fsl-quadspi.c
index 8d659a2888d5..d5269a26c839 100644
--- a/drivers/mtd/spi-nor/fsl-quadspi.c
+++ b/drivers/mtd/spi-nor/fsl-quadspi.c
@@ -881,7 +881,6 @@ static int fsl_qspi_probe(struct platform_device *pdev)
 
         /* iterate the subnodes. */
         for_each_available_child_of_node(dev->of_node, np) {
-                const struct spi_device_id *id;
                 char modalias[40];
 
                 /* skip the holes */
@@ -909,10 +908,6 @@ static int fsl_qspi_probe(struct platform_device *pdev)
                 if (of_modalias_node(np, modalias, sizeof(modalias)) < 0)
                         goto map_failed;
 
-                id = spi_nor_match_id(modalias);
-                if (!id)
-                        goto map_failed;
-
                 ret = of_property_read_u32(np, "spi-max-frequency",
                                 &q->clk_rate);
                 if (ret < 0)
@@ -921,7 +916,7 @@ static int fsl_qspi_probe(struct platform_device *pdev)
                 /* set the chip address for READID */
                 fsl_qspi_set_base_addr(q, nor);
 
-                ret = spi_nor_scan(nor, id, SPI_NOR_QUAD);
+                ret = spi_nor_scan(nor, modalias, SPI_NOR_QUAD);
                 if (ret)
                         goto map_failed;
 
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index ae16aa2f6885..c51ee52386a7 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -28,6 +28,8 @@
 
 #define JEDEC_MFR(_jedec_id)    ((_jedec_id) >> 16)
 
+static const struct spi_device_id *spi_nor_match_id(const char *name);
+
 /*
  * Read the status register, returning its value in the location
  * Return the status register value.
@@ -473,7 +475,7 @@ struct flash_info {
  * more nor chips.  This current list focusses on newer chips, which
  * have been converging on command sets which including JEDEC ID.
  */
-const struct spi_device_id spi_nor_ids[] = {
+static const struct spi_device_id spi_nor_ids[] = {
         /* Atmel -- some are (confusingly) marketed as "DataFlash" */
         { "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K) },
         { "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K) },
@@ -637,7 +639,6 @@ const struct spi_device_id spi_nor_ids[] = {
         { "cat25128", CAT25_INFO(2048, 8, 64, 2, SPI_NOR_NO_ERASE | SPI_NOR_NO_FR) },
         { },
 };
-EXPORT_SYMBOL_GPL(spi_nor_ids);
 
 static const struct spi_device_id *spi_nor_read_id(struct spi_nor *nor)
 {
@@ -911,9 +912,9 @@ static int spi_nor_check(struct spi_nor *nor)
         return 0;
 }
 
-int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
-                        enum read_mode mode)
+int spi_nor_scan(struct spi_nor *nor, const char *name, enum read_mode mode)
 {
+        const struct spi_device_id      *id = NULL;
         struct flash_info               *info;
         struct device *dev = nor->dev;
         struct mtd_info *mtd = nor->mtd;
@@ -925,6 +926,10 @@ int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
         if (ret)
                 return ret;
 
+        id = spi_nor_match_id(name);
+        if (!id)
+                return -ENOENT;
+
         info = (void *)id->driver_data;
 
         if (info->jedec_id) {
@@ -1113,7 +1118,7 @@ int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
 }
 EXPORT_SYMBOL_GPL(spi_nor_scan);
 
-const struct spi_device_id *spi_nor_match_id(char *name)
+static const struct spi_device_id *spi_nor_match_id(const char *name)
 {
         const struct spi_device_id *id = spi_nor_ids;
 
@@ -1124,7 +1129,6 @@ const struct spi_device_id *spi_nor_match_id(char *name)
         }
         return NULL;
 }
-EXPORT_SYMBOL_GPL(spi_nor_match_id);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Huang Shijie <shijie8@gmail.com>");
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 4706386b7d34..f9009be3f307 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -135,6 +135,7 @@ config MACVLAN
 config MACVTAP
         tristate "MAC-VLAN based tap driver"
         depends on MACVLAN
+        depends on INET
         help
           This adds a specialized tap character device driver that is based
           on the MAC-VLAN network interface, called macvtap. A macvtap device
@@ -200,6 +201,7 @@ config RIONET_RX_SIZE
 
 config TUN
         tristate "Universal TUN/TAP device driver support"
+        depends on INET
         select CRC32
         ---help---
           TUN/TAP provides packet reception and transmission for user space
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c9ac06cfe6b7..a5115fb7cf33 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2471,7 +2471,8 @@ static void bond_loadbalance_arp_mon(struct work_struct *work)
                         bond_slave_state_change(bond);
                         if (BOND_MODE(bond) == BOND_MODE_XOR)
                                 bond_update_slave_arr(bond, NULL);
-                } else if (do_failover) {
+                }
+                if (do_failover) {
                         block_netpoll_tx();
                         bond_select_active_slave(bond);
                         unblock_netpoll_tx();
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index c13d83e15ace..45f09a66e6c9 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -225,7 +225,12 @@ static int bond_changelink(struct net_device *bond_dev,
 
                 bond_option_arp_ip_targets_clear(bond);
                 nla_for_each_nested(attr, data[IFLA_BOND_ARP_IP_TARGET], rem) {
-                        __be32 target = nla_get_be32(attr);
+                        __be32 target;
+
+                        if (nla_len(attr) < sizeof(target))
+                                return -EINVAL;
+
+                        target = nla_get_be32(attr);
 
                         bond_opt_initval(&newval, (__force u64)target);
                         err = __bond_opt_set(bond, BOND_OPT_ARP_TARGETS,
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 02492d241e4c..2cfe5012e4e5 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -110,7 +110,7 @@ static int can_calc_bittiming(struct net_device *dev, struct can_bittiming *bt,
         long rate;
         u64 v64;
 
-        /* Use CIA recommended sample points */
+        /* Use CiA recommended sample points */
         if (bt->sample_point) {
                 sampl_pt = bt->sample_point;
         } else {
@@ -382,7 +382,7 @@ void can_free_echo_skb(struct net_device *dev, unsigned int idx)
         BUG_ON(idx >= priv->echo_skb_max);
 
         if (priv->echo_skb[idx]) {
-                kfree_skb(priv->echo_skb[idx]);
+                dev_kfree_skb_any(priv->echo_skb[idx]);
                 priv->echo_skb[idx] = NULL;
         }
 }
diff --git a/drivers/net/can/m_can/Kconfig b/drivers/net/can/m_can/Kconfig
index fca5482c09ac..04f20dd39007 100644
--- a/drivers/net/can/m_can/Kconfig
+++ b/drivers/net/can/m_can/Kconfig
@@ -1,4 +1,5 @@
 config CAN_M_CAN
+        depends on HAS_IOMEM
         tristate "Bosch M_CAN devices"
         ---help---
           Say Y here if you want to support for Bosch M_CAN controller.
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 10d571eaed85..d7bc462aafdc 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -105,14 +105,36 @@ enum m_can_mram_cfg {
         MRAM_CFG_NUM,
 };
 
+/* Fast Bit Timing & Prescaler Register (FBTP) */
+#define FBTR_FBRP_MASK          0x1f
+#define FBTR_FBRP_SHIFT         16
+#define FBTR_FTSEG1_SHIFT       8
+#define FBTR_FTSEG1_MASK        (0xf << FBTR_FTSEG1_SHIFT)
+#define FBTR_FTSEG2_SHIFT       4
+#define FBTR_FTSEG2_MASK        (0x7 << FBTR_FTSEG2_SHIFT)
+#define FBTR_FSJW_SHIFT         0
+#define FBTR_FSJW_MASK          0x3
+
 /* Test Register (TEST) */
 #define TEST_LBCK       BIT(4)
 
 /* CC Control Register(CCCR) */
-#define CCCR_TEST       BIT(7)
-#define CCCR_MON        BIT(5)
-#define CCCR_CCE        BIT(1)
-#define CCCR_INIT       BIT(0)
+#define CCCR_TEST               BIT(7)
+#define CCCR_CMR_MASK           0x3
+#define CCCR_CMR_SHIFT          10
+#define CCCR_CMR_CANFD          0x1
+#define CCCR_CMR_CANFD_BRS      0x2
+#define CCCR_CMR_CAN            0x3
+#define CCCR_CME_MASK           0x3
+#define CCCR_CME_SHIFT          8
+#define CCCR_CME_CAN            0
+#define CCCR_CME_CANFD          0x1
+#define CCCR_CME_CANFD_BRS      0x2
+#define CCCR_TEST               BIT(7)
+#define CCCR_MON                BIT(5)
+#define CCCR_CCE                BIT(1)
+#define CCCR_INIT               BIT(0)
+#define CCCR_CANFD              0x10
 
 /* Bit Timing & Prescaler Register (BTP) */
 #define BTR_BRP_MASK            0x3ff
@@ -204,6 +226,7 @@ enum m_can_mram_cfg {
 
 /* Rx Buffer / FIFO Element Size Configuration (RXESC) */
 #define M_CAN_RXESC_8BYTES      0x0
+#define M_CAN_RXESC_64BYTES     0x777
 
 /* Tx Buffer Configuration(TXBC) */
 #define TXBC_NDTB_OFF           16
@@ -211,6 +234,7 @@ enum m_can_mram_cfg {
 
 /* Tx Buffer Element Size Configuration(TXESC) */
 #define TXESC_TBDS_8BYTES       0x0
+#define TXESC_TBDS_64BYTES      0x7
 
 /* Tx Event FIFO Con.guration (TXEFC) */
 #define TXEFC_EFS_OFF           16
@@ -219,11 +243,11 @@ enum m_can_mram_cfg {
 /* Message RAM Configuration (in bytes) */
 #define SIDF_ELEMENT_SIZE       4
 #define XIDF_ELEMENT_SIZE       8
-#define RXF0_ELEMENT_SIZE       16
-#define RXF1_ELEMENT_SIZE       16
+#define RXF0_ELEMENT_SIZE       72
+#define RXF1_ELEMENT_SIZE       72
 #define RXB_ELEMENT_SIZE        16
 #define TXE_ELEMENT_SIZE        8
-#define TXB_ELEMENT_SIZE        16
+#define TXB_ELEMENT_SIZE        72
 
 /* Message RAM Elements */
 #define M_CAN_FIFO_ID           0x0
@@ -231,11 +255,17 @@ enum m_can_mram_cfg {
 #define M_CAN_FIFO_DATA(n)      (0x8 + ((n) << 2))
 
 /* Rx Buffer Element */
+/* R0 */
 #define RX_BUF_ESI              BIT(31)
 #define RX_BUF_XTD              BIT(30)
 #define RX_BUF_RTR              BIT(29)
+/* R1 */
+#define RX_BUF_ANMF             BIT(31)
+#define RX_BUF_EDL              BIT(21)
+#define RX_BUF_BRS              BIT(20)
 
 /* Tx Buffer Element */
+/* R0 */
 #define TX_BUF_XTD              BIT(30)
 #define TX_BUF_RTR              BIT(29)
 
@@ -296,6 +326,7 @@ static inline void m_can_config_endisable(const struct m_can_priv *priv,
         if (enable) {
                 /* enable m_can configuration */
                 m_can_write(priv, M_CAN_CCCR, cccr | CCCR_INIT);
+                udelay(5);
                 /* CCCR.CCE can only be set/reset while CCCR.INIT = '1' */
                 m_can_write(priv, M_CAN_CCCR, cccr | CCCR_INIT | CCCR_CCE);
         } else {
@@ -326,41 +357,67 @@ static inline void m_can_disable_all_interrupts(const struct m_can_priv *priv)
         m_can_write(priv, M_CAN_ILE, 0x0);
 }
 
-static void m_can_read_fifo(const struct net_device *dev, struct can_frame *cf,
-                            u32 rxfs)
+static void m_can_read_fifo(struct net_device *dev, u32 rxfs)
 {
+        struct net_device_stats *stats = &dev->stats;
         struct m_can_priv *priv = netdev_priv(dev);
-        u32 id, fgi;
+        struct canfd_frame *cf;
+        struct sk_buff *skb;
+        u32 id, fgi, dlc;
+        int i;
 
         /* calculate the fifo get index for where to read data */
         fgi = (rxfs & RXFS_FGI_MASK) >> RXFS_FGI_OFF;
+        dlc = m_can_fifo_read(priv, fgi, M_CAN_FIFO_DLC);
+        if (dlc & RX_BUF_EDL)
+                skb = alloc_canfd_skb(dev, &cf);
+        else
+                skb = alloc_can_skb(dev, (struct can_frame **)&cf);
+        if (!skb) {
+                stats->rx_dropped++;
+                return;
+        }
+
+        if (dlc & RX_BUF_EDL)
+                cf->len = can_dlc2len((dlc >> 16) & 0x0F);
+        else
+                cf->len = get_can_dlc((dlc >> 16) & 0x0F);
+
         id = m_can_fifo_read(priv, fgi, M_CAN_FIFO_ID);
         if (id & RX_BUF_XTD)
                 cf->can_id = (id & CAN_EFF_MASK) | CAN_EFF_FLAG;
         else
                 cf->can_id = (id >> 18) & CAN_SFF_MASK;
 
-        if (id & RX_BUF_RTR) {
+        if (id & RX_BUF_ESI) {
+                cf->flags |= CANFD_ESI;
+                netdev_dbg(dev, "ESI Error\n");
+        }
+
+        if (!(dlc & RX_BUF_EDL) && (id & RX_BUF_RTR)) {
                 cf->can_id |= CAN_RTR_FLAG;
         } else {
-                id = m_can_fifo_read(priv, fgi, M_CAN_FIFO_DLC);
-                cf->can_dlc = get_can_dlc((id >> 16) & 0x0F);
-                *(u32 *)(cf->data + 0) = m_can_fifo_read(priv, fgi,
-                                                         M_CAN_FIFO_DATA(0));
-                *(u32 *)(cf->data + 4) = m_can_fifo_read(priv, fgi,
-                                                         M_CAN_FIFO_DATA(1));
+                if (dlc & RX_BUF_BRS)
+                        cf->flags |= CANFD_BRS;
+
+                for (i = 0; i < cf->len; i += 4)
+                        *(u32 *)(cf->data + i) =
+                                m_can_fifo_read(priv, fgi,
+                                                M_CAN_FIFO_DATA(i / 4));
         }
 
         /* acknowledge rx fifo 0 */
         m_can_write(priv, M_CAN_RXF0A, fgi);
+
+        stats->rx_packets++;
+        stats->rx_bytes += cf->len;
+
+        netif_receive_skb(skb);
 }
 
 static int m_can_do_rx_poll(struct net_device *dev, int quota)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        struct net_device_stats *stats = &dev->stats;
-        struct sk_buff *skb;
-        struct can_frame *frame;
         u32 pkts = 0;
         u32 rxfs;
 
@@ -374,18 +431,7 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota)
                 if (rxfs & RXFS_RFL)
                         netdev_warn(dev, "Rx FIFO 0 Message Lost\n");
 
-                skb = alloc_can_skb(dev, &frame);
-                if (!skb) {
-                        stats->rx_dropped++;
-                        return pkts;
-                }
-
-                m_can_read_fifo(dev, frame, rxfs);
-
-                stats->rx_packets++;
-                stats->rx_bytes += frame->can_dlc;
-
-                netif_receive_skb(skb);
+                m_can_read_fifo(dev, rxfs);
 
                 quota--;
                 pkts++;
@@ -481,11 +527,23 @@ static int m_can_handle_lec_err(struct net_device *dev,
         return 1;
 }
 
+static int __m_can_get_berr_counter(const struct net_device *dev,
+                                    struct can_berr_counter *bec)
+{
+        struct m_can_priv *priv = netdev_priv(dev);
+        unsigned int ecr;
+
+        ecr = m_can_read(priv, M_CAN_ECR);
+        bec->rxerr = (ecr & ECR_REC_MASK) >> ECR_REC_SHIFT;
+        bec->txerr = ecr & ECR_TEC_MASK;
+
+        return 0;
+}
+
 static int m_can_get_berr_counter(const struct net_device *dev,
                                   struct can_berr_counter *bec)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        unsigned int ecr;
         int err;
 
         err = clk_prepare_enable(priv->hclk);
@@ -498,9 +556,7 @@ static int m_can_get_berr_counter(const struct net_device *dev,
                 return err;
         }
 
-        ecr = m_can_read(priv, M_CAN_ECR);
-        bec->rxerr = (ecr & ECR_REC_MASK) >> ECR_REC_SHIFT;
-        bec->txerr = ecr & ECR_TEC_MASK;
+        __m_can_get_berr_counter(dev, bec);
 
         clk_disable_unprepare(priv->cclk);
         clk_disable_unprepare(priv->hclk);
@@ -544,7 +600,7 @@ static int m_can_handle_state_change(struct net_device *dev,
         if (unlikely(!skb))
                 return 0;
 
-        m_can_get_berr_counter(dev, &bec);
+        __m_can_get_berr_counter(dev, &bec);
 
         switch (new_state) {
         case CAN_STATE_ERROR_ACTIVE:
@@ -596,14 +652,14 @@ static int m_can_handle_state_errors(struct net_device *dev, u32 psr)
 
         if ((psr & PSR_EP) &&
             (priv->can.state != CAN_STATE_ERROR_PASSIVE)) {
-                netdev_dbg(dev, "entered error warning state\n");
+                netdev_dbg(dev, "entered error passive state\n");
                 work_done += m_can_handle_state_change(dev,
                                                        CAN_STATE_ERROR_PASSIVE);
         }
 
         if ((psr & PSR_BO) &&
             (priv->can.state != CAN_STATE_BUS_OFF)) {
-                netdev_dbg(dev, "entered error warning state\n");
+                netdev_dbg(dev, "entered error bus off state\n");
                 work_done += m_can_handle_state_change(dev,
                                                        CAN_STATE_BUS_OFF);
         }
@@ -615,7 +671,7 @@ static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus)
 {
         if (irqstatus & IR_WDI)
                 netdev_err(dev, "Message RAM Watchdog event due to missing READY\n");
-        if (irqstatus & IR_BEU)
+        if (irqstatus & IR_ELO)
                 netdev_err(dev, "Error Logging Overflow\n");
         if (irqstatus & IR_BEU)
                 netdev_err(dev, "Bit Error Uncorrected\n");
@@ -733,10 +789,23 @@ static const struct can_bittiming_const m_can_bittiming_const = {
         .brp_inc = 1,
 };
 
+static const struct can_bittiming_const m_can_data_bittiming_const = {
+        .name = KBUILD_MODNAME,
+        .tseg1_min = 2,         /* Time segment 1 = prop_seg + phase_seg1 */
+        .tseg1_max = 16,
+        .tseg2_min = 1,         /* Time segment 2 = phase_seg2 */
+        .tseg2_max = 8,
+        .sjw_max = 4,
+        .brp_min = 1,
+        .brp_max = 32,
+        .brp_inc = 1,
+};
+
 static int m_can_set_bittiming(struct net_device *dev)
 {
         struct m_can_priv *priv = netdev_priv(dev);
         const struct can_bittiming *bt = &priv->can.bittiming;
+        const struct can_bittiming *dbt = &priv->can.data_bittiming;
         u16 brp, sjw, tseg1, tseg2;
         u32 reg_btp;
 
@@ -747,7 +816,17 @@ static int m_can_set_bittiming(struct net_device *dev)
         reg_btp = (brp << BTR_BRP_SHIFT) | (sjw << BTR_SJW_SHIFT) |
                         (tseg1 << BTR_TSEG1_SHIFT) | (tseg2 << BTR_TSEG2_SHIFT);
         m_can_write(priv, M_CAN_BTP, reg_btp);
-        netdev_dbg(dev, "setting BTP 0x%x\n", reg_btp);
+
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+                brp = dbt->brp - 1;
+                sjw = dbt->sjw - 1;
+                tseg1 = dbt->prop_seg + dbt->phase_seg1 - 1;
+                tseg2 = dbt->phase_seg2 - 1;
+                reg_btp = (brp << FBTR_FBRP_SHIFT) | (sjw << FBTR_FSJW_SHIFT) |
+                                (tseg1 << FBTR_FTSEG1_SHIFT) |
+                                (tseg2 << FBTR_FTSEG2_SHIFT);
+                m_can_write(priv, M_CAN_FBTP, reg_btp);
+        }
 
         return 0;
 }
@@ -767,8 +846,8 @@ static void m_can_chip_config(struct net_device *dev)
 
         m_can_config_endisable(priv, true);
 
-        /* RX Buffer/FIFO Element Size 8 bytes data field */
-        m_can_write(priv, M_CAN_RXESC, M_CAN_RXESC_8BYTES);
+        /* RX Buffer/FIFO Element Size 64 bytes data field */
+        m_can_write(priv, M_CAN_RXESC, M_CAN_RXESC_64BYTES);
 
         /* Accept Non-matching Frames Into FIFO 0 */
         m_can_write(priv, M_CAN_GFC, 0x0);
@@ -777,8 +856,8 @@ static void m_can_chip_config(struct net_device *dev)
         m_can_write(priv, M_CAN_TXBC, (1 << TXBC_NDTB_OFF) |
                     priv->mcfg[MRAM_TXB].off);
 
-        /* only support 8 bytes firstly */
-        m_can_write(priv, M_CAN_TXESC, TXESC_TBDS_8BYTES);
+        /* support 64 bytes payload */
+        m_can_write(priv, M_CAN_TXESC, TXESC_TBDS_64BYTES);
 
         m_can_write(priv, M_CAN_TXEFC, (1 << TXEFC_EFS_OFF) |
                     priv->mcfg[MRAM_TXE].off);
@@ -793,7 +872,8 @@ static void m_can_chip_config(struct net_device *dev)
                     RXFC_FWM_1 | priv->mcfg[MRAM_RXF1].off);
 
         cccr = m_can_read(priv, M_CAN_CCCR);
-        cccr &= ~(CCCR_TEST | CCCR_MON);
+        cccr &= ~(CCCR_TEST | CCCR_MON | (CCCR_CMR_MASK << CCCR_CMR_SHIFT) |
+                (CCCR_CME_MASK << CCCR_CME_SHIFT));
         test = m_can_read(priv, M_CAN_TEST);
         test &= ~TEST_LBCK;
 
@@ -805,6 +885,9 @@ static void m_can_chip_config(struct net_device *dev)
                 test |= TEST_LBCK;
         }
 
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD)
+                cccr |= CCCR_CME_CANFD_BRS << CCCR_CME_SHIFT;
+
         m_can_write(priv, M_CAN_CCCR, cccr);
         m_can_write(priv, M_CAN_TEST, test);
 
@@ -869,11 +952,13 @@ static struct net_device *alloc_m_can_dev(void)
 
         priv->dev = dev;
         priv->can.bittiming_const = &m_can_bittiming_const;
+        priv->can.data_bittiming_const = &m_can_data_bittiming_const;
         priv->can.do_set_mode = m_can_set_mode;
         priv->can.do_get_berr_counter = m_can_get_berr_counter;
         priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
                                         CAN_CTRLMODE_LISTENONLY |
-                                        CAN_CTRLMODE_BERR_REPORTING;
+                                        CAN_CTRLMODE_BERR_REPORTING |
+                                        CAN_CTRLMODE_FD;
 
         return dev;
 }
@@ -956,8 +1041,9 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
                                     struct net_device *dev)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        struct can_frame *cf = (struct can_frame *)skb->data;
-        u32 id;
+        struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+        u32 id, cccr;
+        int i;
 
         if (can_dropped_invalid_skb(dev, skb))
                 return NETDEV_TX_OK;
@@ -976,11 +1062,28 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
 
         /* message ram configuration */
         m_can_fifo_write(priv, 0, M_CAN_FIFO_ID, id);
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DLC, cf->can_dlc << 16);
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(0), *(u32 *)(cf->data + 0));
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(1), *(u32 *)(cf->data + 4));
+        m_can_fifo_write(priv, 0, M_CAN_FIFO_DLC, can_len2dlc(cf->len) << 16);
+
+        for (i = 0; i < cf->len; i += 4)
+                m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(i / 4),
+                                 *(u32 *)(cf->data + i));
+
         can_put_echo_skb(skb, dev, 0);
 
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+                cccr = m_can_read(priv, M_CAN_CCCR);
+                cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
+                if (can_is_canfd_skb(skb)) {
+                        if (cf->flags & CANFD_BRS)
+                                cccr |= CCCR_CMR_CANFD_BRS << CCCR_CMR_SHIFT;
+                        else
+                                cccr |= CCCR_CMR_CANFD << CCCR_CMR_SHIFT;
+                } else {
+                        cccr |= CCCR_CMR_CAN << CCCR_CMR_SHIFT;
+                }
+                m_can_write(priv, M_CAN_CCCR, cccr);
+        }
+
         /* enable first TX buffer to start transfer  */
         m_can_write(priv, M_CAN_TXBTIE, 0x1);
         m_can_write(priv, M_CAN_TXBAR, 0x1);
@@ -992,6 +1095,7 @@ static const struct net_device_ops m_can_netdev_ops = {
         .ndo_open = m_can_open,
         .ndo_stop = m_can_close,
         .ndo_start_xmit = m_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static int register_m_can_dev(struct net_device *dev)
@@ -1009,7 +1113,7 @@ static int m_can_of_parse_mram(struct platform_device *pdev,
         struct resource *res;
         void __iomem *addr;
         u32 out_val[MRAM_CFG_LEN];
-        int ret;
+        int i, start, end, ret;
 
         /* message ram could be shared */
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "message_ram");
@@ -1060,6 +1164,15 @@ static int m_can_of_parse_mram(struct platform_device *pdev,
                 priv->mcfg[MRAM_TXE].off, priv->mcfg[MRAM_TXE].num,
                 priv->mcfg[MRAM_TXB].off, priv->mcfg[MRAM_TXB].num);
 
+        /* initialize the entire Message RAM in use to avoid possible
+         * ECC/parity checksum errors when reading an uninitialized buffer
+         */
+        start = priv->mcfg[MRAM_SIDF].off;
+        end = priv->mcfg[MRAM_TXB].off +
+                priv->mcfg[MRAM_TXB].num * TXB_ELEMENT_SIZE;
+        for (i = start; i < end; i += 4)
+                writel(0x0, priv->mram_base + i);
+
         return 0;
 }
 
diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
index 1abe133d1594..9718248e55f1 100644
--- a/drivers/net/can/rcar_can.c
+++ b/drivers/net/can/rcar_can.c
@@ -628,6 +628,7 @@ static const struct net_device_ops rcar_can_netdev_ops = {
         .ndo_open = rcar_can_open,
         .ndo_stop = rcar_can_close,
         .ndo_start_xmit = rcar_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static void rcar_can_rx_pkt(struct rcar_can_priv *priv)
diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
index 8ff3424d5147..15c00faeec61 100644
--- a/drivers/net/can/sja1000/kvaser_pci.c
+++ b/drivers/net/can/sja1000/kvaser_pci.c
@@ -214,7 +214,7 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         struct net_device *dev;
         struct sja1000_priv *priv;
         struct kvaser_pci *board;
-        int err, init_step;
+        int err;
 
         dev = alloc_sja1000dev(sizeof(struct kvaser_pci));
         if (dev == NULL)
@@ -235,7 +235,6 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         if (channel == 0) {
                 board->xilinx_ver =
                         ioread8(board->res_addr + XILINX_VERINT) >> 4;
-                init_step = 2;
 
                 /* Assert PTADR# - we're in passive mode so the other bits are
                    not important */
@@ -264,8 +263,6 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         priv->irq_flags = IRQF_SHARED;
         dev->irq = pdev->irq;
 
-        init_step = 4;
-
         dev_info(&pdev->dev, "reg_base=%p conf_addr=%p irq=%d\n",
                  priv->reg_base, board->conf_addr, dev->irq);
 
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 00f2534dde73..29d3f0938eb8 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -434,10 +434,9 @@ static void ems_usb_read_bulk_callback(struct urb *urb)
         if (urb->actual_length > CPC_HEADER_SIZE) {
                 struct ems_cpc_msg *msg;
                 u8 *ibuf = urb->transfer_buffer;
-                u8 msg_count, again, start;
+                u8 msg_count, start;
 
                 msg_count = ibuf[0] & ~0x80;
-                again = ibuf[0] & 0x80;
 
                 start = CPC_HEADER_SIZE;
 
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index b7c9e8b11460..c063a54ab8dd 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -464,7 +464,6 @@ static void esd_usb2_write_bulk_callback(struct urb *urb)
 {
         struct esd_tx_urb_context *context = urb->context;
         struct esd_usb2_net_priv *priv;
-        struct esd_usb2 *dev;
         struct net_device *netdev;
         size_t size = sizeof(struct esd_usb2_msg);
 
@@ -472,7 +471,6 @@ static void esd_usb2_write_bulk_callback(struct urb *urb)
 
         priv = context->priv;
         netdev = priv->netdev;
-        dev = priv->usb2;
 
         /* free up our allocated buffer */
         usb_free_coherent(urb->dev, size,
@@ -1143,6 +1141,7 @@ static void esd_usb2_disconnect(struct usb_interface *intf)
                         }
                 }
                 unlink_all_urbs(dev);
+                kfree(dev);
         }
 }
 
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 04b0f84612f0..009acc8641fc 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -718,6 +718,7 @@ static const struct net_device_ops gs_usb_netdev_ops = {
         .ndo_open = gs_can_open,
         .ndo_stop = gs_can_close,
         .ndo_start_xmit = gs_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static struct gs_can *gs_make_candev(unsigned int channel, struct usb_interface *intf)
diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index 5e8b5609c067..8a998e3884ce 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -300,7 +300,8 @@ static int xcan_set_bittiming(struct net_device *ndev)
 static int xcan_chip_start(struct net_device *ndev)
 {
         struct xcan_priv *priv = netdev_priv(ndev);
-        u32 err, reg_msr, reg_sr_mask;
+        u32 reg_msr, reg_sr_mask;
+        int err;
         unsigned long timeout;
 
         /* Check if it is in reset mode */
@@ -961,6 +962,7 @@ static const struct net_device_ops xcan_netdev_ops = {
         .ndo_open       = xcan_open,
         .ndo_stop       = xcan_close,
         .ndo_start_xmit = xcan_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 /**
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index b9625968daac..4f4c2a7888e5 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -377,6 +377,29 @@ static irqreturn_t bcm_sf2_switch_1_isr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+static int bcm_sf2_sw_rst(struct bcm_sf2_priv *priv)
+{
+        unsigned int timeout = 1000;
+        u32 reg;
+
+        reg = core_readl(priv, CORE_WATCHDOG_CTRL);
+        reg |= SOFTWARE_RESET | EN_CHIP_RST | EN_SW_RESET;
+        core_writel(priv, reg, CORE_WATCHDOG_CTRL);
+
+        do {
+                reg = core_readl(priv, CORE_WATCHDOG_CTRL);
+                if (!(reg & SOFTWARE_RESET))
+                        break;
+
+                usleep_range(1000, 2000);
+        } while (timeout-- > 0);
+
+        if (timeout == 0)
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
 static int bcm_sf2_sw_setup(struct dsa_switch *ds)
 {
         const char *reg_names[BCM_SF2_REGS_NUM] = BCM_SF2_REGS_NAME;
@@ -404,11 +427,18 @@ static int bcm_sf2_sw_setup(struct dsa_switch *ds)
                 *base = of_iomap(dn, i);
                 if (*base == NULL) {
                         pr_err("unable to find register: %s\n", reg_names[i]);
-                        return -ENODEV;
+                        ret = -ENOMEM;
+                        goto out_unmap;
                 }
                 base++;
         }
 
+        ret = bcm_sf2_sw_rst(priv);
+        if (ret) {
+                pr_err("unable to software reset switch: %d\n", ret);
+                goto out_unmap;
+        }
+
         /* Disable all interrupts and request them */
         intrl2_0_writel(priv, 0xffffffff, INTRL2_CPU_MASK_SET);
         intrl2_0_writel(priv, 0xffffffff, INTRL2_CPU_CLEAR);
@@ -484,7 +514,8 @@ out_free_irq0:
 out_unmap:
         base = &priv->core;
         for (i = 0; i < BCM_SF2_REGS_NUM; i++) {
-                iounmap(*base);
+                if (*base)
+                        iounmap(*base);
                 base++;
         }
         return ret;
@@ -733,29 +764,6 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)
         return 0;
 }
 
-static int bcm_sf2_sw_rst(struct bcm_sf2_priv *priv)
-{
-        unsigned int timeout = 1000;
-        u32 reg;
-
-        reg = core_readl(priv, CORE_WATCHDOG_CTRL);
-        reg |= SOFTWARE_RESET | EN_CHIP_RST | EN_SW_RESET;
-        core_writel(priv, reg, CORE_WATCHDOG_CTRL);
-
-        do {
-                reg = core_readl(priv, CORE_WATCHDOG_CTRL);
-                if (!(reg & SOFTWARE_RESET))
-                        break;
-
-                usleep_range(1000, 2000);
-        } while (timeout-- > 0);
-
-        if (timeout == 0)
-                return -ETIMEDOUT;
-
-        return 0;
-}
-
 static int bcm_sf2_sw_resume(struct dsa_switch *ds)
 {
         struct bcm_sf2_priv *priv = ds_to_priv(ds);
diff --git a/drivers/net/dsa/mv88e6171.c b/drivers/net/dsa/mv88e6171.c
index 1020a7af67cf..78d8e876f3aa 100644
--- a/drivers/net/dsa/mv88e6171.c
+++ b/drivers/net/dsa/mv88e6171.c
@@ -395,7 +395,7 @@ static int mv88e6171_get_sset_count(struct dsa_switch *ds)
 }
 
 struct dsa_switch_driver mv88e6171_switch_driver = {
-        .tag_protocol           = DSA_TAG_PROTO_DSA,
+        .tag_protocol           = DSA_TAG_PROTO_EDSA,
         .priv_size              = sizeof(struct mv88e6xxx_priv_state),
         .probe                  = mv88e6171_probe,
         .setup                  = mv88e6171_setup,
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 29554992215a..2349ea970255 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1465,7 +1465,7 @@ static int xgbe_set_features(struct net_device *netdev,
 {
         struct xgbe_prv_data *pdata = netdev_priv(netdev);
         struct xgbe_hw_if *hw_if = &pdata->hw_if;
-        unsigned int rxcsum, rxvlan, rxvlan_filter;
+        netdev_features_t rxcsum, rxvlan, rxvlan_filter;
 
         rxcsum = pdata->netdev_features & NETIF_F_RXCSUM;
         rxvlan = pdata->netdev_features & NETIF_F_HW_VLAN_CTAG_RX;
@@ -1598,7 +1598,8 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         struct skb_shared_hwtstamps *hwtstamps;
         unsigned int incomplete, error, context_next, context;
         unsigned int len, put_len, max_len;
-        int received = 0;
+        unsigned int received = 0;
+        int packet_count = 0;
 
         DBGPR("-->xgbe_rx_poll: budget=%d\n", budget);
 
@@ -1608,7 +1609,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
 
         rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
         packet = &ring->packet_data;
-        while (received < budget) {
+        while (packet_count < budget) {
                 DBGPR("  cur = %d\n", ring->cur);
 
                 /* First time in loop see if we need to restore state */
@@ -1662,7 +1663,7 @@ read_again:
                         if (packet->errors)
                                 DBGPR("Error in received packet\n");
                         dev_kfree_skb(skb);
-                        continue;
+                        goto next_packet;
                 }
 
                 if (!context) {
@@ -1677,7 +1678,7 @@ read_again:
                                         }
 
                                         dev_kfree_skb(skb);
-                                        continue;
+                                        goto next_packet;
                                 }
                                 memcpy(skb_tail_pointer(skb), rdata->skb->data,
                                        put_len);
@@ -1694,7 +1695,7 @@ read_again:
 
                 /* Stray Context Descriptor? */
                 if (!skb)
-                        continue;
+                        goto next_packet;
 
                 /* Be sure we don't exceed the configured MTU */
                 max_len = netdev->mtu + ETH_HLEN;
@@ -1705,7 +1706,7 @@ read_again:
                 if (skb->len > max_len) {
                         DBGPR("packet length exceeds configured MTU\n");
                         dev_kfree_skb(skb);
-                        continue;
+                        goto next_packet;
                 }
 
 #ifdef XGMAC_ENABLE_RX_PKT_DUMP
@@ -1739,6 +1740,9 @@ read_again:
 
                 netdev->last_rx = jiffies;
                 napi_gro_receive(&pdata->napi, skb);
+
+next_packet:
+                packet_count++;
         }
 
         /* Check if we need to save state before leaving */
@@ -1752,9 +1756,9 @@ read_again:
                 rdata->state.error = error;
         }
 
-        DBGPR("<--xgbe_rx_poll: received = %d\n", received);
+        DBGPR("<--xgbe_rx_poll: packet_count = %d\n", packet_count);
 
-        return received;
+        return packet_count;
 }
 
 static int xgbe_poll(struct napi_struct *napi, int budget)
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 63ea1941e973..7ba83ffb08ac 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -575,10 +575,24 @@ static void xgene_gmac_tx_disable(struct xgene_enet_pdata *pdata)
         xgene_enet_wr_mcx_mac(pdata, MAC_CONFIG_1_ADDR, data & ~TX_EN);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
+bool xgene_ring_mgr_init(struct xgene_enet_pdata *p)
+{
+        if (!ioread32(p->ring_csr_addr + CLKEN_ADDR))
+                return false;
+
+        if (ioread32(p->ring_csr_addr + SRST_ADDR))
+                return false;
+
+        return true;
+}
+
+static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
 {
         u32 val;
 
+        if (!xgene_ring_mgr_init(pdata))
+                return -ENODEV;
+
         clk_prepare_enable(pdata->clk);
         clk_disable_unprepare(pdata->clk);
         clk_prepare_enable(pdata->clk);
@@ -590,6 +604,8 @@ static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
         val |= SCAN_AUTO_INCR;
         MGMT_CLOCK_SEL_SET(&val, 1);
         xgene_enet_wr_mcx_mac(pdata, MII_MGMT_CONFIG_ADDR, val);
+
+        return 0;
 }
 
 static void xgene_gport_shutdown(struct xgene_enet_pdata *pdata)
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
index 38558584080e..ec45f3256f0e 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
@@ -104,6 +104,9 @@ enum xgene_enet_rm {
 #define BLOCK_ETH_MAC_OFFSET            0x0000
 #define BLOCK_ETH_MAC_CSR_OFFSET        0x2800
 
+#define CLKEN_ADDR                      0xc208
+#define SRST_ADDR                       0xc200
+
 #define MAC_ADDR_REG_OFFSET             0x00
 #define MAC_COMMAND_REG_OFFSET          0x04
 #define MAC_WRITE_REG_OFFSET            0x08
@@ -318,6 +321,7 @@ void xgene_enet_parse_error(struct xgene_enet_desc_ring *ring,
 
 int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata);
 void xgene_enet_mdio_remove(struct xgene_enet_pdata *pdata);
+bool xgene_ring_mgr_init(struct xgene_enet_pdata *p);
 
 extern struct xgene_mac_ops xgene_gmac_ops;
 extern struct xgene_port_ops xgene_gport_ops;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 3c208cc6f6bb..123669696184 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -639,9 +639,9 @@ static int xgene_enet_create_desc_rings(struct net_device *ndev)
         struct device *dev = ndev_to_dev(ndev);
         struct xgene_enet_desc_ring *rx_ring, *tx_ring, *cp_ring;
         struct xgene_enet_desc_ring *buf_pool = NULL;
-        u8 cpu_bufnum = 0, eth_bufnum = 0;
-        u8 bp_bufnum = 0x20;
-        u16 ring_id, ring_num = 0;
+        u8 cpu_bufnum = 0, eth_bufnum = START_ETH_BUFNUM;
+        u8 bp_bufnum = START_BP_BUFNUM;
+        u16 ring_id, ring_num = START_RING_NUM;
         int ret;
 
         /* allocate rx descriptor ring */
@@ -852,7 +852,9 @@ static int xgene_enet_init_hw(struct xgene_enet_pdata *pdata)
         u16 dst_ring_num;
         int ret;
 
-        pdata->port_ops->reset(pdata);
+        ret = pdata->port_ops->reset(pdata);
+        if (ret)
+                return ret;
 
         ret = xgene_enet_create_desc_rings(ndev);
         if (ret) {
@@ -954,6 +956,7 @@ static int xgene_enet_probe(struct platform_device *pdev)
 
         return ret;
 err:
+        unregister_netdev(ndev);
         free_netdev(ndev);
         return ret;
 }
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
index 874e5a01161f..f9958fae6ffd 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
@@ -38,6 +38,9 @@
 #define SKB_BUFFER_SIZE         (XGENE_ENET_MAX_MTU - NET_IP_ALIGN)
 #define NUM_PKT_BUF     64
 #define NUM_BUFPOOL     32
+#define START_ETH_BUFNUM        2
+#define START_BP_BUFNUM         0x22
+#define START_RING_NUM          8
 
 #define PHY_POLL_LINK_ON        (10 * HZ)
 #define PHY_POLL_LINK_OFF       (PHY_POLL_LINK_ON / 5)
@@ -83,7 +86,7 @@ struct xgene_mac_ops {
 };
 
 struct xgene_port_ops {
-        void (*reset)(struct xgene_enet_pdata *pdata);
+        int (*reset)(struct xgene_enet_pdata *pdata);
         void (*cle_bypass)(struct xgene_enet_pdata *pdata,
                            u32 dst_ring_num, u16 bufpool_id);
         void (*shutdown)(struct xgene_enet_pdata *pdata);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c b/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
index e6d24c210198..f5d4f68c288c 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
@@ -124,20 +124,18 @@ static int xgene_enet_ecc_init(struct xgene_enet_pdata *p)
 {
         struct net_device *ndev = p->ndev;
         u32 data;
-        int i;
+        int i = 0;
 
         xgene_enet_wr_diag_csr(p, ENET_CFG_MEM_RAM_SHUTDOWN_ADDR, 0);
-        for (i = 0; i < 10 && data != ~0U ; i++) {
+        do {
                 usleep_range(100, 110);
                 data = xgene_enet_rd_diag_csr(p, ENET_BLOCK_MEM_RDY_ADDR);
-        }
-
-        if (data != ~0U) {
-                netdev_err(ndev, "Failed to release memory from shutdown\n");
-                return -ENODEV;
-        }
+                if (data == ~0U)
+                        return 0;
+        } while (++i < 10);
 
-        return 0;
+        netdev_err(ndev, "Failed to release memory from shutdown\n");
+        return -ENODEV;
 }
 
 static void xgene_enet_config_ring_if_assoc(struct xgene_enet_pdata *p)
@@ -313,14 +311,19 @@ static void xgene_sgmac_tx_disable(struct xgene_enet_pdata *p)
         xgene_sgmac_rxtx(p, TX_EN, false);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *p)
+static int xgene_enet_reset(struct xgene_enet_pdata *p)
 {
+        if (!xgene_ring_mgr_init(p))
+                return -ENODEV;
+
         clk_prepare_enable(p->clk);
         clk_disable_unprepare(p->clk);
         clk_prepare_enable(p->clk);
 
         xgene_enet_ecc_init(p);
         xgene_enet_config_ring_if_assoc(p);
+
+        return 0;
 }
 
 static void xgene_enet_cle_bypass(struct xgene_enet_pdata *p,
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c b/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
index 67d07206b3c7..a18a9d1f1143 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
@@ -252,14 +252,19 @@ static void xgene_xgmac_tx_disable(struct xgene_enet_pdata *pdata)
         xgene_enet_wr_mac(pdata, AXGMAC_CONFIG_1, data & ~HSTTFEN);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
+static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
 {
+        if (!xgene_ring_mgr_init(pdata))
+                return -ENODEV;
+
         clk_prepare_enable(pdata->clk);
         clk_disable_unprepare(pdata->clk);
         clk_prepare_enable(pdata->clk);
 
         xgene_enet_ecc_init(pdata);
         xgene_enet_config_ring_if_assoc(pdata);
+
+        return 0;
 }
 
 static void xgene_enet_xgcle_bypass(struct xgene_enet_pdata *pdata,
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 9ae36979bdee..531bb7c57531 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1110,7 +1110,8 @@ static int bcm_sysport_init_tx_ring(struct bcm_sysport_priv *priv,
         /* We just need one DMA descriptor which is DMA-able, since writing to
          * the port will allocate a new descriptor in its internal linked-list
          */
-        p = dma_zalloc_coherent(kdev, 1, &ring->desc_dma, GFP_KERNEL);
+        p = dma_zalloc_coherent(kdev, sizeof(struct dma_desc), &ring->desc_dma,
+                                GFP_KERNEL);
         if (!p) {
                 netif_err(priv, hw, priv->netdev, "DMA alloc failed\n");
                 return -ENOMEM;
@@ -1174,6 +1175,13 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
         if (!(reg & TDMA_DISABLED))
                 netdev_warn(priv->netdev, "TDMA not stopped!\n");
 
+        /* ring->cbs is the last part in bcm_sysport_init_tx_ring which could
+         * fail, so by checking this pointer we know whether the TX ring was
+         * fully initialized or not.
+         */
+        if (!ring->cbs)
+                return;
+
         napi_disable(&ring->napi);
         netif_napi_del(&ring->napi);
 
@@ -1183,7 +1191,8 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
         ring->cbs = NULL;
 
         if (ring->desc_dma) {
-                dma_free_coherent(kdev, 1, ring->desc_cpu, ring->desc_dma);
+                dma_free_coherent(kdev, sizeof(struct dma_desc),
+                                  ring->desc_cpu, ring->desc_dma);
                 ring->desc_dma = 0;
         }
         ring->size = 0;
@@ -1397,6 +1406,9 @@ static void bcm_sysport_netif_start(struct net_device *dev)
         /* Enable NAPI */
         napi_enable(&priv->napi);
 
+        /* Enable RX interrupt and TX ring full interrupt */
+        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
+
         phy_start(priv->phydev);
 
         /* Enable TX interrupts for the 32 TXQs */
@@ -1499,9 +1511,6 @@ static int bcm_sysport_open(struct net_device *dev)
         if (ret)
                 goto out_free_rx_ring;
 
-        /* Enable RX interrupt and TX ring full interrupt */
-        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
-
         /* Turn on TDMA */
         ret = tdma_enable_set(priv, 1);
         if (ret)
@@ -1858,6 +1867,8 @@ static int bcm_sysport_resume(struct device *d)
         if (!netif_running(dev))
                 return 0;
 
+        umac_reset(priv);
+
         /* We may have been suspended and never received a WOL event that
          * would turn off MPD detection, take care of that now
          */
@@ -1885,9 +1896,6 @@ static int bcm_sysport_resume(struct device *d)
 
         netif_device_attach(dev);
 
-        /* Enable RX interrupt and TX ring full interrupt */
-        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
-
         /* RX pipe enable */
         topctrl_writel(priv, 0, RX_FLUSH_CNTL);
 
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 23f23c97c2ad..f05fab65d78a 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -382,10 +382,8 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
                 if (l5_cid >= MAX_CM_SK_TBL_SZ)
                         break;
 
-                rcu_read_lock();
                 if (!rcu_access_pointer(cp->ulp_ops[CNIC_ULP_L4])) {
                         rc = -ENODEV;
-                        rcu_read_unlock();
                         break;
                 }
                 csk = &cp->csk_tbl[l5_cid];
@@ -414,7 +412,6 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
                         }
                 }
                 csk_put(csk);
-                rcu_read_unlock();
                 rc = 0;
         }
         }
@@ -615,7 +612,7 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
                 cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
 
         mutex_lock(&cnic_lock);
-        if (rcu_dereference(cp->ulp_ops[ulp_type])) {
+        if (rcu_access_pointer(cp->ulp_ops[ulp_type])) {
                 RCU_INIT_POINTER(cp->ulp_ops[ulp_type], NULL);
                 cnic_put(dev);
         } else {
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index fdc9ec09e453..da1a2500c91c 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2140,6 +2140,12 @@ static int bcmgenet_open(struct net_device *dev)
                 goto err_irq0;
         }
 
+        /* Re-configure the port multiplexer towards the PHY device */
+        bcmgenet_mii_config(priv->dev, false);
+
+        phy_connect_direct(dev, priv->phydev, bcmgenet_mii_setup,
+                           priv->phy_interface);
+
         bcmgenet_netif_start(dev);
 
         return 0;
@@ -2184,6 +2190,9 @@ static int bcmgenet_close(struct net_device *dev)
 
         bcmgenet_netif_stop(dev);
 
+        /* Really kill the PHY state machine and disconnect from it */
+        phy_disconnect(priv->phydev);
+
         /* Disable MAC receive */
         umac_enable_set(priv, CMD_RX_EN, false);
 
@@ -2685,7 +2694,7 @@ static int bcmgenet_resume(struct device *d)
 
         phy_init_hw(priv->phydev);
         /* Speed settings must be restored */
-        bcmgenet_mii_config(priv->dev);
+        bcmgenet_mii_config(priv->dev, false);
 
         /* disable ethernet MAC while updating its registers */
         umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, false);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index dbf524ea3b19..31b2da5f9b82 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -617,9 +617,10 @@ GENET_IO_MACRO(rbuf, GENET_RBUF_OFF);
 
 /* MDIO routines */
 int bcmgenet_mii_init(struct net_device *dev);
-int bcmgenet_mii_config(struct net_device *dev);
+int bcmgenet_mii_config(struct net_device *dev, bool init);
 void bcmgenet_mii_exit(struct net_device *dev);
 void bcmgenet_mii_reset(struct net_device *dev);
+void bcmgenet_mii_setup(struct net_device *dev);
 
 /* Wake-on-LAN routines */
 void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 9ff799a9f801..933cd7e7cd33 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -77,7 +77,7 @@ static int bcmgenet_mii_write(struct mii_bus *bus, int phy_id,
 /* setup netdev link state when PHY link status change and
  * update UMAC and RGMII block when link up
  */
-static void bcmgenet_mii_setup(struct net_device *dev)
+void bcmgenet_mii_setup(struct net_device *dev)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct phy_device *phydev = priv->phydev;
@@ -211,7 +211,7 @@ static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
         bcmgenet_sys_writel(priv, reg, SYS_PORT_CTRL);
 }
 
-int bcmgenet_mii_config(struct net_device *dev)
+int bcmgenet_mii_config(struct net_device *dev, bool init)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct phy_device *phydev = priv->phydev;
@@ -298,7 +298,8 @@ int bcmgenet_mii_config(struct net_device *dev)
                 return -EINVAL;
         }
 
-        dev_info(kdev, "configuring instance for %s\n", phy_name);
+        if (init)
+                dev_info(kdev, "configuring instance for %s\n", phy_name);
 
         return 0;
 }
@@ -350,7 +351,7 @@ static int bcmgenet_mii_probe(struct net_device *dev)
          * PHY speed which is needed for bcmgenet_mii_config() to configure
          * things appropriately.
          */
-        ret = bcmgenet_mii_config(dev);
+        ret = bcmgenet_mii_config(dev, true);
         if (ret) {
                 phy_disconnect(priv->phydev);
                 return ret;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index dbb41c1923e6..77f8f836cbbe 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -8563,7 +8563,8 @@ static int tg3_init_rings(struct tg3 *tp)
                 if (tnapi->rx_rcb)
                         memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp));
 
-                if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
+                if (tnapi->prodring.rx_std &&
+                    tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
                         tg3_free_rings(tp);
                         return -ENOMEM;
                 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
index 8edf0f5bd679..4fe33606f372 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
@@ -60,6 +60,43 @@ void cxgb4_dcb_version_init(struct net_device *dev)
         dcb->dcb_version = FW_PORT_DCB_VER_AUTO;
 }
 
+static void cxgb4_dcb_cleanup_apps(struct net_device *dev)
+{
+        struct port_info *pi = netdev2pinfo(dev);
+        struct adapter *adap = pi->adapter;
+        struct port_dcb_info *dcb = &pi->dcb;
+        struct dcb_app app;
+        int i, err;
+
+        /* zero priority implies remove */
+        app.priority = 0;
+
+        for (i = 0; i < CXGB4_MAX_DCBX_APP_SUPPORTED; i++) {
+                /* Check if app list is exhausted */
+                if (!dcb->app_priority[i].protocolid)
+                        break;
+
+                app.protocol = dcb->app_priority[i].protocolid;
+
+                if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE) {
+                        app.priority = dcb->app_priority[i].user_prio_map;
+                        app.selector = dcb->app_priority[i].sel_field + 1;
+                        err = dcb_ieee_delapp(dev, &app);
+                } else {
+                        app.selector = !!(dcb->app_priority[i].sel_field);
+                        err = dcb_setapp(dev, &app);
+                }
+
+                if (err) {
+                        dev_err(adap->pdev_dev,
+                                "Failed DCB Clear %s Application Priority: sel=%d, prot=%d, , err=%d\n",
+                                dcb_ver_array[dcb->dcb_version], app.selector,
+                                app.protocol, -err);
+                        break;
+                }
+        }
+}
+
 /* Finite State machine for Data Center Bridging.
  */
 void cxgb4_dcb_state_fsm(struct net_device *dev,
@@ -80,14 +117,17 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
                         /* we're going to use Host DCB */
                         dcb->state = CXGB4_DCB_STATE_HOST;
                         dcb->supported = CXGB4_DCBX_HOST_SUPPORT;
-                        dcb->enabled = 1;
                         break;
                 }
 
                 case CXGB4_DCB_INPUT_FW_ENABLED: {
                         /* we're going to use Firmware DCB */
                         dcb->state = CXGB4_DCB_STATE_FW_INCOMPLETE;
-                        dcb->supported = CXGB4_DCBX_FW_SUPPORT;
+                        dcb->supported = DCB_CAP_DCBX_LLD_MANAGED;
+                        if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE)
+                                dcb->supported |= DCB_CAP_DCBX_VER_IEEE;
+                        else
+                                dcb->supported |= DCB_CAP_DCBX_VER_CEE;
                         break;
                 }
 
@@ -145,6 +185,7 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
                          * state.  We need to reset back to a ground state
                          * of incomplete.
                          */
+                        cxgb4_dcb_cleanup_apps(dev);
                         cxgb4_dcb_state_init(dev);
                         dcb->state = CXGB4_DCB_STATE_FW_INCOMPLETE;
                         dcb->supported = CXGB4_DCBX_FW_SUPPORT;
@@ -349,6 +390,12 @@ static u8 cxgb4_setstate(struct net_device *dev, u8 enabled)
 {
         struct port_info *pi = netdev2pinfo(dev);
 
+        /* If DCBx is host-managed, dcb is enabled by outside lldp agents */
+        if (pi->dcb.state == CXGB4_DCB_STATE_HOST) {
+                pi->dcb.enabled = enabled;
+                return 0;
+        }
+
         /* Firmware doesn't provide any mechanism to control the DCB state.
          */
         if (enabled != (pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED))
@@ -394,14 +441,17 @@ static void cxgb4_getpgtccfg(struct net_device *dev, int tc,
         *up_tc_map = (1 << tc);
 
         /* prio_type is link strict */
-        *prio_type = 0x2;
+        if (*pgid != 0xF)
+                *prio_type = 0x2;
 }
 
 static void cxgb4_getpgtccfg_tx(struct net_device *dev, int tc,
                                 u8 *prio_type, u8 *pgid, u8 *bw_per,
                                 u8 *up_tc_map)
 {
-        return cxgb4_getpgtccfg(dev, tc, prio_type, pgid, bw_per, up_tc_map, 1);
+        /* tc 0 is written at MSB position */
+        return cxgb4_getpgtccfg(dev, (7 - tc), prio_type, pgid, bw_per,
+                                up_tc_map, 1);
 }
 
 
@@ -409,7 +459,9 @@ static void cxgb4_getpgtccfg_rx(struct net_device *dev, int tc,
                                 u8 *prio_type, u8 *pgid, u8 *bw_per,
                                 u8 *up_tc_map)
 {
-        return cxgb4_getpgtccfg(dev, tc, prio_type, pgid, bw_per, up_tc_map, 0);
+        /* tc 0 is written at MSB position */
+        return cxgb4_getpgtccfg(dev, (7 - tc), prio_type, pgid, bw_per,
+                                up_tc_map, 0);
 }
 
 static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
@@ -419,6 +471,7 @@ static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
         struct fw_port_cmd pcmd;
         struct port_info *pi = netdev2pinfo(dev);
         struct adapter *adap = pi->adapter;
+        int fw_tc = 7 - tc;
         u32 _pgid;
         int err;
 
@@ -437,8 +490,8 @@ static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
         }
 
         _pgid = be32_to_cpu(pcmd.u.dcb.pgid.pgid);
-        _pgid &= ~(0xF << (tc * 4));
-        _pgid |= pgid << (tc * 4);
+        _pgid &= ~(0xF << (fw_tc * 4));
+        _pgid |= pgid << (fw_tc * 4);
         pcmd.u.dcb.pgid.pgid = cpu_to_be32(_pgid);
 
         INIT_PORT_DCB_WRITE_CMD(pcmd, pi->port_id);
@@ -551,7 +604,7 @@ static void cxgb4_getpfccfg(struct net_device *dev, int priority, u8 *pfccfg)
             priority >= CXGB4_MAX_PRIORITY)
                 *pfccfg = 0;
         else
-                *pfccfg = (pi->dcb.pfcen >> priority) & 1;
+                *pfccfg = (pi->dcb.pfcen >> (7 - priority)) & 1;
 }
 
 /* Enable/disable Priority Pause Frames for the specified Traffic Class
@@ -576,9 +629,9 @@ static void cxgb4_setpfccfg(struct net_device *dev, int priority, u8 pfccfg)
         pcmd.u.dcb.pfc.pfcen = pi->dcb.pfcen;
 
         if (pfccfg)
-                pcmd.u.dcb.pfc.pfcen |= (1 << priority);
+                pcmd.u.dcb.pfc.pfcen |= (1 << (7 - priority));
         else
-                pcmd.u.dcb.pfc.pfcen &= (~(1 << priority));
+                pcmd.u.dcb.pfc.pfcen &= (~(1 << (7 - priority)));
 
         err = t4_wr_mbox(adap, adap->mbox, &pcmd, sizeof(pcmd), &pcmd);
         if (err != FW_PORT_DCB_CFG_SUCCESS) {
@@ -833,11 +886,16 @@ static int cxgb4_setapp(struct net_device *dev, u8 app_idtype, u16 app_id,
 
 /* Return whether IEEE Data Center Bridging has been negotiated.
  */
-static inline int cxgb4_ieee_negotiation_complete(struct net_device *dev)
+static inline int
+cxgb4_ieee_negotiation_complete(struct net_device *dev,
+                                enum cxgb4_dcb_fw_msgs dcb_subtype)
 {
         struct port_info *pi = netdev2pinfo(dev);
         struct port_dcb_info *dcb = &pi->dcb;
 
+        if (dcb_subtype && !(dcb->msgs & dcb_subtype))
+                return 0;
+
         return (dcb->state == CXGB4_DCB_STATE_FW_ALLSYNCED &&
                 (dcb->supported & DCB_CAP_DCBX_VER_IEEE));
 }
@@ -850,7 +908,7 @@ static int cxgb4_ieee_getapp(struct net_device *dev, struct dcb_app *app)
 {
         int prio;
 
-        if (!cxgb4_ieee_negotiation_complete(dev))
+        if (!cxgb4_ieee_negotiation_complete(dev, CXGB4_DCB_FW_APP_ID))
                 return -EINVAL;
         if (!(app->selector && app->protocol))
                 return -EINVAL;
@@ -872,7 +930,7 @@ static int cxgb4_ieee_setapp(struct net_device *dev, struct dcb_app *app)
 {
         int ret;
 
-        if (!cxgb4_ieee_negotiation_complete(dev))
+        if (!cxgb4_ieee_negotiation_complete(dev, CXGB4_DCB_FW_APP_ID))
                 return -EINVAL;
         if (!(app->selector && app->protocol))
                 return -EINVAL;
@@ -1024,7 +1082,7 @@ static int cxgb4_cee_peer_getpg(struct net_device *dev, struct cee_pg *pg)
         pgid = be32_to_cpu(pcmd.u.dcb.pgid.pgid);
 
         for (i = 0; i < CXGB4_MAX_PRIORITY; i++)
-                pg->prio_pg[i] = (pgid >> (i * 4)) & 0xF;
+                pg->prio_pg[7 - i] = (pgid >> (i * 4)) & 0xF;
 
         INIT_PORT_DCB_READ_PEER_CMD(pcmd, pi->port_id);
         pcmd.u.dcb.pgrate.type = FW_PORT_DCB_TYPE_PGRATE;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 3f60070f2519..279873cb6e3a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -694,7 +694,11 @@ int cxgb4_dcb_enabled(const struct net_device *dev)
 #ifdef CONFIG_CHELSIO_T4_DCB
         struct port_info *pi = netdev_priv(dev);
 
-        return pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED;
+        if (!pi->dcb.enabled)
+                return 0;
+
+        return ((pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED) ||
+                (pi->dcb.state == CXGB4_DCB_STATE_HOST));
 #else
         return 0;
 #endif
@@ -2438,9 +2442,13 @@ static unsigned int from_fw_linkcaps(unsigned int type, unsigned int caps)
                      SUPPORTED_10000baseKR_Full | SUPPORTED_1000baseKX_Full |
                      SUPPORTED_10000baseKX4_Full;
         else if (type == FW_PORT_TYPE_FIBER_XFI ||
-                 type == FW_PORT_TYPE_FIBER_XAUI || type == FW_PORT_TYPE_SFP)
+                 type == FW_PORT_TYPE_FIBER_XAUI || type == FW_PORT_TYPE_SFP) {
                 v |= SUPPORTED_FIBRE;
-        else if (type == FW_PORT_TYPE_BP40_BA)
+                if (caps & FW_PORT_CAP_SPEED_1G)
+                        v |= SUPPORTED_1000baseT_Full;
+                if (caps & FW_PORT_CAP_SPEED_10G)
+                        v |= SUPPORTED_10000baseT_Full;
+        } else if (type == FW_PORT_TYPE_BP40_BA)
                 v |= SUPPORTED_40000baseSR4_Full;
 
         if (caps & FW_PORT_CAP_ANEG)
@@ -6610,6 +6618,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         spin_lock_init(&adapter->stats_lock);
         spin_lock_init(&adapter->tid_release_lock);
+        spin_lock_init(&adapter->win0_lock);
 
         INIT_WORK(&adapter->tid_release_task, process_tid_release_list);
         INIT_WORK(&adapter->db_full_task, process_db_full);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 5e1b314e11af..39f2b13e66c7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2914,7 +2914,8 @@ static int t4_sge_init_hard(struct adapter *adap)
 int t4_sge_init(struct adapter *adap)
 {
         struct sge *s = &adap->sge;
-        u32 sge_control, sge_conm_ctrl;
+        u32 sge_control, sge_control2, sge_conm_ctrl;
+        unsigned int ingpadboundary, ingpackboundary;
         int ret, egress_threshold;
 
         /*
@@ -2924,8 +2925,31 @@ int t4_sge_init(struct adapter *adap)
         sge_control = t4_read_reg(adap, SGE_CONTROL);
         s->pktshift = PKTSHIFT_GET(sge_control);
         s->stat_len = (sge_control & EGRSTATUSPAGESIZE_MASK) ? 128 : 64;
-        s->fl_align = 1 << (INGPADBOUNDARY_GET(sge_control) +
-                            X_INGPADBOUNDARY_SHIFT);
+
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately.  The actual Ingress Packet Data alignment boundary
+         * within Packed Buffer Mode is the maximum of these two
+         * specifications.
+         */
+        ingpadboundary = 1 << (INGPADBOUNDARY_GET(sge_control) +
+                               X_INGPADBOUNDARY_SHIFT);
+        if (is_t4(adap->params.chip)) {
+                s->fl_align = ingpadboundary;
+        } else {
+                /* T5 has a different interpretation of one of the PCIe Packing
+                 * Boundary values.
+                 */
+                sge_control2 = t4_read_reg(adap, SGE_CONTROL2_A);
+                ingpackboundary = INGPACKBOUNDARY_G(sge_control2);
+                if (ingpackboundary == INGPACKBOUNDARY_16B_X)
+                        ingpackboundary = 16;
+                else
+                        ingpackboundary = 1 << (ingpackboundary +
+                                                INGPACKBOUNDARY_SHIFT_X);
+
+                s->fl_align = max(ingpadboundary, ingpackboundary);
+        }
 
         if (adap->flags & USING_SOFT_PARAMS)
                 ret = t4_sge_init_soft(adap);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index a9d9d74e4f09..163a2a14948c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3129,12 +3129,51 @@ int t4_fixup_host_params(struct adapter *adap, unsigned int page_size,
                      HOSTPAGESIZEPF6(sge_hps) |
                      HOSTPAGESIZEPF7(sge_hps));
 
-        t4_set_reg_field(adap, SGE_CONTROL,
-                         INGPADBOUNDARY_MASK |
-                         EGRSTATUSPAGESIZE_MASK,
-                         INGPADBOUNDARY(fl_align_log - 5) |
-                         EGRSTATUSPAGESIZE(stat_len != 64));
-
+        if (is_t4(adap->params.chip)) {
+                t4_set_reg_field(adap, SGE_CONTROL,
+                                 INGPADBOUNDARY_MASK |
+                                 EGRSTATUSPAGESIZE_MASK,
+                                 INGPADBOUNDARY(fl_align_log - 5) |
+                                 EGRSTATUSPAGESIZE(stat_len != 64));
+        } else {
+                /* T5 introduced the separation of the Free List Padding and
+                 * Packing Boundaries.  Thus, we can select a smaller Padding
+                 * Boundary to avoid uselessly chewing up PCIe Link and Memory
+                 * Bandwidth, and use a Packing Boundary which is large enough
+                 * to avoid false sharing between CPUs, etc.
+                 *
+                 * For the PCI Link, the smaller the Padding Boundary the
+                 * better.  For the Memory Controller, a smaller Padding
+                 * Boundary is better until we cross under the Memory Line
+                 * Size (the minimum unit of transfer to/from Memory).  If we
+                 * have a Padding Boundary which is smaller than the Memory
+                 * Line Size, that'll involve a Read-Modify-Write cycle on the
+                 * Memory Controller which is never good.  For T5 the smallest
+                 * Padding Boundary which we can select is 32 bytes which is
+                 * larger than any known Memory Controller Line Size so we'll
+                 * use that.
+                 *
+                 * T5 has a different interpretation of the "0" value for the
+                 * Packing Boundary.  This corresponds to 16 bytes instead of
+                 * the expected 32 bytes.  We never have a Packing Boundary
+                 * less than 32 bytes so we can't use that special value but
+                 * on the other hand, if we wanted 32 bytes, the best we can
+                 * really do is 64 bytes.
+                */
+                if (fl_align <= 32) {
+                        fl_align = 64;
+                        fl_align_log = 6;
+                }
+                t4_set_reg_field(adap, SGE_CONTROL,
+                                 INGPADBOUNDARY_MASK |
+                                 EGRSTATUSPAGESIZE_MASK,
+                                 INGPADBOUNDARY(INGPCIEBOUNDARY_32B_X) |
+                                 EGRSTATUSPAGESIZE(stat_len != 64));
+                t4_set_reg_field(adap, SGE_CONTROL2_A,
+                                 INGPACKBOUNDARY_V(INGPACKBOUNDARY_M),
+                                 INGPACKBOUNDARY_V(fl_align_log -
+                                                 INGPACKBOUNDARY_SHIFT_X));
+        }
         /*
          * Adjust various SGE Free List Host Buffer Sizes.
          *
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index a1024db5dc13..8d2de1006b08 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -95,6 +95,7 @@
 #define X_INGPADBOUNDARY_SHIFT 5
 
 #define SGE_CONTROL 0x1008
+#define SGE_CONTROL2_A          0x1124
 #define  DCASYSTYPE             0x00080000U
 #define  RXPKTCPLMODE_MASK      0x00040000U
 #define  RXPKTCPLMODE_SHIFT     18
@@ -106,6 +107,7 @@
 #define  PKTSHIFT_SHIFT         10
 #define  PKTSHIFT(x)            ((x) << PKTSHIFT_SHIFT)
 #define  PKTSHIFT_GET(x)        (((x) & PKTSHIFT_MASK) >> PKTSHIFT_SHIFT)
+#define  INGPCIEBOUNDARY_32B_X  0
 #define  INGPCIEBOUNDARY_MASK   0x00000380U
 #define  INGPCIEBOUNDARY_SHIFT  7
 #define  INGPCIEBOUNDARY(x)     ((x) << INGPCIEBOUNDARY_SHIFT)
@@ -114,6 +116,14 @@
 #define  INGPADBOUNDARY(x)      ((x) << INGPADBOUNDARY_SHIFT)
 #define  INGPADBOUNDARY_GET(x)  (((x) & INGPADBOUNDARY_MASK) \
                                  >> INGPADBOUNDARY_SHIFT)
+#define  INGPACKBOUNDARY_16B_X  0
+#define  INGPACKBOUNDARY_SHIFT_X 5
+
+#define  INGPACKBOUNDARY_S      16
+#define  INGPACKBOUNDARY_M      0x7U
+#define  INGPACKBOUNDARY_V(x)   ((x) << INGPACKBOUNDARY_S)
+#define  INGPACKBOUNDARY_G(x)   (((x) >> INGPACKBOUNDARY_S) \
+                                 & INGPACKBOUNDARY_M)
 #define  EGRPCIEBOUNDARY_MASK   0x0000000eU
 #define  EGRPCIEBOUNDARY_SHIFT  1
 #define  EGRPCIEBOUNDARY(x)     ((x) << EGRPCIEBOUNDARY_SHIFT)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 68eaa9c88c7d..3d06e77d7121 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -299,6 +299,14 @@ struct sge {
         u16 timer_val[SGE_NTIMERS];     /* interrupt holdoff timer array */
         u8 counter_val[SGE_NCOUNTERS];  /* interrupt RX threshold array */
 
+        /* Decoded Adapter Parameters.
+         */
+        u32 fl_pg_order;                /* large page allocation size */
+        u32 stat_len;                   /* length of status page at ring end */
+        u32 pktshift;                   /* padding between CPL & packet data */
+        u32 fl_align;                   /* response queue message alignment */
+        u32 fl_starve_thres;            /* Free List starvation threshold */
+
         /*
          * Reverse maps from Absolute Queue IDs to associated queue pointers.
          * The absolute Queue IDs are in a compact range which start at a
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index bfa398d91826..0b42bddaf284 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2929,14 +2929,14 @@ static const struct pci_device_id cxgb4vf_pci_tbl[] = {
         CH_DEVICE(0x480d),      /* T480-cr */
         CH_DEVICE(0x480e),      /* T440-lp-cr */
         CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
+        CH_DEVICE(0x4881),
+        CH_DEVICE(0x4882),
+        CH_DEVICE(0x4883),
+        CH_DEVICE(0x4884),
+        CH_DEVICE(0x4885),
+        CH_DEVICE(0x4886),
+        CH_DEVICE(0x4887),
+        CH_DEVICE(0x4888),
         CH_DEVICE(0x5801),      /* T520-cr */
         CH_DEVICE(0x5802),      /* T522-cr */
         CH_DEVICE(0x5803),      /* T540-cr */
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index 85036e6b42c4..fdd078d7d82c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -51,14 +51,6 @@
 #include "../cxgb4/t4_msg.h"
 
 /*
- * Decoded Adapter Parameters.
- */
-static u32 FL_PG_ORDER;         /* large page allocation size */
-static u32 STAT_LEN;            /* length of status page at ring end */
-static u32 PKTSHIFT;            /* padding between CPL and packet data */
-static u32 FL_ALIGN;            /* response queue message alignment */
-
-/*
  * Constants ...
  */
 enum {
@@ -102,12 +94,6 @@ enum {
         MAX_TIMER_TX_RECLAIM = 100,
 
         /*
-         * An FL with <= FL_STARVE_THRES buffers is starving and a periodic
-         * timer will attempt to refill it.
-         */
-        FL_STARVE_THRES = 4,
-
-        /*
          * Suspend an Ethernet TX queue with fewer available descriptors than
          * this.  We always want to have room for a maximum sized packet:
          * inline immediate data + MAX_SKB_FRAGS. This is the same as
@@ -264,15 +250,19 @@ static inline unsigned int fl_cap(const struct sge_fl *fl)
 
 /**
  *      fl_starving - return whether a Free List is starving.
+ *      @adapter: pointer to the adapter
  *      @fl: the Free List
  *
  *      Tests specified Free List to see whether the number of buffers
  *      available to the hardware has falled below our "starvation"
  *      threshold.
  */
-static inline bool fl_starving(const struct sge_fl *fl)
+static inline bool fl_starving(const struct adapter *adapter,
+                               const struct sge_fl *fl)
 {
-        return fl->avail - fl->pend_cred <= FL_STARVE_THRES;
+        const struct sge *s = &adapter->sge;
+
+        return fl->avail - fl->pend_cred <= s->fl_starve_thres;
 }
 
 /**
@@ -457,13 +447,16 @@ static inline void reclaim_completed_tx(struct adapter *adapter,
 
 /**
  *      get_buf_size - return the size of an RX Free List buffer.
+ *      @adapter: pointer to the associated adapter
  *      @sdesc: pointer to the software buffer descriptor
  */
-static inline int get_buf_size(const struct rx_sw_desc *sdesc)
+static inline int get_buf_size(const struct adapter *adapter,
+                               const struct rx_sw_desc *sdesc)
 {
-        return FL_PG_ORDER > 0 && (sdesc->dma_addr & RX_LARGE_BUF)
-                ? (PAGE_SIZE << FL_PG_ORDER)
-                : PAGE_SIZE;
+        const struct sge *s = &adapter->sge;
+
+        return (s->fl_pg_order > 0 && (sdesc->dma_addr & RX_LARGE_BUF)
+                ? (PAGE_SIZE << s->fl_pg_order) : PAGE_SIZE);
 }
 
 /**
@@ -483,7 +476,8 @@ static void free_rx_bufs(struct adapter *adapter, struct sge_fl *fl, int n)
 
                 if (is_buf_mapped(sdesc))
                         dma_unmap_page(adapter->pdev_dev, get_buf_addr(sdesc),
-                                       get_buf_size(sdesc), PCI_DMA_FROMDEVICE);
+                                       get_buf_size(adapter, sdesc),
+                                       PCI_DMA_FROMDEVICE);
                 put_page(sdesc->page);
                 sdesc->page = NULL;
                 if (++fl->cidx == fl->size)
@@ -511,7 +505,8 @@ static void unmap_rx_buf(struct adapter *adapter, struct sge_fl *fl)
 
         if (is_buf_mapped(sdesc))
                 dma_unmap_page(adapter->pdev_dev, get_buf_addr(sdesc),
-                               get_buf_size(sdesc), PCI_DMA_FROMDEVICE);
+                               get_buf_size(adapter, sdesc),
+                               PCI_DMA_FROMDEVICE);
         sdesc->page = NULL;
         if (++fl->cidx == fl->size)
                 fl->cidx = 0;
@@ -589,6 +584,7 @@ static inline void poison_buf(struct page *page, size_t sz)
 static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                               int n, gfp_t gfp)
 {
+        struct sge *s = &adapter->sge;
         struct page *page;
         dma_addr_t dma_addr;
         unsigned int cred = fl->avail;
@@ -608,12 +604,12 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
          * If we don't support large pages, drop directly into the small page
          * allocation code.
          */
-        if (FL_PG_ORDER == 0)
+        if (s->fl_pg_order == 0)
                 goto alloc_small_pages;
 
         while (n) {
                 page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
-                                   FL_PG_ORDER);
+                                   s->fl_pg_order);
                 if (unlikely(!page)) {
                         /*
                          * We've failed inour attempt to allocate a "large
@@ -623,10 +619,10 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                         fl->large_alloc_failed++;
                         break;
                 }
-                poison_buf(page, PAGE_SIZE << FL_PG_ORDER);
+                poison_buf(page, PAGE_SIZE << s->fl_pg_order);
 
                 dma_addr = dma_map_page(adapter->pdev_dev, page, 0,
-                                        PAGE_SIZE << FL_PG_ORDER,
+                                        PAGE_SIZE << s->fl_pg_order,
                                         PCI_DMA_FROMDEVICE);
                 if (unlikely(dma_mapping_error(adapter->pdev_dev, dma_addr))) {
                         /*
@@ -637,7 +633,7 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                          * because DMA mapping resources are typically
                          * critical resources once they become scarse.
                          */
-                        __free_pages(page, FL_PG_ORDER);
+                        __free_pages(page, s->fl_pg_order);
                         goto out;
                 }
                 dma_addr |= RX_LARGE_BUF;
@@ -693,7 +689,7 @@ out:
         fl->pend_cred += cred;
         ring_fl_db(adapter, fl);
 
-        if (unlikely(fl_starving(fl))) {
+        if (unlikely(fl_starving(adapter, fl))) {
                 smp_wmb();
                 set_bit(fl->cntxt_id, adapter->sge.starving_fl);
         }
@@ -1468,6 +1464,8 @@ static void t4vf_pktgl_free(const struct pkt_gl *gl)
 static void do_gro(struct sge_eth_rxq *rxq, const struct pkt_gl *gl,
                    const struct cpl_rx_pkt *pkt)
 {
+        struct adapter *adapter = rxq->rspq.adapter;
+        struct sge *s = &adapter->sge;
         int ret;
         struct sk_buff *skb;
 
@@ -1478,8 +1476,8 @@ static void do_gro(struct sge_eth_rxq *rxq, const struct pkt_gl *gl,
                 return;
         }
 
-        copy_frags(skb, gl, PKTSHIFT);
-        skb->len = gl->tot_len - PKTSHIFT;
+        copy_frags(skb, gl, s->pktshift);
+        skb->len = gl->tot_len - s->pktshift;
         skb->data_len = skb->len;
         skb->truesize += skb->data_len;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1516,6 +1514,8 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
         bool csum_ok = pkt->csum_calc && !pkt->err_vec &&
                        (rspq->netdev->features & NETIF_F_RXCSUM);
         struct sge_eth_rxq *rxq = container_of(rspq, struct sge_eth_rxq, rspq);
+        struct adapter *adapter = rspq->adapter;
+        struct sge *s = &adapter->sge;
 
         /*
          * If this is a good TCP packet and we have Generic Receive Offload
@@ -1537,7 +1537,7 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
                 rxq->stats.rx_drops++;
                 return 0;
         }
-        __skb_pull(skb, PKTSHIFT);
+        __skb_pull(skb, s->pktshift);
         skb->protocol = eth_type_trans(skb, rspq->netdev);
         skb_record_rx_queue(skb, rspq->idx);
         rxq->stats.pkts++;
@@ -1648,6 +1648,8 @@ static inline void rspq_next(struct sge_rspq *rspq)
 static int process_responses(struct sge_rspq *rspq, int budget)
 {
         struct sge_eth_rxq *rxq = container_of(rspq, struct sge_eth_rxq, rspq);
+        struct adapter *adapter = rspq->adapter;
+        struct sge *s = &adapter->sge;
         int budget_left = budget;
 
         while (likely(budget_left)) {
@@ -1697,7 +1699,7 @@ static int process_responses(struct sge_rspq *rspq, int budget)
                                 BUG_ON(frag >= MAX_SKB_FRAGS);
                                 BUG_ON(rxq->fl.avail == 0);
                                 sdesc = &rxq->fl.sdesc[rxq->fl.cidx];
-                                bufsz = get_buf_size(sdesc);
+                                bufsz = get_buf_size(adapter, sdesc);
                                 fp->page = sdesc->page;
                                 fp->offset = rspq->offset;
                                 fp->size = min(bufsz, len);
@@ -1726,7 +1728,7 @@ static int process_responses(struct sge_rspq *rspq, int budget)
                          */
                         ret = rspq->handler(rspq, rspq->cur_desc, &gl);
                         if (likely(ret == 0))
-                                rspq->offset += ALIGN(fp->size, FL_ALIGN);
+                                rspq->offset += ALIGN(fp->size, s->fl_align);
                         else
                                 restore_rx_bufs(&gl, &rxq->fl, frag);
                 } else if (likely(rsp_type == RSP_TYPE_CPL)) {
@@ -1963,7 +1965,7 @@ static void sge_rx_timer_cb(unsigned long data)
                          * schedule napi but the FL is no longer starving.
                          * No biggie.
                          */
-                        if (fl_starving(fl)) {
+                        if (fl_starving(adapter, fl)) {
                                 struct sge_eth_rxq *rxq;
 
                                 rxq = container_of(fl, struct sge_eth_rxq, fl);
@@ -2047,6 +2049,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                        int intr_dest,
                        struct sge_fl *fl, rspq_handler_t hnd)
 {
+        struct sge *s = &adapter->sge;
         struct port_info *pi = netdev_priv(dev);
         struct fw_iq_cmd cmd, rpl;
         int ret, iqandst, flsz = 0;
@@ -2117,7 +2120,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                 fl->size = roundup(fl->size, FL_PER_EQ_UNIT);
                 fl->desc = alloc_ring(adapter->pdev_dev, fl->size,
                                       sizeof(__be64), sizeof(struct rx_sw_desc),
-                                      &fl->addr, &fl->sdesc, STAT_LEN);
+                                      &fl->addr, &fl->sdesc, s->stat_len);
                 if (!fl->desc) {
                         ret = -ENOMEM;
                         goto err;
@@ -2129,7 +2132,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                  * free list ring) in Egress Queue Units.
                  */
                 flsz = (fl->size / FL_PER_EQ_UNIT +
-                        STAT_LEN / EQ_UNIT);
+                        s->stat_len / EQ_UNIT);
 
                 /*
                  * Fill in all the relevant firmware Ingress Queue Command
@@ -2217,6 +2220,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
                            struct net_device *dev, struct netdev_queue *devq,
                            unsigned int iqid)
 {
+        struct sge *s = &adapter->sge;
         int ret, nentries;
         struct fw_eq_eth_cmd cmd, rpl;
         struct port_info *pi = netdev_priv(dev);
@@ -2225,7 +2229,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
          * Calculate the size of the hardware TX Queue (including the Status
          * Page on the end of the TX Queue) in units of TX Descriptors.
          */
-        nentries = txq->q.size + STAT_LEN / sizeof(struct tx_desc);
+        nentries = txq->q.size + s->stat_len / sizeof(struct tx_desc);
 
         /*
          * Allocate the hardware ring for the TX ring (with space for its
@@ -2234,7 +2238,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
         txq->q.desc = alloc_ring(adapter->pdev_dev, txq->q.size,
                                  sizeof(struct tx_desc),
                                  sizeof(struct tx_sw_desc),
-                                 &txq->q.phys_addr, &txq->q.sdesc, STAT_LEN);
+                                 &txq->q.phys_addr, &txq->q.sdesc, s->stat_len);
         if (!txq->q.desc)
                 return -ENOMEM;
 
@@ -2307,8 +2311,10 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
  */
 static void free_txq(struct adapter *adapter, struct sge_txq *tq)
 {
+        struct sge *s = &adapter->sge;
+
         dma_free_coherent(adapter->pdev_dev,
-                          tq->size * sizeof(*tq->desc) + STAT_LEN,
+                          tq->size * sizeof(*tq->desc) + s->stat_len,
                           tq->desc, tq->phys_addr);
         tq->cntxt_id = 0;
         tq->sdesc = NULL;
@@ -2322,6 +2328,7 @@ static void free_txq(struct adapter *adapter, struct sge_txq *tq)
 static void free_rspq_fl(struct adapter *adapter, struct sge_rspq *rspq,
                          struct sge_fl *fl)
 {
+        struct sge *s = &adapter->sge;
         unsigned int flid = fl ? fl->cntxt_id : 0xffff;
 
         t4vf_iq_free(adapter, FW_IQ_TYPE_FL_INT_CAP,
@@ -2337,7 +2344,7 @@ static void free_rspq_fl(struct adapter *adapter, struct sge_rspq *rspq,
         if (fl) {
                 free_rx_bufs(adapter, fl, fl->avail);
                 dma_free_coherent(adapter->pdev_dev,
-                                  fl->size * sizeof(*fl->desc) + STAT_LEN,
+                                  fl->size * sizeof(*fl->desc) + s->stat_len,
                                   fl->desc, fl->addr);
                 kfree(fl->sdesc);
                 fl->sdesc = NULL;
@@ -2423,6 +2430,7 @@ int t4vf_sge_init(struct adapter *adapter)
         u32 fl0 = sge_params->sge_fl_buffer_size[0];
         u32 fl1 = sge_params->sge_fl_buffer_size[1];
         struct sge *s = &adapter->sge;
+        unsigned int ingpadboundary, ingpackboundary;
 
         /*
          * Start by vetting the basic SGE parameters which have been set up by
@@ -2443,12 +2451,48 @@ int t4vf_sge_init(struct adapter *adapter)
          * Now translate the adapter parameters into our internal forms.
          */
         if (fl1)
-                FL_PG_ORDER = ilog2(fl1) - PAGE_SHIFT;
-        STAT_LEN = ((sge_params->sge_control & EGRSTATUSPAGESIZE_MASK)
-                    ? 128 : 64);
-        PKTSHIFT = PKTSHIFT_GET(sge_params->sge_control);
-        FL_ALIGN = 1 << (INGPADBOUNDARY_GET(sge_params->sge_control) +
-                         SGE_INGPADBOUNDARY_SHIFT);
+                s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT;
+        s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_MASK)
+                        ? 128 : 64);
+        s->pktshift = PKTSHIFT_GET(sge_params->sge_control);
+
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately.  The actual Ingress Packet Data alignment boundary
+         * within Packed Buffer Mode is the maximum of these two
+         * specifications.  (Note that it makes no real practical sense to
+         * have the Pading Boudary be larger than the Packing Boundary but you
+         * could set the chip up that way and, in fact, legacy T4 code would
+         * end doing this because it would initialize the Padding Boundary and
+         * leave the Packing Boundary initialized to 0 (16 bytes).)
+         */
+        ingpadboundary = 1 << (INGPADBOUNDARY_GET(sge_params->sge_control) +
+                               X_INGPADBOUNDARY_SHIFT);
+        if (is_t4(adapter->params.chip)) {
+                s->fl_align = ingpadboundary;
+        } else {
+                /* T5 has a different interpretation of one of the PCIe Packing
+                 * Boundary values.
+                 */
+                ingpackboundary = INGPACKBOUNDARY_G(sge_params->sge_control2);
+                if (ingpackboundary == INGPACKBOUNDARY_16B_X)
+                        ingpackboundary = 16;
+                else
+                        ingpackboundary = 1 << (ingpackboundary +
+                                                INGPACKBOUNDARY_SHIFT_X);
+
+                s->fl_align = max(ingpadboundary, ingpackboundary);
+        }
+
+        /* A FL with <= fl_starve_thres buffers is starving and a periodic
+         * timer will attempt to refill it.  This needs to be larger than the
+         * SGE's Egress Congestion Threshold.  If it isn't, then we can get
+         * stuck waiting for new packets while the SGE is waiting for us to
+         * give it more Free List entries.  (Note that the SGE's Egress
+         * Congestion Threshold is in units of 2 Free List pointers.)
+         */
+        s->fl_starve_thres
+                = EGRTHRESHOLD_GET(sge_params->sge_congestion_control)*2 + 1;
 
         /*
          * Set up tasklet timers.
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 95df61dcb4ce..4b6a6d14d86d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -134,11 +134,13 @@ struct dev_params {
  */
 struct sge_params {
         u32 sge_control;                /* padding, boundaries, lengths, etc. */
+        u32 sge_control2;               /* T5: more of the same */
         u32 sge_host_page_size;         /* RDMA page sizes */
         u32 sge_queues_per_page;        /* RDMA queues/page */
         u32 sge_user_mode_limits;       /* limits for BAR2 user mode accesses */
         u32 sge_fl_buffer_size[16];     /* free list buffer sizes */
         u32 sge_ingress_rx_threshold;   /* RX counter interrupt threshold[4] */
+        u32 sge_congestion_control;     /* congestion thresholds, etc. */
         u32 sge_timer_value_0_and_1;    /* interrupt coalescing timer values */
         u32 sge_timer_value_2_and_3;
         u32 sge_timer_value_4_and_5;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index e984fdc48ba2..1e896b923234 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -468,12 +468,38 @@ int t4vf_get_sge_params(struct adapter *adapter)
         sge_params->sge_timer_value_2_and_3 = vals[5];
         sge_params->sge_timer_value_4_and_5 = vals[6];
 
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately with the Padding Boundary in SGE_CONTROL and and Packing
+         * Boundary in SGE_CONTROL2.  So for T5 and later we need to grab
+         * SGE_CONTROL in order to determine how ingress packet data will be
+         * laid out in Packed Buffer Mode.  Unfortunately, older versions of
+         * the firmware won't let us retrieve SGE_CONTROL2 so if we get a
+         * failure grabbing it we throw an error since we can't figure out the
+         * right value.
+         */
+        if (!is_t4(adapter->params.chip)) {
+                params[0] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
+                             FW_PARAMS_PARAM_XYZ(SGE_CONTROL2_A));
+                v = t4vf_query_params(adapter, 1, params, vals);
+                if (v != FW_SUCCESS) {
+                        dev_err(adapter->pdev_dev,
+                                "Unable to get SGE Control2; "
+                                "probably old firmware.\n");
+                        return v;
+                }
+                sge_params->sge_control2 = vals[0];
+        }
+
         params[0] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
                      FW_PARAMS_PARAM_XYZ(SGE_INGRESS_RX_THRESHOLD));
-        v = t4vf_query_params(adapter, 1, params, vals);
+        params[1] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
+                     FW_PARAMS_PARAM_XYZ(SGE_CONM_CTRL));
+        v = t4vf_query_params(adapter, 2, params, vals);
         if (v)
                 return v;
         sge_params->sge_ingress_rx_threshold = vals[0];
+        sge_params->sge_congestion_control = vals[1];
 
         return 0;
 }
diff --git a/drivers/net/ethernet/cisco/enic/enic_clsf.c b/drivers/net/ethernet/cisco/enic/enic_clsf.c
index 69dfd3c9e529..0be6850be8a2 100644
--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
+++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
@@ -86,7 +86,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
         int i;
 
         enic_rfs_timer_stop(enic);
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         enic->rfs_h.free = 0;
         for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
                 struct hlist_head *hhead;
@@ -100,7 +100,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
                         kfree(n);
                 }
         }
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
 }
 
 struct enic_rfs_fltr_node *htbl_fltr_search(struct enic *enic, u16 fltr_id)
@@ -128,7 +128,7 @@ void enic_flow_may_expire(unsigned long data)
         bool res;
         int j;
 
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         for (j = 0; j < ENIC_CLSF_EXPIRE_COUNT; j++) {
                 struct hlist_head *hhead;
                 struct hlist_node *tmp;
@@ -148,7 +148,7 @@ void enic_flow_may_expire(unsigned long data)
                         }
                 }
         }
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
         mod_timer(&enic->rfs_h.rfs_may_expire, jiffies + HZ/4);
 }
 
@@ -183,7 +183,7 @@ int enic_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
                 return -EPROTONOSUPPORT;
 
         tbl_idx = skb_get_hash_raw(skb) & ENIC_RFS_FLW_MASK;
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         n = htbl_key_search(&enic->rfs_h.ht_head[tbl_idx], &keys);
 
         if (n) { /* entry already present  */
@@ -277,7 +277,7 @@ int enic_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
         }
 
 ret_unlock:
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
         return res;
 }
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 929bfe70080a..73cf1653a4a3 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -940,18 +940,8 @@ static int enic_rq_alloc_buf(struct vnic_rq *rq)
         struct vnic_rq_buf *buf = rq->to_use;
 
         if (buf->os_buf) {
-                buf = buf->next;
-                rq->to_use = buf;
-                rq->ring.desc_avail--;
-                if ((buf->index & VNIC_RQ_RETURN_RATE) == 0) {
-                        /* Adding write memory barrier prevents compiler and/or
-                         * CPU reordering, thus avoiding descriptor posting
-                         * before descriptor is initialized. Otherwise, hardware
-                         * can read stale descriptor fields.
-                         */
-                        wmb();
-                        iowrite32(buf->index, &rq->ctrl->posted_index);
-                }
+                enic_queue_rq_desc(rq, buf->os_buf, os_buf_index, buf->dma_addr,
+                                   buf->len);
 
                 return 0;
         }
@@ -1037,7 +1027,10 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                                 enic->rq_truncated_pkts++;
                 }
 
+                pci_unmap_single(enic->pdev, buf->dma_addr, buf->len,
+                                 PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_any(skb);
+                buf->os_buf = NULL;
 
                 return;
         }
@@ -1088,7 +1081,10 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                 /* Buffer overflow
                  */
 
+                pci_unmap_single(enic->pdev, buf->dma_addr, buf->len,
+                                 PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_any(skb);
+                buf->os_buf = NULL;
         }
 }
 
@@ -1674,13 +1670,13 @@ static int enic_stop(struct net_device *netdev)
 
         enic_dev_disable(enic);
 
-        local_bh_disable();
         for (i = 0; i < enic->rq_count; i++) {
                 napi_disable(&enic->napi[i]);
+                local_bh_disable();
                 while (!enic_poll_lock_napi(&enic->rq[i]))
                         mdelay(1);
+                local_bh_enable();
         }
-        local_bh_enable();
 
         netif_carrier_off(netdev);
         netif_tx_disable(netdev);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 9a18e7930b31..597c463e384d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4309,11 +4309,16 @@ static int be_ndo_bridge_setlink(struct net_device *dev, struct nlmsghdr *nlh)
                 return -EOPNOTSUPP;
 
         br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
+        if (!br_spec)
+                return -EINVAL;
 
         nla_for_each_nested(attr, br_spec, rem) {
                 if (nla_type(attr) != IFLA_BRIDGE_MODE)
                         continue;
 
+                if (nla_len(attr) < sizeof(mode))
+                        return -EINVAL;
+
                 mode = nla_get_u16(attr);
                 if (mode != BRIDGE_MODE_VEPA && mode != BRIDGE_MODE_VEB)
                         return -EINVAL;
@@ -4421,6 +4426,11 @@ static void be_del_vxlan_port(struct net_device *netdev, sa_family_t sa_family,
                  "Disabled VxLAN offloads for UDP port %d\n",
                  be16_to_cpu(port));
 }
+
+static bool be_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops be_netdev_ops = {
@@ -4450,6 +4460,7 @@ static const struct net_device_ops be_netdev_ops = {
 #ifdef CONFIG_BE2NET_VXLAN
         .ndo_add_vxlan_port     = be_add_vxlan_port,
         .ndo_del_vxlan_port     = be_del_vxlan_port,
+        .ndo_gso_check          = be_gso_check,
 #endif
 };
 
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 81b96cf87574..3dca494797bd 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -298,6 +298,16 @@ static void *swap_buffer(void *bufaddr, int len)
         return bufaddr;
 }
 
+static void swap_buffer2(void *dst_buf, void *src_buf, int len)
+{
+        int i;
+        unsigned int *src = src_buf;
+        unsigned int *dst = dst_buf;
+
+        for (i = 0; i < len; i += 4, src++, dst++)
+                *dst = swab32p(src);
+}
+
 static void fec_dump(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
@@ -1307,7 +1317,7 @@ fec_enet_new_rxbdp(struct net_device *ndev, struct bufdesc *bdp, struct sk_buff
 }
 
 static bool fec_enet_copybreak(struct net_device *ndev, struct sk_buff **skb,
-                               struct bufdesc *bdp, u32 length)
+                               struct bufdesc *bdp, u32 length, bool swap)
 {
         struct  fec_enet_private *fep = netdev_priv(ndev);
         struct sk_buff *new_skb;
@@ -1322,7 +1332,10 @@ static bool fec_enet_copybreak(struct net_device *ndev, struct sk_buff **skb,
         dma_sync_single_for_cpu(&fep->pdev->dev, bdp->cbd_bufaddr,
                                 FEC_ENET_RX_FRSIZE - fep->rx_align,
                                 DMA_FROM_DEVICE);
-        memcpy(new_skb->data, (*skb)->data, length);
+        if (!swap)
+                memcpy(new_skb->data, (*skb)->data, length);
+        else
+                swap_buffer2(new_skb->data, (*skb)->data, length);
         *skb = new_skb;
 
         return true;
@@ -1352,6 +1365,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
         u16     vlan_tag;
         int     index = 0;
         bool    is_copybreak;
+        bool    need_swap = id_entry->driver_data & FEC_QUIRK_SWAP_FRAME;
 
 #ifdef CONFIG_M532x
         flush_cache_all();
@@ -1415,7 +1429,8 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                  * include that when passing upstream as it messes up
                  * bridging applications.
                  */
-                is_copybreak = fec_enet_copybreak(ndev, &skb, bdp, pkt_len - 4);
+                is_copybreak = fec_enet_copybreak(ndev, &skb, bdp, pkt_len - 4,
+                                                  need_swap);
                 if (!is_copybreak) {
                         skb_new = netdev_alloc_skb(ndev, FEC_ENET_RX_FRSIZE);
                         if (unlikely(!skb_new)) {
@@ -1430,7 +1445,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                 prefetch(skb->data - NET_IP_ALIGN);
                 skb_put(skb, pkt_len - 4);
                 data = skb->data;
-                if (id_entry->driver_data & FEC_QUIRK_SWAP_FRAME)
+                if (!is_copybreak && need_swap)
                         swap_buffer(data, pkt_len);
 
                 /* Extract the enhanced buffer descriptor */
@@ -1581,7 +1596,8 @@ fec_enet_interrupt(int irq, void *dev_id)
                 complete(&fep->mdio_done);
         }
 
-        fec_ptp_check_pps_event(fep);
+        if (fep->ptp_clock)
+                fec_ptp_check_pps_event(fep);
 
         return ret;
 }
@@ -3342,12 +3358,11 @@ static int __maybe_unused fec_suspend(struct device *dev)
                 netif_device_detach(ndev);
                 netif_tx_unlock_bh(ndev);
                 fec_stop(ndev);
+                fec_enet_clk_enable(ndev, false);
+                pinctrl_pm_select_sleep_state(&fep->pdev->dev);
         }
         rtnl_unlock();
 
-        fec_enet_clk_enable(ndev, false);
-        pinctrl_pm_select_sleep_state(&fep->pdev->dev);
-
         if (fep->reg_phy)
                 regulator_disable(fep->reg_phy);
 
@@ -3366,13 +3381,14 @@ static int __maybe_unused fec_resume(struct device *dev)
                         return ret;
         }
 
-        pinctrl_pm_select_default_state(&fep->pdev->dev);
-        ret = fec_enet_clk_enable(ndev, true);
-        if (ret)
-                goto failed_clk;
-
         rtnl_lock();
         if (netif_running(ndev)) {
+                pinctrl_pm_select_default_state(&fep->pdev->dev);
+                ret = fec_enet_clk_enable(ndev, true);
+                if (ret) {
+                        rtnl_unlock();
+                        goto failed_clk;
+                }
                 fec_restart(ndev);
                 netif_tx_lock_bh(ndev);
                 netif_device_attach(ndev);
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
index 3d4e08be1709..b34214e2df5f 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
@@ -341,6 +341,9 @@ static void restart(struct net_device *dev)
                 FC(fecp, x_cntrl, FEC_TCNTRL_FDEN);     /* FD disable */
         }
 
+        /* Restore multicast and promiscuous settings */
+        set_multicast_list(dev);
+
         /*
          * Enable interrupts we wish to service.
          */
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-scc.c b/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
index f30411f0701f..7a184e8816a4 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
@@ -355,6 +355,9 @@ static void restart(struct net_device *dev)
         if (fep->phydev->duplex)
                 S16(sccp, scc_psmr, SCC_PSMR_LPB | SCC_PSMR_FDE);
 
+        /* Restore multicast and promiscuous settings */
+        set_multicast_list(dev);
+
         S32(sccp, scc_gsmrl, SCC_GSMRL_ENR | SCC_GSMRL_ENT);
 }
 
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 5f6aded512f5..24f3986cfae2 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -1075,7 +1075,10 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                                   NETIF_F_HW_CSUM |
                                   NETIF_F_SG);
 
-        netdev->priv_flags |= IFF_UNICAST_FLT;
+        /* Do not set IFF_UNICAST_FLT for VMWare's 82545EM */
+        if (hw->device_id != E1000_DEV_ID_82545EM_COPPER ||
+            hw->subsystem_vendor_id != PCI_VENDOR_ID_VMWARE)
+                netdev->priv_flags |= IFF_UNICAST_FLT;
 
         adapter->en_mng_pt = e1000_enable_mng_pass_thru(hw);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index ed5f1c15fb0f..c3a7f4a4b775 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -6151,7 +6151,7 @@ static void i40e_handle_mdd_event(struct i40e_pf *pf)
                                 I40E_GL_MDET_TX_PF_NUM_SHIFT;
                 u8 vf_num = (reg & I40E_GL_MDET_TX_VF_NUM_MASK) >>
                                 I40E_GL_MDET_TX_VF_NUM_SHIFT;
-                u8 event = (reg & I40E_GL_MDET_TX_EVENT_SHIFT) >>
+                u8 event = (reg & I40E_GL_MDET_TX_EVENT_MASK) >>
                                 I40E_GL_MDET_TX_EVENT_SHIFT;
                 u8 queue = (reg & I40E_GL_MDET_TX_QUEUE_MASK) >>
                                 I40E_GL_MDET_TX_QUEUE_SHIFT;
@@ -6165,7 +6165,7 @@ static void i40e_handle_mdd_event(struct i40e_pf *pf)
         if (reg & I40E_GL_MDET_RX_VALID_MASK) {
                 u8 func = (reg & I40E_GL_MDET_RX_FUNCTION_MASK) >>
                                 I40E_GL_MDET_RX_FUNCTION_SHIFT;
-                u8 event = (reg & I40E_GL_MDET_RX_EVENT_SHIFT) >>
+                u8 event = (reg & I40E_GL_MDET_RX_EVENT_MASK) >>
                                 I40E_GL_MDET_RX_EVENT_SHIFT;
                 u8 queue = (reg & I40E_GL_MDET_RX_QUEUE_MASK) >>
                                 I40E_GL_MDET_RX_QUEUE_SHIFT;
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a21b14495ebd..487cd9c4ac0d 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1012,7 +1012,8 @@ static void igb_free_q_vector(struct igb_adapter *adapter, int v_idx)
         /* igb_get_stats64() might access the rings on this vector,
          * we must wait a grace period before freeing it.
          */
-        kfree_rcu(q_vector, rcu);
+        if (q_vector)
+                kfree_rcu(q_vector, rcu);
 }
 
 /**
@@ -1792,8 +1793,10 @@ void igb_down(struct igb_adapter *adapter)
         adapter->flags &= ~IGB_FLAG_NEED_LINK_UPDATE;
 
         for (i = 0; i < adapter->num_q_vectors; i++) {
-                napi_synchronize(&(adapter->q_vector[i]->napi));
-                napi_disable(&(adapter->q_vector[i]->napi));
+                if (adapter->q_vector[i]) {
+                        napi_synchronize(&adapter->q_vector[i]->napi);
+                        napi_disable(&adapter->q_vector[i]->napi);
+                }
         }
 
 
@@ -3717,7 +3720,8 @@ static void igb_free_all_tx_resources(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_tx_queues; i++)
-                igb_free_tx_resources(adapter->tx_ring[i]);
+                if (adapter->tx_ring[i])
+                        igb_free_tx_resources(adapter->tx_ring[i]);
 }
 
 void igb_unmap_and_free_tx_resource(struct igb_ring *ring,
@@ -3782,7 +3786,8 @@ static void igb_clean_all_tx_rings(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_tx_queues; i++)
-                igb_clean_tx_ring(adapter->tx_ring[i]);
+                if (adapter->tx_ring[i])
+                        igb_clean_tx_ring(adapter->tx_ring[i]);
 }
 
 /**
@@ -3819,7 +3824,8 @@ static void igb_free_all_rx_resources(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_rx_queues; i++)
-                igb_free_rx_resources(adapter->rx_ring[i]);
+                if (adapter->rx_ring[i])
+                        igb_free_rx_resources(adapter->rx_ring[i]);
 }
 
 /**
@@ -3874,7 +3880,8 @@ static void igb_clean_all_rx_rings(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_rx_queues; i++)
-                igb_clean_rx_ring(adapter->rx_ring[i]);
+                if (adapter->rx_ring[i])
+                        igb_clean_rx_ring(adapter->rx_ring[i]);
 }
 
 /**
@@ -6537,6 +6544,9 @@ static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer,
         if (unlikely(page_to_nid(page) != numa_node_id()))
                 return false;
 
+        if (unlikely(page->pfmemalloc))
+                return false;
+
 #if (PAGE_SIZE < 8192)
         /* if we are only owner of page we can reuse it */
         if (unlikely(page_count(page) != 1))
@@ -6603,7 +6613,8 @@ static bool igb_add_rx_frag(struct igb_ring *rx_ring,
                 memcpy(__skb_put(skb, size), va, ALIGN(size, sizeof(long)));
 
                 /* we can reuse buffer as-is, just make sure it is local */
-                if (likely(page_to_nid(page) == numa_node_id()))
+                if (likely((page_to_nid(page) == numa_node_id()) &&
+                           !page->pfmemalloc))
                         return true;
 
                 /* this page cannot be reused so discard it */
@@ -7400,6 +7411,8 @@ static int igb_resume(struct device *dev)
         pci_restore_state(pdev);
         pci_save_state(pdev);
 
+        if (!pci_device_is_present(pdev))
+                return -ENODEV;
         err = pci_enable_device_mem(pdev);
         if (err) {
                 dev_err(&pdev->dev,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index 3ce4a258f945..0ae038b9af90 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -342,12 +342,16 @@ static int ixgbe_set_settings(struct net_device *netdev,
                 if (old == advertised)
                         return err;
                 /* this sets the link speed and restarts auto-neg */
+                while (test_and_set_bit(__IXGBE_IN_SFP_INIT, &adapter->state))
+                        usleep_range(1000, 2000);
+
                 hw->mac.autotry_restart = true;
                 err = hw->mac.ops.setup_link(hw, advertised, true);
                 if (err) {
                         e_info(probe, "setup link failed with code %d\n", err);
                         hw->mac.ops.setup_link(hw, old, true);
                 }
+                clear_bit(__IXGBE_IN_SFP_INIT, &adapter->state);
         } else {
                 /* in this case we currently only support 10Gb/FULL */
                 u32 speed = ethtool_cmd_speed(ecmd);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index fec5212d4337..cc51554c9e99 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -3936,8 +3936,8 @@ void ixgbe_set_rx_mode(struct net_device *netdev)
                  * if SR-IOV and VMDQ are disabled - otherwise ensure
                  * that hardware VLAN filters remain enabled.
                  */
-                if (!(adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED |
-                                        IXGBE_FLAG_SRIOV_ENABLED)))
+                if (adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED |
+                                      IXGBE_FLAG_SRIOV_ENABLED))
                         vlnctrl |= (IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
         } else {
                 if (netdev->flags & IFF_ALLMULTI) {
@@ -4321,8 +4321,8 @@ static void ixgbe_clean_rx_ring(struct ixgbe_ring *rx_ring)
                                 IXGBE_CB(skb)->page_released = false;
                         }
                         dev_kfree_skb(skb);
+                        rx_buffer->skb = NULL;
                 }
-                rx_buffer->skb = NULL;
                 if (rx_buffer->dma)
                         dma_unmap_page(dev, rx_buffer->dma,
                                        ixgbe_rx_pg_size(rx_ring),
@@ -7669,6 +7669,8 @@ static int ixgbe_ndo_bridge_setlink(struct net_device *dev,
                 return -EOPNOTSUPP;
 
         br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
+        if (!br_spec)
+                return -EINVAL;
 
         nla_for_each_nested(attr, br_spec, rem) {
                 __u16 mode;
@@ -7677,6 +7679,9 @@ static int ixgbe_ndo_bridge_setlink(struct net_device *dev,
                 if (nla_type(attr) != IFLA_BRIDGE_MODE)
                         continue;
 
+                if (nla_len(attr) < sizeof(mode))
+                        return -EINVAL;
+
                 mode = nla_get_u16(attr);
                 if (mode == BRIDGE_MODE_VEPA) {
                         reg = 0;
@@ -7979,6 +7984,7 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int i, err, pci_using_dac, expected_gts;
         unsigned int indices = MAX_TX_QUEUES;
         u8 part_str[IXGBE_PBANUM_LENGTH];
+        bool disable_dev = false;
 #ifdef IXGBE_FCOE
         u16 device_caps;
 #endif
@@ -8369,13 +8375,14 @@ err_sw_init:
         iounmap(adapter->io_addr);
         kfree(adapter->mac_table);
 err_ioremap:
+        disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
         free_netdev(netdev);
 err_alloc_etherdev:
         pci_release_selected_regions(pdev,
                                      pci_select_bars(pdev, IORESOURCE_MEM));
 err_pci_reg:
 err_dma:
-        if (!adapter || !test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
+        if (!adapter || disable_dev)
                 pci_disable_device(pdev);
         return err;
 }
@@ -8393,6 +8400,7 @@ static void ixgbe_remove(struct pci_dev *pdev)
 {
         struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
         struct net_device *netdev = adapter->netdev;
+        bool disable_dev;
 
         ixgbe_dbg_adapter_exit(adapter);
 
@@ -8442,11 +8450,12 @@ static void ixgbe_remove(struct pci_dev *pdev)
         e_dev_info("complete\n");
 
         kfree(adapter->mac_table);
+        disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
         free_netdev(netdev);
 
         pci_disable_pcie_error_reporting(pdev);
 
-        if (!test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
+        if (disable_dev)
                 pci_disable_device(pdev);
 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index d47b19f27c35..28b81ae09b5a 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -635,7 +635,6 @@ s32 ixgbe_check_phy_link_tnx(struct ixgbe_hw *hw, ixgbe_link_speed *speed,
  **/
 s32 ixgbe_setup_phy_link_tnx(struct ixgbe_hw *hw)
 {
-        s32 status;
         u16 autoneg_reg = IXGBE_MII_AUTONEG_REG;
         bool autoneg = false;
         ixgbe_link_speed speed;
@@ -700,8 +699,7 @@ s32 ixgbe_setup_phy_link_tnx(struct ixgbe_hw *hw)
 
         hw->phy.ops.write_reg(hw, MDIO_CTRL1,
                               MDIO_MMD_AN, autoneg_reg);
-
-        return status;
+        return 0;
 }
 
 /**
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index b151a949f352..d44560d1d268 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1047,7 +1047,6 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 int tx_index;
                 struct tx_desc *desc;
                 u32 cmd_sts;
-                struct sk_buff *skb;
 
                 tx_index = txq->tx_used_desc;
                 desc = &txq->tx_desc_area[tx_index];
@@ -1066,19 +1065,22 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 reclaimed++;
                 txq->tx_desc_count--;
 
-                skb = NULL;
-                if (cmd_sts & TX_LAST_DESC)
-                        skb = __skb_dequeue(&txq->tx_skb);
+                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
+                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
+                                         desc->byte_cnt, DMA_TO_DEVICE);
+
+                if (cmd_sts & TX_ENABLE_INTERRUPT) {
+                        struct sk_buff *skb = __skb_dequeue(&txq->tx_skb);
+
+                        if (!WARN_ON(!skb))
+                                dev_kfree_skb(skb);
+                }
 
                 if (cmd_sts & ERROR_SUMMARY) {
                         netdev_info(mp->dev, "tx error\n");
                         mp->dev->stats.tx_errors++;
                 }
 
-                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
-                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
-                                         desc->byte_cnt, DMA_TO_DEVICE);
-                dev_kfree_skb(skb);
         }
 
         __netif_tx_unlock_bh(nq);
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index ece83f101526..fdf3e382e464 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -1692,6 +1692,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
 {
         struct mvpp2_prs_entry *pe;
         int tid_aux, tid;
+        int ret = 0;
 
         pe = mvpp2_prs_vlan_find(priv, tpid, ai);
 
@@ -1723,8 +1724,10 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
                                 break;
                 }
 
-                if (tid <= tid_aux)
-                        return -EINVAL;
+                if (tid <= tid_aux) {
+                        ret = -EINVAL;
+                        goto error;
+                }
 
                 memset(pe, 0 , sizeof(struct mvpp2_prs_entry));
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_VLAN);
@@ -1756,9 +1759,10 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
 
         mvpp2_prs_hw_write(priv, pe);
 
+error:
         kfree(pe);
 
-        return 0;
+        return ret;
 }
 
 /* Get first free double vlan ai number */
@@ -1821,7 +1825,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
                                      unsigned int port_map)
 {
         struct mvpp2_prs_entry *pe;
-        int tid_aux, tid, ai;
+        int tid_aux, tid, ai, ret = 0;
 
         pe = mvpp2_prs_double_vlan_find(priv, tpid1, tpid2);
 
@@ -1838,8 +1842,10 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
 
                 /* Set ai value for new double vlan entry */
                 ai = mvpp2_prs_double_vlan_ai_free_get(priv);
-                if (ai < 0)
-                        return ai;
+                if (ai < 0) {
+                        ret = ai;
+                        goto error;
+                }
 
                 /* Get first single/triple vlan tid */
                 for (tid_aux = MVPP2_PE_FIRST_FREE_TID;
@@ -1859,8 +1865,10 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
                                 break;
                 }
 
-                if (tid >= tid_aux)
-                        return -ERANGE;
+                if (tid >= tid_aux) {
+                        ret = -ERANGE;
+                        goto error;
+                }
 
                 memset(pe, 0, sizeof(struct mvpp2_prs_entry));
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_VLAN);
@@ -1887,8 +1895,9 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
         mvpp2_prs_tcam_port_map_set(pe, port_map);
         mvpp2_prs_hw_write(priv, pe);
 
+error:
         kfree(pe);
-        return 0;
+        return ret;
 }
 
 /* IPv4 header parsing for fragmentation and L4 offset */
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index f3032fec8fce..4d69e382b4e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1693,7 +1693,7 @@ int mlx4_en_start_port(struct net_device *dev)
         mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
 
 #ifdef CONFIG_MLX4_EN_VXLAN
-        if (priv->mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS)
+        if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 vxlan_get_rx_port(dev);
 #endif
         priv->port_up = true;
@@ -2281,8 +2281,16 @@ static void mlx4_en_add_vxlan_offloads(struct work_struct *work)
         ret = mlx4_SET_PORT_VXLAN(priv->mdev->dev, priv->port,
                                   VXLAN_STEER_BY_OUTER_MAC, 1);
 out:
-        if (ret)
+        if (ret) {
                 en_err(priv, "failed setting L2 tunnel configuration ret %d\n", ret);
+                return;
+        }
+
+        /* set offloads */
+        priv->dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
+                                      NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->features    |= NETIF_F_GSO_UDP_TUNNEL;
 }
 
 static void mlx4_en_del_vxlan_offloads(struct work_struct *work)
@@ -2290,6 +2298,11 @@ static void mlx4_en_del_vxlan_offloads(struct work_struct *work)
         int ret;
         struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
                                                  vxlan_del_task);
+        /* unset offloads */
+        priv->dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
+                                      NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL);
+        priv->dev->hw_features &= ~NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->features    &= ~NETIF_F_GSO_UDP_TUNNEL;
 
         ret = mlx4_SET_PORT_VXLAN(priv->mdev->dev, priv->port,
                                   VXLAN_STEER_BY_OUTER_MAC, 0);
@@ -2342,6 +2355,11 @@ static void mlx4_en_del_vxlan_port(struct  net_device *dev,
 
         queue_work(priv->mdev->workqueue, &priv->vxlan_del_task);
 }
+
+static bool mlx4_en_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops mlx4_netdev_ops = {
@@ -2373,6 +2391,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
 #ifdef CONFIG_MLX4_EN_VXLAN
         .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
         .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
+        .ndo_gso_check          = mlx4_en_gso_check,
 #endif
 };
 
@@ -2403,6 +2422,11 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
         .ndo_rx_flow_steer      = mlx4_en_filter_rfs,
 #endif
         .ndo_get_phys_port_id   = mlx4_en_get_phys_port_id,
+#ifdef CONFIG_MLX4_EN_VXLAN
+        .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
+        .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
+        .ndo_gso_check          = mlx4_en_gso_check,
+#endif
 };
 
 int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
@@ -2568,13 +2592,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         if (mdev->dev->caps.steering_mode != MLX4_STEERING_MODE_A0)
                 dev->priv_flags |= IFF_UNICAST_FLT;
 
-        if (mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN) {
-                dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
-                                        NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL;
-                dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
-                dev->features    |= NETIF_F_GSO_UDP_TUNNEL;
-        }
-
         mdev->pndev[port] = dev;
 
         netif_carrier_off(dev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 34c137878545..454d9fea640e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -836,8 +836,11 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
          * whether LSO is used */
         tx_desc->ctrl.srcrb_flags = priv->ctrl_flags;
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
-                tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM |
-                                                         MLX4_WQE_CTRL_TCP_UDP_CSUM);
+                if (!skb->encapsulation)
+                        tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM |
+                                                                 MLX4_WQE_CTRL_TCP_UDP_CSUM);
+                else
+                        tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM);
                 ring->tx_csum++;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index a49c9d11d8a5..49290a405903 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1026,6 +1026,7 @@ static void mlx4_free_eq(struct mlx4_dev *dev,
                                 pr_cont("\n");
                 }
         }
+        synchronize_irq(eq->irq);
 
         mlx4_mtt_cleanup(dev, &eq->mtt);
         for (i = 0; i < npages; ++i)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index ca0f98c95105..872843179f44 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -955,6 +955,10 @@ static void mlx4_err_rule(struct mlx4_dev *dev, char *str,
                                         cur->ib.dst_gid_msk);
                         break;
 
+                case MLX4_NET_TRANS_RULE_ID_VXLAN:
+                        len += snprintf(buf + len, BUF_SIZE - len,
+                                        "VNID = %d ", be32_to_cpu(cur->vxlan.vni));
+                        break;
                 case MLX4_NET_TRANS_RULE_ID_IPV6:
                         break;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 5d2498dcf536..cd5cf6d957c7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -1546,7 +1546,7 @@ static int qp_alloc_res(struct mlx4_dev *dev, int slave, int op, int cmd,
 
         switch (op) {
         case RES_OP_RESERVE:
-                count = get_param_l(&in_param);
+                count = get_param_l(&in_param) & 0xffffff;
                 align = get_param_h(&in_param);
                 err = mlx4_grant_resource(dev, slave, RES_QP, count, 0);
                 if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index ed53291468f3..ad2c96a02a53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -374,15 +374,14 @@ int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
         snprintf(eq->name, MLX5_MAX_EQ_NAME, "%s@pci:%s",
                  name, pci_name(dev->pdev));
         eq->eqn = out.eq_number;
+        eq->irqn = vecidx;
+        eq->dev = dev;
+        eq->doorbell = uar->map + MLX5_EQ_DOORBEL_OFFSET;
         err = request_irq(table->msix_arr[vecidx].vector, mlx5_msix_handler, 0,
                           eq->name, eq);
         if (err)
                 goto err_eq;
 
-        eq->irqn = vecidx;
-        eq->dev = dev;
-        eq->doorbell = uar->map + MLX5_EQ_DOORBEL_OFFSET;
-
         err = mlx5_debug_eq_add(dev, eq);
         if (err)
                 goto err_irq;
@@ -420,6 +419,7 @@ int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq)
         if (err)
                 mlx5_core_warn(dev, "failed to destroy a previously created eq: eqn %d\n",
                                eq->eqn);
+        synchronize_irq(table->msix_arr[eq->irqn].vector);
         mlx5_buf_free(dev, &eq->buf);
 
         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 3d8e8e489b2d..71b10b210792 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -864,14 +864,14 @@ static int init_one(struct pci_dev *pdev,
         dev->profile = &profile[prof_sel];
         dev->event = mlx5_core_event;
 
+        INIT_LIST_HEAD(&priv->ctx_list);
+        spin_lock_init(&priv->ctx_lock);
         err = mlx5_dev_init(dev, pdev);
         if (err) {
                 dev_err(&pdev->dev, "mlx5_dev_init failed %d\n", err);
                 goto out;
         }
 
-        INIT_LIST_HEAD(&priv->ctx_list);
-        spin_lock_init(&priv->ctx_lock);
         err = mlx5_register_device(dev);
         if (err) {
                 dev_err(&pdev->dev, "mlx5_register_device failed %d\n", err);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 0b2a1ccd276d..613037584d08 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -2762,7 +2762,8 @@ netxen_fw_poll_work(struct work_struct *work)
         if (test_bit(__NX_RESETTING, &adapter->state))
                 goto reschedule;
 
-        if (test_bit(__NX_DEV_UP, &adapter->state)) {
+        if (test_bit(__NX_DEV_UP, &adapter->state) &&
+            !(adapter->capabilities & NX_FW_CAPABILITY_LINK_NOTIFICATION)) {
                 if (!adapter->has_link_events) {
 
                         netxen_nic_handle_phy_intr(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index f5e29f7bdae3..a913b3ad2f89 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -503,6 +503,11 @@ static void qlcnic_del_vxlan_port(struct net_device *netdev,
 
         adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
 }
+
+static bool qlcnic_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops qlcnic_netdev_ops = {
@@ -526,6 +531,7 @@ static const struct net_device_ops qlcnic_netdev_ops = {
 #ifdef CONFIG_QLCNIC_VXLAN
         .ndo_add_vxlan_port     = qlcnic_add_vxlan_port,
         .ndo_del_vxlan_port     = qlcnic_del_vxlan_port,
+        .ndo_gso_check          = qlcnic_gso_check,
 #endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = qlcnic_poll_controller,
diff --git a/drivers/net/ethernet/qualcomm/Kconfig b/drivers/net/ethernet/qualcomm/Kconfig
index f3a47147937d..9a49f42ac2ba 100644
--- a/drivers/net/ethernet/qualcomm/Kconfig
+++ b/drivers/net/ethernet/qualcomm/Kconfig
@@ -5,7 +5,6 @@
 config NET_VENDOR_QUALCOMM
         bool "Qualcomm devices"
         default y
-        depends on SPI_MASTER && OF_GPIO
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
           and read the Ethernet-HOWTO, available from
@@ -20,7 +19,7 @@ if NET_VENDOR_QUALCOMM
 
 config QCA7000
         tristate "Qualcomm Atheros QCA7000 support"
-        depends on SPI_MASTER && OF_GPIO
+        depends on SPI_MASTER && OF
         ---help---
           This SPI protocol driver supports the Qualcomm Atheros QCA7000.
 
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 60e9c2cd051e..b5db6b3f939f 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -917,21 +917,13 @@ static int sh_eth_reset(struct net_device *ndev)
         return ret;
 }
 
-#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
 static void sh_eth_set_receive_align(struct sk_buff *skb)
 {
-        int reserve;
+        uintptr_t reserve = (uintptr_t)skb->data & (SH_ETH_RX_ALIGN - 1);
 
-        reserve = SH4_SKB_RX_ALIGN - ((u32)skb->data & (SH4_SKB_RX_ALIGN - 1));
         if (reserve)
-                skb_reserve(skb, reserve);
+                skb_reserve(skb, SH_ETH_RX_ALIGN - reserve);
 }
-#else
-static void sh_eth_set_receive_align(struct sk_buff *skb)
-{
-        skb_reserve(skb, SH2_SH3_SKB_RX_ALIGN);
-}
-#endif
 
 
 /* CPU <-> EDMAC endian convert */
@@ -1119,6 +1111,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
         struct sh_eth_txdesc *txdesc = NULL;
         int rx_ringsize = sizeof(*rxdesc) * mdp->num_rx_ring;
         int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
+        int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
 
         mdp->cur_rx = 0;
         mdp->cur_tx = 0;
@@ -1131,21 +1124,21 @@ static void sh_eth_ring_format(struct net_device *ndev)
         for (i = 0; i < mdp->num_rx_ring; i++) {
                 /* skb */
                 mdp->rx_skbuff[i] = NULL;
-                skb = netdev_alloc_skb(ndev, mdp->rx_buf_sz);
+                skb = netdev_alloc_skb(ndev, skbuff_size);
                 mdp->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
-                dma_map_single(&ndev->dev, skb->data, mdp->rx_buf_sz,
-                               DMA_FROM_DEVICE);
                 sh_eth_set_receive_align(skb);
 
                 /* RX descriptor */
                 rxdesc = &mdp->rx_ring[i];
+                /* The size of the buffer is a multiple of 16 bytes. */
+                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
+                dma_map_single(&ndev->dev, skb->data, rxdesc->buffer_length,
+                               DMA_FROM_DEVICE);
                 rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
                 rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
 
-                /* The size of the buffer is 16 byte boundary. */
-                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
                 /* Rx descriptor address set */
                 if (i == 0) {
                         sh_eth_write(ndev, mdp->rx_desc_dma, RDLAR);
@@ -1397,6 +1390,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         struct sk_buff *skb;
         u16 pkt_len = 0;
         u32 desc_status;
+        int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
 
         rxdesc = &mdp->rx_ring[entry];
         while (!(rxdesc->status & cpu_to_edmac(mdp, RD_RACT))) {
@@ -1448,7 +1442,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
                         dma_sync_single_for_cpu(&ndev->dev, rxdesc->addr,
-                                                mdp->rx_buf_sz,
+                                                ALIGN(mdp->rx_buf_sz, 16),
                                                 DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
                         skb->protocol = eth_type_trans(skb, ndev);
@@ -1468,13 +1462,13 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
 
                 if (mdp->rx_skbuff[entry] == NULL) {
-                        skb = netdev_alloc_skb(ndev, mdp->rx_buf_sz);
+                        skb = netdev_alloc_skb(ndev, skbuff_size);
                         mdp->rx_skbuff[entry] = skb;
                         if (skb == NULL)
                                 break;  /* Better luck next round. */
-                        dma_map_single(&ndev->dev, skb->data, mdp->rx_buf_sz,
-                                       DMA_FROM_DEVICE);
                         sh_eth_set_receive_align(skb);
+                        dma_map_single(&ndev->dev, skb->data,
+                                       rxdesc->buffer_length, DMA_FROM_DEVICE);
 
                         skb_checksum_none_assert(skb);
                         rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
@@ -2042,6 +2036,8 @@ static int sh_eth_open(struct net_device *ndev)
         if (ret)
                 goto out_free_irq;
 
+        mdp->is_opened = 1;
+
         return ret;
 
 out_free_irq:
@@ -2131,6 +2127,36 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NETDEV_TX_OK;
 }
 
+static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+
+        if (sh_eth_is_rz_fast_ether(mdp))
+                return &ndev->stats;
+
+        if (!mdp->is_opened)
+                return &ndev->stats;
+
+        ndev->stats.tx_dropped += sh_eth_read(ndev, TROCR);
+        sh_eth_write(ndev, 0, TROCR);   /* (write clear) */
+        ndev->stats.collisions += sh_eth_read(ndev, CDCR);
+        sh_eth_write(ndev, 0, CDCR);    /* (write clear) */
+        ndev->stats.tx_carrier_errors += sh_eth_read(ndev, LCCR);
+        sh_eth_write(ndev, 0, LCCR);    /* (write clear) */
+
+        if (sh_eth_is_gether(mdp)) {
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CERCR);
+                sh_eth_write(ndev, 0, CERCR);   /* (write clear) */
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CEECR);
+                sh_eth_write(ndev, 0, CEECR);   /* (write clear) */
+        } else {
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CNDCR);
+                sh_eth_write(ndev, 0, CNDCR);   /* (write clear) */
+        }
+
+        return &ndev->stats;
+}
+
 /* device close function */
 static int sh_eth_close(struct net_device *ndev)
 {
@@ -2145,6 +2171,7 @@ static int sh_eth_close(struct net_device *ndev)
         sh_eth_write(ndev, 0, EDTRR);
         sh_eth_write(ndev, 0, EDRRR);
 
+        sh_eth_get_stats(ndev);
         /* PHY Disconnect */
         if (mdp->phydev) {
                 phy_stop(mdp->phydev);
@@ -2163,36 +2190,9 @@ static int sh_eth_close(struct net_device *ndev)
 
         pm_runtime_put_sync(&mdp->pdev->dev);
 
-        return 0;
-}
-
-static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-
-        if (sh_eth_is_rz_fast_ether(mdp))
-                return &ndev->stats;
+        mdp->is_opened = 0;
 
-        pm_runtime_get_sync(&mdp->pdev->dev);
-
-        ndev->stats.tx_dropped += sh_eth_read(ndev, TROCR);
-        sh_eth_write(ndev, 0, TROCR);   /* (write clear) */
-        ndev->stats.collisions += sh_eth_read(ndev, CDCR);
-        sh_eth_write(ndev, 0, CDCR);    /* (write clear) */
-        ndev->stats.tx_carrier_errors += sh_eth_read(ndev, LCCR);
-        sh_eth_write(ndev, 0, LCCR);    /* (write clear) */
-        if (sh_eth_is_gether(mdp)) {
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CERCR);
-                sh_eth_write(ndev, 0, CERCR);   /* (write clear) */
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CEECR);
-                sh_eth_write(ndev, 0, CEECR);   /* (write clear) */
-        } else {
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CNDCR);
-                sh_eth_write(ndev, 0, CNDCR);   /* (write clear) */
-        }
-        pm_runtime_put_sync(&mdp->pdev->dev);
-
-        return &ndev->stats;
+        return 0;
 }
 
 /* ioctl to device function */
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index b37c427144ee..22301bf9c21d 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -162,9 +162,9 @@ enum {
 
 /* Driver's parameters */
 #if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
-#define SH4_SKB_RX_ALIGN        32
+#define SH_ETH_RX_ALIGN         32
 #else
-#define SH2_SH3_SKB_RX_ALIGN    2
+#define SH_ETH_RX_ALIGN         2
 #endif
 
 /* Register's bits
@@ -522,6 +522,7 @@ struct sh_eth_private {
 
         unsigned no_ether_link:1;
         unsigned ether_link_active_low:1;
+        unsigned is_opened:1;
 };
 
 static inline void sh_eth_soft_swap(char *src, int len)
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 002d4cdc319f..a77f05ce8325 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -180,7 +180,8 @@ static int efx_ef10_probe(struct efx_nic *efx)
                       EFX_MAX_CHANNELS,
                       resource_size(&efx->pci_dev->resource[EFX_MEM_BAR]) /
                       (EFX_VI_PAGE_SIZE * EFX_TXQ_TYPES));
-        BUG_ON(efx->max_channels == 0);
+        if (WARN_ON(efx->max_channels == 0))
+                return -EIO;
 
         nic_data = kzalloc(sizeof(*nic_data), GFP_KERNEL);
         if (!nic_data)
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index ee84a90e371c..aaf2987512b5 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -343,8 +343,6 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         unsigned short dma_flags;
         int i = 0;
 
-        EFX_BUG_ON_PARANOID(tx_queue->write_count > tx_queue->insert_count);
-
         if (skb_shinfo(skb)->gso_size)
                 return efx_enqueue_skb_tso(tx_queue, skb);
 
@@ -1258,8 +1256,6 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
         /* Find the packet protocol and sanity-check it */
         state.protocol = efx_tso_check_protocol(skb);
 
-        EFX_BUG_ON_PARANOID(tx_queue->write_count > tx_queue->insert_count);
-
         rc = tso_start(&state, efx, skb);
         if (rc)
                 goto mem_err;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 5e94d00b96b3..6cc3cf6f17c8 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -81,6 +81,7 @@ static const char version[] =
 #include <linux/workqueue.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/of_gpio.h>
 
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -2188,6 +2189,41 @@ static const struct of_device_id smc91x_match[] = {
         {},
 };
 MODULE_DEVICE_TABLE(of, smc91x_match);
+
+/**
+ * of_try_set_control_gpio - configure a gpio if it exists
+ */
+static int try_toggle_control_gpio(struct device *dev,
+                                   struct gpio_desc **desc,
+                                   const char *name, int index,
+                                   int value, unsigned int nsdelay)
+{
+        struct gpio_desc *gpio = *desc;
+        int res;
+
+        gpio = devm_gpiod_get_index(dev, name, index);
+        if (IS_ERR(gpio)) {
+                if (PTR_ERR(gpio) == -ENOENT) {
+                        *desc = NULL;
+                        return 0;
+                }
+
+                return PTR_ERR(gpio);
+        }
+        res = gpiod_direction_output(gpio, !value);
+        if (res) {
+                dev_err(dev, "unable to toggle gpio %s: %i\n", name, res);
+                devm_gpiod_put(dev, gpio);
+                gpio = NULL;
+                return res;
+        }
+        if (nsdelay)
+                usleep_range(nsdelay, 2 * nsdelay);
+        gpiod_set_value_cansleep(gpio, value);
+        *desc = gpio;
+
+        return 0;
+}
 #endif
 
 /*
@@ -2207,9 +2243,10 @@ static int smc_drv_probe(struct platform_device *pdev)
         const struct of_device_id *match = NULL;
         struct smc_local *lp;
         struct net_device *ndev;
-        struct resource *res, *ires;
+        struct resource *res;
         unsigned int __iomem *addr;
         unsigned long irq_flags = SMC_IRQ_FLAGS;
+        unsigned long irq_resflags;
         int ret;
 
         ndev = alloc_etherdev(sizeof(struct smc_local));
@@ -2237,6 +2274,28 @@ static int smc_drv_probe(struct platform_device *pdev)
                 struct device_node *np = pdev->dev.of_node;
                 u32 val;
 
+                /* Optional pwrdwn GPIO configured? */
+                ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
+                                              "power", 0, 0, 100);
+                if (ret)
+                        return ret;
+
+                /*
+                 * Optional reset GPIO configured? Minimum 100 ns reset needed
+                 * according to LAN91C96 datasheet page 14.
+                 */
+                ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
+                                              "reset", 0, 0, 100);
+                if (ret)
+                        return ret;
+
+                /*
+                 * Need to wait for optional EEPROM to load, max 750 us according
+                 * to LAN91C96 datasheet page 55.
+                 */
+                if (lp->reset_gpio)
+                        usleep_range(750, 1000);
+
                 /* Combination of IO widths supported, default to 16-bit */
                 if (!of_property_read_u32(np, "reg-io-width", &val)) {
                         if (val & 1)
@@ -2279,16 +2338,19 @@ static int smc_drv_probe(struct platform_device *pdev)
                 goto out_free_netdev;
         }
 
-        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (!ires) {
+        ndev->irq = platform_get_irq(pdev, 0);
+        if (ndev->irq <= 0) {
                 ret = -ENODEV;
                 goto out_release_io;
         }
-
-        ndev->irq = ires->start;
-
-        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
-                irq_flags = ires->flags & IRQF_TRIGGER_MASK;
+        /*
+         * If this platform does not specify any special irqflags, or if
+         * the resource supplies a trigger, override the irqflags with
+         * the trigger flags from the resource.
+         */
+        irq_resflags = irqd_get_trigger_type(irq_get_irq_data(ndev->irq));
+        if (irq_flags == -1 || irq_resflags & IRQF_TRIGGER_MASK)
+                irq_flags = irq_resflags & IRQF_TRIGGER_MASK;
 
         ret = smc_request_attrib(pdev, ndev);
         if (ret)
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 47dce918eb0f..2a38dacbbd27 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -298,6 +298,9 @@ struct smc_local {
         struct sk_buff *pending_tx_skb;
         struct tasklet_struct tx_task;
 
+        struct gpio_desc *power_gpio;
+        struct gpio_desc *reset_gpio;
+
         /* version/revision of the SMC91x chip */
         int     version;
 
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index affb29da353e..77ed74561e5f 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -1342,6 +1342,42 @@ static void smsc911x_rx_multicast_update_workaround(struct smsc911x_data *pdata)
         spin_unlock(&pdata->mac_lock);
 }
 
+static int smsc911x_phy_general_power_up(struct smsc911x_data *pdata)
+{
+        int rc = 0;
+
+        if (!pdata->phy_dev)
+                return rc;
+
+        /* If the internal PHY is in General Power-Down mode, all, except the
+         * management interface, is powered-down and stays in that condition as
+         * long as Phy register bit 0.11 is HIGH.
+         *
+         * In that case, clear the bit 0.11, so the PHY powers up and we can
+         * access to the phy registers.
+         */
+        rc = phy_read(pdata->phy_dev, MII_BMCR);
+        if (rc < 0) {
+                SMSC_WARN(pdata, drv, "Failed reading PHY control reg");
+                return rc;
+        }
+
+        /* If the PHY general power-down bit is not set is not necessary to
+         * disable the general power down-mode.
+         */
+        if (rc & BMCR_PDOWN) {
+                rc = phy_write(pdata->phy_dev, MII_BMCR, rc & ~BMCR_PDOWN);
+                if (rc < 0) {
+                        SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
+                        return rc;
+                }
+
+                usleep_range(1000, 1500);
+        }
+
+        return 0;
+}
+
 static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
 {
         int rc = 0;
@@ -1356,12 +1392,8 @@ static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
                 return rc;
         }
 
-        /*
-         * If energy is detected the PHY is already awake so is not necessary
-         * to disable the energy detect power-down mode.
-         */
-        if ((rc & MII_LAN83C185_EDPWRDOWN) &&
-            !(rc & MII_LAN83C185_ENERGYON)) {
+        /* Only disable if energy detect mode is already enabled */
+        if (rc & MII_LAN83C185_EDPWRDOWN) {
                 /* Disable energy detect mode for this SMSC Transceivers */
                 rc = phy_write(pdata->phy_dev, MII_LAN83C185_CTRL_STATUS,
                                rc & (~MII_LAN83C185_EDPWRDOWN));
@@ -1370,8 +1402,8 @@ static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
                         SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
                         return rc;
                 }
-
-                mdelay(1);
+                /* Allow PHY to wakeup */
+                mdelay(2);
         }
 
         return 0;
@@ -1393,7 +1425,6 @@ static int smsc911x_phy_enable_energy_detect(struct smsc911x_data *pdata)
 
         /* Only enable if energy detect mode is already disabled */
         if (!(rc & MII_LAN83C185_EDPWRDOWN)) {
-                mdelay(100);
                 /* Enable energy detect mode for this SMSC Transceivers */
                 rc = phy_write(pdata->phy_dev, MII_LAN83C185_CTRL_STATUS,
                                rc | MII_LAN83C185_EDPWRDOWN);
@@ -1402,8 +1433,6 @@ static int smsc911x_phy_enable_energy_detect(struct smsc911x_data *pdata)
                         SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
                         return rc;
                 }
-
-                mdelay(1);
         }
         return 0;
 }
@@ -1415,6 +1444,16 @@ static int smsc911x_soft_reset(struct smsc911x_data *pdata)
         int ret;
 
         /*
+         * Make sure to power-up the PHY chip before doing a reset, otherwise
+         * the reset fails.
+         */
+        ret = smsc911x_phy_general_power_up(pdata);
+        if (ret) {
+                SMSC_WARN(pdata, drv, "Failed to power-up the PHY chip");
+                return ret;
+        }
+
+        /*
          * LAN9210/LAN9211/LAN9220/LAN9221 chips have an internal PHY that
          * are initialized in a Energy Detect Power-Down mode that prevents
          * the MAC chip to be software reseted. So we have to wakeup the PHY
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6f77a46c7e2c..18c46bb0f3bf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -276,6 +276,7 @@ static void stmmac_eee_ctrl_timer(unsigned long arg)
 bool stmmac_eee_init(struct stmmac_priv *priv)
 {
         char *phy_bus_name = priv->plat->phy_bus_name;
+        unsigned long flags;
         bool ret = false;
 
         /* Using PCS we cannot dial with the phy registers at this stage
@@ -300,6 +301,7 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                          * changed).
                          * In that case the driver disable own timers.
                          */
+                        spin_lock_irqsave(&priv->lock, flags);
                         if (priv->eee_active) {
                                 pr_debug("stmmac: disable EEE\n");
                                 del_timer_sync(&priv->eee_ctrl_timer);
@@ -307,9 +309,11 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                                                              tx_lpi_timer);
                         }
                         priv->eee_active = 0;
+                        spin_unlock_irqrestore(&priv->lock, flags);
                         goto out;
                 }
                 /* Activate the EEE and start timers */
+                spin_lock_irqsave(&priv->lock, flags);
                 if (!priv->eee_active) {
                         priv->eee_active = 1;
                         init_timer(&priv->eee_ctrl_timer);
@@ -325,9 +329,10 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                 /* Set HW EEE according to the speed */
                 priv->hw->mac->set_eee_pls(priv->hw, priv->phydev->link);
 
-                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
-
                 ret = true;
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
         }
 out:
         return ret;
@@ -760,12 +765,12 @@ static void stmmac_adjust_link(struct net_device *dev)
         if (new_state && netif_msg_link(priv))
                 phy_print_status(phydev);
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* At this stage, it could be needed to setup the EEE or adjust some
          * MAC related HW registers.
          */
         priv->eee_enabled = stmmac_eee_init(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 /**
@@ -959,12 +964,12 @@ static void stmmac_clear_descriptors(struct stmmac_priv *priv)
 }
 
 static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
-                                  int i)
+                                  int i, gfp_t flags)
 {
         struct sk_buff *skb;
 
         skb = __netdev_alloc_skb(priv->dev, priv->dma_buf_sz + NET_IP_ALIGN,
-                                 GFP_KERNEL);
+                                 flags);
         if (!skb) {
                 pr_err("%s: Rx init fails; skb is NULL\n", __func__);
                 return -ENOMEM;
@@ -1006,7 +1011,7 @@ static void stmmac_free_rx_buffers(struct stmmac_priv *priv, int i)
  * and allocates the socket buffers. It suppors the chained and ring
  * modes.
  */
-static int init_dma_desc_rings(struct net_device *dev)
+static int init_dma_desc_rings(struct net_device *dev, gfp_t flags)
 {
         int i;
         struct stmmac_priv *priv = netdev_priv(dev);
@@ -1041,7 +1046,7 @@ static int init_dma_desc_rings(struct net_device *dev)
                 else
                         p = priv->dma_rx + i;
 
-                ret = stmmac_init_rx_buffers(priv, p, i);
+                ret = stmmac_init_rx_buffers(priv, p, i, flags);
                 if (ret)
                         goto err_init_rx_buffers;
 
@@ -1647,11 +1652,6 @@ static int stmmac_hw_setup(struct net_device *dev)
         struct stmmac_priv *priv = netdev_priv(dev);
         int ret;
 
-        ret = init_dma_desc_rings(dev);
-        if (ret < 0) {
-                pr_err("%s: DMA descriptors initialization failed\n", __func__);
-                return ret;
-        }
         /* DMA initialization and SW reset */
         ret = stmmac_init_dma_engine(priv);
         if (ret < 0) {
@@ -1705,10 +1705,6 @@ static int stmmac_hw_setup(struct net_device *dev)
         }
         priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS;
 
-        priv->eee_enabled = stmmac_eee_init(priv);
-
-        stmmac_init_tx_coalesce(priv);
-
         if ((priv->use_riwt) && (priv->hw->dma->rx_watchdog)) {
                 priv->rx_riwt = MAX_DMA_RIWT;
                 priv->hw->dma->rx_watchdog(priv->ioaddr, MAX_DMA_RIWT);
@@ -1761,12 +1757,20 @@ static int stmmac_open(struct net_device *dev)
                 goto dma_desc_error;
         }
 
+        ret = init_dma_desc_rings(dev, GFP_KERNEL);
+        if (ret < 0) {
+                pr_err("%s: DMA descriptors initialization failed\n", __func__);
+                goto init_error;
+        }
+
         ret = stmmac_hw_setup(dev);
         if (ret < 0) {
                 pr_err("%s: Hw setup failed\n", __func__);
                 goto init_error;
         }
 
+        stmmac_init_tx_coalesce(priv);
+
         if (priv->phydev)
                 phy_start(priv->phydev);
 
@@ -1894,7 +1898,10 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         unsigned int nopaged_len = skb_headlen(skb);
         unsigned int enh_desc = priv->plat->enh_desc;
 
+        spin_lock(&priv->tx_lock);
+
         if (unlikely(stmmac_tx_avail(priv) < nfrags + 1)) {
+                spin_unlock(&priv->tx_lock);
                 if (!netif_queue_stopped(dev)) {
                         netif_stop_queue(dev);
                         /* This is a hard error, log it. */
@@ -1903,8 +1910,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        spin_lock(&priv->tx_lock);
-
         if (priv->tx_path_in_lpi_mode)
                 stmmac_disable_eee_mode(priv);
 
@@ -2025,6 +2030,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         return NETDEV_TX_OK;
 
 dma_map_err:
+        spin_unlock(&priv->tx_lock);
         dev_err(priv->device, "Tx dma map failed\n");
         dev_kfree_skb(skb);
         priv->dev->stats.tx_dropped++;
@@ -2281,9 +2287,7 @@ static void stmmac_set_rx_mode(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
 
-        spin_lock(&priv->lock);
         priv->hw->mac->set_filter(priv->hw, dev);
-        spin_unlock(&priv->lock);
 }
 
 /**
@@ -2950,7 +2954,7 @@ int stmmac_suspend(struct net_device *ndev)
                 stmmac_set_mac(priv->ioaddr, false);
                 pinctrl_pm_select_sleep_state(priv->device);
                 /* Disable clock in case of PWM is off */
-                clk_disable_unprepare(priv->stmmac_clk);
+                clk_disable(priv->stmmac_clk);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -2982,7 +2986,7 @@ int stmmac_resume(struct net_device *ndev)
         } else {
                 pinctrl_pm_select_default_state(priv->device);
                 /* enable the clk prevously disabled */
-                clk_prepare_enable(priv->stmmac_clk);
+                clk_enable(priv->stmmac_clk);
                 /* reset the phy so that it's ready */
                 if (priv->mii)
                         stmmac_mdio_reset(priv->mii);
@@ -2990,7 +2994,9 @@ int stmmac_resume(struct net_device *ndev)
 
         netif_device_attach(ndev);
 
+        init_dma_desc_rings(ndev, GFP_ATOMIC);
         stmmac_hw_setup(ndev);
+        stmmac_init_tx_coalesce(priv);
 
         napi_enable(&priv->napi);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 655a23bbc451..e17a970eaf2b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -33,6 +33,7 @@ static struct stmmac_dma_cfg dma_cfg;
 static void stmmac_default_data(void)
 {
         memset(&plat_dat, 0, sizeof(struct plat_stmmacenet_data));
+
         plat_dat.bus_id = 1;
         plat_dat.phy_addr = 0;
         plat_dat.interface = PHY_INTERFACE_MODE_GMII;
@@ -47,6 +48,12 @@ static void stmmac_default_data(void)
         dma_cfg.pbl = 32;
         dma_cfg.burst_len = DMA_AXI_BLEN_256;
         plat_dat.dma_cfg = &dma_cfg;
+
+        /* Set default value for multicast hash bins */
+        plat_dat.multicast_filter_bins = HASH_TABLE_SIZE;
+
+        /* Set default value for unicast filter entries */
+        plat_dat.unicast_filter_entries = 1;
 }
 
 /**
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index db56fa7ce8f9..58a1a0a423d4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -177,12 +177,6 @@ static int stmmac_probe_config_dt(struct platform_device *pdev,
          */
         plat->maxmtu = JUMBO_LEN;
 
-        /* Set default value for multicast hash bins */
-        plat->multicast_filter_bins = HASH_TABLE_SIZE;
-
-        /* Set default value for unicast filter entries */
-        plat->unicast_filter_entries = 1;
-
         /*
          * Currently only the properties needed on SPEAr600
          * are provided. All other properties should be added
@@ -270,16 +264,23 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
                 return PTR_ERR(addr);
 
         plat_dat = dev_get_platdata(&pdev->dev);
-        if (pdev->dev.of_node) {
-                if (!plat_dat)
-                        plat_dat = devm_kzalloc(&pdev->dev,
+
+        if (!plat_dat)
+                plat_dat = devm_kzalloc(&pdev->dev,
                                         sizeof(struct plat_stmmacenet_data),
                                         GFP_KERNEL);
-                if (!plat_dat) {
-                        pr_err("%s: ERROR: no memory", __func__);
-                        return  -ENOMEM;
-                }
+        if (!plat_dat) {
+                pr_err("%s: ERROR: no memory", __func__);
+                return  -ENOMEM;
+        }
+
+        /* Set default value for multicast hash bins */
+        plat_dat->multicast_filter_bins = HASH_TABLE_SIZE;
 
+        /* Set default value for unicast filter entries */
+        plat_dat->unicast_filter_entries = 1;
+
+        if (pdev->dev.of_node) {
                 ret = stmmac_probe_config_dt(pdev, plat_dat, &mac);
                 if (ret) {
                         pr_err("%s: main dt probe failed", __func__);
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index 72c8525d5457..9c014803b03b 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1262,6 +1262,7 @@ static void happy_meal_init_rings(struct happy_meal *hp)
         HMD(("init rxring, "));
         for (i = 0; i < RX_RING_SIZE; i++) {
                 struct sk_buff *skb;
+                u32 mapping;
 
                 skb = happy_meal_alloc_skb(RX_BUF_ALLOC_SIZE, GFP_ATOMIC);
                 if (!skb) {
@@ -1272,10 +1273,16 @@ static void happy_meal_init_rings(struct happy_meal *hp)
 
                 /* Because we reserve afterwards. */
                 skb_put(skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
+                mapping = dma_map_single(hp->dma_dev, skb->data, RX_BUF_ALLOC_SIZE,
+                                         DMA_FROM_DEVICE);
+                if (dma_mapping_error(hp->dma_dev, mapping)) {
+                        dev_kfree_skb_any(skb);
+                        hme_write_rxd(hp, &hb->happy_meal_rxd[i], 0, 0);
+                        continue;
+                }
                 hme_write_rxd(hp, &hb->happy_meal_rxd[i],
                               (RXFLAG_OWN | ((RX_BUF_ALLOC_SIZE - RX_OFFSET) << 16)),
-                              dma_map_single(hp->dma_dev, skb->data, RX_BUF_ALLOC_SIZE,
-                                             DMA_FROM_DEVICE));
+                              mapping);
                 skb_reserve(skb, RX_OFFSET);
         }
 
@@ -2020,6 +2027,7 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
                 skb = hp->rx_skbs[elem];
                 if (len > RX_COPY_THRESHOLD) {
                         struct sk_buff *new_skb;
+                        u32 mapping;
 
                         /* Now refill the entry, if we can. */
                         new_skb = happy_meal_alloc_skb(RX_BUF_ALLOC_SIZE, GFP_ATOMIC);
@@ -2027,13 +2035,21 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
                                 drops++;
                                 goto drop_it;
                         }
+                        skb_put(new_skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
+                        mapping = dma_map_single(hp->dma_dev, new_skb->data,
+                                                 RX_BUF_ALLOC_SIZE,
+                                                 DMA_FROM_DEVICE);
+                        if (unlikely(dma_mapping_error(hp->dma_dev, mapping))) {
+                                dev_kfree_skb_any(new_skb);
+                                drops++;
+                                goto drop_it;
+                        }
+
                         dma_unmap_single(hp->dma_dev, dma_addr, RX_BUF_ALLOC_SIZE, DMA_FROM_DEVICE);
                         hp->rx_skbs[elem] = new_skb;
-                        skb_put(new_skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
                         hme_write_rxd(hp, this,
                                       (RXFLAG_OWN|((RX_BUF_ALLOC_SIZE-RX_OFFSET)<<16)),
-                                      dma_map_single(hp->dma_dev, new_skb->data, RX_BUF_ALLOC_SIZE,
-                                                     DMA_FROM_DEVICE));
+                                      mapping);
                         skb_reserve(new_skb, RX_OFFSET);
 
                         /* Trim the original skb for the netif. */
@@ -2248,6 +2264,25 @@ static void happy_meal_tx_timeout(struct net_device *dev)
         netif_wake_queue(dev);
 }
 
+static void unmap_partial_tx_skb(struct happy_meal *hp, u32 first_mapping,
+                                 u32 first_len, u32 first_entry, u32 entry)
+{
+        struct happy_meal_txd *txbase = &hp->happy_block->happy_meal_txd[0];
+
+        dma_unmap_single(hp->dma_dev, first_mapping, first_len, DMA_TO_DEVICE);
+
+        first_entry = NEXT_TX(first_entry);
+        while (first_entry != entry) {
+                struct happy_meal_txd *this = &txbase[first_entry];
+                u32 addr, len;
+
+                addr = hme_read_desc32(hp, &this->tx_addr);
+                len = hme_read_desc32(hp, &this->tx_flags);
+                len &= TXFLAG_SIZE;
+                dma_unmap_page(hp->dma_dev, addr, len, DMA_TO_DEVICE);
+        }
+}
+
 static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                                          struct net_device *dev)
 {
@@ -2284,6 +2319,8 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
 
                 len = skb->len;
                 mapping = dma_map_single(hp->dma_dev, skb->data, len, DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(hp->dma_dev, mapping)))
+                        goto out_dma_error;
                 tx_flags |= (TXFLAG_SOP | TXFLAG_EOP);
                 hme_write_txd(hp, &hp->happy_block->happy_meal_txd[entry],
                               (tx_flags | (len & TXFLAG_SIZE)),
@@ -2299,6 +2336,8 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                 first_len = skb_headlen(skb);
                 first_mapping = dma_map_single(hp->dma_dev, skb->data, first_len,
                                                DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(hp->dma_dev, first_mapping)))
+                        goto out_dma_error;
                 entry = NEXT_TX(entry);
 
                 for (frag = 0; frag < skb_shinfo(skb)->nr_frags; frag++) {
@@ -2308,6 +2347,11 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                         len = skb_frag_size(this_frag);
                         mapping = skb_frag_dma_map(hp->dma_dev, this_frag,
                                                    0, len, DMA_TO_DEVICE);
+                        if (unlikely(dma_mapping_error(hp->dma_dev, mapping))) {
+                                unmap_partial_tx_skb(hp, first_mapping, first_len,
+                                                     first_entry, entry);
+                                goto out_dma_error;
+                        }
                         this_txflags = tx_flags;
                         if (frag == skb_shinfo(skb)->nr_frags - 1)
                                 this_txflags |= TXFLAG_EOP;
@@ -2333,6 +2377,14 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
 
         tx_add_log(hp, TXLOG_ACTION_TXMIT, 0);
         return NETDEV_TX_OK;
+
+out_dma_error:
+        hp->tx_skbs[hp->tx_new] = NULL;
+        spin_unlock_irq(&hp->happy_lock);
+
+        dev_kfree_skb_any(skb);
+        dev->stats.tx_dropped++;
+        return NETDEV_TX_OK;
 }
 
 static struct net_device_stats *happy_meal_get_stats(struct net_device *dev)
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 952e1e4764b7..c560f9aeb55d 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -129,9 +129,9 @@ do {								\
 #define CPSW_VLAN_AWARE         BIT(1)
 #define CPSW_ALE_VLAN_AWARE     1
 
-#define CPSW_FIFO_NORMAL_MODE           (0 << 15)
-#define CPSW_FIFO_DUAL_MAC_MODE         (1 << 15)
-#define CPSW_FIFO_RATE_LIMIT_MODE       (2 << 15)
+#define CPSW_FIFO_NORMAL_MODE           (0 << 16)
+#define CPSW_FIFO_DUAL_MAC_MODE         (1 << 16)
+#define CPSW_FIFO_RATE_LIMIT_MODE       (2 << 16)
 
 #define CPSW_INTPACEEN          (0x3f << 16)
 #define CPSW_INTPRESCALE_MASK   (0x7FF << 0)
@@ -591,8 +591,8 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                 if (enable) {
                         unsigned long timeout = jiffies + HZ;
 
-                        /* Disable Learn for all ports */
-                        for (i = 0; i < priv->data.slaves; i++) {
+                        /* Disable Learn for all ports (host is port 0 and slaves are port 1 and up */
+                        for (i = 0; i <= priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 1);
                                 cpsw_ale_control_set(ale, i,
@@ -616,11 +616,11 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                         cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
                         dev_dbg(&ndev->dev, "promiscuity enabled\n");
                 } else {
-                        /* Flood All Unicast Packets to Host port */
+                        /* Don't Flood All Unicast Packets to Host port */
                         cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 0);
 
-                        /* Enable Learn for all ports */
-                        for (i = 0; i < priv->data.slaves; i++) {
+                        /* Enable Learn for all ports (host is port 0 and slaves are port 1 and up */
+                        for (i = 0; i <= priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 0);
                                 cpsw_ale_control_set(ale, i,
@@ -638,12 +638,16 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
         if (ndev->flags & IFF_PROMISC) {
                 /* Enable promiscuous mode */
                 cpsw_set_promiscious(ndev, true);
+                cpsw_ale_set_allmulti(priv->ale, IFF_ALLMULTI);
                 return;
         } else {
                 /* Disable promiscuous mode */
                 cpsw_set_promiscious(ndev, false);
         }
 
+        /* Restore allmulti on vlans if necessary */
+        cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI);
+
         /* Clear all mcast from ALE */
         cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port);
 
@@ -1149,6 +1153,7 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
         const int port = priv->host_port;
         u32 reg;
         int i;
+        int unreg_mcast_mask;
 
         reg = (priv->version == CPSW_VERSION_1) ? CPSW1_PORT_VLAN :
                CPSW2_PORT_VLAN;
@@ -1158,9 +1163,14 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
         for (i = 0; i < priv->data.slaves; i++)
                 slave_write(priv->slaves + i, vlan, reg);
 
+        if (priv->ndev->flags & IFF_ALLMULTI)
+                unreg_mcast_mask = ALE_ALL_PORTS;
+        else
+                unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2;
+
         cpsw_ale_add_vlan(priv->ale, vlan, ALE_ALL_PORTS << port,
                           ALE_ALL_PORTS << port, ALE_ALL_PORTS << port,
-                          (ALE_PORT_1 | ALE_PORT_2) << port);
+                          unreg_mcast_mask << port);
 }
 
 static void cpsw_init_host_port(struct cpsw_priv *priv)
@@ -1620,11 +1630,17 @@ static inline int cpsw_add_vlan_ale_entry(struct cpsw_priv *priv,
                                 unsigned short vid)
 {
         int ret;
+        int unreg_mcast_mask;
+
+        if (priv->ndev->flags & IFF_ALLMULTI)
+                unreg_mcast_mask = ALE_ALL_PORTS;
+        else
+                unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2;
 
         ret = cpsw_ale_add_vlan(priv->ale, vid,
                                 ALE_ALL_PORTS << priv->host_port,
                                 0, ALE_ALL_PORTS << priv->host_port,
-                                (ALE_PORT_1 | ALE_PORT_2) << priv->host_port);
+                                unreg_mcast_mask << priv->host_port);
         if (ret != 0)
                 return ret;
 
@@ -2006,7 +2022,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 parp = of_get_property(slave_node, "phy_id", &lenp);
                 if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                         dev_err(&pdev->dev, "Missing slave[%d] phy_id property\n", i);
-                        return -EINVAL;
+                        goto no_phy_slave;
                 }
                 mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
                 phyid = be32_to_cpup(parp+1);
@@ -2019,6 +2035,14 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
                          PHY_ID_FMT, mdio->name, phyid);
 
+                slave_data->phy_if = of_get_phy_mode(slave_node);
+                if (slave_data->phy_if < 0) {
+                        dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n",
+                                i);
+                        return slave_data->phy_if;
+                }
+
+no_phy_slave:
                 mac_addr = of_get_mac_address(slave_node);
                 if (mac_addr) {
                         memcpy(slave_data->mac_addr, mac_addr, ETH_ALEN);
@@ -2030,14 +2054,6 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                                         return ret;
                         }
                 }
-
-                slave_data->phy_if = of_get_phy_mode(slave_node);
-                if (slave_data->phy_if < 0) {
-                        dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n",
-                                i);
-                        return slave_data->phy_if;
-                }
-
                 if (data->dual_emac) {
                         if (of_property_read_u32(slave_node, "dual_emac_res_vlan",
                                                  &prop)) {
diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
index 0579b2243bb6..097ebe7077ac 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.c
+++ b/drivers/net/ethernet/ti/cpsw_ale.c
@@ -443,6 +443,35 @@ int cpsw_ale_del_vlan(struct cpsw_ale *ale, u16 vid, int port_mask)
         return 0;
 }
 
+void cpsw_ale_set_allmulti(struct cpsw_ale *ale, int allmulti)
+{
+        u32 ale_entry[ALE_ENTRY_WORDS];
+        int type, idx;
+        int unreg_mcast = 0;
+
+        /* Only bother doing the work if the setting is actually changing */
+        if (ale->allmulti == allmulti)
+                return;
+
+        /* Remember the new setting to check against next time */
+        ale->allmulti = allmulti;
+
+        for (idx = 0; idx < ale->params.ale_entries; idx++) {
+                cpsw_ale_read(ale, idx, ale_entry);
+                type = cpsw_ale_get_entry_type(ale_entry);
+                if (type != ALE_TYPE_VLAN)
+                        continue;
+
+                unreg_mcast = cpsw_ale_get_vlan_unreg_mcast(ale_entry);
+                if (allmulti)
+                        unreg_mcast |= 1;
+                else
+                        unreg_mcast &= ~1;
+                cpsw_ale_set_vlan_unreg_mcast(ale_entry, unreg_mcast);
+                cpsw_ale_write(ale, idx, ale_entry);
+        }
+}
+
 struct ale_control_info {
         const char      *name;
         int             offset, port_offset;
@@ -756,7 +785,6 @@ int cpsw_ale_destroy(struct cpsw_ale *ale)
 {
         if (!ale)
                 return -EINVAL;
-        cpsw_ale_stop(ale);
         cpsw_ale_control_set(ale, 0, ALE_ENABLE, 0);
         kfree(ale);
         return 0;
diff --git a/drivers/net/ethernet/ti/cpsw_ale.h b/drivers/net/ethernet/ti/cpsw_ale.h
index 31cf43cab42e..c0d4127aa549 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.h
+++ b/drivers/net/ethernet/ti/cpsw_ale.h
@@ -27,6 +27,7 @@ struct cpsw_ale {
         struct cpsw_ale_params  params;
         struct timer_list       timer;
         unsigned long           ageout;
+        int                     allmulti;
 };
 
 enum cpsw_ale_control {
@@ -103,6 +104,7 @@ int cpsw_ale_del_mcast(struct cpsw_ale *ale, u8 *addr, int port_mask,
 int cpsw_ale_add_vlan(struct cpsw_ale *ale, u16 vid, int port, int untag,
                         int reg_mcast, int unreg_mcast);
 int cpsw_ale_del_vlan(struct cpsw_ale *ale, u16 vid, int port);
+void cpsw_ale_set_allmulti(struct cpsw_ale *ale, int allmulti);
 
 int cpsw_ale_control_get(struct cpsw_ale *ale, int port, int control);
 int cpsw_ale_control_set(struct cpsw_ale *ale, int port,
diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index ab92f67da035..4a4388b813ac 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -264,7 +264,7 @@ static int cpts_match(struct sk_buff *skb, unsigned int ptp_class,
 
         switch (ptp_class & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 9e17d1a91e71..78ec33f5100b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -550,6 +550,7 @@ do_lso:
 do_send:
         /* Start filling in the page buffers with the rndis hdr */
         rndis_msg->msg_len += rndis_msg_size;
+        packet->total_data_buflen = rndis_msg->msg_len;
         packet->page_buf_cnt = init_page_array(rndis_msg, rndis_msg_size,
                                         skb, &packet->page_buf[0]);
 
diff --git a/drivers/net/ieee802154/fakehard.c b/drivers/net/ieee802154/fakehard.c
index 9ce854f43917..6cbc56ad9ff4 100644
--- a/drivers/net/ieee802154/fakehard.c
+++ b/drivers/net/ieee802154/fakehard.c
@@ -377,17 +377,20 @@ static int ieee802154fake_probe(struct platform_device *pdev)
 
         err = wpan_phy_register(phy);
         if (err)
-                goto out;
+                goto err_phy_reg;
 
         err = register_netdev(dev);
-        if (err < 0)
-                goto out;
+        if (err)
+                goto err_netdev_reg;
 
         dev_info(&pdev->dev, "Added ieee802154 HardMAC hardware\n");
         return 0;
 
-out:
-        unregister_netdev(dev);
+err_netdev_reg:
+        wpan_phy_unregister(phy);
+err_phy_reg:
+        free_netdev(dev);
+        wpan_phy_free(phy);
         return err;
 }
 
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 29b3bb410781..bfb0b6ec8c56 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -272,7 +272,7 @@ static void macvlan_process_broadcast(struct work_struct *w)
         struct sk_buff *skb;
         struct sk_buff_head list;
 
-        skb_queue_head_init(&list);
+        __skb_queue_head_init(&list);
 
         spin_lock_bh(&port->bc_queue.lock);
         skb_queue_splice_tail_init(&port->bc_queue, &list);
@@ -1082,9 +1082,15 @@ static void macvlan_port_destroy(struct net_device *dev)
 {
         struct macvlan_port *port = macvlan_port_get_rtnl(dev);
 
-        cancel_work_sync(&port->bc_work);
         dev->priv_flags &= ~IFF_MACVLAN_PORT;
         netdev_rx_handler_unregister(dev);
+
+        /* After this point, no packet can schedule bc_work anymore,
+         * but we need to cancel it and purge left skbs if any.
+         */
+        cancel_work_sync(&port->bc_work);
+        __skb_queue_purge(&port->bc_queue);
+
         kfree_rcu(port, rcu);
 }
 
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 65e2892342bd..880cc090dc44 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -16,6 +16,7 @@
 #include <linux/idr.h>
 #include <linux/fs.h>
 
+#include <net/ipv6.h>
 #include <net/net_namespace.h>
 #include <net/rtnetlink.h>
 #include <net/sock.h>
@@ -65,7 +66,7 @@ static struct cdev macvtap_cdev;
 static const struct proto_ops macvtap_socket_ops;
 
 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
-                      NETIF_F_TSO6 | NETIF_F_UFO)
+                      NETIF_F_TSO6)
 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
 #define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
 
@@ -569,7 +570,11 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb,
                         gso_type = SKB_GSO_TCPV6;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                        pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n",
+                                     current->comm);
                         gso_type = SKB_GSO_UDP;
+                        if (skb->protocol == htons(ETH_P_IPV6))
+                                ipv6_proxy_select_ident(skb);
                         break;
                 default:
                         return -EINVAL;
@@ -614,8 +619,6 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                 else if (sinfo->gso_type & SKB_GSO_TCPV6)
                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                else if (sinfo->gso_type & SKB_GSO_UDP)
-                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
                 else
                         BUG();
                 if (sinfo->gso_type & SKB_GSO_TCP_ECN)
@@ -626,6 +629,8 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 vnet_hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
                 vnet_hdr->csum_start = skb_checksum_start_offset(skb);
+                if (vlan_tx_tag_present(skb))
+                        vnet_hdr->csum_start += VLAN_HLEN;
                 vnet_hdr->csum_offset = skb->csum_offset;
         } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
                 vnet_hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
@@ -950,9 +955,6 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
                         if (arg & TUN_F_TSO6)
                                 feature_mask |= NETIF_F_TSO6;
                 }
-
-                if (arg & TUN_F_UFO)
-                        feature_mask |= NETIF_F_UFO;
         }
 
         /* tun/tap driver inverts the usage for TSO offloads, where
@@ -963,7 +965,7 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
          * When user space turns off TSO, we turn off GSO/LRO so that
          * user-space will not receive TSO frames.
          */
-        if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO))
+        if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6))
                 features |= RX_OFFLOADS;
         else
                 features &= ~RX_OFFLOADS;
@@ -1064,7 +1066,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
         case TUNSETOFFLOAD:
                 /* let the user check for future flags */
                 if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
-                            TUN_F_TSO_ECN | TUN_F_UFO))
+                            TUN_F_TSO_ECN))
                         return -EINVAL;
 
                 rtnl_lock();
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 2954052706e8..e22e602beef3 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -791,7 +791,7 @@ static int match(struct sk_buff *skb, unsigned int type, struct rxts *rxts)
 
         switch (type & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
@@ -934,7 +934,7 @@ static int is_sync(struct sk_buff *skb, int type)
 
         switch (type & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index bd37e45c89c0..225c033b08f3 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -50,10 +50,15 @@
 #define MII_M1011_PHY_SCR               0x10
 #define MII_M1011_PHY_SCR_AUTO_CROSS    0x0060
 
+#define MII_M1145_PHY_EXT_SR            0x1b
 #define MII_M1145_PHY_EXT_CR            0x14
 #define MII_M1145_RGMII_RX_DELAY        0x0080
 #define MII_M1145_RGMII_TX_DELAY        0x0002
 
+#define MII_M1145_HWCFG_MODE_SGMII_NO_CLK       0x4
+#define MII_M1145_HWCFG_MODE_MASK               0xf
+#define MII_M1145_HWCFG_FIBER_COPPER_AUTO       0x8000
+
 #define MII_M1111_PHY_LED_CONTROL       0x18
 #define MII_M1111_PHY_LED_DIRECT        0x4100
 #define MII_M1111_PHY_LED_COMBINE       0x411c
@@ -676,6 +681,20 @@ static int m88e1145_config_init(struct phy_device *phydev)
                 }
         }
 
+        if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+                int temp = phy_read(phydev, MII_M1145_PHY_EXT_SR);
+                if (temp < 0)
+                        return temp;
+
+                temp &= ~MII_M1145_HWCFG_MODE_MASK;
+                temp |= MII_M1145_HWCFG_MODE_SGMII_NO_CLK;
+                temp |= MII_M1145_HWCFG_FIBER_COPPER_AUTO;
+
+                err = phy_write(phydev, MII_M1145_PHY_EXT_SR, temp);
+                if (err < 0)
+                        return err;
+        }
+
         err = marvell_of_reg_init(phydev);
         if (err < 0)
                 return err;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1dfffdc9dfc3..767cd110f496 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -352,6 +352,7 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
 {
         struct mii_ioctl_data *mii_data = if_mii(ifr);
         u16 val = mii_data->val_in;
+        bool change_autoneg = false;
 
         switch (cmd) {
         case SIOCGMIIPHY:
@@ -367,22 +368,29 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
                 if (mii_data->phy_id == phydev->addr) {
                         switch (mii_data->reg_num) {
                         case MII_BMCR:
-                                if ((val & (BMCR_RESET | BMCR_ANENABLE)) == 0)
+                                if ((val & (BMCR_RESET | BMCR_ANENABLE)) == 0) {
+                                        if (phydev->autoneg == AUTONEG_ENABLE)
+                                                change_autoneg = true;
                                         phydev->autoneg = AUTONEG_DISABLE;
-                                else
+                                        if (val & BMCR_FULLDPLX)
+                                                phydev->duplex = DUPLEX_FULL;
+                                        else
+                                                phydev->duplex = DUPLEX_HALF;
+                                        if (val & BMCR_SPEED1000)
+                                                phydev->speed = SPEED_1000;
+                                        else if (val & BMCR_SPEED100)
+                                                phydev->speed = SPEED_100;
+                                        else phydev->speed = SPEED_10;
+                                }
+                                else {
+                                        if (phydev->autoneg == AUTONEG_DISABLE)
+                                                change_autoneg = true;
                                         phydev->autoneg = AUTONEG_ENABLE;
-                                if (!phydev->autoneg && (val & BMCR_FULLDPLX))
-                                        phydev->duplex = DUPLEX_FULL;
-                                else
-                                        phydev->duplex = DUPLEX_HALF;
-                                if (!phydev->autoneg && (val & BMCR_SPEED1000))
-                                        phydev->speed = SPEED_1000;
-                                else if (!phydev->autoneg &&
-                                         (val & BMCR_SPEED100))
-                                        phydev->speed = SPEED_100;
+                                }
                                 break;
                         case MII_ADVERTISE:
-                                phydev->advertising = val;
+                                phydev->advertising = mii_adv_to_ethtool_adv_t(val);
+                                change_autoneg = true;
                                 break;
                         default:
                                 /* do nothing */
@@ -396,6 +404,10 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
                 if (mii_data->reg_num == MII_BMCR &&
                     val & BMCR_RESET)
                         return phy_init_hw(phydev);
+
+                if (change_autoneg)
+                        return phy_start_aneg(phydev);
+
                 return 0;
 
         case SIOCSHWTSTAMP:
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 68c3a3f4e0ab..794a47329368 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -755,23 +755,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 err = get_filter(argp, &code);
                 if (err >= 0) {
+                        struct bpf_prog *pass_filter = NULL;
                         struct sock_fprog_kern fprog = {
                                 .len = err,
                                 .filter = code,
                         };
 
-                        ppp_lock(ppp);
-                        if (ppp->pass_filter) {
-                                bpf_prog_destroy(ppp->pass_filter);
-                                ppp->pass_filter = NULL;
+                        err = 0;
+                        if (fprog.filter)
+                                err = bpf_prog_create(&pass_filter, &fprog);
+                        if (!err) {
+                                ppp_lock(ppp);
+                                if (ppp->pass_filter)
+                                        bpf_prog_destroy(ppp->pass_filter);
+                                ppp->pass_filter = pass_filter;
+                                ppp_unlock(ppp);
                         }
-                        if (fprog.filter != NULL)
-                                err = bpf_prog_create(&ppp->pass_filter,
-                                                      &fprog);
-                        else
-                                err = 0;
                         kfree(code);
-                        ppp_unlock(ppp);
                 }
                 break;
         }
@@ -781,23 +781,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 err = get_filter(argp, &code);
                 if (err >= 0) {
+                        struct bpf_prog *active_filter = NULL;
                         struct sock_fprog_kern fprog = {
                                 .len = err,
                                 .filter = code,
                         };
 
-                        ppp_lock(ppp);
-                        if (ppp->active_filter) {
-                                bpf_prog_destroy(ppp->active_filter);
-                                ppp->active_filter = NULL;
+                        err = 0;
+                        if (fprog.filter)
+                                err = bpf_prog_create(&active_filter, &fprog);
+                        if (!err) {
+                                ppp_lock(ppp);
+                                if (ppp->active_filter)
+                                        bpf_prog_destroy(ppp->active_filter);
+                                ppp->active_filter = active_filter;
+                                ppp_unlock(ppp);
                         }
-                        if (fprog.filter != NULL)
-                                err = bpf_prog_create(&ppp->active_filter,
-                                                      &fprog);
-                        else
-                                err = 0;
                         kfree(code);
-                        ppp_unlock(ppp);
                 }
                 break;
         }
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 1aff970be33e..1dc628ffce2b 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -506,7 +506,9 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
         int len = sizeof(struct sockaddr_pppox);
         struct sockaddr_pppox sp;
 
-        sp.sa_family      = AF_PPPOX;
+        memset(&sp.sa_addr, 0, sizeof(sp.sa_addr));
+
+        sp.sa_family    = AF_PPPOX;
         sp.sa_protocol  = PX_PROTO_PPTP;
         sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr;
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 186ce541c657..9dd3746994a4 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -65,6 +65,7 @@
 #include <linux/nsproxy.h>
 #include <linux/virtio_net.h>
 #include <linux/rcupdate.h>
+#include <net/ipv6.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
@@ -174,7 +175,7 @@ struct tun_struct {
         struct net_device       *dev;
         netdev_features_t       set_features;
 #define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
-                          NETIF_F_TSO6|NETIF_F_UFO)
+                          NETIF_F_TSO6)
 
         int                     vnet_hdr_sz;
         int                     sndbuf;
@@ -1139,6 +1140,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                 break;
         }
 
+        skb_reset_network_header(skb);
+
         if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
                 pr_debug("GSO!\n");
                 switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
@@ -1149,8 +1152,20 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                {
+                        static bool warned;
+
+                        if (!warned) {
+                                warned = true;
+                                netdev_warn(tun->dev,
+                                            "%s: using disabled UFO feature; please fix this program\n",
+                                            current->comm);
+                        }
                         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+                        if (skb->protocol == htons(ETH_P_IPV6))
+                                ipv6_proxy_select_ident(skb);
                         break;
+                }
                 default:
                         tun->dev->stats.rx_frame_errors++;
                         kfree_skb(skb);
@@ -1179,7 +1194,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
         }
 
-        skb_reset_network_header(skb);
         skb_probe_transport_header(skb, 0);
 
         rxhash = skb_get_hash(skb);
@@ -1221,12 +1235,20 @@ static ssize_t tun_put_user(struct tun_struct *tun,
         struct tun_pi pi = { 0, skb->protocol };
         ssize_t total = 0;
         int vlan_offset = 0, copied;
+        int vlan_hlen = 0;
+        int vnet_hdr_sz = 0;
+
+        if (vlan_tx_tag_present(skb))
+                vlan_hlen = VLAN_HLEN;
+
+        if (tun->flags & TUN_VNET_HDR)
+                vnet_hdr_sz = tun->vnet_hdr_sz;
 
         if (!(tun->flags & TUN_NO_PI)) {
                 if ((len -= sizeof(pi)) < 0)
                         return -EINVAL;
 
-                if (len < skb->len) {
+                if (len < skb->len + vlan_hlen + vnet_hdr_sz) {
                         /* Packet will be striped */
                         pi.flags |= TUN_PKT_STRIP;
                 }
@@ -1236,9 +1258,9 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 total += sizeof(pi);
         }
 
-        if (tun->flags & TUN_VNET_HDR) {
+        if (vnet_hdr_sz) {
                 struct virtio_net_hdr gso = { 0 }; /* no info leak */
-                if ((len -= tun->vnet_hdr_sz) < 0)
+                if ((len -= vnet_hdr_sz) < 0)
                         return -EINVAL;
 
                 if (skb_is_gso(skb)) {
@@ -1251,8 +1273,6 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                                 gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                         else if (sinfo->gso_type & SKB_GSO_TCPV6)
                                 gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                        else if (sinfo->gso_type & SKB_GSO_UDP)
-                                gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
                         else {
                                 pr_err("unexpected GSO type: "
                                        "0x%x, gso_size %d, hdr_len %d\n",
@@ -1272,7 +1292,8 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 
                 if (skb->ip_summed == CHECKSUM_PARTIAL) {
                         gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
-                        gso.csum_start = skb_checksum_start_offset(skb);
+                        gso.csum_start = skb_checksum_start_offset(skb) +
+                                         vlan_hlen;
                         gso.csum_offset = skb->csum_offset;
                 } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
                         gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
@@ -1281,14 +1302,13 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
                                                sizeof(gso))))
                         return -EFAULT;
-                total += tun->vnet_hdr_sz;
+                total += vnet_hdr_sz;
         }
 
         copied = total;
-        total += skb->len;
-        if (!vlan_tx_tag_present(skb)) {
-                len = min_t(int, skb->len, len);
-        } else {
+        len = min_t(int, skb->len + vlan_hlen, len);
+        total += skb->len + vlan_hlen;
+        if (vlan_hlen) {
                 int copy, ret;
                 struct {
                         __be16 h_vlan_proto;
@@ -1299,8 +1319,6 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 veth.h_vlan_TCI = htons(vlan_tx_tag_get(skb));
 
                 vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
-                len = min_t(int, skb->len + VLAN_HLEN, len);
-                total += VLAN_HLEN;
 
                 copy = min_t(int, vlan_offset, len);
                 ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
@@ -1762,11 +1780,6 @@ static int set_offload(struct tun_struct *tun, unsigned long arg)
                                 features |= NETIF_F_TSO6;
                         arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
                 }
-
-                if (arg & TUN_F_UFO) {
-                        features |= NETIF_F_UFO;
-                        arg &= ~TUN_F_UFO;
-                }
         }
 
         /* This gives the user a way to test for new features in future by
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 2c05f6cdb12f..816d511e34d3 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -465,19 +465,7 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
                 return ret;
         }
 
-        ret = asix_sw_reset(dev, AX_SWRESET_IPPD | AX_SWRESET_PRL);
-        if (ret < 0)
-                return ret;
-
-        msleep(150);
-
-        ret = asix_sw_reset(dev, AX_SWRESET_CLEAR);
-        if (ret < 0)
-                return ret;
-
-        msleep(150);
-
-        ret = asix_sw_reset(dev, embd_phy ? AX_SWRESET_IPRL : AX_SWRESET_PRTE);
+        ax88772_reset(dev);
 
         /* Read PHYID register *AFTER* the PHY was reset properly */
         phyid = asix_get_phyid(dev);
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index be4275721039..e6338c16081a 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -937,6 +937,7 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p)
 {
         struct usbnet *dev = netdev_priv(net);
         struct sockaddr *addr = p;
+        int ret;
 
         if (netif_running(net))
                 return -EBUSY;
@@ -946,8 +947,12 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p)
         memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
 
         /* Set the MAC address */
-        return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+        ret = ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
                                  ETH_ALEN, net->dev_addr);
+        if (ret < 0)
+                return ret;
+
+        return 0;
 }
 
 static const struct net_device_ops ax88179_netdev_ops = {
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 2a32d9167d3b..d3920b54a92c 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -67,6 +67,35 @@ static const u8 mbm_guid[16] = {
         0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a,
 };
 
+static void usbnet_cdc_update_filter(struct usbnet *dev)
+{
+        struct cdc_state        *info = (void *) &dev->data;
+        struct usb_interface    *intf = info->control;
+
+        u16 cdc_filter =
+            USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED |
+            USB_CDC_PACKET_TYPE_BROADCAST;
+
+        if (dev->net->flags & IFF_PROMISC)
+                cdc_filter |= USB_CDC_PACKET_TYPE_PROMISCUOUS;
+
+        /* FIXME cdc-ether has some multicast code too, though it complains
+         * in routine cases.  info->ether describes the multicast support.
+         * Implement that here, manipulating the cdc filter as needed.
+         */
+
+        usb_control_msg(dev->udev,
+                        usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
+                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        cdc_filter,
+                        intf->cur_altsetting->desc.bInterfaceNumber,
+                        NULL,
+                        0,
+                        USB_CTRL_SET_TIMEOUT
+                );
+}
+
 /* probes control interface, claims data interface, collects the bulk
  * endpoints, activates data interface (if needed), maybe sets MTU.
  * all pure cdc, except for certain firmware workarounds, and knowing
@@ -347,16 +376,8 @@ next_desc:
          * don't do reset all the way. So the packet filter should
          * be set to a sane initial value.
          */
-        usb_control_msg(dev->udev,
-                        usb_sndctrlpipe(dev->udev, 0),
-                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
-                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED | USB_CDC_PACKET_TYPE_BROADCAST,
-                        intf->cur_altsetting->desc.bInterfaceNumber,
-                        NULL,
-                        0,
-                        USB_CTRL_SET_TIMEOUT
-                );
+        usbnet_cdc_update_filter(dev);
+
         return 0;
 
 bad_desc:
@@ -468,10 +489,6 @@ int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                 return status;
         }
 
-        /* FIXME cdc-ether has some multicast code too, though it complains
-         * in routine cases.  info->ether describes the multicast support.
-         * Implement that here, manipulating the cdc filter as needed.
-         */
         return 0;
 }
 EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
@@ -482,6 +499,7 @@ static const struct driver_info	cdc_info = {
         .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       usbnet_cdc_status,
+        .set_rx_mode =  usbnet_cdc_update_filter,
         .manage_power = usbnet_manage_power,
 };
 
@@ -491,6 +509,7 @@ static const struct driver_info wwan_info = {
         .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       usbnet_cdc_status,
+        .set_rx_mode =  usbnet_cdc_update_filter,
         .manage_power = usbnet_manage_power,
 };
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 22756db53dca..b8a82b86f909 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -780,6 +780,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x03f0, 0x581d, 4)},    /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index e3d84c322e4e..c6554c7a8147 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1162,6 +1162,9 @@ static void intr_callback(struct urb *urb)
         case -ESHUTDOWN:
                 netif_device_detach(tp->netdev);
         case -ENOENT:
+        case -EPROTO:
+                netif_info(tp, intr, tp->netdev,
+                           "Stop submitting intr, status %d\n", status);
                 return;
         case -EOVERFLOW:
                 netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n");
@@ -2891,6 +2894,9 @@ static int rtl8152_open(struct net_device *netdev)
         if (res)
                 goto out;
 
+        /* set speed to 0 to avoid autoresume try to submit rx */
+        tp->speed = 0;
+
         res = usb_autopm_get_interface(tp->intf);
         if (res < 0) {
                 free_all_mem(tp);
@@ -2904,6 +2910,8 @@ static int rtl8152_open(struct net_device *netdev)
                 clear_bit(WORK_ENABLE, &tp->flags);
                 usb_kill_urb(tp->intr_urb);
                 cancel_delayed_work_sync(&tp->schedule);
+
+                /* disable the tx/rx, if the workqueue has enabled them. */
                 if (tp->speed & LINK_STATUS)
                         tp->rtl_ops.disable(tp);
         }
@@ -2955,10 +2963,7 @@ static int rtl8152_close(struct net_device *netdev)
                  * be disable when autoresume occurs, because the
                  * netif_running() would be false.
                  */
-                if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
-                        rtl_runtime_suspend_enable(tp, false);
-                        clear_bit(SELECTIVE_SUSPEND, &tp->flags);
-                }
+                rtl_runtime_suspend_enable(tp, false);
 
                 tasklet_disable(&tp->tl);
                 tp->rtl_ops.down(tp);
@@ -3205,7 +3210,7 @@ static int rtl8152_suspend(struct usb_interface *intf, pm_message_t message)
                 netif_device_detach(netdev);
         }
 
-        if (netif_running(netdev)) {
+        if (netif_running(netdev) && test_bit(WORK_ENABLE, &tp->flags)) {
                 clear_bit(WORK_ENABLE, &tp->flags);
                 usb_kill_urb(tp->intr_urb);
                 tasklet_disable(&tp->tl);
@@ -3253,6 +3258,8 @@ static int rtl8152_resume(struct usb_interface *intf)
                         set_bit(WORK_ENABLE, &tp->flags);
                 }
                 usb_submit_urb(tp->intr_urb, GFP_KERNEL);
+        } else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
+                clear_bit(SELECTIVE_SUSPEND, &tp->flags);
         }
 
         mutex_unlock(&tp->control);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 20615bbd693b..3a6770a65d78 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1052,6 +1052,21 @@ static void __handle_link_change(struct usbnet *dev)
         clear_bit(EVENT_LINK_CHANGE, &dev->flags);
 }
 
+static void usbnet_set_rx_mode(struct net_device *net)
+{
+        struct usbnet           *dev = netdev_priv(net);
+
+        usbnet_defer_kevent(dev, EVENT_SET_RX_MODE);
+}
+
+static void __handle_set_rx_mode(struct usbnet *dev)
+{
+        if (dev->driver_info->set_rx_mode)
+                (dev->driver_info->set_rx_mode)(dev);
+
+        clear_bit(EVENT_SET_RX_MODE, &dev->flags);
+}
+
 /* work that cannot be done in interrupt context uses keventd.
  *
  * NOTE:  with 2.5 we could do more of this using completion callbacks,
@@ -1157,6 +1172,10 @@ skip_reset:
         if (test_bit (EVENT_LINK_CHANGE, &dev->flags))
                 __handle_link_change(dev);
 
+        if (test_bit (EVENT_SET_RX_MODE, &dev->flags))
+                __handle_set_rx_mode(dev);
+
+
         if (dev->flags)
                 netdev_dbg(dev->net, "kevent done, flags = 0x%lx\n", dev->flags);
 }
@@ -1525,6 +1544,7 @@ static const struct net_device_ops usbnet_netdev_ops = {
         .ndo_stop               = usbnet_stop,
         .ndo_start_xmit         = usbnet_start_xmit,
         .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_set_rx_mode        = usbnet_set_rx_mode,
         .ndo_change_mtu         = usbnet_change_mtu,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d75256bd1a6a..b0bc8ead47de 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -491,8 +491,17 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                {
+                        static bool warned;
+
+                        if (!warned) {
+                                warned = true;
+                                netdev_warn(dev,
+                                            "host using disabled UFO feature; please fix it\n");
+                        }
                         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                         break;
+                }
                 case VIRTIO_NET_HDR_GSO_TCPV6:
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
                         break;
@@ -881,8 +890,6 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
                         hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                 else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
                         hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                else if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
-                        hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP;
                 else
                         BUG();
                 if (skb_shinfo(skb)->gso_type & SKB_GSO_TCP_ECN)
@@ -1666,6 +1673,40 @@ static const struct attribute_group virtio_net_mrg_rx_group = {
 };
 #endif
 
+static bool virtnet_fail_on_feature(struct virtio_device *vdev,
+                                    unsigned int fbit,
+                                    const char *fname, const char *dname)
+{
+        if (!virtio_has_feature(vdev, fbit))
+                return false;
+
+        dev_err(&vdev->dev, "device advertises feature %s but not %s",
+                fname, dname);
+
+        return true;
+}
+
+#define VIRTNET_FAIL_ON(vdev, fbit, dbit)                       \
+        virtnet_fail_on_feature(vdev, fbit, #fbit, dbit)
+
+static bool virtnet_validate_features(struct virtio_device *vdev)
+{
+        if (!virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) &&
+            (VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_RX,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_VLAN,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_GUEST_ANNOUNCE,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_MQ, "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR,
+                             "VIRTIO_NET_F_CTRL_VQ"))) {
+                return false;
+        }
+
+        return true;
+}
+
 static int virtnet_probe(struct virtio_device *vdev)
 {
         int i, err;
@@ -1673,6 +1714,9 @@ static int virtnet_probe(struct virtio_device *vdev)
         struct virtnet_info *vi;
         u16 max_queue_pairs;
 
+        if (!virtnet_validate_features(vdev))
+                return -EINVAL;
+
         /* Find if host supports multiqueue virtio_net device */
         err = virtio_cread_feature(vdev, VIRTIO_NET_F_MQ,
                                    struct virtio_net_config,
@@ -1705,7 +1749,7 @@ static int virtnet_probe(struct virtio_device *vdev)
                         dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
 
                 if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
-                        dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
+                        dev->hw_features |= NETIF_F_TSO
                                 | NETIF_F_TSO_ECN | NETIF_F_TSO6;
                 }
                 /* Individual feature bits: what can host handle? */
@@ -1715,11 +1759,9 @@ static int virtnet_probe(struct virtio_device *vdev)
                         dev->hw_features |= NETIF_F_TSO6;
                 if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_ECN))
                         dev->hw_features |= NETIF_F_TSO_ECN;
-                if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_UFO))
-                        dev->hw_features |= NETIF_F_UFO;
 
                 if (gso)
-                        dev->features |= dev->hw_features & (NETIF_F_ALL_TSO|NETIF_F_UFO);
+                        dev->features |= dev->hw_features & NETIF_F_ALL_TSO;
                 /* (!csum && gso) case will be fixed by register_netdev() */
         }
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM))
@@ -1757,8 +1799,7 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* If we can receive ANY GSO packets, we must allocate large ones. */
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
             virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
                 vi->big_packets = true;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
@@ -1952,9 +1993,9 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
         VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
         VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
-        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
+        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_TSO6,
         VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
-        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO,
+        VIRTIO_NET_F_GUEST_ECN,
         VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ,
         VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
         VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index ca309820d39e..be4649a49c5e 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -67,12 +67,6 @@
 
 #define VXLAN_FLAGS 0x08000000  /* struct vxlanhdr.vx_flags required value. */
 
-/* VXLAN protocol header */
-struct vxlanhdr {
-        __be32 vx_flags;
-        __be32 vx_vni;
-};
-
 /* UDP port for VXLAN traffic.
  * The IANA assigned port is 4789, but the Linux default is 8472
  * for compatibility with early adopters.
@@ -275,13 +269,15 @@ static inline struct vxlan_rdst *first_remote_rtnl(struct vxlan_fdb *fdb)
         return list_first_entry(&fdb->remotes, struct vxlan_rdst, list);
 }
 
-/* Find VXLAN socket based on network namespace and UDP port */
-static struct vxlan_sock *vxlan_find_sock(struct net *net, __be16 port)
+/* Find VXLAN socket based on network namespace, address family and UDP port */
+static struct vxlan_sock *vxlan_find_sock(struct net *net,
+                                          sa_family_t family, __be16 port)
 {
         struct vxlan_sock *vs;
 
         hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) {
-                if (inet_sk(vs->sock->sk)->inet_sport == port)
+                if (inet_sk(vs->sock->sk)->inet_sport == port &&
+                    inet_sk(vs->sock->sk)->sk.sk_family == family)
                         return vs;
         }
         return NULL;
@@ -300,11 +296,12 @@ static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, u32 id)
 }
 
 /* Look up VNI in a per net namespace table */
-static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id, __be16 port)
+static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id,
+                                        sa_family_t family, __be16 port)
 {
         struct vxlan_sock *vs;
 
-        vs = vxlan_find_sock(net, port);
+        vs = vxlan_find_sock(net, family, port);
         if (!vs)
                 return NULL;
 
@@ -621,6 +618,8 @@ static int vxlan_gro_complete(struct sk_buff *skb, int nhoff)
         int vxlan_len  = sizeof(struct vxlanhdr) + sizeof(struct ethhdr);
         int err = -ENOSYS;
 
+        udp_tunnel_gro_complete(skb, nhoff);
+
         eh = (struct ethhdr *)(skb->data + nhoff + sizeof(struct vxlanhdr));
         type = eh->h_proto;
 
@@ -1771,7 +1770,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         struct vxlan_dev *dst_vxlan;
 
                         ip_rt_put(rt);
-                        dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
+                        dst_vxlan = vxlan_find_vni(vxlan->net, vni,
+                                                   dst->sa.sa_family, dst_port);
                         if (!dst_vxlan)
                                 goto tx_error;
                         vxlan_encap_bypass(skb, vxlan, dst_vxlan);
@@ -1825,7 +1825,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         struct vxlan_dev *dst_vxlan;
 
                         dst_release(ndst);
-                        dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
+                        dst_vxlan = vxlan_find_vni(vxlan->net, vni,
+                                                   dst->sa.sa_family, dst_port);
                         if (!dst_vxlan)
                                 goto tx_error;
                         vxlan_encap_bypass(skb, vxlan, dst_vxlan);
@@ -1985,13 +1986,15 @@ static int vxlan_init(struct net_device *dev)
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
         struct vxlan_sock *vs;
+        bool ipv6 = vxlan->flags & VXLAN_F_IPV6;
 
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
         spin_lock(&vn->sock_lock);
-        vs = vxlan_find_sock(vxlan->net, vxlan->dst_port);
+        vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
+                             vxlan->dst_port);
         if (vs) {
                 /* If we have a socket with same port already, reuse it */
                 atomic_inc(&vs->refcnt);
@@ -2303,9 +2306,9 @@ static struct socket *vxlan_create_sock(struct net *net, bool ipv6,
         if (ipv6) {
                 udp_conf.family = AF_INET6;
                 udp_conf.use_udp6_tx_checksums =
-                    !!(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
+                    !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
                 udp_conf.use_udp6_rx_checksums =
-                    !!(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
+                    !(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
         } else {
                 udp_conf.family = AF_INET;
                 udp_conf.local_ip.s_addr = INADDR_ANY;
@@ -2382,6 +2385,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_sock *vs;
+        bool ipv6 = flags & VXLAN_F_IPV6;
 
         vs = vxlan_socket_create(net, port, rcv, data, flags);
         if (!IS_ERR(vs))
@@ -2391,7 +2395,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
                 return vs;
 
         spin_lock(&vn->sock_lock);
-        vs = vxlan_find_sock(net, port);
+        vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port);
         if (vs) {
                 if (vs->rcv == rcv)
                         atomic_inc(&vs->refcnt);
@@ -2550,7 +2554,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
             nla_get_u8(data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]))
                 vxlan->flags |= VXLAN_F_UDP_ZERO_CSUM6_RX;
 
-        if (vxlan_find_vni(net, vni, vxlan->dst_port)) {
+        if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET,
+                           vxlan->dst_port)) {
                 pr_info("duplicate VNI %u\n", vni);
                 return -EEXIST;
         }
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index e5ba6faf3281..86907e5ba6ca 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -80,6 +80,7 @@ struct reg_dmn_pair_mapping {
 
 struct ath_regulatory {
         char alpha2[2];
+        enum nl80211_dfs_regions region;
         u16 country_code;
         u16 max_power_level;
         u16 current_rd;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 697c4ae90af0..1e8ea5e4d4ca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -664,6 +664,19 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
                 ah->enabled_cals |= TX_CL_CAL;
         else
                 ah->enabled_cals &= ~TX_CL_CAL;
+
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+                if (ah->is_clk_25mhz) {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
+                } else {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
+                }
+                udelay(100);
+        }
 }
 
 static void ar9003_hw_prog_ini(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index c6dd7f1fed65..33b0c7aef2ea 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -368,11 +368,11 @@ void ath9k_cmn_update_txpow(struct ath_hw *ah, u16 cur_txpow,
 {
         struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
 
-        if (reg->power_limit != new_txpow) {
+        if (reg->power_limit != new_txpow)
                 ath9k_hw_set_txpowerlimit(ah, new_txpow, false);
-                /* read back in case value is clamped */
-                *txpower = reg->max_power_level;
-        }
+
+        /* read back in case value is clamped */
+        *txpower = reg->max_power_level;
 }
 EXPORT_SYMBOL(ath9k_cmn_update_txpow);
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 46f20a309b5f..5c45e787814e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -455,7 +455,7 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                          "%2d          %2x      %1x     %2x           %2x\n",
                          i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
                          (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
-                         val[2] & (0x7 << (i * 3)) >> (i * 3),
+                         (val[2] & (0x7 << (i * 3))) >> (i * 3),
                          (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8be4b1453394..2ad605760e21 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -861,19 +861,6 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
         udelay(RTC_PLL_SETTLE_DELAY);
 
         REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
-
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
-                if (ah->is_clk_25mhz) {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e7ae);
-                } else {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e800);
-                }
-                udelay(100);
-        }
 }
 
 static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 156a944134dc..3bd030494986 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -734,6 +734,32 @@ static const struct ieee80211_iface_combination if_comb[] = {
 #endif
 };
 
+#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
+static void ath9k_set_mcc_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!ath9k_is_chanctx_enabled())
+                return;
+
+        hw->flags |= IEEE80211_HW_QUEUE_CONTROL;
+        hw->queues = ATH9K_NUM_TX_QUEUES;
+        hw->offchannel_tx_hw_queue = hw->queues - 1;
+        hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS);
+        hw->wiphy->iface_combinations = if_comb_multi;
+        hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi);
+        hw->wiphy->max_scan_ssids = 255;
+        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+        hw->wiphy->max_remain_on_channel_duration = 10000;
+        hw->chanctx_data_size = sizeof(void *);
+        hw->extra_beacon_tailroom =
+                sizeof(struct ieee80211_p2p_noa_attr) + 9;
+
+        ath_dbg(common, CHAN_CTX, "Use channel contexts\n");
+}
+#endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
+
 static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 {
         struct ath_hw *ah = sc->sc_ah;
@@ -746,7 +772,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                 IEEE80211_HW_SUPPORTS_RC_TABLE |
-                IEEE80211_HW_QUEUE_CONTROL |
                 IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (ath9k_ps_enable)
@@ -781,24 +806,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                         hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
         }
 
-#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
-
-        if (ath9k_is_chanctx_enabled()) {
-                hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS);
-                hw->wiphy->iface_combinations = if_comb_multi;
-                hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi);
-                hw->wiphy->max_scan_ssids = 255;
-                hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
-                hw->wiphy->max_remain_on_channel_duration = 10000;
-                hw->chanctx_data_size = sizeof(void *);
-                hw->extra_beacon_tailroom =
-                        sizeof(struct ieee80211_p2p_noa_attr) + 9;
-
-                ath_dbg(common, CHAN_CTX, "Use channel contexts\n");
-        }
-
-#endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
-
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
@@ -808,12 +815,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
-        /* allow 4 queues per channel context +
-         * 1 cab queue + 1 offchannel tx queue
-         */
-        hw->queues = ATH9K_NUM_TX_QUEUES;
-        /* last queue for offchannel */
-        hw->offchannel_tx_hw_queue = hw->queues - 1;
+        hw->queues = 4;
         hw->max_rates = 4;
         hw->max_listen_interval = 10;
         hw->max_rate_tries = 10;
@@ -837,6 +839,9 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &common->sbands[IEEE80211_BAND_5GHZ];
 
+#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
+        ath9k_set_mcc_capab(sc, hw);
+#endif
         ath9k_init_wow(hw);
         ath9k_cmn_reload_chainmask(ah);
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6f6a974f7fdb..4f18a6be0c7d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -974,9 +974,8 @@ void ath9k_calculate_iter_data(struct ath_softc *sc,
         struct ath_vif *avp;
 
         /*
-         * Pick the MAC address of the first interface as the new hardware
-         * MAC address. The hardware will use it together with the BSSID mask
-         * when matching addresses.
+         * The hardware will use primary station addr together with the
+         * BSSID mask when matching addresses.
          */
         memset(iter_data, 0, sizeof(*iter_data));
         memset(&iter_data->mask, 0xff, ETH_ALEN);
@@ -1162,6 +1161,9 @@ static void ath9k_assign_hw_queues(struct ieee80211_hw *hw,
 {
         int i;
 
+        if (!ath9k_is_chanctx_enabled())
+                return;
+
         for (i = 0; i < IEEE80211_NUM_ACS; i++)
                 vif->hw_queue[i] = i;
 
@@ -1202,6 +1204,8 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 list_add_tail(&avp->list, &avp->chanctx->vifs);
         }
 
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         ath9k_assign_hw_queues(hw, vif);
 
         an->sc = sc;
@@ -1271,6 +1275,8 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 
         ath_tx_node_cleanup(sc, &avp->mcast_node);
 
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 493a183d0aaf..d6e54a3c88f6 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -169,7 +169,10 @@ static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
 
         if (txq->stopped &&
             txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                ieee80211_wake_queue(sc->hw, info->hw_queue);
+                if (ath9k_is_chanctx_enabled())
+                        ieee80211_wake_queue(sc->hw, info->hw_queue);
+                else
+                        ieee80211_wake_queue(sc->hw, q);
                 txq->stopped = false;
         }
 }
@@ -2247,7 +2250,10 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 fi->txq = q;
                 if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
                     !txq->stopped) {
-                        ieee80211_stop_queue(sc->hw, info->hw_queue);
+                        if (ath9k_is_chanctx_enabled())
+                                ieee80211_stop_queue(sc->hw, info->hw_queue);
+                        else
+                                ieee80211_stop_queue(sc->hw, q);
                         txq->stopped = true;
                 }
         }
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 415393dfb6fc..06ea6cc9e30a 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -515,6 +515,7 @@ void ath_reg_notifier_apply(struct wiphy *wiphy,
         if (!request)
                 return;
 
+        reg->region = request->dfs_region;
         switch (request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
                 /*
@@ -779,6 +780,19 @@ u32 ath_regd_get_band_ctl(struct ath_regulatory *reg,
                 return SD_NO_CTL;
         }
 
+        if (ath_regd_get_eepromRD(reg) == CTRY_DEFAULT) {
+                switch (reg->region) {
+                case NL80211_DFS_FCC:
+                        return CTL_FCC;
+                case NL80211_DFS_ETSI:
+                        return CTL_ETSI;
+                case NL80211_DFS_JP:
+                        return CTL_MKK;
+                default:
+                        break;
+                }
+        }
+
         switch (band) {
         case IEEE80211_BAND_2GHZ:
                 return reg->regpair->reg_2ghz_ctl;
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 1dfc682a8055..ee27b06074e1 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -300,9 +300,7 @@ void b43_phy_write(struct b43_wldev *dev, u16 reg, u16 value)
 
 void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
 {
-        assert_mac_suspended(dev);
-        dev->phy.ops->phy_write(dev, destreg,
-                dev->phy.ops->phy_read(dev, srcreg));
+        b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
 }
 
 void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index f55f625fd06b..d20d4e6f391a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -670,7 +670,6 @@ static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
                                   struct brcmf_sdio_dev *sdiodev)
 {
         int i;
-        uint fw_len, nv_len;
         char end;
 
         for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
@@ -684,25 +683,25 @@ static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
                 return -ENODEV;
         }
 
-        fw_len = sizeof(sdiodev->fw_name) - 1;
-        nv_len = sizeof(sdiodev->nvram_name) - 1;
         /* check if firmware path is provided by module parameter */
         if (brcmf_firmware_path[0] != '\0') {
-                strncpy(sdiodev->fw_name, brcmf_firmware_path, fw_len);
-                strncpy(sdiodev->nvram_name, brcmf_firmware_path, nv_len);
-                fw_len -= strlen(sdiodev->fw_name);
-                nv_len -= strlen(sdiodev->nvram_name);
+                strlcpy(sdiodev->fw_name, brcmf_firmware_path,
+                        sizeof(sdiodev->fw_name));
+                strlcpy(sdiodev->nvram_name, brcmf_firmware_path,
+                        sizeof(sdiodev->nvram_name));
 
                 end = brcmf_firmware_path[strlen(brcmf_firmware_path) - 1];
                 if (end != '/') {
-                        strncat(sdiodev->fw_name, "/", fw_len);
-                        strncat(sdiodev->nvram_name, "/", nv_len);
-                        fw_len--;
-                        nv_len--;
+                        strlcat(sdiodev->fw_name, "/",
+                                sizeof(sdiodev->fw_name));
+                        strlcat(sdiodev->nvram_name, "/",
+                                sizeof(sdiodev->nvram_name));
                 }
         }
-        strncat(sdiodev->fw_name, brcmf_fwname_data[i].bin, fw_len);
-        strncat(sdiodev->nvram_name, brcmf_fwname_data[i].nv, nv_len);
+        strlcat(sdiodev->fw_name, brcmf_fwname_data[i].bin,
+                sizeof(sdiodev->fw_name));
+        strlcat(sdiodev->nvram_name, brcmf_fwname_data[i].nv,
+                sizeof(sdiodev->nvram_name));
 
         return 0;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/of.c b/drivers/net/wireless/brcm80211/brcmfmac/of.c
index f05f5270fec1..927bffd5be64 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c
@@ -40,8 +40,8 @@ void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
                 return;
 
         irq = irq_of_parse_and_map(np, 0);
-        if (irq < 0) {
-                brcmf_err("interrupt could not be mapped: err=%d\n", irq);
+        if (!irq) {
+                brcmf_err("interrupt could not be mapped\n");
                 devm_kfree(dev, sdiodev->pdata);
                 return;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 8c0632ec9f7a..16fef3382019 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -19,10 +19,10 @@
 #include <linux/pci.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
-#include <linux/unaligned/access_ok.h>
 #include <linux/interrupt.h>
 #include <linux/bcma/bcma.h>
 #include <linux/sched.h>
+#include <asm/unaligned.h>
 
 #include <soc.h>
 #include <chipcommon.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index dc135915470d..875d1142c8b0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -669,10 +669,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
                 goto finalize;
         }
 
-        if (!brcmf_usb_ioctl_resp_wait(devinfo))
+        if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
+                usb_kill_urb(devinfo->ctl_urb);
                 ret = -ETIMEDOUT;
-        else
+        } else {
                 memcpy(buffer, tmpbuf, buflen);
+        }
 
 finalize:
         kfree(tmpbuf);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 28fa25b509db..39b45c038a93 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -299,6 +299,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         primary_offset = ch->center_freq1 - ch->chan->center_freq;
         switch (ch->width) {
         case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_20_NOHT:
                 ch_inf.bw = BRCMU_CHAN_BW_20;
                 WARN_ON(primary_offset != 0);
                 break;
@@ -323,6 +324,10 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
                                 ch_inf.sb = BRCMU_CHAN_SB_LU;
                 }
                 break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
         default:
                 WARN_ON_ONCE(1);
         }
@@ -333,6 +338,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         case IEEE80211_BAND_5GHZ:
                 ch_inf.band = BRCMU_CHAN_BAND_5G;
                 break;
+        case IEEE80211_BAND_60GHZ:
         default:
                 WARN_ON_ONCE(1);
         }
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 2364a3c09b9e..cae692ff1013 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1095,6 +1095,7 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                              u32 queues, bool drop)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+        u32 scd_queues;
 
         mutex_lock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "enter\n");
@@ -1108,18 +1109,19 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 goto done;
         }
 
-        /*
-         * mac80211 will not push any more frames for transmit
-         * until the flush is completed
-         */
-        if (drop) {
-                IWL_DEBUG_MAC80211(priv, "send flush command\n");
-                if (iwlagn_txfifo_flush(priv, 0)) {
-                        IWL_ERR(priv, "flush request fail\n");
-                        goto done;
-                }
+        scd_queues = BIT(priv->cfg->base_params->num_of_queues) - 1;
+        scd_queues &= ~(BIT(IWL_IPAN_CMD_QUEUE_NUM) |
+                        BIT(IWL_DEFAULT_CMD_QUEUE_NUM));
+
+        if (vif)
+                scd_queues &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
+
+        IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n", scd_queues);
+        if (iwlagn_txfifo_flush(priv, scd_queues)) {
+                IWL_ERR(priv, "flush request fail\n");
+                goto done;
         }
-        IWL_DEBUG_MAC80211(priv, "wait transmit/flush all frames\n");
+        IWL_DEBUG_TX_QUEUES(priv, "wait transmit/flush all frames\n");
         iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff);
 done:
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index e4351487ca72..d2b7234b1c73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -82,7 +82,8 @@
 #define IWL8000_TX_POWER_VERSION        0xffff /* meaningless */
 
 #define IWL8000_FW_PRE "iwlwifi-8000"
-#define IWL8000_MODULE_FIRMWARE(api) IWL8000_FW_PRE __stringify(api) ".ucode"
+#define IWL8000_MODULE_FIRMWARE(api) \
+        IWL8000_FW_PRE "-" __stringify(api) ".ucode"
 
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
 #define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000.bin"
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index 4f6e66892acc..b894a84e8393 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -155,6 +155,7 @@ enum iwl_ucode_tlv_api {
  * @IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT: supports Quiet Period requests
  * @IWL_UCODE_TLV_CAPA_DQA_SUPPORT: supports dynamic queue allocation (DQA),
  *      which also implies support for the scheduler configuration command
+ * @IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT: supports Hot Spot Command
  */
 enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_D0I3_SUPPORT                 = BIT(0),
@@ -163,6 +164,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT       = BIT(10),
         IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT         = BIT(11),
         IWL_UCODE_TLV_CAPA_DQA_SUPPORT                  = BIT(12),
+        IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT              = BIT(18),
 };
 
 /* The default calibrate table size if not specified by firmware file */
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 9eb85249e89c..d8fc548c0d6c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -563,6 +563,7 @@ enum iwl_trans_state {
  *      Set during transport allocation.
  * @hw_id_str: a string with info about HW ID. Set during transport allocation.
  * @pm_support: set to true in start_hw if link pm is supported
+ * @ltr_enabled: set to true if the LTR is enabled
  * @dev_cmd_pool: pool for Tx cmd allocation - for internal use only.
  *      The user should use iwl_trans_{alloc,free}_tx_cmd.
  * @dev_cmd_headroom: room needed for the transport's private use before the
@@ -589,6 +590,7 @@ struct iwl_trans {
         u8 rx_mpdu_cmd, rx_mpdu_cmd_hdr_size;
 
         bool pm_support;
+        bool ltr_enabled;
 
         /* The following fields are internal only */
         struct kmem_cache *dev_cmd_pool;
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 8df2021f9856..da2ffb785194 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -303,8 +303,8 @@ static const __le64 iwl_ci_mask[][3] = {
 };
 
 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x28412201),
-        cpu_to_le32(0x11118451),
+        cpu_to_le32(0x2e402280),
+        cpu_to_le32(0x7711a751),
 };
 
 struct corunning_block_luts {
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index 585c0ab4a3ec..8a1d2f33d5b7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -291,8 +291,8 @@ static const __le64 iwl_ci_mask[][3] = {
 };
 
 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x28412201),
-        cpu_to_le32(0x11118451),
+        cpu_to_le32(0x2e402280),
+        cpu_to_le32(0x7711a751),
 };
 
 struct corunning_block_luts {
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 27dd86395b39..2fd8ad4633e0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -68,13 +68,46 @@
 
 /* Power Management Commands, Responses, Notifications */
 
+/**
+ * enum iwl_ltr_config_flags - masks for LTR config command flags
+ * @LTR_CFG_FLAG_FEATURE_ENABLE: Feature operational status
+ * @LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS: allow LTR change on shadow
+ *      memory access
+ * @LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH: allow LTR msg send on ANY LTR
+ *      reg change
+ * @LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3: allow LTR msg send on transition from
+ *      D0 to D3
+ * @LTR_CFG_FLAG_SW_SET_SHORT: fixed static short LTR register
+ * @LTR_CFG_FLAG_SW_SET_LONG: fixed static short LONG register
+ * @LTR_CFG_FLAG_DENIE_C10_ON_PD: allow going into C10 on PD
+ */
+enum iwl_ltr_config_flags {
+        LTR_CFG_FLAG_FEATURE_ENABLE = BIT(0),
+        LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS = BIT(1),
+        LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH = BIT(2),
+        LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3 = BIT(3),
+        LTR_CFG_FLAG_SW_SET_SHORT = BIT(4),
+        LTR_CFG_FLAG_SW_SET_LONG = BIT(5),
+        LTR_CFG_FLAG_DENIE_C10_ON_PD = BIT(6),
+};
+
+/**
+ * struct iwl_ltr_config_cmd - configures the LTR
+ * @flags: See %enum iwl_ltr_config_flags
+ */
+struct iwl_ltr_config_cmd {
+        __le32 flags;
+        __le32 static_long;
+        __le32 static_short;
+} __packed;
+
 /* Radio LP RX Energy Threshold measured in dBm */
 #define POWER_LPRX_RSSI_THRESHOLD       75
 #define POWER_LPRX_RSSI_THRESHOLD_MAX   94
 #define POWER_LPRX_RSSI_THRESHOLD_MIN   30
 
 /**
- * enum iwl_scan_flags - masks for power table command flags
+ * enum iwl_power_flags - masks for power table command flags
  * @POWER_FLAGS_POWER_SAVE_ENA_MSK: '1' Allow to save power by turning off
  *              receiver and transmitter. '0' - does not allow.
  * @POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK: '0' Driver disables power management,
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 667a92274c87..c62575d86bcd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -157,6 +157,7 @@ enum {
         /* Power - legacy power table command */
         POWER_TABLE_CMD = 0x77,
         PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78,
+        LTR_CONFIG = 0xee,
 
         /* Thermal Throttling*/
         REPLY_THERMAL_MNG_BACKOFF = 0x7e,
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 23fd711a67e4..eb03943f8463 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -284,7 +284,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (WARN_ON_ONCE(mvm->init_ucode_complete))
+        if (WARN_ON_ONCE(mvm->init_ucode_complete || mvm->calibrating))
                 return 0;
 
         iwl_init_notification_wait(&mvm->notif_wait,
@@ -334,6 +334,8 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                 goto out;
         }
 
+        mvm->calibrating = true;
+
         /* Send TX valid antennas before triggering calibrations */
         ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
         if (ret)
@@ -358,11 +360,17 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                         MVM_UCODE_CALIB_TIMEOUT);
         if (!ret)
                 mvm->init_ucode_complete = true;
+
+        if (ret && iwl_mvm_is_radio_killed(mvm)) {
+                IWL_DEBUG_RF_KILL(mvm, "RFKILL while calibrating.\n");
+                ret = 1;
+        }
         goto out;
 
 error:
         iwl_remove_notification(&mvm->notif_wait, &calib_wait);
 out:
+        mvm->calibrating = false;
         if (iwlmvm_mod_params.init_dbg && !mvm->nvm_data) {
                 /* we want to debug INIT and we have no NVM - fake */
                 mvm->nvm_data = kzalloc(sizeof(struct iwl_nvm_data) +
@@ -480,6 +488,15 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         /* Initialize tx backoffs to the minimal possible */
         iwl_mvm_tt_tx_backoff(mvm, 0);
 
+        if (mvm->trans->ltr_enabled) {
+                struct iwl_ltr_config_cmd cmd = {
+                        .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+                };
+
+                WARN_ON(iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                             sizeof(cmd), &cmd));
+        }
+
         ret = iwl_mvm_power_update_device(mvm);
         if (ret)
                 goto error;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index c7a73c68bdab..b6d2683da3a9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -526,7 +526,8 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
         }
 
         if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
-            !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status))
+            !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
+            !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
                 goto drop;
 
         /* treat non-bufferable MMPDUs as broadcast if sta is sleeping */
@@ -787,6 +788,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
         mvm->ps_disabled = false;
+        mvm->calibrating = false;
 
         /* just in case one was running */
         ieee80211_remain_on_channel_expired(mvm->hw);
@@ -1734,6 +1736,13 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
         if (changes & BSS_CHANGED_BEACON &&
             iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
                 IWL_WARN(mvm, "Failed updating beacon data\n");
+
+        if (changes & BSS_CHANGED_TXPOWER) {
+                IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
+                                bss_conf->txpower);
+                iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
+        }
+
 }
 
 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
@@ -2367,14 +2376,19 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
         /* Set the node address */
         memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
 
+        lockdep_assert_held(&mvm->mutex);
+
+        spin_lock_bh(&mvm->time_event_lock);
+
+        if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
+                spin_unlock_bh(&mvm->time_event_lock);
+                return -EIO;
+        }
+
         te_data->vif = vif;
         te_data->duration = duration;
         te_data->id = HOT_SPOT_CMD;
 
-        lockdep_assert_held(&mvm->mutex);
-
-        spin_lock_bh(&mvm->time_event_lock);
-        list_add_tail(&te_data->list, &mvm->time_event_list);
         spin_unlock_bh(&mvm->time_event_lock);
 
         /*
@@ -2430,22 +2444,29 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
         IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
                            duration, type);
 
+        mutex_lock(&mvm->mutex);
+
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                /* Use aux roc framework (HS20) */
-                ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
-                                               vif, duration);
-                return ret;
+                if (mvm->fw->ucode_capa.capa[0] &
+                    IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT) {
+                        /* Use aux roc framework (HS20) */
+                        ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
+                                                       vif, duration);
+                        goto out_unlock;
+                }
+                IWL_ERR(mvm, "hotspot not supported\n");
+                ret = -EINVAL;
+                goto out_unlock;
         case NL80211_IFTYPE_P2P_DEVICE:
                 /* handle below */
                 break;
         default:
                 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_unlock;
         }
 
-        mutex_lock(&mvm->mutex);
-
         for (i = 0; i < NUM_PHY_CTX; i++) {
                 phy_ctxt = &mvm->phy_ctxts[i];
                 if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index b153ced7015b..845429c88cf4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -548,6 +548,7 @@ struct iwl_mvm {
         enum iwl_ucode_type cur_ucode;
         bool ucode_loaded;
         bool init_ucode_complete;
+        bool calibrating;
         u32 error_event_table;
         u32 log_event_table;
         u32 umac_error_event_table;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 15aa298ee79c..5b719ee8e789 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -336,6 +336,7 @@ static const char *const iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(DTS_MEASUREMENT_NOTIFICATION),
         CMD(REPLY_THERMAL_MNG_BACKOFF),
         CMD(MAC_PM_POWER_TABLE),
+        CMD(LTR_CONFIG),
         CMD(BT_COEX_CI),
         CMD(BT_COEX_UPDATE_SW_BOOST),
         CMD(BT_COEX_UPDATE_CORUN_LUT),
@@ -423,6 +424,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         }
         mvm->sf_state = SF_UNINIT;
         mvm->low_latency_agg_frame_limit = 6;
+        mvm->cur_ucode = IWL_UCODE_INIT;
 
         mutex_init(&mvm->mutex);
         mutex_init(&mvm->d0i3_suspend_mutex);
@@ -751,6 +753,7 @@ void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
 static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+        bool calibrating = ACCESS_ONCE(mvm->calibrating);
 
         if (state)
                 set_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
@@ -759,7 +762,15 @@ static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 
         wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
 
-        return state && mvm->cur_ucode != IWL_UCODE_INIT;
+        /* iwl_run_init_mvm_ucode is waiting for results, abort it */
+        if (calibrating)
+                iwl_abort_notification_waits(&mvm->notif_wait);
+
+        /*
+         * Stop the device if we run OPERATIONAL firmware or if we are in the
+         * middle of the calibrations.
+         */
+        return state && (mvm->cur_ucode != IWL_UCODE_INIT || calibrating);
 }
 
 static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index cb85e63c20aa..7554f7053830 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -459,7 +459,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                                 basic_ssid ? 1 : 0);
 
         cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
-                                           TX_CMD_FLG_BT_DIS);
+                                           3 << TX_CMD_FLG_BT_PRIO_POS);
+
         cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id;
         cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
         cmd->tx_cmd.rate_n_flags =
@@ -601,16 +602,6 @@ static int iwl_mvm_cancel_regular_scan(struct iwl_mvm *mvm)
                                                SCAN_COMPLETE_NOTIFICATION };
         int ret;
 
-        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
-                return 0;
-
-        if (iwl_mvm_is_radio_killed(mvm)) {
-                ieee80211_scan_completed(mvm->hw, true);
-                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
-                mvm->scan_status = IWL_MVM_SCAN_NONE;
-                return 0;
-        }
-
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                    scan_abort_notif,
                                    ARRAY_SIZE(scan_abort_notif),
@@ -1399,6 +1390,16 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
 
 int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
 {
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ieee80211_scan_completed(mvm->hw, true);
+                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
+                return 0;
+        }
+
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN)
                 return iwl_mvm_scan_offload_stop(mvm, true);
         return iwl_mvm_cancel_regular_scan(mvm);
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index b7f9e61d14e2..6dfad230be5e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -305,8 +305,8 @@ static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm,
                 te_data->running = false;
                 te_data->vif = NULL;
                 te_data->uid = 0;
+                te_data->id = TE_MAX;
         } else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) {
-                set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
                 set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
                 te_data->running = true;
                 ieee80211_ready_on_channel(mvm->hw); /* Start TE */
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 1cb793a498ac..c6a517c771df 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -175,14 +175,10 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
 
         /*
          * for data packets, rate info comes from the table inside the fw. This
-         * table is controlled by LINK_QUALITY commands. Exclude ctrl port
-         * frames like EAPOLs which should be treated as mgmt frames. This
-         * avoids them being sent initially in high rates which increases the
-         * chances for completion of the 4-Way handshake.
+         * table is controlled by LINK_QUALITY commands
          */
 
-        if (ieee80211_is_data(fc) && sta &&
-            !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO)) {
+        if (ieee80211_is_data(fc) && sta) {
                 tx_cmd->initial_rate_index = 0;
                 tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE);
                 return;
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 1393bac0025c..dd2f3f8baa9d 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -174,6 +174,7 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u16 lctl;
+        u16 cap;
 
         /*
          * HW bug W/A for instability in PCIe bus L0S->L1 transition.
@@ -184,16 +185,17 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans)
          *    power savings, even without L1.
          */
         pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_LNKCTL, &lctl);
-        if (lctl & PCI_EXP_LNKCTL_ASPM_L1) {
-                /* L1-ASPM enabled; disable(!) L0S */
+        if (lctl & PCI_EXP_LNKCTL_ASPM_L1)
                 iwl_set_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-                dev_info(trans->dev, "L1 Enabled; Disabling L0S\n");
-        } else {
-                /* L1-ASPM disabled; enable(!) L0S */
+        else
                 iwl_clear_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-                dev_info(trans->dev, "L1 Disabled; Enabling L0S\n");
-        }
         trans->pm_support = !(lctl & PCI_EXP_LNKCTL_ASPM_L0S);
+
+        pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_DEVCTL2, &cap);
+        trans->ltr_enabled = cap & PCI_EXP_DEVCTL2_LTR_EN;
+        dev_info(trans->dev, "L1 %sabled - LTR %sabled\n",
+                 (lctl & PCI_EXP_LNKCTL_ASPM_L1) ? "En" : "Dis",
+                 trans->ltr_enabled ? "En" : "Dis");
 }
 
 /*
@@ -428,7 +430,7 @@ static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
         ret = iwl_poll_bit(trans, CSR_RESET,
                            CSR_RESET_REG_FLAG_MASTER_DISABLED,
                            CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
-        if (ret)
+        if (ret < 0)
                 IWL_WARN(trans, "Master Disable Timed Out, 100 usec\n");
 
         IWL_DEBUG_INFO(trans, "stop master\n");
@@ -544,7 +546,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
                 msleep(25);
         }
 
-        IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
+        IWL_ERR(trans, "Couldn't prepare the card\n");
 
         return ret;
 }
@@ -913,7 +915,8 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
          * restart. So don't process again if the device is
          * already dead.
          */
-        if (test_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+        if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+                IWL_DEBUG_INFO(trans, "DEVICE_ENABLED bit was set and is now cleared\n");
                 iwl_pcie_tx_stop(trans);
                 iwl_pcie_rx_stop(trans);
 
@@ -943,7 +946,6 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
         /* clear all status bits */
         clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
         clear_bit(STATUS_INT_ENABLED, &trans->status);
-        clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
         clear_bit(STATUS_TPOWER_PMI, &trans->status);
         clear_bit(STATUS_RFKILL, &trans->status);
 
@@ -1043,7 +1045,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
                            CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
                            CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
                            25000);
-        if (ret) {
+        if (ret < 0) {
                 IWL_ERR(trans, "Failed to resume the device (mac ready)\n");
                 return ret;
         }
@@ -1892,8 +1894,7 @@ static u32 iwl_trans_pcie_dump_prph(struct iwl_trans *trans,
                 int reg;
                 __le32 *val;
 
-                prph_len += sizeof(*data) + sizeof(*prph) +
-                        num_bytes_in_chunk;
+                prph_len += sizeof(**data) + sizeof(*prph) + num_bytes_in_chunk;
 
                 (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH);
                 (*data)->len = cpu_to_le32(sizeof(*prph) +
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index babbdc1ce741..c9ad4cf1adfb 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1987,7 +1987,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         if (err != 0) {
                 printk(KERN_DEBUG "mac80211_hwsim: device_bind_driver failed (%d)\n",
                        err);
-                goto failed_hw;
+                goto failed_bind;
         }
 
         skb_queue_head_init(&data->pending);
@@ -2183,6 +2183,8 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         return idx;
 
 failed_hw:
+        device_release_driver(data->dev);
+failed_bind:
         device_unregister(data->dev);
 failed_drvdata:
         ieee80211_free_hw(hw);
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 40057079ffb9..5ef5a0eeba50 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -196,6 +196,7 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
         mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, start_win);
 
         del_timer_sync(&tbl->timer_context.timer);
+        tbl->timer_context.timer_is_set = false;
 
         spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
         list_del(&tbl->list);
@@ -297,6 +298,7 @@ mwifiex_flush_data(unsigned long context)
                 (struct reorder_tmr_cnxt *) context;
         int start_win, seq_num;
 
+        ctx->timer_is_set = false;
         seq_num = mwifiex_11n_find_last_seq_num(ctx);
 
         if (seq_num < 0)
@@ -385,6 +387,7 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         new_node->timer_context.ptr = new_node;
         new_node->timer_context.priv = priv;
+        new_node->timer_context.timer_is_set = false;
 
         init_timer(&new_node->timer_context.timer);
         new_node->timer_context.timer.function = mwifiex_flush_data;
@@ -399,6 +402,22 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
 }
 
+static void
+mwifiex_11n_rxreorder_timer_restart(struct mwifiex_rx_reorder_tbl *tbl)
+{
+        u32 min_flush_time;
+
+        if (tbl->win_size >= MWIFIEX_BA_WIN_SIZE_32)
+                min_flush_time = MIN_FLUSH_TIMER_15_MS;
+        else
+                min_flush_time = MIN_FLUSH_TIMER_MS;
+
+        mod_timer(&tbl->timer_context.timer,
+                  jiffies + msecs_to_jiffies(min_flush_time * tbl->win_size));
+
+        tbl->timer_context.timer_is_set = true;
+}
+
 /*
  * This function prepares command for adding a BA request.
  *
@@ -523,31 +542,31 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                                 u8 *ta, u8 pkt_type, void *payload)
 {
         struct mwifiex_rx_reorder_tbl *tbl;
-        int start_win, end_win, win_size;
+        int prev_start_win, start_win, end_win, win_size;
         u16 pkt_index;
         bool init_window_shift = false;
+        int ret = 0;
 
         tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
         if (!tbl) {
                 if (pkt_type != PKT_TYPE_BAR)
                         mwifiex_11n_dispatch_pkt(priv, payload);
-                return 0;
+                return ret;
         }
 
         if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) {
                 mwifiex_11n_dispatch_pkt(priv, payload);
-                return 0;
+                return ret;
         }
 
         start_win = tbl->start_win;
+        prev_start_win = start_win;
         win_size = tbl->win_size;
         end_win = ((start_win + win_size) - 1) & (MAX_TID_VALUE - 1);
         if (tbl->flags & RXREOR_INIT_WINDOW_SHIFT) {
                 init_window_shift = true;
                 tbl->flags &= ~RXREOR_INIT_WINDOW_SHIFT;
         }
-        mod_timer(&tbl->timer_context.timer,
-                  jiffies + msecs_to_jiffies(MIN_FLUSH_TIMER_MS * win_size));
 
         if (tbl->flags & RXREOR_FORCE_NO_DROP) {
                 dev_dbg(priv->adapter->dev,
@@ -568,11 +587,14 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                 if ((start_win + TWOPOW11) > (MAX_TID_VALUE - 1)) {
                         if (seq_num >= ((start_win + TWOPOW11) &
                                         (MAX_TID_VALUE - 1)) &&
-                            seq_num < start_win)
-                                return -1;
+                            seq_num < start_win) {
+                                ret = -1;
+                                goto done;
+                        }
                 } else if ((seq_num < start_win) ||
-                           (seq_num > (start_win + TWOPOW11))) {
-                        return -1;
+                           (seq_num >= (start_win + TWOPOW11))) {
+                        ret = -1;
+                        goto done;
                 }
         }
 
@@ -601,8 +623,10 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                 else
                         pkt_index = (seq_num+MAX_TID_VALUE) - start_win;
 
-                if (tbl->rx_reorder_ptr[pkt_index])
-                        return -1;
+                if (tbl->rx_reorder_ptr[pkt_index]) {
+                        ret = -1;
+                        goto done;
+                }
 
                 tbl->rx_reorder_ptr[pkt_index] = payload;
         }
@@ -613,7 +637,11 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
          */
         mwifiex_11n_scan_and_dispatch(priv, tbl);
 
-        return 0;
+done:
+        if (!tbl->timer_context.timer_is_set ||
+            prev_start_win != tbl->start_win)
+                mwifiex_11n_rxreorder_timer_restart(tbl);
+        return ret;
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index 3a87bb0e3a62..63ecea89b4ab 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -21,6 +21,8 @@
 #define _MWIFIEX_11N_RXREORDER_H_
 
 #define MIN_FLUSH_TIMER_MS              50
+#define MIN_FLUSH_TIMER_15_MS           15
+#define MWIFIEX_BA_WIN_SIZE_32          32
 
 #define PKT_TYPE_BAR 0xE7
 #define MAX_TID_VALUE                   (2 << 11)
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index e2635747d966..f55658d15c60 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -592,6 +592,7 @@ struct reorder_tmr_cnxt {
         struct timer_list timer;
         struct mwifiex_rx_reorder_tbl *ptr;
         struct mwifiex_private *priv;
+        u8 timer_is_set;
 };
 
 struct mwifiex_rx_reorder_tbl {
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 573897b8e878..8444313eabe2 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1111,6 +1111,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Ovislink */
         { USB_DEVICE(0x1b75, 0x3071) },
         { USB_DEVICE(0x1b75, 0x3072) },
+        { USB_DEVICE(0x1b75, 0xa200) },
         /* Para */
         { USB_DEVICE(0x20b8, 0x8888) },
         /* Pegatron */
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 8e68f87ab13c..66ff36447b94 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -158,55 +158,29 @@ void rt2x00queue_align_frame(struct sk_buff *skb)
         skb_trim(skb, frame_length);
 }
 
-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
+/*
+ * H/W needs L2 padding between the header and the paylod if header size
+ * is not 4 bytes aligned.
+ */
+void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        unsigned int payload_length = skb->len - header_length;
-        unsigned int header_align = ALIGN_SIZE(skb, 0);
-        unsigned int payload_align = ALIGN_SIZE(skb, header_length);
-        unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
-        /*
-         * Adjust the header alignment if the payload needs to be moved more
-         * than the header.
-         */
-        if (payload_align > header_align)
-                header_align += 4;
-
-        /* There is nothing to do if no alignment is needed */
-        if (!header_align)
+        if (!l2pad)
                 return;
 
-        /* Reserve the amount of space needed in front of the frame */
-        skb_push(skb, header_align);
-
-        /*
-         * Move the header.
-         */
-        memmove(skb->data, skb->data + header_align, header_length);
-
-        /* Move the payload, if present and if required */
-        if (payload_length && payload_align)
-                memmove(skb->data + header_length + l2pad,
-                        skb->data + header_length + l2pad + payload_align,
-                        payload_length);
-
-        /* Trim the skb to the correct size */
-        skb_trim(skb, header_length + l2pad + payload_length);
+        skb_push(skb, l2pad);
+        memmove(skb->data, skb->data + l2pad, hdr_len);
 }
 
-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
+void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        /*
-         * L2 padding is only present if the skb contains more than just the
-         * IEEE 802.11 header.
-         */
-        unsigned int l2pad = (skb->len > header_length) ?
-                                L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
         if (!l2pad)
                 return;
 
-        memmove(skb->data + l2pad, skb->data, header_length);
+        memmove(skb->data + l2pad, skb->data, hdr_len);
         skb_pull(skb, l2pad);
 }
 
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 58ba71830886..40b6d1d006d7 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -467,7 +467,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
                     rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw);
         /* <2> work queue */
         rtlpriv->works.hw = hw;
-        rtlpriv->works.rtl_wq = alloc_workqueue(rtlpriv->cfg->name, 0, 0);
+        rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
         INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
                           (void *)rtl_watchdog_wq_callback);
         INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index f6179bc06086..07dae0d44abc 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1828,3 +1828,9 @@ const struct ieee80211_ops rtl_ops = {
         .flush = rtl_op_flush,
 };
 EXPORT_SYMBOL_GPL(rtl_ops);
+
+bool rtl_btc_status_false(void)
+{
+        return false;
+}
+EXPORT_SYMBOL_GPL(rtl_btc_status_false);
diff --git a/drivers/net/wireless/rtlwifi/core.h b/drivers/net/wireless/rtlwifi/core.h
index 59cd3b9dca25..624e1dc16d31 100644
--- a/drivers/net/wireless/rtlwifi/core.h
+++ b/drivers/net/wireless/rtlwifi/core.h
@@ -42,5 +42,6 @@ void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                      u32 mask, u32 data);
 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data);
 bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
+bool rtl_btc_status_false(void);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 667aba81246c..846a2e6e34d8 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -842,7 +842,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         break;
                 }
                 /* handle command packet here */
-                if (rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
+                if (rtlpriv->cfg->ops->rx_command_packet &&
+                    rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
                                 dev_kfree_skb_any(skb);
                                 goto end;
                 }
@@ -1127,9 +1128,14 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
 
         __skb_queue_tail(&ring->queue, pskb);
 
-        rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
-                                    &temp_one);
-
+        if (rtlpriv->use_new_trx_flow) {
+                temp_one = 4;
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pbuffer_desc, true,
+                                            HW_DESC_OWN, (u8 *)&temp_one);
+        } else {
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
+                                            &temp_one);
+        }
         return;
 }
 
@@ -1370,9 +1376,9 @@ static void _rtl_pci_free_tx_ring(struct ieee80211_hw *hw,
         ring->desc = NULL;
         if (rtlpriv->use_new_trx_flow) {
                 pci_free_consistent(rtlpci->pdev,
-                                    sizeof(*ring->desc) * ring->entries,
+                                    sizeof(*ring->buffer_desc) * ring->entries,
                                     ring->buffer_desc, ring->buffer_desc_dma);
-                ring->desc = NULL;
+                ring->buffer_desc = NULL;
         }
 }
 
@@ -1543,7 +1549,6 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw)
                                                          true,
                                                          HW_DESC_TXBUFF_ADDR),
                                                  skb->len, PCI_DMA_TODEVICE);
-                                ring->idx = (ring->idx + 1) % ring->entries;
                                 kfree_skb(skb);
                                 ring->idx = (ring->idx + 1) % ring->entries;
                         }
@@ -1796,7 +1801,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
         rtl_pci_reset_trx_ring(hw);
 
         rtlpci->driver_is_goingto_unload = false;
-        if (rtlpriv->cfg->ops->get_btc_status()) {
+        if (rtlpriv->cfg->ops->get_btc_status &&
+            rtlpriv->cfg->ops->get_btc_status()) {
                 rtlpriv->btcoexist.btc_ops->btc_init_variables(rtlpriv);
                 rtlpriv->btcoexist.btc_ops->btc_init_hal_vars(rtlpriv);
         }
@@ -2243,6 +2249,16 @@ int rtl_pci_probe(struct pci_dev *pdev,
         /*like read eeprom and so on */
         rtlpriv->cfg->ops->read_eeprom_info(hw);
 
+        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
+                err = -ENODEV;
+                goto fail3;
+        }
+        rtlpriv->cfg->ops->init_sw_leds(hw);
+
+        /*aspm */
+        rtl_pci_init_aspm(hw);
+
         /* Init mac80211 sw */
         err = rtl_init_core(hw);
         if (err) {
@@ -2258,16 +2274,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
                 goto fail3;
         }
 
-        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
-                err = -ENODEV;
-                goto fail3;
-        }
-        rtlpriv->cfg->ops->init_sw_leds(hw);
-
-        /*aspm */
-        rtl_pci_init_aspm(hw);
-
         err = ieee80211_register_hw(hw);
         if (err) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index a00861b26ece..29983bc96a89 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -656,7 +656,8 @@ static u8 reserved_page_packet[TOTAL_RESERVED_PKT_LEN] = {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 };
 
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
+         bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *))
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -722,7 +723,10 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
         memcpy((u8 *)skb_put(skb, totalpacketlen),
                &reserved_page_packet, totalpacketlen);
 
-        rtstatus = rtl_cmd_send_packet(hw, skb);
+        if (cmd_send_packet)
+                rtstatus = cmd_send_packet(hw, skb);
+        else
+                rtstatus = rtl_cmd_send_packet(hw, skb);
 
         if (rtstatus)
                 b_dlok = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
index a815bd6273da..b64ae45dc674 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
@@ -109,7 +109,9 @@ void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw, u8 element_id,
                          u32 cmd_len, u8 *p_cmdbuffer);
 void rtl92c_firmware_selfreset(struct ieee80211_hw *hw);
 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
+void rtl92c_set_fw_rsvdpagepkt
+        (struct ieee80211_hw *hw,
+         bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *));
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void usb_writeN_async(struct rtl_priv *rtlpriv, u32 addr, void *data, u16 len);
 void rtl92c_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 831df101d7b7..9b660df6fd71 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -114,6 +114,8 @@
         LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 16, 4)
 #define GET_C2H_CMD_FEEDBACK_CCX_SEQ(__pcmdfbhdr)       \
         LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 20, 12)
+#define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc)                   \
+        SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define CHIP_VER_B                      BIT(4)
 #define CHIP_BONDING_IDENTIFIER(_value) (((_value) >> 22) & 0x3)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 8ec0f031f48a..55357d69397a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -459,7 +459,7 @@ void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
                                                tmp_reg422 & (~BIT(6)));
 
-                                rtl92c_set_fw_rsvdpagepkt(hw, 0);
+                                rtl92c_set_fw_rsvdpagepkt(hw, NULL);
 
                                 _rtl92ce_set_bcn_ctrl_reg(hw, BIT(3), 0);
                                 _rtl92ce_set_bcn_ctrl_reg(hw, 0, BIT(4));
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index d86b5b566444..46ea07605eb4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -244,6 +244,7 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .phy_lc_calibrate = _rtl92ce_phy_lc_calibrate,
         .phy_set_bw_mode_callback = rtl92ce_phy_set_bw_mode_callback,
         .dm_dynamic_txpower = rtl92ce_dm_dynamic_txpower,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92ce_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 2fb9c7acb76a..dc3d20b17a26 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -728,6 +728,9 @@ u32 rtl92ce_get_desc(u8 *p_desc, bool istx, u8 desc_name)
                 case HW_DESC_RXPKT_LEN:
                         ret = GET_RX_DESC_PKT_LEN(pdesc);
                         break;
+                case HW_DESC_RXBUFF_ADDR:
+                        ret = GET_RX_STATUS_DESC_BUFF_ADDR(pdesc);
+                        break;
                 default:
                         RT_ASSERT(false, "ERR rxdesc :%d not process\n",
                                   desc_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 04aa0b5f5b3d..873363acbacf 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1592,6 +1592,20 @@ void rtl92cu_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
         }
 }
 
+bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+  /* Currently nothing happens here.
+   * Traffic stops after some seconds in WPA2 802.11n mode.
+   * Maybe because rtl8192cu chip should be set from here?
+   * If I understand correctly, the realtek vendor driver sends some urbs
+   * if its "here".
+   *
+   * This is maybe necessary:
+   * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb);
+   */
+        return true;
+}
+
 void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1939,7 +1953,8 @@ void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                         recover = true;
                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
                                                tmp_reg422 & (~BIT(6)));
-                                rtl92c_set_fw_rsvdpagepkt(hw, 0);
+                                rtl92c_set_fw_rsvdpagepkt(hw,
+                                                          &usb_cmd_send_packet);
                                 _rtl92cu_set_bcn_ctrl_reg(hw, BIT(3), 0);
                                 _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
                                 if (recover)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
index 0f7812e0c8aa..c1e33b0228c0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
@@ -104,7 +104,6 @@ bool rtl92cu_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 * valid);
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid);
 int rtl92c_download_fw(struct ieee80211_hw *hw);
 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished);
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw,
                          u8 element_id, u32 cmd_len, u8 *p_cmdbuffer);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 7c5fbaf5fee0..e06bafee37f9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -101,6 +101,12 @@ static void rtl92cu_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+/* get bt coexist status */
+static bool rtl92cu_get_btc_status(void)
+{
+        return false;
+}
+
 static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .init_sw_vars = rtl92cu_init_sw_vars,
         .deinit_sw_vars = rtl92cu_deinit_sw_vars,
@@ -148,6 +154,7 @@ static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .phy_set_bw_mode_callback = rtl92cu_phy_set_bw_mode_callback,
         .dm_dynamic_txpower = rtl92cu_dm_dynamic_txpower,
         .fill_h2c_cmd = rtl92c_fill_h2c_cmd,
+        .get_btc_status = rtl92cu_get_btc_status,
 };
 
 static struct rtl_mod_params rtl92cu_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index edab5a5351b5..a0aba088259a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -251,6 +251,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = {
         .get_rfreg = rtl92d_phy_query_rf_reg,
         .set_rfreg = rtl92d_phy_set_rf_reg,
         .linked_set_reg = rtl92d_linked_set_reg,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92de_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
index dfdc9b20e4ad..1a87edca2c3f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
@@ -362,7 +362,7 @@ void rtl92ee_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 }
                 break;
         default:
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "switch case not process %x\n", variable);
                 break;
         }
@@ -591,7 +591,7 @@ void rtl92ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                 acm_ctrl &= (~ACMHW_BEQEN);
                                 break;
                         default:
-                                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                          "switch case not process\n");
                                 break;
                         }
@@ -710,7 +710,7 @@ void rtl92ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 }
                 break;
         default:
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "switch case not process %x\n", variable);
                 break;
         }
@@ -2424,7 +2424,7 @@ void rtl92ee_set_key(struct ieee80211_hw *hw, u32 key_index,
                         enc_algo = CAM_AES;
                         break;
                 default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                  "switch case not process\n");
                         enc_algo = CAM_TKIP;
                         break;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/def.h b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
index 83c98674bfd3..6e7a70b43949 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
@@ -446,6 +446,8 @@
 /* DWORD 6 */
 #define SET_RX_STATUS__DESC_BUFF_ADDR(__pdesc, __val)   \
         SET_BITS_OFFSET_LE(__pdesc + 24, 0, 32, __val)
+#define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc)                   \
+        SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define SE_RX_HAL_IS_CCK_RATE(_pdesc)\
         (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE1M ||  \
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 00e067044c08..5761d5b49e39 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -1201,6 +1201,9 @@ static int _rtl92se_set_media_status(struct ieee80211_hw *hw,
 
         }
 
+        if (type != NL80211_IFTYPE_AP &&
+            rtlpriv->mac80211.link_state < MAC80211_LINKED)
+                bt_msr = rtl_read_byte(rtlpriv, MSR) & ~MSR_LINK_MASK;
         rtl_write_byte(rtlpriv, (MSR), bt_msr);
 
         temp = rtl_read_dword(rtlpriv, TCR);
@@ -1262,6 +1265,7 @@ void rtl92se_enable_interrupt(struct ieee80211_hw *hw)
         rtl_write_dword(rtlpriv, INTA_MASK, rtlpci->irq_mask[0]);
         /* Support Bit 32-37(Assign as Bit 0-5) interrupt setting now */
         rtl_write_dword(rtlpriv, INTA_MASK + 4, rtlpci->irq_mask[1] & 0x3F);
+        rtlpci->irq_enabled = true;
 }
 
 void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
@@ -1276,8 +1280,7 @@ void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
         rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         rtl_write_dword(rtlpriv, INTA_MASK, 0);
         rtl_write_dword(rtlpriv, INTA_MASK + 4, 0);
-
-        synchronize_irq(rtlpci->pdev->irq);
+        rtlpci->irq_enabled = false;
 }
 
 static u8 _rtl92s_set_sysclk(struct ieee80211_hw *hw, u8 data)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
index 77c5b5f35244..4b4612fe2fdb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
@@ -399,6 +399,8 @@ static bool _rtl92s_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
                 case 2:
                         currentcmd = &postcommoncmd[*step];
                         break;
+                default:
+                        return true;
                 }
 
                 if (currentcmd->cmdid == CMDID_END) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index 1bff2a0f7600..fb003868bdef 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -87,11 +87,8 @@ static void rtl92s_init_aspm_vars(struct ieee80211_hw *hw)
 static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
 {
         struct ieee80211_hw *hw = context;
-        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(pcipriv);
         struct rt_firmware *pfirmware = NULL;
-        int err;
 
         RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
                          "Firmware callback routine entered!\n");
@@ -112,20 +109,6 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
         memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size);
         pfirmware->sz_fw_tmpbufferlen = firmware->size;
         release_firmware(firmware);
-
-        err = ieee80211_register_hw(hw);
-        if (err) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Can't register mac80211 hw\n");
-                return;
-        } else {
-                rtlpriv->mac80211.mac80211_registered = 1;
-        }
-        rtlpci->irq_alloc = 1;
-        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
-
-        /*init rfkill */
-        rtl_init_rfkill(hw);
 }
 
 static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
@@ -226,8 +209,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
         if (!rtlpriv->rtlhal.pfirmware)
                 return 1;
 
-        rtlpriv->max_fw_size = RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE;
-
+        rtlpriv->max_fw_size = RTL8190_MAX_FIRMWARE_CODE_SIZE*2 +
+                               sizeof(struct fw_hdr);
         pr_info("Driver for Realtek RTL8192SE/RTL8191SE\n"
                 "Loading firmware %s\n", rtlpriv->cfg->fw_name);
         /* request fw */
@@ -253,6 +236,19 @@ static void rtl92s_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+static bool rtl92se_is_tx_desc_closed(struct ieee80211_hw *hw, u8 hw_queue,
+                                      u16 index)
+{
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+        u8 *entry = (u8 *)(&ring->desc[ring->idx]);
+        u8 own = (u8)rtl92se_get_desc(entry, true, HW_DESC_OWN);
+
+        if (own)
+                return false;
+        return true;
+}
+
 static struct rtl_hal_ops rtl8192se_hal_ops = {
         .init_sw_vars = rtl92s_init_sw_vars,
         .deinit_sw_vars = rtl92s_deinit_sw_vars,
@@ -286,6 +282,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .led_control = rtl92se_led_control,
         .set_desc = rtl92se_set_desc,
         .get_desc = rtl92se_get_desc,
+        .is_tx_desc_closed = rtl92se_is_tx_desc_closed,
         .tx_polling = rtl92se_tx_polling,
         .enable_hw_sec = rtl92se_enable_hw_security_config,
         .set_key = rtl92se_set_key,
@@ -294,6 +291,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .set_bbreg = rtl92s_phy_set_bb_reg,
         .get_rfreg = rtl92s_phy_query_rf_reg,
         .set_rfreg = rtl92s_phy_set_rf_reg,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92se_mod_params = {
@@ -322,6 +320,8 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
         .maps[MAC_RCR_ACRC32] = RCR_ACRC32,
         .maps[MAC_RCR_ACF] = RCR_ACF,
         .maps[MAC_RCR_AAP] = RCR_AAP,
+        .maps[MAC_HIMR] = INTA_MASK,
+        .maps[MAC_HIMRE] = INTA_MASK + 4,
 
         .maps[EFUSE_TEST] = REG_EFUSE_TEST,
         .maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index b358ebce8942..672fd3b02835 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -640,6 +640,9 @@ u32 rtl92se_get_desc(u8 *desc, bool istx, u8 desc_name)
                 case HW_DESC_RXPKT_LEN:
                         ret = GET_RX_STATUS_DESC_PKT_LEN(desc);
                         break;
+                case HW_DESC_RXBUFF_ADDR:
+                        ret = GET_RX_STATUS_DESC_BUFF_ADDR(desc);
+                        break;
                 default:
                         RT_ASSERT(false, "ERR rxdesc :%d not process\n",
                                   desc_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
index 310d3163dc5b..8ec8200002c7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
@@ -3672,8 +3672,9 @@ static void rtl8821ae_update_hal_rate_mask(struct ieee80211_hw *hw,
                 mac->opmode == NL80211_IFTYPE_ADHOC)
                 macid = sta->aid + 1;
         if (wirelessmode == WIRELESS_MODE_N_5G ||
-            wirelessmode == WIRELESS_MODE_AC_5G)
-                ratr_bitmap = sta->supp_rates[NL80211_BAND_5GHZ];
+            wirelessmode == WIRELESS_MODE_AC_5G ||
+            wirelessmode == WIRELESS_MODE_A)
+                ratr_bitmap = sta->supp_rates[NL80211_BAND_5GHZ] << 4;
         else
                 ratr_bitmap = sta->supp_rates[NL80211_BAND_2GHZ];
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
index 9786313dc62f..1e9570fa874f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
@@ -1889,15 +1889,18 @@ static void _rtl8821ae_store_tx_power_by_rate(struct ieee80211_hw *hw,
         struct rtl_phy *rtlphy = &rtlpriv->phy;
         u8 rate_section = _rtl8821ae_get_rate_section_index(regaddr);
 
-        if (band != BAND_ON_2_4G && band != BAND_ON_5G)
+        if (band != BAND_ON_2_4G && band != BAND_ON_5G) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid Band %d\n", band);
-
-        if (rfpath >= MAX_RF_PATH)
+                band = BAND_ON_2_4G;
+        }
+        if (rfpath >= MAX_RF_PATH) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid RfPath %d\n", rfpath);
-
-        if (txnum >= MAX_RF_PATH)
+                rfpath = MAX_RF_PATH - 1;
+        }
+        if (txnum >= MAX_RF_PATH) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid TxNum %d\n", txnum);
-
+                txnum = MAX_RF_PATH - 1;
+        }
         rtlphy->tx_power_by_rate_offset[band][rfpath][txnum][rate_section] = data;
         RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                  "TxPwrByRateOffset[Band %d][RfPath %d][TxNum %d][RateSection %d] = 0x%x\n",
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 10cf69c4bc42..46ee956d0235 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -1117,7 +1117,18 @@ int rtl_usb_probe(struct usb_interface *intf,
         }
         rtlpriv->cfg->ops->init_sw_leds(hw);
 
+        err = ieee80211_register_hw(hw);
+        if (err) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Can't register mac80211 hw.\n");
+                err = -ENODEV;
+                goto error_out;
+        }
+        rtlpriv->mac80211.mac80211_registered = 1;
+
+        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
         return 0;
+
 error_out:
         rtl_deinit_core(hw);
         _rtl_usb_io_handler_release(hw);
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index d4eb8d2e9cb7..083ecc93fe5e 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -176,10 +176,11 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         char rx_irq_name[IRQ_NAME_SIZE]; /* DEVNAME-qN-rx */
         struct xen_netif_rx_back_ring rx;
         struct sk_buff_head rx_queue;
-        RING_IDX rx_last_skb_slots;
-        unsigned long status;
 
-        struct timer_list rx_stalled;
+        unsigned int rx_queue_max;
+        unsigned int rx_queue_len;
+        unsigned long last_rx_time;
+        bool stalled;
 
         struct gnttab_copy grant_copy_op[MAX_GRANT_COPY_OPS];
 
@@ -199,18 +200,14 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         struct xenvif_stats stats;
 };
 
+/* Maximum number of Rx slots a to-guest packet may use, including the
+ * slot needed for GSO meta-data.
+ */
+#define XEN_NETBK_RX_SLOTS_MAX (MAX_SKB_FRAGS + 1)
+
 enum state_bit_shift {
         /* This bit marks that the vif is connected */
         VIF_STATUS_CONNECTED,
-        /* This bit signals the RX thread that queuing was stopped (in
-         * start_xmit), and either the timer fired or an RX interrupt came
-         */
-        QUEUE_STATUS_RX_PURGE_EVENT,
-        /* This bit tells the interrupt handler that this queue was the reason
-         * for the carrier off, so it should kick the thread. Only queues which
-         * brought it down can turn on the carrier.
-         */
-        QUEUE_STATUS_RX_STALLED
 };
 
 struct xenvif {
@@ -228,9 +225,6 @@ struct xenvif {
         u8 ip_csum:1;
         u8 ipv6_csum:1;
 
-        /* Internal feature information. */
-        u8 can_queue:1;     /* can queue packets for receiver? */
-
         /* Is this interface disabled? True when backend discovers
          * frontend is rogue.
          */
@@ -240,6 +234,9 @@ struct xenvif {
         /* Queues */
         struct xenvif_queue *queues;
         unsigned int num_queues; /* active queues, resource allocated */
+        unsigned int stalled_queues;
+
+        spinlock_t lock;
 
 #ifdef CONFIG_DEBUG_FS
         struct dentry *xenvif_dbg_root;
@@ -249,6 +246,14 @@ struct xenvif {
         struct net_device *dev;
 };
 
+struct xenvif_rx_cb {
+        unsigned long expires;
+        int meta_slots_used;
+        bool full_coalesce;
+};
+
+#define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb)
+
 static inline struct xenbus_device *xenvif_to_xenbus_device(struct xenvif *vif)
 {
         return to_xenbus_device(vif->dev->dev.parent);
@@ -272,8 +277,6 @@ void xenvif_xenbus_fini(void);
 
 int xenvif_schedulable(struct xenvif *vif);
 
-int xenvif_must_stop_queue(struct xenvif_queue *queue);
-
 int xenvif_queue_stopped(struct xenvif_queue *queue);
 void xenvif_wake_queue(struct xenvif_queue *queue);
 
@@ -296,6 +299,8 @@ void xenvif_kick_thread(struct xenvif_queue *queue);
 
 int xenvif_dealloc_kthread(void *data);
 
+void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
+
 /* Determine whether the needed number of slots (req) are available,
  * and set req_event if not.
  */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f379689dde30..895fe84011e7 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -43,6 +43,9 @@
 #define XENVIF_QUEUE_LENGTH 32
 #define XENVIF_NAPI_WEIGHT  64
 
+/* Number of bytes allowed on the internal guest Rx queue. */
+#define XENVIF_RX_QUEUE_BYTES (XEN_NETIF_RX_RING_SIZE/2 * PAGE_SIZE)
+
 /* This function is used to set SKBTX_DEV_ZEROCOPY as well as
  * increasing the inflight counter. We need to increase the inflight
  * counter because core driver calls into xenvif_zerocopy_callback
@@ -60,20 +63,11 @@ void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue)
         atomic_dec(&queue->inflight_packets);
 }
 
-static inline void xenvif_stop_queue(struct xenvif_queue *queue)
-{
-        struct net_device *dev = queue->vif->dev;
-
-        if (!queue->vif->can_queue)
-                return;
-
-        netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
-}
-
 int xenvif_schedulable(struct xenvif *vif)
 {
         return netif_running(vif->dev) &&
-                test_bit(VIF_STATUS_CONNECTED, &vif->status);
+                test_bit(VIF_STATUS_CONNECTED, &vif->status) &&
+                !vif->disabled;
 }
 
 static irqreturn_t xenvif_tx_interrupt(int irq, void *dev_id)
@@ -114,16 +108,7 @@ int xenvif_poll(struct napi_struct *napi, int budget)
 static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id)
 {
         struct xenvif_queue *queue = dev_id;
-        struct netdev_queue *net_queue =
-                netdev_get_tx_queue(queue->vif->dev, queue->id);
 
-        /* QUEUE_STATUS_RX_PURGE_EVENT is only set if either QDisc was off OR
-         * the carrier went down and this queue was previously blocked
-         */
-        if (unlikely(netif_tx_queue_stopped(net_queue) ||
-                     (!netif_carrier_ok(queue->vif->dev) &&
-                      test_bit(QUEUE_STATUS_RX_STALLED, &queue->status))))
-                set_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status);
         xenvif_kick_thread(queue);
 
         return IRQ_HANDLED;
@@ -151,24 +136,13 @@ void xenvif_wake_queue(struct xenvif_queue *queue)
         netif_tx_wake_queue(netdev_get_tx_queue(dev, id));
 }
 
-/* Callback to wake the queue's thread and turn the carrier off on timeout */
-static void xenvif_rx_stalled(unsigned long data)
-{
-        struct xenvif_queue *queue = (struct xenvif_queue *)data;
-
-        if (xenvif_queue_stopped(queue)) {
-                set_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status);
-                xenvif_kick_thread(queue);
-        }
-}
-
 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
         unsigned int num_queues = vif->num_queues;
         u16 index;
-        int min_slots_needed;
+        struct xenvif_rx_cb *cb;
 
         BUG_ON(skb->dev != dev);
 
@@ -191,30 +165,10 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
             !xenvif_schedulable(vif))
                 goto drop;
 
-        /* At best we'll need one slot for the header and one for each
-         * frag.
-         */
-        min_slots_needed = 1 + skb_shinfo(skb)->nr_frags;
-
-        /* If the skb is GSO then we'll also need an extra slot for the
-         * metadata.
-         */
-        if (skb_is_gso(skb))
-                min_slots_needed++;
+        cb = XENVIF_RX_CB(skb);
+        cb->expires = jiffies + rx_drain_timeout_jiffies;
 
-        /* If the skb can't possibly fit in the remaining slots
-         * then turn off the queue to give the ring a chance to
-         * drain.
-         */
-        if (!xenvif_rx_ring_slots_available(queue, min_slots_needed)) {
-                queue->rx_stalled.function = xenvif_rx_stalled;
-                queue->rx_stalled.data = (unsigned long)queue;
-                xenvif_stop_queue(queue);
-                mod_timer(&queue->rx_stalled,
-                          jiffies + rx_drain_timeout_jiffies);
-        }
-
-        skb_queue_tail(&queue->rx_queue, skb);
+        xenvif_rx_queue_tail(queue, skb);
         xenvif_kick_thread(queue);
 
         return NETDEV_TX_OK;
@@ -465,6 +419,8 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->queues = NULL;
         vif->num_queues = 0;
 
+        spin_lock_init(&vif->lock);
+
         dev->netdev_ops = &xenvif_netdev_ops;
         dev->hw_features = NETIF_F_SG |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
@@ -508,6 +464,8 @@ int xenvif_init_queue(struct xenvif_queue *queue)
         init_timer(&queue->credit_timeout);
         queue->credit_window_start = get_jiffies_64();
 
+        queue->rx_queue_max = XENVIF_RX_QUEUE_BYTES;
+
         skb_queue_head_init(&queue->rx_queue);
         skb_queue_head_init(&queue->tx_queue);
 
@@ -539,8 +497,6 @@ int xenvif_init_queue(struct xenvif_queue *queue)
                 queue->grant_tx_handle[i] = NETBACK_INVALID_HANDLE;
         }
 
-        init_timer(&queue->rx_stalled);
-
         return 0;
 }
 
@@ -551,7 +507,6 @@ void xenvif_carrier_on(struct xenvif *vif)
                 dev_set_mtu(vif->dev, ETH_DATA_LEN);
         netdev_update_features(vif->dev);
         set_bit(VIF_STATUS_CONNECTED, &vif->status);
-        netif_carrier_on(vif->dev);
         if (netif_running(vif->dev))
                 xenvif_up(vif);
         rtnl_unlock();
@@ -611,6 +566,8 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
                 disable_irq(queue->rx_irq);
         }
 
+        queue->stalled = true;
+
         task = kthread_create(xenvif_kthread_guest_rx,
                               (void *)queue, "%s-guest-rx", queue->name);
         if (IS_ERR(task)) {
@@ -674,7 +631,6 @@ void xenvif_disconnect(struct xenvif *vif)
                 netif_napi_del(&queue->napi);
 
                 if (queue->task) {
-                        del_timer_sync(&queue->rx_stalled);
                         kthread_stop(queue->task);
                         queue->task = NULL;
                 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 08f65996534c..6563f0713fc0 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -55,13 +55,20 @@
 bool separate_tx_rx_irq = 1;
 module_param(separate_tx_rx_irq, bool, 0644);
 
-/* When guest ring is filled up, qdisc queues the packets for us, but we have
- * to timeout them, otherwise other guests' packets can get stuck there
+/* The time that packets can stay on the guest Rx internal queue
+ * before they are dropped.
  */
 unsigned int rx_drain_timeout_msecs = 10000;
 module_param(rx_drain_timeout_msecs, uint, 0444);
 unsigned int rx_drain_timeout_jiffies;
 
+/* The length of time before the frontend is considered unresponsive
+ * because it isn't providing Rx slots.
+ */
+static unsigned int rx_stall_timeout_msecs = 60000;
+module_param(rx_stall_timeout_msecs, uint, 0444);
+static unsigned int rx_stall_timeout_jiffies;
+
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -83,7 +90,6 @@ static void make_tx_response(struct xenvif_queue *queue,
                              s8       st);
 
 static inline int tx_work_todo(struct xenvif_queue *queue);
-static inline int rx_work_todo(struct xenvif_queue *queue);
 
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                              u16      id,
@@ -163,6 +169,69 @@ bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue, int needed)
         return false;
 }
 
+void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+        __skb_queue_tail(&queue->rx_queue, skb);
+
+        queue->rx_queue_len += skb->len;
+        if (queue->rx_queue_len > queue->rx_queue_max)
+                netif_tx_stop_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));
+
+        spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+}
+
+static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+
+        spin_lock_irq(&queue->rx_queue.lock);
+
+        skb = __skb_dequeue(&queue->rx_queue);
+        if (skb)
+                queue->rx_queue_len -= skb->len;
+
+        spin_unlock_irq(&queue->rx_queue.lock);
+
+        return skb;
+}
+
+static void xenvif_rx_queue_maybe_wake(struct xenvif_queue *queue)
+{
+        spin_lock_irq(&queue->rx_queue.lock);
+
+        if (queue->rx_queue_len < queue->rx_queue_max)
+                netif_tx_wake_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));
+
+        spin_unlock_irq(&queue->rx_queue.lock);
+}
+
+
+static void xenvif_rx_queue_purge(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+        while ((skb = xenvif_rx_dequeue(queue)) != NULL)
+                kfree_skb(skb);
+}
+
+static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+
+        for(;;) {
+                skb = skb_peek(&queue->rx_queue);
+                if (!skb)
+                        break;
+                if (time_before(jiffies, XENVIF_RX_CB(skb)->expires))
+                        break;
+                xenvif_rx_dequeue(queue);
+                kfree_skb(skb);
+        }
+}
+
 /*
  * Returns true if we should start a new receive buffer instead of
  * adding 'size' bytes to a buffer which currently contains 'offset'
@@ -237,13 +306,6 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
         return meta;
 }
 
-struct xenvif_rx_cb {
-        int meta_slots_used;
-        bool full_coalesce;
-};
-
-#define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb)
-
 /*
  * Set up the grant operations for this fragment. If it's a flipping
  * interface, we also set up the unmap request from here.
@@ -587,12 +649,15 @@ static void xenvif_rx_action(struct xenvif_queue *queue)
 
         skb_queue_head_init(&rxq);
 
-        while ((skb = skb_dequeue(&queue->rx_queue)) != NULL) {
+        while (xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX)
+               && (skb = xenvif_rx_dequeue(queue)) != NULL) {
                 RING_IDX max_slots_needed;
                 RING_IDX old_req_cons;
                 RING_IDX ring_slots_used;
                 int i;
 
+                queue->last_rx_time = jiffies;
+
                 /* We need a cheap worse case estimate for the number of
                  * slots we'll use.
                  */
@@ -634,15 +699,6 @@ static void xenvif_rx_action(struct xenvif_queue *queue)
                     skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
                         max_slots_needed++;
 
-                /* If the skb may not fit then bail out now */
-                if (!xenvif_rx_ring_slots_available(queue, max_slots_needed)) {
-                        skb_queue_head(&queue->rx_queue, skb);
-                        need_to_notify = true;
-                        queue->rx_last_skb_slots = max_slots_needed;
-                        break;
-                } else
-                        queue->rx_last_skb_slots = 0;
-
                 old_req_cons = queue->rx.req_cons;
                 XENVIF_RX_CB(skb)->meta_slots_used = xenvif_gop_skb(skb, &npo, queue);
                 ring_slots_used = queue->rx.req_cons - old_req_cons;
@@ -1869,12 +1925,6 @@ void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
         }
 }
 
-static inline int rx_work_todo(struct xenvif_queue *queue)
-{
-        return (!skb_queue_empty(&queue->rx_queue) &&
-               xenvif_rx_ring_slots_available(queue, queue->rx_last_skb_slots));
-}
-
 static inline int tx_work_todo(struct xenvif_queue *queue)
 {
         if (likely(RING_HAS_UNCONSUMED_REQUESTS(&queue->tx)))
@@ -1931,92 +1981,121 @@ err:
         return err;
 }
 
-static void xenvif_start_queue(struct xenvif_queue *queue)
+static void xenvif_queue_carrier_off(struct xenvif_queue *queue)
 {
-        if (xenvif_schedulable(queue->vif))
-                xenvif_wake_queue(queue);
+        struct xenvif *vif = queue->vif;
+
+        queue->stalled = true;
+
+        /* At least one queue has stalled? Disable the carrier. */
+        spin_lock(&vif->lock);
+        if (vif->stalled_queues++ == 0) {
+                netdev_info(vif->dev, "Guest Rx stalled");
+                netif_carrier_off(vif->dev);
+        }
+        spin_unlock(&vif->lock);
 }
 
-/* Only called from the queue's thread, it handles the situation when the guest
- * doesn't post enough requests on the receiving ring.
- * First xenvif_start_xmit disables QDisc and start a timer, and then either the
- * timer fires, or the guest send an interrupt after posting new request. If it
- * is the timer, the carrier is turned off here.
- * */
-static void xenvif_rx_purge_event(struct xenvif_queue *queue)
+static void xenvif_queue_carrier_on(struct xenvif_queue *queue)
 {
-        /* Either the last unsuccesful skb or at least 1 slot should fit */
-        int needed = queue->rx_last_skb_slots ?
-                     queue->rx_last_skb_slots : 1;
+        struct xenvif *vif = queue->vif;
 
-        /* It is assumed that if the guest post new slots after this, the RX
-         * interrupt will set the QUEUE_STATUS_RX_PURGE_EVENT bit and wake up
-         * the thread again
-         */
-        set_bit(QUEUE_STATUS_RX_STALLED, &queue->status);
-        if (!xenvif_rx_ring_slots_available(queue, needed)) {
-                rtnl_lock();
-                if (netif_carrier_ok(queue->vif->dev)) {
-                        /* Timer fired and there are still no slots. Turn off
-                         * everything except the interrupts
-                         */
-                        netif_carrier_off(queue->vif->dev);
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                        if (net_ratelimit())
-                                netdev_err(queue->vif->dev, "Carrier off due to lack of guest response on queue %d\n", queue->id);
-                } else {
-                        /* Probably an another queue already turned the carrier
-                         * off, make sure nothing is stucked in the internal
-                         * queue of this queue
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                }
-                rtnl_unlock();
-        } else if (!netif_carrier_ok(queue->vif->dev)) {
-                unsigned int num_queues = queue->vif->num_queues;
-                unsigned int i;
-                /* The carrier was down, but an interrupt kicked
-                 * the thread again after new requests were
-                 * posted
-                 */
-                clear_bit(QUEUE_STATUS_RX_STALLED,
-                          &queue->status);
-                rtnl_lock();
-                netif_carrier_on(queue->vif->dev);
-                netif_tx_wake_all_queues(queue->vif->dev);
-                rtnl_unlock();
+        queue->last_rx_time = jiffies; /* Reset Rx stall detection. */
+        queue->stalled = false;
 
-                for (i = 0; i < num_queues; i++) {
-                        struct xenvif_queue *temp = &queue->vif->queues[i];
+        /* All queues are ready? Enable the carrier. */
+        spin_lock(&vif->lock);
+        if (--vif->stalled_queues == 0) {
+                netdev_info(vif->dev, "Guest Rx ready");
+                netif_carrier_on(vif->dev);
+        }
+        spin_unlock(&vif->lock);
+}
 
-                        xenvif_napi_schedule_or_enable_events(temp);
-                }
-                if (net_ratelimit())
-                        netdev_err(queue->vif->dev, "Carrier on again\n");
-        } else {
-                /* Queuing were stopped, but the guest posted
-                 * new requests and sent an interrupt
-                 */
-                clear_bit(QUEUE_STATUS_RX_STALLED,
-                          &queue->status);
-                del_timer_sync(&queue->rx_stalled);
-                xenvif_start_queue(queue);
+static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
+{
+        RING_IDX prod, cons;
+
+        prod = queue->rx.sring->req_prod;
+        cons = queue->rx.req_cons;
+
+        return !queue->stalled
+                && prod - cons < XEN_NETBK_RX_SLOTS_MAX
+                && time_after(jiffies,
+                              queue->last_rx_time + rx_stall_timeout_jiffies);
+}
+
+static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
+{
+        RING_IDX prod, cons;
+
+        prod = queue->rx.sring->req_prod;
+        cons = queue->rx.req_cons;
+
+        return queue->stalled
+                && prod - cons >= XEN_NETBK_RX_SLOTS_MAX;
+}
+
+static bool xenvif_have_rx_work(struct xenvif_queue *queue)
+{
+        return (!skb_queue_empty(&queue->rx_queue)
+                && xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX))
+                || xenvif_rx_queue_stalled(queue)
+                || xenvif_rx_queue_ready(queue)
+                || kthread_should_stop()
+                || queue->vif->disabled;
+}
+
+static long xenvif_rx_queue_timeout(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+        long timeout;
+
+        skb = skb_peek(&queue->rx_queue);
+        if (!skb)
+                return MAX_SCHEDULE_TIMEOUT;
+
+        timeout = XENVIF_RX_CB(skb)->expires - jiffies;
+        return timeout < 0 ? 0 : timeout;
+}
+
+/* Wait until the guest Rx thread has work.
+ *
+ * The timeout needs to be adjusted based on the current head of the
+ * queue (and not just the head at the beginning).  In particular, if
+ * the queue is initially empty an infinite timeout is used and this
+ * needs to be reduced when a skb is queued.
+ *
+ * This cannot be done with wait_event_timeout() because it only
+ * calculates the timeout once.
+ */
+static void xenvif_wait_for_rx_work(struct xenvif_queue *queue)
+{
+        DEFINE_WAIT(wait);
+
+        if (xenvif_have_rx_work(queue))
+                return;
+
+        for (;;) {
+                long ret;
+
+                prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE);
+                if (xenvif_have_rx_work(queue))
+                        break;
+                ret = schedule_timeout(xenvif_rx_queue_timeout(queue));
+                if (!ret)
+                        break;
         }
+        finish_wait(&queue->wq, &wait);
 }
 
 int xenvif_kthread_guest_rx(void *data)
 {
         struct xenvif_queue *queue = data;
-        struct sk_buff *skb;
+        struct xenvif *vif = queue->vif;
 
-        while (!kthread_should_stop()) {
-                wait_event_interruptible(queue->wq,
-                                         rx_work_todo(queue) ||
-                                         queue->vif->disabled ||
-                                         test_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status) ||
-                                         kthread_should_stop());
+        for (;;) {
+                xenvif_wait_for_rx_work(queue);
 
                 if (kthread_should_stop())
                         break;
@@ -2028,35 +2107,38 @@ int xenvif_kthread_guest_rx(void *data)
                  * context so we defer it here, if this thread is
                  * associated with queue 0.
                  */
-                if (unlikely(queue->vif->disabled && queue->id == 0)) {
-                        xenvif_carrier_off(queue->vif);
-                } else if (unlikely(queue->vif->disabled)) {
-                        /* kthread_stop() would be called upon this thread soon,
-                         * be a bit proactive
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                } else if (unlikely(test_and_clear_bit(QUEUE_STATUS_RX_PURGE_EVENT,
-                                                     &queue->status))) {
-                        xenvif_rx_purge_event(queue);
-                } else if (!netif_carrier_ok(queue->vif->dev)) {
-                        /* Another queue stalled and turned the carrier off, so
-                         * purge the internal queue of queues which were not
-                         * blocked
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
+                if (unlikely(vif->disabled && queue->id == 0)) {
+                        xenvif_carrier_off(vif);
+                        xenvif_rx_queue_purge(queue);
+                        continue;
                 }
 
                 if (!skb_queue_empty(&queue->rx_queue))
                         xenvif_rx_action(queue);
 
+                /* If the guest hasn't provided any Rx slots for a
+                 * while it's probably not responsive, drop the
+                 * carrier so packets are dropped earlier.
+                 */
+                if (xenvif_rx_queue_stalled(queue))
+                        xenvif_queue_carrier_off(queue);
+                else if (xenvif_rx_queue_ready(queue))
+                        xenvif_queue_carrier_on(queue);
+
+                /* Queued packets may have foreign pages from other
+                 * domains.  These cannot be queued indefinitely as
+                 * this would starve guests of grant refs and transmit
+                 * slots.
+                 */
+                xenvif_rx_queue_drop_expired(queue);
+
+                xenvif_rx_queue_maybe_wake(queue);
+
                 cond_resched();
         }
 
         /* Bin any remaining skbs */
-        while ((skb = skb_dequeue(&queue->rx_queue)) != NULL)
-                dev_kfree_skb(skb);
+        xenvif_rx_queue_purge(queue);
 
         return 0;
 }
@@ -2113,6 +2195,7 @@ static int __init netback_init(void)
                 goto failed_init;
 
         rx_drain_timeout_jiffies = msecs_to_jiffies(rx_drain_timeout_msecs);
+        rx_stall_timeout_jiffies = msecs_to_jiffies(rx_stall_timeout_msecs);
 
 #ifdef CONFIG_DEBUG_FS
         xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 8079c31ac5e6..fab0d4b42f58 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -39,7 +39,7 @@ struct backend_info {
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue);
 static void connect(struct backend_info *be);
 static int read_xenbus_vif_flags(struct backend_info *be);
-static void backend_create_xenvif(struct backend_info *be);
+static int backend_create_xenvif(struct backend_info *be);
 static void unregister_hotplug_status_watch(struct backend_info *be);
 static void set_backend_state(struct backend_info *be,
                               enum xenbus_state state);
@@ -52,6 +52,7 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v)
         struct xenvif_queue *queue = m->private;
         struct xen_netif_tx_back_ring *tx_ring = &queue->tx;
         struct xen_netif_rx_back_ring *rx_ring = &queue->rx;
+        struct netdev_queue *dev_queue;
 
         if (tx_ring->sring) {
                 struct xen_netif_tx_sring *sring = tx_ring->sring;
@@ -112,6 +113,13 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v)
                    queue->credit_timeout.expires,
                    jiffies);
 
+        dev_queue = netdev_get_tx_queue(queue->vif->dev, queue->id);
+
+        seq_printf(m, "\nRx internal queue: len %u max %u pkts %u %s\n",
+                   queue->rx_queue_len, queue->rx_queue_max,
+                   skb_queue_len(&queue->rx_queue),
+                   netif_tx_queue_stopped(dev_queue) ? "stopped" : "running");
+
         return 0;
 }
 
@@ -344,7 +352,9 @@ static int netback_probe(struct xenbus_device *dev,
         be->state = XenbusStateInitWait;
 
         /* This kicks hotplug scripts, so do it immediately. */
-        backend_create_xenvif(be);
+        err = backend_create_xenvif(be);
+        if (err)
+                goto fail;
 
         return 0;
 
@@ -389,19 +399,19 @@ static int netback_uevent(struct xenbus_device *xdev,
 }
 
 
-static void backend_create_xenvif(struct backend_info *be)
+static int backend_create_xenvif(struct backend_info *be)
 {
         int err;
         long handle;
         struct xenbus_device *dev = be->dev;
 
         if (be->vif != NULL)
-                return;
+                return 0;
 
         err = xenbus_scanf(XBT_NIL, dev->nodename, "handle", "%li", &handle);
         if (err != 1) {
                 xenbus_dev_fatal(dev, err, "reading handle");
-                return;
+                return (err < 0) ? err : -EINVAL;
         }
 
         be->vif = xenvif_alloc(&dev->dev, dev->otherend_id, handle);
@@ -409,10 +419,11 @@ static void backend_create_xenvif(struct backend_info *be)
                 err = PTR_ERR(be->vif);
                 be->vif = NULL;
                 xenbus_dev_fatal(dev, err, "creating interface");
-                return;
+                return err;
         }
 
         kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
+        return 0;
 }
 
 static void backend_disconnect(struct backend_info *be)
@@ -703,6 +714,7 @@ static void connect(struct backend_info *be)
         be->vif->queues = vzalloc(requested_num_queues *
                                   sizeof(struct xenvif_queue));
         be->vif->num_queues = requested_num_queues;
+        be->vif->stalled_queues = requested_num_queues;
 
         for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) {
                 queue = &be->vif->queues[queue_index];
@@ -873,15 +885,10 @@ static int read_xenbus_vif_flags(struct backend_info *be)
         if (!rx_copy)
                 return -EOPNOTSUPP;
 
-        if (vif->dev->tx_queue_len != 0) {
-                if (xenbus_scanf(XBT_NIL, dev->otherend,
-                                 "feature-rx-notify", "%d", &val) < 0)
-                        val = 0;
-                if (val)
-                        vif->can_queue = 1;
-                else
-                        /* Must be non-zero for pfifo_fast to work. */
-                        vif->dev->tx_queue_len = 1;
+        if (xenbus_scanf(XBT_NIL, dev->otherend,
+                         "feature-rx-notify", "%d", &val) < 0 || val == 0) {
+                xenbus_dev_fatal(dev, -EINVAL, "feature-rx-notify is mandatory");
+                return -EINVAL;
         }
 
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-sg",
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index cca871346a0f..ece8d1804d13 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -496,9 +496,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue,
                 len = skb_frag_size(frag);
                 offset = frag->page_offset;
 
-                /* Data must not cross a page boundary. */
-                BUG_ON(len + offset > PAGE_SIZE<<compound_order(page));
-
                 /* Skip unused frames from start of page */
                 page += offset >> PAGE_SHIFT;
                 offset &= ~PAGE_MASK;
@@ -506,8 +503,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue,
                 while (len > 0) {
                         unsigned long bytes;
 
-                        BUG_ON(offset >= PAGE_SIZE);
-
                         bytes = PAGE_SIZE - offset;
                         if (bytes > len)
                                 bytes = len;
diff --git a/drivers/of/address.c b/drivers/of/address.c
index afdb78299f61..06af494184d6 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -450,6 +450,21 @@ static struct of_bus *of_match_bus(struct device_node *np)
         return NULL;
 }
 
+static int of_empty_ranges_quirk(void)
+{
+        if (IS_ENABLED(CONFIG_PPC)) {
+                /* To save cycles, we cache the result */
+                static int quirk_state = -1;
+
+                if (quirk_state < 0)
+                        quirk_state =
+                                of_machine_is_compatible("Power Macintosh") ||
+                                of_machine_is_compatible("MacRISC");
+                return quirk_state;
+        }
+        return false;
+}
+
 static int of_translate_one(struct device_node *parent, struct of_bus *bus,
                             struct of_bus *pbus, __be32 *addr,
                             int na, int ns, int pna, const char *rprop)
@@ -475,12 +490,10 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
          * This code is only enabled on powerpc. --gcl
          */
         ranges = of_get_property(parent, rprop, &rlen);
-#if !defined(CONFIG_PPC)
-        if (ranges == NULL) {
+        if (ranges == NULL && !of_empty_ranges_quirk()) {
                 pr_err("OF: no ranges; cannot translate\n");
                 return 1;
         }
-#endif /* !defined(CONFIG_PPC) */
         if (ranges == NULL || rlen == 0) {
                 offset = of_read_number(addr, na);
                 memset(addr, 0, pna * 4);
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 2305dc0382bc..3823edf2d012 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1280,52 +1280,6 @@ int of_property_read_string(struct device_node *np, const char *propname,
 EXPORT_SYMBOL_GPL(of_property_read_string);
 
 /**
- * of_property_read_string_index - Find and read a string from a multiple
- * strings property.
- * @np:         device node from which the property value is to be read.
- * @propname:   name of the property to be searched.
- * @index:      index of the string in the list of strings
- * @out_string: pointer to null terminated return string, modified only if
- *              return value is 0.
- *
- * Search for a property in a device tree node and retrieve a null
- * terminated string value (pointer to data, not a copy) in the list of strings
- * contained in that property.
- * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if
- * property does not have a value, and -EILSEQ if the string is not
- * null-terminated within the length of the property data.
- *
- * The out_string pointer is modified only if a valid string can be decoded.
- */
-int of_property_read_string_index(struct device_node *np, const char *propname,
-                                  int index, const char **output)
-{
-        struct property *prop = of_find_property(np, propname, NULL);
-        int i = 0;
-        size_t l = 0, total = 0;
-        const char *p;
-
-        if (!prop)
-                return -EINVAL;
-        if (!prop->value)
-                return -ENODATA;
-        if (strnlen(prop->value, prop->length) >= prop->length)
-                return -EILSEQ;
-
-        p = prop->value;
-
-        for (i = 0; total < prop->length; total += l, p += l) {
-                l = strlen(p) + 1;
-                if (i++ == index) {
-                        *output = p;
-                        return 0;
-                }
-        }
-        return -ENODATA;
-}
-EXPORT_SYMBOL_GPL(of_property_read_string_index);
-
-/**
  * of_property_match_string() - Find string in a list and return index
  * @np: pointer to node containing string list property
  * @propname: string list property name
@@ -1351,7 +1305,7 @@ int of_property_match_string(struct device_node *np, const char *propname,
         end = p + prop->length;
 
         for (i = 0; p < end; i++, p += l) {
-                l = strlen(p) + 1;
+                l = strnlen(p, end - p) + 1;
                 if (p + l > end)
                         return -EILSEQ;
                 pr_debug("comparing %s with %s\n", string, p);
@@ -1363,39 +1317,41 @@ int of_property_match_string(struct device_node *np, const char *propname,
 EXPORT_SYMBOL_GPL(of_property_match_string);
 
 /**
- * of_property_count_strings - Find and return the number of strings from a
- * multiple strings property.
+ * of_property_read_string_util() - Utility helper for parsing string properties
  * @np:         device node from which the property value is to be read.
  * @propname:   name of the property to be searched.
+ * @out_strs:   output array of string pointers.
+ * @sz:         number of array elements to read.
+ * @skip:       Number of strings to skip over at beginning of list.
  *
- * Search for a property in a device tree node and retrieve the number of null
- * terminated string contain in it. Returns the number of strings on
- * success, -EINVAL if the property does not exist, -ENODATA if property
- * does not have a value, and -EILSEQ if the string is not null-terminated
- * within the length of the property data.
+ * Don't call this function directly. It is a utility helper for the
+ * of_property_read_string*() family of functions.
  */
-int of_property_count_strings(struct device_node *np, const char *propname)
+int of_property_read_string_helper(struct device_node *np, const char *propname,
+                                   const char **out_strs, size_t sz, int skip)
 {
         struct property *prop = of_find_property(np, propname, NULL);
-        int i = 0;
-        size_t l = 0, total = 0;
-        const char *p;
+        int l = 0, i = 0;
+        const char *p, *end;
 
         if (!prop)
                 return -EINVAL;
         if (!prop->value)
                 return -ENODATA;
-        if (strnlen(prop->value, prop->length) >= prop->length)
-                return -EILSEQ;
-
         p = prop->value;
+        end = p + prop->length;
 
-        for (i = 0; total < prop->length; total += l, p += l, i++)
-                l = strlen(p) + 1;
-
-        return i;
+        for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) {
+                l = strnlen(p, end - p) + 1;
+                if (p + l > end)
+                        return -EILSEQ;
+                if (out_strs && i >= skip)
+                        *out_strs++ = p;
+        }
+        i -= skip;
+        return i <= 0 ? -ENODATA : i;
 }
-EXPORT_SYMBOL_GPL(of_property_count_strings);
+EXPORT_SYMBOL_GPL(of_property_read_string_helper);
 
 void of_print_phandle_args(const char *msg, const struct of_phandle_args *args)
 {
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index f297891d8529..d4994177dec2 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -247,7 +247,7 @@ void of_node_release(struct kobject *kobj)
  * @allocflags: Allocation flags (typically pass GFP_KERNEL)
  *
  * Copy a property by dynamically allocating the memory of both the
- * property stucture and the property name & contents. The property's
+ * property structure and the property name & contents. The property's
  * flags have the OF_DYNAMIC bit set so that we can differentiate between
  * dynamically allocated properties and not.
  * Returns the newly allocated property or NULL on out of memory error.
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index d1ffca8b34ea..d134710de96d 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -773,7 +773,7 @@ int __init early_init_dt_scan_chosen_serial(void)
         if (offset < 0)
                 return -ENODEV;
 
-        while (match->compatible) {
+        while (match->compatible[0]) {
                 unsigned long addr;
                 if (fdt_node_check_compatible(fdt, offset, match->compatible)) {
                         match++;
@@ -964,8 +964,6 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size)
 int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
                                         phys_addr_t size, bool nomap)
 {
-        if (memblock_is_region_reserved(base, size))
-                return -EBUSY;
         if (nomap)
                 return memblock_remove(base, size);
         return memblock_reserve(base, size);
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 59fb12e84e6b..dc566b38645f 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -243,23 +243,27 @@ static inline struct reserved_mem *__find_rmem(struct device_node *node)
  * This function assign memory region pointed by "memory-region" device tree
  * property to the given device.
  */
-void of_reserved_mem_device_init(struct device *dev)
+int of_reserved_mem_device_init(struct device *dev)
 {
         struct reserved_mem *rmem;
         struct device_node *np;
+        int ret;
 
         np = of_parse_phandle(dev->of_node, "memory-region", 0);
         if (!np)
-                return;
+                return -ENODEV;
 
         rmem = __find_rmem(np);
         of_node_put(np);
 
         if (!rmem || !rmem->ops || !rmem->ops->device_init)
-                return;
+                return -EINVAL;
+
+        ret = rmem->ops->device_init(rmem, dev);
+        if (ret == 0)
+                dev_info(dev, "assigned reserved memory node %s\n", rmem->name);
 
-        rmem->ops->device_init(rmem, dev);
-        dev_info(dev, "assigned reserved memory node %s\n", rmem->name);
+        return ret;
 }
 
 /**
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index 78001270a598..e2d79afa9dc6 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -339,8 +339,9 @@ static void __init of_selftest_parse_phandle_with_args(void)
         selftest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
 }
 
-static void __init of_selftest_property_match_string(void)
+static void __init of_selftest_property_string(void)
 {
+        const char *strings[4];
         struct device_node *np;
         int rc;
 
@@ -357,13 +358,66 @@ static void __init of_selftest_property_match_string(void)
         rc = of_property_match_string(np, "phandle-list-names", "third");
         selftest(rc == 2, "third expected:0 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "fourth");
-        selftest(rc == -ENODATA, "unmatched string; rc=%i", rc);
+        selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
         rc = of_property_match_string(np, "missing-property", "blah");
-        selftest(rc == -EINVAL, "missing property; rc=%i", rc);
+        selftest(rc == -EINVAL, "missing property; rc=%i\n", rc);
         rc = of_property_match_string(np, "empty-property", "blah");
-        selftest(rc == -ENODATA, "empty property; rc=%i", rc);
+        selftest(rc == -ENODATA, "empty property; rc=%i\n", rc);
         rc = of_property_match_string(np, "unterminated-string", "blah");
-        selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc);
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+
+        /* of_property_count_strings() tests */
+        rc = of_property_count_strings(np, "string-property");
+        selftest(rc == 1, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "phandle-list-names");
+        selftest(rc == 3, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "unterminated-string");
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "unterminated-string-list");
+        selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc);
+
+        /* of_property_read_string_index() tests */
+        rc = of_property_read_string_index(np, "string-property", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "string-property", 1, strings);
+        selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 1, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 2, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "phandle-list-names", 3, strings);
+        selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "unterminated-string", 0, strings);
+        selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */
+        selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[1] = NULL;
+
+        /* of_property_read_string_array() tests */
+        rc = of_property_read_string_array(np, "string-property", strings, 4);
+        selftest(rc == 1, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_read_string_array(np, "phandle-list-names", strings, 4);
+        selftest(rc == 3, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_read_string_array(np, "unterminated-string", strings, 4);
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+        /* -- An incorrectly formed string should cause a failure */
+        rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4);
+        selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc);
+        /* -- parsing the correctly formed strings should still work: */
+        strings[2] = NULL;
+        rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2);
+        selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc);
+        strings[1] = NULL;
+        rc = of_property_read_string_array(np, "phandle-list-names", strings, 1);
+        selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]);
 }
 
 #define propcmp(p1, p2) (((p1)->length == (p2)->length) && \
@@ -842,10 +896,14 @@ static void selftest_data_remove(void)
                 return;
         }
 
-        while (last_node_index >= 0) {
+        while (last_node_index-- > 0) {
                 if (nodes[last_node_index]) {
                         np = of_find_node_by_path(nodes[last_node_index]->full_name);
-                        if (strcmp(np->full_name, "/aliases") != 0) {
+                        if (np == nodes[last_node_index]) {
+                                if (of_aliases == np) {
+                                        of_node_put(of_aliases);
+                                        of_aliases = NULL;
+                                }
                                 detach_node_and_children(np);
                         } else {
                                 for_each_property_of_node(np, prop) {
@@ -854,7 +912,6 @@ static void selftest_data_remove(void)
                                 }
                         }
                 }
-                last_node_index--;
         }
 }
 
@@ -867,6 +924,8 @@ static int __init of_selftest(void)
         res = selftest_data_add();
         if (res)
                 return res;
+        if (!of_aliases)
+                of_aliases = of_find_node_by_path("/aliases");
 
         np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a");
         if (!np) {
@@ -881,7 +940,7 @@ static int __init of_selftest(void)
         of_selftest_find_node_by_name();
         of_selftest_dynamic();
         of_selftest_parse_phandle_with_args();
-        of_selftest_property_match_string();
+        of_selftest_property_string();
         of_selftest_property_copy();
         of_selftest_changeset();
         of_selftest_parse_interrupts();
diff --git a/drivers/of/testcase-data/tests-phandle.dtsi b/drivers/of/testcase-data/tests-phandle.dtsi
index ce0fe083d406..5b1527e8a7fb 100644
--- a/drivers/of/testcase-data/tests-phandle.dtsi
+++ b/drivers/of/testcase-data/tests-phandle.dtsi
@@ -39,7 +39,9 @@
                                 phandle-list-bad-args = <&provider2 1 0>,
                                                         <&provider3 0>;
                                 empty-property;
+                                string-property = "foobar";
                                 unterminated-string = [40 41 42 43];
+                                unterminated-string-list = "first", "second", [40 41 42 43];
                         };
                 };
         };
diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index d292d7cb3417..49dd766852ba 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -444,7 +444,7 @@ static inline int pcie_cap_version(const struct pci_dev *dev)
         return pcie_caps_reg(dev) & PCI_EXP_FLAGS_VERS;
 }
 
-static inline bool pcie_cap_has_lnkctl(const struct pci_dev *dev)
+bool pcie_cap_has_lnkctl(const struct pci_dev *dev)
 {
         int type = pci_pcie_type(dev);
 
diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c
index 233fe8a88264..69202d1eb8fb 100644
--- a/drivers/pci/host/pci-imx6.c
+++ b/drivers/pci/host/pci-imx6.c
@@ -275,15 +275,22 @@ static int imx6_pcie_deassert_core_reset(struct pcie_port *pp)
                 goto err_pcie;
         }
 
-        /* allow the clocks to stabilize */
-        usleep_range(200, 500);
-
         /* power up core phy and enable ref clock */
         regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR1,
                         IMX6Q_GPR1_PCIE_TEST_PD, 0 << 18);
+        /*
+         * the async reset input need ref clock to sync internally,
+         * when the ref clock comes after reset, internal synced
+         * reset time is too short, cannot meet the requirement.
+         * add one ~10us delay here.
+         */
+        udelay(10);
         regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR1,
                         IMX6Q_GPR1_PCIE_REF_CLK_EN, 1 << 16);
 
+        /* allow the clocks to stabilize */
+        usleep_range(200, 500);
+
         /* Some boards don't have PCIe reset GPIO. */
         if (gpio_is_valid(imx6_pcie->reset_gpio)) {
                 gpio_set_value(imx6_pcie->reset_gpio, 0);
diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
index 3d43874319be..19bb19c7db4a 100644
--- a/drivers/pci/host/pci-tegra.c
+++ b/drivers/pci/host/pci-tegra.c
@@ -276,6 +276,7 @@ struct tegra_pcie {
 
         struct resource all;
         struct resource io;
+        struct resource pio;
         struct resource mem;
         struct resource prefetch;
         struct resource busn;
@@ -658,7 +659,6 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
 {
         struct tegra_pcie *pcie = sys_to_pcie(sys);
         int err;
-        phys_addr_t io_start;
 
         err = devm_request_resource(pcie->dev, &pcie->all, &pcie->mem);
         if (err < 0)
@@ -668,14 +668,12 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
         if (err)
                 return err;
 
-        io_start = pci_pio_to_address(pcie->io.start);
-
         pci_add_resource_offset(&sys->resources, &pcie->mem, sys->mem_offset);
         pci_add_resource_offset(&sys->resources, &pcie->prefetch,
                                 sys->mem_offset);
         pci_add_resource(&sys->resources, &pcie->busn);
 
-        pci_ioremap_io(nr * SZ_64K, io_start);
+        pci_ioremap_io(pcie->pio.start, pcie->io.start);
 
         return 1;
 }
@@ -786,7 +784,6 @@ static irqreturn_t tegra_pcie_isr(int irq, void *arg)
 static void tegra_pcie_setup_translations(struct tegra_pcie *pcie)
 {
         u32 fpci_bar, size, axi_address;
-        phys_addr_t io_start = pci_pio_to_address(pcie->io.start);
 
         /* Bar 0: type 1 extended configuration space */
         fpci_bar = 0xfe100000;
@@ -799,7 +796,7 @@ static void tegra_pcie_setup_translations(struct tegra_pcie *pcie)
         /* Bar 1: downstream IO bar */
         fpci_bar = 0xfdfc0000;
         size = resource_size(&pcie->io);
-        axi_address = io_start;
+        axi_address = pcie->io.start;
         afi_writel(pcie, axi_address, AFI_AXI_BAR1_START);
         afi_writel(pcie, size >> 12, AFI_AXI_BAR1_SZ);
         afi_writel(pcie, fpci_bar, AFI_FPCI_BAR1);
@@ -1690,8 +1687,23 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
 
                 switch (res.flags & IORESOURCE_TYPE_BITS) {
                 case IORESOURCE_IO:
-                        memcpy(&pcie->io, &res, sizeof(res));
-                        pcie->io.name = np->full_name;
+                        memcpy(&pcie->pio, &res, sizeof(res));
+                        pcie->pio.name = np->full_name;
+
+                        /*
+                         * The Tegra PCIe host bridge uses this to program the
+                         * mapping of the I/O space to the physical address,
+                         * so we override the .start and .end fields here that
+                         * of_pci_range_to_resource() converted to I/O space.
+                         * We also set the IORESOURCE_MEM type to clarify that
+                         * the resource is in the physical memory space.
+                         */
+                        pcie->io.start = range.cpu_addr;
+                        pcie->io.end = range.cpu_addr + range.size - 1;
+                        pcie->io.flags = IORESOURCE_MEM;
+                        pcie->io.name = "I/O";
+
+                        memcpy(&res, &pcie->io, sizeof(res));
                         break;
 
                 case IORESOURCE_MEM:
diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
index 9ecabfa8c634..2988fe136c1e 100644
--- a/drivers/pci/host/pci-xgene.c
+++ b/drivers/pci/host/pci-xgene.c
@@ -631,10 +631,15 @@ static int xgene_pcie_probe_bridge(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        bus = pci_scan_root_bus(&pdev->dev, 0, &xgene_pcie_ops, port, &res);
+        bus = pci_create_root_bus(&pdev->dev, 0,
+                                        &xgene_pcie_ops, port, &res);
         if (!bus)
                 return -ENOMEM;
 
+        pci_scan_child_bus(bus);
+        pci_assign_unassigned_bus_resources(bus);
+        pci_bus_add_devices(bus);
+
         platform_set_drvdata(pdev, port);
         return 0;
 }
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index 3a5e7e28b874..07aa722bb12c 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -262,13 +262,6 @@ static int pciehp_probe(struct pcie_device *dev)
                 goto err_out_none;
         }
 
-        if (!dev->port->subordinate) {
-                /* Can happen if we run out of bus numbers during probe */
-                dev_err(&dev->device,
-                        "Hotplug bridge without secondary bus, ignoring\n");
-                goto err_out_none;
-        }
-
         ctrl = pcie_init(dev);
         if (!ctrl) {
                 dev_err(&dev->device, "Controller initialization failed\n");
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 9fab30af0e75..084587d7cd13 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -590,6 +590,20 @@ static struct msi_desc *msi_setup_entry(struct pci_dev *dev)
         return entry;
 }
 
+static int msi_verify_entries(struct pci_dev *dev)
+{
+        struct msi_desc *entry;
+
+        list_for_each_entry(entry, &dev->msi_list, list) {
+                if (!dev->no_64bit_msi || !entry->msg.address_hi)
+                        continue;
+                dev_err(&dev->dev, "Device has broken 64-bit MSI but arch"
+                        " tried to assign one above 4G\n");
+                return -EIO;
+        }
+        return 0;
+}
+
 /**
  * msi_capability_init - configure device's MSI capability structure
  * @dev: pointer to the pci_dev data structure of MSI device function
@@ -627,6 +641,13 @@ static int msi_capability_init(struct pci_dev *dev, int nvec)
                 return ret;
         }
 
+        ret = msi_verify_entries(dev);
+        if (ret) {
+                msi_mask_irq(entry, mask, ~mask);
+                free_msi_irqs(dev);
+                return ret;
+        }
+
         ret = populate_msi_sysfs(dev);
         if (ret) {
                 msi_mask_irq(entry, mask, ~mask);
@@ -739,6 +760,11 @@ static int msix_capability_init(struct pci_dev *dev,
         if (ret)
                 goto out_avail;
 
+        /* Check if all MSI entries honor device restrictions */
+        ret = msi_verify_entries(dev);
+        if (ret)
+                goto out_free;
+
         /*
          * Some devices require MSI-X to be enabled before we can touch the
          * MSI-X registers.  We need to mask all the vectors to prevent
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 92b6d9ab00e4..2c6643fdc0cf 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -185,7 +185,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(modalias);
 
-static ssize_t enabled_store(struct device *dev, struct device_attribute *attr,
+static ssize_t enable_store(struct device *dev, struct device_attribute *attr,
                              const char *buf, size_t count)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -210,7 +210,7 @@ static ssize_t enabled_store(struct device *dev, struct device_attribute *attr,
         return result < 0 ? result : count;
 }
 
-static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
+static ssize_t enable_show(struct device *dev, struct device_attribute *attr,
                             char *buf)
 {
         struct pci_dev *pdev;
@@ -218,7 +218,7 @@ static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
         pdev = to_pci_dev(dev);
         return sprintf(buf, "%u\n", atomic_read(&pdev->enable_cnt));
 }
-static DEVICE_ATTR_RW(enabled);
+static DEVICE_ATTR_RW(enable);
 
 #ifdef CONFIG_NUMA
 static ssize_t numa_node_show(struct device *dev, struct device_attribute *attr,
@@ -563,7 +563,7 @@ static struct attribute *pci_dev_attrs[] = {
 #endif
         &dev_attr_dma_mask_bits.attr,
         &dev_attr_consistent_dma_mask_bits.attr,
-        &dev_attr_enabled.attr,
+        &dev_attr_enable.attr,
         &dev_attr_broken_parity_status.attr,
         &dev_attr_msi_bus.attr,
 #if defined(CONFIG_PM_RUNTIME) && defined(CONFIG_ACPI)
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 0601890db22d..4a3902d8e6fe 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -6,6 +6,8 @@
 
 extern const unsigned char pcie_link_speed[];
 
+bool pcie_cap_has_lnkctl(const struct pci_dev *dev);
+
 /* Functions internal to the PCI core code */
 
 int pci_create_sysfs_dev_files(struct pci_dev *pdev);
diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c
index a9f9c46e5022..63fc63911295 100644
--- a/drivers/pci/pcie/pme.c
+++ b/drivers/pci/pcie/pme.c
@@ -397,6 +397,7 @@ static int pcie_pme_suspend(struct pcie_device *srv)
         struct pcie_pme_service_data *data = get_service_data(srv);
         struct pci_dev *port = srv->port;
         bool wakeup;
+        int ret;
 
         if (device_may_wakeup(&port->dev)) {
                 wakeup = true;
@@ -407,9 +408,10 @@ static int pcie_pme_suspend(struct pcie_device *srv)
         }
         spin_lock_irq(&data->lock);
         if (wakeup) {
-                enable_irq_wake(srv->irq);
+                ret = enable_irq_wake(srv->irq);
                 data->suspend_level = PME_SUSPEND_WAKEUP;
-        } else {
+        }
+        if (!wakeup || ret) {
                 struct pci_dev *port = srv->port;
 
                 pcie_pme_interrupt_enable(port, false);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 5ed99309c758..c8ca98c2b480 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -407,15 +407,16 @@ static void pci_read_bridge_mmio_pref(struct pci_bus *child)
 {
         struct pci_dev *dev = child->self;
         u16 mem_base_lo, mem_limit_lo;
-        unsigned long base, limit;
+        u64 base64, limit64;
+        dma_addr_t base, limit;
         struct pci_bus_region region;
         struct resource *res;
 
         res = child->resource[2];
         pci_read_config_word(dev, PCI_PREF_MEMORY_BASE, &mem_base_lo);
         pci_read_config_word(dev, PCI_PREF_MEMORY_LIMIT, &mem_limit_lo);
-        base = ((unsigned long) mem_base_lo & PCI_PREF_RANGE_MASK) << 16;
-        limit = ((unsigned long) mem_limit_lo & PCI_PREF_RANGE_MASK) << 16;
+        base64 = (mem_base_lo & PCI_PREF_RANGE_MASK) << 16;
+        limit64 = (mem_limit_lo & PCI_PREF_RANGE_MASK) << 16;
 
         if ((mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) == PCI_PREF_RANGE_TYPE_64) {
                 u32 mem_base_hi, mem_limit_hi;
@@ -429,17 +430,20 @@ static void pci_read_bridge_mmio_pref(struct pci_bus *child)
                  * this, just assume they are not being used.
                  */
                 if (mem_base_hi <= mem_limit_hi) {
-#if BITS_PER_LONG == 64
-                        base |= ((unsigned long) mem_base_hi) << 32;
-                        limit |= ((unsigned long) mem_limit_hi) << 32;
-#else
-                        if (mem_base_hi || mem_limit_hi) {
-                                dev_err(&dev->dev, "can't handle 64-bit address space for bridge\n");
-                                return;
-                        }
-#endif
+                        base64 |= (u64) mem_base_hi << 32;
+                        limit64 |= (u64) mem_limit_hi << 32;
                 }
         }
+
+        base = (dma_addr_t) base64;
+        limit = (dma_addr_t) limit64;
+
+        if (base != base64) {
+                dev_err(&dev->dev, "can't handle bridge window above 4GB (bus address %#010llx)\n",
+                        (unsigned long long) base64);
+                return;
+        }
+
         if (base <= limit) {
                 res->flags = (mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) |
                                          IORESOURCE_MEM | IORESOURCE_PREFETCH;
@@ -1323,7 +1327,7 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
                         ~hpp->pci_exp_devctl_and, hpp->pci_exp_devctl_or);
 
         /* Initialize Link Control Register */
-        if (dev->subordinate)
+        if (pcie_cap_has_lnkctl(dev))
                 pcie_capability_clear_and_set_word(dev, PCI_EXP_LNKCTL,
                         ~hpp->pci_exp_lnkctl_and, hpp->pci_exp_lnkctl_or);
 
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index 8c842980834a..f091576b6449 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -258,14 +258,16 @@ static int omap_usb2_probe(struct platform_device *pdev)
         otg->phy                = &phy->phy;
 
         platform_set_drvdata(pdev, phy);
+        pm_runtime_enable(phy->dev);
 
         generic_phy = devm_phy_create(phy->dev, NULL, &ops, NULL);
-        if (IS_ERR(generic_phy))
+        if (IS_ERR(generic_phy)) {
+                pm_runtime_disable(phy->dev);
                 return PTR_ERR(generic_phy);
+        }
 
         phy_set_drvdata(generic_phy, phy);
 
-        pm_runtime_enable(phy->dev);
         phy_provider = devm_of_phy_provider_register(phy->dev,
                         of_phy_simple_xlate);
         if (IS_ERR(phy_provider)) {
diff --git a/drivers/pinctrl/pinctrl-baytrail.c b/drivers/pinctrl/pinctrl-baytrail.c
index e12e5b07f6d7..9dc38140194b 100644
--- a/drivers/pinctrl/pinctrl-baytrail.c
+++ b/drivers/pinctrl/pinctrl-baytrail.c
@@ -227,10 +227,14 @@ static int byt_irq_type(struct irq_data *d, unsigned type)
         spin_lock_irqsave(&vg->lock, flags);
         value = readl(reg);
 
+        WARN(value & BYT_DIRECT_IRQ_EN,
+                "Bad pad config for io mode, force direct_irq_en bit clearing");
+
         /* For level trigges the BYT_TRIG_POS and BYT_TRIG_NEG bits
          * are used to indicate high and low level triggering
          */
-        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+        value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
+                   BYT_TRIG_LVL);
 
         switch (type) {
         case IRQ_TYPE_LEVEL_HIGH:
@@ -318,7 +322,7 @@ static int byt_gpio_direction_output(struct gpio_chip *chip,
                 "Potential Error: Setting GPIO with direct_irq_en to output");
 
         reg_val = readl(reg) | BYT_DIR_MASK;
-        reg_val &= ~BYT_OUTPUT_EN;
+        reg_val &= ~(BYT_OUTPUT_EN | BYT_INPUT_EN);
 
         if (value)
                 writel(reg_val | BYT_LEVEL, reg);
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 4dcfb7116a04..a2eabe6ff9ad 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -202,6 +202,7 @@ config TC1100_WMI
 config HP_ACCEL
         tristate "HP laptop accelerometer"
         depends on INPUT && ACPI
+        depends on SERIO_I8042
         select SENSORS_LIS3LV02D
         select NEW_LEDS
         select LEDS_CLASS
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 96a0b75c52c9..26c4fd1394da 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -579,6 +579,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] __initconst = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5741"),
                 },
         },
+        {
+                /*
+                 * Note no video_set_backlight_video_vendor, we must use the
+                 * acer interface, as there is no native backlight interface.
+                 */
+                .ident = "Acer KAV80",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 3a4951f46065..c1a6cd66af42 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -182,6 +182,15 @@ static const struct dmi_system_id asus_quirks[] = {
         },
         {
                 .callback = dmi_matched,
+                .ident = "ASUSTeK COMPUTER INC. X550VB",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X550VB"),
+                },
+                .driver_data = &quirk_asus_wapf4,
+        },
+        {
+                .callback = dmi_matched,
                 .ident = "ASUSTeK COMPUTER INC. X55A",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
index 13e14ec1d3d7..6bec745b6b92 100644
--- a/drivers/platform/x86/hp_accel.c
+++ b/drivers/platform/x86/hp_accel.c
@@ -37,6 +37,8 @@
 #include <linux/leds.h>
 #include <linux/atomic.h>
 #include <linux/acpi.h>
+#include <linux/i8042.h>
+#include <linux/serio.h>
 #include "../../misc/lis3lv02d/lis3lv02d.h"
 
 #define DRIVER_NAME     "hp_accel"
@@ -73,6 +75,13 @@ static inline void delayed_sysfs_set(struct led_classdev *led_cdev,
 
 /* HP-specific accelerometer driver ------------------------------------ */
 
+/* e0 25, e0 26, e0 27, e0 28 are scan codes that the accelerometer with acpi id
+ * HPQ6000 sends through the keyboard bus */
+#define ACCEL_1 0x25
+#define ACCEL_2 0x26
+#define ACCEL_3 0x27
+#define ACCEL_4 0x28
+
 /* For automatic insertion of the module */
 static const struct acpi_device_id lis3lv02d_device_ids[] = {
         {"HPQ0004", 0}, /* HP Mobile Data Protection System PNP */
@@ -294,6 +303,35 @@ static void lis3lv02d_enum_resources(struct acpi_device *device)
                 printk(KERN_DEBUG DRIVER_NAME ": Error getting resources\n");
 }
 
+static bool hp_accel_i8042_filter(unsigned char data, unsigned char str,
+                                  struct serio *port)
+{
+        static bool extended;
+
+        if (str & I8042_STR_AUXDATA)
+                return false;
+
+        if (data == 0xe0) {
+                extended = true;
+                return true;
+        } else if (unlikely(extended)) {
+                extended = false;
+
+                switch (data) {
+                case ACCEL_1:
+                case ACCEL_2:
+                case ACCEL_3:
+                case ACCEL_4:
+                        return true;
+                default:
+                        serio_interrupt(port, 0xe0, 0);
+                        return false;
+                }
+        }
+
+        return false;
+}
+
 static int lis3lv02d_add(struct acpi_device *device)
 {
         int ret;
@@ -326,6 +364,11 @@ static int lis3lv02d_add(struct acpi_device *device)
         if (ret)
                 return ret;
 
+        /* filter to remove HPQ6000 accelerometer data
+         * from keyboard bus stream */
+        if (strstr(dev_name(&device->dev), "HPQ6000"))
+                i8042_install_filter(hp_accel_i8042_filter);
+
         INIT_WORK(&hpled_led.work, delayed_set_status_worker);
         ret = led_classdev_register(NULL, &hpled_led.led_classdev);
         if (ret) {
@@ -343,6 +386,7 @@ static int lis3lv02d_remove(struct acpi_device *device)
         if (!device)
                 return -EINVAL;
 
+        i8042_remove_filter(hp_accel_i8042_filter);
         lis3lv02d_joystick_disable(&lis3_dev);
         lis3lv02d_poweroff(&lis3_dev);
 
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 02152de135b5..ed494f37c40f 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -837,6 +837,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
                         DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 2"),
                 },
         },
+        {
+                .ident = "Lenovo Yoga 3 Pro 1370",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 Pro-1370"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index 5a5966512277..ff765d8e1a09 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -1561,6 +1561,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
         },
         {
          .callback = samsung_dmi_matched,
+         .ident = "NC210",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "NC210/NC110"),
+                DMI_MATCH(DMI_BOARD_NAME, "NC210/NC110"),
+                },
+         .driver_data = &samsung_broken_acpi_video,
+        },
+        {
+         .callback = samsung_dmi_matched,
          .ident = "730U3E/740U3E",
          .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index ef3a1904e92f..ab6151f05420 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -240,6 +240,12 @@ static const struct dmi_system_id toshiba_alt_keymap_dmi[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Qosmio X75-A"),
                 },
         },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TECRA A50-A"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/power/ab8500_fg.c b/drivers/power/ab8500_fg.c
index 217da4b2ca86..99a78d365ceb 100644
--- a/drivers/power/ab8500_fg.c
+++ b/drivers/power/ab8500_fg.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/time.h>
+#include <linux/time64.h>
 #include <linux/of.h>
 #include <linux/completion.h>
 #include <linux/mfd/core.h>
@@ -108,7 +109,7 @@ enum ab8500_fg_calibration_state {
 struct ab8500_fg_avg_cap {
         int avg;
         int samples[NBR_AVG_SAMPLES];
-        __kernel_time_t time_stamps[NBR_AVG_SAMPLES];
+        time64_t time_stamps[NBR_AVG_SAMPLES];
         int pos;
         int nbr_samples;
         int sum;
@@ -386,15 +387,15 @@ static int ab8500_fg_is_low_curr(struct ab8500_fg *di, int curr)
  */
 static int ab8500_fg_add_cap_sample(struct ab8500_fg *di, int sample)
 {
-        struct timespec ts;
+        struct timespec64 ts64;
         struct ab8500_fg_avg_cap *avg = &di->avg_cap;
 
-        getnstimeofday(&ts);
+        getnstimeofday64(&ts64);
 
         do {
                 avg->sum += sample - avg->samples[avg->pos];
                 avg->samples[avg->pos] = sample;
-                avg->time_stamps[avg->pos] = ts.tv_sec;
+                avg->time_stamps[avg->pos] = ts64.tv_sec;
                 avg->pos++;
 
                 if (avg->pos == NBR_AVG_SAMPLES)
@@ -407,7 +408,7 @@ static int ab8500_fg_add_cap_sample(struct ab8500_fg *di, int sample)
                  * Check the time stamp for each sample. If too old,
                  * replace with latest sample
                  */
-        } while (ts.tv_sec - VALID_CAPACITY_SEC > avg->time_stamps[avg->pos]);
+        } while (ts64.tv_sec - VALID_CAPACITY_SEC > avg->time_stamps[avg->pos]);
 
         avg->avg = avg->sum / avg->nbr_samples;
 
@@ -446,14 +447,14 @@ static void ab8500_fg_clear_cap_samples(struct ab8500_fg *di)
 static void ab8500_fg_fill_cap_sample(struct ab8500_fg *di, int sample)
 {
         int i;
-        struct timespec ts;
+        struct timespec64 ts64;
         struct ab8500_fg_avg_cap *avg = &di->avg_cap;
 
-        getnstimeofday(&ts);
+        getnstimeofday64(&ts64);
 
         for (i = 0; i < NBR_AVG_SAMPLES; i++) {
                 avg->samples[i] = sample;
-                avg->time_stamps[i] = ts.tv_sec;
+                avg->time_stamps[i] = ts64.tv_sec;
         }
 
         avg->pos = 0;
diff --git a/drivers/power/bq2415x_charger.c b/drivers/power/bq2415x_charger.c
index e384844a1ae1..1f49986fc605 100644
--- a/drivers/power/bq2415x_charger.c
+++ b/drivers/power/bq2415x_charger.c
@@ -1579,8 +1579,15 @@ static int bq2415x_probe(struct i2c_client *client,
         if (np) {
                 bq->notify_psy = power_supply_get_by_phandle(np, "ti,usb-charger-detection");
 
-                if (!bq->notify_psy)
-                        return -EPROBE_DEFER;
+                if (IS_ERR(bq->notify_psy)) {
+                        dev_info(&client->dev,
+                                "no 'ti,usb-charger-detection' property (err=%ld)\n",
+                                PTR_ERR(bq->notify_psy));
+                        bq->notify_psy = NULL;
+                } else if (!bq->notify_psy) {
+                        ret = -EPROBE_DEFER;
+                        goto error_2;
+                }
         }
         else if (pdata->notify_device)
                 bq->notify_psy = power_supply_get_by_name(pdata->notify_device);
@@ -1602,27 +1609,27 @@ static int bq2415x_probe(struct i2c_client *client,
                 ret = of_property_read_u32(np, "ti,current-limit",
                                 &bq->init_data.current_limit);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,weak-battery-voltage",
                                 &bq->init_data.weak_battery_voltage);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,battery-regulation-voltage",
                                 &bq->init_data.battery_regulation_voltage);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,charge-current",
                                 &bq->init_data.charge_current);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,termination-current",
                                 &bq->init_data.termination_current);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,resistor-sense",
                                 &bq->init_data.resistor_sense);
                 if (ret)
-                        return ret;
+                        goto error_2;
         } else {
                 memcpy(&bq->init_data, pdata, sizeof(bq->init_data));
         }
diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
index 7098a1ce2d3c..ef8094a61f1e 100644
--- a/drivers/power/charger-manager.c
+++ b/drivers/power/charger-manager.c
@@ -97,6 +97,7 @@ static struct charger_global_desc *g_desc; /* init with setup_charger_manager */
 static bool is_batt_present(struct charger_manager *cm)
 {
         union power_supply_propval val;
+        struct power_supply *psy;
         bool present = false;
         int i, ret;
 
@@ -107,16 +108,27 @@ static bool is_batt_present(struct charger_manager *cm)
         case CM_NO_BATTERY:
                 break;
         case CM_FUEL_GAUGE:
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                psy = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!psy)
+                        break;
+
+                ret = psy->get_property(psy,
                                 POWER_SUPPLY_PROP_PRESENT, &val);
                 if (ret == 0 && val.intval)
                         present = true;
                 break;
         case CM_CHARGER_STAT:
-                for (i = 0; cm->charger_stat[i]; i++) {
-                        ret = cm->charger_stat[i]->get_property(
-                                        cm->charger_stat[i],
-                                        POWER_SUPPLY_PROP_PRESENT, &val);
+                for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                        psy = power_supply_get_by_name(
+                                        cm->desc->psy_charger_stat[i]);
+                        if (!psy) {
+                                dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                                continue;
+                        }
+
+                        ret = psy->get_property(psy, POWER_SUPPLY_PROP_PRESENT,
+                                        &val);
                         if (ret == 0 && val.intval) {
                                 present = true;
                                 break;
@@ -139,14 +151,20 @@ static bool is_batt_present(struct charger_manager *cm)
 static bool is_ext_pwr_online(struct charger_manager *cm)
 {
         union power_supply_propval val;
+        struct power_supply *psy;
         bool online = false;
         int i, ret;
 
         /* If at least one of them has one, it's yes. */
-        for (i = 0; cm->charger_stat[i]; i++) {
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_ONLINE, &val);
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                psy = power_supply_get_by_name(cm->desc->psy_charger_stat[i]);
+                if (!psy) {
+                        dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                        continue;
+                }
+
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_ONLINE, &val);
                 if (ret == 0 && val.intval) {
                         online = true;
                         break;
@@ -167,12 +185,14 @@ static bool is_ext_pwr_online(struct charger_manager *cm)
 static int get_batt_uV(struct charger_manager *cm, int *uV)
 {
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
         int ret;
 
-        if (!cm->fuel_gauge)
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
                 return -ENODEV;
 
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+        ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_VOLTAGE_NOW, &val);
         if (ret)
                 return ret;
@@ -189,6 +209,7 @@ static bool is_charging(struct charger_manager *cm)
 {
         int i, ret;
         bool charging = false;
+        struct power_supply *psy;
         union power_supply_propval val;
 
         /* If there is no battery, it cannot be charged */
@@ -196,17 +217,22 @@ static bool is_charging(struct charger_manager *cm)
                 return false;
 
         /* If at least one of the charger is charging, return yes */
-        for (i = 0; cm->charger_stat[i]; i++) {
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
                 /* 1. The charger sholuld not be DISABLED */
                 if (cm->emergency_stop)
                         continue;
                 if (!cm->charger_enabled)
                         continue;
 
+                psy = power_supply_get_by_name(cm->desc->psy_charger_stat[i]);
+                if (!psy) {
+                        dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                        continue;
+                }
+
                 /* 2. The charger should be online (ext-power) */
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_ONLINE, &val);
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_ONLINE, &val);
                 if (ret) {
                         dev_warn(cm->dev, "Cannot read ONLINE value from %s\n",
                                  cm->desc->psy_charger_stat[i]);
@@ -219,9 +245,7 @@ static bool is_charging(struct charger_manager *cm)
                  * 3. The charger should not be FULL, DISCHARGING,
                  * or NOT_CHARGING.
                  */
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_STATUS, &val);
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_STATUS, &val);
                 if (ret) {
                         dev_warn(cm->dev, "Cannot read STATUS value from %s\n",
                                  cm->desc->psy_charger_stat[i]);
@@ -248,6 +272,7 @@ static bool is_full_charged(struct charger_manager *cm)
 {
         struct charger_desc *desc = cm->desc;
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
         int ret = 0;
         int uV;
 
@@ -255,11 +280,15 @@ static bool is_full_charged(struct charger_manager *cm)
         if (!is_batt_present(cm))
                 return false;
 
-        if (cm->fuel_gauge && desc->fullbatt_full_capacity > 0) {
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
+                return false;
+
+        if (desc->fullbatt_full_capacity > 0) {
                 val.intval = 0;
 
                 /* Not full if capacity of fuel gauge isn't full */
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CHARGE_FULL, &val);
                 if (!ret && val.intval > desc->fullbatt_full_capacity)
                         return true;
@@ -273,10 +302,10 @@ static bool is_full_charged(struct charger_manager *cm)
         }
 
         /* Full, if the capacity is more than fullbatt_soc */
-        if (cm->fuel_gauge && desc->fullbatt_soc > 0) {
+        if (desc->fullbatt_soc > 0) {
                 val.intval = 0;
 
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CAPACITY, &val);
                 if (!ret && val.intval >= desc->fullbatt_soc)
                         return true;
@@ -551,6 +580,20 @@ static int check_charging_duration(struct charger_manager *cm)
         return ret;
 }
 
+static int cm_get_battery_temperature_by_psy(struct charger_manager *cm,
+                                        int *temp)
+{
+        struct power_supply *fuel_gauge;
+
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
+                return -ENODEV;
+
+        return fuel_gauge->get_property(fuel_gauge,
+                                POWER_SUPPLY_PROP_TEMP,
+                                (union power_supply_propval *)temp);
+}
+
 static int cm_get_battery_temperature(struct charger_manager *cm,
                                         int *temp)
 {
@@ -560,15 +603,18 @@ static int cm_get_battery_temperature(struct charger_manager *cm,
                 return -ENODEV;
 
 #ifdef CONFIG_THERMAL
-        ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
-        if (!ret)
-                /* Calibrate temperature unit */
-                *temp /= 100;
-#else
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
-                                POWER_SUPPLY_PROP_TEMP,
-                                (union power_supply_propval *)temp);
+        if (cm->tzd_batt) {
+                ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
+                if (!ret)
+                        /* Calibrate temperature unit */
+                        *temp /= 100;
+        } else
 #endif
+        {
+                /* if-else continued from CONFIG_THERMAL */
+                ret = cm_get_battery_temperature_by_psy(cm, temp);
+        }
+
         return ret;
 }
 
@@ -827,6 +873,7 @@ static int charger_get_property(struct power_supply *psy,
         struct charger_manager *cm = container_of(psy,
                         struct charger_manager, charger_psy);
         struct charger_desc *desc = cm->desc;
+        struct power_supply *fuel_gauge;
         int ret = 0;
         int uV;
 
@@ -857,14 +904,20 @@ static int charger_get_property(struct power_supply *psy,
                 ret = get_batt_uV(cm, &val->intval);
                 break;
         case POWER_SUPPLY_PROP_CURRENT_NOW:
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!fuel_gauge) {
+                        ret = -ENODEV;
+                        break;
+                }
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CURRENT_NOW, val);
                 break;
         case POWER_SUPPLY_PROP_TEMP:
         case POWER_SUPPLY_PROP_TEMP_AMBIENT:
                 return cm_get_battery_temperature(cm, &val->intval);
         case POWER_SUPPLY_PROP_CAPACITY:
-                if (!cm->fuel_gauge) {
+                fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!fuel_gauge) {
                         ret = -ENODEV;
                         break;
                 }
@@ -875,7 +928,7 @@ static int charger_get_property(struct power_supply *psy,
                         break;
                 }
 
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                         POWER_SUPPLY_PROP_CAPACITY, val);
                 if (ret)
                         break;
@@ -924,7 +977,14 @@ static int charger_get_property(struct power_supply *psy,
                 break;
         case POWER_SUPPLY_PROP_CHARGE_NOW:
                 if (is_charging(cm)) {
-                        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                        fuel_gauge = power_supply_get_by_name(
+                                        cm->desc->psy_fuel_gauge);
+                        if (!fuel_gauge) {
+                                ret = -ENODEV;
+                                break;
+                        }
+
+                        ret = fuel_gauge->get_property(fuel_gauge,
                                                 POWER_SUPPLY_PROP_CHARGE_NOW,
                                                 val);
                         if (ret) {
@@ -970,6 +1030,7 @@ static struct power_supply psy_default = {
         .properties = default_charger_props,
         .num_properties = ARRAY_SIZE(default_charger_props),
         .get_property = charger_get_property,
+        .no_thermal = true,
 };
 
 /**
@@ -1485,14 +1546,15 @@ err:
         return ret;
 }
 
-static int cm_init_thermal_data(struct charger_manager *cm)
+static int cm_init_thermal_data(struct charger_manager *cm,
+                struct power_supply *fuel_gauge)
 {
         struct charger_desc *desc = cm->desc;
         union power_supply_propval val;
         int ret;
 
         /* Verify whether fuel gauge provides battery temperature */
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+        ret = fuel_gauge->get_property(fuel_gauge,
                                         POWER_SUPPLY_PROP_TEMP, &val);
 
         if (!ret) {
@@ -1502,8 +1564,6 @@ static int cm_init_thermal_data(struct charger_manager *cm)
                 cm->desc->measure_battery_temp = true;
         }
 #ifdef CONFIG_THERMAL
-        cm->tzd_batt = cm->fuel_gauge->tzd;
-
         if (ret && desc->thermal_zone) {
                 cm->tzd_batt =
                         thermal_zone_get_zone_by_name(desc->thermal_zone);
@@ -1666,6 +1726,7 @@ static int charger_manager_probe(struct platform_device *pdev)
         int ret = 0, i = 0;
         int j = 0;
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
 
         if (g_desc && !rtc_dev && g_desc->rtc_name) {
                 rtc_dev = rtc_class_open(g_desc->rtc_name);
@@ -1729,23 +1790,20 @@ static int charger_manager_probe(struct platform_device *pdev)
         while (desc->psy_charger_stat[i])
                 i++;
 
-        cm->charger_stat = devm_kzalloc(&pdev->dev,
-                                sizeof(struct power_supply *) * i, GFP_KERNEL);
-        if (!cm->charger_stat)
-                return -ENOMEM;
-
+        /* Check if charger's supplies are present at probe */
         for (i = 0; desc->psy_charger_stat[i]; i++) {
-                cm->charger_stat[i] = power_supply_get_by_name(
-                                        desc->psy_charger_stat[i]);
-                if (!cm->charger_stat[i]) {
+                struct power_supply *psy;
+
+                psy = power_supply_get_by_name(desc->psy_charger_stat[i]);
+                if (!psy) {
                         dev_err(&pdev->dev, "Cannot find power supply \"%s\"\n",
                                 desc->psy_charger_stat[i]);
                         return -ENODEV;
                 }
         }
 
-        cm->fuel_gauge = power_supply_get_by_name(desc->psy_fuel_gauge);
-        if (!cm->fuel_gauge) {
+        fuel_gauge = power_supply_get_by_name(desc->psy_fuel_gauge);
+        if (!fuel_gauge) {
                 dev_err(&pdev->dev, "Cannot find power supply \"%s\"\n",
                         desc->psy_fuel_gauge);
                 return -ENODEV;
@@ -1788,13 +1846,13 @@ static int charger_manager_probe(struct platform_device *pdev)
         cm->charger_psy.num_properties = psy_default.num_properties;
 
         /* Find which optional psy-properties are available */
-        if (!cm->fuel_gauge->get_property(cm->fuel_gauge,
+        if (!fuel_gauge->get_property(fuel_gauge,
                                           POWER_SUPPLY_PROP_CHARGE_NOW, &val)) {
                 cm->charger_psy.properties[cm->charger_psy.num_properties] =
                                 POWER_SUPPLY_PROP_CHARGE_NOW;
                 cm->charger_psy.num_properties++;
         }
-        if (!cm->fuel_gauge->get_property(cm->fuel_gauge,
+        if (!fuel_gauge->get_property(fuel_gauge,
                                           POWER_SUPPLY_PROP_CURRENT_NOW,
                                           &val)) {
                 cm->charger_psy.properties[cm->charger_psy.num_properties] =
@@ -1802,7 +1860,7 @@ static int charger_manager_probe(struct platform_device *pdev)
                 cm->charger_psy.num_properties++;
         }
 
-        ret = cm_init_thermal_data(cm);
+        ret = cm_init_thermal_data(cm, fuel_gauge);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to initialize thermal data\n");
                 cm->desc->measure_battery_temp = false;
@@ -2066,8 +2124,8 @@ static bool find_power_supply(struct charger_manager *cm,
         int i;
         bool found = false;
 
-        for (i = 0; cm->charger_stat[i]; i++) {
-                if (psy == cm->charger_stat[i]) {
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                if (!strcmp(psy->name, cm->desc->psy_charger_stat[i])) {
                         found = true;
                         break;
                 }
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 6cb7fe5c022d..694e8cddd5c1 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -417,6 +417,9 @@ static int psy_register_thermal(struct power_supply *psy)
 {
         int i;
 
+        if (psy->no_thermal)
+                return 0;
+
         /* Register battery zone device psy reports temperature */
         for (i = 0; i < psy->num_properties; i++) {
                 if (psy->properties[i] == POWER_SUPPLY_PROP_TEMP) {
diff --git a/drivers/power/reset/at91-reset.c b/drivers/power/reset/at91-reset.c
index 3611806c9cfd..3cb36693343a 100644
--- a/drivers/power/reset/at91-reset.c
+++ b/drivers/power/reset/at91-reset.c
@@ -100,11 +100,11 @@ static void at91sam9g45_restart(enum reboot_mode mode, const char *cmd)
                 /* Disable SDRAM0 accesses */
                 "1:     str     %3, [%0, #" __stringify(AT91_DDRSDRC_RTR) "]\n\t"
                 /* Power down SDRAM0 */
-                "       str     %4, [%0, #" __stringify(AT91_DDRSDRC_RTR) "]\n\t"
+                "       str     %4, [%0, #" __stringify(AT91_DDRSDRC_LPR) "]\n\t"
                 /* Disable SDRAM1 accesses */
                 "       strne   %3, [%1, #" __stringify(AT91_DDRSDRC_RTR) "]\n\t"
                 /* Power down SDRAM1 */
-                "       strne   %4, [%1, #" __stringify(AT91_DDRSDRC_RTR) "]\n\t"
+                "       strne   %4, [%1, #" __stringify(AT91_DDRSDRC_LPR) "]\n\t"
                 /* Reset CPU */
                 "       str     %5, [%2, #" __stringify(AT91_RSTC_CR) "]\n\t"
 
diff --git a/drivers/pwm/Kconfig b/drivers/pwm/Kconfig
index b800783800a3..ef2dd2e4754b 100644
--- a/drivers/pwm/Kconfig
+++ b/drivers/pwm/Kconfig
@@ -83,6 +83,7 @@ config PWM_BFIN
 config PWM_CLPS711X
         tristate "CLPS711X PWM support"
         depends on ARCH_CLPS711X || COMPILE_TEST
+        depends on HAS_IOMEM
         help
           Generic PWM framework driver for Cirrus Logic CLPS711X.
 
@@ -101,6 +102,7 @@ config PWM_EP93XX
 config PWM_FSL_FTM
         tristate "Freescale FlexTimer Module (FTM) PWM support"
         depends on OF
+        select REGMAP_MMIO
         help
           Generic FTM PWM framework driver for Freescale VF610 and
           Layerscape LS-1 SoCs.
@@ -149,7 +151,7 @@ config PWM_LPC32XX
 
 config PWM_LPSS
         tristate "Intel LPSS PWM support"
-        depends on ACPI
+        depends on X86
         help
           Generic PWM framework driver for Intel Low Power Subsystem PWM
           controller.
@@ -157,6 +159,24 @@ config PWM_LPSS
           To compile this driver as a module, choose M here: the module
           will be called pwm-lpss.
 
+config PWM_LPSS_PCI
+        tristate "Intel LPSS PWM PCI driver"
+        depends on PWM_LPSS && PCI
+        help
+          The PCI driver for Intel Low Power Subsystem PWM controller.
+
+          To compile this driver as a module, choose M here: the module
+          will be called pwm-lpss-pci.
+
+config PWM_LPSS_PLATFORM
+        tristate "Intel LPSS PWM platform driver"
+        depends on PWM_LPSS && ACPI
+        help
+          The platform driver for Intel Low Power Subsystem PWM controller.
+
+          To compile this driver as a module, choose M here: the module
+          will be called pwm-lpss-platform.
+
 config PWM_MXS
         tristate "Freescale MXS PWM support"
         depends on ARCH_MXS && OF
diff --git a/drivers/pwm/Makefile b/drivers/pwm/Makefile
index f8c577d41091..c458606c3755 100644
--- a/drivers/pwm/Makefile
+++ b/drivers/pwm/Makefile
@@ -13,6 +13,8 @@ obj-$(CONFIG_PWM_JZ4740)	+= pwm-jz4740.o
 obj-$(CONFIG_PWM_LP3943)        += pwm-lp3943.o
 obj-$(CONFIG_PWM_LPC32XX)       += pwm-lpc32xx.o
 obj-$(CONFIG_PWM_LPSS)          += pwm-lpss.o
+obj-$(CONFIG_PWM_LPSS_PCI)      += pwm-lpss-pci.o
+obj-$(CONFIG_PWM_LPSS_PLATFORM) += pwm-lpss-platform.o
 obj-$(CONFIG_PWM_MXS)           += pwm-mxs.o
 obj-$(CONFIG_PWM_PCA9685)       += pwm-pca9685.o
 obj-$(CONFIG_PWM_PUV3)          += pwm-puv3.o
diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index d2c35920ff08..966497d10c6e 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -236,7 +236,7 @@ int pwmchip_add(struct pwm_chip *chip)
         int ret;
 
         if (!chip || !chip->dev || !chip->ops || !chip->ops->config ||
-            !chip->ops->enable || !chip->ops->disable)
+            !chip->ops->enable || !chip->ops->disable || !chip->npwm)
                 return -EINVAL;
 
         mutex_lock(&pwm_lock);
@@ -602,12 +602,9 @@ struct pwm_device *pwm_get(struct device *dev, const char *con_id)
         struct pwm_device *pwm = ERR_PTR(-EPROBE_DEFER);
         const char *dev_id = dev ? dev_name(dev) : NULL;
         struct pwm_chip *chip = NULL;
-        unsigned int index = 0;
         unsigned int best = 0;
-        struct pwm_lookup *p;
+        struct pwm_lookup *p, *chosen = NULL;
         unsigned int match;
-        unsigned int period;
-        enum pwm_polarity polarity;
 
         /* look up via DT first */
         if (IS_ENABLED(CONFIG_OF) && dev && dev->of_node)
@@ -653,10 +650,7 @@ struct pwm_device *pwm_get(struct device *dev, const char *con_id)
                 }
 
                 if (match > best) {
-                        chip = pwmchip_find_by_name(p->provider);
-                        index = p->index;
-                        period = p->period;
-                        polarity = p->polarity;
+                        chosen = p;
 
                         if (match != 3)
                                 best = match;
@@ -665,17 +659,22 @@ struct pwm_device *pwm_get(struct device *dev, const char *con_id)
                 }
         }
 
-        mutex_unlock(&pwm_lookup_lock);
+        if (!chosen)
+                goto out;
 
-        if (chip)
-                pwm = pwm_request_from_chip(chip, index, con_id ?: dev_id);
-        if (IS_ERR(pwm))
-                return pwm;
+        chip = pwmchip_find_by_name(chosen->provider);
+        if (!chip)
+                goto out;
 
-        pwm_set_period(pwm, period);
-        pwm_set_polarity(pwm, polarity);
+        pwm = pwm_request_from_chip(chip, chosen->index, con_id ?: dev_id);
+        if (IS_ERR(pwm))
+                goto out;
 
+        pwm_set_period(pwm, chosen->period);
+        pwm_set_polarity(pwm, chosen->polarity);
 
+out:
+        mutex_unlock(&pwm_lookup_lock);
         return pwm;
 }
 EXPORT_SYMBOL_GPL(pwm_get);
diff --git a/drivers/pwm/pwm-atmel.c b/drivers/pwm/pwm-atmel.c
index 6e700a541ca3..d3c22de9ee47 100644
--- a/drivers/pwm/pwm-atmel.c
+++ b/drivers/pwm/pwm-atmel.c
@@ -102,7 +102,7 @@ static int atmel_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
                             int duty_ns, int period_ns)
 {
         struct atmel_pwm_chip *atmel_pwm = to_atmel_pwm_chip(chip);
-        unsigned long clk_rate, prd, dty;
+        unsigned long prd, dty;
         unsigned long long div;
         unsigned int pres = 0;
         u32 val;
@@ -113,20 +113,18 @@ static int atmel_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
                 return -EBUSY;
         }
 
-        clk_rate = clk_get_rate(atmel_pwm->clk);
-        div = clk_rate;
+        /* Calculate the period cycles and prescale value */
+        div = (unsigned long long)clk_get_rate(atmel_pwm->clk) * period_ns;
+        do_div(div, NSEC_PER_SEC);
 
-        /* Calculate the period cycles */
         while (div > PWM_MAX_PRD) {
-                div = clk_rate / (1 << pres);
-                div = div * period_ns;
-                /* 1/Hz = 100000000 ns */
-                do_div(div, 1000000000);
-
-                if (pres++ > PRD_MAX_PRES) {
-                        dev_err(chip->dev, "pres exceeds the maximum value\n");
-                        return -EINVAL;
-                }
+                div >>= 1;
+                pres++;
+        }
+
+        if (pres > PRD_MAX_PRES) {
+                dev_err(chip->dev, "pres exceeds the maximum value\n");
+                return -EINVAL;
         }
 
         /* Calculate the duty cycles */
diff --git a/drivers/pwm/pwm-fsl-ftm.c b/drivers/pwm/pwm-fsl-ftm.c
index a18bc8fea385..0f2cc7ef7784 100644
--- a/drivers/pwm/pwm-fsl-ftm.c
+++ b/drivers/pwm/pwm-fsl-ftm.c
@@ -18,14 +18,14 @@
 #include <linux/of_address.h>
 #include <linux/platform_device.h>
 #include <linux/pwm.h>
+#include <linux/regmap.h>
 #include <linux/slab.h>
 
 #define FTM_SC          0x00
-#define FTM_SC_CLK_MASK 0x3
-#define FTM_SC_CLK_SHIFT        3
-#define FTM_SC_CLK(c)   (((c) + 1) << FTM_SC_CLK_SHIFT)
+#define FTM_SC_CLK_MASK_SHIFT   3
+#define FTM_SC_CLK_MASK (3 << FTM_SC_CLK_MASK_SHIFT)
+#define FTM_SC_CLK(c)   (((c) + 1) << FTM_SC_CLK_MASK_SHIFT)
 #define FTM_SC_PS_MASK  0x7
-#define FTM_SC_PS_SHIFT 0
 
 #define FTM_CNT         0x04
 #define FTM_MOD         0x08
@@ -83,7 +83,7 @@ struct fsl_pwm_chip {
         unsigned int cnt_select;
         unsigned int clk_ps;
 
-        void __iomem *base;
+        struct regmap *regmap;
 
         int period_ns;
 
@@ -219,10 +219,11 @@ static unsigned long fsl_pwm_calculate_duty(struct fsl_pwm_chip *fpc,
                                             unsigned long period_ns,
                                             unsigned long duty_ns)
 {
-        unsigned long long val, duty;
+        unsigned long long duty;
+        u32 val;
 
-        val = readl(fpc->base + FTM_MOD);
-        duty = duty_ns * (val + 1);
+        regmap_read(fpc->regmap, FTM_MOD, &val);
+        duty = (unsigned long long)duty_ns * (val + 1);
         do_div(duty, period_ns);
 
         return (unsigned long)duty;
@@ -232,7 +233,7 @@ static int fsl_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
                           int duty_ns, int period_ns)
 {
         struct fsl_pwm_chip *fpc = to_fsl_chip(chip);
-        u32 val, period, duty;
+        u32 period, duty;
 
         mutex_lock(&fpc->lock);
 
@@ -257,11 +258,9 @@ static int fsl_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
                         return -EINVAL;
                 }
 
-                val = readl(fpc->base + FTM_SC);
-                val &= ~(FTM_SC_PS_MASK << FTM_SC_PS_SHIFT);
-                val |= fpc->clk_ps;
-                writel(val, fpc->base + FTM_SC);
-                writel(period - 1, fpc->base + FTM_MOD);
+                regmap_update_bits(fpc->regmap, FTM_SC, FTM_SC_PS_MASK,
+                                   fpc->clk_ps);
+                regmap_write(fpc->regmap, FTM_MOD, period - 1);
 
                 fpc->period_ns = period_ns;
         }
@@ -270,8 +269,9 @@ static int fsl_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 
         duty = fsl_pwm_calculate_duty(fpc, period_ns, duty_ns);
 
-        writel(FTM_CSC_MSB | FTM_CSC_ELSB, fpc->base + FTM_CSC(pwm->hwpwm));
-        writel(duty, fpc->base + FTM_CV(pwm->hwpwm));
+        regmap_write(fpc->regmap, FTM_CSC(pwm->hwpwm),
+                     FTM_CSC_MSB | FTM_CSC_ELSB);
+        regmap_write(fpc->regmap, FTM_CV(pwm->hwpwm), duty);
 
         return 0;
 }
@@ -283,31 +283,28 @@ static int fsl_pwm_set_polarity(struct pwm_chip *chip,
         struct fsl_pwm_chip *fpc = to_fsl_chip(chip);
         u32 val;
 
-        val = readl(fpc->base + FTM_POL);
+        regmap_read(fpc->regmap, FTM_POL, &val);
 
         if (polarity == PWM_POLARITY_INVERSED)
                 val |= BIT(pwm->hwpwm);
         else
                 val &= ~BIT(pwm->hwpwm);
 
-        writel(val, fpc->base + FTM_POL);
+        regmap_write(fpc->regmap, FTM_POL, val);
 
         return 0;
 }
 
 static int fsl_counter_clock_enable(struct fsl_pwm_chip *fpc)
 {
-        u32 val;
         int ret;
 
         if (fpc->use_count != 0)
                 return 0;
 
         /* select counter clock source */
-        val = readl(fpc->base + FTM_SC);
-        val &= ~(FTM_SC_CLK_MASK << FTM_SC_CLK_SHIFT);
-        val |= FTM_SC_CLK(fpc->cnt_select);
-        writel(val, fpc->base + FTM_SC);
+        regmap_update_bits(fpc->regmap, FTM_SC, FTM_SC_CLK_MASK,
+                           FTM_SC_CLK(fpc->cnt_select));
 
         ret = clk_prepare_enable(fpc->clk[fpc->cnt_select]);
         if (ret)
@@ -327,13 +324,10 @@ static int fsl_counter_clock_enable(struct fsl_pwm_chip *fpc)
 static int fsl_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
 {
         struct fsl_pwm_chip *fpc = to_fsl_chip(chip);
-        u32 val;
         int ret;
 
         mutex_lock(&fpc->lock);
-        val = readl(fpc->base + FTM_OUTMASK);
-        val &= ~BIT(pwm->hwpwm);
-        writel(val, fpc->base + FTM_OUTMASK);
+        regmap_update_bits(fpc->regmap, FTM_OUTMASK, BIT(pwm->hwpwm), 0);
 
         ret = fsl_counter_clock_enable(fpc);
         mutex_unlock(&fpc->lock);
@@ -343,8 +337,6 @@ static int fsl_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
 
 static void fsl_counter_clock_disable(struct fsl_pwm_chip *fpc)
 {
-        u32 val;
-
         /*
          * already disabled, do nothing
          */
@@ -356,9 +348,7 @@ static void fsl_counter_clock_disable(struct fsl_pwm_chip *fpc)
                 return;
 
         /* no users left, disable PWM counter clock */
-        val = readl(fpc->base + FTM_SC);
-        val &= ~(FTM_SC_CLK_MASK << FTM_SC_CLK_SHIFT);
-        writel(val, fpc->base + FTM_SC);
+        regmap_update_bits(fpc->regmap, FTM_SC, FTM_SC_CLK_MASK, 0);
 
         clk_disable_unprepare(fpc->clk[FSL_PWM_CLK_CNTEN]);
         clk_disable_unprepare(fpc->clk[fpc->cnt_select]);
@@ -370,14 +360,12 @@ static void fsl_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
         u32 val;
 
         mutex_lock(&fpc->lock);
-        val = readl(fpc->base + FTM_OUTMASK);
-        val |= BIT(pwm->hwpwm);
-        writel(val, fpc->base + FTM_OUTMASK);
+        regmap_update_bits(fpc->regmap, FTM_OUTMASK, BIT(pwm->hwpwm),
+                           BIT(pwm->hwpwm));
 
         fsl_counter_clock_disable(fpc);
 
-        val = readl(fpc->base + FTM_OUTMASK);
-
+        regmap_read(fpc->regmap, FTM_OUTMASK, &val);
         if ((val & 0xFF) == 0xFF)
                 fpc->period_ns = 0;
 
@@ -402,19 +390,28 @@ static int fsl_pwm_init(struct fsl_pwm_chip *fpc)
         if (ret)
                 return ret;
 
-        writel(0x00, fpc->base + FTM_CNTIN);
-        writel(0x00, fpc->base + FTM_OUTINIT);
-        writel(0xFF, fpc->base + FTM_OUTMASK);
+        regmap_write(fpc->regmap, FTM_CNTIN, 0x00);
+        regmap_write(fpc->regmap, FTM_OUTINIT, 0x00);
+        regmap_write(fpc->regmap, FTM_OUTMASK, 0xFF);
 
         clk_disable_unprepare(fpc->clk[FSL_PWM_CLK_SYS]);
 
         return 0;
 }
 
+static const struct regmap_config fsl_pwm_regmap_config = {
+        .reg_bits = 32,
+        .reg_stride = 4,
+        .val_bits = 32,
+
+        .max_register = FTM_PWMLOAD,
+};
+
 static int fsl_pwm_probe(struct platform_device *pdev)
 {
         struct fsl_pwm_chip *fpc;
         struct resource *res;
+        void __iomem *base;
         int ret;
 
         fpc = devm_kzalloc(&pdev->dev, sizeof(*fpc), GFP_KERNEL);
@@ -426,9 +423,16 @@ static int fsl_pwm_probe(struct platform_device *pdev)
         fpc->chip.dev = &pdev->dev;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        fpc->base = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(fpc->base))
-                return PTR_ERR(fpc->base);
+        base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        fpc->regmap = devm_regmap_init_mmio_clk(&pdev->dev, NULL, base,
+                                                &fsl_pwm_regmap_config);
+        if (IS_ERR(fpc->regmap)) {
+                dev_err(&pdev->dev, "regmap init failed\n");
+                return PTR_ERR(fpc->regmap);
+        }
 
         fpc->clk[FSL_PWM_CLK_SYS] = devm_clk_get(&pdev->dev, "ftm_sys");
         if (IS_ERR(fpc->clk[FSL_PWM_CLK_SYS])) {
diff --git a/drivers/pwm/pwm-imx.c b/drivers/pwm/pwm-imx.c
index 5449d9150d40..f8b5f109c1ab 100644
--- a/drivers/pwm/pwm-imx.c
+++ b/drivers/pwm/pwm-imx.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/clk.h>
+#include <linux/delay.h>
 #include <linux/io.h>
 #include <linux/pwm.h>
 #include <linux/of.h>
@@ -21,24 +22,30 @@
 
 /* i.MX1 and i.MX21 share the same PWM function block: */
 
-#define MX1_PWMC    0x00   /* PWM Control Register */
-#define MX1_PWMS    0x04   /* PWM Sample Register */
-#define MX1_PWMP    0x08   /* PWM Period Register */
+#define MX1_PWMC                        0x00   /* PWM Control Register */
+#define MX1_PWMS                        0x04   /* PWM Sample Register */
+#define MX1_PWMP                        0x08   /* PWM Period Register */
 
-#define MX1_PWMC_EN             (1 << 4)
+#define MX1_PWMC_EN                     (1 << 4)
 
 /* i.MX27, i.MX31, i.MX35 share the same PWM function block: */
 
-#define MX3_PWMCR                 0x00    /* PWM Control Register */
-#define MX3_PWMSAR                0x0C    /* PWM Sample Register */
-#define MX3_PWMPR                 0x10    /* PWM Period Register */
-#define MX3_PWMCR_PRESCALER(x)    (((x - 1) & 0xFFF) << 4)
-#define MX3_PWMCR_DOZEEN                (1 << 24)
-#define MX3_PWMCR_WAITEN                (1 << 23)
+#define MX3_PWMCR                       0x00    /* PWM Control Register */
+#define MX3_PWMSR                       0x04    /* PWM Status Register */
+#define MX3_PWMSAR                      0x0C    /* PWM Sample Register */
+#define MX3_PWMPR                       0x10    /* PWM Period Register */
+#define MX3_PWMCR_PRESCALER(x)          ((((x) - 1) & 0xFFF) << 4)
+#define MX3_PWMCR_DOZEEN                (1 << 24)
+#define MX3_PWMCR_WAITEN                (1 << 23)
 #define MX3_PWMCR_DBGEN                 (1 << 22)
-#define MX3_PWMCR_CLKSRC_IPG_HIGH (2 << 16)
-#define MX3_PWMCR_CLKSRC_IPG      (1 << 16)
-#define MX3_PWMCR_EN              (1 << 0)
+#define MX3_PWMCR_CLKSRC_IPG_HIGH       (2 << 16)
+#define MX3_PWMCR_CLKSRC_IPG            (1 << 16)
+#define MX3_PWMCR_SWR                   (1 << 3)
+#define MX3_PWMCR_EN                    (1 << 0)
+#define MX3_PWMSR_FIFOAV_4WORDS         0x4
+#define MX3_PWMSR_FIFOAV_MASK           0x7
+
+#define MX3_PWM_SWR_LOOP                5
 
 struct imx_chip {
         struct clk      *clk_per;
@@ -103,9 +110,43 @@ static int imx_pwm_config_v2(struct pwm_chip *chip,
                 struct pwm_device *pwm, int duty_ns, int period_ns)
 {
         struct imx_chip *imx = to_imx_chip(chip);
+        struct device *dev = chip->dev;
         unsigned long long c;
         unsigned long period_cycles, duty_cycles, prescale;
-        u32 cr;
+        unsigned int period_ms;
+        bool enable = test_bit(PWMF_ENABLED, &pwm->flags);
+        int wait_count = 0, fifoav;
+        u32 cr, sr;
+
+        /*
+         * i.MX PWMv2 has a 4-word sample FIFO.
+         * In order to avoid FIFO overflow issue, we do software reset
+         * to clear all sample FIFO if the controller is disabled or
+         * wait for a full PWM cycle to get a relinquished FIFO slot
+         * when the controller is enabled and the FIFO is fully loaded.
+         */
+        if (enable) {
+                sr = readl(imx->mmio_base + MX3_PWMSR);
+                fifoav = sr & MX3_PWMSR_FIFOAV_MASK;
+                if (fifoav == MX3_PWMSR_FIFOAV_4WORDS) {
+                        period_ms = DIV_ROUND_UP(pwm->period, NSEC_PER_MSEC);
+                        msleep(period_ms);
+
+                        sr = readl(imx->mmio_base + MX3_PWMSR);
+                        if (fifoav == (sr & MX3_PWMSR_FIFOAV_MASK))
+                                dev_warn(dev, "there is no free FIFO slot\n");
+                }
+        } else {
+                writel(MX3_PWMCR_SWR, imx->mmio_base + MX3_PWMCR);
+                do {
+                        usleep_range(200, 1000);
+                        cr = readl(imx->mmio_base + MX3_PWMCR);
+                } while ((cr & MX3_PWMCR_SWR) &&
+                         (wait_count++ < MX3_PWM_SWR_LOOP));
+
+                if (cr & MX3_PWMCR_SWR)
+                        dev_warn(dev, "software reset timeout\n");
+        }
 
         c = clk_get_rate(imx->clk_per);
         c = c * period_ns;
@@ -135,7 +176,7 @@ static int imx_pwm_config_v2(struct pwm_chip *chip,
                 MX3_PWMCR_DOZEEN | MX3_PWMCR_WAITEN |
                 MX3_PWMCR_DBGEN | MX3_PWMCR_CLKSRC_IPG_HIGH;
 
-        if (test_bit(PWMF_ENABLED, &pwm->flags))
+        if (enable)
                 cr |= MX3_PWMCR_EN;
 
         writel(cr, imx->mmio_base + MX3_PWMCR);
diff --git a/drivers/pwm/pwm-lpss-pci.c b/drivers/pwm/pwm-lpss-pci.c
new file mode 100644
index 000000000000..cf20d2beacdd
--- /dev/null
+++ b/drivers/pwm/pwm-lpss-pci.c
@@ -0,0 +1,64 @@
+/*
+ * Intel Low Power Subsystem PWM controller PCI driver
+ *
+ * Copyright (C) 2014, Intel Corporation
+ *
+ * Derived from the original pwm-lpss.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+
+#include "pwm-lpss.h"
+
+static int pwm_lpss_probe_pci(struct pci_dev *pdev,
+                              const struct pci_device_id *id)
+{
+        const struct pwm_lpss_boardinfo *info;
+        struct pwm_lpss_chip *lpwm;
+        int err;
+
+        err = pcim_enable_device(pdev);
+        if (err < 0)
+                return err;
+
+        info = (struct pwm_lpss_boardinfo *)id->driver_data;
+        lpwm = pwm_lpss_probe(&pdev->dev, &pdev->resource[0], info);
+        if (IS_ERR(lpwm))
+                return PTR_ERR(lpwm);
+
+        pci_set_drvdata(pdev, lpwm);
+        return 0;
+}
+
+static void pwm_lpss_remove_pci(struct pci_dev *pdev)
+{
+        struct pwm_lpss_chip *lpwm = pci_get_drvdata(pdev);
+
+        pwm_lpss_remove(lpwm);
+}
+
+static const struct pci_device_id pwm_lpss_pci_ids[] = {
+        { PCI_VDEVICE(INTEL, 0x0f08), (unsigned long)&pwm_lpss_byt_info},
+        { PCI_VDEVICE(INTEL, 0x0f09), (unsigned long)&pwm_lpss_byt_info},
+        { PCI_VDEVICE(INTEL, 0x2288), (unsigned long)&pwm_lpss_bsw_info},
+        { PCI_VDEVICE(INTEL, 0x2289), (unsigned long)&pwm_lpss_bsw_info},
+        { },
+};
+MODULE_DEVICE_TABLE(pci, pwm_lpss_pci_ids);
+
+static struct pci_driver pwm_lpss_driver_pci = {
+        .name = "pwm-lpss",
+        .id_table = pwm_lpss_pci_ids,
+        .probe = pwm_lpss_probe_pci,
+        .remove = pwm_lpss_remove_pci,
+};
+module_pci_driver(pwm_lpss_driver_pci);
+
+MODULE_DESCRIPTION("PWM PCI driver for Intel LPSS");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/pwm/pwm-lpss-platform.c b/drivers/pwm/pwm-lpss-platform.c
new file mode 100644
index 000000000000..18a9c880a76d
--- /dev/null
+++ b/drivers/pwm/pwm-lpss-platform.c
@@ -0,0 +1,68 @@
+/*
+ * Intel Low Power Subsystem PWM controller driver
+ *
+ * Copyright (C) 2014, Intel Corporation
+ *
+ * Derived from the original pwm-lpss.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/acpi.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include "pwm-lpss.h"
+
+static int pwm_lpss_probe_platform(struct platform_device *pdev)
+{
+        const struct pwm_lpss_boardinfo *info;
+        const struct acpi_device_id *id;
+        struct pwm_lpss_chip *lpwm;
+        struct resource *r;
+
+        id = acpi_match_device(pdev->dev.driver->acpi_match_table, &pdev->dev);
+        if (!id)
+                return -ENODEV;
+
+        info = (const struct pwm_lpss_boardinfo *)id->driver_data;
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+        lpwm = pwm_lpss_probe(&pdev->dev, r, info);
+        if (IS_ERR(lpwm))
+                return PTR_ERR(lpwm);
+
+        platform_set_drvdata(pdev, lpwm);
+        return 0;
+}
+
+static int pwm_lpss_remove_platform(struct platform_device *pdev)
+{
+        struct pwm_lpss_chip *lpwm = platform_get_drvdata(pdev);
+
+        return pwm_lpss_remove(lpwm);
+}
+
+static const struct acpi_device_id pwm_lpss_acpi_match[] = {
+        { "80860F09", (unsigned long)&pwm_lpss_byt_info },
+        { "80862288", (unsigned long)&pwm_lpss_bsw_info },
+        { },
+};
+MODULE_DEVICE_TABLE(acpi, pwm_lpss_acpi_match);
+
+static struct platform_driver pwm_lpss_driver_platform = {
+        .driver = {
+                .name = "pwm-lpss",
+                .acpi_match_table = pwm_lpss_acpi_match,
+        },
+        .probe = pwm_lpss_probe_platform,
+        .remove = pwm_lpss_remove_platform,
+};
+module_platform_driver(pwm_lpss_driver_platform);
+
+MODULE_DESCRIPTION("PWM platform driver for Intel LPSS");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:pwm-lpss");
diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 4df994f72d96..e9798253a16f 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -13,15 +13,11 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/acpi.h>
-#include <linux/device.h>
+#include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/pwm.h>
-#include <linux/platform_device.h>
-#include <linux/pci.h>
 
-static int pci_drv, plat_drv;   /* So we know which drivers registered */
+#include "pwm-lpss.h"
 
 #define PWM                             0x00000000
 #define PWM_ENABLE                      BIT(31)
@@ -39,14 +35,17 @@ struct pwm_lpss_chip {
         unsigned long clk_rate;
 };
 
-struct pwm_lpss_boardinfo {
-        unsigned long clk_rate;
+/* BayTrail */
+const struct pwm_lpss_boardinfo pwm_lpss_byt_info = {
+        .clk_rate = 25000000
 };
+EXPORT_SYMBOL_GPL(pwm_lpss_byt_info);
 
-/* BayTrail */
-static const struct pwm_lpss_boardinfo byt_info = {
-        25000000
+/* Braswell */
+const struct pwm_lpss_boardinfo pwm_lpss_bsw_info = {
+        .clk_rate = 19200000
 };
+EXPORT_SYMBOL_GPL(pwm_lpss_bsw_info);
 
 static inline struct pwm_lpss_chip *to_lpwm(struct pwm_chip *chip)
 {
@@ -118,9 +117,8 @@ static const struct pwm_ops pwm_lpss_ops = {
         .owner = THIS_MODULE,
 };
 
-static struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev,
-                                            struct resource *r,
-                                            const struct pwm_lpss_boardinfo *info)
+struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, struct resource *r,
+                                     const struct pwm_lpss_boardinfo *info)
 {
         struct pwm_lpss_chip *lpwm;
         int ret;
@@ -147,8 +145,9 @@ static struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev,
 
         return lpwm;
 }
+EXPORT_SYMBOL_GPL(pwm_lpss_probe);
 
-static int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
+int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
 {
         u32 ctrl;
 
@@ -157,114 +156,8 @@ static int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
 
         return pwmchip_remove(&lpwm->chip);
 }
-
-static int pwm_lpss_probe_pci(struct pci_dev *pdev,
-                              const struct pci_device_id *id)
-{
-        const struct pwm_lpss_boardinfo *info;
-        struct pwm_lpss_chip *lpwm;
-        int err;
-
-        err = pci_enable_device(pdev);
-        if (err < 0)
-                return err;
-
-        info = (struct pwm_lpss_boardinfo *)id->driver_data;
-        lpwm = pwm_lpss_probe(&pdev->dev, &pdev->resource[0], info);
-        if (IS_ERR(lpwm))
-                return PTR_ERR(lpwm);
-
-        pci_set_drvdata(pdev, lpwm);
-        return 0;
-}
-
-static void pwm_lpss_remove_pci(struct pci_dev *pdev)
-{
-        struct pwm_lpss_chip *lpwm = pci_get_drvdata(pdev);
-
-        pwm_lpss_remove(lpwm);
-        pci_disable_device(pdev);
-}
-
-static struct pci_device_id pwm_lpss_pci_ids[] = {
-        { PCI_VDEVICE(INTEL, 0x0f08), (unsigned long)&byt_info},
-        { PCI_VDEVICE(INTEL, 0x0f09), (unsigned long)&byt_info},
-        { },
-};
-MODULE_DEVICE_TABLE(pci, pwm_lpss_pci_ids);
-
-static struct pci_driver pwm_lpss_driver_pci = {
-        .name = "pwm-lpss",
-        .id_table = pwm_lpss_pci_ids,
-        .probe = pwm_lpss_probe_pci,
-        .remove = pwm_lpss_remove_pci,
-};
-
-static int pwm_lpss_probe_platform(struct platform_device *pdev)
-{
-        const struct pwm_lpss_boardinfo *info;
-        const struct acpi_device_id *id;
-        struct pwm_lpss_chip *lpwm;
-        struct resource *r;
-
-        id = acpi_match_device(pdev->dev.driver->acpi_match_table, &pdev->dev);
-        if (!id)
-                return -ENODEV;
-
-        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-
-        info = (struct pwm_lpss_boardinfo *)id->driver_data;
-        lpwm = pwm_lpss_probe(&pdev->dev, r, info);
-        if (IS_ERR(lpwm))
-                return PTR_ERR(lpwm);
-
-        platform_set_drvdata(pdev, lpwm);
-        return 0;
-}
-
-static int pwm_lpss_remove_platform(struct platform_device *pdev)
-{
-        struct pwm_lpss_chip *lpwm = platform_get_drvdata(pdev);
-
-        return pwm_lpss_remove(lpwm);
-}
-
-static const struct acpi_device_id pwm_lpss_acpi_match[] = {
-        { "80860F09", (unsigned long)&byt_info },
-        { },
-};
-MODULE_DEVICE_TABLE(acpi, pwm_lpss_acpi_match);
-
-static struct platform_driver pwm_lpss_driver_platform = {
-        .driver = {
-                .name = "pwm-lpss",
-                .acpi_match_table = pwm_lpss_acpi_match,
-        },
-        .probe = pwm_lpss_probe_platform,
-        .remove = pwm_lpss_remove_platform,
-};
-
-static int __init pwm_init(void)
-{
-        pci_drv = pci_register_driver(&pwm_lpss_driver_pci);
-        plat_drv = platform_driver_register(&pwm_lpss_driver_platform);
-        if (pci_drv && plat_drv)
-                return pci_drv;
-
-        return 0;
-}
-module_init(pwm_init);
-
-static void __exit pwm_exit(void)
-{
-        if (!pci_drv)
-                pci_unregister_driver(&pwm_lpss_driver_pci);
-        if (!plat_drv)
-                platform_driver_unregister(&pwm_lpss_driver_platform);
-}
-module_exit(pwm_exit);
+EXPORT_SYMBOL_GPL(pwm_lpss_remove);
 
 MODULE_DESCRIPTION("PWM driver for Intel LPSS");
 MODULE_AUTHOR("Mika Westerberg <mika.westerberg@linux.intel.com>");
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:pwm-lpss");
diff --git a/drivers/pwm/pwm-lpss.h b/drivers/pwm/pwm-lpss.h
new file mode 100644
index 000000000000..aa041bb1b67d
--- /dev/null
+++ b/drivers/pwm/pwm-lpss.h
@@ -0,0 +1,32 @@
+/*
+ * Intel Low Power Subsystem PWM controller driver
+ *
+ * Copyright (C) 2014, Intel Corporation
+ *
+ * Derived from the original pwm-lpss.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __PWM_LPSS_H
+#define __PWM_LPSS_H
+
+#include <linux/device.h>
+#include <linux/pwm.h>
+
+struct pwm_lpss_chip;
+
+struct pwm_lpss_boardinfo {
+        unsigned long clk_rate;
+};
+
+extern const struct pwm_lpss_boardinfo pwm_lpss_byt_info;
+extern const struct pwm_lpss_boardinfo pwm_lpss_bsw_info;
+
+struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, struct resource *r,
+                                     const struct pwm_lpss_boardinfo *info);
+int pwm_lpss_remove(struct pwm_lpss_chip *lpwm);
+
+#endif  /* __PWM_LPSS_H */
diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
index bdd8644c01cf..9442df244101 100644
--- a/drivers/pwm/pwm-rockchip.c
+++ b/drivers/pwm/pwm-rockchip.c
@@ -24,7 +24,9 @@
 #define PWM_ENABLE              (1 << 0)
 #define PWM_CONTINUOUS          (1 << 1)
 #define PWM_DUTY_POSITIVE       (1 << 3)
+#define PWM_DUTY_NEGATIVE       (0 << 3)
 #define PWM_INACTIVE_NEGATIVE   (0 << 4)
+#define PWM_INACTIVE_POSITIVE   (1 << 4)
 #define PWM_OUTPUT_LEFT         (0 << 5)
 #define PWM_LP_DISABLE          (0 << 8)
 
@@ -45,8 +47,10 @@ struct rockchip_pwm_regs {
 struct rockchip_pwm_data {
         struct rockchip_pwm_regs regs;
         unsigned int prescaler;
+        const struct pwm_ops *ops;
 
-        void (*set_enable)(struct pwm_chip *chip, bool enable);
+        void (*set_enable)(struct pwm_chip *chip,
+                           struct pwm_device *pwm, bool enable);
 };
 
 static inline struct rockchip_pwm_chip *to_rockchip_pwm_chip(struct pwm_chip *c)
@@ -54,7 +58,8 @@ static inline struct rockchip_pwm_chip *to_rockchip_pwm_chip(struct pwm_chip *c)
         return container_of(c, struct rockchip_pwm_chip, chip);
 }
 
-static void rockchip_pwm_set_enable_v1(struct pwm_chip *chip, bool enable)
+static void rockchip_pwm_set_enable_v1(struct pwm_chip *chip,
+                                       struct pwm_device *pwm, bool enable)
 {
         struct rockchip_pwm_chip *pc = to_rockchip_pwm_chip(chip);
         u32 enable_conf = PWM_CTRL_OUTPUT_EN | PWM_CTRL_TIMER_EN;
@@ -70,14 +75,19 @@ static void rockchip_pwm_set_enable_v1(struct pwm_chip *chip, bool enable)
         writel_relaxed(val, pc->base + pc->data->regs.ctrl);
 }
 
-static void rockchip_pwm_set_enable_v2(struct pwm_chip *chip, bool enable)
+static void rockchip_pwm_set_enable_v2(struct pwm_chip *chip,
+                                       struct pwm_device *pwm, bool enable)
 {
         struct rockchip_pwm_chip *pc = to_rockchip_pwm_chip(chip);
         u32 enable_conf = PWM_OUTPUT_LEFT | PWM_LP_DISABLE | PWM_ENABLE |
-                          PWM_CONTINUOUS | PWM_DUTY_POSITIVE |
-                          PWM_INACTIVE_NEGATIVE;
+                          PWM_CONTINUOUS;
         u32 val;
 
+        if (pwm->polarity == PWM_POLARITY_INVERSED)
+                enable_conf |= PWM_DUTY_NEGATIVE | PWM_INACTIVE_POSITIVE;
+        else
+                enable_conf |= PWM_DUTY_POSITIVE | PWM_INACTIVE_NEGATIVE;
+
         val = readl_relaxed(pc->base + pc->data->regs.ctrl);
 
         if (enable)
@@ -124,6 +134,19 @@ static int rockchip_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
         return 0;
 }
 
+static int rockchip_pwm_set_polarity(struct pwm_chip *chip,
+                                     struct pwm_device *pwm,
+                                     enum pwm_polarity polarity)
+{
+        /*
+         * No action needed here because pwm->polarity will be set by the core
+         * and the core will only change polarity when the PWM is not enabled.
+         * We'll handle things in set_enable().
+         */
+
+        return 0;
+}
+
 static int rockchip_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
 {
         struct rockchip_pwm_chip *pc = to_rockchip_pwm_chip(chip);
@@ -133,7 +156,7 @@ static int rockchip_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
         if (ret)
                 return ret;
 
-        pc->data->set_enable(chip, true);
+        pc->data->set_enable(chip, pwm, true);
 
         return 0;
 }
@@ -142,18 +165,26 @@ static void rockchip_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
 {
         struct rockchip_pwm_chip *pc = to_rockchip_pwm_chip(chip);
 
-        pc->data->set_enable(chip, false);
+        pc->data->set_enable(chip, pwm, false);
 
         clk_disable(pc->clk);
 }
 
-static const struct pwm_ops rockchip_pwm_ops = {
+static const struct pwm_ops rockchip_pwm_ops_v1 = {
         .config = rockchip_pwm_config,
         .enable = rockchip_pwm_enable,
         .disable = rockchip_pwm_disable,
         .owner = THIS_MODULE,
 };
 
+static const struct pwm_ops rockchip_pwm_ops_v2 = {
+        .config = rockchip_pwm_config,
+        .set_polarity = rockchip_pwm_set_polarity,
+        .enable = rockchip_pwm_enable,
+        .disable = rockchip_pwm_disable,
+        .owner = THIS_MODULE,
+};
+
 static const struct rockchip_pwm_data pwm_data_v1 = {
         .regs = {
                 .duty = 0x04,
@@ -162,6 +193,7 @@ static const struct rockchip_pwm_data pwm_data_v1 = {
                 .ctrl = 0x0c,
         },
         .prescaler = 2,
+        .ops = &rockchip_pwm_ops_v1,
         .set_enable = rockchip_pwm_set_enable_v1,
 };
 
@@ -173,6 +205,7 @@ static const struct rockchip_pwm_data pwm_data_v2 = {
                 .ctrl = 0x0c,
         },
         .prescaler = 1,
+        .ops = &rockchip_pwm_ops_v2,
         .set_enable = rockchip_pwm_set_enable_v2,
 };
 
@@ -184,6 +217,7 @@ static const struct rockchip_pwm_data pwm_data_vop = {
                 .ctrl = 0x00,
         },
         .prescaler = 1,
+        .ops = &rockchip_pwm_ops_v2,
         .set_enable = rockchip_pwm_set_enable_v2,
 };
 
@@ -227,10 +261,15 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
 
         pc->data = id->data;
         pc->chip.dev = &pdev->dev;
-        pc->chip.ops = &rockchip_pwm_ops;
+        pc->chip.ops = pc->data->ops;
         pc->chip.base = -1;
         pc->chip.npwm = 1;
 
+        if (pc->data->ops->set_polarity) {
+                pc->chip.of_xlate = of_pwm_xlate_with_flags;
+                pc->chip.of_pwm_n_cells = 3;
+        }
+
         ret = pwmchip_add(&pc->chip);
         if (ret < 0) {
                 clk_unprepare(pc->clk);
diff --git a/drivers/regulator/max1586.c b/drivers/regulator/max1586.c
index 86db310d5304..d2a8c64cae42 100644
--- a/drivers/regulator/max1586.c
+++ b/drivers/regulator/max1586.c
@@ -163,7 +163,7 @@ static int of_get_max1586_platform_data(struct device *dev,
                                  struct max1586_platform_data *pdata)
 {
         struct max1586_subdev_data *sub;
-        struct of_regulator_match rmatch[ARRAY_SIZE(max1586_reg)];
+        struct of_regulator_match rmatch[ARRAY_SIZE(max1586_reg)] = { };
         struct device_node *np = dev->of_node;
         int i, matched;
 
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index ef1af2debbd2..f69320e1738f 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -395,7 +395,7 @@ static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
         struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np;
         struct max77686_regulator_data *rdata;
-        struct of_regulator_match rmatch;
+        struct of_regulator_match rmatch = { };
         unsigned int i;
 
         pmic_np = iodev->dev->of_node;
diff --git a/drivers/regulator/max77693.c b/drivers/regulator/max77693.c
index c67ff05fc1dd..d158f71fa128 100644
--- a/drivers/regulator/max77693.c
+++ b/drivers/regulator/max77693.c
@@ -227,7 +227,7 @@ static int max77693_pmic_probe(struct platform_device *pdev)
         struct max77693_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct max77693_regulator_data *rdata = NULL;
         int num_rdata, i;
-        struct regulator_config config;
+        struct regulator_config config = { };
 
         num_rdata = max77693_pmic_init_rdata(&pdev->dev, &rdata);
         if (!rdata || num_rdata <= 0) {
diff --git a/drivers/regulator/max77802.c b/drivers/regulator/max77802.c
index d89792b084e9..45fa240fe243 100644
--- a/drivers/regulator/max77802.c
+++ b/drivers/regulator/max77802.c
@@ -454,7 +454,7 @@ static int max77802_pmic_dt_parse_pdata(struct platform_device *pdev,
         struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np;
         struct max77686_regulator_data *rdata;
-        struct of_regulator_match rmatch;
+        struct of_regulator_match rmatch = { };
         unsigned int i;
 
         pmic_np = iodev->dev->of_node;
diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
index 2fc411188794..7eee2ca18541 100644
--- a/drivers/regulator/max8660.c
+++ b/drivers/regulator/max8660.c
@@ -335,7 +335,7 @@ static int max8660_pdata_from_dt(struct device *dev,
         int matched, i;
         struct device_node *np;
         struct max8660_subdev_data *sub;
-        struct of_regulator_match rmatch[ARRAY_SIZE(max8660_reg)];
+        struct of_regulator_match rmatch[ARRAY_SIZE(max8660_reg)] = { };
 
         np = of_get_child_by_name(dev->of_node, "regulators");
         if (!np) {
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 7a51814abdc5..5a1d4afa4776 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -211,7 +211,8 @@ struct regulator_init_data *regulator_of_get_init_data(struct device *dev,
                 search = dev->of_node;
 
         if (!search) {
-                dev_err(dev, "Failed to find regulator container node\n");
+                dev_dbg(dev, "Failed to find regulator container node '%s'\n",
+                        desc->regulators_node);
                 return NULL;
         }
 
diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
index e305416d7697..196a5c8838c4 100644
--- a/drivers/regulator/rk808-regulator.c
+++ b/drivers/regulator/rk808-regulator.c
@@ -44,7 +44,7 @@ static const int rk808_buck_config_regs[] = {
 };
 
 static const struct regulator_linear_range rk808_buck_voltage_ranges[] = {
-        REGULATOR_LINEAR_RANGE(700000, 0, 63, 12500),
+        REGULATOR_LINEAR_RANGE(712500, 0, 63, 12500),
 };
 
 static const struct regulator_linear_range rk808_buck4_voltage_ranges[] = {
diff --git a/drivers/regulator/s2mpa01.c b/drivers/regulator/s2mpa01.c
index 4acefa6b462e..7633b9bfbe6e 100644
--- a/drivers/regulator/s2mpa01.c
+++ b/drivers/regulator/s2mpa01.c
@@ -341,7 +341,7 @@ static int s2mpa01_pmic_probe(struct platform_device *pdev)
 {
         struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct sec_platform_data *pdata = dev_get_platdata(iodev->dev);
-        struct of_regulator_match rdata[S2MPA01_REGULATOR_MAX];
+        struct of_regulator_match rdata[S2MPA01_REGULATOR_MAX] = { };
         struct device_node *reg_np = NULL;
         struct regulator_config config = { };
         struct s2mpa01_info *s2mpa01;
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 8cd0beebdc3f..6dd12ddbabc6 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -830,7 +830,7 @@ config RTC_DRV_DA9063
 
 config RTC_DRV_EFI
         tristate "EFI RTC"
-        depends on EFI
+        depends on EFI && !X86
         help
           If you say yes here you will get support for the EFI
           Real Time Clock.
@@ -1320,7 +1320,7 @@ config RTC_DRV_LPC32XX
 
 config RTC_DRV_PM8XXX
         tristate "Qualcomm PMIC8XXX RTC"
-        depends on MFD_PM8XXX
+        depends on MFD_PM8XXX || MFD_SPMI_PMIC
         help
           If you say yes here you get support for the
           Qualcomm PMIC8XXX RTC.
diff --git a/drivers/rtc/rtc-bq32k.c b/drivers/rtc/rtc-bq32k.c
index 314129e66d6e..92679df6d6e2 100644
--- a/drivers/rtc/rtc-bq32k.c
+++ b/drivers/rtc/rtc-bq32k.c
@@ -160,7 +160,7 @@ static int trickle_charger_of_init(struct device *dev, struct device_node *node)
                         dev_err(dev, "bq32k: diode and resistor mismatch\n");
                         return -EINVAL;
                 }
-                reg = 0x25;
+                reg = 0x45;
                 break;
 
         default:
diff --git a/drivers/rtc/rtc-efi.c b/drivers/rtc/rtc-efi.c
index c384fec6d173..53b589dc34eb 100644
--- a/drivers/rtc/rtc-efi.c
+++ b/drivers/rtc/rtc-efi.c
@@ -236,3 +236,4 @@ MODULE_ALIAS("platform:rtc-efi");
 MODULE_AUTHOR("dann frazier <dannf@hp.com>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("EFI RTC driver");
+MODULE_ALIAS("platform:rtc-efi");
diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
index 197699f358c7..5adcf111fc14 100644
--- a/drivers/rtc/rtc-pm8xxx.c
+++ b/drivers/rtc/rtc-pm8xxx.c
@@ -27,21 +27,36 @@
 
 /* RTC_CTRL register bit fields */
 #define PM8xxx_RTC_ENABLE               BIT(7)
-#define PM8xxx_RTC_ALARM_ENABLE         BIT(1)
 #define PM8xxx_RTC_ALARM_CLEAR          BIT(0)
 
 #define NUM_8_BIT_RTC_REGS              0x4
 
 /**
+ * struct pm8xxx_rtc_regs - describe RTC registers per PMIC versions
+ * @ctrl: base address of control register
+ * @write: base address of write register
+ * @read: base address of read register
+ * @alarm_ctrl: base address of alarm control register
+ * @alarm_ctrl2: base address of alarm control2 register
+ * @alarm_rw: base address of alarm read-write register
+ * @alarm_en: alarm enable mask
+ */
+struct pm8xxx_rtc_regs {
+        unsigned int ctrl;
+        unsigned int write;
+        unsigned int read;
+        unsigned int alarm_ctrl;
+        unsigned int alarm_ctrl2;
+        unsigned int alarm_rw;
+        unsigned int alarm_en;
+};
+
+/**
  * struct pm8xxx_rtc -  rtc driver internal structure
  * @rtc:                rtc device for this driver.
  * @regmap:             regmap used to access RTC registers
  * @allow_set_time:     indicates whether writing to the RTC is allowed
  * @rtc_alarm_irq:      rtc alarm irq number.
- * @rtc_base:           address of rtc control register.
- * @rtc_read_base:      base address of read registers.
- * @rtc_write_base:     base address of write registers.
- * @alarm_rw_base:      base address of alarm registers.
  * @ctrl_reg:           rtc control register.
  * @rtc_dev:            device structure.
  * @ctrl_reg_lock:      spinlock protecting access to ctrl_reg.
@@ -51,11 +66,7 @@ struct pm8xxx_rtc {
         struct regmap *regmap;
         bool allow_set_time;
         int rtc_alarm_irq;
-        int rtc_base;
-        int rtc_read_base;
-        int rtc_write_base;
-        int alarm_rw_base;
-        u8 ctrl_reg;
+        const struct pm8xxx_rtc_regs *regs;
         struct device *rtc_dev;
         spinlock_t ctrl_reg_lock;
 };
@@ -71,8 +82,10 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
         int rc, i;
         unsigned long secs, irq_flags;
-        u8 value[NUM_8_BIT_RTC_REGS], alarm_enabled = 0, ctrl_reg;
+        u8 value[NUM_8_BIT_RTC_REGS], alarm_enabled = 0;
+        unsigned int ctrl_reg;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
         if (!rtc_dd->allow_set_time)
                 return -EACCES;
@@ -87,30 +100,30 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
         dev_dbg(dev, "Seconds value to be written to RTC = %lu\n", secs);
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
-        ctrl_reg = rtc_dd->ctrl_reg;
 
-        if (ctrl_reg & PM8xxx_RTC_ALARM_ENABLE) {
+        rc = regmap_read(rtc_dd->regmap, regs->ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
+
+        if (ctrl_reg & regs->alarm_en) {
                 alarm_enabled = 1;
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+                ctrl_reg &= ~regs->alarm_en;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
                 if (rc) {
                         dev_err(dev, "Write to RTC control register failed\n");
                         goto rtc_rw_fail;
                 }
-                rtc_dd->ctrl_reg = ctrl_reg;
-        } else {
-                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
         }
 
         /* Write 0 to Byte[0] */
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_write_base, 0);
+        rc = regmap_write(rtc_dd->regmap, regs->write, 0);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
                 goto rtc_rw_fail;
         }
 
         /* Write Byte[1], Byte[2], Byte[3] */
-        rc = regmap_bulk_write(rtc_dd->regmap, rtc_dd->rtc_write_base + 1,
+        rc = regmap_bulk_write(rtc_dd->regmap, regs->write + 1,
                                &value[1], sizeof(value) - 1);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
@@ -118,25 +131,23 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
         }
 
         /* Write Byte[0] */
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_write_base, value[0]);
+        rc = regmap_write(rtc_dd->regmap, regs->write, value[0]);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
                 goto rtc_rw_fail;
         }
 
         if (alarm_enabled) {
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+                ctrl_reg |= regs->alarm_en;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
                 if (rc) {
                         dev_err(dev, "Write to RTC control register failed\n");
                         goto rtc_rw_fail;
                 }
-                rtc_dd->ctrl_reg = ctrl_reg;
         }
 
 rtc_rw_fail:
-        if (alarm_enabled)
-                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
+        spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         return rc;
 }
@@ -148,9 +159,9 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
         unsigned long secs;
         unsigned int reg;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
-        rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->rtc_read_base,
-                              value, sizeof(value));
+        rc = regmap_bulk_read(rtc_dd->regmap, regs->read, value, sizeof(value));
         if (rc) {
                 dev_err(dev, "RTC read data register failed\n");
                 return rc;
@@ -160,14 +171,14 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
          * Read the LSB again and check if there has been a carry over.
          * If there is, redo the read operation.
          */
-        rc = regmap_read(rtc_dd->regmap, rtc_dd->rtc_read_base, &reg);
+        rc = regmap_read(rtc_dd->regmap, regs->read, &reg);
         if (rc < 0) {
                 dev_err(dev, "RTC read data register failed\n");
                 return rc;
         }
 
         if (unlikely(reg < value[0])) {
-                rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->rtc_read_base,
+                rc = regmap_bulk_read(rtc_dd->regmap, regs->read,
                                       value, sizeof(value));
                 if (rc) {
                         dev_err(dev, "RTC read data register failed\n");
@@ -195,9 +206,11 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
 static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 {
         int rc, i;
-        u8 value[NUM_8_BIT_RTC_REGS], ctrl_reg;
+        u8 value[NUM_8_BIT_RTC_REGS];
+        unsigned int ctrl_reg;
         unsigned long secs, irq_flags;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
         rtc_tm_to_time(&alarm->time, &secs);
 
@@ -208,28 +221,28 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
-        rc = regmap_bulk_write(rtc_dd->regmap, rtc_dd->alarm_rw_base, value,
+        rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value,
                                sizeof(value));
         if (rc) {
                 dev_err(dev, "Write to RTC ALARM register failed\n");
                 goto rtc_rw_fail;
         }
 
-        ctrl_reg = rtc_dd->ctrl_reg;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
 
         if (alarm->enabled)
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg |= regs->alarm_en;
         else
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
-                dev_err(dev, "Write to RTC control register failed\n");
+                dev_err(dev, "Write to RTC alarm control register failed\n");
                 goto rtc_rw_fail;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
-
         dev_dbg(dev, "Alarm Set for h:r:s=%d:%d:%d, d/m/y=%d/%d/%d\n",
                 alarm->time.tm_hour, alarm->time.tm_min,
                 alarm->time.tm_sec, alarm->time.tm_mday,
@@ -245,8 +258,9 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
         u8 value[NUM_8_BIT_RTC_REGS];
         unsigned long secs;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
-        rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->alarm_rw_base, value,
+        rc = regmap_bulk_read(rtc_dd->regmap, regs->alarm_rw, value,
                               sizeof(value));
         if (rc) {
                 dev_err(dev, "RTC alarm time read failed\n");
@@ -276,25 +290,26 @@ static int pm8xxx_rtc_alarm_irq_enable(struct device *dev, unsigned int enable)
         int rc;
         unsigned long irq_flags;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
-        u8 ctrl_reg;
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
+        unsigned int ctrl_reg;
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
-        ctrl_reg = rtc_dd->ctrl_reg;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
 
         if (enable)
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg |= regs->alarm_en;
         else
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
                 dev_err(dev, "Write to RTC control register failed\n");
                 goto rtc_rw_fail;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
-
 rtc_rw_fail:
         spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
         return rc;
@@ -311,6 +326,7 @@ static const struct rtc_class_ops pm8xxx_rtc_ops = {
 static irqreturn_t pm8xxx_alarm_trigger(int irq, void *dev_id)
 {
         struct pm8xxx_rtc *rtc_dd = dev_id;
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
         unsigned int ctrl_reg;
         int rc;
         unsigned long irq_flags;
@@ -320,48 +336,100 @@ static irqreturn_t pm8xxx_alarm_trigger(int irq, void *dev_id)
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         /* Clear the alarm enable bit */
-        ctrl_reg = rtc_dd->ctrl_reg;
-        ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc) {
+                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
+                goto rtc_alarm_handled;
+        }
+
+        ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
                 spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
                 dev_err(rtc_dd->rtc_dev,
-                        "Write to RTC control register failed\n");
+                        "Write to alarm control register failed\n");
                 goto rtc_alarm_handled;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
         spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         /* Clear RTC alarm register */
-        rc = regmap_read(rtc_dd->regmap,
-                         rtc_dd->rtc_base + PM8XXX_ALARM_CTRL_OFFSET,
-                         &ctrl_reg);
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl2, &ctrl_reg);
         if (rc) {
                 dev_err(rtc_dd->rtc_dev,
-                        "RTC Alarm control register read failed\n");
+                        "RTC Alarm control2 register read failed\n");
                 goto rtc_alarm_handled;
         }
 
-        ctrl_reg &= ~PM8xxx_RTC_ALARM_CLEAR;
-        rc = regmap_write(rtc_dd->regmap,
-                          rtc_dd->rtc_base + PM8XXX_ALARM_CTRL_OFFSET,
-                          ctrl_reg);
+        ctrl_reg |= PM8xxx_RTC_ALARM_CLEAR;
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl2, ctrl_reg);
         if (rc)
                 dev_err(rtc_dd->rtc_dev,
-                        "Write to RTC Alarm control register failed\n");
+                        "Write to RTC Alarm control2 register failed\n");
 
 rtc_alarm_handled:
         return IRQ_HANDLED;
 }
 
+static int pm8xxx_rtc_enable(struct pm8xxx_rtc *rtc_dd)
+{
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
+        unsigned int ctrl_reg;
+        int rc;
+
+        /* Check if the RTC is on, else turn it on */
+        rc = regmap_read(rtc_dd->regmap, regs->ctrl, &ctrl_reg);
+        if (rc)
+                return rc;
+
+        if (!(ctrl_reg & PM8xxx_RTC_ENABLE)) {
+                ctrl_reg |= PM8xxx_RTC_ENABLE;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
+
+static const struct pm8xxx_rtc_regs pm8921_regs = {
+        .ctrl           = 0x11d,
+        .write          = 0x11f,
+        .read           = 0x123,
+        .alarm_rw       = 0x127,
+        .alarm_ctrl     = 0x11d,
+        .alarm_ctrl2    = 0x11e,
+        .alarm_en       = BIT(1),
+};
+
+static const struct pm8xxx_rtc_regs pm8058_regs = {
+        .ctrl           = 0x1e8,
+        .write          = 0x1ea,
+        .read           = 0x1ee,
+        .alarm_rw       = 0x1f2,
+        .alarm_ctrl     = 0x1e8,
+        .alarm_ctrl2    = 0x1e9,
+        .alarm_en       = BIT(1),
+};
+
+static const struct pm8xxx_rtc_regs pm8941_regs = {
+        .ctrl           = 0x6046,
+        .write          = 0x6040,
+        .read           = 0x6048,
+        .alarm_rw       = 0x6140,
+        .alarm_ctrl     = 0x6146,
+        .alarm_ctrl2    = 0x6148,
+        .alarm_en       = BIT(7),
+};
+
 /*
  * Hardcoded RTC bases until IORESOURCE_REG mapping is figured out
  */
 static const struct of_device_id pm8xxx_id_table[] = {
-        { .compatible = "qcom,pm8921-rtc", .data = (void *) 0x11D },
-        { .compatible = "qcom,pm8058-rtc", .data = (void *) 0x1E8 },
+        { .compatible = "qcom,pm8921-rtc", .data = &pm8921_regs },
+        { .compatible = "qcom,pm8058-rtc", .data = &pm8058_regs },
+        { .compatible = "qcom,pm8941-rtc", .data = &pm8941_regs },
         { },
 };
 MODULE_DEVICE_TABLE(of, pm8xxx_id_table);
@@ -369,7 +437,6 @@ MODULE_DEVICE_TABLE(of, pm8xxx_id_table);
 static int pm8xxx_rtc_probe(struct platform_device *pdev)
 {
         int rc;
-        unsigned int ctrl_reg;
         struct pm8xxx_rtc *rtc_dd;
         const struct of_device_id *match;
 
@@ -399,33 +466,12 @@ static int pm8xxx_rtc_probe(struct platform_device *pdev)
         rtc_dd->allow_set_time = of_property_read_bool(pdev->dev.of_node,
                                                       "allow-set-time");
 
-        rtc_dd->rtc_base = (long) match->data;
-
-        /* Setup RTC register addresses */
-        rtc_dd->rtc_write_base = rtc_dd->rtc_base + PM8XXX_RTC_WRITE_OFFSET;
-        rtc_dd->rtc_read_base = rtc_dd->rtc_base + PM8XXX_RTC_READ_OFFSET;
-        rtc_dd->alarm_rw_base = rtc_dd->rtc_base + PM8XXX_ALARM_RW_OFFSET;
-
+        rtc_dd->regs = match->data;
         rtc_dd->rtc_dev = &pdev->dev;
 
-        /* Check if the RTC is on, else turn it on */
-        rc = regmap_read(rtc_dd->regmap, rtc_dd->rtc_base, &ctrl_reg);
-        if (rc) {
-                dev_err(&pdev->dev, "RTC control register read failed!\n");
+        rc = pm8xxx_rtc_enable(rtc_dd);
+        if (rc)
                 return rc;
-        }
-
-        if (!(ctrl_reg & PM8xxx_RTC_ENABLE)) {
-                ctrl_reg |= PM8xxx_RTC_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
-                if (rc) {
-                        dev_err(&pdev->dev,
-                                "Write to RTC control register failed\n");
-                        return rc;
-                }
-        }
-
-        rtc_dd->ctrl_reg = ctrl_reg;
 
         platform_set_drvdata(pdev, rtc_dd);
 
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index a6b1252c9941..806072238c00 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -535,13 +535,15 @@ static int s3c_rtc_probe(struct platform_device *pdev)
         }
         clk_prepare_enable(info->rtc_clk);
 
-        info->rtc_src_clk = devm_clk_get(&pdev->dev, "rtc_src");
-        if (IS_ERR(info->rtc_src_clk)) {
-                dev_err(&pdev->dev, "failed to find rtc source clock\n");
-                return PTR_ERR(info->rtc_src_clk);
+        if (info->data->needs_src_clk) {
+                info->rtc_src_clk = devm_clk_get(&pdev->dev, "rtc_src");
+                if (IS_ERR(info->rtc_src_clk)) {
+                        dev_err(&pdev->dev,
+                                "failed to find rtc source clock\n");
+                        return PTR_ERR(info->rtc_src_clk);
+                }
+                clk_prepare_enable(info->rtc_src_clk);
         }
-        clk_prepare_enable(info->rtc_src_clk);
-
 
         /* check to see if everything is setup correctly */
         if (info->data->enable)
diff --git a/drivers/s390/char/Kconfig b/drivers/s390/char/Kconfig
index dc24ecfac2d1..db2cb1f8a1b5 100644
--- a/drivers/s390/char/Kconfig
+++ b/drivers/s390/char/Kconfig
@@ -105,7 +105,7 @@ config SCLP_ASYNC
 config HMC_DRV
         def_tristate m
         prompt "Support for file transfers from HMC drive CD/DVD-ROM"
-        depends on 64BIT
+        depends on S390 && 64BIT
         select CRC16
         help
           This option enables support for file transfers from a Hardware
diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/kvm/virtio_ccw.c
index 6cbe6ef3c889..bda52f18e967 100644
--- a/drivers/s390/kvm/virtio_ccw.c
+++ b/drivers/s390/kvm/virtio_ccw.c
@@ -888,7 +888,6 @@ static void virtio_ccw_int_handler(struct ccw_device *cdev,
         struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
         int i;
         struct virtqueue *vq;
-        struct virtio_driver *drv;
 
         if (!vcdev)
                 return;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_els.c b/drivers/scsi/bnx2fc/bnx2fc_els.c
index ca75c7ca2559..ef355c13ccc4 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_els.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_els.c
@@ -480,9 +480,7 @@ void bnx2fc_rec_compl(struct bnx2fc_els_cb_arg *cb_arg)
                         bnx2fc_initiate_cleanup(orig_io_req);
                         /* Post a new IO req with the same sc_cmd */
                         BNX2FC_IO_DBG(rec_req, "Post IO request again\n");
-                        spin_unlock_bh(&tgt->tgt_lock);
                         rc = bnx2fc_post_io_req(tgt, new_io_req);
-                        spin_lock_bh(&tgt->tgt_lock);
                         if (!rc)
                                 goto free_frame;
                         BNX2FC_IO_DBG(rec_req, "REC: io post err\n");
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 79e5c94107a9..72533c58c1f3 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -412,6 +412,7 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
         struct fc_frame_header *fh;
         struct fcoe_rcv_info *fr;
         struct fcoe_percpu_s *bg;
+        struct sk_buff *tmp_skb;
         unsigned short oxid;
 
         interface = container_of(ptype, struct bnx2fc_interface,
@@ -424,6 +425,12 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
                 goto err;
         }
 
+        tmp_skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!tmp_skb)
+                goto err;
+
+        skb = tmp_skb;
+
         if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) {
                 printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n");
                 goto err;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 0679782d9d15..5b99844ef6bf 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -1894,18 +1894,24 @@ int bnx2fc_queuecommand(struct Scsi_Host *host,
                         goto exit_qcmd;
                 }
         }
+
+        spin_lock_bh(&tgt->tgt_lock);
+
         io_req = bnx2fc_cmd_alloc(tgt);
         if (!io_req) {
                 rc = SCSI_MLQUEUE_HOST_BUSY;
-                goto exit_qcmd;
+                goto exit_qcmd_tgtlock;
         }
         io_req->sc_cmd = sc_cmd;
 
         if (bnx2fc_post_io_req(tgt, io_req)) {
                 printk(KERN_ERR PFX "Unable to post io_req\n");
                 rc = SCSI_MLQUEUE_HOST_BUSY;
-                goto exit_qcmd;
+                goto exit_qcmd_tgtlock;
         }
+
+exit_qcmd_tgtlock:
+        spin_unlock_bh(&tgt->tgt_lock);
 exit_qcmd:
         return rc;
 }
@@ -2020,6 +2026,8 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         int task_idx, index;
         u16 xid;
 
+        /* bnx2fc_post_io_req() is called with the tgt_lock held */
+
         /* Initialize rest of io_req fields */
         io_req->cmd_type = BNX2FC_SCSI_CMD;
         io_req->port = port;
@@ -2047,9 +2055,7 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         /* Build buffer descriptor list for firmware from sg list */
         if (bnx2fc_build_bd_list_from_sg(io_req)) {
                 printk(KERN_ERR PFX "BD list creation failed\n");
-                spin_lock_bh(&tgt->tgt_lock);
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
@@ -2061,19 +2067,15 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         task = &(task_page[index]);
         bnx2fc_init_task(io_req, task);
 
-        spin_lock_bh(&tgt->tgt_lock);
-
         if (tgt->flush_in_prog) {
                 printk(KERN_ERR PFX "Flush in progress..Host Busy\n");
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
         if (!test_bit(BNX2FC_FLAG_SESSION_READY, &tgt->flags)) {
                 printk(KERN_ERR PFX "Session not ready...post_io\n");
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
@@ -2091,6 +2093,5 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
 
         /* Ring doorbell */
         bnx2fc_ring_doorbell(tgt);
-        spin_unlock_bh(&tgt->tgt_lock);
         return 0;
 }
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 3e0a0d315f72..15081257cfc8 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -828,6 +828,8 @@ static void do_act_open_rpl(struct cxgbi_device *cdev, struct sk_buff *skb)
         if (status == CPL_ERR_RTX_NEG_ADVICE)
                 goto rel_skb;
 
+        module_put(THIS_MODULE);
+
         if (status && status != CPL_ERR_TCAM_FULL &&
             status != CPL_ERR_CONN_EXIST &&
             status != CPL_ERR_ARP_MISS)
@@ -936,20 +938,23 @@ static void do_abort_req_rss(struct cxgbi_device *cdev, struct sk_buff *skb)
         cxgbi_sock_get(csk);
         spin_lock_bh(&csk->lock);
 
-        if (!cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD)) {
-                cxgbi_sock_set_flag(csk, CTPF_ABORT_REQ_RCVD);
-                cxgbi_sock_set_state(csk, CTP_ABORTING);
-                goto done;
+        cxgbi_sock_clear_flag(csk, CTPF_ABORT_REQ_RCVD);
+
+        if (!cxgbi_sock_flag(csk, CTPF_TX_DATA_SENT)) {
+                send_tx_flowc_wr(csk);
+                cxgbi_sock_set_flag(csk, CTPF_TX_DATA_SENT);
         }
 
-        cxgbi_sock_clear_flag(csk, CTPF_ABORT_REQ_RCVD);
+        cxgbi_sock_set_flag(csk, CTPF_ABORT_REQ_RCVD);
+        cxgbi_sock_set_state(csk, CTP_ABORTING);
+
         send_abort_rpl(csk, rst_status);
 
         if (!cxgbi_sock_flag(csk, CTPF_ABORT_RPL_PENDING)) {
                 csk->err = abort_status_to_errno(csk, req->status, &rst_status);
                 cxgbi_sock_closed(csk);
         }
-done:
+
         spin_unlock_bh(&csk->lock);
         cxgbi_sock_put(csk);
 rel_skb:
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index 54fa6e0bc1bb..7da59c38a69e 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -399,6 +399,35 @@ EXPORT_SYMBOL_GPL(cxgbi_hbas_add);
  *   If the source port is outside our allocation range, the caller is
  *   responsible for keeping track of their port usage.
  */
+
+static struct cxgbi_sock *find_sock_on_port(struct cxgbi_device *cdev,
+                                            unsigned char port_id)
+{
+        struct cxgbi_ports_map *pmap = &cdev->pmap;
+        unsigned int i;
+        unsigned int used;
+
+        if (!pmap->max_connect || !pmap->used)
+                return NULL;
+
+        spin_lock_bh(&pmap->lock);
+        used = pmap->used;
+        for (i = 0; used && i < pmap->max_connect; i++) {
+                struct cxgbi_sock *csk = pmap->port_csk[i];
+
+                if (csk) {
+                        if (csk->port_id == port_id) {
+                                spin_unlock_bh(&pmap->lock);
+                                return csk;
+                        }
+                        used--;
+                }
+        }
+        spin_unlock_bh(&pmap->lock);
+
+        return NULL;
+}
+
 static int sock_get_port(struct cxgbi_sock *csk)
 {
         struct cxgbi_device *cdev = csk->cdev;
@@ -749,6 +778,7 @@ static struct cxgbi_sock *cxgbi_check_route6(struct sockaddr *dst_addr)
         csk->daddr6.sin6_addr = daddr6->sin6_addr;
         csk->daddr6.sin6_port = daddr6->sin6_port;
         csk->daddr6.sin6_family = daddr6->sin6_family;
+        csk->saddr6.sin6_family = daddr6->sin6_family;
         csk->saddr6.sin6_addr = pref_saddr;
 
         neigh_release(n);
@@ -786,7 +816,7 @@ static void cxgbi_inform_iscsi_conn_closing(struct cxgbi_sock *csk)
                 read_lock_bh(&csk->callback_lock);
                 if (csk->user_data)
                         iscsi_conn_failure(csk->user_data,
-                                        ISCSI_ERR_CONN_FAILED);
+                                        ISCSI_ERR_TCP_CONN_CLOSE);
                 read_unlock_bh(&csk->callback_lock);
         }
 }
@@ -875,18 +905,16 @@ void cxgbi_sock_rcv_abort_rpl(struct cxgbi_sock *csk)
 {
         cxgbi_sock_get(csk);
         spin_lock_bh(&csk->lock);
+
+        cxgbi_sock_set_flag(csk, CTPF_ABORT_RPL_RCVD);
         if (cxgbi_sock_flag(csk, CTPF_ABORT_RPL_PENDING)) {
-                if (!cxgbi_sock_flag(csk, CTPF_ABORT_RPL_RCVD))
-                        cxgbi_sock_set_flag(csk, CTPF_ABORT_RPL_RCVD);
-                else {
-                        cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_RCVD);
-                        cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_PENDING);
-                        if (cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD))
-                                pr_err("csk 0x%p,%u,0x%lx,%u,ABT_RPL_RSS.\n",
-                                        csk, csk->state, csk->flags, csk->tid);
-                        cxgbi_sock_closed(csk);
-                }
+                cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_PENDING);
+                if (cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD))
+                        pr_err("csk 0x%p,%u,0x%lx,%u,ABT_RPL_RSS.\n",
+                               csk, csk->state, csk->flags, csk->tid);
+                cxgbi_sock_closed(csk);
         }
+
         spin_unlock_bh(&csk->lock);
         cxgbi_sock_put(csk);
 }
@@ -2647,12 +2675,14 @@ int cxgbi_get_host_param(struct Scsi_Host *shost, enum iscsi_host_param param,
                 break;
         case ISCSI_HOST_PARAM_IPADDRESS:
         {
-                __be32 addr;
-
-                addr = cxgbi_get_iscsi_ipv4(chba);
-                len = sprintf(buf, "%pI4", &addr);
+                struct cxgbi_sock *csk = find_sock_on_port(chba->cdev,
+                                                           chba->port_id);
+                if (csk) {
+                        len = sprintf(buf, "%pIS",
+                                      (struct sockaddr *)&csk->saddr);
+                }
                 log_debug(1 << CXGBI_DBG_ISCSI,
-                        "hba %s, ipv4 %pI4.\n", chba->ndev->name, &addr);
+                          "hba %s, addr %s.\n", chba->ndev->name, buf);
                 break;
         }
         default:
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 1d98fad6a0ab..2c7cb1c0c453 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -700,11 +700,6 @@ static inline void cxgbi_set_iscsi_ipv4(struct cxgbi_hba *chba, __be32 ipaddr)
                         chba->ndev->name);
 }
 
-static inline __be32 cxgbi_get_iscsi_ipv4(struct cxgbi_hba *chba)
-{
-        return chba->ipv4addr;
-}
-
 struct cxgbi_device *cxgbi_device_register(unsigned int, unsigned int);
 void cxgbi_device_unregister(struct cxgbi_device *);
 void cxgbi_device_unregister_all(unsigned int flag);
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index e99507ed0e3c..fd78bdc53528 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -474,6 +474,13 @@ static int alua_check_sense(struct scsi_device *sdev,
                          * LUN Not Ready -- Offline
                          */
                         return SUCCESS;
+                if (sdev->allow_restart &&
+                    sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x02)
+                        /*
+                         * if the device is not started, we need to wake
+                         * the error handler to start the motor
+                         */
+                        return FAILED;
                 break;
         case UNIT_ATTENTION:
                 if (sense_hdr->asc == 0x29 && sense_hdr->ascq == 0x00)
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index f6a69a3b1b3f..5640ad1c8214 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4453,7 +4453,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
                         instance->msixentry[i].entry = i;
                 i = pci_enable_msix_range(instance->pdev, instance->msixentry,
                                           1, instance->msix_vectors);
-                if (i)
+                if (i > 0)
                         instance->msix_vectors = i;
                 else
                         instance->msix_vectors = 0;
diff --git a/drivers/scsi/osd/Kbuild b/drivers/scsi/osd/Kbuild
index 5fd73d77c3af..58cecd45b0f5 100644
--- a/drivers/scsi/osd/Kbuild
+++ b/drivers/scsi/osd/Kbuild
@@ -4,7 +4,7 @@
 # Copyright (C) 2008 Panasas Inc.  All rights reserved.
 #
 # Authors:
-#   Boaz Harrosh <bharrosh@panasas.com>
+#   Boaz Harrosh <ooo@electrozaur.com>
 #   Benny Halevy <bhalevy@panasas.com>
 #
 # This program is free software; you can redistribute it and/or modify
diff --git a/drivers/scsi/osd/Kconfig b/drivers/scsi/osd/Kconfig
index a0703514eb0f..347cc5e33749 100644
--- a/drivers/scsi/osd/Kconfig
+++ b/drivers/scsi/osd/Kconfig
@@ -4,7 +4,7 @@
 # Copyright (C) 2008 Panasas Inc.  All rights reserved.
 #
 # Authors:
-#   Boaz Harrosh <bharrosh@panasas.com>
+#   Boaz Harrosh <ooo@electrozaur.com>
 #   Benny Halevy <bhalevy@panasas.com>
 #
 # This program is free software; you can redistribute it and/or modify
diff --git a/drivers/scsi/osd/osd_debug.h b/drivers/scsi/osd/osd_debug.h
index 579e491f11df..26341261bb5c 100644
--- a/drivers/scsi/osd/osd_debug.h
+++ b/drivers/scsi/osd/osd_debug.h
@@ -4,7 +4,7 @@
  * Copyright (C) 2008 Panasas Inc.  All rights reserved.
  *
  * Authors:
- *   Boaz Harrosh <bharrosh@panasas.com>
+ *   Boaz Harrosh <ooo@electrozaur.com>
  *   Benny Halevy <bhalevy@panasas.com>
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
index fd19fd8468ac..488c3929f19a 100644
--- a/drivers/scsi/osd/osd_initiator.c
+++ b/drivers/scsi/osd/osd_initiator.c
@@ -7,7 +7,7 @@
  * Copyright (C) 2008 Panasas Inc.  All rights reserved.
  *
  * Authors:
- *   Boaz Harrosh <bharrosh@panasas.com>
+ *   Boaz Harrosh <ooo@electrozaur.com>
  *   Benny Halevy <bhalevy@panasas.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -57,7 +57,7 @@
 
 enum { OSD_REQ_RETRIES = 1 };
 
-MODULE_AUTHOR("Boaz Harrosh <bharrosh@panasas.com>");
+MODULE_AUTHOR("Boaz Harrosh <ooo@electrozaur.com>");
 MODULE_DESCRIPTION("open-osd initiator library libosd.ko");
 MODULE_LICENSE("GPL");
 
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index e1d9a4c4c4b3..92cdd4b06526 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -10,7 +10,7 @@
  * Copyright (C) 2008 Panasas Inc.  All rights reserved.
  *
  * Authors:
- *   Boaz Harrosh <bharrosh@panasas.com>
+ *   Boaz Harrosh <ooo@electrozaur.com>
  *   Benny Halevy <bhalevy@panasas.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -74,7 +74,7 @@
 static const char osd_name[] = "osd";
 static const char *osd_version_string = "open-osd 0.2.1";
 
-MODULE_AUTHOR("Boaz Harrosh <bharrosh@panasas.com>");
+MODULE_AUTHOR("Boaz Harrosh <ooo@electrozaur.com>");
 MODULE_DESCRIPTION("open-osd Upper-Layer-Driver osd.ko");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_CHARDEV_MAJOR(SCSI_OSD_MAJOR);
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 829752cfd73f..a902fa1db7af 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -112,6 +112,7 @@ static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
         struct qla_tgt_cmd *cmd);
 static void qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
         struct atio_from_isp *atio, uint16_t status, int qfull);
+static void qlt_disable_vha(struct scsi_qla_host *vha);
 /*
  * Global Variables
  */
@@ -210,7 +211,7 @@ static inline void qlt_decr_num_pend_cmds(struct scsi_qla_host *vha)
         spin_unlock_irqrestore(&vha->hw->tgt.q_full_lock, flags);
 }
 
-void qlt_24xx_atio_pkt_all_vps(struct scsi_qla_host *vha,
+static void qlt_24xx_atio_pkt_all_vps(struct scsi_qla_host *vha,
         struct atio_from_isp *atio)
 {
         ql_dbg(ql_dbg_tgt, vha, 0xe072,
@@ -433,7 +434,7 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
 #if 0 /* FIXME: Re-enable Global event handling.. */
                 /* Global event */
                 atomic_inc(&ha->tgt.qla_tgt->tgt_global_resets_count);
-                qlt_clear_tgt_db(ha->tgt.qla_tgt, 1);
+                qlt_clear_tgt_db(ha->tgt.qla_tgt);
                 if (!list_empty(&ha->tgt.qla_tgt->sess_list)) {
                         sess = list_entry(ha->tgt.qla_tgt->sess_list.next,
                             typeof(*sess), sess_list_entry);
@@ -515,7 +516,7 @@ static void qlt_schedule_sess_for_deletion(struct qla_tgt_sess *sess,
 }
 
 /* ha->hardware_lock supposed to be held on entry */
-static void qlt_clear_tgt_db(struct qla_tgt *tgt, bool local_only)
+static void qlt_clear_tgt_db(struct qla_tgt *tgt)
 {
         struct qla_tgt_sess *sess;
 
@@ -867,7 +868,7 @@ int qlt_stop_phase1(struct qla_tgt *tgt)
         mutex_lock(&vha->vha_tgt.tgt_mutex);
         spin_lock_irqsave(&ha->hardware_lock, flags);
         tgt->tgt_stop = 1;
-        qlt_clear_tgt_db(tgt, true);
+        qlt_clear_tgt_db(tgt);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         mutex_unlock(&vha->vha_tgt.tgt_mutex);
         mutex_unlock(&qla_tgt_mutex);
@@ -1462,12 +1463,13 @@ out_err:
         return -1;
 }
 
-static inline void qlt_unmap_sg(struct scsi_qla_host *vha,
-        struct qla_tgt_cmd *cmd)
+static void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
 {
         struct qla_hw_data *ha = vha->hw;
 
-        BUG_ON(!cmd->sg_mapped);
+        if (!cmd->sg_mapped)
+                return;
+
         pci_unmap_sg(ha->pdev, cmd->sg, cmd->sg_cnt, cmd->dma_data_direction);
         cmd->sg_mapped = 0;
 
@@ -2428,8 +2430,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
         return 0;
 
 out_unmap_unlock:
-        if (cmd->sg_mapped)
-                qlt_unmap_sg(vha, cmd);
+        qlt_unmap_sg(vha, cmd);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         return res;
@@ -2506,8 +2507,7 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
         return res;
 
 out_unlock_free_unmap:
-        if (cmd->sg_mapped)
-                qlt_unmap_sg(vha, cmd);
+        qlt_unmap_sg(vha, cmd);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         return res;
@@ -2741,8 +2741,7 @@ done:
                 if (!ha_locked && !in_interrupt())
                         msleep(250); /* just in case */
 
-                if (cmd->sg_mapped)
-                        qlt_unmap_sg(vha, cmd);
+                qlt_unmap_sg(vha, cmd);
                 vha->hw->tgt.tgt_ops->free_cmd(cmd);
         }
         return;
@@ -3087,8 +3086,7 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
         tfo = se_cmd->se_tfo;
         cmd->cmd_sent_to_fw = 0;
 
-        if (cmd->sg_mapped)
-                qlt_unmap_sg(vha, cmd);
+        qlt_unmap_sg(vha, cmd);
 
         if (unlikely(status != CTIO_SUCCESS)) {
                 switch (status & 0xFFFF) {
@@ -5343,7 +5341,7 @@ void qlt_lport_deregister(struct scsi_qla_host *vha)
 EXPORT_SYMBOL(qlt_lport_deregister);
 
 /* Must be called under HW lock */
-void qlt_set_mode(struct scsi_qla_host *vha)
+static void qlt_set_mode(struct scsi_qla_host *vha)
 {
         struct qla_hw_data *ha = vha->hw;
 
@@ -5364,7 +5362,7 @@ void qlt_set_mode(struct scsi_qla_host *vha)
 }
 
 /* Must be called under HW lock */
-void qlt_clear_mode(struct scsi_qla_host *vha)
+static void qlt_clear_mode(struct scsi_qla_host *vha)
 {
         struct qla_hw_data *ha = vha->hw;
 
@@ -5428,8 +5426,7 @@ EXPORT_SYMBOL(qlt_enable_vha);
  *
  * Disable Target Mode and reset the adapter
  */
-void
-qlt_disable_vha(struct scsi_qla_host *vha)
+static void qlt_disable_vha(struct scsi_qla_host *vha)
 {
         struct qla_hw_data *ha = vha->hw;
         struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 8ff330f7d6f5..332086776dfe 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -1001,11 +1001,11 @@ struct qla_tgt_prm {
         struct qla_tgt *tgt;
         void *pkt;
         struct scatterlist *sg; /* cmd data buffer SG vector */
+        unsigned char *sense_buffer;
         int seg_cnt;
         int req_cnt;
         uint16_t rq_result;
         uint16_t scsi_status;
-        unsigned char *sense_buffer;
         int sense_buffer_len;
         int residual;
         int add_status_pkt;
@@ -1033,10 +1033,6 @@ struct qla_tgt_srr_ctio {
 
 
 extern struct qla_tgt_data qla_target;
-/*
- * Internal function prototypes
- */
-void qlt_disable_vha(struct scsi_qla_host *);
 
 /*
  * Function prototypes for qla_target.c logic used by qla2xxx LLD code.
@@ -1049,8 +1045,6 @@ extern void qlt_lport_deregister(struct scsi_qla_host *);
 extern void qlt_unreg_sess(struct qla_tgt_sess *);
 extern void qlt_fc_port_added(struct scsi_qla_host *, fc_port_t *);
 extern void qlt_fc_port_deleted(struct scsi_qla_host *, fc_port_t *);
-extern void qlt_set_mode(struct scsi_qla_host *ha);
-extern void qlt_clear_mode(struct scsi_qla_host *ha);
 extern int __init qlt_init(void);
 extern void qlt_exit(void);
 extern void qlt_update_vp_map(struct scsi_qla_host *, int);
@@ -1083,13 +1077,9 @@ static inline void qla_reverse_ini_mode(struct scsi_qla_host *ha)
 /*
  * Exported symbols from qla_target.c LLD logic used by qla2xxx code..
  */
-extern void qlt_24xx_atio_pkt_all_vps(struct scsi_qla_host *,
-        struct atio_from_isp *);
 extern void qlt_response_pkt_all_vps(struct scsi_qla_host *, response_t *);
 extern int qlt_rdy_to_xfer(struct qla_tgt_cmd *);
 extern int qlt_xmit_response(struct qla_tgt_cmd *, int, uint8_t);
-extern int qlt_rdy_to_xfer_dif(struct qla_tgt_cmd *);
-extern int qlt_xmit_response_dif(struct qla_tgt_cmd *, int, uint8_t);
 extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 031b2961c6b7..73f9feecda72 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -786,7 +786,16 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct qla_tgt_sess *sess)
         pr_debug("fc_rport domain: port_id 0x%06x\n", nacl->nport_id);
 
         node = btree_remove32(&lport->lport_fcport_map, nacl->nport_id);
-        WARN_ON(node && (node != se_nacl));
+        if (WARN_ON(node && (node != se_nacl))) {
+                /*
+                 * The nacl no longer matches what we think it should be.
+                 * Most likely a new dynamic acl has been added while
+                 * someone dropped the hardware lock.  It clearly is a
+                 * bug elsewhere, but this bit can't make things worse.
+                 */
+                btree_insert32(&lport->lport_fcport_map, nacl->nport_id,
+                               node, GFP_ATOMIC);
+        }
 
         pr_debug("Removed from fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%06x\n",
             se_nacl, nacl->nport_wwnn, nacl->nport_id);
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 49014a143c6a..c1d04d4d3c6c 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -202,6 +202,7 @@ static struct {
         {"IOMEGA", "Io20S         *F", NULL, BLIST_KEY},
         {"INSITE", "Floptical   F*8I", NULL, BLIST_KEY},
         {"INSITE", "I325VM", NULL, BLIST_KEY},
+        {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
         {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
         {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
         {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 9a6f8468225f..bc5ff6ff9c79 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -459,14 +459,6 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
         if (! scsi_command_normalize_sense(scmd, &sshdr))
                 return FAILED;  /* no valid sense data */
 
-        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
-                /*
-                 * nasty: for mid-layer issued TURs, we need to return the
-                 * actual sense data without any recovery attempt.  For eh
-                 * issued ones, we need to try to recover and interpret
-                 */
-                return SUCCESS;
-
         scsi_report_sense(sdev, &sshdr);
 
         if (scsi_sense_is_deferred(&sshdr))
@@ -482,6 +474,14 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
                 /* handler does not care. Drop down to default handling */
         }
 
+        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
+                /*
+                 * nasty: for mid-layer issued TURs, we need to return the
+                 * actual sense data without any recovery attempt.  For eh
+                 * issued ones, we need to try to recover and interpret
+                 */
+                return SUCCESS;
+
         /*
          * Previous logic looked for FILEMARK, EOM or ILI which are
          * mainly associated with tapes and returned SUCCESS.
@@ -2001,8 +2001,10 @@ static void scsi_restart_operations(struct Scsi_Host *shost)
          * is no point trying to lock the door of an off-line device.
          */
         shost_for_each_device(sdev, shost) {
-                if (scsi_device_online(sdev) && sdev->locked)
+                if (scsi_device_online(sdev) && sdev->was_reset && sdev->locked) {
                         scsi_eh_lock_door(sdev);
+                        sdev->was_reset = 0;
+                }
         }
 
         /*
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9eff8a375132..50a6e1ac8d9c 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1893,6 +1893,11 @@ static int scsi_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req,
                 blk_mq_start_request(req);
         }
 
+        if (blk_queue_tagged(q))
+                req->cmd_flags |= REQ_QUEUED;
+        else
+                req->cmd_flags &= ~REQ_QUEUED;
+
         scsi_init_cmd_errh(cmd);
         cmd->scsi_done = scsi_mq_done;
 
diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index 8adf067ff019..1c3467b82566 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -102,7 +102,6 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
         clkfreq = devm_kzalloc(dev, sz * sizeof(*clkfreq),
                         GFP_KERNEL);
         if (!clkfreq) {
-                dev_err(dev, "%s: no memory\n", "freq-table-hz");
                 ret = -ENOMEM;
                 goto out;
         }
@@ -112,19 +111,19 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
         if (ret && (ret != -EINVAL)) {
                 dev_err(dev, "%s: error reading array %d\n",
                                 "freq-table-hz", ret);
-                goto free_clkfreq;
+                return ret;
         }
 
         for (i = 0; i < sz; i += 2) {
                 ret = of_property_read_string_index(np,
                                 "clock-names", i/2, (const char **)&name);
                 if (ret)
-                        goto free_clkfreq;
+                        goto out;
 
                 clki = devm_kzalloc(dev, sizeof(*clki), GFP_KERNEL);
                 if (!clki) {
                         ret = -ENOMEM;
-                        goto free_clkfreq;
+                        goto out;
                 }
 
                 clki->min_freq = clkfreq[i];
@@ -134,8 +133,6 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
                                 clki->min_freq, clki->max_freq, clki->name);
                 list_add_tail(&clki->list, &hba->clk_list_head);
         }
-free_clkfreq:
-        kfree(clkfreq);
 out:
         return ret;
 }
@@ -162,10 +159,8 @@ static int ufshcd_populate_vreg(struct device *dev, const char *name,
         }
 
         vreg = devm_kzalloc(dev, sizeof(*vreg), GFP_KERNEL);
-        if (!vreg) {
-                dev_err(dev, "No memory for %s regulator\n", name);
-                goto out;
-        }
+        if (!vreg)
+                return -ENOMEM;
 
         vreg->name = kstrdup(name, GFP_KERNEL);
 
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 497c38a4a866..605ca60e8a10 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -744,6 +744,8 @@ static void ufshcd_exit_clk_gating(struct ufs_hba *hba)
         if (!ufshcd_is_clkgating_allowed(hba))
                 return;
         device_remove_file(hba->dev, &hba->clk_gating.delay_attr);
+        cancel_work_sync(&hba->clk_gating.ungate_work);
+        cancel_delayed_work_sync(&hba->clk_gating.gate_work);
 }
 
 /* Must be called with host lock acquired */
@@ -2246,6 +2248,22 @@ static int ufshcd_uic_hibern8_exit(struct ufs_hba *hba)
         return ret;
 }
 
+ /**
+ * ufshcd_init_pwr_info - setting the POR (power on reset)
+ * values in hba power info
+ * @hba: per-adapter instance
+ */
+static void ufshcd_init_pwr_info(struct ufs_hba *hba)
+{
+        hba->pwr_info.gear_rx = UFS_PWM_G1;
+        hba->pwr_info.gear_tx = UFS_PWM_G1;
+        hba->pwr_info.lane_rx = 1;
+        hba->pwr_info.lane_tx = 1;
+        hba->pwr_info.pwr_rx = SLOWAUTO_MODE;
+        hba->pwr_info.pwr_tx = SLOWAUTO_MODE;
+        hba->pwr_info.hs_rate = 0;
+}
+
 /**
  * ufshcd_get_max_pwr_mode - reads the max power mode negotiated with device
  * @hba: per-adapter instance
@@ -2844,8 +2862,13 @@ static void ufshcd_slave_destroy(struct scsi_device *sdev)
         hba = shost_priv(sdev->host);
         scsi_deactivate_tcq(sdev, hba->nutrs);
         /* Drop the reference as it won't be needed anymore */
-        if (ufshcd_scsi_to_upiu_lun(sdev->lun) == UFS_UPIU_UFS_DEVICE_WLUN)
+        if (ufshcd_scsi_to_upiu_lun(sdev->lun) == UFS_UPIU_UFS_DEVICE_WLUN) {
+                unsigned long flags;
+
+                spin_lock_irqsave(hba->host->host_lock, flags);
                 hba->sdev_ufs_device = NULL;
+                spin_unlock_irqrestore(hba->host->host_lock, flags);
+        }
 }
 
 /**
@@ -4062,6 +4085,8 @@ static void ufshcd_init_icc_levels(struct ufs_hba *hba)
 static int ufshcd_scsi_add_wlus(struct ufs_hba *hba)
 {
         int ret = 0;
+        struct scsi_device *sdev_rpmb;
+        struct scsi_device *sdev_boot;
 
         hba->sdev_ufs_device = __scsi_add_device(hba->host, 0, 0,
                 ufshcd_upiu_wlun_to_scsi_wlun(UFS_UPIU_UFS_DEVICE_WLUN), NULL);
@@ -4070,26 +4095,27 @@ static int ufshcd_scsi_add_wlus(struct ufs_hba *hba)
                 hba->sdev_ufs_device = NULL;
                 goto out;
         }
+        scsi_device_put(hba->sdev_ufs_device);
 
-        hba->sdev_boot = __scsi_add_device(hba->host, 0, 0,
+        sdev_boot = __scsi_add_device(hba->host, 0, 0,
                 ufshcd_upiu_wlun_to_scsi_wlun(UFS_UPIU_BOOT_WLUN), NULL);
-        if (IS_ERR(hba->sdev_boot)) {
-                ret = PTR_ERR(hba->sdev_boot);
-                hba->sdev_boot = NULL;
+        if (IS_ERR(sdev_boot)) {
+                ret = PTR_ERR(sdev_boot);
                 goto remove_sdev_ufs_device;
         }
+        scsi_device_put(sdev_boot);
 
-        hba->sdev_rpmb = __scsi_add_device(hba->host, 0, 0,
+        sdev_rpmb = __scsi_add_device(hba->host, 0, 0,
                 ufshcd_upiu_wlun_to_scsi_wlun(UFS_UPIU_RPMB_WLUN), NULL);
-        if (IS_ERR(hba->sdev_rpmb)) {
-                ret = PTR_ERR(hba->sdev_rpmb);
-                hba->sdev_rpmb = NULL;
+        if (IS_ERR(sdev_rpmb)) {
+                ret = PTR_ERR(sdev_rpmb);
                 goto remove_sdev_boot;
         }
+        scsi_device_put(sdev_rpmb);
         goto out;
 
 remove_sdev_boot:
-        scsi_remove_device(hba->sdev_boot);
+        scsi_remove_device(sdev_boot);
 remove_sdev_ufs_device:
         scsi_remove_device(hba->sdev_ufs_device);
 out:
@@ -4097,30 +4123,6 @@ out:
 }
 
 /**
- * ufshcd_scsi_remove_wlus - Removes the W-LUs which were added by
- *                           ufshcd_scsi_add_wlus()
- * @hba: per-adapter instance
- *
- */
-static void ufshcd_scsi_remove_wlus(struct ufs_hba *hba)
-{
-        if (hba->sdev_ufs_device) {
-                scsi_remove_device(hba->sdev_ufs_device);
-                hba->sdev_ufs_device = NULL;
-        }
-
-        if (hba->sdev_boot) {
-                scsi_remove_device(hba->sdev_boot);
-                hba->sdev_boot = NULL;
-        }
-
-        if (hba->sdev_rpmb) {
-                scsi_remove_device(hba->sdev_rpmb);
-                hba->sdev_rpmb = NULL;
-        }
-}
-
-/**
  * ufshcd_probe_hba - probe hba to detect device and initialize
  * @hba: per-adapter instance
  *
@@ -4134,6 +4136,8 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
         if (ret)
                 goto out;
 
+        ufshcd_init_pwr_info(hba);
+
         /* UniPro link is active now */
         ufshcd_set_link_active(hba);
 
@@ -4264,12 +4268,18 @@ static int ufshcd_config_vreg_load(struct device *dev, struct ufs_vreg *vreg,
 static inline int ufshcd_config_vreg_lpm(struct ufs_hba *hba,
                                          struct ufs_vreg *vreg)
 {
+        if (!vreg)
+                return 0;
+
         return ufshcd_config_vreg_load(hba->dev, vreg, UFS_VREG_LPM_LOAD_UA);
 }
 
 static inline int ufshcd_config_vreg_hpm(struct ufs_hba *hba,
                                          struct ufs_vreg *vreg)
 {
+        if (!vreg)
+                return 0;
+
         return ufshcd_config_vreg_load(hba->dev, vreg, vreg->max_uA);
 }
 
@@ -4471,7 +4481,7 @@ out:
                         if (!IS_ERR_OR_NULL(clki->clk) && clki->enabled)
                                 clk_disable_unprepare(clki->clk);
                 }
-        } else if (!ret && on) {
+        } else if (on) {
                 spin_lock_irqsave(hba->host->host_lock, flags);
                 hba->clk_gating.state = CLKS_ON;
                 spin_unlock_irqrestore(hba->host->host_lock, flags);
@@ -4675,11 +4685,25 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba,
 {
         unsigned char cmd[6] = { START_STOP };
         struct scsi_sense_hdr sshdr;
-        struct scsi_device *sdp = hba->sdev_ufs_device;
+        struct scsi_device *sdp;
+        unsigned long flags;
         int ret;
 
-        if (!sdp || !scsi_device_online(sdp))
-                return -ENODEV;
+        spin_lock_irqsave(hba->host->host_lock, flags);
+        sdp = hba->sdev_ufs_device;
+        if (sdp) {
+                ret = scsi_device_get(sdp);
+                if (!ret && !scsi_device_online(sdp)) {
+                        ret = -ENODEV;
+                        scsi_device_put(sdp);
+                }
+        } else {
+                ret = -ENODEV;
+        }
+        spin_unlock_irqrestore(hba->host->host_lock, flags);
+
+        if (ret)
+                return ret;
 
         /*
          * If scsi commands fail, the scsi mid-layer schedules scsi error-
@@ -4718,6 +4742,7 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba,
         if (!ret)
                 hba->curr_dev_pwr_mode = pwr_mode;
 out:
+        scsi_device_put(sdp);
         hba->host->eh_noresume = 0;
         return ret;
 }
@@ -5087,7 +5112,7 @@ int ufshcd_system_suspend(struct ufs_hba *hba)
         int ret = 0;
 
         if (!hba || !hba->is_powered)
-                goto out;
+                return 0;
 
         if (pm_runtime_suspended(hba->dev)) {
                 if (hba->rpm_lvl == hba->spm_lvl)
@@ -5231,7 +5256,6 @@ EXPORT_SYMBOL(ufshcd_shutdown);
 void ufshcd_remove(struct ufs_hba *hba)
 {
         scsi_remove_host(hba->host);
-        ufshcd_scsi_remove_wlus(hba);
         /* disable interrupts */
         ufshcd_disable_intr(hba, hba->intr_mask);
         ufshcd_hba_stop(hba);
diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
index 58ecdff5065c..4a574aa45855 100644
--- a/drivers/scsi/ufs/ufshcd.h
+++ b/drivers/scsi/ufs/ufshcd.h
@@ -392,8 +392,6 @@ struct ufs_hba {
          * "UFS device" W-LU.
          */
         struct scsi_device *sdev_ufs_device;
-        struct scsi_device *sdev_rpmb;
-        struct scsi_device *sdev_boot;
 
         enum ufs_dev_pwr_mode curr_dev_pwr_mode;
         enum uic_link_state uic_link_state;
diff --git a/drivers/soc/versatile/soc-realview.c b/drivers/soc/versatile/soc-realview.c
index cea8ea3491d2..1a07bf540fec 100644
--- a/drivers/soc/versatile/soc-realview.c
+++ b/drivers/soc/versatile/soc-realview.c
@@ -26,6 +26,7 @@ static const struct of_device_id realview_soc_of_match[] = {
         { .compatible = "arm,realview-pb11mp-soc", },
         { .compatible = "arm,realview-pba8-soc", },
         { .compatible = "arm,realview-pbx-soc", },
+        { }
 };
 
 static u32 realview_coreid;
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 98de2074e8fe..400c34468cad 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -308,6 +308,14 @@ config SPI_FSL_ESPI
           From MPC8536, 85xx platform uses the controller, and all P10xx,
           P20xx, P30xx,P40xx, P50xx uses this controller.
 
+config SPI_MESON_SPIFC
+        tristate "Amlogic Meson SPIFC controller"
+        depends on ARCH_MESON || COMPILE_TEST
+        select REGMAP_MMIO
+        help
+          This enables master mode support for the SPIFC (SPI flash
+          controller) available in Amlogic Meson SoCs.
+
 config SPI_OC_TINY
         tristate "OpenCores tiny SPI"
         depends on GPIOLIB
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index 37dc2e7d2c7e..6b9d2ac629cc 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -43,6 +43,7 @@ obj-$(CONFIG_SPI_GPIO)			+= spi-gpio.o
 obj-$(CONFIG_SPI_IMG_SPFI)              += spi-img-spfi.o
 obj-$(CONFIG_SPI_IMX)                   += spi-imx.o
 obj-$(CONFIG_SPI_LM70_LLP)              += spi-lm70llp.o
+obj-$(CONFIG_SPI_MESON_SPIFC)           += spi-meson-spifc.o
 obj-$(CONFIG_SPI_MPC512x_PSC)           += spi-mpc512x-psc.o
 obj-$(CONFIG_SPI_MPC52xx_PSC)           += spi-mpc52xx-psc.o
 obj-$(CONFIG_SPI_MPC52xx)               += spi-mpc52xx.o
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 113c83f44b5c..e4193ccc4970 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -26,6 +26,7 @@
 #include <linux/io.h>
 #include <linux/gpio.h>
 #include <linux/pinctrl/consumer.h>
+#include <linux/pm_runtime.h>
 
 /* SPI register offsets */
 #define SPI_CR                                  0x0000
@@ -191,6 +192,8 @@
 
 #define SPI_DMA_TIMEOUT         (msecs_to_jiffies(1000))
 
+#define AUTOSUSPEND_TIMEOUT     2000
+
 struct atmel_spi_dma {
         struct dma_chan                 *chan_rx;
         struct dma_chan                 *chan_tx;
@@ -414,23 +417,6 @@ static int atmel_spi_dma_slave_config(struct atmel_spi *as,
         return err;
 }
 
-static bool filter(struct dma_chan *chan, void *pdata)
-{
-        struct atmel_spi_dma *sl_pdata = pdata;
-        struct at_dma_slave *sl;
-
-        if (!sl_pdata)
-                return false;
-
-        sl = &sl_pdata->dma_slave;
-        if (sl->dma_dev == chan->device->dev) {
-                chan->private = sl;
-                return true;
-        } else {
-                return false;
-        }
-}
-
 static int atmel_spi_configure_dma(struct atmel_spi *as)
 {
         struct dma_slave_config slave_config;
@@ -441,19 +427,24 @@ static int atmel_spi_configure_dma(struct atmel_spi *as)
         dma_cap_zero(mask);
         dma_cap_set(DMA_SLAVE, mask);
 
-        as->dma.chan_tx = dma_request_slave_channel_compat(mask, filter,
-                                                           &as->dma,
-                                                           dev, "tx");
-        if (!as->dma.chan_tx) {
+        as->dma.chan_tx = dma_request_slave_channel_reason(dev, "tx");
+        if (IS_ERR(as->dma.chan_tx)) {
+                err = PTR_ERR(as->dma.chan_tx);
+                if (err == -EPROBE_DEFER) {
+                        dev_warn(dev, "no DMA channel available at the moment\n");
+                        return err;
+                }
                 dev_err(dev,
                         "DMA TX channel not available, SPI unable to use DMA\n");
                 err = -EBUSY;
                 goto error;
         }
 
-        as->dma.chan_rx = dma_request_slave_channel_compat(mask, filter,
-                                                           &as->dma,
-                                                           dev, "rx");
+        /*
+         * No reason to check EPROBE_DEFER here since we have already requested
+         * tx channel. If it fails here, it's for another reason.
+         */
+        as->dma.chan_rx = dma_request_slave_channel(dev, "rx");
 
         if (!as->dma.chan_rx) {
                 dev_err(dev,
@@ -474,7 +465,7 @@ static int atmel_spi_configure_dma(struct atmel_spi *as)
 error:
         if (as->dma.chan_rx)
                 dma_release_channel(as->dma.chan_rx);
-        if (as->dma.chan_tx)
+        if (!IS_ERR(as->dma.chan_tx))
                 dma_release_channel(as->dma.chan_tx);
         return err;
 }
@@ -482,11 +473,9 @@ error:
 static void atmel_spi_stop_dma(struct atmel_spi *as)
 {
         if (as->dma.chan_rx)
-                as->dma.chan_rx->device->device_control(as->dma.chan_rx,
-                                                        DMA_TERMINATE_ALL, 0);
+                dmaengine_terminate_all(as->dma.chan_rx);
         if (as->dma.chan_tx)
-                as->dma.chan_tx->device->device_control(as->dma.chan_tx,
-                                                        DMA_TERMINATE_ALL, 0);
+                dmaengine_terminate_all(as->dma.chan_tx);
 }
 
 static void atmel_spi_release_dma(struct atmel_spi *as)
@@ -1315,6 +1304,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
         master->setup = atmel_spi_setup;
         master->transfer_one_message = atmel_spi_transfer_one_message;
         master->cleanup = atmel_spi_cleanup;
+        master->auto_runtime_pm = true;
         platform_set_drvdata(pdev, master);
 
         as = spi_master_get_devdata(master);
@@ -1347,8 +1337,11 @@ static int atmel_spi_probe(struct platform_device *pdev)
         as->use_dma = false;
         as->use_pdc = false;
         if (as->caps.has_dma_support) {
-                if (atmel_spi_configure_dma(as) == 0)
+                ret = atmel_spi_configure_dma(as);
+                if (ret == 0)
                         as->use_dma = true;
+                else if (ret == -EPROBE_DEFER)
+                        return ret;
         } else {
                 as->use_pdc = true;
         }
@@ -1387,6 +1380,11 @@ static int atmel_spi_probe(struct platform_device *pdev)
         dev_info(&pdev->dev, "Atmel SPI Controller at 0x%08lx (irq %d)\n",
                         (unsigned long)regs->start, irq);
 
+        pm_runtime_set_autosuspend_delay(&pdev->dev, AUTOSUSPEND_TIMEOUT);
+        pm_runtime_use_autosuspend(&pdev->dev);
+        pm_runtime_set_active(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+
         ret = devm_spi_register_master(&pdev->dev, master);
         if (ret)
                 goto out_free_dma;
@@ -1394,6 +1392,9 @@ static int atmel_spi_probe(struct platform_device *pdev)
         return 0;
 
 out_free_dma:
+        pm_runtime_disable(&pdev->dev);
+        pm_runtime_set_suspended(&pdev->dev);
+
         if (as->use_dma)
                 atmel_spi_release_dma(as);
 
@@ -1415,6 +1416,8 @@ static int atmel_spi_remove(struct platform_device *pdev)
         struct spi_master       *master = platform_get_drvdata(pdev);
         struct atmel_spi        *as = spi_master_get_devdata(master);
 
+        pm_runtime_get_sync(&pdev->dev);
+
         /* reset the hardware and block queue progress */
         spin_lock_irq(&as->lock);
         if (as->use_dma) {
@@ -1432,14 +1435,37 @@ static int atmel_spi_remove(struct platform_device *pdev)
 
         clk_disable_unprepare(as->clk);
 
+        pm_runtime_put_noidle(&pdev->dev);
+        pm_runtime_disable(&pdev->dev);
+
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
+static int atmel_spi_runtime_suspend(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct atmel_spi *as = spi_master_get_devdata(master);
+
+        clk_disable_unprepare(as->clk);
+        pinctrl_pm_select_sleep_state(dev);
+
+        return 0;
+}
+
+static int atmel_spi_runtime_resume(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct atmel_spi *as = spi_master_get_devdata(master);
+
+        pinctrl_pm_select_default_state(dev);
+
+        return clk_prepare_enable(as->clk);
+}
+
 static int atmel_spi_suspend(struct device *dev)
 {
-        struct spi_master       *master = dev_get_drvdata(dev);
-        struct atmel_spi        *as = spi_master_get_devdata(master);
+        struct spi_master *master = dev_get_drvdata(dev);
         int ret;
 
         /* Stop the queue running */
@@ -1449,22 +1475,22 @@ static int atmel_spi_suspend(struct device *dev)
                 return ret;
         }
 
-        clk_disable_unprepare(as->clk);
-
-        pinctrl_pm_select_sleep_state(dev);
+        if (!pm_runtime_suspended(dev))
+                atmel_spi_runtime_suspend(dev);
 
         return 0;
 }
 
 static int atmel_spi_resume(struct device *dev)
 {
-        struct spi_master       *master = dev_get_drvdata(dev);
-        struct atmel_spi        *as = spi_master_get_devdata(master);
+        struct spi_master *master = dev_get_drvdata(dev);
         int ret;
 
-        pinctrl_pm_select_default_state(dev);
-
-        clk_prepare_enable(as->clk);
+        if (!pm_runtime_suspended(dev)) {
+                ret = atmel_spi_runtime_resume(dev);
+                if (ret)
+                        return ret;
+        }
 
         /* Start the queue running */
         ret = spi_master_resume(master);
@@ -1474,8 +1500,11 @@ static int atmel_spi_resume(struct device *dev)
         return ret;
 }
 
-static SIMPLE_DEV_PM_OPS(atmel_spi_pm_ops, atmel_spi_suspend, atmel_spi_resume);
-
+static const struct dev_pm_ops atmel_spi_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(atmel_spi_suspend, atmel_spi_resume)
+        SET_RUNTIME_PM_OPS(atmel_spi_runtime_suspend,
+                           atmel_spi_runtime_resume, NULL)
+};
 #define ATMEL_SPI_PM_OPS        (&atmel_spi_pm_ops)
 #else
 #define ATMEL_SPI_PM_OPS        NULL
diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
index 7b811e38c7ad..5a6749881ff9 100644
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -47,6 +47,7 @@
 #define CDNS_SPI_CR_CPHA_MASK           0x00000004 /* Clock Phase Control */
 #define CDNS_SPI_CR_CPOL_MASK           0x00000002 /* Clock Polarity Control */
 #define CDNS_SPI_CR_SSCTRL_MASK         0x00003C00 /* Slave Select Mask */
+#define CDNS_SPI_CR_PERI_SEL_MASK       0x00000200 /* Peripheral Select Decode */
 #define CDNS_SPI_CR_BAUD_DIV_MASK       0x00000038 /* Baud Rate Divisor Mask */
 #define CDNS_SPI_CR_MSTREN_MASK         0x00000001 /* Master Enable Mask */
 #define CDNS_SPI_CR_MANSTRTEN_MASK      0x00008000 /* Manual TX Enable Mask */
@@ -148,6 +149,11 @@ static inline void cdns_spi_write(struct cdns_spi *xspi, u32 offset, u32 val)
  */
 static void cdns_spi_init_hw(struct cdns_spi *xspi)
 {
+        u32 ctrl_reg = CDNS_SPI_CR_DEFAULT_MASK;
+
+        if (xspi->is_decoded_cs)
+                ctrl_reg |= CDNS_SPI_CR_PERI_SEL_MASK;
+
         cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
                        CDNS_SPI_ER_DISABLE_MASK);
         cdns_spi_write(xspi, CDNS_SPI_IDR_OFFSET,
@@ -160,8 +166,7 @@ static void cdns_spi_init_hw(struct cdns_spi *xspi)
 
         cdns_spi_write(xspi, CDNS_SPI_ISR_OFFSET,
                        CDNS_SPI_IXR_ALL_MASK);
-        cdns_spi_write(xspi, CDNS_SPI_CR_OFFSET,
-                       CDNS_SPI_CR_DEFAULT_MASK);
+        cdns_spi_write(xspi, CDNS_SPI_CR_OFFSET, ctrl_reg);
         cdns_spi_write(xspi, CDNS_SPI_ER_OFFSET,
                        CDNS_SPI_ER_ENABLE_MASK);
 }
@@ -516,6 +521,17 @@ static int cdns_spi_probe(struct platform_device *pdev)
                 goto clk_dis_apb;
         }
 
+        ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
+        if (ret < 0)
+                master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
+        else
+                master->num_chipselect = num_cs;
+
+        ret = of_property_read_u32(pdev->dev.of_node, "is-decoded-cs",
+                                   &xspi->is_decoded_cs);
+        if (ret < 0)
+                xspi->is_decoded_cs = 0;
+
         /* SPI controller initializations */
         cdns_spi_init_hw(xspi);
 
@@ -534,19 +550,6 @@ static int cdns_spi_probe(struct platform_device *pdev)
                 goto remove_master;
         }
 
-        ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
-
-        if (ret < 0)
-                master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
-        else
-                master->num_chipselect = num_cs;
-
-        ret = of_property_read_u32(pdev->dev.of_node, "is-decoded-cs",
-                                   &xspi->is_decoded_cs);
-
-        if (ret < 0)
-                xspi->is_decoded_cs = 0;
-
         master->prepare_transfer_hardware = cdns_prepare_transfer_hardware;
         master->prepare_message = cdns_prepare_message;
         master->transfer_one = cdns_transfer_one;
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index 46c6d58e1fda..7281316a5ecb 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -26,6 +26,9 @@
 #include <linux/intel_mid_dma.h>
 #include <linux/pci.h>
 
+#define RX_BUSY         0
+#define TX_BUSY         1
+
 struct mid_dma {
         struct intel_mid_dma_slave      dmas_tx;
         struct intel_mid_dma_slave      dmas_rx;
@@ -98,41 +101,26 @@ static void mid_spi_dma_exit(struct dw_spi *dws)
 }
 
 /*
- * dws->dma_chan_done is cleared before the dma transfer starts,
- * callback for rx/tx channel will each increment it by 1.
- * Reaching 2 means the whole spi transaction is done.
+ * dws->dma_chan_busy is set before the dma transfer starts, callback for tx
+ * channel will clear a corresponding bit.
  */
-static void dw_spi_dma_done(void *arg)
+static void dw_spi_dma_tx_done(void *arg)
 {
         struct dw_spi *dws = arg;
 
-        if (++dws->dma_chan_done != 2)
+        if (test_and_clear_bit(TX_BUSY, &dws->dma_chan_busy) & BIT(RX_BUSY))
                 return;
         dw_spi_xfer_done(dws);
 }
 
-static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
+static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws)
 {
-        struct dma_async_tx_descriptor *txdesc, *rxdesc;
-        struct dma_slave_config txconf, rxconf;
-        u16 dma_ctrl = 0;
-
-        /* 1. setup DMA related registers */
-        if (cs_change) {
-                spi_enable_chip(dws, 0);
-                dw_writew(dws, DW_SPI_DMARDLR, 0xf);
-                dw_writew(dws, DW_SPI_DMATDLR, 0x10);
-                if (dws->tx_dma)
-                        dma_ctrl |= SPI_DMA_TDMAE;
-                if (dws->rx_dma)
-                        dma_ctrl |= SPI_DMA_RDMAE;
-                dw_writew(dws, DW_SPI_DMACR, dma_ctrl);
-                spi_enable_chip(dws, 1);
-        }
+        struct dma_slave_config txconf;
+        struct dma_async_tx_descriptor *txdesc;
 
-        dws->dma_chan_done = 0;
+        if (!dws->tx_dma)
+                return NULL;
 
-        /* 2. Prepare the TX dma transfer */
         txconf.direction = DMA_MEM_TO_DEV;
         txconf.dst_addr = dws->dma_addr;
         txconf.dst_maxburst = LNW_DMA_MSIZE_16;
@@ -151,10 +139,33 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
                                 1,
                                 DMA_MEM_TO_DEV,
                                 DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-        txdesc->callback = dw_spi_dma_done;
+        txdesc->callback = dw_spi_dma_tx_done;
         txdesc->callback_param = dws;
 
-        /* 3. Prepare the RX dma transfer */
+        return txdesc;
+}
+
+/*
+ * dws->dma_chan_busy is set before the dma transfer starts, callback for rx
+ * channel will clear a corresponding bit.
+ */
+static void dw_spi_dma_rx_done(void *arg)
+{
+        struct dw_spi *dws = arg;
+
+        if (test_and_clear_bit(RX_BUSY, &dws->dma_chan_busy) & BIT(TX_BUSY))
+                return;
+        dw_spi_xfer_done(dws);
+}
+
+static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws)
+{
+        struct dma_slave_config rxconf;
+        struct dma_async_tx_descriptor *rxdesc;
+
+        if (!dws->rx_dma)
+                return NULL;
+
         rxconf.direction = DMA_DEV_TO_MEM;
         rxconf.src_addr = dws->dma_addr;
         rxconf.src_maxburst = LNW_DMA_MSIZE_16;
@@ -173,15 +184,56 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
                                 1,
                                 DMA_DEV_TO_MEM,
                                 DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-        rxdesc->callback = dw_spi_dma_done;
+        rxdesc->callback = dw_spi_dma_rx_done;
         rxdesc->callback_param = dws;
 
+        return rxdesc;
+}
+
+static void dw_spi_dma_setup(struct dw_spi *dws)
+{
+        u16 dma_ctrl = 0;
+
+        spi_enable_chip(dws, 0);
+
+        dw_writew(dws, DW_SPI_DMARDLR, 0xf);
+        dw_writew(dws, DW_SPI_DMATDLR, 0x10);
+
+        if (dws->tx_dma)
+                dma_ctrl |= SPI_DMA_TDMAE;
+        if (dws->rx_dma)
+                dma_ctrl |= SPI_DMA_RDMAE;
+        dw_writew(dws, DW_SPI_DMACR, dma_ctrl);
+
+        spi_enable_chip(dws, 1);
+}
+
+static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
+{
+        struct dma_async_tx_descriptor *txdesc, *rxdesc;
+
+        /* 1. setup DMA related registers */
+        if (cs_change)
+                dw_spi_dma_setup(dws);
+
+        /* 2. Prepare the TX dma transfer */
+        txdesc = dw_spi_dma_prepare_tx(dws);
+
+        /* 3. Prepare the RX dma transfer */
+        rxdesc = dw_spi_dma_prepare_rx(dws);
+
         /* rx must be started before tx due to spi instinct */
-        dmaengine_submit(rxdesc);
-        dma_async_issue_pending(dws->rxchan);
+        if (rxdesc) {
+                set_bit(RX_BUSY, &dws->dma_chan_busy);
+                dmaengine_submit(rxdesc);
+                dma_async_issue_pending(dws->rxchan);
+        }
 
-        dmaengine_submit(txdesc);
-        dma_async_issue_pending(dws->txchan);
+        if (txdesc) {
+                set_bit(TX_BUSY, &dws->dma_chan_busy);
+                dmaengine_submit(txdesc);
+                dma_async_issue_pending(dws->txchan);
+        }
 
         return 0;
 }
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 729215885250..d0d5542efc06 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -376,9 +376,6 @@ static void pump_transfers(unsigned long data)
         chip = dws->cur_chip;
         spi = message->spi;
 
-        if (unlikely(!chip->clk_div))
-                chip->clk_div = dws->max_freq / chip->speed_hz;
-
         if (message->state == ERROR_STATE) {
                 message->status = -EIO;
                 goto early_exit;
@@ -419,7 +416,7 @@ static void pump_transfers(unsigned long data)
         if (transfer->speed_hz) {
                 speed = chip->speed_hz;
 
-                if (transfer->speed_hz != speed) {
+                if ((transfer->speed_hz != speed) || (!chip->clk_div)) {
                         speed = transfer->speed_hz;
 
                         /* clk_div doesn't support odd number */
@@ -581,7 +578,6 @@ static int dw_spi_setup(struct spi_device *spi)
                 dev_err(&spi->dev, "No max speed HZ parameter\n");
                 return -EINVAL;
         }
-        chip->speed_hz = spi->max_speed_hz;
 
         chip->tmode = 0; /* Tx & Rx */
         /* Default SPI mode is SCPOL = 0, SCPH = 0 */
@@ -669,6 +665,7 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
         master->cleanup = dw_spi_cleanup;
         master->transfer_one_message = dw_spi_transfer_one_message;
         master->max_speed_hz = dws->max_freq;
+        master->dev.of_node = dev->of_node;
 
         /* Basic HW init */
         spi_hw_init(dws);
diff --git a/drivers/spi/spi-dw.h b/drivers/spi/spi-dw.h
index 83a103a76481..3d32be68c142 100644
--- a/drivers/spi/spi-dw.h
+++ b/drivers/spi/spi-dw.h
@@ -139,7 +139,7 @@ struct dw_spi {
         struct scatterlist      tx_sgl;
         struct dma_chan         *rxchan;
         struct scatterlist      rx_sgl;
-        int                     dma_chan_done;
+        unsigned long           dma_chan_busy;
         struct device           *dma_dev;
         dma_addr_t              dma_addr; /* phy address of the Data register */
         struct dw_spi_dma_ops   *dma_ops;
diff --git a/drivers/spi/spi-fsl-cpm.c b/drivers/spi/spi-fsl-cpm.c
index c5dd20beee22..e85ab1cb17a2 100644
--- a/drivers/spi/spi-fsl-cpm.c
+++ b/drivers/spi/spi-fsl-cpm.c
@@ -56,12 +56,15 @@ void fsl_spi_cpm_reinit_txrx(struct mpc8xxx_spi *mspi)
                 qe_issue_cmd(QE_INIT_TX_RX, mspi->subblock,
                              QE_CR_PROTOCOL_UNSPECIFIED, 0);
         } else {
-                cpm_command(CPM_SPI_CMD, CPM_CR_INIT_TRX);
                 if (mspi->flags & SPI_CPM1) {
+                        out_be32(&mspi->pram->rstate, 0);
                         out_be16(&mspi->pram->rbptr,
                                  in_be16(&mspi->pram->rbase));
+                        out_be32(&mspi->pram->tstate, 0);
                         out_be16(&mspi->pram->tbptr,
                                  in_be16(&mspi->pram->tbase));
+                } else {
+                        cpm_command(CPM_SPI_CMD, CPM_CR_INIT_TRX);
                 }
         }
 }
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 448216025ce8..4cda994d3f40 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -46,7 +46,7 @@
 
 #define SPI_TCR                 0x08
 
-#define SPI_CTAR(x)             (0x0c + (x * 4))
+#define SPI_CTAR(x)             (0x0c + (((x) & 0x3) * 4))
 #define SPI_CTAR_FMSZ(x)        (((x) & 0x0000000f) << 27)
 #define SPI_CTAR_CPOL(x)        ((x) << 26)
 #define SPI_CTAR_CPHA(x)        ((x) << 25)
@@ -70,7 +70,7 @@
 
 #define SPI_PUSHR               0x34
 #define SPI_PUSHR_CONT          (1 << 31)
-#define SPI_PUSHR_CTAS(x)       (((x) & 0x00000007) << 28)
+#define SPI_PUSHR_CTAS(x)       (((x) & 0x00000003) << 28)
 #define SPI_PUSHR_EOQ           (1 << 27)
 #define SPI_PUSHR_CTCNT (1 << 26)
 #define SPI_PUSHR_PCS(x)        (((1 << x) & 0x0000003f) << 16)
@@ -438,7 +438,7 @@ static int dspi_resume(struct device *dev)
 
 static SIMPLE_DEV_PM_OPS(dspi_pm, dspi_suspend, dspi_resume);
 
-static struct regmap_config dspi_regmap_config = {
+static const struct regmap_config dspi_regmap_config = {
         .reg_bits = 32,
         .val_bits = 32,
         .reg_stride = 4,
@@ -492,7 +492,6 @@ static int dspi_probe(struct platform_device *pdev)
                 goto out_master_put;
         }
 
-        dspi_regmap_config.lock_arg = dspi;
         dspi->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "dspi", base,
                                                 &dspi_regmap_config);
         if (IS_ERR(dspi->regmap)) {
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
index a7f94b6a9e70..56cadf13519e 100644
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -411,7 +411,8 @@ static void fsl_espi_rw_trans(struct spi_message *m,
         kfree(local_buf);
 }
 
-static void fsl_espi_do_one_msg(struct spi_message *m)
+static int fsl_espi_do_one_msg(struct spi_master *master,
+                               struct spi_message *m)
 {
         struct spi_transfer *t;
         u8 *rx_buf = NULL;
@@ -441,8 +442,8 @@ static void fsl_espi_do_one_msg(struct spi_message *m)
 
         m->actual_length = espi_trans.actual_length;
         m->status = espi_trans.status;
-        if (m->complete)
-                m->complete(m->context);
+        spi_finalize_current_message(master);
+        return 0;
 }
 
 static int fsl_espi_setup(struct spi_device *spi)
@@ -587,6 +588,38 @@ static void fsl_espi_remove(struct mpc8xxx_spi *mspi)
         iounmap(mspi->reg_base);
 }
 
+static int fsl_espi_suspend(struct spi_master *master)
+{
+        struct mpc8xxx_spi *mpc8xxx_spi;
+        struct fsl_espi_reg *reg_base;
+        u32 regval;
+
+        mpc8xxx_spi = spi_master_get_devdata(master);
+        reg_base = mpc8xxx_spi->reg_base;
+
+        regval = mpc8xxx_spi_read_reg(&reg_base->mode);
+        regval &= ~SPMODE_ENABLE;
+        mpc8xxx_spi_write_reg(&reg_base->mode, regval);
+
+        return 0;
+}
+
+static int fsl_espi_resume(struct spi_master *master)
+{
+        struct mpc8xxx_spi *mpc8xxx_spi;
+        struct fsl_espi_reg *reg_base;
+        u32 regval;
+
+        mpc8xxx_spi = spi_master_get_devdata(master);
+        reg_base = mpc8xxx_spi->reg_base;
+
+        regval = mpc8xxx_spi_read_reg(&reg_base->mode);
+        regval |= SPMODE_ENABLE;
+        mpc8xxx_spi_write_reg(&reg_base->mode, regval);
+
+        return 0;
+}
+
 static struct spi_master * fsl_espi_probe(struct device *dev,
                 struct resource *mem, unsigned int irq)
 {
@@ -607,16 +640,16 @@ static struct spi_master * fsl_espi_probe(struct device *dev,
 
         dev_set_drvdata(dev, master);
 
-        ret = mpc8xxx_spi_probe(dev, mem, irq);
-        if (ret)
-                goto err_probe;
+        mpc8xxx_spi_probe(dev, mem, irq);
 
         master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 16);
         master->setup = fsl_espi_setup;
         master->cleanup = fsl_espi_cleanup;
+        master->transfer_one_message = fsl_espi_do_one_msg;
+        master->prepare_transfer_hardware = fsl_espi_resume;
+        master->unprepare_transfer_hardware = fsl_espi_suspend;
 
         mpc8xxx_spi = spi_master_get_devdata(master);
-        mpc8xxx_spi->spi_do_one_msg = fsl_espi_do_one_msg;
         mpc8xxx_spi->spi_remove = fsl_espi_remove;
 
         mpc8xxx_spi->reg_base = ioremap(mem->start, resource_size(mem));
@@ -762,25 +795,15 @@ static int of_fsl_espi_remove(struct platform_device *dev)
 static int of_fsl_espi_suspend(struct device *dev)
 {
         struct spi_master *master = dev_get_drvdata(dev);
-        struct mpc8xxx_spi *mpc8xxx_spi;
-        struct fsl_espi_reg *reg_base;
-        u32 regval;
         int ret;
 
-        mpc8xxx_spi = spi_master_get_devdata(master);
-        reg_base = mpc8xxx_spi->reg_base;
-
         ret = spi_master_suspend(master);
         if (ret) {
                 dev_warn(dev, "cannot suspend master\n");
                 return ret;
         }
 
-        regval = mpc8xxx_spi_read_reg(&reg_base->mode);
-        regval &= ~SPMODE_ENABLE;
-        mpc8xxx_spi_write_reg(&reg_base->mode, regval);
-
-        return 0;
+        return fsl_espi_suspend(master);
 }
 
 static int of_fsl_espi_resume(struct device *dev)
diff --git a/drivers/spi/spi-fsl-lib.c b/drivers/spi/spi-fsl-lib.c
index 5ddb5b098e4e..446b737e1532 100644
--- a/drivers/spi/spi-fsl-lib.c
+++ b/drivers/spi/spi-fsl-lib.c
@@ -61,44 +61,6 @@ struct mpc8xxx_spi_probe_info *to_of_pinfo(struct fsl_spi_platform_data *pdata)
         return container_of(pdata, struct mpc8xxx_spi_probe_info, pdata);
 }
 
-static void mpc8xxx_spi_work(struct work_struct *work)
-{
-        struct mpc8xxx_spi *mpc8xxx_spi = container_of(work, struct mpc8xxx_spi,
-                                                       work);
-
-        spin_lock_irq(&mpc8xxx_spi->lock);
-        while (!list_empty(&mpc8xxx_spi->queue)) {
-                struct spi_message *m = container_of(mpc8xxx_spi->queue.next,
-                                                   struct spi_message, queue);
-
-                list_del_init(&m->queue);
-                spin_unlock_irq(&mpc8xxx_spi->lock);
-
-                if (mpc8xxx_spi->spi_do_one_msg)
-                        mpc8xxx_spi->spi_do_one_msg(m);
-
-                spin_lock_irq(&mpc8xxx_spi->lock);
-        }
-        spin_unlock_irq(&mpc8xxx_spi->lock);
-}
-
-int mpc8xxx_spi_transfer(struct spi_device *spi,
-                                struct spi_message *m)
-{
-        struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
-        unsigned long flags;
-
-        m->actual_length = 0;
-        m->status = -EINPROGRESS;
-
-        spin_lock_irqsave(&mpc8xxx_spi->lock, flags);
-        list_add_tail(&m->queue, &mpc8xxx_spi->queue);
-        queue_work(mpc8xxx_spi->workqueue, &mpc8xxx_spi->work);
-        spin_unlock_irqrestore(&mpc8xxx_spi->lock, flags);
-
-        return 0;
-}
-
 const char *mpc8xxx_spi_strmode(unsigned int flags)
 {
         if (flags & SPI_QE_CPU_MODE) {
@@ -114,13 +76,12 @@ const char *mpc8xxx_spi_strmode(unsigned int flags)
         return "CPU";
 }
 
-int mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
+void mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
                         unsigned int irq)
 {
         struct fsl_spi_platform_data *pdata = dev_get_platdata(dev);
         struct spi_master *master;
         struct mpc8xxx_spi *mpc8xxx_spi;
-        int ret = 0;
 
         master = dev_get_drvdata(dev);
 
@@ -128,7 +89,6 @@ int mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
         master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH
                         | SPI_LSB_FIRST | SPI_LOOP;
 
-        master->transfer = mpc8xxx_spi_transfer;
         master->dev.of_node = dev->of_node;
 
         mpc8xxx_spi = spi_master_get_devdata(master);
@@ -147,22 +107,7 @@ int mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
         master->bus_num = pdata->bus_num;
         master->num_chipselect = pdata->max_chipselect;
 
-        spin_lock_init(&mpc8xxx_spi->lock);
         init_completion(&mpc8xxx_spi->done);
-        INIT_WORK(&mpc8xxx_spi->work, mpc8xxx_spi_work);
-        INIT_LIST_HEAD(&mpc8xxx_spi->queue);
-
-        mpc8xxx_spi->workqueue = create_singlethread_workqueue(
-                dev_name(master->dev.parent));
-        if (mpc8xxx_spi->workqueue == NULL) {
-                ret = -EBUSY;
-                goto err;
-        }
-
-        return 0;
-
-err:
-        return ret;
 }
 
 int mpc8xxx_spi_remove(struct device *dev)
@@ -173,8 +118,6 @@ int mpc8xxx_spi_remove(struct device *dev)
         master = dev_get_drvdata(dev);
         mpc8xxx_spi = spi_master_get_devdata(master);
 
-        flush_workqueue(mpc8xxx_spi->workqueue);
-        destroy_workqueue(mpc8xxx_spi->workqueue);
         spi_unregister_master(master);
 
         free_irq(mpc8xxx_spi->irq, mpc8xxx_spi);
diff --git a/drivers/spi/spi-fsl-lib.h b/drivers/spi/spi-fsl-lib.h
index 2fcbfd01d109..b4ed04e8862f 100644
--- a/drivers/spi/spi-fsl-lib.h
+++ b/drivers/spi/spi-fsl-lib.h
@@ -55,7 +55,6 @@ struct mpc8xxx_spi {
         u32(*get_tx) (struct mpc8xxx_spi *);
 
         /* hooks for different controller driver */
-        void (*spi_do_one_msg) (struct spi_message *m);
         void (*spi_remove) (struct mpc8xxx_spi *mspi);
 
         unsigned int count;
@@ -78,12 +77,6 @@ struct mpc8xxx_spi {
                            int bits_per_word, int msb_first);
 #endif
 
-        struct workqueue_struct *workqueue;
-        struct work_struct work;
-
-        struct list_head queue;
-        spinlock_t lock;
-
         struct completion done;
 };
 
@@ -123,9 +116,8 @@ extern struct mpc8xxx_spi_probe_info *to_of_pinfo(
                 struct fsl_spi_platform_data *pdata);
 extern int mpc8xxx_spi_bufs(struct mpc8xxx_spi *mspi,
                 struct spi_transfer *t, unsigned int len);
-extern int mpc8xxx_spi_transfer(struct spi_device *spi, struct spi_message *m);
 extern const char *mpc8xxx_spi_strmode(unsigned int flags);
-extern int mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
+extern void mpc8xxx_spi_probe(struct device *dev, struct resource *mem,
                 unsigned int irq);
 extern int mpc8xxx_spi_remove(struct device *dev);
 extern int of_mpc8xxx_spi_probe(struct platform_device *ofdev);
diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index ed792880c9d6..3b159364c459 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -353,7 +353,8 @@ static int fsl_spi_bufs(struct spi_device *spi, struct spi_transfer *t,
         return mpc8xxx_spi->count;
 }
 
-static void fsl_spi_do_one_msg(struct spi_message *m)
+static int fsl_spi_do_one_msg(struct spi_master *master,
+                              struct spi_message *m)
 {
         struct spi_device *spi = m->spi;
         struct spi_transfer *t, *first;
@@ -367,10 +368,9 @@ static void fsl_spi_do_one_msg(struct spi_message *m)
         list_for_each_entry(t, &m->transfers, transfer_list) {
                 if ((first->bits_per_word != t->bits_per_word) ||
                         (first->speed_hz != t->speed_hz)) {
-                        status = -EINVAL;
                         dev_err(&spi->dev,
                                 "bits_per_word/speed_hz should be same for the same SPI transfer\n");
-                        return;
+                        return -EINVAL;
                 }
         }
 
@@ -408,8 +408,7 @@ static void fsl_spi_do_one_msg(struct spi_message *m)
         }
 
         m->status = status;
-        if (m->complete)
-                m->complete(m->context);
+        spi_finalize_current_message(master);
 
         if (status || !cs_change) {
                 ndelay(nsecs);
@@ -417,6 +416,7 @@ static void fsl_spi_do_one_msg(struct spi_message *m)
         }
 
         fsl_spi_setup_transfer(spi, NULL);
+        return 0;
 }
 
 static int fsl_spi_setup(struct spi_device *spi)
@@ -624,15 +624,13 @@ static struct spi_master * fsl_spi_probe(struct device *dev,
 
         dev_set_drvdata(dev, master);
 
-        ret = mpc8xxx_spi_probe(dev, mem, irq);
-        if (ret)
-                goto err_probe;
+        mpc8xxx_spi_probe(dev, mem, irq);
 
         master->setup = fsl_spi_setup;
         master->cleanup = fsl_spi_cleanup;
+        master->transfer_one_message = fsl_spi_do_one_msg;
 
         mpc8xxx_spi = spi_master_get_devdata(master);
-        mpc8xxx_spi->spi_do_one_msg = fsl_spi_do_one_msg;
         mpc8xxx_spi->spi_remove = fsl_spi_remove;
         mpc8xxx_spi->max_bits_per_word = 32;
         mpc8xxx_spi->type = fsl_spi_get_type(dev);
@@ -704,7 +702,6 @@ free_irq:
 err_ioremap:
         fsl_spi_cpm_free(mpc8xxx_spi);
 err_cpm_init:
-err_probe:
         spi_master_put(master);
 err:
         return ERR_PTR(ret);
diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index 9f595535cf27..4b600d4f8548 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -48,7 +48,7 @@ struct spi_gpio {
         struct spi_bitbang              bitbang;
         struct spi_gpio_platform_data   pdata;
         struct platform_device          *pdev;
-        int                             cs_gpios[0];
+        unsigned long                   cs_gpios[0];
 };
 
 /*----------------------------------------------------------------------*/
@@ -220,7 +220,7 @@ static u32 spi_gpio_spec_txrx_word_mode3(struct spi_device *spi,
 static void spi_gpio_chipselect(struct spi_device *spi, int is_active)
 {
         struct spi_gpio *spi_gpio = spi_to_spi_gpio(spi);
-        unsigned int cs = spi_gpio->cs_gpios[spi->chip_select];
+        unsigned long cs = spi_gpio->cs_gpios[spi->chip_select];
 
         /* set initial clock polarity */
         if (is_active)
@@ -234,7 +234,7 @@ static void spi_gpio_chipselect(struct spi_device *spi, int is_active)
 
 static int spi_gpio_setup(struct spi_device *spi)
 {
-        unsigned int            cs;
+        unsigned long           cs;
         int                     status = 0;
         struct spi_gpio         *spi_gpio = spi_to_spi_gpio(spi);
         struct device_node      *np = spi->master->dev.of_node;
@@ -249,7 +249,7 @@ static int spi_gpio_setup(struct spi_device *spi)
                 /*
                  * ... otherwise, take it from spi->controller_data
                  */
-                cs = (unsigned int)(uintptr_t) spi->controller_data;
+                cs = (uintptr_t) spi->controller_data;
         }
 
         if (!spi->controller_state) {
@@ -277,7 +277,7 @@ static int spi_gpio_setup(struct spi_device *spi)
 static void spi_gpio_cleanup(struct spi_device *spi)
 {
         struct spi_gpio *spi_gpio = spi_to_spi_gpio(spi);
-        unsigned int cs = spi_gpio->cs_gpios[spi->chip_select];
+        unsigned long cs = spi_gpio->cs_gpios[spi->chip_select];
 
         if (cs != SPI_GPIO_NO_CHIPSELECT)
                 gpio_free(cs);
@@ -413,6 +413,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
         struct spi_gpio_platform_data   *pdata;
         u16 master_flags = 0;
         bool use_of = 0;
+        int num_devices;
 
         status = spi_gpio_probe_dt(pdev);
         if (status < 0)
@@ -422,16 +423,21 @@ static int spi_gpio_probe(struct platform_device *pdev)
 
         pdata = dev_get_platdata(&pdev->dev);
 #ifdef GENERIC_BITBANG
-        if (!pdata || !pdata->num_chipselect)
+        if (!pdata || (!use_of && !pdata->num_chipselect))
                 return -ENODEV;
 #endif
 
+        if (use_of && !SPI_N_CHIPSEL)
+                num_devices = 1;
+        else
+                num_devices = SPI_N_CHIPSEL;
+
         status = spi_gpio_request(pdata, dev_name(&pdev->dev), &master_flags);
         if (status < 0)
                 return status;
 
         master = spi_alloc_master(&pdev->dev, sizeof(*spi_gpio) +
-                                        (sizeof(int) * SPI_N_CHIPSEL));
+                                        (sizeof(unsigned long) * num_devices));
         if (!master) {
                 status = -ENOMEM;
                 goto gpio_free;
@@ -446,7 +452,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
         master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32);
         master->flags = master_flags;
         master->bus_num = pdev->id;
-        master->num_chipselect = SPI_N_CHIPSEL;
+        master->num_chipselect = num_devices;
         master->setup = spi_gpio_setup;
         master->cleanup = spi_gpio_cleanup;
 #ifdef CONFIG_OF
@@ -461,9 +467,18 @@ static int spi_gpio_probe(struct platform_device *pdev)
                  * property of the node.
                  */
 
-                for (i = 0; i < SPI_N_CHIPSEL; i++)
-                        spi_gpio->cs_gpios[i] =
-                                of_get_named_gpio(np, "cs-gpios", i);
+                if (!SPI_N_CHIPSEL)
+                        spi_gpio->cs_gpios[0] = SPI_GPIO_NO_CHIPSELECT;
+                else
+                        for (i = 0; i < SPI_N_CHIPSEL; i++) {
+                                status = of_get_named_gpio(np, "cs-gpios", i);
+                                if (status < 0) {
+                                        dev_err(&pdev->dev,
+                                                "invalid cs-gpios property\n");
+                                        goto gpio_free;
+                                }
+                                spi_gpio->cs_gpios[i] = status;
+                        }
         }
 #endif
 
diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c
new file mode 100644
index 000000000000..0e48f8c2037d
--- /dev/null
+++ b/drivers/spi/spi-meson-spifc.c
@@ -0,0 +1,462 @@
+/*
+ * Driver for Amlogic Meson SPI flash controller (SPIFC)
+ *
+ * Copyright (C) 2014 Beniamino Galvani <b.galvani@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/regmap.h>
+#include <linux/spi/spi.h>
+#include <linux/types.h>
+
+/* register map */
+#define REG_CMD                 0x00
+#define REG_ADDR                0x04
+#define REG_CTRL                0x08
+#define REG_CTRL1               0x0c
+#define REG_STATUS              0x10
+#define REG_CTRL2               0x14
+#define REG_CLOCK               0x18
+#define REG_USER                0x1c
+#define REG_USER1               0x20
+#define REG_USER2               0x24
+#define REG_USER3               0x28
+#define REG_USER4               0x2c
+#define REG_SLAVE               0x30
+#define REG_SLAVE1              0x34
+#define REG_SLAVE2              0x38
+#define REG_SLAVE3              0x3c
+#define REG_C0                  0x40
+#define REG_B8                  0x60
+#define REG_MAX                 0x7c
+
+/* register fields */
+#define CMD_USER                BIT(18)
+#define CTRL_ENABLE_AHB         BIT(17)
+#define CLOCK_SOURCE            BIT(31)
+#define CLOCK_DIV_SHIFT         12
+#define CLOCK_DIV_MASK          (0x3f << CLOCK_DIV_SHIFT)
+#define CLOCK_CNT_HIGH_SHIFT    6
+#define CLOCK_CNT_HIGH_MASK     (0x3f << CLOCK_CNT_HIGH_SHIFT)
+#define CLOCK_CNT_LOW_SHIFT     0
+#define CLOCK_CNT_LOW_MASK      (0x3f << CLOCK_CNT_LOW_SHIFT)
+#define USER_DIN_EN_MS          BIT(0)
+#define USER_CMP_MODE           BIT(2)
+#define USER_UC_DOUT_SEL        BIT(27)
+#define USER_UC_DIN_SEL         BIT(28)
+#define USER_UC_MASK            ((BIT(5) - 1) << 27)
+#define USER1_BN_UC_DOUT_SHIFT  17
+#define USER1_BN_UC_DOUT_MASK   (0xff << 16)
+#define USER1_BN_UC_DIN_SHIFT   8
+#define USER1_BN_UC_DIN_MASK    (0xff << 8)
+#define USER4_CS_ACT            BIT(30)
+#define SLAVE_TRST_DONE         BIT(4)
+#define SLAVE_OP_MODE           BIT(30)
+#define SLAVE_SW_RST            BIT(31)
+
+#define SPIFC_BUFFER_SIZE       64
+
+/**
+ * struct meson_spifc
+ * @master:     the SPI master
+ * @regmap:     regmap for device registers
+ * @clk:        input clock of the built-in baud rate generator
+ * @device:     the device structure
+ */
+struct meson_spifc {
+        struct spi_master *master;
+        struct regmap *regmap;
+        struct clk *clk;
+        struct device *dev;
+};
+
+static struct regmap_config spifc_regmap_config = {
+        .reg_bits = 32,
+        .val_bits = 32,
+        .reg_stride = 4,
+        .max_register = REG_MAX,
+};
+
+/**
+ * meson_spifc_wait_ready() - wait for the current operation to terminate
+ * @spifc:      the Meson SPI device
+ * Return:      0 on success, a negative value on error
+ */
+static int meson_spifc_wait_ready(struct meson_spifc *spifc)
+{
+        unsigned long deadline = jiffies + msecs_to_jiffies(5);
+        u32 data;
+
+        do {
+                regmap_read(spifc->regmap, REG_SLAVE, &data);
+                if (data & SLAVE_TRST_DONE)
+                        return 0;
+                cond_resched();
+        } while (!time_after(jiffies, deadline));
+
+        return -ETIMEDOUT;
+}
+
+/**
+ * meson_spifc_drain_buffer() - copy data from device buffer to memory
+ * @spifc:      the Meson SPI device
+ * @buf:        the destination buffer
+ * @len:        number of bytes to copy
+ */
+static void meson_spifc_drain_buffer(struct meson_spifc *spifc, u8 *buf,
+                                     int len)
+{
+        u32 data;
+        int i = 0;
+
+        while (i < len) {
+                regmap_read(spifc->regmap, REG_C0 + i, &data);
+
+                if (len - i >= 4) {
+                        *((u32 *)buf) = data;
+                        buf += 4;
+                } else {
+                        memcpy(buf, &data, len - i);
+                        break;
+                }
+                i += 4;
+        }
+}
+
+/**
+ * meson_spifc_fill_buffer() - copy data from memory to device buffer
+ * @spifc:      the Meson SPI device
+ * @buf:        the source buffer
+ * @len:        number of bytes to copy
+ */
+static void meson_spifc_fill_buffer(struct meson_spifc *spifc, const u8 *buf,
+                                    int len)
+{
+        u32 data;
+        int i = 0;
+
+        while (i < len) {
+                if (len - i >= 4)
+                        data = *(u32 *)buf;
+                else
+                        memcpy(&data, buf, len - i);
+
+                regmap_write(spifc->regmap, REG_C0 + i, data);
+
+                buf += 4;
+                i += 4;
+        }
+}
+
+/**
+ * meson_spifc_setup_speed() - program the clock divider
+ * @spifc:      the Meson SPI device
+ * @speed:      desired speed in Hz
+ */
+static void meson_spifc_setup_speed(struct meson_spifc *spifc, u32 speed)
+{
+        unsigned long parent, value;
+        int n;
+
+        parent = clk_get_rate(spifc->clk);
+        n = max_t(int, parent / speed - 1, 1);
+
+        dev_dbg(spifc->dev, "parent %lu, speed %u, n %d\n", parent,
+                speed, n);
+
+        value = (n << CLOCK_DIV_SHIFT) & CLOCK_DIV_MASK;
+        value |= (n << CLOCK_CNT_LOW_SHIFT) & CLOCK_CNT_LOW_MASK;
+        value |= (((n + 1) / 2 - 1) << CLOCK_CNT_HIGH_SHIFT) &
+                CLOCK_CNT_HIGH_MASK;
+
+        regmap_write(spifc->regmap, REG_CLOCK, value);
+}
+
+/**
+ * meson_spifc_txrx() - transfer a chunk of data
+ * @spifc:      the Meson SPI device
+ * @xfer:       the current SPI transfer
+ * @offset:     offset of the data to transfer
+ * @len:        length of the data to transfer
+ * @last_xfer:  whether this is the last transfer of the message
+ * @last_chunk: whether this is the last chunk of the transfer
+ * Return:      0 on success, a negative value on error
+ */
+static int meson_spifc_txrx(struct meson_spifc *spifc,
+                            struct spi_transfer *xfer,
+                            int offset, int len, bool last_xfer,
+                            bool last_chunk)
+{
+        bool keep_cs = true;
+        int ret;
+
+        if (xfer->tx_buf)
+                meson_spifc_fill_buffer(spifc, xfer->tx_buf + offset, len);
+
+        /* enable DOUT stage */
+        regmap_update_bits(spifc->regmap, REG_USER, USER_UC_MASK,
+                           USER_UC_DOUT_SEL);
+        regmap_write(spifc->regmap, REG_USER1,
+                     (8 * len - 1) << USER1_BN_UC_DOUT_SHIFT);
+
+        /* enable data input during DOUT */
+        regmap_update_bits(spifc->regmap, REG_USER, USER_DIN_EN_MS,
+                           USER_DIN_EN_MS);
+
+        if (last_chunk) {
+                if (last_xfer)
+                        keep_cs = xfer->cs_change;
+                else
+                        keep_cs = !xfer->cs_change;
+        }
+
+        regmap_update_bits(spifc->regmap, REG_USER4, USER4_CS_ACT,
+                           keep_cs ? USER4_CS_ACT : 0);
+
+        /* clear transition done bit */
+        regmap_update_bits(spifc->regmap, REG_SLAVE, SLAVE_TRST_DONE, 0);
+        /* start transfer */
+        regmap_update_bits(spifc->regmap, REG_CMD, CMD_USER, CMD_USER);
+
+        ret = meson_spifc_wait_ready(spifc);
+
+        if (!ret && xfer->rx_buf)
+                meson_spifc_drain_buffer(spifc, xfer->rx_buf + offset, len);
+
+        return ret;
+}
+
+/**
+ * meson_spifc_transfer_one() - perform a single transfer
+ * @master:     the SPI master
+ * @spi:        the SPI device
+ * @xfer:       the current SPI transfer
+ * Return:      0 on success, a negative value on error
+ */
+static int meson_spifc_transfer_one(struct spi_master *master,
+                                    struct spi_device *spi,
+                                    struct spi_transfer *xfer)
+{
+        struct meson_spifc *spifc = spi_master_get_devdata(master);
+        int len, done = 0, ret = 0;
+
+        meson_spifc_setup_speed(spifc, xfer->speed_hz);
+
+        regmap_update_bits(spifc->regmap, REG_CTRL, CTRL_ENABLE_AHB, 0);
+
+        while (done < xfer->len && !ret) {
+                len = min_t(int, xfer->len - done, SPIFC_BUFFER_SIZE);
+                ret = meson_spifc_txrx(spifc, xfer, done, len,
+                                       spi_transfer_is_last(master, xfer),
+                                       done + len >= xfer->len);
+                done += len;
+        }
+
+        regmap_update_bits(spifc->regmap, REG_CTRL, CTRL_ENABLE_AHB,
+                           CTRL_ENABLE_AHB);
+
+        return ret;
+}
+
+/**
+ * meson_spifc_hw_init() - reset and initialize the SPI controller
+ * @spifc:      the Meson SPI device
+ */
+static void meson_spifc_hw_init(struct meson_spifc *spifc)
+{
+        /* reset device */
+        regmap_update_bits(spifc->regmap, REG_SLAVE, SLAVE_SW_RST,
+                           SLAVE_SW_RST);
+        /* disable compatible mode */
+        regmap_update_bits(spifc->regmap, REG_USER, USER_CMP_MODE, 0);
+        /* set master mode */
+        regmap_update_bits(spifc->regmap, REG_SLAVE, SLAVE_OP_MODE, 0);
+}
+
+static int meson_spifc_probe(struct platform_device *pdev)
+{
+        struct spi_master *master;
+        struct meson_spifc *spifc;
+        struct resource *res;
+        void __iomem *base;
+        unsigned int rate;
+        int ret = 0;
+
+        master = spi_alloc_master(&pdev->dev, sizeof(struct meson_spifc));
+        if (!master)
+                return -ENOMEM;
+
+        platform_set_drvdata(pdev, master);
+
+        spifc = spi_master_get_devdata(master);
+        spifc->dev = &pdev->dev;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        base = devm_ioremap_resource(spifc->dev, res);
+        if (IS_ERR(base)) {
+                ret = PTR_ERR(base);
+                goto out_err;
+        }
+
+        spifc->regmap = devm_regmap_init_mmio(spifc->dev, base,
+                                              &spifc_regmap_config);
+        if (IS_ERR(spifc->regmap)) {
+                ret = PTR_ERR(spifc->regmap);
+                goto out_err;
+        }
+
+        spifc->clk = devm_clk_get(spifc->dev, NULL);
+        if (IS_ERR(spifc->clk)) {
+                dev_err(spifc->dev, "missing clock\n");
+                ret = PTR_ERR(spifc->clk);
+                goto out_err;
+        }
+
+        ret = clk_prepare_enable(spifc->clk);
+        if (ret) {
+                dev_err(spifc->dev, "can't prepare clock\n");
+                goto out_err;
+        }
+
+        rate = clk_get_rate(spifc->clk);
+
+        master->num_chipselect = 1;
+        master->dev.of_node = pdev->dev.of_node;
+        master->bits_per_word_mask = SPI_BPW_MASK(8);
+        master->auto_runtime_pm = true;
+        master->transfer_one = meson_spifc_transfer_one;
+        master->min_speed_hz = rate >> 6;
+        master->max_speed_hz = rate >> 1;
+
+        meson_spifc_hw_init(spifc);
+
+        pm_runtime_set_active(spifc->dev);
+        pm_runtime_enable(spifc->dev);
+
+        ret = devm_spi_register_master(spifc->dev, master);
+        if (ret) {
+                dev_err(spifc->dev, "failed to register spi master\n");
+                goto out_clk;
+        }
+
+        return 0;
+out_clk:
+        clk_disable_unprepare(spifc->clk);
+out_err:
+        spi_master_put(master);
+        return ret;
+}
+
+static int meson_spifc_remove(struct platform_device *pdev)
+{
+        struct spi_master *master = platform_get_drvdata(pdev);
+        struct meson_spifc *spifc = spi_master_get_devdata(master);
+
+        pm_runtime_get_sync(&pdev->dev);
+        clk_disable_unprepare(spifc->clk);
+        pm_runtime_disable(&pdev->dev);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int meson_spifc_suspend(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct meson_spifc *spifc = spi_master_get_devdata(master);
+        int ret;
+
+        ret = spi_master_suspend(master);
+        if (ret)
+                return ret;
+
+        if (!pm_runtime_suspended(dev))
+                clk_disable_unprepare(spifc->clk);
+
+        return 0;
+}
+
+static int meson_spifc_resume(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct meson_spifc *spifc = spi_master_get_devdata(master);
+        int ret;
+
+        if (!pm_runtime_suspended(dev)) {
+                ret = clk_prepare_enable(spifc->clk);
+                if (ret)
+                        return ret;
+        }
+
+        meson_spifc_hw_init(spifc);
+
+        ret = spi_master_resume(master);
+        if (ret)
+                clk_disable_unprepare(spifc->clk);
+
+        return ret;
+}
+#endif /* CONFIG_PM_SLEEP */
+
+#ifdef CONFIG_PM_RUNTIME
+static int meson_spifc_runtime_suspend(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct meson_spifc *spifc = spi_master_get_devdata(master);
+
+        clk_disable_unprepare(spifc->clk);
+
+        return 0;
+}
+
+static int meson_spifc_runtime_resume(struct device *dev)
+{
+        struct spi_master *master = dev_get_drvdata(dev);
+        struct meson_spifc *spifc = spi_master_get_devdata(master);
+
+        return clk_prepare_enable(spifc->clk);
+}
+#endif /* CONFIG_PM_RUNTIME */
+
+static const struct dev_pm_ops meson_spifc_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(meson_spifc_suspend, meson_spifc_resume)
+        SET_RUNTIME_PM_OPS(meson_spifc_runtime_suspend,
+                           meson_spifc_runtime_resume,
+                           NULL)
+};
+
+static const struct of_device_id meson_spifc_dt_match[] = {
+        { .compatible = "amlogic,meson6-spifc", },
+        { },
+};
+
+static struct platform_driver meson_spifc_driver = {
+        .probe  = meson_spifc_probe,
+        .remove = meson_spifc_remove,
+        .driver = {
+                .name           = "meson-spifc",
+                .of_match_table = of_match_ptr(meson_spifc_dt_match),
+                .pm             = &meson_spifc_pm_ops,
+        },
+};
+
+module_platform_driver(meson_spifc_driver);
+
+MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");
+MODULE_DESCRIPTION("Amlogic Meson SPIFC driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
index 835cdda6f4f5..c76b7d7879df 100644
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -454,7 +454,7 @@ static int orion_spi_probe(struct platform_device *pdev)
         spi->master = master;
 
         of_id = of_match_device(orion_spi_of_match_table, &pdev->dev);
-        devdata = of_id->data;
+        devdata = (of_id) ? of_id->data : &orion_spi_dev_data;
         spi->devdata = devdata;
 
         spi->clk = devm_clk_get(&pdev->dev, NULL);
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index f35f723816ea..fc2dd8441608 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1106,7 +1106,7 @@ err_rxdesc:
                      pl022->sgt_tx.nents, DMA_TO_DEVICE);
 err_tx_sgmap:
         dma_unmap_sg(rxchan->device->dev, pl022->sgt_rx.sgl,
-                     pl022->sgt_tx.nents, DMA_FROM_DEVICE);
+                     pl022->sgt_rx.nents, DMA_FROM_DEVICE);
 err_rx_sgmap:
         sg_free_table(&pl022->sgt_tx);
 err_alloc_tx_sg:
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index d8a105f76837..9e9e0f971e6c 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1274,7 +1274,9 @@ static int pxa2xx_spi_suspend(struct device *dev)
         if (status != 0)
                 return status;
         write_SSCR0(0, drv_data->ioaddr);
-        clk_disable_unprepare(ssp->clk);
+
+        if (!pm_runtime_suspended(dev))
+                clk_disable_unprepare(ssp->clk);
 
         return 0;
 }
@@ -1288,7 +1290,8 @@ static int pxa2xx_spi_resume(struct device *dev)
         pxa2xx_spi_dma_resume(drv_data);
 
         /* Enable the SSP clock */
-        clk_prepare_enable(ssp->clk);
+        if (!pm_runtime_suspended(dev))
+                clk_prepare_enable(ssp->clk);
 
         /* Restore LPSS private register bits */
         lpss_ssp_setup(drv_data);
diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index f96ea8a38d64..87bc16f491f0 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -145,6 +145,9 @@
 #define RXBUSY                                          (1 << 0)
 #define TXBUSY                                          (1 << 1)
 
+/* sclk_out: spi master internal logic in rk3x can support 50Mhz */
+#define MAX_SCLK_OUT            50000000
+
 enum rockchip_ssi_type {
         SSI_MOTO_SPI = 0,
         SSI_TI_SSP,
@@ -325,6 +328,8 @@ static int rockchip_spi_unprepare_message(struct spi_master *master,
 
         spin_unlock_irqrestore(&rs->lock, flags);
 
+        spi_enable_chip(rs, 0);
+
         return 0;
 }
 
@@ -381,6 +386,8 @@ static int rockchip_spi_pio_transfer(struct rockchip_spi *rs)
         if (rs->tx)
                 wait_for_idle(rs);
 
+        spi_enable_chip(rs, 0);
+
         return 0;
 }
 
@@ -392,8 +399,10 @@ static void rockchip_spi_dma_rxcb(void *data)
         spin_lock_irqsave(&rs->lock, flags);
 
         rs->state &= ~RXBUSY;
-        if (!(rs->state & TXBUSY))
+        if (!(rs->state & TXBUSY)) {
+                spi_enable_chip(rs, 0);
                 spi_finalize_current_transfer(rs->master);
+        }
 
         spin_unlock_irqrestore(&rs->lock, flags);
 }
@@ -409,8 +418,10 @@ static void rockchip_spi_dma_txcb(void *data)
         spin_lock_irqsave(&rs->lock, flags);
 
         rs->state &= ~TXBUSY;
-        if (!(rs->state & RXBUSY))
+        if (!(rs->state & RXBUSY)) {
+                spi_enable_chip(rs, 0);
                 spi_finalize_current_transfer(rs->master);
+        }
 
         spin_unlock_irqrestore(&rs->lock, flags);
 }
@@ -496,12 +507,19 @@ static void rockchip_spi_config(struct rockchip_spi *rs)
                         dmacr |= RF_DMA_EN;
         }
 
+        if (WARN_ON(rs->speed > MAX_SCLK_OUT))
+                rs->speed = MAX_SCLK_OUT;
+
+        /* the minimum divsor is 2 */
+        if (rs->max_freq < 2 * rs->speed) {
+                clk_set_rate(rs->spiclk, 2 * rs->speed);
+                rs->max_freq = clk_get_rate(rs->spiclk);
+        }
+
         /* div doesn't support odd number */
         div = max_t(u32, rs->max_freq / rs->speed, 1);
         div = (div + 1) & 0xfffe;
 
-        spi_enable_chip(rs, 0);
-
         writel_relaxed(cr0, rs->regs + ROCKCHIP_SPI_CTRLR0);
 
         writel_relaxed(rs->len - 1, rs->regs + ROCKCHIP_SPI_CTRLR1);
@@ -515,8 +533,6 @@ static void rockchip_spi_config(struct rockchip_spi *rs)
         spi_set_clk(rs, div);
 
         dev_dbg(rs->dev, "cr0 0x%x, div %d\n", cr0, div);
-
-        spi_enable_chip(rs, 1);
 }
 
 static int rockchip_spi_transfer_one(
@@ -524,7 +540,7 @@ static int rockchip_spi_transfer_one(
                 struct spi_device *spi,
                 struct spi_transfer *xfer)
 {
-        int ret = 0;
+        int ret = 1;
         struct rockchip_spi *rs = spi_master_get_devdata(master);
 
         WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
@@ -556,17 +572,27 @@ static int rockchip_spi_transfer_one(
                 rs->tmode = CR0_XFM_RO;
 
         /* we need prepare dma before spi was enabled */
-        if (master->can_dma && master->can_dma(master, spi, xfer)) {
+        if (master->can_dma && master->can_dma(master, spi, xfer))
                 rs->use_dma = 1;
-                rockchip_spi_prepare_dma(rs);
-        } else {
+        else
                 rs->use_dma = 0;
-        }
 
         rockchip_spi_config(rs);
 
-        if (!rs->use_dma)
+        if (rs->use_dma) {
+                if (rs->tmode == CR0_XFM_RO) {
+                        /* rx: dma must be prepared first */
+                        rockchip_spi_prepare_dma(rs);
+                        spi_enable_chip(rs, 1);
+                } else {
+                        /* tx or tr: spi must be enabled first */
+                        spi_enable_chip(rs, 1);
+                        rockchip_spi_prepare_dma(rs);
+                }
+        } else {
+                spi_enable_chip(rs, 1);
                 ret = rockchip_spi_pio_transfer(rs);
+        }
 
         return ret;
 }
diff --git a/drivers/spi/spi-sirf.c b/drivers/spi/spi-sirf.c
index 39e2c0a55a28..f63de781c729 100644
--- a/drivers/spi/spi-sirf.c
+++ b/drivers/spi/spi-sirf.c
@@ -562,9 +562,9 @@ spi_sirfsoc_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 
         sspi->word_width = DIV_ROUND_UP(bits_per_word, 8);
         txfifo_ctrl = SIRFSOC_SPI_FIFO_THD(SIRFSOC_SPI_FIFO_SIZE / 2) |
-                                           sspi->word_width;
+                                           (sspi->word_width >> 1);
         rxfifo_ctrl = SIRFSOC_SPI_FIFO_THD(SIRFSOC_SPI_FIFO_SIZE / 2) |
-                                           sspi->word_width;
+                                           (sspi->word_width >> 1);
 
         if (!(spi->mode & SPI_CS_HIGH))
                 regval |= SIRFSOC_SPI_CS_IDLE_STAT;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index ebcb33df2eb2..da7e6225b8f6 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -615,13 +615,13 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
                                 sg_free_table(sgt);
                                 return -ENOMEM;
                         }
-                        sg_buf = page_address(vm_page) +
-                                ((size_t)buf & ~PAGE_MASK);
+                        sg_set_page(&sgt->sgl[i], vm_page,
+                                    min, offset_in_page(buf));
                 } else {
                         sg_buf = buf;
+                        sg_set_buf(&sgt->sgl[i], sg_buf, min);
                 }
 
-                sg_set_buf(&sgt->sgl[i], sg_buf, min);
 
                 buf += min;
                 len -= min;
@@ -1001,7 +1001,7 @@ static int spi_init_queue(struct spi_master *master)
                                            dev_name(&master->dev));
         if (IS_ERR(master->kworker_task)) {
                 dev_err(&master->dev, "failed to create message pump task\n");
-                return -ENOMEM;
+                return PTR_ERR(master->kworker_task);
         }
         init_kthread_work(&master->pump_messages, spi_pump_messages);
 
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index e3bc23bb5883..e50039fb1474 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -82,10 +82,11 @@ struct spidev_data {
         struct spi_device       *spi;
         struct list_head        device_entry;
 
-        /* buffer is NULL unless this device is open (users > 0) */
+        /* TX/RX buffers are NULL unless this device is open (users > 0) */
         struct mutex            buf_lock;
         unsigned                users;
-        u8                      *buffer;
+        u8                      *tx_buffer;
+        u8                      *rx_buffer;
 };
 
 static LIST_HEAD(device_list);
@@ -135,7 +136,7 @@ static inline ssize_t
 spidev_sync_write(struct spidev_data *spidev, size_t len)
 {
         struct spi_transfer     t = {
-                        .tx_buf         = spidev->buffer,
+                        .tx_buf         = spidev->tx_buffer,
                         .len            = len,
                 };
         struct spi_message      m;
@@ -149,7 +150,7 @@ static inline ssize_t
 spidev_sync_read(struct spidev_data *spidev, size_t len)
 {
         struct spi_transfer     t = {
-                        .rx_buf         = spidev->buffer,
+                        .rx_buf         = spidev->rx_buffer,
                         .len            = len,
                 };
         struct spi_message      m;
@@ -179,7 +180,7 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
         if (status > 0) {
                 unsigned long   missing;
 
-                missing = copy_to_user(buf, spidev->buffer, status);
+                missing = copy_to_user(buf, spidev->rx_buffer, status);
                 if (missing == status)
                         status = -EFAULT;
                 else
@@ -206,7 +207,7 @@ spidev_write(struct file *filp, const char __user *buf,
         spidev = filp->private_data;
 
         mutex_lock(&spidev->buf_lock);
-        missing = copy_from_user(spidev->buffer, buf, count);
+        missing = copy_from_user(spidev->tx_buffer, buf, count);
         if (missing == 0)
                 status = spidev_sync_write(spidev, count);
         else
@@ -224,7 +225,7 @@ static int spidev_message(struct spidev_data *spidev,
         struct spi_transfer     *k_tmp;
         struct spi_ioc_transfer *u_tmp;
         unsigned                n, total;
-        u8                      *buf;
+        u8                      *tx_buf, *rx_buf;
         int                     status = -EFAULT;
 
         spi_message_init(&msg);
@@ -236,7 +237,8 @@ static int spidev_message(struct spidev_data *spidev,
          * We walk the array of user-provided transfers, using each one
          * to initialize a kernel version of the same transfer.
          */
-        buf = spidev->buffer;
+        tx_buf = spidev->tx_buffer;
+        rx_buf = spidev->rx_buffer;
         total = 0;
         for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers;
                         n;
@@ -250,20 +252,21 @@ static int spidev_message(struct spidev_data *spidev,
                 }
 
                 if (u_tmp->rx_buf) {
-                        k_tmp->rx_buf = buf;
+                        k_tmp->rx_buf = rx_buf;
                         if (!access_ok(VERIFY_WRITE, (u8 __user *)
                                                 (uintptr_t) u_tmp->rx_buf,
                                                 u_tmp->len))
                                 goto done;
                 }
                 if (u_tmp->tx_buf) {
-                        k_tmp->tx_buf = buf;
-                        if (copy_from_user(buf, (const u8 __user *)
+                        k_tmp->tx_buf = tx_buf;
+                        if (copy_from_user(tx_buf, (const u8 __user *)
                                                 (uintptr_t) u_tmp->tx_buf,
                                         u_tmp->len))
                                 goto done;
                 }
-                buf += k_tmp->len;
+                tx_buf += k_tmp->len;
+                rx_buf += k_tmp->len;
 
                 k_tmp->cs_change = !!u_tmp->cs_change;
                 k_tmp->tx_nbits = u_tmp->tx_nbits;
@@ -290,17 +293,17 @@ static int spidev_message(struct spidev_data *spidev,
                 goto done;
 
         /* copy any rx data out of bounce buffer */
-        buf = spidev->buffer;
+        rx_buf = spidev->rx_buffer;
         for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
                 if (u_tmp->rx_buf) {
                         if (__copy_to_user((u8 __user *)
-                                        (uintptr_t) u_tmp->rx_buf, buf,
+                                        (uintptr_t) u_tmp->rx_buf, rx_buf,
                                         u_tmp->len)) {
                                 status = -EFAULT;
                                 goto done;
                         }
                 }
-                buf += u_tmp->len;
+                rx_buf += u_tmp->len;
         }
         status = total;
 
@@ -508,22 +511,41 @@ static int spidev_open(struct inode *inode, struct file *filp)
                         break;
                 }
         }
-        if (status == 0) {
-                if (!spidev->buffer) {
-                        spidev->buffer = kmalloc(bufsiz, GFP_KERNEL);
-                        if (!spidev->buffer) {
+
+        if (status) {
+                pr_debug("spidev: nothing for minor %d\n", iminor(inode));
+                goto err_find_dev;
+        }
+
+        if (!spidev->tx_buffer) {
+                spidev->tx_buffer = kmalloc(bufsiz, GFP_KERNEL);
+                if (!spidev->tx_buffer) {
                                 dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
                                 status = -ENOMEM;
+                        goto err_find_dev;
                         }
                 }
-                if (status == 0) {
-                        spidev->users++;
-                        filp->private_data = spidev;
-                        nonseekable_open(inode, filp);
+
+        if (!spidev->rx_buffer) {
+                spidev->rx_buffer = kmalloc(bufsiz, GFP_KERNEL);
+                if (!spidev->rx_buffer) {
+                        dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
+                        status = -ENOMEM;
+                        goto err_alloc_rx_buf;
                 }
-        } else
-                pr_debug("spidev: nothing for minor %d\n", iminor(inode));
+        }
+
+        spidev->users++;
+        filp->private_data = spidev;
+        nonseekable_open(inode, filp);
+
+        mutex_unlock(&device_list_lock);
+        return 0;
 
+err_alloc_rx_buf:
+        kfree(spidev->tx_buffer);
+        spidev->tx_buffer = NULL;
+err_find_dev:
         mutex_unlock(&device_list_lock);
         return status;
 }
@@ -542,8 +564,11 @@ static int spidev_release(struct inode *inode, struct file *filp)
         if (!spidev->users) {
                 int             dofree;
 
-                kfree(spidev->buffer);
-                spidev->buffer = NULL;
+                kfree(spidev->tx_buffer);
+                spidev->tx_buffer = NULL;
+
+                kfree(spidev->rx_buffer);
+                spidev->rx_buffer = NULL;
 
                 /* ... after we unbound from the underlying device? */
                 spin_lock_irq(&spidev->spi_lock);
diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
index 28b93d39a94e..a673ffa34aa3 100644
--- a/drivers/staging/android/logger.c
+++ b/drivers/staging/android/logger.c
@@ -420,7 +420,7 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
         struct logger_log *log = file_get_log(iocb->ki_filp);
         struct logger_entry header;
         struct timespec now;
-        size_t len, count;
+        size_t len, count, w_off;
 
         count = min_t(size_t, iocb->ki_nbytes, LOGGER_ENTRY_MAX_PAYLOAD);
 
@@ -452,11 +452,14 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
         memcpy(log->buffer + log->w_off, &header, len);
         memcpy(log->buffer, (char *)&header + len, sizeof(header) - len);
 
-        len = min(count, log->size - log->w_off);
+        /* Work with a copy until we are ready to commit the whole entry */
+        w_off =  logger_offset(log, log->w_off + sizeof(struct logger_entry));
 
-        if (copy_from_iter(log->buffer + log->w_off, len, from) != len) {
+        len = min(count, log->size - w_off);
+
+        if (copy_from_iter(log->buffer + w_off, len, from) != len) {
                 /*
-                 * Note that by not updating w_off, this abandons the
+                 * Note that by not updating log->w_off, this abandons the
                  * portion of the new entry that *was* successfully
                  * copied, just above.  This is intentional to avoid
                  * message corruption from missing fragments.
@@ -470,7 +473,7 @@ static ssize_t logger_write_iter(struct kiocb *iocb, struct iov_iter *from)
                 return -EFAULT;
         }
 
-        log->w_off = logger_offset(log, log->w_off + count);
+        log->w_off = logger_offset(log, w_off + count);
         mutex_unlock(&log->mutex);
 
         /* wake up any blocked readers */
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index a8bc2b567789..152f4c12ea43 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -426,6 +426,7 @@ config COMEDI_AIO_IIRO_16
 
 config COMEDI_II_PCI20KC
         tristate "Intelligent Instruments PCI-20001C carrier support"
+        depends on HAS_IOMEM
         ---help---
           Enable support for Intelligent Instruments PCI-20001C carrier
           PCI-20001, PCI-20006 and PCI-20341
@@ -667,7 +668,6 @@ config COMEDI_ADDI_APCI_2200
 config COMEDI_ADDI_APCI_3120
         tristate "ADDI-DATA APCI_3120/3001 support"
         depends on HAS_DMA
-        depends on VIRT_TO_BUS
         ---help---
           Enable support for ADDI-DATA APCI_3120/3001 cards
 
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index 495969f46e76..9c32f0276009 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1462,10 +1462,7 @@ static int __comedi_get_user_chanlist(struct comedi_device *dev,
         unsigned int *chanlist;
         int ret;
 
-        /* user_chanlist could be NULL for do_cmdtest ioctls */
-        if (!user_chanlist)
-                return 0;
-
+        cmd->chanlist = NULL;
         chanlist = memdup_user(user_chanlist,
                                cmd->chanlist_len * sizeof(unsigned int));
         if (IS_ERR(chanlist))
@@ -1609,13 +1606,18 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
 
         s = &dev->subdevices[cmd.subdev];
 
-        /* load channel/gain list */
-        ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
-        if (ret)
-                return ret;
+        /* user_chanlist can be NULL for COMEDI_CMDTEST ioctl */
+        if (user_chanlist) {
+                /* load channel/gain list */
+                ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
+                if (ret)
+                        return ret;
+        }
 
         ret = s->do_cmdtest(dev, s, &cmd);
 
+        kfree(cmd.chanlist);    /* free kernel copy of user chanlist */
+
         /* restore chanlist pointer before copying back */
         cmd.chanlist = (unsigned int __force *)user_chanlist;
 
@@ -1642,7 +1644,7 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
 
 */
 
-static int do_lock_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_lock_ioctl(struct comedi_device *dev, unsigned long arg,
                          void *file)
 {
         int ret = 0;
@@ -1679,7 +1681,7 @@ static int do_lock_ioctl(struct comedi_device *dev, unsigned int arg,
         This function isn't protected by the semaphore, since
         we already own the lock.
 */
-static int do_unlock_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_unlock_ioctl(struct comedi_device *dev, unsigned long arg,
                            void *file)
 {
         struct comedi_subdevice *s;
@@ -1714,7 +1716,7 @@ static int do_unlock_ioctl(struct comedi_device *dev, unsigned int arg,
                 nothing
 
 */
-static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_cancel_ioctl(struct comedi_device *dev, unsigned long arg,
                            void *file)
 {
         struct comedi_subdevice *s;
@@ -1751,7 +1753,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
                 nothing
 
 */
-static int do_poll_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_poll_ioctl(struct comedi_device *dev, unsigned long arg,
                          void *file)
 {
         struct comedi_subdevice *s;
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index 32a19264a170..2a29b9baec0d 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -1559,14 +1559,16 @@ static int mxs_lradc_probe(struct platform_device *pdev)
         /* Grab all IRQ sources */
         for (i = 0; i < of_cfg->irq_count; i++) {
                 lradc->irq[i] = platform_get_irq(pdev, i);
-                if (lradc->irq[i] < 0)
-                        return lradc->irq[i];
+                if (lradc->irq[i] < 0) {
+                        ret = lradc->irq[i];
+                        goto err_clk;
+                }
 
                 ret = devm_request_irq(dev, lradc->irq[i],
                                         mxs_lradc_handle_irq, 0,
                                         of_cfg->irq_name[i], iio);
                 if (ret)
-                        return ret;
+                        goto err_clk;
         }
 
         lradc->vref_mv = of_cfg->vref_mv;
@@ -1588,7 +1590,7 @@ static int mxs_lradc_probe(struct platform_device *pdev)
                                 &mxs_lradc_trigger_handler,
                                 &mxs_lradc_buffer_ops);
         if (ret)
-                return ret;
+                goto err_clk;
 
         ret = mxs_lradc_trigger_init(iio);
         if (ret)
@@ -1643,6 +1645,8 @@ err_dev:
         mxs_lradc_trigger_remove(iio);
 err_trig:
         iio_triggered_buffer_cleanup(iio);
+err_clk:
+        clk_disable_unprepare(lradc->clk);
         return ret;
 }
 
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index d0c89d0457de..b6bd609c3655 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -115,6 +115,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .channel = 0,
                 .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),
                 .address = AD5933_REG_TEMP_DATA,
+                .scan_index = -1,
                 .scan_type = {
                         .sign = 's',
                         .realbits = 14,
@@ -124,9 +125,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "real_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
-                BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "real",
                 .address = AD5933_REG_REAL_DATA,
                 .scan_index = 0,
                 .scan_type = {
@@ -138,9 +137,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "imag_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
-                BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "imag",
                 .address = AD5933_REG_IMAG_DATA,
                 .scan_index = 1,
                 .scan_type = {
@@ -749,14 +746,14 @@ static int ad5933_probe(struct i2c_client *client,
         indio_dev->name = id->name;
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->channels = ad5933_channels;
-        indio_dev->num_channels = 1; /* only register temp0_input */
+        indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
 
         ret = ad5933_register_ring_funcs_and_init(indio_dev);
         if (ret)
                 goto error_disable_reg;
 
-        /* skip temp0_input, register in0_(real|imag)_raw */
-        ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2);
+        ret = iio_buffer_register(indio_dev, ad5933_channels,
+                ARRAY_SIZE(ad5933_channels));
         if (ret)
                 goto error_unreg_ring;
 
diff --git a/drivers/staging/iio/meter/ade7758.h b/drivers/staging/iio/meter/ade7758.h
index 07318203a836..e8c98cf57070 100644
--- a/drivers/staging/iio/meter/ade7758.h
+++ b/drivers/staging/iio/meter/ade7758.h
@@ -119,7 +119,6 @@ struct ade7758_state {
         u8                      *tx;
         u8                      *rx;
         struct mutex            buf_lock;
-        const struct iio_chan_spec *ade7758_ring_channels;
         struct spi_transfer     ring_xfer[4];
         struct spi_message      ring_msg;
         /*
diff --git a/drivers/staging/iio/meter/ade7758_core.c b/drivers/staging/iio/meter/ade7758_core.c
index abc60067cd72..fb373b89dcc2 100644
--- a/drivers/staging/iio/meter/ade7758_core.c
+++ b/drivers/staging/iio/meter/ade7758_core.c
@@ -634,9 +634,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE),
                 .scan_index = 0,
                 .scan_type = {
@@ -648,9 +645,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT),
                 .scan_index = 1,
                 .scan_type = {
@@ -662,9 +656,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR),
                 .scan_index = 2,
                 .scan_type = {
@@ -676,9 +668,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR),
                 .scan_index = 3,
                 .scan_type = {
@@ -690,9 +680,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR),
                 .scan_index = 4,
                 .scan_type = {
@@ -704,9 +692,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE),
                 .scan_index = 5,
                 .scan_type = {
@@ -718,9 +703,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT),
                 .scan_index = 6,
                 .scan_type = {
@@ -732,9 +714,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR),
                 .scan_index = 7,
                 .scan_type = {
@@ -746,9 +726,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR),
                 .scan_index = 8,
                 .scan_type = {
@@ -760,9 +738,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR),
                 .scan_index = 9,
                 .scan_type = {
@@ -774,9 +750,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE),
                 .scan_index = 10,
                 .scan_type = {
@@ -788,9 +761,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT),
                 .scan_index = 11,
                 .scan_type = {
@@ -802,9 +772,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR),
                 .scan_index = 12,
                 .scan_type = {
@@ -816,9 +784,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR),
                 .scan_index = 13,
                 .scan_type = {
@@ -830,9 +796,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR),
                 .scan_index = 14,
                 .scan_type = {
@@ -873,13 +837,14 @@ static int ade7758_probe(struct spi_device *spi)
                 goto error_free_rx;
         }
         st->us = spi;
-        st->ade7758_ring_channels = &ade7758_channels[0];
         mutex_init(&st->buf_lock);
 
         indio_dev->name = spi->dev.driver->name;
         indio_dev->dev.parent = &spi->dev;
         indio_dev->info = &ade7758_info;
         indio_dev->modes = INDIO_DIRECT_MODE;
+        indio_dev->channels = ade7758_channels;
+        indio_dev->num_channels = ARRAY_SIZE(ade7758_channels);
 
         ret = ade7758_configure_ring(indio_dev);
         if (ret)
diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c
index c0accf8cce93..6e9006490742 100644
--- a/drivers/staging/iio/meter/ade7758_ring.c
+++ b/drivers/staging/iio/meter/ade7758_ring.c
@@ -85,17 +85,16 @@ static irqreturn_t ade7758_trigger_handler(int irq, void *p)
  **/
 static int ade7758_ring_preenable(struct iio_dev *indio_dev)
 {
-        struct ade7758_state *st = iio_priv(indio_dev);
         unsigned channel;
 
-        if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength))
+        if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength))
                 return -EINVAL;
 
         channel = find_first_bit(indio_dev->active_scan_mask,
                                  indio_dev->masklength);
 
         ade7758_write_waveform_type(&indio_dev->dev,
-                st->ade7758_ring_channels[channel].address);
+                indio_dev->channels[channel].address);
 
         return 0;
 }
diff --git a/drivers/staging/rtl8188eu/core/rtw_cmd.c b/drivers/staging/rtl8188eu/core/rtw_cmd.c
index 9935e66935af..eddef9cd2e16 100644
--- a/drivers/staging/rtl8188eu/core/rtw_cmd.c
+++ b/drivers/staging/rtl8188eu/core/rtw_cmd.c
@@ -275,11 +275,11 @@ u8 rtw_sitesurvey_cmd(struct adapter  *padapter, struct ndis_802_11_ssid *ssid,
         if (check_fwstate(pmlmepriv, _FW_LINKED) == true)
                 rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SCAN, 1);
 
-        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (ph2c == NULL)
                 return _FAIL;
 
-        psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_KERNEL);
+        psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
         if (psurveyPara == NULL) {
                 kfree(ph2c);
                 return _FAIL;
@@ -405,7 +405,7 @@ u8 rtw_joinbss_cmd(struct adapter  *padapter, struct wlan_network *pnetwork)
         else
                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+Join cmd: SSid =[%s]\n", pmlmepriv->assoc_ssid.Ssid));
 
-        pcmd = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        pcmd = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (pcmd == NULL) {
                 res = _FAIL;
                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("rtw_joinbss_cmd: memory allocate for cmd_obj fail!!!\n"));
@@ -755,13 +755,13 @@ u8 rtw_dynamic_chk_wk_cmd(struct adapter *padapter)
         u8      res = _SUCCESS;
 
 
-        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (ph2c == NULL) {
                 res = _FAIL;
                 goto exit;
         }
 
-        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
+        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
         if (pdrvextra_cmd_parm == NULL) {
                 kfree(ph2c);
                 res = _FAIL;
@@ -967,13 +967,13 @@ u8 rtw_lps_ctrl_wk_cmd(struct adapter *padapter, u8 lps_ctrl_type, u8 enqueue)
         u8      res = _SUCCESS;
 
         if (enqueue) {
-                ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+                ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
                 if (ph2c == NULL) {
                         res = _FAIL;
                         goto exit;
                 }
 
-                pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
+                pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
                 if (pdrvextra_cmd_parm == NULL) {
                         kfree(ph2c);
                         res = _FAIL;
@@ -1010,13 +1010,13 @@ u8 rtw_rpt_timer_cfg_cmd(struct adapter *padapter, u16 min_time)
 
         u8      res = _SUCCESS;
 
-        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (ph2c == NULL) {
                 res = _FAIL;
                 goto exit;
         }
 
-        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
+        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
         if (pdrvextra_cmd_parm == NULL) {
                 kfree(ph2c);
                 res = _FAIL;
@@ -1088,13 +1088,13 @@ u8 rtw_ps_cmd(struct adapter *padapter)
 
         u8      res = _SUCCESS;
 
-        ppscmd = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        ppscmd = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (ppscmd == NULL) {
                 res = _FAIL;
                 goto exit;
         }
 
-        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_KERNEL);
+        pdrvextra_cmd_parm = kzalloc(sizeof(struct drvextra_cmd_parm), GFP_ATOMIC);
         if (pdrvextra_cmd_parm == NULL) {
                 kfree(ppscmd);
                 res = _FAIL;
diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
index 5ba5099ec20d..70b1bc3e0e63 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mlme_ext.c
@@ -4241,12 +4241,12 @@ void report_survey_event(struct adapter *padapter,
         pcmdpriv = &padapter->cmdpriv;
 
 
-        pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (pcmd_obj == NULL)
                 return;
 
         cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
-        pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
+        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
         if (pevtcmd == NULL) {
                 kfree(pcmd_obj);
                 return;
@@ -4339,12 +4339,12 @@ void report_join_res(struct adapter *padapter, int res)
         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
 
-        pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+        pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
         if (pcmd_obj == NULL)
                 return;
 
         cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
-        pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
+        pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
         if (pevtcmd == NULL) {
                 kfree(pcmd_obj);
                 return;
@@ -4854,11 +4854,11 @@ void survey_timer_hdl(void *function_context)
                         pmlmeext->scan_abort = false;/* reset */
                 }
 
-                ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
+                ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
                 if (ph2c == NULL)
                         goto exit_survey_timer_hdl;
 
-                psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_KERNEL);
+                psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
                 if (psurveyPara == NULL) {
                         kfree(ph2c);
                         goto exit_survey_timer_hdl;
diff --git a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
index 33ccbbbd8ed6..d300369977fa 100644
--- a/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8188eu/core/rtw_wlan_util.c
@@ -935,7 +935,7 @@ int rtw_check_bcn_info(struct adapter  *Adapter, u8 *pframe, u32 packet_len)
                 return true;
         }
 
-        bssid = kzalloc(sizeof(struct wlan_bssid_ex), GFP_KERNEL);
+        bssid = kzalloc(sizeof(struct wlan_bssid_ex), GFP_ATOMIC);
 
         subtype = GetFrameSubType(pframe) >> 4;
 
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 407a318b09db..2f87150a21b7 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -47,6 +47,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
         {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+        {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
         {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
         {}      /* Terminating entry */
 };
diff --git a/drivers/staging/rtl8723au/include/rtw_eeprom.h b/drivers/staging/rtl8723au/include/rtw_eeprom.h
index e5121a2a64b4..a86f36e49dd1 100644
--- a/drivers/staging/rtl8723au/include/rtw_eeprom.h
+++ b/drivers/staging/rtl8723au/include/rtw_eeprom.h
@@ -107,12 +107,12 @@ enum rt_customer_id
 };
 
 struct eeprom_priv {
+        u8              mac_addr[6];    /* PermanentAddress */
         u8              bautoload_fail_flag;
         u8              bloadfile_fail_flag;
         u8              bloadmac_fail_flag;
         /* u8           bempty; */
         /* u8           sys_config; */
-        u8              mac_addr[6];    /* PermanentAddress */
         /* u8           config0; */
         u16             channel_plan;
         /* u8           country_string[3]; */
diff --git a/drivers/target/Kconfig b/drivers/target/Kconfig
index dc2d84ac5a0e..81d44c477a5b 100644
--- a/drivers/target/Kconfig
+++ b/drivers/target/Kconfig
@@ -31,6 +31,13 @@ config TCM_PSCSI
         Say Y here to enable the TCM/pSCSI subsystem plugin for non-buffered
         passthrough access to Linux/SCSI device
 
+config TCM_USER
+        tristate "TCM/USER Subsystem Plugin for Linux"
+        depends on UIO && NET
+        help
+        Say Y here to enable the TCM/USER subsystem plugin for a userspace
+        process to handle requests
+
 source "drivers/target/loopback/Kconfig"
 source "drivers/target/tcm_fc/Kconfig"
 source "drivers/target/iscsi/Kconfig"
diff --git a/drivers/target/Makefile b/drivers/target/Makefile
index 85b012d2f89b..bbb4a7d638ef 100644
--- a/drivers/target/Makefile
+++ b/drivers/target/Makefile
@@ -22,6 +22,7 @@ obj-$(CONFIG_TARGET_CORE)	+= target_core_mod.o
 obj-$(CONFIG_TCM_IBLOCK)        += target_core_iblock.o
 obj-$(CONFIG_TCM_FILEIO)        += target_core_file.o
 obj-$(CONFIG_TCM_PSCSI)         += target_core_pscsi.o
+obj-$(CONFIG_TCM_USER)          += target_core_user.o
 
 # Fabric modules
 obj-$(CONFIG_LOOPBACK_TARGET)   += loopback/
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 260c3e1e312c..73e58d22e325 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -3491,7 +3491,7 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
                                 len = sprintf(buf, "TargetAddress="
                                         "%s:%hu,%hu",
                                         inaddr_any ? conn->local_ip : np->np_ip,
-                                        inaddr_any ? conn->local_port : np->np_port,
+                                        np->np_port,
                                         tpg->tpgt);
                                 len += 1;
 
@@ -3709,7 +3709,6 @@ static inline void iscsit_thread_check_cpumask(
         struct task_struct *p,
         int mode)
 {
-        char buf[128];
         /*
          * mode == 1 signals iscsi_target_tx_thread() usage.
          * mode == 0 signals iscsi_target_rx_thread() usage.
@@ -3728,8 +3727,6 @@ static inline void iscsit_thread_check_cpumask(
          * both TX and RX kthreads are scheduled to run on the
          * same CPU.
          */
-        memset(buf, 0, 128);
-        cpumask_scnprintf(buf, 128, conn->conn_cpumask);
         set_cpus_allowed_ptr(p, conn->conn_cpumask);
 }
 
@@ -4326,8 +4323,7 @@ int iscsit_close_connection(
         if (conn->conn_tx_hash.tfm)
                 crypto_free_hash(conn->conn_tx_hash.tfm);
 
-        if (conn->conn_cpumask)
-                free_cpumask_var(conn->conn_cpumask);
+        free_cpumask_var(conn->conn_cpumask);
 
         kfree(conn->conn_ops);
         conn->conn_ops = NULL;
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index ae03f3e5de1e..9059c1e0b26e 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -669,12 +669,10 @@ static ssize_t lio_target_nacl_show_info(
         } else {
                 sess = se_sess->fabric_sess_ptr;
 
-                if (sess->sess_ops->InitiatorName)
-                        rb += sprintf(page+rb, "InitiatorName: %s\n",
-                                sess->sess_ops->InitiatorName);
-                if (sess->sess_ops->InitiatorAlias)
-                        rb += sprintf(page+rb, "InitiatorAlias: %s\n",
-                                sess->sess_ops->InitiatorAlias);
+                rb += sprintf(page+rb, "InitiatorName: %s\n",
+                        sess->sess_ops->InitiatorName);
+                rb += sprintf(page+rb, "InitiatorAlias: %s\n",
+                        sess->sess_ops->InitiatorAlias);
 
                 rb += sprintf(page+rb, "LIO Session ID: %u   "
                         "ISID: 0x%02x %02x %02x %02x %02x %02x  "
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 0d1e6ee3e992..a0ae5fc0ad75 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -345,7 +345,6 @@ static int iscsit_dataout_check_datasn(
         struct iscsi_cmd *cmd,
         unsigned char *buf)
 {
-        int dump = 0, recovery = 0;
         u32 data_sn = 0;
         struct iscsi_conn *conn = cmd->conn;
         struct iscsi_data *hdr = (struct iscsi_data *) buf;
@@ -370,13 +369,11 @@ static int iscsit_dataout_check_datasn(
                 pr_err("Command ITT: 0x%08x, received DataSN: 0x%08x"
                         " higher than expected 0x%08x.\n", cmd->init_task_tag,
                                 be32_to_cpu(hdr->datasn), data_sn);
-                recovery = 1;
                 goto recover;
         } else if (be32_to_cpu(hdr->datasn) < data_sn) {
                 pr_err("Command ITT: 0x%08x, received DataSN: 0x%08x"
                         " lower than expected 0x%08x, discarding payload.\n",
                         cmd->init_task_tag, be32_to_cpu(hdr->datasn), data_sn);
-                dump = 1;
                 goto dump;
         }
 
@@ -392,8 +389,7 @@ dump:
         if (iscsit_dump_data_payload(conn, payload_length, 1) < 0)
                 return DATAOUT_CANNOT_RECOVER;
 
-        return (recovery || dump) ? DATAOUT_WITHIN_COMMAND_RECOVERY :
-                                DATAOUT_NORMAL;
+        return DATAOUT_WITHIN_COMMAND_RECOVERY;
 }
 
 static int iscsit_dataout_pre_datapduinorder_yes(
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 5e71ac609418..480f2e0ecc11 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -978,8 +978,7 @@ int iscsit_setup_np(
         return 0;
 fail:
         np->np_socket = NULL;
-        if (sock)
-                sock_release(sock);
+        sock_release(sock);
         return ret;
 }
 
@@ -1190,8 +1189,7 @@ old_sess_out:
         if (!IS_ERR(conn->conn_tx_hash.tfm))
                 crypto_free_hash(conn->conn_tx_hash.tfm);
 
-        if (conn->conn_cpumask)
-                free_cpumask_var(conn->conn_cpumask);
+        free_cpumask_var(conn->conn_cpumask);
 
         kfree(conn->conn_ops);
 
@@ -1268,8 +1266,6 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                         iscsit_put_transport(conn->conn_transport);
                         kfree(conn);
                         conn = NULL;
-                        if (ret == -ENODEV)
-                                goto out;
                         /* Get another socket */
                         return 1;
                 }
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 73355f4fca74..ce87ce9bdb9c 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -1481,8 +1481,9 @@ void iscsit_collect_login_stats(
                 if (conn->param_list)
                         intrname = iscsi_find_param_from_key(INITIATORNAME,
                                                              conn->param_list);
-                strcpy(ls->last_intr_fail_name,
-                       (intrname ? intrname->value : "Unknown"));
+                strlcpy(ls->last_intr_fail_name,
+                       (intrname ? intrname->value : "Unknown"),
+                       sizeof(ls->last_intr_fail_name));
 
                 ls->last_intr_fail_ip_family = conn->login_family;
 
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 340de9d92b15..ab3ab27d49b7 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -153,18 +153,11 @@ static int tcm_loop_change_queue_type(struct scsi_device *sdev, int tag)
 /*
  * Locate the SAM Task Attr from struct scsi_cmnd *
  */
-static int tcm_loop_sam_attr(struct scsi_cmnd *sc)
-{
-        if (sc->device->tagged_supported) {
-                switch (sc->tag) {
-                case HEAD_OF_QUEUE_TAG:
-                        return MSG_HEAD_TAG;
-                case ORDERED_QUEUE_TAG:
-                        return MSG_ORDERED_TAG;
-                default:
-                        break;
-                }
-        }
+static int tcm_loop_sam_attr(struct scsi_cmnd *sc, int tag)
+{
+        if (sc->device->tagged_supported &&
+            sc->device->ordered_tags && tag >= 0)
+                return MSG_ORDERED_TAG;
 
         return MSG_SIMPLE_TAG;
 }
@@ -227,7 +220,7 @@ static void tcm_loop_submission_work(struct work_struct *work)
 
         rc = target_submit_cmd_map_sgls(se_cmd, tl_nexus->se_sess, sc->cmnd,
                         &tl_cmd->tl_sense_buf[0], tl_cmd->sc->device->lun,
-                        transfer_length, tcm_loop_sam_attr(sc),
+                        transfer_length, tcm_loop_sam_attr(sc, tl_cmd->sc_cmd_tag),
                         sc->sc_data_direction, 0,
                         scsi_sglist(sc), scsi_sg_count(sc),
                         sgl_bidi, sgl_bidi_count,
@@ -266,7 +259,7 @@ static int tcm_loop_queuecommand(struct Scsi_Host *sh, struct scsi_cmnd *sc)
         }
 
         tl_cmd->sc = sc;
-        tl_cmd->sc_cmd_tag = sc->tag;
+        tl_cmd->sc_cmd_tag = sc->request->tag;
         INIT_WORK(&tl_cmd->work, tcm_loop_submission_work);
         queue_work(tcm_loop_workqueue, &tl_cmd->work);
         return 0;
@@ -370,7 +363,7 @@ static int tcm_loop_abort_task(struct scsi_cmnd *sc)
          */
         tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
         ret = tcm_loop_issue_tmr(tl_tpg, tl_nexus, sc->device->lun,
-                                 sc->tag, TMR_ABORT_TASK);
+                                 sc->request->tag, TMR_ABORT_TASK);
         return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
 }
 
@@ -960,8 +953,7 @@ static int tcm_loop_port_link(
                                 struct tcm_loop_tpg, tl_se_tpg);
         struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;
 
-        atomic_inc(&tl_tpg->tl_tpg_port_count);
-        smp_mb__after_atomic();
+        atomic_inc_mb(&tl_tpg->tl_tpg_port_count);
         /*
          * Add Linux/SCSI struct scsi_device by HCTL
          */
@@ -995,8 +987,7 @@ static void tcm_loop_port_unlink(
         scsi_remove_device(sd);
         scsi_device_put(sd);
 
-        atomic_dec(&tl_tpg->tl_tpg_port_count);
-        smp_mb__after_atomic();
+        atomic_dec_mb(&tl_tpg->tl_tpg_port_count);
 
         pr_debug("TCM_Loop_ConfigFS: Port Unlink Successful\n");
 }
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index fbc5ebb5f761..fb87780929d2 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -392,8 +392,7 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
                                 if (tg_pt_id != tg_pt_gp->tg_pt_gp_id)
                                         continue;
 
-                                atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt);
-                                smp_mb__after_atomic();
+                                atomic_inc_mb(&tg_pt_gp->tg_pt_gp_ref_cnt);
 
                                 spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
@@ -403,8 +402,7 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
                                         found = true;
 
                                 spin_lock(&dev->t10_alua.tg_pt_gps_lock);
-                                atomic_dec(&tg_pt_gp->tg_pt_gp_ref_cnt);
-                                smp_mb__after_atomic();
+                                atomic_dec_mb(&tg_pt_gp->tg_pt_gp_ref_cnt);
                                 break;
                         }
                         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
@@ -998,8 +996,7 @@ static void core_alua_do_transition_tg_pt_work(struct work_struct *work)
                  * every I_T nexus other than the I_T nexus on which the SET
                  * TARGET PORT GROUPS command
                  */
-                atomic_inc(&mem->tg_pt_gp_mem_ref_cnt);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&mem->tg_pt_gp_mem_ref_cnt);
                 spin_unlock(&tg_pt_gp->tg_pt_gp_lock);
 
                 spin_lock_bh(&port->sep_alua_lock);
@@ -1028,8 +1025,7 @@ static void core_alua_do_transition_tg_pt_work(struct work_struct *work)
                 spin_unlock_bh(&port->sep_alua_lock);
 
                 spin_lock(&tg_pt_gp->tg_pt_gp_lock);
-                atomic_dec(&mem->tg_pt_gp_mem_ref_cnt);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&mem->tg_pt_gp_mem_ref_cnt);
         }
         spin_unlock(&tg_pt_gp->tg_pt_gp_lock);
         /*
@@ -1063,7 +1059,6 @@ static void core_alua_do_transition_tg_pt_work(struct work_struct *work)
                 core_alua_dump_state(tg_pt_gp->tg_pt_gp_alua_pending_state));
         spin_lock(&dev->t10_alua.tg_pt_gps_lock);
         atomic_dec(&tg_pt_gp->tg_pt_gp_ref_cnt);
-        smp_mb__after_atomic();
         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
         if (tg_pt_gp->tg_pt_gp_transition_complete)
@@ -1125,7 +1120,6 @@ static int core_alua_do_transition_tg_pt(
          */
         spin_lock(&dev->t10_alua.tg_pt_gps_lock);
         atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt);
-        smp_mb__after_atomic();
         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
         if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs) {
@@ -1168,7 +1162,6 @@ int core_alua_do_port_transition(
         spin_lock(&local_lu_gp_mem->lu_gp_mem_lock);
         lu_gp = local_lu_gp_mem->lu_gp;
         atomic_inc(&lu_gp->lu_gp_ref_cnt);
-        smp_mb__after_atomic();
         spin_unlock(&local_lu_gp_mem->lu_gp_mem_lock);
         /*
          * For storage objects that are members of the 'default_lu_gp',
@@ -1184,8 +1177,7 @@ int core_alua_do_port_transition(
                 l_tg_pt_gp->tg_pt_gp_alua_nacl = l_nacl;
                 rc = core_alua_do_transition_tg_pt(l_tg_pt_gp,
                                                    new_state, explicit);
-                atomic_dec(&lu_gp->lu_gp_ref_cnt);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&lu_gp->lu_gp_ref_cnt);
                 return rc;
         }
         /*
@@ -1198,8 +1190,7 @@ int core_alua_do_port_transition(
                                 lu_gp_mem_list) {
 
                 dev = lu_gp_mem->lu_gp_mem_dev;
-                atomic_inc(&lu_gp_mem->lu_gp_mem_ref_cnt);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&lu_gp_mem->lu_gp_mem_ref_cnt);
                 spin_unlock(&lu_gp->lu_gp_lock);
 
                 spin_lock(&dev->t10_alua.tg_pt_gps_lock);
@@ -1227,8 +1218,7 @@ int core_alua_do_port_transition(
                                 tg_pt_gp->tg_pt_gp_alua_port = NULL;
                                 tg_pt_gp->tg_pt_gp_alua_nacl = NULL;
                         }
-                        atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt);
-                        smp_mb__after_atomic();
+                        atomic_inc_mb(&tg_pt_gp->tg_pt_gp_ref_cnt);
                         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
                         /*
                          * core_alua_do_transition_tg_pt() will always return
@@ -1238,16 +1228,14 @@ int core_alua_do_port_transition(
                                         new_state, explicit);
 
                         spin_lock(&dev->t10_alua.tg_pt_gps_lock);
-                        atomic_dec(&tg_pt_gp->tg_pt_gp_ref_cnt);
-                        smp_mb__after_atomic();
+                        atomic_dec_mb(&tg_pt_gp->tg_pt_gp_ref_cnt);
                         if (rc)
                                 break;
                 }
                 spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
                 spin_lock(&lu_gp->lu_gp_lock);
-                atomic_dec(&lu_gp_mem->lu_gp_mem_ref_cnt);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&lu_gp_mem->lu_gp_mem_ref_cnt);
         }
         spin_unlock(&lu_gp->lu_gp_lock);
 
@@ -1260,8 +1248,7 @@ int core_alua_do_port_transition(
                          core_alua_dump_state(new_state));
         }
 
-        atomic_dec(&lu_gp->lu_gp_ref_cnt);
-        smp_mb__after_atomic();
+        atomic_dec_mb(&lu_gp->lu_gp_ref_cnt);
         return rc;
 }
 
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 756def38c77a..79f9296a08ae 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -665,6 +665,9 @@ SE_DEV_ATTR(is_nonrot, S_IRUGO | S_IWUSR);
 DEF_DEV_ATTRIB(emulate_rest_reord);
 SE_DEV_ATTR(emulate_rest_reord, S_IRUGO | S_IWUSR);
 
+DEF_DEV_ATTRIB(force_pr_aptpl);
+SE_DEV_ATTR(force_pr_aptpl, S_IRUGO | S_IWUSR);
+
 DEF_DEV_ATTRIB_RO(hw_block_size);
 SE_DEV_ATTR_RO(hw_block_size);
 
@@ -719,6 +722,7 @@ static struct configfs_attribute *target_core_dev_attrib_attrs[] = {
         &target_core_dev_attrib_hw_pi_prot_type.attr,
         &target_core_dev_attrib_pi_prot_format.attr,
         &target_core_dev_attrib_enforce_pr_isids.attr,
+        &target_core_dev_attrib_force_pr_aptpl.attr,
         &target_core_dev_attrib_is_nonrot.attr,
         &target_core_dev_attrib_emulate_rest_reord.attr,
         &target_core_dev_attrib_hw_block_size.attr,
@@ -1263,7 +1267,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
 {
         unsigned char *i_fabric = NULL, *i_port = NULL, *isid = NULL;
         unsigned char *t_fabric = NULL, *t_port = NULL;
-        char *orig, *ptr, *arg_p, *opts;
+        char *orig, *ptr, *opts;
         substring_t args[MAX_OPT_ARGS];
         unsigned long long tmp_ll;
         u64 sa_res_key = 0;
@@ -1295,14 +1299,14 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                 token = match_token(ptr, tokens, args);
                 switch (token) {
                 case Opt_initiator_fabric:
-                        i_fabric = match_strdup(&args[0]);
+                        i_fabric = match_strdup(args);
                         if (!i_fabric) {
                                 ret = -ENOMEM;
                                 goto out;
                         }
                         break;
                 case Opt_initiator_node:
-                        i_port = match_strdup(&args[0]);
+                        i_port = match_strdup(args);
                         if (!i_port) {
                                 ret = -ENOMEM;
                                 goto out;
@@ -1316,7 +1320,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                         }
                         break;
                 case Opt_initiator_sid:
-                        isid = match_strdup(&args[0]);
+                        isid = match_strdup(args);
                         if (!isid) {
                                 ret = -ENOMEM;
                                 goto out;
@@ -1330,15 +1334,9 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                         }
                         break;
                 case Opt_sa_res_key:
-                        arg_p = match_strdup(&args[0]);
-                        if (!arg_p) {
-                                ret = -ENOMEM;
-                                goto out;
-                        }
-                        ret = kstrtoull(arg_p, 0, &tmp_ll);
+                        ret = kstrtoull(args->from, 0, &tmp_ll);
                         if (ret < 0) {
-                                pr_err("kstrtoull() failed for"
-                                        " sa_res_key=\n");
+                                pr_err("kstrtoull() failed for sa_res_key=\n");
                                 goto out;
                         }
                         sa_res_key = (u64)tmp_ll;
@@ -1370,14 +1368,14 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                  * PR APTPL Metadata for Target Port
                  */
                 case Opt_target_fabric:
-                        t_fabric = match_strdup(&args[0]);
+                        t_fabric = match_strdup(args);
                         if (!t_fabric) {
                                 ret = -ENOMEM;
                                 goto out;
                         }
                         break;
                 case Opt_target_node:
-                        t_port = match_strdup(&args[0]);
+                        t_port = match_strdup(args);
                         if (!t_port) {
                                 ret = -ENOMEM;
                                 goto out;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 98da90167159..c45f9e907e44 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -224,8 +224,7 @@ struct se_dev_entry *core_get_se_deve_from_rtpi(
                 if (port->sep_rtpi != rtpi)
                         continue;
 
-                atomic_inc(&deve->pr_ref_count);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&deve->pr_ref_count);
                 spin_unlock_irq(&nacl->device_list_lock);
 
                 return deve;
@@ -1019,6 +1018,23 @@ int se_dev_set_enforce_pr_isids(struct se_device *dev, int flag)
         return 0;
 }
 
+int se_dev_set_force_pr_aptpl(struct se_device *dev, int flag)
+{
+        if ((flag != 0) && (flag != 1)) {
+                printk(KERN_ERR "Illegal value %d\n", flag);
+                return -EINVAL;
+        }
+        if (dev->export_count) {
+                pr_err("dev[%p]: Unable to set force_pr_aptpl while"
+                       " export_count is %d\n", dev, dev->export_count);
+                return -EINVAL;
+        }
+
+        dev->dev_attrib.force_pr_aptpl = flag;
+        pr_debug("dev[%p]: SE Device force_pr_aptpl: %d\n", dev, flag);
+        return 0;
+}
+
 int se_dev_set_is_nonrot(struct se_device *dev, int flag)
 {
         if ((flag != 0) && (flag != 1)) {
@@ -1250,24 +1266,16 @@ struct se_lun *core_dev_add_lun(
  *
  *
  */
-int core_dev_del_lun(
+void core_dev_del_lun(
         struct se_portal_group *tpg,
-        u32 unpacked_lun)
+        struct se_lun *lun)
 {
-        struct se_lun *lun;
-
-        lun = core_tpg_pre_dellun(tpg, unpacked_lun);
-        if (IS_ERR(lun))
-                return PTR_ERR(lun);
-
-        core_tpg_post_dellun(tpg, lun);
-
-        pr_debug("%s_TPG[%u]_LUN[%u] - Deactivated %s Logical Unit from"
+        pr_debug("%s_TPG[%u]_LUN[%u] - Deactivating %s Logical Unit from"
                 " device object\n", tpg->se_tpg_tfo->get_fabric_name(),
-                tpg->se_tpg_tfo->tpg_get_tag(tpg), unpacked_lun,
+                tpg->se_tpg_tfo->tpg_get_tag(tpg), lun->unpacked_lun,
                 tpg->se_tpg_tfo->get_fabric_name());
 
-        return 0;
+        core_tpg_remove_lun(tpg, lun);
 }
 
 struct se_lun *core_get_lun_from_tpg(struct se_portal_group *tpg, u32 unpacked_lun)
@@ -1396,8 +1404,7 @@ int core_dev_add_initiator_node_lun_acl(
 
         spin_lock(&lun->lun_acl_lock);
         list_add_tail(&lacl->lacl_list, &lun->lun_acl_list);
-        atomic_inc(&lun->lun_acl_count);
-        smp_mb__after_atomic();
+        atomic_inc_mb(&lun->lun_acl_count);
         spin_unlock(&lun->lun_acl_lock);
 
         pr_debug("%s_TPG[%hu]_LUN[%u->%u] - Added %s ACL for "
@@ -1409,7 +1416,8 @@ int core_dev_add_initiator_node_lun_acl(
          * Check to see if there are any existing persistent reservation APTPL
          * pre-registrations that need to be enabled for this LUN ACL..
          */
-        core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, lacl);
+        core_scsi3_check_aptpl_registration(lun->lun_se_dev, tpg, lun, nacl,
+                                            lacl->mapped_lun);
         return 0;
 }
 
@@ -1430,8 +1438,7 @@ int core_dev_del_initiator_node_lun_acl(
 
         spin_lock(&lun->lun_acl_lock);
         list_del(&lacl->lacl_list);
-        atomic_dec(&lun->lun_acl_count);
-        smp_mb__after_atomic();
+        atomic_dec_mb(&lun->lun_acl_count);
         spin_unlock(&lun->lun_acl_lock);
 
         core_disable_device_list_for_node(lun, NULL, lacl->mapped_lun,
@@ -1554,6 +1561,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
         dev->dev_attrib.emulate_3pc = DA_EMULATE_3PC;
         dev->dev_attrib.pi_prot_type = TARGET_DIF_TYPE0_PROT;
         dev->dev_attrib.enforce_pr_isids = DA_ENFORCE_PR_ISIDS;
+        dev->dev_attrib.force_pr_aptpl = DA_FORCE_PR_APTPL;
         dev->dev_attrib.is_nonrot = DA_IS_NONROT;
         dev->dev_attrib.emulate_rest_reord = DA_EMULATE_REST_REORD;
         dev->dev_attrib.max_unmap_lba_count = DA_MAX_UNMAP_LBA_COUNT;
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index 7de9f0475d05..0c3f90130b7d 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -320,7 +320,7 @@ static struct config_group *target_fabric_make_mappedlun(
                         struct se_node_acl, acl_group);
         struct se_portal_group *se_tpg = se_nacl->se_tpg;
         struct target_fabric_configfs *tf = se_tpg->se_tpg_wwn->wwn_tf;
-        struct se_lun_acl *lacl;
+        struct se_lun_acl *lacl = NULL;
         struct config_item *acl_ci;
         struct config_group *lacl_cg = NULL, *ml_stat_grp = NULL;
         char *buf;
@@ -406,6 +406,7 @@ static struct config_group *target_fabric_make_mappedlun(
 out:
         if (lacl_cg)
                 kfree(lacl_cg->default_groups);
+        kfree(lacl);
         kfree(buf);
         return ERR_PTR(ret);
 }
@@ -821,7 +822,7 @@ static int target_fabric_port_unlink(
                 tf->tf_ops.fabric_pre_unlink(se_tpg, lun);
         }
 
-        core_dev_del_lun(se_tpg, lun->unpacked_lun);
+        core_dev_del_lun(se_tpg, lun);
         return 0;
 }
 
@@ -910,16 +911,12 @@ static struct config_group *target_fabric_make_lun(
                                 GFP_KERNEL);
         if (!port_stat_grp->default_groups) {
                 pr_err("Unable to allocate port_stat_grp->default_groups\n");
-                errno = -ENOMEM;
-                goto out;
+                kfree(lun_cg->default_groups);
+                return ERR_PTR(-ENOMEM);
         }
         target_stat_setup_port_default_groups(lun);
 
         return &lun->lun_group;
-out:
-        if (lun_cg)
-                kfree(lun_cg->default_groups);
-        return ERR_PTR(errno);
 }
 
 static void target_fabric_drop_lun(
diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c
index 0d1cf8b4f49f..35bfe77160d8 100644
--- a/drivers/target/target_core_fabric_lib.c
+++ b/drivers/target/target_core_fabric_lib.c
@@ -394,9 +394,9 @@ char *iscsi_parse_pr_out_transport_id(
          * If the caller wants the TransportID Length, we set that value for the
          * entire iSCSI Tarnsport ID now.
          */
-         if (out_tid_len != NULL) {
-                add_len = ((buf[2] >> 8) & 0xff);
-                add_len |= (buf[3] & 0xff);
+        if (out_tid_len) {
+                /* The shift works thanks to integer promotion rules */
+                add_len = (buf[2] << 8) | buf[3];
 
                 tid_len = strlen(&buf[4]);
                 tid_len += 4; /* Add four bytes for iSCSI Transport ID header */
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 7d6cddaec525..72c83d98662b 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -415,7 +415,7 @@ fd_execute_sync_cache(struct se_cmd *cmd)
         } else {
                 start = cmd->t_task_lba * dev->dev_attrib.block_size;
                 if (cmd->data_length)
-                        end = start + cmd->data_length;
+                        end = start + cmd->data_length - 1;
                 else
                         end = LLONG_MAX;
         }
@@ -680,7 +680,12 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                         struct fd_dev *fd_dev = FD_DEV(dev);
                         loff_t start = cmd->t_task_lba *
                                 dev->dev_attrib.block_size;
-                        loff_t end = start + cmd->data_length;
+                        loff_t end;
+
+                        if (cmd->data_length)
+                                end = start + cmd->data_length - 1;
+                        else
+                                end = LLONG_MAX;
 
                         vfs_fsync_range(fd_dev->fd_file, start, end, 1);
                 }
@@ -762,7 +767,9 @@ static ssize_t fd_set_configfs_dev_params(struct se_device *dev,
                         fd_dev->fbd_flags |= FBDF_HAS_SIZE;
                         break;
                 case Opt_fd_buffered_io:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         if (arg != 1) {
                                 pr_err("bogus fd_buffered_io=%d value\n", arg);
                                 ret = -EINVAL;
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index de9cab708f45..e31f42f369ff 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -38,6 +38,7 @@ int	se_dev_set_emulate_3pc(struct se_device *, int);
 int     se_dev_set_pi_prot_type(struct se_device *, int);
 int     se_dev_set_pi_prot_format(struct se_device *, int);
 int     se_dev_set_enforce_pr_isids(struct se_device *, int);
+int     se_dev_set_force_pr_aptpl(struct se_device *, int);
 int     se_dev_set_is_nonrot(struct se_device *, int);
 int     se_dev_set_emulate_rest_reord(struct se_device *dev, int);
 int     se_dev_set_queue_depth(struct se_device *, u32);
@@ -46,7 +47,7 @@ int	se_dev_set_fabric_max_sectors(struct se_device *, u32);
 int     se_dev_set_optimal_sectors(struct se_device *, u32);
 int     se_dev_set_block_size(struct se_device *, u32);
 struct se_lun *core_dev_add_lun(struct se_portal_group *, struct se_device *, u32);
-int     core_dev_del_lun(struct se_portal_group *, u32);
+void    core_dev_del_lun(struct se_portal_group *, struct se_lun *);
 struct se_lun *core_get_lun_from_tpg(struct se_portal_group *, u32);
 struct se_lun_acl *core_dev_init_initiator_node_lun_acl(struct se_portal_group *,
                 struct se_node_acl *, u32, int *);
@@ -82,8 +83,7 @@ void	core_tpg_wait_for_nacl_pr_ref(struct se_node_acl *);
 struct se_lun *core_tpg_alloc_lun(struct se_portal_group *, u32);
 int     core_tpg_add_lun(struct se_portal_group *, struct se_lun *,
                 u32, struct se_device *);
-struct se_lun *core_tpg_pre_dellun(struct se_portal_group *, u32 unpacked_lun);
-int     core_tpg_post_dellun(struct se_portal_group *, struct se_lun *);
+void core_tpg_remove_lun(struct se_portal_group *, struct se_lun *);
 
 /* target_core_transport.c */
 extern struct kmem_cache *se_tmr_req_cache;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index df357862286e..9f93b8234095 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -674,8 +674,7 @@ static struct t10_pr_registration *__core_scsi3_alloc_registration(
          */
         spin_lock(&dev->se_port_lock);
         list_for_each_entry_safe(port, port_tmp, &dev->dev_sep_list, sep_list) {
-                atomic_inc(&port->sep_tg_pt_ref_cnt);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&port->sep_tg_pt_ref_cnt);
                 spin_unlock(&dev->se_port_lock);
 
                 spin_lock_bh(&port->sep_alua_lock);
@@ -709,8 +708,7 @@ static struct t10_pr_registration *__core_scsi3_alloc_registration(
                         if (strcmp(nacl->initiatorname, nacl_tmp->initiatorname))
                                 continue;
 
-                        atomic_inc(&deve_tmp->pr_ref_count);
-                        smp_mb__after_atomic();
+                        atomic_inc_mb(&deve_tmp->pr_ref_count);
                         spin_unlock_bh(&port->sep_alua_lock);
                         /*
                          * Grab a configfs group dependency that is released
@@ -722,10 +720,8 @@ static struct t10_pr_registration *__core_scsi3_alloc_registration(
                         if (ret < 0) {
                                 pr_err("core_scsi3_lunacl_depend"
                                                 "_item() failed\n");
-                                atomic_dec(&port->sep_tg_pt_ref_cnt);
-                                smp_mb__after_atomic();
-                                atomic_dec(&deve_tmp->pr_ref_count);
-                                smp_mb__after_atomic();
+                                atomic_dec_mb(&port->sep_tg_pt_ref_cnt);
+                                atomic_dec_mb(&deve_tmp->pr_ref_count);
                                 goto out;
                         }
                         /*
@@ -739,10 +735,8 @@ static struct t10_pr_registration *__core_scsi3_alloc_registration(
                                                 nacl_tmp, deve_tmp, NULL,
                                                 sa_res_key, all_tg_pt, aptpl);
                         if (!pr_reg_atp) {
-                                atomic_dec(&port->sep_tg_pt_ref_cnt);
-                                smp_mb__after_atomic();
-                                atomic_dec(&deve_tmp->pr_ref_count);
-                                smp_mb__after_atomic();
+                                atomic_dec_mb(&port->sep_tg_pt_ref_cnt);
+                                atomic_dec_mb(&deve_tmp->pr_ref_count);
                                 core_scsi3_lunacl_undepend_item(deve_tmp);
                                 goto out;
                         }
@@ -754,8 +748,7 @@ static struct t10_pr_registration *__core_scsi3_alloc_registration(
                 spin_unlock_bh(&port->sep_alua_lock);
 
                 spin_lock(&dev->se_port_lock);
-                atomic_dec(&port->sep_tg_pt_ref_cnt);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&port->sep_tg_pt_ref_cnt);
         }
         spin_unlock(&dev->se_port_lock);
 
@@ -902,6 +895,7 @@ static int __core_scsi3_check_aptpl_registration(
         spin_lock(&pr_tmpl->aptpl_reg_lock);
         list_for_each_entry_safe(pr_reg, pr_reg_tmp, &pr_tmpl->aptpl_reg_list,
                                 pr_reg_aptpl_list) {
+
                 if (!strcmp(pr_reg->pr_iport, i_port) &&
                      (pr_reg->pr_res_mapped_lun == deve->mapped_lun) &&
                     !(strcmp(pr_reg->pr_tport, t_port)) &&
@@ -944,10 +938,10 @@ int core_scsi3_check_aptpl_registration(
         struct se_device *dev,
         struct se_portal_group *tpg,
         struct se_lun *lun,
-        struct se_lun_acl *lun_acl)
+        struct se_node_acl *nacl,
+        u32 mapped_lun)
 {
-        struct se_node_acl *nacl = lun_acl->se_lun_nacl;
-        struct se_dev_entry *deve = nacl->device_list[lun_acl->mapped_lun];
+        struct se_dev_entry *deve = nacl->device_list[mapped_lun];
 
         if (dev->dev_reservation_flags & DRF_SPC2_RESERVATIONS)
                 return 0;
@@ -1109,8 +1103,7 @@ static struct t10_pr_registration *__core_scsi3_locate_pr_reg(
                                 if (dev->dev_attrib.enforce_pr_isids)
                                         continue;
                         }
-                        atomic_inc(&pr_reg->pr_res_holders);
-                        smp_mb__after_atomic();
+                        atomic_inc_mb(&pr_reg->pr_res_holders);
                         spin_unlock(&pr_tmpl->registration_lock);
                         return pr_reg;
                 }
@@ -1124,8 +1117,7 @@ static struct t10_pr_registration *__core_scsi3_locate_pr_reg(
                 if (strcmp(isid, pr_reg->pr_reg_isid))
                         continue;
 
-                atomic_inc(&pr_reg->pr_res_holders);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&pr_reg->pr_res_holders);
                 spin_unlock(&pr_tmpl->registration_lock);
                 return pr_reg;
         }
@@ -1154,8 +1146,7 @@ static struct t10_pr_registration *core_scsi3_locate_pr_reg(
 
 static void core_scsi3_put_pr_reg(struct t10_pr_registration *pr_reg)
 {
-        atomic_dec(&pr_reg->pr_res_holders);
-        smp_mb__after_atomic();
+        atomic_dec_mb(&pr_reg->pr_res_holders);
 }
 
 static int core_scsi3_check_implicit_release(
@@ -1348,8 +1339,7 @@ static void core_scsi3_tpg_undepend_item(struct se_portal_group *tpg)
         configfs_undepend_item(tpg->se_tpg_tfo->tf_subsys,
                         &tpg->tpg_group.cg_item);
 
-        atomic_dec(&tpg->tpg_pr_ref_count);
-        smp_mb__after_atomic();
+        atomic_dec_mb(&tpg->tpg_pr_ref_count);
 }
 
 static int core_scsi3_nodeacl_depend_item(struct se_node_acl *nacl)
@@ -1368,16 +1358,14 @@ static void core_scsi3_nodeacl_undepend_item(struct se_node_acl *nacl)
         struct se_portal_group *tpg = nacl->se_tpg;
 
         if (nacl->dynamic_node_acl) {
-                atomic_dec(&nacl->acl_pr_ref_count);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&nacl->acl_pr_ref_count);
                 return;
         }
 
         configfs_undepend_item(tpg->se_tpg_tfo->tf_subsys,
                         &nacl->acl_group.cg_item);
 
-        atomic_dec(&nacl->acl_pr_ref_count);
-        smp_mb__after_atomic();
+        atomic_dec_mb(&nacl->acl_pr_ref_count);
 }
 
 static int core_scsi3_lunacl_depend_item(struct se_dev_entry *se_deve)
@@ -1407,8 +1395,7 @@ static void core_scsi3_lunacl_undepend_item(struct se_dev_entry *se_deve)
          * For nacl->dynamic_node_acl=1
          */
         if (!lun_acl) {
-                atomic_dec(&se_deve->pr_ref_count);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&se_deve->pr_ref_count);
                 return;
         }
         nacl = lun_acl->se_lun_nacl;
@@ -1417,8 +1404,7 @@ static void core_scsi3_lunacl_undepend_item(struct se_dev_entry *se_deve)
         configfs_undepend_item(tpg->se_tpg_tfo->tf_subsys,
                         &lun_acl->se_lun_group.cg_item);
 
-        atomic_dec(&se_deve->pr_ref_count);
-        smp_mb__after_atomic();
+        atomic_dec_mb(&se_deve->pr_ref_count);
 }
 
 static sense_reason_t
@@ -1551,15 +1537,13 @@ core_scsi3_decode_spec_i_port(
                         if (!i_str)
                                 continue;
 
-                        atomic_inc(&tmp_tpg->tpg_pr_ref_count);
-                        smp_mb__after_atomic();
+                        atomic_inc_mb(&tmp_tpg->tpg_pr_ref_count);
                         spin_unlock(&dev->se_port_lock);
 
                         if (core_scsi3_tpg_depend_item(tmp_tpg)) {
                                 pr_err(" core_scsi3_tpg_depend_item()"
                                         " for tmp_tpg\n");
-                                atomic_dec(&tmp_tpg->tpg_pr_ref_count);
-                                smp_mb__after_atomic();
+                                atomic_dec_mb(&tmp_tpg->tpg_pr_ref_count);
                                 ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                                 goto out_unmap;
                         }
@@ -1571,10 +1555,8 @@ core_scsi3_decode_spec_i_port(
                         spin_lock_irq(&tmp_tpg->acl_node_lock);
                         dest_node_acl = __core_tpg_get_initiator_node_acl(
                                                 tmp_tpg, i_str);
-                        if (dest_node_acl) {
-                                atomic_inc(&dest_node_acl->acl_pr_ref_count);
-                                smp_mb__after_atomic();
-                        }
+                        if (dest_node_acl)
+                                atomic_inc_mb(&dest_node_acl->acl_pr_ref_count);
                         spin_unlock_irq(&tmp_tpg->acl_node_lock);
 
                         if (!dest_node_acl) {
@@ -1586,8 +1568,7 @@ core_scsi3_decode_spec_i_port(
                         if (core_scsi3_nodeacl_depend_item(dest_node_acl)) {
                                 pr_err("configfs_depend_item() failed"
                                         " for dest_node_acl->acl_group\n");
-                                atomic_dec(&dest_node_acl->acl_pr_ref_count);
-                                smp_mb__after_atomic();
+                                atomic_dec_mb(&dest_node_acl->acl_pr_ref_count);
                                 core_scsi3_tpg_undepend_item(tmp_tpg);
                                 ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                                 goto out_unmap;
@@ -1646,8 +1627,7 @@ core_scsi3_decode_spec_i_port(
                 if (core_scsi3_lunacl_depend_item(dest_se_deve)) {
                         pr_err("core_scsi3_lunacl_depend_item()"
                                         " failed\n");
-                        atomic_dec(&dest_se_deve->pr_ref_count);
-                        smp_mb__after_atomic();
+                        atomic_dec_mb(&dest_se_deve->pr_ref_count);
                         core_scsi3_nodeacl_undepend_item(dest_node_acl);
                         core_scsi3_tpg_undepend_item(dest_tpg);
                         ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -2758,7 +2738,8 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
         struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_reg_n, *pr_res_holder;
         struct t10_reservation *pr_tmpl = &dev->t10_pr;
         u32 pr_res_mapped_lun = 0;
-        int all_reg = 0, calling_it_nexus = 0, released_regs = 0;
+        int all_reg = 0, calling_it_nexus = 0;
+        bool sa_res_key_unmatched = sa_res_key != 0;
         int prh_type = 0, prh_scope = 0;
 
         if (!se_sess)
@@ -2833,6 +2814,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                         if (!all_reg) {
                                 if (pr_reg->pr_res_key != sa_res_key)
                                         continue;
+                                sa_res_key_unmatched = false;
 
                                 calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
                                 pr_reg_nacl = pr_reg->pr_reg_nacl;
@@ -2840,7 +2822,6 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 __core_scsi3_free_registration(dev, pr_reg,
                                         (preempt_type == PREEMPT_AND_ABORT) ? &preempt_and_abort_list :
                                                 NULL, calling_it_nexus);
-                                released_regs++;
                         } else {
                                 /*
                                  * Case for any existing all registrants type
@@ -2858,6 +2839,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 if ((sa_res_key) &&
                                      (pr_reg->pr_res_key != sa_res_key))
                                         continue;
+                                sa_res_key_unmatched = false;
 
                                 calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
                                 if (calling_it_nexus)
@@ -2868,7 +2850,6 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 __core_scsi3_free_registration(dev, pr_reg,
                                         (preempt_type == PREEMPT_AND_ABORT) ? &preempt_and_abort_list :
                                                 NULL, 0);
-                                released_regs++;
                         }
                         if (!calling_it_nexus)
                                 core_scsi3_ua_allocate(pr_reg_nacl,
@@ -2883,7 +2864,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                  * registered reservation key, then the device server shall
                  * complete the command with RESERVATION CONFLICT status.
                  */
-                if (!released_regs) {
+                if (sa_res_key_unmatched) {
                         spin_unlock(&dev->dev_reservation_lock);
                         core_scsi3_put_pr_reg(pr_reg_n);
                         return TCM_RESERVATION_CONFLICT;
@@ -3167,15 +3148,13 @@ core_scsi3_emulate_pro_register_and_move(struct se_cmd *cmd, u64 res_key,
                 if (!dest_tf_ops)
                         continue;
 
-                atomic_inc(&dest_se_tpg->tpg_pr_ref_count);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&dest_se_tpg->tpg_pr_ref_count);
                 spin_unlock(&dev->se_port_lock);
 
                 if (core_scsi3_tpg_depend_item(dest_se_tpg)) {
                         pr_err("core_scsi3_tpg_depend_item() failed"
                                 " for dest_se_tpg\n");
-                        atomic_dec(&dest_se_tpg->tpg_pr_ref_count);
-                        smp_mb__after_atomic();
+                        atomic_dec_mb(&dest_se_tpg->tpg_pr_ref_count);
                         ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                         goto out_put_pr_reg;
                 }
@@ -3271,10 +3250,8 @@ after_iport_check:
         spin_lock_irq(&dest_se_tpg->acl_node_lock);
         dest_node_acl = __core_tpg_get_initiator_node_acl(dest_se_tpg,
                                 initiator_str);
-        if (dest_node_acl) {
-                atomic_inc(&dest_node_acl->acl_pr_ref_count);
-                smp_mb__after_atomic();
-        }
+        if (dest_node_acl)
+                atomic_inc_mb(&dest_node_acl->acl_pr_ref_count);
         spin_unlock_irq(&dest_se_tpg->acl_node_lock);
 
         if (!dest_node_acl) {
@@ -3288,8 +3265,7 @@ after_iport_check:
         if (core_scsi3_nodeacl_depend_item(dest_node_acl)) {
                 pr_err("core_scsi3_nodeacl_depend_item() for"
                         " dest_node_acl\n");
-                atomic_dec(&dest_node_acl->acl_pr_ref_count);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&dest_node_acl->acl_pr_ref_count);
                 dest_node_acl = NULL;
                 ret = TCM_INVALID_PARAMETER_LIST;
                 goto out;
@@ -3313,8 +3289,7 @@ after_iport_check:
 
         if (core_scsi3_lunacl_depend_item(dest_se_deve)) {
                 pr_err("core_scsi3_lunacl_depend_item() failed\n");
-                atomic_dec(&dest_se_deve->pr_ref_count);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&dest_se_deve->pr_ref_count);
                 dest_se_deve = NULL;
                 ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                 goto out;
@@ -3497,6 +3472,7 @@ static unsigned long long core_scsi3_extract_reservation_key(unsigned char *cdb)
 sense_reason_t
 target_scsi3_emulate_pr_out(struct se_cmd *cmd)
 {
+        struct se_device *dev = cmd->se_dev;
         unsigned char *cdb = &cmd->t_task_cdb[0];
         unsigned char *buf;
         u64 res_key, sa_res_key;
@@ -3561,6 +3537,13 @@ target_scsi3_emulate_pr_out(struct se_cmd *cmd)
                 aptpl = (buf[17] & 0x01);
                 unreg = (buf[17] & 0x02);
         }
+        /*
+         * If the backend device has been configured to force APTPL metadata
+         * write-out, go ahead and propigate aptpl=1 down now.
+         */
+        if (dev->dev_attrib.force_pr_aptpl)
+                aptpl = 1;
+
         transport_kunmap_data_sg(cmd);
         buf = NULL;
 
@@ -3803,7 +3786,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
         if (!buf)
                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 
-        buf[0] = ((add_len << 8) & 0xff);
+        buf[0] = ((add_len >> 8) & 0xff);
         buf[1] = (add_len & 0xff);
         buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */
         buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */
@@ -3879,8 +3862,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
                 se_tpg = pr_reg->pr_reg_nacl->se_tpg;
                 add_desc_len = 0;
 
-                atomic_inc(&pr_reg->pr_res_holders);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&pr_reg->pr_res_holders);
                 spin_unlock(&pr_tmpl->registration_lock);
                 /*
                  * Determine expected length of $FABRIC_MOD specific
@@ -3893,8 +3875,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
                         pr_warn("SPC-3 PRIN READ_FULL_STATUS ran"
                                 " out of buffer: %d\n", cmd->data_length);
                         spin_lock(&pr_tmpl->registration_lock);
-                        atomic_dec(&pr_reg->pr_res_holders);
-                        smp_mb__after_atomic();
+                        atomic_dec_mb(&pr_reg->pr_res_holders);
                         break;
                 }
                 /*
@@ -3955,8 +3936,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
                                 se_nacl, pr_reg, &format_code, &buf[off+4]);
 
                 spin_lock(&pr_tmpl->registration_lock);
-                atomic_dec(&pr_reg->pr_res_holders);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&pr_reg->pr_res_holders);
                 /*
                  * Set the ADDITIONAL DESCRIPTOR LENGTH
                  */
diff --git a/drivers/target/target_core_pr.h b/drivers/target/target_core_pr.h
index 2ee2936fa0bd..749fd7bb7510 100644
--- a/drivers/target/target_core_pr.h
+++ b/drivers/target/target_core_pr.h
@@ -60,7 +60,7 @@ extern int core_scsi3_alloc_aptpl_registration(
                         unsigned char *, u16, u32, int, int, u8);
 extern int core_scsi3_check_aptpl_registration(struct se_device *,
                         struct se_portal_group *, struct se_lun *,
-                        struct se_lun_acl *);
+                        struct se_node_acl *, u32);
 extern void core_scsi3_free_pr_reg_from_nacl(struct se_device *,
                                              struct se_node_acl *);
 extern void core_scsi3_free_all_registrations(struct se_device *);
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 70d9f6dabba0..7c8291f0bbbc 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -749,14 +749,18 @@ static ssize_t pscsi_set_configfs_dev_params(struct se_device *dev,
                                 ret = -EINVAL;
                                 goto out;
                         }
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         pdv->pdv_host_id = arg;
                         pr_debug("PSCSI[%d]: Referencing SCSI Host ID:"
                                 " %d\n", phv->phv_host_id, pdv->pdv_host_id);
                         pdv->pdv_flags |= PDF_HAS_VIRT_HOST_ID;
                         break;
                 case Opt_scsi_channel_id:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         pdv->pdv_channel_id = arg;
                         pr_debug("PSCSI[%d]: Referencing SCSI Channel"
                                 " ID: %d\n",  phv->phv_host_id,
@@ -764,7 +768,9 @@ static ssize_t pscsi_set_configfs_dev_params(struct se_device *dev,
                         pdv->pdv_flags |= PDF_HAS_CHANNEL_ID;
                         break;
                 case Opt_scsi_target_id:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         pdv->pdv_target_id = arg;
                         pr_debug("PSCSI[%d]: Referencing SCSI Target"
                                 " ID: %d\n", phv->phv_host_id,
@@ -772,7 +778,9 @@ static ssize_t pscsi_set_configfs_dev_params(struct se_device *dev,
                         pdv->pdv_flags |= PDF_HAS_TARGET_ID;
                         break;
                 case Opt_scsi_lun_id:
-                        match_int(args, &arg);
+                        ret = match_int(args, &arg);
+                        if (ret)
+                                goto out;
                         pdv->pdv_lun_id = arg;
                         pr_debug("PSCSI[%d]: Referencing SCSI LUN ID:"
                                 " %d\n", phv->phv_host_id, pdv->pdv_lun_id);
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index bd78d9235ac6..ebe62afb957d 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -948,7 +948,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
         }
 
         /* reject any command that we don't have a handler for */
-        if (!(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) && !cmd->execute_cmd)
+        if (!cmd->execute_cmd)
                 return TCM_UNSUPPORTED_SCSI_OPCODE;
 
         if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index f7cd95e8111a..fa5e157db47b 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -64,21 +64,17 @@ int core_tmr_alloc_req(
 }
 EXPORT_SYMBOL(core_tmr_alloc_req);
 
-void core_tmr_release_req(
-        struct se_tmr_req *tmr)
+void core_tmr_release_req(struct se_tmr_req *tmr)
 {
         struct se_device *dev = tmr->tmr_dev;
         unsigned long flags;
 
-        if (!dev) {
-                kfree(tmr);
-                return;
+        if (dev) {
+                spin_lock_irqsave(&dev->se_tmr_lock, flags);
+                list_del(&tmr->tmr_list);
+                spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
         }
 
-        spin_lock_irqsave(&dev->se_tmr_lock, flags);
-        list_del(&tmr->tmr_list);
-        spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
-
         kfree(tmr);
 }
 
@@ -90,9 +86,8 @@ static void core_tmr_handle_tas_abort(
         bool remove = true;
         /*
          * TASK ABORTED status (TAS) bit support
-        */
-        if ((tmr_nacl &&
-             (tmr_nacl != cmd->se_sess->se_node_acl)) && tas) {
+         */
+        if ((tmr_nacl && (tmr_nacl != cmd->se_sess->se_node_acl)) && tas) {
                 remove = false;
                 transport_send_task_abort(cmd);
         }
@@ -120,13 +115,12 @@ void core_tmr_abort_task(
         struct se_tmr_req *tmr,
         struct se_session *se_sess)
 {
-        struct se_cmd *se_cmd, *tmp_cmd;
+        struct se_cmd *se_cmd;
         unsigned long flags;
         int ref_tag;
 
         spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
-        list_for_each_entry_safe(se_cmd, tmp_cmd,
-                        &se_sess->sess_cmd_list, se_cmd_list) {
+        list_for_each_entry(se_cmd, &se_sess->sess_cmd_list, se_cmd_list) {
 
                 if (dev != se_cmd->se_dev)
                         continue;
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index be783f717f19..0696de9553d3 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -40,6 +40,7 @@
 #include <target/target_core_fabric.h>
 
 #include "target_core_internal.h"
+#include "target_core_pr.h"
 
 extern struct se_device *g_lun0_dev;
 
@@ -166,6 +167,13 @@ void core_tpg_add_node_to_devs(
 
                 core_enable_device_list_for_node(lun, NULL, lun->unpacked_lun,
                                 lun_access, acl, tpg);
+                /*
+                 * Check to see if there are any existing persistent reservation
+                 * APTPL pre-registrations that need to be enabled for this dynamic
+                 * LUN ACL now..
+                 */
+                core_scsi3_check_aptpl_registration(dev, tpg, lun, acl,
+                                                    lun->unpacked_lun);
                 spin_lock(&tpg->tpg_lun_lock);
         }
         spin_unlock(&tpg->tpg_lun_lock);
@@ -335,7 +343,7 @@ void core_tpg_clear_object_luns(struct se_portal_group *tpg)
                         continue;
 
                 spin_unlock(&tpg->tpg_lun_lock);
-                core_dev_del_lun(tpg, lun->unpacked_lun);
+                core_dev_del_lun(tpg, lun);
                 spin_lock(&tpg->tpg_lun_lock);
         }
         spin_unlock(&tpg->tpg_lun_lock);
@@ -663,13 +671,6 @@ static int core_tpg_setup_virtual_lun0(struct se_portal_group *se_tpg)
         return 0;
 }
 
-static void core_tpg_release_virtual_lun0(struct se_portal_group *se_tpg)
-{
-        struct se_lun *lun = &se_tpg->tpg_virt_lun0;
-
-        core_tpg_post_dellun(se_tpg, lun);
-}
-
 int core_tpg_register(
         struct target_core_fabric_ops *tfo,
         struct se_wwn *se_wwn,
@@ -773,7 +774,7 @@ int core_tpg_deregister(struct se_portal_group *se_tpg)
         spin_unlock_irq(&se_tpg->acl_node_lock);
 
         if (se_tpg->se_tpg_type == TRANSPORT_TPG_TYPE_NORMAL)
-                core_tpg_release_virtual_lun0(se_tpg);
+                core_tpg_remove_lun(se_tpg, &se_tpg->tpg_virt_lun0);
 
         se_tpg->se_tpg_fabric_ptr = NULL;
         array_free(se_tpg->tpg_lun_list, TRANSPORT_MAX_LUNS_PER_TPG);
@@ -838,37 +839,7 @@ int core_tpg_add_lun(
         return 0;
 }
 
-struct se_lun *core_tpg_pre_dellun(
-        struct se_portal_group *tpg,
-        u32 unpacked_lun)
-{
-        struct se_lun *lun;
-
-        if (unpacked_lun > (TRANSPORT_MAX_LUNS_PER_TPG-1)) {
-                pr_err("%s LUN: %u exceeds TRANSPORT_MAX_LUNS_PER_TPG"
-                        "-1: %u for Target Portal Group: %u\n",
-                        tpg->se_tpg_tfo->get_fabric_name(), unpacked_lun,
-                        TRANSPORT_MAX_LUNS_PER_TPG-1,
-                        tpg->se_tpg_tfo->tpg_get_tag(tpg));
-                return ERR_PTR(-EOVERFLOW);
-        }
-
-        spin_lock(&tpg->tpg_lun_lock);
-        lun = tpg->tpg_lun_list[unpacked_lun];
-        if (lun->lun_status != TRANSPORT_LUN_STATUS_ACTIVE) {
-                pr_err("%s Logical Unit Number: %u is not active on"
-                        " Target Portal Group: %u, ignoring request.\n",
-                        tpg->se_tpg_tfo->get_fabric_name(), unpacked_lun,
-                        tpg->se_tpg_tfo->tpg_get_tag(tpg));
-                spin_unlock(&tpg->tpg_lun_lock);
-                return ERR_PTR(-ENODEV);
-        }
-        spin_unlock(&tpg->tpg_lun_lock);
-
-        return lun;
-}
-
-int core_tpg_post_dellun(
+void core_tpg_remove_lun(
         struct se_portal_group *tpg,
         struct se_lun *lun)
 {
@@ -882,6 +853,4 @@ int core_tpg_post_dellun(
         spin_unlock(&tpg->tpg_lun_lock);
 
         percpu_ref_exit(&lun->lun_ref);
-
-        return 0;
 }
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 7fa62fc93e0b..be877bf6f730 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -232,6 +232,10 @@ void transport_subsystem_check_init(void)
         if (ret != 0)
                 pr_err("Unable to load target_core_pscsi\n");
 
+        ret = request_module("target_core_user");
+        if (ret != 0)
+                pr_err("Unable to load target_core_user\n");
+
         sub_api_initialized = 1;
 }
 
@@ -752,8 +756,7 @@ void target_qf_do_work(struct work_struct *work)
 
         list_for_each_entry_safe(cmd, cmd_tmp, &qf_cmd_list, se_qf_node) {
                 list_del(&cmd->se_qf_node);
-                atomic_dec(&dev->dev_qf_count);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&dev->dev_qf_count);
 
                 pr_debug("Processing %s cmd: %p QUEUE_FULL in work queue"
                         " context: %s\n", cmd->se_tfo->get_fabric_name(), cmd,
@@ -1166,7 +1169,6 @@ transport_check_alloc_task_attr(struct se_cmd *cmd)
          * Dormant to Active status.
          */
         cmd->se_ordered_id = atomic_inc_return(&dev->dev_ordered_id);
-        smp_mb__after_atomic();
         pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
                         cmd->se_ordered_id, cmd->sam_task_attr,
                         dev->transport->name);
@@ -1722,8 +1724,7 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
                          cmd->t_task_cdb[0], cmd->se_ordered_id);
                 return false;
         case MSG_ORDERED_TAG:
-                atomic_inc(&dev->dev_ordered_sync);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&dev->dev_ordered_sync);
 
                 pr_debug("Added ORDERED for CDB: 0x%02x to ordered list, "
                          " se_ordered_id: %u\n",
@@ -1740,8 +1741,7 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
                 /*
                  * For SIMPLE and UNTAGGED Task Attribute commands
                  */
-                atomic_inc(&dev->simple_cmds);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&dev->simple_cmds);
                 break;
         }
 
@@ -1845,8 +1845,7 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
                 return;
 
         if (cmd->sam_task_attr == MSG_SIMPLE_TAG) {
-                atomic_dec(&dev->simple_cmds);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&dev->simple_cmds);
                 dev->dev_cur_ordered_id++;
                 pr_debug("Incremented dev->dev_cur_ordered_id: %u for"
                         " SIMPLE: %u\n", dev->dev_cur_ordered_id,
@@ -1857,8 +1856,7 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
                         " HEAD_OF_QUEUE: %u\n", dev->dev_cur_ordered_id,
                         cmd->se_ordered_id);
         } else if (cmd->sam_task_attr == MSG_ORDERED_TAG) {
-                atomic_dec(&dev->dev_ordered_sync);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&dev->dev_ordered_sync);
 
                 dev->dev_cur_ordered_id++;
                 pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED:"
@@ -1877,8 +1875,7 @@ static void transport_complete_qf(struct se_cmd *cmd)
         if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_status(cmd);
-                if (ret)
-                        goto out;
+                goto out;
         }
 
         switch (cmd->data_direction) {
@@ -1916,8 +1913,7 @@ static void transport_handle_queue_full(
 {
         spin_lock_irq(&dev->qf_cmd_lock);
         list_add_tail(&cmd->se_qf_node, &cmd->se_dev->qf_cmd_list);
-        atomic_inc(&dev->dev_qf_count);
-        smp_mb__after_atomic();
+        atomic_inc_mb(&dev->dev_qf_count);
         spin_unlock_irq(&cmd->se_dev->qf_cmd_lock);
 
         schedule_work(&cmd->se_dev->qf_work_queue);
@@ -2296,7 +2292,7 @@ transport_generic_new_cmd(struct se_cmd *cmd)
          * and let it call back once the write buffers are ready.
          */
         target_add_to_state_list(cmd);
-        if (cmd->data_direction != DMA_TO_DEVICE) {
+        if (cmd->data_direction != DMA_TO_DEVICE || cmd->data_length == 0) {
                 target_execute_cmd(cmd);
                 return 0;
         }
@@ -2896,7 +2892,6 @@ void transport_send_task_abort(struct se_cmd *cmd)
                 if (cmd->se_tfo->write_pending_status(cmd) != 0) {
                         cmd->transport_state |= CMD_T_ABORTED;
                         cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
-                        smp_mb__after_atomic();
                         return;
                 }
         }
diff --git a/drivers/target/target_core_ua.c b/drivers/target/target_core_ua.c
index 101858e245b3..1738b1646988 100644
--- a/drivers/target/target_core_ua.c
+++ b/drivers/target/target_core_ua.c
@@ -161,8 +161,7 @@ int core_scsi3_ua_allocate(
                 spin_unlock(&deve->ua_lock);
                 spin_unlock_irq(&nacl->device_list_lock);
 
-                atomic_inc(&deve->ua_count);
-                smp_mb__after_atomic();
+                atomic_inc_mb(&deve->ua_count);
                 return 0;
         }
         list_add_tail(&ua->ua_nacl_list, &deve->ua_list);
@@ -174,8 +173,7 @@ int core_scsi3_ua_allocate(
                 nacl->se_tpg->se_tpg_tfo->get_fabric_name(), unpacked_lun,
                 asc, ascq);
 
-        atomic_inc(&deve->ua_count);
-        smp_mb__after_atomic();
+        atomic_inc_mb(&deve->ua_count);
         return 0;
 }
 
@@ -189,8 +187,7 @@ void core_scsi3_ua_release_all(
                 list_del(&ua->ua_nacl_list);
                 kmem_cache_free(se_ua_cache, ua);
 
-                atomic_dec(&deve->ua_count);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&deve->ua_count);
         }
         spin_unlock(&deve->ua_lock);
 }
@@ -250,8 +247,7 @@ void core_scsi3_ua_for_check_condition(
                 list_del(&ua->ua_nacl_list);
                 kmem_cache_free(se_ua_cache, ua);
 
-                atomic_dec(&deve->ua_count);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&deve->ua_count);
         }
         spin_unlock(&deve->ua_lock);
         spin_unlock_irq(&nacl->device_list_lock);
@@ -309,8 +305,7 @@ int core_scsi3_ua_clear_for_request_sense(
                 list_del(&ua->ua_nacl_list);
                 kmem_cache_free(se_ua_cache, ua);
 
-                atomic_dec(&deve->ua_count);
-                smp_mb__after_atomic();
+                atomic_dec_mb(&deve->ua_count);
         }
         spin_unlock(&deve->ua_lock);
         spin_unlock_irq(&nacl->device_list_lock);
diff --git a/drivers/target/target_core_ua.h b/drivers/target/target_core_ua.h
index be912b36daae..a6b56b364e7a 100644
--- a/drivers/target/target_core_ua.h
+++ b/drivers/target/target_core_ua.h
@@ -1,4 +1,5 @@
 #ifndef TARGET_CORE_UA_H
+#define TARGET_CORE_UA_H
 
 /*
  * From spc4r17, Table D.1: ASC and ASCQ Assignement
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
new file mode 100644
index 000000000000..9a1b314f6482
--- /dev/null
+++ b/drivers/target/target_core_user.c
@@ -0,0 +1,1167 @@
+/*
+ * Copyright (C) 2013 Shaohua Li <shli@kernel.org>
+ * Copyright (C) 2014 Red Hat, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <linux/spinlock.h>
+#include <linux/module.h>
+#include <linux/idr.h>
+#include <linux/timer.h>
+#include <linux/parser.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_host.h>
+#include <linux/uio_driver.h>
+#include <net/genetlink.h>
+#include <target/target_core_base.h>
+#include <target/target_core_fabric.h>
+#include <target/target_core_backend.h>
+#include <linux/target_core_user.h>
+
+/*
+ * Define a shared-memory interface for LIO to pass SCSI commands and
+ * data to userspace for processing. This is to allow backends that
+ * are too complex for in-kernel support to be possible.
+ *
+ * It uses the UIO framework to do a lot of the device-creation and
+ * introspection work for us.
+ *
+ * See the .h file for how the ring is laid out. Note that while the
+ * command ring is defined, the particulars of the data area are
+ * not. Offset values in the command entry point to other locations
+ * internal to the mmap()ed area. There is separate space outside the
+ * command ring for data buffers. This leaves maximum flexibility for
+ * moving buffer allocations, or even page flipping or other
+ * allocation techniques, without altering the command ring layout.
+ *
+ * SECURITY:
+ * The user process must be assumed to be malicious. There's no way to
+ * prevent it breaking the command ring protocol if it wants, but in
+ * order to prevent other issues we must only ever read *data* from
+ * the shared memory area, not offsets or sizes. This applies to
+ * command ring entries as well as the mailbox. Extra code needed for
+ * this may have a 'UAM' comment.
+ */
+
+
+#define TCMU_TIME_OUT (30 * MSEC_PER_SEC)
+
+#define CMDR_SIZE (16 * 4096)
+#define DATA_SIZE (257 * 4096)
+
+#define TCMU_RING_SIZE (CMDR_SIZE + DATA_SIZE)
+
+static struct device *tcmu_root_device;
+
+struct tcmu_hba {
+        u32 host_id;
+};
+
+/* User wants all cmds or just some */
+enum passthru_level {
+        TCMU_PASS_ALL = 0,
+        TCMU_PASS_IO,
+        TCMU_PASS_INVALID,
+};
+
+#define TCMU_CONFIG_LEN 256
+
+struct tcmu_dev {
+        struct se_device se_dev;
+
+        char *name;
+        struct se_hba *hba;
+
+#define TCMU_DEV_BIT_OPEN 0
+#define TCMU_DEV_BIT_BROKEN 1
+        unsigned long flags;
+        enum passthru_level pass_level;
+
+        struct uio_info uio_info;
+
+        struct tcmu_mailbox *mb_addr;
+        size_t dev_size;
+        u32 cmdr_size;
+        u32 cmdr_last_cleaned;
+        /* Offset of data ring from start of mb */
+        size_t data_off;
+        size_t data_size;
+        /* Ring head + tail values. */
+        /* Must add data_off and mb_addr to get the address */
+        size_t data_head;
+        size_t data_tail;
+
+        wait_queue_head_t wait_cmdr;
+        /* TODO should this be a mutex? */
+        spinlock_t cmdr_lock;
+
+        struct idr commands;
+        spinlock_t commands_lock;
+
+        struct timer_list timeout;
+
+        char dev_config[TCMU_CONFIG_LEN];
+};
+
+#define TCMU_DEV(_se_dev) container_of(_se_dev, struct tcmu_dev, se_dev)
+
+#define CMDR_OFF sizeof(struct tcmu_mailbox)
+
+struct tcmu_cmd {
+        struct se_cmd *se_cmd;
+        struct tcmu_dev *tcmu_dev;
+
+        uint16_t cmd_id;
+
+        /* Can't use se_cmd->data_length when cleaning up expired cmds, because if
+           cmd has been completed then accessing se_cmd is off limits */
+        size_t data_length;
+
+        unsigned long deadline;
+
+#define TCMU_CMD_BIT_EXPIRED 0
+        unsigned long flags;
+};
+
+static struct kmem_cache *tcmu_cmd_cache;
+
+/* multicast group */
+enum tcmu_multicast_groups {
+        TCMU_MCGRP_CONFIG,
+};
+
+static const struct genl_multicast_group tcmu_mcgrps[] = {
+        [TCMU_MCGRP_CONFIG] = { .name = "config", },
+};
+
+/* Our generic netlink family */
+static struct genl_family tcmu_genl_family = {
+        .id = GENL_ID_GENERATE,
+        .hdrsize = 0,
+        .name = "TCM-USER",
+        .version = 1,
+        .maxattr = TCMU_ATTR_MAX,
+        .mcgrps = tcmu_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(tcmu_mcgrps),
+};
+
+static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd)
+{
+        struct se_device *se_dev = se_cmd->se_dev;
+        struct tcmu_dev *udev = TCMU_DEV(se_dev);
+        struct tcmu_cmd *tcmu_cmd;
+        int cmd_id;
+
+        tcmu_cmd = kmem_cache_zalloc(tcmu_cmd_cache, GFP_KERNEL);
+        if (!tcmu_cmd)
+                return NULL;
+
+        tcmu_cmd->se_cmd = se_cmd;
+        tcmu_cmd->tcmu_dev = udev;
+        tcmu_cmd->data_length = se_cmd->data_length;
+
+        tcmu_cmd->deadline = jiffies + msecs_to_jiffies(TCMU_TIME_OUT);
+
+        idr_preload(GFP_KERNEL);
+        spin_lock_irq(&udev->commands_lock);
+        cmd_id = idr_alloc(&udev->commands, tcmu_cmd, 0,
+                USHRT_MAX, GFP_NOWAIT);
+        spin_unlock_irq(&udev->commands_lock);
+        idr_preload_end();
+
+        if (cmd_id < 0) {
+                kmem_cache_free(tcmu_cmd_cache, tcmu_cmd);
+                return NULL;
+        }
+        tcmu_cmd->cmd_id = cmd_id;
+
+        return tcmu_cmd;
+}
+
+static inline void tcmu_flush_dcache_range(void *vaddr, size_t size)
+{
+        unsigned long offset = (unsigned long) vaddr & ~PAGE_MASK;
+
+        size = round_up(size+offset, PAGE_SIZE);
+        vaddr -= offset;
+
+        while (size) {
+                flush_dcache_page(virt_to_page(vaddr));
+                size -= PAGE_SIZE;
+        }
+}
+
+/*
+ * Some ring helper functions. We don't assume size is a power of 2 so
+ * we can't use circ_buf.h.
+ */
+static inline size_t spc_used(size_t head, size_t tail, size_t size)
+{
+        int diff = head - tail;
+
+        if (diff >= 0)
+                return diff;
+        else
+                return size + diff;
+}
+
+static inline size_t spc_free(size_t head, size_t tail, size_t size)
+{
+        /* Keep 1 byte unused or we can't tell full from empty */
+        return (size - spc_used(head, tail, size) - 1);
+}
+
+static inline size_t head_to_end(size_t head, size_t size)
+{
+        return size - head;
+}
+
+#define UPDATE_HEAD(head, used, size) smp_store_release(&head, ((head % size) + used) % size)
+
+/*
+ * We can't queue a command until we have space available on the cmd ring *and* space
+ * space avail on the data ring.
+ *
+ * Called with ring lock held.
+ */
+static bool is_ring_space_avail(struct tcmu_dev *udev, size_t cmd_size, size_t data_needed)
+{
+        struct tcmu_mailbox *mb = udev->mb_addr;
+        size_t space;
+        u32 cmd_head;
+        size_t cmd_needed;
+
+        tcmu_flush_dcache_range(mb, sizeof(*mb));
+
+        cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
+
+        /*
+         * If cmd end-of-ring space is too small then we need space for a NOP plus
+         * original cmd - cmds are internally contiguous.
+         */
+        if (head_to_end(cmd_head, udev->cmdr_size) >= cmd_size)
+                cmd_needed = cmd_size;
+        else
+                cmd_needed = cmd_size + head_to_end(cmd_head, udev->cmdr_size);
+
+        space = spc_free(cmd_head, udev->cmdr_last_cleaned, udev->cmdr_size);
+        if (space < cmd_needed) {
+                pr_debug("no cmd space: %u %u %u\n", cmd_head,
+                       udev->cmdr_last_cleaned, udev->cmdr_size);
+                return false;
+        }
+
+        space = spc_free(udev->data_head, udev->data_tail, udev->data_size);
+        if (space < data_needed) {
+                pr_debug("no data space: %zu %zu %zu\n", udev->data_head,
+                       udev->data_tail, udev->data_size);
+                return false;
+        }
+
+        return true;
+}
+
+static int tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+{
+        struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+        struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
+        size_t base_command_size, command_size;
+        struct tcmu_mailbox *mb;
+        struct tcmu_cmd_entry *entry;
+        int i;
+        struct scatterlist *sg;
+        struct iovec *iov;
+        int iov_cnt = 0;
+        uint32_t cmd_head;
+        uint64_t cdb_off;
+
+        if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags))
+                return -EINVAL;
+
+        /*
+         * Must be a certain minimum size for response sense info, but
+         * also may be larger if the iov array is large.
+         *
+         * iovs = sgl_nents+1, for end-of-ring case, plus another 1
+         * b/c size == offsetof one-past-element.
+        */
+        base_command_size = max(offsetof(struct tcmu_cmd_entry,
+                                         req.iov[se_cmd->t_data_nents + 2]),
+                                sizeof(struct tcmu_cmd_entry));
+        command_size = base_command_size
+                + round_up(scsi_command_size(se_cmd->t_task_cdb), TCMU_OP_ALIGN_SIZE);
+
+        WARN_ON(command_size & (TCMU_OP_ALIGN_SIZE-1));
+
+        spin_lock_irq(&udev->cmdr_lock);
+
+        mb = udev->mb_addr;
+        cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
+        if ((command_size > (udev->cmdr_size / 2))
+            || tcmu_cmd->data_length > (udev->data_size - 1))
+                pr_warn("TCMU: Request of size %zu/%zu may be too big for %u/%zu "
+                        "cmd/data ring buffers\n", command_size, tcmu_cmd->data_length,
+                        udev->cmdr_size, udev->data_size);
+
+        while (!is_ring_space_avail(udev, command_size, tcmu_cmd->data_length)) {
+                int ret;
+                DEFINE_WAIT(__wait);
+
+                prepare_to_wait(&udev->wait_cmdr, &__wait, TASK_INTERRUPTIBLE);
+
+                pr_debug("sleeping for ring space\n");
+                spin_unlock_irq(&udev->cmdr_lock);
+                ret = schedule_timeout(msecs_to_jiffies(TCMU_TIME_OUT));
+                finish_wait(&udev->wait_cmdr, &__wait);
+                if (!ret) {
+                        pr_warn("tcmu: command timed out\n");
+                        return -ETIMEDOUT;
+                }
+
+                spin_lock_irq(&udev->cmdr_lock);
+
+                /* We dropped cmdr_lock, cmd_head is stale */
+                cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
+        }
+
+        /* Insert a PAD if end-of-ring space is too small */
+        if (head_to_end(cmd_head, udev->cmdr_size) < command_size) {
+                size_t pad_size = head_to_end(cmd_head, udev->cmdr_size);
+
+                entry = (void *) mb + CMDR_OFF + cmd_head;
+                tcmu_flush_dcache_range(entry, sizeof(*entry));
+                tcmu_hdr_set_op(&entry->hdr, TCMU_OP_PAD);
+                tcmu_hdr_set_len(&entry->hdr, pad_size);
+
+                UPDATE_HEAD(mb->cmd_head, pad_size, udev->cmdr_size);
+
+                cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
+                WARN_ON(cmd_head != 0);
+        }
+
+        entry = (void *) mb + CMDR_OFF + cmd_head;
+        tcmu_flush_dcache_range(entry, sizeof(*entry));
+        tcmu_hdr_set_op(&entry->hdr, TCMU_OP_CMD);
+        tcmu_hdr_set_len(&entry->hdr, command_size);
+        entry->cmd_id = tcmu_cmd->cmd_id;
+
+        /*
+         * Fix up iovecs, and handle if allocation in data ring wrapped.
+         */
+        iov = &entry->req.iov[0];
+        for_each_sg(se_cmd->t_data_sg, sg, se_cmd->t_data_nents, i) {
+                size_t copy_bytes = min((size_t)sg->length,
+                                     head_to_end(udev->data_head, udev->data_size));
+                void *from = kmap_atomic(sg_page(sg)) + sg->offset;
+                void *to = (void *) mb + udev->data_off + udev->data_head;
+
+                if (tcmu_cmd->se_cmd->data_direction == DMA_TO_DEVICE) {
+                        memcpy(to, from, copy_bytes);
+                        tcmu_flush_dcache_range(to, copy_bytes);
+                }
+
+                /* Even iov_base is relative to mb_addr */
+                iov->iov_len = copy_bytes;
+                iov->iov_base = (void *) udev->data_off + udev->data_head;
+                iov_cnt++;
+                iov++;
+
+                UPDATE_HEAD(udev->data_head, copy_bytes, udev->data_size);
+
+                /* Uh oh, we wrapped the buffer. Must split sg across 2 iovs. */
+                if (sg->length != copy_bytes) {
+                        from += copy_bytes;
+                        copy_bytes = sg->length - copy_bytes;
+
+                        iov->iov_len = copy_bytes;
+                        iov->iov_base = (void *) udev->data_off + udev->data_head;
+
+                        if (se_cmd->data_direction == DMA_TO_DEVICE) {
+                                to = (void *) mb + udev->data_off + udev->data_head;
+                                memcpy(to, from, copy_bytes);
+                                tcmu_flush_dcache_range(to, copy_bytes);
+                        }
+
+                        iov_cnt++;
+                        iov++;
+
+                        UPDATE_HEAD(udev->data_head, copy_bytes, udev->data_size);
+                }
+
+                kunmap_atomic(from);
+        }
+        entry->req.iov_cnt = iov_cnt;
+
+        /* All offsets relative to mb_addr, not start of entry! */
+        cdb_off = CMDR_OFF + cmd_head + base_command_size;
+        memcpy((void *) mb + cdb_off, se_cmd->t_task_cdb, scsi_command_size(se_cmd->t_task_cdb));
+        entry->req.cdb_off = cdb_off;
+        tcmu_flush_dcache_range(entry, sizeof(*entry));
+
+        UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size);
+        tcmu_flush_dcache_range(mb, sizeof(*mb));
+
+        spin_unlock_irq(&udev->cmdr_lock);
+
+        /* TODO: only if FLUSH and FUA? */
+        uio_event_notify(&udev->uio_info);
+
+        mod_timer(&udev->timeout,
+                round_jiffies_up(jiffies + msecs_to_jiffies(TCMU_TIME_OUT)));
+
+        return 0;
+}
+
+static int tcmu_queue_cmd(struct se_cmd *se_cmd)
+{
+        struct se_device *se_dev = se_cmd->se_dev;
+        struct tcmu_dev *udev = TCMU_DEV(se_dev);
+        struct tcmu_cmd *tcmu_cmd;
+        int ret;
+
+        tcmu_cmd = tcmu_alloc_cmd(se_cmd);
+        if (!tcmu_cmd)
+                return -ENOMEM;
+
+        ret = tcmu_queue_cmd_ring(tcmu_cmd);
+        if (ret < 0) {
+                pr_err("TCMU: Could not queue command\n");
+                spin_lock_irq(&udev->commands_lock);
+                idr_remove(&udev->commands, tcmu_cmd->cmd_id);
+                spin_unlock_irq(&udev->commands_lock);
+
+                kmem_cache_free(tcmu_cmd_cache, tcmu_cmd);
+        }
+
+        return ret;
+}
+
+static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *entry)
+{
+        struct se_cmd *se_cmd = cmd->se_cmd;
+        struct tcmu_dev *udev = cmd->tcmu_dev;
+
+        if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
+                /* cmd has been completed already from timeout, just reclaim data
+                   ring space */
+                UPDATE_HEAD(udev->data_tail, cmd->data_length, udev->data_size);
+                return;
+        }
+
+        if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) {
+                memcpy(se_cmd->sense_buffer, entry->rsp.sense_buffer,
+                               se_cmd->scsi_sense_length);
+
+                UPDATE_HEAD(udev->data_tail, cmd->data_length, udev->data_size);
+        }
+        else if (se_cmd->data_direction == DMA_FROM_DEVICE) {
+                struct scatterlist *sg;
+                int i;
+
+                /* It'd be easier to look at entry's iovec again, but UAM */
+                for_each_sg(se_cmd->t_data_sg, sg, se_cmd->t_data_nents, i) {
+                        size_t copy_bytes;
+                        void *to;
+                        void *from;
+
+                        copy_bytes = min((size_t)sg->length,
+                                         head_to_end(udev->data_tail, udev->data_size));
+
+                        to = kmap_atomic(sg_page(sg)) + sg->offset;
+                        WARN_ON(sg->length + sg->offset > PAGE_SIZE);
+                        from = (void *) udev->mb_addr + udev->data_off + udev->data_tail;
+                        tcmu_flush_dcache_range(from, copy_bytes);
+                        memcpy(to, from, copy_bytes);
+
+                        UPDATE_HEAD(udev->data_tail, copy_bytes, udev->data_size);
+
+                        /* Uh oh, wrapped the data buffer for this sg's data */
+                        if (sg->length != copy_bytes) {
+                                from = (void *) udev->mb_addr + udev->data_off + udev->data_tail;
+                                WARN_ON(udev->data_tail);
+                                to += copy_bytes;
+                                copy_bytes = sg->length - copy_bytes;
+                                tcmu_flush_dcache_range(from, copy_bytes);
+                                memcpy(to, from, copy_bytes);
+
+                                UPDATE_HEAD(udev->data_tail, copy_bytes, udev->data_size);
+                        }
+
+                        kunmap_atomic(to);
+                }
+
+        } else if (se_cmd->data_direction == DMA_TO_DEVICE) {
+                UPDATE_HEAD(udev->data_tail, cmd->data_length, udev->data_size);
+        } else {
+                pr_warn("TCMU: data direction was %d!\n", se_cmd->data_direction);
+        }
+
+        target_complete_cmd(cmd->se_cmd, entry->rsp.scsi_status);
+        cmd->se_cmd = NULL;
+
+        kmem_cache_free(tcmu_cmd_cache, cmd);
+}
+
+static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+{
+        struct tcmu_mailbox *mb;
+        LIST_HEAD(cpl_cmds);
+        unsigned long flags;
+        int handled = 0;
+
+        if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags)) {
+                pr_err("ring broken, not handling completions\n");
+                return 0;
+        }
+
+        spin_lock_irqsave(&udev->cmdr_lock, flags);
+
+        mb = udev->mb_addr;
+        tcmu_flush_dcache_range(mb, sizeof(*mb));
+
+        while (udev->cmdr_last_cleaned != ACCESS_ONCE(mb->cmd_tail)) {
+
+                struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
+                struct tcmu_cmd *cmd;
+
+                tcmu_flush_dcache_range(entry, sizeof(*entry));
+
+                if (tcmu_hdr_get_op(&entry->hdr) == TCMU_OP_PAD) {
+                        UPDATE_HEAD(udev->cmdr_last_cleaned, tcmu_hdr_get_len(&entry->hdr), udev->cmdr_size);
+                        continue;
+                }
+                WARN_ON(tcmu_hdr_get_op(&entry->hdr) != TCMU_OP_CMD);
+
+                spin_lock(&udev->commands_lock);
+                cmd = idr_find(&udev->commands, entry->cmd_id);
+                if (cmd)
+                        idr_remove(&udev->commands, cmd->cmd_id);
+                spin_unlock(&udev->commands_lock);
+
+                if (!cmd) {
+                        pr_err("cmd_id not found, ring is broken\n");
+                        set_bit(TCMU_DEV_BIT_BROKEN, &udev->flags);
+                        break;
+                }
+
+                tcmu_handle_completion(cmd, entry);
+
+                UPDATE_HEAD(udev->cmdr_last_cleaned, tcmu_hdr_get_len(&entry->hdr), udev->cmdr_size);
+
+                handled++;
+        }
+
+        if (mb->cmd_tail == mb->cmd_head)
+                del_timer(&udev->timeout); /* no more pending cmds */
+
+        spin_unlock_irqrestore(&udev->cmdr_lock, flags);
+
+        wake_up(&udev->wait_cmdr);
+
+        return handled;
+}
+
+static int tcmu_check_expired_cmd(int id, void *p, void *data)
+{
+        struct tcmu_cmd *cmd = p;
+
+        if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
+                return 0;
+
+        if (!time_after(cmd->deadline, jiffies))
+                return 0;
+
+        set_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags);
+        target_complete_cmd(cmd->se_cmd, SAM_STAT_CHECK_CONDITION);
+        cmd->se_cmd = NULL;
+
+        kmem_cache_free(tcmu_cmd_cache, cmd);
+
+        return 0;
+}
+
+static void tcmu_device_timedout(unsigned long data)
+{
+        struct tcmu_dev *udev = (struct tcmu_dev *)data;
+        unsigned long flags;
+        int handled;
+
+        handled = tcmu_handle_completions(udev);
+
+        pr_warn("%d completions handled from timeout\n", handled);
+
+        spin_lock_irqsave(&udev->commands_lock, flags);
+        idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL);
+        spin_unlock_irqrestore(&udev->commands_lock, flags);
+
+        /*
+         * We don't need to wakeup threads on wait_cmdr since they have their
+         * own timeout.
+         */
+}
+
+static int tcmu_attach_hba(struct se_hba *hba, u32 host_id)
+{
+        struct tcmu_hba *tcmu_hba;
+
+        tcmu_hba = kzalloc(sizeof(struct tcmu_hba), GFP_KERNEL);
+        if (!tcmu_hba)
+                return -ENOMEM;
+
+        tcmu_hba->host_id = host_id;
+        hba->hba_ptr = tcmu_hba;
+
+        return 0;
+}
+
+static void tcmu_detach_hba(struct se_hba *hba)
+{
+        kfree(hba->hba_ptr);
+        hba->hba_ptr = NULL;
+}
+
+static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
+{
+        struct tcmu_dev *udev;
+
+        udev = kzalloc(sizeof(struct tcmu_dev), GFP_KERNEL);
+        if (!udev)
+                return NULL;
+
+        udev->name = kstrdup(name, GFP_KERNEL);
+        if (!udev->name) {
+                kfree(udev);
+                return NULL;
+        }
+
+        udev->hba = hba;
+
+        init_waitqueue_head(&udev->wait_cmdr);
+        spin_lock_init(&udev->cmdr_lock);
+
+        idr_init(&udev->commands);
+        spin_lock_init(&udev->commands_lock);
+
+        setup_timer(&udev->timeout, tcmu_device_timedout,
+                (unsigned long)udev);
+
+        udev->pass_level = TCMU_PASS_ALL;
+
+        return &udev->se_dev;
+}
+
+static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on)
+{
+        struct tcmu_dev *tcmu_dev = container_of(info, struct tcmu_dev, uio_info);
+
+        tcmu_handle_completions(tcmu_dev);
+
+        return 0;
+}
+
+/*
+ * mmap code from uio.c. Copied here because we want to hook mmap()
+ * and this stuff must come along.
+ */
+static int tcmu_find_mem_index(struct vm_area_struct *vma)
+{
+        struct tcmu_dev *udev = vma->vm_private_data;
+        struct uio_info *info = &udev->uio_info;
+
+        if (vma->vm_pgoff < MAX_UIO_MAPS) {
+                if (info->mem[vma->vm_pgoff].size == 0)
+                        return -1;
+                return (int)vma->vm_pgoff;
+        }
+        return -1;
+}
+
+static int tcmu_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct tcmu_dev *udev = vma->vm_private_data;
+        struct uio_info *info = &udev->uio_info;
+        struct page *page;
+        unsigned long offset;
+        void *addr;
+
+        int mi = tcmu_find_mem_index(vma);
+        if (mi < 0)
+                return VM_FAULT_SIGBUS;
+
+        /*
+         * We need to subtract mi because userspace uses offset = N*PAGE_SIZE
+         * to use mem[N].
+         */
+        offset = (vmf->pgoff - mi) << PAGE_SHIFT;
+
+        addr = (void *)(unsigned long)info->mem[mi].addr + offset;
+        if (info->mem[mi].memtype == UIO_MEM_LOGICAL)
+                page = virt_to_page(addr);
+        else
+                page = vmalloc_to_page(addr);
+        get_page(page);
+        vmf->page = page;
+        return 0;
+}
+
+static const struct vm_operations_struct tcmu_vm_ops = {
+        .fault = tcmu_vma_fault,
+};
+
+static int tcmu_mmap(struct uio_info *info, struct vm_area_struct *vma)
+{
+        struct tcmu_dev *udev = container_of(info, struct tcmu_dev, uio_info);
+
+        vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+        vma->vm_ops = &tcmu_vm_ops;
+
+        vma->vm_private_data = udev;
+
+        /* Ensure the mmap is exactly the right size */
+        if (vma_pages(vma) != (TCMU_RING_SIZE >> PAGE_SHIFT))
+                return -EINVAL;
+
+        return 0;
+}
+
+static int tcmu_open(struct uio_info *info, struct inode *inode)
+{
+        struct tcmu_dev *udev = container_of(info, struct tcmu_dev, uio_info);
+
+        /* O_EXCL not supported for char devs, so fake it? */
+        if (test_and_set_bit(TCMU_DEV_BIT_OPEN, &udev->flags))
+                return -EBUSY;
+
+        pr_debug("open\n");
+
+        return 0;
+}
+
+static int tcmu_release(struct uio_info *info, struct inode *inode)
+{
+        struct tcmu_dev *udev = container_of(info, struct tcmu_dev, uio_info);
+
+        clear_bit(TCMU_DEV_BIT_OPEN, &udev->flags);
+
+        pr_debug("close\n");
+
+        return 0;
+}
+
+static int tcmu_netlink_event(enum tcmu_genl_cmd cmd, const char *name, int minor)
+{
+        struct sk_buff *skb;
+        void *msg_header;
+        int ret = -ENOMEM;
+
+        skb = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!skb)
+                return ret;
+
+        msg_header = genlmsg_put(skb, 0, 0, &tcmu_genl_family, 0, cmd);
+        if (!msg_header)
+                goto free_skb;
+
+        ret = nla_put_string(skb, TCMU_ATTR_DEVICE, name);
+        if (ret < 0)
+                goto free_skb;
+
+        ret = nla_put_u32(skb, TCMU_ATTR_MINOR, minor);
+        if (ret < 0)
+                goto free_skb;
+
+        ret = genlmsg_end(skb, msg_header);
+        if (ret < 0)
+                goto free_skb;
+
+        ret = genlmsg_multicast(&tcmu_genl_family, skb, 0,
+                                TCMU_MCGRP_CONFIG, GFP_KERNEL);
+
+        /* We don't care if no one is listening */
+        if (ret == -ESRCH)
+                ret = 0;
+
+        return ret;
+free_skb:
+        nlmsg_free(skb);
+        return ret;
+}
+
+static int tcmu_configure_device(struct se_device *dev)
+{
+        struct tcmu_dev *udev = TCMU_DEV(dev);
+        struct tcmu_hba *hba = udev->hba->hba_ptr;
+        struct uio_info *info;
+        struct tcmu_mailbox *mb;
+        size_t size;
+        size_t used;
+        int ret = 0;
+        char *str;
+
+        info = &udev->uio_info;
+
+        size = snprintf(NULL, 0, "tcm-user/%u/%s/%s", hba->host_id, udev->name,
+                        udev->dev_config);
+        size += 1; /* for \0 */
+        str = kmalloc(size, GFP_KERNEL);
+        if (!str)
+                return -ENOMEM;
+
+        used = snprintf(str, size, "tcm-user/%u/%s", hba->host_id, udev->name);
+
+        if (udev->dev_config[0])
+                snprintf(str + used, size - used, "/%s", udev->dev_config);
+
+        info->name = str;
+
+        udev->mb_addr = vzalloc(TCMU_RING_SIZE);
+        if (!udev->mb_addr) {
+                ret = -ENOMEM;
+                goto err_vzalloc;
+        }
+
+        /* mailbox fits in first part of CMDR space */
+        udev->cmdr_size = CMDR_SIZE - CMDR_OFF;
+        udev->data_off = CMDR_SIZE;
+        udev->data_size = TCMU_RING_SIZE - CMDR_SIZE;
+
+        mb = udev->mb_addr;
+        mb->version = 1;
+        mb->cmdr_off = CMDR_OFF;
+        mb->cmdr_size = udev->cmdr_size;
+
+        WARN_ON(!PAGE_ALIGNED(udev->data_off));
+        WARN_ON(udev->data_size % PAGE_SIZE);
+
+        info->version = "1";
+
+        info->mem[0].name = "tcm-user command & data buffer";
+        info->mem[0].addr = (phys_addr_t) udev->mb_addr;
+        info->mem[0].size = TCMU_RING_SIZE;
+        info->mem[0].memtype = UIO_MEM_VIRTUAL;
+
+        info->irqcontrol = tcmu_irqcontrol;
+        info->irq = UIO_IRQ_CUSTOM;
+
+        info->mmap = tcmu_mmap;
+        info->open = tcmu_open;
+        info->release = tcmu_release;
+
+        ret = uio_register_device(tcmu_root_device, info);
+        if (ret)
+                goto err_register;
+
+        /* Other attributes can be configured in userspace */
+        dev->dev_attrib.hw_block_size = 512;
+        dev->dev_attrib.hw_max_sectors = 128;
+        dev->dev_attrib.hw_queue_depth = 128;
+
+        ret = tcmu_netlink_event(TCMU_CMD_ADDED_DEVICE, udev->uio_info.name,
+                                 udev->uio_info.uio_dev->minor);
+        if (ret)
+                goto err_netlink;
+
+        return 0;
+
+err_netlink:
+        uio_unregister_device(&udev->uio_info);
+err_register:
+        vfree(udev->mb_addr);
+err_vzalloc:
+        kfree(info->name);
+
+        return ret;
+}
+
+static int tcmu_check_pending_cmd(int id, void *p, void *data)
+{
+        struct tcmu_cmd *cmd = p;
+
+        if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
+                return 0;
+        return -EINVAL;
+}
+
+static void tcmu_free_device(struct se_device *dev)
+{
+        struct tcmu_dev *udev = TCMU_DEV(dev);
+        int i;
+
+        del_timer_sync(&udev->timeout);
+
+        vfree(udev->mb_addr);
+
+        /* Upper layer should drain all requests before calling this */
+        spin_lock_irq(&udev->commands_lock);
+        i = idr_for_each(&udev->commands, tcmu_check_pending_cmd, NULL);
+        idr_destroy(&udev->commands);
+        spin_unlock_irq(&udev->commands_lock);
+        WARN_ON(i);
+
+        /* Device was configured */
+        if (udev->uio_info.uio_dev) {
+                tcmu_netlink_event(TCMU_CMD_REMOVED_DEVICE, udev->uio_info.name,
+                                   udev->uio_info.uio_dev->minor);
+
+                uio_unregister_device(&udev->uio_info);
+                kfree(udev->uio_info.name);
+                kfree(udev->name);
+        }
+
+        kfree(udev);
+}
+
+enum {
+        Opt_dev_config, Opt_dev_size, Opt_err, Opt_pass_level,
+};
+
+static match_table_t tokens = {
+        {Opt_dev_config, "dev_config=%s"},
+        {Opt_dev_size, "dev_size=%u"},
+        {Opt_pass_level, "pass_level=%u"},
+        {Opt_err, NULL}
+};
+
+static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
+                const char *page, ssize_t count)
+{
+        struct tcmu_dev *udev = TCMU_DEV(dev);
+        char *orig, *ptr, *opts, *arg_p;
+        substring_t args[MAX_OPT_ARGS];
+        int ret = 0, token;
+        int arg;
+
+        opts = kstrdup(page, GFP_KERNEL);
+        if (!opts)
+                return -ENOMEM;
+
+        orig = opts;
+
+        while ((ptr = strsep(&opts, ",\n")) != NULL) {
+                if (!*ptr)
+                        continue;
+
+                token = match_token(ptr, tokens, args);
+                switch (token) {
+                case Opt_dev_config:
+                        if (match_strlcpy(udev->dev_config, &args[0],
+                                          TCMU_CONFIG_LEN) == 0) {
+                                ret = -EINVAL;
+                                break;
+                        }
+                        pr_debug("TCMU: Referencing Path: %s\n", udev->dev_config);
+                        break;
+                case Opt_dev_size:
+                        arg_p = match_strdup(&args[0]);
+                        if (!arg_p) {
+                                ret = -ENOMEM;
+                                break;
+                        }
+                        ret = kstrtoul(arg_p, 0, (unsigned long *) &udev->dev_size);
+                        kfree(arg_p);
+                        if (ret < 0)
+                                pr_err("kstrtoul() failed for dev_size=\n");
+                        break;
+                case Opt_pass_level:
+                        match_int(args, &arg);
+                        if (arg >= TCMU_PASS_INVALID) {
+                                pr_warn("TCMU: Invalid pass_level: %d\n", arg);
+                                break;
+                        }
+
+                        pr_debug("TCMU: Setting pass_level to %d\n", arg);
+                        udev->pass_level = arg;
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        kfree(orig);
+        return (!ret) ? count : ret;
+}
+
+static ssize_t tcmu_show_configfs_dev_params(struct se_device *dev, char *b)
+{
+        struct tcmu_dev *udev = TCMU_DEV(dev);
+        ssize_t bl = 0;
+
+        bl = sprintf(b + bl, "Config: %s ",
+                     udev->dev_config[0] ? udev->dev_config : "NULL");
+        bl += sprintf(b + bl, "Size: %zu PassLevel: %u\n",
+                      udev->dev_size, udev->pass_level);
+
+        return bl;
+}
+
+static sector_t tcmu_get_blocks(struct se_device *dev)
+{
+        struct tcmu_dev *udev = TCMU_DEV(dev);
+
+        return div_u64(udev->dev_size - dev->dev_attrib.block_size,
+                       dev->dev_attrib.block_size);
+}
+
+static sense_reason_t
+tcmu_execute_rw(struct se_cmd *se_cmd, struct scatterlist *sgl, u32 sgl_nents,
+                enum dma_data_direction data_direction)
+{
+        int ret;
+
+        ret = tcmu_queue_cmd(se_cmd);
+
+        if (ret != 0)
+                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        else
+                return TCM_NO_SENSE;
+}
+
+static sense_reason_t
+tcmu_pass_op(struct se_cmd *se_cmd)
+{
+        int ret = tcmu_queue_cmd(se_cmd);
+
+        if (ret != 0)
+                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        else
+                return TCM_NO_SENSE;
+}
+
+static struct sbc_ops tcmu_sbc_ops = {
+        .execute_rw = tcmu_execute_rw,
+        .execute_sync_cache     = tcmu_pass_op,
+        .execute_write_same     = tcmu_pass_op,
+        .execute_write_same_unmap = tcmu_pass_op,
+        .execute_unmap          = tcmu_pass_op,
+};
+
+static sense_reason_t
+tcmu_parse_cdb(struct se_cmd *cmd)
+{
+        unsigned char *cdb = cmd->t_task_cdb;
+        struct tcmu_dev *udev = TCMU_DEV(cmd->se_dev);
+        sense_reason_t ret;
+
+        switch (udev->pass_level) {
+        case TCMU_PASS_ALL:
+                /* We're just like pscsi, then */
+                /*
+                 * For REPORT LUNS we always need to emulate the response, for everything
+                 * else, pass it up.
+                 */
+                switch (cdb[0]) {
+                case REPORT_LUNS:
+                        cmd->execute_cmd = spc_emulate_report_luns;
+                        break;
+                case READ_6:
+                case READ_10:
+                case READ_12:
+                case READ_16:
+                case WRITE_6:
+                case WRITE_10:
+                case WRITE_12:
+                case WRITE_16:
+                case WRITE_VERIFY:
+                        cmd->se_cmd_flags |= SCF_SCSI_DATA_CDB;
+                        /* FALLTHROUGH */
+                default:
+                        cmd->execute_cmd = tcmu_pass_op;
+                }
+                ret = TCM_NO_SENSE;
+                break;
+        case TCMU_PASS_IO:
+                ret = sbc_parse_cdb(cmd, &tcmu_sbc_ops);
+                break;
+        default:
+                pr_err("Unknown tcm-user pass level %d\n", udev->pass_level);
+                ret = TCM_CHECK_CONDITION_ABORT_CMD;
+        }
+
+        return ret;
+}
+
+static struct se_subsystem_api tcmu_template = {
+        .name                   = "user",
+        .inquiry_prod           = "USER",
+        .inquiry_rev            = TCMU_VERSION,
+        .owner                  = THIS_MODULE,
+        .transport_type         = TRANSPORT_PLUGIN_VHBA_PDEV,
+        .attach_hba             = tcmu_attach_hba,
+        .detach_hba             = tcmu_detach_hba,
+        .alloc_device           = tcmu_alloc_device,
+        .configure_device       = tcmu_configure_device,
+        .free_device            = tcmu_free_device,
+        .parse_cdb              = tcmu_parse_cdb,
+        .set_configfs_dev_params = tcmu_set_configfs_dev_params,
+        .show_configfs_dev_params = tcmu_show_configfs_dev_params,
+        .get_device_type        = sbc_get_device_type,
+        .get_blocks             = tcmu_get_blocks,
+};
+
+static int __init tcmu_module_init(void)
+{
+        int ret;
+
+        BUILD_BUG_ON((sizeof(struct tcmu_cmd_entry) % TCMU_OP_ALIGN_SIZE) != 0);
+
+        tcmu_cmd_cache = kmem_cache_create("tcmu_cmd_cache",
+                                sizeof(struct tcmu_cmd),
+                                __alignof__(struct tcmu_cmd),
+                                0, NULL);
+        if (!tcmu_cmd_cache)
+                return -ENOMEM;
+
+        tcmu_root_device = root_device_register("tcm_user");
+        if (IS_ERR(tcmu_root_device)) {
+                ret = PTR_ERR(tcmu_root_device);
+                goto out_free_cache;
+        }
+
+        ret = genl_register_family(&tcmu_genl_family);
+        if (ret < 0) {
+                goto out_unreg_device;
+        }
+
+        ret = transport_subsystem_register(&tcmu_template);
+        if (ret)
+                goto out_unreg_genl;
+
+        return 0;
+
+out_unreg_genl:
+        genl_unregister_family(&tcmu_genl_family);
+out_unreg_device:
+        root_device_unregister(tcmu_root_device);
+out_free_cache:
+        kmem_cache_destroy(tcmu_cmd_cache);
+
+        return ret;
+}
+
+static void __exit tcmu_module_exit(void)
+{
+        transport_subsystem_release(&tcmu_template);
+        genl_unregister_family(&tcmu_genl_family);
+        root_device_unregister(tcmu_root_device);
+        kmem_cache_destroy(tcmu_cmd_cache);
+}
+
+MODULE_DESCRIPTION("TCM USER subsystem plugin");
+MODULE_AUTHOR("Shaohua Li <shli@kernel.org>");
+MODULE_AUTHOR("Andy Grover <agrover@redhat.com>");
+MODULE_LICENSE("GPL");
+
+module_init(tcmu_module_init);
+module_exit(tcmu_module_exit);
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index 21ce50880c79..ccee7e332a4d 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -98,7 +98,7 @@ static void ft_tport_delete(struct ft_tport *tport)
         ft_sess_delete_all(tport);
         lport = tport->lport;
         BUG_ON(tport != lport->prov[FC_TYPE_FCP]);
-        rcu_assign_pointer(lport->prov[FC_TYPE_FCP], NULL);
+        RCU_INIT_POINTER(lport->prov[FC_TYPE_FCP], NULL);
 
         tpg = tport->tpg;
         if (tpg) {
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index ef5587fe2c69..f554d25b4399 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -84,6 +84,16 @@ config THERMAL_GOV_STEP_WISE
           Enable this to manage platform thermals using a simple linear
           governor.
 
+config THERMAL_GOV_BANG_BANG
+        bool "Bang Bang thermal governor"
+        default n
+        help
+          Enable this to manage platform thermals using bang bang governor.
+
+          Say 'Y' here if you want to use two point temperature regulation
+          used for fans without throttling.  Some fan drivers depend on this
+          governor to be enabled (e.g. acerhdf).
+
 config THERMAL_GOV_USER_SPACE
         bool "User_space thermal governor"
         help
@@ -207,21 +217,6 @@ config X86_PKG_TEMP_THERMAL
           two trip points which can be set by user to get notifications via thermal
           notification methods.
 
-config ACPI_INT3403_THERMAL
-        tristate "ACPI INT3403 thermal driver"
-        depends on X86 && ACPI
-        help
-          Newer laptops and tablets that use ACPI may have thermal sensors
-          outside the core CPU/SOC for thermal safety reasons. These
-          temperature sensors are also exposed for the OS to use via the so
-          called INT3403 ACPI object. This driver will, on devices that have
-          such sensors, expose the temperature information from these sensors
-          to userspace via the normal thermal framework. This means that a wide
-          range of applications and GUI widgets can show this information to
-          the user or use this information for making decisions. For example,
-          the Intel Thermal Daemon can use this information to allow the user
-          to select his laptop to run without turning on the fans.
-
 config INTEL_SOC_DTS_THERMAL
         tristate "Intel SoCs DTS thermal driver"
         depends on X86 && IOSF_MBI
@@ -234,6 +229,30 @@ config INTEL_SOC_DTS_THERMAL
           notification methods.The other trip is a critical trip point, which
           was set by the driver based on the TJ MAX temperature.
 
+config INT340X_THERMAL
+        tristate "ACPI INT340X thermal drivers"
+        depends on X86 && ACPI
+        select THERMAL_GOV_USER_SPACE
+        select ACPI_THERMAL_REL
+        select ACPI_FAN
+        help
+          Newer laptops and tablets that use ACPI may have thermal sensors and
+          other devices with thermal control capabilities outside the core
+          CPU/SOC, for thermal safety reasons.
+          They are exposed for the OS to use via the INT3400 ACPI device object
+          as the master, and INT3401~INT340B ACPI device objects as the slaves.
+          Enable this to expose the temperature information and cooling ability
+          from these objects to userspace via the normal thermal framework.
+          This means that a wide range of applications and GUI widgets can show
+          the information to the user or use this information for making
+          decisions. For example, the Intel Thermal Daemon can use this
+          information to allow the user to select his laptop to run without
+          turning on the fans.
+
+config ACPI_THERMAL_REL
+        tristate
+        depends on ACPI
+
 menu "Texas Instruments thermal drivers"
 source "drivers/thermal/ti-soc-thermal/Kconfig"
 endmenu
diff --git a/drivers/thermal/Makefile b/drivers/thermal/Makefile
index 31e232f84b6b..39c4fe87da2f 100644
--- a/drivers/thermal/Makefile
+++ b/drivers/thermal/Makefile
@@ -11,6 +11,7 @@ thermal_sys-$(CONFIG_THERMAL_OF)		+= of-thermal.o
 
 # governors
 thermal_sys-$(CONFIG_THERMAL_GOV_FAIR_SHARE)    += fair_share.o
+thermal_sys-$(CONFIG_THERMAL_GOV_BANG_BANG)     += gov_bang_bang.o
 thermal_sys-$(CONFIG_THERMAL_GOV_STEP_WISE)     += step_wise.o
 thermal_sys-$(CONFIG_THERMAL_GOV_USER_SPACE)    += user_space.o
 
@@ -31,5 +32,5 @@ obj-$(CONFIG_INTEL_POWERCLAMP)	+= intel_powerclamp.o
 obj-$(CONFIG_X86_PKG_TEMP_THERMAL)      += x86_pkg_temp_thermal.o
 obj-$(CONFIG_INTEL_SOC_DTS_THERMAL)     += intel_soc_dts_thermal.o
 obj-$(CONFIG_TI_SOC_THERMAL)    += ti-soc-thermal/
-obj-$(CONFIG_ACPI_INT3403_THERMAL)      += int3403_thermal.o
+obj-$(CONFIG_INT340X_THERMAL)  += int340x_thermal/
 obj-$(CONFIG_ST_THERMAL)        += st/
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 1ab0018271c5..ad09e51ffae4 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -50,15 +50,14 @@ struct cpufreq_cooling_device {
         unsigned int cpufreq_state;
         unsigned int cpufreq_val;
         struct cpumask allowed_cpus;
+        struct list_head node;
 };
 static DEFINE_IDR(cpufreq_idr);
 static DEFINE_MUTEX(cooling_cpufreq_lock);
 
 static unsigned int cpufreq_dev_count;
 
-/* notify_table passes value to the CPUFREQ_ADJUST callback function. */
-#define NOTIFY_INVALID NULL
-static struct cpufreq_cooling_device *notify_device;
+static LIST_HEAD(cpufreq_dev_list);
 
 /**
  * get_idr - function to get a unique id.
@@ -287,15 +286,12 @@ static int cpufreq_apply_cooling(struct cpufreq_cooling_device *cpufreq_device,
 
         cpufreq_device->cpufreq_state = cooling_state;
         cpufreq_device->cpufreq_val = clip_freq;
-        notify_device = cpufreq_device;
 
         for_each_cpu(cpuid, mask) {
                 if (is_cpufreq_valid(cpuid))
                         cpufreq_update_policy(cpuid);
         }
 
-        notify_device = NOTIFY_INVALID;
-
         return 0;
 }
 
@@ -316,21 +312,28 @@ static int cpufreq_thermal_notifier(struct notifier_block *nb,
 {
         struct cpufreq_policy *policy = data;
         unsigned long max_freq = 0;
+        struct cpufreq_cooling_device *cpufreq_dev;
 
-        if (event != CPUFREQ_ADJUST || notify_device == NOTIFY_INVALID)
+        if (event != CPUFREQ_ADJUST)
                 return 0;
 
-        if (cpumask_test_cpu(policy->cpu, &notify_device->allowed_cpus))
-                max_freq = notify_device->cpufreq_val;
-        else
-                return 0;
+        mutex_lock(&cooling_cpufreq_lock);
+        list_for_each_entry(cpufreq_dev, &cpufreq_dev_list, node) {
+                if (!cpumask_test_cpu(policy->cpu,
+                                        &cpufreq_dev->allowed_cpus))
+                        continue;
+
+                if (!cpufreq_dev->cpufreq_val)
+                        cpufreq_dev->cpufreq_val = get_cpu_frequency(
+                                        cpumask_any(&cpufreq_dev->allowed_cpus),
+                                        cpufreq_dev->cpufreq_state);
 
-        /* Never exceed user_policy.max */
-        if (max_freq > policy->user_policy.max)
-                max_freq = policy->user_policy.max;
+                max_freq = cpufreq_dev->cpufreq_val;
 
-        if (policy->max != max_freq)
-                cpufreq_verify_within_limits(policy, 0, max_freq);
+                if (policy->max != max_freq)
+                        cpufreq_verify_within_limits(policy, 0, max_freq);
+        }
+        mutex_unlock(&cooling_cpufreq_lock);
 
         return 0;
 }
@@ -486,6 +489,7 @@ __cpufreq_cooling_register(struct device_node *np,
                 cpufreq_register_notifier(&thermal_cpufreq_notifier_block,
                                           CPUFREQ_POLICY_NOTIFIER);
         cpufreq_dev_count++;
+        list_add(&cpufreq_dev->node, &cpufreq_dev_list);
 
         mutex_unlock(&cooling_cpufreq_lock);
 
@@ -549,6 +553,7 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
 
         cpufreq_dev = cdev->devdata;
         mutex_lock(&cooling_cpufreq_lock);
+        list_del(&cpufreq_dev->node);
         cpufreq_dev_count--;
 
         /* Unregister the notifier for the last cpufreq cooling device */
diff --git a/drivers/thermal/fair_share.c b/drivers/thermal/fair_share.c
index 944ba2f340c8..6e0a3fbfae86 100644
--- a/drivers/thermal/fair_share.c
+++ b/drivers/thermal/fair_share.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/thermal.h>
+#include <trace/events/thermal.h>
 
 #include "thermal_core.h"
 
@@ -34,6 +35,7 @@ static int get_trip_level(struct thermal_zone_device *tz)
 {
         int count = 0;
         unsigned long trip_temp;
+        enum thermal_trip_type trip_type;
 
         if (tz->trips == 0 || !tz->ops->get_trip_temp)
                 return 0;
@@ -43,6 +45,16 @@ static int get_trip_level(struct thermal_zone_device *tz)
                 if (tz->temperature < trip_temp)
                         break;
         }
+
+        /*
+         * count > 0 only if temperature is greater than first trip
+         * point, in which case, trip_point = count - 1
+         */
+        if (count > 0) {
+                tz->ops->get_trip_type(tz, count - 1, &trip_type);
+                trace_thermal_zone_trip(tz, count - 1, trip_type);
+        }
+
         return count;
 }
 
diff --git a/drivers/thermal/gov_bang_bang.c b/drivers/thermal/gov_bang_bang.c
new file mode 100644
index 000000000000..c5dd76b2ee74
--- /dev/null
+++ b/drivers/thermal/gov_bang_bang.c
@@ -0,0 +1,131 @@
+/*
+ *  gov_bang_bang.c - A simple thermal throttling governor using hysteresis
+ *
+ *  Copyright (C) 2014 Peter Feuerer <peter@piie.net>
+ *
+ *  Based on step_wise.c with following Copyrights:
+ *  Copyright (C) 2012 Intel Corp
+ *  Copyright (C) 2012 Durgadoss R <durgadoss.r@intel.com>
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
+ * the GNU General Public License for more details.
+ *
+ */
+
+#include <linux/thermal.h>
+
+#include "thermal_core.h"
+
+static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
+{
+        long trip_temp;
+        unsigned long trip_hyst;
+        struct thermal_instance *instance;
+
+        tz->ops->get_trip_temp(tz, trip, &trip_temp);
+        tz->ops->get_trip_hyst(tz, trip, &trip_hyst);
+
+        dev_dbg(&tz->device, "Trip%d[temp=%ld]:temp=%d:hyst=%ld\n",
+                                trip, trip_temp, tz->temperature,
+                                trip_hyst);
+
+        mutex_lock(&tz->lock);
+
+        list_for_each_entry(instance, &tz->thermal_instances, tz_node) {
+                if (instance->trip != trip)
+                        continue;
+
+                /* in case fan is in initial state, switch the fan off */
+                if (instance->target == THERMAL_NO_TARGET)
+                        instance->target = 0;
+
+                /* in case fan is neither on nor off set the fan to active */
+                if (instance->target != 0 && instance->target != 1) {
+                        pr_warn("Thermal instance %s controlled by bang-bang has unexpected state: %ld\n",
+                                        instance->name, instance->target);
+                        instance->target = 1;
+                }
+
+                /*
+                 * enable fan when temperature exceeds trip_temp and disable
+                 * the fan in case it falls below trip_temp minus hysteresis
+                 */
+                if (instance->target == 0 && tz->temperature >= trip_temp)
+                        instance->target = 1;
+                else if (instance->target == 1 &&
+                                tz->temperature < trip_temp - trip_hyst)
+                        instance->target = 0;
+
+                dev_dbg(&instance->cdev->device, "target=%d\n",
+                                        (int)instance->target);
+
+                instance->cdev->updated = false; /* cdev needs update */
+        }
+
+        mutex_unlock(&tz->lock);
+}
+
+/**
+ * bang_bang_control - controls devices associated with the given zone
+ * @tz - thermal_zone_device
+ * @trip - the trip point
+ *
+ * Regulation Logic: a two point regulation, deliver cooling state depending
+ * on the previous state shown in this diagram:
+ *
+ *                Fan:   OFF    ON
+ *
+ *                              |
+ *                              |
+ *          trip_temp:    +---->+
+ *                        |     |        ^
+ *                        |     |        |
+ *                        |     |   Temperature
+ * (trip_temp - hyst):    +<----+
+ *                        |
+ *                        |
+ *                        |
+ *
+ *   * If the fan is not running and temperature exceeds trip_temp, the fan
+ *     gets turned on.
+ *   * In case the fan is running, temperature must fall below
+ *     (trip_temp - hyst) so that the fan gets turned off again.
+ *
+ */
+static int bang_bang_control(struct thermal_zone_device *tz, int trip)
+{
+        struct thermal_instance *instance;
+
+        thermal_zone_trip_update(tz, trip);
+
+        mutex_lock(&tz->lock);
+
+        list_for_each_entry(instance, &tz->thermal_instances, tz_node)
+                thermal_cdev_update(instance->cdev);
+
+        mutex_unlock(&tz->lock);
+
+        return 0;
+}
+
+static struct thermal_governor thermal_gov_bang_bang = {
+        .name           = "bang_bang",
+        .throttle       = bang_bang_control,
+};
+
+int thermal_gov_bang_bang_register(void)
+{
+        return thermal_register_governor(&thermal_gov_bang_bang);
+}
+
+void thermal_gov_bang_bang_unregister(void)
+{
+        thermal_unregister_governor(&thermal_gov_bang_bang);
+}
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index 2c516f2eebed..5a1f1070b702 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -19,6 +19,7 @@
 #include <linux/mfd/syscon.h>
 #include <linux/module.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/regmap.h>
 #include <linux/slab.h>
@@ -31,6 +32,11 @@
 
 #define MISC0                           0x0150
 #define MISC0_REFTOP_SELBIASOFF         (1 << 3)
+#define MISC1                           0x0160
+#define MISC1_IRQ_TEMPHIGH              (1 << 29)
+/* Below LOW and PANIC bits are only for TEMPMON_IMX6SX */
+#define MISC1_IRQ_TEMPLOW               (1 << 28)
+#define MISC1_IRQ_TEMPPANIC             (1 << 27)
 
 #define TEMPSENSE0                      0x0180
 #define TEMPSENSE0_ALARM_VALUE_SHIFT    20
@@ -43,6 +49,12 @@
 
 #define TEMPSENSE1                      0x0190
 #define TEMPSENSE1_MEASURE_FREQ         0xffff
+/* Below TEMPSENSE2 is only for TEMPMON_IMX6SX */
+#define TEMPSENSE2                      0x0290
+#define TEMPSENSE2_LOW_VALUE_SHIFT      0
+#define TEMPSENSE2_LOW_VALUE_MASK       0xfff
+#define TEMPSENSE2_PANIC_VALUE_SHIFT    16
+#define TEMPSENSE2_PANIC_VALUE_MASK     0xfff0000
 
 #define OCOTP_ANA1                      0x04e0
 
@@ -66,6 +78,21 @@ enum imx_thermal_trip {
 #define FACTOR1                         15976
 #define FACTOR2                         4297157
 
+#define TEMPMON_IMX6Q                   1
+#define TEMPMON_IMX6SX                  2
+
+struct thermal_soc_data {
+        u32 version;
+};
+
+static struct thermal_soc_data thermal_imx6q_data = {
+        .version = TEMPMON_IMX6Q,
+};
+
+static struct thermal_soc_data thermal_imx6sx_data = {
+        .version = TEMPMON_IMX6SX,
+};
+
 struct imx_thermal_data {
         struct thermal_zone_device *tz;
         struct thermal_cooling_device *cdev;
@@ -79,8 +106,21 @@ struct imx_thermal_data {
         bool irq_enabled;
         int irq;
         struct clk *thermal_clk;
+        const struct thermal_soc_data *socdata;
 };
 
+static void imx_set_panic_temp(struct imx_thermal_data *data,
+                               signed long panic_temp)
+{
+        struct regmap *map = data->tempmon;
+        int critical_value;
+
+        critical_value = (data->c2 - panic_temp) / data->c1;
+        regmap_write(map, TEMPSENSE2 + REG_CLR, TEMPSENSE2_PANIC_VALUE_MASK);
+        regmap_write(map, TEMPSENSE2 + REG_SET, critical_value <<
+                        TEMPSENSE2_PANIC_VALUE_SHIFT);
+}
+
 static void imx_set_alarm_temp(struct imx_thermal_data *data,
                                signed long alarm_temp)
 {
@@ -142,13 +182,17 @@ static int imx_get_temp(struct thermal_zone_device *tz, unsigned long *temp)
         /* See imx_get_sensor_data() for formula derivation */
         *temp = data->c2 - n_meas * data->c1;
 
-        /* Update alarm value to next higher trip point */
-        if (data->alarm_temp == data->temp_passive && *temp >= data->temp_passive)
-                imx_set_alarm_temp(data, data->temp_critical);
-        if (data->alarm_temp == data->temp_critical && *temp < data->temp_passive) {
-                imx_set_alarm_temp(data, data->temp_passive);
-                dev_dbg(&tz->device, "thermal alarm off: T < %lu\n",
-                        data->alarm_temp / 1000);
+        /* Update alarm value to next higher trip point for TEMPMON_IMX6Q */
+        if (data->socdata->version == TEMPMON_IMX6Q) {
+                if (data->alarm_temp == data->temp_passive &&
+                        *temp >= data->temp_passive)
+                        imx_set_alarm_temp(data, data->temp_critical);
+                if (data->alarm_temp == data->temp_critical &&
+                        *temp < data->temp_passive) {
+                        imx_set_alarm_temp(data, data->temp_passive);
+                        dev_dbg(&tz->device, "thermal alarm off: T < %lu\n",
+                                data->alarm_temp / 1000);
+                }
         }
 
         if (*temp != data->last_temp) {
@@ -398,14 +442,27 @@ static irqreturn_t imx_thermal_alarm_irq_thread(int irq, void *dev)
         return IRQ_HANDLED;
 }
 
+static const struct of_device_id of_imx_thermal_match[] = {
+        { .compatible = "fsl,imx6q-tempmon", .data = &thermal_imx6q_data, },
+        { .compatible = "fsl,imx6sx-tempmon", .data = &thermal_imx6sx_data, },
+        { /* end */ }
+};
+MODULE_DEVICE_TABLE(of, of_imx_thermal_match);
+
 static int imx_thermal_probe(struct platform_device *pdev)
 {
+        const struct of_device_id *of_id =
+                of_match_device(of_imx_thermal_match, &pdev->dev);
         struct imx_thermal_data *data;
         struct cpumask clip_cpus;
         struct regmap *map;
         int measure_freq;
         int ret;
 
+        if (!cpufreq_get_current_driver()) {
+                dev_dbg(&pdev->dev, "no cpufreq driver!");
+                return -EPROBE_DEFER;
+        }
         data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
@@ -418,6 +475,20 @@ static int imx_thermal_probe(struct platform_device *pdev)
         }
         data->tempmon = map;
 
+        data->socdata = of_id->data;
+
+        /* make sure the IRQ flag is clear before enabling irq on i.MX6SX */
+        if (data->socdata->version == TEMPMON_IMX6SX) {
+                regmap_write(map, MISC1 + REG_CLR, MISC1_IRQ_TEMPHIGH |
+                        MISC1_IRQ_TEMPLOW | MISC1_IRQ_TEMPPANIC);
+                /*
+                 * reset value of LOW ALARM is incorrect, set it to lowest
+                 * value to avoid false trigger of low alarm.
+                 */
+                regmap_write(map, TEMPSENSE2 + REG_SET,
+                        TEMPSENSE2_LOW_VALUE_MASK);
+        }
+
         data->irq = platform_get_irq(pdev, 0);
         if (data->irq < 0)
                 return data->irq;
@@ -454,6 +525,30 @@ static int imx_thermal_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        data->thermal_clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(data->thermal_clk)) {
+                ret = PTR_ERR(data->thermal_clk);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(&pdev->dev,
+                                "failed to get thermal clk: %d\n", ret);
+                cpufreq_cooling_unregister(data->cdev);
+                return ret;
+        }
+
+        /*
+         * Thermal sensor needs clk on to get correct value, normally
+         * we should enable its clk before taking measurement and disable
+         * clk after measurement is done, but if alarm function is enabled,
+         * hardware will auto measure the temperature periodically, so we
+         * need to keep the clk always on for alarm function.
+         */
+        ret = clk_prepare_enable(data->thermal_clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to enable thermal clk: %d\n", ret);
+                cpufreq_cooling_unregister(data->cdev);
+                return ret;
+        }
+
         data->tz = thermal_zone_device_register("imx_thermal_zone",
                                                 IMX_TRIP_NUM,
                                                 BIT(IMX_TRIP_PASSIVE), data,
@@ -464,31 +559,20 @@ static int imx_thermal_probe(struct platform_device *pdev)
                 ret = PTR_ERR(data->tz);
                 dev_err(&pdev->dev,
                         "failed to register thermal zone device %d\n", ret);
+                clk_disable_unprepare(data->thermal_clk);
                 cpufreq_cooling_unregister(data->cdev);
                 return ret;
         }
 
-        data->thermal_clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(data->thermal_clk)) {
-                dev_warn(&pdev->dev, "failed to get thermal clk!\n");
-        } else {
-                /*
-                 * Thermal sensor needs clk on to get correct value, normally
-                 * we should enable its clk before taking measurement and disable
-                 * clk after measurement is done, but if alarm function is enabled,
-                 * hardware will auto measure the temperature periodically, so we
-                 * need to keep the clk always on for alarm function.
-                 */
-                ret = clk_prepare_enable(data->thermal_clk);
-                if (ret)
-                        dev_warn(&pdev->dev, "failed to enable thermal clk: %d\n", ret);
-        }
-
         /* Enable measurements at ~ 10 Hz */
         regmap_write(map, TEMPSENSE1 + REG_CLR, TEMPSENSE1_MEASURE_FREQ);
         measure_freq = DIV_ROUND_UP(32768, 10); /* 10 Hz */
         regmap_write(map, TEMPSENSE1 + REG_SET, measure_freq);
         imx_set_alarm_temp(data, data->temp_passive);
+
+        if (data->socdata->version == TEMPMON_IMX6SX)
+                imx_set_panic_temp(data, data->temp_critical);
+
         regmap_write(map, TEMPSENSE0 + REG_CLR, TEMPSENSE0_POWER_DOWN);
         regmap_write(map, TEMPSENSE0 + REG_SET, TEMPSENSE0_MEASURE_TEMP);
 
@@ -550,12 +634,6 @@ static int imx_thermal_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(imx_thermal_pm_ops,
                          imx_thermal_suspend, imx_thermal_resume);
 
-static const struct of_device_id of_imx_thermal_match[] = {
-        { .compatible = "fsl,imx6q-tempmon", },
-        { /* end */ }
-};
-MODULE_DEVICE_TABLE(of, of_imx_thermal_match);
-
 static struct platform_driver imx_thermal = {
         .driver = {
                 .name   = "imx_thermal",
diff --git a/drivers/thermal/int3403_thermal.c b/drivers/thermal/int3403_thermal.c
deleted file mode 100644
index 17554eeb3953..000000000000
--- a/drivers/thermal/int3403_thermal.c
+++ /dev/null
@@ -1,296 +0,0 @@
-/*
- * ACPI INT3403 thermal driver
- * Copyright (c) 2013, Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/types.h>
-#include <linux/acpi.h>
-#include <linux/thermal.h>
-
-#define INT3403_TYPE_SENSOR             0x03
-#define INT3403_PERF_CHANGED_EVENT      0x80
-#define INT3403_THERMAL_EVENT           0x90
-
-#define DECI_KELVIN_TO_MILLI_CELSIUS(t, off) (((t) - (off)) * 100)
-#define KELVIN_OFFSET   2732
-#define MILLI_CELSIUS_TO_DECI_KELVIN(t, off) (((t) / 100) + (off))
-
-#define ACPI_INT3403_CLASS              "int3403"
-#define ACPI_INT3403_FILE_STATE         "state"
-
-struct int3403_sensor {
-        struct thermal_zone_device *tzone;
-        unsigned long *thresholds;
-        unsigned long   crit_temp;
-        int             crit_trip_id;
-        unsigned long   psv_temp;
-        int             psv_trip_id;
-};
-
-static int sys_get_curr_temp(struct thermal_zone_device *tzone,
-                                unsigned long *temp)
-{
-        struct acpi_device *device = tzone->devdata;
-        unsigned long long tmp;
-        acpi_status status;
-
-        status = acpi_evaluate_integer(device->handle, "_TMP", NULL, &tmp);
-        if (ACPI_FAILURE(status))
-                return -EIO;
-
-        *temp = DECI_KELVIN_TO_MILLI_CELSIUS(tmp, KELVIN_OFFSET);
-
-        return 0;
-}
-
-static int sys_get_trip_hyst(struct thermal_zone_device *tzone,
-                int trip, unsigned long *temp)
-{
-        struct acpi_device *device = tzone->devdata;
-        unsigned long long hyst;
-        acpi_status status;
-
-        status = acpi_evaluate_integer(device->handle, "GTSH", NULL, &hyst);
-        if (ACPI_FAILURE(status))
-                return -EIO;
-
-        /*
-         * Thermal hysteresis represents a temperature difference.
-         * Kelvin and Celsius have same degree size. So the
-         * conversion here between tenths of degree Kelvin unit
-         * and Milli-Celsius unit is just to multiply 100.
-         */
-        *temp = hyst * 100;
-
-        return 0;
-}
-
-static int sys_get_trip_temp(struct thermal_zone_device *tzone,
-                int trip, unsigned long *temp)
-{
-        struct acpi_device *device = tzone->devdata;
-        struct int3403_sensor *obj = acpi_driver_data(device);
-
-        if (trip == obj->crit_trip_id)
-                *temp = obj->crit_temp;
-        else if (trip == obj->psv_trip_id)
-                *temp = obj->psv_temp;
-        else {
-                /*
-                 * get_trip_temp is a mandatory callback but
-                 * PATx method doesn't return any value, so return
-                 * cached value, which was last set from user space.
-                 */
-                *temp = obj->thresholds[trip];
-        }
-
-        return 0;
-}
-
-static int sys_get_trip_type(struct thermal_zone_device *thermal,
-                int trip, enum thermal_trip_type *type)
-{
-        struct acpi_device *device = thermal->devdata;
-        struct int3403_sensor *obj = acpi_driver_data(device);
-
-        /* Mandatory callback, may not mean much here */
-        if (trip == obj->crit_trip_id)
-                *type = THERMAL_TRIP_CRITICAL;
-        else
-                *type = THERMAL_TRIP_PASSIVE;
-
-        return 0;
-}
-
-int sys_set_trip_temp(struct thermal_zone_device *tzone, int trip,
-                                                        unsigned long temp)
-{
-        struct acpi_device *device = tzone->devdata;
-        acpi_status status;
-        char name[10];
-        int ret = 0;
-        struct int3403_sensor *obj = acpi_driver_data(device);
-
-        snprintf(name, sizeof(name), "PAT%d", trip);
-        if (acpi_has_method(device->handle, name)) {
-                status = acpi_execute_simple_method(device->handle, name,
-                                MILLI_CELSIUS_TO_DECI_KELVIN(temp,
-                                                        KELVIN_OFFSET));
-                if (ACPI_FAILURE(status))
-                        ret = -EIO;
-                else
-                        obj->thresholds[trip] = temp;
-        } else {
-                ret = -EIO;
-                dev_err(&device->dev, "sys_set_trip_temp: method not found\n");
-        }
-
-        return ret;
-}
-
-static struct thermal_zone_device_ops tzone_ops = {
-        .get_temp = sys_get_curr_temp,
-        .get_trip_temp = sys_get_trip_temp,
-        .get_trip_type = sys_get_trip_type,
-        .set_trip_temp = sys_set_trip_temp,
-        .get_trip_hyst =  sys_get_trip_hyst,
-};
-
-static void acpi_thermal_notify(struct acpi_device *device, u32 event)
-{
-        struct int3403_sensor *obj;
-
-        if (!device)
-                return;
-
-        obj = acpi_driver_data(device);
-        if (!obj)
-                return;
-
-        switch (event) {
-        case INT3403_PERF_CHANGED_EVENT:
-                break;
-        case INT3403_THERMAL_EVENT:
-                thermal_zone_device_update(obj->tzone);
-                break;
-        default:
-                dev_err(&device->dev, "Unsupported event [0x%x]\n", event);
-                break;
-        }
-}
-
-static int sys_get_trip_crt(struct acpi_device *device, unsigned long *temp)
-{
-        unsigned long long crt;
-        acpi_status status;
-
-        status = acpi_evaluate_integer(device->handle, "_CRT", NULL, &crt);
-        if (ACPI_FAILURE(status))
-                return -EIO;
-
-        *temp = DECI_KELVIN_TO_MILLI_CELSIUS(crt, KELVIN_OFFSET);
-
-        return 0;
-}
-
-static int sys_get_trip_psv(struct acpi_device *device, unsigned long *temp)
-{
-        unsigned long long psv;
-        acpi_status status;
-
-        status = acpi_evaluate_integer(device->handle, "_PSV", NULL, &psv);
-        if (ACPI_FAILURE(status))
-                return -EIO;
-
-        *temp = DECI_KELVIN_TO_MILLI_CELSIUS(psv, KELVIN_OFFSET);
-
-        return 0;
-}
-
-static int acpi_int3403_add(struct acpi_device *device)
-{
-        int result = 0;
-        unsigned long long ptyp;
-        acpi_status status;
-        struct int3403_sensor *obj;
-        unsigned long long trip_cnt;
-        int trip_mask = 0;
-
-        if (!device)
-                return -EINVAL;
-
-        status = acpi_evaluate_integer(device->handle, "PTYP", NULL, &ptyp);
-        if (ACPI_FAILURE(status))
-                return -EINVAL;
-
-        if (ptyp != INT3403_TYPE_SENSOR)
-                return -EINVAL;
-
-        obj = devm_kzalloc(&device->dev, sizeof(*obj), GFP_KERNEL);
-        if (!obj)
-                return -ENOMEM;
-
-        device->driver_data = obj;
-
-        status = acpi_evaluate_integer(device->handle, "PATC", NULL,
-                                                &trip_cnt);
-        if (ACPI_FAILURE(status))
-                trip_cnt = 0;
-
-        if (trip_cnt) {
-                /* We have to cache, thresholds can't be readback */
-                obj->thresholds = devm_kzalloc(&device->dev,
-                                        sizeof(*obj->thresholds) * trip_cnt,
-                                        GFP_KERNEL);
-                if (!obj->thresholds)
-                        return -ENOMEM;
-                trip_mask = BIT(trip_cnt) - 1;
-        }
-
-        obj->psv_trip_id = -1;
-        if (!sys_get_trip_psv(device, &obj->psv_temp))
-                obj->psv_trip_id = trip_cnt++;
-
-        obj->crit_trip_id = -1;
-        if (!sys_get_trip_crt(device, &obj->crit_temp))
-                obj->crit_trip_id = trip_cnt++;
-
-        obj->tzone = thermal_zone_device_register(acpi_device_bid(device),
-                                trip_cnt, trip_mask, device, &tzone_ops,
-                                NULL, 0, 0);
-        if (IS_ERR(obj->tzone)) {
-                result = PTR_ERR(obj->tzone);
-                return result;
-        }
-
-        strcpy(acpi_device_name(device), "INT3403");
-        strcpy(acpi_device_class(device), ACPI_INT3403_CLASS);
-
-        return 0;
-}
-
-static int acpi_int3403_remove(struct acpi_device *device)
-{
-        struct int3403_sensor *obj;
-
-        obj = acpi_driver_data(device);
-        thermal_zone_device_unregister(obj->tzone);
-
-        return 0;
-}
-
-ACPI_MODULE_NAME("int3403");
-static const struct acpi_device_id int3403_device_ids[] = {
-        {"INT3403", 0},
-        {"", 0},
-};
-MODULE_DEVICE_TABLE(acpi, int3403_device_ids);
-
-static struct acpi_driver acpi_int3403_driver = {
-        .name = "INT3403",
-        .class = ACPI_INT3403_CLASS,
-        .ids = int3403_device_ids,
-        .ops = {
-                .add = acpi_int3403_add,
-                .remove = acpi_int3403_remove,
-                .notify = acpi_thermal_notify,
-                },
-};
-
-module_acpi_driver(acpi_int3403_driver);
-
-MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>");
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("ACPI INT3403 thermal driver");
diff --git a/drivers/thermal/int340x_thermal/Makefile b/drivers/thermal/int340x_thermal/Makefile
new file mode 100644
index 000000000000..ffe40bffaf1a
--- /dev/null
+++ b/drivers/thermal/int340x_thermal/Makefile
@@ -0,0 +1,4 @@
+obj-$(CONFIG_INT340X_THERMAL)   += int3400_thermal.o
+obj-$(CONFIG_INT340X_THERMAL)   += int3402_thermal.o
+obj-$(CONFIG_INT340X_THERMAL)   += int3403_thermal.o
+obj-$(CONFIG_ACPI_THERMAL_REL)  += acpi_thermal_rel.o
diff --git a/drivers/thermal/int340x_thermal/acpi_thermal_rel.c b/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
new file mode 100644
index 000000000000..0d8db808f0ae
--- /dev/null
+++ b/drivers/thermal/int340x_thermal/acpi_thermal_rel.c
@@ -0,0 +1,400 @@
+/* acpi_thermal_rel.c driver for exporting ACPI thermal relationship
+ *
+ * Copyright (c) 2014 Intel Corp
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ */
+
+/*
+ * Two functionalities included:
+ * 1. Export _TRT, _ART, via misc device interface to the userspace.
+ * 2. Provide parsing result to kernel drivers
+ *
+ */
+#include <linux/init.h>
+#include <linux/export.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/acpi.h>
+#include <linux/uaccess.h>
+#include <linux/miscdevice.h>
+#include "acpi_thermal_rel.h"
+
+static acpi_handle acpi_thermal_rel_handle;
+static DEFINE_SPINLOCK(acpi_thermal_rel_chrdev_lock);
+static int acpi_thermal_rel_chrdev_count;       /* #times opened */
+static int acpi_thermal_rel_chrdev_exclu;       /* already open exclusive? */
+
+static int acpi_thermal_rel_open(struct inode *inode, struct file *file)
+{
+        spin_lock(&acpi_thermal_rel_chrdev_lock);
+        if (acpi_thermal_rel_chrdev_exclu ||
+            (acpi_thermal_rel_chrdev_count && (file->f_flags & O_EXCL))) {
+                spin_unlock(&acpi_thermal_rel_chrdev_lock);
+                return -EBUSY;
+        }
+
+        if (file->f_flags & O_EXCL)
+                acpi_thermal_rel_chrdev_exclu = 1;
+        acpi_thermal_rel_chrdev_count++;
+
+        spin_unlock(&acpi_thermal_rel_chrdev_lock);
+
+        return nonseekable_open(inode, file);
+}
+
+static int acpi_thermal_rel_release(struct inode *inode, struct file *file)
+{
+        spin_lock(&acpi_thermal_rel_chrdev_lock);
+        acpi_thermal_rel_chrdev_count--;
+        acpi_thermal_rel_chrdev_exclu = 0;
+        spin_unlock(&acpi_thermal_rel_chrdev_lock);
+
+        return 0;
+}
+
+/**
+ * acpi_parse_trt - Thermal Relationship Table _TRT for passive cooling
+ *
+ * @handle: ACPI handle of the device contains _TRT
+ * @art_count: the number of valid entries resulted from parsing _TRT
+ * @artp: pointer to pointer of array of art entries in parsing result
+ * @create_dev: whether to create platform devices for target and source
+ *
+ */
+int acpi_parse_trt(acpi_handle handle, int *trt_count, struct trt **trtp,
+                bool create_dev)
+{
+        acpi_status status;
+        int result = 0;
+        int i;
+        int nr_bad_entries = 0;
+        struct trt *trts;
+        struct acpi_device *adev;
+        union acpi_object *p;
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+        struct acpi_buffer element = { 0, NULL };
+        struct acpi_buffer trt_format = { sizeof("RRNNNNNN"), "RRNNNNNN" };
+
+        if (!acpi_has_method(handle, "_TRT"))
+                return 0;
+
+        status = acpi_evaluate_object(handle, "_TRT", NULL, &buffer);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+
+        p = buffer.pointer;
+        if (!p || (p->type != ACPI_TYPE_PACKAGE)) {
+                pr_err("Invalid _TRT data\n");
+                result = -EFAULT;
+                goto end;
+        }
+
+        *trt_count = p->package.count;
+        trts = kzalloc(*trt_count * sizeof(struct trt), GFP_KERNEL);
+        if (!trts) {
+                result = -ENOMEM;
+                goto end;
+        }
+
+        for (i = 0; i < *trt_count; i++) {
+                struct trt *trt = &trts[i - nr_bad_entries];
+
+                element.length = sizeof(struct trt);
+                element.pointer = trt;
+
+                status = acpi_extract_package(&(p->package.elements[i]),
+                                              &trt_format, &element);
+                if (ACPI_FAILURE(status)) {
+                        nr_bad_entries++;
+                        pr_warn("_TRT package %d is invalid, ignored\n", i);
+                        continue;
+                }
+                if (!create_dev)
+                        continue;
+
+                result = acpi_bus_get_device(trt->source, &adev);
+                if (!result)
+                        acpi_create_platform_device(adev);
+                else
+                        pr_warn("Failed to get source ACPI device\n");
+
+                result = acpi_bus_get_device(trt->target, &adev);
+                if (!result)
+                        acpi_create_platform_device(adev);
+                else
+                        pr_warn("Failed to get target ACPI device\n");
+        }
+
+        *trtp = trts;
+        /* don't count bad entries */
+        *trt_count -= nr_bad_entries;
+end:
+        kfree(buffer.pointer);
+        return result;
+}
+EXPORT_SYMBOL(acpi_parse_trt);
+
+/**
+ * acpi_parse_art - Parse Active Relationship Table _ART
+ *
+ * @handle: ACPI handle of the device contains _ART
+ * @art_count: the number of valid entries resulted from parsing _ART
+ * @artp: pointer to pointer of array of art entries in parsing result
+ * @create_dev: whether to create platform devices for target and source
+ *
+ */
+int acpi_parse_art(acpi_handle handle, int *art_count, struct art **artp,
+                bool create_dev)
+{
+        acpi_status status;
+        int result = 0;
+        int i;
+        int nr_bad_entries = 0;
+        struct art *arts;
+        struct acpi_device *adev;
+        union acpi_object *p;
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+        struct acpi_buffer element = { 0, NULL };
+        struct acpi_buffer art_format = {
+                sizeof("RRNNNNNNNNNNN"), "RRNNNNNNNNNNN" };
+
+        if (!acpi_has_method(handle, "_ART"))
+                return 0;
+
+        status = acpi_evaluate_object(handle, "_ART", NULL, &buffer);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+
+        p = buffer.pointer;
+        if (!p || (p->type != ACPI_TYPE_PACKAGE)) {
+                pr_err("Invalid _ART data\n");
+                result = -EFAULT;
+                goto end;
+        }
+
+        /* ignore p->package.elements[0], as this is _ART Revision field */
+        *art_count = p->package.count - 1;
+        arts = kzalloc(*art_count * sizeof(struct art), GFP_KERNEL);
+        if (!arts) {
+                result = -ENOMEM;
+                goto end;
+        }
+
+        for (i = 0; i < *art_count; i++) {
+                struct art *art = &arts[i - nr_bad_entries];
+
+                element.length = sizeof(struct art);
+                element.pointer = art;
+
+                status = acpi_extract_package(&(p->package.elements[i + 1]),
+                                              &art_format, &element);
+                if (ACPI_FAILURE(status)) {
+                        pr_warn("_ART package %d is invalid, ignored", i);
+                        nr_bad_entries++;
+                        continue;
+                }
+                if (!create_dev)
+                        continue;
+
+                if (art->source) {
+                        result = acpi_bus_get_device(art->source, &adev);
+                        if (!result)
+                                acpi_create_platform_device(adev);
+                        else
+                                pr_warn("Failed to get source ACPI device\n");
+                }
+                if (art->target) {
+                        result = acpi_bus_get_device(art->target, &adev);
+                        if (!result)
+                                acpi_create_platform_device(adev);
+                        else
+                                pr_warn("Failed to get source ACPI device\n");
+                }
+        }
+
+        *artp = arts;
+        /* don't count bad entries */
+        *art_count -= nr_bad_entries;
+end:
+        kfree(buffer.pointer);
+        return result;
+}
+EXPORT_SYMBOL(acpi_parse_art);
+
+
+/* get device name from acpi handle */
+static void get_single_name(acpi_handle handle, char *name)
+{
+        struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER};
+
+        if (ACPI_FAILURE(acpi_get_name(handle, ACPI_SINGLE_NAME, &buffer)))
+                pr_warn("Failed get name from handle\n");
+        else {
+                memcpy(name, buffer.pointer, ACPI_NAME_SIZE);
+                kfree(buffer.pointer);
+        }
+}
+
+static int fill_art(char __user *ubuf)
+{
+        int i;
+        int ret;
+        int count;
+        int art_len;
+        struct art *arts = NULL;
+        union art_object *art_user;
+
+        ret = acpi_parse_art(acpi_thermal_rel_handle, &count, &arts, false);
+        if (ret)
+                goto free_art;
+        art_len = count * sizeof(union art_object);
+        art_user = kzalloc(art_len, GFP_KERNEL);
+        if (!art_user) {
+                ret = -ENOMEM;
+                goto free_art;
+        }
+        /* now fill in user art data */
+        for (i = 0; i < count; i++) {
+                /* userspace art needs device name instead of acpi reference */
+                get_single_name(arts[i].source, art_user[i].source_device);
+                get_single_name(arts[i].target, art_user[i].target_device);
+                /* copy the rest int data in addition to source and target */
+                memcpy(&art_user[i].weight, &arts[i].weight,
+                        sizeof(u64) * (ACPI_NR_ART_ELEMENTS - 2));
+        }
+
+        if (copy_to_user(ubuf, art_user, art_len))
+                ret = -EFAULT;
+        kfree(art_user);
+free_art:
+        kfree(arts);
+        return ret;
+}
+
+static int fill_trt(char __user *ubuf)
+{
+        int i;
+        int ret;
+        int count;
+        int trt_len;
+        struct trt *trts = NULL;
+        union trt_object *trt_user;
+
+        ret = acpi_parse_trt(acpi_thermal_rel_handle, &count, &trts, false);
+        if (ret)
+                goto free_trt;
+        trt_len = count * sizeof(union trt_object);
+        trt_user = kzalloc(trt_len, GFP_KERNEL);
+        if (!trt_user) {
+                ret = -ENOMEM;
+                goto free_trt;
+        }
+        /* now fill in user trt data */
+        for (i = 0; i < count; i++) {
+                /* userspace trt needs device name instead of acpi reference */
+                get_single_name(trts[i].source, trt_user[i].source_device);
+                get_single_name(trts[i].target, trt_user[i].target_device);
+                trt_user[i].sample_period = trts[i].sample_period;
+                trt_user[i].influence = trts[i].influence;
+        }
+
+        if (copy_to_user(ubuf, trt_user, trt_len))
+                ret = -EFAULT;
+        kfree(trt_user);
+free_trt:
+        kfree(trts);
+        return ret;
+}
+
+static long acpi_thermal_rel_ioctl(struct file *f, unsigned int cmd,
+                                   unsigned long __arg)
+{
+        int ret = 0;
+        unsigned long length = 0;
+        unsigned long count = 0;
+        char __user *arg = (void __user *)__arg;
+        struct trt *trts;
+        struct art *arts;
+
+        switch (cmd) {
+        case ACPI_THERMAL_GET_TRT_COUNT:
+                ret = acpi_parse_trt(acpi_thermal_rel_handle, (int *)&count,
+                                &trts, false);
+                kfree(trts);
+                if (!ret)
+                        return put_user(count, (unsigned long __user *)__arg);
+                return ret;
+        case ACPI_THERMAL_GET_TRT_LEN:
+                ret = acpi_parse_trt(acpi_thermal_rel_handle, (int *)&count,
+                                &trts, false);
+                kfree(trts);
+                length = count * sizeof(union trt_object);
+                if (!ret)
+                        return put_user(length, (unsigned long __user *)__arg);
+                return ret;
+        case ACPI_THERMAL_GET_TRT:
+                return fill_trt(arg);
+        case ACPI_THERMAL_GET_ART_COUNT:
+                ret = acpi_parse_art(acpi_thermal_rel_handle, (int *)&count,
+                                &arts, false);
+                kfree(arts);
+                if (!ret)
+                        return put_user(count, (unsigned long __user *)__arg);
+                return ret;
+        case ACPI_THERMAL_GET_ART_LEN:
+                ret = acpi_parse_art(acpi_thermal_rel_handle, (int *)&count,
+                                &arts, false);
+                kfree(arts);
+                length = count * sizeof(union art_object);
+                if (!ret)
+                        return put_user(length, (unsigned long __user *)__arg);
+                return ret;
+
+        case ACPI_THERMAL_GET_ART:
+                return fill_art(arg);
+
+        default:
+                return -ENOTTY;
+        }
+}
+
+static const struct file_operations acpi_thermal_rel_fops = {
+        .owner          = THIS_MODULE,
+        .open           = acpi_thermal_rel_open,
+        .release        = acpi_thermal_rel_release,
+        .unlocked_ioctl = acpi_thermal_rel_ioctl,
+        .llseek         = no_llseek,
+};
+
+static struct miscdevice acpi_thermal_rel_misc_device = {
+        .minor  = MISC_DYNAMIC_MINOR,
+        "acpi_thermal_rel",
+        &acpi_thermal_rel_fops
+};
+
+int acpi_thermal_rel_misc_device_add(acpi_handle handle)
+{
+        acpi_thermal_rel_handle = handle;
+
+        return misc_register(&acpi_thermal_rel_misc_device);
+}
+EXPORT_SYMBOL(acpi_thermal_rel_misc_device_add);
+
+int acpi_thermal_rel_misc_device_remove(acpi_handle handle)
+{
+        misc_deregister(&acpi_thermal_rel_misc_device);
+
+        return 0;
+}
+EXPORT_SYMBOL(acpi_thermal_rel_misc_device_remove);
+
+MODULE_AUTHOR("Zhang Rui <rui.zhang@intel.com>");
+MODULE_AUTHOR("Jacob Pan <jacob.jun.pan@intel.com");
+MODULE_DESCRIPTION("Intel acpi thermal rel misc dev driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/thermal/int340x_thermal/acpi_thermal_rel.h b/drivers/thermal/int340x_thermal/acpi_thermal_rel.h
new file mode 100644
index 000000000000..f00700bc9d79
--- /dev/null
+++ b/drivers/thermal/int340x_thermal/acpi_thermal_rel.h
@@ -0,0 +1,84 @@
+#ifndef __ACPI_ACPI_THERMAL_H
+#define __ACPI_ACPI_THERMAL_H
+
+#include <asm/ioctl.h>
+
+#define ACPI_THERMAL_MAGIC 's'
+
+#define ACPI_THERMAL_GET_TRT_LEN _IOR(ACPI_THERMAL_MAGIC, 1, unsigned long)
+#define ACPI_THERMAL_GET_ART_LEN _IOR(ACPI_THERMAL_MAGIC, 2, unsigned long)
+#define ACPI_THERMAL_GET_TRT_COUNT _IOR(ACPI_THERMAL_MAGIC, 3, unsigned long)
+#define ACPI_THERMAL_GET_ART_COUNT _IOR(ACPI_THERMAL_MAGIC, 4, unsigned long)
+
+#define ACPI_THERMAL_GET_TRT    _IOR(ACPI_THERMAL_MAGIC, 5, unsigned long)
+#define ACPI_THERMAL_GET_ART    _IOR(ACPI_THERMAL_MAGIC, 6, unsigned long)
+
+struct art {
+        acpi_handle source;
+        acpi_handle target;
+        u64 weight;
+        u64 ac0_max;
+        u64 ac1_max;
+        u64 ac2_max;
+        u64 ac3_max;
+        u64 ac4_max;
+        u64 ac5_max;
+        u64 ac6_max;
+        u64 ac7_max;
+        u64 ac8_max;
+        u64 ac9_max;
+} __packed;
+
+struct trt {
+        acpi_handle source;
+        acpi_handle target;
+        u64 influence;
+        u64 sample_period;
+        u64 reverved1;
+        u64 reverved2;
+        u64 reverved3;
+        u64 reverved4;
+} __packed;
+
+#define ACPI_NR_ART_ELEMENTS 13
+/* for usrspace */
+union art_object {
+        struct {
+                char source_device[8]; /* ACPI single name */
+                char target_device[8]; /* ACPI single name */
+                u64 weight;
+                u64 ac0_max_level;
+                u64 ac1_max_level;
+                u64 ac2_max_level;
+                u64 ac3_max_level;
+                u64 ac4_max_level;
+                u64 ac5_max_level;
+                u64 ac6_max_level;
+                u64 ac7_max_level;
+                u64 ac8_max_level;
+                u64 ac9_max_level;
+        };
+        u64 __data[ACPI_NR_ART_ELEMENTS];
+};
+
+union trt_object {
+        struct {
+                char source_device[8]; /* ACPI single name */
+                char target_device[8]; /* ACPI single name */
+                u64 influence;
+                u64 sample_period;
+                u64 reserved[4];
+        };
+        u64 __data[8];
+};
+
+#ifdef __KERNEL__
+int acpi_thermal_rel_misc_device_add(acpi_handle handle);
+int acpi_thermal_rel_misc_device_remove(acpi_handle handle);
+int acpi_parse_art(acpi_handle handle, int *art_count, struct art **arts,
+                bool create_dev);
+int acpi_parse_trt(acpi_handle handle, int *trt_count, struct trt **trts,
+                bool create_dev);
+#endif
+
+#endif /* __ACPI_ACPI_THERMAL_H */
diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
new file mode 100644
index 000000000000..edc1cce117ba
--- /dev/null
+++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
@@ -0,0 +1,271 @@
+/*
+ * INT3400 thermal driver
+ *
+ * Copyright (C) 2014, Intel Corporation
+ * Authors: Zhang Rui <rui.zhang@intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/acpi.h>
+#include <linux/thermal.h>
+#include "acpi_thermal_rel.h"
+
+enum int3400_thermal_uuid {
+        INT3400_THERMAL_PASSIVE_1,
+        INT3400_THERMAL_PASSIVE_2,
+        INT3400_THERMAL_ACTIVE,
+        INT3400_THERMAL_CRITICAL,
+        INT3400_THERMAL_COOLING_MODE,
+        INT3400_THERMAL_MAXIMUM_UUID,
+};
+
+static u8 *int3400_thermal_uuids[INT3400_THERMAL_MAXIMUM_UUID] = {
+        "42A441D6-AE6A-462b-A84B-4A8CE79027D3",
+        "9E04115A-AE87-4D1C-9500-0F3E340BFE75",
+        "3A95C389-E4B8-4629-A526-C52C88626BAE",
+        "97C68AE7-15FA-499c-B8C9-5DA81D606E0A",
+        "16CAF1B7-DD38-40ed-B1C1-1B8A1913D531",
+};
+
+struct int3400_thermal_priv {
+        struct acpi_device *adev;
+        struct thermal_zone_device *thermal;
+        int mode;
+        int art_count;
+        struct art *arts;
+        int trt_count;
+        struct trt *trts;
+        u8 uuid_bitmap;
+        int rel_misc_dev_res;
+};
+
+static int int3400_thermal_get_uuids(struct int3400_thermal_priv *priv)
+{
+        struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER, NULL};
+        union acpi_object *obja, *objb;
+        int i, j;
+        int result = 0;
+        acpi_status status;
+
+        status = acpi_evaluate_object(priv->adev->handle, "IDSP", NULL, &buf);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+
+        obja = (union acpi_object *)buf.pointer;
+        if (obja->type != ACPI_TYPE_PACKAGE) {
+                result = -EINVAL;
+                goto end;
+        }
+
+        for (i = 0; i < obja->package.count; i++) {
+                objb = &obja->package.elements[i];
+                if (objb->type != ACPI_TYPE_BUFFER) {
+                        result = -EINVAL;
+                        goto end;
+                }
+
+                /* UUID must be 16 bytes */
+                if (objb->buffer.length != 16) {
+                        result = -EINVAL;
+                        goto end;
+                }
+
+                for (j = 0; j < INT3400_THERMAL_MAXIMUM_UUID; j++) {
+                        u8 uuid[16];
+
+                        acpi_str_to_uuid(int3400_thermal_uuids[j], uuid);
+                        if (!strncmp(uuid, objb->buffer.pointer, 16)) {
+                                priv->uuid_bitmap |= (1 << j);
+                                break;
+                        }
+                }
+        }
+
+end:
+        kfree(buf.pointer);
+        return result;
+}
+
+static int int3400_thermal_run_osc(acpi_handle handle,
+                                enum int3400_thermal_uuid uuid, bool enable)
+{
+        u32 ret, buf[2];
+        acpi_status status;
+        int result = 0;
+        struct acpi_osc_context context = {
+                .uuid_str = int3400_thermal_uuids[uuid],
+                .rev = 1,
+                .cap.length = 8,
+        };
+
+        buf[OSC_QUERY_DWORD] = 0;
+        buf[OSC_SUPPORT_DWORD] = enable;
+
+        context.cap.pointer = buf;
+
+        status = acpi_run_osc(handle, &context);
+        if (ACPI_SUCCESS(status)) {
+                ret = *((u32 *)(context.ret.pointer + 4));
+                if (ret != enable)
+                        result = -EPERM;
+        } else
+                result = -EPERM;
+
+        kfree(context.ret.pointer);
+        return result;
+}
+
+static int int3400_thermal_get_temp(struct thermal_zone_device *thermal,
+                        unsigned long *temp)
+{
+        *temp = 20 * 1000; /* faked temp sensor with 20C */
+        return 0;
+}
+
+static int int3400_thermal_get_mode(struct thermal_zone_device *thermal,
+                                enum thermal_device_mode *mode)
+{
+        struct int3400_thermal_priv *priv = thermal->devdata;
+
+        if (!priv)
+                return -EINVAL;
+
+        *mode = priv->mode;
+
+        return 0;
+}
+
+static int int3400_thermal_set_mode(struct thermal_zone_device *thermal,
+                                enum thermal_device_mode mode)
+{
+        struct int3400_thermal_priv *priv = thermal->devdata;
+        bool enable;
+        int result = 0;
+
+        if (!priv)
+                return -EINVAL;
+
+        if (mode == THERMAL_DEVICE_ENABLED)
+                enable = true;
+        else if (mode == THERMAL_DEVICE_DISABLED)
+                enable = false;
+        else
+                return -EINVAL;
+
+        if (enable != priv->mode) {
+                priv->mode = enable;
+                /* currently, only PASSIVE COOLING is supported */
+                result = int3400_thermal_run_osc(priv->adev->handle,
+                                        INT3400_THERMAL_PASSIVE_1, enable);
+        }
+        return result;
+}
+
+static struct thermal_zone_device_ops int3400_thermal_ops = {
+        .get_temp = int3400_thermal_get_temp,
+};
+
+static struct thermal_zone_params int3400_thermal_params = {
+        .governor_name = "user_space",
+        .no_hwmon = true,
+};
+
+static int int3400_thermal_probe(struct platform_device *pdev)
+{
+        struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
+        struct int3400_thermal_priv *priv;
+        int result;
+
+        if (!adev)
+                return -ENODEV;
+
+        priv = kzalloc(sizeof(struct int3400_thermal_priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        priv->adev = adev;
+
+        result = int3400_thermal_get_uuids(priv);
+        if (result)
+                goto free_priv;
+
+        result = acpi_parse_art(priv->adev->handle, &priv->art_count,
+                                &priv->arts, true);
+        if (result)
+                goto free_priv;
+
+
+        result = acpi_parse_trt(priv->adev->handle, &priv->trt_count,
+                                &priv->trts, true);
+        if (result)
+                goto free_art;
+
+        platform_set_drvdata(pdev, priv);
+
+        if (priv->uuid_bitmap & 1 << INT3400_THERMAL_PASSIVE_1) {
+                int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
+                int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
+        }
+        priv->thermal = thermal_zone_device_register("INT3400 Thermal", 0, 0,
+                                                priv, &int3400_thermal_ops,
+                                                &int3400_thermal_params, 0, 0);
+        if (IS_ERR(priv->thermal)) {
+                result = PTR_ERR(priv->thermal);
+                goto free_trt;
+        }
+
+        priv->rel_misc_dev_res = acpi_thermal_rel_misc_device_add(
+                                                        priv->adev->handle);
+
+        return 0;
+free_trt:
+        kfree(priv->trts);
+free_art:
+        kfree(priv->arts);
+free_priv:
+        kfree(priv);
+        return result;
+}
+
+static int int3400_thermal_remove(struct platform_device *pdev)
+{
+        struct int3400_thermal_priv *priv = platform_get_drvdata(pdev);
+
+        if (!priv->rel_misc_dev_res)
+                acpi_thermal_rel_misc_device_remove(priv->adev->handle);
+
+        thermal_zone_device_unregister(priv->thermal);
+        kfree(priv->trts);
+        kfree(priv->arts);
+        kfree(priv);
+        return 0;
+}
+
+static const struct acpi_device_id int3400_thermal_match[] = {
+        {"INT3400", 0},
+        {}
+};
+
+MODULE_DEVICE_TABLE(acpi, int3400_thermal_match);
+
+static struct platform_driver int3400_thermal_driver = {
+        .probe = int3400_thermal_probe,
+        .remove = int3400_thermal_remove,
+        .driver = {
+                   .name = "int3400 thermal",
+                   .owner = THIS_MODULE,
+                   .acpi_match_table = ACPI_PTR(int3400_thermal_match),
+                   },
+};
+
+module_platform_driver(int3400_thermal_driver);
+
+MODULE_DESCRIPTION("INT3400 Thermal driver");
+MODULE_AUTHOR("Zhang Rui <rui.zhang@intel.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/thermal/int340x_thermal/int3402_thermal.c b/drivers/thermal/int340x_thermal/int3402_thermal.c
new file mode 100644
index 000000000000..a5d08c14ba24
--- /dev/null
+++ b/drivers/thermal/int340x_thermal/int3402_thermal.c
@@ -0,0 +1,242 @@
+/*
+ * INT3402 thermal driver for memory temperature reporting
+ *
+ * Copyright (C) 2014, Intel Corporation
+ * Authors: Aaron Lu <aaron.lu@intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/acpi.h>
+#include <linux/thermal.h>
+
+#define ACPI_ACTIVE_COOLING_MAX_NR 10
+
+struct active_trip {
+        unsigned long temp;
+        int id;
+        bool valid;
+};
+
+struct int3402_thermal_data {
+        unsigned long *aux_trips;
+        int aux_trip_nr;
+        unsigned long psv_temp;
+        int psv_trip_id;
+        unsigned long crt_temp;
+        int crt_trip_id;
+        unsigned long hot_temp;
+        int hot_trip_id;
+        struct active_trip act_trips[ACPI_ACTIVE_COOLING_MAX_NR];
+        acpi_handle *handle;
+};
+
+static int int3402_thermal_get_zone_temp(struct thermal_zone_device *zone,
+                                         unsigned long *temp)
+{
+        struct int3402_thermal_data *d = zone->devdata;
+        unsigned long long tmp;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(d->handle, "_TMP", NULL, &tmp);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+
+        /* _TMP returns the temperature in tenths of degrees Kelvin */
+        *temp = DECI_KELVIN_TO_MILLICELSIUS(tmp);
+
+        return 0;
+}
+
+static int int3402_thermal_get_trip_temp(struct thermal_zone_device *zone,
+                                         int trip, unsigned long *temp)
+{
+        struct int3402_thermal_data *d = zone->devdata;
+        int i;
+
+        if (trip < d->aux_trip_nr)
+                *temp = d->aux_trips[trip];
+        else if (trip == d->crt_trip_id)
+                *temp = d->crt_temp;
+        else if (trip == d->psv_trip_id)
+                *temp = d->psv_temp;
+        else if (trip == d->hot_trip_id)
+                *temp = d->hot_temp;
+        else {
+                for (i = 0; i < ACPI_ACTIVE_COOLING_MAX_NR; i++) {
+                        if (d->act_trips[i].valid &&
+                            d->act_trips[i].id == trip) {
+                                *temp = d->act_trips[i].temp;
+                                break;
+                        }
+                }
+                if (i == ACPI_ACTIVE_COOLING_MAX_NR)
+                        return -EINVAL;
+        }
+        return 0;
+}
+
+static int int3402_thermal_get_trip_type(struct thermal_zone_device *zone,
+                                         int trip, enum thermal_trip_type *type)
+{
+        struct int3402_thermal_data *d = zone->devdata;
+        int i;
+
+        if (trip < d->aux_trip_nr)
+                *type = THERMAL_TRIP_PASSIVE;
+        else if (trip == d->crt_trip_id)
+                *type = THERMAL_TRIP_CRITICAL;
+        else if (trip == d->hot_trip_id)
+                *type = THERMAL_TRIP_HOT;
+        else if (trip == d->psv_trip_id)
+                *type = THERMAL_TRIP_PASSIVE;
+        else {
+                for (i = 0; i < ACPI_ACTIVE_COOLING_MAX_NR; i++) {
+                        if (d->act_trips[i].valid &&
+                            d->act_trips[i].id == trip) {
+                                *type = THERMAL_TRIP_ACTIVE;
+                                break;
+                        }
+                }
+                if (i == ACPI_ACTIVE_COOLING_MAX_NR)
+                        return -EINVAL;
+        }
+        return 0;
+}
+
+static int int3402_thermal_set_trip_temp(struct thermal_zone_device *zone, int trip,
+                                  unsigned long temp)
+{
+        struct int3402_thermal_data *d = zone->devdata;
+        acpi_status status;
+        char name[10];
+
+        snprintf(name, sizeof(name), "PAT%d", trip);
+        status = acpi_execute_simple_method(d->handle, name,
+                        MILLICELSIUS_TO_DECI_KELVIN(temp));
+        if (ACPI_FAILURE(status))
+                return -EIO;
+
+        d->aux_trips[trip] = temp;
+        return 0;
+}
+
+static struct thermal_zone_device_ops int3402_thermal_zone_ops = {
+        .get_temp       = int3402_thermal_get_zone_temp,
+        .get_trip_temp  = int3402_thermal_get_trip_temp,
+        .get_trip_type  = int3402_thermal_get_trip_type,
+        .set_trip_temp  = int3402_thermal_set_trip_temp,
+};
+
+static struct thermal_zone_params int3402_thermal_params = {
+        .governor_name = "user_space",
+        .no_hwmon = true,
+};
+
+static int int3402_thermal_get_temp(acpi_handle handle, char *name,
+                                    unsigned long *temp)
+{
+        unsigned long long r;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(handle, name, NULL, &r);
+        if (ACPI_FAILURE(status))
+                return -EIO;
+
+        *temp = DECI_KELVIN_TO_MILLICELSIUS(r);
+        return 0;
+}
+
+static int int3402_thermal_probe(struct platform_device *pdev)
+{
+        struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
+        struct int3402_thermal_data *d;
+        struct thermal_zone_device *zone;
+        acpi_status status;
+        unsigned long long trip_cnt;
+        int trip_mask = 0, i;
+
+        if (!acpi_has_method(adev->handle, "_TMP"))
+                return -ENODEV;
+
+        d = devm_kzalloc(&pdev->dev, sizeof(*d), GFP_KERNEL);
+        if (!d)
+                return -ENOMEM;
+
+        status = acpi_evaluate_integer(adev->handle, "PATC", NULL, &trip_cnt);
+        if (ACPI_FAILURE(status))
+                trip_cnt = 0;
+        else {
+                d->aux_trips = devm_kzalloc(&pdev->dev,
+                                sizeof(*d->aux_trips) * trip_cnt, GFP_KERNEL);
+                if (!d->aux_trips)
+                        return -ENOMEM;
+                trip_mask = trip_cnt - 1;
+                d->handle = adev->handle;
+                d->aux_trip_nr = trip_cnt;
+        }
+
+        d->crt_trip_id = -1;
+        if (!int3402_thermal_get_temp(adev->handle, "_CRT", &d->crt_temp))
+                d->crt_trip_id = trip_cnt++;
+        d->hot_trip_id = -1;
+        if (!int3402_thermal_get_temp(adev->handle, "_HOT", &d->hot_temp))
+                d->hot_trip_id = trip_cnt++;
+        d->psv_trip_id = -1;
+        if (!int3402_thermal_get_temp(adev->handle, "_PSV", &d->psv_temp))
+                d->psv_trip_id = trip_cnt++;
+        for (i = 0; i < ACPI_ACTIVE_COOLING_MAX_NR; i++) {
+                char name[5] = { '_', 'A', 'C', '0' + i, '\0' };
+                if (int3402_thermal_get_temp(adev->handle, name,
+                                             &d->act_trips[i].temp))
+                        break;
+                d->act_trips[i].id = trip_cnt++;
+                d->act_trips[i].valid = true;
+        }
+
+        zone = thermal_zone_device_register(acpi_device_bid(adev), trip_cnt,
+                                            trip_mask, d,
+                                            &int3402_thermal_zone_ops,
+                                            &int3402_thermal_params,
+                                            0, 0);
+        if (IS_ERR(zone))
+                return PTR_ERR(zone);
+        platform_set_drvdata(pdev, zone);
+
+        return 0;
+}
+
+static int int3402_thermal_remove(struct platform_device *pdev)
+{
+        struct thermal_zone_device *zone = platform_get_drvdata(pdev);
+
+        thermal_zone_device_unregister(zone);
+        return 0;
+}
+
+static const struct acpi_device_id int3402_thermal_match[] = {
+        {"INT3402", 0},
+        {}
+};
+
+MODULE_DEVICE_TABLE(acpi, int3402_thermal_match);
+
+static struct platform_driver int3402_thermal_driver = {
+        .probe = int3402_thermal_probe,
+        .remove = int3402_thermal_remove,
+        .driver = {
+                   .name = "int3402 thermal",
+                   .owner = THIS_MODULE,
+                   .acpi_match_table = int3402_thermal_match,
+                   },
+};
+
+module_platform_driver(int3402_thermal_driver);
+
+MODULE_DESCRIPTION("INT3402 Thermal driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/thermal/int340x_thermal/int3403_thermal.c b/drivers/thermal/int340x_thermal/int3403_thermal.c
new file mode 100644
index 000000000000..6e9fb62eb817
--- /dev/null
+++ b/drivers/thermal/int340x_thermal/int3403_thermal.c
@@ -0,0 +1,483 @@
+/*
+ * ACPI INT3403 thermal driver
+ * Copyright (c) 2013, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/acpi.h>
+#include <linux/thermal.h>
+#include <linux/platform_device.h>
+
+#define INT3403_TYPE_SENSOR             0x03
+#define INT3403_TYPE_CHARGER            0x0B
+#define INT3403_TYPE_BATTERY            0x0C
+#define INT3403_PERF_CHANGED_EVENT      0x80
+#define INT3403_THERMAL_EVENT           0x90
+
+#define DECI_KELVIN_TO_MILLI_CELSIUS(t, off) (((t) - (off)) * 100)
+#define KELVIN_OFFSET   2732
+#define MILLI_CELSIUS_TO_DECI_KELVIN(t, off) (((t) / 100) + (off))
+
+struct int3403_sensor {
+        struct thermal_zone_device *tzone;
+        unsigned long *thresholds;
+        unsigned long   crit_temp;
+        int             crit_trip_id;
+        unsigned long   psv_temp;
+        int             psv_trip_id;
+
+};
+
+struct int3403_performance_state {
+        u64 performance;
+        u64 power;
+        u64 latency;
+        u64 linear;
+        u64 control;
+        u64 raw_performace;
+        char *raw_unit;
+        int reserved;
+};
+
+struct int3403_cdev {
+        struct thermal_cooling_device *cdev;
+        unsigned long max_state;
+};
+
+struct int3403_priv {
+        struct platform_device *pdev;
+        struct acpi_device *adev;
+        unsigned long long type;
+        void *priv;
+};
+
+static int sys_get_curr_temp(struct thermal_zone_device *tzone,
+                                unsigned long *temp)
+{
+        struct int3403_priv *priv = tzone->devdata;
+        struct acpi_device *device = priv->adev;
+        unsigned long long tmp;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(device->handle, "_TMP", NULL, &tmp);
+        if (ACPI_FAILURE(status))
+                return -EIO;
+
+        *temp = DECI_KELVIN_TO_MILLI_CELSIUS(tmp, KELVIN_OFFSET);
+
+        return 0;
+}
+
+static int sys_get_trip_hyst(struct thermal_zone_device *tzone,
+                int trip, unsigned long *temp)
+{
+        struct int3403_priv *priv = tzone->devdata;
+        struct acpi_device *device = priv->adev;
+        unsigned long long hyst;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(device->handle, "GTSH", NULL, &hyst);
+        if (ACPI_FAILURE(status))
+                return -EIO;
+
+        /*
+         * Thermal hysteresis represents a temperature difference.
+         * Kelvin and Celsius have same degree size. So the
+         * conversion here between tenths of degree Kelvin unit
+         * and Milli-Celsius unit is just to multiply 100.
+         */
+        *temp = hyst * 100;
+
+        return 0;
+}
+
+static int sys_get_trip_temp(struct thermal_zone_device *tzone,
+                int trip, unsigned long *temp)
+{
+        struct int3403_priv *priv = tzone->devdata;
+        struct int3403_sensor *obj = priv->priv;
+
+        if (priv->type != INT3403_TYPE_SENSOR || !obj)
+                return -EINVAL;
+
+        if (trip == obj->crit_trip_id)
+                *temp = obj->crit_temp;
+        else if (trip == obj->psv_trip_id)
+                *temp = obj->psv_temp;
+        else {
+                /*
+                 * get_trip_temp is a mandatory callback but
+                 * PATx method doesn't return any value, so return
+                 * cached value, which was last set from user space
+                 */
+                *temp = obj->thresholds[trip];
+        }
+
+        return 0;
+}
+
+static int sys_get_trip_type(struct thermal_zone_device *thermal,
+                int trip, enum thermal_trip_type *type)
+{
+        struct int3403_priv *priv = thermal->devdata;
+        struct int3403_sensor *obj = priv->priv;
+
+        /* Mandatory callback, may not mean much here */
+        if (trip == obj->crit_trip_id)
+                *type = THERMAL_TRIP_CRITICAL;
+        else
+                *type = THERMAL_TRIP_PASSIVE;
+
+        return 0;
+}
+
+int sys_set_trip_temp(struct thermal_zone_device *tzone, int trip,
+                                                        unsigned long temp)
+{
+        struct int3403_priv *priv = tzone->devdata;
+        struct acpi_device *device = priv->adev;
+        struct int3403_sensor *obj = priv->priv;
+        acpi_status status;
+        char name[10];
+        int ret = 0;
+
+        snprintf(name, sizeof(name), "PAT%d", trip);
+        if (acpi_has_method(device->handle, name)) {
+                status = acpi_execute_simple_method(device->handle, name,
+                                MILLI_CELSIUS_TO_DECI_KELVIN(temp,
+                                                        KELVIN_OFFSET));
+                if (ACPI_FAILURE(status))
+                        ret = -EIO;
+                else
+                        obj->thresholds[trip] = temp;
+        } else {
+                ret = -EIO;
+                dev_err(&device->dev, "sys_set_trip_temp: method not found\n");
+        }
+
+        return ret;
+}
+
+static struct thermal_zone_device_ops tzone_ops = {
+        .get_temp = sys_get_curr_temp,
+        .get_trip_temp = sys_get_trip_temp,
+        .get_trip_type = sys_get_trip_type,
+        .set_trip_temp = sys_set_trip_temp,
+        .get_trip_hyst =  sys_get_trip_hyst,
+};
+
+static struct thermal_zone_params int3403_thermal_params = {
+        .governor_name = "user_space",
+        .no_hwmon = true,
+};
+
+static void int3403_notify(acpi_handle handle,
+                u32 event, void *data)
+{
+        struct int3403_priv *priv = data;
+        struct int3403_sensor *obj;
+
+        if (!priv)
+                return;
+
+        obj = priv->priv;
+        if (priv->type != INT3403_TYPE_SENSOR || !obj)
+                return;
+
+        switch (event) {
+        case INT3403_PERF_CHANGED_EVENT:
+                break;
+        case INT3403_THERMAL_EVENT:
+                thermal_zone_device_update(obj->tzone);
+                break;
+        default:
+                dev_err(&priv->pdev->dev, "Unsupported event [0x%x]\n", event);
+                break;
+        }
+}
+
+static int sys_get_trip_crt(struct acpi_device *device, unsigned long *temp)
+{
+        unsigned long long crt;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(device->handle, "_CRT", NULL, &crt);
+        if (ACPI_FAILURE(status))
+                return -EIO;
+
+        *temp = DECI_KELVIN_TO_MILLI_CELSIUS(crt, KELVIN_OFFSET);
+
+        return 0;
+}
+
+static int sys_get_trip_psv(struct acpi_device *device, unsigned long *temp)
+{
+        unsigned long long psv;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(device->handle, "_PSV", NULL, &psv);
+        if (ACPI_FAILURE(status))
+                return -EIO;
+
+        *temp = DECI_KELVIN_TO_MILLI_CELSIUS(psv, KELVIN_OFFSET);
+
+        return 0;
+}
+
+static int int3403_sensor_add(struct int3403_priv *priv)
+{
+        int result = 0;
+        acpi_status status;
+        struct int3403_sensor *obj;
+        unsigned long long trip_cnt;
+        int trip_mask = 0;
+
+        obj = devm_kzalloc(&priv->pdev->dev, sizeof(*obj), GFP_KERNEL);
+        if (!obj)
+                return -ENOMEM;
+
+        priv->priv = obj;
+
+        status = acpi_evaluate_integer(priv->adev->handle, "PATC", NULL,
+                                                &trip_cnt);
+        if (ACPI_FAILURE(status))
+                trip_cnt = 0;
+
+        if (trip_cnt) {
+                /* We have to cache, thresholds can't be readback */
+                obj->thresholds = devm_kzalloc(&priv->pdev->dev,
+                                        sizeof(*obj->thresholds) * trip_cnt,
+                                        GFP_KERNEL);
+                if (!obj->thresholds) {
+                        result = -ENOMEM;
+                        goto err_free_obj;
+                }
+                trip_mask = BIT(trip_cnt) - 1;
+        }
+
+        obj->psv_trip_id = -1;
+        if (!sys_get_trip_psv(priv->adev, &obj->psv_temp))
+                obj->psv_trip_id = trip_cnt++;
+
+        obj->crit_trip_id = -1;
+        if (!sys_get_trip_crt(priv->adev, &obj->crit_temp))
+                obj->crit_trip_id = trip_cnt++;
+
+        obj->tzone = thermal_zone_device_register(acpi_device_bid(priv->adev),
+                                trip_cnt, trip_mask, priv, &tzone_ops,
+                                &int3403_thermal_params, 0, 0);
+        if (IS_ERR(obj->tzone)) {
+                result = PTR_ERR(obj->tzone);
+                obj->tzone = NULL;
+                goto err_free_obj;
+        }
+
+        result = acpi_install_notify_handler(priv->adev->handle,
+                        ACPI_DEVICE_NOTIFY, int3403_notify,
+                        (void *)priv);
+        if (result)
+                goto err_free_obj;
+
+        return 0;
+
+ err_free_obj:
+        if (obj->tzone)
+                thermal_zone_device_unregister(obj->tzone);
+        return result;
+}
+
+static int int3403_sensor_remove(struct int3403_priv *priv)
+{
+        struct int3403_sensor *obj = priv->priv;
+
+        thermal_zone_device_unregister(obj->tzone);
+        return 0;
+}
+
+/* INT3403 Cooling devices */
+static int int3403_get_max_state(struct thermal_cooling_device *cdev,
+                                 unsigned long *state)
+{
+        struct int3403_priv *priv = cdev->devdata;
+        struct int3403_cdev *obj = priv->priv;
+
+        *state = obj->max_state;
+        return 0;
+}
+
+static int int3403_get_cur_state(struct thermal_cooling_device *cdev,
+                                 unsigned long *state)
+{
+        struct int3403_priv *priv = cdev->devdata;
+        unsigned long long level;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(priv->adev->handle, "PPPC", NULL, &level);
+        if (ACPI_SUCCESS(status)) {
+                *state = level;
+                return 0;
+        } else
+                return -EINVAL;
+}
+
+static int
+int3403_set_cur_state(struct thermal_cooling_device *cdev, unsigned long state)
+{
+        struct int3403_priv *priv = cdev->devdata;
+        acpi_status status;
+
+        status = acpi_execute_simple_method(priv->adev->handle, "SPPC", state);
+        if (ACPI_SUCCESS(status))
+                return 0;
+        else
+                return -EINVAL;
+}
+
+static const struct thermal_cooling_device_ops int3403_cooling_ops = {
+        .get_max_state = int3403_get_max_state,
+        .get_cur_state = int3403_get_cur_state,
+        .set_cur_state = int3403_set_cur_state,
+};
+
+static int int3403_cdev_add(struct int3403_priv *priv)
+{
+        int result = 0;
+        acpi_status status;
+        struct int3403_cdev *obj;
+        struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER, NULL };
+        union acpi_object *p;
+
+        obj = devm_kzalloc(&priv->pdev->dev, sizeof(*obj), GFP_KERNEL);
+        if (!obj)
+                return -ENOMEM;
+
+        status = acpi_evaluate_object(priv->adev->handle, "PPSS", NULL, &buf);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+
+        p = buf.pointer;
+        if (!p || (p->type != ACPI_TYPE_PACKAGE)) {
+                printk(KERN_WARNING "Invalid PPSS data\n");
+                return -EFAULT;
+        }
+
+        obj->max_state = p->package.count - 1;
+        obj->cdev =
+                thermal_cooling_device_register(acpi_device_bid(priv->adev),
+                                priv, &int3403_cooling_ops);
+        if (IS_ERR(obj->cdev))
+                result = PTR_ERR(obj->cdev);
+
+        priv->priv = obj;
+
+        /* TODO: add ACPI notification support */
+
+        return result;
+}
+
+static int int3403_cdev_remove(struct int3403_priv *priv)
+{
+        struct int3403_cdev *obj = priv->priv;
+
+        thermal_cooling_device_unregister(obj->cdev);
+        return 0;
+}
+
+static int int3403_add(struct platform_device *pdev)
+{
+        struct int3403_priv *priv;
+        int result = 0;
+        acpi_status status;
+
+        priv = devm_kzalloc(&pdev->dev, sizeof(struct int3403_priv),
+                            GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        priv->pdev = pdev;
+        priv->adev = ACPI_COMPANION(&(pdev->dev));
+        if (!priv->adev) {
+                result = -EINVAL;
+                goto err;
+        }
+
+        status = acpi_evaluate_integer(priv->adev->handle, "PTYP",
+                                       NULL, &priv->type);
+        if (ACPI_FAILURE(status)) {
+                result = -EINVAL;
+                goto err;
+        }
+
+        platform_set_drvdata(pdev, priv);
+        switch (priv->type) {
+        case INT3403_TYPE_SENSOR:
+                result = int3403_sensor_add(priv);
+                break;
+        case INT3403_TYPE_CHARGER:
+        case INT3403_TYPE_BATTERY:
+                result = int3403_cdev_add(priv);
+                break;
+        default:
+                result = -EINVAL;
+        }
+
+        if (result)
+                goto err;
+        return result;
+
+err:
+        return result;
+}
+
+static int int3403_remove(struct platform_device *pdev)
+{
+        struct int3403_priv *priv = platform_get_drvdata(pdev);
+
+        switch (priv->type) {
+        case INT3403_TYPE_SENSOR:
+                int3403_sensor_remove(priv);
+                break;
+        case INT3403_TYPE_CHARGER:
+        case INT3403_TYPE_BATTERY:
+                int3403_cdev_remove(priv);
+                break;
+        default:
+                break;
+        }
+
+        return 0;
+}
+
+static const struct acpi_device_id int3403_device_ids[] = {
+        {"INT3403", 0},
+        {"", 0},
+};
+MODULE_DEVICE_TABLE(acpi, int3403_device_ids);
+
+static struct platform_driver int3403_driver = {
+        .probe = int3403_add,
+        .remove = int3403_remove,
+        .driver = {
+                .name = "int3403 thermal",
+                .owner  = THIS_MODULE,
+                .acpi_match_table = int3403_device_ids,
+        },
+};
+
+module_platform_driver(int3403_driver);
+
+MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("ACPI INT3403 thermal driver");
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 4b2b999b7611..62143ba31001 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -387,20 +387,27 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id,
                                 int (*get_trend)(void *, long *))
 {
         struct device_node *np, *child, *sensor_np;
+        struct thermal_zone_device *tzd = ERR_PTR(-ENODEV);
 
         np = of_find_node_by_name(NULL, "thermal-zones");
         if (!np)
                 return ERR_PTR(-ENODEV);
 
-        if (!dev || !dev->of_node)
+        if (!dev || !dev->of_node) {
+                of_node_put(np);
                 return ERR_PTR(-EINVAL);
+        }
 
-        sensor_np = dev->of_node;
+        sensor_np = of_node_get(dev->of_node);
 
         for_each_child_of_node(np, child) {
                 struct of_phandle_args sensor_specs;
                 int ret, id;
 
+                /* Check whether child is enabled or not */
+                if (!of_device_is_available(child))
+                        continue;
+
                 /* For now, thermal framework supports only 1 sensor per zone */
                 ret = of_parse_phandle_with_args(child, "thermal-sensors",
                                                  "#thermal-sensor-cells",
@@ -418,16 +425,21 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id,
                 }
 
                 if (sensor_specs.np == sensor_np && id == sensor_id) {
-                        of_node_put(np);
-                        return thermal_zone_of_add_sensor(child, sensor_np,
-                                                          data,
-                                                          get_temp,
-                                                          get_trend);
+                        tzd = thermal_zone_of_add_sensor(child, sensor_np,
+                                                         data,
+                                                         get_temp,
+                                                         get_trend);
+                        of_node_put(sensor_specs.np);
+                        of_node_put(child);
+                        goto exit;
                 }
+                of_node_put(sensor_specs.np);
         }
+exit:
+        of_node_put(sensor_np);
         of_node_put(np);
 
-        return ERR_PTR(-ENODEV);
+        return tzd;
 }
 EXPORT_SYMBOL_GPL(thermal_zone_of_sensor_register);
 
@@ -619,6 +631,7 @@ static int thermal_of_populate_trip(struct device_node *np,
 
         /* Required for cooling map matching */
         trip->np = np;
+        of_node_get(np);
 
         return 0;
 }
@@ -726,9 +739,14 @@ finish:
         return tz;
 
 free_tbps:
+        for (i = 0; i < tz->num_tbps; i++)
+                of_node_put(tz->tbps[i].cooling_device);
         kfree(tz->tbps);
 free_trips:
+        for (i = 0; i < tz->ntrips; i++)
+                of_node_put(tz->trips[i].np);
         kfree(tz->trips);
+        of_node_put(gchild);
 free_tz:
         kfree(tz);
         of_node_put(child);
@@ -738,7 +756,13 @@ free_tz:
 
 static inline void of_thermal_free_zone(struct __thermal_zone *tz)
 {
+        int i;
+
+        for (i = 0; i < tz->num_tbps; i++)
+                of_node_put(tz->tbps[i].cooling_device);
         kfree(tz->tbps);
+        for (i = 0; i < tz->ntrips; i++)
+                of_node_put(tz->trips[i].np);
         kfree(tz->trips);
         kfree(tz);
 }
@@ -771,6 +795,10 @@ int __init of_parse_thermal_zones(void)
                 struct thermal_zone_device *zone;
                 struct thermal_zone_params *tzp;
 
+                /* Check whether child is enabled or not */
+                if (!of_device_is_available(child))
+                        continue;
+
                 tz = thermal_of_build_thermal_zone(child);
                 if (IS_ERR(tz)) {
                         pr_err("failed to build thermal zone %s: %ld\n",
@@ -806,10 +834,13 @@ int __init of_parse_thermal_zones(void)
                         /* attempting to build remaining zones still */
                 }
         }
+        of_node_put(np);
 
         return 0;
 
 exit_free:
+        of_node_put(child);
+        of_node_put(np);
         of_thermal_free_zone(tz);
 
         /* no memory available, so free what we have built */
@@ -838,6 +869,10 @@ void of_thermal_destroy_zones(void)
         for_each_child_of_node(np, child) {
                 struct thermal_zone_device *zone;
 
+                /* Check whether child is enabled or not */
+                if (!of_device_is_available(child))
+                        continue;
+
                 zone = thermal_zone_get_zone_by_name(child->name);
                 if (IS_ERR(zone))
                         continue;
@@ -847,4 +882,5 @@ void of_thermal_destroy_zones(void)
                 kfree(zone->ops);
                 of_thermal_free_zone(zone->devdata);
         }
+        of_node_put(np);
 }
diff --git a/drivers/thermal/samsung/exynos_thermal_common.c b/drivers/thermal/samsung/exynos_thermal_common.c
index 3f5ad25ddca8..b6be572704a4 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.c
+++ b/drivers/thermal/samsung/exynos_thermal_common.c
@@ -417,13 +417,10 @@ void exynos_unregister_thermal(struct thermal_sensor_conf *sensor_conf)
 
         th_zone = sensor_conf->pzone_data;
 
-        if (th_zone->therm_dev)
-                thermal_zone_device_unregister(th_zone->therm_dev);
+        thermal_zone_device_unregister(th_zone->therm_dev);
 
-        for (i = 0; i < th_zone->cool_dev_size; i++) {
-                if (th_zone->cool_dev[i])
-                        cpufreq_cooling_unregister(th_zone->cool_dev[i]);
-        }
+        for (i = 0; i < th_zone->cool_dev_size; ++i)
+                cpufreq_cooling_unregister(th_zone->cool_dev[i]);
 
         dev_info(sensor_conf->dev,
                 "Exynos: Kernel Thermal management unregistered\n");
diff --git a/drivers/thermal/samsung/exynos_thermal_common.h b/drivers/thermal/samsung/exynos_thermal_common.h
index 3eb2ed9ea3a4..158f5aa8dc5d 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.h
+++ b/drivers/thermal/samsung/exynos_thermal_common.h
@@ -27,7 +27,7 @@
 #define SENSOR_NAME_LEN 16
 #define MAX_TRIP_COUNT  8
 #define MAX_COOLING_DEVICE 4
-#define MAX_THRESHOLD_LEVS 5
+#define MAX_TRIMINFO_CTRL_REG   2
 
 #define ACTIVE_INTERVAL 500
 #define IDLE_INTERVAL 10000
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index acbff14da3a4..49c09243fd38 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -77,16 +77,6 @@ static int temp_to_code(struct exynos_tmu_data *data, u8 temp)
         struct exynos_tmu_platform_data *pdata = data->pdata;
         int temp_code;
 
-        if (pdata->cal_mode == HW_MODE)
-                return temp;
-
-        if (data->soc == SOC_ARCH_EXYNOS4210)
-                /* temp should range between 25 and 125 */
-                if (temp < 25 || temp > 125) {
-                        temp_code = -EINVAL;
-                        goto out;
-                }
-
         switch (pdata->cal_type) {
         case TYPE_TWO_POINT_TRIMMING:
                 temp_code = (temp - pdata->first_point_trim) *
@@ -101,7 +91,7 @@ static int temp_to_code(struct exynos_tmu_data *data, u8 temp)
                 temp_code = temp + pdata->default_temp_offset;
                 break;
         }
-out:
+
         return temp_code;
 }
 
@@ -114,16 +104,6 @@ static int code_to_temp(struct exynos_tmu_data *data, u8 temp_code)
         struct exynos_tmu_platform_data *pdata = data->pdata;
         int temp;
 
-        if (pdata->cal_mode == HW_MODE)
-                return temp_code;
-
-        if (data->soc == SOC_ARCH_EXYNOS4210)
-                /* temp_code should range between 75 and 175 */
-                if (temp_code < 75 || temp_code > 175) {
-                        temp = -ENODATA;
-                        goto out;
-                }
-
         switch (pdata->cal_type) {
         case TYPE_TWO_POINT_TRIMMING:
                 temp = (temp_code - data->temp_error1) *
@@ -138,18 +118,35 @@ static int code_to_temp(struct exynos_tmu_data *data, u8 temp_code)
                 temp = temp_code - pdata->default_temp_offset;
                 break;
         }
-out:
+
         return temp;
 }
 
+static void exynos_tmu_clear_irqs(struct exynos_tmu_data *data)
+{
+        const struct exynos_tmu_registers *reg = data->pdata->registers;
+        unsigned int val_irq;
+
+        val_irq = readl(data->base + reg->tmu_intstat);
+        /*
+         * Clear the interrupts.  Please note that the documentation for
+         * Exynos3250, Exynos4412, Exynos5250 and Exynos5260 incorrectly
+         * states that INTCLEAR register has a different placing of bits
+         * responsible for FALL IRQs than INTSTAT register.  Exynos5420
+         * and Exynos5440 documentation is correct (Exynos4210 doesn't
+         * support FALL IRQs at all).
+         */
+        writel(val_irq, data->base + reg->tmu_intclear);
+}
+
 static int exynos_tmu_initialize(struct platform_device *pdev)
 {
         struct exynos_tmu_data *data = platform_get_drvdata(pdev);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int status, trim_info = 0, con;
+        unsigned int status, trim_info = 0, con, ctrl;
         unsigned int rising_threshold = 0, falling_threshold = 0;
-        int ret = 0, threshold_code, i, trigger_levs = 0;
+        int ret = 0, threshold_code, i;
 
         mutex_lock(&data->lock);
         clk_enable(data->clk);
@@ -164,11 +161,17 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
                 }
         }
 
-        if (TMU_SUPPORTS(pdata, TRIM_RELOAD))
-                __raw_writel(1, data->base + reg->triminfo_ctrl);
-
-        if (pdata->cal_mode == HW_MODE)
-                goto skip_calib_data;
+        if (TMU_SUPPORTS(pdata, TRIM_RELOAD)) {
+                for (i = 0; i < reg->triminfo_ctrl_count; i++) {
+                        if (pdata->triminfo_reload[i]) {
+                                ctrl = readl(data->base +
+                                                reg->triminfo_ctrl[i]);
+                                ctrl |= pdata->triminfo_reload[i];
+                                writel(ctrl, data->base +
+                                                reg->triminfo_ctrl[i]);
+                        }
+                }
+        }
 
         /* Save trimming info in order to perform calibration */
         if (data->soc == SOC_ARCH_EXYNOS5440) {
@@ -197,7 +200,7 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
                         trim_info = readl(data->base + reg->triminfo_data);
         }
         data->temp_error1 = trim_info & EXYNOS_TMU_TEMP_MASK;
-        data->temp_error2 = ((trim_info >> reg->triminfo_85_shift) &
+        data->temp_error2 = ((trim_info >> EXYNOS_TRIMINFO_85_SHIFT) &
                                 EXYNOS_TMU_TEMP_MASK);
 
         if (!data->temp_error1 ||
@@ -207,67 +210,33 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
 
         if (!data->temp_error2)
                 data->temp_error2 =
-                        (pdata->efuse_value >> reg->triminfo_85_shift) &
+                        (pdata->efuse_value >> EXYNOS_TRIMINFO_85_SHIFT) &
                         EXYNOS_TMU_TEMP_MASK;
 
-skip_calib_data:
-        if (pdata->max_trigger_level > MAX_THRESHOLD_LEVS) {
-                dev_err(&pdev->dev, "Invalid max trigger level\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        for (i = 0; i < pdata->max_trigger_level; i++) {
-                if (!pdata->trigger_levels[i])
-                        continue;
-
-                if ((pdata->trigger_type[i] == HW_TRIP) &&
-                (!pdata->trigger_levels[pdata->max_trigger_level - 1])) {
-                        dev_err(&pdev->dev, "Invalid hw trigger level\n");
-                        ret = -EINVAL;
-                        goto out;
-                }
-
-                /* Count trigger levels except the HW trip*/
-                if (!(pdata->trigger_type[i] == HW_TRIP))
-                        trigger_levs++;
-        }
-
         rising_threshold = readl(data->base + reg->threshold_th0);
 
         if (data->soc == SOC_ARCH_EXYNOS4210) {
                 /* Write temperature code for threshold */
                 threshold_code = temp_to_code(data, pdata->threshold);
-                if (threshold_code < 0) {
-                        ret = threshold_code;
-                        goto out;
-                }
                 writeb(threshold_code,
                         data->base + reg->threshold_temp);
-                for (i = 0; i < trigger_levs; i++)
+                for (i = 0; i < pdata->non_hw_trigger_levels; i++)
                         writeb(pdata->trigger_levels[i], data->base +
                         reg->threshold_th0 + i * sizeof(reg->threshold_th0));
 
-                writel(reg->intclr_rise_mask, data->base + reg->tmu_intclear);
+                exynos_tmu_clear_irqs(data);
         } else {
                 /* Write temperature code for rising and falling threshold */
-                for (i = 0;
-                i < trigger_levs && i < EXYNOS_MAX_TRIGGER_PER_REG; i++) {
+                for (i = 0; i < pdata->non_hw_trigger_levels; i++) {
                         threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i]);
-                        if (threshold_code < 0) {
-                                ret = threshold_code;
-                                goto out;
-                        }
                         rising_threshold &= ~(0xff << 8 * i);
                         rising_threshold |= threshold_code << 8 * i;
                         if (pdata->threshold_falling) {
                                 threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i] -
                                                 pdata->threshold_falling);
-                                if (threshold_code > 0)
-                                        falling_threshold |=
-                                                threshold_code << 8 * i;
+                                falling_threshold |= threshold_code << 8 * i;
                         }
                 }
 
@@ -276,9 +245,7 @@ skip_calib_data:
                 writel(falling_threshold,
                                 data->base + reg->threshold_th1);
 
-                writel((reg->intclr_rise_mask << reg->intclr_rise_shift) |
-                        (reg->intclr_fall_mask << reg->intclr_fall_shift),
-                                data->base + reg->tmu_intclear);
+                exynos_tmu_clear_irqs(data);
 
                 /* if last threshold limit is also present */
                 i = pdata->max_trigger_level - 1;
@@ -286,10 +253,6 @@ skip_calib_data:
                                 (pdata->trigger_type[i] == HW_TRIP)) {
                         threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i]);
-                        if (threshold_code < 0) {
-                                ret = threshold_code;
-                                goto out;
-                        }
                         if (i == EXYNOS_MAX_TRIGGER_PER_REG - 1) {
                                 /* 1-4 level to be assigned in th0 reg */
                                 rising_threshold &= ~(0xff << 8 * i);
@@ -325,7 +288,7 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
         struct exynos_tmu_data *data = platform_get_drvdata(pdev);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int con, interrupt_en, cal_val;
+        unsigned int con, interrupt_en;
 
         mutex_lock(&data->lock);
         clk_enable(data->clk);
@@ -335,15 +298,11 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
         if (pdata->test_mux)
                 con |= (pdata->test_mux << reg->test_mux_addr_shift);
 
-        if (pdata->reference_voltage) {
-                con &= ~(reg->buf_vref_sel_mask << reg->buf_vref_sel_shift);
-                con |= pdata->reference_voltage << reg->buf_vref_sel_shift;
-        }
+        con &= ~(EXYNOS_TMU_REF_VOLTAGE_MASK << EXYNOS_TMU_REF_VOLTAGE_SHIFT);
+        con |= pdata->reference_voltage << EXYNOS_TMU_REF_VOLTAGE_SHIFT;
 
-        if (pdata->gain) {
-                con &= ~(reg->buf_slope_sel_mask << reg->buf_slope_sel_shift);
-                con |= (pdata->gain << reg->buf_slope_sel_shift);
-        }
+        con &= ~(EXYNOS_TMU_BUF_SLOPE_SEL_MASK << EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT);
+        con |= (pdata->gain << EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT);
 
         if (pdata->noise_cancel_mode) {
                 con &= ~(reg->therm_trip_mode_mask <<
@@ -351,29 +310,8 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
                 con |= (pdata->noise_cancel_mode << reg->therm_trip_mode_shift);
         }
 
-        if (pdata->cal_mode == HW_MODE) {
-                con &= ~(reg->calib_mode_mask << reg->calib_mode_shift);
-                cal_val = 0;
-                switch (pdata->cal_type) {
-                case TYPE_TWO_POINT_TRIMMING:
-                        cal_val = 3;
-                        break;
-                case TYPE_ONE_POINT_TRIMMING_85:
-                        cal_val = 2;
-                        break;
-                case TYPE_ONE_POINT_TRIMMING_25:
-                        cal_val = 1;
-                        break;
-                case TYPE_NONE:
-                        break;
-                default:
-                        dev_err(&pdev->dev, "Invalid calibration type, using none\n");
-                }
-                con |= cal_val << reg->calib_mode_shift;
-        }
-
         if (on) {
-                con |= (1 << reg->core_en_shift);
+                con |= (1 << EXYNOS_TMU_CORE_EN_SHIFT);
                 interrupt_en =
                         pdata->trigger_enable[3] << reg->inten_rise3_shift |
                         pdata->trigger_enable[2] << reg->inten_rise2_shift |
@@ -383,7 +321,7 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
                         interrupt_en |=
                                 interrupt_en << reg->inten_fall0_shift;
         } else {
-                con &= ~(1 << reg->core_en_shift);
+                con &= ~(1 << EXYNOS_TMU_CORE_EN_SHIFT);
                 interrupt_en = 0; /* Disable all interrupts */
         }
         writel(interrupt_en, data->base + reg->tmu_inten);
@@ -404,8 +342,16 @@ static int exynos_tmu_read(struct exynos_tmu_data *data)
         clk_enable(data->clk);
 
         temp_code = readb(data->base + reg->tmu_cur_temp);
-        temp = code_to_temp(data, temp_code);
 
+        if (data->soc == SOC_ARCH_EXYNOS4210)
+                /* temp_code should range between 75 and 175 */
+                if (temp_code < 75 || temp_code > 175) {
+                        temp = -ENODATA;
+                        goto out;
+                }
+
+        temp = code_to_temp(data, temp_code);
+out:
         clk_disable(data->clk);
         mutex_unlock(&data->lock);
 
@@ -465,7 +411,7 @@ static void exynos_tmu_work(struct work_struct *work)
                         struct exynos_tmu_data, irq_work);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int val_irq, val_type;
+        unsigned int val_type;
 
         if (!IS_ERR(data->clk_sec))
                 clk_enable(data->clk_sec);
@@ -483,9 +429,7 @@ static void exynos_tmu_work(struct work_struct *work)
         clk_enable(data->clk);
 
         /* TODO: take action based on particular interrupt */
-        val_irq = readl(data->base + reg->tmu_intstat);
-        /* clear the interrupts */
-        writel(val_irq, data->base + reg->tmu_intclear);
+        exynos_tmu_clear_irqs(data);
 
         clk_disable(data->clk);
         mutex_unlock(&data->lock);
diff --git a/drivers/thermal/samsung/exynos_tmu.h b/drivers/thermal/samsung/exynos_tmu.h
index 1b4a6444ea61..c58c7663a3fe 100644
--- a/drivers/thermal/samsung/exynos_tmu.h
+++ b/drivers/thermal/samsung/exynos_tmu.h
@@ -34,11 +34,6 @@ enum calibration_type {
         TYPE_NONE,
 };
 
-enum calibration_mode {
-        SW_MODE,
-        HW_MODE,
-};
-
 enum soc_type {
         SOC_ARCH_EXYNOS3250 = 1,
         SOC_ARCH_EXYNOS4210,
@@ -82,46 +77,19 @@ enum soc_type {
  * bitfields. The register validity, offsets and bitfield values may vary
  * slightly across different exynos SOC's.
  * @triminfo_data: register containing 2 pont trimming data
- * @triminfo_25_shift: shift bit of the 25 C trim value in triminfo_data reg.
- * @triminfo_85_shift: shift bit of the 85 C trim value in triminfo_data reg.
  * @triminfo_ctrl: trim info controller register.
- * @triminfo_reload_shift: shift of triminfo reload enable bit in triminfo_ctrl
-        reg.
+ * @triminfo_ctrl_count: the number of trim info controller register.
  * @tmu_ctrl: TMU main controller register.
  * @test_mux_addr_shift: shift bits of test mux address.
- * @buf_vref_sel_shift: shift bits of reference voltage in tmu_ctrl register.
- * @buf_vref_sel_mask: mask bits of reference voltage in tmu_ctrl register.
  * @therm_trip_mode_shift: shift bits of tripping mode in tmu_ctrl register.
  * @therm_trip_mode_mask: mask bits of tripping mode in tmu_ctrl register.
  * @therm_trip_en_shift: shift bits of tripping enable in tmu_ctrl register.
- * @buf_slope_sel_shift: shift bits of amplifier gain value in tmu_ctrl
-        register.
- * @buf_slope_sel_mask: mask bits of amplifier gain value in tmu_ctrl register.
- * @calib_mode_shift: shift bits of calibration mode value in tmu_ctrl
-        register.
- * @calib_mode_mask: mask bits of calibration mode value in tmu_ctrl
-        register.
- * @therm_trip_tq_en_shift: shift bits of thermal trip enable by TQ pin in
-        tmu_ctrl register.
- * @core_en_shift: shift bits of TMU core enable bit in tmu_ctrl register.
  * @tmu_status: register drescribing the TMU status.
  * @tmu_cur_temp: register containing the current temperature of the TMU.
- * @tmu_cur_temp_shift: shift bits of current temp value in tmu_cur_temp
-        register.
  * @threshold_temp: register containing the base threshold level.
  * @threshold_th0: Register containing first set of rising levels.
- * @threshold_th0_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th0_l1_shift: shift bits of level1 threshold temperature.
- * @threshold_th0_l2_shift: shift bits of level2 threshold temperature.
- * @threshold_th0_l3_shift: shift bits of level3 threshold temperature.
  * @threshold_th1: Register containing second set of rising levels.
- * @threshold_th1_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th1_l1_shift: shift bits of level1 threshold temperature.
- * @threshold_th1_l2_shift: shift bits of level2 threshold temperature.
- * @threshold_th1_l3_shift: shift bits of level3 threshold temperature.
  * @threshold_th2: Register containing third set of rising levels.
- * @threshold_th2_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th3: Register containing fourth set of rising levels.
  * @threshold_th3_l0_shift: shift bits of level0 threshold temperature.
  * @tmu_inten: register containing the different threshold interrupt
         enable bits.
@@ -130,68 +98,35 @@ enum soc_type {
  * @inten_rise2_shift: shift bits of rising 2 interrupt bits.
  * @inten_rise3_shift: shift bits of rising 3 interrupt bits.
  * @inten_fall0_shift: shift bits of falling 0 interrupt bits.
- * @inten_fall1_shift: shift bits of falling 1 interrupt bits.
- * @inten_fall2_shift: shift bits of falling 2 interrupt bits.
- * @inten_fall3_shift: shift bits of falling 3 interrupt bits.
  * @tmu_intstat: Register containing the interrupt status values.
  * @tmu_intclear: Register for clearing the raised interrupt status.
- * @intclr_fall_shift: shift bits for interrupt clear fall 0
- * @intclr_rise_shift: shift bits of all rising interrupt bits.
- * @intclr_rise_mask: mask bits of all rising interrupt bits.
- * @intclr_fall_mask: mask bits of all rising interrupt bits.
  * @emul_con: TMU emulation controller register.
  * @emul_temp_shift: shift bits of emulation temperature.
  * @emul_time_shift: shift bits of emulation time.
- * @emul_time_mask: mask bits of emulation time.
  * @tmu_irqstatus: register to find which TMU generated interrupts.
  * @tmu_pmin: register to get/set the Pmin value.
  */
 struct exynos_tmu_registers {
         u32     triminfo_data;
-        u32     triminfo_25_shift;
-        u32     triminfo_85_shift;
 
-        u32     triminfo_ctrl;
-        u32     triminfo_ctrl1;
-        u32     triminfo_reload_shift;
+        u32     triminfo_ctrl[MAX_TRIMINFO_CTRL_REG];
+        u32     triminfo_ctrl_count;
 
         u32     tmu_ctrl;
         u32     test_mux_addr_shift;
-        u32     buf_vref_sel_shift;
-        u32     buf_vref_sel_mask;
         u32     therm_trip_mode_shift;
         u32     therm_trip_mode_mask;
         u32     therm_trip_en_shift;
-        u32     buf_slope_sel_shift;
-        u32     buf_slope_sel_mask;
-        u32     calib_mode_shift;
-        u32     calib_mode_mask;
-        u32     therm_trip_tq_en_shift;
-        u32     core_en_shift;
 
         u32     tmu_status;
 
         u32     tmu_cur_temp;
-        u32     tmu_cur_temp_shift;
 
         u32     threshold_temp;
 
         u32     threshold_th0;
-        u32     threshold_th0_l0_shift;
-        u32     threshold_th0_l1_shift;
-        u32     threshold_th0_l2_shift;
-        u32     threshold_th0_l3_shift;
-
         u32     threshold_th1;
-        u32     threshold_th1_l0_shift;
-        u32     threshold_th1_l1_shift;
-        u32     threshold_th1_l2_shift;
-        u32     threshold_th1_l3_shift;
-
         u32     threshold_th2;
-        u32     threshold_th2_l0_shift;
-
-        u32     threshold_th3;
         u32     threshold_th3_l0_shift;
 
         u32     tmu_inten;
@@ -200,22 +135,14 @@ struct exynos_tmu_registers {
         u32     inten_rise2_shift;
         u32     inten_rise3_shift;
         u32     inten_fall0_shift;
-        u32     inten_fall1_shift;
-        u32     inten_fall2_shift;
-        u32     inten_fall3_shift;
 
         u32     tmu_intstat;
 
         u32     tmu_intclear;
-        u32     intclr_fall_shift;
-        u32     intclr_rise_shift;
-        u32     intclr_fall_mask;
-        u32     intclr_rise_mask;
 
         u32     emul_con;
         u32     emul_temp_shift;
         u32     emul_time_shift;
-        u32     emul_time_mask;
 
         u32     tmu_irqstatus;
         u32     tmu_pmin;
@@ -250,11 +177,12 @@ struct exynos_tmu_registers {
  *      1 = enable trigger_level[] interrupt,
  *      0 = disable trigger_level[] interrupt
  * @max_trigger_level: max trigger level supported by the TMU
+ * @non_hw_trigger_levels: number of defined non-hardware trigger levels
  * @gain: gain of amplifier in the positive-TC generator block
- *      0 <= gain <= 15
+ *      0 < gain <= 15
  * @reference_voltage: reference voltage of amplifier
  *      in the positive-TC generator block
- *      0 <= reference_voltage <= 31
+ *      0 < reference_voltage <= 31
  * @noise_cancel_mode: noise cancellation mode
  *      000, 100, 101, 110 and 111 can be different modes
  * @type: determines the type of SOC
@@ -265,8 +193,8 @@ struct exynos_tmu_registers {
  * @second_point_trim: temp value of the second point trimming
  * @default_temp_offset: default temperature offset in case of no trimming
  * @test_mux; information if SoC supports test MUX
+ * @triminfo_reload: reload value to read TRIMINFO register
  * @cal_type: calibration type for temperature
- * @cal_mode: calibration mode for temperature
  * @freq_clip_table: Table representing frequency reduction percentage.
  * @freq_tab_count: Count of the above table as frequency reduction may
  *      applicable to only some of the trigger levels.
@@ -284,6 +212,7 @@ struct exynos_tmu_platform_data {
         enum trigger_type trigger_type[MAX_TRIP_COUNT];
         bool trigger_enable[MAX_TRIP_COUNT];
         u8 max_trigger_level;
+        u8 non_hw_trigger_levels;
         u8 gain;
         u8 reference_voltage;
         u8 noise_cancel_mode;
@@ -295,9 +224,9 @@ struct exynos_tmu_platform_data {
         u8 second_point_trim;
         u8 default_temp_offset;
         u8 test_mux;
+        u8 triminfo_reload[MAX_TRIMINFO_CTRL_REG];
 
         enum calibration_type cal_type;
-        enum calibration_mode cal_mode;
         enum soc_type type;
         struct freq_clip_table freq_tab[4];
         unsigned int freq_tab_count;
diff --git a/drivers/thermal/samsung/exynos_tmu_data.c b/drivers/thermal/samsung/exynos_tmu_data.c
index aa8e0dee2055..1724f6cdaef8 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.c
+++ b/drivers/thermal/samsung/exynos_tmu_data.c
@@ -27,14 +27,7 @@
 #if defined(CONFIG_CPU_EXYNOS4210)
 static const struct exynos_tmu_registers exynos4210_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_temp = EXYNOS4210_TMU_REG_THRESHOLD_TEMP,
@@ -46,7 +39,6 @@ static const struct exynos_tmu_registers exynos4210_tmu_registers = {
         .inten_rise3_shift = EXYNOS_TMU_INTEN_RISE3_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_rise_mask = EXYNOS4210_TMU_TRIG_LEVEL_MASK,
 };
 
 struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
@@ -64,6 +56,7 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
                 .trigger_type[1] = THROTTLE_ACTIVE,
                 .trigger_type[2] = SW_TRIP,
                 .max_trigger_level = 4,
+                .non_hw_trigger_levels = 3,
                 .gain = 15,
                 .reference_voltage = 7,
                 .cal_type = TYPE_ONE_POINT_TRIMMING,
@@ -93,18 +86,14 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS3250)
 static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
+        .triminfo_ctrl[0] = EXYNOS_TMU_TRIMINFO_CON1,
+        .triminfo_ctrl[1] = EXYNOS_TMU_TRIMINFO_CON2,
+        .triminfo_ctrl_count = 2,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
         .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -116,14 +105,9 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define EXYNOS3250_TMU_DATA \
@@ -141,6 +125,7 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -160,8 +145,10 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
                 .temp_level = 95, \
         }, \
         .freq_tab_count = 2, \
+        .triminfo_reload[0] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
+        .triminfo_reload[1] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
         .registers = &exynos3250_tmu_registers, \
-        .features = (TMU_SUPPORT_EMULATION | \
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                         TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
                         TMU_SUPPORT_EMUL_TIME)
 #endif
@@ -182,20 +169,13 @@ struct exynos_tmu_init_data const exynos3250_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS4412) || defined(CONFIG_SOC_EXYNOS5250)
 static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
-        .triminfo_ctrl = EXYNOS_TMU_TRIMINFO_CON,
-        .triminfo_reload_shift = EXYNOS_TRIMINFO_RELOAD_SHIFT,
+        .triminfo_ctrl[0] = EXYNOS_TMU_TRIMINFO_CON2,
+        .triminfo_ctrl_count = 1,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
         .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -208,14 +188,9 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define EXYNOS4412_TMU_DATA \
@@ -233,6 +208,7 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -252,6 +228,7 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
                 .temp_level = 95, \
         }, \
         .freq_tab_count = 2, \
+        .triminfo_reload[0] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
         .registers = &exynos4412_tmu_registers, \
         .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                         TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
@@ -286,18 +263,10 @@ struct exynos_tmu_init_data const exynos5250_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5260)
 static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .tmu_ctrl = EXYNOS_TMU_REG_CONTROL1,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -310,14 +279,9 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS5260_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS5260_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS5260_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS5260_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS5260_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define __EXYNOS5260_TMU_DATA   \
@@ -335,6 +299,7 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -359,9 +324,8 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
 #define EXYNOS5260_TMU_DATA \
         __EXYNOS5260_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5260, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME)
 
 struct exynos_tmu_init_data const exynos5260_default_tmu_data = {
         .tmu_data = {
@@ -378,17 +342,10 @@ struct exynos_tmu_init_data const exynos5260_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5420)
 static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -402,14 +359,9 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define __EXYNOS5420_TMU_DATA   \
@@ -427,6 +379,7 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -451,16 +404,15 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
 #define EXYNOS5420_TMU_DATA \
         __EXYNOS5420_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5250, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME)
 
 #define EXYNOS5420_TMU_DATA_SHARED \
         __EXYNOS5420_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5420_TRIMINFO, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME | TMU_SUPPORT_ADDRESS_MULTIPLE)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME | \
+                        TMU_SUPPORT_ADDRESS_MULTIPLE)
 
 struct exynos_tmu_init_data const exynos5420_default_tmu_data = {
         .tmu_data = {
@@ -477,19 +429,10 @@ struct exynos_tmu_init_data const exynos5420_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5440)
 static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .triminfo_data = EXYNOS5440_TMU_S0_7_TRIM,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS5440_TMU_S0_7_CTRL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .calib_mode_shift = EXYNOS_TMU_CALIB_MODE_SHIFT,
-        .calib_mode_mask = EXYNOS_TMU_CALIB_MODE_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS5440_TMU_S0_7_STATUS,
         .tmu_cur_temp = EXYNOS5440_TMU_S0_7_TEMP,
         .threshold_th0 = EXYNOS5440_TMU_S0_7_TH0,
@@ -504,10 +447,6 @@ static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .inten_fall0_shift = EXYNOS5440_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS5440_TMU_S0_7_IRQ,
         .tmu_intclear = EXYNOS5440_TMU_S0_7_IRQ,
-        .intclr_fall_shift = EXYNOS5440_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS5440_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS5440_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS5440_TMU_FALL_INT_MASK,
         .tmu_irqstatus = EXYNOS5440_TMU_IRQ_STATUS,
         .emul_con = EXYNOS5440_TMU_S0_7_DEBUG,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
@@ -521,11 +460,11 @@ static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .trigger_type[0] = SW_TRIP, \
         .trigger_type[4] = HW_TRIP, \
         .max_trigger_level = 5, \
+        .non_hw_trigger_levels = 1, \
         .gain = 5, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
         .cal_type = TYPE_ONE_POINT_TRIMMING, \
-        .cal_mode = 0, \
         .efuse_value = 0x5b2d, \
         .min_efuse_value = 16, \
         .max_efuse_value = 76, \
diff --git a/drivers/thermal/samsung/exynos_tmu_data.h b/drivers/thermal/samsung/exynos_tmu_data.h
index f0979e598491..63de598c9c2c 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.h
+++ b/drivers/thermal/samsung/exynos_tmu_data.h
@@ -39,55 +39,31 @@
 #define EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT  8
 #define EXYNOS_TMU_CORE_EN_SHIFT        0
 
+/* Exynos3250 specific registers */
+#define EXYNOS_TMU_TRIMINFO_CON1        0x10
+
 /* Exynos4210 specific registers */
 #define EXYNOS4210_TMU_REG_THRESHOLD_TEMP       0x44
 #define EXYNOS4210_TMU_REG_TRIG_LEVEL0  0x50
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL1  0x54
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL2  0x58
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL3  0x5C
-#define EXYNOS4210_TMU_REG_PAST_TEMP0   0x60
-#define EXYNOS4210_TMU_REG_PAST_TEMP1   0x64
-#define EXYNOS4210_TMU_REG_PAST_TEMP2   0x68
-#define EXYNOS4210_TMU_REG_PAST_TEMP3   0x6C
-
-#define EXYNOS4210_TMU_TRIG_LEVEL0_MASK 0x1
-#define EXYNOS4210_TMU_TRIG_LEVEL1_MASK 0x10
-#define EXYNOS4210_TMU_TRIG_LEVEL2_MASK 0x100
-#define EXYNOS4210_TMU_TRIG_LEVEL3_MASK 0x1000
-#define EXYNOS4210_TMU_TRIG_LEVEL_MASK  0x1111
-#define EXYNOS4210_TMU_INTCLEAR_VAL     0x1111
-
-/* Exynos5250 and Exynos4412 specific registers */
-#define EXYNOS_TMU_TRIMINFO_CON 0x14
+
+/* Exynos5250, Exynos4412, Exynos3250 specific registers */
+#define EXYNOS_TMU_TRIMINFO_CON2        0x14
 #define EXYNOS_THD_TEMP_RISE            0x50
 #define EXYNOS_THD_TEMP_FALL            0x54
 #define EXYNOS_EMUL_CON         0x80
 
-#define EXYNOS_TRIMINFO_RELOAD_SHIFT    1
+#define EXYNOS_TRIMINFO_RELOAD_ENABLE   1
 #define EXYNOS_TRIMINFO_25_SHIFT        0
 #define EXYNOS_TRIMINFO_85_SHIFT        8
-#define EXYNOS_TMU_RISE_INT_MASK        0x111
-#define EXYNOS_TMU_RISE_INT_SHIFT       0
-#define EXYNOS_TMU_FALL_INT_MASK        0x111
-#define EXYNOS_TMU_CLEAR_RISE_INT       0x111
-#define EXYNOS_TMU_CLEAR_FALL_INT       (0x111 << 12)
-#define EXYNOS_TMU_CLEAR_FALL_INT_SHIFT 12
-#define EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT     16
-#define EXYNOS5440_TMU_CLEAR_FALL_INT_SHIFT     4
 #define EXYNOS_TMU_TRIP_MODE_SHIFT      13
 #define EXYNOS_TMU_TRIP_MODE_MASK       0x7
 #define EXYNOS_TMU_THERM_TRIP_EN_SHIFT  12
-#define EXYNOS_TMU_CALIB_MODE_SHIFT     4
-#define EXYNOS_TMU_CALIB_MODE_MASK      0x3
 
 #define EXYNOS_TMU_INTEN_RISE0_SHIFT    0
 #define EXYNOS_TMU_INTEN_RISE1_SHIFT    4
 #define EXYNOS_TMU_INTEN_RISE2_SHIFT    8
 #define EXYNOS_TMU_INTEN_RISE3_SHIFT    12
 #define EXYNOS_TMU_INTEN_FALL0_SHIFT    16
-#define EXYNOS_TMU_INTEN_FALL1_SHIFT    20
-#define EXYNOS_TMU_INTEN_FALL2_SHIFT    24
-#define EXYNOS_TMU_INTEN_FALL3_SHIFT    28
 
 #define EXYNOS_EMUL_TIME        0x57F0
 #define EXYNOS_EMUL_TIME_MASK   0xffff
@@ -99,14 +75,9 @@
 #define EXYNOS_MAX_TRIGGER_PER_REG      4
 
 /* Exynos5260 specific */
-#define EXYNOS_TMU_REG_CONTROL1                 0x24
 #define EXYNOS5260_TMU_REG_INTEN                0xC0
 #define EXYNOS5260_TMU_REG_INTSTAT              0xC4
 #define EXYNOS5260_TMU_REG_INTCLEAR             0xC8
-#define EXYNOS5260_TMU_CLEAR_RISE_INT           0x1111
-#define EXYNOS5260_TMU_CLEAR_FALL_INT           (0x1111 << 16)
-#define EXYNOS5260_TMU_RISE_INT_MASK            0x1111
-#define EXYNOS5260_TMU_FALL_INT_MASK            0x1111
 #define EXYNOS5260_EMUL_CON                     0x100
 
 /* Exynos4412 specific */
@@ -122,29 +93,17 @@
 #define EXYNOS5440_TMU_S0_7_TH0                 0x110
 #define EXYNOS5440_TMU_S0_7_TH1                 0x130
 #define EXYNOS5440_TMU_S0_7_TH2                 0x150
-#define EXYNOS5440_TMU_S0_7_EVTEN               0x1F0
 #define EXYNOS5440_TMU_S0_7_IRQEN               0x210
 #define EXYNOS5440_TMU_S0_7_IRQ                 0x230
 /* exynos5440 common registers */
 #define EXYNOS5440_TMU_IRQ_STATUS               0x000
 #define EXYNOS5440_TMU_PMIN                     0x004
-#define EXYNOS5440_TMU_TEMP                     0x008
 
-#define EXYNOS5440_TMU_RISE_INT_MASK            0xf
-#define EXYNOS5440_TMU_RISE_INT_SHIFT           0
-#define EXYNOS5440_TMU_FALL_INT_MASK            0xf
 #define EXYNOS5440_TMU_INTEN_RISE0_SHIFT        0
 #define EXYNOS5440_TMU_INTEN_RISE1_SHIFT        1
 #define EXYNOS5440_TMU_INTEN_RISE2_SHIFT        2
 #define EXYNOS5440_TMU_INTEN_RISE3_SHIFT        3
 #define EXYNOS5440_TMU_INTEN_FALL0_SHIFT        4
-#define EXYNOS5440_TMU_INTEN_FALL1_SHIFT        5
-#define EXYNOS5440_TMU_INTEN_FALL2_SHIFT        6
-#define EXYNOS5440_TMU_INTEN_FALL3_SHIFT        7
-#define EXYNOS5440_TMU_TH_RISE0_SHIFT           0
-#define EXYNOS5440_TMU_TH_RISE1_SHIFT           8
-#define EXYNOS5440_TMU_TH_RISE2_SHIFT           16
-#define EXYNOS5440_TMU_TH_RISE3_SHIFT           24
 #define EXYNOS5440_TMU_TH_RISE4_SHIFT           24
 #define EXYNOS5440_EFUSE_SWAP_OFFSET            8
 
diff --git a/drivers/thermal/st/st_thermal.c b/drivers/thermal/st/st_thermal.c
index 90163b384660..d1ec5804c0bb 100644
--- a/drivers/thermal/st/st_thermal.c
+++ b/drivers/thermal/st/st_thermal.c
@@ -275,6 +275,7 @@ int st_thermal_unregister(struct platform_device *pdev)
 }
 EXPORT_SYMBOL_GPL(st_thermal_unregister);
 
+#ifdef CONFIG_PM_SLEEP
 static int st_thermal_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -305,6 +306,8 @@ static int st_thermal_resume(struct device *dev)
 
         return 0;
 }
+#endif
+
 SIMPLE_DEV_PM_OPS(st_thermal_pm_ops, st_thermal_suspend, st_thermal_resume);
 EXPORT_SYMBOL_GPL(st_thermal_pm_ops);
 
diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
index f251521baaa2..fdd1f523a1ed 100644
--- a/drivers/thermal/step_wise.c
+++ b/drivers/thermal/step_wise.c
@@ -23,6 +23,7 @@
  */
 
 #include <linux/thermal.h>
+#include <trace/events/thermal.h>
 
 #include "thermal_core.h"
 
@@ -76,7 +77,7 @@ static unsigned long get_target_state(struct thermal_instance *instance,
                         next_target = instance->upper;
                 break;
         case THERMAL_TREND_DROPPING:
-                if (cur_state == instance->lower) {
+                if (cur_state <= instance->lower) {
                         if (!throttle)
                                 next_target = THERMAL_NO_TARGET;
                 } else {
@@ -129,8 +130,10 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
 
         trend = get_tz_trend(tz, trip);
 
-        if (tz->temperature >= trip_temp)
+        if (tz->temperature >= trip_temp) {
                 throttle = true;
+                trace_thermal_zone_trip(tz, trip, trip_type);
+        }
 
         dev_dbg(&tz->device, "Trip%d[type=%d,temp=%ld]:trend=%d,throttle=%d\n",
                                 trip, trip_type, trip_temp, trend, throttle);
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 1e23f4f8d2c2..43b90709585f 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -38,6 +38,9 @@
 #include <net/netlink.h>
 #include <net/genetlink.h>
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/thermal.h>
+
 #include "thermal_core.h"
 #include "thermal_hwmon.h"
 
@@ -368,6 +371,8 @@ static void handle_critical_trips(struct thermal_zone_device *tz,
         if (tz->temperature < trip_temp)
                 return;
 
+        trace_thermal_zone_trip(tz, trip, trip_type);
+
         if (tz->ops->notify)
                 tz->ops->notify(tz, trip, trip_type);
 
@@ -463,6 +468,7 @@ static void update_temperature(struct thermal_zone_device *tz)
         tz->temperature = temp;
         mutex_unlock(&tz->lock);
 
+        trace_thermal_temperature(tz);
         dev_dbg(&tz->device, "last_temperature=%d, current_temperature=%d\n",
                                 tz->last_temperature, tz->temperature);
 }
@@ -1287,6 +1293,7 @@ void thermal_cdev_update(struct thermal_cooling_device *cdev)
         mutex_unlock(&cdev->lock);
         cdev->ops->set_cur_state(cdev, target);
         cdev->updated = true;
+        trace_cdev_update(cdev, target);
         dev_dbg(&cdev->device, "set to state %lu\n", target);
 }
 EXPORT_SYMBOL(thermal_cdev_update);
@@ -1568,8 +1575,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
 
         thermal_zone_device_update(tz);
 
-        if (!result)
-                return tz;
+        return tz;
 
 unregister:
         release_idr(&thermal_tz_idr, &thermal_idr_lock, tz->id);
@@ -1790,6 +1796,10 @@ static int __init thermal_register_governors(void)
         if (result)
                 return result;
 
+        result = thermal_gov_bang_bang_register();
+        if (result)
+                return result;
+
         return thermal_gov_user_space_register();
 }
 
@@ -1797,6 +1807,7 @@ static void thermal_unregister_governors(void)
 {
         thermal_gov_step_wise_unregister();
         thermal_gov_fair_share_unregister();
+        thermal_gov_bang_bang_unregister();
         thermal_gov_user_space_unregister();
 }
 
diff --git a/drivers/thermal/thermal_core.h b/drivers/thermal/thermal_core.h
index 3db339fb636f..d15d243de27a 100644
--- a/drivers/thermal/thermal_core.h
+++ b/drivers/thermal/thermal_core.h
@@ -69,6 +69,14 @@ static inline int thermal_gov_fair_share_register(void) { return 0; }
 static inline void thermal_gov_fair_share_unregister(void) {}
 #endif /* CONFIG_THERMAL_GOV_FAIR_SHARE */
 
+#ifdef CONFIG_THERMAL_GOV_BANG_BANG
+int thermal_gov_bang_bang_register(void);
+void thermal_gov_bang_bang_unregister(void);
+#else
+static inline int thermal_gov_bang_bang_register(void) { return 0; }
+static inline void thermal_gov_bang_bang_unregister(void) {}
+#endif /* CONFIG_THERMAL_GOV_BANG_BANG */
+
 #ifdef CONFIG_THERMAL_GOV_USER_SPACE
 int thermal_gov_user_space_register(void);
 void thermal_gov_user_space_unregister(void);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 89c4cee253e3..2e900a98c3e3 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2413,12 +2413,17 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
 
         poll_wait(file, &tty->read_wait, wait);
         poll_wait(file, &tty->write_wait, wait);
+        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
+                mask |= POLLHUP;
         if (input_available_p(tty, 1))
                 mask |= POLLIN | POLLRDNORM;
+        else if (mask & POLLHUP) {
+                tty_flush_to_ldisc(tty);
+                if (input_available_p(tty, 1))
+                        mask |= POLLIN | POLLRDNORM;
+        }
         if (tty->packet && tty->link->ctrl_status)
                 mask |= POLLPRI | POLLIN | POLLRDNORM;
-        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
-                mask |= POLLHUP;
         if (tty_hung_up_p(file))
                 mask |= POLLHUP;
         if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index 8f37d57165ec..de7aae523b37 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -81,7 +81,7 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
                 /* Set to highest baudrate supported */
                 if (baud >= 1152000)
                         baud = 921600;
-                quot = DIV_ROUND_CLOSEST(port->uartclk, 256 * baud);
+                quot = (port->uartclk / (256 * baud)) + 1;
         }
 
         /*
diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index 8bc2563335ae..bf355050eab6 100644
--- a/drivers/tty/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
@@ -158,7 +158,7 @@ static int of_platform_serial_probe(struct platform_device *ofdev)
         if (of_find_property(ofdev->dev.of_node, "used-by-rtas", NULL))
                 return -EBUSY;
 
-        info = kmalloc(sizeof(*info), GFP_KERNEL);
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (info == NULL)
                 return -ENOMEM;
 
@@ -240,32 +240,6 @@ static int of_platform_serial_remove(struct platform_device *ofdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int of_serial_suspend(struct device *dev)
-{
-        struct of_serial_info *info = dev_get_drvdata(dev);
-
-        serial8250_suspend_port(info->line);
-        if (info->clk)
-                clk_disable_unprepare(info->clk);
-
-        return 0;
-}
-
-static int of_serial_resume(struct device *dev)
-{
-        struct of_serial_info *info = dev_get_drvdata(dev);
-
-        if (info->clk)
-                clk_prepare_enable(info->clk);
-
-        serial8250_resume_port(info->line);
-
-        return 0;
-}
-#endif
-static SIMPLE_DEV_PM_OPS(of_serial_pm_ops, of_serial_suspend, of_serial_resume);
-
 /*
  * A few common types, add more as needed.
  */
@@ -297,7 +271,6 @@ static struct platform_driver of_platform_serial_driver = {
                 .name = "of_serial",
                 .owner = THIS_MODULE,
                 .of_match_table = of_platform_serial_table,
-                .pm = &of_serial_pm_ops,
         },
         .probe = of_platform_serial_probe,
         .remove = of_platform_serial_remove,
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index df3a8c74358e..eaeb9a02c7fe 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -363,7 +363,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
                  * The spd_hi, spd_vhi, spd_shi, spd_warp kludge...
                  * Die! Die! Die!
                  */
-                if (baud == 38400)
+                if (try == 0 && baud == 38400)
                         baud = altbaud;
 
                 /*
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 16a2c0237dd6..0508a1d8e4cd 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1709,6 +1709,8 @@ int tty_release(struct inode *inode, struct file *filp)
         int     pty_master, tty_closing, o_tty_closing, do_sleep;
         int     idx;
         char    buf[64];
+        long    timeout = 0;
+        int     once = 1;
 
         if (tty_paranoia_check(tty, inode, __func__))
                 return 0;
@@ -1789,11 +1791,18 @@ int tty_release(struct inode *inode, struct file *filp)
                 if (!do_sleep)
                         break;
 
-                printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
-                                __func__, tty_name(tty, buf));
+                if (once) {
+                        once = 0;
+                        printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
+                               __func__, tty_name(tty, buf));
+                }
                 tty_unlock_pair(tty, o_tty);
                 mutex_unlock(&tty_mutex);
-                schedule();
+                schedule_timeout_killable(timeout);
+                if (timeout < 120 * HZ)
+                        timeout = 2 * timeout + 1;
+                else
+                        timeout = MAX_SCHEDULE_TIMEOUT;
         }
 
         /*
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
index 610b720d3b91..59b25e039968 100644
--- a/drivers/tty/vt/consolemap.c
+++ b/drivers/tty/vt/consolemap.c
@@ -539,6 +539,12 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list)
 
         /* Save original vc_unipagdir_loc in case we allocate a new one */
         p = *vc->vc_uni_pagedir_loc;
+
+        if (!p) {
+                err = -EINVAL;
+
+                goto out_unlock;
+        }
         
         if (p->refcount > 1) {
                 int j, k;
@@ -623,6 +629,7 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list)
                 set_inverse_transl(vc, p, i); /* Update inverse translations */
         set_inverse_trans_unicode(vc, p);
 
+out_unlock:
         console_unlock();
         return err;
 }
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index a673e5b6a2e0..60fa6278fbce 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -28,18 +28,6 @@
 
 #define UIO_MAX_DEVICES         (1U << MINORBITS)
 
-struct uio_device {
-        struct module           *owner;
-        struct device           *dev;
-        int                     minor;
-        atomic_t                event;
-        struct fasync_struct    *async_queue;
-        wait_queue_head_t       wait;
-        struct uio_info         *info;
-        struct kobject          *map_dir;
-        struct kobject          *portio_dir;
-};
-
 static int uio_major;
 static struct cdev *uio_cdev;
 static DEFINE_IDR(uio_idr);
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 3df5005c554d..9bdc6bd73432 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -742,7 +742,6 @@ static int ci_hdrc_remove(struct platform_device *pdev)
         ci_role_destroy(ci);
         ci_hdrc_enter_lpm(ci, true);
         usb_phy_shutdown(ci->transceiver);
-        kfree(ci->hw_bank.regmap);
 
         return 0;
 }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e934e19f49f5..077d58ac3dcb 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -60,6 +60,9 @@ static struct acm *acm_table[ACM_TTY_MINORS];
 
 static DEFINE_MUTEX(acm_table_lock);
 
+static void acm_tty_set_termios(struct tty_struct *tty,
+                                struct ktermios *termios_old);
+
 /*
  * acm_table accessors
  */
@@ -145,8 +148,15 @@ static int acm_ctrl_msg(struct acm *acm, int request, int value,
 /* devices aren't required to support these requests.
  * the cdc acm descriptor tells whether they do...
  */
-#define acm_set_control(acm, control) \
-        acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE, control, NULL, 0)
+static inline int acm_set_control(struct acm *acm, int control)
+{
+        if (acm->quirks & QUIRK_CONTROL_LINE_STATE)
+                return -EOPNOTSUPP;
+
+        return acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE,
+                        control, NULL, 0);
+}
+
 #define acm_set_line(acm, line) \
         acm_ctrl_msg(acm, USB_CDC_REQ_SET_LINE_CODING, 0, line, sizeof *(line))
 #define acm_send_break(acm, ms) \
@@ -554,6 +564,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
                 goto error_submit_urb;
         }
 
+        acm_tty_set_termios(tty, NULL);
+
         /*
          * Unthrottle device in case the TTY was closed while throttled.
          */
@@ -980,11 +992,12 @@ static void acm_tty_set_termios(struct tty_struct *tty,
         /* FIXME: Needs to clear unsupported bits in the termios */
         acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
 
-        if (!newline.dwDTERate) {
+        if (C_BAUD(tty) == B0) {
                 newline.dwDTERate = acm->line.dwDTERate;
                 newctrl &= ~ACM_CTRL_DTR;
-        } else
+        } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) {
                 newctrl |=  ACM_CTRL_DTR;
+        }
 
         if (newctrl != acm->ctrlout)
                 acm_set_control(acm, acm->ctrlout = newctrl);
@@ -1314,6 +1327,7 @@ made_compressed_probe:
         tty_port_init(&acm->port);
         acm->port.ops = &acm_port_ops;
         init_usb_anchor(&acm->delayed);
+        acm->quirks = quirks;
 
         buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
         if (!buf) {
@@ -1681,6 +1695,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
+        .driver_info = QUIRK_CONTROL_LINE_STATE, },
+        { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
         { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
         },
         /* Motorola H24 HSPA module: */
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index fc75651afe1c..d3251ebd09e2 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -121,6 +121,7 @@ struct acm {
         unsigned int throttle_req:1;                    /* throttle requested */
         u8 bInterval;
         struct usb_anchor delayed;                      /* writes queued for a device about to be woken */
+        unsigned long quirks;
 };
 
 #define CDC_DATA_INTERFACE_TYPE 0x0a
@@ -132,3 +133,4 @@ struct acm {
 #define NOT_A_MODEM                     BIT(3)
 #define NO_DATA_INTERFACE               BIT(4)
 #define IGNORE_DEVICE                   BIT(5)
+#define QUIRK_CONTROL_LINE_STATE        BIT(6)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index b84fb141e122..a6efb4184f2b 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2060,6 +2060,8 @@ int usb_alloc_streams(struct usb_interface *interface,
                 return -EINVAL;
         if (dev->speed != USB_SPEED_SUPER)
                 return -EINVAL;
+        if (dev->state < USB_STATE_CONFIGURED)
+                return -ENODEV;
 
         for (i = 0; i < num_eps; i++) {
                 /* Streams only apply to bulk endpoints. */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 11e80ac31324..b649fef2e35d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4468,9 +4468,6 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
         if (retval)
                 goto fail;
 
-        if (hcd->usb_phy && !hdev->parent)
-                usb_phy_notify_connect(hcd->usb_phy, udev->speed);
-
         /*
          * Some superspeed devices have finished the link training process
          * and attached to a superspeed hub port, but the device descriptor
@@ -4627,8 +4624,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
 
         /* Disconnect any existing devices under this port */
         if (udev) {
-                if (hcd->usb_phy && !hdev->parent &&
-                                !(portstatus & USB_PORT_STAT_CONNECTION))
+                if (hcd->usb_phy && !hdev->parent)
                         usb_phy_notify_disconnect(hcd->usb_phy, udev->speed);
                 usb_disconnect(&port_dev->child);
         }
@@ -4783,6 +4779,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                                 port_dev->child = NULL;
                                 spin_unlock_irq(&device_state_lock);
                                 mutex_unlock(&usb_port_peer_mutex);
+                        } else {
+                                if (hcd->usb_phy && !hdev->parent)
+                                        usb_phy_notify_connect(hcd->usb_phy,
+                                                        udev->speed);
                         }
                 }
 
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 5ae883dc21f5..96fafed92b76 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Microsoft Wireless Laser Mouse 6000 Receiver */
+        { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Microsoft LifeCam-VX700 v2.0 */
         { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
@@ -97,6 +100,12 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x04f3, 0x0089), .driver_info =
                         USB_QUIRK_DEVICE_QUALIFIER },
 
+        { USB_DEVICE(0x04f3, 0x009b), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
+
+        { USB_DEVICE(0x04f3, 0x016f), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
+
         /* Roland SC-8820 */
         { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index bf015ab3b44c..55c90c53f2d6 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -619,7 +619,7 @@ struct dwc2_hsotg {
                         unsigned port_suspend_change:1;
                         unsigned port_over_current_change:1;
                         unsigned port_l1_change:1;
-                        unsigned reserved:26;
+                        unsigned reserved:25;
                 } b;
         } flags;
 
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 7b5856fadd93..8b5c079c7b7d 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -2327,7 +2327,7 @@ irq_retry:
 
                 u32 usb_status = readl(hsotg->regs + GOTGCTL);
 
-                dev_info(hsotg->dev, "%s: USBRst\n", __func__);
+                dev_dbg(hsotg->dev, "%s: USBRst\n", __func__);
                 dev_dbg(hsotg->dev, "GNPTXSTS=%08x\n",
                         readl(hsotg->regs + GNPTXSTS));
 
@@ -2561,8 +2561,10 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
                         hs_ep->fifo_size = val;
                         break;
                 }
-                if (i == 8)
-                        return -ENOMEM;
+                if (i == 8) {
+                        ret = -ENOMEM;
+                        goto error;
+                }
         }
 
         /* for non control endpoints, set PID to D0 */
@@ -2579,6 +2581,7 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         /* enable the endpoint interrupt */
         s3c_hsotg_ctrl_epint(hsotg, index, dir_in, 1);
 
+error:
         spin_unlock_irqrestore(&hsotg->lock, flags);
         return ret;
 }
@@ -2934,9 +2937,7 @@ static int s3c_hsotg_udc_stop(struct usb_gadget *gadget,
 
         spin_lock_irqsave(&hsotg->lock, flags);
 
-        if (!driver)
-                hsotg->driver = NULL;
-
+        hsotg->driver = NULL;
         hsotg->gadget.speed = USB_SPEED_UNKNOWN;
 
         spin_unlock_irqrestore(&hsotg->lock, flags);
@@ -3567,6 +3568,7 @@ static int s3c_hsotg_probe(struct platform_device *pdev)
                 s3c_hsotg_initep(hsotg, &hsotg->eps[epnum], epnum);
 
         /* disable power and clock */
+        s3c_hsotg_phy_disable(hsotg);
 
         ret = regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies),
                                     hsotg->supplies);
@@ -3575,8 +3577,6 @@ static int s3c_hsotg_probe(struct platform_device *pdev)
                 goto err_ep_mem;
         }
 
-        s3c_hsotg_phy_disable(hsotg);
-
         ret = usb_add_gadget_udc(&pdev->dev, &hsotg->gadget);
         if (ret)
                 goto err_ep_mem;
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 2f537d588225..a0aa9f3da441 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -597,7 +597,7 @@ static int dwc3_omap_prepare(struct device *dev)
 {
         struct dwc3_omap        *omap = dev_get_drvdata(dev);
 
-        dwc3_omap_write_irqmisc_set(omap, 0x00);
+        dwc3_omap_disable_irqs(omap);
 
         return 0;
 }
@@ -605,19 +605,8 @@ static int dwc3_omap_prepare(struct device *dev)
 static void dwc3_omap_complete(struct device *dev)
 {
         struct dwc3_omap        *omap = dev_get_drvdata(dev);
-        u32                     reg;
 
-        reg = (USBOTGSS_IRQMISC_OEVT |
-                        USBOTGSS_IRQMISC_DRVVBUS_RISE |
-                        USBOTGSS_IRQMISC_CHRGVBUS_RISE |
-                        USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
-                        USBOTGSS_IRQMISC_IDPULLUP_RISE |
-                        USBOTGSS_IRQMISC_DRVVBUS_FALL |
-                        USBOTGSS_IRQMISC_CHRGVBUS_FALL |
-                        USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
-                        USBOTGSS_IRQMISC_IDPULLUP_FALL);
-
-        dwc3_omap_write_irqmisc_set(omap, reg);
+        dwc3_omap_enable_irqs(omap);
 }
 
 static int dwc3_omap_suspend(struct device *dev)
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 436fb08c40b8..a36cf66302fb 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -30,6 +30,7 @@
 #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
 #define PCI_DEVICE_ID_INTEL_BYT         0x0f37
 #define PCI_DEVICE_ID_INTEL_MRFLD       0x119e
+#define PCI_DEVICE_ID_INTEL_BSW         0x22B7
 
 struct dwc3_pci {
         struct device           *dev;
@@ -181,6 +182,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS,
                                 PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3),
         },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BSW), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
         {  }    /* Terminating Entry */
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index b35938777dde..df38e7ef4976 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -256,7 +256,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
 
         /* stall is always issued on EP0 */
         dep = dwc->eps[0];
-        __dwc3_gadget_ep_set_halt(dep, 1);
+        __dwc3_gadget_ep_set_halt(dep, 1, false);
         dep->flags = DWC3_EP_ENABLED;
         dwc->delayed_status = false;
 
@@ -271,7 +271,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
         dwc3_ep0_out_start(dwc);
 }
 
-int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
+int __dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
 {
         struct dwc3_ep                  *dep = to_dwc3_ep(ep);
         struct dwc3                     *dwc = dep->dwc;
@@ -281,6 +281,20 @@ int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
         return 0;
 }
 
+int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
+{
+        struct dwc3_ep                  *dep = to_dwc3_ep(ep);
+        struct dwc3                     *dwc = dep->dwc;
+        unsigned long                   flags;
+        int                             ret;
+
+        spin_lock_irqsave(&dwc->lock, flags);
+        ret = __dwc3_gadget_ep0_set_halt(ep, value);
+        spin_unlock_irqrestore(&dwc->lock, flags);
+
+        return ret;
+}
+
 void dwc3_ep0_out_start(struct dwc3 *dwc)
 {
         int                             ret;
@@ -466,7 +480,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
                                 return -EINVAL;
                         if (set == 0 && (dep->flags & DWC3_EP_WEDGE))
                                 break;
-                        ret = __dwc3_gadget_ep_set_halt(dep, set);
+                        ret = __dwc3_gadget_ep_set_halt(dep, set, true);
                         if (ret)
                                 return -EINVAL;
                         break;
@@ -775,11 +789,12 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
 
         dwc->ep0_next_event = DWC3_EP0_NRDY_STATUS;
 
-        r = next_request(&ep0->request_list);
-        ur = &r->request;
-
         trb = dwc->ep0_trb;
 
+        r = next_request(&ep0->request_list);
+        if (!r)
+                return;
+
         status = DWC3_TRB_SIZE_TRBSTS(trb->size);
         if (status == DWC3_TRBSTS_SETUP_PENDING) {
                 dwc3_trace(trace_dwc3_ep0, "Setup Pending received");
@@ -790,6 +805,8 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                 return;
         }
 
+        ur = &r->request;
+
         length = trb->size & DWC3_TRB_SIZE_MASK;
 
         if (dwc->ep0_bounced) {
@@ -811,12 +828,19 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
 
                 dwc3_ep0_stall_and_restart(dwc);
         } else {
-                /*
-                 * handle the case where we have to send a zero packet. This
-                 * seems to be case when req.length > maxpacket. Could it be?
-                 */
-                if (r)
-                        dwc3_gadget_giveback(ep0, r, 0);
+                dwc3_gadget_giveback(ep0, r, 0);
+
+                if (IS_ALIGNED(ur->length, ep0->endpoint.maxpacket) &&
+                                ur->length && ur->zero) {
+                        int ret;
+
+                        dwc->ep0_next_event = DWC3_EP0_COMPLETE;
+
+                        ret = dwc3_ep0_start_trans(dwc, epnum,
+                                        dwc->ctrl_req_addr, 0,
+                                        DWC3_TRBCTL_CONTROL_DATA);
+                        WARN_ON(ret < 0);
+                }
         }
 }
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 3818b26bfc05..546ea5431b8c 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -525,12 +525,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
                 if (!usb_endpoint_xfer_isoc(desc))
                         return 0;
 
-                memset(&trb_link, 0, sizeof(trb_link));
-
                 /* Link TRB for ISOC. The HWO bit is never reset */
                 trb_st_hw = &dep->trb_pool[0];
 
                 trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1];
+                memset(trb_link, 0, sizeof(*trb_link));
 
                 trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw));
                 trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw));
@@ -581,7 +580,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
 
         /* make sure HW endpoint isn't stalled */
         if (dep->flags & DWC3_EP_STALL)
-                __dwc3_gadget_ep_set_halt(dep, 0);
+                __dwc3_gadget_ep_set_halt(dep, 0, false);
 
         reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
         reg &= ~DWC3_DALEPENA_EP(dep->number);
@@ -1202,15 +1201,28 @@ out0:
         return ret;
 }
 
-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
 {
         struct dwc3_gadget_ep_cmd_params        params;
         struct dwc3                             *dwc = dep->dwc;
         int                                     ret;
 
+        if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
+                dev_err(dwc->dev, "%s is of Isochronous type\n", dep->name);
+                return -EINVAL;
+        }
+
         memset(&params, 0x00, sizeof(params));
 
         if (value) {
+                if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) ||
+                                (!list_empty(&dep->req_queued) ||
+                                 !list_empty(&dep->request_list)))) {
+                        dev_dbg(dwc->dev, "%s: pending request, cannot halt\n",
+                                        dep->name);
+                        return -EAGAIN;
+                }
+
                 ret = dwc3_send_gadget_ep_cmd(dwc, dep->number,
                         DWC3_DEPCMD_SETSTALL, &params);
                 if (ret)
@@ -1241,15 +1253,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value)
         int                             ret;
 
         spin_lock_irqsave(&dwc->lock, flags);
-
-        if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
-                dev_err(dwc->dev, "%s is of Isochronous type\n", dep->name);
-                ret = -EINVAL;
-                goto out;
-        }
-
-        ret = __dwc3_gadget_ep_set_halt(dep, value);
-out:
+        ret = __dwc3_gadget_ep_set_halt(dep, value, false);
         spin_unlock_irqrestore(&dwc->lock, flags);
 
         return ret;
@@ -1260,15 +1264,18 @@ static int dwc3_gadget_ep_set_wedge(struct usb_ep *ep)
         struct dwc3_ep                  *dep = to_dwc3_ep(ep);
         struct dwc3                     *dwc = dep->dwc;
         unsigned long                   flags;
+        int                             ret;
 
         spin_lock_irqsave(&dwc->lock, flags);
         dep->flags |= DWC3_EP_WEDGE;
-        spin_unlock_irqrestore(&dwc->lock, flags);
 
         if (dep->number == 0 || dep->number == 1)
-                return dwc3_gadget_ep0_set_halt(ep, 1);
+                ret = __dwc3_gadget_ep0_set_halt(ep, 1);
         else
-                return dwc3_gadget_ep_set_halt(ep, 1);
+                ret = __dwc3_gadget_ep_set_halt(dep, 1, false);
+        spin_unlock_irqrestore(&dwc->lock, flags);
+
+        return ret;
 }
 
 /* -------------------------------------------------------------------------- */
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index 178ad8982206..18ae3eaa8b6f 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -82,10 +82,11 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
 void dwc3_ep0_interrupt(struct dwc3 *dwc,
                 const struct dwc3_event_depevt *event);
 void dwc3_ep0_out_start(struct dwc3 *dwc);
+int __dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value);
 int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value);
 int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request,
                 gfp_t gfp_flags);
-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value);
+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol);
 
 /**
  * dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW
diff --git a/drivers/usb/dwc3/trace.h b/drivers/usb/dwc3/trace.h
index 78aff1da089a..60b0f41eafc4 100644
--- a/drivers/usb/dwc3/trace.h
+++ b/drivers/usb/dwc3/trace.h
@@ -73,15 +73,23 @@ DECLARE_EVENT_CLASS(dwc3_log_ctrl,
         TP_PROTO(struct usb_ctrlrequest *ctrl),
         TP_ARGS(ctrl),
         TP_STRUCT__entry(
-                __field(struct usb_ctrlrequest *, ctrl)
+                __field(__u8, bRequestType)
+                __field(__u8, bRequest)
+                __field(__le16, wValue)
+                __field(__le16, wIndex)
+                __field(__le16, wLength)
         ),
         TP_fast_assign(
-                __entry->ctrl = ctrl;
+                __entry->bRequestType = ctrl->bRequestType;
+                __entry->bRequest = ctrl->bRequest;
+                __entry->wValue = ctrl->wValue;
+                __entry->wIndex = ctrl->wIndex;
+                __entry->wLength = ctrl->wLength;
         ),
         TP_printk("bRequestType %02x bRequest %02x wValue %04x wIndex %04x wLength %d",
-                __entry->ctrl->bRequestType, __entry->ctrl->bRequest,
-                le16_to_cpu(__entry->ctrl->wValue), le16_to_cpu(__entry->ctrl->wIndex),
-                le16_to_cpu(__entry->ctrl->wLength)
+                __entry->bRequestType, __entry->bRequest,
+                le16_to_cpu(__entry->wValue), le16_to_cpu(__entry->wIndex),
+                le16_to_cpu(__entry->wLength)
         )
 );
 
@@ -94,15 +102,22 @@ DECLARE_EVENT_CLASS(dwc3_log_request,
         TP_PROTO(struct dwc3_request *req),
         TP_ARGS(req),
         TP_STRUCT__entry(
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(struct dwc3_request *, req)
+                __field(unsigned, actual)
+                __field(unsigned, length)
+                __field(int, status)
         ),
         TP_fast_assign(
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", req->dep->name);
                 __entry->req = req;
+                __entry->actual = req->request.actual;
+                __entry->length = req->request.length;
+                __entry->status = req->request.status;
         ),
         TP_printk("%s: req %p length %u/%u ==> %d",
-                __entry->req->dep->name, __entry->req,
-                __entry->req->request.actual, __entry->req->request.length,
-                __entry->req->request.status
+                __get_str(name), __entry->req, __entry->actual, __entry->length,
+                __entry->status
         )
 );
 
@@ -158,17 +173,17 @@ DECLARE_EVENT_CLASS(dwc3_log_gadget_ep_cmd,
                 struct dwc3_gadget_ep_cmd_params *params),
         TP_ARGS(dep, cmd, params),
         TP_STRUCT__entry(
-                __field(struct dwc3_ep *, dep)
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(unsigned int, cmd)
                 __field(struct dwc3_gadget_ep_cmd_params *, params)
         ),
         TP_fast_assign(
-                __entry->dep = dep;
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", dep->name);
                 __entry->cmd = cmd;
                 __entry->params = params;
         ),
         TP_printk("%s: cmd '%s' [%d] params %08x %08x %08x\n",
-                __entry->dep->name, dwc3_gadget_ep_cmd_string(__entry->cmd),
+                __get_str(name), dwc3_gadget_ep_cmd_string(__entry->cmd),
                 __entry->cmd, __entry->params->param0,
                 __entry->params->param1, __entry->params->param2
         )
@@ -184,16 +199,24 @@ DECLARE_EVENT_CLASS(dwc3_log_trb,
         TP_PROTO(struct dwc3_ep *dep, struct dwc3_trb *trb),
         TP_ARGS(dep, trb),
         TP_STRUCT__entry(
-                __field(struct dwc3_ep *, dep)
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(struct dwc3_trb *, trb)
+                __field(u32, bpl)
+                __field(u32, bph)
+                __field(u32, size)
+                __field(u32, ctrl)
         ),
         TP_fast_assign(
-                __entry->dep = dep;
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", dep->name);
                 __entry->trb = trb;
+                __entry->bpl = trb->bpl;
+                __entry->bph = trb->bph;
+                __entry->size = trb->size;
+                __entry->ctrl = trb->ctrl;
         ),
         TP_printk("%s: trb %p bph %08x bpl %08x size %08x ctrl %08x\n",
-                __entry->dep->name, __entry->trb, __entry->trb->bph,
-                __entry->trb->bpl, __entry->trb->size, __entry->trb->ctrl
+                __get_str(name), __entry->trb, __entry->bph, __entry->bpl,
+                __entry->size, __entry->ctrl
         )
 );
 
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index a8c18df171c3..f6a51fddd5b5 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -560,7 +560,7 @@ static int bos_desc(struct usb_composite_dev *cdev)
         usb_ext->bLength = USB_DT_USB_EXT_CAP_SIZE;
         usb_ext->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
         usb_ext->bDevCapabilityType = USB_CAP_TYPE_EXT;
-        usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT);
+        usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT | USB_BESL_SUPPORT);
 
         /*
          * The Superspeed USB Capability descriptor shall be implemented by all
diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
index 6da4685490ef..aad8165e98ef 100644
--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -433,12 +433,12 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
                         dev_vdbg(&cdev->gadget->dev,
                                  "reset acm control interface %d\n", intf);
                         usb_ep_disable(acm->notify);
-                } else {
-                        dev_vdbg(&cdev->gadget->dev,
-                                 "init acm ctrl interface %d\n", intf);
+                }
+
+                if (!acm->notify->desc)
                         if (config_ep_by_speed(cdev->gadget, f, acm->notify))
                                 return -EINVAL;
-                }
+
                 usb_ep_enable(acm->notify);
                 acm->notify->driver_data = acm;
 
diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index 4d8b236ea608..c9e90de5bdd9 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -325,7 +325,6 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         if (eem->port.out_ep)
                 eem->port.out_ep->driver_data = NULL;
         if (eem->port.in_ep)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 7c6771d027a2..63314ede7ba6 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -647,15 +647,26 @@ static void ffs_user_copy_worker(struct work_struct *work)
         if (io_data->read && ret > 0) {
                 int i;
                 size_t pos = 0;
+
+                /*
+                 * Since req->length may be bigger than io_data->len (after
+                 * being rounded up to maxpacketsize), we may end up with more
+                 * data then user space has space for.
+                 */
+                ret = min_t(int, ret, io_data->len);
+
                 use_mm(io_data->mm);
                 for (i = 0; i < io_data->nr_segs; i++) {
+                        size_t len = min_t(size_t, ret - pos,
+                                        io_data->iovec[i].iov_len);
+                        if (!len)
+                                break;
                         if (unlikely(copy_to_user(io_data->iovec[i].iov_base,
-                                                 &io_data->buf[pos],
-                                                 io_data->iovec[i].iov_len))) {
+                                                 &io_data->buf[pos], len))) {
                                 ret = -EFAULT;
                                 break;
                         }
-                        pos += io_data->iovec[i].iov_len;
+                        pos += len;
                 }
                 unuse_mm(io_data->mm);
         }
@@ -687,7 +698,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
         struct ffs_epfile *epfile = file->private_data;
         struct ffs_ep *ep;
         char *data = NULL;
-        ssize_t ret, data_len;
+        ssize_t ret, data_len = -EINVAL;
         int halt;
 
         /* Are we still active? */
@@ -787,13 +798,30 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                 /* Fire the request */
                 struct usb_request *req;
 
+                /*
+                 * Sanity Check: even though data_len can't be used
+                 * uninitialized at the time I write this comment, some
+                 * compilers complain about this situation.
+                 * In order to keep the code clean from warnings, data_len is
+                 * being initialized to -EINVAL during its declaration, which
+                 * means we can't rely on compiler anymore to warn no future
+                 * changes won't result in data_len being used uninitialized.
+                 * For such reason, we're adding this redundant sanity check
+                 * here.
+                 */
+                if (unlikely(data_len == -EINVAL)) {
+                        WARN(1, "%s: data_len == -EINVAL\n", __func__);
+                        ret = -EINVAL;
+                        goto error_lock;
+                }
+
                 if (io_data->aio) {
                         req = usb_ep_alloc_request(ep->ep, GFP_KERNEL);
                         if (unlikely(!req))
                                 goto error_lock;
 
                         req->buf      = data;
-                        req->length   = io_data->len;
+                        req->length   = data_len;
 
                         io_data->buf = data;
                         io_data->ep = ep->ep;
@@ -815,7 +843,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 
                         req = ep->req;
                         req->buf      = data;
-                        req->length   = io_data->len;
+                        req->length   = data_len;
 
                         req->context  = &done;
                         req->complete = ffs_epfile_io_complete;
@@ -2663,8 +2691,6 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
         func->conf = c;
         func->gadget = c->cdev->gadget;
 
-        ffs_data_get(func->ffs);
-
         /*
          * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
          * configurations are bound in sequence with list_for_each_entry,
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index a95290a1289f..59ab62c92b66 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -621,12 +621,14 @@ static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
         dev = MKDEV(major, hidg->minor);
         status = cdev_add(&hidg->cdev, dev, 1);
         if (status)
-                goto fail;
+                goto fail_free_descs;
 
         device_create(hidg_class, NULL, dev, NULL, "%s%d", "hidg", hidg->minor);
 
         return 0;
 
+fail_free_descs:
+        usb_free_all_descriptors(f);
 fail:
         ERROR(f->config->cdev, "hidg_bind FAILED\n");
         if (hidg->req != NULL) {
@@ -635,7 +637,6 @@ fail:
                         usb_ep_free_request(hidg->in_ep, hidg->req);
         }
 
-        usb_free_all_descriptors(f);
         return status;
 }
 
diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index bf04389137e6..298b46112b1a 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -253,22 +253,13 @@ static void loopback_complete(struct usb_ep *ep, struct usb_request *req)
 
         case 0:                         /* normal completion? */
                 if (ep == loop->out_ep) {
-                        /* loop this OUT packet back IN to the host */
                         req->zero = (req->actual < req->length);
                         req->length = req->actual;
-                        status = usb_ep_queue(loop->in_ep, req, GFP_ATOMIC);
-                        if (status == 0)
-                                return;
-
-                        /* "should never get here" */
-                        ERROR(cdev, "can't loop %s to %s: %d\n",
-                                ep->name, loop->in_ep->name,
-                                status);
                 }
 
                 /* queue the buffer for some later OUT packet */
                 req->length = buflen;
-                status = usb_ep_queue(loop->out_ep, req, GFP_ATOMIC);
+                status = usb_ep_queue(ep, req, GFP_ATOMIC);
                 if (status == 0)
                         return;
 
@@ -308,60 +299,66 @@ static inline struct usb_request *lb_alloc_ep_req(struct usb_ep *ep, int len)
         return alloc_ep_req(ep, len, buflen);
 }
 
-static int
-enable_loopback(struct usb_composite_dev *cdev, struct f_loopback *loop)
+static int enable_endpoint(struct usb_composite_dev *cdev, struct f_loopback *loop,
+                struct usb_ep *ep)
 {
-        int                                     result = 0;
-        struct usb_ep                           *ep;
         struct usb_request                      *req;
         unsigned                                i;
+        int                                     result;
 
-        /* one endpoint writes data back IN to the host */
-        ep = loop->in_ep;
+        /*
+         * one endpoint writes data back IN to the host while another endpoint
+         * just reads OUT packets
+         */
         result = config_ep_by_speed(cdev->gadget, &(loop->function), ep);
         if (result)
-                return result;
+                goto fail0;
         result = usb_ep_enable(ep);
         if (result < 0)
-                return result;
-        ep->driver_data = loop;
-
-        /* one endpoint just reads OUT packets */
-        ep = loop->out_ep;
-        result = config_ep_by_speed(cdev->gadget, &(loop->function), ep);
-        if (result)
                 goto fail0;
-
-        result = usb_ep_enable(ep);
-        if (result < 0) {
-fail0:
-                ep = loop->in_ep;
-                usb_ep_disable(ep);
-                ep->driver_data = NULL;
-                return result;
-        }
         ep->driver_data = loop;
 
-        /* allocate a bunch of read buffers and queue them all at once.
+        /*
+         * allocate a bunch of read buffers and queue them all at once.
          * we buffer at most 'qlen' transfers; fewer if any need more
          * than 'buflen' bytes each.
          */
         for (i = 0; i < qlen && result == 0; i++) {
                 req = lb_alloc_ep_req(ep, 0);
-                if (req) {
-                        req->complete = loopback_complete;
-                        result = usb_ep_queue(ep, req, GFP_ATOMIC);
-                        if (result)
-                                ERROR(cdev, "%s queue req --> %d\n",
-                                                ep->name, result);
-                } else {
-                        usb_ep_disable(ep);
-                        ep->driver_data = NULL;
-                        result = -ENOMEM;
-                        goto fail0;
+                if (!req)
+                        goto fail1;
+
+                req->complete = loopback_complete;
+                result = usb_ep_queue(ep, req, GFP_ATOMIC);
+                if (result) {
+                        ERROR(cdev, "%s queue req --> %d\n",
+                                        ep->name, result);
+                        goto fail1;
                 }
         }
 
+        return 0;
+
+fail1:
+        usb_ep_disable(ep);
+
+fail0:
+        return result;
+}
+
+static int
+enable_loopback(struct usb_composite_dev *cdev, struct f_loopback *loop)
+{
+        int                                     result = 0;
+
+        result = enable_endpoint(cdev, loop, loop->in_ep);
+        if (result)
+                return result;
+
+        result = enable_endpoint(cdev, loop, loop->out_ep);
+        if (result)
+                return result;
+
         DBG(cdev, "%s enabled\n", loop->function.name);
         return result;
 }
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 146f48cc65d7..16361b0a8b46 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1461,7 +1461,6 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         if (ncm->notify_req) {
                 kfree(ncm->notify_req->buf);
                 usb_ep_free_request(ncm->notify, ncm->notify_req);
diff --git a/drivers/usb/gadget/function/f_obex.c b/drivers/usb/gadget/function/f_obex.c
index 5f40080c92cc..a1b79c53499c 100644
--- a/drivers/usb/gadget/function/f_obex.c
+++ b/drivers/usb/gadget/function/f_obex.c
@@ -35,6 +35,7 @@ struct f_obex {
         struct gserial                  port;
         u8                              ctrl_id;
         u8                              data_id;
+        u8                              cur_alt;
         u8                              port_num;
         u8                              can_activate;
 };
@@ -235,6 +236,8 @@ static int obex_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
         } else
                 goto fail;
 
+        obex->cur_alt = alt;
+
         return 0;
 
 fail:
@@ -245,10 +248,7 @@ static int obex_get_alt(struct usb_function *f, unsigned intf)
 {
         struct f_obex           *obex = func_to_obex(f);
 
-        if (intf == obex->ctrl_id)
-                return 0;
-
-        return obex->port.in->driver_data ? 1 : 0;
+        return obex->cur_alt;
 }
 
 static void obex_disable(struct usb_function *f)
@@ -397,7 +397,6 @@ static int obex_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         /* we might as well release our claims on endpoints */
         if (obex->port.out)
                 obex->port.out->driver_data = NULL;
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b9cfc1571d71..1ec8b7ffdccd 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -570,8 +570,8 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
 err_req:
         for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
                 usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
-err:
         usb_free_all_descriptors(f);
+err:
         if (fp->out_ep)
                 fp->out_ep->driver_data = NULL;
         if (fp->in_ep)
diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index ddb09dc6d1f2..f13fc6a58565 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -802,8 +802,10 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
 
         if (rndis->manufacturer && rndis->vendorID &&
                         rndis_set_param_vendor(rndis->config, rndis->vendorID,
-                                               rndis->manufacturer))
-                goto fail;
+                                               rndis->manufacturer)) {
+                status = -EINVAL;
+                goto fail_free_descs;
+        }
 
         /* NOTE:  all that is done without knowing or caring about
          * the network link ... which is unavailable to this code
@@ -817,10 +819,11 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
                         rndis->notify->name);
         return 0;
 
+fail_free_descs:
+        usb_free_all_descriptors(f);
 fail:
         kfree(f->os_desc_table);
         f->os_desc_n = 0;
-        usb_free_all_descriptors(f);
 
         if (rndis->notify_req) {
                 kfree(rndis->notify_req->buf);
diff --git a/drivers/usb/gadget/function/f_subset.c b/drivers/usb/gadget/function/f_subset.c
index 1ea8baf33333..e3dfa675ff06 100644
--- a/drivers/usb/gadget/function/f_subset.c
+++ b/drivers/usb/gadget/function/f_subset.c
@@ -380,7 +380,6 @@ geth_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         /* we might as well release our claims on endpoints */
         if (geth->port.out_ep)
                 geth->port.out_ep->driver_data = NULL;
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index a5a27a504d67..33e16658e5cf 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -512,6 +512,11 @@ static int snd_uac2_remove(struct platform_device *pdev)
         return 0;
 }
 
+static void snd_uac2_release(struct device *dev)
+{
+        dev_dbg(dev, "releasing '%s'\n", dev_name(dev));
+}
+
 static int alsa_uac2_init(struct audio_dev *agdev)
 {
         struct snd_uac2_chip *uac2 = &agdev->uac2;
@@ -523,6 +528,7 @@ static int alsa_uac2_init(struct audio_dev *agdev)
 
         uac2->pdev.id = 0;
         uac2->pdev.name = uac2_name;
+        uac2->pdev.dev.release = snd_uac2_release;
 
         /* Register snd_uac2 driver */
         err = platform_driver_register(&uac2->pdrv);
@@ -772,6 +778,7 @@ struct usb_endpoint_descriptor fs_epout_desc = {
 
         .bEndpointAddress = USB_DIR_OUT,
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1023),
         .bInterval = 1,
 };
 
@@ -780,6 +787,7 @@ struct usb_endpoint_descriptor hs_epout_desc = {
         .bDescriptorType = USB_DT_ENDPOINT,
 
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1024),
         .bInterval = 4,
 };
 
@@ -847,6 +855,7 @@ struct usb_endpoint_descriptor fs_epin_desc = {
 
         .bEndpointAddress = USB_DIR_IN,
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1023),
         .bInterval = 1,
 };
 
@@ -855,6 +864,7 @@ struct usb_endpoint_descriptor hs_epin_desc = {
         .bDescriptorType = USB_DT_ENDPOINT,
 
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1024),
         .bInterval = 4,
 };
 
@@ -947,6 +957,9 @@ free_ep(struct uac2_rtd_params *prm, struct usb_ep *ep)
         struct snd_uac2_chip *uac2 = prm->uac2;
         int i;
 
+        if (!prm->ep_enabled)
+                return;
+
         prm->ep_enabled = false;
 
         for (i = 0; i < USB_XFERS; i++) {
@@ -1071,7 +1084,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL);
         if (!prm->rbuf) {
                 prm->max_psize = 0;
-                goto err;
+                goto err_free_descs;
         }
 
         prm = &agdev->uac2.p_prm;
@@ -1079,17 +1092,19 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL);
         if (!prm->rbuf) {
                 prm->max_psize = 0;
-                goto err;
+                goto err_free_descs;
         }
 
         ret = alsa_uac2_init(agdev);
         if (ret)
-                goto err;
+                goto err_free_descs;
         return 0;
+
+err_free_descs:
+        usb_free_all_descriptors(fn);
 err:
         kfree(agdev->uac2.p_prm.rbuf);
         kfree(agdev->uac2.c_prm.rbuf);
-        usb_free_all_descriptors(fn);
         if (agdev->in_ep)
                 agdev->in_ep->driver_data = NULL;
         if (agdev->out_ep)
diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index e126439e4b65..945b3bd2ca98 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -279,27 +279,41 @@ uvc_function_get_alt(struct usb_function *f, unsigned interface)
         else if (interface != uvc->streaming_intf)
                 return -EINVAL;
         else
-                return uvc->state == UVC_STATE_STREAMING ? 1 : 0;
+                return uvc->video.ep->driver_data ? 1 : 0;
 }
 
 static int
 uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
 {
         struct uvc_device *uvc = to_uvc(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
         struct v4l2_event v4l2_event;
         struct uvc_event *uvc_event = (void *)&v4l2_event.u.data;
         int ret;
 
-        INFO(f->config->cdev, "uvc_function_set_alt(%u, %u)\n", interface, alt);
+        INFO(cdev, "uvc_function_set_alt(%u, %u)\n", interface, alt);
 
         if (interface == uvc->control_intf) {
                 if (alt)
                         return -EINVAL;
 
+                if (uvc->control_ep->driver_data) {
+                        INFO(cdev, "reset UVC Control\n");
+                        usb_ep_disable(uvc->control_ep);
+                        uvc->control_ep->driver_data = NULL;
+                }
+
+                if (!uvc->control_ep->desc)
+                        if (config_ep_by_speed(cdev->gadget, f, uvc->control_ep))
+                                return -EINVAL;
+
+                usb_ep_enable(uvc->control_ep);
+                uvc->control_ep->driver_data = uvc;
+
                 if (uvc->state == UVC_STATE_DISCONNECTED) {
                         memset(&v4l2_event, 0, sizeof(v4l2_event));
                         v4l2_event.type = UVC_EVENT_CONNECT;
-                        uvc_event->speed = f->config->cdev->gadget->speed;
+                        uvc_event->speed = cdev->gadget->speed;
                         v4l2_event_queue(uvc->vdev, &v4l2_event);
 
                         uvc->state = UVC_STATE_CONNECTED;
@@ -321,8 +335,10 @@ uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
                 if (uvc->state != UVC_STATE_STREAMING)
                         return 0;
 
-                if (uvc->video.ep)
+                if (uvc->video.ep) {
                         usb_ep_disable(uvc->video.ep);
+                        uvc->video.ep->driver_data = NULL;
+                }
 
                 memset(&v4l2_event, 0, sizeof(v4l2_event));
                 v4l2_event.type = UVC_EVENT_STREAMOFF;
@@ -335,14 +351,22 @@ uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
                 if (uvc->state != UVC_STATE_CONNECTED)
                         return 0;
 
-                if (uvc->video.ep) {
-                        ret = config_ep_by_speed(f->config->cdev->gadget,
-                                        &(uvc->func), uvc->video.ep);
-                        if (ret)
-                                return ret;
-                        usb_ep_enable(uvc->video.ep);
+                if (!uvc->video.ep)
+                        return -EINVAL;
+
+                if (uvc->video.ep->driver_data) {
+                        INFO(cdev, "reset UVC\n");
+                        usb_ep_disable(uvc->video.ep);
+                        uvc->video.ep->driver_data = NULL;
                 }
 
+                ret = config_ep_by_speed(f->config->cdev->gadget,
+                                &(uvc->func), uvc->video.ep);
+                if (ret)
+                        return ret;
+                usb_ep_enable(uvc->video.ep);
+                uvc->video.ep->driver_data = uvc;
+
                 memset(&v4l2_event, 0, sizeof(v4l2_event));
                 v4l2_event.type = UVC_EVENT_STREAMON;
                 v4l2_event_queue(uvc->vdev, &v4l2_event);
@@ -366,6 +390,16 @@ uvc_function_disable(struct usb_function *f)
         v4l2_event_queue(uvc->vdev, &v4l2_event);
 
         uvc->state = UVC_STATE_DISCONNECTED;
+
+        if (uvc->video.ep->driver_data) {
+                usb_ep_disable(uvc->video.ep);
+                uvc->video.ep->driver_data = NULL;
+        }
+
+        if (uvc->control_ep->driver_data) {
+                usb_ep_disable(uvc->control_ep);
+                uvc->control_ep->driver_data = NULL;
+        }
 }
 
 /* --------------------------------------------------------------------------
diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index c3e1f27dbbef..9cb86bc1a9a5 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -352,7 +352,8 @@ int uvcg_video_enable(struct uvc_video *video, int enable)
 
         if (!enable) {
                 for (i = 0; i < UVC_NUM_REQUESTS; ++i)
-                        usb_ep_dequeue(video->ep, video->req[i]);
+                        if (video->req[i])
+                                usb_ep_dequeue(video->ep, video->req[i]);
 
                 uvc_video_free_requests(video);
                 uvcg_queue_enable(&video->queue, 0);
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 3ea287b0e448..217365d35a25 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -357,6 +357,7 @@ config USB_EG20T
 
 config USB_GADGET_XILINX
         tristate "Xilinx USB Driver"
+        depends on HAS_DMA
         depends on OF || COMPILE_TEST
         help
           USB peripheral controller driver for Xilinx USB2 device.
diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index f107bb60a5ab..f2054659f25b 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -507,6 +507,11 @@ static ssize_t usb_udc_softconn_store(struct device *dev,
 {
         struct usb_udc          *udc = container_of(dev, struct usb_udc, dev);
 
+        if (!udc->driver) {
+                dev_err(dev, "soft-connect without a gadget driver\n");
+                return -EOPNOTSUPP;
+        }
+
         if (sysfs_streq(buf, "connect")) {
                 usb_gadget_udc_start(udc->gadget, udc->driver);
                 usb_gadget_connect(udc->gadget);
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index a8a30b1d4167..a3ca1375dd52 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -234,7 +234,7 @@ config USB_EHCI_SH
 
 config USB_EHCI_EXYNOS
        tristate "EHCI support for Samsung S5P/EXYNOS SoC Series"
-       depends on PLAT_S5P || ARCH_EXYNOS
+       depends on ARCH_S5PV210 || ARCH_EXYNOS
        help
         Enable support for the Samsung Exynos SOC's on-chip EHCI controller.
 
@@ -550,7 +550,7 @@ config USB_OHCI_SH
 
 config USB_OHCI_EXYNOS
         tristate "OHCI support for Samsung S5P/EXYNOS SoC Series"
-        depends on PLAT_S5P || ARCH_EXYNOS
+        depends on ARCH_S5PV210 || ARCH_EXYNOS
         help
          Enable support for the Samsung Exynos SOC's on-chip OHCI controller.
 
diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index d0d8fadf7066..1db0626c8bf4 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -607,7 +607,7 @@ found:
         wa->wa_descr = wa_descr = (struct usb_wa_descriptor *) hdr;
         if (le16_to_cpu(wa_descr->bcdWAVersion) > 0x0100)
                 dev_warn(dev, "Wire Adapter v%d.%d newer than groked v1.0\n",
-                         le16_to_cpu(wa_descr->bcdWAVersion) & 0xff00 >> 8,
+                         (le16_to_cpu(wa_descr->bcdWAVersion) & 0xff00) >> 8,
                          le16_to_cpu(wa_descr->bcdWAVersion) & 0x00ff);
         result = 0;
 error:
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 696160d48ae8..388cfd83b6b6 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -22,7 +22,6 @@
 
 
 #include <linux/slab.h>
-#include <linux/device.h>
 #include <asm/unaligned.h>
 
 #include "xhci.h"
@@ -1149,9 +1148,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                  * including the USB 3.0 roothub, but only if CONFIG_PM_RUNTIME
                  * is enabled, so also enable remote wake here.
                  */
-                if (hcd->self.root_hub->do_remote_wakeup
-                                && device_may_wakeup(hcd->self.controller)) {
-
+                if (hcd->self.root_hub->do_remote_wakeup) {
                         if (t1 & PORT_CONNECT) {
                                 t2 |= PORT_WKOC_E | PORT_WKDISC_E;
                                 t2 &= ~PORT_WKCONN_E;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 280dde93abe5..142b601f9563 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -128,20 +128,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_AVOID_BEI;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
-            (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI ||
-             pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) {
-                /* Workaround for occasional spurious wakeups from S5 (or
-                 * any other sleep) on Haswell machines with LPT and LPT-LP
-                 * with the new Intel BIOS
-                 */
-                /* Limit the quirk to only known vendors, as this triggers
-                 * yet another BIOS bug on some other machines
-                 * https://bugzilla.kernel.org/show_bug.cgi?id=66171
-                 */
-                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
-                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
-        }
-        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                 pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
                 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
         }
@@ -162,6 +148,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                         pdev->device == 0x3432)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
 
+        if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+                        pdev->device == 0x1042)
+                xhci->quirks |= XHCI_BROKEN_STREAMS;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
@@ -291,7 +281,7 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
         if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
                 pdev->no_d3cold = true;
 
-        return xhci_suspend(xhci);
+        return xhci_suspend(xhci, do_wakeup);
 }
 
 static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 3d78b0cd674b..646300cbe5f7 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -204,7 +204,15 @@ static int xhci_plat_suspend(struct device *dev)
         struct usb_hcd  *hcd = dev_get_drvdata(dev);
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
-        return xhci_suspend(xhci);
+        /*
+         * xhci_suspend() needs `do_wakeup` to know whether host is allowed
+         * to do wakeup during suspend. Since xhci_plat_suspend is currently
+         * only designed for system suspend, device_may_wakeup() is enough
+         * to dertermine whether host is allowed to do wakeup. Need to
+         * reconsider this when xhci_plat_suspend enlarges its scope, e.g.,
+         * also applies to runtime suspend.
+         */
+        return xhci_suspend(xhci, device_may_wakeup(dev));
 }
 
 static int xhci_plat_resume(struct device *dev)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index bc6fcbc16f61..06433aec81d7 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1067,9 +1067,8 @@ static void xhci_handle_cmd_reset_ep(struct xhci_hcd *xhci, int slot_id,
                                 false);
                 xhci_ring_cmd_db(xhci);
         } else {
-                /* Clear our internal halted state and restart the ring(s) */
+                /* Clear our internal halted state */
                 xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED;
-                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
         }
 }
 
@@ -1823,22 +1822,13 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 ep->stopped_td = td;
                 return 0;
         } else {
-                if (trb_comp_code == COMP_STALL) {
-                        /* The transfer is completed from the driver's
-                         * perspective, but we need to issue a set dequeue
-                         * command for this stalled endpoint to move the dequeue
-                         * pointer past the TD.  We can't do that here because
-                         * the halt condition must be cleared first.  Let the
-                         * USB class driver clear the stall later.
-                         */
-                        ep->stopped_td = td;
-                        ep->stopped_stream = ep_ring->stream_id;
-                } else if (xhci_requires_manual_halt_cleanup(xhci,
-                                        ep_ctx, trb_comp_code)) {
-                        /* Other types of errors halt the endpoint, but the
-                         * class driver doesn't call usb_reset_endpoint() unless
-                         * the error is -EPIPE.  Clear the halted status in the
-                         * xHCI hardware manually.
+                if (trb_comp_code == COMP_STALL ||
+                    xhci_requires_manual_halt_cleanup(xhci, ep_ctx,
+                                                      trb_comp_code)) {
+                        /* Issue a reset endpoint command to clear the host side
+                         * halt, followed by a set dequeue command to move the
+                         * dequeue pointer past the TD.
+                         * The class driver clears the device side halt later.
                          */
                         xhci_cleanup_halted_endpoint(xhci,
                                         slot_id, ep_index, ep_ring->stream_id,
@@ -1958,9 +1948,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 else
                         td->urb->actual_length = 0;
 
-                xhci_cleanup_halted_endpoint(xhci,
-                        slot_id, ep_index, 0, td, event_trb);
-                return finish_td(xhci, td, event_trb, event, ep, status, true);
+                return finish_td(xhci, td, event_trb, event, ep, status, false);
         }
         /*
          * Did we transfer any data, despite the errors that might have
@@ -2519,17 +2507,8 @@ cleanup:
                 if (ret) {
                         urb = td->urb;
                         urb_priv = urb->hcpriv;
-                        /* Leave the TD around for the reset endpoint function
-                         * to use(but only if it's not a control endpoint,
-                         * since we already queued the Set TR dequeue pointer
-                         * command for stalled control endpoints).
-                         */
-                        if (usb_endpoint_xfer_control(&urb->ep->desc) ||
-                                (trb_comp_code != COMP_STALL &&
-                                        trb_comp_code != COMP_BABBLE))
-                                xhci_urb_free_priv(xhci, urb_priv);
-                        else
-                                kfree(urb_priv);
+
+                        xhci_urb_free_priv(xhci, urb_priv);
 
                         usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
                         if ((urb->actual_length != urb->transfer_buffer_length &&
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2a5d45b4cb15..033b46c470bd 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -35,6 +35,8 @@
 #define DRIVER_AUTHOR "Sarah Sharp"
 #define DRIVER_DESC "'eXtensible' Host Controller (xHC) Driver"
 
+#define PORT_WAKE_BITS  (PORT_WKOC_E | PORT_WKDISC_E | PORT_WKCONN_E)
+
 /* Some 0.95 hardware can't handle the chain bit on a Link TRB being cleared */
 static int link_quirk;
 module_param(link_quirk, int, S_IRUGO | S_IWUSR);
@@ -851,13 +853,47 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci)
         xhci_set_cmd_ring_deq(xhci);
 }
 
+static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
+{
+        int port_index;
+        __le32 __iomem **port_array;
+        unsigned long flags;
+        u32 t1, t2;
+
+        spin_lock_irqsave(&xhci->lock, flags);
+
+        /* disble usb3 ports Wake bits*/
+        port_index = xhci->num_usb3_ports;
+        port_array = xhci->usb3_ports;
+        while (port_index--) {
+                t1 = readl(port_array[port_index]);
+                t1 = xhci_port_state_to_neutral(t1);
+                t2 = t1 & ~PORT_WAKE_BITS;
+                if (t1 != t2)
+                        writel(t2, port_array[port_index]);
+        }
+
+        /* disble usb2 ports Wake bits*/
+        port_index = xhci->num_usb2_ports;
+        port_array = xhci->usb2_ports;
+        while (port_index--) {
+                t1 = readl(port_array[port_index]);
+                t1 = xhci_port_state_to_neutral(t1);
+                t2 = t1 & ~PORT_WAKE_BITS;
+                if (t1 != t2)
+                        writel(t2, port_array[port_index]);
+        }
+
+        spin_unlock_irqrestore(&xhci->lock, flags);
+}
+
 /*
  * Stop HC (not bus-specific)
  *
  * This is called when the machine transition into S3/S4 mode.
  *
  */
-int xhci_suspend(struct xhci_hcd *xhci)
+int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
 {
         int                     rc = 0;
         unsigned int            delay = XHCI_MAX_HALT_USEC;
@@ -868,6 +904,10 @@ int xhci_suspend(struct xhci_hcd *xhci)
                         xhci->shared_hcd->state != HC_STATE_SUSPENDED)
                 return -EINVAL;
 
+        /* Clear root port wake on bits if wakeup not allowed. */
+        if (!do_wakeup)
+                xhci_disable_port_wake_on_bits(xhci);
+
         /* Don't poll the roothubs on bus suspend. */
         xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
         clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
@@ -2912,68 +2952,33 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
         }
 }
 
-/* Deal with stalled endpoints.  The core should have sent the control message
- * to clear the halt condition.  However, we need to make the xHCI hardware
- * reset its sequence number, since a device will expect a sequence number of
- * zero after the halt condition is cleared.
+/* Called when clearing halted device. The core should have sent the control
+ * message to clear the device halt condition. The host side of the halt should
+ * already be cleared with a reset endpoint command issued when the STALL tx
+ * event was received.
+ *
  * Context: in_interrupt
  */
+
 void xhci_endpoint_reset(struct usb_hcd *hcd,
                 struct usb_host_endpoint *ep)
 {
         struct xhci_hcd *xhci;
-        struct usb_device *udev;
-        unsigned int ep_index;
-        unsigned long flags;
-        int ret;
-        struct xhci_virt_ep *virt_ep;
-        struct xhci_command *command;
 
         xhci = hcd_to_xhci(hcd);
-        udev = (struct usb_device *) ep->hcpriv;
-        /* Called with a root hub endpoint (or an endpoint that wasn't added
-         * with xhci_add_endpoint()
-         */
-        if (!ep->hcpriv)
-                return;
-        ep_index = xhci_get_endpoint_index(&ep->desc);
-        virt_ep = &xhci->devs[udev->slot_id]->eps[ep_index];
-        if (!virt_ep->stopped_td) {
-                xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
-                        "Endpoint 0x%x not halted, refusing to reset.",
-                        ep->desc.bEndpointAddress);
-                return;
-        }
-        if (usb_endpoint_xfer_control(&ep->desc)) {
-                xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
-                                "Control endpoint stall already handled.");
-                return;
-        }
 
-        command = xhci_alloc_command(xhci, false, false, GFP_ATOMIC);
-        if (!command)
-                return;
-
-        xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
-                        "Queueing reset endpoint command");
-        spin_lock_irqsave(&xhci->lock, flags);
-        ret = xhci_queue_reset_ep(xhci, command, udev->slot_id, ep_index);
         /*
-         * Can't change the ring dequeue pointer until it's transitioned to the
-         * stopped state, which is only upon a successful reset endpoint
-         * command.  Better hope that last command worked!
+         * We might need to implement the config ep cmd in xhci 4.8.1 note:
+         * The Reset Endpoint Command may only be issued to endpoints in the
+         * Halted state. If software wishes reset the Data Toggle or Sequence
+         * Number of an endpoint that isn't in the Halted state, then software
+         * may issue a Configure Endpoint Command with the Drop and Add bits set
+         * for the target endpoint. that is in the Stopped state.
          */
-        if (!ret) {
-                xhci_cleanup_stalled_ring(xhci, udev, ep_index);
-                kfree(virt_ep->stopped_td);
-                xhci_ring_cmd_db(xhci);
-        }
-        virt_ep->stopped_td = NULL;
-        virt_ep->stopped_stream = 0;
-        spin_unlock_irqrestore(&xhci->lock, flags);
 
-        if (ret)
-                xhci_warn(xhci, "FIXME allocate a new ring segment\n");
+        /* For now just print debug to follow the situation */
+        xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
+                 ep->desc.bEndpointAddress);
 }
 
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index df76d642e719..d745715a1e2f 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1746,7 +1746,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks);
 void xhci_init_driver(struct hc_driver *drv, int (*setup_fn)(struct usb_hcd *));
 
 #ifdef  CONFIG_PM
-int xhci_suspend(struct xhci_hcd *xhci);
+int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup);
 int xhci_resume(struct xhci_hcd *xhci, bool hibernated);
 #else
 #define xhci_suspend    NULL
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index acdfb3e68a90..5a9b977fbc19 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -209,7 +209,8 @@ static enum hrtimer_restart cppi41_recheck_tx_req(struct hrtimer *timer)
                 }
         }
 
-        if (!list_empty(&controller->early_tx_list)) {
+        if (!list_empty(&controller->early_tx_list) &&
+            !hrtimer_is_queued(&controller->early_tx)) {
                 ret = HRTIMER_RESTART;
                 hrtimer_forward_now(&controller->early_tx,
                                 ktime_set(0, 20 * NSEC_PER_USEC));
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 154bcf1b5dfa..48bc09e7b83b 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -868,9 +868,15 @@ static int dsps_suspend(struct device *dev)
         struct dsps_glue *glue = dev_get_drvdata(dev);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
         struct musb *musb = platform_get_drvdata(glue->musb);
-        void __iomem *mbase = musb->ctrl_base;
+        void __iomem *mbase;
 
         del_timer_sync(&glue->timer);
+
+        if (!musb)
+                /* This can happen if the musb device is in -EPROBE_DEFER */
+                return 0;
+
+        mbase = musb->ctrl_base;
         glue->context.control = dsps_readl(mbase, wrp->control);
         glue->context.epintr = dsps_readl(mbase, wrp->epintr_set);
         glue->context.coreintr = dsps_readl(mbase, wrp->coreintr_set);
@@ -887,8 +893,12 @@ static int dsps_resume(struct device *dev)
         struct dsps_glue *glue = dev_get_drvdata(dev);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
         struct musb *musb = platform_get_drvdata(glue->musb);
-        void __iomem *mbase = musb->ctrl_base;
+        void __iomem *mbase;
+
+        if (!musb)
+                return 0;
 
+        mbase = musb->ctrl_base;
         dsps_writel(mbase, wrp->control, glue->context.control);
         dsps_writel(mbase, wrp->epintr_set, glue->context.epintr);
         dsps_writel(mbase, wrp->coreintr_set, glue->context.coreintr);
@@ -896,7 +906,9 @@ static int dsps_resume(struct device *dev)
         dsps_writel(mbase, wrp->mode, glue->context.mode);
         dsps_writel(mbase, wrp->tx_mode, glue->context.tx_mode);
         dsps_writel(mbase, wrp->rx_mode, glue->context.rx_mode);
-        setup_timer(&glue->timer, otg_timer, (unsigned long) musb);
+        if (musb->xceiv->state == OTG_STATE_B_IDLE &&
+            musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE)
+                mod_timer(&glue->timer, jiffies + wrp->poll_seconds * HZ);
 
         return 0;
 }
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index eca1747ca8c7..6c4eb3cf5efd 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -120,6 +120,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
         { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
         { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+        { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
         { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
         { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
         { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
@@ -155,6 +156,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
         { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
         { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+        { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
         { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
         { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
         { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index dc72b924c399..1ebb351b9e9a 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -140,6 +140,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = {
  * /sys/bus/usb-serial/drivers/ftdi_sio/new_id and send a patch or report.
  */
 static const struct usb_device_id id_table_combined[] = {
+        { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
@@ -469,6 +470,39 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FD_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FE_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FF_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_4701_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9300_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9301_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9302_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9303_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9304_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9305_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9306_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9307_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9308_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9309_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930A_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930B_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930C_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930D_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930E_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930F_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9310_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9311_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9312_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9313_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9314_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9315_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9316_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9317_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9318_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9319_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931A_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931B_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931C_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931D_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931E_PID) },
+        { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931F_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
@@ -661,6 +695,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
+        { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+        { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
         { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
         { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 5937b2d242f2..e52409c9be99 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -30,6 +30,12 @@
 
 /*** third-party PIDs (using FTDI_VID) ***/
 
+/*
+ * Certain versions of the official Windows FTDI driver reprogrammed
+ * counterfeit FTDI devices to PID 0. Support these devices anyway.
+ */
+#define FTDI_BRICK_PID          0x0000
+
 #define FTDI_LUMEL_PD12_PID     0x6002
 
 /*
@@ -143,8 +149,12 @@
  * Xsens Technologies BV products (http://www.xsens.com).
  */
 #define XSENS_VID               0x2639
-#define XSENS_CONVERTER_PID     0xD00D  /* Xsens USB-serial converter */
+#define XSENS_AWINDA_STATION_PID 0x0101
+#define XSENS_AWINDA_DONGLE_PID 0x0102
 #define XSENS_MTW_PID           0x0200  /* Xsens MTw */
+#define XSENS_CONVERTER_PID     0xD00D  /* Xsens USB-serial converter */
+
+/* Xsens devices using FTDI VID */
 #define XSENS_CONVERTER_0_PID   0xD388  /* Xsens USB converter */
 #define XSENS_CONVERTER_1_PID   0xD389  /* Xsens Wireless Receiver */
 #define XSENS_CONVERTER_2_PID   0xD38A
@@ -916,8 +926,8 @@
 #define BAYER_CONTOUR_CABLE_PID        0x6001
 
 /*
- * The following are the values for the Matrix Orbital FTDI Range
- * Anything in this range will use an FT232RL.
+ * Matrix Orbital Intelligent USB displays.
+ * http://www.matrixorbital.com
  */
 #define MTXORB_VID                      0x1B3D
 #define MTXORB_FTDI_RANGE_0100_PID      0x0100
@@ -1176,8 +1186,39 @@
 #define MTXORB_FTDI_RANGE_01FD_PID      0x01FD
 #define MTXORB_FTDI_RANGE_01FE_PID      0x01FE
 #define MTXORB_FTDI_RANGE_01FF_PID      0x01FF
-
-
+#define MTXORB_FTDI_RANGE_4701_PID      0x4701
+#define MTXORB_FTDI_RANGE_9300_PID      0x9300
+#define MTXORB_FTDI_RANGE_9301_PID      0x9301
+#define MTXORB_FTDI_RANGE_9302_PID      0x9302
+#define MTXORB_FTDI_RANGE_9303_PID      0x9303
+#define MTXORB_FTDI_RANGE_9304_PID      0x9304
+#define MTXORB_FTDI_RANGE_9305_PID      0x9305
+#define MTXORB_FTDI_RANGE_9306_PID      0x9306
+#define MTXORB_FTDI_RANGE_9307_PID      0x9307
+#define MTXORB_FTDI_RANGE_9308_PID      0x9308
+#define MTXORB_FTDI_RANGE_9309_PID      0x9309
+#define MTXORB_FTDI_RANGE_930A_PID      0x930A
+#define MTXORB_FTDI_RANGE_930B_PID      0x930B
+#define MTXORB_FTDI_RANGE_930C_PID      0x930C
+#define MTXORB_FTDI_RANGE_930D_PID      0x930D
+#define MTXORB_FTDI_RANGE_930E_PID      0x930E
+#define MTXORB_FTDI_RANGE_930F_PID      0x930F
+#define MTXORB_FTDI_RANGE_9310_PID      0x9310
+#define MTXORB_FTDI_RANGE_9311_PID      0x9311
+#define MTXORB_FTDI_RANGE_9312_PID      0x9312
+#define MTXORB_FTDI_RANGE_9313_PID      0x9313
+#define MTXORB_FTDI_RANGE_9314_PID      0x9314
+#define MTXORB_FTDI_RANGE_9315_PID      0x9315
+#define MTXORB_FTDI_RANGE_9316_PID      0x9316
+#define MTXORB_FTDI_RANGE_9317_PID      0x9317
+#define MTXORB_FTDI_RANGE_9318_PID      0x9318
+#define MTXORB_FTDI_RANGE_9319_PID      0x9319
+#define MTXORB_FTDI_RANGE_931A_PID      0x931A
+#define MTXORB_FTDI_RANGE_931B_PID      0x931B
+#define MTXORB_FTDI_RANGE_931C_PID      0x931C
+#define MTXORB_FTDI_RANGE_931D_PID      0x931D
+#define MTXORB_FTDI_RANGE_931E_PID      0x931E
+#define MTXORB_FTDI_RANGE_931F_PID      0x931F
 
 /*
  * The Mobility Lab (TML)
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 93cb7cebda62..077c714f1285 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -311,24 +311,30 @@ static void	usa26_indat_callback(struct urb *urb)
                 if ((data[0] & 0x80) == 0) {
                         /* no errors on individual bytes, only
                            possible overrun err */
-                        if (data[0] & RXERROR_OVERRUN)
-                                err = TTY_OVERRUN;
-                        else
-                                err = 0;
+                        if (data[0] & RXERROR_OVERRUN) {
+                                tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                        }
                         for (i = 1; i < urb->actual_length ; ++i)
-                                tty_insert_flip_char(&port->port, data[i], err);
+                                tty_insert_flip_char(&port->port, data[i],
+                                                                TTY_NORMAL);
                 } else {
                         /* some bytes had errors, every byte has status */
                         dev_dbg(&port->dev, "%s - RX error!!!!\n", __func__);
                         for (i = 0; i + 1 < urb->actual_length; i += 2) {
-                                int stat = data[i], flag = 0;
-                                if (stat & RXERROR_OVERRUN)
-                                        flag |= TTY_OVERRUN;
-                                if (stat & RXERROR_FRAMING)
-                                        flag |= TTY_FRAME;
-                                if (stat & RXERROR_PARITY)
-                                        flag |= TTY_PARITY;
+                                int stat = data[i];
+                                int flag = TTY_NORMAL;
+
+                                if (stat & RXERROR_OVERRUN) {
+                                        tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                                }
                                 /* XXX should handle break (0x10) */
+                                if (stat & RXERROR_PARITY)
+                                        flag = TTY_PARITY;
+                                else if (stat & RXERROR_FRAMING)
+                                        flag = TTY_FRAME;
+
                                 tty_insert_flip_char(&port->port, data[i+1],
                                                 flag);
                         }
@@ -649,14 +655,19 @@ static void	usa49_indat_callback(struct urb *urb)
                 } else {
                         /* some bytes had errors, every byte has status */
                         for (i = 0; i + 1 < urb->actual_length; i += 2) {
-                                int stat = data[i], flag = 0;
-                                if (stat & RXERROR_OVERRUN)
-                                        flag |= TTY_OVERRUN;
-                                if (stat & RXERROR_FRAMING)
-                                        flag |= TTY_FRAME;
-                                if (stat & RXERROR_PARITY)
-                                        flag |= TTY_PARITY;
+                                int stat = data[i];
+                                int flag = TTY_NORMAL;
+
+                                if (stat & RXERROR_OVERRUN) {
+                                        tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                                }
                                 /* XXX should handle break (0x10) */
+                                if (stat & RXERROR_PARITY)
+                                        flag = TTY_PARITY;
+                                else if (stat & RXERROR_FRAMING)
+                                        flag = TTY_FRAME;
+
                                 tty_insert_flip_char(&port->port, data[i+1],
                                                 flag);
                         }
@@ -713,15 +724,19 @@ static void usa49wg_indat_callback(struct urb *urb)
                          */
                         for (x = 0; x + 1 < len &&
                                     i + 1 < urb->actual_length; x += 2) {
-                                int stat = data[i], flag = 0;
+                                int stat = data[i];
+                                int flag = TTY_NORMAL;
 
-                                if (stat & RXERROR_OVERRUN)
-                                        flag |= TTY_OVERRUN;
-                                if (stat & RXERROR_FRAMING)
-                                        flag |= TTY_FRAME;
-                                if (stat & RXERROR_PARITY)
-                                        flag |= TTY_PARITY;
+                                if (stat & RXERROR_OVERRUN) {
+                                        tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                                }
                                 /* XXX should handle break (0x10) */
+                                if (stat & RXERROR_PARITY)
+                                        flag = TTY_PARITY;
+                                else if (stat & RXERROR_FRAMING)
+                                        flag = TTY_FRAME;
+
                                 tty_insert_flip_char(&port->port, data[i+1],
                                                      flag);
                                 i += 2;
@@ -773,25 +788,31 @@ static void usa90_indat_callback(struct urb *urb)
                         if ((data[0] & 0x80) == 0) {
                                 /* no errors on individual bytes, only
                                    possible overrun err*/
-                                if (data[0] & RXERROR_OVERRUN)
-                                        err = TTY_OVERRUN;
-                                else
-                                        err = 0;
+                                if (data[0] & RXERROR_OVERRUN) {
+                                        tty_insert_flip_char(&port->port, 0,
+                                                                TTY_OVERRUN);
+                                }
                                 for (i = 1; i < urb->actual_length ; ++i)
                                         tty_insert_flip_char(&port->port,
-                                                        data[i], err);
+                                                        data[i], TTY_NORMAL);
                         }  else {
                         /* some bytes had errors, every byte has status */
                                 dev_dbg(&port->dev, "%s - RX error!!!!\n", __func__);
                                 for (i = 0; i + 1 < urb->actual_length; i += 2) {
-                                        int stat = data[i], flag = 0;
-                                        if (stat & RXERROR_OVERRUN)
-                                                flag |= TTY_OVERRUN;
-                                        if (stat & RXERROR_FRAMING)
-                                                flag |= TTY_FRAME;
-                                        if (stat & RXERROR_PARITY)
-                                                flag |= TTY_PARITY;
+                                        int stat = data[i];
+                                        int flag = TTY_NORMAL;
+
+                                        if (stat & RXERROR_OVERRUN) {
+                                                tty_insert_flip_char(
+                                                                &port->port, 0,
+                                                                TTY_OVERRUN);
+                                        }
                                         /* XXX should handle break (0x10) */
+                                        if (stat & RXERROR_PARITY)
+                                                flag = TTY_PARITY;
+                                        else if (stat & RXERROR_FRAMING)
+                                                flag = TTY_FRAME;
+
                                         tty_insert_flip_char(&port->port,
                                                         data[i+1], flag);
                                 }
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 078f9ed419c8..02c420af251e 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -335,7 +335,8 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
                         port->interrupt_out_urb->transfer_buffer_length = length;
 
                         priv->cur_pos = priv->cur_pos + length;
-                        result = usb_submit_urb(port->interrupt_out_urb, GFP_NOIO);
+                        result = usb_submit_urb(port->interrupt_out_urb,
+                                        GFP_ATOMIC);
                         dev_dbg(&port->dev, "%s - Send write URB returns: %i\n", __func__, result);
                         todo = priv->filled - priv->cur_pos;
 
@@ -350,7 +351,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
                 if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID ||
                         priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) {
                         result = usb_submit_urb(port->interrupt_in_urb,
-                                                                GFP_NOIO);
+                                        GFP_ATOMIC);
                         dev_dbg(&port->dev, "%s - Send read URB returns: %i\n", __func__, result);
                 }
         }
@@ -414,8 +415,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
         int result;
         int dtr = 0;
         int rts = 0;
-        unsigned char *transfer_buffer;
-        int transfer_buffer_length = 8;
 
         /* FIXME: locking ? */
         priv = usb_get_serial_port_data(port);
@@ -425,11 +424,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
                 return -EINVAL;
         }
 
-        /* allocate memory for transfer buffer */
-        transfer_buffer = kzalloc(transfer_buffer_length, GFP_KERNEL);
-        if (!transfer_buffer)
-                return -ENOMEM;
-
         if (set & TIOCM_RTS)
                 rts = 1;
         if (set & TIOCM_DTR)
@@ -469,7 +463,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
                         KOBIL_TIMEOUT);
         }
         dev_dbg(dev, "%s - Send set_status_line URB returns: %i\n", __func__, result);
-        kfree(transfer_buffer);
         return (result < 0) ? result : 0;
 }
 
@@ -530,8 +523,6 @@ static int kobil_ioctl(struct tty_struct *tty,
 {
         struct usb_serial_port *port = tty->driver_data;
         struct kobil_private *priv = usb_get_serial_port_data(port);
-        unsigned char *transfer_buffer;
-        int transfer_buffer_length = 8;
         int result;
 
         if (priv->device_type == KOBIL_USBTWIN_PRODUCT_ID ||
@@ -541,10 +532,6 @@ static int kobil_ioctl(struct tty_struct *tty,
 
         switch (cmd) {
         case TCFLSH:
-                transfer_buffer = kmalloc(transfer_buffer_length, GFP_KERNEL);
-                if (!transfer_buffer)
-                        return -ENOBUFS;
-
                 result = usb_control_msg(port->serial->dev,
                           usb_sndctrlpipe(port->serial->dev, 0),
                           SUSBCRequest_Misc,
@@ -559,7 +546,6 @@ static int kobil_ioctl(struct tty_struct *tty,
                 dev_dbg(&port->dev,
                         "%s - Send reset_all_queues (FLUSH) URB returns: %i\n",
                         __func__, result);
-                kfree(transfer_buffer);
                 return (result < 0) ? -EIO: 0;
         default:
                 return -ENOIOCTLCMD;
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index 4856fb7e637e..4b7bfb394a32 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -215,7 +215,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
 
         /* The connected devices do not have a bulk write endpoint,
          * to transmit data to de barcode device the control endpoint is used */
-        dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);
+        dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC);
         if (!dr) {
                 count = -ENOMEM;
                 goto error_no_dr;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index d1a3f6044c8a..7a4c21b4f676 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_DE910_DUAL                0x1010
 #define TELIT_PRODUCT_UE910_V2                  0x1012
 #define TELIT_PRODUCT_LE920                     0x1200
+#define TELIT_PRODUCT_LE910                     0x1201
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -362,6 +363,7 @@ static void option_instat_callback(struct urb *urb);
 
 /* Haier products */
 #define HAIER_VENDOR_ID                         0x201e
+#define HAIER_PRODUCT_CE81B                     0x10f8
 #define HAIER_PRODUCT_CE100                     0x2009
 
 /* Cinterion (formerly Siemens) products */
@@ -589,6 +591,11 @@ static const struct option_blacklist_info zte_1255_blacklist = {
         .reserved = BIT(3) | BIT(4),
 };
 
+static const struct option_blacklist_info telit_le910_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(2),
+};
+
 static const struct option_blacklist_info telit_le920_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(5),
@@ -1138,6 +1145,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+                .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
                 .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
@@ -1621,6 +1630,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
         { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) },
         /* Pirelli  */
         { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) },
         { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2, 0xff) },
diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
index a7fe664b6b7d..70a098de429f 100644
--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -490,10 +490,9 @@ static void ssu100_update_lsr(struct usb_serial_port *port, u8 lsr,
                         if (*tty_flag == TTY_NORMAL)
                                 *tty_flag = TTY_FRAME;
                 }
-                if (lsr & UART_LSR_OE){
+                if (lsr & UART_LSR_OE) {
                         port->icount.overrun++;
-                        if (*tty_flag == TTY_NORMAL)
-                                *tty_flag = TTY_OVERRUN;
+                        tty_insert_flip_char(&port->port, 0, TTY_OVERRUN);
                 }
         }
 
@@ -511,12 +510,8 @@ static void ssu100_process_read_urb(struct urb *urb)
         if ((len >= 4) &&
             (packet[0] == 0x1b) && (packet[1] == 0x1b) &&
             ((packet[2] == 0x00) || (packet[2] == 0x01))) {
-                if (packet[2] == 0x00) {
+                if (packet[2] == 0x00)
                         ssu100_update_lsr(port, packet[3], &flag);
-                        if (flag == TTY_OVERRUN)
-                                tty_insert_flip_char(&port->port, 0,
-                                                TTY_OVERRUN);
-                }
                 if (packet[2] == 0x01)
                         ssu100_update_msr(port, packet[3]);
 
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index 4bc2fc98636e..73f125e0cb58 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -52,7 +52,7 @@ int usb_stor_euscsi_init(struct us_data *us)
         us->iobuf[0] = 0x1;
         result = usb_stor_control_msg(us, us->send_ctrl_pipe,
                         0x0C, USB_RECIP_INTERFACE | USB_TYPE_VENDOR,
-                        0x01, 0x0, us->iobuf, 0x1, USB_CTRL_SET_TIMEOUT);
+                        0x01, 0x0, us->iobuf, 0x1, 5 * HZ);
         usb_stor_dbg(us, "-- result is %d\n", result);
 
         return 0;
@@ -100,7 +100,7 @@ int usb_stor_huawei_e220_init(struct us_data *us)
         result = usb_stor_control_msg(us, us->send_ctrl_pipe,
                                       USB_REQ_SET_FEATURE,
                                       USB_TYPE_STANDARD | USB_RECIP_DEVICE,
-                                      0x01, 0x0, NULL, 0x0, 1000);
+                                      0x01, 0x0, NULL, 0x0, 1 * HZ);
         usb_stor_dbg(us, "Huawei mode set result is %d\n", result);
         return 0;
 }
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index 8591d89a38e6..27e4a580d2ed 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -626,6 +626,7 @@ static int config_autodelink_after_power_on(struct us_data *us)
         return 0;
 }
 
+#ifdef CONFIG_PM
 static int config_autodelink_before_power_down(struct us_data *us)
 {
         struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
@@ -716,6 +717,7 @@ static void fw5895_init(struct us_data *us)
                 }
         }
 }
+#endif
 
 #ifdef CONFIG_REALTEK_AUTOPM
 static void fw5895_set_mmc_wp(struct us_data *us)
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 22c7d4360fa2..b1d815eb6d0b 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
                  */
                 if (result == USB_STOR_XFER_LONG)
                         fake_sense = 1;
+
+                /*
+                 * Sometimes a device will mistakenly skip the data phase
+                 * and go directly to the status phase without sending a
+                 * zero-length packet.  If we get a 13-byte response here,
+                 * check whether it really is a CSW.
+                 */
+                if (result == USB_STOR_XFER_SHORT &&
+                                srb->sc_data_direction == DMA_FROM_DEVICE &&
+                                transfer_length - scsi_get_resid(srb) ==
+                                        US_BULK_CS_WRAP_LEN) {
+                        struct scatterlist *sg = NULL;
+                        unsigned int offset = 0;
+
+                        if (usb_stor_access_xfer_buf((unsigned char *) bcs,
+                                        US_BULK_CS_WRAP_LEN, srb, &sg,
+                                        &offset, FROM_XFER_BUF) ==
+                                                US_BULK_CS_WRAP_LEN &&
+                                        bcs->Signature ==
+                                                cpu_to_le32(US_BULK_CS_SIGN)) {
+                                usb_stor_dbg(us, "Device skipped data phase\n");
+                                scsi_set_resid(srb, transfer_length);
+                                goto skipped_data_phase;
+                        }
+                }
         }
 
         /* See flow chart on pg 15 of the Bulk Only Transport spec for
@@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
+ skipped_data_phase:
         /* check bulk status */
         residue = le32_to_cpu(bcs->Residue);
         usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 8511b54a65d9..18a283d6de1c 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -54,6 +54,20 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999,
+                "Seagate",
+                "Expansion Desk",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
+/* Reported-by: Bogdan Mihalcea <bogdan.mihalcea@infim.ro> */
+UNUSUAL_DEV(0x0bc2, 0xa003, 0x0000, 0x9999,
+                "Seagate",
+                "Backup Plus",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
 /* https://bbs.archlinux.org/viewtopic.php?id=183190 */
 UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
                 "Seagate",
@@ -61,6 +75,13 @@ UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* https://bbs.archlinux.org/viewtopic.php?id=183190 */
+UNUSUAL_DEV(0x0bc2, 0xab21, 0x0000, 0x9999,
+                "Seagate",
+                "Backup+ BK",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
 /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                 "JMicron",
@@ -75,3 +96,17 @@ UNUSUAL_DEV(0x174c, 0x5106, 0x0000, 0x9999,
                 "ASM1051",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_UAS),
+
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
+                "VIA",
+                "VL711",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
+                "Hitachi",
+                "External HDD",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_UAS),
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 69906cacd04f..a17f11850669 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1312,6 +1312,7 @@ static int
 vhost_scsi_set_endpoint(struct vhost_scsi *vs,
                         struct vhost_scsi_target *t)
 {
+        struct se_portal_group *se_tpg;
         struct tcm_vhost_tport *tv_tport;
         struct tcm_vhost_tpg *tpg;
         struct tcm_vhost_tpg **vs_tpg;
@@ -1359,6 +1360,21 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
                                 ret = -EEXIST;
                                 goto out;
                         }
+                        /*
+                         * In order to ensure individual vhost-scsi configfs
+                         * groups cannot be removed while in use by vhost ioctl,
+                         * go ahead and take an explicit se_tpg->tpg_group.cg_item
+                         * dependency now.
+                         */
+                        se_tpg = &tpg->se_tpg;
+                        ret = configfs_depend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                                   &se_tpg->tpg_group.cg_item);
+                        if (ret) {
+                                pr_warn("configfs_depend_item() failed: %d\n", ret);
+                                kfree(vs_tpg);
+                                mutex_unlock(&tpg->tv_tpg_mutex);
+                                goto out;
+                        }
                         tpg->tv_tpg_vhost_count++;
                         tpg->vhost_scsi = vs;
                         vs_tpg[tpg->tport_tpgt] = tpg;
@@ -1401,6 +1417,7 @@ static int
 vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
                           struct vhost_scsi_target *t)
 {
+        struct se_portal_group *se_tpg;
         struct tcm_vhost_tport *tv_tport;
         struct tcm_vhost_tpg *tpg;
         struct vhost_virtqueue *vq;
@@ -1449,6 +1466,13 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
                 vs->vs_tpg[target] = NULL;
                 match = true;
                 mutex_unlock(&tpg->tv_tpg_mutex);
+                /*
+                 * Release se_tpg->tpg_group.cg_item configfs dependency now
+                 * to allow vhost-scsi WWPN se_tpg->tpg_group shutdown to occur.
+                 */
+                se_tpg = &tpg->se_tpg;
+                configfs_undepend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                       &se_tpg->tpg_group.cg_item);
         }
         if (match) {
                 for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 57b1d44acbfe..eb976ee3a02f 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -448,8 +448,10 @@ static int __init fb_console_setup(char *this_opt)
                 return 1;
 
         while ((options = strsep(&this_opt, ",")) != NULL) {
-                if (!strncmp(options, "font:", 5))
+                if (!strncmp(options, "font:", 5)) {
                         strlcpy(fontname, options + 5, sizeof(fontname));
+                        continue;
+                }
                 
                 if (!strncmp(options, "scrollback:", 11)) {
                         options += 11;
@@ -457,13 +459,9 @@ static int __init fb_console_setup(char *this_opt)
                                 fbcon_softback_size = simple_strtoul(options, &options, 0);
                                 if (*options == 'k' || *options == 'K') {
                                         fbcon_softback_size *= 1024;
-                                        options++;
                                 }
-                                if (*options != ',')
-                                        return 1;
-                                options++;
-                        } else
-                                return 1;
+                        }
+                        continue;
                 }
                 
                 if (!strncmp(options, "map:", 4)) {
@@ -478,8 +476,7 @@ static int __init fb_console_setup(char *this_opt)
 
                                 fbcon_map_override();
                         }
-
-                        return 1;
+                        continue;
                 }
 
                 if (!strncmp(options, "vc:", 3)) {
@@ -491,7 +488,8 @@ static int __init fb_console_setup(char *this_opt)
                         if (*options++ == '-')
                                 last_fb_vc = simple_strtoul(options, &options, 10) - 1;
                         fbcon_is_default = 0; 
-                }       
+                        continue;
+                }
 
                 if (!strncmp(options, "rotate:", 7)) {
                         options += 7;
@@ -499,6 +497,7 @@ static int __init fb_console_setup(char *this_opt)
                                 initial_rotation = simple_strtoul(options, &options, 0);
                         if (initial_rotation > 3)
                                 initial_rotation = 0;
+                        continue;
                 }
         }
         return 1;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 6e6aa704fe84..517f565b65d7 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -56,7 +56,7 @@ static int cursor_size_lastfrom;
 static int cursor_size_lastto;
 static u32 vgacon_xres;
 static u32 vgacon_yres;
-static struct vgastate state;
+static struct vgastate vgastate;
 
 #define BLANK 0x0020
 
@@ -400,7 +400,7 @@ static const char *vgacon_startup(void)
 
         vga_video_num_lines = screen_info.orig_video_lines;
         vga_video_num_columns = screen_info.orig_video_cols;
-        state.vgabase = NULL;
+        vgastate.vgabase = NULL;
 
         if (screen_info.orig_video_mode == 7) {
                 /* Monochrome display */
@@ -851,12 +851,12 @@ static void vga_set_palette(struct vc_data *vc, unsigned char *table)
 {
         int i, j;
 
-        vga_w(state.vgabase, VGA_PEL_MSK, 0xff);
+        vga_w(vgastate.vgabase, VGA_PEL_MSK, 0xff);
         for (i = j = 0; i < 16; i++) {
-                vga_w(state.vgabase, VGA_PEL_IW, table[i]);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_IW, table[i]);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
         }
 }
 
@@ -1008,7 +1008,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
         switch (blank) {
         case 0:         /* Unblank */
                 if (vga_vesa_blanked) {
-                        vga_vesa_unblank(&state);
+                        vga_vesa_unblank(&vgastate);
                         vga_vesa_blanked = 0;
                 }
                 if (vga_palette_blanked) {
@@ -1022,7 +1022,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
         case 1:         /* Normal blanking */
         case -1:        /* Obsolete */
                 if (!mode_switch && vga_video_type == VIDEO_TYPE_VGAC) {
-                        vga_pal_blank(&state);
+                        vga_pal_blank(&vgastate);
                         vga_palette_blanked = 1;
                         return 0;
                 }
@@ -1034,7 +1034,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
                 return 1;
         default:                /* VESA blanking */
                 if (vga_video_type == VIDEO_TYPE_VGAC) {
-                        vga_vesa_blank(&state, blank - 1);
+                        vga_vesa_blank(&vgastate, blank - 1);
                         vga_vesa_blanked = blank;
                 }
                 return 0;
@@ -1280,7 +1280,7 @@ static int vgacon_font_set(struct vc_data *c, struct console_font *font, unsigne
             (charcount != 256 && charcount != 512))
                 return -EINVAL;
 
-        rc = vgacon_do_font_op(&state, font->data, 1, charcount == 512);
+        rc = vgacon_do_font_op(&vgastate, font->data, 1, charcount == 512);
         if (rc)
                 return rc;
 
@@ -1299,7 +1299,7 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font)
         font->charcount = vga_512_chars ? 512 : 256;
         if (!font->data)
                 return 0;
-        return vgacon_do_font_op(&state, font->data, 0, vga_512_chars);
+        return vgacon_do_font_op(&vgastate, font->data, 0, vga_512_chars);
 }
 
 #else
diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 3bf403150a2d..9ec81d46fc57 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -27,7 +27,6 @@
 #include <linux/regulator/consumer.h>
 #include <video/videomode.h>
 
-#include <mach/cpu.h>
 #include <asm/gpio.h>
 
 #include <video/atmel_lcdc.h>
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c b/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
index 5ee3b5505f7f..91921665b98b 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
@@ -301,6 +301,8 @@ static const struct of_device_id tvc_of_match[] = {
         {},
 };
 
+MODULE_DEVICE_TABLE(of, tvc_of_match);
+
 static struct platform_driver tvc_connector_driver = {
         .probe  = tvc_probe,
         .remove = __exit_p(tvc_remove),
@@ -308,6 +310,7 @@ static struct platform_driver tvc_connector_driver = {
                 .name   = "connector-analog-tv",
                 .owner  = THIS_MODULE,
                 .of_match_table = tvc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-dvi.c b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
index 74de2bc50c4f..2dfb6e5ff0cc 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
@@ -391,6 +391,7 @@ static struct platform_driver dvi_connector_driver = {
                 .name   = "connector-dvi",
                 .owner  = THIS_MODULE,
                 .of_match_table = dvic_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c b/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
index 131c6e260898..7b25967a91eb 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
@@ -437,6 +437,7 @@ static struct platform_driver hdmi_connector_driver = {
                 .name   = "connector-hdmi",
                 .owner  = THIS_MODULE,
                 .of_match_table = hdmic_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c b/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
index b4e9a42a79e6..47ee7cdee1c5 100644
--- a/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
+++ b/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
@@ -298,6 +298,7 @@ static struct platform_driver tfp410_driver = {
                 .name   = "tfp410",
                 .owner  = THIS_MODULE,
                 .of_match_table = tfp410_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c b/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
index c891d8f84cb2..c4abd56dd846 100644
--- a/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
+++ b/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
@@ -461,6 +461,7 @@ static struct platform_driver tpd_driver = {
                 .name   = "tpd12s015",
                 .owner  = THIS_MODULE,
                 .of_match_table = tpd_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-dpi.c b/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
index 3636b61dc9b4..a9c3dcf0f6b5 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
@@ -327,6 +327,7 @@ static struct platform_driver panel_dpi_driver = {
                 .name = "panel-dpi",
                 .owner = THIS_MODULE,
                 .of_match_table = panel_dpi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c b/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
index d6f14e8717e8..899cb1ab523d 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
@@ -1378,6 +1378,7 @@ static struct platform_driver dsicm_driver = {
                 .name = "panel-dsi-cm",
                 .owner = THIS_MODULE,
                 .of_match_table = dsicm_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c b/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
index cc5b5124e0b4..27d4fcfa1824 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
@@ -394,6 +394,7 @@ static struct spi_driver lb035q02_spi_driver = {
                 .name   = "panel_lgphilips_lb035q02",
                 .owner  = THIS_MODULE,
                 .of_match_table = lb035q02_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c b/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
index 3595f111aa35..ccf3f4f3c703 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
@@ -424,6 +424,7 @@ static struct spi_driver nec_8048_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = NEC_8048_PM_OPS,
                 .of_match_table = nec_8048_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = nec_8048_probe,
         .remove = nec_8048_remove,
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c b/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
index f1f72ce50a17..234142cc3764 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
@@ -410,6 +410,7 @@ static struct platform_driver sharp_ls_driver = {
                 .name = "panel-sharp-ls037v7dw01",
                 .owner = THIS_MODULE,
                 .of_match_table = sharp_ls_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
index 617f8d2f5127..337ccc5c0f5e 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
@@ -904,6 +904,7 @@ static struct spi_driver acx565akm_driver = {
                 .name   = "acx565akm",
                 .owner  = THIS_MODULE,
                 .of_match_table = acx565akm_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = acx565akm_probe,
         .remove = acx565akm_remove,
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
index 728808bcceeb..fbba0b8ca871 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
@@ -500,6 +500,7 @@ static struct spi_driver td028ttec1_spi_driver = {
                 .name   = "panel-tpo-td028ttec1",
                 .owner  = THIS_MODULE,
                 .of_match_table = td028ttec1_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
index de78ab0caaa8..5aba76bca25a 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
@@ -673,6 +673,7 @@ static struct spi_driver tpo_td043_spi_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &tpo_td043_spi_pm,
                 .of_match_table = tpo_td043_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = tpo_td043_probe,
         .remove = tpo_td043_remove,
diff --git a/drivers/video/fbdev/omap2/dss/apply.c b/drivers/video/fbdev/omap2/dss/apply.c
index 0a0b084ce65d..663ccc3bf4e5 100644
--- a/drivers/video/fbdev/omap2/dss/apply.c
+++ b/drivers/video/fbdev/omap2/dss/apply.c
@@ -1132,6 +1132,8 @@ static void dss_mgr_disable_compat(struct omap_overlay_manager *mgr)
         if (!mp->enabled)
                 goto out;
 
+        wait_pending_extra_info_updates();
+
         if (!mgr_manual_update(mgr))
                 dispc_mgr_disable_sync(mgr->id);
 
diff --git a/drivers/video/fbdev/omap2/dss/dispc.c b/drivers/video/fbdev/omap2/dss/dispc.c
index be053aa80880..0e9a74bb9fc2 100644
--- a/drivers/video/fbdev/omap2/dss/dispc.c
+++ b/drivers/video/fbdev/omap2/dss/dispc.c
@@ -3290,8 +3290,11 @@ static void dispc_dump_regs(struct seq_file *s)
                 DUMPREG(i, DISPC_OVL_FIFO_SIZE_STATUS);
                 DUMPREG(i, DISPC_OVL_ROW_INC);
                 DUMPREG(i, DISPC_OVL_PIXEL_INC);
+
                 if (dss_has_feature(FEAT_PRELOAD))
                         DUMPREG(i, DISPC_OVL_PRELOAD);
+                if (dss_has_feature(FEAT_MFLAG))
+                        DUMPREG(i, DISPC_OVL_MFLAG_THRESHOLD);
 
                 if (i == OMAP_DSS_GFX) {
                         DUMPREG(i, DISPC_OVL_WINDOW_SKIP);
@@ -3312,10 +3315,6 @@ static void dispc_dump_regs(struct seq_file *s)
                 }
                 if (dss_has_feature(FEAT_ATTR2))
                         DUMPREG(i, DISPC_OVL_ATTRIBUTES2);
-                if (dss_has_feature(FEAT_PRELOAD))
-                        DUMPREG(i, DISPC_OVL_PRELOAD);
-                if (dss_has_feature(FEAT_MFLAG))
-                        DUMPREG(i, DISPC_OVL_MFLAG_THRESHOLD);
         }
 
 #undef DISPC_REG
@@ -3843,6 +3842,7 @@ static struct platform_driver omap_dispchw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dispc_pm_ops,
                 .of_match_table = dispc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dispc.h b/drivers/video/fbdev/omap2/dss/dispc.h
index 78edb449c763..3043d6e0a5f9 100644
--- a/drivers/video/fbdev/omap2/dss/dispc.h
+++ b/drivers/video/fbdev/omap2/dss/dispc.h
@@ -101,8 +101,7 @@
                                         DISPC_FIR_COEF_V2_OFFSET(n, i))
 #define DISPC_OVL_PRELOAD(n)            (DISPC_OVL_BASE(n) + \
                                         DISPC_PRELOAD_OFFSET(n))
-#define DISPC_OVL_MFLAG_THRESHOLD(n)    (DISPC_OVL_BASE(n) + \
-                                        DISPC_MFLAG_THRESHOLD_OFFSET(n))
+#define DISPC_OVL_MFLAG_THRESHOLD(n)    DISPC_MFLAG_THRESHOLD_OFFSET(n)
 
 /* DISPC up/downsampling FIR filter coefficient structure */
 struct dispc_coef {
diff --git a/drivers/video/fbdev/omap2/dss/dpi.c b/drivers/video/fbdev/omap2/dss/dpi.c
index 9368972d6962..4a3363dae74a 100644
--- a/drivers/video/fbdev/omap2/dss/dpi.c
+++ b/drivers/video/fbdev/omap2/dss/dpi.c
@@ -720,6 +720,7 @@ static struct platform_driver omap_dpi_driver = {
         .driver         = {
                 .name   = "omapdss_dpi",
                 .owner  = THIS_MODULE,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dsi.c b/drivers/video/fbdev/omap2/dss/dsi.c
index b6f6ae1d4664..0793bc67a275 100644
--- a/drivers/video/fbdev/omap2/dss/dsi.c
+++ b/drivers/video/fbdev/omap2/dss/dsi.c
@@ -1603,7 +1603,7 @@ int dsi_pll_set_clock_div(struct platform_device *dsidev,
         } else if (dss_has_feature(FEAT_DSI_PLL_SELFREQDCO)) {
                 f = cinfo->clkin4ddr < 1000000000 ? 0x2 : 0x4;
 
-                l = FLD_MOD(l, f, 4, 1);        /* PLL_SELFREQDCO */
+                l = FLD_MOD(l, f, 3, 1);        /* PLL_SELFREQDCO */
         }
 
         l = FLD_MOD(l, 1, 13, 13);              /* DSI_PLL_REFEN */
@@ -5754,6 +5754,7 @@ static struct platform_driver omap_dsihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dsi_pm_ops,
                 .of_match_table = dsi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dss.c b/drivers/video/fbdev/omap2/dss/dss.c
index 6daeb7ed44c6..14bcd6c43f72 100644
--- a/drivers/video/fbdev/omap2/dss/dss.c
+++ b/drivers/video/fbdev/omap2/dss/dss.c
@@ -966,6 +966,7 @@ static struct platform_driver omap_dsshw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dss_pm_ops,
                 .of_match_table = dss_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi4.c b/drivers/video/fbdev/omap2/dss/hdmi4.c
index 6a8550cf43e5..9a8713ca090c 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi4.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi4.c
@@ -781,6 +781,7 @@ static struct platform_driver omapdss_hdmihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi5.c b/drivers/video/fbdev/omap2/dss/hdmi5.c
index 32d02ec34d23..169b764bb9d4 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi5.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi5.c
@@ -806,6 +806,7 @@ static struct platform_driver omapdss_hdmihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi_pll.c b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
index 54df12a8d744..6d92bb32fe51 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi_pll.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
@@ -124,16 +124,15 @@ static int hdmi_pll_config(struct hdmi_pll_data *pll)
         r = FLD_MOD(r, 0x0, 14, 14);    /* PHY_CLKINEN de-assert during locking */
         r = FLD_MOD(r, fmt->refsel, 22, 21);    /* REFSEL */
 
-        if (fmt->dcofreq) {
-                /* divider programming for frequency beyond 1000Mhz */
-                REG_FLD_MOD(pll->base, PLLCTRL_CFG3, fmt->regsd, 17, 10);
+        if (fmt->dcofreq)
                 r = FLD_MOD(r, 0x4, 3, 1);      /* 1000MHz and 2000MHz */
-        } else {
+        else
                 r = FLD_MOD(r, 0x2, 3, 1);      /* 500MHz and 1000MHz */
-        }
 
         hdmi_write_reg(pll->base, PLLCTRL_CFG2, r);
 
+        REG_FLD_MOD(pll->base, PLLCTRL_CFG3, fmt->regsd, 17, 10);
+
         r = hdmi_read_reg(pll->base, PLLCTRL_CFG4);
         r = FLD_MOD(r, fmt->regm2, 24, 18);
         r = FLD_MOD(r, fmt->regmf, 17, 0);
@@ -144,8 +143,8 @@ static int hdmi_pll_config(struct hdmi_pll_data *pll)
 
         /* wait for bit change */
         if (hdmi_wait_for_bit_change(pll->base, PLLCTRL_PLL_GO,
-                        0, 0, 1) != 1) {
-                DSSERR("PLL GO bit not set\n");
+                        0, 0, 0) != 0) {
+                DSSERR("PLL GO bit not clearing\n");
                 return -ETIMEDOUT;
         }
 
diff --git a/drivers/video/fbdev/omap2/dss/rfbi.c b/drivers/video/fbdev/omap2/dss/rfbi.c
index c8a81a2b879c..878273f58839 100644
--- a/drivers/video/fbdev/omap2/dss/rfbi.c
+++ b/drivers/video/fbdev/omap2/dss/rfbi.c
@@ -1044,6 +1044,7 @@ static struct platform_driver omap_rfbihw_driver = {
                 .name   = "omapdss_rfbi",
                 .owner  = THIS_MODULE,
                 .pm     = &rfbi_pm_ops,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/sdi.c b/drivers/video/fbdev/omap2/dss/sdi.c
index 911dcc9173a6..4c9c46d4ea60 100644
--- a/drivers/video/fbdev/omap2/dss/sdi.c
+++ b/drivers/video/fbdev/omap2/dss/sdi.c
@@ -377,6 +377,7 @@ static struct platform_driver omap_sdi_driver = {
         .driver         = {
                 .name   = "omapdss_sdi",
                 .owner  = THIS_MODULE,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/venc.c b/drivers/video/fbdev/omap2/dss/venc.c
index 21d81113962b..d077d8a75ddc 100644
--- a/drivers/video/fbdev/omap2/dss/venc.c
+++ b/drivers/video/fbdev/omap2/dss/venc.c
@@ -966,6 +966,7 @@ static struct platform_driver omap_venchw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &venc_pm_ops,
                 .of_match_table = venc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-main.c b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
index 15872433e0c6..ce8a70570756 100644
--- a/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
@@ -1833,14 +1833,13 @@ static void omapfb_free_resources(struct omapfb2_device *fbdev)
         if (fbdev == NULL)
                 return;
 
-        for (i = 0; i < fbdev->num_fbs; i++) {
-                struct omapfb_info *ofbi = FB2OFB(fbdev->fbs[i]);
-                int j;
+        for (i = 0; i < fbdev->num_overlays; i++) {
+                struct omap_overlay *ovl = fbdev->overlays[i];
 
-                for (j = 0; j < ofbi->num_overlays; j++) {
-                        struct omap_overlay *ovl = ofbi->overlays[j];
-                        ovl->disable(ovl);
-                }
+                ovl->disable(ovl);
+
+                if (ovl->manager)
+                        ovl->unset_manager(ovl);
         }
 
         for (i = 0; i < fbdev->num_fbs; i++)
@@ -2619,7 +2618,7 @@ err0:
         return r;
 }
 
-static int __exit omapfb_remove(struct platform_device *pdev)
+static int omapfb_remove(struct platform_device *pdev)
 {
         struct omapfb2_device *fbdev = platform_get_drvdata(pdev);
 
@@ -2636,7 +2635,7 @@ static int __exit omapfb_remove(struct platform_device *pdev)
 
 static struct platform_driver omapfb_driver = {
         .probe          = omapfb_probe,
-        .remove         = __exit_p(omapfb_remove),
+        .remove         = omapfb_remove,
         .driver         = {
                 .name   = "omapfb",
                 .owner  = THIS_MODULE,
@@ -2651,6 +2650,7 @@ module_param_named(mirror, def_mirror, bool, 0);
 
 module_platform_driver(omapfb_driver);
 
+MODULE_ALIAS("platform:omapfb");
 MODULE_AUTHOR("Tomi Valkeinen <tomi.valkeinen@nokia.com>");
 MODULE_DESCRIPTION("OMAP2/3 Framebuffer");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index e3d5bf0a5021..d0107d424ee4 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -87,6 +87,15 @@ config DA9055_WATCHDOG
           This driver can also be built as a module.  If so, the module
           will be called da9055_wdt.
 
+config DA9063_WATCHDOG
+        tristate "Dialog DA9063 Watchdog"
+        depends on MFD_DA9063
+        select WATCHDOG_CORE
+        help
+          Support for the watchdog in the DA9063 PMIC.
+
+          This driver can be built as a module. The module name is da9063_wdt.
+
 config GPIO_WATCHDOG
         tristate "Watchdog device controlled through GPIO-line"
         depends on OF_GPIO
@@ -123,6 +132,7 @@ config WM8350_WATCHDOG
 
 config XILINX_WATCHDOG
         tristate "Xilinx Watchdog timer"
+        depends on HAS_IOMEM
         select WATCHDOG_CORE
         help
           Watchdog driver for the xps_timebase_wdt ip core.
@@ -157,6 +167,14 @@ config AT91SAM9X_WATCHDOG
           Watchdog timer embedded into AT91SAM9X and AT91CAP9 chips. This will
           reboot your system when the timeout is reached.
 
+config CADENCE_WATCHDOG
+        tristate "Cadence Watchdog Timer"
+        depends on ARM
+        select WATCHDOG_CORE
+        help
+          Say Y here if you want to include support for the watchdog
+          timer in the Xilinx Zynq.
+
 config 21285_WATCHDOG
         tristate "DC21285 watchdog"
         depends on FOOTBRIDGE
@@ -319,6 +337,17 @@ config ORION_WATCHDOG
           To compile this driver as a module, choose M here: the
           module will be called orion_wdt.
 
+config RN5T618_WATCHDOG
+        tristate "Ricoh RN5T618 watchdog"
+        depends on MFD_RN5T618
+        select WATCHDOG_CORE
+        help
+          If you say yes here you get support for watchdog on the Ricoh
+          RN5T618 PMIC.
+
+          This driver can also be built as a module.  If so, the module
+          will be called rn5t618_wdt.
+
 config SUNXI_WATCHDOG
         tristate "Allwinner SoCs watchdog support"
         depends on ARCH_SUNXI
@@ -444,7 +473,7 @@ config SIRFSOC_WATCHDOG
 
 config TEGRA_WATCHDOG
         tristate "Tegra watchdog"
-        depends on ARCH_TEGRA || COMPILE_TEST
+        depends on (ARCH_TEGRA || COMPILE_TEST) && HAS_IOMEM
         select WATCHDOG_CORE
         help
           Say Y here to include support for the watchdog timer
@@ -453,6 +482,29 @@ config TEGRA_WATCHDOG
           To compile this driver as a module, choose M here: the
           module will be called tegra_wdt.
 
+config QCOM_WDT
+        tristate "QCOM watchdog"
+        depends on HAS_IOMEM
+        depends on ARCH_QCOM
+        select WATCHDOG_CORE
+        help
+          Say Y here to include Watchdog timer support for the watchdog found
+          on QCOM chipsets.  Currently supported targets are the MSM8960,
+          APQ8064, and IPQ8064.
+
+          To compile this driver as a module, choose M here: the
+          module will be called qcom_wdt.
+
+config MESON_WATCHDOG
+        tristate "Amlogic Meson SoCs watchdog support"
+        depends on ARCH_MESON
+        select WATCHDOG_CORE
+        help
+          Say Y here to include support for the watchdog timer
+          in Amlogic Meson SoCs.
+          To compile this driver as a module, choose M here: the
+          module will be called meson_wdt.
+
 # AVR32 Architecture
 
 config AT32AP700X_WDT
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index de1701470c14..c569ec8f8a76 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -32,6 +32,7 @@ obj-$(CONFIG_USBPCWATCHDOG) += pcwd_usb.o
 obj-$(CONFIG_ARM_SP805_WATCHDOG) += sp805_wdt.o
 obj-$(CONFIG_AT91RM9200_WATCHDOG) += at91rm9200_wdt.o
 obj-$(CONFIG_AT91SAM9X_WATCHDOG) += at91sam9_wdt.o
+obj-$(CONFIG_CADENCE_WATCHDOG) += cadence_wdt.o
 obj-$(CONFIG_OMAP_WATCHDOG) += omap_wdt.o
 obj-$(CONFIG_TWL4030_WATCHDOG) += twl4030_wdt.o
 obj-$(CONFIG_21285_WATCHDOG) += wdt285.o
@@ -47,6 +48,7 @@ obj-$(CONFIG_IOP_WATCHDOG) += iop_wdt.o
 obj-$(CONFIG_DAVINCI_WATCHDOG) += davinci_wdt.o
 obj-$(CONFIG_ORION_WATCHDOG) += orion_wdt.o
 obj-$(CONFIG_SUNXI_WATCHDOG) += sunxi_wdt.o
+obj-$(CONFIG_RN5T618_WATCHDOG) += rn5t618_wdt.o
 obj-$(CONFIG_COH901327_WATCHDOG) += coh901327_wdt.o
 obj-$(CONFIG_STMP3XXX_RTC_WATCHDOG) += stmp3xxx_rtc_wdt.o
 obj-$(CONFIG_NUC900_WATCHDOG) += nuc900_wdt.o
@@ -57,8 +59,10 @@ obj-$(CONFIG_RETU_WATCHDOG) += retu_wdt.o
 obj-$(CONFIG_BCM2835_WDT) += bcm2835_wdt.o
 obj-$(CONFIG_MOXART_WDT) += moxart_wdt.o
 obj-$(CONFIG_SIRFSOC_WATCHDOG) += sirfsoc_wdt.o
+obj-$(CONFIG_QCOM_WDT) += qcom-wdt.o
 obj-$(CONFIG_BCM_KONA_WDT) += bcm_kona_wdt.o
 obj-$(CONFIG_TEGRA_WATCHDOG) += tegra_wdt.o
+obj-$(CONFIG_MESON_WATCHDOG) += meson_wdt.o
 
 # AVR32 Architecture
 obj-$(CONFIG_AT32AP700X_WDT) += at32ap700x_wdt.o
@@ -173,6 +177,7 @@ obj-$(CONFIG_XEN_WDT) += xen_wdt.o
 # Architecture Independent
 obj-$(CONFIG_DA9052_WATCHDOG) += da9052_wdt.o
 obj-$(CONFIG_DA9055_WATCHDOG) += da9055_wdt.o
+obj-$(CONFIG_DA9063_WATCHDOG) += da9063_wdt.o
 obj-$(CONFIG_GPIO_WATCHDOG)     += gpio_wdt.o
 obj-$(CONFIG_WM831X_WATCHDOG) += wm831x_wdt.o
 obj-$(CONFIG_WM8350_WATCHDOG) += wm8350_wdt.o
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 08a785398eac..e96b09b135c8 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -30,8 +30,6 @@
  * occur, and the final time the board will reset.
  */
 
-u32 booke_wdt_enabled;
-u32 booke_wdt_period = CONFIG_BOOKE_WDT_DEFAULT_TIMEOUT;
 
 #ifdef  CONFIG_PPC_FSL_BOOK3E
 #define WDTP(x)         ((((x)&0x3)<<30)|(((x)&0x3c)<<15))
@@ -41,27 +39,10 @@ u32 booke_wdt_period = CONFIG_BOOKE_WDT_DEFAULT_TIMEOUT;
 #define WDTP_MASK       (TCR_WP_MASK)
 #endif
 
-/* Checks wdt=x and wdt_period=xx command-line option */
-notrace int __init early_parse_wdt(char *p)
-{
-        if (p && strncmp(p, "0", 1) != 0)
-                booke_wdt_enabled = 1;
-
-        return 0;
-}
-early_param("wdt", early_parse_wdt);
-
-int __init early_parse_wdt_period(char *p)
-{
-        unsigned long ret;
-        if (p) {
-                if (!kstrtol(p, 0, &ret))
-                        booke_wdt_period = ret;
-        }
-
-        return 0;
-}
-early_param("wdt_period", early_parse_wdt_period);
+static bool booke_wdt_enabled;
+module_param(booke_wdt_enabled, bool, 0);
+static int  booke_wdt_period = CONFIG_BOOKE_WDT_DEFAULT_TIMEOUT;
+module_param(booke_wdt_period, int, 0);
 
 #ifdef CONFIG_PPC_FSL_BOOK3E
 
@@ -259,5 +240,6 @@ static int __init booke_wdt_init(void)
 module_init(booke_wdt_init);
 module_exit(booke_wdt_exit);
 
+MODULE_ALIAS("booke_wdt");
 MODULE_DESCRIPTION("PowerPC Book-E watchdog driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/watchdog/cadence_wdt.c b/drivers/watchdog/cadence_wdt.c
new file mode 100644
index 000000000000..5927c0a98a74
--- /dev/null
+++ b/drivers/watchdog/cadence_wdt.c
@@ -0,0 +1,516 @@
+/*
+ * Cadence WDT driver - Used by Xilinx Zynq
+ *
+ * Copyright (C) 2010 - 2014 Xilinx, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/clk.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <linux/watchdog.h>
+
+#define CDNS_WDT_DEFAULT_TIMEOUT        10
+/* Supports 1 - 516 sec */
+#define CDNS_WDT_MIN_TIMEOUT    1
+#define CDNS_WDT_MAX_TIMEOUT    516
+
+/* Restart key */
+#define CDNS_WDT_RESTART_KEY 0x00001999
+
+/* Counter register access key */
+#define CDNS_WDT_REGISTER_ACCESS_KEY 0x00920000
+
+/* Counter value divisor */
+#define CDNS_WDT_COUNTER_VALUE_DIVISOR 0x1000
+
+/* Clock prescaler value and selection */
+#define CDNS_WDT_PRESCALE_64    64
+#define CDNS_WDT_PRESCALE_512   512
+#define CDNS_WDT_PRESCALE_4096  4096
+#define CDNS_WDT_PRESCALE_SELECT_64     1
+#define CDNS_WDT_PRESCALE_SELECT_512    2
+#define CDNS_WDT_PRESCALE_SELECT_4096   3
+
+/* Input clock frequency */
+#define CDNS_WDT_CLK_10MHZ      10000000
+#define CDNS_WDT_CLK_75MHZ      75000000
+
+/* Counter maximum value */
+#define CDNS_WDT_COUNTER_MAX 0xFFF
+
+static int wdt_timeout = CDNS_WDT_DEFAULT_TIMEOUT;
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+module_param(wdt_timeout, int, 0);
+MODULE_PARM_DESC(wdt_timeout,
+                 "Watchdog time in seconds. (default="
+                 __MODULE_STRING(CDNS_WDT_DEFAULT_TIMEOUT) ")");
+
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout,
+                 "Watchdog cannot be stopped once started (default="
+                 __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+/**
+ * struct cdns_wdt - Watchdog device structure
+ * @regs: baseaddress of device
+ * @rst: reset flag
+ * @clk: struct clk * of a clock source
+ * @prescaler: for saving prescaler value
+ * @ctrl_clksel: counter clock prescaler selection
+ * @io_lock: spinlock for IO register access
+ * @cdns_wdt_device: watchdog device structure
+ * @cdns_wdt_notifier: notifier structure
+ *
+ * Structure containing parameters specific to cadence watchdog.
+ */
+struct cdns_wdt {
+        void __iomem            *regs;
+        bool                    rst;
+        struct clk              *clk;
+        u32                     prescaler;
+        u32                     ctrl_clksel;
+        spinlock_t              io_lock;
+        struct watchdog_device  cdns_wdt_device;
+        struct notifier_block   cdns_wdt_notifier;
+};
+
+/* Write access to Registers */
+static inline void cdns_wdt_writereg(struct cdns_wdt *wdt, u32 offset, u32 val)
+{
+        writel_relaxed(val, wdt->regs + offset);
+}
+
+/*************************Register Map**************************************/
+
+/* Register Offsets for the WDT */
+#define CDNS_WDT_ZMR_OFFSET     0x0     /* Zero Mode Register */
+#define CDNS_WDT_CCR_OFFSET     0x4     /* Counter Control Register */
+#define CDNS_WDT_RESTART_OFFSET 0x8     /* Restart Register */
+#define CDNS_WDT_SR_OFFSET      0xC     /* Status Register */
+
+/*
+ * Zero Mode Register - This register controls how the time out is indicated
+ * and also contains the access code to allow writes to the register (0xABC).
+ */
+#define CDNS_WDT_ZMR_WDEN_MASK  0x00000001 /* Enable the WDT */
+#define CDNS_WDT_ZMR_RSTEN_MASK 0x00000002 /* Enable the reset output */
+#define CDNS_WDT_ZMR_IRQEN_MASK 0x00000004 /* Enable IRQ output */
+#define CDNS_WDT_ZMR_RSTLEN_16  0x00000030 /* Reset pulse of 16 pclk cycles */
+#define CDNS_WDT_ZMR_ZKEY_VAL   0x00ABC000 /* Access key, 0xABC << 12 */
+/*
+ * Counter Control register - This register controls how fast the timer runs
+ * and the reset value and also contains the access code to allow writes to
+ * the register.
+ */
+#define CDNS_WDT_CCR_CRV_MASK   0x00003FFC /* Counter reset value */
+
+/**
+ * cdns_wdt_stop - Stop the watchdog.
+ *
+ * @wdd: watchdog device
+ *
+ * Read the contents of the ZMR register, clear the WDEN bit
+ * in the register and set the access key for successful write.
+ *
+ * Return: always 0
+ */
+static int cdns_wdt_stop(struct watchdog_device *wdd)
+{
+        struct cdns_wdt *wdt = watchdog_get_drvdata(wdd);
+
+        spin_lock(&wdt->io_lock);
+        cdns_wdt_writereg(wdt, CDNS_WDT_ZMR_OFFSET,
+                          CDNS_WDT_ZMR_ZKEY_VAL & (~CDNS_WDT_ZMR_WDEN_MASK));
+        spin_unlock(&wdt->io_lock);
+
+        return 0;
+}
+
+/**
+ * cdns_wdt_reload - Reload the watchdog timer (i.e. pat the watchdog).
+ *
+ * @wdd: watchdog device
+ *
+ * Write the restart key value (0x00001999) to the restart register.
+ *
+ * Return: always 0
+ */
+static int cdns_wdt_reload(struct watchdog_device *wdd)
+{
+        struct cdns_wdt *wdt = watchdog_get_drvdata(wdd);
+
+        spin_lock(&wdt->io_lock);
+        cdns_wdt_writereg(wdt, CDNS_WDT_RESTART_OFFSET,
+                          CDNS_WDT_RESTART_KEY);
+        spin_unlock(&wdt->io_lock);
+
+        return 0;
+}
+
+/**
+ * cdns_wdt_start - Enable and start the watchdog.
+ *
+ * @wdd: watchdog device
+ *
+ * The counter value is calculated according to the formula:
+ *              calculated count = (timeout * clock) / prescaler + 1.
+ * The calculated count is divided by 0x1000 to obtain the field value
+ * to write to counter control register.
+ * Clears the contents of prescaler and counter reset value. Sets the
+ * prescaler to 4096 and the calculated count and access key
+ * to write to CCR Register.
+ * Sets the WDT (WDEN bit) and either the Reset signal(RSTEN bit)
+ * or Interrupt signal(IRQEN) with a specified cycles and the access
+ * key to write to ZMR Register.
+ *
+ * Return: always 0
+ */
+static int cdns_wdt_start(struct watchdog_device *wdd)
+{
+        struct cdns_wdt *wdt = watchdog_get_drvdata(wdd);
+        unsigned int data = 0;
+        unsigned short count;
+        unsigned long clock_f = clk_get_rate(wdt->clk);
+
+        /*
+         * Counter value divisor to obtain the value of
+         * counter reset to be written to control register.
+         */
+        count = (wdd->timeout * (clock_f / wdt->prescaler)) /
+                 CDNS_WDT_COUNTER_VALUE_DIVISOR + 1;
+
+        if (count > CDNS_WDT_COUNTER_MAX)
+                count = CDNS_WDT_COUNTER_MAX;
+
+        spin_lock(&wdt->io_lock);
+        cdns_wdt_writereg(wdt, CDNS_WDT_ZMR_OFFSET,
+                          CDNS_WDT_ZMR_ZKEY_VAL);
+
+        count = (count << 2) & CDNS_WDT_CCR_CRV_MASK;
+
+        /* Write counter access key first to be able write to register */
+        data = count | CDNS_WDT_REGISTER_ACCESS_KEY | wdt->ctrl_clksel;
+        cdns_wdt_writereg(wdt, CDNS_WDT_CCR_OFFSET, data);
+        data = CDNS_WDT_ZMR_WDEN_MASK | CDNS_WDT_ZMR_RSTLEN_16 |
+               CDNS_WDT_ZMR_ZKEY_VAL;
+
+        /* Reset on timeout if specified in device tree. */
+        if (wdt->rst) {
+                data |= CDNS_WDT_ZMR_RSTEN_MASK;
+                data &= ~CDNS_WDT_ZMR_IRQEN_MASK;
+        } else {
+                data &= ~CDNS_WDT_ZMR_RSTEN_MASK;
+                data |= CDNS_WDT_ZMR_IRQEN_MASK;
+        }
+        cdns_wdt_writereg(wdt, CDNS_WDT_ZMR_OFFSET, data);
+        cdns_wdt_writereg(wdt, CDNS_WDT_RESTART_OFFSET,
+                          CDNS_WDT_RESTART_KEY);
+        spin_unlock(&wdt->io_lock);
+
+        return 0;
+}
+
+/**
+ * cdns_wdt_settimeout - Set a new timeout value for the watchdog device.
+ *
+ * @wdd: watchdog device
+ * @new_time: new timeout value that needs to be set
+ * Return: 0 on success
+ *
+ * Update the watchdog_device timeout with new value which is used when
+ * cdns_wdt_start is called.
+ */
+static int cdns_wdt_settimeout(struct watchdog_device *wdd,
+                               unsigned int new_time)
+{
+        wdd->timeout = new_time;
+
+        return cdns_wdt_start(wdd);
+}
+
+/**
+ * cdns_wdt_irq_handler - Notifies of watchdog timeout.
+ *
+ * @irq: interrupt number
+ * @dev_id: pointer to a platform device structure
+ * Return: IRQ_HANDLED
+ *
+ * The handler is invoked when the watchdog times out and a
+ * reset on timeout has not been enabled.
+ */
+static irqreturn_t cdns_wdt_irq_handler(int irq, void *dev_id)
+{
+        struct platform_device *pdev = dev_id;
+
+        dev_info(&pdev->dev,
+                 "Watchdog timed out. Internal reset not enabled\n");
+
+        return IRQ_HANDLED;
+}
+
+/*
+ * Info structure used to indicate the features supported by the device
+ * to the upper layers. This is defined in watchdog.h header file.
+ */
+static struct watchdog_info cdns_wdt_info = {
+        .identity       = "cdns_wdt watchdog",
+        .options        = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING |
+                          WDIOF_MAGICCLOSE,
+};
+
+/* Watchdog Core Ops */
+static struct watchdog_ops cdns_wdt_ops = {
+        .owner = THIS_MODULE,
+        .start = cdns_wdt_start,
+        .stop = cdns_wdt_stop,
+        .ping = cdns_wdt_reload,
+        .set_timeout = cdns_wdt_settimeout,
+};
+
+/**
+ * cdns_wdt_notify_sys - Notifier for reboot or shutdown.
+ *
+ * @this: handle to notifier block
+ * @code: turn off indicator
+ * @unused: unused
+ * Return: NOTIFY_DONE
+ *
+ * This notifier is invoked whenever the system reboot or shutdown occur
+ * because we need to disable the WDT before system goes down as WDT might
+ * reset on the next boot.
+ */
+static int cdns_wdt_notify_sys(struct notifier_block *this, unsigned long code,
+                               void *unused)
+{
+        struct cdns_wdt *wdt = container_of(this, struct cdns_wdt,
+                                            cdns_wdt_notifier);
+        if (code == SYS_DOWN || code == SYS_HALT)
+                cdns_wdt_stop(&wdt->cdns_wdt_device);
+
+        return NOTIFY_DONE;
+}
+
+/************************Platform Operations*****************************/
+/**
+ * cdns_wdt_probe - Probe call for the device.
+ *
+ * @pdev: handle to the platform device structure.
+ * Return: 0 on success, negative error otherwise.
+ *
+ * It does all the memory allocation and registration for the device.
+ */
+static int cdns_wdt_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        int ret, irq;
+        unsigned long clock_f;
+        struct cdns_wdt *wdt;
+        struct watchdog_device *cdns_wdt_device;
+
+        wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
+        if (!wdt)
+                return -ENOMEM;
+
+        cdns_wdt_device = &wdt->cdns_wdt_device;
+        cdns_wdt_device->info = &cdns_wdt_info;
+        cdns_wdt_device->ops = &cdns_wdt_ops;
+        cdns_wdt_device->timeout = CDNS_WDT_DEFAULT_TIMEOUT;
+        cdns_wdt_device->min_timeout = CDNS_WDT_MIN_TIMEOUT;
+        cdns_wdt_device->max_timeout = CDNS_WDT_MAX_TIMEOUT;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        wdt->regs = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(wdt->regs))
+                return PTR_ERR(wdt->regs);
+
+        /* Register the interrupt */
+        wdt->rst = of_property_read_bool(pdev->dev.of_node, "reset-on-timeout");
+        irq = platform_get_irq(pdev, 0);
+        if (!wdt->rst && irq >= 0) {
+                ret = devm_request_irq(&pdev->dev, irq, cdns_wdt_irq_handler, 0,
+                                       pdev->name, pdev);
+                if (ret) {
+                        dev_err(&pdev->dev,
+                                "cannot register interrupt handler err=%d\n",
+                                ret);
+                        return ret;
+                }
+        }
+
+        /* Initialize the members of cdns_wdt structure */
+        cdns_wdt_device->parent = &pdev->dev;
+
+        ret = watchdog_init_timeout(cdns_wdt_device, wdt_timeout, &pdev->dev);
+        if (ret) {
+                dev_err(&pdev->dev, "unable to set timeout value\n");
+                return ret;
+        }
+
+        watchdog_set_nowayout(cdns_wdt_device, nowayout);
+        watchdog_set_drvdata(cdns_wdt_device, wdt);
+
+        wdt->clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(wdt->clk)) {
+                dev_err(&pdev->dev, "input clock not found\n");
+                ret = PTR_ERR(wdt->clk);
+                return ret;
+        }
+
+        ret = clk_prepare_enable(wdt->clk);
+        if (ret) {
+                dev_err(&pdev->dev, "unable to enable clock\n");
+                return ret;
+        }
+
+        clock_f = clk_get_rate(wdt->clk);
+        if (clock_f <= CDNS_WDT_CLK_75MHZ) {
+                wdt->prescaler = CDNS_WDT_PRESCALE_512;
+                wdt->ctrl_clksel = CDNS_WDT_PRESCALE_SELECT_512;
+        } else {
+                wdt->prescaler = CDNS_WDT_PRESCALE_4096;
+                wdt->ctrl_clksel = CDNS_WDT_PRESCALE_SELECT_4096;
+        }
+
+        spin_lock_init(&wdt->io_lock);
+
+        wdt->cdns_wdt_notifier.notifier_call = &cdns_wdt_notify_sys;
+        ret = register_reboot_notifier(&wdt->cdns_wdt_notifier);
+        if (ret != 0) {
+                dev_err(&pdev->dev, "cannot register reboot notifier err=%d)\n",
+                        ret);
+                goto err_clk_disable;
+        }
+
+        ret = watchdog_register_device(cdns_wdt_device);
+        if (ret) {
+                dev_err(&pdev->dev, "Failed to register wdt device\n");
+                goto err_clk_disable;
+        }
+        platform_set_drvdata(pdev, wdt);
+
+        dev_dbg(&pdev->dev, "Xilinx Watchdog Timer at %p with timeout %ds%s\n",
+                 wdt->regs, cdns_wdt_device->timeout,
+                 nowayout ? ", nowayout" : "");
+
+        return 0;
+
+err_clk_disable:
+        clk_disable_unprepare(wdt->clk);
+
+        return ret;
+}
+
+/**
+ * cdns_wdt_remove - Probe call for the device.
+ *
+ * @pdev: handle to the platform device structure.
+ * Return: 0 on success, otherwise negative error.
+ *
+ * Unregister the device after releasing the resources.
+ */
+static int cdns_wdt_remove(struct platform_device *pdev)
+{
+        struct cdns_wdt *wdt = platform_get_drvdata(pdev);
+
+        cdns_wdt_stop(&wdt->cdns_wdt_device);
+        watchdog_unregister_device(&wdt->cdns_wdt_device);
+        unregister_reboot_notifier(&wdt->cdns_wdt_notifier);
+        clk_disable_unprepare(wdt->clk);
+
+        return 0;
+}
+
+/**
+ * cdns_wdt_shutdown - Stop the device.
+ *
+ * @pdev: handle to the platform structure.
+ *
+ */
+static void cdns_wdt_shutdown(struct platform_device *pdev)
+{
+        struct cdns_wdt *wdt = platform_get_drvdata(pdev);
+
+        cdns_wdt_stop(&wdt->cdns_wdt_device);
+        clk_disable_unprepare(wdt->clk);
+}
+
+/**
+ * cdns_wdt_suspend - Stop the device.
+ *
+ * @dev: handle to the device structure.
+ * Return: 0 always.
+ */
+static int __maybe_unused cdns_wdt_suspend(struct device *dev)
+{
+        struct platform_device *pdev = container_of(dev,
+                        struct platform_device, dev);
+        struct cdns_wdt *wdt = platform_get_drvdata(pdev);
+
+        cdns_wdt_stop(&wdt->cdns_wdt_device);
+        clk_disable_unprepare(wdt->clk);
+
+        return 0;
+}
+
+/**
+ * cdns_wdt_resume - Resume the device.
+ *
+ * @dev: handle to the device structure.
+ * Return: 0 on success, errno otherwise.
+ */
+static int __maybe_unused cdns_wdt_resume(struct device *dev)
+{
+        int ret;
+        struct platform_device *pdev = container_of(dev,
+                        struct platform_device, dev);
+        struct cdns_wdt *wdt = platform_get_drvdata(pdev);
+
+        ret = clk_prepare_enable(wdt->clk);
+        if (ret) {
+                dev_err(dev, "unable to enable clock\n");
+                return ret;
+        }
+        cdns_wdt_start(&wdt->cdns_wdt_device);
+
+        return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(cdns_wdt_pm_ops, cdns_wdt_suspend, cdns_wdt_resume);
+
+static struct of_device_id cdns_wdt_of_match[] = {
+        { .compatible = "cdns,wdt-r1p2", },
+        { /* end of table */ }
+};
+MODULE_DEVICE_TABLE(of, cdns_wdt_of_match);
+
+/* Driver Structure */
+static struct platform_driver cdns_wdt_driver = {
+        .probe          = cdns_wdt_probe,
+        .remove         = cdns_wdt_remove,
+        .shutdown       = cdns_wdt_shutdown,
+        .driver         = {
+                .name   = "cdns-wdt",
+                .owner  = THIS_MODULE,
+                .of_match_table = cdns_wdt_of_match,
+                .pm     = &cdns_wdt_pm_ops,
+        },
+};
+
+module_platform_driver(cdns_wdt_driver);
+
+MODULE_AUTHOR("Xilinx, Inc.");
+MODULE_DESCRIPTION("Watchdog driver for Cadence WDT");
+MODULE_LICENSE("GPL");
diff --git a/drivers/watchdog/da9063_wdt.c b/drivers/watchdog/da9063_wdt.c
new file mode 100644
index 000000000000..2cd6b2c2dd2a
--- /dev/null
+++ b/drivers/watchdog/da9063_wdt.c
@@ -0,0 +1,191 @@
+/*
+ * Watchdog driver for DA9063 PMICs.
+ *
+ * Copyright(c) 2012 Dialog Semiconductor Ltd.
+ *
+ * Author: Mariusz Wojtasik <mariusz.wojtasik@diasemi.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/watchdog.h>
+#include <linux/platform_device.h>
+#include <linux/uaccess.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/mfd/da9063/registers.h>
+#include <linux/mfd/da9063/core.h>
+#include <linux/regmap.h>
+
+/*
+ * Watchdog selector to timeout in seconds.
+ *   0: WDT disabled;
+ *   others: timeout = 2048 ms * 2^(TWDSCALE-1).
+ */
+static const unsigned int wdt_timeout[] = { 0, 2, 4, 8, 16, 32, 65, 131 };
+#define DA9063_TWDSCALE_DISABLE         0
+#define DA9063_TWDSCALE_MIN             1
+#define DA9063_TWDSCALE_MAX             (ARRAY_SIZE(wdt_timeout) - 1)
+#define DA9063_WDT_MIN_TIMEOUT          wdt_timeout[DA9063_TWDSCALE_MIN]
+#define DA9063_WDT_MAX_TIMEOUT          wdt_timeout[DA9063_TWDSCALE_MAX]
+#define DA9063_WDG_TIMEOUT              wdt_timeout[3]
+
+struct da9063_watchdog {
+        struct da9063 *da9063;
+        struct watchdog_device wdtdev;
+};
+
+static unsigned int da9063_wdt_timeout_to_sel(unsigned int secs)
+{
+        unsigned int i;
+
+        for (i = DA9063_TWDSCALE_MIN; i <= DA9063_TWDSCALE_MAX; i++) {
+                if (wdt_timeout[i] >= secs)
+                        return i;
+        }
+
+        return DA9063_TWDSCALE_MAX;
+}
+
+static int _da9063_wdt_set_timeout(struct da9063 *da9063, unsigned int regval)
+{
+        return regmap_update_bits(da9063->regmap, DA9063_REG_CONTROL_D,
+                                  DA9063_TWDSCALE_MASK, regval);
+}
+
+static int da9063_wdt_start(struct watchdog_device *wdd)
+{
+        struct da9063_watchdog *wdt = watchdog_get_drvdata(wdd);
+        unsigned int selector;
+        int ret;
+
+        selector = da9063_wdt_timeout_to_sel(wdt->wdtdev.timeout);
+        ret = _da9063_wdt_set_timeout(wdt->da9063, selector);
+        if (ret)
+                dev_err(wdt->da9063->dev, "Watchdog failed to start (err = %d)\n",
+                        ret);
+
+        return ret;
+}
+
+static int da9063_wdt_stop(struct watchdog_device *wdd)
+{
+        struct da9063_watchdog *wdt = watchdog_get_drvdata(wdd);
+        int ret;
+
+        ret = regmap_update_bits(wdt->da9063->regmap, DA9063_REG_CONTROL_D,
+                                 DA9063_TWDSCALE_MASK, DA9063_TWDSCALE_DISABLE);
+        if (ret)
+                dev_alert(wdt->da9063->dev, "Watchdog failed to stop (err = %d)\n",
+                          ret);
+
+        return ret;
+}
+
+static int da9063_wdt_ping(struct watchdog_device *wdd)
+{
+        struct da9063_watchdog *wdt = watchdog_get_drvdata(wdd);
+        int ret;
+
+        ret = regmap_write(wdt->da9063->regmap, DA9063_REG_CONTROL_F,
+                           DA9063_WATCHDOG);
+        if (ret)
+                dev_alert(wdt->da9063->dev, "Failed to ping the watchdog (err = %d)\n",
+                          ret);
+
+        return ret;
+}
+
+static int da9063_wdt_set_timeout(struct watchdog_device *wdd,
+                                  unsigned int timeout)
+{
+        struct da9063_watchdog *wdt = watchdog_get_drvdata(wdd);
+        unsigned int selector;
+        int ret;
+
+        selector = da9063_wdt_timeout_to_sel(timeout);
+        ret = _da9063_wdt_set_timeout(wdt->da9063, selector);
+        if (ret)
+                dev_err(wdt->da9063->dev, "Failed to set watchdog timeout (err = %d)\n",
+                        ret);
+        else
+                wdd->timeout = wdt_timeout[selector];
+
+        return ret;
+}
+
+static const struct watchdog_info da9063_watchdog_info = {
+        .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
+        .identity = "DA9063 Watchdog",
+};
+
+static const struct watchdog_ops da9063_watchdog_ops = {
+        .owner = THIS_MODULE,
+        .start = da9063_wdt_start,
+        .stop = da9063_wdt_stop,
+        .ping = da9063_wdt_ping,
+        .set_timeout = da9063_wdt_set_timeout,
+};
+
+static int da9063_wdt_probe(struct platform_device *pdev)
+{
+        int ret;
+        struct da9063 *da9063;
+        struct da9063_watchdog *wdt;
+
+        if (!pdev->dev.parent)
+                return -EINVAL;
+
+        da9063 = dev_get_drvdata(pdev->dev.parent);
+        if (!da9063)
+                return -EINVAL;
+
+        wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
+        if (!wdt)
+                return -ENOMEM;
+
+        wdt->da9063 = da9063;
+
+        wdt->wdtdev.info = &da9063_watchdog_info;
+        wdt->wdtdev.ops = &da9063_watchdog_ops;
+        wdt->wdtdev.min_timeout = DA9063_WDT_MIN_TIMEOUT;
+        wdt->wdtdev.max_timeout = DA9063_WDT_MAX_TIMEOUT;
+        wdt->wdtdev.timeout = DA9063_WDG_TIMEOUT;
+
+        wdt->wdtdev.status = WATCHDOG_NOWAYOUT_INIT_STATUS;
+
+        watchdog_set_drvdata(&wdt->wdtdev, wdt);
+        dev_set_drvdata(&pdev->dev, wdt);
+
+        ret = watchdog_register_device(&wdt->wdtdev);
+
+        return ret;
+}
+
+static int da9063_wdt_remove(struct platform_device *pdev)
+{
+        struct da9063_watchdog *wdt = dev_get_drvdata(&pdev->dev);
+
+        watchdog_unregister_device(&wdt->wdtdev);
+
+        return 0;
+}
+
+static struct platform_driver da9063_wdt_driver = {
+        .probe = da9063_wdt_probe,
+        .remove = da9063_wdt_remove,
+        .driver = {
+                .name = DA9063_DRVNAME_WATCHDOG,
+        },
+};
+module_platform_driver(da9063_wdt_driver);
+
+MODULE_AUTHOR("Mariusz Wojtasik <mariusz.wojtasik@diasemi.com>");
+MODULE_DESCRIPTION("Watchdog driver for Dialog DA9063");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" DA9063_DRVNAME_WATCHDOG);
diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c
index 9f210299de24..9e577a64ec9e 100644
--- a/drivers/watchdog/dw_wdt.c
+++ b/drivers/watchdog/dw_wdt.c
@@ -21,6 +21,7 @@
 
 #include <linux/bitops.h>
 #include <linux/clk.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/fs.h>
@@ -29,9 +30,11 @@
 #include <linux/miscdevice.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
+#include <linux/notifier.h>
 #include <linux/of.h>
 #include <linux/pm.h>
 #include <linux/platform_device.h>
+#include <linux/reboot.h>
 #include <linux/spinlock.h>
 #include <linux/timer.h>
 #include <linux/uaccess.h>
@@ -40,6 +43,7 @@
 #define WDOG_CONTROL_REG_OFFSET             0x00
 #define WDOG_CONTROL_REG_WDT_EN_MASK        0x01
 #define WDOG_TIMEOUT_RANGE_REG_OFFSET       0x04
+#define WDOG_TIMEOUT_RANGE_TOPINIT_SHIFT    4
 #define WDOG_CURRENT_COUNT_REG_OFFSET       0x08
 #define WDOG_COUNTER_RESTART_REG_OFFSET     0x0c
 #define WDOG_COUNTER_RESTART_KICK_VALUE     0x76
@@ -62,6 +66,7 @@ static struct {
         unsigned long           next_heartbeat;
         struct timer_list       timer;
         int                     expect_close;
+        struct notifier_block   restart_handler;
 } dw_wdt;
 
 static inline int dw_wdt_is_enabled(void)
@@ -106,7 +111,8 @@ static int dw_wdt_set_top(unsigned top_s)
                 }
 
         /* Set the new value in the watchdog. */
-        writel(top_val, dw_wdt.regs + WDOG_TIMEOUT_RANGE_REG_OFFSET);
+        writel(top_val | top_val << WDOG_TIMEOUT_RANGE_TOPINIT_SHIFT,
+                dw_wdt.regs + WDOG_TIMEOUT_RANGE_REG_OFFSET);
 
         dw_wdt_set_next_heartbeat();
 
@@ -119,6 +125,26 @@ static void dw_wdt_keepalive(void)
                WDOG_COUNTER_RESTART_REG_OFFSET);
 }
 
+static int dw_wdt_restart_handle(struct notifier_block *this,
+                                unsigned long mode, void *cmd)
+{
+        u32 val;
+
+        writel(0, dw_wdt.regs + WDOG_TIMEOUT_RANGE_REG_OFFSET);
+        val = readl(dw_wdt.regs + WDOG_CONTROL_REG_OFFSET);
+        if (val & WDOG_CONTROL_REG_WDT_EN_MASK)
+                writel(WDOG_COUNTER_RESTART_KICK_VALUE, dw_wdt.regs +
+                        WDOG_COUNTER_RESTART_REG_OFFSET);
+        else
+                writel(WDOG_CONTROL_REG_WDT_EN_MASK,
+                       dw_wdt.regs + WDOG_CONTROL_REG_OFFSET);
+
+        /* wait for reset to assert... */
+        mdelay(500);
+
+        return NOTIFY_DONE;
+}
+
 static void dw_wdt_ping(unsigned long data)
 {
         if (time_before(jiffies, dw_wdt.next_heartbeat) ||
@@ -314,6 +340,12 @@ static int dw_wdt_drv_probe(struct platform_device *pdev)
         if (ret)
                 goto out_disable_clk;
 
+        dw_wdt.restart_handler.notifier_call = dw_wdt_restart_handle;
+        dw_wdt.restart_handler.priority = 128;
+        ret = register_restart_handler(&dw_wdt.restart_handler);
+        if (ret)
+                pr_warn("cannot register restart handler\n");
+
         dw_wdt_set_next_heartbeat();
         setup_timer(&dw_wdt.timer, dw_wdt_ping, 0);
         mod_timer(&dw_wdt.timer, jiffies + WDT_TIMEOUT);
@@ -328,6 +360,8 @@ out_disable_clk:
 
 static int dw_wdt_drv_remove(struct platform_device *pdev)
 {
+        unregister_restart_handler(&dw_wdt.restart_handler);
+
         misc_deregister(&dw_wdt_miscdev);
 
         clk_disable_unprepare(dw_wdt.clk);
diff --git a/drivers/watchdog/imx2_wdt.c b/drivers/watchdog/imx2_wdt.c
index 68c3d379ffa8..7e12f88bb4a6 100644
--- a/drivers/watchdog/imx2_wdt.c
+++ b/drivers/watchdog/imx2_wdt.c
@@ -22,14 +22,17 @@
  */
 
 #include <linux/clk.h>
+#include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/jiffies.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
+#include <linux/notifier.h>
 #include <linux/of_address.h>
 #include <linux/platform_device.h>
+#include <linux/reboot.h>
 #include <linux/regmap.h>
 #include <linux/timer.h>
 #include <linux/watchdog.h>
@@ -59,6 +62,7 @@ struct imx2_wdt_device {
         struct regmap *regmap;
         struct timer_list timer;        /* Pings the watchdog when closed */
         struct watchdog_device wdog;
+        struct notifier_block restart_handler;
 };
 
 static bool nowayout = WATCHDOG_NOWAYOUT;
@@ -77,6 +81,31 @@ static const struct watchdog_info imx2_wdt_info = {
         .options = WDIOF_KEEPALIVEPING | WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE,
 };
 
+static int imx2_restart_handler(struct notifier_block *this, unsigned long mode,
+                                void *cmd)
+{
+        unsigned int wcr_enable = IMX2_WDT_WCR_WDE;
+        struct imx2_wdt_device *wdev = container_of(this,
+                                                    struct imx2_wdt_device,
+                                                    restart_handler);
+        /* Assert SRS signal */
+        regmap_write(wdev->regmap, 0, wcr_enable);
+        /*
+         * Due to imx6q errata ERR004346 (WDOG: WDOG SRS bit requires to be
+         * written twice), we add another two writes to ensure there must be at
+         * least two writes happen in the same one 32kHz clock period.  We save
+         * the target check here, since the writes shouldn't be a huge burden
+         * for other platforms.
+         */
+        regmap_write(wdev->regmap, 0, wcr_enable);
+        regmap_write(wdev->regmap, 0, wcr_enable);
+
+        /* wait for reset to assert... */
+        mdelay(500);
+
+        return NOTIFY_DONE;
+}
+
 static inline void imx2_wdt_setup(struct watchdog_device *wdog)
 {
         struct imx2_wdt_device *wdev = watchdog_get_drvdata(wdog);
@@ -191,12 +220,10 @@ static struct regmap_config imx2_wdt_regmap_config = {
 
 static int __init imx2_wdt_probe(struct platform_device *pdev)
 {
-        struct device_node *np = pdev->dev.of_node;
         struct imx2_wdt_device *wdev;
         struct watchdog_device *wdog;
         struct resource *res;
         void __iomem *base;
-        bool big_endian;
         int ret;
         u32 val;
 
@@ -204,10 +231,6 @@ static int __init imx2_wdt_probe(struct platform_device *pdev)
         if (!wdev)
                 return -ENOMEM;
 
-        big_endian = of_property_read_bool(np, "big-endian");
-        if (big_endian)
-                imx2_wdt_regmap_config.val_format_endian = REGMAP_ENDIAN_BIG;
-
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(base))
@@ -257,6 +280,12 @@ static int __init imx2_wdt_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        wdev->restart_handler.notifier_call = imx2_restart_handler;
+        wdev->restart_handler.priority = 128;
+        ret = register_restart_handler(&wdev->restart_handler);
+        if (ret)
+                dev_err(&pdev->dev, "cannot register restart handler\n");
+
         dev_info(&pdev->dev, "timeout %d sec (nowayout=%d)\n",
                  wdog->timeout, nowayout);
 
@@ -268,6 +297,8 @@ static int __exit imx2_wdt_remove(struct platform_device *pdev)
         struct watchdog_device *wdog = platform_get_drvdata(pdev);
         struct imx2_wdt_device *wdev = watchdog_get_drvdata(wdog);
 
+        unregister_restart_handler(&wdev->restart_handler);
+
         watchdog_unregister_device(wdog);
 
         if (imx2_wdt_is_running(wdev)) {
diff --git a/drivers/watchdog/meson_wdt.c b/drivers/watchdog/meson_wdt.c
new file mode 100644
index 000000000000..ef6a298e8c45
--- /dev/null
+++ b/drivers/watchdog/meson_wdt.c
@@ -0,0 +1,236 @@
+/*
+ *      Meson Watchdog Driver
+ *
+ *      Copyright (c) 2014 Carlo Caione
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/notifier.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <linux/types.h>
+#include <linux/watchdog.h>
+
+#define DRV_NAME                "meson_wdt"
+
+#define MESON_WDT_TC            0x00
+#define MESON_WDT_TC_EN         BIT(22)
+#define MESON_WDT_TC_TM_MASK    0x3fffff
+#define MESON_WDT_DC_RESET      (3 << 24)
+
+#define MESON_WDT_RESET         0x04
+
+#define MESON_WDT_TIMEOUT       30
+#define MESON_WDT_MIN_TIMEOUT   1
+#define MESON_WDT_MAX_TIMEOUT   (MESON_WDT_TC_TM_MASK / 100000)
+
+#define MESON_SEC_TO_TC(s)      ((s) * 100000)
+
+static bool nowayout = WATCHDOG_NOWAYOUT;
+static unsigned int timeout = MESON_WDT_TIMEOUT;
+
+struct meson_wdt_dev {
+        struct watchdog_device wdt_dev;
+        void __iomem *wdt_base;
+        struct notifier_block restart_handler;
+};
+
+static int meson_restart_handle(struct notifier_block *this, unsigned long mode,
+                                void *cmd)
+{
+        u32 tc_reboot = MESON_WDT_DC_RESET | MESON_WDT_TC_EN;
+        struct meson_wdt_dev *meson_wdt = container_of(this,
+                                                       struct meson_wdt_dev,
+                                                       restart_handler);
+
+        while (1) {
+                writel(tc_reboot, meson_wdt->wdt_base + MESON_WDT_TC);
+                mdelay(5);
+        }
+
+        return NOTIFY_DONE;
+}
+
+static int meson_wdt_ping(struct watchdog_device *wdt_dev)
+{
+        struct meson_wdt_dev *meson_wdt = watchdog_get_drvdata(wdt_dev);
+
+        writel(0, meson_wdt->wdt_base + MESON_WDT_RESET);
+
+        return 0;
+}
+
+static void meson_wdt_change_timeout(struct watchdog_device *wdt_dev,
+                                     unsigned int timeout)
+{
+        struct meson_wdt_dev *meson_wdt = watchdog_get_drvdata(wdt_dev);
+        u32 reg;
+
+        reg = readl(meson_wdt->wdt_base + MESON_WDT_TC);
+        reg &= ~MESON_WDT_TC_TM_MASK;
+        reg |= MESON_SEC_TO_TC(timeout);
+        writel(reg, meson_wdt->wdt_base + MESON_WDT_TC);
+}
+
+static int meson_wdt_set_timeout(struct watchdog_device *wdt_dev,
+                                 unsigned int timeout)
+{
+        wdt_dev->timeout = timeout;
+
+        meson_wdt_change_timeout(wdt_dev, timeout);
+        meson_wdt_ping(wdt_dev);
+
+        return 0;
+}
+
+static int meson_wdt_stop(struct watchdog_device *wdt_dev)
+{
+        struct meson_wdt_dev *meson_wdt = watchdog_get_drvdata(wdt_dev);
+        u32 reg;
+
+        reg = readl(meson_wdt->wdt_base + MESON_WDT_TC);
+        reg &= ~MESON_WDT_TC_EN;
+        writel(reg, meson_wdt->wdt_base + MESON_WDT_TC);
+
+        return 0;
+}
+
+static int meson_wdt_start(struct watchdog_device *wdt_dev)
+{
+        struct meson_wdt_dev *meson_wdt = watchdog_get_drvdata(wdt_dev);
+        u32 reg;
+
+        meson_wdt_change_timeout(wdt_dev, meson_wdt->wdt_dev.timeout);
+        meson_wdt_ping(wdt_dev);
+
+        reg = readl(meson_wdt->wdt_base + MESON_WDT_TC);
+        reg |= MESON_WDT_TC_EN;
+        writel(reg, meson_wdt->wdt_base + MESON_WDT_TC);
+
+        return 0;
+}
+
+static const struct watchdog_info meson_wdt_info = {
+        .identity       = DRV_NAME,
+        .options        = WDIOF_SETTIMEOUT |
+                          WDIOF_KEEPALIVEPING |
+                          WDIOF_MAGICCLOSE,
+};
+
+static const struct watchdog_ops meson_wdt_ops = {
+        .owner          = THIS_MODULE,
+        .start          = meson_wdt_start,
+        .stop           = meson_wdt_stop,
+        .ping           = meson_wdt_ping,
+        .set_timeout    = meson_wdt_set_timeout,
+};
+
+static int meson_wdt_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        struct meson_wdt_dev *meson_wdt;
+        int err;
+
+        meson_wdt = devm_kzalloc(&pdev->dev, sizeof(*meson_wdt), GFP_KERNEL);
+        if (!meson_wdt)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        meson_wdt->wdt_base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(meson_wdt->wdt_base))
+                return PTR_ERR(meson_wdt->wdt_base);
+
+        meson_wdt->wdt_dev.parent = &pdev->dev;
+        meson_wdt->wdt_dev.info = &meson_wdt_info;
+        meson_wdt->wdt_dev.ops = &meson_wdt_ops;
+        meson_wdt->wdt_dev.timeout = MESON_WDT_TIMEOUT;
+        meson_wdt->wdt_dev.max_timeout = MESON_WDT_MAX_TIMEOUT;
+        meson_wdt->wdt_dev.min_timeout = MESON_WDT_MIN_TIMEOUT;
+
+        watchdog_set_drvdata(&meson_wdt->wdt_dev, meson_wdt);
+
+        watchdog_init_timeout(&meson_wdt->wdt_dev, timeout, &pdev->dev);
+        watchdog_set_nowayout(&meson_wdt->wdt_dev, nowayout);
+
+        meson_wdt_stop(&meson_wdt->wdt_dev);
+
+        err = watchdog_register_device(&meson_wdt->wdt_dev);
+        if (err)
+                return err;
+
+        platform_set_drvdata(pdev, meson_wdt);
+
+        meson_wdt->restart_handler.notifier_call = meson_restart_handle;
+        meson_wdt->restart_handler.priority = 128;
+        err = register_restart_handler(&meson_wdt->restart_handler);
+        if (err)
+                dev_err(&pdev->dev,
+                        "cannot register restart handler (err=%d)\n", err);
+
+        dev_info(&pdev->dev, "Watchdog enabled (timeout=%d sec, nowayout=%d)",
+                 meson_wdt->wdt_dev.timeout, nowayout);
+
+        return 0;
+}
+
+static int meson_wdt_remove(struct platform_device *pdev)
+{
+        struct meson_wdt_dev *meson_wdt = platform_get_drvdata(pdev);
+
+        unregister_restart_handler(&meson_wdt->restart_handler);
+
+        watchdog_unregister_device(&meson_wdt->wdt_dev);
+
+        return 0;
+}
+
+static void meson_wdt_shutdown(struct platform_device *pdev)
+{
+        struct meson_wdt_dev *meson_wdt = platform_get_drvdata(pdev);
+
+        meson_wdt_stop(&meson_wdt->wdt_dev);
+}
+
+static const struct of_device_id meson_wdt_dt_ids[] = {
+        { .compatible = "amlogic,meson6-wdt" },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, meson_wdt_dt_ids);
+
+static struct platform_driver meson_wdt_driver = {
+        .probe          = meson_wdt_probe,
+        .remove         = meson_wdt_remove,
+        .shutdown       = meson_wdt_shutdown,
+        .driver         = {
+                .owner          = THIS_MODULE,
+                .name           = DRV_NAME,
+                .of_match_table = meson_wdt_dt_ids,
+        },
+};
+
+module_platform_driver(meson_wdt_driver);
+
+module_param(timeout, uint, 0);
+MODULE_PARM_DESC(timeout, "Watchdog heartbeat in seconds");
+
+module_param(nowayout, bool, 0);
+MODULE_PARM_DESC(nowayout,
+                 "Watchdog cannot be stopped once started (default="
+                 __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Carlo Caione <carlo@caione.org>");
+MODULE_DESCRIPTION("Meson Watchdog Timer Driver");
diff --git a/drivers/watchdog/of_xilinx_wdt.c b/drivers/watchdog/of_xilinx_wdt.c
index 1e6e28df5d7b..b2e1b4cbbdc1 100644
--- a/drivers/watchdog/of_xilinx_wdt.c
+++ b/drivers/watchdog/of_xilinx_wdt.c
@@ -236,7 +236,6 @@ static struct platform_driver xwdt_driver = {
         .probe       = xwdt_probe,
         .remove      = xwdt_remove,
         .driver = {
-                .owner = THIS_MODULE,
                 .name  = WATCHDOG_NAME,
                 .of_match_table = xwdt_of_match,
         },
diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
new file mode 100644
index 000000000000..aa85618c4d03
--- /dev/null
+++ b/drivers/watchdog/qcom-wdt.c
@@ -0,0 +1,224 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <linux/watchdog.h>
+
+#define WDT_RST         0x0
+#define WDT_EN          0x8
+#define WDT_BITE_TIME   0x24
+
+struct qcom_wdt {
+        struct watchdog_device  wdd;
+        struct clk              *clk;
+        unsigned long           rate;
+        struct notifier_block   restart_nb;
+        void __iomem            *base;
+};
+
+static inline
+struct qcom_wdt *to_qcom_wdt(struct watchdog_device *wdd)
+{
+        return container_of(wdd, struct qcom_wdt, wdd);
+}
+
+static int qcom_wdt_start(struct watchdog_device *wdd)
+{
+        struct qcom_wdt *wdt = to_qcom_wdt(wdd);
+
+        writel(0, wdt->base + WDT_EN);
+        writel(1, wdt->base + WDT_RST);
+        writel(wdd->timeout * wdt->rate, wdt->base + WDT_BITE_TIME);
+        writel(1, wdt->base + WDT_EN);
+        return 0;
+}
+
+static int qcom_wdt_stop(struct watchdog_device *wdd)
+{
+        struct qcom_wdt *wdt = to_qcom_wdt(wdd);
+
+        writel(0, wdt->base + WDT_EN);
+        return 0;
+}
+
+static int qcom_wdt_ping(struct watchdog_device *wdd)
+{
+        struct qcom_wdt *wdt = to_qcom_wdt(wdd);
+
+        writel(1, wdt->base + WDT_RST);
+        return 0;
+}
+
+static int qcom_wdt_set_timeout(struct watchdog_device *wdd,
+                                unsigned int timeout)
+{
+        wdd->timeout = timeout;
+        return qcom_wdt_start(wdd);
+}
+
+static const struct watchdog_ops qcom_wdt_ops = {
+        .start          = qcom_wdt_start,
+        .stop           = qcom_wdt_stop,
+        .ping           = qcom_wdt_ping,
+        .set_timeout    = qcom_wdt_set_timeout,
+        .owner          = THIS_MODULE,
+};
+
+static const struct watchdog_info qcom_wdt_info = {
+        .options        = WDIOF_KEEPALIVEPING
+                        | WDIOF_MAGICCLOSE
+                        | WDIOF_SETTIMEOUT,
+        .identity       = KBUILD_MODNAME,
+};
+
+static int qcom_wdt_restart(struct notifier_block *nb, unsigned long action,
+                            void *data)
+{
+        struct qcom_wdt *wdt = container_of(nb, struct qcom_wdt, restart_nb);
+        u32 timeout;
+
+        /*
+         * Trigger watchdog bite:
+         *    Setup BITE_TIME to be 128ms, and enable WDT.
+         */
+        timeout = 128 * wdt->rate / 1000;
+
+        writel(0, wdt->base + WDT_EN);
+        writel(1, wdt->base + WDT_RST);
+        writel(timeout, wdt->base + WDT_BITE_TIME);
+        writel(1, wdt->base + WDT_EN);
+
+        /*
+         * Actually make sure the above sequence hits hardware before sleeping.
+         */
+        wmb();
+
+        msleep(150);
+        return NOTIFY_DONE;
+}
+
+static int qcom_wdt_probe(struct platform_device *pdev)
+{
+        struct qcom_wdt *wdt;
+        struct resource *res;
+        int ret;
+
+        wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
+        if (!wdt)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        wdt->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(wdt->base))
+                return PTR_ERR(wdt->base);
+
+        wdt->clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(wdt->clk)) {
+                dev_err(&pdev->dev, "failed to get input clock\n");
+                return PTR_ERR(wdt->clk);
+        }
+
+        ret = clk_prepare_enable(wdt->clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to setup clock\n");
+                return ret;
+        }
+
+        /*
+         * We use the clock rate to calculate the max timeout, so ensure it's
+         * not zero to avoid a divide-by-zero exception.
+         *
+         * WATCHDOG_CORE assumes units of seconds, if the WDT is clocked such
+         * that it would bite before a second elapses it's usefulness is
+         * limited.  Bail if this is the case.
+         */
+        wdt->rate = clk_get_rate(wdt->clk);
+        if (wdt->rate == 0 ||
+            wdt->rate > 0x10000000U) {
+                dev_err(&pdev->dev, "invalid clock rate\n");
+                ret = -EINVAL;
+                goto err_clk_unprepare;
+        }
+
+        wdt->wdd.dev = &pdev->dev;
+        wdt->wdd.info = &qcom_wdt_info;
+        wdt->wdd.ops = &qcom_wdt_ops;
+        wdt->wdd.min_timeout = 1;
+        wdt->wdd.max_timeout = 0x10000000U / wdt->rate;
+
+        /*
+         * If 'timeout-sec' unspecified in devicetree, assume a 30 second
+         * default, unless the max timeout is less than 30 seconds, then use
+         * the max instead.
+         */
+        wdt->wdd.timeout = min(wdt->wdd.max_timeout, 30U);
+        watchdog_init_timeout(&wdt->wdd, 0, &pdev->dev);
+
+        ret = watchdog_register_device(&wdt->wdd);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to register watchdog\n");
+                goto err_clk_unprepare;
+        }
+
+        /*
+         * WDT restart notifier has priority 0 (use as a last resort)
+         */
+        wdt->restart_nb.notifier_call = qcom_wdt_restart;
+        ret = register_restart_handler(&wdt->restart_nb);
+        if (ret)
+                dev_err(&pdev->dev, "failed to setup restart handler\n");
+
+        platform_set_drvdata(pdev, wdt);
+        return 0;
+
+err_clk_unprepare:
+        clk_disable_unprepare(wdt->clk);
+        return ret;
+}
+
+static int qcom_wdt_remove(struct platform_device *pdev)
+{
+        struct qcom_wdt *wdt = platform_get_drvdata(pdev);
+
+        unregister_restart_handler(&wdt->restart_nb);
+        watchdog_unregister_device(&wdt->wdd);
+        clk_disable_unprepare(wdt->clk);
+        return 0;
+}
+
+static const struct of_device_id qcom_wdt_of_table[] = {
+        { .compatible = "qcom,kpss-wdt-msm8960", },
+        { .compatible = "qcom,kpss-wdt-apq8064", },
+        { .compatible = "qcom,kpss-wdt-ipq8064", },
+        { },
+};
+MODULE_DEVICE_TABLE(of, qcom_wdt_of_table);
+
+static struct platform_driver qcom_watchdog_driver = {
+        .probe  = qcom_wdt_probe,
+        .remove = qcom_wdt_remove,
+        .driver = {
+                .name           = KBUILD_MODNAME,
+                .of_match_table = qcom_wdt_of_table,
+        },
+};
+module_platform_driver(qcom_watchdog_driver);
+
+MODULE_DESCRIPTION("QCOM KPSS Watchdog Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/watchdog/rn5t618_wdt.c b/drivers/watchdog/rn5t618_wdt.c
new file mode 100644
index 000000000000..d1c12278cb6a
--- /dev/null
+++ b/drivers/watchdog/rn5t618_wdt.c
@@ -0,0 +1,198 @@
+/*
+ * Watchdog driver for Ricoh RN5T618 PMIC
+ *
+ * Copyright (C) 2014 Beniamino Galvani <b.galvani@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/device.h>
+#include <linux/mfd/rn5t618.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/watchdog.h>
+
+#define DRIVER_NAME "rn5t618-wdt"
+
+static bool nowayout = WATCHDOG_NOWAYOUT;
+static unsigned int timeout;
+
+module_param(timeout, uint, 0);
+MODULE_PARM_DESC(timeout, "Initial watchdog timeout in seconds");
+
+module_param(nowayout, bool, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
+                 __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+struct rn5t618_wdt {
+        struct watchdog_device wdt_dev;
+        struct rn5t618 *rn5t618;
+};
+
+/*
+ * This array encodes the values of WDOGTIM field for the supported
+ * watchdog expiration times. If the watchdog is not accessed before
+ * the timer expiration, the PMU generates an interrupt and if the CPU
+ * doesn't clear it within one second the system is restarted.
+ */
+static const struct {
+        u8 reg_val;
+        unsigned int time;
+} rn5t618_wdt_map[] = {
+        { 0, 1 },
+        { 1, 8 },
+        { 2, 32 },
+        { 3, 128 },
+};
+
+static int rn5t618_wdt_set_timeout(struct watchdog_device *wdt_dev,
+                                   unsigned int t)
+{
+        struct rn5t618_wdt *wdt = watchdog_get_drvdata(wdt_dev);
+        int ret, i;
+
+        for (i = 0; i < ARRAY_SIZE(rn5t618_wdt_map); i++) {
+                if (rn5t618_wdt_map[i].time + 1 >= t)
+                        break;
+        }
+
+        if (i == ARRAY_SIZE(rn5t618_wdt_map))
+                return -EINVAL;
+
+        ret = regmap_update_bits(wdt->rn5t618->regmap, RN5T618_WATCHDOG,
+                                 RN5T618_WATCHDOG_WDOGTIM_M,
+                                 rn5t618_wdt_map[i].reg_val);
+        if (!ret)
+                wdt_dev->timeout = rn5t618_wdt_map[i].time;
+
+        return ret;
+}
+
+static int rn5t618_wdt_start(struct watchdog_device *wdt_dev)
+{
+        struct rn5t618_wdt *wdt = watchdog_get_drvdata(wdt_dev);
+        int ret;
+
+        ret = rn5t618_wdt_set_timeout(wdt_dev, wdt_dev->timeout);
+        if (ret)
+                return ret;
+
+        /* enable repower-on */
+        ret = regmap_update_bits(wdt->rn5t618->regmap, RN5T618_REPCNT,
+                                 RN5T618_REPCNT_REPWRON,
+                                 RN5T618_REPCNT_REPWRON);
+        if (ret)
+                return ret;
+
+        /* enable watchdog */
+        ret = regmap_update_bits(wdt->rn5t618->regmap, RN5T618_WATCHDOG,
+                                 RN5T618_WATCHDOG_WDOGEN,
+                                 RN5T618_WATCHDOG_WDOGEN);
+        if (ret)
+                return ret;
+
+        /* enable watchdog interrupt */
+        return regmap_update_bits(wdt->rn5t618->regmap, RN5T618_PWRIREN,
+                                  RN5T618_PWRIRQ_IR_WDOG,
+                                  RN5T618_PWRIRQ_IR_WDOG);
+}
+
+static int rn5t618_wdt_stop(struct watchdog_device *wdt_dev)
+{
+        struct rn5t618_wdt *wdt = watchdog_get_drvdata(wdt_dev);
+
+        return regmap_update_bits(wdt->rn5t618->regmap, RN5T618_WATCHDOG,
+                                  RN5T618_WATCHDOG_WDOGEN, 0);
+}
+
+static int rn5t618_wdt_ping(struct watchdog_device *wdt_dev)
+{
+        struct rn5t618_wdt *wdt = watchdog_get_drvdata(wdt_dev);
+        unsigned int val;
+        int ret;
+
+        /* The counter is restarted after a R/W access to watchdog register */
+        ret = regmap_read(wdt->rn5t618->regmap, RN5T618_WATCHDOG, &val);
+        if (ret)
+                return ret;
+
+        ret = regmap_write(wdt->rn5t618->regmap, RN5T618_WATCHDOG, val);
+        if (ret)
+                return ret;
+
+        /* Clear pending watchdog interrupt */
+        return regmap_update_bits(wdt->rn5t618->regmap, RN5T618_PWRIRQ,
+                                  RN5T618_PWRIRQ_IR_WDOG, 0);
+}
+
+static struct watchdog_info rn5t618_wdt_info = {
+        .options        = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE |
+                          WDIOF_KEEPALIVEPING,
+        .identity       = DRIVER_NAME,
+};
+
+static struct watchdog_ops rn5t618_wdt_ops = {
+        .owner          = THIS_MODULE,
+        .start          = rn5t618_wdt_start,
+        .stop           = rn5t618_wdt_stop,
+        .ping           = rn5t618_wdt_ping,
+        .set_timeout    = rn5t618_wdt_set_timeout,
+};
+
+static int rn5t618_wdt_probe(struct platform_device *pdev)
+{
+        struct rn5t618 *rn5t618 = dev_get_drvdata(pdev->dev.parent);
+        struct rn5t618_wdt *wdt;
+        int min_timeout, max_timeout;
+
+        wdt = devm_kzalloc(&pdev->dev, sizeof(struct rn5t618_wdt), GFP_KERNEL);
+        if (!wdt)
+                return -ENOMEM;
+
+        min_timeout = rn5t618_wdt_map[0].time;
+        max_timeout = rn5t618_wdt_map[ARRAY_SIZE(rn5t618_wdt_map) - 1].time;
+
+        wdt->rn5t618 = rn5t618;
+        wdt->wdt_dev.info = &rn5t618_wdt_info;
+        wdt->wdt_dev.ops = &rn5t618_wdt_ops;
+        wdt->wdt_dev.min_timeout = min_timeout;
+        wdt->wdt_dev.max_timeout = max_timeout;
+        wdt->wdt_dev.timeout = max_timeout;
+        wdt->wdt_dev.parent = &pdev->dev;
+
+        watchdog_set_drvdata(&wdt->wdt_dev, wdt);
+        watchdog_init_timeout(&wdt->wdt_dev, timeout, &pdev->dev);
+        watchdog_set_nowayout(&wdt->wdt_dev, nowayout);
+
+        platform_set_drvdata(pdev, wdt);
+
+        return watchdog_register_device(&wdt->wdt_dev);
+}
+
+static int rn5t618_wdt_remove(struct platform_device *pdev)
+{
+        struct rn5t618_wdt *wdt = platform_get_drvdata(pdev);
+
+        watchdog_unregister_device(&wdt->wdt_dev);
+
+        return 0;
+}
+
+static struct platform_driver rn5t618_wdt_driver = {
+        .probe = rn5t618_wdt_probe,
+        .remove = rn5t618_wdt_remove,
+        .driver = {
+                .name   = DRIVER_NAME,
+        },
+};
+
+module_platform_driver(rn5t618_wdt_driver);
+
+MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");
+MODULE_DESCRIPTION("RN5T618 watchdog driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 7c6ccd071baf..1626dc66e763 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -41,6 +41,8 @@
 #include <linux/of.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
+#include <linux/reboot.h>
+#include <linux/delay.h>
 
 #define S3C2410_WTCON           0x00
 #define S3C2410_WTDAT           0x04
@@ -128,6 +130,7 @@ struct s3c2410_wdt {
         unsigned long           wtdat_save;
         struct watchdog_device  wdt_device;
         struct notifier_block   freq_transition;
+        struct notifier_block   restart_handler;
         struct s3c2410_wdt_variant *drv_data;
         struct regmap *pmureg;
 };
@@ -155,6 +158,15 @@ static const struct s3c2410_wdt_variant drv_data_exynos5420 = {
         .quirks = QUIRK_HAS_PMU_CONFIG | QUIRK_HAS_RST_STAT,
 };
 
+static const struct s3c2410_wdt_variant drv_data_exynos7 = {
+        .disable_reg = EXYNOS5_WDT_DISABLE_REG_OFFSET,
+        .mask_reset_reg = EXYNOS5_WDT_MASK_RESET_REG_OFFSET,
+        .mask_bit = 23,
+        .rst_stat_reg = EXYNOS5_RST_STAT_REG_OFFSET,
+        .rst_stat_bit = 23,     /* A57 WDTRESET */
+        .quirks = QUIRK_HAS_PMU_CONFIG | QUIRK_HAS_RST_STAT,
+};
+
 static const struct of_device_id s3c2410_wdt_match[] = {
         { .compatible = "samsung,s3c2410-wdt",
           .data = &drv_data_s3c2410 },
@@ -162,6 +174,8 @@ static const struct of_device_id s3c2410_wdt_match[] = {
           .data = &drv_data_exynos5250 },
         { .compatible = "samsung,exynos5420-wdt",
           .data = &drv_data_exynos5420 },
+        { .compatible = "samsung,exynos7-wdt",
+          .data = &drv_data_exynos7 },
         {},
 };
 MODULE_DEVICE_TABLE(of, s3c2410_wdt_match);
@@ -438,6 +452,31 @@ static inline void s3c2410wdt_cpufreq_deregister(struct s3c2410_wdt *wdt)
 }
 #endif
 
+static int s3c2410wdt_restart(struct notifier_block *this,
+                              unsigned long mode, void *cmd)
+{
+        struct s3c2410_wdt *wdt = container_of(this, struct s3c2410_wdt,
+                                               restart_handler);
+        void __iomem *wdt_base = wdt->reg_base;
+
+        /* disable watchdog, to be safe  */
+        writel(0, wdt_base + S3C2410_WTCON);
+
+        /* put initial values into count and data */
+        writel(0x80, wdt_base + S3C2410_WTCNT);
+        writel(0x80, wdt_base + S3C2410_WTDAT);
+
+        /* set the watchdog to go and reset... */
+        writel(S3C2410_WTCON_ENABLE | S3C2410_WTCON_DIV16 |
+                S3C2410_WTCON_RSTEN | S3C2410_WTCON_PRESCALE(0x20),
+                wdt_base + S3C2410_WTCON);
+
+        /* wait for reset to assert... */
+        mdelay(500);
+
+        return NOTIFY_DONE;
+}
+
 static inline unsigned int s3c2410wdt_get_bootstatus(struct s3c2410_wdt *wdt)
 {
         unsigned int rst_stat;
@@ -592,6 +631,12 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, wdt);
 
+        wdt->restart_handler.notifier_call = s3c2410wdt_restart;
+        wdt->restart_handler.priority = 128;
+        ret = register_restart_handler(&wdt->restart_handler);
+        if (ret)
+                pr_err("cannot register restart handler, %d\n", ret);
+
         /* print out a statement of readiness */
 
         wtcon = readl(wdt->reg_base + S3C2410_WTCON);
@@ -621,6 +666,8 @@ static int s3c2410wdt_remove(struct platform_device *dev)
         int ret;
         struct s3c2410_wdt *wdt = platform_get_drvdata(dev);
 
+        unregister_restart_handler(&wdt->restart_handler);
+
         ret = s3c2410wdt_mask_and_disable_reset(wdt, true);
         if (ret < 0)
                 return ret;
diff --git a/drivers/watchdog/stmp3xxx_rtc_wdt.c b/drivers/watchdog/stmp3xxx_rtc_wdt.c
index 3804d5e9baea..a62b1b6decf4 100644
--- a/drivers/watchdog/stmp3xxx_rtc_wdt.c
+++ b/drivers/watchdog/stmp3xxx_rtc_wdt.c
@@ -94,9 +94,33 @@ static int stmp3xxx_wdt_remove(struct platform_device *pdev)
         return 0;
 }
 
+static int __maybe_unused stmp3xxx_wdt_suspend(struct device *dev)
+{
+        struct watchdog_device *wdd = &stmp3xxx_wdd;
+
+        if (watchdog_active(wdd))
+                return wdt_stop(wdd);
+
+        return 0;
+}
+
+static int __maybe_unused stmp3xxx_wdt_resume(struct device *dev)
+{
+        struct watchdog_device *wdd = &stmp3xxx_wdd;
+
+        if (watchdog_active(wdd))
+                return wdt_start(wdd);
+
+        return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(stmp3xxx_wdt_pm_ops,
+                         stmp3xxx_wdt_suspend, stmp3xxx_wdt_resume);
+
 static struct platform_driver stmp3xxx_wdt_driver = {
         .driver = {
                 .name = "stmp3xxx_rtc_wdt",
+                .pm = &stmp3xxx_wdt_pm_ops,
         },
         .probe = stmp3xxx_wdt_probe,
         .remove = stmp3xxx_wdt_remove,
diff --git a/drivers/watchdog/sunxi_wdt.c b/drivers/watchdog/sunxi_wdt.c
index 480bb557f353..b62301e74e5f 100644
--- a/drivers/watchdog/sunxi_wdt.c
+++ b/drivers/watchdog/sunxi_wdt.c
@@ -23,6 +23,7 @@
 #include <linux/moduleparam.h>
 #include <linux/notifier.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/reboot.h>
 #include <linux/types.h>
@@ -30,15 +31,11 @@
 
 #define WDT_MAX_TIMEOUT         16
 #define WDT_MIN_TIMEOUT         1
-#define WDT_MODE_TIMEOUT(n)     ((n) << 3)
-#define WDT_TIMEOUT_MASK        WDT_MODE_TIMEOUT(0x0F)
+#define WDT_TIMEOUT_MASK        0x0F
 
-#define WDT_CTRL                0x00
 #define WDT_CTRL_RELOAD         ((1 << 0) | (0x0a57 << 1))
 
-#define WDT_MODE                0x04
 #define WDT_MODE_EN             (1 << 0)
-#define WDT_MODE_RST_EN         (1 << 1)
 
 #define DRV_NAME                "sunxi-wdt"
 #define DRV_VERSION             "1.0"
@@ -46,15 +43,29 @@
 static bool nowayout = WATCHDOG_NOWAYOUT;
 static unsigned int timeout = WDT_MAX_TIMEOUT;
 
+/*
+ * This structure stores the register offsets for different variants
+ * of Allwinner's watchdog hardware.
+ */
+struct sunxi_wdt_reg {
+        u8 wdt_ctrl;
+        u8 wdt_cfg;
+        u8 wdt_mode;
+        u8 wdt_timeout_shift;
+        u8 wdt_reset_mask;
+        u8 wdt_reset_val;
+};
+
 struct sunxi_wdt_dev {
         struct watchdog_device wdt_dev;
         void __iomem *wdt_base;
+        const struct sunxi_wdt_reg *wdt_regs;
         struct notifier_block restart_handler;
 };
 
 /*
  * wdt_timeout_map maps the watchdog timer interval value in seconds to
- * the value of the register WDT_MODE bit 3:6
+ * the value of the register WDT_MODE at bits .wdt_timeout_shift ~ +3
  *
  * [timeout seconds] = register value
  *
@@ -82,19 +93,32 @@ static int sunxi_restart_handle(struct notifier_block *this, unsigned long mode,
                                                        struct sunxi_wdt_dev,
                                                        restart_handler);
         void __iomem *wdt_base = sunxi_wdt->wdt_base;
+        const struct sunxi_wdt_reg *regs = sunxi_wdt->wdt_regs;
+        u32 val;
+
+        /* Set system reset function */
+        val = readl(wdt_base + regs->wdt_cfg);
+        val &= ~(regs->wdt_reset_mask);
+        val |= regs->wdt_reset_val;
+        writel(val, wdt_base + regs->wdt_cfg);
 
-        /* Enable timer and set reset bit in the watchdog */
-        writel(WDT_MODE_EN | WDT_MODE_RST_EN, wdt_base + WDT_MODE);
+        /* Set lowest timeout and enable watchdog */
+        val = readl(wdt_base + regs->wdt_mode);
+        val &= ~(WDT_TIMEOUT_MASK << regs->wdt_timeout_shift);
+        val |= WDT_MODE_EN;
+        writel(val, wdt_base + regs->wdt_mode);
 
         /*
          * Restart the watchdog. The default (and lowest) interval
          * value for the watchdog is 0.5s.
          */
-        writel(WDT_CTRL_RELOAD, wdt_base + WDT_CTRL);
+        writel(WDT_CTRL_RELOAD, wdt_base + regs->wdt_ctrl);
 
         while (1) {
                 mdelay(5);
-                writel(WDT_MODE_EN | WDT_MODE_RST_EN, wdt_base + WDT_MODE);
+                val = readl(wdt_base + regs->wdt_mode);
+                val |= WDT_MODE_EN;
+                writel(val, wdt_base + regs->wdt_mode);
         }
         return NOTIFY_DONE;
 }
@@ -103,8 +127,9 @@ static int sunxi_wdt_ping(struct watchdog_device *wdt_dev)
 {
         struct sunxi_wdt_dev *sunxi_wdt = watchdog_get_drvdata(wdt_dev);
         void __iomem *wdt_base = sunxi_wdt->wdt_base;
+        const struct sunxi_wdt_reg *regs = sunxi_wdt->wdt_regs;
 
-        iowrite32(WDT_CTRL_RELOAD, wdt_base + WDT_CTRL);
+        writel(WDT_CTRL_RELOAD, wdt_base + regs->wdt_ctrl);
 
         return 0;
 }
@@ -114,6 +139,7 @@ static int sunxi_wdt_set_timeout(struct watchdog_device *wdt_dev,
 {
         struct sunxi_wdt_dev *sunxi_wdt = watchdog_get_drvdata(wdt_dev);
         void __iomem *wdt_base = sunxi_wdt->wdt_base;
+        const struct sunxi_wdt_reg *regs = sunxi_wdt->wdt_regs;
         u32 reg;
 
         if (wdt_timeout_map[timeout] == 0)
@@ -121,10 +147,10 @@ static int sunxi_wdt_set_timeout(struct watchdog_device *wdt_dev,
 
         sunxi_wdt->wdt_dev.timeout = timeout;
 
-        reg = ioread32(wdt_base + WDT_MODE);
-        reg &= ~WDT_TIMEOUT_MASK;
-        reg |= WDT_MODE_TIMEOUT(wdt_timeout_map[timeout]);
-        iowrite32(reg, wdt_base + WDT_MODE);
+        reg = readl(wdt_base + regs->wdt_mode);
+        reg &= ~(WDT_TIMEOUT_MASK << regs->wdt_timeout_shift);
+        reg |= wdt_timeout_map[timeout] << regs->wdt_timeout_shift;
+        writel(reg, wdt_base + regs->wdt_mode);
 
         sunxi_wdt_ping(wdt_dev);
 
@@ -135,8 +161,9 @@ static int sunxi_wdt_stop(struct watchdog_device *wdt_dev)
 {
         struct sunxi_wdt_dev *sunxi_wdt = watchdog_get_drvdata(wdt_dev);
         void __iomem *wdt_base = sunxi_wdt->wdt_base;
+        const struct sunxi_wdt_reg *regs = sunxi_wdt->wdt_regs;
 
-        iowrite32(0, wdt_base + WDT_MODE);
+        writel(0, wdt_base + regs->wdt_mode);
 
         return 0;
 }
@@ -146,6 +173,7 @@ static int sunxi_wdt_start(struct watchdog_device *wdt_dev)
         u32 reg;
         struct sunxi_wdt_dev *sunxi_wdt = watchdog_get_drvdata(wdt_dev);
         void __iomem *wdt_base = sunxi_wdt->wdt_base;
+        const struct sunxi_wdt_reg *regs = sunxi_wdt->wdt_regs;
         int ret;
 
         ret = sunxi_wdt_set_timeout(&sunxi_wdt->wdt_dev,
@@ -153,9 +181,16 @@ static int sunxi_wdt_start(struct watchdog_device *wdt_dev)
         if (ret < 0)
                 return ret;
 
-        reg = ioread32(wdt_base + WDT_MODE);
-        reg |= (WDT_MODE_RST_EN | WDT_MODE_EN);
-        iowrite32(reg, wdt_base + WDT_MODE);
+        /* Set system reset function */
+        reg = readl(wdt_base + regs->wdt_cfg);
+        reg &= ~(regs->wdt_reset_mask);
+        reg |= ~(regs->wdt_reset_val);
+        writel(reg, wdt_base + regs->wdt_cfg);
+
+        /* Enable watchdog */
+        reg = readl(wdt_base + regs->wdt_mode);
+        reg |= WDT_MODE_EN;
+        writel(reg, wdt_base + regs->wdt_mode);
 
         return 0;
 }
@@ -175,9 +210,35 @@ static const struct watchdog_ops sunxi_wdt_ops = {
         .set_timeout    = sunxi_wdt_set_timeout,
 };
 
+static const struct sunxi_wdt_reg sun4i_wdt_reg = {
+        .wdt_ctrl = 0x00,
+        .wdt_cfg = 0x04,
+        .wdt_mode = 0x04,
+        .wdt_timeout_shift = 3,
+        .wdt_reset_mask = 0x02,
+        .wdt_reset_val = 0x02,
+};
+
+static const struct sunxi_wdt_reg sun6i_wdt_reg = {
+        .wdt_ctrl = 0x10,
+        .wdt_cfg = 0x14,
+        .wdt_mode = 0x18,
+        .wdt_timeout_shift = 4,
+        .wdt_reset_mask = 0x03,
+        .wdt_reset_val = 0x01,
+};
+
+static const struct of_device_id sunxi_wdt_dt_ids[] = {
+        { .compatible = "allwinner,sun4i-a10-wdt", .data = &sun4i_wdt_reg },
+        { .compatible = "allwinner,sun6i-a31-wdt", .data = &sun6i_wdt_reg },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, sunxi_wdt_dt_ids);
+
 static int sunxi_wdt_probe(struct platform_device *pdev)
 {
         struct sunxi_wdt_dev *sunxi_wdt;
+        const struct of_device_id *device;
         struct resource *res;
         int err;
 
@@ -187,6 +248,12 @@ static int sunxi_wdt_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, sunxi_wdt);
 
+        device = of_match_device(sunxi_wdt_dt_ids, &pdev->dev);
+        if (!device)
+                return -ENODEV;
+
+        sunxi_wdt->wdt_regs = device->data;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         sunxi_wdt->wdt_base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(sunxi_wdt->wdt_base))
@@ -242,12 +309,6 @@ static void sunxi_wdt_shutdown(struct platform_device *pdev)
         sunxi_wdt_stop(&sunxi_wdt->wdt_dev);
 }
 
-static const struct of_device_id sunxi_wdt_dt_ids[] = {
-        { .compatible = "allwinner,sun4i-a10-wdt" },
-        { /* sentinel */ }
-};
-MODULE_DEVICE_TABLE(of, sunxi_wdt_dt_ids);
-
 static struct platform_driver sunxi_wdt_driver = {
         .probe          = sunxi_wdt_probe,
         .remove         = sunxi_wdt_remove,
diff --git a/drivers/watchdog/ts72xx_wdt.c b/drivers/watchdog/ts72xx_wdt.c
index afa9d6ef353a..dee9c6cbe6df 100644
--- a/drivers/watchdog/ts72xx_wdt.c
+++ b/drivers/watchdog/ts72xx_wdt.c
@@ -428,11 +428,7 @@ static int ts72xx_wdt_probe(struct platform_device *pdev)
 
 static int ts72xx_wdt_remove(struct platform_device *pdev)
 {
-        int error;
-
-        error = misc_deregister(&ts72xx_wdt_miscdev);
-
-        return error;
+        return misc_deregister(&ts72xx_wdt_miscdev);
 }
 
 static struct platform_driver ts72xx_wdt_driver = {
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 1e0a317d3dcd..3860d02729dc 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -167,6 +167,9 @@ static struct page *balloon_next_page(struct page *page)
 
 static enum bp_state update_schedule(enum bp_state state)
 {
+        if (state == BP_ECANCELED)
+                return BP_ECANCELED;
+
         if (state == BP_DONE) {
                 balloon_stats.schedule_delay = 1;
                 balloon_stats.retry_count = 1;
diff --git a/drivers/xen/pci.c b/drivers/xen/pci.c
index dd9c249ea311..95ee4302ffb8 100644
--- a/drivers/xen/pci.c
+++ b/drivers/xen/pci.c
@@ -41,24 +41,29 @@ static int xen_add_device(struct device *dev)
 #endif
 
         if (pci_seg_supported) {
-                struct physdev_pci_device_add add = {
-                        .seg = pci_domain_nr(pci_dev->bus),
-                        .bus = pci_dev->bus->number,
-                        .devfn = pci_dev->devfn
+                struct {
+                        struct physdev_pci_device_add add;
+                        uint32_t pxm;
+                } add_ext = {
+                        .add.seg = pci_domain_nr(pci_dev->bus),
+                        .add.bus = pci_dev->bus->number,
+                        .add.devfn = pci_dev->devfn
                 };
+                struct physdev_pci_device_add *add = &add_ext.add;
+
 #ifdef CONFIG_ACPI
                 acpi_handle handle;
 #endif
 
 #ifdef CONFIG_PCI_IOV
                 if (pci_dev->is_virtfn) {
-                        add.flags = XEN_PCI_DEV_VIRTFN;
-                        add.physfn.bus = physfn->bus->number;
-                        add.physfn.devfn = physfn->devfn;
+                        add->flags = XEN_PCI_DEV_VIRTFN;
+                        add->physfn.bus = physfn->bus->number;
+                        add->physfn.devfn = physfn->devfn;
                 } else
 #endif
                 if (pci_ari_enabled(pci_dev->bus) && PCI_SLOT(pci_dev->devfn))
-                        add.flags = XEN_PCI_DEV_EXTFN;
+                        add->flags = XEN_PCI_DEV_EXTFN;
 
 #ifdef CONFIG_ACPI
                 handle = ACPI_HANDLE(&pci_dev->dev);
@@ -77,8 +82,8 @@ static int xen_add_device(struct device *dev)
                                 status = acpi_evaluate_integer(handle, "_PXM",
                                                                NULL, &pxm);
                                 if (ACPI_SUCCESS(status)) {
-                                        add.optarr[0] = pxm;
-                                        add.flags |= XEN_PCI_DEV_PXM;
+                                        add->optarr[0] = pxm;
+                                        add->flags |= XEN_PCI_DEV_PXM;
                                         break;
                                 }
                                 status = acpi_get_parent(handle, &handle);
@@ -86,7 +91,7 @@ static int xen_add_device(struct device *dev)
                 }
 #endif /* CONFIG_ACPI */
 
-                r = HYPERVISOR_physdev_op(PHYSDEVOP_pci_device_add, &add);
+                r = HYPERVISOR_physdev_op(PHYSDEVOP_pci_device_add, add);
                 if (r != -ENOSYS)
                         return r;
                 pci_seg_supported = false;