307 files changed, 2930 insertions, 1305 deletions
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index db6dfcfa3e2e..ab58556d347c 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3625,6 +3625,7 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)
                shost->max_lun = 1;
                shost->max_channel = 1;
                shost->max_cmd_len = 16;
+                shost->no_write_same = 1;
                /* Schedule policy is determined by ->qc_defer()
                 * callback and it needs to see every deferred qc.
diff --git a/drivers/base/regmap/regmap-mmio.c b/drivers/base/regmap/regmap-mmio.c
index 98745dd77e8c..81f977510775 100644
--- a/drivers/base/regmap/regmap-mmio.c
+++ b/drivers/base/regmap/regmap-mmio.c
@@ -40,7 +40,7 @@ static int regmap_mmio_gather_write(void *context,
        BUG_ON(reg_size != 4);
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                ret = clk_enable(ctx->clk);
                if (ret < 0)
                        return ret;
@@ -73,7 +73,7 @@ static int regmap_mmio_gather_write(void *context,
                offset += ctx->val_bytes;
        }
-        if (ctx->clk)
+        if (!IS_ERR(ctx->clk))
                clk_disable(ctx->clk);
        return 0;
@@ -96,7 +96,7 @@ static int regmap_mmio_read(void *context,
        BUG_ON(reg_size != 4);
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                ret = clk_enable(ctx->clk);
                if (ret < 0)
                        return ret;
@@ -129,7 +129,7 @@ static int regmap_mmio_read(void *context,
                offset += ctx->val_bytes;
        }
-        if (ctx->clk)
+        if (!IS_ERR(ctx->clk))
                clk_disable(ctx->clk);
        return 0;
@@ -139,7 +139,7 @@ static void regmap_mmio_free_context(void *context)
 {
        struct regmap_mmio_context *ctx = context;
-        if (ctx->clk) {
+        if (!IS_ERR(ctx->clk)) {
                clk_unprepare(ctx->clk);
                clk_put(ctx->clk);
        }
@@ -209,6 +209,7 @@ static struct regmap_mmio_context *regmap_mmio_gen_context(struct device *dev,
        ctx->regs = regs;
        ctx->val_bytes = config->val_bits / 8;
+        ctx->clk = ERR_PTR(-ENODEV);
        if (clk_id == NULL)
                return ctx;
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 9c021d9cace0..c2e002100949 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1549,7 +1549,7 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
                                                val + (i * val_bytes),
                                                val_bytes);
                        if (ret != 0)
-                                return ret;
+                                goto out;
                }
        } else {
                ret = _regmap_raw_write(map, reg, wval, val_bytes * val_count);
@@ -1743,7 +1743,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
 /**
 * regmap_read(): Read a value from a single register
 *
- * @map: Register map to write to
+ * @map: Register map to read from
 * @reg: Register to be read from
 * @val: Pointer to store read value
 *
@@ -1770,7 +1770,7 @@ EXPORT_SYMBOL_GPL(regmap_read);
 /**
 * regmap_raw_read(): Read raw data from the device
 *
- * @map: Register map to write to
+ * @map: Register map to read from
 * @reg: First register to be read from
 * @val: Pointer to store read value
 * @val_len: Size of data to read
@@ -1882,7 +1882,7 @@ EXPORT_SYMBOL_GPL(regmap_fields_read);
 /**
 * regmap_bulk_read(): Read multiple registers from the device
 *
- * @map: Register map to write to
+ * @map: Register map to read from
 * @reg: First register to be read from
 * @val: Pointer to store read value, in native register size for device
 * @val_count: Number of registers to read
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 432db1b59b00..c4a4c9006288 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -489,7 +489,7 @@ static int blkif_queue_request(struct request *req)
                        if ((ring_req->operation == BLKIF_OP_INDIRECT) &&
                            (i % SEGS_PER_INDIRECT_FRAME == 0)) {
-                                unsigned long pfn;
+                                unsigned long uninitialized_var(pfn);
                                if (segments)
                                        kunmap_atomic(segments);
@@ -2011,6 +2011,10 @@ static void blkif_release(struct gendisk *disk, fmode_t mode)
        bdev = bdget_disk(disk, 0);
+        if (!bdev) {
+                WARN(1, "Block device %s yanked out from us!\n", disk->disk_name);
+                goto out_mutex;
+        }
        if (bdev->bd_openers)
                goto out;
@@ -2041,6 +2045,7 @@ static void blkif_release(struct gendisk *disk, fmode_t mode)
 out:
        bdput(bdev);
+out_mutex:
        mutex_unlock(&blkfront_mutex);
 }
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index 40cc0cf2ded6..e6939e13e338 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -664,6 +664,13 @@ static struct dmi_system_id __initdata i8k_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro"),
                },
        },
+        {
+                .ident = "Dell XPS421",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS L421X"),
+                },
+        },
        { }
 };
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index bdb953e15d2a..5c07a56962db 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -87,6 +87,7 @@ config ARM_ARCH_TIMER
 config ARM_ARCH_TIMER_EVTSTREAM
        bool "Support for ARM architected timer event stream generation"
        default y if ARM_ARCH_TIMER
+        depends on ARM_ARCH_TIMER
        help
          This option enables support for event stream generation based on
          the ARM architected timer. It is used for waking up CPUs executing
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 4aac9ee0d0c0..3cf12834681e 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -313,8 +313,20 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
                goto err1;
        }
-        return sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
+        ret = clk_prepare(p->clk);
-                                cfg->clockevent_rating);
+        if (ret < 0)
+                goto err2;
+        ret = sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
+                               cfg->clockevent_rating);
+        if (ret < 0)
+                goto err3;
+        return 0;
+ err3:
+        clk_unprepare(p->clk);
+ err2:
+        clk_put(p->clk);
 err1:
        iounmap(p->mapbase);
 err0:
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 78b8dae49628..63557cda0a7d 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -472,12 +472,26 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
                ret = PTR_ERR(p->clk);
                goto err1;
        }
+        ret = clk_prepare(p->clk);
+        if (ret < 0)
+                goto err2;
        p->cs_enabled = false;
        p->enable_count = 0;
-        return sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
+        ret = sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
-                               cfg->clockevent_rating,
+                              cfg->clockevent_rating,
-                               cfg->clocksource_rating);
+                              cfg->clocksource_rating);
+        if (ret < 0)
+                goto err3;
+        return 0;
+ err3:
+        clk_unprepare(p->clk);
+ err2:
+        clk_put(p->clk);
 err1:
        iounmap(p->mapbase);
 err0:
diff --git a/drivers/cpufreq/at32ap-cpufreq.c b/drivers/cpufreq/at32ap-cpufreq.c
index 856ad80418ae..7c03dd84f66a 100644
--- a/drivers/cpufreq/at32ap-cpufreq.c
+++ b/drivers/cpufreq/at32ap-cpufreq.c
@@ -58,7 +58,7 @@ static int at32_set_target(struct cpufreq_policy *policy, unsigned int index)
        return 0;
 }
-static int __init at32_cpufreq_driver_init(struct cpufreq_policy *policy)
+static int at32_cpufreq_driver_init(struct cpufreq_policy *policy)
 {
        unsigned int frequency, rate, min_freq;
        int retval, steps, i;
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 2a991e468f78..a55e68f2cfc8 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -400,7 +400,7 @@ EXPORT_SYMBOL_GPL(cpuidle_register_device);
 */
 void cpuidle_unregister_device(struct cpuidle_device *dev)
 {
-        if (dev->registered == 0)
+        if (!dev || dev->registered == 0)
                return;
        cpuidle_pause_and_lock();
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 4f44b71b9e24..4cf5dec826e1 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -818,7 +818,7 @@ static void aead_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
                       ivsize, 1);
        print_hex_dump(KERN_ERR, "dst    @"__stringify(__LINE__)": ",
                       DUMP_PREFIX_ADDRESS, 16, 4, sg_virt(req->dst),
-                       req->cryptlen, 1);
+                       req->cryptlen - ctx->authsize, 1);
 #endif
        if (err) {
@@ -972,12 +972,9 @@ static void init_aead_job(u32 *sh_desc, dma_addr_t ptr,
                                 (edesc->src_nents ? : 1);
                in_options = LDST_SGF;
        }
-        if (encrypt)
-                append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
+        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize + req->cryptlen,
-                                  req->cryptlen - authsize, in_options);
+                          in_options);
-        else
-                append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
-                                  req->cryptlen, in_options);
        if (likely(req->src == req->dst)) {
                if (all_contig) {
@@ -998,7 +995,8 @@ static void init_aead_job(u32 *sh_desc, dma_addr_t ptr,
                }
        }
        if (encrypt)
-                append_seq_out_ptr(desc, dst_dma, req->cryptlen, out_options);
+                append_seq_out_ptr(desc, dst_dma, req->cryptlen + authsize,
+                                   out_options);
        else
                append_seq_out_ptr(desc, dst_dma, req->cryptlen - authsize,
                                   out_options);
@@ -1048,8 +1046,8 @@ static void init_aead_giv_job(u32 *sh_desc, dma_addr_t ptr,
                sec4_sg_index += edesc->assoc_nents + 1 + edesc->src_nents;
                in_options = LDST_SGF;
        }
-        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize +
+        append_seq_in_ptr(desc, src_dma, req->assoclen + ivsize + req->cryptlen,
-                          req->cryptlen - authsize, in_options);
+                          in_options);
        if (contig & GIV_DST_CONTIG) {
                dst_dma = edesc->iv_dma;
@@ -1066,7 +1064,8 @@ static void init_aead_giv_job(u32 *sh_desc, dma_addr_t ptr,
                }
        }
-        append_seq_out_ptr(desc, dst_dma, ivsize + req->cryptlen, out_options);
+        append_seq_out_ptr(desc, dst_dma, ivsize + req->cryptlen + authsize,
+                           out_options);
 }
 /*
@@ -1130,7 +1129,8 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
 * allocate and map the aead extended descriptor
 */
 static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
-                                           int desc_bytes, bool *all_contig_ptr)
+                                           int desc_bytes, bool *all_contig_ptr,
+                                           bool encrypt)
 {
        struct crypto_aead *aead = crypto_aead_reqtfm(req);
        struct caam_ctx *ctx = crypto_aead_ctx(aead);
@@ -1145,12 +1145,22 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req,
        bool assoc_chained = false, src_chained = false, dst_chained = false;
        int ivsize = crypto_aead_ivsize(aead);
        int sec4_sg_index, sec4_sg_len = 0, sec4_sg_bytes;
+        unsigned int authsize = ctx->authsize;
        assoc_nents = sg_count(req->assoc, req->assoclen, &assoc_chained);
-        src_nents = sg_count(req->src, req->cryptlen, &src_chained);
-        if (unlikely(req->dst != req->src))
+        if (unlikely(req->dst != req->src)) {
-                dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained);
+                src_nents = sg_count(req->src, req->cryptlen, &src_chained);
+                dst_nents = sg_count(req->dst,
+                                     req->cryptlen +
+                                        (encrypt ? authsize : (-authsize)),
+                                     &dst_chained);
+        } else {
+                src_nents = sg_count(req->src,
+                                     req->cryptlen +
+                                        (encrypt ? authsize : 0),
+                                     &src_chained);
+        }
        sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1,
                                 DMA_TO_DEVICE, assoc_chained);
@@ -1234,11 +1244,9 @@ static int aead_encrypt(struct aead_request *req)
        u32 *desc;
        int ret = 0;
-        req->cryptlen += ctx->authsize;
        /* allocate extended descriptor */
        edesc = aead_edesc_alloc(req, DESC_JOB_IO_LEN *
-                                 CAAM_CMD_SZ, &all_contig);
+                                 CAAM_CMD_SZ, &all_contig, true);
        if (IS_ERR(edesc))
                return PTR_ERR(edesc);
@@ -1275,7 +1283,7 @@ static int aead_decrypt(struct aead_request *req)
        /* allocate extended descriptor */
        edesc = aead_edesc_alloc(req, DESC_JOB_IO_LEN *
-                                 CAAM_CMD_SZ, &all_contig);
+                                 CAAM_CMD_SZ, &all_contig, false);
        if (IS_ERR(edesc))
                return PTR_ERR(edesc);
@@ -1332,7 +1340,8 @@ static struct aead_edesc *aead_giv_edesc_alloc(struct aead_givcrypt_request
        src_nents = sg_count(req->src, req->cryptlen, &src_chained);
        if (unlikely(req->dst != req->src))
-                dst_nents = sg_count(req->dst, req->cryptlen, &dst_chained);
+                dst_nents = sg_count(req->dst, req->cryptlen + ctx->authsize,
+                                     &dst_chained);
        sgc = dma_map_sg_chained(jrdev, req->assoc, assoc_nents ? : 1,
                                 DMA_TO_DEVICE, assoc_chained);
@@ -1426,8 +1435,6 @@ static int aead_givencrypt(struct aead_givcrypt_request *areq)
        u32 *desc;
        int ret = 0;
-        req->cryptlen += ctx->authsize;
        /* allocate extended descriptor */
        edesc = aead_giv_edesc_alloc(areq, DESC_JOB_IO_LEN *
                                     CAAM_CMD_SZ, &contig);
diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index d23356d20e1c..1d80bd3636c5 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -6,6 +6,7 @@
 */
 #include <linux/of_irq.h>
+#include <linux/of_address.h>
 #include "compat.h"
 #include "regs.h"
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 905de4427e7c..b44f4ddc565c 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -790,7 +790,7 @@ static void ipsec_esp_unmap(struct device *dev,
        if (edesc->assoc_chained)
                talitos_unmap_sg_chain(dev, areq->assoc, DMA_TO_DEVICE);
-        else
+        else if (areq->assoclen)
                /* assoc_nents counts also for IV in non-contiguous cases */
                dma_unmap_sg(dev, areq->assoc,
                             edesc->assoc_nents ? edesc->assoc_nents - 1 : 1,
@@ -973,7 +973,11 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
                dma_sync_single_for_device(dev, edesc->dma_link_tbl,
                                           edesc->dma_len, DMA_BIDIRECTIONAL);
        } else {
-                to_talitos_ptr(&desc->ptr[1], sg_dma_address(areq->assoc));
+                if (areq->assoclen)
+                        to_talitos_ptr(&desc->ptr[1],
+                                       sg_dma_address(areq->assoc));
+                else
+                        to_talitos_ptr(&desc->ptr[1], edesc->iv_dma);
                desc->ptr[1].j_extent = 0;
        }
@@ -1108,7 +1112,8 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                                                 unsigned int authsize,
                                                 unsigned int ivsize,
                                                 int icv_stashing,
-                                                 u32 cryptoflags)
+                                                 u32 cryptoflags,
+                                                 bool encrypt)
 {
        struct talitos_edesc *edesc;
        int assoc_nents = 0, src_nents, dst_nents, alloc_len, dma_len;
@@ -1122,10 +1127,10 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                return ERR_PTR(-EINVAL);
        }
-        if (iv)
+        if (ivsize)
                iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
-        if (assoc) {
+        if (assoclen) {
                /*
                 * Currently it is assumed that iv is provided whenever assoc
                 * is.
@@ -1141,19 +1146,17 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
                        assoc_nents = assoc_nents ? assoc_nents + 1 : 2;
        }
-        src_nents = sg_count(src, cryptlen + authsize, &src_chained);
+        if (!dst || dst == src) {
-        src_nents = (src_nents == 1) ? 0 : src_nents;
+                src_nents = sg_count(src, cryptlen + authsize, &src_chained);
+                src_nents = (src_nents == 1) ? 0 : src_nents;
-        if (!dst) {
+                dst_nents = dst ? src_nents : 0;
-                dst_nents = 0;
+        } else { /* dst && dst != src*/
-        } else {
+                src_nents = sg_count(src, cryptlen + (encrypt ? 0 : authsize),
-                if (dst == src) {
+                                     &src_chained);
-                        dst_nents = src_nents;
+                src_nents = (src_nents == 1) ? 0 : src_nents;
-                } else {
+                dst_nents = sg_count(dst, cryptlen + (encrypt ? authsize : 0),
-                        dst_nents = sg_count(dst, cryptlen + authsize,
+                                     &dst_chained);
-                                             &dst_chained);
+                dst_nents = (dst_nents == 1) ? 0 : dst_nents;
-                        dst_nents = (dst_nents == 1) ? 0 : dst_nents;
-                }
        }
        /*
@@ -1173,9 +1176,16 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
        edesc = kmalloc(alloc_len, GFP_DMA | flags);
        if (!edesc) {
-                talitos_unmap_sg_chain(dev, assoc, DMA_TO_DEVICE);
+                if (assoc_chained)
+                        talitos_unmap_sg_chain(dev, assoc, DMA_TO_DEVICE);
+                else if (assoclen)
+                        dma_unmap_sg(dev, assoc,
+                                     assoc_nents ? assoc_nents - 1 : 1,
+                                     DMA_TO_DEVICE);
                if (iv_dma)
                        dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE);
                dev_err(dev, "could not allocate edescriptor\n");
                return ERR_PTR(-ENOMEM);
        }
@@ -1197,7 +1207,7 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
 }
 static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
-                                              int icv_stashing)
+                                              int icv_stashing, bool encrypt)
 {
        struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
        struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
@@ -1206,7 +1216,7 @@ static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
        return talitos_edesc_alloc(ctx->dev, areq->assoc, areq->src, areq->dst,
                                   iv, areq->assoclen, areq->cryptlen,
                                   ctx->authsize, ivsize, icv_stashing,
-                                   areq->base.flags);
+                                   areq->base.flags, encrypt);
 }
 static int aead_encrypt(struct aead_request *req)
@@ -1216,7 +1226,7 @@ static int aead_encrypt(struct aead_request *req)
        struct talitos_edesc *edesc;
        /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(req, req->iv, 0);
+        edesc = aead_edesc_alloc(req, req->iv, 0, true);
        if (IS_ERR(edesc))
                return PTR_ERR(edesc);
@@ -1239,7 +1249,7 @@ static int aead_decrypt(struct aead_request *req)
        req->cryptlen -= authsize;
        /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(req, req->iv, 1);
+        edesc = aead_edesc_alloc(req, req->iv, 1, false);
        if (IS_ERR(edesc))
                return PTR_ERR(edesc);
@@ -1285,7 +1295,7 @@ static int aead_givencrypt(struct aead_givcrypt_request *req)
        struct talitos_edesc *edesc;
        /* allocate extended descriptor */
-        edesc = aead_edesc_alloc(areq, req->giv, 0);
+        edesc = aead_edesc_alloc(areq, req->giv, 0, true);
        if (IS_ERR(edesc))
                return PTR_ERR(edesc);
@@ -1441,7 +1451,7 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
 }
 static struct talitos_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request *
-                                                    areq)
+                                                    areq, bool encrypt)
 {
        struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
        struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
@@ -1449,7 +1459,7 @@ static struct talitos_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request *
        return talitos_edesc_alloc(ctx->dev, NULL, areq->src, areq->dst,
                                   areq->info, 0, areq->nbytes, 0, ivsize, 0,
-                                   areq->base.flags);
+                                   areq->base.flags, encrypt);
 }
 static int ablkcipher_encrypt(struct ablkcipher_request *areq)
@@ -1459,7 +1469,7 @@ static int ablkcipher_encrypt(struct ablkcipher_request *areq)
        struct talitos_edesc *edesc;
        /* allocate extended descriptor */
-        edesc = ablkcipher_edesc_alloc(areq);
+        edesc = ablkcipher_edesc_alloc(areq, true);
        if (IS_ERR(edesc))
                return PTR_ERR(edesc);
@@ -1476,7 +1486,7 @@ static int ablkcipher_decrypt(struct ablkcipher_request *areq)
        struct talitos_edesc *edesc;
        /* allocate extended descriptor */
-        edesc = ablkcipher_edesc_alloc(areq);
+        edesc = ablkcipher_edesc_alloc(areq, false);
        if (IS_ERR(edesc))
                return PTR_ERR(edesc);
@@ -1628,7 +1638,7 @@ static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq,
        struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
        return talitos_edesc_alloc(ctx->dev, NULL, req_ctx->psrc, NULL, NULL, 0,
-                                   nbytes, 0, 0, 0, areq->base.flags);
+                                   nbytes, 0, 0, 0, areq->base.flags, false);
 }
 static int ahash_init(struct ahash_request *areq)
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index 16a2aa28f856..ec4ee5c1fe9d 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -1169,7 +1169,7 @@ static void pl08x_desc_free(struct virt_dma_desc *vd)
        struct pl08x_txd *txd = to_pl08x_txd(&vd->tx);
        struct pl08x_dma_chan *plchan = to_pl08x_chan(vd->tx.chan);
-        dma_descriptor_unmap(txd);
+        dma_descriptor_unmap(&vd->tx);
        if (!txd->done)
                pl08x_release_mux(plchan);
diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index dcb1e05149a7..8869500ab92b 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -1017,6 +1017,7 @@ static int mmp_pdma_probe(struct platform_device *op)
                }
        }
+        platform_set_drvdata(op, pdev);
        dev_info(pdev->device.dev, "initialized %d channels\n", dma_channels);
        return 0;
 }
diff --git a/drivers/dma/s3c24xx-dma.c b/drivers/dma/s3c24xx-dma.c
index 4cb127978636..4eddedb6eb7d 100644
--- a/drivers/dma/s3c24xx-dma.c
+++ b/drivers/dma/s3c24xx-dma.c
@@ -628,42 +628,13 @@ retry:
        s3cchan->state = S3C24XX_DMA_CHAN_IDLE;
 }
-static void s3c24xx_dma_unmap_buffers(struct s3c24xx_txd *txd)
-{
-        struct device *dev = txd->vd.tx.chan->device->dev;
-        struct s3c24xx_sg *dsg;
-        if (!(txd->vd.tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
-                if (txd->vd.tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_single(dev, dsg->src_addr, dsg->len,
-                                                DMA_TO_DEVICE);
-                else {
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_page(dev, dsg->src_addr, dsg->len,
-                                                DMA_TO_DEVICE);
-                }
-        }
-        if (!(txd->vd.tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
-                if (txd->vd.tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_single(dev, dsg->dst_addr, dsg->len,
-                                                DMA_FROM_DEVICE);
-                else
-                        list_for_each_entry(dsg, &txd->dsg_list, node)
-                                dma_unmap_page(dev, dsg->dst_addr, dsg->len,
-                                                DMA_FROM_DEVICE);
-        }
-}
 static void s3c24xx_dma_desc_free(struct virt_dma_desc *vd)
 {
        struct s3c24xx_txd *txd = to_s3c24xx_txd(&vd->tx);
        struct s3c24xx_dma_chan *s3cchan = to_s3c24xx_dma_chan(vd->tx.chan);
        if (!s3cchan->slave)
-                s3c24xx_dma_unmap_buffers(txd);
+                dma_descriptor_unmap(&vd->tx);
        s3c24xx_dma_free_txd(txd);
 }
@@ -795,7 +766,7 @@ static enum dma_status s3c24xx_dma_tx_status(struct dma_chan *chan,
        spin_lock_irqsave(&s3cchan->vc.lock, flags);
        ret = dma_cookie_status(chan, cookie, txstate);
-        if (ret == DMA_SUCCESS) {
+        if (ret == DMA_COMPLETE) {
                spin_unlock_irqrestore(&s3cchan->vc.lock, flags);
                return ret;
        }
diff --git a/drivers/dma/sh/rcar-hpbdma.c b/drivers/dma/sh/rcar-hpbdma.c
index ebad84591a6e..3083d901a414 100644
--- a/drivers/dma/sh/rcar-hpbdma.c
+++ b/drivers/dma/sh/rcar-hpbdma.c
@@ -60,6 +60,7 @@
 #define HPB_DMAE_DSTPR_DMSTP    BIT(0)
 /* DMA status register (DSTSR) bits */
+#define HPB_DMAE_DSTSR_DQSTS    BIT(2)
 #define HPB_DMAE_DSTSR_DMSTS    BIT(0)
 /* DMA common registers */
@@ -286,6 +287,9 @@ static void hpb_dmae_halt(struct shdma_chan *schan)
        ch_reg_write(chan, HPB_DMAE_DCMDR_DQEND, HPB_DMAE_DCMDR);
        ch_reg_write(chan, HPB_DMAE_DSTPR_DMSTP, HPB_DMAE_DSTPR);
+        chan->plane_idx = 0;
+        chan->first_desc = true;
 }
 static const struct hpb_dmae_slave_config *
@@ -385,7 +389,10 @@ static bool hpb_dmae_channel_busy(struct shdma_chan *schan)
        struct hpb_dmae_chan *chan = to_chan(schan);
        u32 dstsr = ch_reg_read(chan, HPB_DMAE_DSTSR);
-        return (dstsr & HPB_DMAE_DSTSR_DMSTS) == HPB_DMAE_DSTSR_DMSTS;
+        if (chan->xfer_mode == XFER_DOUBLE)
+                return dstsr & HPB_DMAE_DSTSR_DQSTS;
+        else
+                return dstsr & HPB_DMAE_DSTSR_DMSTS;
 }
 static int
@@ -510,6 +517,8 @@ static int hpb_dmae_chan_probe(struct hpb_dmae_device *hpbdev, int id)
        }
        schan = &new_hpb_chan->shdma_chan;
+        schan->max_xfer_len = HPB_DMA_TCR_MAX;
        shdma_chan_probe(sdev, schan, id);
        if (pdev->id >= 0)
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 8472405c5586..d7f1b57bd3be 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -945,7 +945,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
        u32                     tad_offset;
        u32                     rir_way;
        u32                     mb, kb;
-        u64                     ch_addr, offset, limit, prv = 0;
+        u64                     ch_addr, offset, limit = 0, prv = 0;
        /*
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index 3c55ec856e39..a287cece0593 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -1082,7 +1082,7 @@ static void arizona_micd_set_level(struct arizona *arizona, int index,
 static int arizona_extcon_probe(struct platform_device *pdev)
 {
        struct arizona *arizona = dev_get_drvdata(pdev->dev.parent);
-        struct arizona_pdata *pdata;
+        struct arizona_pdata *pdata = &arizona->pdata;
        struct arizona_extcon_info *info;
        unsigned int val;
        int jack_irq_fall, jack_irq_rise;
@@ -1091,8 +1091,6 @@ static int arizona_extcon_probe(struct platform_device *pdev)
        if (!arizona->dapm || !arizona->dapm->card)
                return -EPROBE_DEFER;
-        pdata = dev_get_platdata(arizona->dev);
        info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
        if (!info) {
                dev_err(&pdev->dev, "Failed to allocate memory\n");
diff --git a/drivers/extcon/extcon-class.c b/drivers/extcon/extcon-class.c
index 15443d3b6be1..76322330cbd7 100644
--- a/drivers/extcon/extcon-class.c
+++ b/drivers/extcon/extcon-class.c
@@ -792,6 +792,8 @@ void extcon_dev_unregister(struct extcon_dev *edev)
                return;
        }
+        device_unregister(&edev->dev);
        if (edev->mutually_exclusive && edev->max_supported) {
                for (index = 0; edev->mutually_exclusive[index];
                                index++)
@@ -812,7 +814,6 @@ void extcon_dev_unregister(struct extcon_dev *edev)
        if (switch_class)
                class_compat_remove_link(switch_class, &edev->dev, NULL);
 #endif
-        device_unregister(&edev->dev);
        put_device(&edev->dev);
 }
 EXPORT_SYMBOL_GPL(extcon_dev_unregister);
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 281029daf98c..b0bb056458a3 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1623,6 +1623,7 @@ static struct scsi_host_template scsi_driver_template = {
        .cmd_per_lun            = 1,
        .can_queue              = 1,
        .sdev_attrs             = sbp2_scsi_sysfs_attrs,
+        .no_write_same          = 1,
 };
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index 5002d50e3781..743fd426f21b 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -18,14 +18,12 @@ module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
 static int efi_pstore_open(struct pstore_info *psi)
 {
-        efivar_entry_iter_begin();
        psi->data = NULL;
        return 0;
 }
 static int efi_pstore_close(struct pstore_info *psi)
 {
-        efivar_entry_iter_end();
        psi->data = NULL;
        return 0;
 }
@@ -39,6 +37,12 @@ struct pstore_read_data {
        char **buf;
 };
+static inline u64 generic_id(unsigned long timestamp,
+                             unsigned int part, int count)
+{
+        return (timestamp * 100 + part) * 1000 + count;
+}
 static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
 {
        efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
@@ -57,7 +61,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
        if (sscanf(name, "dump-type%u-%u-%d-%lu-%c",
                   cb_data->type, &part, &cnt, &time, &data_type) == 5) {
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, cnt);
                *cb_data->count = cnt;
                cb_data->timespec->tv_sec = time;
                cb_data->timespec->tv_nsec = 0;
@@ -67,7 +71,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
                        *cb_data->compressed = false;
        } else if (sscanf(name, "dump-type%u-%u-%d-%lu",
                   cb_data->type, &part, &cnt, &time) == 4) {
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, cnt);
                *cb_data->count = cnt;
                cb_data->timespec->tv_sec = time;
                cb_data->timespec->tv_nsec = 0;
@@ -79,7 +83,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
                 * which doesn't support holding
                 * multiple logs, remains.
                 */
-                *cb_data->id = part;
+                *cb_data->id = generic_id(time, part, 0);
                *cb_data->count = 0;
                cb_data->timespec->tv_sec = time;
                cb_data->timespec->tv_nsec = 0;
@@ -91,19 +95,125 @@ static int efi_pstore_read_func(struct efivar_entry *entry, void *data)
        __efivar_entry_get(entry, &entry->var.Attributes,
                           &entry->var.DataSize, entry->var.Data);
        size = entry->var.DataSize;
+        memcpy(*cb_data->buf, entry->var.Data,
+               (size_t)min_t(unsigned long, EFIVARS_DATA_SIZE_MAX, size));
-        *cb_data->buf = kmemdup(entry->var.Data, size, GFP_KERNEL);
-        if (*cb_data->buf == NULL)
-                return -ENOMEM;
        return size;
 }
+/**
+ * efi_pstore_scan_sysfs_enter
+ * @entry: scanning entry
+ * @next: next entry
+ * @head: list head
+ */
+static void efi_pstore_scan_sysfs_enter(struct efivar_entry *pos,
+                                        struct efivar_entry *next,
+                                        struct list_head *head)
+{
+        pos->scanning = true;
+        if (&next->list != head)
+                next->scanning = true;
+}
+/**
+ * __efi_pstore_scan_sysfs_exit
+ * @entry: deleting entry
+ * @turn_off_scanning: Check if a scanning flag should be turned off
+ */
+static inline void __efi_pstore_scan_sysfs_exit(struct efivar_entry *entry,
+                                                bool turn_off_scanning)
+{
+        if (entry->deleting) {
+                list_del(&entry->list);
+                efivar_entry_iter_end();
+                efivar_unregister(entry);
+                efivar_entry_iter_begin();
+        } else if (turn_off_scanning)
+                entry->scanning = false;
+}
+/**
+ * efi_pstore_scan_sysfs_exit
+ * @pos: scanning entry
+ * @next: next entry
+ * @head: list head
+ * @stop: a flag checking if scanning will stop
+ */
+static void efi_pstore_scan_sysfs_exit(struct efivar_entry *pos,
+                                       struct efivar_entry *next,
+                                       struct list_head *head, bool stop)
+{
+        __efi_pstore_scan_sysfs_exit(pos, true);
+        if (stop)
+                __efi_pstore_scan_sysfs_exit(next, &next->list != head);
+}
+/**
+ * efi_pstore_sysfs_entry_iter
+ *
+ * @data: function-specific data to pass to callback
+ * @pos: entry to begin iterating from
+ *
+ * You MUST call efivar_enter_iter_begin() before this function, and
+ * efivar_entry_iter_end() afterwards.
+ *
+ * It is possible to begin iteration from an arbitrary entry within
+ * the list by passing @pos. @pos is updated on return to point to
+ * the next entry of the last one passed to efi_pstore_read_func().
+ * To begin iterating from the beginning of the list @pos must be %NULL.
+ */
+static int efi_pstore_sysfs_entry_iter(void *data, struct efivar_entry **pos)
+{
+        struct efivar_entry *entry, *n;
+        struct list_head *head = &efivar_sysfs_list;
+        int size = 0;
+        if (!*pos) {
+                list_for_each_entry_safe(entry, n, head, list) {
+                        efi_pstore_scan_sysfs_enter(entry, n, head);
+                        size = efi_pstore_read_func(entry, data);
+                        efi_pstore_scan_sysfs_exit(entry, n, head, size < 0);
+                        if (size)
+                                break;
+                }
+                *pos = n;
+                return size;
+        }
+        list_for_each_entry_safe_from((*pos), n, head, list) {
+                efi_pstore_scan_sysfs_enter((*pos), n, head);
+                size = efi_pstore_read_func((*pos), data);
+                efi_pstore_scan_sysfs_exit((*pos), n, head, size < 0);
+                if (size)
+                        break;
+        }
+        *pos = n;
+        return size;
+}
+/**
+ * efi_pstore_read
+ *
+ * This function returns a size of NVRAM entry logged via efi_pstore_write().
+ * The meaning and behavior of efi_pstore/pstore are as below.
+ *
+ * size > 0: Got data of an entry logged via efi_pstore_write() successfully,
+ *           and pstore filesystem will continue reading subsequent entries.
+ * size == 0: Entry was not logged via efi_pstore_write(),
+ *            and efi_pstore driver will continue reading subsequent entries.
+ * size < 0: Failed to get data of entry logging via efi_pstore_write(),
+ *           and pstore will stop reading entry.
+ */
 static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
                               int *count, struct timespec *timespec,
                               char **buf, bool *compressed,
                               struct pstore_info *psi)
 {
        struct pstore_read_data data;
+        ssize_t size;
        data.id = id;
        data.type = type;
@@ -112,8 +222,17 @@ static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
        data.compressed = compressed;
        data.buf = buf;
-        return __efivar_entry_iter(efi_pstore_read_func, &efivar_sysfs_list, &data,
+        *data.buf = kzalloc(EFIVARS_DATA_SIZE_MAX, GFP_KERNEL);
-                                   (struct efivar_entry **)&psi->data);
+        if (!*data.buf)
+                return -ENOMEM;
+        efivar_entry_iter_begin();
+        size = efi_pstore_sysfs_entry_iter(&data,
+                                           (struct efivar_entry **)&psi->data);
+        efivar_entry_iter_end();
+        if (size <= 0)
+                kfree(*data.buf);
+        return size;
 }
 static int efi_pstore_write(enum pstore_type_id type,
@@ -184,9 +303,17 @@ static int efi_pstore_erase_func(struct efivar_entry *entry, void *data)
                        return 0;
        }
+        if (entry->scanning) {
+                /*
+                 * Skip deletion because this entry will be deleted
+                 * after scanning is completed.
+                 */
+                entry->deleting = true;
+        } else
+                list_del(&entry->list);
        /* found */
        __efivar_entry_delete(entry);
-        list_del(&entry->list);
        return 1;
 }
@@ -199,14 +326,16 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
        char name[DUMP_NAME_LEN];
        efi_char16_t efi_name[DUMP_NAME_LEN];
        int found, i;
+        unsigned int part;
-        sprintf(name, "dump-type%u-%u-%d-%lu", type, (unsigned int)id, count,
+        do_div(id, 1000);
-                time.tv_sec);
+        part = do_div(id, 100);
+        sprintf(name, "dump-type%u-%u-%d-%lu", type, part, count, time.tv_sec);
        for (i = 0; i < DUMP_NAME_LEN; i++)
                efi_name[i] = name[i];
-        edata.id = id;
+        edata.id = part;
        edata.type = type;
        edata.count = count;
        edata.time = time;
@@ -214,10 +343,12 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
        efivar_entry_iter_begin();
        found = __efivar_entry_iter(efi_pstore_erase_func, &efivar_sysfs_list, &edata, &entry);
-        efivar_entry_iter_end();
-        if (found)
+        if (found && !entry->scanning) {
+                efivar_entry_iter_end();
                efivar_unregister(entry);
+        } else
+                efivar_entry_iter_end();
        return 0;
 }
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 933eb027d527..3dc248239197 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -383,12 +383,16 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
        else if (__efivar_entry_delete(entry))
                err = -EIO;
-        efivar_entry_iter_end();
+        if (err) {
+                efivar_entry_iter_end();
-        if (err)
                return err;
+        }
-        efivar_unregister(entry);
+        if (!entry->scanning) {
+                efivar_entry_iter_end();
+                efivar_unregister(entry);
+        } else
+                efivar_entry_iter_end();
        /* It's dead Jim.... */
        return count;
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 391c67b182d9..b22659cccca4 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -683,8 +683,16 @@ struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid,
        if (!found)
                return NULL;
-        if (remove)
+        if (remove) {
-                list_del(&entry->list);
+                if (entry->scanning) {
+                        /*
+                         * The entry will be deleted
+                         * after scanning is completed.
+                         */
+                        entry->deleting = true;
+                } else
+                        list_del(&entry->list);
+        }
        return entry;
 }
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index 8847adf392b7..84be70157ad6 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -327,7 +327,7 @@ static int gpio_to_irq_unbanked(struct gpio_chip *chip, unsigned offset)
         * NOTE:  we assume for now that only irqs in the first gpio_chip
         * can provide direct-mapped IRQs to AINTC (up to 32 GPIOs).
         */
-        if (offset < d->irq_base)
+        if (offset < d->gpio_unbanked)
                return d->gpio_irq + offset;
        else
                return -ENODEV;
@@ -419,6 +419,8 @@ static int davinci_gpio_irq_setup(struct platform_device *pdev)
                /* pass "bank 0" GPIO IRQs to AINTC */
                chips[0].chip.to_irq = gpio_to_irq_unbanked;
+                chips[0].gpio_irq = bank_irq;
+                chips[0].gpio_unbanked = pdata->gpio_unbanked;
                binten = BIT(0);
                /* AINTC handles mask/unmask; GPIO handles triggering */
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 914e859e3eda..d7d6d72eba33 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -70,10 +70,14 @@ static int mpc8572_gpio_get(struct gpio_chip *gc, unsigned int gpio)
        u32 val;
        struct of_mm_gpio_chip *mm = to_of_mm_gpio_chip(gc);
        struct mpc8xxx_gpio_chip *mpc8xxx_gc = to_mpc8xxx_gpio_chip(mm);
+        u32 out_mask, out_shadow;
-        val = in_be32(mm->regs + GPIO_DAT) & ~in_be32(mm->regs + GPIO_DIR);
+        out_mask = in_be32(mm->regs + GPIO_DIR);
-        return (val | mpc8xxx_gc->data) & mpc8xxx_gpio2mask(gpio);
+        val = in_be32(mm->regs + GPIO_DAT) & ~out_mask;
+        out_shadow = mpc8xxx_gc->data & out_mask;
+        return (val | out_shadow) & mpc8xxx_gpio2mask(gpio);
 }
 static int mpc8xxx_gpio_get(struct gpio_chip *gc, unsigned int gpio)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index ac53a9593662..85f772c0b26a 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2368,7 +2368,7 @@ static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
                                continue;
                        }
-                        if (chip->ngpio >= p->chip_hwnum) {
+                        if (chip->ngpio <= p->chip_hwnum) {
                                dev_warn(dev, "GPIO chip %s has %d GPIOs\n",
                                         chip->label, chip->ngpio);
                                continue;
@@ -2418,7 +2418,7 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
                                               const char *con_id,
                                               unsigned int idx)
 {
-        struct gpio_desc *desc;
+        struct gpio_desc *desc = NULL;
        int status;
        enum gpio_lookup_flags flags = 0;
@@ -2431,13 +2431,23 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
        } else if (IS_ENABLED(CONFIG_ACPI) && dev && ACPI_HANDLE(dev)) {
                dev_dbg(dev, "using ACPI for GPIO lookup\n");
                desc = acpi_find_gpio(dev, con_id, idx, &flags);
-        } else {
+        }
+        /*
+         * Either we are not using DT or ACPI, or their lookup did not return
+         * a result. In that case, use platform lookup as a fallback.
+         */
+        if (!desc || IS_ERR(desc)) {
+                struct gpio_desc *pdesc;
                dev_dbg(dev, "using lookup tables for GPIO lookup");
-                desc = gpiod_find(dev, con_id, idx, &flags);
+                pdesc = gpiod_find(dev, con_id, idx, &flags);
+                /* If used as fallback, do not replace the previous error */
+                if (!IS_ERR(pdesc) || !desc)
+                        desc = pdesc;
        }
        if (IS_ERR(desc)) {
-                dev_warn(dev, "lookup for GPIO %s failed\n", con_id);
+                dev_dbg(dev, "lookup for GPIO %s failed\n", con_id);
                return desc;
        }
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index fb7cf0e796f6..0a1e4a5f4234 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -2674,7 +2674,7 @@ static int add_3d_struct_modes(struct drm_connector *connector, u16 structure,
        int modes = 0;
        u8 cea_mode;
-        if (video_db == NULL || video_index > video_len)
+        if (video_db == NULL || video_index >= video_len)
                return 0;
        /* CEA modes are numbered 1..127 */
@@ -2701,7 +2701,7 @@ static int add_3d_struct_modes(struct drm_connector *connector, u16 structure,
        if (structure & (1 << 8)) {
                newmode = drm_mode_duplicate(dev, &edid_cea_modes[cea_mode]);
                if (newmode) {
-                        newmode->flags = DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF;
+                        newmode->flags |= DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF;
                        drm_mode_probed_add(connector, newmode);
                        modes++;
                }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index b676006a95a0..22b8f5eced80 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -173,28 +173,37 @@ static int exynos_drm_open(struct drm_device *dev, struct drm_file *file)
 static void exynos_drm_preclose(struct drm_device *dev,
                                        struct drm_file *file)
 {
+        exynos_drm_subdrv_close(dev, file);
+}
+static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
+{
        struct exynos_drm_private *private = dev->dev_private;
-        struct drm_pending_vblank_event *e, *t;
+        struct drm_pending_vblank_event *v, *vt;
+        struct drm_pending_event *e, *et;
        unsigned long flags;
-        /* release events of current file */
+        if (!file->driver_priv)
+                return;
+        /* Release all events not unhandled by page flip handler. */
        spin_lock_irqsave(&dev->event_lock, flags);
-        list_for_each_entry_safe(e, t, &private->pageflip_event_list,
+        list_for_each_entry_safe(v, vt, &private->pageflip_event_list,
                        base.link) {
-                if (e->base.file_priv == file) {
+                if (v->base.file_priv == file) {
-                        list_del(&e->base.link);
+                        list_del(&v->base.link);
-                        e->base.destroy(&e->base);
+                        drm_vblank_put(dev, v->pipe);
+                        v->base.destroy(&v->base);
                }
        }
-        spin_unlock_irqrestore(&dev->event_lock, flags);
-        exynos_drm_subdrv_close(dev, file);
+        /* Release all events handled by page flip handler but not freed. */
-}
+        list_for_each_entry_safe(e, et, &file->event_list, link) {
+                list_del(&e->link);
+                e->destroy(e);
+        }
+        spin_unlock_irqrestore(&dev->event_lock, flags);
-static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
-{
-        if (!file->driver_priv)
-                return;
        kfree(file->driver_priv);
        file->driver_priv = NULL;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 23da72b5eae9..a61878bf5dcd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -31,7 +31,7 @@
 #include "exynos_drm_iommu.h"
 /*
- * FIMD is stand for Fully Interactive Mobile Display and
+ * FIMD stands for Fully Interactive Mobile Display and
 * as a display controller, it transfers contents drawn on memory
 * to a LCD Panel through Display Interfaces such as RGB or
 * CPU Interface.
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 989be12cdd6e..2e367a1c6a64 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -534,8 +534,10 @@ static int i915_drm_freeze(struct drm_device *dev)
                 * Disable CRTCs directly since we want to preserve sw state
                 * for _thaw.
                 */
+                mutex_lock(&dev->mode_config.mutex);
                list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
                        dev_priv->display.crtc_disable(crtc);
+                mutex_unlock(&dev->mode_config.mutex);
                intel_modeset_suspend_hw(dev);
        }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 12bbd5eac70d..621c7c67a643 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4442,10 +4442,9 @@ i915_gem_init_hw(struct drm_device *dev)
        if (dev_priv->ellc_size)
                I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
-        if (IS_HSW_GT3(dev))
+        if (IS_HASWELL(dev))
-                I915_WRITE(MI_PREDICATE_RESULT_2, LOWER_SLICE_ENABLED);
+                I915_WRITE(MI_PREDICATE_RESULT_2, IS_HSW_GT3(dev) ?
-        else
+                           LOWER_SLICE_ENABLED : LOWER_SLICE_DISABLED);
-                I915_WRITE(MI_PREDICATE_RESULT_2, LOWER_SLICE_DISABLED);
        if (HAS_PCH_NOP(dev)) {
                u32 temp = I915_READ(GEN7_MSG_CTL);
diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
index 7d5752fda5f1..9bb533e0d762 100644
--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
@@ -125,13 +125,15 @@ static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
        ret = i915_gem_object_get_pages(obj);
        if (ret)
-                goto error;
+                goto err;
+        i915_gem_object_pin_pages(obj);
        ret = -ENOMEM;
        pages = drm_malloc_ab(obj->base.size >> PAGE_SHIFT, sizeof(*pages));
        if (pages == NULL)
-                goto error;
+                goto err_unpin;
        i = 0;
        for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0)
@@ -141,15 +143,16 @@ static void *i915_gem_dmabuf_vmap(struct dma_buf *dma_buf)
        drm_free_large(pages);
        if (!obj->dma_buf_vmapping)
-                goto error;
+                goto err_unpin;
        obj->vmapping_count = 1;
-        i915_gem_object_pin_pages(obj);
 out_unlock:
        mutex_unlock(&dev->struct_mutex);
        return obj->dma_buf_vmapping;
-error:
+err_unpin:
+        i915_gem_object_unpin_pages(obj);
+err:
        mutex_unlock(&dev->struct_mutex);
        return ERR_PTR(ret);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 885d595e0e02..b7e787fb4649 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -33,6 +33,9 @@
 #include "intel_drv.h"
 #include <linux/dma_remapping.h>
+#define  __EXEC_OBJECT_HAS_PIN (1<<31)
+#define  __EXEC_OBJECT_HAS_FENCE (1<<30)
 struct eb_vmas {
        struct list_head vmas;
        int and;
@@ -187,7 +190,28 @@ static struct i915_vma *eb_get_vma(struct eb_vmas *eb, unsigned long handle)
        }
 }
-static void eb_destroy(struct eb_vmas *eb) {
+static void
+i915_gem_execbuffer_unreserve_vma(struct i915_vma *vma)
+{
+        struct drm_i915_gem_exec_object2 *entry;
+        struct drm_i915_gem_object *obj = vma->obj;
+        if (!drm_mm_node_allocated(&vma->node))
+                return;
+        entry = vma->exec_entry;
+        if (entry->flags & __EXEC_OBJECT_HAS_FENCE)
+                i915_gem_object_unpin_fence(obj);
+        if (entry->flags & __EXEC_OBJECT_HAS_PIN)
+                i915_gem_object_unpin(obj);
+        entry->flags &= ~(__EXEC_OBJECT_HAS_FENCE | __EXEC_OBJECT_HAS_PIN);
+}
+static void eb_destroy(struct eb_vmas *eb)
+{
        while (!list_empty(&eb->vmas)) {
                struct i915_vma *vma;
@@ -195,6 +219,7 @@ static void eb_destroy(struct eb_vmas *eb) {
                                       struct i915_vma,
                                       exec_list);
                list_del_init(&vma->exec_list);
+                i915_gem_execbuffer_unreserve_vma(vma);
                drm_gem_object_unreference(&vma->obj->base);
        }
        kfree(eb);
@@ -478,9 +503,6 @@ i915_gem_execbuffer_relocate(struct eb_vmas *eb,
        return ret;
 }
-#define  __EXEC_OBJECT_HAS_PIN (1<<31)
-#define  __EXEC_OBJECT_HAS_FENCE (1<<30)
 static int
 need_reloc_mappable(struct i915_vma *vma)
 {
@@ -552,26 +574,6 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
        return 0;
 }
-static void
-i915_gem_execbuffer_unreserve_vma(struct i915_vma *vma)
-{
-        struct drm_i915_gem_exec_object2 *entry;
-        struct drm_i915_gem_object *obj = vma->obj;
-        if (!drm_mm_node_allocated(&vma->node))
-                return;
-        entry = vma->exec_entry;
-        if (entry->flags & __EXEC_OBJECT_HAS_FENCE)
-                i915_gem_object_unpin_fence(obj);
-        if (entry->flags & __EXEC_OBJECT_HAS_PIN)
-                i915_gem_object_unpin(obj);
-        entry->flags &= ~(__EXEC_OBJECT_HAS_FENCE | __EXEC_OBJECT_HAS_PIN);
-}
 static int
 i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                            struct list_head *vmas,
@@ -670,13 +672,14 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                                goto err;
                }
-err:            /* Decrement pin count for bound objects */
+err:
-                list_for_each_entry(vma, vmas, exec_list)
-                        i915_gem_execbuffer_unreserve_vma(vma);
                if (ret != -ENOSPC || retry++)
                        return ret;
+                /* Decrement pin count for bound objects */
+                list_for_each_entry(vma, vmas, exec_list)
+                        i915_gem_execbuffer_unreserve_vma(vma);
                ret = i915_gem_evict_vm(vm, true);
                if (ret)
                        return ret;
@@ -708,6 +711,7 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
        while (!list_empty(&eb->vmas)) {
                vma = list_first_entry(&eb->vmas, struct i915_vma, exec_list);
                list_del_init(&vma->exec_list);
+                i915_gem_execbuffer_unreserve_vma(vma);
                drm_gem_object_unreference(&vma->obj->base);
        }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 3620a1b0a73c..38cb8d44a013 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -57,7 +57,9 @@ typedef gen8_gtt_pte_t gen8_ppgtt_pde_t;
 #define HSW_WB_LLC_AGE3                 HSW_CACHEABILITY_CONTROL(0x2)
 #define HSW_WB_LLC_AGE0                 HSW_CACHEABILITY_CONTROL(0x3)
 #define HSW_WB_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0xb)
+#define HSW_WB_ELLC_LLC_AGE3            HSW_CACHEABILITY_CONTROL(0x8)
 #define HSW_WT_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0x6)
+#define HSW_WT_ELLC_LLC_AGE3            HSW_CACHEABILITY_CONTROL(0x7)
 #define GEN8_PTES_PER_PAGE              (PAGE_SIZE / sizeof(gen8_gtt_pte_t))
 #define GEN8_PDES_PER_PAGE              (PAGE_SIZE / sizeof(gen8_ppgtt_pde_t))
@@ -185,10 +187,10 @@ static gen6_gtt_pte_t iris_pte_encode(dma_addr_t addr,
        case I915_CACHE_NONE:
                break;
        case I915_CACHE_WT:
-                pte |= HSW_WT_ELLC_LLC_AGE0;
+                pte |= HSW_WT_ELLC_LLC_AGE3;
                break;
        default:
-                pte |= HSW_WB_ELLC_LLC_AGE0;
+                pte |= HSW_WB_ELLC_LLC_AGE3;
                break;
        }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index f9eafb6ed523..ee2742122a02 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -235,6 +235,7 @@
 */
 #define MI_LOAD_REGISTER_IMM(x) MI_INSTR(0x22, 2*x-1)
 #define MI_STORE_REGISTER_MEM(x) MI_INSTR(0x24, 2*x-1)
+#define  MI_SRM_LRM_GLOBAL_GTT          (1<<22)
 #define MI_FLUSH_DW             MI_INSTR(0x26, 1) /* for GEN6 */
 #define   MI_FLUSH_DW_STORE_INDEX       (1<<21)
 #define   MI_INVALIDATE_TLB             (1<<18)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 330077bcd0bd..526c8ded16b0 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -173,7 +173,7 @@ static void intel_prepare_ddi_buffers(struct drm_device *dev, enum port port)
                ddi_translations = ddi_translations_dp;
                break;
        case PORT_D:
-                if (intel_dpd_is_edp(dev))
+                if (intel_dp_is_edp(dev, PORT_D))
                        ddi_translations = ddi_translations_edp;
                else
                        ddi_translations = ddi_translations_dp;
@@ -1158,9 +1158,10 @@ static void intel_ddi_post_disable(struct intel_encoder *intel_encoder)
        if (wait)
                intel_wait_ddi_buf_idle(dev_priv, port);
-        if (type == INTEL_OUTPUT_EDP) {
+        if (type == INTEL_OUTPUT_DISPLAYPORT || type == INTEL_OUTPUT_EDP) {
                struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
                ironlake_edp_panel_vdd_on(intel_dp);
+                intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
                ironlake_edp_panel_off(intel_dp);
        }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 7ec8b488bb1d..080f6fd4e839 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5815,7 +5815,7 @@ static void intel_set_pipe_csc(struct drm_crtc *crtc)
                uint16_t postoff = 0;
                if (intel_crtc->config.limited_color_range)
-                        postoff = (16 * (1 << 13) / 255) & 0x1fff;
+                        postoff = (16 * (1 << 12) / 255) & 0x1fff;
                I915_WRITE(PIPE_CSC_POSTOFF_HI(pipe), postoff);
                I915_WRITE(PIPE_CSC_POSTOFF_ME(pipe), postoff);
@@ -6402,7 +6402,7 @@ static void hsw_restore_lcpll(struct drm_i915_private *dev_priv)
        /* Make sure we're not on PC8 state before disabling PC8, otherwise
         * we'll hang the machine! */
-        dev_priv->uncore.funcs.force_wake_get(dev_priv);
+        gen6_gt_force_wake_get(dev_priv);
        if (val & LCPLL_POWER_DOWN_ALLOW) {
                val &= ~LCPLL_POWER_DOWN_ALLOW;
@@ -6436,7 +6436,7 @@ static void hsw_restore_lcpll(struct drm_i915_private *dev_priv)
                        DRM_ERROR("Switching back to LCPLL failed\n");
        }
-        dev_priv->uncore.funcs.force_wake_put(dev_priv);
+        gen6_gt_force_wake_put(dev_priv);
 }
 void hsw_enable_pc8_work(struct work_struct *__work)
@@ -8354,7 +8354,8 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
                intel_ring_emit(ring, ~(DERRMR_PIPEA_PRI_FLIP_DONE |
                                        DERRMR_PIPEB_PRI_FLIP_DONE |
                                        DERRMR_PIPEC_PRI_FLIP_DONE));
-                intel_ring_emit(ring, MI_STORE_REGISTER_MEM(1));
+                intel_ring_emit(ring, MI_STORE_REGISTER_MEM(1) |
+                                MI_SRM_LRM_GLOBAL_GTT);
                intel_ring_emit(ring, DERRMR);
                intel_ring_emit(ring, ring->scratch.gtt_offset + 256);
        }
@@ -10049,7 +10050,7 @@ static void intel_setup_outputs(struct drm_device *dev)
                        intel_ddi_init(dev, PORT_D);
        } else if (HAS_PCH_SPLIT(dev)) {
                int found;
-                dpd_is_edp = intel_dpd_is_edp(dev);
+                dpd_is_edp = intel_dp_is_edp(dev, PORT_D);
                if (has_edp_a(dev))
                        intel_dp_init(dev, DP_A, PORT_A);
@@ -10086,8 +10087,7 @@ static void intel_setup_outputs(struct drm_device *dev)
                        intel_hdmi_init(dev, VLV_DISPLAY_BASE + GEN4_HDMIC,
                                        PORT_C);
                        if (I915_READ(VLV_DISPLAY_BASE + DP_C) & DP_DETECTED)
-                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_C,
+                                intel_dp_init(dev, VLV_DISPLAY_BASE + DP_C, PORT_C);
-                                              PORT_C);
                }
                intel_dsi_init(dev);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 0b2e842fef01..30c627c7b7ba 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -3326,11 +3326,19 @@ intel_trans_dp_port_sel(struct drm_crtc *crtc)
 }
 /* check the VBT to see whether the eDP is on DP-D port */
-bool intel_dpd_is_edp(struct drm_device *dev)
+bool intel_dp_is_edp(struct drm_device *dev, enum port port)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        union child_device_config *p_child;
        int i;
+        static const short port_mapping[] = {
+                [PORT_B] = PORT_IDPB,
+                [PORT_C] = PORT_IDPC,
+                [PORT_D] = PORT_IDPD,
+        };
+        if (port == PORT_A)
+                return true;
        if (!dev_priv->vbt.child_dev_num)
                return false;
@@ -3338,7 +3346,7 @@ bool intel_dpd_is_edp(struct drm_device *dev)
        for (i = 0; i < dev_priv->vbt.child_dev_num; i++) {
                p_child = dev_priv->vbt.child_dev + i;
-                if (p_child->common.dvo_port == PORT_IDPD &&
+                if (p_child->common.dvo_port == port_mapping[port] &&
                    (p_child->common.device_type & DEVICE_TYPE_eDP_BITS) ==
                    (DEVICE_TYPE_eDP & DEVICE_TYPE_eDP_BITS))
                        return true;
@@ -3616,26 +3624,10 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
        intel_dp->DP = I915_READ(intel_dp->output_reg);
        intel_dp->attached_connector = intel_connector;
-        type = DRM_MODE_CONNECTOR_DisplayPort;
+        if (intel_dp_is_edp(dev, port))
-        /*
-         * FIXME : We need to initialize built-in panels before external panels.
-         * For X0, DP_C is fixed as eDP. Revisit this as part of VLV eDP cleanup
-         */
-        switch (port) {
-        case PORT_A:
                type = DRM_MODE_CONNECTOR_eDP;
-                break;
+        else
-        case PORT_C:
+                type = DRM_MODE_CONNECTOR_DisplayPort;
-                if (IS_VALLEYVIEW(dev))
-                        type = DRM_MODE_CONNECTOR_eDP;
-                break;
-        case PORT_D:
-                if (HAS_PCH_SPLIT(dev) && intel_dpd_is_edp(dev))
-                        type = DRM_MODE_CONNECTOR_eDP;
-                break;
-        default:        /* silence GCC warning */
-                break;
-        }
        /*
         * For eDP we always set the encoder type to INTEL_OUTPUT_EDP, but
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 1e49aa8f5377..a18e88b3e425 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -708,7 +708,7 @@ void intel_dp_encoder_destroy(struct drm_encoder *encoder);
 void intel_dp_check_link_status(struct intel_dp *intel_dp);
 bool intel_dp_compute_config(struct intel_encoder *encoder,
                             struct intel_crtc_config *pipe_config);
-bool intel_dpd_is_edp(struct drm_device *dev);
+bool intel_dp_is_edp(struct drm_device *dev, enum port port);
 void ironlake_edp_backlight_on(struct intel_dp *intel_dp);
 void ironlake_edp_backlight_off(struct intel_dp *intel_dp);
 void ironlake_edp_panel_on(struct intel_dp *intel_dp);
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index caf2ee4e5441..6e0d5e075b15 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -1180,7 +1180,7 @@ static bool g4x_compute_wm0(struct drm_device *dev,
        adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
        clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
        hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
        pixel_size = crtc->fb->bits_per_pixel / 8;
@@ -1267,7 +1267,7 @@ static bool g4x_compute_srwm(struct drm_device *dev,
        crtc = intel_get_crtc_for_plane(dev, plane);
        adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
        clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
        hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
        pixel_size = crtc->fb->bits_per_pixel / 8;
@@ -1498,7 +1498,7 @@ static void i965_update_wm(struct drm_crtc *unused_crtc)
                const struct drm_display_mode *adjusted_mode =
                        &to_intel_crtc(crtc)->config.adjusted_mode;
                int clock = adjusted_mode->crtc_clock;
-                int htotal = adjusted_mode->htotal;
+                int htotal = adjusted_mode->crtc_htotal;
                int hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
                int pixel_size = crtc->fb->bits_per_pixel / 8;
                unsigned long line_time_us;
@@ -1624,7 +1624,7 @@ static void i9xx_update_wm(struct drm_crtc *unused_crtc)
                const struct drm_display_mode *adjusted_mode =
                        &to_intel_crtc(enabled)->config.adjusted_mode;
                int clock = adjusted_mode->crtc_clock;
-                int htotal = adjusted_mode->htotal;
+                int htotal = adjusted_mode->crtc_htotal;
                int hdisplay = to_intel_crtc(enabled)->config.pipe_src_w;
                int pixel_size = enabled->fb->bits_per_pixel / 8;
                unsigned long line_time_us;
@@ -1776,7 +1776,7 @@ static bool ironlake_compute_srwm(struct drm_device *dev, int level, int plane,
        crtc = intel_get_crtc_for_plane(dev, plane);
        adjusted_mode = &to_intel_crtc(crtc)->config.adjusted_mode;
        clock = adjusted_mode->crtc_clock;
-        htotal = adjusted_mode->htotal;
+        htotal = adjusted_mode->crtc_htotal;
        hdisplay = to_intel_crtc(crtc)->config.pipe_src_w;
        pixel_size = crtc->fb->bits_per_pixel / 8;
@@ -2469,8 +2469,9 @@ hsw_compute_linetime_wm(struct drm_device *dev, struct drm_crtc *crtc)
        /* The WM are computed with base on how long it takes to fill a single
         * row at the given clock rate, multiplied by 8.
         * */
-        linetime = DIV_ROUND_CLOSEST(mode->htotal * 1000 * 8, mode->clock);
+        linetime = DIV_ROUND_CLOSEST(mode->crtc_htotal * 1000 * 8,
-        ips_linetime = DIV_ROUND_CLOSEST(mode->htotal * 1000 * 8,
+                                     mode->crtc_clock);
+        ips_linetime = DIV_ROUND_CLOSEST(mode->crtc_htotal * 1000 * 8,
                                         intel_ddi_get_cdclk_freq(dev_priv));
        return PIPE_WM_LINETIME_IPS_LINETIME(ips_linetime) |
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
index edcf801613e6..b3fa1ba191b7 100644
--- a/drivers/gpu/drm/nouveau/Makefile
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -59,6 +59,7 @@ nouveau-y += core/subdev/clock/nv40.o
 nouveau-y += core/subdev/clock/nv50.o
 nouveau-y += core/subdev/clock/nv84.o
 nouveau-y += core/subdev/clock/nva3.o
+nouveau-y += core/subdev/clock/nvaa.o
 nouveau-y += core/subdev/clock/nvc0.o
 nouveau-y += core/subdev/clock/nve0.o
 nouveau-y += core/subdev/clock/pllnv04.o
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
index db139827047c..db3fc7be856a 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nv50.c
@@ -283,7 +283,7 @@ nv50_identify(struct nouveau_device *device)
                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                device->oclass[NVDEV_SUBDEV_GPIO   ] = &nv50_gpio_oclass;
                device->oclass[NVDEV_SUBDEV_I2C    ] = &nv94_i2c_oclass;
-                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nv84_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nvaa_clock_oclass;
                device->oclass[NVDEV_SUBDEV_THERM  ] = &nv84_therm_oclass;
                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv50_devinit_oclass;
@@ -311,7 +311,7 @@ nv50_identify(struct nouveau_device *device)
                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nouveau_bios_oclass;
                device->oclass[NVDEV_SUBDEV_GPIO   ] = &nv50_gpio_oclass;
                device->oclass[NVDEV_SUBDEV_I2C    ] = &nv94_i2c_oclass;
-                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nv84_clock_oclass;
+                device->oclass[NVDEV_SUBDEV_CLOCK  ] =  nvaa_clock_oclass;
                device->oclass[NVDEV_SUBDEV_THERM  ] = &nv84_therm_oclass;
                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv50_devinit_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
index 5f555788121c..e6352bd5b4ff 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv50.c
@@ -33,6 +33,7 @@
 #include <engine/dmaobj.h>
 #include <engine/fifo.h>
+#include "nv04.h"
 #include "nv50.h"
 /*******************************************************************************
@@ -460,6 +461,8 @@ nv50_fifo_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        nv_subdev(priv)->intr = nv04_fifo_intr;
        nv_engine(priv)->cclass = &nv50_fifo_cclass;
        nv_engine(priv)->sclass = nv50_fifo_sclass;
+        priv->base.pause = nv04_fifo_pause;
+        priv->base.start = nv04_fifo_start;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
index 0908dc834c84..fe0f41e65d9b 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv84.c
@@ -35,6 +35,7 @@
 #include <engine/dmaobj.h>
 #include <engine/fifo.h>
+#include "nv04.h"
 #include "nv50.h"
 /*******************************************************************************
@@ -432,6 +433,8 @@ nv84_fifo_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        nv_subdev(priv)->intr = nv04_fifo_intr;
        nv_engine(priv)->cclass = &nv84_fifo_cclass;
        nv_engine(priv)->sclass = nv84_fifo_sclass;
+        priv->base.pause = nv04_fifo_pause;
+        priv->base.start = nv04_fifo_start;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/software/nv50.c b/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
index b574dd4bb828..5ce686ee729e 100644
--- a/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/software/nv50.c
@@ -176,7 +176,7 @@ nv50_software_context_ctor(struct nouveau_object *parent,
        if (ret)
                return ret;
-        chan->vblank.nr_event = pdisp->vblank->index_nr;
+        chan->vblank.nr_event = pdisp ? pdisp->vblank->index_nr : 0;
        chan->vblank.event = kzalloc(chan->vblank.nr_event *
                                     sizeof(*chan->vblank.event), GFP_KERNEL);
        if (!chan->vblank.event)
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
index e2675bc0edba..8f4ced75444a 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
@@ -14,6 +14,9 @@ enum nv_clk_src {
        nv_clk_src_hclk,
        nv_clk_src_hclkm3,
        nv_clk_src_hclkm3d2,
+        nv_clk_src_hclkm2d3, /* NVAA */
+        nv_clk_src_hclkm4, /* NVAA */
+        nv_clk_src_cclk, /* NVAA */
        nv_clk_src_host,
@@ -127,6 +130,7 @@ extern struct nouveau_oclass nv04_clock_oclass;
 extern struct nouveau_oclass nv40_clock_oclass;
 extern struct nouveau_oclass *nv50_clock_oclass;
 extern struct nouveau_oclass *nv84_clock_oclass;
+extern struct nouveau_oclass *nvaa_clock_oclass;
 extern struct nouveau_oclass nva3_clock_oclass;
 extern struct nouveau_oclass nvc0_clock_oclass;
 extern struct nouveau_oclass nve0_clock_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
index da50c1b12928..30c1f3a4158e 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nv04.c
@@ -69,6 +69,11 @@ nv04_clock_pll_prog(struct nouveau_clock *clk, u32 reg1,
        return 0;
 }
+static struct nouveau_clocks
+nv04_domain[] = {
+        { nv_clk_src_max }
+};
 static int
 nv04_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                struct nouveau_oclass *oclass, void *data, u32 size,
@@ -77,7 +82,7 @@ nv04_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
        struct nv04_clock_priv *priv;
        int ret;
-        ret = nouveau_clock_create(parent, engine, oclass, NULL, &priv);
+        ret = nouveau_clock_create(parent, engine, oclass, nv04_domain, &priv);
        *pobject = nv_object(priv);
        if (ret)
                return ret;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c
new file mode 100644
index 000000000000..7a723b4f564d
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nvaa.c
@@ -0,0 +1,445 @@
+/*
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+#include <engine/fifo.h>
+#include <subdev/bios.h>
+#include <subdev/bios/pll.h>
+#include <subdev/timer.h>
+#include <subdev/clock.h>
+#include "pll.h"
+struct nvaa_clock_priv {
+        struct nouveau_clock base;
+        enum nv_clk_src csrc, ssrc, vsrc;
+        u32 cctrl, sctrl;
+        u32 ccoef, scoef;
+        u32 cpost, spost;
+        u32 vdiv;
+};
+static u32
+read_div(struct nouveau_clock *clk)
+{
+        return nv_rd32(clk, 0x004600);
+}
+static u32
+read_pll(struct nouveau_clock *clk, u32 base)
+{
+        u32 ctrl = nv_rd32(clk, base + 0);
+        u32 coef = nv_rd32(clk, base + 4);
+        u32 ref = clk->read(clk, nv_clk_src_href);
+        u32 post_div = 0;
+        u32 clock = 0;
+        int N1, M1;
+        switch (base){
+        case 0x4020:
+                post_div = 1 << ((nv_rd32(clk, 0x4070) & 0x000f0000) >> 16);
+                break;
+        case 0x4028:
+                post_div = (nv_rd32(clk, 0x4040) & 0x000f0000) >> 16;
+                break;
+        default:
+                break;
+        }
+        N1 = (coef & 0x0000ff00) >> 8;
+        M1 = (coef & 0x000000ff);
+        if ((ctrl & 0x80000000) && M1) {
+                clock = ref * N1 / M1;
+                clock = clock / post_div;
+        }
+        return clock;
+}
+static int
+nvaa_clock_read(struct nouveau_clock *clk, enum nv_clk_src src)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        u32 mast = nv_rd32(clk, 0x00c054);
+        u32 P = 0;
+        switch (src) {
+        case nv_clk_src_crystal:
+                return nv_device(priv)->crystal;
+        case nv_clk_src_href:
+                return 100000; /* PCIE reference clock */
+        case nv_clk_src_hclkm4:
+                return clk->read(clk, nv_clk_src_href) * 4;
+        case nv_clk_src_hclkm2d3:
+                return clk->read(clk, nv_clk_src_href) * 2 / 3;
+        case nv_clk_src_host:
+                switch (mast & 0x000c0000) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_hclkm2d3);
+                case 0x00040000: break;
+                case 0x00080000: return clk->read(clk, nv_clk_src_hclkm4);
+                case 0x000c0000: return clk->read(clk, nv_clk_src_cclk);
+                }
+                break;
+        case nv_clk_src_core:
+                P = (nv_rd32(clk, 0x004028) & 0x00070000) >> 16;
+                switch (mast & 0x00000003) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_crystal) >> P;
+                case 0x00000001: return 0;
+                case 0x00000002: return clk->read(clk, nv_clk_src_hclkm4) >> P;
+                case 0x00000003: return read_pll(clk, 0x004028) >> P;
+                }
+                break;
+        case nv_clk_src_cclk:
+                if ((mast & 0x03000000) != 0x03000000)
+                        return clk->read(clk, nv_clk_src_core);
+                if ((mast & 0x00000200) == 0x00000000)
+                        return clk->read(clk, nv_clk_src_core);
+                switch (mast & 0x00000c00) {
+                case 0x00000000: return clk->read(clk, nv_clk_src_href);
+                case 0x00000400: return clk->read(clk, nv_clk_src_hclkm4);
+                case 0x00000800: return clk->read(clk, nv_clk_src_hclkm2d3);
+                default: return 0;
+                }
+        case nv_clk_src_shader:
+                P = (nv_rd32(clk, 0x004020) & 0x00070000) >> 16;
+                switch (mast & 0x00000030) {
+                case 0x00000000:
+                        if (mast & 0x00000040)
+                                return clk->read(clk, nv_clk_src_href) >> P;
+                        return clk->read(clk, nv_clk_src_crystal) >> P;
+                case 0x00000010: break;
+                case 0x00000020: return read_pll(clk, 0x004028) >> P;
+                case 0x00000030: return read_pll(clk, 0x004020) >> P;
+                }
+                break;
+        case nv_clk_src_mem:
+                return 0;
+                break;
+        case nv_clk_src_vdec:
+                P = (read_div(clk) & 0x00000700) >> 8;
+                switch (mast & 0x00400000) {
+                case 0x00400000:
+                        return clk->read(clk, nv_clk_src_core) >> P;
+                        break;
+                default:
+                        return 500000 >> P;
+                        break;
+                }
+                break;
+        default:
+                break;
+        }
+        nv_debug(priv, "unknown clock source %d 0x%08x\n", src, mast);
+        return 0;
+}
+static u32
+calc_pll(struct nvaa_clock_priv *priv, u32 reg,
+         u32 clock, int *N, int *M, int *P)
+{
+        struct nouveau_bios *bios = nouveau_bios(priv);
+        struct nvbios_pll pll;
+        struct nouveau_clock *clk = &priv->base;
+        int ret;
+        ret = nvbios_pll_parse(bios, reg, &pll);
+        if (ret)
+                return 0;
+        pll.vco2.max_freq = 0;
+        pll.refclk = clk->read(clk, nv_clk_src_href);
+        if (!pll.refclk)
+                return 0;
+        return nv04_pll_calc(nv_subdev(priv), &pll, clock, N, M, NULL, NULL, P);
+}
+static inline u32
+calc_P(u32 src, u32 target, int *div)
+{
+        u32 clk0 = src, clk1 = src;
+        for (*div = 0; *div <= 7; (*div)++) {
+                if (clk0 <= target) {
+                        clk1 = clk0 << (*div ? 1 : 0);
+                        break;
+                }
+                clk0 >>= 1;
+        }
+        if (target - clk0 <= clk1 - target)
+                return clk0;
+        (*div)--;
+        return clk1;
+}
+static int
+nvaa_clock_calc(struct nouveau_clock *clk, struct nouveau_cstate *cstate)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        const int shader = cstate->domain[nv_clk_src_shader];
+        const int core = cstate->domain[nv_clk_src_core];
+        const int vdec = cstate->domain[nv_clk_src_vdec];
+        u32 out = 0, clock = 0;
+        int N, M, P1, P2 = 0;
+        int divs = 0;
+        /* cclk: find suitable source, disable PLL if we can */
+        if (core < clk->read(clk, nv_clk_src_hclkm4))
+                out = calc_P(clk->read(clk, nv_clk_src_hclkm4), core, &divs);
+        /* Calculate clock * 2, so shader clock can use it too */
+        clock = calc_pll(priv, 0x4028, (core << 1), &N, &M, &P1);
+        if (abs(core - out) <=
+            abs(core - (clock >> 1))) {
+                priv->csrc = nv_clk_src_hclkm4;
+                priv->cctrl = divs << 16;
+        } else {
+                /* NVCTRL is actually used _after_ NVPOST, and after what we
+                 * call NVPLL. To make matters worse, NVPOST is an integer
+                 * divider instead of a right-shift number. */
+                if(P1 > 2) {
+                        P2 = P1 - 2;
+                        P1 = 2;
+                }
+                priv->csrc = nv_clk_src_core;
+                priv->ccoef = (N << 8) | M;
+                priv->cctrl = (P2 + 1) << 16;
+                priv->cpost = (1 << P1) << 16;
+        }
+        /* sclk: nvpll + divisor, href or spll */
+        out = 0;
+        if (shader == clk->read(clk, nv_clk_src_href)) {
+                priv->ssrc = nv_clk_src_href;
+        } else {
+                clock = calc_pll(priv, 0x4020, shader, &N, &M, &P1);
+                if (priv->csrc == nv_clk_src_core) {
+                        out = calc_P((core << 1), shader, &divs);
+                }
+                if (abs(shader - out) <=
+                    abs(shader - clock) &&
+                   (divs + P2) <= 7) {
+                        priv->ssrc = nv_clk_src_core;
+                        priv->sctrl = (divs + P2) << 16;
+                } else {
+                        priv->ssrc = nv_clk_src_shader;
+                        priv->scoef = (N << 8) | M;
+                        priv->sctrl = P1 << 16;
+                }
+        }
+        /* vclk */
+        out = calc_P(core, vdec, &divs);
+        clock = calc_P(500000, vdec, &P1);
+        if(abs(vdec - out) <=
+           abs(vdec - clock)) {
+                priv->vsrc = nv_clk_src_cclk;
+                priv->vdiv = divs << 16;
+        } else {
+                priv->vsrc = nv_clk_src_vdec;
+                priv->vdiv = P1 << 16;
+        }
+        /* Print strategy! */
+        nv_debug(priv, "nvpll: %08x %08x %08x\n",
+                        priv->ccoef, priv->cpost, priv->cctrl);
+        nv_debug(priv, " spll: %08x %08x %08x\n",
+                        priv->scoef, priv->spost, priv->sctrl);
+        nv_debug(priv, " vdiv: %08x\n", priv->vdiv);
+        if (priv->csrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "core: hrefm4\n");
+        else
+                nv_debug(priv, "core: nvpll\n");
+        if (priv->ssrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "shader: hrefm4\n");
+        else if (priv->ssrc == nv_clk_src_core)
+                nv_debug(priv, "shader: nvpll\n");
+        else
+                nv_debug(priv, "shader: spll\n");
+        if (priv->vsrc == nv_clk_src_hclkm4)
+                nv_debug(priv, "vdec: 500MHz\n");
+        else
+                nv_debug(priv, "vdec: core\n");
+        return 0;
+}
+static int
+nvaa_clock_prog(struct nouveau_clock *clk)
+{
+        struct nvaa_clock_priv *priv = (void *)clk;
+        struct nouveau_fifo *pfifo = nouveau_fifo(clk);
+        unsigned long flags;
+        u32 pllmask = 0, mast, ptherm_gate;
+        int ret = -EBUSY;
+        /* halt and idle execution engines */
+        ptherm_gate = nv_mask(clk, 0x020060, 0x00070000, 0x00000000);
+        nv_mask(clk, 0x002504, 0x00000001, 0x00000001);
+        /* Wait until the interrupt handler is finished */
+        if (!nv_wait(clk, 0x000100, 0xffffffff, 0x00000000))
+                goto resume;
+        if (pfifo)
+                pfifo->pause(pfifo, &flags);
+        if (!nv_wait(clk, 0x002504, 0x00000010, 0x00000010))
+                goto resume;
+        if (!nv_wait(clk, 0x00251c, 0x0000003f, 0x0000003f))
+                goto resume;
+        /* First switch to safe clocks: href */
+        mast = nv_mask(clk, 0xc054, 0x03400e70, 0x03400640);
+        mast &= ~0x00400e73;
+        mast |= 0x03000000;
+        switch (priv->csrc) {
+        case nv_clk_src_hclkm4:
+                nv_mask(clk, 0x4028, 0x00070000, priv->cctrl);
+                mast |= 0x00000002;
+                break;
+        case nv_clk_src_core:
+                nv_wr32(clk, 0x402c, priv->ccoef);
+                nv_wr32(clk, 0x4028, 0x80000000 | priv->cctrl);
+                nv_wr32(clk, 0x4040, priv->cpost);
+                pllmask |= (0x3 << 8);
+                mast |= 0x00000003;
+                break;
+        default:
+                nv_warn(priv,"Reclocking failed: unknown core clock\n");
+                goto resume;
+        }
+        switch (priv->ssrc) {
+        case nv_clk_src_href:
+                nv_mask(clk, 0x4020, 0x00070000, 0x00000000);
+                /* mast |= 0x00000000; */
+                break;
+        case nv_clk_src_core:
+                nv_mask(clk, 0x4020, 0x00070000, priv->sctrl);
+                mast |= 0x00000020;
+                break;
+        case nv_clk_src_shader:
+                nv_wr32(clk, 0x4024, priv->scoef);
+                nv_wr32(clk, 0x4020, 0x80000000 | priv->sctrl);
+                nv_wr32(clk, 0x4070, priv->spost);
+                pllmask |= (0x3 << 12);
+                mast |= 0x00000030;
+                break;
+        default:
+                nv_warn(priv,"Reclocking failed: unknown sclk clock\n");
+                goto resume;
+        }
+        if (!nv_wait(clk, 0x004080, pllmask, pllmask)) {
+                nv_warn(priv,"Reclocking failed: unstable PLLs\n");
+                goto resume;
+        }
+        switch (priv->vsrc) {
+        case nv_clk_src_cclk:
+                mast |= 0x00400000;
+        default:
+                nv_wr32(clk, 0x4600, priv->vdiv);
+        }
+        nv_wr32(clk, 0xc054, mast);
+        ret = 0;
+resume:
+        if (pfifo)
+                pfifo->start(pfifo, &flags);
+        nv_mask(clk, 0x002504, 0x00000001, 0x00000000);
+        nv_wr32(clk, 0x020060, ptherm_gate);
+        /* Disable some PLLs and dividers when unused */
+        if (priv->csrc != nv_clk_src_core) {
+                nv_wr32(clk, 0x4040, 0x00000000);
+                nv_mask(clk, 0x4028, 0x80000000, 0x00000000);
+        }
+        if (priv->ssrc != nv_clk_src_shader) {
+                nv_wr32(clk, 0x4070, 0x00000000);
+                nv_mask(clk, 0x4020, 0x80000000, 0x00000000);
+        }
+        return ret;
+}
+static void
+nvaa_clock_tidy(struct nouveau_clock *clk)
+{
+}
+static struct nouveau_clocks
+nvaa_domains[] = {
+        { nv_clk_src_crystal, 0xff },
+        { nv_clk_src_href   , 0xff },
+        { nv_clk_src_core   , 0xff, 0, "core", 1000 },
+        { nv_clk_src_shader , 0xff, 0, "shader", 1000 },
+        { nv_clk_src_vdec   , 0xff, 0, "vdec", 1000 },
+        { nv_clk_src_max }
+};
+static int
+nvaa_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+                struct nouveau_oclass *oclass, void *data, u32 size,
+                struct nouveau_object **pobject)
+{
+        struct nvaa_clock_priv *priv;
+        int ret;
+        ret = nouveau_clock_create(parent, engine, oclass, nvaa_domains, &priv);
+        *pobject = nv_object(priv);
+        if (ret)
+                return ret;
+        priv->base.read = nvaa_clock_read;
+        priv->base.calc = nvaa_clock_calc;
+        priv->base.prog = nvaa_clock_prog;
+        priv->base.tidy = nvaa_clock_tidy;
+        return 0;
+}
+struct nouveau_oclass *
+nvaa_clock_oclass = &(struct nouveau_oclass) {
+        .handle = NV_SUBDEV(CLOCK, 0xaa),
+        .ofuncs = &(struct nouveau_ofuncs) {
+                .ctor = nvaa_clock_ctor,
+                .dtor = _nouveau_clock_dtor,
+                .init = _nouveau_clock_init,
+                .fini = _nouveau_clock_fini,
+        },
+};
diff --git a/drivers/gpu/drm/nouveau/dispnv04/overlay.c b/drivers/gpu/drm/nouveau/dispnv04/overlay.c
index 3618ac6b6316..32e7064b819b 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/overlay.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/overlay.c
@@ -58,8 +58,8 @@ struct nouveau_plane {
 };
 static uint32_t formats[] = {
-        DRM_FORMAT_NV12,
        DRM_FORMAT_UYVY,
+        DRM_FORMAT_NV12,
 };
 /* Sine can be approximated with
@@ -99,13 +99,28 @@ nv10_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
        struct nouveau_bo *cur = nv_plane->cur;
        bool flip = nv_plane->flip;
-        int format = ALIGN(src_w * 4, 0x100);
        int soff = NV_PCRTC0_SIZE * nv_crtc->index;
        int soff2 = NV_PCRTC0_SIZE * !nv_crtc->index;
-        int ret;
+        int format, ret;
+        /* Source parameters given in 16.16 fixed point, ignore fractional. */
+        src_x >>= 16;
+        src_y >>= 16;
+        src_w >>= 16;
+        src_h >>= 16;
+        format = ALIGN(src_w * 4, 0x100);
        if (format > 0xffff)
-                return -EINVAL;
+                return -ERANGE;
+        if (dev->chipset >= 0x30) {
+                if (crtc_w < (src_w >> 1) || crtc_h < (src_h >> 1))
+                        return -ERANGE;
+        } else {
+                if (crtc_w < (src_w >> 3) || crtc_h < (src_h >> 3))
+                        return -ERANGE;
+        }
        ret = nouveau_bo_pin(nv_fb->nvbo, TTM_PL_FLAG_VRAM);
        if (ret)
@@ -113,12 +128,6 @@ nv10_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
        nv_plane->cur = nv_fb->nvbo;
-        /* Source parameters given in 16.16 fixed point, ignore fractional. */
-        src_x = src_x >> 16;
-        src_y = src_y >> 16;
-        src_w = src_w >> 16;
-        src_h = src_h >> 16;
        nv_mask(dev, NV_PCRTC_ENGINE_CTRL + soff, NV_CRTC_FSEL_OVERLAY, NV_CRTC_FSEL_OVERLAY);
        nv_mask(dev, NV_PCRTC_ENGINE_CTRL + soff2, NV_CRTC_FSEL_OVERLAY, 0);
@@ -245,14 +254,25 @@ nv10_overlay_init(struct drm_device *device)
 {
        struct nouveau_device *dev = nouveau_dev(device);
        struct nouveau_plane *plane = kzalloc(sizeof(struct nouveau_plane), GFP_KERNEL);
+        int num_formats = ARRAY_SIZE(formats);
        int ret;
        if (!plane)
                return;
+        switch (dev->chipset) {
+        case 0x10:
+        case 0x11:
+        case 0x15:
+        case 0x1a:
+        case 0x20:
+                num_formats = 1;
+                break;
+        }
        ret = drm_plane_init(device, &plane->base, 3 /* both crtc's */,
                             &nv10_plane_funcs,
-                             formats, ARRAY_SIZE(formats), false);
+                             formats, num_formats, false);
        if (ret)
                goto err;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 7809d92183c4..29c3efdfc7dd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -608,6 +608,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        fence = nouveau_fence_ref(new_bo->bo.sync_obj);
        spin_unlock(&new_bo->bo.bdev->fence_lock);
        ret = nouveau_fence_sync(fence, chan);
+        nouveau_fence_unref(&fence);
        if (ret)
                return ret;
@@ -701,7 +702,7 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
        s = list_first_entry(&fctx->flip, struct nouveau_page_flip_state, head);
        if (s->event)
-                drm_send_vblank_event(dev, -1, s->event);
+                drm_send_vblank_event(dev, s->crtc, s->event);
        list_del(&s->head);
        if (ps)
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index f8e66c08b11a..4e384a2f99c3 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1265,7 +1265,7 @@ nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b,
                    uint32_t start, uint32_t size)
 {
        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
-        u32 end = max(start + size, (u32)256);
+        u32 end = min_t(u32, start + size, 256);
        u32 i;
        for (i = start; i < end; i++) {
diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
index 0652ee0a2098..f685035dbe39 100644
--- a/drivers/gpu/drm/radeon/atombios_i2c.c
+++ b/drivers/gpu/drm/radeon/atombios_i2c.c
@@ -44,7 +44,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
        PROCESS_I2C_CHANNEL_TRANSACTION_PS_ALLOCATION args;
        int index = GetIndexIntoMasterTable(COMMAND, ProcessI2cChannelTransaction);
        unsigned char *base;
-        u16 out;
+        u16 out = cpu_to_le16(0);
        memset(&args, 0, sizeof(args));
@@ -55,11 +55,14 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
                        DRM_ERROR("hw i2c: tried to write too many bytes (%d vs 3)\n", num);
                        return -EINVAL;
                }
-                args.ucRegIndex = buf[0];
+                if (buf == NULL)
-                if (num > 1) {
+                        args.ucRegIndex = 0;
+                else
+                        args.ucRegIndex = buf[0];
+                if (num)
                        num--;
+                if (num)
                        memcpy(&out, &buf[1], num);
-                }
                args.lpI2CDataOut = cpu_to_le16(out);
        } else {
                if (num > ATOM_MAX_HW_I2C_READ) {
@@ -96,14 +99,14 @@ int radeon_atom_hw_i2c_xfer(struct i2c_adapter *i2c_adap,
        struct radeon_i2c_chan *i2c = i2c_get_adapdata(i2c_adap);
        struct i2c_msg *p;
        int i, remaining, current_count, buffer_offset, max_bytes, ret;
-        u8 buf = 0, flags;
+        u8 flags;
        /* check for bus probe */
        p = &msgs[0];
        if ((num == 1) && (p->len == 0)) {
                ret = radeon_process_i2c_ch(i2c,
                                            p->addr, HW_I2C_WRITE,
-                                            &buf, 1);
+                                            NULL, 0);
                if (ret)
                        return ret;
                else
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 009f46e0ce72..de86493cbc44 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -93,11 +93,13 @@ void dce6_afmt_select_pin(struct drm_encoder *encoder)
        struct radeon_device *rdev = encoder->dev->dev_private;
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
        struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-        u32 offset = dig->afmt->offset;
+        u32 offset;
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                return;
+        offset = dig->afmt->offset;
        WREG32(AFMT_AUDIO_SRC_CONTROL + offset,
               AFMT_AUDIO_SRC_SELECT(dig->afmt->pin->id));
 }
@@ -112,7 +114,7 @@ void dce6_afmt_write_latency_fields(struct drm_encoder *encoder,
        struct radeon_connector *radeon_connector = NULL;
        u32 tmp = 0, offset;
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                return;
        offset = dig->afmt->pin->offset;
@@ -156,7 +158,7 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        u8 *sadb;
        int sad_count;
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                return;
        offset = dig->afmt->pin->offset;
@@ -217,7 +219,7 @@ void dce6_afmt_write_sad_regs(struct drm_encoder *encoder)
                { AZ_F0_CODEC_PIN_CONTROL_AUDIO_DESCRIPTOR13, HDMI_AUDIO_CODING_TYPE_WMA_PRO },
        };
-        if (!dig->afmt->pin)
+        if (!dig || !dig->afmt || !dig->afmt->pin)
                return;
        offset = dig->afmt->pin->offset;
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index cdc003085a76..49c4d48f54d6 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -785,8 +785,8 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
        struct ni_ps *ps = ni_get_ps(rps);
        struct radeon_clock_and_voltage_limits *max_limits;
        bool disable_mclk_switching;
-        u32 mclk, sclk;
+        u32 mclk;
-        u16 vddc, vddci;
+        u16 vddci;
        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        int i;
@@ -839,24 +839,14 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
        /* XXX validate the min clocks required for display */
+        /* adjust low state */
        if (disable_mclk_switching) {
-                mclk  = ps->performance_levels[ps->performance_level_count - 1].mclk;
+                ps->performance_levels[0].mclk =
-                sclk = ps->performance_levels[0].sclk;
+                        ps->performance_levels[ps->performance_level_count - 1].mclk;
-                vddc = ps->performance_levels[0].vddc;
+                ps->performance_levels[0].vddci =
-                vddci = ps->performance_levels[ps->performance_level_count - 1].vddci;
+                        ps->performance_levels[ps->performance_level_count - 1].vddci;
-        } else {
-                sclk = ps->performance_levels[0].sclk;
-                mclk = ps->performance_levels[0].mclk;
-                vddc = ps->performance_levels[0].vddc;
-                vddci = ps->performance_levels[0].vddci;
        }
-        /* adjusted low state */
-        ps->performance_levels[0].sclk = sclk;
-        ps->performance_levels[0].mclk = mclk;
-        ps->performance_levels[0].vddc = vddc;
-        ps->performance_levels[0].vddci = vddci;
        btc_skip_blacklist_clocks(rdev, max_limits->sclk, max_limits->mclk,
                                  &ps->performance_levels[0].sclk,
                                  &ps->performance_levels[0].mclk);
@@ -868,11 +858,15 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
                        ps->performance_levels[i].vddc = ps->performance_levels[i - 1].vddc;
        }
+        /* adjust remaining states */
        if (disable_mclk_switching) {
                mclk = ps->performance_levels[0].mclk;
+                vddci = ps->performance_levels[0].vddci;
                for (i = 1; i < ps->performance_level_count; i++) {
                        if (mclk < ps->performance_levels[i].mclk)
                                mclk = ps->performance_levels[i].mclk;
+                        if (vddci < ps->performance_levels[i].vddci)
+                                vddci = ps->performance_levels[i].vddci;
                }
                for (i = 0; i < ps->performance_level_count; i++) {
                        ps->performance_levels[i].mclk = mclk;
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 4b89262f3f0e..b7d3ecba43e3 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -304,9 +304,9 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                        WREG32(DCCG_AUDIO_DTO1_MODULE, dto_modulo);
                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                }
-        } else if (ASIC_IS_DCE3(rdev)) {
+        } else {
                /* according to the reg specs, this should DCE3.2 only, but in
-                 * practice it seems to cover DCE3.0/3.1 as well.
+                 * practice it seems to cover DCE2.0/3.0/3.1 as well.
                 */
                if (dig->dig_encoder == 0) {
                        WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
@@ -317,10 +317,6 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                        WREG32(DCCG_AUDIO_DTO1_MODULE, clock * 100);
                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                }
-        } else {
-                /* according to the reg specs, this should be DCE2.0 and DCE3.0/3.1 */
-                WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
-                       AUDIO_DTO_MODULE(clock / 10));
        }
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index ecf2a3960c07..b1f990d0eaa1 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -2710,10 +2710,10 @@ void radeon_vm_fence(struct radeon_device *rdev,
                     struct radeon_vm *vm,
                     struct radeon_fence *fence);
 uint64_t radeon_vm_map_gart(struct radeon_device *rdev, uint64_t addr);
-int radeon_vm_bo_update_pte(struct radeon_device *rdev,
+int radeon_vm_bo_update(struct radeon_device *rdev,
-                            struct radeon_vm *vm,
+                        struct radeon_vm *vm,
-                            struct radeon_bo *bo,
+                        struct radeon_bo *bo,
-                            struct ttm_mem_reg *mem);
+                        struct ttm_mem_reg *mem);
 void radeon_vm_bo_invalidate(struct radeon_device *rdev,
                             struct radeon_bo *bo);
 struct radeon_bo_va *radeon_vm_bo_find(struct radeon_vm *vm,
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index f79ee184ffd5..5c39bf7c3d88 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2918,7 +2918,7 @@ int radeon_atom_get_memory_pll_dividers(struct radeon_device *rdev,
                        mpll_param->dll_speed = args.ucDllSpeed;
                        mpll_param->bwcntl = args.ucBWCntl;
                        mpll_param->vco_mode =
-                                (args.ucPllCntlFlag & MPLL_CNTL_FLAG_VCO_MODE_MASK) ? 1 : 0;
+                                (args.ucPllCntlFlag & MPLL_CNTL_FLAG_VCO_MODE_MASK);
                        mpll_param->yclk_sel =
                                (args.ucPllCntlFlag & MPLL_CNTL_FLAG_BYPASS_DQ_PLL) ? 1 : 0;
                        mpll_param->qdr =
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index f41594b2eeac..0b366169d64d 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -360,13 +360,13 @@ static int radeon_bo_vm_update_pte(struct radeon_cs_parser *parser,
        struct radeon_bo *bo;
        int r;
-        r = radeon_vm_bo_update_pte(rdev, vm, rdev->ring_tmp_bo.bo, &rdev->ring_tmp_bo.bo->tbo.mem);
+        r = radeon_vm_bo_update(rdev, vm, rdev->ring_tmp_bo.bo, &rdev->ring_tmp_bo.bo->tbo.mem);
        if (r) {
                return r;
        }
        list_for_each_entry(lobj, &parser->validated, tv.head) {
                bo = lobj->bo;
-                r = radeon_vm_bo_update_pte(parser->rdev, vm, bo, &bo->tbo.mem);
+                r = radeon_vm_bo_update(parser->rdev, vm, bo, &bo->tbo.mem);
                if (r) {
                        return r;
                }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 543dcfae7e6f..00e0d449021c 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -108,9 +108,10 @@
 * 1.31- Add support for num Z pipes from GET_PARAM
 * 1.32- fixes for rv740 setup
 * 1.33- Add r6xx/r7xx const buffer support
+ * 1.34- fix evergreen/cayman GS register
 */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            33
+#define DRIVER_MINOR            34
 #define DRIVER_PATCHLEVEL       0
 long radeon_drm_ioctl(struct file *filp,
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 3044e504f4ec..96e440061bdb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -29,6 +29,7 @@
 #include <drm/radeon_drm.h>
 #include "radeon.h"
 #include "radeon_reg.h"
+#include "radeon_trace.h"
 /*
 * GART
@@ -737,6 +738,7 @@ struct radeon_fence *radeon_vm_grab_id(struct radeon_device *rdev,
        for (i = 0; i < 2; ++i) {
                if (choices[i]) {
                        vm->id = choices[i];
+                        trace_radeon_vm_grab_id(vm->id, ring);
                        return rdev->vm_manager.active[choices[i]];
                }
        }
@@ -1116,7 +1118,7 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
 }
 /**
- * radeon_vm_bo_update_pte - map a bo into the vm page table
+ * radeon_vm_bo_update - map a bo into the vm page table
 *
 * @rdev: radeon_device pointer
 * @vm: requested vm
@@ -1128,10 +1130,10 @@ static void radeon_vm_update_ptes(struct radeon_device *rdev,
 *
 * Object have to be reserved & global and local mutex must be locked!
 */
-int radeon_vm_bo_update_pte(struct radeon_device *rdev,
+int radeon_vm_bo_update(struct radeon_device *rdev,
-                            struct radeon_vm *vm,
+                        struct radeon_vm *vm,
-                            struct radeon_bo *bo,
+                        struct radeon_bo *bo,
-                            struct ttm_mem_reg *mem)
+                        struct ttm_mem_reg *mem)
 {
        struct radeon_ib ib;
        struct radeon_bo_va *bo_va;
@@ -1176,6 +1178,8 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
                bo_va->valid = false;
        }
+        trace_radeon_vm_bo_update(bo_va);
        nptes = radeon_bo_ngpu_pages(bo);
        /* assume two extra pdes in case the mapping overlaps the borders */
@@ -1257,7 +1261,7 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
        mutex_lock(&rdev->vm_manager.lock);
        mutex_lock(&bo_va->vm->mutex);
        if (bo_va->soffset) {
-                r = radeon_vm_bo_update_pte(rdev, bo_va->vm, bo_va->bo, NULL);
+                r = radeon_vm_bo_update(rdev, bo_va->vm, bo_va->bo, NULL);
        }
        mutex_unlock(&rdev->vm_manager.lock);
        list_del(&bo_va->vm_list);
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index d1385ccc672c..dc75bb603ea5 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -537,8 +537,7 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
                                      struct device_attribute *attr,
                                      char *buf)
 {
-        struct drm_device *ddev = dev_get_drvdata(dev);
+        struct radeon_device *rdev = dev_get_drvdata(dev);
-        struct radeon_device *rdev = ddev->dev_private;
        int temp;
        if (rdev->asic->pm.get_temperature)
@@ -566,23 +565,14 @@ static ssize_t radeon_hwmon_show_temp_thresh(struct device *dev,
        return snprintf(buf, PAGE_SIZE, "%d\n", temp);
 }
-static ssize_t radeon_hwmon_show_name(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
-{
-        return sprintf(buf, "radeon\n");
-}
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, radeon_hwmon_show_temp, NULL, 0);
 static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 0);
 static SENSOR_DEVICE_ATTR(temp1_crit_hyst, S_IRUGO, radeon_hwmon_show_temp_thresh, NULL, 1);
-static SENSOR_DEVICE_ATTR(name, S_IRUGO, radeon_hwmon_show_name, NULL, 0);
 static struct attribute *hwmon_attributes[] = {
        &sensor_dev_attr_temp1_input.dev_attr.attr,
        &sensor_dev_attr_temp1_crit.dev_attr.attr,
        &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr,
-        &sensor_dev_attr_name.dev_attr.attr,
        NULL
 };
@@ -607,11 +597,15 @@ static const struct attribute_group hwmon_attrgroup = {
        .is_visible = hwmon_attributes_visible,
 };
+static const struct attribute_group *hwmon_groups[] = {
+        &hwmon_attrgroup,
+        NULL
+};
 static int radeon_hwmon_init(struct radeon_device *rdev)
 {
        int err = 0;
+        struct device *hwmon_dev;
-        rdev->pm.int_hwmon_dev = NULL;
        switch (rdev->pm.int_thermal_type) {
        case THERMAL_TYPE_RV6XX:
@@ -624,20 +618,13 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
        case THERMAL_TYPE_KV:
                if (rdev->asic->pm.get_temperature == NULL)
                        return err;
-                rdev->pm.int_hwmon_dev = hwmon_device_register(rdev->dev);
+                hwmon_dev = hwmon_device_register_with_groups(rdev->dev,
-                if (IS_ERR(rdev->pm.int_hwmon_dev)) {
+                                                              "radeon", rdev,
-                        err = PTR_ERR(rdev->pm.int_hwmon_dev);
+                                                              hwmon_groups);
+                if (IS_ERR(hwmon_dev)) {
+                        err = PTR_ERR(hwmon_dev);
                        dev_err(rdev->dev,
                                "Unable to register hwmon device: %d\n", err);
-                        break;
-                }
-                dev_set_drvdata(rdev->pm.int_hwmon_dev, rdev->ddev);
-                err = sysfs_create_group(&rdev->pm.int_hwmon_dev->kobj,
-                                         &hwmon_attrgroup);
-                if (err) {
-                        dev_err(rdev->dev,
-                                "Unable to create hwmon sysfs file: %d\n", err);
-                        hwmon_device_unregister(rdev->dev);
                }
                break;
        default:
@@ -647,14 +634,6 @@ static int radeon_hwmon_init(struct radeon_device *rdev)
        return err;
 }
-static void radeon_hwmon_fini(struct radeon_device *rdev)
-{
-        if (rdev->pm.int_hwmon_dev) {
-                sysfs_remove_group(&rdev->pm.int_hwmon_dev->kobj, &hwmon_attrgroup);
-                hwmon_device_unregister(rdev->pm.int_hwmon_dev);
-        }
-}
 static void radeon_dpm_thermal_work_handler(struct work_struct *work)
 {
        struct radeon_device *rdev =
@@ -1337,8 +1316,6 @@ static void radeon_pm_fini_old(struct radeon_device *rdev)
        if (rdev->pm.power_state)
                kfree(rdev->pm.power_state);
-        radeon_hwmon_fini(rdev);
 }
 static void radeon_pm_fini_dpm(struct radeon_device *rdev)
@@ -1358,8 +1335,6 @@ static void radeon_pm_fini_dpm(struct radeon_device *rdev)
        if (rdev->pm.power_state)
                kfree(rdev->pm.power_state);
-        radeon_hwmon_fini(rdev);
 }
 void radeon_pm_fini(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/radeon_trace.h b/drivers/gpu/drm/radeon/radeon_trace.h
index 9f0e18172b6e..0473257d4078 100644
--- a/drivers/gpu/drm/radeon/radeon_trace.h
+++ b/drivers/gpu/drm/radeon/radeon_trace.h
@@ -47,6 +47,39 @@ TRACE_EVENT(radeon_cs,
                      __entry->fences)
 );
+TRACE_EVENT(radeon_vm_grab_id,
+            TP_PROTO(unsigned vmid, int ring),
+            TP_ARGS(vmid, ring),
+            TP_STRUCT__entry(
+                             __field(u32, vmid)
+                             __field(u32, ring)
+                             ),
+            TP_fast_assign(
+                           __entry->vmid = vmid;
+                           __entry->ring = ring;
+                           ),
+            TP_printk("vmid=%u, ring=%u", __entry->vmid, __entry->ring)
+);
+TRACE_EVENT(radeon_vm_bo_update,
+            TP_PROTO(struct radeon_bo_va *bo_va),
+            TP_ARGS(bo_va),
+            TP_STRUCT__entry(
+                             __field(u64, soffset)
+                             __field(u64, eoffset)
+                             __field(u32, flags)
+                             ),
+            TP_fast_assign(
+                           __entry->soffset = bo_va->soffset;
+                           __entry->eoffset = bo_va->eoffset;
+                           __entry->flags = bo_va->flags;
+                           ),
+            TP_printk("soffs=%010llx, eoffs=%010llx, flags=%08x",
+                      __entry->soffset, __entry->eoffset, __entry->flags)
+);
 TRACE_EVENT(radeon_vm_set_page,
            TP_PROTO(uint64_t pe, uint64_t addr, unsigned count,
                     uint32_t incr, uint32_t flags),
diff --git a/drivers/gpu/drm/radeon/reg_srcs/cayman b/drivers/gpu/drm/radeon/reg_srcs/cayman
index a072fa8c46b0..d46b58d078aa 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/cayman
+++ b/drivers/gpu/drm/radeon/reg_srcs/cayman
@@ -21,7 +21,7 @@ cayman 0x9400
 0x000089AC VGT_COMPUTE_THREAD_GOURP_SIZE
 0x000089B0 VGT_HS_OFFCHIP_PARAM
 0x00008A14 PA_CL_ENHANCE
-0x00008A60 PA_SC_LINE_STIPPLE_VALUE
+0x00008A60 PA_SU_LINE_STIPPLE_VALUE
 0x00008B10 PA_SC_LINE_STIPPLE_STATE
 0x00008BF0 PA_SC_ENHANCE
 0x00008D8C SQ_DYN_GPR_CNTL_PS_FLUSH_REQ
@@ -532,7 +532,7 @@ cayman 0x9400
 0x00028B84 PA_SU_POLY_OFFSET_FRONT_OFFSET
 0x00028B88 PA_SU_POLY_OFFSET_BACK_SCALE
 0x00028B8C PA_SU_POLY_OFFSET_BACK_OFFSET
-0x00028B74 VGT_GS_INSTANCE_CNT
+0x00028B90 VGT_GS_INSTANCE_CNT
 0x00028BD4 PA_SC_CENTROID_PRIORITY_0
 0x00028BD8 PA_SC_CENTROID_PRIORITY_1
 0x00028BDC PA_SC_LINE_CNTL
diff --git a/drivers/gpu/drm/radeon/reg_srcs/evergreen b/drivers/gpu/drm/radeon/reg_srcs/evergreen
index b912a37689bf..57745c8761c8 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/evergreen
+++ b/drivers/gpu/drm/radeon/reg_srcs/evergreen
@@ -22,7 +22,7 @@ evergreen 0x9400
 0x000089A4 VGT_COMPUTE_START_Z
 0x000089AC VGT_COMPUTE_THREAD_GOURP_SIZE
 0x00008A14 PA_CL_ENHANCE
-0x00008A60 PA_SC_LINE_STIPPLE_VALUE
+0x00008A60 PA_SU_LINE_STIPPLE_VALUE
 0x00008B10 PA_SC_LINE_STIPPLE_STATE
 0x00008BF0 PA_SC_ENHANCE
 0x00008D8C SQ_DYN_GPR_CNTL_PS_FLUSH_REQ
@@ -545,7 +545,7 @@ evergreen 0x9400
 0x00028B84 PA_SU_POLY_OFFSET_FRONT_OFFSET
 0x00028B88 PA_SU_POLY_OFFSET_BACK_SCALE
 0x00028B8C PA_SU_POLY_OFFSET_BACK_OFFSET
-0x00028B74 VGT_GS_INSTANCE_CNT
+0x00028B90 VGT_GS_INSTANCE_CNT
 0x00028C00 PA_SC_LINE_CNTL
 0x00028C08 PA_SU_VTX_CNTL
 0x00028C0C PA_CL_GB_VERT_CLIP_ADJ
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 6a64ccaa0695..a36736dab5e0 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3882,8 +3882,15 @@ static int si_mc_init(struct radeon_device *rdev)
        rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
        rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
        /* size in MB on si */
-        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
+        tmp = RREG32(CONFIG_MEMSIZE);
-        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
+        /* some boards may have garbage in the upper 16 bits */
+        if (tmp & 0xffff0000) {
+                DRM_INFO("Probable bad vram size: 0x%08x\n", tmp);
+                if (tmp & 0xffff)
+                        tmp &= 0xffff;
+        }
+        rdev->mc.mc_vram_size = tmp * 1024ULL * 1024ULL;
+        rdev->mc.real_vram_size = rdev->mc.mc_vram_size;
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
        si_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 28e178137718..07eba596d458 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -135,11 +135,11 @@ int tegra_drm_submit(struct tegra_drm_context *context,
        unsigned int num_relocs = args->num_relocs;
        unsigned int num_waitchks = args->num_waitchks;
        struct drm_tegra_cmdbuf __user *cmdbufs =
-                (void * __user)(uintptr_t)args->cmdbufs;
+                (void __user *)(uintptr_t)args->cmdbufs;
        struct drm_tegra_reloc __user *relocs =
-                (void * __user)(uintptr_t)args->relocs;
+                (void __user *)(uintptr_t)args->relocs;
        struct drm_tegra_waitchk __user *waitchks =
-                (void * __user)(uintptr_t)args->waitchks;
+                (void __user *)(uintptr_t)args->waitchks;
        struct drm_tegra_syncpt syncpt;
        struct host1x_job *job;
        int err;
@@ -163,9 +163,10 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                struct drm_tegra_cmdbuf cmdbuf;
                struct host1x_bo *bo;
-                err = copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf));
+                if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
-                if (err)
+                        err = -EFAULT;
                        goto fail;
+                }
                bo = host1x_bo_lookup(drm, file, cmdbuf.handle);
                if (!bo) {
@@ -178,10 +179,11 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                cmdbufs++;
        }
-        err = copy_from_user(job->relocarray, relocs,
+        if (copy_from_user(job->relocarray, relocs,
-                             sizeof(*relocs) * num_relocs);
+                           sizeof(*relocs) * num_relocs)) {
-        if (err)
+                err = -EFAULT;
                goto fail;
+        }
        while (num_relocs--) {
                struct host1x_reloc *reloc = &job->relocarray[num_relocs];
@@ -199,15 +201,17 @@ int tegra_drm_submit(struct tegra_drm_context *context,
                }
        }
-        err = copy_from_user(job->waitchk, waitchks,
+        if (copy_from_user(job->waitchk, waitchks,
-                             sizeof(*waitchks) * num_waitchks);
+                           sizeof(*waitchks) * num_waitchks)) {
-        if (err)
+                err = -EFAULT;
                goto fail;
+        }
-        err = copy_from_user(&syncpt, (void * __user)(uintptr_t)args->syncpts,
+        if (copy_from_user(&syncpt, (void __user *)(uintptr_t)args->syncpts,
-                             sizeof(syncpt));
+                           sizeof(syncpt))) {
-        if (err)
+                err = -EFAULT;
                goto fail;
+        }
        job->is_addr_reg = context->client->ops->is_addr_reg;
        job->syncpt_incrs = syncpt.incrs;
@@ -573,7 +577,7 @@ static void tegra_debugfs_cleanup(struct drm_minor *minor)
 }
 #endif
-struct drm_driver tegra_drm_driver = {
+static struct drm_driver tegra_drm_driver = {
        .driver_features = DRIVER_MODESET | DRIVER_GEM,
        .load = tegra_drm_load,
        .unload = tegra_drm_unload,
diff --git a/drivers/gpu/drm/tegra/drm.h b/drivers/gpu/drm/tegra/drm.h
index fdfe259ed7f8..7da0b923131f 100644
--- a/drivers/gpu/drm/tegra/drm.h
+++ b/drivers/gpu/drm/tegra/drm.h
@@ -116,7 +116,7 @@ host1x_client_to_dc(struct host1x_client *client)
 static inline struct tegra_dc *to_tegra_dc(struct drm_crtc *crtc)
 {
-        return container_of(crtc, struct tegra_dc, base);
+        return crtc ? container_of(crtc, struct tegra_dc, base) : NULL;
 }
 static inline void tegra_dc_writel(struct tegra_dc *dc, unsigned long value,
diff --git a/drivers/gpu/drm/tegra/fb.c b/drivers/gpu/drm/tegra/fb.c
index 490f7719e317..a3835e7de184 100644
--- a/drivers/gpu/drm/tegra/fb.c
+++ b/drivers/gpu/drm/tegra/fb.c
@@ -247,7 +247,7 @@ static int tegra_fbdev_probe(struct drm_fb_helper *helper,
                 info->var.yoffset * fb->pitches[0];
        drm->mode_config.fb_base = (resource_size_t)bo->paddr;
-        info->screen_base = bo->vaddr + offset;
+        info->screen_base = (void __iomem *)bo->vaddr + offset;
        info->screen_size = size;
        info->fix.smem_start = (unsigned long)(bo->paddr + offset);
        info->fix.smem_len = size;
diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
index ba47ca4fb880..3b29018913a5 100644
--- a/drivers/gpu/drm/tegra/rgb.c
+++ b/drivers/gpu/drm/tegra/rgb.c
@@ -14,6 +14,8 @@
 struct tegra_rgb {
        struct tegra_output output;
+        struct tegra_dc *dc;
        struct clk *clk_parent;
        struct clk *clk;
 };
@@ -84,18 +86,18 @@ static void tegra_dc_write_regs(struct tegra_dc *dc,
 static int tegra_output_rgb_enable(struct tegra_output *output)
 {
-        struct tegra_dc *dc = to_tegra_dc(output->encoder.crtc);
+        struct tegra_rgb *rgb = to_rgb(output);
-        tegra_dc_write_regs(dc, rgb_enable, ARRAY_SIZE(rgb_enable));
+        tegra_dc_write_regs(rgb->dc, rgb_enable, ARRAY_SIZE(rgb_enable));
        return 0;
 }
 static int tegra_output_rgb_disable(struct tegra_output *output)
 {
-        struct tegra_dc *dc = to_tegra_dc(output->encoder.crtc);
+        struct tegra_rgb *rgb = to_rgb(output);
-        tegra_dc_write_regs(dc, rgb_disable, ARRAY_SIZE(rgb_disable));
+        tegra_dc_write_regs(rgb->dc, rgb_disable, ARRAY_SIZE(rgb_disable));
        return 0;
 }
@@ -146,6 +148,7 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
        rgb->output.dev = dc->dev;
        rgb->output.of_node = np;
+        rgb->dc = dc;
        err = tegra_output_probe(&rgb->output);
        if (err < 0)
diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
index 24ffbe990736..8d67b943ac05 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -125,6 +125,12 @@ static int udl_gem_get_pages(struct udl_gem_object *obj, gfp_t gfpmask)
 static void udl_gem_put_pages(struct udl_gem_object *obj)
 {
+        if (obj->base.import_attach) {
+                drm_free_large(obj->pages);
+                obj->pages = NULL;
+                return;
+        }
        drm_gem_put_pages(&obj->base, obj->pages, false, false);
        obj->pages = NULL;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
index 7776e6f0aef6..0489c6152482 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
@@ -150,6 +150,8 @@ struct vmw_ttm_tt {
        bool mapped;
 };
+const size_t vmw_tt_size = sizeof(struct vmw_ttm_tt);
 /**
 * Helper functions to advance a struct vmw_piter iterator.
 *
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index db85985c7086..20890ad8408b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -615,6 +615,7 @@ extern int vmw_mmap(struct file *filp, struct vm_area_struct *vma);
 * TTM buffer object driver - vmwgfx_buffer.c
 */
+extern const size_t vmw_tt_size;
 extern struct ttm_placement vmw_vram_placement;
 extern struct ttm_placement vmw_vram_ne_placement;
 extern struct ttm_placement vmw_vram_sys_placement;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ecb3d867b426..03f1c2038631 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -75,6 +75,7 @@ void vmw_display_unit_cleanup(struct vmw_display_unit *du)
                vmw_surface_unreference(&du->cursor_surface);
        if (du->cursor_dmabuf)
                vmw_dmabuf_unreference(&du->cursor_dmabuf);
+        drm_sysfs_connector_remove(&du->connector);
        drm_crtc_cleanup(&du->crtc);
        drm_encoder_cleanup(&du->encoder);
        drm_connector_cleanup(&du->connector);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 79f7e8e60529..a055a26819c2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -260,6 +260,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
                connector->encoder = NULL;
                encoder->crtc = NULL;
                crtc->fb = NULL;
+                crtc->enabled = false;
                vmw_ldu_del_active(dev_priv, ldu);
@@ -285,6 +286,7 @@ static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
        crtc->x = set->x;
        crtc->y = set->y;
        crtc->mode = *mode;
+        crtc->enabled = true;
        vmw_ldu_add_active(dev_priv, ldu, vfb);
@@ -369,6 +371,8 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
        encoder->possible_crtcs = (1 << unit);
        encoder->possible_clones = 0;
+        (void) drm_sysfs_connector_add(connector);
        drm_crtc_init(dev, crtc, &vmw_legacy_crtc_funcs);
        drm_mode_crtc_set_gamma_size(crtc, 256);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index efe2b74c5eb1..9b5ea2ac7ddf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -352,6 +352,38 @@ int vmw_user_lookup_handle(struct vmw_private *dev_priv,
 /**
 * Buffer management.
 */
+/**
+ * vmw_dmabuf_acc_size - Calculate the pinned memory usage of buffers
+ *
+ * @dev_priv: Pointer to a struct vmw_private identifying the device.
+ * @size: The requested buffer size.
+ * @user: Whether this is an ordinary dma buffer or a user dma buffer.
+ */
+static size_t vmw_dmabuf_acc_size(struct vmw_private *dev_priv, size_t size,
+                                  bool user)
+{
+        static size_t struct_size, user_struct_size;
+        size_t num_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+        size_t page_array_size = ttm_round_pot(num_pages * sizeof(void *));
+        if (unlikely(struct_size == 0)) {
+                size_t backend_size = ttm_round_pot(vmw_tt_size);
+                struct_size = backend_size +
+                        ttm_round_pot(sizeof(struct vmw_dma_buffer));
+                user_struct_size = backend_size +
+                        ttm_round_pot(sizeof(struct vmw_user_dma_buffer));
+        }
+        if (dev_priv->map_mode == vmw_dma_alloc_coherent)
+                page_array_size +=
+                        ttm_round_pot(num_pages * sizeof(dma_addr_t));
+        return ((user) ? user_struct_size : struct_size) +
+                page_array_size;
+}
 void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
 {
        struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
@@ -359,6 +391,13 @@ void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
        kfree(vmw_bo);
 }
+static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
+{
+        struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
+        ttm_prime_object_kfree(vmw_user_bo, prime);
+}
 int vmw_dmabuf_init(struct vmw_private *dev_priv,
                    struct vmw_dma_buffer *vmw_bo,
                    size_t size, struct ttm_placement *placement,
@@ -368,28 +407,23 @@ int vmw_dmabuf_init(struct vmw_private *dev_priv,
        struct ttm_bo_device *bdev = &dev_priv->bdev;
        size_t acc_size;
        int ret;
+        bool user = (bo_free == &vmw_user_dmabuf_destroy);
-        BUG_ON(!bo_free);
+        BUG_ON(!bo_free && (!user && (bo_free != vmw_dmabuf_bo_free)));
-        acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct vmw_dma_buffer));
+        acc_size = vmw_dmabuf_acc_size(dev_priv, size, user);
        memset(vmw_bo, 0, sizeof(*vmw_bo));
        INIT_LIST_HEAD(&vmw_bo->res_list);
        ret = ttm_bo_init(bdev, &vmw_bo->base, size,
-                          ttm_bo_type_device, placement,
+                          (user) ? ttm_bo_type_device :
+                          ttm_bo_type_kernel, placement,
                          0, interruptible,
                          NULL, acc_size, NULL, bo_free);
        return ret;
 }
-static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
-{
-        struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
-        ttm_prime_object_kfree(vmw_user_bo, prime);
-}
 static void vmw_user_dmabuf_release(struct ttm_base_object **p_base)
 {
        struct vmw_user_dma_buffer *vmw_user_bo;
@@ -781,54 +815,55 @@ err_ref:
 }
+/**
+ * vmw_dumb_create - Create a dumb kms buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @args: Pointer to a struct drm_mode_create_dumb structure
+ *
+ * This is a driver callback for the core drm create_dumb functionality.
+ * Note that this is very similar to the vmw_dmabuf_alloc ioctl, except
+ * that the arguments have a different format.
+ */
 int vmw_dumb_create(struct drm_file *file_priv,
                    struct drm_device *dev,
                    struct drm_mode_create_dumb *args)
 {
        struct vmw_private *dev_priv = vmw_priv(dev);
        struct vmw_master *vmaster = vmw_master(file_priv->master);
-        struct vmw_user_dma_buffer *vmw_user_bo;
+        struct vmw_dma_buffer *dma_buf;
-        struct ttm_buffer_object *tmp;
        int ret;
        args->pitch = args->width * ((args->bpp + 7) / 8);
        args->size = args->pitch * args->height;
-        vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
-        if (vmw_user_bo == NULL)
-                return -ENOMEM;
        ret = ttm_read_lock(&vmaster->lock, true);
-        if (ret != 0) {
+        if (unlikely(ret != 0))
-                kfree(vmw_user_bo);
                return ret;
-        }
-        ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
+        ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
-                              &vmw_vram_sys_placement, true,
+                                    args->size, false, &args->handle,
-                              &vmw_user_dmabuf_destroy);
+                                    &dma_buf);
-        if (ret != 0)
-                goto out_no_dmabuf;
-        tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
-        ret = ttm_prime_object_init(vmw_fpriv(file_priv)->tfile,
-                                    args->size,
-                                    &vmw_user_bo->prime,
-                                    false,
-                                    ttm_buffer_type,
-                                    &vmw_user_dmabuf_release, NULL);
        if (unlikely(ret != 0))
-                goto out_no_base_object;
+                goto out_no_dmabuf;
-        args->handle = vmw_user_bo->prime.base.hash.key;
-out_no_base_object:
+        vmw_dmabuf_unreference(&dma_buf);
-        ttm_bo_unref(&tmp);
 out_no_dmabuf:
        ttm_read_unlock(&vmaster->lock);
        return ret;
 }
+/**
+ * vmw_dumb_map_offset - Return the address space offset of a dumb buffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @handle: Handle identifying the dumb buffer.
+ * @offset: The address space offset returned.
+ *
+ * This is a driver callback for the core drm dumb_map_offset functionality.
+ */
 int vmw_dumb_map_offset(struct drm_file *file_priv,
                        struct drm_device *dev, uint32_t handle,
                        uint64_t *offset)
@@ -846,6 +881,15 @@ int vmw_dumb_map_offset(struct drm_file *file_priv,
        return 0;
 }
+/**
+ * vmw_dumb_destroy - Destroy a dumb boffer
+ *
+ * @file_priv: Pointer to a struct drm_file identifying the caller.
+ * @dev: Pointer to the drm device.
+ * @handle: Handle identifying the dumb buffer.
+ *
+ * This is a driver callback for the core drm dumb_destroy functionality.
+ */
 int vmw_dumb_destroy(struct drm_file *file_priv,
                     struct drm_device *dev,
                     uint32_t handle)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index 26387c3d5a21..22406c8651ea 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -310,6 +310,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
                crtc->fb = NULL;
                crtc->x = 0;
                crtc->y = 0;
+                crtc->enabled = false;
                vmw_sou_del_active(dev_priv, sou);
@@ -370,6 +371,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
                crtc->fb = NULL;
                crtc->x = 0;
                crtc->y = 0;
+                crtc->enabled = false;
                return ret;
        }
@@ -382,6 +384,7 @@ static int vmw_sou_crtc_set_config(struct drm_mode_set *set)
        crtc->fb = fb;
        crtc->x = set->x;
        crtc->y = set->y;
+        crtc->enabled = true;
        return 0;
 }
@@ -464,6 +467,8 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
        encoder->possible_crtcs = (1 << unit);
        encoder->possible_clones = 0;
+        (void) drm_sysfs_connector_add(connector);
        drm_crtc_init(dev, crtc, &vmw_screen_object_crtc_funcs);
        drm_mode_crtc_set_gamma_size(crtc, 256);
diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 509383f8be03..6a929591aa73 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -19,6 +19,7 @@
 #include <linux/of.h>
 #include <linux/slab.h>
+#include "bus.h"
 #include "dev.h"
 static DEFINE_MUTEX(clients_lock);
@@ -257,7 +258,7 @@ static int host1x_unregister_client(struct host1x *host1x,
        return -ENODEV;
 }
-struct bus_type host1x_bus_type = {
+static struct bus_type host1x_bus_type = {
        .name = "host1x",
 };
@@ -301,7 +302,7 @@ static int host1x_device_add(struct host1x *host1x,
        device->dev.coherent_dma_mask = host1x->dev->coherent_dma_mask;
        device->dev.dma_mask = &device->dev.coherent_dma_mask;
        device->dev.release = host1x_device_release;
-        dev_set_name(&device->dev, driver->name);
+        dev_set_name(&device->dev, "%s", driver->name);
        device->dev.bus = &host1x_bus_type;
        device->dev.parent = host1x->dev;
diff --git a/drivers/gpu/host1x/hw/cdma_hw.c b/drivers/gpu/host1x/hw/cdma_hw.c
index 37e2a63241a9..6b09b71940c2 100644
--- a/drivers/gpu/host1x/hw/cdma_hw.c
+++ b/drivers/gpu/host1x/hw/cdma_hw.c
@@ -54,8 +54,8 @@ static void cdma_timeout_cpu_incr(struct host1x_cdma *cdma, u32 getptr,
                u32 *p = (u32 *)((u32)pb->mapped + getptr);
                *(p++) = HOST1X_OPCODE_NOP;
                *(p++) = HOST1X_OPCODE_NOP;
-                dev_dbg(host1x->dev, "%s: NOP at 0x%x\n", __func__,
+                dev_dbg(host1x->dev, "%s: NOP at %#llx\n", __func__,
-                        pb->phys + getptr);
+                        (u64)pb->phys + getptr);
                getptr = (getptr + 8) & (pb->size_bytes - 1);
        }
        wmb();
diff --git a/drivers/gpu/host1x/hw/debug_hw.c b/drivers/gpu/host1x/hw/debug_hw.c
index 640c75ca5a8b..f72c873eff81 100644
--- a/drivers/gpu/host1x/hw/debug_hw.c
+++ b/drivers/gpu/host1x/hw/debug_hw.c
@@ -163,8 +163,8 @@ static void show_channel_gathers(struct output *o, struct host1x_cdma *cdma)
                                continue;
                        }
-                        host1x_debug_output(o, "    GATHER at %08x+%04x, %d words\n",
+                        host1x_debug_output(o, "    GATHER at %#llx+%04x, %d words\n",
-                                            g->base, g->offset, g->words);
+                                            (u64)g->base, g->offset, g->words);
                        show_gather(o, g->base + g->offset, g->words, cdma,
                                    g->base, mapped);
diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
index ecb5ca669e97..e77696367591 100644
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -341,6 +341,7 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
        case USB_DEVICE_ID_GENIUS_GX_IMPERATOR:
                rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83,
                                        "Genius Gx Imperator Keyboard");
+                break;
        case USB_DEVICE_ID_GENIUS_MANTICORE:
                rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
                                        "Genius Manticore Keyboard");
diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index a184e1921c11..8fab82829f8b 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -112,13 +112,15 @@ static int sensor_hub_get_physical_device_count(
 static void sensor_hub_fill_attr_info(
                struct hid_sensor_hub_attribute_info *info,
-                s32 index, s32 report_id, s32 units, s32 unit_expo, s32 size)
+                s32 index, s32 report_id, struct hid_field *field)
 {
        info->index = index;
        info->report_id = report_id;
-        info->units = units;
+        info->units = field->unit;
-        info->unit_expo = unit_expo;
+        info->unit_expo = field->unit_exponent;
-        info->size = size/8;
+        info->size = (field->report_size * field->report_count)/8;
+        info->logical_minimum = field->logical_minimum;
+        info->logical_maximum = field->logical_maximum;
 }
 static struct hid_sensor_hub_callbacks *sensor_hub_get_callback(
@@ -325,9 +327,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
                        if (field->physical == usage_id &&
                                field->logical == attr_usage_id) {
                                sensor_hub_fill_attr_info(info, i, report->id,
-                                        field->unit, field->unit_exponent,
+                                                          field);
-                                        field->report_size *
-                                                        field->report_count);
                                ret = 0;
                        } else {
                                for (j = 0; j < field->maxusage; ++j) {
@@ -336,11 +336,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
                                        field->usage[j].collection_index ==
                                        collection_index) {
                                                sensor_hub_fill_attr_info(info,
-                                                        i, report->id,
+                                                          i, report->id, field);
-                                                        field->unit,
-                                                        field->unit_exponent,
-                                                        field->report_size *
-                                                        field->report_count);
                                                ret = 0;
                                                break;
                                        }
@@ -573,6 +569,8 @@ static int sensor_hub_probe(struct hid_device *hdev,
                                        goto err_free_names;
                        }
                        sd->hid_sensor_hub_client_devs[
+                                sd->hid_sensor_client_cnt].id = PLATFORM_DEVID_AUTO;
+                        sd->hid_sensor_hub_client_devs[
                                sd->hid_sensor_client_cnt].name = name;
                        sd->hid_sensor_hub_client_devs[
                                sd->hid_sensor_client_cnt].platform_data =
diff --git a/drivers/hwmon/hih6130.c b/drivers/hwmon/hih6130.c
index 2dc37c7c6947..7d68a08baaa8 100644
--- a/drivers/hwmon/hih6130.c
+++ b/drivers/hwmon/hih6130.c
@@ -43,6 +43,7 @@
 * @last_update: time of last update (jiffies)
 * @temperature: cached temperature measurement value
 * @humidity: cached humidity measurement value
+ * @write_length: length for I2C measurement request
 */
 struct hih6130 {
        struct device *hwmon_dev;
@@ -51,6 +52,7 @@ struct hih6130 {
        unsigned long last_update;
        int temperature;
        int humidity;
+        size_t write_length;
 };
 /**
@@ -121,8 +123,15 @@ static int hih6130_update_measurements(struct i2c_client *client)
         */
        if (time_after(jiffies, hih6130->last_update + HZ) || !hih6130->valid) {
-                /* write to slave address, no data, to request a measurement */
+                /*
-                ret = i2c_master_send(client, tmp, 0);
+                 * Write to slave address to request a measurement.
+                 * According with the datasheet it should be with no data, but
+                 * for systems with I2C bus drivers that do not allow zero
+                 * length packets we write one dummy byte to allow sensor
+                 * measurements on them.
+                 */
+                tmp[0] = 0;
+                ret = i2c_master_send(client, tmp, hih6130->write_length);
                if (ret < 0)
                        goto out;
@@ -252,6 +261,9 @@ static int hih6130_probe(struct i2c_client *client,
                goto fail_remove_sysfs;
        }
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_QUICK))
+                hih6130->write_length = 1;
        return 0;
 fail_remove_sysfs:
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index 6cf6bff79003..a2f3b4a365e4 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -94,6 +94,8 @@ static inline u8 FAN_TO_REG(long rpm, int div)
 {
        if (rpm <= 0)
                return 255;
+        if (rpm > 1350000)
+                return 1;
        return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
 }
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 4c4c1421bf28..8b8f3aa49726 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -1610,12 +1610,14 @@ static int lm90_probe(struct i2c_client *client,
                                                "lm90", client);
                if (err < 0) {
                        dev_err(dev, "cannot request IRQ %d\n", client->irq);
-                        goto exit_remove_files;
+                        goto exit_unregister;
                }
        }
        return 0;
+exit_unregister:
+        hwmon_device_unregister(data->hwmon_dev);
 exit_remove_files:
        lm90_remove_files(client, data);
 exit_restore:
diff --git a/drivers/hwmon/sis5595.c b/drivers/hwmon/sis5595.c
index 1404e6319deb..72a889702f0d 100644
--- a/drivers/hwmon/sis5595.c
+++ b/drivers/hwmon/sis5595.c
@@ -141,6 +141,8 @@ static inline u8 FAN_TO_REG(long rpm, int div)
 {
        if (rpm <= 0)
                return 255;
+        if (rpm > 1350000)
+                return 1;
        return clamp_val((1350000 + rpm * div / 2) / (rpm * div), 1, 254);
 }
diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c
index 0e7017841f7d..aee14e2192f8 100644
--- a/drivers/hwmon/vt8231.c
+++ b/drivers/hwmon/vt8231.c
@@ -145,7 +145,7 @@ static const u8 regtempmin[] = { 0x3a, 0x3e, 0x2c, 0x2e, 0x30, 0x32 };
 */
 static inline u8 FAN_TO_REG(long rpm, int div)
 {
-        if (rpm == 0)
+        if (rpm <= 0 || rpm > 1310720)
                return 0;
        return clamp_val(1310720 / (rpm * div), 1, 255);
 }
diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index edb06cda5a68..6ed76ceb9270 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -481,9 +481,11 @@ store_pwm(struct device *dev, struct device_attribute *attr,
        if (err)
                return err;
        val = clamp_val(val, 0, 255);
+        val = DIV_ROUND_CLOSEST(val, 0x11);
        mutex_lock(&data->update_lock);
-        data->pwm[nr] = val;
+        data->pwm[nr] = val * 0x11;
+        val |= w83l786ng_read_value(client, W83L786NG_REG_PWM[nr]) & 0xf0;
        w83l786ng_write_value(client, W83L786NG_REG_PWM[nr], val);
        mutex_unlock(&data->update_lock);
        return count;
@@ -510,7 +512,7 @@ store_pwm_enable(struct device *dev, struct device_attribute *attr,
        mutex_lock(&data->update_lock);
        reg = w83l786ng_read_value(client, W83L786NG_REG_FAN_CFG);
        data->pwm_enable[nr] = val;
-        reg &= ~(0x02 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
+        reg &= ~(0x03 << W83L786NG_PWM_ENABLE_SHIFT[nr]);
        reg |= (val - 1) << W83L786NG_PWM_ENABLE_SHIFT[nr];
        w83l786ng_write_value(client, W83L786NG_REG_FAN_CFG, reg);
        mutex_unlock(&data->update_lock);
@@ -776,9 +778,10 @@ static struct w83l786ng_data *w83l786ng_update_device(struct device *dev)
                            ((pwmcfg >> W83L786NG_PWM_MODE_SHIFT[i]) & 1)
                            ? 0 : 1;
                        data->pwm_enable[i] =
-                            ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 2) + 1;
+                            ((pwmcfg >> W83L786NG_PWM_ENABLE_SHIFT[i]) & 3) + 1;
-                        data->pwm[i] = w83l786ng_read_value(client,
+                        data->pwm[i] =
-                            W83L786NG_REG_PWM[i]);
+                            (w83l786ng_read_value(client, W83L786NG_REG_PWM[i])
+                             & 0x0f) * 0x11;
                }
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 1d7efa3169cd..d0cfbb4cb964 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -312,7 +312,9 @@ static int i2c_imx_start(struct imx_i2c_struct *i2c_imx)
        dev_dbg(&i2c_imx->adapter.dev, "<%s>\n", __func__);
-        clk_prepare_enable(i2c_imx->clk);
+        result = clk_prepare_enable(i2c_imx->clk);
+        if (result)
+                return result;
        imx_i2c_write_reg(i2c_imx->ifdr, i2c_imx, IMX_I2C_IFDR);
        /* Enable I2C controller */
        imx_i2c_write_reg(i2c_imx->hwdata->i2sr_clr_opcode, i2c_imx, IMX_I2C_I2SR);
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 797e3117bef7..2d0847b6be62 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -139,6 +139,8 @@ struct i2c_adapter *i2c_add_mux_adapter(struct i2c_adapter *parent,
        priv->adap.algo = &priv->algo;
        priv->adap.algo_data = priv;
        priv->adap.dev.parent = &parent->dev;
+        priv->adap.retries = parent->retries;
+        priv->adap.timeout = parent->timeout;
        /* Sanity check on class */
        if (i2c_mux_parent_classes(parent) & class)
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index cbd4e9abc47e..92d1206482a6 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -329,7 +329,7 @@ static struct cpuidle_state atom_cstates[] __initdata = {
        {
                .enter = NULL }
 };
-static struct cpuidle_state avn_cstates[CPUIDLE_STATE_MAX] = {
+static struct cpuidle_state avn_cstates[] __initdata = {
        {
                .name = "C1-AVN",
                .desc = "MWAIT 0x00",
@@ -340,7 +340,7 @@ static struct cpuidle_state avn_cstates[CPUIDLE_STATE_MAX] = {
        {
                .name = "C6-AVN",
                .desc = "MWAIT 0x51",
-                .flags = MWAIT2flg(0x58) | CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
+                .flags = MWAIT2flg(0x51) | CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                .exit_latency = 15,
                .target_residency = 45,
                .enter = &intel_idle },
diff --git a/drivers/iio/common/hid-sensors/Kconfig b/drivers/iio/common/hid-sensors/Kconfig
index 1178121b55b0..39188b72cd3b 100644
--- a/drivers/iio/common/hid-sensors/Kconfig
+++ b/drivers/iio/common/hid-sensors/Kconfig
@@ -25,13 +25,4 @@ config HID_SENSOR_IIO_TRIGGER
          If this driver is compiled as a module, it will be named
          hid-sensor-trigger.
-config HID_SENSOR_ENUM_BASE_QUIRKS
-        bool "ENUM base quirks for HID Sensor IIO drivers"
-        depends on HID_SENSOR_IIO_COMMON
-        help
-          Say yes here to build support for sensor hub FW using
-          enumeration, which is using 1 as base instead of 0.
-          Since logical minimum is still set 0 instead of 1,
-          there is no easy way to differentiate.
 endmenu
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index bbd6426c9726..7dcf83998e6f 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -33,24 +33,34 @@ static int hid_sensor_data_rdy_trigger_set_state(struct iio_trigger *trig,
 {
        struct hid_sensor_common *st = iio_trigger_get_drvdata(trig);
        int state_val;
+        int report_val;
        if (state) {
                if (sensor_hub_device_open(st->hsdev))
                        return -EIO;
-        } else
+                state_val =
+                HID_USAGE_SENSOR_PROP_POWER_STATE_D0_FULL_POWER_ENUM;
+                report_val =
+                HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM;
+        } else {
                sensor_hub_device_close(st->hsdev);
+                state_val =
+                HID_USAGE_SENSOR_PROP_POWER_STATE_D4_POWER_OFF_ENUM;
+                report_val =
+                HID_USAGE_SENSOR_PROP_REPORTING_STATE_NO_EVENTS_ENUM;
+        }
-        state_val = state ? 1 : 0;
-        if (IS_ENABLED(CONFIG_HID_SENSOR_ENUM_BASE_QUIRKS))
-                ++state_val;
        st->data_ready = state;
+        state_val += st->power_state.logical_minimum;
+        report_val += st->report_state.logical_minimum;
        sensor_hub_set_feature(st->hsdev, st->power_state.report_id,
                                        st->power_state.index,
                                        (s32)state_val);
        sensor_hub_set_feature(st->hsdev, st->report_state.report_id,
                                        st->report_state.index,
-                                        (s32)state_val);
+                                        (s32)report_val);
        return 0;
 }
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index b0d65df3ede2..a022f27c6690 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -43,6 +43,7 @@ config GP2AP020A00F
        depends on I2C
        select IIO_BUFFER
        select IIO_TRIGGERED_BUFFER
+        select IRQ_WORK
        help
          Say Y here if you have a Sharp GP2AP020A00F proximity/ALS combo-chip
          hooked to an I2C bus.
diff --git a/drivers/input/keyboard/adp5588-keys.c b/drivers/input/keyboard/adp5588-keys.c
index dbd2047f1641..3ed23513d881 100644
--- a/drivers/input/keyboard/adp5588-keys.c
+++ b/drivers/input/keyboard/adp5588-keys.c
@@ -536,7 +536,8 @@ static int adp5588_probe(struct i2c_client *client,
                __set_bit(EV_REP, input->evbit);
        for (i = 0; i < input->keycodemax; i++)
-                __set_bit(kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(kpad->keycode[i], input->keybit);
        __clear_bit(KEY_RESERVED, input->keybit);
        if (kpad->gpimapsize)
diff --git a/drivers/input/keyboard/adp5589-keys.c b/drivers/input/keyboard/adp5589-keys.c
index 67d12b3427c9..60dafd4fa692 100644
--- a/drivers/input/keyboard/adp5589-keys.c
+++ b/drivers/input/keyboard/adp5589-keys.c
@@ -992,7 +992,8 @@ static int adp5589_probe(struct i2c_client *client,
                __set_bit(EV_REP, input->evbit);
        for (i = 0; i < input->keycodemax; i++)
-                __set_bit(kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(kpad->keycode[i], input->keybit);
        __clear_bit(KEY_RESERVED, input->keybit);
        if (kpad->gpimapsize)
diff --git a/drivers/input/keyboard/bf54x-keys.c b/drivers/input/keyboard/bf54x-keys.c
index fc88fb48d70d..09b91d093087 100644
--- a/drivers/input/keyboard/bf54x-keys.c
+++ b/drivers/input/keyboard/bf54x-keys.c
@@ -289,7 +289,8 @@ static int bfin_kpad_probe(struct platform_device *pdev)
                __set_bit(EV_REP, input->evbit);
        for (i = 0; i < input->keycodemax; i++)
-                __set_bit(bf54x_kpad->keycode[i] & KEY_MAX, input->keybit);
+                if (bf54x_kpad->keycode[i] <= KEY_MAX)
+                        __set_bit(bf54x_kpad->keycode[i], input->keybit);
        __clear_bit(KEY_RESERVED, input->keybit);
        error = input_register_device(input);
diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index 0735de3a6468..1cb1da294419 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -158,7 +158,7 @@
 /* ORIENT ADXL346 only */
 #define ADXL346_2D_VALID                (1 << 6)
-#define ADXL346_2D_ORIENT(x)            (((x) & 0x3) >> 4)
+#define ADXL346_2D_ORIENT(x)            (((x) & 0x30) >> 4)
 #define ADXL346_3D_VALID                (1 << 3)
 #define ADXL346_3D_ORIENT(x)            ((x) & 0x7)
 #define ADXL346_2D_PORTRAIT_POS         0       /* +X */
diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
index e37392976fdd..0deca5a3c87f 100644
--- a/drivers/input/misc/pcf8574_keypad.c
+++ b/drivers/input/misc/pcf8574_keypad.c
@@ -113,9 +113,12 @@ static int pcf8574_kp_probe(struct i2c_client *client, const struct i2c_device_i
        idev->keycodemax = ARRAY_SIZE(lp->btncode);
        for (i = 0; i < ARRAY_SIZE(pcf8574_kp_btncode); i++) {
-                lp->btncode[i] = pcf8574_kp_btncode[i];
+                if (lp->btncode[i] <= KEY_MAX) {
-                __set_bit(lp->btncode[i] & KEY_MAX, idev->keybit);
+                        lp->btncode[i] = pcf8574_kp_btncode[i];
+                        __set_bit(lp->btncode[i], idev->keybit);
+                }
        }
+        __clear_bit(KEY_RESERVED, idev->keybit);
        sprintf(lp->name, DRV_NAME);
        sprintf(lp->phys, "kp_data/input0");
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index ca7a26f1dce8..5cf62e315218 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -70,6 +70,25 @@ static const struct alps_nibble_commands alps_v4_nibble_commands[] = {
        { PSMOUSE_CMD_SETSCALE11,       0x00 }, /* f */
 };
+static const struct alps_nibble_commands alps_v6_nibble_commands[] = {
+        { PSMOUSE_CMD_ENABLE,           0x00 }, /* 0 */
+        { PSMOUSE_CMD_SETRATE,          0x0a }, /* 1 */
+        { PSMOUSE_CMD_SETRATE,          0x14 }, /* 2 */
+        { PSMOUSE_CMD_SETRATE,          0x28 }, /* 3 */
+        { PSMOUSE_CMD_SETRATE,          0x3c }, /* 4 */
+        { PSMOUSE_CMD_SETRATE,          0x50 }, /* 5 */
+        { PSMOUSE_CMD_SETRATE,          0x64 }, /* 6 */
+        { PSMOUSE_CMD_SETRATE,          0xc8 }, /* 7 */
+        { PSMOUSE_CMD_GETID,            0x00 }, /* 8 */
+        { PSMOUSE_CMD_GETINFO,          0x00 }, /* 9 */
+        { PSMOUSE_CMD_SETRES,           0x00 }, /* a */
+        { PSMOUSE_CMD_SETRES,           0x01 }, /* b */
+        { PSMOUSE_CMD_SETRES,           0x02 }, /* c */
+        { PSMOUSE_CMD_SETRES,           0x03 }, /* d */
+        { PSMOUSE_CMD_SETSCALE21,       0x00 }, /* e */
+        { PSMOUSE_CMD_SETSCALE11,       0x00 }, /* f */
+};
 #define ALPS_DUALPOINT          0x02    /* touchpad has trackstick */
 #define ALPS_PASS               0x04    /* device has a pass-through port */
@@ -103,6 +122,7 @@ static const struct alps_model_info alps_model_data[] = {
        /* Dell Latitude E5500, E6400, E6500, Precision M4400 */
        { { 0x62, 0x02, 0x14 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf,
                ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
+        { { 0x73, 0x00, 0x14 }, 0x00, ALPS_PROTO_V6, 0xff, 0xff, ALPS_DUALPOINT },              /* Dell XT2 */
        { { 0x73, 0x02, 0x50 }, 0x00, ALPS_PROTO_V2, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },           /* Dell Vostro 1400 */
        { { 0x52, 0x01, 0x14 }, 0x00, ALPS_PROTO_V2, 0xff, 0xff,
                ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },                            /* Toshiba Tecra A11-11L */
@@ -645,6 +665,76 @@ static void alps_process_packet_v3(struct psmouse *psmouse)
        alps_process_touchpad_packet_v3(psmouse);
 }
+static void alps_process_packet_v6(struct psmouse *psmouse)
+{
+        struct alps_data *priv = psmouse->private;
+        unsigned char *packet = psmouse->packet;
+        struct input_dev *dev = psmouse->dev;
+        struct input_dev *dev2 = priv->dev2;
+        int x, y, z, left, right, middle;
+        /*
+         * We can use Byte5 to distinguish if the packet is from Touchpad
+         * or Trackpoint.
+         * Touchpad:    0 - 0x7E
+         * Trackpoint:  0x7F
+         */
+        if (packet[5] == 0x7F) {
+                /* It should be a DualPoint when received Trackpoint packet */
+                if (!(priv->flags & ALPS_DUALPOINT))
+                        return;
+                /* Trackpoint packet */
+                x = packet[1] | ((packet[3] & 0x20) << 2);
+                y = packet[2] | ((packet[3] & 0x40) << 1);
+                z = packet[4];
+                left = packet[3] & 0x01;
+                right = packet[3] & 0x02;
+                middle = packet[3] & 0x04;
+                /* To prevent the cursor jump when finger lifted */
+                if (x == 0x7F && y == 0x7F && z == 0x7F)
+                        x = y = z = 0;
+                /* Divide 4 since trackpoint's speed is too fast */
+                input_report_rel(dev2, REL_X, (char)x / 4);
+                input_report_rel(dev2, REL_Y, -((char)y / 4));
+                input_report_key(dev2, BTN_LEFT, left);
+                input_report_key(dev2, BTN_RIGHT, right);
+                input_report_key(dev2, BTN_MIDDLE, middle);
+                input_sync(dev2);
+                return;
+        }
+        /* Touchpad packet */
+        x = packet[1] | ((packet[3] & 0x78) << 4);
+        y = packet[2] | ((packet[4] & 0x78) << 4);
+        z = packet[5];
+        left = packet[3] & 0x01;
+        right = packet[3] & 0x02;
+        if (z > 30)
+                input_report_key(dev, BTN_TOUCH, 1);
+        if (z < 25)
+                input_report_key(dev, BTN_TOUCH, 0);
+        if (z > 0) {
+                input_report_abs(dev, ABS_X, x);
+                input_report_abs(dev, ABS_Y, y);
+        }
+        input_report_abs(dev, ABS_PRESSURE, z);
+        input_report_key(dev, BTN_TOOL_FINGER, z > 0);
+        /* v6 touchpad does not have middle button */
+        input_report_key(dev, BTN_LEFT, left);
+        input_report_key(dev, BTN_RIGHT, right);
+        input_sync(dev);
+}
 static void alps_process_packet_v4(struct psmouse *psmouse)
 {
        struct alps_data *priv = psmouse->private;
@@ -897,7 +987,7 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
        }
        /* Bytes 2 - pktsize should have 0 in the highest bit */
-        if (priv->proto_version != ALPS_PROTO_V5 &&
+        if ((priv->proto_version < ALPS_PROTO_V5) &&
            psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
            (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
                psmouse_dbg(psmouse, "refusing packet[%i] = %x\n",
@@ -1085,6 +1175,80 @@ static int alps_absolute_mode_v1_v2(struct psmouse *psmouse)
        return ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETPOLL);
 }
+static int alps_monitor_mode_send_word(struct psmouse *psmouse, u16 word)
+{
+        int i, nibble;
+        /*
+         * b0-b11 are valid bits, send sequence is inverse.
+         * e.g. when word = 0x0123, nibble send sequence is 3, 2, 1
+         */
+        for (i = 0; i <= 8; i += 4) {
+                nibble = (word >> i) & 0xf;
+                if (alps_command_mode_send_nibble(psmouse, nibble))
+                        return -1;
+        }
+        return 0;
+}
+static int alps_monitor_mode_write_reg(struct psmouse *psmouse,
+                                       u16 addr, u16 value)
+{
+        struct ps2dev *ps2dev = &psmouse->ps2dev;
+        /* 0x0A0 is the command to write the word */
+        if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_ENABLE) ||
+            alps_monitor_mode_send_word(psmouse, 0x0A0) ||
+            alps_monitor_mode_send_word(psmouse, addr) ||
+            alps_monitor_mode_send_word(psmouse, value) ||
+            ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE))
+                return -1;
+        return 0;
+}
+static int alps_monitor_mode(struct psmouse *psmouse, bool enable)
+{
+        struct ps2dev *ps2dev = &psmouse->ps2dev;
+        if (enable) {
+                /* EC E9 F5 F5 E7 E6 E7 E9 to enter monitor mode */
+                if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_RESET_WRAP) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_GETINFO) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_DISABLE) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE21) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE21) ||
+                    ps2_command(ps2dev, NULL, PSMOUSE_CMD_GETINFO))
+                        return -1;
+        } else {
+                /* EC to exit monitor mode */
+                if (ps2_command(ps2dev, NULL, PSMOUSE_CMD_RESET_WRAP))
+                        return -1;
+        }
+        return 0;
+}
+static int alps_absolute_mode_v6(struct psmouse *psmouse)
+{
+        u16 reg_val = 0x181;
+        int ret = -1;
+        /* enter monitor mode, to write the register */
+        if (alps_monitor_mode(psmouse, true))
+                return -1;
+        ret = alps_monitor_mode_write_reg(psmouse, 0x000, reg_val);
+        if (alps_monitor_mode(psmouse, false))
+                ret = -1;
+        return ret;
+}
 static int alps_get_status(struct psmouse *psmouse, char *param)
 {
        /* Get status: 0xF5 0xF5 0xF5 0xE9 */
@@ -1189,6 +1353,32 @@ static int alps_hw_init_v1_v2(struct psmouse *psmouse)
        return 0;
 }
+static int alps_hw_init_v6(struct psmouse *psmouse)
+{
+        unsigned char param[2] = {0xC8, 0x14};
+        /* Enter passthrough mode to let trackpoint enter 6byte raw mode */
+        if (alps_passthrough_mode_v2(psmouse, true))
+                return -1;
+        if (ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11) ||
+            ps2_command(&psmouse->ps2dev, &param[0], PSMOUSE_CMD_SETRATE) ||
+            ps2_command(&psmouse->ps2dev, &param[1], PSMOUSE_CMD_SETRATE))
+                return -1;
+        if (alps_passthrough_mode_v2(psmouse, false))
+                return -1;
+        if (alps_absolute_mode_v6(psmouse)) {
+                psmouse_err(psmouse, "Failed to enable absolute mode\n");
+                return -1;
+        }
+        return 0;
+}
 /*
 * Enable or disable passthrough mode to the trackstick.
 */
@@ -1553,6 +1743,8 @@ static void alps_set_defaults(struct alps_data *priv)
                priv->hw_init = alps_hw_init_v1_v2;
                priv->process_packet = alps_process_packet_v1_v2;
                priv->set_abs_params = alps_set_abs_params_st;
+                priv->x_max = 1023;
+                priv->y_max = 767;
                break;
        case ALPS_PROTO_V3:
                priv->hw_init = alps_hw_init_v3;
@@ -1584,6 +1776,14 @@ static void alps_set_defaults(struct alps_data *priv)
                priv->x_bits = 23;
                priv->y_bits = 12;
                break;
+        case ALPS_PROTO_V6:
+                priv->hw_init = alps_hw_init_v6;
+                priv->process_packet = alps_process_packet_v6;
+                priv->set_abs_params = alps_set_abs_params_st;
+                priv->nibble_commands = alps_v6_nibble_commands;
+                priv->x_max = 2047;
+                priv->y_max = 1535;
+                break;
        }
 }
@@ -1705,8 +1905,8 @@ static void alps_disconnect(struct psmouse *psmouse)
 static void alps_set_abs_params_st(struct alps_data *priv,
                                   struct input_dev *dev1)
 {
-        input_set_abs_params(dev1, ABS_X, 0, 1023, 0, 0);
+        input_set_abs_params(dev1, ABS_X, 0, priv->x_max, 0, 0);
-        input_set_abs_params(dev1, ABS_Y, 0, 767, 0, 0);
+        input_set_abs_params(dev1, ABS_Y, 0, priv->y_max, 0, 0);
 }
 static void alps_set_abs_params_mt(struct alps_data *priv,
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index eee59853b9ce..704f0f924307 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -17,6 +17,7 @@
 #define ALPS_PROTO_V3   3
 #define ALPS_PROTO_V4   4
 #define ALPS_PROTO_V5   5
+#define ALPS_PROTO_V6   6
 /**
 * struct alps_model_info - touchpad ID table
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 8551dcaf24db..597e9b8fc18d 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1313,6 +1313,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                        break;
                case 6:
                case 7:
+                case 8:
                        etd->hw_version = 4;
                        break;
                default:
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 98707fb2cb5d..8f4c4ab04bc2 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -455,16 +455,26 @@ static DEVICE_ATTR_RO(type);
 static DEVICE_ATTR_RO(proto);
 static DEVICE_ATTR_RO(id);
 static DEVICE_ATTR_RO(extra);
-static DEVICE_ATTR_RO(modalias);
-static DEVICE_ATTR_WO(drvctl);
-static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
-static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
 static struct attribute *serio_device_id_attrs[] = {
        &dev_attr_type.attr,
        &dev_attr_proto.attr,
        &dev_attr_id.attr,
        &dev_attr_extra.attr,
+        NULL
+};
+static struct attribute_group serio_id_attr_group = {
+        .name   = "id",
+        .attrs  = serio_device_id_attrs,
+};
+static DEVICE_ATTR_RO(modalias);
+static DEVICE_ATTR_WO(drvctl);
+static DEVICE_ATTR(description, S_IRUGO, serio_show_description, NULL);
+static DEVICE_ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode);
+static struct attribute *serio_device_attrs[] = {
        &dev_attr_modalias.attr,
        &dev_attr_description.attr,
        &dev_attr_drvctl.attr,
@@ -472,13 +482,13 @@ static struct attribute *serio_device_id_attrs[] = {
        NULL
 };
-static struct attribute_group serio_id_attr_group = {
+static struct attribute_group serio_device_attr_group = {
-        .name   = "id",
+        .attrs  = serio_device_attrs,
-        .attrs  = serio_device_id_attrs,
 };
 static const struct attribute_group *serio_device_attr_groups[] = {
        &serio_id_attr_group,
+        &serio_device_attr_group,
        NULL
 };
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index cfd1b7e8c001..f1cb05148b46 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -251,7 +251,7 @@ static void sur40_poll(struct input_polled_dev *polldev)
        struct sur40_state *sur40 = polldev->private;
        struct input_dev *input = polldev->input;
        int result, bulk_read, need_blobs, packet_blobs, i;
-        u32 packet_id;
+        u32 uninitialized_var(packet_id);
        struct sur40_header *header = &sur40->bulk_in_buffer->header;
        struct sur40_blob *inblob = &sur40->bulk_in_buffer->blobs[0];
@@ -286,7 +286,7 @@ static void sur40_poll(struct input_polled_dev *polldev)
                if (need_blobs == -1) {
                        need_blobs = le16_to_cpu(header->count);
                        dev_dbg(sur40->dev, "need %d blobs\n", need_blobs);
-                        packet_id = header->packet_id;
+                        packet_id = le32_to_cpu(header->packet_id);
                }
                /*
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index ae4b6b903629..5f87bed05467 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -106,6 +106,7 @@ struct usbtouch_device_info {
 struct usbtouch_usb {
        unsigned char *data;
        dma_addr_t data_dma;
+        int data_size;
        unsigned char *buffer;
        int buf_len;
        struct urb *irq;
@@ -1521,7 +1522,7 @@ static int usbtouch_reset_resume(struct usb_interface *intf)
 static void usbtouch_free_buffers(struct usb_device *udev,
                                  struct usbtouch_usb *usbtouch)
 {
-        usb_free_coherent(udev, usbtouch->type->rept_size,
+        usb_free_coherent(udev, usbtouch->data_size,
                          usbtouch->data, usbtouch->data_dma);
        kfree(usbtouch->buffer);
 }
@@ -1566,7 +1567,20 @@ static int usbtouch_probe(struct usb_interface *intf,
        if (!type->process_pkt)
                type->process_pkt = usbtouch_process_pkt;
-        usbtouch->data = usb_alloc_coherent(udev, type->rept_size,
+        usbtouch->data_size = type->rept_size;
+        if (type->get_pkt_len) {
+                /*
+                 * When dealing with variable-length packets we should
+                 * not request more than wMaxPacketSize bytes at once
+                 * as we do not know if there is more data coming or
+                 * we filled exactly wMaxPacketSize bytes and there is
+                 * nothing else.
+                 */
+                usbtouch->data_size = min(usbtouch->data_size,
+                                          usb_endpoint_maxp(endpoint));
+        }
+        usbtouch->data = usb_alloc_coherent(udev, usbtouch->data_size,
                                            GFP_KERNEL, &usbtouch->data_dma);
        if (!usbtouch->data)
                goto out_free;
@@ -1626,12 +1640,12 @@ static int usbtouch_probe(struct usb_interface *intf,
        if (usb_endpoint_type(endpoint) == USB_ENDPOINT_XFER_INT)
                usb_fill_int_urb(usbtouch->irq, udev,
                         usb_rcvintpipe(udev, endpoint->bEndpointAddress),
-                         usbtouch->data, type->rept_size,
+                         usbtouch->data, usbtouch->data_size,
                         usbtouch_irq, usbtouch, endpoint->bInterval);
        else
                usb_fill_bulk_urb(usbtouch->irq, udev,
                         usb_rcvbulkpipe(udev, endpoint->bEndpointAddress),
-                         usbtouch->data, type->rept_size,
+                         usbtouch->data, usbtouch->data_size,
                         usbtouch_irq, usbtouch);
        usbtouch->irq->dev = udev;
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 1abfb5684ab7..e46a88700b68 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -392,7 +392,7 @@ struct arm_smmu_domain {
        struct arm_smmu_cfg             root_cfg;
        phys_addr_t                     output_mask;
-        spinlock_t                      lock;
+        struct mutex                    lock;
 };
 static DEFINE_SPINLOCK(arm_smmu_devices_lock);
@@ -900,7 +900,7 @@ static int arm_smmu_domain_init(struct iommu_domain *domain)
                goto out_free_domain;
        smmu_domain->root_cfg.pgd = pgd;
-        spin_lock_init(&smmu_domain->lock);
+        mutex_init(&smmu_domain->lock);
        domain->priv = smmu_domain;
        return 0;
@@ -1137,7 +1137,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
         * Sanity check the domain. We don't currently support domains
         * that cross between different SMMU chains.
         */
-        spin_lock(&smmu_domain->lock);
+        mutex_lock(&smmu_domain->lock);
        if (!smmu_domain->leaf_smmu) {
                /* Now that we have a master, we can finalise the domain */
                ret = arm_smmu_init_domain_context(domain, dev);
@@ -1152,7 +1152,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
                        dev_name(device_smmu->dev));
                goto err_unlock;
        }
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
        /* Looks ok, so add the device to the domain */
        master = find_smmu_master(smmu_domain->leaf_smmu, dev->of_node);
@@ -1162,7 +1162,7 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
        return arm_smmu_domain_add_master(smmu_domain, master);
 err_unlock:
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
        return ret;
 }
@@ -1394,7 +1394,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
        if (paddr & ~output_mask)
                return -ERANGE;
-        spin_lock(&smmu_domain->lock);
+        mutex_lock(&smmu_domain->lock);
        pgd += pgd_index(iova);
        end = iova + size;
        do {
@@ -1410,7 +1410,7 @@ static int arm_smmu_handle_mapping(struct arm_smmu_domain *smmu_domain,
        } while (pgd++, iova != end);
 out_unlock:
-        spin_unlock(&smmu_domain->lock);
+        mutex_unlock(&smmu_domain->lock);
        /* Ensure new page tables are visible to the hardware walker */
        if (smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
@@ -1423,9 +1423,8 @@ static int arm_smmu_map(struct iommu_domain *domain, unsigned long iova,
                        phys_addr_t paddr, size_t size, int flags)
 {
        struct arm_smmu_domain *smmu_domain = domain->priv;
-        struct arm_smmu_device *smmu = smmu_domain->leaf_smmu;
-        if (!smmu_domain || !smmu)
+        if (!smmu_domain)
                return -ENODEV;
        /* Check for silent address truncation up the SMMU chain. */
@@ -1449,44 +1448,34 @@ static size_t arm_smmu_unmap(struct iommu_domain *domain, unsigned long iova,
 static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain,
                                         dma_addr_t iova)
 {
-        pgd_t *pgd;
+        pgd_t *pgdp, pgd;
-        pud_t *pud;
+        pud_t pud;
-        pmd_t *pmd;
+        pmd_t pmd;
-        pte_t *pte;
+        pte_t pte;
        struct arm_smmu_domain *smmu_domain = domain->priv;
        struct arm_smmu_cfg *root_cfg = &smmu_domain->root_cfg;
-        struct arm_smmu_device *smmu = root_cfg->smmu;
-        spin_lock(&smmu_domain->lock);
+        pgdp = root_cfg->pgd;
-        pgd = root_cfg->pgd;
+        if (!pgdp)
-        if (!pgd)
+                return 0;
-                goto err_unlock;
-        pgd += pgd_index(iova);
+        pgd = *(pgdp + pgd_index(iova));
-        if (pgd_none_or_clear_bad(pgd))
+        if (pgd_none(pgd))
-                goto err_unlock;
+                return 0;
-        pud = pud_offset(pgd, iova);
+        pud = *pud_offset(&pgd, iova);
-        if (pud_none_or_clear_bad(pud))
+        if (pud_none(pud))
-                goto err_unlock;
+                return 0;
-        pmd = pmd_offset(pud, iova);
+        pmd = *pmd_offset(&pud, iova);
-        if (pmd_none_or_clear_bad(pmd))
+        if (pmd_none(pmd))
-                goto err_unlock;
+                return 0;
-        pte = pmd_page_vaddr(*pmd) + pte_index(iova);
+        pte = *(pmd_page_vaddr(pmd) + pte_index(iova));
        if (pte_none(pte))
-                goto err_unlock;
+                return 0;
-        spin_unlock(&smmu_domain->lock);
-        return __pfn_to_phys(pte_pfn(*pte)) | (iova & ~PAGE_MASK);
-err_unlock:
+        return __pfn_to_phys(pte_pfn(pte)) | (iova & ~PAGE_MASK);
-        spin_unlock(&smmu_domain->lock);
-        dev_warn(smmu->dev,
-                 "invalid (corrupt?) page tables detected for iova 0x%llx\n",
-                 (unsigned long long)iova);
-        return -EINVAL;
 }
 static int arm_smmu_domain_has_cap(struct iommu_domain *domain,
@@ -1863,6 +1852,7 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
                dev_err(dev,
                        "found only %d context interrupt(s) but %d required\n",
                        smmu->num_context_irqs, smmu->num_context_banks);
+                err = -ENODEV;
                goto out_put_parent;
        }
diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
index 2848171b8576..b31d8e99c419 100644
--- a/drivers/leds/leds-pwm.c
+++ b/drivers/leds/leds-pwm.c
@@ -82,22 +82,12 @@ static inline size_t sizeof_pwm_leds_priv(int num_leds)
                      (sizeof(struct led_pwm_data) * num_leds);
 }
-static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
+static int led_pwm_create_of(struct platform_device *pdev,
+                             struct led_pwm_priv *priv)
 {
        struct device_node *node = pdev->dev.of_node;
        struct device_node *child;
-        struct led_pwm_priv *priv;
+        int ret;
-        int count, ret;
-        /* count LEDs in this device, so we know how much to allocate */
-        count = of_get_child_count(node);
-        if (!count)
-                return NULL;
-        priv = devm_kzalloc(&pdev->dev, sizeof_pwm_leds_priv(count),
-                            GFP_KERNEL);
-        if (!priv)
-                return NULL;
        for_each_child_of_node(node, child) {
                struct led_pwm_data *led_dat = &priv->leds[priv->num_leds];
@@ -109,6 +99,7 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
                if (IS_ERR(led_dat->pwm)) {
                        dev_err(&pdev->dev, "unable to request PWM for %s\n",
                                led_dat->cdev.name);
+                        ret = PTR_ERR(led_dat->pwm);
                        goto err;
                }
                /* Get the period from PWM core when n*/
@@ -137,28 +128,36 @@ static struct led_pwm_priv *led_pwm_create_of(struct platform_device *pdev)
                priv->num_leds++;
        }
-        return priv;
+        return 0;
 err:
        while (priv->num_leds--)
                led_classdev_unregister(&priv->leds[priv->num_leds].cdev);
-        return NULL;
+        return ret;
 }
 static int led_pwm_probe(struct platform_device *pdev)
 {
        struct led_pwm_platform_data *pdata = dev_get_platdata(&pdev->dev);
        struct led_pwm_priv *priv;
-        int i, ret = 0;
+        int count, i;
+        int ret = 0;
+        if (pdata)
+                count = pdata->num_leds;
+        else
+                count = of_get_child_count(pdev->dev.of_node);
+        if (!count)
+                return -EINVAL;
-        if (pdata && pdata->num_leds) {
+        priv = devm_kzalloc(&pdev->dev, sizeof_pwm_leds_priv(count),
-                priv = devm_kzalloc(&pdev->dev,
+                            GFP_KERNEL);
-                                    sizeof_pwm_leds_priv(pdata->num_leds),
+        if (!priv)
-                                    GFP_KERNEL);
+                return -ENOMEM;
-                if (!priv)
-                        return -ENOMEM;
-                for (i = 0; i < pdata->num_leds; i++) {
+        if (pdata) {
+                for (i = 0; i < count; i++) {
                        struct led_pwm *cur_led = &pdata->leds[i];
                        struct led_pwm_data *led_dat = &priv->leds[i];
@@ -188,11 +187,11 @@ static int led_pwm_probe(struct platform_device *pdev)
                        if (ret < 0)
                                goto err;
                }
-                priv->num_leds = pdata->num_leds;
+                priv->num_leds = count;
        } else {
-                priv = led_pwm_create_of(pdev);
+                ret = led_pwm_create_of(pdev, priv);
-                if (!priv)
+                if (ret)
-                        return -ENODEV;
+                        return ret;
        }
        platform_set_drvdata(pdev, priv);
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 173cbb20d104..54bdd923316f 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1717,6 +1717,11 @@ static int __init dm_bufio_init(void)
 {
        __u64 mem;
+        dm_bufio_allocated_kmem_cache = 0;
+        dm_bufio_allocated_get_free_pages = 0;
+        dm_bufio_allocated_vmalloc = 0;
+        dm_bufio_current_allocated = 0;
        memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
        memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
index 416b7b752a6e..64780ad73bb0 100644
--- a/drivers/md/dm-cache-policy-mq.c
+++ b/drivers/md/dm-cache-policy-mq.c
@@ -730,15 +730,18 @@ static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e,
        int r = 0;
        bool updated = updated_this_tick(mq, e);
-        requeue_and_update_tick(mq, e);
        if ((!discarded_oblock && updated) ||
-            !should_promote(mq, e, discarded_oblock, data_dir))
+            !should_promote(mq, e, discarded_oblock, data_dir)) {
+                requeue_and_update_tick(mq, e);
                result->op = POLICY_MISS;
-        else if (!can_migrate)
+        } else if (!can_migrate)
                r = -EWOULDBLOCK;
-        else
+        else {
+                requeue_and_update_tick(mq, e);
                r = pre_cache_to_cache(mq, e, result);
+        }
        return r;
 }
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 9efcf1059b99..1b1469ebe5cb 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2755,7 +2755,7 @@ static int resize_cache_dev(struct cache *cache, dm_cblock_t new_size)
 {
        int r;
-        r = dm_cache_resize(cache->cmd, cache->cache_size);
+        r = dm_cache_resize(cache->cmd, new_size);
        if (r) {
                DMERR("could not resize cache metadata");
                return r;
diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 496d5f3646a5..2f91d6d4a2cc 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -20,6 +20,7 @@
 struct delay_c {
        struct timer_list delay_timer;
        struct mutex timer_lock;
+        struct workqueue_struct *kdelayd_wq;
        struct work_struct flush_expired_bios;
        struct list_head delayed_bios;
        atomic_t may_delay;
@@ -45,14 +46,13 @@ struct dm_delay_info {
 static DEFINE_MUTEX(delayed_bios_lock);
-static struct workqueue_struct *kdelayd_wq;
 static struct kmem_cache *delayed_cache;
 static void handle_delayed_timer(unsigned long data)
 {
        struct delay_c *dc = (struct delay_c *)data;
-        queue_work(kdelayd_wq, &dc->flush_expired_bios);
+        queue_work(dc->kdelayd_wq, &dc->flush_expired_bios);
 }
 static void queue_timeout(struct delay_c *dc, unsigned long expires)
@@ -191,6 +191,12 @@ out:
                goto bad_dev_write;
        }
+        dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
+        if (!dc->kdelayd_wq) {
+                DMERR("Couldn't start kdelayd");
+                goto bad_queue;
+        }
        setup_timer(&dc->delay_timer, handle_delayed_timer, (unsigned long)dc);
        INIT_WORK(&dc->flush_expired_bios, flush_expired_bios);
@@ -203,6 +209,8 @@ out:
        ti->private = dc;
        return 0;
+bad_queue:
+        mempool_destroy(dc->delayed_pool);
 bad_dev_write:
        if (dc->dev_write)
                dm_put_device(ti, dc->dev_write);
@@ -217,7 +225,7 @@ static void delay_dtr(struct dm_target *ti)
 {
        struct delay_c *dc = ti->private;
-        flush_workqueue(kdelayd_wq);
+        destroy_workqueue(dc->kdelayd_wq);
        dm_put_device(ti, dc->dev_read);
@@ -350,12 +358,6 @@ static int __init dm_delay_init(void)
 {
        int r = -ENOMEM;
-        kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
-        if (!kdelayd_wq) {
-                DMERR("Couldn't start kdelayd");
-                goto bad_queue;
-        }
        delayed_cache = KMEM_CACHE(dm_delay_info, 0);
        if (!delayed_cache) {
                DMERR("Couldn't create delayed bio cache.");
@@ -373,8 +375,6 @@ static int __init dm_delay_init(void)
 bad_register:
        kmem_cache_destroy(delayed_cache);
 bad_memcache:
-        destroy_workqueue(kdelayd_wq);
-bad_queue:
        return r;
 }
@@ -382,7 +382,6 @@ static void __exit dm_delay_exit(void)
 {
        dm_unregister_target(&delay_target);
        kmem_cache_destroy(delayed_cache);
-        destroy_workqueue(kdelayd_wq);
 }
 /* Module hooks */
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index aec57d76db5d..944690bafd93 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -66,6 +66,18 @@ struct dm_snapshot {
        atomic_t pending_exceptions_count;
+        /* Protected by "lock" */
+        sector_t exception_start_sequence;
+        /* Protected by kcopyd single-threaded callback */
+        sector_t exception_complete_sequence;
+        /*
+         * A list of pending exceptions that completed out of order.
+         * Protected by kcopyd single-threaded callback.
+         */
+        struct list_head out_of_order_list;
        mempool_t *pending_pool;
        struct dm_exception_table pending;
@@ -173,6 +185,14 @@ struct dm_snap_pending_exception {
         */
        int started;
+        /* There was copying error. */
+        int copy_error;
+        /* A sequence number, it is used for in-order completion. */
+        sector_t exception_sequence;
+        struct list_head out_of_order_entry;
        /*
         * For writing a complete chunk, bypassing the copy.
         */
@@ -1094,6 +1114,9 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
        s->valid = 1;
        s->active = 0;
        atomic_set(&s->pending_exceptions_count, 0);
+        s->exception_start_sequence = 0;
+        s->exception_complete_sequence = 0;
+        INIT_LIST_HEAD(&s->out_of_order_list);
        init_rwsem(&s->lock);
        INIT_LIST_HEAD(&s->list);
        spin_lock_init(&s->pe_lock);
@@ -1443,6 +1466,19 @@ static void commit_callback(void *context, int success)
        pending_complete(pe, success);
 }
+static void complete_exception(struct dm_snap_pending_exception *pe)
+{
+        struct dm_snapshot *s = pe->snap;
+        if (unlikely(pe->copy_error))
+                pending_complete(pe, 0);
+        else
+                /* Update the metadata if we are persistent */
+                s->store->type->commit_exception(s->store, &pe->e,
+                                                 commit_callback, pe);
+}
 /*
 * Called when the copy I/O has finished.  kcopyd actually runs
 * this code so don't block.
@@ -1452,13 +1488,32 @@ static void copy_callback(int read_err, unsigned long write_err, void *context)
        struct dm_snap_pending_exception *pe = context;
        struct dm_snapshot *s = pe->snap;
-        if (read_err || write_err)
+        pe->copy_error = read_err || write_err;
-                pending_complete(pe, 0);
-        else
+        if (pe->exception_sequence == s->exception_complete_sequence) {
-                /* Update the metadata if we are persistent */
+                s->exception_complete_sequence++;
-                s->store->type->commit_exception(s->store, &pe->e,
+                complete_exception(pe);
-                                                 commit_callback, pe);
+                while (!list_empty(&s->out_of_order_list)) {
+                        pe = list_entry(s->out_of_order_list.next,
+                                        struct dm_snap_pending_exception, out_of_order_entry);
+                        if (pe->exception_sequence != s->exception_complete_sequence)
+                                break;
+                        s->exception_complete_sequence++;
+                        list_del(&pe->out_of_order_entry);
+                        complete_exception(pe);
+                }
+        } else {
+                struct list_head *lh;
+                struct dm_snap_pending_exception *pe2;
+                list_for_each_prev(lh, &s->out_of_order_list) {
+                        pe2 = list_entry(lh, struct dm_snap_pending_exception, out_of_order_entry);
+                        if (pe2->exception_sequence < pe->exception_sequence)
+                                break;
+                }
+                list_add(&pe->out_of_order_entry, lh);
+        }
 }
 /*
@@ -1553,6 +1608,8 @@ __find_pending_exception(struct dm_snapshot *s,
                return NULL;
        }
+        pe->exception_sequence = s->exception_start_sequence++;
        dm_insert_exception(&s->pending, &pe->e);
        return pe;
@@ -2192,7 +2249,7 @@ static struct target_type origin_target = {
 static struct target_type snapshot_target = {
        .name    = "snapshot",
-        .version = {1, 11, 1},
+        .version = {1, 12, 0},
        .module  = THIS_MODULE,
        .ctr     = snapshot_ctr,
        .dtr     = snapshot_dtr,
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 3d404c1371ed..28a90122a5a8 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -964,6 +964,7 @@ int dm_stats_message(struct mapped_device *md, unsigned argc, char **argv,
 int __init dm_statistics_init(void)
 {
+        shared_memory_amount = 0;
        dm_stat_need_rcu_barrier = 0;
        return 0;
 }
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 465f08ca62b1..3ba6a3859ce3 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -200,6 +200,11 @@ int dm_table_create(struct dm_table **result, fmode_t mode,
        num_targets = dm_round_up(num_targets, KEYS_PER_NODE);
+        if (!num_targets) {
+                kfree(t);
+                return -ENOMEM;
+        }
        if (alloc_targets(t, num_targets)) {
                kfree(t);
                return -ENOMEM;
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 60bce435f4fa..8a30ad54bd46 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1697,6 +1697,14 @@ void dm_pool_metadata_read_only(struct dm_pool_metadata *pmd)
        up_write(&pmd->root_lock);
 }
+void dm_pool_metadata_read_write(struct dm_pool_metadata *pmd)
+{
+        down_write(&pmd->root_lock);
+        pmd->read_only = false;
+        dm_bm_set_read_write(pmd->bm);
+        up_write(&pmd->root_lock);
+}
 int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                        dm_block_t threshold,
                                        dm_sm_threshold_fn fn,
diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
index 845ebbe589a9..7bcc0e1d6238 100644
--- a/drivers/md/dm-thin-metadata.h
+++ b/drivers/md/dm-thin-metadata.h
@@ -193,6 +193,7 @@ int dm_pool_resize_metadata_dev(struct dm_pool_metadata *pmd, dm_block_t new_siz
 * that nothing is changing.
 */
 void dm_pool_metadata_read_only(struct dm_pool_metadata *pmd);
+void dm_pool_metadata_read_write(struct dm_pool_metadata *pmd);
 int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
                                        dm_block_t threshold,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 2c0cf511ec23..ee29037ffc2e 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -640,7 +640,9 @@ static void process_prepared_mapping(struct dm_thin_new_mapping *m)
         */
        r = dm_thin_insert_block(tc->td, m->virt_block, m->data_block);
        if (r) {
-                DMERR_LIMIT("dm_thin_insert_block() failed");
+                DMERR_LIMIT("%s: dm_thin_insert_block() failed: error = %d",
+                            dm_device_name(pool->pool_md), r);
+                set_pool_mode(pool, PM_READ_ONLY);
                cell_error(pool, m->cell);
                goto out;
        }
@@ -881,32 +883,23 @@ static void schedule_zero(struct thin_c *tc, dm_block_t virt_block,
        }
 }
-static int commit(struct pool *pool)
-{
-        int r;
-        r = dm_pool_commit_metadata(pool->pmd);
-        if (r)
-                DMERR_LIMIT("%s: commit failed: error = %d",
-                            dm_device_name(pool->pool_md), r);
-        return r;
-}
 /*
 * A non-zero return indicates read_only or fail_io mode.
 * Many callers don't care about the return value.
 */
-static int commit_or_fallback(struct pool *pool)
+static int commit(struct pool *pool)
 {
        int r;
        if (get_pool_mode(pool) != PM_WRITE)
                return -EINVAL;
-        r = commit(pool);
+        r = dm_pool_commit_metadata(pool->pmd);
-        if (r)
+        if (r) {
+                DMERR_LIMIT("%s: dm_pool_commit_metadata failed: error = %d",
+                            dm_device_name(pool->pool_md), r);
                set_pool_mode(pool, PM_READ_ONLY);
+        }
        return r;
 }
@@ -943,7 +936,9 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                 * Try to commit to see if that will free up some
                 * more space.
                 */
-                (void) commit_or_fallback(pool);
+                r = commit(pool);
+                if (r)
+                        return r;
                r = dm_pool_get_free_block_count(pool->pmd, &free_blocks);
                if (r)
@@ -957,7 +952,7 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
                 * table reload).
                 */
                if (!free_blocks) {
-                        DMWARN("%s: no free space available.",
+                        DMWARN("%s: no free data space available.",
                               dm_device_name(pool->pool_md));
                        spin_lock_irqsave(&pool->lock, flags);
                        pool->no_free_space = 1;
@@ -967,8 +962,16 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
        }
        r = dm_pool_alloc_data_block(pool->pmd, result);
-        if (r)
+        if (r) {
+                if (r == -ENOSPC &&
+                    !dm_pool_get_free_metadata_block_count(pool->pmd, &free_blocks) &&
+                    !free_blocks) {
+                        DMWARN("%s: no free metadata space available.",
+                               dm_device_name(pool->pool_md));
+                        set_pool_mode(pool, PM_READ_ONLY);
+                }
                return r;
+        }
        return 0;
 }
@@ -1349,7 +1352,7 @@ static void process_deferred_bios(struct pool *pool)
        if (bio_list_empty(&bios) && !need_commit_due_to_time(pool))
                return;
-        if (commit_or_fallback(pool)) {
+        if (commit(pool)) {
                while ((bio = bio_list_pop(&bios)))
                        bio_io_error(bio);
                return;
@@ -1397,6 +1400,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode mode)
        case PM_FAIL:
                DMERR("%s: switching pool to failure mode",
                      dm_device_name(pool->pool_md));
+                dm_pool_metadata_read_only(pool->pmd);
                pool->process_bio = process_bio_fail;
                pool->process_discard = process_bio_fail;
                pool->process_prepared_mapping = process_prepared_mapping_fail;
@@ -1421,6 +1425,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode mode)
                break;
        case PM_WRITE:
+                dm_pool_metadata_read_write(pool->pmd);
                pool->process_bio = process_bio;
                pool->process_discard = process_discard;
                pool->process_prepared_mapping = process_prepared_mapping;
@@ -1637,12 +1642,19 @@ static int bind_control_target(struct pool *pool, struct dm_target *ti)
        struct pool_c *pt = ti->private;
        /*
-         * We want to make sure that degraded pools are never upgraded.
+         * We want to make sure that a pool in PM_FAIL mode is never upgraded.
         */
        enum pool_mode old_mode = pool->pf.mode;
        enum pool_mode new_mode = pt->adjusted_pf.mode;
-        if (old_mode > new_mode)
+        /*
+         * If we were in PM_FAIL mode, rollback of metadata failed.  We're
+         * not going to recover without a thin_repair.  So we never let the
+         * pool move out of the old mode.  On the other hand a PM_READ_ONLY
+         * may have been due to a lack of metadata or data space, and may
+         * now work (ie. if the underlying devices have been resized).
+         */
+        if (old_mode == PM_FAIL)
                new_mode = old_mode;
        pool->ti = ti;
@@ -2266,7 +2278,7 @@ static int pool_preresume(struct dm_target *ti)
                return r;
        if (need_commit1 || need_commit2)
-                (void) commit_or_fallback(pool);
+                (void) commit(pool);
        return 0;
 }
@@ -2293,7 +2305,7 @@ static void pool_postsuspend(struct dm_target *ti)
        cancel_delayed_work(&pool->waker);
        flush_workqueue(pool->wq);
-        (void) commit_or_fallback(pool);
+        (void) commit(pool);
 }
 static int check_arg_count(unsigned argc, unsigned args_required)
@@ -2427,7 +2439,7 @@ static int process_reserve_metadata_snap_mesg(unsigned argc, char **argv, struct
        if (r)
                return r;
-        (void) commit_or_fallback(pool);
+        (void) commit(pool);
        r = dm_pool_reserve_metadata_snap(pool->pmd);
        if (r)
@@ -2489,7 +2501,7 @@ static int pool_message(struct dm_target *ti, unsigned argc, char **argv)
                DMWARN("Unrecognised thin pool target message received: %s", argv[0]);
        if (!r)
-                (void) commit_or_fallback(pool);
+                (void) commit(pool);
        return r;
 }
@@ -2544,7 +2556,7 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                /* Commit to ensure statistics aren't out-of-date */
                if (!(status_flags & DM_STATUS_NOFLUSH_FLAG) && !dm_suspended(ti))
-                        (void) commit_or_fallback(pool);
+                        (void) commit(pool);
                r = dm_pool_get_metadata_transaction_id(pool->pmd, &transaction_id);
                if (r) {
diff --git a/drivers/md/md.c b/drivers/md/md.c
index e60cebf3f519..21f4d7ff0da2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -776,16 +776,10 @@ void md_super_wait(struct mddev *mddev)
        finish_wait(&mddev->sb_wait, &wq);
 }
-static void bi_complete(struct bio *bio, int error)
-{
-        complete((struct completion*)bio->bi_private);
-}
 int sync_page_io(struct md_rdev *rdev, sector_t sector, int size,
                 struct page *page, int rw, bool metadata_op)
 {
        struct bio *bio = bio_alloc_mddev(GFP_NOIO, 1, rdev->mddev);
-        struct completion event;
        int ret;
        rw |= REQ_SYNC;
@@ -801,11 +795,7 @@ int sync_page_io(struct md_rdev *rdev, sector_t sector, int size,
        else
                bio->bi_sector = sector + rdev->data_offset;
        bio_add_page(bio, page, size, 0);
-        init_completion(&event);
+        submit_bio_wait(rw, bio);
-        bio->bi_private = &event;
-        bio->bi_end_io = bi_complete;
-        submit_bio(rw, bio);
-        wait_for_completion(&event);
        ret = test_bit(BIO_UPTODATE, &bio->bi_flags);
        bio_put(bio);
diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c
index af96e24ec328..1d75b1dc1e2e 100644
--- a/drivers/md/persistent-data/dm-array.c
+++ b/drivers/md/persistent-data/dm-array.c
@@ -317,8 +317,16 @@ static int shadow_ablock(struct dm_array_info *info, dm_block_t *root,
         * The shadow op will often be a noop.  Only insert if it really
         * copied data.
         */
-        if (dm_block_location(*block) != b)
+        if (dm_block_location(*block) != b) {
+                /*
+                 * dm_tm_shadow_block will have already decremented the old
+                 * block, but it is still referenced by the btree.  We
+                 * increment to stop the insert decrementing it below zero
+                 * when overwriting the old value.
+                 */
+                dm_tm_inc(info->btree_info.tm, b);
                r = insert_ablock(info, index, *block, root);
+        }
        return r;
 }
diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c
index a7e8bf296388..064a3c271baa 100644
--- a/drivers/md/persistent-data/dm-block-manager.c
+++ b/drivers/md/persistent-data/dm-block-manager.c
@@ -626,6 +626,12 @@ void dm_bm_set_read_only(struct dm_block_manager *bm)
 }
 EXPORT_SYMBOL_GPL(dm_bm_set_read_only);
+void dm_bm_set_read_write(struct dm_block_manager *bm)
+{
+        bm->read_only = false;
+}
+EXPORT_SYMBOL_GPL(dm_bm_set_read_write);
 u32 dm_bm_checksum(const void *data, size_t len, u32 init_xor)
 {
        return crc32c(~(u32) 0, data, len) ^ init_xor;
diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h
index 9a82083a66b6..13cd58e1fe69 100644
--- a/drivers/md/persistent-data/dm-block-manager.h
+++ b/drivers/md/persistent-data/dm-block-manager.h
@@ -108,9 +108,9 @@ int dm_bm_unlock(struct dm_block *b);
 int dm_bm_flush_and_unlock(struct dm_block_manager *bm,
                           struct dm_block *superblock);
- /*
+/*
-  * Request data be prefetched into the cache.
+ * Request data is prefetched into the cache.
-  */
+ */
 void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b);
 /*
@@ -125,6 +125,7 @@ void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b);
 * be returned if you do.
 */
 void dm_bm_set_read_only(struct dm_block_manager *bm);
+void dm_bm_set_read_write(struct dm_block_manager *bm);
 u32 dm_bm_checksum(const void *data, size_t len, u32 init_xor);
diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
index 6058569fe86c..466a60bbd716 100644
--- a/drivers/md/persistent-data/dm-space-map-common.c
+++ b/drivers/md/persistent-data/dm-space-map-common.c
@@ -381,7 +381,7 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin,
 }
 static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
-                        uint32_t (*mutator)(void *context, uint32_t old),
+                        int (*mutator)(void *context, uint32_t old, uint32_t *new),
                        void *context, enum allocation_event *ev)
 {
        int r;
@@ -410,11 +410,17 @@ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
        if (old > 2) {
                r = sm_ll_lookup_big_ref_count(ll, b, &old);
-                if (r < 0)
+                if (r < 0) {
+                        dm_tm_unlock(ll->tm, nb);
                        return r;
+                }
        }
-        ref_count = mutator(context, old);
+        r = mutator(context, old, &ref_count);
+        if (r) {
+                dm_tm_unlock(ll->tm, nb);
+                return r;
+        }
        if (ref_count <= 2) {
                sm_set_bitmap(bm_le, bit, ref_count);
@@ -465,9 +471,10 @@ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
        return ll->save_ie(ll, index, &ie_disk);
 }
-static uint32_t set_ref_count(void *context, uint32_t old)
+static int set_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return *((uint32_t *) context);
+        *new = *((uint32_t *) context);
+        return 0;
 }
 int sm_ll_insert(struct ll_disk *ll, dm_block_t b,
@@ -476,9 +483,10 @@ int sm_ll_insert(struct ll_disk *ll, dm_block_t b,
        return sm_ll_mutate(ll, b, set_ref_count, &ref_count, ev);
 }
-static uint32_t inc_ref_count(void *context, uint32_t old)
+static int inc_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return old + 1;
+        *new = old + 1;
+        return 0;
 }
 int sm_ll_inc(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
@@ -486,9 +494,15 @@ int sm_ll_inc(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
        return sm_ll_mutate(ll, b, inc_ref_count, NULL, ev);
 }
-static uint32_t dec_ref_count(void *context, uint32_t old)
+static int dec_ref_count(void *context, uint32_t old, uint32_t *new)
 {
-        return old - 1;
+        if (!old) {
+                DMERR_LIMIT("unable to decrement a reference count below 0");
+                return -EINVAL;
+        }
+        *new = old - 1;
+        return 0;
 }
 int sm_ll_dec(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev)
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 1c959684caef..58fc1eef7499 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -384,12 +384,16 @@ static int sm_metadata_new_block(struct dm_space_map *sm, dm_block_t *b)
        struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
        int r = sm_metadata_new_block_(sm, b);
-        if (r)
+        if (r) {
                DMERR("unable to allocate new metadata block");
+                return r;
+        }
        r = sm_metadata_get_nr_free(sm, &count);
-        if (r)
+        if (r) {
                DMERR("couldn't get free block count");
+                return r;
+        }
        check_threshold(&smm->threshold, count);
diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h
index d0799e323364..9c9063cd3208 100644
--- a/drivers/media/common/siano/smscoreapi.h
+++ b/drivers/media/common/siano/smscoreapi.h
@@ -955,7 +955,7 @@ struct sms_rx_stats {
        u32 modem_state;                /* from SMSHOSTLIB_DVB_MODEM_STATE_ET */
        s32 SNR;                /* dB */
        u32 ber;                /* Post Viterbi ber [1E-5] */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
        u32 ber_bit_count;      /* Total number of SYNC bits. */
        u32 ts_per;             /* Transport stream PER,
        0xFFFFFFFF indicate N/A */
@@ -981,7 +981,7 @@ struct sms_rx_stats_ex {
        u32 modem_state;                /* from SMSHOSTLIB_DVB_MODEM_STATE_ET */
        s32 SNR;                /* dB */
        u32 ber;                /* Post Viterbi ber [1E-5] */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
        u32 ber_bit_count;      /* Total number of SYNC bits. */
        u32 ts_per;             /* Transport stream PER,
        0xFFFFFFFF indicate N/A */
diff --git a/drivers/media/common/siano/smsdvb.h b/drivers/media/common/siano/smsdvb.h
index 92c413ba0c79..ae36d0ae0fb1 100644
--- a/drivers/media/common/siano/smsdvb.h
+++ b/drivers/media/common/siano/smsdvb.h
@@ -95,7 +95,7 @@ struct RECEPTION_STATISTICS_PER_SLICES_S {
        u32 is_demod_locked;    /* 0 - not locked, 1 - locked */
        u32 ber_bit_count;      /* Total number of SYNC bits. */
-        u32 ber_error_count;    /* Number of erronous SYNC bits. */
+        u32 ber_error_count;    /* Number of erroneous SYNC bits. */
        s32 MRC_SNR;            /* dB */
        s32 mrc_in_band_pwr;    /* In band power in dBM */
diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
index 58de4410c525..6c7ff0cdcd32 100644
--- a/drivers/media/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb-core/dvb_demux.c
@@ -435,7 +435,7 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                dprintk_tscheck("TEI detected. "
                                "PID=0x%x data1=0x%x\n",
                                pid, buf[1]);
-                /* data in this packet cant be trusted - drop it unless
+                /* data in this packet can't be trusted - drop it unless
                 * module option dvb_demux_feed_err_pkts is set */
                if (!dvb_demux_feed_err_pkts)
                        return;
@@ -1032,8 +1032,13 @@ static int dmx_section_feed_release_filter(struct dmx_section_feed *feed,
                return -EINVAL;
        }
-        if (feed->is_filtering)
+        if (feed->is_filtering) {
+                /* release dvbdmx->mutex as far as it is
+                   acquired by stop_filtering() itself */
+                mutex_unlock(&dvbdmx->mutex);
                feed->stop_filtering(feed);
+                mutex_lock(&dvbdmx->mutex);
+        }
        spin_lock_irq(&dvbdmx->lock);
        f = dvbdmxfeed->filter;
diff --git a/drivers/media/dvb-frontends/af9033.c b/drivers/media/dvb-frontends/af9033.c
index 30ee59052157..65728c25ea05 100644
--- a/drivers/media/dvb-frontends/af9033.c
+++ b/drivers/media/dvb-frontends/af9033.c
@@ -170,18 +170,18 @@ static int af9033_rd_reg_mask(struct af9033_state *state, u32 reg, u8 *val,
 static int af9033_wr_reg_val_tab(struct af9033_state *state,
                const struct reg_val *tab, int tab_len)
 {
+#define MAX_TAB_LEN 212
        int ret, i, j;
-        u8 buf[MAX_XFER_SIZE];
+        u8 buf[1 + MAX_TAB_LEN];
+        dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
        if (tab_len > sizeof(buf)) {
-                dev_warn(&state->i2c->dev,
+                dev_warn(&state->i2c->dev, "%s: tab len %d is too big\n",
-                         "%s: i2c wr len=%d is too big!\n",
+                                KBUILD_MODNAME, tab_len);
-                         KBUILD_MODNAME, tab_len);
                return -EINVAL;
        }
-        dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
        for (i = 0, j = 0; i < tab_len; i++) {
                buf[j] = tab[i].val;
diff --git a/drivers/media/dvb-frontends/cxd2820r_c.c b/drivers/media/dvb-frontends/cxd2820r_c.c
index 125a44041011..5c6ab4921bf1 100644
--- a/drivers/media/dvb-frontends/cxd2820r_c.c
+++ b/drivers/media/dvb-frontends/cxd2820r_c.c
@@ -78,7 +78,7 @@ int cxd2820r_set_frontend_c(struct dvb_frontend *fe)
        num = if_freq / 1000; /* Hz => kHz */
        num *= 0x4000;
-        if_ctl = cxd2820r_div_u64_round_closest(num, 41000);
+        if_ctl = 0x4000 - cxd2820r_div_u64_round_closest(num, 41000);
        buf[0] = (if_ctl >> 8) & 0x3f;
        buf[1] = (if_ctl >> 0) & 0xff;
diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
index 90536147bf04..6dbbee453ee1 100644
--- a/drivers/media/dvb-frontends/dib8000.c
+++ b/drivers/media/dvb-frontends/dib8000.c
@@ -3048,7 +3048,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
                        dib8000_set_diversity_in(state->fe[0], state->diversity_onoff);
                        locks = (dib8000_read_word(state, 180) >> 6) & 0x3f; /* P_coff_winlen ? */
-                        /* coff should lock over P_coff_winlen ofdm symbols : give 3 times this lenght to lock */
+                        /* coff should lock over P_coff_winlen ofdm symbols : give 3 times this length to lock */
                        *timeout = dib8000_get_timeout(state, 2 * locks, SYMBOL_DEPENDENT_ON);
                        *tune_state = CT_DEMOD_STEP_5;
                        break;
@@ -3115,7 +3115,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
        case CT_DEMOD_STEP_9: /* 39 */
                        if ((state->revision == 0x8090) || ((dib8000_read_word(state, 1291) >> 9) & 0x1)) { /* fe capable of deinterleaving : esram */
-                                /* defines timeout for mpeg lock depending on interleaver lenght of longest layer */
+                                /* defines timeout for mpeg lock depending on interleaver length of longest layer */
                                for (i = 0; i < 3; i++) {
                                        if (c->layer[i].interleaving >= deeper_interleaver) {
                                                dprintk("layer%i: time interleaver = %d ", i, c->layer[i].interleaving);
diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c
index d416c15691da..bf29a3f0e6f0 100644
--- a/drivers/media/dvb-frontends/drxk_hard.c
+++ b/drivers/media/dvb-frontends/drxk_hard.c
@@ -1191,7 +1191,7 @@ static int mpegts_configure_pins(struct drxk_state *state, bool mpeg_enable)
                        goto error;
                if (state->m_enable_parallel == true) {
-                        /* paralel -> enable MD1 to MD7 */
+                        /* parallel -> enable MD1 to MD7 */
                        status = write16(state, SIO_PDR_MD1_CFG__A,
                                         sio_pdr_mdx_cfg);
                        if (status < 0)
@@ -1428,7 +1428,7 @@ static int mpegts_stop(struct drxk_state *state)
        dprintk(1, "\n");
-        /* Gracefull shutdown (byte boundaries) */
+        /* Graceful shutdown (byte boundaries) */
        status = read16(state, FEC_OC_SNC_MODE__A, &fec_oc_snc_mode);
        if (status < 0)
                goto error;
@@ -2021,7 +2021,7 @@ static int mpegts_dto_setup(struct drxk_state *state,
                fec_oc_dto_burst_len = 204;
        }
-        /* Check serial or parrallel output */
+        /* Check serial or parallel output */
        fec_oc_reg_ipr_mode &= (~(FEC_OC_IPR_MODE_SERIAL__M));
        if (state->m_enable_parallel == false) {
                /* MPEG data output is serial -> set ipr_mode[0] */
@@ -2908,7 +2908,7 @@ static int adc_synchronization(struct drxk_state *state)
                goto error;
        if (count == 1) {
-                /* Try sampling on a diffrent edge */
+                /* Try sampling on a different edge */
                u16 clk_neg = 0;
                status = read16(state, IQM_AF_CLKNEG__A, &clk_neg);
@@ -3306,7 +3306,7 @@ static int dvbt_sc_command(struct drxk_state *state,
        if (status < 0)
                goto error;
-        /* Retreive results parameters from SC */
+        /* Retrieve results parameters from SC */
        switch (cmd) {
                /* All commands yielding 5 results */
                /* All commands yielding 4 results */
@@ -3849,7 +3849,7 @@ static int set_dvbt(struct drxk_state *state, u16 intermediate_freqk_hz,
                break;
        }
 #if 0
-        /* No hierachical channels support in BDA */
+        /* No hierarchical channels support in BDA */
        /* Priority (only for hierarchical channels) */
        switch (channel->priority) {
        case DRX_PRIORITY_LOW:
@@ -4081,7 +4081,7 @@ error:
 /*============================================================================*/
 /**
-* \brief Retreive lock status .
+* \brief Retrieve lock status .
 * \param demod    Pointer to demodulator instance.
 * \param lockStat Pointer to lock status structure.
 * \return DRXStatus_t.
@@ -6174,7 +6174,7 @@ static int init_drxk(struct drxk_state *state)
                        goto error;
                /* Stamp driver version number in SCU data RAM in BCD code
-                        Done to enable field application engineers to retreive drxdriver version
+                        Done to enable field application engineers to retrieve drxdriver version
                        via I2C from SCU RAM.
                        Not using SCU command interface for SCU register access since no
                        microcode may be present.
@@ -6399,7 +6399,7 @@ static int drxk_set_parameters(struct dvb_frontend *fe)
        fe->ops.tuner_ops.get_if_frequency(fe, &IF);
        start(state, 0, IF);
-        /* After set_frontend, stats aren't avaliable */
+        /* After set_frontend, stats aren't available */
        p->strength.stat[0].scale = FE_SCALE_RELATIVE;
        p->cnr.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
        p->block_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c
index 7efb796c472c..50e8b63e5169 100644
--- a/drivers/media/dvb-frontends/rtl2830.c
+++ b/drivers/media/dvb-frontends/rtl2830.c
@@ -710,6 +710,7 @@ struct dvb_frontend *rtl2830_attach(const struct rtl2830_config *cfg,
                sizeof(priv->tuner_i2c_adapter.name));
        priv->tuner_i2c_adapter.algo = &rtl2830_tuner_i2c_algo;
        priv->tuner_i2c_adapter.algo_data = NULL;
+        priv->tuner_i2c_adapter.dev.parent = &i2c->dev;
        i2c_set_adapdata(&priv->tuner_i2c_adapter, priv);
        if (i2c_add_adapter(&priv->tuner_i2c_adapter) < 0) {
                dev_err(&i2c->dev,
diff --git a/drivers/media/i2c/adv7183_regs.h b/drivers/media/i2c/adv7183_regs.h
index 4a5b7d211d2f..b253d400e817 100644
--- a/drivers/media/i2c/adv7183_regs.h
+++ b/drivers/media/i2c/adv7183_regs.h
@@ -52,9 +52,9 @@
 #define ADV7183_VS_FIELD_CTRL_1    0x31 /* Vsync field control 1 */
 #define ADV7183_VS_FIELD_CTRL_2    0x32 /* Vsync field control 2 */
 #define ADV7183_VS_FIELD_CTRL_3    0x33 /* Vsync field control 3 */
-#define ADV7183_HS_POS_CTRL_1      0x34 /* Hsync positon control 1 */
+#define ADV7183_HS_POS_CTRL_1      0x34 /* Hsync position control 1 */
-#define ADV7183_HS_POS_CTRL_2      0x35 /* Hsync positon control 2 */
+#define ADV7183_HS_POS_CTRL_2      0x35 /* Hsync position control 2 */
-#define ADV7183_HS_POS_CTRL_3      0x36 /* Hsync positon control 3 */
+#define ADV7183_HS_POS_CTRL_3      0x36 /* Hsync position control 3 */
 #define ADV7183_POLARITY           0x37 /* Polarity */
 #define ADV7183_NTSC_COMB_CTRL     0x38 /* NTSC comb control */
 #define ADV7183_PAL_COMB_CTRL      0x39 /* PAL comb control */
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index fbfdd2fc2a36..a324106b9f11 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -877,7 +877,7 @@ static void configure_custom_video_timings(struct v4l2_subdev *sd,
                break;
        case ADV7604_MODE_HDMI:
                /* set default prim_mode/vid_std for HDMI
-                   accoring to [REF_03, c. 4.2] */
+                   according to [REF_03, c. 4.2] */
                io_write(sd, 0x00, 0x02); /* video std */
                io_write(sd, 0x01, 0x06); /* prim mode */
                break;
diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index 22f729d66a96..b154f36740b4 100644
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -1013,7 +1013,7 @@ static void configure_custom_video_timings(struct v4l2_subdev *sd,
                break;
        case ADV7842_MODE_HDMI:
                /* set default prim_mode/vid_std for HDMI
-                   accoring to [REF_03, c. 4.2] */
+                   according to [REF_03, c. 4.2] */
                io_write(sd, 0x00, 0x02); /* video std */
                io_write(sd, 0x01, 0x06); /* prim mode */
                break;
diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
index 82bf5679da30..99ee456700f4 100644
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -394,7 +394,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
        if (!rc) {
                /*
-                 * If platform_data doesn't specify rc_dev, initilize it
+                 * If platform_data doesn't specify rc_dev, initialize it
                 * internally
                 */
                rc = rc_allocate_device();
diff --git a/drivers/media/i2c/m5mols/m5mols_controls.c b/drivers/media/i2c/m5mols/m5mols_controls.c
index f34429e452ab..a60931e66312 100644
--- a/drivers/media/i2c/m5mols/m5mols_controls.c
+++ b/drivers/media/i2c/m5mols/m5mols_controls.c
@@ -544,7 +544,7 @@ int m5mols_init_controls(struct v4l2_subdev *sd)
        u16 zoom_step;
        int ret;
-        /* Determine the firmware dependant control range and step values */
+        /* Determine the firmware dependent control range and step values */
        ret = m5mols_read_u16(sd, AE_MAX_GAIN_MON, &exposure_max);
        if (ret < 0)
                return ret;
diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index 4734836fe5a4..1c2303d18bf4 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -19,6 +19,7 @@
 #include <linux/i2c.h>
 #include <linux/log2.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/of_gpio.h>
 #include <linux/pm.h>
 #include <linux/regulator/consumer.h>
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index 6fec9384d86e..e7f555cc827a 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -1460,7 +1460,7 @@ static int s5c73m3_oif_registered(struct v4l2_subdev *sd)
        mutex_unlock(&state->lock);
        v4l2_dbg(1, s5c73m3_dbg, sd, "%s: Booting %s (%d)\n",
-                 __func__, ret ? "failed" : "succeded", ret);
+                 __func__, ret ? "failed" : "succeeded", ret);
        return ret;
 }
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3.h b/drivers/media/i2c/s5c73m3/s5c73m3.h
index 9d2c08652246..9dfa516f6944 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3.h
+++ b/drivers/media/i2c/s5c73m3/s5c73m3.h
@@ -393,7 +393,7 @@ struct s5c73m3 {
        /* External master clock frequency */
        u32 mclk_frequency;
-        /* Video bus type - MIPI-CSI2/paralell */
+        /* Video bus type - MIPI-CSI2/parallel */
        enum v4l2_mbus_type bus_type;
        const struct s5c73m3_frame_size *sensor_pix_size[2];
diff --git a/drivers/media/i2c/saa7115.c b/drivers/media/i2c/saa7115.c
index 637d02634527..afdbcb045cee 100644
--- a/drivers/media/i2c/saa7115.c
+++ b/drivers/media/i2c/saa7115.c
@@ -1699,7 +1699,7 @@ static void saa711x_write_platform_data(struct saa711x_state *state,
 * the analog demod.
 * If the tuner is not found, it returns -ENODEV.
 * If auto-detection is disabled and the tuner doesn't match what it was
- *      requred, it returns -EINVAL and fills 'name'.
+ *      required, it returns -EINVAL and fills 'name'.
 * If the chip is found, it returns the chip ID and fills 'name'.
 */
 static int saa711x_detect_chip(struct i2c_client *client,
diff --git a/drivers/media/i2c/soc_camera/ov5642.c b/drivers/media/i2c/soc_camera/ov5642.c
index 0a5c5d4fedd6..d2daa6a8f272 100644
--- a/drivers/media/i2c/soc_camera/ov5642.c
+++ b/drivers/media/i2c/soc_camera/ov5642.c
@@ -642,7 +642,7 @@ static const struct ov5642_datafmt
 static int reg_read(struct i2c_client *client, u16 reg, u8 *val)
 {
        int ret;
-        /* We have 16-bit i2c addresses - care for endianess */
+        /* We have 16-bit i2c addresses - care for endianness */
        unsigned char data[2] = { reg >> 8, reg & 0xff };
        ret = i2c_master_send(client, data, 2);
diff --git a/drivers/media/i2c/ths7303.c b/drivers/media/i2c/ths7303.c
index 42276d93624c..ed9ae8875348 100644
--- a/drivers/media/i2c/ths7303.c
+++ b/drivers/media/i2c/ths7303.c
@@ -83,7 +83,8 @@ static int ths7303_write(struct v4l2_subdev *sd, u8 reg, u8 val)
 }
 /* following function is used to set ths7303 */
-int ths7303_setval(struct v4l2_subdev *sd, enum ths7303_filter_mode mode)
+static int ths7303_setval(struct v4l2_subdev *sd,
+                          enum ths7303_filter_mode mode)
 {
        struct i2c_client *client = v4l2_get_subdevdata(sd);
        struct ths7303_state *state = to_state(sd);
diff --git a/drivers/media/i2c/wm8775.c b/drivers/media/i2c/wm8775.c
index 3f584a7d0781..bee7946faa7c 100644
--- a/drivers/media/i2c/wm8775.c
+++ b/drivers/media/i2c/wm8775.c
@@ -130,12 +130,10 @@ static int wm8775_s_routing(struct v4l2_subdev *sd,
                return -EINVAL;
        }
        state->input = input;
-        if (!v4l2_ctrl_g_ctrl(state->mute))
+        if (v4l2_ctrl_g_ctrl(state->mute))
                return 0;
        if (!v4l2_ctrl_g_ctrl(state->vol))
                return 0;
-        if (!v4l2_ctrl_g_ctrl(state->bal))
-                return 0;
        wm8775_set_audio(sd, 1);
        return 0;
 }
diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index a3b1ee9c00d7..92a06fd85865 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -4182,7 +4182,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
        }
        btv->std = V4L2_STD_PAL;
        init_irqreg(btv);
-        v4l2_ctrl_handler_setup(hdl);
+        if (!bttv_tvcards[btv->c.type].no_video)
+                v4l2_ctrl_handler_setup(hdl);
        if (hdl->error) {
                result = hdl->error;
                goto fail2;
diff --git a/drivers/media/pci/cx18/cx18-driver.h b/drivers/media/pci/cx18/cx18-driver.h
index 2767c64df0c8..57f4688ea55b 100644
--- a/drivers/media/pci/cx18/cx18-driver.h
+++ b/drivers/media/pci/cx18/cx18-driver.h
@@ -262,7 +262,7 @@ struct cx18_options {
 };
 /* per-mdl bit flags */
-#define CX18_F_M_NEED_SWAP  0   /* mdl buffer data must be endianess swapped */
+#define CX18_F_M_NEED_SWAP  0   /* mdl buffer data must be endianness swapped */
 /* per-stream, s_flags */
 #define CX18_F_S_CLAIMED        3       /* this stream is claimed */
diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
index e3fc2c71808a..95666eee7b27 100644
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -427,7 +427,7 @@ int mc417_register_read(struct cx23885_dev *dev, u16 address, u32 *value)
        cx_write(MC417_RWD, regval);
        /* Transition RD to effect read transaction across bus.
-         * Transtion 0x5000 -> 0x9000 correct (RD/RDY -> WR/RDY)?
+         * Transition 0x5000 -> 0x9000 correct (RD/RDY -> WR/RDY)?
         * Should it be 0x9000 -> 0xF000 (also why is RDY being set, its
         * input only...)
         */
diff --git a/drivers/media/pci/pluto2/pluto2.c b/drivers/media/pci/pluto2/pluto2.c
index 8164d74b46a4..655d6854a8d7 100644
--- a/drivers/media/pci/pluto2/pluto2.c
+++ b/drivers/media/pci/pluto2/pluto2.c
@@ -401,7 +401,7 @@ static int pluto_hw_init(struct pluto *pluto)
        /* set automatic LED control by FPGA */
        pluto_rw(pluto, REG_MISC, MISC_ALED, MISC_ALED);
-        /* set data endianess */
+        /* set data endianness */
 #ifdef __LITTLE_ENDIAN
        pluto_rw(pluto, REG_PIDn(0), PID0_END, PID0_END);
 #else
diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index 57ef5456f1e8..1bf06970ca3e 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -1354,9 +1354,11 @@ static int saa7164_initdev(struct pci_dev *pci_dev,
                if (fw_debug) {
                        dev->kthread = kthread_run(saa7164_thread_function, dev,
                                "saa7164 debug");
-                        if (!dev->kthread)
+                        if (IS_ERR(dev->kthread)) {
+                                dev->kthread = NULL;
                                printk(KERN_ERR "%s() Failed to create "
                                        "debug kernel thread\n", __func__);
+                        }
                }
        } /* != BOARD_UNKNOWN */
diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
index bd72fb97fea5..61f3dbcc259f 100644
--- a/drivers/media/platform/coda.c
+++ b/drivers/media/platform/coda.c
@@ -1434,7 +1434,7 @@ static void coda_buf_queue(struct vb2_buffer *vb)
        if (q_data->fourcc == V4L2_PIX_FMT_H264 &&
            vb->vb2_queue->type == V4L2_BUF_TYPE_VIDEO_OUTPUT) {
                /*
-                 * For backwards compatiblity, queuing an empty buffer marks
+                 * For backwards compatibility, queuing an empty buffer marks
                 * the stream end
                 */
                if (vb2_get_plane_payload(vb, 0) == 0)
diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
index 3d66d88ea3a1..f7915695c907 100644
--- a/drivers/media/platform/exynos4-is/fimc-core.c
+++ b/drivers/media/platform/exynos4-is/fimc-core.c
@@ -1039,7 +1039,7 @@ static int fimc_runtime_resume(struct device *dev)
        dbg("fimc%d: state: 0x%lx", fimc->id, fimc->state);
-        /* Enable clocks and perform basic initalization */
+        /* Enable clocks and perform basic initialization */
        clk_enable(fimc->clock[CLK_GATE]);
        fimc_hw_reset(fimc);
diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
index 7a4ee4c0449d..c1bce170df6f 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -759,7 +759,7 @@ static int fimc_md_register_platform_entity(struct fimc_md *fmd,
                goto dev_unlock;
        drvdata = dev_get_drvdata(dev);
-        /* Some subdev didn't probe succesfully id drvdata is NULL */
+        /* Some subdev didn't probe successfully id drvdata is NULL */
        if (drvdata) {
                switch (plat_entity) {
                case IDX_FIMC:
diff --git a/drivers/media/platform/marvell-ccic/mmp-driver.c b/drivers/media/platform/marvell-ccic/mmp-driver.c
index 3458fa0e2fd5..054507f16734 100644
--- a/drivers/media/platform/marvell-ccic/mmp-driver.c
+++ b/drivers/media/platform/marvell-ccic/mmp-driver.c
@@ -142,12 +142,6 @@ static int mmpcam_power_up(struct mcam_camera *mcam)
        struct mmp_camera *cam = mcam_to_cam(mcam);
        struct mmp_camera_platform_data *pdata;
-        if (mcam->bus_type == V4L2_MBUS_CSI2) {
-                cam->mipi_clk = devm_clk_get(mcam->dev, "mipi");
-                if ((IS_ERR(cam->mipi_clk) && mcam->dphy[2] == 0))
-                        return PTR_ERR(cam->mipi_clk);
-        }
 /*
 * Turn on power and clocks to the controller.
 */
@@ -186,12 +180,6 @@ static void mmpcam_power_down(struct mcam_camera *mcam)
        gpio_set_value(pdata->sensor_power_gpio, 0);
        gpio_set_value(pdata->sensor_reset_gpio, 0);
-        if (mcam->bus_type == V4L2_MBUS_CSI2 && !IS_ERR(cam->mipi_clk)) {
-                if (cam->mipi_clk)
-                        devm_clk_put(mcam->dev, cam->mipi_clk);
-                cam->mipi_clk = NULL;
-        }
        mcam_clk_disable(mcam);
 }
@@ -292,8 +280,9 @@ void mmpcam_calc_dphy(struct mcam_camera *mcam)
                return;
        /* get the escape clk, this is hard coded */
+        clk_prepare_enable(cam->mipi_clk);
        tx_clk_esc = (clk_get_rate(cam->mipi_clk) / 1000000) / 12;
+        clk_disable_unprepare(cam->mipi_clk);
        /*
         * dphy[2] - CSI2_DPHY6:
         * bit 0 ~ bit 7: CK Term Enable
@@ -325,19 +314,6 @@ static irqreturn_t mmpcam_irq(int irq, void *data)
        return IRQ_RETVAL(handled);
 }
-static void mcam_deinit_clk(struct mcam_camera *mcam)
-{
-        unsigned int i;
-        for (i = 0; i < NR_MCAM_CLK; i++) {
-                if (!IS_ERR(mcam->clk[i])) {
-                        if (mcam->clk[i])
-                                devm_clk_put(mcam->dev, mcam->clk[i]);
-                }
-                mcam->clk[i] = NULL;
-        }
-}
 static void mcam_init_clk(struct mcam_camera *mcam)
 {
        unsigned int i;
@@ -371,7 +347,6 @@ static int mmpcam_probe(struct platform_device *pdev)
        if (cam == NULL)
                return -ENOMEM;
        cam->pdev = pdev;
-        cam->mipi_clk = NULL;
        INIT_LIST_HEAD(&cam->devlist);
        mcam = &cam->mcam;
@@ -387,6 +362,11 @@ static int mmpcam_probe(struct platform_device *pdev)
        mcam->mclk_div = pdata->mclk_div;
        mcam->bus_type = pdata->bus_type;
        mcam->dphy = pdata->dphy;
+        if (mcam->bus_type == V4L2_MBUS_CSI2) {
+                cam->mipi_clk = devm_clk_get(mcam->dev, "mipi");
+                if ((IS_ERR(cam->mipi_clk) && mcam->dphy[2] == 0))
+                        return PTR_ERR(cam->mipi_clk);
+        }
        mcam->mipi_enabled = false;
        mcam->lane = pdata->lane;
        mcam->chip_id = MCAM_ARMADA610;
@@ -444,7 +424,7 @@ static int mmpcam_probe(struct platform_device *pdev)
         */
        ret = mmpcam_power_up(mcam);
        if (ret)
-                goto out_deinit_clk;
+                return ret;
        ret = mccic_register(mcam);
        if (ret)
                goto out_power_down;
@@ -469,8 +449,6 @@ out_unregister:
        mccic_shutdown(mcam);
 out_power_down:
        mmpcam_power_down(mcam);
-out_deinit_clk:
-        mcam_deinit_clk(mcam);
        return ret;
 }
@@ -478,18 +456,10 @@ out_deinit_clk:
 static int mmpcam_remove(struct mmp_camera *cam)
 {
        struct mcam_camera *mcam = &cam->mcam;
-        struct mmp_camera_platform_data *pdata;
        mmpcam_remove_device(cam);
        mccic_shutdown(mcam);
        mmpcam_power_down(mcam);
-        pdata = cam->pdev->dev.platform_data;
-        gpio_free(pdata->sensor_reset_gpio);
-        gpio_free(pdata->sensor_power_gpio);
-        mcam_deinit_clk(mcam);
-        iounmap(cam->power_regs);
-        iounmap(mcam->regs);
-        kfree(cam);
        return 0;
 }
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 1c3608039663..561bce8ffb1b 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -1673,7 +1673,7 @@ void omap3isp_print_status(struct isp_device *isp)
 * ISP clocks get disabled in suspend(). Similarly, the clocks are reenabled in
 * resume(), and the the pipelines are restarted in complete().
 *
- * TODO: PM dependencies between the ISP and sensors are not modeled explicitly
+ * TODO: PM dependencies between the ISP and sensors are not modelled explicitly
 * yet.
 */
 static int isp_pm_prepare(struct device *dev)
diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
index a908d006f527..f6304bb074f5 100644
--- a/drivers/media/platform/omap3isp/ispvideo.c
+++ b/drivers/media/platform/omap3isp/ispvideo.c
@@ -339,14 +339,11 @@ __isp_video_get_format(struct isp_video *video, struct v4l2_format *format)
        if (subdev == NULL)
                return -EINVAL;
-        mutex_lock(&video->mutex);
        fmt.pad = pad;
        fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE;
-        ret = v4l2_subdev_call(subdev, pad, get_fmt, NULL, &fmt);
-        if (ret == -ENOIOCTLCMD)
-                ret = -EINVAL;
+        mutex_lock(&video->mutex);
+        ret = v4l2_subdev_call(subdev, pad, get_fmt, NULL, &fmt);
        mutex_unlock(&video->mutex);
        if (ret)
diff --git a/drivers/media/platform/s5p-mfc/regs-mfc.h b/drivers/media/platform/s5p-mfc/regs-mfc.h
index 9319e93599ae..6ccc3f8c122a 100644
--- a/drivers/media/platform/s5p-mfc/regs-mfc.h
+++ b/drivers/media/platform/s5p-mfc/regs-mfc.h
@@ -382,7 +382,7 @@
 #define S5P_FIMV_R2H_CMD_EDFU_INIT_RET          16
 #define S5P_FIMV_R2H_CMD_ERR_RET                32
-/* Dummy definition for MFCv6 compatibilty */
+/* Dummy definition for MFCv6 compatibility */
 #define S5P_FIMV_CODEC_H264_MVC_DEC             -1
 #define S5P_FIMV_R2H_CMD_FIELD_DONE_RET         -1
 #define S5P_FIMV_MFC_RESET                      -1
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 5f2c4ad6c2cb..e46067a57853 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -239,7 +239,7 @@ static void s5p_mfc_handle_frame_copy_time(struct s5p_mfc_ctx *ctx)
        frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_dec_frame_type, dev);
        /* Copy timestamp / timecode from decoded src to dst and set
-           appropraite flags */
+           appropriate flags */
        src_buf = list_entry(ctx->src_queue.next, struct s5p_mfc_buf, list);
        list_for_each_entry(dst_buf, &ctx->dst_queue, list) {
                if (vb2_dma_contig_plane_dma_addr(dst_buf->b, 0) == dec_y_addr) {
@@ -428,7 +428,7 @@ static void s5p_mfc_handle_error(struct s5p_mfc_dev *dev,
                case MFCINST_FINISHING:
                case MFCINST_FINISHED:
                case MFCINST_RUNNING:
-                        /* It is higly probable that an error occured
+                        /* It is highly probable that an error occurred
                         * while decoding a frame */
                        clear_work_bit(ctx);
                        ctx->state = MFCINST_ERROR;
@@ -611,7 +611,7 @@ static irqreturn_t s5p_mfc_irq(int irq, void *priv)
        mfc_debug(1, "Int reason: %d (err: %08x)\n", reason, err);
        switch (reason) {
        case S5P_MFC_R2H_CMD_ERR_RET:
-                /* An error has occured */
+                /* An error has occurred */
                if (ctx->state == MFCINST_RUNNING &&
                        s5p_mfc_hw_call(dev->mfc_ops, err_dec, err) >=
                                dev->warn_start)
@@ -840,7 +840,7 @@ static int s5p_mfc_open(struct file *file)
        mutex_unlock(&dev->mfc_mutex);
        mfc_debug_leave();
        return ret;
-        /* Deinit when failure occured */
+        /* Deinit when failure occurred */
 err_queue_init:
        if (dev->num_inst == 1)
                s5p_mfc_deinit_hw(dev);
@@ -881,14 +881,14 @@ static int s5p_mfc_release(struct file *file)
        /* Mark context as idle */
        clear_work_bit_irqsave(ctx);
        /* If instance was initialised then
-         * return instance and free reosurces */
+         * return instance and free resources */
        if (ctx->inst_no != MFC_NO_INSTANCE_SET) {
                mfc_debug(2, "Has to free instance\n");
                ctx->state = MFCINST_RETURN_INST;
                set_work_bit_irqsave(ctx);
                s5p_mfc_clean_ctx_int_flags(ctx);
                s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
-                /* Wait until instance is returned or timeout occured */
+                /* Wait until instance is returned or timeout occurred */
                if (s5p_mfc_wait_for_done_ctx
                    (ctx, S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0)) {
                        s5p_mfc_clock_off();
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
index 7cab6849fb5b..2475a3c9a0a6 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
@@ -69,7 +69,7 @@ int s5p_mfc_alloc_firmware(struct s5p_mfc_dev *dev)
        } else {
                /* In this case bank2 can point to the same address as bank1.
-                 * Firmware will always occupy the beggining of this area so it is
+                 * Firmware will always occupy the beginning of this area so it is
                 * impossible having a video frame buffer with zero address. */
                dev->bank2 = dev->bank1;
        }
diff --git a/drivers/media/platform/s5p-tv/mixer.h b/drivers/media/platform/s5p-tv/mixer.h
index 04e6490a45be..fb2acc53112a 100644
--- a/drivers/media/platform/s5p-tv/mixer.h
+++ b/drivers/media/platform/s5p-tv/mixer.h
@@ -65,7 +65,7 @@ struct mxr_format {
        int num_subframes;
        /** specifies to which subframe belong given plane */
        int plane2subframe[MXR_MAX_PLANES];
-        /** internal code, driver dependant */
+        /** internal code, driver dependent */
        unsigned long cookie;
 };
diff --git a/drivers/media/platform/s5p-tv/mixer_video.c b/drivers/media/platform/s5p-tv/mixer_video.c
index 641b1f071e06..81b97db111d8 100644
--- a/drivers/media/platform/s5p-tv/mixer_video.c
+++ b/drivers/media/platform/s5p-tv/mixer_video.c
@@ -528,7 +528,7 @@ static int mxr_s_dv_timings(struct file *file, void *fh,
        mutex_lock(&mdev->mutex);
        /* timings change cannot be done while there is an entity
-         * dependant on output configuration
+         * dependent on output configuration
         */
        if (mdev->n_output > 0) {
                mutex_unlock(&mdev->mutex);
@@ -585,7 +585,7 @@ static int mxr_s_std(struct file *file, void *fh, v4l2_std_id norm)
        mutex_lock(&mdev->mutex);
        /* standard change cannot be done while there is an entity
-         * dependant on output configuration
+         * dependent on output configuration
         */
        if (mdev->n_output > 0) {
                mutex_unlock(&mdev->mutex);
diff --git a/drivers/media/platform/soc_camera/omap1_camera.c b/drivers/media/platform/soc_camera/omap1_camera.c
index 6769193c7c7b..74ce8b6b79fa 100644
--- a/drivers/media/platform/soc_camera/omap1_camera.c
+++ b/drivers/media/platform/soc_camera/omap1_camera.c
@@ -1495,7 +1495,7 @@ static int omap1_cam_set_bus_param(struct soc_camera_device *icd)
        if (ctrlclock & LCLK_EN)
                CAM_WRITE(pcdev, CTRLCLOCK, ctrlclock);
-        /* select bus endianess */
+        /* select bus endianness */
        xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
        fmt = xlate->host_fmt;
diff --git a/drivers/media/platform/vivi.c b/drivers/media/platform/vivi.c
index 1d3f11965196..2d4e73b45c5e 100644
--- a/drivers/media/platform/vivi.c
+++ b/drivers/media/platform/vivi.c
@@ -1108,7 +1108,7 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
        return 0;
 }
-/* timeperframe is arbitrary and continous */
+/* timeperframe is arbitrary and continuous */
 static int vidioc_enum_frameintervals(struct file *file, void *priv,
                                             struct v4l2_frmivalenum *fival)
 {
@@ -1125,7 +1125,7 @@ static int vidioc_enum_frameintervals(struct file *file, void *priv,
        fival->type = V4L2_FRMIVAL_TYPE_CONTINUOUS;
-        /* fill in stepwise (step=1.0 is requred by V4L2 spec) */
+        /* fill in stepwise (step=1.0 is required by V4L2 spec) */
        fival->stepwise.min  = tpf_min;
        fival->stepwise.max  = tpf_max;
        fival->stepwise.step = (struct v4l2_fract) {1, 1};
diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
index 1c9e771aa15c..d16bf0f41e24 100644
--- a/drivers/media/platform/vsp1/vsp1_drv.c
+++ b/drivers/media/platform/vsp1/vsp1_drv.c
@@ -323,7 +323,7 @@ static void vsp1_clocks_disable(struct vsp1_device *vsp1)
 * Increment the VSP1 reference count and initialize the device if the first
 * reference is taken.
 *
- * Return a pointer to the VSP1 device or NULL if an error occured.
+ * Return a pointer to the VSP1 device or NULL if an error occurred.
 */
 struct vsp1_device *vsp1_device_get(struct vsp1_device *vsp1)
 {
diff --git a/drivers/media/platform/vsp1/vsp1_video.c b/drivers/media/platform/vsp1/vsp1_video.c
index 714c53ef6c11..4b0ac07af662 100644
--- a/drivers/media/platform/vsp1/vsp1_video.c
+++ b/drivers/media/platform/vsp1/vsp1_video.c
@@ -1026,8 +1026,10 @@ int vsp1_video_init(struct vsp1_video *video, struct vsp1_entity *rwpf)
        /* ... and the buffers queue... */
        video->alloc_ctx = vb2_dma_contig_init_ctx(video->vsp1->dev);
-        if (IS_ERR(video->alloc_ctx))
+        if (IS_ERR(video->alloc_ctx)) {
+                ret = PTR_ERR(video->alloc_ctx);
                goto error;
+        }
        video->queue.type = video->type;
        video->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF;
diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c
index 3db8a8cfe1a8..050b3bb96fec 100644
--- a/drivers/media/radio/radio-shark.c
+++ b/drivers/media/radio/radio-shark.c
@@ -271,8 +271,7 @@ static void shark_unregister_leds(struct shark_device *shark)
        cancel_work_sync(&shark->led_work);
 }
-#ifdef CONFIG_PM
+static inline void shark_resume_leds(struct shark_device *shark)
-static void shark_resume_leds(struct shark_device *shark)
 {
        if (test_bit(BLUE_IS_PULSE, &shark->brightness_new))
                set_bit(BLUE_PULSE_LED, &shark->brightness_new);
@@ -281,7 +280,6 @@ static void shark_resume_leds(struct shark_device *shark)
        set_bit(RED_LED, &shark->brightness_new);
        schedule_work(&shark->led_work);
 }
-#endif
 #else
 static int shark_register_leds(struct shark_device *shark, struct device *dev)
 {
diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
index d86d90dab8bf..8654e0dc5c95 100644
--- a/drivers/media/radio/radio-shark2.c
+++ b/drivers/media/radio/radio-shark2.c
@@ -237,8 +237,7 @@ static void shark_unregister_leds(struct shark_device *shark)
        cancel_work_sync(&shark->led_work);
 }
-#ifdef CONFIG_PM
+static inline void shark_resume_leds(struct shark_device *shark)
-static void shark_resume_leds(struct shark_device *shark)
 {
        int i;
@@ -247,7 +246,6 @@ static void shark_resume_leds(struct shark_device *shark)
        schedule_work(&shark->led_work);
 }
-#endif
 #else
 static int shark_register_leds(struct shark_device *shark, struct device *dev)
 {
diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
index 9c9084cb99f7..2fd9009f8663 100644
--- a/drivers/media/radio/radio-si476x.c
+++ b/drivers/media/radio/radio-si476x.c
@@ -268,8 +268,8 @@ struct si476x_radio;
 *
 * @tune_freq: Tune chip to a specific frequency
 * @seek_start: Star station seeking
- * @rsq_status: Get Recieved Signal Quality(RSQ) status
+ * @rsq_status: Get Received Signal Quality(RSQ) status
- * @rds_blckcnt: Get recived RDS blocks count
+ * @rds_blckcnt: Get received RDS blocks count
 * @phase_diversity: Change phase diversity mode of the tuner
 * @phase_div_status: Get phase diversity mode status
 * @acf_status: Get the status of Automatically Controlled
diff --git a/drivers/media/radio/radio-tea5764.c b/drivers/media/radio/radio-tea5764.c
index 036e2f54f4db..3ed1f5669f79 100644
--- a/drivers/media/radio/radio-tea5764.c
+++ b/drivers/media/radio/radio-tea5764.c
@@ -356,7 +356,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
                   So we keep it as-is. */
                return -EINVAL;
        }
-        clamp(freq, FREQ_MIN * FREQ_MUL, FREQ_MAX * FREQ_MUL);
+        freq = clamp(freq, FREQ_MIN * FREQ_MUL, FREQ_MAX * FREQ_MUL);
        tea5764_power_up(radio);
        tea5764_tune(radio, (freq * 125) / 2);
        return 0;
diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
index 69e3245a58a0..a9319a24c7ef 100644
--- a/drivers/media/radio/tef6862.c
+++ b/drivers/media/radio/tef6862.c
@@ -112,7 +112,7 @@ static int tef6862_s_frequency(struct v4l2_subdev *sd, const struct v4l2_frequen
        if (f->tuner != 0)
                return -EINVAL;
-        clamp(freq, TEF6862_LO_FREQ, TEF6862_HI_FREQ);
+        freq = clamp(freq, TEF6862_LO_FREQ, TEF6862_HI_FREQ);
        pll = 1964 + ((freq - TEF6862_LO_FREQ) * 20) / FREQ_MUL;
        i2cmsg[0] = (MSA_MODE_PRESET << MSA_MODE_SHIFT) | WM_SUB_PLLM;
        i2cmsg[1] = (pll >> 8) & 0xff;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 72e3fa652481..f329485c6629 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -1370,7 +1370,7 @@ static void imon_pad_to_keys(struct imon_context *ictx, unsigned char *buf)
         * 0x68nnnnB7 to 0x6AnnnnB7, the left mouse button generates
         * 0x688301b7 and the right one 0x688481b7. All other keys generate
         * 0x2nnnnnnn. Position coordinate is encoded in buf[1] and buf[2] with
-         * reversed endianess. Extract direction from buffer, rotate endianess,
+         * reversed endianness. Extract direction from buffer, rotate endianness,
         * adjust sign and feed the values into stabilize(). The resulting codes
         * will be 0x01008000, 0x01007F00, which match the newer devices.
         */
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 094484fac94c..a5d4f883d053 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -118,7 +118,7 @@ static int debug;
 #define RR3_IR_IO_LENGTH_FUZZ   0x04
 /* Timeout for end of signal detection */
 #define RR3_IR_IO_SIG_TIMEOUT   0x05
-/* Minumum value for pause recognition. */
+/* Minimum value for pause recognition. */
 #define RR3_IR_IO_MIN_PAUSE     0x06
 /* Clock freq. of EZ-USB chip */
diff --git a/drivers/media/tuners/mt2063.c b/drivers/media/tuners/mt2063.c
index 2e1a02e360ff..20cca405bf45 100644
--- a/drivers/media/tuners/mt2063.c
+++ b/drivers/media/tuners/mt2063.c
@@ -1195,7 +1195,7 @@ static u32 mt2063_set_dnc_output_enable(struct mt2063_state *state,
 *   DNC Output is selected, the other is always off)
 *
 * @state:      ptr to mt2063_state structure
- * @Mode:       desired reciever delivery system
+ * @Mode:       desired receiver delivery system
 *
 * Note: Register cache must be valid for it to work
 */
@@ -2119,7 +2119,7 @@ static int mt2063_set_analog_params(struct dvb_frontend *fe,
 /*
 * As defined on EN 300 429, the DVB-C roll-off factor is 0.15.
- * So, the amount of the needed bandwith is given by:
+ * So, the amount of the needed bandwidth is given by:
 *      Bw = Symbol_rate * (1 + 0.15)
 * As such, the maximum symbol rate supported by 6 MHz is given by:
 *      max_symbol_rate = 6 MHz / 1.15 = 5217391 Bauds
diff --git a/drivers/media/tuners/tuner-xc2028-types.h b/drivers/media/tuners/tuner-xc2028-types.h
index 74dc46a71f64..7e4798783db7 100644
--- a/drivers/media/tuners/tuner-xc2028-types.h
+++ b/drivers/media/tuners/tuner-xc2028-types.h
@@ -119,7 +119,7 @@
 #define V4L2_STD_A2             (V4L2_STD_A2_A    | V4L2_STD_A2_B)
 #define V4L2_STD_NICAM          (V4L2_STD_NICAM_A | V4L2_STD_NICAM_B)
-/* To preserve backward compatibilty,
+/* To preserve backward compatibility,
   (std & V4L2_STD_AUDIO) = 0 means that ALL audio stds are supported
 */
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
index e9d017bea377..528cce958a82 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1412,8 +1412,8 @@ err_v4l2:
        usb_set_intfdata(interface, NULL);
 err_if:
        usb_put_dev(udev);
-        kfree(dev);
        clear_bit(dev->devno, &cx231xx_devused);
+        kfree(dev);
        return retval;
 }
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index c8fcd78425bd..8f9b2cea88f0 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -131,7 +131,7 @@ static int af9035_wr_regs(struct dvb_usb_device *d, u32 reg, u8 *val, int len)
 {
        u8 wbuf[MAX_XFER_SIZE];
        u8 mbox = (reg >> 16) & 0xff;
-        struct usb_req req = { CMD_MEM_WR, mbox, sizeof(wbuf), wbuf, 0, NULL };
+        struct usb_req req = { CMD_MEM_WR, mbox, 6 + len, wbuf, 0, NULL };
        if (6 + len > sizeof(wbuf)) {
                dev_warn(&d->udev->dev, "%s: i2c wr: len=%d is too big!\n",
@@ -238,14 +238,15 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                } else {
                        /* I2C */
                        u8 buf[MAX_XFER_SIZE];
-                        struct usb_req req = { CMD_I2C_RD, 0, sizeof(buf),
+                        struct usb_req req = { CMD_I2C_RD, 0, 5 + msg[0].len,
                                        buf, msg[1].len, msg[1].buf };
                        if (5 + msg[0].len > sizeof(buf)) {
                                dev_warn(&d->udev->dev,
                                         "%s: i2c xfer: len=%d is too big!\n",
                                         KBUILD_MODNAME, msg[0].len);
-                                return -EOPNOTSUPP;
+                                ret = -EOPNOTSUPP;
+                                goto unlock;
                        }
                        req.mbox |= ((msg[0].addr & 0x80)  >>  3);
                        buf[0] = msg[1].len;
@@ -274,14 +275,15 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                } else {
                        /* I2C */
                        u8 buf[MAX_XFER_SIZE];
-                        struct usb_req req = { CMD_I2C_WR, 0, sizeof(buf), buf,
+                        struct usb_req req = { CMD_I2C_WR, 0, 5 + msg[0].len,
-                                        0, NULL };
+                                        buf, 0, NULL };
                        if (5 + msg[0].len > sizeof(buf)) {
                                dev_warn(&d->udev->dev,
                                         "%s: i2c xfer: len=%d is too big!\n",
                                         KBUILD_MODNAME, msg[0].len);
-                                return -EOPNOTSUPP;
+                                ret = -EOPNOTSUPP;
+                                goto unlock;
                        }
                        req.mbox |= ((msg[0].addr & 0x80)  >>  3);
                        buf[0] = msg[0].len;
@@ -319,6 +321,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
                ret = -EOPNOTSUPP;
        }
+unlock:
        mutex_unlock(&d->i2c_mutex);
        if (ret < 0)
@@ -1534,6 +1537,8 @@ static const struct usb_device_id af9035_id_table[] = {
        /* XXX: that same ID [0ccd:0099] is used by af9015 driver too */
        { DVB_USB_DEVICE(USB_VID_TERRATEC, 0x0099,
                &af9035_props, "TerraTec Cinergy T Stick Dual RC (rev. 2)", NULL) },
+        { DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a05,
+                &af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) },
        { }
 };
 MODULE_DEVICE_TABLE(usb, af9035_id_table);
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 2627553f7de1..08240e498451 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -266,7 +266,7 @@ static int mxl111sf_adap_fe_init(struct dvb_frontend *fe)
        struct mxl111sf_adap_state *adap_state = &state->adap_state[fe->id];
        int err;
-        /* exit if we didnt initialize the driver yet */
+        /* exit if we didn't initialize the driver yet */
        if (!state->chip_id) {
                mxl_debug("driver not yet initialized, exit.");
                goto fail;
@@ -322,7 +322,7 @@ static int mxl111sf_adap_fe_sleep(struct dvb_frontend *fe)
        struct mxl111sf_adap_state *adap_state = &state->adap_state[fe->id];
        int err;
-        /* exit if we didnt initialize the driver yet */
+        /* exit if we didn't initialize the driver yet */
        if (!state->chip_id) {
                mxl_debug("driver not yet initialized, exit.");
                goto fail;
diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
index 40832a1aef6c..98d24aefb640 100644
--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
+++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
@@ -102,7 +102,7 @@ static int technisat_usb2_i2c_access(struct usb_device *udev,
        if (rxlen > 62) {
                err("i2c RX buffer can't exceed 62 bytes (dev 0x%02x)",
                                device_addr);
-                txlen = 62;
+                rxlen = 62;
        }
        b[0] = I2C_SPEED_100KHZ_BIT;
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index fc5d60efd4ab..dd19c9ff76e0 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -1664,8 +1664,8 @@ static int em28xx_v4l2_close(struct file *filp)
        em28xx_videodbg("users=%d\n", dev->users);
-        mutex_lock(&dev->lock);
        vb2_fop_release(filp);
+        mutex_lock(&dev->lock);
        if (dev->users == 1) {
                /* the device is already disconnect,
diff --git a/drivers/media/usb/gspca/gl860/gl860.c b/drivers/media/usb/gspca/gl860/gl860.c
index cb1e64ca59c9..cea8d7f51c3c 100644
--- a/drivers/media/usb/gspca/gl860/gl860.c
+++ b/drivers/media/usb/gspca/gl860/gl860.c
@@ -438,7 +438,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
        s32 nToSkip =
                sd->swapRB * (gspca_dev->cam.cam_mode[mode].bytesperline + 1);
-        /* Test only against 0202h, so endianess does not matter */
+        /* Test only against 0202h, so endianness does not matter */
        switch (*(s16 *) data) {
        case 0x0202:            /* End of frame, start a new one */
                gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
diff --git a/drivers/media/usb/gspca/pac207.c b/drivers/media/usb/gspca/pac207.c
index cd79c180f67b..07529e5a0c56 100644
--- a/drivers/media/usb/gspca/pac207.c
+++ b/drivers/media/usb/gspca/pac207.c
@@ -416,7 +416,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                        u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
        int ret = -EINVAL;
diff --git a/drivers/media/usb/gspca/pac7302.c b/drivers/media/usb/gspca/pac7302.c
index a91509643563..2fd1c5e31a0f 100644
--- a/drivers/media/usb/gspca/pac7302.c
+++ b/drivers/media/usb/gspca/pac7302.c
@@ -874,7 +874,7 @@ static int sd_dbg_s_register(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                        u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
        int ret = -EINVAL;
        u8 data0, data1;
diff --git a/drivers/media/usb/gspca/stk1135.c b/drivers/media/usb/gspca/stk1135.c
index 1fc80af2a189..48234c9a8b6c 100644
--- a/drivers/media/usb/gspca/stk1135.c
+++ b/drivers/media/usb/gspca/stk1135.c
@@ -361,6 +361,9 @@ static void stk1135_configure_clock(struct gspca_dev *gspca_dev)
        /* set serial interface clock divider (30MHz/0x1f*16+2) = 60240 kHz) */
        reg_w(gspca_dev, STK1135_REG_SICTL + 2, 0x1f);
+        /* wait a while for sensor to catch up */
+        udelay(1000);
 }
 static void stk1135_camera_disable(struct gspca_dev *gspca_dev)
diff --git a/drivers/media/usb/gspca/stv0680.c b/drivers/media/usb/gspca/stv0680.c
index 9c0827631b9c..7f94ec74282e 100644
--- a/drivers/media/usb/gspca/stv0680.c
+++ b/drivers/media/usb/gspca/stv0680.c
@@ -139,7 +139,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
        struct sd *sd = (struct sd *) gspca_dev;
        struct cam *cam = &gspca_dev->cam;
-        /* Give the camera some time to settle, otherwise initalization will
+        /* Give the camera some time to settle, otherwise initialization will
           fail on hotplug, and yes it really needs a full second. */
        msleep(1000);
diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
index a517d185febe..46c9f2229a18 100644
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -1027,6 +1027,7 @@ static const struct usb_device_id device_table[] = {
        {USB_DEVICE(0x055f, 0xc650), BS(SPCA533, 0)},
        {USB_DEVICE(0x05da, 0x1018), BS(SPCA504B, 0)},
        {USB_DEVICE(0x06d6, 0x0031), BS(SPCA533, 0)},
+        {USB_DEVICE(0x06d6, 0x0041), BS(SPCA504B, 0)},
        {USB_DEVICE(0x0733, 0x1311), BS(SPCA533, 0)},
        {USB_DEVICE(0x0733, 0x1314), BS(SPCA533, 0)},
        {USB_DEVICE(0x0733, 0x2211), BS(SPCA533, 0)},
diff --git a/drivers/media/usb/gspca/zc3xx.c b/drivers/media/usb/gspca/zc3xx.c
index 7b95d8e88a20..d3e1b6d8bf49 100644
--- a/drivers/media/usb/gspca/zc3xx.c
+++ b/drivers/media/usb/gspca/zc3xx.c
@@ -6905,7 +6905,7 @@ static int sd_get_jcomp(struct gspca_dev *gspca_dev,
 #if IS_ENABLED(CONFIG_INPUT)
 static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
                        u8 *data,               /* interrupt packet data */
-                        int len)                /* interrput packet length */
+                        int len)                /* interrupt packet length */
 {
        if (len == 8 && data[4] == 1) {
                input_report_key(gspca_dev->input_dev, KEY_CAMERA, 1);
diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c
index 77bbf7889659..78c9bc8e7f56 100644
--- a/drivers/media/usb/pwc/pwc-if.c
+++ b/drivers/media/usb/pwc/pwc-if.c
@@ -1039,7 +1039,7 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
        /* Set the leds off */
        pwc_set_leds(pdev, 0, 0);
-        /* Setup intial videomode */
+        /* Setup initial videomode */
        rc = pwc_set_video_mode(pdev, MAX_WIDTH, MAX_HEIGHT,
                                V4L2_PIX_FMT_YUV420, 30, &compression, 1);
        if (rc)
diff --git a/drivers/media/usb/usbtv/usbtv.c b/drivers/media/usb/usbtv/usbtv.c
index 8a505a90d318..6222a4ab1e00 100644
--- a/drivers/media/usb/usbtv/usbtv.c
+++ b/drivers/media/usb/usbtv/usbtv.c
@@ -50,13 +50,8 @@
 #define USBTV_ISOC_TRANSFERS    16
 #define USBTV_ISOC_PACKETS      8
-#define USBTV_WIDTH             720
-#define USBTV_HEIGHT            480
 #define USBTV_CHUNK_SIZE        256
 #define USBTV_CHUNK             240
-#define USBTV_CHUNKS            (USBTV_WIDTH * USBTV_HEIGHT \
-                                        / 4 / USBTV_CHUNK)
 /* Chunk header. */
 #define USBTV_MAGIC_OK(chunk)   ((be32_to_cpu(chunk[0]) & 0xff000000) \
@@ -65,6 +60,27 @@
 #define USBTV_ODD(chunk)        ((be32_to_cpu(chunk[0]) & 0x0000f000) >> 15)
 #define USBTV_CHUNK_NO(chunk)   (be32_to_cpu(chunk[0]) & 0x00000fff)
+#define USBTV_TV_STD  (V4L2_STD_525_60 | V4L2_STD_PAL)
+/* parameters for supported TV norms */
+struct usbtv_norm_params {
+        v4l2_std_id norm;
+        int cap_width, cap_height;
+};
+static struct usbtv_norm_params norm_params[] = {
+        {
+                .norm = V4L2_STD_525_60,
+                .cap_width = 720,
+                .cap_height = 480,
+        },
+        {
+                .norm = V4L2_STD_PAL,
+                .cap_width = 720,
+                .cap_height = 576,
+        }
+};
 /* A single videobuf2 frame buffer. */
 struct usbtv_buf {
        struct vb2_buffer vb;
@@ -94,11 +110,38 @@ struct usbtv {
                USBTV_COMPOSITE_INPUT,
                USBTV_SVIDEO_INPUT,
        } input;
+        v4l2_std_id norm;
+        int width, height;
+        int n_chunks;
        int iso_size;
        unsigned int sequence;
        struct urb *isoc_urbs[USBTV_ISOC_TRANSFERS];
 };
+static int usbtv_configure_for_norm(struct usbtv *usbtv, v4l2_std_id norm)
+{
+        int i, ret = 0;
+        struct usbtv_norm_params *params = NULL;
+        for (i = 0; i < ARRAY_SIZE(norm_params); i++) {
+                if (norm_params[i].norm & norm) {
+                        params = &norm_params[i];
+                        break;
+                }
+        }
+        if (params) {
+                usbtv->width = params->cap_width;
+                usbtv->height = params->cap_height;
+                usbtv->n_chunks = usbtv->width * usbtv->height
+                                                / 4 / USBTV_CHUNK;
+                usbtv->norm = params->norm;
+        } else
+                ret = -EINVAL;
+        return ret;
+}
 static int usbtv_set_regs(struct usbtv *usbtv, const u16 regs[][2], int size)
 {
        int ret;
@@ -158,6 +201,57 @@ static int usbtv_select_input(struct usbtv *usbtv, int input)
        return ret;
 }
+static int usbtv_select_norm(struct usbtv *usbtv, v4l2_std_id norm)
+{
+        int ret;
+        static const u16 pal[][2] = {
+                { USBTV_BASE + 0x001a, 0x0068 },
+                { USBTV_BASE + 0x010e, 0x0072 },
+                { USBTV_BASE + 0x010f, 0x00a2 },
+                { USBTV_BASE + 0x0112, 0x00b0 },
+                { USBTV_BASE + 0x0117, 0x0001 },
+                { USBTV_BASE + 0x0118, 0x002c },
+                { USBTV_BASE + 0x012d, 0x0010 },
+                { USBTV_BASE + 0x012f, 0x0020 },
+                { USBTV_BASE + 0x024f, 0x0002 },
+                { USBTV_BASE + 0x0254, 0x0059 },
+                { USBTV_BASE + 0x025a, 0x0016 },
+                { USBTV_BASE + 0x025b, 0x0035 },
+                { USBTV_BASE + 0x0263, 0x0017 },
+                { USBTV_BASE + 0x0266, 0x0016 },
+                { USBTV_BASE + 0x0267, 0x0036 }
+        };
+        static const u16 ntsc[][2] = {
+                { USBTV_BASE + 0x001a, 0x0079 },
+                { USBTV_BASE + 0x010e, 0x0068 },
+                { USBTV_BASE + 0x010f, 0x009c },
+                { USBTV_BASE + 0x0112, 0x00f0 },
+                { USBTV_BASE + 0x0117, 0x0000 },
+                { USBTV_BASE + 0x0118, 0x00fc },
+                { USBTV_BASE + 0x012d, 0x0004 },
+                { USBTV_BASE + 0x012f, 0x0008 },
+                { USBTV_BASE + 0x024f, 0x0001 },
+                { USBTV_BASE + 0x0254, 0x005f },
+                { USBTV_BASE + 0x025a, 0x0012 },
+                { USBTV_BASE + 0x025b, 0x0001 },
+                { USBTV_BASE + 0x0263, 0x001c },
+                { USBTV_BASE + 0x0266, 0x0011 },
+                { USBTV_BASE + 0x0267, 0x0005 }
+        };
+        ret = usbtv_configure_for_norm(usbtv, norm);
+        if (!ret) {
+                if (norm & V4L2_STD_525_60)
+                        ret = usbtv_set_regs(usbtv, ntsc, ARRAY_SIZE(ntsc));
+                else if (norm & V4L2_STD_PAL)
+                        ret = usbtv_set_regs(usbtv, pal, ARRAY_SIZE(pal));
+        }
+        return ret;
+}
 static int usbtv_setup_capture(struct usbtv *usbtv)
 {
        int ret;
@@ -225,26 +319,11 @@ static int usbtv_setup_capture(struct usbtv *usbtv)
                { USBTV_BASE + 0x0284, 0x0088 },
                { USBTV_BASE + 0x0003, 0x0004 },
-                { USBTV_BASE + 0x001a, 0x0079 },
                { USBTV_BASE + 0x0100, 0x00d3 },
-                { USBTV_BASE + 0x010e, 0x0068 },
-                { USBTV_BASE + 0x010f, 0x009c },
-                { USBTV_BASE + 0x0112, 0x00f0 },
                { USBTV_BASE + 0x0115, 0x0015 },
-                { USBTV_BASE + 0x0117, 0x0000 },
-                { USBTV_BASE + 0x0118, 0x00fc },
-                { USBTV_BASE + 0x012d, 0x0004 },
-                { USBTV_BASE + 0x012f, 0x0008 },
                { USBTV_BASE + 0x0220, 0x002e },
                { USBTV_BASE + 0x0225, 0x0008 },
                { USBTV_BASE + 0x024e, 0x0002 },
-                { USBTV_BASE + 0x024f, 0x0001 },
-                { USBTV_BASE + 0x0254, 0x005f },
-                { USBTV_BASE + 0x025a, 0x0012 },
-                { USBTV_BASE + 0x025b, 0x0001 },
-                { USBTV_BASE + 0x0263, 0x001c },
-                { USBTV_BASE + 0x0266, 0x0011 },
-                { USBTV_BASE + 0x0267, 0x0005 },
                { USBTV_BASE + 0x024e, 0x0002 },
                { USBTV_BASE + 0x024f, 0x0002 },
        };
@@ -253,6 +332,10 @@ static int usbtv_setup_capture(struct usbtv *usbtv)
        if (ret)
                return ret;
+        ret = usbtv_select_norm(usbtv, usbtv->norm);
+        if (ret)
+                return ret;
        ret = usbtv_select_input(usbtv, usbtv->input);
        if (ret)
                return ret;
@@ -296,7 +379,7 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
        frame_id = USBTV_FRAME_ID(chunk);
        odd = USBTV_ODD(chunk);
        chunk_no = USBTV_CHUNK_NO(chunk);
-        if (chunk_no >= USBTV_CHUNKS)
+        if (chunk_no >= usbtv->n_chunks)
                return;
        /* Beginning of a frame. */
@@ -324,10 +407,10 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
        usbtv->chunks_done++;
        /* Last chunk in a frame, signalling an end */
-        if (odd && chunk_no == USBTV_CHUNKS-1) {
+        if (odd && chunk_no == usbtv->n_chunks-1) {
                int size = vb2_plane_size(&buf->vb, 0);
                enum vb2_buffer_state state = usbtv->chunks_done ==
-                                                USBTV_CHUNKS ?
+                                                usbtv->n_chunks ?
                                                VB2_BUF_STATE_DONE :
                                                VB2_BUF_STATE_ERROR;
@@ -500,6 +583,8 @@ static int usbtv_querycap(struct file *file, void *priv,
 static int usbtv_enum_input(struct file *file, void *priv,
                                        struct v4l2_input *i)
 {
+        struct usbtv *dev = video_drvdata(file);
        switch (i->index) {
        case USBTV_COMPOSITE_INPUT:
                strlcpy(i->name, "Composite", sizeof(i->name));
@@ -512,7 +597,7 @@ static int usbtv_enum_input(struct file *file, void *priv,
        }
        i->type = V4L2_INPUT_TYPE_CAMERA;
-        i->std = V4L2_STD_525_60;
+        i->std = dev->vdev.tvnorms;
        return 0;
 }
@@ -531,23 +616,37 @@ static int usbtv_enum_fmt_vid_cap(struct file *file, void  *priv,
 static int usbtv_fmt_vid_cap(struct file *file, void *priv,
                                        struct v4l2_format *f)
 {
-        f->fmt.pix.width = USBTV_WIDTH;
+        struct usbtv *usbtv = video_drvdata(file);
-        f->fmt.pix.height = USBTV_HEIGHT;
+        f->fmt.pix.width = usbtv->width;
+        f->fmt.pix.height = usbtv->height;
        f->fmt.pix.pixelformat = V4L2_PIX_FMT_YUYV;
        f->fmt.pix.field = V4L2_FIELD_INTERLACED;
-        f->fmt.pix.bytesperline = USBTV_WIDTH * 2;
+        f->fmt.pix.bytesperline = usbtv->width * 2;
        f->fmt.pix.sizeimage = (f->fmt.pix.bytesperline * f->fmt.pix.height);
        f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
-        f->fmt.pix.priv = 0;
        return 0;
 }
 static int usbtv_g_std(struct file *file, void *priv, v4l2_std_id *norm)
 {
-        *norm = V4L2_STD_525_60;
+        struct usbtv *usbtv = video_drvdata(file);
+        *norm = usbtv->norm;
        return 0;
 }
+static int usbtv_s_std(struct file *file, void *priv, v4l2_std_id norm)
+{
+        int ret = -EINVAL;
+        struct usbtv *usbtv = video_drvdata(file);
+        if ((norm & V4L2_STD_525_60) || (norm & V4L2_STD_PAL))
+                ret = usbtv_select_norm(usbtv, norm);
+        return ret;
+}
 static int usbtv_g_input(struct file *file, void *priv, unsigned int *i)
 {
        struct usbtv *usbtv = video_drvdata(file);
@@ -561,13 +660,6 @@ static int usbtv_s_input(struct file *file, void *priv, unsigned int i)
        return usbtv_select_input(usbtv, i);
 }
-static int usbtv_s_std(struct file *file, void *priv, v4l2_std_id norm)
-{
-        if (norm & V4L2_STD_525_60)
-                return 0;
-        return -EINVAL;
-}
 struct v4l2_ioctl_ops usbtv_ioctl_ops = {
        .vidioc_querycap = usbtv_querycap,
        .vidioc_enum_input = usbtv_enum_input,
@@ -604,10 +696,12 @@ static int usbtv_queue_setup(struct vb2_queue *vq,
        const struct v4l2_format *v4l_fmt, unsigned int *nbuffers,
        unsigned int *nplanes, unsigned int sizes[], void *alloc_ctxs[])
 {
+        struct usbtv *usbtv = vb2_get_drv_priv(vq);
        if (*nbuffers < 2)
                *nbuffers = 2;
        *nplanes = 1;
-        sizes[0] = USBTV_WIDTH * USBTV_HEIGHT / 2 * sizeof(u32);
+        sizes[0] = USBTV_CHUNK * usbtv->n_chunks * 2 * sizeof(u32);
        return 0;
 }
@@ -690,7 +784,11 @@ static int usbtv_probe(struct usb_interface *intf,
                return -ENOMEM;
        usbtv->dev = dev;
        usbtv->udev = usb_get_dev(interface_to_usbdev(intf));
        usbtv->iso_size = size;
+        (void)usbtv_configure_for_norm(usbtv, V4L2_STD_525_60);
        spin_lock_init(&usbtv->buflock);
        mutex_init(&usbtv->v4l2_lock);
        mutex_init(&usbtv->vb2q_lock);
@@ -727,7 +825,7 @@ static int usbtv_probe(struct usb_interface *intf,
        usbtv->vdev.release = video_device_release_empty;
        usbtv->vdev.fops = &usbtv_fops;
        usbtv->vdev.ioctl_ops = &usbtv_ioctl_ops;
-        usbtv->vdev.tvnorms = V4L2_STD_525_60;
+        usbtv->vdev.tvnorms = USBTV_TV_STD;
        usbtv->vdev.queue = &usbtv->vb2q;
        usbtv->vdev.lock = &usbtv->v4l2_lock;
        set_bit(V4L2_FL_USE_FH_PRIO, &usbtv->vdev.flags);
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 899cb6d1c4a4..898c208889cd 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -556,7 +556,7 @@ static u16 uvc_video_clock_host_sof(const struct uvc_clock_sample *sample)
 *
 * SOF = ((SOF2 - SOF1) * PTS + SOF1 * STC2 - SOF2 * STC1) / (STC2 - STC1)   (1)
 *
- * to avoid loosing precision in the division. Similarly, the host timestamp is
+ * to avoid losing precision in the division. Similarly, the host timestamp is
 * computed with
 *
 * TS = ((TS2 - TS1) * PTS + TS1 * SOF2 - TS2 * SOF1) / (SOF2 - SOF1)        (2)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 60dcc0f3b32e..fb46790d0eca 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -420,7 +420,7 @@ const char * const *v4l2_ctrl_get_menu(u32 id)
                "Advanced Simple",
                "Core",
                "Simple Scalable",
-                "Advanced Coding Efficency",
+                "Advanced Coding Efficiency",
                NULL,
        };
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index b19b306c8f7f..0edc165f418d 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -145,6 +145,25 @@ static void __vb2_buf_dmabuf_put(struct vb2_buffer *vb)
 }
 /**
+ * __setup_lengths() - setup initial lengths for every plane in
+ * every buffer on the queue
+ */
+static void __setup_lengths(struct vb2_queue *q, unsigned int n)
+{
+        unsigned int buffer, plane;
+        struct vb2_buffer *vb;
+        for (buffer = q->num_buffers; buffer < q->num_buffers + n; ++buffer) {
+                vb = q->bufs[buffer];
+                if (!vb)
+                        continue;
+                for (plane = 0; plane < vb->num_planes; ++plane)
+                        vb->v4l2_planes[plane].length = q->plane_sizes[plane];
+        }
+}
+/**
 * __setup_offsets() - setup unique offsets ("cookies") for every plane in
 * every buffer on the queue
 */
@@ -169,7 +188,6 @@ static void __setup_offsets(struct vb2_queue *q, unsigned int n)
                        continue;
                for (plane = 0; plane < vb->num_planes; ++plane) {
-                        vb->v4l2_planes[plane].length = q->plane_sizes[plane];
                        vb->v4l2_planes[plane].m.mem_offset = off;
                        dprintk(3, "Buffer %d, plane %d offset 0x%08lx\n",
@@ -241,6 +259,7 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum v4l2_memory memory,
                q->bufs[q->num_buffers + buffer] = vb;
        }
+        __setup_lengths(q, buffer);
        if (memory == V4L2_MEMORY_MMAP)
                __setup_offsets(q, buffer);
@@ -1824,8 +1843,8 @@ int vb2_expbuf(struct vb2_queue *q, struct v4l2_exportbuffer *eb)
                return -EINVAL;
        }
-        if (eb->flags & ~O_CLOEXEC) {
+        if (eb->flags & ~(O_CLOEXEC | O_ACCMODE)) {
-                dprintk(1, "Queue does support only O_CLOEXEC flag\n");
+                dprintk(1, "Queue does support only O_CLOEXEC and access mode flags\n");
                return -EINVAL;
        }
@@ -1848,14 +1867,14 @@ int vb2_expbuf(struct vb2_queue *q, struct v4l2_exportbuffer *eb)
        vb_plane = &vb->planes[eb->plane];
-        dbuf = call_memop(q, get_dmabuf, vb_plane->mem_priv);
+        dbuf = call_memop(q, get_dmabuf, vb_plane->mem_priv, eb->flags & O_ACCMODE);
        if (IS_ERR_OR_NULL(dbuf)) {
                dprintk(1, "Failed to export buffer %d, plane %d\n",
                        eb->index, eb->plane);
                return -EINVAL;
        }
-        ret = dma_buf_fd(dbuf, eb->flags);
+        ret = dma_buf_fd(dbuf, eb->flags & ~O_ACCMODE);
        if (ret < 0) {
                dprintk(3, "buffer %d, plane %d failed to export (%d)\n",
                        eb->index, eb->plane, ret);
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index 646f08f4f504..33d3871d1e13 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -393,7 +393,7 @@ static struct sg_table *vb2_dc_get_base_sgt(struct vb2_dc_buf *buf)
        return sgt;
 }
-static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv)
+static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv, unsigned long flags)
 {
        struct vb2_dc_buf *buf = buf_priv;
        struct dma_buf *dbuf;
@@ -404,7 +404,7 @@ static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv)
        if (WARN_ON(!buf->sgt_base))
                return NULL;
-        dbuf = dma_buf_export(buf, &vb2_dc_dmabuf_ops, buf->size, 0);
+        dbuf = dma_buf_export(buf, &vb2_dc_dmabuf_ops, buf->size, flags);
        if (IS_ERR(dbuf))
                return NULL;
diff --git a/drivers/media/v4l2-core/videobuf2-dma-sg.c b/drivers/media/v4l2-core/videobuf2-dma-sg.c
index 2f860543912c..0d3a8ffe47a3 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c
@@ -178,7 +178,7 @@ static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
        buf->pages = kzalloc(buf->num_pages * sizeof(struct page *),
                             GFP_KERNEL);
        if (!buf->pages)
-                return NULL;
+                goto userptr_fail_alloc_pages;
        num_pages_from_user = get_user_pages(current, current->mm,
                                             vaddr & PAGE_MASK,
@@ -204,6 +204,7 @@ userptr_fail_get_user_pages:
        while (--num_pages_from_user >= 0)
                put_page(buf->pages[num_pages_from_user]);
        kfree(buf->pages);
+userptr_fail_alloc_pages:
        kfree(buf);
        return NULL;
 }
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 62a60caa5d1f..dd671582c9a1 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -32,7 +32,7 @@ config MFD_AS3722
        select MFD_CORE
        select REGMAP_I2C
        select REGMAP_IRQ
-        depends on I2C && OF
+        depends on I2C=y && OF
        help
          The ams AS3722 is a compact system PMU suitable for mobile phones,
          tablets etc. It has 4 DC/DC step-down regulators, 3 DC/DC step-down
diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
index da1c6566d93d..37edf9e989b0 100644
--- a/drivers/mfd/lpc_ich.c
+++ b/drivers/mfd/lpc_ich.c
@@ -506,7 +506,7 @@ static struct lpc_ich_info lpc_chipset_info[] = {
                .iTCO_version = 2,
        },
        [LPC_WPT_LP] = {
-                .name = "Lynx Point_LP",
+                .name = "Wildcat Point_LP",
                .iTCO_version = 2,
        },
 };
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index 34c18fb8c089..54cc25546592 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -81,31 +81,31 @@ static struct of_device_id sec_dt_match[] = {
 int sec_reg_read(struct sec_pmic_dev *sec_pmic, u8 reg, void *dest)
 {
-        return regmap_read(sec_pmic->regmap, reg, dest);
+        return regmap_read(sec_pmic->regmap_pmic, reg, dest);
 }
 EXPORT_SYMBOL_GPL(sec_reg_read);
 int sec_bulk_read(struct sec_pmic_dev *sec_pmic, u8 reg, int count, u8 *buf)
 {
-        return regmap_bulk_read(sec_pmic->regmap, reg, buf, count);
+        return regmap_bulk_read(sec_pmic->regmap_pmic, reg, buf, count);
 }
 EXPORT_SYMBOL_GPL(sec_bulk_read);
 int sec_reg_write(struct sec_pmic_dev *sec_pmic, u8 reg, u8 value)
 {
-        return regmap_write(sec_pmic->regmap, reg, value);
+        return regmap_write(sec_pmic->regmap_pmic, reg, value);
 }
 EXPORT_SYMBOL_GPL(sec_reg_write);
 int sec_bulk_write(struct sec_pmic_dev *sec_pmic, u8 reg, int count, u8 *buf)
 {
-        return regmap_raw_write(sec_pmic->regmap, reg, buf, count);
+        return regmap_raw_write(sec_pmic->regmap_pmic, reg, buf, count);
 }
 EXPORT_SYMBOL_GPL(sec_bulk_write);
 int sec_reg_update(struct sec_pmic_dev *sec_pmic, u8 reg, u8 val, u8 mask)
 {
-        return regmap_update_bits(sec_pmic->regmap, reg, mask, val);
+        return regmap_update_bits(sec_pmic->regmap_pmic, reg, mask, val);
 }
 EXPORT_SYMBOL_GPL(sec_reg_update);
@@ -166,6 +166,11 @@ static struct regmap_config s5m8767_regmap_config = {
        .cache_type = REGCACHE_FLAT,
 };
+static const struct regmap_config sec_rtc_regmap_config = {
+        .reg_bits = 8,
+        .val_bits = 8,
+};
 #ifdef CONFIG_OF
 /*
 * Only the common platform data elements for s5m8767 are parsed here from the
@@ -266,9 +271,9 @@ static int sec_pmic_probe(struct i2c_client *i2c,
                break;
        }
-        sec_pmic->regmap = devm_regmap_init_i2c(i2c, regmap);
+        sec_pmic->regmap_pmic = devm_regmap_init_i2c(i2c, regmap);
-        if (IS_ERR(sec_pmic->regmap)) {
+        if (IS_ERR(sec_pmic->regmap_pmic)) {
-                ret = PTR_ERR(sec_pmic->regmap);
+                ret = PTR_ERR(sec_pmic->regmap_pmic);
                dev_err(&i2c->dev, "Failed to allocate register map: %d\n",
                        ret);
                return ret;
@@ -277,6 +282,15 @@ static int sec_pmic_probe(struct i2c_client *i2c,
        sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
        i2c_set_clientdata(sec_pmic->rtc, sec_pmic);
+        sec_pmic->regmap_rtc = devm_regmap_init_i2c(sec_pmic->rtc,
+                        &sec_rtc_regmap_config);
+        if (IS_ERR(sec_pmic->regmap_rtc)) {
+                ret = PTR_ERR(sec_pmic->regmap_rtc);
+                dev_err(&i2c->dev, "Failed to allocate RTC register map: %d\n",
+                        ret);
+                return ret;
+        }
        if (pdata && pdata->cfg_pmic_irq)
                pdata->cfg_pmic_irq();
diff --git a/drivers/mfd/sec-irq.c b/drivers/mfd/sec-irq.c
index 0dd84e99081e..b441b1be27cb 100644
--- a/drivers/mfd/sec-irq.c
+++ b/drivers/mfd/sec-irq.c
@@ -280,19 +280,19 @@ int sec_irq_init(struct sec_pmic_dev *sec_pmic)
        switch (type) {
        case S5M8763X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                  IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                  sec_pmic->irq_base, &s5m8763_irq_chip,
                                  &sec_pmic->irq_data);
                break;
        case S5M8767X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                  IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                  sec_pmic->irq_base, &s5m8767_irq_chip,
                                  &sec_pmic->irq_data);
                break;
        case S2MPS11X:
-                ret = regmap_add_irq_chip(sec_pmic->regmap, sec_pmic->irq,
+                ret = regmap_add_irq_chip(sec_pmic->regmap_pmic, sec_pmic->irq,
                                  IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                  sec_pmic->irq_base, &s2mps11_irq_chip,
                                  &sec_pmic->irq_data);
diff --git a/drivers/mfd/ti-ssp.c b/drivers/mfd/ti-ssp.c
index 71e3e0c5bf73..a5424579679c 100644
--- a/drivers/mfd/ti-ssp.c
+++ b/drivers/mfd/ti-ssp.c
@@ -32,6 +32,7 @@
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/io.h>
+#include <linux/sched.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/ti_ssp.h>
@@ -409,7 +410,6 @@ static int ti_ssp_probe(struct platform_device *pdev)
                cells[id].id            = id;
                cells[id].name          = data->dev_name;
                cells[id].platform_data = data->pdata;
-                cells[id].data_size     = data->pdata_size;
        }
        error = mfd_add_devices(dev, 0, cells, 2, NULL, 0, NULL);
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index 0e8df41aaf14..2cf2bbc0b927 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -198,6 +198,13 @@ static void enclosure_remove_links(struct enclosure_component *cdev)
 {
        char name[ENCLOSURE_NAME_SIZE];
+        /*
+         * In odd circumstances, like multipath devices, something else may
+         * already have removed the links, so check for this condition first.
+         */
+        if (!cdev->dev->kobj.sd)
+                return;
        enclosure_link_name(cdev, name);
        sysfs_remove_link(&cdev->dev->kobj, name);
        sysfs_remove_link(&cdev->cdev.kobj, "device");
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 6c0fde55270d..66f411a6e8ea 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -109,9 +109,12 @@
 #define MEI_DEV_ID_PPT_2      0x1CBA  /* Panther Point */
 #define MEI_DEV_ID_PPT_3      0x1DBA  /* Panther Point */
-#define MEI_DEV_ID_LPT        0x8C3A  /* Lynx Point */
+#define MEI_DEV_ID_LPT_H      0x8C3A  /* Lynx Point H */
 #define MEI_DEV_ID_LPT_W      0x8D3A  /* Lynx Point - Wellsburg */
 #define MEI_DEV_ID_LPT_LP     0x9C3A  /* Lynx Point LP */
+#define MEI_DEV_ID_LPT_HR     0x8CBA  /* Lynx Point H Refresh */
+#define MEI_DEV_ID_WPT_LP     0x9CBA  /* Wildcat Point LP */
 /*
 * MEI HW Section
 */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index b96205aece0c..2cab3c0a6805 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -76,9 +76,11 @@ static DEFINE_PCI_DEVICE_TABLE(mei_me_pci_tbl) = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_1)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_2)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_PPT_3)},
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_H)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_W)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_LP)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_LPT_HR)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MEI_DEV_ID_WPT_LP)},
        /* required last entry */
        {0, }
diff --git a/drivers/misc/mic/card/mic_virtio.c b/drivers/misc/mic/card/mic_virtio.c
index 8aa42e738acc..653799b96bfa 100644
--- a/drivers/misc/mic/card/mic_virtio.c
+++ b/drivers/misc/mic/card/mic_virtio.c
@@ -154,14 +154,14 @@ static void mic_reset_inform_host(struct virtio_device *vdev)
 {
        struct mic_vdev *mvdev = to_micvdev(vdev);
        struct mic_device_ctrl __iomem *dc = mvdev->dc;
-        int retry = 100, i;
+        int retry;
        iowrite8(0, &dc->host_ack);
        iowrite8(1, &dc->vdev_reset);
        mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
        /* Wait till host completes all card accesses and acks the reset */
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                if (ioread8(&dc->host_ack))
                        break;
                msleep(100);
@@ -187,11 +187,12 @@ static void mic_reset(struct virtio_device *vdev)
 /*
 * The virtio_ring code calls this API when it wants to notify the Host.
 */
-static void mic_notify(struct virtqueue *vq)
+static bool mic_notify(struct virtqueue *vq)
 {
        struct mic_vdev *mvdev = vq->priv;
        mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
+        return true;
 }
 static void mic_del_vq(struct virtqueue *vq, int n)
@@ -247,17 +248,17 @@ static struct virtqueue *mic_find_vq(struct virtio_device *vdev,
        /* First assign the vring's allocated in host memory */
        vqconfig = mic_vq_config(mvdev->desc) + index;
        memcpy_fromio(&config, vqconfig, sizeof(config));
-        _vr_size = vring_size(config.num, MIC_VIRTIO_RING_ALIGN);
+        _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN);
        vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info));
-        va = mic_card_map(mvdev->mdev, config.address, vr_size);
+        va = mic_card_map(mvdev->mdev, le64_to_cpu(config.address), vr_size);
        if (!va)
                return ERR_PTR(-ENOMEM);
        mvdev->vr[index] = va;
        memset_io(va, 0x0, _vr_size);
-        vq = vring_new_virtqueue(index,
+        vq = vring_new_virtqueue(index, le16_to_cpu(config.num),
-                                config.num, MIC_VIRTIO_RING_ALIGN, vdev,
+                                 MIC_VIRTIO_RING_ALIGN, vdev, false,
-                                false,
+                                 (void __force *)va, mic_notify, callback,
-                                va, mic_notify, callback, name);
+                                 name);
        if (!vq) {
                err = -ENOMEM;
                goto unmap;
@@ -272,7 +273,8 @@ static struct virtqueue *mic_find_vq(struct virtio_device *vdev,
        /* Allocate and reassign used ring now */
        mvdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
-                        sizeof(struct vring_used_elem) * config.num);
+                                             sizeof(struct vring_used_elem) *
+                                             le16_to_cpu(config.num));
        used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                        get_order(mvdev->used_size[index]));
        if (!used) {
@@ -309,7 +311,7 @@ static int mic_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
        struct mic_vdev *mvdev = to_micvdev(vdev);
        struct mic_device_ctrl __iomem *dc = mvdev->dc;
-        int i, err, retry = 100;
+        int i, err, retry;
        /* We must have this many virtqueues. */
        if (nvqs > ioread8(&mvdev->desc->num_vq))
@@ -331,7 +333,7 @@ static int mic_find_vqs(struct virtio_device *vdev, unsigned nvqs,
         * rings have been re-assigned.
         */
        mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                if (!ioread8(&dc->used_address_updated))
                        break;
                msleep(100);
@@ -519,8 +521,8 @@ static void mic_scan_devices(struct mic_driver *mdrv, bool remove)
        struct device *dev;
        int ret;
-        for (i = mic_aligned_size(struct mic_bootparam);
+        for (i = sizeof(struct mic_bootparam); i < MIC_DP_SIZE;
-                i < MIC_DP_SIZE; i += mic_total_desc_size(d)) {
+                i += mic_total_desc_size(d)) {
                d = mdrv->dp + i;
                dc = (void __iomem *)d + mic_aligned_desc_size(d);
                /*
@@ -539,7 +541,8 @@ static void mic_scan_devices(struct mic_driver *mdrv, bool remove)
                        continue;
                /* device already exists */
-                dev = device_find_child(mdrv->dev, d, mic_match_desc);
+                dev = device_find_child(mdrv->dev, (void __force *)d,
+                                        mic_match_desc);
                if (dev) {
                        if (remove)
                                iowrite8(MIC_VIRTIO_PARAM_DEV_REMOVE,
diff --git a/drivers/misc/mic/card/mic_virtio.h b/drivers/misc/mic/card/mic_virtio.h
index 2c5c22c93ba8..d0407ba53bb7 100644
--- a/drivers/misc/mic/card/mic_virtio.h
+++ b/drivers/misc/mic/card/mic_virtio.h
@@ -42,8 +42,8 @@
 static inline unsigned mic_desc_size(struct mic_device_desc __iomem *desc)
 {
-        return mic_aligned_size(*desc)
+        return sizeof(*desc)
-                + ioread8(&desc->num_vq) * mic_aligned_size(struct mic_vqconfig)
+                + ioread8(&desc->num_vq) * sizeof(struct mic_vqconfig)
                + ioread8(&desc->feature_len) * 2
                + ioread8(&desc->config_len);
 }
@@ -67,8 +67,7 @@ mic_vq_configspace(struct mic_device_desc __iomem *desc)
 }
 static inline unsigned mic_total_desc_size(struct mic_device_desc __iomem *desc)
 {
-        return mic_aligned_desc_size(desc) +
+        return mic_aligned_desc_size(desc) + sizeof(struct mic_device_ctrl);
-                mic_aligned_size(struct mic_device_ctrl);
 }
 int mic_devices_init(struct mic_driver *mdrv);
diff --git a/drivers/misc/mic/host/mic_boot.c b/drivers/misc/mic/host/mic_boot.c
index 7558d9186438..b75c6b5cc20f 100644
--- a/drivers/misc/mic/host/mic_boot.c
+++ b/drivers/misc/mic/host/mic_boot.c
@@ -62,7 +62,7 @@ void mic_bootparam_init(struct mic_device *mdev)
 {
        struct mic_bootparam *bootparam = mdev->dp;
-        bootparam->magic = MIC_MAGIC;
+        bootparam->magic = cpu_to_le32(MIC_MAGIC);
        bootparam->c2h_shutdown_db = mdev->shutdown_db;
        bootparam->h2c_shutdown_db = -1;
        bootparam->h2c_config_db = -1;
diff --git a/drivers/misc/mic/host/mic_virtio.c b/drivers/misc/mic/host/mic_virtio.c
index 5b8494bd1e00..e04bb4fe6823 100644
--- a/drivers/misc/mic/host/mic_virtio.c
+++ b/drivers/misc/mic/host/mic_virtio.c
@@ -41,7 +41,7 @@ static int mic_virtio_copy_to_user(struct mic_vdev *mvdev,
         * We are copying from IO below an should ideally use something
         * like copy_to_user_fromio(..) if it existed.
         */
-        if (copy_to_user(ubuf, dbuf, len)) {
+        if (copy_to_user(ubuf, (void __force *)dbuf, len)) {
                err = -EFAULT;
                dev_err(mic_dev(mvdev), "%s %d err %d\n",
                        __func__, __LINE__, err);
@@ -66,7 +66,7 @@ static int mic_virtio_copy_from_user(struct mic_vdev *mvdev,
         * We are copying to IO below and should ideally use something
         * like copy_from_user_toio(..) if it existed.
         */
-        if (copy_from_user(dbuf, ubuf, len)) {
+        if (copy_from_user((void __force *)dbuf, ubuf, len)) {
                err = -EFAULT;
                dev_err(mic_dev(mvdev), "%s %d err %d\n",
                        __func__, __LINE__, err);
@@ -293,7 +293,7 @@ static void mic_virtio_init_post(struct mic_vdev *mvdev)
                        continue;
                }
                mvdev->mvr[i].vrh.vring.used =
-                        mvdev->mdev->aper.va +
+                        (void __force *)mvdev->mdev->aper.va +
                        le64_to_cpu(vqconfig[i].used_address);
        }
@@ -378,7 +378,7 @@ int mic_virtio_config_change(struct mic_vdev *mvdev,
                        void __user *argp)
 {
        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
-        int ret = 0, retry = 100, i;
+        int ret = 0, retry, i;
        struct mic_bootparam *bootparam = mvdev->mdev->dp;
        s8 db = bootparam->h2c_config_db;
@@ -401,7 +401,7 @@ int mic_virtio_config_change(struct mic_vdev *mvdev,
        mvdev->dc->config_change = MIC_VIRTIO_PARAM_CONFIG_CHANGED;
        mvdev->mdev->ops->send_intr(mvdev->mdev, db);
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                ret = wait_event_timeout(wake,
                        mvdev->dc->guest_ack, msecs_to_jiffies(100));
                if (ret)
@@ -467,7 +467,7 @@ static int mic_copy_dp_entry(struct mic_vdev *mvdev,
        }
        /* Find the first free device page entry */
-        for (i = mic_aligned_size(struct mic_bootparam);
+        for (i = sizeof(struct mic_bootparam);
                i < MIC_DP_SIZE - mic_total_desc_size(dd_config);
                i += mic_total_desc_size(devp)) {
                devp = mdev->dp + i;
@@ -525,6 +525,7 @@ int mic_virtio_add_device(struct mic_vdev *mvdev,
        char irqname[10];
        struct mic_bootparam *bootparam = mdev->dp;
        u16 num;
+        dma_addr_t vr_addr;
        mutex_lock(&mdev->mic_mutex);
@@ -559,17 +560,16 @@ int mic_virtio_add_device(struct mic_vdev *mvdev,
                }
                vr->len = vr_size;
                vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN);
-                vr->info->magic = MIC_MAGIC + mvdev->virtio_id + i;
+                vr->info->magic = cpu_to_le32(MIC_MAGIC + mvdev->virtio_id + i);
-                vqconfig[i].address = mic_map_single(mdev,
+                vr_addr = mic_map_single(mdev, vr->va, vr_size);
-                        vr->va, vr_size);
+                if (mic_map_error(vr_addr)) {
-                if (mic_map_error(vqconfig[i].address)) {
                        free_pages((unsigned long)vr->va, get_order(vr_size));
                        ret = -ENOMEM;
                        dev_err(mic_dev(mvdev), "%s %d err %d\n",
                                __func__, __LINE__, ret);
                        goto err;
                }
-                vqconfig[i].address = cpu_to_le64(vqconfig[i].address);
+                vqconfig[i].address = cpu_to_le64(vr_addr);
                vring_init(&vr->vr, num, vr->va, MIC_VIRTIO_RING_ALIGN);
                ret = vringh_init_kern(&mvr->vrh,
@@ -639,7 +639,7 @@ void mic_virtio_del_device(struct mic_vdev *mvdev)
        struct mic_vdev *tmp_mvdev;
        struct mic_device *mdev = mvdev->mdev;
        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
-        int i, ret, retry = 100;
+        int i, ret, retry;
        struct mic_vqconfig *vqconfig;
        struct mic_bootparam *bootparam = mdev->dp;
        s8 db;
@@ -652,16 +652,16 @@ void mic_virtio_del_device(struct mic_vdev *mvdev)
                "Requesting hot remove id %d\n", mvdev->virtio_id);
        mvdev->dc->config_change = MIC_VIRTIO_PARAM_DEV_REMOVE;
        mdev->ops->send_intr(mdev, db);
-        for (i = retry; i--;) {
+        for (retry = 100; retry--;) {
                ret = wait_event_timeout(wake,
                        mvdev->dc->guest_ack, msecs_to_jiffies(100));
                if (ret)
                        break;
        }
        dev_dbg(mdev->sdev->parent,
-                "Device id %d config_change %d guest_ack %d\n",
+                "Device id %d config_change %d guest_ack %d retry %d\n",
                mvdev->virtio_id, mvdev->dc->config_change,
-                mvdev->dc->guest_ack);
+                mvdev->dc->guest_ack, retry);
        mvdev->dc->config_change = 0;
        mvdev->dc->guest_ack = 0;
 skip_hot_remove:
diff --git a/drivers/misc/mic/host/mic_x100.c b/drivers/misc/mic/host/mic_x100.c
index 81e9541b784c..0dfa8a81436e 100644
--- a/drivers/misc/mic/host/mic_x100.c
+++ b/drivers/misc/mic/host/mic_x100.c
@@ -397,8 +397,8 @@ mic_x100_load_ramdisk(struct mic_device *mdev)
         * so copy over the ramdisk @ 128M.
         */
        memcpy_toio(mdev->aper.va + (mdev->bootaddr << 1), fw->data, fw->size);
-        iowrite32(cpu_to_le32(mdev->bootaddr << 1), &bp->hdr.ramdisk_image);
+        iowrite32(mdev->bootaddr << 1, &bp->hdr.ramdisk_image);
-        iowrite32(cpu_to_le32(fw->size), &bp->hdr.ramdisk_size);
+        iowrite32(fw->size, &bp->hdr.ramdisk_size);
        release_firmware(fw);
 error:
        return rc;
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 0b10a9030f4e..98b6b6ef7e5c 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -22,6 +22,7 @@
 #include <linux/delay.h>
 #include <linux/spinlock.h>
 #include <linux/timer.h>
+#include <linux/of.h>
 #include <linux/omap-dma.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/card.h>
@@ -90,17 +91,6 @@
 #define OMAP_MMC_CMDTYPE_AC     2
 #define OMAP_MMC_CMDTYPE_ADTC   3
-#define OMAP_DMA_MMC_TX         21
-#define OMAP_DMA_MMC_RX         22
-#define OMAP_DMA_MMC2_TX        54
-#define OMAP_DMA_MMC2_RX        55
-#define OMAP24XX_DMA_MMC2_TX    47
-#define OMAP24XX_DMA_MMC2_RX    48
-#define OMAP24XX_DMA_MMC1_TX    61
-#define OMAP24XX_DMA_MMC1_RX    62
 #define DRIVER_NAME "mmci-omap"
 /* Specifies how often in millisecs to poll for card status changes
@@ -1330,7 +1320,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
        struct mmc_omap_host *host = NULL;
        struct resource *res;
        dma_cap_mask_t mask;
-        unsigned sig;
+        unsigned sig = 0;
        int i, ret = 0;
        int irq;
@@ -1340,7 +1330,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
        }
        if (pdata->nr_slots == 0) {
                dev_err(&pdev->dev, "no slots\n");
-                return -ENXIO;
+                return -EPROBE_DEFER;
        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1407,19 +1397,20 @@ static int mmc_omap_probe(struct platform_device *pdev)
        host->dma_tx_burst = -1;
        host->dma_rx_burst = -1;
-        if (mmc_omap2())
+        res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
-                sig = host->id == 0 ? OMAP24XX_DMA_MMC1_TX : OMAP24XX_DMA_MMC2_TX;
+        if (res)
-        else
+                sig = res->start;
-                sig = host->id == 0 ? OMAP_DMA_MMC_TX : OMAP_DMA_MMC2_TX;
+        host->dma_tx = dma_request_slave_channel_compat(mask,
-        host->dma_tx = dma_request_channel(mask, omap_dma_filter_fn, &sig);
+                                omap_dma_filter_fn, &sig, &pdev->dev, "tx");
        if (!host->dma_tx)
                dev_warn(host->dev, "unable to obtain TX DMA engine channel %u\n",
                        sig);
-        if (mmc_omap2())
-                sig = host->id == 0 ? OMAP24XX_DMA_MMC1_RX : OMAP24XX_DMA_MMC2_RX;
+        res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
-        else
+        if (res)
-                sig = host->id == 0 ? OMAP_DMA_MMC_RX : OMAP_DMA_MMC2_RX;
+                sig = res->start;
-        host->dma_rx = dma_request_channel(mask, omap_dma_filter_fn, &sig);
+        host->dma_rx = dma_request_slave_channel_compat(mask,
+                                omap_dma_filter_fn, &sig, &pdev->dev, "rx");
        if (!host->dma_rx)
                dev_warn(host->dev, "unable to obtain RX DMA engine channel %u\n",
                        sig);
@@ -1512,12 +1503,20 @@ static int mmc_omap_remove(struct platform_device *pdev)
        return 0;
 }
+#if IS_BUILTIN(CONFIG_OF)
+static const struct of_device_id mmc_omap_match[] = {
+        { .compatible = "ti,omap2420-mmc", },
+        { },
+};
+#endif
 static struct platform_driver mmc_omap_driver = {
        .probe          = mmc_omap_probe,
        .remove         = mmc_omap_remove,
        .driver         = {
                .name   = DRIVER_NAME,
                .owner  = THIS_MODULE,
+                .of_match_table = of_match_ptr(mmc_omap_match),
        },
 };
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 4cabdc9fda90..4b3aaa898a8b 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -962,7 +962,7 @@ static int pxa3xx_nand_init_buff(struct pxa3xx_nand_info *info)
 static void pxa3xx_nand_free_buff(struct pxa3xx_nand_info *info)
 {
        struct platform_device *pdev = info->pdev;
-        if (use_dma) {
+        if (info->use_dma) {
                pxa_free_dma(info->data_dma_ch);
                dma_free_coherent(&pdev->dev, info->buf_size,
                                  info->data_buff, info->data_buff_phys);
@@ -1259,10 +1259,6 @@ static struct of_device_id pxa3xx_nand_dt_ids[] = {
                .compatible = "marvell,pxa3xx-nand",
                .data       = (void *)PXA3XX_NAND_VARIANT_PXA,
        },
-        {
-                .compatible = "marvell,armada370-nand",
-                .data       = (void *)PXA3XX_NAND_VARIANT_ARMADA370,
-        },
        {}
 };
 MODULE_DEVICE_TABLE(of, pxa3xx_nand_dt_ids);
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index c269e430c760..2aa7b77c7c88 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -447,6 +447,11 @@ static int mvebu_sw_pci_bridge_read(struct mvebu_pcie_port *port,
                *value = 0;
                break;
+        case PCI_INTERRUPT_LINE:
+                /* LINE PIN MIN_GNT MAX_LAT */
+                *value = 0;
+                break;
        default:
                *value = 0xffffffff;
                return PCIBIOS_BAD_REGISTER_NUMBER;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 9042fdbd7244..25f0bc659164 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -19,6 +19,7 @@
 #include <linux/cpu.h>
 #include <linux/pm_runtime.h>
 #include <linux/suspend.h>
+#include <linux/kexec.h>
 #include "pci.h"
 struct pci_dynid {
@@ -288,12 +289,27 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
        int error, node;
        struct drv_dev_and_id ddi = { drv, dev, id };
-        /* Execute driver initialization on node where the device's
+        /*
-           bus is attached to.  This way the driver likely allocates
+         * Execute driver initialization on node where the device is
-           its local memory on the right node without any need to
+         * attached.  This way the driver likely allocates its local memory
-           change it. */
+         * on the right node.
+         */
        node = dev_to_node(&dev->dev);
-        if (node >= 0) {
+        /*
+         * On NUMA systems, we are likely to call a PF probe function using
+         * work_on_cpu().  If that probe calls pci_enable_sriov() (which
+         * adds the VF devices via pci_bus_add_device()), we may re-enter
+         * this function to call the VF probe function.  Calling
+         * work_on_cpu() again will cause a lockdep warning.  Since VFs are
+         * always on the same node as the PF, we can work around this by
+         * avoiding work_on_cpu() when we're already on the correct node.
+         *
+         * Preemption is enabled, so it's theoretically unsafe to use
+         * numa_node_id(), but even if we run the probe function on the
+         * wrong node, it should be functionally correct.
+         */
+        if (node >= 0 && node != numa_node_id()) {
                int cpu;
                get_online_cpus();
@@ -305,6 +321,7 @@ static int pci_call_probe(struct pci_driver *drv, struct pci_dev *dev,
                put_online_cpus();
        } else
                error = local_pci_probe(&ddi);
        return error;
 }
@@ -399,12 +416,17 @@ static void pci_device_shutdown(struct device *dev)
        pci_msi_shutdown(pci_dev);
        pci_msix_shutdown(pci_dev);
+#ifdef CONFIG_KEXEC
        /*
-         * Turn off Bus Master bit on the device to tell it to not
+         * If this is a kexec reboot, turn off Bus Master bit on the
-         * continue to do DMA. Don't touch devices in D3cold or unknown states.
+         * device to tell it to not continue to do DMA. Don't touch
+         * devices in D3cold or unknown states.
+         * If it is not a kexec reboot, firmware will hit the PCI
+         * devices with big hammer and stop their DMA any way.
         */
-        if (pci_dev->current_state <= PCI_D3hot)
+        if (kexec_in_progress && (pci_dev->current_state <= PCI_D3hot))
                pci_clear_master(pci_dev);
+#endif
 }
 #ifdef CONFIG_PM
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index 1576851028db..cc9337a71529 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -24,7 +24,7 @@ static void pci_stop_dev(struct pci_dev *dev)
        if (dev->is_added) {
                pci_proc_detach_device(dev);
                pci_remove_sysfs_dev_files(dev);
-                device_del(&dev->dev);
+                device_release_driver(&dev->dev);
                dev->is_added = 0;
        }
@@ -34,6 +34,8 @@ static void pci_stop_dev(struct pci_dev *dev)
 static void pci_destroy_dev(struct pci_dev *dev)
 {
+        device_del(&dev->dev);
        down_write(&pci_bus_sem);
        list_del(&dev->bus_list);
        up_write(&pci_bus_sem);
diff --git a/drivers/pinctrl/pinctrl-abx500.c b/drivers/pinctrl/pinctrl-abx500.c
index 4780959e11d4..5183e7bb8de3 100644
--- a/drivers/pinctrl/pinctrl-abx500.c
+++ b/drivers/pinctrl/pinctrl-abx500.c
@@ -418,7 +418,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                        ret = abx500_gpio_set_bits(chip,
                                        AB8500_GPIO_ALTFUN_REG,
                                        af.alt_bit1,
-                                        !!(af.alta_val && BIT(0)));
+                                        !!(af.alta_val & BIT(0)));
                        if (ret < 0)
                                goto out;
@@ -439,7 +439,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                        goto out;
                ret = abx500_gpio_set_bits(chip, AB8500_GPIO_ALTFUN_REG,
-                                af.alt_bit1, !!(af.altb_val && BIT(0)));
+                                af.alt_bit1, !!(af.altb_val & BIT(0)));
                if (ret < 0)
                        goto out;
@@ -462,7 +462,7 @@ static int abx500_set_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                        goto out;
                ret = abx500_gpio_set_bits(chip, AB8500_GPIO_ALTFUN_REG,
-                                af.alt_bit2, !!(af.altc_val && BIT(1)));
+                                af.alt_bit2, !!(af.altc_val & BIT(1)));
                break;
        default:
diff --git a/drivers/pinctrl/pinctrl-abx500.h b/drivers/pinctrl/pinctrl-abx500.h
index eeca8f973999..82293806e842 100644
--- a/drivers/pinctrl/pinctrl-abx500.h
+++ b/drivers/pinctrl/pinctrl-abx500.h
@@ -1,4 +1,4 @@
-#ifndef PINCTRL_PINCTRL_ABx5O0_H
+#ifndef PINCTRL_PINCTRL_ABx500_H
 #define PINCTRL_PINCTRL_ABx500_H
 /* Package definitions */
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index e939c28cbf1f..46dddc159286 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -504,6 +504,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank,
                        data |= (3 << bit);
                        break;
                default:
+                        spin_unlock_irqrestore(&bank->slock, flags);
                        dev_err(info->dev, "unsupported pull setting %d\n",
                                pull);
                        return -EINVAL;
@@ -1453,8 +1454,8 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
        if (ctrl->type == RK3188) {
                res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
                info->reg_pull = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(info->reg_base))
+                if (IS_ERR(info->reg_pull))
-                        return PTR_ERR(info->reg_base);
+                        return PTR_ERR(info->reg_pull);
        }
        ret = rockchip_gpiolib_register(pdev, info);
diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
index 009174d07767..bc5eb453a45c 100644
--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
@@ -3720,7 +3720,7 @@ static void __iomem *r8a7740_pinmux_portcr(struct sh_pfc *pfc, unsigned int pin)
                const struct r8a7740_portcr_group *group =
                        &r8a7740_portcr_offsets[i];
-                if (i <= group->end_pin)
+                if (pin <= group->end_pin)
                        return pfc->window->virt + group->offset + pin;
        }
diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7372.c b/drivers/pinctrl/sh-pfc/pfc-sh7372.c
index 70b522d34821..cc097b693820 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh7372.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh7372.c
@@ -2584,7 +2584,7 @@ static void __iomem *sh7372_pinmux_portcr(struct sh_pfc *pfc, unsigned int pin)
                const struct sh7372_portcr_group *group =
                        &sh7372_portcr_offsets[i];
-                if (i <= group->end_pin)
+                if (pin <= group->end_pin)
                        return pfc->window->virt + group->offset + pin;
        }
diff --git a/drivers/pnp/driver.c b/drivers/pnp/driver.c
index 6936e0acedcd..f748cc8cbb03 100644
--- a/drivers/pnp/driver.c
+++ b/drivers/pnp/driver.c
@@ -197,6 +197,11 @@ static int pnp_bus_freeze(struct device *dev)
        return __pnp_bus_suspend(dev, PMSG_FREEZE);
 }
+static int pnp_bus_poweroff(struct device *dev)
+{
+        return __pnp_bus_suspend(dev, PMSG_HIBERNATE);
+}
 static int pnp_bus_resume(struct device *dev)
 {
        struct pnp_dev *pnp_dev = to_pnp_dev(dev);
@@ -234,9 +239,14 @@ static int pnp_bus_resume(struct device *dev)
 }
 static const struct dev_pm_ops pnp_bus_dev_pm_ops = {
+        /* Suspend callbacks */
        .suspend = pnp_bus_suspend,
-        .freeze = pnp_bus_freeze,
        .resume = pnp_bus_resume,
+        /* Hibernate callbacks */
+        .freeze = pnp_bus_freeze,
+        .thaw = pnp_bus_resume,
+        .poweroff = pnp_bus_poweroff,
+        .restore = pnp_bus_resume,
 };
 struct bus_type pnp_bus_type = {
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 8d0fe431dbdd..84419af16f77 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -377,9 +377,14 @@ static void create_power_zone_common_attributes(
        if (power_zone->ops->get_max_energy_range_uj)
                power_zone->zone_dev_attrs[count++] =
                                        &dev_attr_max_energy_range_uj.attr;
-        if (power_zone->ops->get_energy_uj)
+        if (power_zone->ops->get_energy_uj) {
+                if (power_zone->ops->reset_energy_uj)
+                        dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
+                else
+                        dev_attr_energy_uj.attr.mode = S_IRUGO;
                power_zone->zone_dev_attrs[count++] =
                                        &dev_attr_energy_uj.attr;
+        }
        if (power_zone->ops->get_power_uw)
                power_zone->zone_dev_attrs[count++] =
                                        &dev_attr_power_uw.attr;
diff --git a/drivers/regulator/as3722-regulator.c b/drivers/regulator/as3722-regulator.c
index 5917fe3dc983..b9f1d24c6812 100644
--- a/drivers/regulator/as3722-regulator.c
+++ b/drivers/regulator/as3722-regulator.c
@@ -590,8 +590,8 @@ static int as3722_sd016_set_current_limit(struct regulator_dev *rdev,
        default:
                return -EINVAL;
        }
+        ret <<= ffs(mask) - 1;
        val = ret & mask;
-        val <<= ffs(mask) - 1;
        return as3722_update_bits(as3722, reg, mask, val);
 }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 3fe13130baec..d85f31385b24 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -119,6 +119,11 @@ static const char *rdev_get_name(struct regulator_dev *rdev)
                return "";
 }
+static bool have_full_constraints(void)
+{
+        return has_full_constraints || of_have_populated_dt();
+}
 /**
 * of_get_regulator - get a regulator device node based on supply name
 * @dev: Device pointer for the consumer (of regulator) device
@@ -1340,7 +1345,7 @@ static struct regulator *_regulator_get(struct device *dev, const char *id,
         * Assume that a regulator is physically present and enabled
         * even if it isn't hooked up and just provide a dummy.
         */
-        if (has_full_constraints && allow_dummy) {
+        if (have_full_constraints() && allow_dummy) {
                pr_warn("%s supply %s not found, using dummy regulator\n",
                        devname, id);
@@ -3627,7 +3632,7 @@ int regulator_suspend_finish(void)
                        if (error)
                                ret = error;
                } else {
-                        if (!has_full_constraints)
+                        if (!have_full_constraints())
                                goto unlock;
                        if (!ops->disable)
                                goto unlock;
@@ -3825,7 +3830,7 @@ static int __init regulator_init_complete(void)
                if (!enabled)
                        goto unlock;
-                if (has_full_constraints) {
+                if (have_full_constraints()) {
                        /* We log since this may kill the system if it
                         * goes wrong. */
                        rdev_info(rdev, "disabling\n");
diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index 032df3799efb..8b5e4c712a01 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -38,7 +38,7 @@
 #define PFUZE100_DEVICEID       0x0
 #define PFUZE100_REVID          0x3
-#define PFUZE100_FABID          0x3
+#define PFUZE100_FABID          0x4
 #define PFUZE100_SW1ABVOL       0x20
 #define PFUZE100_SW1CVOL        0x2e
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index cbf91e25cf7f..aeb40aad0ae7 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -925,7 +925,7 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
                config.dev = s5m8767->dev;
                config.init_data = pdata->regulators[i].initdata;
                config.driver_data = s5m8767;
-                config.regmap = iodev->regmap;
+                config.regmap = iodev->regmap_pmic;
                config.of_node = pdata->regulators[i].reg_node;
                rdev[i] = devm_regulator_register(&pdev->dev, &regulators[id],
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index c0da95e95702..3281c90691c3 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -220,6 +220,8 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        at91_alarm_year = tm.tm_year;
+        tm.tm_mon = alrm->time.tm_mon;
+        tm.tm_mday = alrm->time.tm_mday;
        tm.tm_hour = alrm->time.tm_hour;
        tm.tm_min = alrm->time.tm_min;
        tm.tm_sec = alrm->time.tm_sec;
diff --git a/drivers/rtc/rtc-s5m.c b/drivers/rtc/rtc-s5m.c
index b7fd02bc0a14..ae8119dc2846 100644
--- a/drivers/rtc/rtc-s5m.c
+++ b/drivers/rtc/rtc-s5m.c
@@ -28,10 +28,20 @@
 #include <linux/mfd/samsung/irq.h>
 #include <linux/mfd/samsung/rtc.h>
+/*
+ * Maximum number of retries for checking changes in UDR field
+ * of SEC_RTC_UDR_CON register (to limit possible endless loop).
+ *
+ * After writing to RTC registers (setting time or alarm) read the UDR field
+ * in SEC_RTC_UDR_CON register. UDR is auto-cleared when data have
+ * been transferred.
+ */
+#define UDR_READ_RETRY_CNT      5
 struct s5m_rtc_info {
        struct device *dev;
        struct sec_pmic_dev *s5m87xx;
-        struct regmap *rtc;
+        struct regmap *regmap;
        struct rtc_device *rtc_dev;
        int irq;
        int device_type;
@@ -84,12 +94,31 @@ static int s5m8767_tm_to_data(struct rtc_time *tm, u8 *data)
        }
 }
+/*
+ * Read RTC_UDR_CON register and wait till UDR field is cleared.
+ * This indicates that time/alarm update ended.
+ */
+static inline int s5m8767_wait_for_udr_update(struct s5m_rtc_info *info)
+{
+        int ret, retry = UDR_READ_RETRY_CNT;
+        unsigned int data;
+        do {
+                ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
+        } while (--retry && (data & RTC_UDR_MASK) && !ret);
+        if (!retry)
+                dev_err(info->dev, "waiting for UDR update, reached max number of retries\n");
+        return ret;
+}
 static inline int s5m8767_rtc_set_time_reg(struct s5m_rtc_info *info)
 {
        int ret;
        unsigned int data;
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
        if (ret < 0) {
                dev_err(info->dev, "failed to read update reg(%d)\n", ret);
                return ret;
@@ -98,15 +127,13 @@ static inline int s5m8767_rtc_set_time_reg(struct s5m_rtc_info *info)
        data |= RTC_TIME_EN_MASK;
        data |= RTC_UDR_MASK;
-        ret = regmap_write(info->rtc, SEC_RTC_UDR_CON, data);
+        ret = regmap_write(info->regmap, SEC_RTC_UDR_CON, data);
        if (ret < 0) {
                dev_err(info->dev, "failed to write update reg(%d)\n", ret);
                return ret;
        }
-        do {
+        ret = s5m8767_wait_for_udr_update(info);
-                ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
-        } while ((data & RTC_UDR_MASK) && !ret);
        return ret;
 }
@@ -116,7 +143,7 @@ static inline int s5m8767_rtc_set_alarm_reg(struct s5m_rtc_info *info)
        int ret;
        unsigned int data;
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &data);
        if (ret < 0) {
                dev_err(info->dev, "%s: fail to read update reg(%d)\n",
                        __func__, ret);
@@ -126,16 +153,14 @@ static inline int s5m8767_rtc_set_alarm_reg(struct s5m_rtc_info *info)
        data &= ~RTC_TIME_EN_MASK;
        data |= RTC_UDR_MASK;
-        ret = regmap_write(info->rtc, SEC_RTC_UDR_CON, data);
+        ret = regmap_write(info->regmap, SEC_RTC_UDR_CON, data);
        if (ret < 0) {
                dev_err(info->dev, "%s: fail to write update reg(%d)\n",
                        __func__, ret);
                return ret;
        }
-        do {
+        ret = s5m8767_wait_for_udr_update(info);
-                ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &data);
-        } while ((data & RTC_UDR_MASK) && !ret);
        return ret;
 }
@@ -178,7 +203,7 @@ static int s5m_rtc_read_time(struct device *dev, struct rtc_time *tm)
        u8 data[8];
        int ret;
-        ret = regmap_bulk_read(info->rtc, SEC_RTC_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_RTC_SEC, data, 8);
        if (ret < 0)
                return ret;
@@ -226,7 +251,7 @@ static int s5m_rtc_set_time(struct device *dev, struct rtc_time *tm)
                1900 + tm->tm_year, 1 + tm->tm_mon, tm->tm_mday,
                tm->tm_hour, tm->tm_min, tm->tm_sec, tm->tm_wday);
-        ret = regmap_raw_write(info->rtc, SEC_RTC_SEC, data, 8);
+        ret = regmap_raw_write(info->regmap, SEC_RTC_SEC, data, 8);
        if (ret < 0)
                return ret;
@@ -242,20 +267,20 @@ static int s5m_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
        unsigned int val;
        int ret, i;
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
        if (ret < 0)
                return ret;
        switch (info->device_type) {
        case S5M8763X:
                s5m8763_data_to_tm(data, &alrm->time);
-                ret = regmap_read(info->rtc, SEC_ALARM0_CONF, &val);
+                ret = regmap_read(info->regmap, SEC_ALARM0_CONF, &val);
                if (ret < 0)
                        return ret;
                alrm->enabled = !!val;
-                ret = regmap_read(info->rtc, SEC_RTC_STATUS, &val);
+                ret = regmap_read(info->regmap, SEC_RTC_STATUS, &val);
                if (ret < 0)
                        return ret;
@@ -278,7 +303,7 @@ static int s5m_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
                }
                alrm->pending = 0;
-                ret = regmap_read(info->rtc, SEC_RTC_STATUS, &val);
+                ret = regmap_read(info->regmap, SEC_RTC_STATUS, &val);
                if (ret < 0)
                        return ret;
                break;
@@ -301,7 +326,7 @@ static int s5m_rtc_stop_alarm(struct s5m_rtc_info *info)
        int ret, i;
        struct rtc_time tm;
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
        if (ret < 0)
                return ret;
@@ -312,14 +337,14 @@ static int s5m_rtc_stop_alarm(struct s5m_rtc_info *info)
        switch (info->device_type) {
        case S5M8763X:
-                ret = regmap_write(info->rtc, SEC_ALARM0_CONF, 0);
+                ret = regmap_write(info->regmap, SEC_ALARM0_CONF, 0);
                break;
        case S5M8767X:
                for (i = 0; i < 7; i++)
                        data[i] &= ~ALARM_ENABLE_MASK;
-                ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+                ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
                if (ret < 0)
                        return ret;
@@ -341,7 +366,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
        u8 alarm0_conf;
        struct rtc_time tm;
-        ret = regmap_bulk_read(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_bulk_read(info->regmap, SEC_ALARM0_SEC, data, 8);
        if (ret < 0)
                return ret;
@@ -353,7 +378,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
        switch (info->device_type) {
        case S5M8763X:
                alarm0_conf = 0x77;
-                ret = regmap_write(info->rtc, SEC_ALARM0_CONF, alarm0_conf);
+                ret = regmap_write(info->regmap, SEC_ALARM0_CONF, alarm0_conf);
                break;
        case S5M8767X:
@@ -368,7 +393,7 @@ static int s5m_rtc_start_alarm(struct s5m_rtc_info *info)
                if (data[RTC_YEAR1] & 0x7f)
                        data[RTC_YEAR1] |= ALARM_ENABLE_MASK;
-                ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+                ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
                if (ret < 0)
                        return ret;
                ret = s5m8767_rtc_set_alarm_reg(info);
@@ -410,7 +435,7 @@ static int s5m_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
        if (ret < 0)
                return ret;
-        ret = regmap_raw_write(info->rtc, SEC_ALARM0_SEC, data, 8);
+        ret = regmap_raw_write(info->regmap, SEC_ALARM0_SEC, data, 8);
        if (ret < 0)
                return ret;
@@ -455,7 +480,7 @@ static const struct rtc_class_ops s5m_rtc_ops = {
 static void s5m_rtc_enable_wtsr(struct s5m_rtc_info *info, bool enable)
 {
        int ret;
-        ret = regmap_update_bits(info->rtc, SEC_WTSR_SMPL_CNTL,
+        ret = regmap_update_bits(info->regmap, SEC_WTSR_SMPL_CNTL,
                                 WTSR_ENABLE_MASK,
                                 enable ? WTSR_ENABLE_MASK : 0);
        if (ret < 0)
@@ -466,7 +491,7 @@ static void s5m_rtc_enable_wtsr(struct s5m_rtc_info *info, bool enable)
 static void s5m_rtc_enable_smpl(struct s5m_rtc_info *info, bool enable)
 {
        int ret;
-        ret = regmap_update_bits(info->rtc, SEC_WTSR_SMPL_CNTL,
+        ret = regmap_update_bits(info->regmap, SEC_WTSR_SMPL_CNTL,
                                 SMPL_ENABLE_MASK,
                                 enable ? SMPL_ENABLE_MASK : 0);
        if (ret < 0)
@@ -481,7 +506,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
        int ret;
        struct rtc_time tm;
-        ret = regmap_read(info->rtc, SEC_RTC_UDR_CON, &tp_read);
+        ret = regmap_read(info->regmap, SEC_RTC_UDR_CON, &tp_read);
        if (ret < 0) {
                dev_err(info->dev, "%s: fail to read control reg(%d)\n",
                        __func__, ret);
@@ -493,7 +518,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
        data[1] = (0 << BCD_EN_SHIFT) | (1 << MODEL24_SHIFT);
        info->rtc_24hr_mode = 1;
-        ret = regmap_raw_write(info->rtc, SEC_ALARM0_CONF, data, 2);
+        ret = regmap_raw_write(info->regmap, SEC_ALARM0_CONF, data, 2);
        if (ret < 0) {
                dev_err(info->dev, "%s: fail to write controlm reg(%d)\n",
                        __func__, ret);
@@ -515,7 +540,7 @@ static int s5m8767_rtc_init_reg(struct s5m_rtc_info *info)
                ret = s5m_rtc_set_time(info->dev, &tm);
        }
-        ret = regmap_update_bits(info->rtc, SEC_RTC_UDR_CON,
+        ret = regmap_update_bits(info->regmap, SEC_RTC_UDR_CON,
                                 RTC_TCON_MASK, tp_read | RTC_TCON_MASK);
        if (ret < 0)
                dev_err(info->dev, "%s: fail to update TCON reg(%d)\n",
@@ -542,17 +567,19 @@ static int s5m_rtc_probe(struct platform_device *pdev)
        info->dev = &pdev->dev;
        info->s5m87xx = s5m87xx;
-        info->rtc = s5m87xx->rtc;
+        info->regmap = s5m87xx->regmap_rtc;
        info->device_type = s5m87xx->device_type;
        info->wtsr_smpl = s5m87xx->wtsr_smpl;
        switch (pdata->device_type) {
        case S5M8763X:
-                info->irq = s5m87xx->irq_base + S5M8763_IRQ_ALARM0;
+                info->irq = regmap_irq_get_virq(s5m87xx->irq_data,
+                                S5M8763_IRQ_ALARM0);
                break;
        case S5M8767X:
-                info->irq = s5m87xx->irq_base + S5M8767_IRQ_RTCA1;
+                info->irq = regmap_irq_get_virq(s5m87xx->irq_data,
+                                S5M8767_IRQ_RTCA1);
                break;
        default:
@@ -596,7 +623,7 @@ static void s5m_rtc_shutdown(struct platform_device *pdev)
        if (info->wtsr_smpl) {
                for (i = 0; i < 3; i++) {
                        s5m_rtc_enable_wtsr(info, false);
-                        regmap_read(info->rtc, SEC_WTSR_SMPL_CNTL, &val);
+                        regmap_read(info->regmap, SEC_WTSR_SMPL_CNTL, &val);
                        pr_debug("%s: WTSR_SMPL reg(0x%02x)\n", __func__, val);
                        if (val & WTSR_ENABLE_MASK)
                                pr_emerg("%s: fail to disable WTSR\n",
@@ -612,6 +639,30 @@ static void s5m_rtc_shutdown(struct platform_device *pdev)
        s5m_rtc_enable_smpl(info, false);
 }
+static int s5m_rtc_resume(struct device *dev)
+{
+        struct s5m_rtc_info *info = dev_get_drvdata(dev);
+        int ret = 0;
+        if (device_may_wakeup(dev))
+                ret = disable_irq_wake(info->irq);
+        return ret;
+}
+static int s5m_rtc_suspend(struct device *dev)
+{
+        struct s5m_rtc_info *info = dev_get_drvdata(dev);
+        int ret = 0;
+        if (device_may_wakeup(dev))
+                ret = enable_irq_wake(info->irq);
+        return ret;
+}
+static SIMPLE_DEV_PM_OPS(s5m_rtc_pm_ops, s5m_rtc_suspend, s5m_rtc_resume);
 static const struct platform_device_id s5m_rtc_id[] = {
        { "s5m-rtc", 0 },
 };
@@ -620,6 +671,7 @@ static struct platform_driver s5m_rtc_driver = {
        .driver         = {
                .name   = "s5m-rtc",
                .owner  = THIS_MODULE,
+                .pm     = &s5m_rtc_pm_ops,
        },
        .probe          = s5m_rtc_probe,
        .shutdown       = s5m_rtc_shutdown,
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index f64921756ad6..f224d59c4b6b 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -87,7 +87,6 @@ void dasd_gendisk_free(struct dasd_block *block)
 {
        if (block->gdp) {
                del_gendisk(block->gdp);
-                block->gdp->queue = NULL;
                block->gdp->private_data = NULL;
                put_disk(block->gdp);
                block->gdp = NULL;
diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
index f7aa080e9b28..1465e9563101 100644
--- a/drivers/s390/char/sclp_early.c
+++ b/drivers/s390/char/sclp_early.c
@@ -35,7 +35,6 @@ struct read_info_sccb {
        u8      _reserved5[4096 - 112]; /* 112-4095 */
 } __packed __aligned(PAGE_SIZE);
-static __initdata struct init_sccb early_event_mask_sccb __aligned(PAGE_SIZE);
 static __initdata struct read_info_sccb early_read_info_sccb;
 static __initdata char sccb_early[PAGE_SIZE] __aligned(PAGE_SIZE);
 static unsigned long sclp_hsa_size;
@@ -113,7 +112,7 @@ static void __init sclp_facilities_detect(void)
 bool __init sclp_has_linemode(void)
 {
-        struct init_sccb *sccb = &early_event_mask_sccb;
+        struct init_sccb *sccb = (void *) &sccb_early;
        if (sccb->header.response_code != 0x20)
                return 0;
@@ -126,7 +125,7 @@ bool __init sclp_has_linemode(void)
 bool __init sclp_has_vt220(void)
 {
-        struct init_sccb *sccb = &early_event_mask_sccb;
+        struct init_sccb *sccb = (void *) &sccb_early;
        if (sccb->header.response_code != 0x20)
                return 0;
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index 5e1e12c0cf42..0a7325361d29 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -2025,7 +2025,8 @@ static struct scsi_host_template driver_template = {
        .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,
        .use_clustering         = ENABLE_CLUSTERING,
        .shost_attrs            = twa_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
index c845bdbeb6c0..4de346017e9f 100644
--- a/drivers/scsi/3w-sas.c
+++ b/drivers/scsi/3w-sas.c
@@ -1600,7 +1600,8 @@ static struct scsi_host_template driver_template = {
        .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,
        .use_clustering         = ENABLE_CLUSTERING,
        .shost_attrs            = twl_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index b9276d10b25c..752624e6bc00 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -2279,7 +2279,8 @@ static struct scsi_host_template driver_template = {
        .cmd_per_lun            = TW_MAX_CMDS_PER_LUN,  
        .use_clustering         = ENABLE_CLUSTERING,
        .shost_attrs            = tw_host_attrs,
-        .emulated               = 1
+        .emulated               = 1,
+        .no_write_same          = 1,
 };
 /* This function will probe and initialize a card */
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index f0d432c139d0..4921ed19a027 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1081,6 +1081,7 @@ static struct scsi_host_template aac_driver_template = {
 #endif
        .use_clustering                 = ENABLE_CLUSTERING,
        .emulated                       = 1,
+        .no_write_same                  = 1,
 };
 static void __aac_shutdown(struct aac_dev * aac)
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 97fd450aff09..4f6a30b8e5f9 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -137,6 +137,7 @@ static struct scsi_host_template arcmsr_scsi_host_template = {
        .cmd_per_lun            = ARCMSR_MAX_CMD_PERLUN,
        .use_clustering         = ENABLE_CLUSTERING,
        .shost_attrs            = arcmsr_host_attrs,
+        .no_write_same          = 1,
 };
 static struct pci_device_id arcmsr_device_id_table[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1110)},
diff --git a/drivers/scsi/bfa/bfa_fcs.h b/drivers/scsi/bfa/bfa_fcs.h
index 94d5d0102f7d..42bcb970445a 100644
--- a/drivers/scsi/bfa/bfa_fcs.h
+++ b/drivers/scsi/bfa/bfa_fcs.h
@@ -296,6 +296,7 @@ wwn_t bfa_fcs_lport_get_rport(struct bfa_fcs_lport_s *port, wwn_t wwn,
 struct bfa_fcs_lport_s *bfa_fcs_lookup_port(struct bfa_fcs_s *fcs,
                                            u16 vf_id, wwn_t lpwwn);
+void bfa_fcs_lport_set_symname(struct bfa_fcs_lport_s *port, char *symname);
 void bfa_fcs_lport_get_info(struct bfa_fcs_lport_s *port,
                            struct bfa_lport_info_s *port_info);
 void bfa_fcs_lport_get_attr(struct bfa_fcs_lport_s *port,
diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
index 2f61a5af3658..f5e4e61a0fd7 100644
--- a/drivers/scsi/bfa/bfa_fcs_lport.c
+++ b/drivers/scsi/bfa/bfa_fcs_lport.c
@@ -1097,6 +1097,17 @@ bfa_fcs_lport_init(struct bfa_fcs_lport_s *lport,
        bfa_sm_send_event(lport, BFA_FCS_PORT_SM_CREATE);
 }
+void
+bfa_fcs_lport_set_symname(struct bfa_fcs_lport_s *port,
+                                char *symname)
+{
+        strcpy(port->port_cfg.sym_name.symname, symname);
+        if (bfa_sm_cmp_state(port, bfa_fcs_lport_sm_online))
+                bfa_fcs_lport_ns_util_send_rspn_id(
+                        BFA_FCS_GET_NS_FROM_PORT(port), NULL);
+}
 /*
 *  fcs_lport_api
 */
@@ -5140,9 +5151,6 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced)
        u8 *psymbl = &symbl[0];
        int len;
-        if (!bfa_sm_cmp_state(port, bfa_fcs_lport_sm_online))
-                return;
        /* Avoid sending RSPN in the following states. */
        if (bfa_sm_cmp_state(ns, bfa_fcs_lport_ns_sm_offline) ||
            bfa_sm_cmp_state(ns, bfa_fcs_lport_ns_sm_plogi_sending) ||
diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
index e9a681d31223..40be670a1cbc 100644
--- a/drivers/scsi/bfa/bfad_attr.c
+++ b/drivers/scsi/bfa/bfad_attr.c
@@ -593,11 +593,8 @@ bfad_im_vport_set_symbolic_name(struct fc_vport *fc_vport)
                return;
        spin_lock_irqsave(&bfad->bfad_lock, flags);
-        if (strlen(sym_name) > 0) {
+        if (strlen(sym_name) > 0)
-                strcpy(fcs_vport->lport.port_cfg.sym_name.symname, sym_name);
+                bfa_fcs_lport_set_symname(&fcs_vport->lport, sym_name);
-                bfa_fcs_lport_ns_util_send_rspn_id(
-                        BFA_FCS_GET_NS_FROM_PORT((&fcs_vport->lport)), NULL);
-        }
        spin_unlock_irqrestore(&bfad->bfad_lock, flags);
 }
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index ee4fa40a50b1..ce5ef0190bad 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -4684,6 +4684,7 @@ static struct scsi_host_template gdth_template = {
        .cmd_per_lun            = GDTH_MAXC_P_L,
        .unchecked_isa_dma      = 1,
        .use_clustering         = ENABLE_CLUSTERING,
+        .no_write_same          = 1,
 };
 #ifdef CONFIG_ISA
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index f334859024c0..f2c5005f312a 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -395,6 +395,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
        shost->use_clustering = sht->use_clustering;
        shost->ordered_tag = sht->ordered_tag;
        shost->eh_deadline = shost_eh_deadline * HZ;
+        shost->no_write_same = sht->no_write_same;
        if (sht->supported_mode == MODE_UNKNOWN)
                /* means we didn't set it ... default to INITIATOR */
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 22f6432eb475..20a5e6ecf945 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -561,6 +561,7 @@ static struct scsi_host_template hpsa_driver_template = {
        .sdev_attrs = hpsa_sdev_attrs,
        .shost_attrs = hpsa_shost_attrs,
        .max_sectors = 8192,
+        .no_write_same = 1,
 };
@@ -1288,7 +1289,7 @@ static void complete_scsi_command(struct CommandList *cp)
                                        "has check condition: aborted command: "
                                        "ASC: 0x%x, ASCQ: 0x%x\n",
                                        cp, asc, ascq);
-                                cmd->result = DID_SOFT_ERROR << 16;
+                                cmd->result |= DID_SOFT_ERROR << 16;
                                break;
                        }
                        /* Must be some other type of check condition */
@@ -4925,7 +4926,7 @@ reinit_after_soft_reset:
        hpsa_hba_inquiry(h);
        hpsa_register_scsi(h);  /* hook ourselves into SCSI subsystem */
        start_controller_lockup_detector(h);
-        return 1;
+        return 0;
 clean4:
        hpsa_free_sg_chain_blocks(h);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 36ac1c34ce97..573f4128b6b6 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6305,7 +6305,8 @@ static struct scsi_host_template driver_template = {
        .use_clustering = ENABLE_CLUSTERING,
        .shost_attrs = ipr_ioa_attrs,
        .sdev_attrs = ipr_dev_attrs,
-        .proc_name = IPR_NAME
+        .proc_name = IPR_NAME,
+        .no_write_same = 1,
 };
 /**
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index 8d5ea8a1e5a6..52a216f21ae5 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -374,6 +374,7 @@ static struct scsi_host_template ips_driver_template = {
        .sg_tablesize           = IPS_MAX_SG,
        .cmd_per_lun            = 3,
        .use_clustering         = ENABLE_CLUSTERING,
+        .no_write_same          = 1,
 };
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 161c98efade9..d2895836f9fa 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -211,7 +211,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
                qc->tf.nsect = 0;
        }
-        ata_tf_to_fis(&qc->tf, 1, 0, (u8*)&task->ata_task.fis);
+        ata_tf_to_fis(&qc->tf, qc->dev->link->pmp, 1, (u8 *)&task->ata_task.fis);
        task->uldd_task = qc;
        if (ata_is_atapi(qc->tf.protocol)) {
                memcpy(task->ata_task.atapi_packet, qc->cdb, qc->dev->cdb_len);
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 90c95a3385d1..816db12ef5d5 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -4244,6 +4244,7 @@ static struct scsi_host_template megaraid_template = {
        .eh_device_reset_handler        = megaraid_reset,
        .eh_bus_reset_handler           = megaraid_reset,
        .eh_host_reset_handler          = megaraid_reset,
+        .no_write_same                  = 1,
 };
 static int
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index d1a4b82836ea..e2237a97cb9d 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -367,6 +367,7 @@ static struct scsi_host_template megaraid_template_g = {
        .eh_host_reset_handler          = megaraid_reset_handler,
        .change_queue_depth             = megaraid_change_queue_depth,
        .use_clustering                 = ENABLE_CLUSTERING,
+        .no_write_same                  = 1,
        .sdev_attrs                     = megaraid_sdev_attrs,
        .shost_attrs                    = megaraid_shost_attrs,
 };
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 0a743a5d1647..c99812bf2a73 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -2148,6 +2148,7 @@ static struct scsi_host_template megasas_template = {
        .bios_param = megasas_bios_param,
        .use_clustering = ENABLE_CLUSTERING,
        .change_queue_depth = megasas_change_queue_depth,
+        .no_write_same = 1,
 };
 /**
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index f16ece91b94a..0a1296a87d66 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -3403,6 +3403,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
        unsigned long flags;
        u8 deviceType = pPayload->sas_identify.dev_type;
        port->port_state =  portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPC;
        PM8001_MSG_DBG(pm8001_ha,
                pm8001_printk("HW_EVENT_SAS_PHY_UP port id = %d, phy id = %d\n",
                port_id, phy_id));
@@ -3483,6 +3484,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
                pm8001_printk("HW_EVENT_SATA_PHY_UP port id = %d,"
                " phy id = %d\n", port_id, phy_id));
        port->port_state =  portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPC;
        port->port_attached = 1;
        pm8001_get_lrate_mode(phy, link_rate);
        phy->phy_type |= PORT_TYPE_SATA;
diff --git a/drivers/scsi/pm8001/pm8001_hwi.h b/drivers/scsi/pm8001/pm8001_hwi.h
index 6d91e2446542..e4867e690c84 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.h
+++ b/drivers/scsi/pm8001/pm8001_hwi.h
@@ -131,6 +131,10 @@
 #define LINKRATE_30                     (0x02 << 8)
 #define LINKRATE_60                     (0x04 << 8)
+/* for phy state */
+#define PHY_STATE_LINK_UP_SPC           0x1
 /* for new SPC controllers MEMBASE III is shared between BIOS and DATA */
 #define GSM_SM_BASE                     0x4F0000
 struct mpi_msg_hdr{
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 34f5f5ffef05..73a120d81b4d 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -175,20 +175,16 @@ static void pm8001_free(struct pm8001_hba_info *pm8001_ha)
 static void pm8001_tasklet(unsigned long opaque)
 {
        struct pm8001_hba_info *pm8001_ha;
-        u32 vec;
+        struct isr_param *irq_vector;
-        pm8001_ha = (struct pm8001_hba_info *)opaque;
+        irq_vector = (struct isr_param *)opaque;
+        pm8001_ha = irq_vector->drv_inst;
        if (unlikely(!pm8001_ha))
                BUG_ON(1);
-        vec = pm8001_ha->int_vector;
+        PM8001_CHIP_DISP->isr(pm8001_ha, irq_vector->irq_id);
-        PM8001_CHIP_DISP->isr(pm8001_ha, vec);
 }
 #endif
-static struct  pm8001_hba_info *outq_to_hba(u8 *outq)
-{
-        return container_of((outq - *outq), struct pm8001_hba_info, outq[0]);
-}
 /**
 * pm8001_interrupt_handler_msix - main MSIX interrupt handler.
 * It obtains the vector number and calls the equivalent bottom
@@ -198,18 +194,20 @@ static struct  pm8001_hba_info *outq_to_hba(u8 *outq)
 */
 static irqreturn_t pm8001_interrupt_handler_msix(int irq, void *opaque)
 {
-        struct pm8001_hba_info *pm8001_ha = outq_to_hba(opaque);
+        struct isr_param *irq_vector;
-        u8 outq = *(u8 *)opaque;
+        struct pm8001_hba_info *pm8001_ha;
        irqreturn_t ret = IRQ_HANDLED;
+        irq_vector = (struct isr_param *)opaque;
+        pm8001_ha = irq_vector->drv_inst;
        if (unlikely(!pm8001_ha))
                return IRQ_NONE;
        if (!PM8001_CHIP_DISP->is_our_interupt(pm8001_ha))
                return IRQ_NONE;
-        pm8001_ha->int_vector = outq;
 #ifdef PM8001_USE_TASKLET
-        tasklet_schedule(&pm8001_ha->tasklet);
+        tasklet_schedule(&pm8001_ha->tasklet[irq_vector->irq_id]);
 #else
-        ret = PM8001_CHIP_DISP->isr(pm8001_ha, outq);
+        ret = PM8001_CHIP_DISP->isr(pm8001_ha, irq_vector->irq_id);
 #endif
        return ret;
 }
@@ -230,9 +228,8 @@ static irqreturn_t pm8001_interrupt_handler_intx(int irq, void *dev_id)
        if (!PM8001_CHIP_DISP->is_our_interupt(pm8001_ha))
                return IRQ_NONE;
-        pm8001_ha->int_vector = 0;
 #ifdef PM8001_USE_TASKLET
-        tasklet_schedule(&pm8001_ha->tasklet);
+        tasklet_schedule(&pm8001_ha->tasklet[0]);
 #else
        ret = PM8001_CHIP_DISP->isr(pm8001_ha, 0);
 #endif
@@ -457,7 +454,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
 {
        struct pm8001_hba_info *pm8001_ha;
        struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+        int j;
        pm8001_ha = sha->lldd_ha;
        if (!pm8001_ha)
@@ -480,12 +477,14 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
                pm8001_ha->iomb_size = IOMB_SIZE_SPC;
 #ifdef PM8001_USE_TASKLET
-        /**
+        /* Tasklet for non msi-x interrupt handler */
-        * default tasklet for non msi-x interrupt handler/first msi-x
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
-        * interrupt handler
+                tasklet_init(&pm8001_ha->tasklet[0], pm8001_tasklet,
-        **/
+                        (unsigned long)&(pm8001_ha->irq_vector[0]));
-        tasklet_init(&pm8001_ha->tasklet, pm8001_tasklet,
+        else
-                        (unsigned long)pm8001_ha);
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_init(&pm8001_ha->tasklet[j], pm8001_tasklet,
+                                (unsigned long)&(pm8001_ha->irq_vector[j]));
 #endif
        pm8001_ioremap(pm8001_ha);
        if (!pm8001_alloc(pm8001_ha, ent))
@@ -733,19 +732,20 @@ static u32 pm8001_setup_msix(struct pm8001_hba_info *pm8001_ha)
                        "pci_enable_msix request ret:%d no of intr %d\n",
                                        rc, pm8001_ha->number_of_intr));
-                for (i = 0; i < number_of_intr; i++)
-                        pm8001_ha->outq[i] = i;
                for (i = 0; i < number_of_intr; i++) {
                        snprintf(intr_drvname[i], sizeof(intr_drvname[0]),
                                        DRV_NAME"%d", i);
+                        pm8001_ha->irq_vector[i].irq_id = i;
+                        pm8001_ha->irq_vector[i].drv_inst = pm8001_ha;
                        if (request_irq(pm8001_ha->msix_entries[i].vector,
                                pm8001_interrupt_handler_msix, flag,
-                                intr_drvname[i], &pm8001_ha->outq[i])) {
+                                intr_drvname[i], &(pm8001_ha->irq_vector[i]))) {
                                for (j = 0; j < i; j++)
                                        free_irq(
                                        pm8001_ha->msix_entries[j].vector,
-                                        &pm8001_ha->outq[j]);
+                                        &(pm8001_ha->irq_vector[i]));
                                pci_disable_msix(pm8001_ha->pdev);
                                break;
                        }
@@ -907,7 +907,7 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
 {
        struct sas_ha_struct *sha = pci_get_drvdata(pdev);
        struct pm8001_hba_info *pm8001_ha;
-        int i;
+        int i, j;
        pm8001_ha = sha->lldd_ha;
        sas_unregister_ha(sha);
        sas_remove_host(pm8001_ha->shost);
@@ -921,13 +921,18 @@ static void pm8001_pci_remove(struct pci_dev *pdev)
                synchronize_irq(pm8001_ha->msix_entries[i].vector);
        for (i = 0; i < pm8001_ha->number_of_intr; i++)
                free_irq(pm8001_ha->msix_entries[i].vector,
-                                &pm8001_ha->outq[i]);
+                                &(pm8001_ha->irq_vector[i]));
        pci_disable_msix(pdev);
 #else
        free_irq(pm8001_ha->irq, sha);
 #endif
 #ifdef PM8001_USE_TASKLET
-        tasklet_kill(&pm8001_ha->tasklet);
+        /* For non-msix and msix interrupts */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_kill(&pm8001_ha->tasklet[0]);
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_kill(&pm8001_ha->tasklet[j]);
 #endif
        pm8001_free(pm8001_ha);
        kfree(sha->sas_phy);
@@ -948,7 +953,7 @@ static int pm8001_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 {
        struct sas_ha_struct *sha = pci_get_drvdata(pdev);
        struct pm8001_hba_info *pm8001_ha;
-        int i;
+        int  i, j;
        u32 device_state;
        pm8001_ha = sha->lldd_ha;
        flush_workqueue(pm8001_wq);
@@ -964,13 +969,18 @@ static int pm8001_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                synchronize_irq(pm8001_ha->msix_entries[i].vector);
        for (i = 0; i < pm8001_ha->number_of_intr; i++)
                free_irq(pm8001_ha->msix_entries[i].vector,
-                                &pm8001_ha->outq[i]);
+                                &(pm8001_ha->irq_vector[i]));
        pci_disable_msix(pdev);
 #else
        free_irq(pm8001_ha->irq, sha);
 #endif
 #ifdef PM8001_USE_TASKLET
-        tasklet_kill(&pm8001_ha->tasklet);
+        /* For non-msix and msix interrupts */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
+                tasklet_kill(&pm8001_ha->tasklet[0]);
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_kill(&pm8001_ha->tasklet[j]);
 #endif
        device_state = pci_choose_state(pdev, state);
        pm8001_printk("pdev=0x%p, slot=%s, entering "
@@ -993,7 +1003,7 @@ static int pm8001_pci_resume(struct pci_dev *pdev)
        struct sas_ha_struct *sha = pci_get_drvdata(pdev);
        struct pm8001_hba_info *pm8001_ha;
        int rc;
-        u8 i = 0;
+        u8 i = 0, j;
        u32 device_state;
        pm8001_ha = sha->lldd_ha;
        device_state = pdev->current_state;
@@ -1033,10 +1043,14 @@ static int pm8001_pci_resume(struct pci_dev *pdev)
        if (rc)
                goto err_out_disable;
 #ifdef PM8001_USE_TASKLET
-        /* default tasklet for non msi-x interrupt handler/first msi-x
+        /*  Tasklet for non msi-x interrupt handler */
-        * interrupt handler */
+        if ((!pdev->msix_cap) || (pm8001_ha->chip_id == chip_8001))
-        tasklet_init(&pm8001_ha->tasklet, pm8001_tasklet,
+                tasklet_init(&pm8001_ha->tasklet[0], pm8001_tasklet,
-                        (unsigned long)pm8001_ha);
+                        (unsigned long)&(pm8001_ha->irq_vector[0]));
+        else
+                for (j = 0; j < PM8001_MAX_MSIX_VEC; j++)
+                        tasklet_init(&pm8001_ha->tasklet[j], pm8001_tasklet,
+                                (unsigned long)&(pm8001_ha->irq_vector[j]));
 #endif
        PM8001_CHIP_DISP->interrupt_enable(pm8001_ha, 0);
        if (pm8001_ha->chip_id != chip_8001) {
@@ -1169,6 +1183,7 @@ module_exit(pm8001_exit);
 MODULE_AUTHOR("Jack Wang <jack_wang@usish.com>");
 MODULE_AUTHOR("Anand Kumar Santhanam <AnandKumar.Santhanam@pmcs.com>");
 MODULE_AUTHOR("Sangeetha Gnanasekaran <Sangeetha.Gnanasekaran@pmcs.com>");
+MODULE_AUTHOR("Nikith Ganigarakoppal <Nikith.Ganigarakoppal@pmcs.com>");
 MODULE_DESCRIPTION(
                "PMC-Sierra PM8001/8081/8088/8089/8074/8076/8077 "
                "SAS/SATA controller driver");
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index f4eb18e51631..f50ac44b950e 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -1098,15 +1098,17 @@ int pm8001_lu_reset(struct domain_device *dev, u8 *lun)
        struct pm8001_tmf_task tmf_task;
        struct pm8001_device *pm8001_dev = dev->lldd_dev;
        struct pm8001_hba_info *pm8001_ha = pm8001_find_ha_by_dev(dev);
+        DECLARE_COMPLETION_ONSTACK(completion_setstate);
        if (dev_is_sata(dev)) {
                struct sas_phy *phy = sas_get_local_phy(dev);
                rc = pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev ,
                        dev, 1, 0);
                rc = sas_phy_reset(phy, 1);
                sas_put_local_phy(phy);
+                pm8001_dev->setds_completion = &completion_setstate;
                rc = PM8001_CHIP_DISP->set_dev_state_req(pm8001_ha,
                        pm8001_dev, 0x01);
-                msleep(2000);
+                wait_for_completion(&completion_setstate);
        } else {
                tmf_task.tmf = TMF_LU_RESET;
                rc = pm8001_issue_ssp_tmf(dev, lun, &tmf_task);
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
index 6037d477a183..6c5fd5ee22d3 100644
--- a/drivers/scsi/pm8001/pm8001_sas.h
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -466,6 +466,10 @@ struct pm8001_hba_memspace {
        u64                     membase;
        u32                     memsize;
 };
+struct isr_param {
+        struct pm8001_hba_info *drv_inst;
+        u32 irq_id;
+};
 struct pm8001_hba_info {
        char                    name[PM8001_NAME_LENGTH];
        struct list_head        list;
@@ -519,14 +523,13 @@ struct pm8001_hba_info {
        int                     number_of_intr;/*will be used in remove()*/
 #endif
 #ifdef PM8001_USE_TASKLET
-        struct tasklet_struct   tasklet;
+        struct tasklet_struct   tasklet[PM8001_MAX_MSIX_VEC];
 #endif
        u32                     logging_level;
        u32                     fw_status;
        u32                     smp_exp_mode;
-        u32                     int_vector;
        const struct firmware   *fw_image;
-        u8                      outq[PM8001_MAX_MSIX_VEC];
+        struct isr_param irq_vector[PM8001_MAX_MSIX_VEC];
 };
 struct pm8001_work {
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 8987b1706216..c950dc5c9943 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -2894,6 +2894,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
        unsigned long flags;
        u8 deviceType = pPayload->sas_identify.dev_type;
        port->port_state = portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPCV;
        PM8001_MSG_DBG(pm8001_ha, pm8001_printk(
                "portid:%d; phyid:%d; linkrate:%d; "
                "portstate:%x; devicetype:%x\n",
@@ -2978,6 +2979,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
                                port_id, phy_id, link_rate, portstate));
        port->port_state = portstate;
+        phy->phy_state = PHY_STATE_LINK_UP_SPCV;
        port->port_attached = 1;
        pm8001_get_lrate_mode(phy, link_rate);
        phy->phy_type |= PORT_TYPE_SATA;
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
index c86816bea424..9970a385795d 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.h
+++ b/drivers/scsi/pm8001/pm80xx_hwi.h
@@ -215,6 +215,8 @@
 #define SAS_DOPNRJT_RTRY_TMO            128
 #define SAS_COPNRJT_RTRY_TMO            128
+/* for phy state */
+#define PHY_STATE_LINK_UP_SPCV          0x2
 /*
  Making ORR bigger than IT NEXUS LOSS which is 2000000us = 2 second.
  Assuming a bigger value 3 second, 3000000/128 = 23437.5 where 128
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 892ea6161376..be8ce54f99b2 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -4325,6 +4325,7 @@ static struct scsi_host_template pmcraid_host_template = {
        .this_id = -1,
        .sg_tablesize = PMCRAID_MAX_IOADLS,
        .max_sectors = PMCRAID_IOA_MAX_SECTORS,
+        .no_write_same = 1,
        .cmd_per_lun = PMCRAID_MAX_CMD_PER_LUN,
        .use_clustering = ENABLE_CLUSTERING,
        .shost_attrs = pmcraid_host_attrs,
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e6c4bff04339..69725f7c32c1 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2659,6 +2659,12 @@ static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer)
 {
        struct scsi_device *sdev = sdkp->device;
+        if (sdev->host->no_write_same) {
+                sdev->no_write_same = 1;
+                return;
+        }
        if (scsi_report_opcode(sdev, buffer, SD_BUF_SIZE, INQUIRY) < 0) {
                /* too large values might cause issues with arcmsr */
                int vpd_buf_len = 64;
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 1a28f5632797..17d740427240 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1697,6 +1697,7 @@ static struct scsi_host_template scsi_driver = {
        .use_clustering =       DISABLE_CLUSTERING,
        /* Make sure we dont get a sg segment crosses a page boundary */
        .dma_boundary =         PAGE_SIZE-1,
+        .no_write_same =        1,
 };
 enum {
diff --git a/drivers/staging/tidspbridge/rmgr/drv_interface.c b/drivers/staging/tidspbridge/rmgr/drv_interface.c
index 1aa4a3fd0f1b..56e355b3e7fa 100644
--- a/drivers/staging/tidspbridge/rmgr/drv_interface.c
+++ b/drivers/staging/tidspbridge/rmgr/drv_interface.c
@@ -258,7 +258,8 @@ err:
 /* This function maps kernel space memory to user space memory. */
 static int bridge_mmap(struct file *filp, struct vm_area_struct *vma)
 {
-        u32 status;
+        struct omap_dsp_platform_data *pdata =
+                                        omap_dspbridge_dev->dev.platform_data;
        /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by remap_pfn_range() */
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
@@ -268,13 +269,9 @@ static int bridge_mmap(struct file *filp, struct vm_area_struct *vma)
                vma->vm_start, vma->vm_end, vma->vm_page_prot,
                vma->vm_flags);
-        status = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+        return vm_iomap_memory(vma,
-                                 vma->vm_end - vma->vm_start,
+                               pdata->phys_mempool_base,
-                                 vma->vm_page_prot);
+                               pdata->phys_mempool_size);
-        if (status != 0)
-                status = -EAGAIN;
-        return status;
 }
 static const struct file_operations bridge_fops = {
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 0f74945af624..268b62768f2b 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -810,7 +810,8 @@ static void process_echoes(struct tty_struct *tty)
        struct n_tty_data *ldata = tty->disc_data;
        size_t echoed;
-        if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_tail)
+        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
+            ldata->echo_commit == ldata->echo_tail)
                return;
        mutex_lock(&ldata->output_lock);
@@ -825,7 +826,8 @@ static void flush_echoes(struct tty_struct *tty)
 {
        struct n_tty_data *ldata = tty->disc_data;
-        if (!L_ECHO(tty) || ldata->echo_commit == ldata->echo_head)
+        if ((!L_ECHO(tty) && !L_ECHONL(tty)) ||
+            ldata->echo_commit == ldata->echo_head)
                return;
        mutex_lock(&ldata->output_lock);
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 67beb8444930..f7beb6eb40c7 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -653,6 +653,8 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
                return -EINVAL;
        mem = idev->info->mem + mi;
+        if (mem->addr & ~PAGE_MASK)
+                return -ENODEV;
        if (vma->vm_end - vma->vm_start > mem->size)
                return -EINVAL;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 3e7560f004f8..e8404319ca68 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1515,6 +1515,8 @@ static int acm_reset_resume(struct usb_interface *intf)
 static const struct usb_device_id acm_ids[] = {
        /* quirky and broken devices */
+        { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
+        .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
        { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
        },
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a7c04e24ca48..bd9dc3504b51 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4832,8 +4832,9 @@ static void hub_events(void)
                                        hub->ports[i - 1]->child;
                                dev_dbg(hub_dev, "warm reset port %d\n", i);
-                                if (!udev || !(portstatus &
+                                if (!udev ||
-                                                USB_PORT_STAT_CONNECTION)) {
+                                    !(portstatus & USB_PORT_STAT_CONNECTION) ||
+                                    udev->state == USB_STATE_NOTATTACHED) {
                                        status = hub_port_reset(hub, i,
                                                        NULL, HUB_BH_RESET_TIME,
                                                        true);
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 95f7649c71a7..21a352079bc2 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -459,6 +459,8 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
                        dep = dwc3_wIndex_to_dep(dwc, wIndex);
                        if (!dep)
                                return -EINVAL;
+                        if (set == 0 && (dep->flags & DWC3_EP_WEDGE))
+                                break;
                        ret = __dwc3_gadget_ep_set_halt(dep, set);
                        if (ret)
                                return -EINVAL;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 5452c0fce360..02e44fcaf205 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1200,9 +1200,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
                else
                        dep->flags |= DWC3_EP_STALL;
        } else {
-                if (dep->flags & DWC3_EP_WEDGE)
-                        return 0;
                ret = dwc3_send_gadget_ep_cmd(dwc, dep->number,
                        DWC3_DEPCMD_CLEARSTALL, &params);
                if (ret)
@@ -1210,7 +1207,7 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
                                        value ? "set" : "clear",
                                        dep->name);
                else
-                        dep->flags &= ~DWC3_EP_STALL;
+                        dep->flags &= ~(DWC3_EP_STALL | DWC3_EP_WEDGE);
        }
        return ret;
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index a91e6422f930..f66d96ad1f51 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -682,6 +682,7 @@ config USB_CONFIGFS_PHONET
 config USB_CONFIGFS_MASS_STORAGE
        boolean "Mass storage"
        depends on USB_CONFIGFS
+        depends on BLOCK
        select USB_F_MASS_STORAGE
        help
          The Mass Storage Gadget acts as a USB Mass Storage disk drive.
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 3e7ae707f691..2018ba1a2172 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -593,6 +593,7 @@ static void reset_config(struct usb_composite_dev *cdev)
                bitmap_zero(f->endpoints, 32);
        }
        cdev->config = NULL;
+        cdev->delayed_status = 0;
 }
 static int set_config(struct usb_composite_dev *cdev,
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 774e8b89cdb5..241fc873ffa4 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1304,7 +1304,7 @@ static struct ffs_data *ffs_data_new(void)
 {
        struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
        if (unlikely(!ffs))
-                return 0;
+                return NULL;
        ENTER();
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index a03ba2c83589..b96393908860 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -523,7 +523,7 @@ static int fsg_setup(struct usb_function *f,
                 */
                DBG(fsg, "bulk reset request\n");
                raise_exception(fsg->common, FSG_STATE_RESET);
-                return DELAYED_STATUS;
+                return USB_GADGET_DELAYED_STATUS;
        case US_BULK_GET_MAX_LUN:
                if (ctrl->bRequestType !=
@@ -602,13 +602,14 @@ static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
        return true;
 }
-static int sleep_thread(struct fsg_common *common)
+static int sleep_thread(struct fsg_common *common, bool can_freeze)
 {
        int     rc = 0;
        /* Wait until a signal arrives or we are woken up */
        for (;;) {
-                try_to_freeze();
+                if (can_freeze)
+                        try_to_freeze();
                set_current_state(TASK_INTERRUPTIBLE);
                if (signal_pending(current)) {
                        rc = -EINTR;
@@ -682,7 +683,7 @@ static int do_read(struct fsg_common *common)
                /* Wait for the next buffer to become available */
                bh = common->next_buffhd_to_fill;
                while (bh->state != BUF_STATE_EMPTY) {
-                        rc = sleep_thread(common);
+                        rc = sleep_thread(common, false);
                        if (rc)
                                return rc;
                }
@@ -937,7 +938,7 @@ static int do_write(struct fsg_common *common)
                }
                /* Wait for something to happen */
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, false);
                if (rc)
                        return rc;
        }
@@ -1504,7 +1505,7 @@ static int throw_away_data(struct fsg_common *common)
                }
                /* Otherwise wait for something to happen */
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                if (rc)
                        return rc;
        }
@@ -1625,7 +1626,7 @@ static int send_status(struct fsg_common *common)
        /* Wait for the next buffer to become available */
        bh = common->next_buffhd_to_fill;
        while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                if (rc)
                        return rc;
        }
@@ -1828,7 +1829,7 @@ static int do_scsi_command(struct fsg_common *common)
        bh = common->next_buffhd_to_fill;
        common->next_buffhd_to_drain = bh;
        while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                if (rc)
                        return rc;
        }
@@ -2174,7 +2175,7 @@ static int get_next_command(struct fsg_common *common)
        /* Wait for the next buffer to become available */
        bh = common->next_buffhd_to_fill;
        while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                if (rc)
                        return rc;
        }
@@ -2193,7 +2194,7 @@ static int get_next_command(struct fsg_common *common)
        /* Wait for the CBW to arrive */
        while (bh->state != BUF_STATE_FULL) {
-                rc = sleep_thread(common);
+                rc = sleep_thread(common, true);
                if (rc)
                        return rc;
        }
@@ -2379,7 +2380,7 @@ static void handle_exception(struct fsg_common *common)
                        }
                        if (num_active == 0)
                                break;
-                        if (sleep_thread(common))
+                        if (sleep_thread(common, true))
                                return;
                }
@@ -2516,7 +2517,7 @@ static int fsg_main_thread(void *common_)
                }
                if (!common->running) {
-                        sleep_thread(common);
+                        sleep_thread(common, true);
                        continue;
                }
@@ -3111,7 +3112,7 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
                                          fsg->common->can_stall);
                if (ret)
                        return ret;
-                fsg_common_set_inquiry_string(fsg->common, 0, 0);
+                fsg_common_set_inquiry_string(fsg->common, NULL, NULL);
                ret = fsg_common_run_thread(fsg->common);
                if (ret)
                        return ret;
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index 0ac6064aa3b8..409a3c45a36a 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -54,6 +54,7 @@
 */
 #ifdef CONFIG_ARCH_PXA
 #include <mach/pxa25x-udc.h>
+#include <mach/hardware.h>
 #endif
 #ifdef CONFIG_ARCH_LUBBOCK
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 9875d9c0823f..e20bc109fdd7 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -1180,6 +1180,7 @@ static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
 }
 static void s3c_hsotg_enqueue_setup(struct s3c_hsotg *hsotg);
+static void s3c_hsotg_disconnect(struct s3c_hsotg *hsotg);
 /**
 * s3c_hsotg_process_control - process a control request
@@ -1221,6 +1222,7 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
        if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
                switch (ctrl->bRequest) {
                case USB_REQ_SET_ADDRESS:
+                        s3c_hsotg_disconnect(hsotg);
                        dcfg = readl(hsotg->regs + DCFG);
                        dcfg &= ~DCFG_DevAddr_MASK;
                        dcfg |= ctrl->wValue << DCFG_DevAddr_SHIFT;
@@ -1245,7 +1247,9 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
        /* as a fallback, try delivering it to the driver to deal with */
        if (ret == 0 && hsotg->driver) {
+                spin_unlock(&hsotg->lock);
                ret = hsotg->driver->setup(&hsotg->gadget, ctrl);
+                spin_lock(&hsotg->lock);
                if (ret < 0)
                        dev_dbg(hsotg->dev, "driver->setup() ret %d\n", ret);
        }
@@ -1308,10 +1312,12 @@ static void s3c_hsotg_complete_setup(struct usb_ep *ep,
                return;
        }
+        spin_lock(&hsotg->lock);
        if (req->actual == 0)
                s3c_hsotg_enqueue_setup(hsotg);
        else
                s3c_hsotg_process_control(hsotg, req->buf);
+        spin_unlock(&hsotg->lock);
 }
 /**
@@ -2533,7 +2539,6 @@ irq_retry:
                writel(GINTSTS_USBSusp, hsotg->regs + GINTSTS);
                call_gadget(hsotg, suspend);
-                s3c_hsotg_disconnect(hsotg);
        }
        if (gintsts & GINTSTS_WkUpInt) {
diff --git a/drivers/usb/gadget/storage_common.h b/drivers/usb/gadget/storage_common.h
index c74c2fdbd56e..70c891469f57 100644
--- a/drivers/usb/gadget/storage_common.h
+++ b/drivers/usb/gadget/storage_common.h
@@ -119,10 +119,6 @@ static inline bool fsg_lun_is_open(struct fsg_lun *curlun)
        return curlun->filp != NULL;
 }
-/* Big enough to hold our biggest descriptor */
-#define EP0_BUFSIZE     256
-#define DELAYED_STATUS  (EP0_BUFSIZE + 999)     /* An impossibly large value */
 /* Default size of buffer length. */
 #define FSG_BUFLEN      ((u32)16384)
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
index 6c3d7950d2a9..0f8aad78b54f 100644
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -370,7 +370,7 @@ err:
        return -ENOMEM;
 }
-void bot_cleanup_old_alt(struct f_uas *fu)
+static void bot_cleanup_old_alt(struct f_uas *fu)
 {
        if (!(fu->flags & USBG_ENABLED))
                return;
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 0dd07ae1555d..f49b0b61ecc8 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -91,17 +91,17 @@ static struct usb_zero_options gzero_options = {
 * functional coverage for the "USBCV" test harness from USB-IF.
 * It's always set if OTG mode is enabled.
 */
-unsigned autoresume = DEFAULT_AUTORESUME;
+static unsigned autoresume = DEFAULT_AUTORESUME;
 module_param(autoresume, uint, S_IRUGO);
 MODULE_PARM_DESC(autoresume, "zero, or seconds before remote wakeup");
 /* Maximum Autoresume time */
-unsigned max_autoresume;
+static unsigned max_autoresume;
 module_param(max_autoresume, uint, S_IRUGO);
 MODULE_PARM_DESC(max_autoresume, "maximum seconds before remote wakeup");
 /* Interval between two remote wakeups */
-unsigned autoresume_interval_ms;
+static unsigned autoresume_interval_ms;
 module_param(autoresume_interval_ms, uint, S_IRUGO);
 MODULE_PARM_DESC(autoresume_interval_ms,
                "milliseconds to increase successive wakeup delays");
diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
index e89ac4d4b87e..9b7435f0dcd6 100644
--- a/drivers/usb/host/ohci-pxa27x.c
+++ b/drivers/usb/host/ohci-pxa27x.c
@@ -21,6 +21,7 @@
 #include <linux/clk.h>
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 1e2f3f495843..53c2e296467f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2973,8 +2973,58 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
        }
        while (1) {
-                if (room_on_ring(xhci, ep_ring, num_trbs))
+                if (room_on_ring(xhci, ep_ring, num_trbs)) {
-                        break;
+                        union xhci_trb *trb = ep_ring->enqueue;
+                        unsigned int usable = ep_ring->enq_seg->trbs +
+                                        TRBS_PER_SEGMENT - 1 - trb;
+                        u32 nop_cmd;
+                        /*
+                         * Section 4.11.7.1 TD Fragments states that a link
+                         * TRB must only occur at the boundary between
+                         * data bursts (eg 512 bytes for 480M).
+                         * While it is possible to split a large fragment
+                         * we don't know the size yet.
+                         * Simplest solution is to fill the trb before the
+                         * LINK with nop commands.
+                         */
+                        if (num_trbs == 1 || num_trbs <= usable || usable == 0)
+                                break;
+                        if (ep_ring->type != TYPE_BULK)
+                                /*
+                                 * While isoc transfers might have a buffer that
+                                 * crosses a 64k boundary it is unlikely.
+                                 * Since we can't add NOPs without generating
+                                 * gaps in the traffic just hope it never
+                                 * happens at the end of the ring.
+                                 * This could be fixed by writing a LINK TRB
+                                 * instead of the first NOP - however the
+                                 * TRB_TYPE_LINK_LE32() calls would all need
+                                 * changing to check the ring length.
+                                 */
+                                break;
+                        if (num_trbs >= TRBS_PER_SEGMENT) {
+                                xhci_err(xhci, "Too many fragments %d, max %d\n",
+                                                num_trbs, TRBS_PER_SEGMENT - 1);
+                                return -ENOMEM;
+                        }
+                        nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
+                                        ep_ring->cycle_state);
+                        ep_ring->num_trbs_free -= usable;
+                        do {
+                                trb->generic.field[0] = 0;
+                                trb->generic.field[1] = 0;
+                                trb->generic.field[2] = 0;
+                                trb->generic.field[3] = nop_cmd;
+                                trb++;
+                        } while (--usable);
+                        ep_ring->enqueue = trb;
+                        if (room_on_ring(xhci, ep_ring, num_trbs))
+                                break;
+                }
                if (ep_ring == xhci->cmd_ring) {
                        xhci_err(xhci, "Do not support expand command ring\n");
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 0a43329569d1..4d4499b80449 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1809,7 +1809,6 @@ static void musb_free(struct musb *musb)
                        disable_irq_wake(musb->nIrq);
                free_irq(musb->nIrq, musb);
        }
-        cancel_work_sync(&musb->irq_work);
        musb_host_free(musb);
 }
@@ -1896,6 +1895,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        musb_platform_disable(musb);
        musb_generic_disable(musb);
+        /* Init IRQ workqueue before request_irq */
+        INIT_WORK(&musb->irq_work, musb_irq_work);
        /* setup musb parts of the core (especially endpoints) */
        status = musb_core_init(plat->config->multipoint
                        ? MUSB_CONTROLLER_MHDRC
@@ -1905,9 +1907,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
        setup_timer(&musb->otg_timer, musb_otg_timer_func, (unsigned long) musb);
-        /* Init IRQ workqueue before request_irq */
-        INIT_WORK(&musb->irq_work, musb_irq_work);
        /* attach to the IRQ */
        if (request_irq(nIrq, musb->isr, 0, dev_name(dev), musb)) {
                dev_err(dev, "request_irq %d failed!\n", nIrq);
@@ -1981,6 +1980,7 @@ fail4:
        musb_host_cleanup(musb);
 fail3:
+        cancel_work_sync(&musb->irq_work);
        if (musb->dma_controller)
                dma_controller_destroy(musb->dma_controller);
 fail2_5:
@@ -2043,6 +2043,7 @@ static int musb_remove(struct platform_device *pdev)
        if (musb->dma_controller)
                dma_controller_destroy(musb->dma_controller);
+        cancel_work_sync(&musb->irq_work);
        musb_free(musb);
        device_init_wakeup(dev, 0);
        return 0;
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index ff9d6de2b746..a12bd30401e0 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -38,6 +38,7 @@ struct cppi41_dma_channel {
        u32 prog_len;
        u32 transferred;
        u32 packet_sz;
+        struct list_head tx_check;
 };
 #define MUSB_DMA_NUM_CHANNELS 15
@@ -47,6 +48,8 @@ struct cppi41_dma_controller {
        struct cppi41_dma_channel rx_channel[MUSB_DMA_NUM_CHANNELS];
        struct cppi41_dma_channel tx_channel[MUSB_DMA_NUM_CHANNELS];
        struct musb *musb;
+        struct hrtimer early_tx;
+        struct list_head early_tx_list;
        u32 rx_mode;
        u32 tx_mode;
        u32 auto_req;
@@ -96,31 +99,27 @@ static void update_rx_toggle(struct cppi41_dma_channel *cppi41_channel)
        cppi41_channel->usb_toggle = toggle;
 }
-static void cppi41_dma_callback(void *private_data)
+static bool musb_is_tx_fifo_empty(struct musb_hw_ep *hw_ep)
 {
-        struct dma_channel *channel = private_data;
+        u8              epnum = hw_ep->epnum;
-        struct cppi41_dma_channel *cppi41_channel = channel->private_data;
+        struct musb     *musb = hw_ep->musb;
-        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+        void __iomem    *epio = musb->endpoints[epnum].regs;
-        struct musb *musb = hw_ep->musb;
+        u16             csr;
-        unsigned long flags;
-        struct dma_tx_state txstate;
-        u32 transferred;
-        spin_lock_irqsave(&musb->lock, flags);
+        csr = musb_readw(epio, MUSB_TXCSR);
+        if (csr & MUSB_TXCSR_TXPKTRDY)
+                return false;
+        return true;
+}
-        dmaengine_tx_status(cppi41_channel->dc, cppi41_channel->cookie,
+static void cppi41_dma_callback(void *private_data);
-                        &txstate);
-        transferred = cppi41_channel->prog_len - txstate.residue;
-        cppi41_channel->transferred += transferred;
-        dev_dbg(musb->controller, "DMA transfer done on hw_ep=%d bytes=%d/%d\n",
+static void cppi41_trans_done(struct cppi41_dma_channel *cppi41_channel)
-                hw_ep->epnum, cppi41_channel->transferred,
+{
-                cppi41_channel->total_len);
+        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+        struct musb *musb = hw_ep->musb;
-        update_rx_toggle(cppi41_channel);
+        if (!cppi41_channel->prog_len) {
-        if (cppi41_channel->transferred == cppi41_channel->total_len ||
-                        transferred < cppi41_channel->packet_sz) {
                /* done, complete */
                cppi41_channel->channel.actual_len =
@@ -150,13 +149,11 @@ static void cppi41_dma_callback(void *private_data)
                                remain_bytes,
                                direction,
                                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-                if (WARN_ON(!dma_desc)) {
+                if (WARN_ON(!dma_desc))
-                        spin_unlock_irqrestore(&musb->lock, flags);
                        return;
-                }
                dma_desc->callback = cppi41_dma_callback;
-                dma_desc->callback_param = channel;
+                dma_desc->callback_param = &cppi41_channel->channel;
                cppi41_channel->cookie = dma_desc->tx_submit(dma_desc);
                dma_async_issue_pending(dc);
@@ -166,6 +163,117 @@ static void cppi41_dma_callback(void *private_data)
                        musb_writew(epio, MUSB_RXCSR, csr);
                }
        }
+}
+static enum hrtimer_restart cppi41_recheck_tx_req(struct hrtimer *timer)
+{
+        struct cppi41_dma_controller *controller;
+        struct cppi41_dma_channel *cppi41_channel, *n;
+        struct musb *musb;
+        unsigned long flags;
+        enum hrtimer_restart ret = HRTIMER_NORESTART;
+        controller = container_of(timer, struct cppi41_dma_controller,
+                        early_tx);
+        musb = controller->musb;
+        spin_lock_irqsave(&musb->lock, flags);
+        list_for_each_entry_safe(cppi41_channel, n, &controller->early_tx_list,
+                        tx_check) {
+                bool empty;
+                struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+                empty = musb_is_tx_fifo_empty(hw_ep);
+                if (empty) {
+                        list_del_init(&cppi41_channel->tx_check);
+                        cppi41_trans_done(cppi41_channel);
+                }
+        }
+        if (!list_empty(&controller->early_tx_list)) {
+                ret = HRTIMER_RESTART;
+                hrtimer_forward_now(&controller->early_tx,
+                                ktime_set(0, 150 * NSEC_PER_USEC));
+        }
+        spin_unlock_irqrestore(&musb->lock, flags);
+        return ret;
+}
+static void cppi41_dma_callback(void *private_data)
+{
+        struct dma_channel *channel = private_data;
+        struct cppi41_dma_channel *cppi41_channel = channel->private_data;
+        struct musb_hw_ep *hw_ep = cppi41_channel->hw_ep;
+        struct musb *musb = hw_ep->musb;
+        unsigned long flags;
+        struct dma_tx_state txstate;
+        u32 transferred;
+        bool empty;
+        spin_lock_irqsave(&musb->lock, flags);
+        dmaengine_tx_status(cppi41_channel->dc, cppi41_channel->cookie,
+                        &txstate);
+        transferred = cppi41_channel->prog_len - txstate.residue;
+        cppi41_channel->transferred += transferred;
+        dev_dbg(musb->controller, "DMA transfer done on hw_ep=%d bytes=%d/%d\n",
+                hw_ep->epnum, cppi41_channel->transferred,
+                cppi41_channel->total_len);
+        update_rx_toggle(cppi41_channel);
+        if (cppi41_channel->transferred == cppi41_channel->total_len ||
+                        transferred < cppi41_channel->packet_sz)
+                cppi41_channel->prog_len = 0;
+        empty = musb_is_tx_fifo_empty(hw_ep);
+        if (empty) {
+                cppi41_trans_done(cppi41_channel);
+        } else {
+                struct cppi41_dma_controller *controller;
+                /*
+                 * On AM335x it has been observed that the TX interrupt fires
+                 * too early that means the TXFIFO is not yet empty but the DMA
+                 * engine says that it is done with the transfer. We don't
+                 * receive a FIFO empty interrupt so the only thing we can do is
+                 * to poll for the bit. On HS it usually takes 2us, on FS around
+                 * 110us - 150us depending on the transfer size.
+                 * We spin on HS (no longer than than 25us and setup a timer on
+                 * FS to check for the bit and complete the transfer.
+                 */
+                controller = cppi41_channel->controller;
+                if (musb->g.speed == USB_SPEED_HIGH) {
+                        unsigned wait = 25;
+                        do {
+                                empty = musb_is_tx_fifo_empty(hw_ep);
+                                if (empty)
+                                        break;
+                                wait--;
+                                if (!wait)
+                                        break;
+                                udelay(1);
+                        } while (1);
+                        empty = musb_is_tx_fifo_empty(hw_ep);
+                        if (empty) {
+                                cppi41_trans_done(cppi41_channel);
+                                goto out;
+                        }
+                }
+                list_add_tail(&cppi41_channel->tx_check,
+                                &controller->early_tx_list);
+                if (!hrtimer_active(&controller->early_tx)) {
+                        hrtimer_start_range_ns(&controller->early_tx,
+                                ktime_set(0, 140 * NSEC_PER_USEC),
+                                40 * NSEC_PER_USEC,
+                                HRTIMER_MODE_REL);
+                }
+        }
+out:
        spin_unlock_irqrestore(&musb->lock, flags);
 }
@@ -364,6 +472,8 @@ static int cppi41_is_compatible(struct dma_channel *channel, u16 maxpacket,
                WARN_ON(1);
                return 1;
        }
+        if (cppi41_channel->hw_ep->ep_in.type != USB_ENDPOINT_XFER_BULK)
+                return 0;
        if (cppi41_channel->is_tx)
                return 1;
        /* AM335x Advisory 1.0.13. No workaround for device RX mode */
@@ -388,6 +498,7 @@ static int cppi41_dma_channel_abort(struct dma_channel *channel)
        if (cppi41_channel->channel.status == MUSB_DMA_STATUS_FREE)
                return 0;
+        list_del_init(&cppi41_channel->tx_check);
        if (is_tx) {
                csr = musb_readw(epio, MUSB_TXCSR);
                csr &= ~MUSB_TXCSR_DMAENAB;
@@ -495,6 +606,7 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
                cppi41_channel->controller = controller;
                cppi41_channel->port_num = port;
                cppi41_channel->is_tx = is_tx;
+                INIT_LIST_HEAD(&cppi41_channel->tx_check);
                musb_dma = &cppi41_channel->channel;
                musb_dma->private_data = cppi41_channel;
@@ -520,6 +632,7 @@ void dma_controller_destroy(struct dma_controller *c)
        struct cppi41_dma_controller *controller = container_of(c,
                        struct cppi41_dma_controller, controller);
+        hrtimer_cancel(&controller->early_tx);
        cppi41_dma_controller_stop(controller);
        kfree(controller);
 }
@@ -539,6 +652,9 @@ struct dma_controller *dma_controller_create(struct musb *musb,
        if (!controller)
                goto kzalloc_fail;
+        hrtimer_init(&controller->early_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        controller->early_tx.function = cppi41_recheck_tx_req;
+        INIT_LIST_HEAD(&controller->early_tx_list);
        controller->musb = musb;
        controller->controller.channel_alloc = cppi41_dma_channel_allocate;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index d2d3a173b315..32fb057c03f5 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1796,7 +1796,11 @@ int musb_gadget_setup(struct musb *musb)
        /* this "gadget" abstracts/virtualizes the controller */
        musb->g.name = musb_driver_name;
+#if IS_ENABLED(CONFIG_USB_MUSB_DUAL_ROLE)
        musb->g.is_otg = 1;
+#elif IS_ENABLED(CONFIG_USB_MUSB_GADGET)
+        musb->g.is_otg = 0;
+#endif
        musb_g_init_endpoints(musb);
diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
index 6370e50649d7..0e3c60cb669a 100644
--- a/drivers/usb/phy/phy-am335x.c
+++ b/drivers/usb/phy/phy-am335x.c
@@ -52,8 +52,7 @@ static int am335x_phy_probe(struct platform_device *pdev)
                return am_phy->id;
        }
-        ret = usb_phy_gen_create_phy(dev, &am_phy->usb_phy_gen,
+        ret = usb_phy_gen_create_phy(dev, &am_phy->usb_phy_gen, NULL);
-                        USB_PHY_TYPE_USB2, 0, false);
        if (ret)
                return ret;
@@ -66,8 +65,6 @@ static int am335x_phy_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, am_phy);
        return 0;
-        return ret;
 }
 static int am335x_phy_remove(struct platform_device *pdev)
diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
index fce3a9e9bb5d..aa6d37b3378a 100644
--- a/drivers/usb/phy/phy-generic.c
+++ b/drivers/usb/phy/phy-generic.c
@@ -48,8 +48,9 @@ void usb_nop_xceiv_register(void)
        if (pd)
                return;
        pd = platform_device_register_simple("usb_phy_gen_xceiv", -1, NULL, 0);
-        if (!pd) {
+        if (IS_ERR(pd)) {
                pr_err("Unable to register generic usb transceiver\n");
+                pd = NULL;
                return;
        }
 }
@@ -150,10 +151,40 @@ static int nop_set_host(struct usb_otg *otg, struct usb_bus *host)
 }
 int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
-                enum usb_phy_type type, u32 clk_rate, bool needs_vcc)
+                struct usb_phy_gen_xceiv_platform_data *pdata)
 {
+        enum usb_phy_type type = USB_PHY_TYPE_USB2;
        int err;
+        u32 clk_rate = 0;
+        bool needs_vcc = false;
+        nop->reset_active_low = true;   /* default behaviour */
+        if (dev->of_node) {
+                struct device_node *node = dev->of_node;
+                enum of_gpio_flags flags = 0;
+                if (of_property_read_u32(node, "clock-frequency", &clk_rate))
+                        clk_rate = 0;
+                needs_vcc = of_property_read_bool(node, "vcc-supply");
+                nop->gpio_reset = of_get_named_gpio_flags(node, "reset-gpios",
+                                                                0, &flags);
+                if (nop->gpio_reset == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+                nop->reset_active_low = flags & OF_GPIO_ACTIVE_LOW;
+        } else if (pdata) {
+                type = pdata->type;
+                clk_rate = pdata->clk_rate;
+                needs_vcc = pdata->needs_vcc;
+                nop->gpio_reset = pdata->gpio_reset;
+        } else {
+                nop->gpio_reset = -1;
+        }
        nop->phy.otg = devm_kzalloc(dev, sizeof(*nop->phy.otg),
                        GFP_KERNEL);
        if (!nop->phy.otg)
@@ -218,43 +249,14 @@ EXPORT_SYMBOL_GPL(usb_phy_gen_create_phy);
 static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
-        struct usb_phy_gen_xceiv_platform_data *pdata =
-                        dev_get_platdata(&pdev->dev);
        struct usb_phy_gen_xceiv        *nop;
-        enum usb_phy_type       type = USB_PHY_TYPE_USB2;
        int err;
-        u32 clk_rate = 0;
-        bool needs_vcc = false;
        nop = devm_kzalloc(dev, sizeof(*nop), GFP_KERNEL);
        if (!nop)
                return -ENOMEM;
-        nop->reset_active_low = true;   /* default behaviour */
+        err = usb_phy_gen_create_phy(dev, nop, dev_get_platdata(&pdev->dev));
-        if (dev->of_node) {
-                struct device_node *node = dev->of_node;
-                enum of_gpio_flags flags;
-                if (of_property_read_u32(node, "clock-frequency", &clk_rate))
-                        clk_rate = 0;
-                needs_vcc = of_property_read_bool(node, "vcc-supply");
-                nop->gpio_reset = of_get_named_gpio_flags(node, "reset-gpios",
-                                                                0, &flags);
-                if (nop->gpio_reset == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                nop->reset_active_low = flags & OF_GPIO_ACTIVE_LOW;
-        } else if (pdata) {
-                type = pdata->type;
-                clk_rate = pdata->clk_rate;
-                needs_vcc = pdata->needs_vcc;
-                nop->gpio_reset = pdata->gpio_reset;
-        }
-        err = usb_phy_gen_create_phy(dev, nop, type, clk_rate, needs_vcc);
        if (err)
                return err;
@@ -271,8 +273,6 @@ static int usb_phy_gen_xceiv_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, nop);
        return 0;
-        return err;
 }
 static int usb_phy_gen_xceiv_remove(struct platform_device *pdev)
diff --git a/drivers/usb/phy/phy-generic.h b/drivers/usb/phy/phy-generic.h
index d2a220d81734..38a81f307b82 100644
--- a/drivers/usb/phy/phy-generic.h
+++ b/drivers/usb/phy/phy-generic.h
@@ -1,6 +1,8 @@
 #ifndef _PHY_GENERIC_H_
 #define _PHY_GENERIC_H_
+#include <linux/usb/usb_phy_gen_xceiv.h>
 struct usb_phy_gen_xceiv {
        struct usb_phy phy;
        struct device *dev;
@@ -14,6 +16,6 @@ int usb_gen_phy_init(struct usb_phy *phy);
 void usb_gen_phy_shutdown(struct usb_phy *phy);
 int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_gen_xceiv *nop,
-                enum usb_phy_type type, u32 clk_rate, bool needs_vcc);
+                struct usb_phy_gen_xceiv_platform_data *pdata);
 #endif
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index fdd33b44dbd3..545844b7e796 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -164,7 +164,7 @@ static int mxs_phy_probe(struct platform_device *pdev)
        mxs_phy->clk = clk;
-        platform_set_drvdata(pdev, &mxs_phy->phy);
+        platform_set_drvdata(pdev, mxs_phy);
        ret = usb_add_phy_dev(&mxs_phy->phy);
        if (ret)
diff --git a/drivers/usb/phy/phy-rcar-gen2-usb.c b/drivers/usb/phy/phy-rcar-gen2-usb.c
index a99a6953f11c..db3ab34cddb4 100644
--- a/drivers/usb/phy/phy-rcar-gen2-usb.c
+++ b/drivers/usb/phy/phy-rcar-gen2-usb.c
@@ -107,10 +107,10 @@ static void __rcar_gen2_usb_phy_init(struct rcar_gen2_usb_phy_priv *priv)
        clk_prepare_enable(priv->clk);
        /* Set USB channels in the USBHS UGCTRL2 register */
-        val = ioread32(priv->base);
+        val = ioread32(priv->base + USBHS_UGCTRL2_REG);
        val &= ~(USBHS_UGCTRL2_USB0_HS | USBHS_UGCTRL2_USB2_SS);
        val |= priv->ugctrl2;
-        iowrite32(val, priv->base);
+        iowrite32(val, priv->base + USBHS_UGCTRL2_REG);
 }
 /* Shutdown USB channels */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 9ced8937a8f3..fb0d537435eb 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2123,6 +2123,20 @@ static void ftdi_set_termios(struct tty_struct *tty,
                termios->c_cflag |= CRTSCTS;
        }
+        /*
+         * All FTDI UART chips are limited to CS7/8. We won't pretend to
+         * support CS5/6 and revert the CSIZE setting instead.
+         */
+        if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) {
+                dev_warn(ddev, "requested CSIZE setting not supported\n");
+                termios->c_cflag &= ~CSIZE;
+                if (old_termios)
+                        termios->c_cflag |= old_termios->c_cflag & CSIZE;
+                else
+                        termios->c_cflag |= CS8;
+        }
        cflag = termios->c_cflag;
        if (!old_termios)
@@ -2159,19 +2173,16 @@ no_skip:
        } else {
                urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
        }
-        if (cflag & CSIZE) {
+        switch (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
+        case CS7:
-                case CS7:
+                urb_value |= 7;
-                        urb_value |= 7;
+                dev_dbg(ddev, "Setting CS7\n");
-                        dev_dbg(ddev, "Setting CS7\n");
+                break;
-                        break;
+        default:
-                case CS8:
+        case CS8:
-                        urb_value |= 8;
+                urb_value |= 8;
-                        dev_dbg(ddev, "Setting CS8\n");
+                dev_dbg(ddev, "Setting CS8\n");
-                        break;
+                break;
-                default:
-                        dev_err(ddev, "CSIZE was set but not CS7-CS8\n");
-                }
        }
        /* This is needed by the break command since it uses the same command
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 2b01ec8651c2..b63ce023f96f 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -173,16 +173,8 @@ retry:
                clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
                return result;
        }
-        /*
-         * Try sending off another urb, unless called from completion handler
-         * (in which case there will be no free urb or no data).
-         */
-        if (mem_flags != GFP_ATOMIC)
-                goto retry;
-        clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
+        goto retry;     /* try sending off another urb */
-        return 0;
 }
 EXPORT_SYMBOL_GPL(usb_serial_generic_write_start);
@@ -208,7 +200,7 @@ int usb_serial_generic_write(struct tty_struct *tty,
                return 0;
        count = kfifo_in_locked(&port->write_fifo, buf, count, &port->lock);
-        result = usb_serial_generic_write_start(port, GFP_KERNEL);
+        result = usb_serial_generic_write_start(port, GFP_ATOMIC);
        if (result)
                return result;
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index e5bdd987b9e8..a69da83604c0 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1813,25 +1813,25 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
        iflag = tty->termios.c_iflag;
        /* Change the number of bits */
-        if (cflag & CSIZE) {
+        switch (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
+        case CS5:
-                case CS5:
+                lData = LCR_BITS_5;
-                        lData = LCR_BITS_5;
+                break;
-                        break;
-                case CS6:
+        case CS6:
-                        lData = LCR_BITS_6;
+                lData = LCR_BITS_6;
-                        break;
+                break;
-                case CS7:
+        case CS7:
-                        lData = LCR_BITS_7;
+                lData = LCR_BITS_7;
-                        break;
+                break;
-                default:
-                case CS8:
+        default:
-                        lData = LCR_BITS_8;
+        case CS8:
-                        break;
+                lData = LCR_BITS_8;
-                }
+                break;
        }
        /* Change the Parity bit */
        if (cflag & PARENB) {
                if (cflag & PARODD) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c3d94853b4ab..496b7e39d5be 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -85,6 +85,7 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_K4605                    0x14C6
+#define HUAWEI_PRODUCT_E173S6                   0x1C07
 #define QUANTA_VENDOR_ID                        0x0408
 #define QUANTA_PRODUCT_Q101                     0xEA02
@@ -572,6 +573,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173S6, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t) &net_intf2_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
@@ -634,6 +637,10 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6D) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6E) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x75) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x78) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x79) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x7A) },
@@ -688,6 +695,10 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6D) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6E) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x75) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x78) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x79) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7A) },
@@ -742,6 +753,10 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6D) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6E) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x75) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x78) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x79) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7A) },
@@ -796,6 +811,10 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6D) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6E) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x75) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x78) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x79) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7A) },
@@ -850,6 +869,10 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6D) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6E) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x75) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x78) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x79) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7A) },
@@ -904,6 +927,10 @@ static const struct usb_device_id option_ids[] = {
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6D) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6E) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x72) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x73) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x74) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x75) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x78) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x79) },
        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7A) },
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 1e6de4cd079d..1e3318dfa1cb 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -361,23 +361,21 @@ static void pl2303_set_termios(struct tty_struct *tty,
                            0, 0, buf, 7, 100);
        dev_dbg(&port->dev, "0xa1:0x21:0:0  %d - %7ph\n", i, buf);
-        if (C_CSIZE(tty)) {
+        switch (C_CSIZE(tty)) {
-                switch (C_CSIZE(tty)) {
+        case CS5:
-                case CS5:
+                buf[6] = 5;
-                        buf[6] = 5;
+                break;
-                        break;
+        case CS6:
-                case CS6:
+                buf[6] = 6;
-                        buf[6] = 6;
+                break;
-                        break;
+        case CS7:
-                case CS7:
+                buf[6] = 7;
-                        buf[6] = 7;
+                break;
-                        break;
+        default:
-                default:
+        case CS8:
-                case CS8:
+                buf[6] = 8;
-                        buf[6] = 8;
-                }
-                dev_dbg(&port->dev, "data bits = %d\n", buf[6]);
        }
+        dev_dbg(&port->dev, "data bits = %d\n", buf[6]);
        /* For reference buf[0]:buf[3] baud rate value */
        pl2303_encode_baudrate(tty, port, &buf[0]);
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 4abac28b5992..5b793c352267 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -348,22 +348,20 @@ static void spcp8x5_set_termios(struct tty_struct *tty,
        }
        /* Set Data Length : 00:5bit, 01:6bit, 10:7bit, 11:8bit */
-        if (cflag & CSIZE) {
+        switch (cflag & CSIZE) {
-                switch (cflag & CSIZE) {
+        case CS5:
-                case CS5:
+                buf[1] |= SET_UART_FORMAT_SIZE_5;
-                        buf[1] |= SET_UART_FORMAT_SIZE_5;
+                break;
-                        break;
+        case CS6:
-                case CS6:
+                buf[1] |= SET_UART_FORMAT_SIZE_6;
-                        buf[1] |= SET_UART_FORMAT_SIZE_6;
+                break;
-                        break;
+        case CS7:
-                case CS7:
+                buf[1] |= SET_UART_FORMAT_SIZE_7;
-                        buf[1] |= SET_UART_FORMAT_SIZE_7;
+                break;
-                        break;
+        default:
-                default:
+        case CS8:
-                case CS8:
+                buf[1] |= SET_UART_FORMAT_SIZE_8;
-                        buf[1] |= SET_UART_FORMAT_SIZE_8;
+                break;
-                        break;
-                }
        }
        /* Set Stop bit2 : 0:1bit 1:2bit */
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index e538b72c4e3a..f14e7929ba22 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -97,18 +97,12 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work);
 static void wusb_dev_free(struct wusb_dev *wusb_dev)
 {
-        if (wusb_dev) {
+        kfree(wusb_dev);
-                kfree(wusb_dev->set_gtk_req);
-                usb_free_urb(wusb_dev->set_gtk_urb);
-                kfree(wusb_dev);
-        }
 }
 static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 {
        struct wusb_dev *wusb_dev;
-        struct urb *urb;
-        struct usb_ctrlrequest *req;
        wusb_dev = kzalloc(sizeof(*wusb_dev), GFP_KERNEL);
        if (wusb_dev == NULL)
@@ -118,22 +112,6 @@ static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
        INIT_WORK(&wusb_dev->devconnect_acked_work, wusbhc_devconnect_acked_work);
-        urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (urb == NULL)
-                goto err;
-        wusb_dev->set_gtk_urb = urb;
-        req = kmalloc(sizeof(*req), GFP_KERNEL);
-        if (req == NULL)
-                goto err;
-        wusb_dev->set_gtk_req = req;
-        req->bRequestType = USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
-        req->bRequest = USB_REQ_SET_DESCRIPTOR;
-        req->wValue = cpu_to_le16(USB_DT_KEY << 8 | wusbhc->gtk_index);
-        req->wIndex = 0;
-        req->wLength = cpu_to_le16(wusbhc->gtk.descr.bLength);
        return wusb_dev;
 err:
        wusb_dev_free(wusb_dev);
@@ -411,9 +389,6 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
 /*
 * Refresh the list of keep alives to emit in the MMC
 *
- * Some devices don't respond to keep alives unless they've been
- * authenticated, so skip unauthenticated devices.
- *
 * We only publish the first four devices that have a coming timeout
 * condition. Then when we are done processing those, we go for the
 * next ones. We ignore the ones that have timed out already (they'll
@@ -448,7 +423,7 @@ static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
                if (wusb_dev == NULL)
                        continue;
-                if (wusb_dev->usb_dev == NULL || !wusb_dev->usb_dev->authenticated)
+                if (wusb_dev->usb_dev == NULL)
                        continue;
                if (time_after(jiffies, wusb_dev->entry_ts + tt)) {
@@ -524,11 +499,19 @@ static struct wusb_dev *wusbhc_find_dev_by_addr(struct wusbhc *wusbhc, u8 addr)
 *
 * @wusbhc shall be referenced and unlocked
 */
-static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
+static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, u8 srcaddr)
 {
+        struct wusb_dev *wusb_dev;
        mutex_lock(&wusbhc->mutex);
-        wusb_dev->entry_ts = jiffies;
+        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
-        __wusbhc_keep_alive(wusbhc);
+        if (wusb_dev == NULL) {
+                dev_dbg(wusbhc->dev, "ignoring DN_Alive from unconnected device %02x\n",
+                        srcaddr);
+        } else {
+                wusb_dev->entry_ts = jiffies;
+                __wusbhc_keep_alive(wusbhc);
+        }
        mutex_unlock(&wusbhc->mutex);
 }
@@ -582,14 +565,22 @@ static void wusbhc_handle_dn_connect(struct wusbhc *wusbhc,
 *
 * @wusbhc shall be referenced and unlocked
 */
-static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
+static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, u8 srcaddr)
 {
        struct device *dev = wusbhc->dev;
+        struct wusb_dev *wusb_dev;
-        dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n", wusb_dev->addr);
        mutex_lock(&wusbhc->mutex);
-        __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, wusb_dev->port_idx));
+        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
+        if (wusb_dev == NULL) {
+                dev_dbg(dev, "ignoring DN DISCONNECT from unconnected device %02x\n",
+                        srcaddr);
+        } else {
+                dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n",
+                        wusb_dev->addr);
+                __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc,
+                        wusb_dev->port_idx));
+        }
        mutex_unlock(&wusbhc->mutex);
 }
@@ -611,30 +602,21 @@ void wusbhc_handle_dn(struct wusbhc *wusbhc, u8 srcaddr,
                      struct wusb_dn_hdr *dn_hdr, size_t size)
 {
        struct device *dev = wusbhc->dev;
-        struct wusb_dev *wusb_dev;
        if (size < sizeof(struct wusb_dn_hdr)) {
                dev_err(dev, "DN data shorter than DN header (%d < %d)\n",
                        (int)size, (int)sizeof(struct wusb_dn_hdr));
                return;
        }
-        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
-        if (wusb_dev == NULL && dn_hdr->bType != WUSB_DN_CONNECT) {
-                dev_dbg(dev, "ignoring DN %d from unconnected device %02x\n",
-                        dn_hdr->bType, srcaddr);
-                return;
-        }
        switch (dn_hdr->bType) {
        case WUSB_DN_CONNECT:
                wusbhc_handle_dn_connect(wusbhc, dn_hdr, size);
                break;
        case WUSB_DN_ALIVE:
-                wusbhc_handle_dn_alive(wusbhc, wusb_dev);
+                wusbhc_handle_dn_alive(wusbhc, srcaddr);
                break;
        case WUSB_DN_DISCONNECT:
-                wusbhc_handle_dn_disconnect(wusbhc, wusb_dev);
+                wusbhc_handle_dn_disconnect(wusbhc, srcaddr);
                break;
        case WUSB_DN_MASAVAILCHANGED:
        case WUSB_DN_RWAKE:
diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c
index dd88441c8f78..4c40d0dbf53d 100644
--- a/drivers/usb/wusbcore/security.c
+++ b/drivers/usb/wusbcore/security.c
@@ -29,19 +29,16 @@
 #include <linux/export.h>
 #include "wusbhc.h"
-static void wusbhc_set_gtk_callback(struct urb *urb);
+static void wusbhc_gtk_rekey_work(struct work_struct *work);
-static void wusbhc_gtk_rekey_done_work(struct work_struct *work);
 int wusbhc_sec_create(struct wusbhc *wusbhc)
 {
        wusbhc->gtk.descr.bLength = sizeof(wusbhc->gtk.descr) + sizeof(wusbhc->gtk.data);
        wusbhc->gtk.descr.bDescriptorType = USB_DT_KEY;
        wusbhc->gtk.descr.bReserved = 0;
+        wusbhc->gtk_index = 0;
-        wusbhc->gtk_index = wusb_key_index(0, WUSB_KEY_INDEX_TYPE_GTK,
+        INIT_WORK(&wusbhc->gtk_rekey_work, wusbhc_gtk_rekey_work);
-                                           WUSB_KEY_INDEX_ORIGINATOR_HOST);
-        INIT_WORK(&wusbhc->gtk_rekey_done_work, wusbhc_gtk_rekey_done_work);
        return 0;
 }
@@ -113,7 +110,7 @@ int wusbhc_sec_start(struct wusbhc *wusbhc)
        wusbhc_generate_gtk(wusbhc);
        result = wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid,
-                                 &wusbhc->gtk.descr.bKeyData, key_size);
+                                &wusbhc->gtk.descr.bKeyData, key_size);
        if (result < 0)
                dev_err(wusbhc->dev, "cannot set GTK for the host: %d\n",
                        result);
@@ -129,7 +126,7 @@ int wusbhc_sec_start(struct wusbhc *wusbhc)
 */
 void wusbhc_sec_stop(struct wusbhc *wusbhc)
 {
-        cancel_work_sync(&wusbhc->gtk_rekey_done_work);
+        cancel_work_sync(&wusbhc->gtk_rekey_work);
 }
@@ -185,12 +182,14 @@ static int wusb_dev_set_encryption(struct usb_device *usb_dev, int value)
 static int wusb_dev_set_gtk(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
 {
        struct usb_device *usb_dev = wusb_dev->usb_dev;
+        u8 key_index = wusb_key_index(wusbhc->gtk_index,
+                WUSB_KEY_INDEX_TYPE_GTK, WUSB_KEY_INDEX_ORIGINATOR_HOST);
        return usb_control_msg(
                usb_dev, usb_sndctrlpipe(usb_dev, 0),
                USB_REQ_SET_DESCRIPTOR,
                USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
-                USB_DT_KEY << 8 | wusbhc->gtk_index, 0,
+                USB_DT_KEY << 8 | key_index, 0,
                &wusbhc->gtk.descr, wusbhc->gtk.descr.bLength,
                1000);
 }
@@ -520,24 +519,55 @@ error_kzalloc:
 * Once all connected and authenticated devices have received the new
 * GTK, switch the host to using it.
 */
-static void wusbhc_gtk_rekey_done_work(struct work_struct *work)
+static void wusbhc_gtk_rekey_work(struct work_struct *work)
 {
-        struct wusbhc *wusbhc = container_of(work, struct wusbhc, gtk_rekey_done_work);
+        struct wusbhc *wusbhc = container_of(work,
+                                        struct wusbhc, gtk_rekey_work);
        size_t key_size = sizeof(wusbhc->gtk.data);
+        int port_idx;
+        struct wusb_dev *wusb_dev, *wusb_dev_next;
+        LIST_HEAD(rekey_list);
        mutex_lock(&wusbhc->mutex);
+        /* generate the new key */
+        wusbhc_generate_gtk(wusbhc);
+        /* roll the gtk index. */
+        wusbhc->gtk_index = (wusbhc->gtk_index + 1) % (WUSB_KEY_INDEX_MAX + 1);
+        /*
+         * Save all connected devices on a list while holding wusbhc->mutex and
+         * take a reference to each one.  Then submit the set key request to
+         * them after releasing the lock in order to avoid a deadlock.
+         */
+        for (port_idx = 0; port_idx < wusbhc->ports_max; port_idx++) {
+                wusb_dev = wusbhc->port[port_idx].wusb_dev;
+                if (!wusb_dev || !wusb_dev->usb_dev
+                        || !wusb_dev->usb_dev->authenticated)
+                        continue;
-        if (--wusbhc->pending_set_gtks == 0)
+                wusb_dev_get(wusb_dev);
-                wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid, &wusbhc->gtk.descr.bKeyData, key_size);
+                list_add_tail(&wusb_dev->rekey_node, &rekey_list);
+        }
        mutex_unlock(&wusbhc->mutex);
-}
-static void wusbhc_set_gtk_callback(struct urb *urb)
+        /* Submit the rekey requests without holding wusbhc->mutex. */
-{
+        list_for_each_entry_safe(wusb_dev, wusb_dev_next, &rekey_list,
-        struct wusbhc *wusbhc = urb->context;
+                rekey_node) {
+                list_del_init(&wusb_dev->rekey_node);
+                dev_dbg(&wusb_dev->usb_dev->dev, "%s: rekey device at port %d\n",
+                        __func__, wusb_dev->port_idx);
+                if (wusb_dev_set_gtk(wusbhc, wusb_dev) < 0) {
+                        dev_err(&wusb_dev->usb_dev->dev, "%s: rekey device at port %d failed\n",
+                                __func__, wusb_dev->port_idx);
+                }
+                wusb_dev_put(wusb_dev);
+        }
-        queue_work(wusbd, &wusbhc->gtk_rekey_done_work);
+        /* Switch the host controller to use the new GTK. */
+        mutex_lock(&wusbhc->mutex);
+        wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid,
+                &wusbhc->gtk.descr.bKeyData, key_size);
+        mutex_unlock(&wusbhc->mutex);
 }
 /**
@@ -553,26 +583,12 @@ static void wusbhc_set_gtk_callback(struct urb *urb)
 */
 void wusbhc_gtk_rekey(struct wusbhc *wusbhc)
 {
-        static const size_t key_size = sizeof(wusbhc->gtk.data);
+        /*
-        int p;
+         * We need to submit a URB to the downstream WUSB devices in order to
+         * change the group key.  This can't be done while holding the
-        wusbhc_generate_gtk(wusbhc);
+         * wusbhc->mutex since that is also taken in the urb_enqueue routine
+         * and will cause a deadlock.  Instead, queue a work item to do
-        for (p = 0; p < wusbhc->ports_max; p++) {
+         * it when the lock is not held
-                struct wusb_dev *wusb_dev;
+         */
+        queue_work(wusbd, &wusbhc->gtk_rekey_work);
-                wusb_dev = wusbhc->port[p].wusb_dev;
-                if (!wusb_dev || !wusb_dev->usb_dev || !wusb_dev->usb_dev->authenticated)
-                        continue;
-                usb_fill_control_urb(wusb_dev->set_gtk_urb, wusb_dev->usb_dev,
-                                     usb_sndctrlpipe(wusb_dev->usb_dev, 0),
-                                     (void *)wusb_dev->set_gtk_req,
-                                     &wusbhc->gtk.descr, wusbhc->gtk.descr.bLength,
-                                     wusbhc_set_gtk_callback, wusbhc);
-                if (usb_submit_urb(wusb_dev->set_gtk_urb, GFP_KERNEL) == 0)
-                        wusbhc->pending_set_gtks++;
-        }
-        if (wusbhc->pending_set_gtks == 0)
-                wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid, &wusbhc->gtk.descr.bKeyData, key_size);
 }
diff --git a/drivers/usb/wusbcore/wusbhc.h b/drivers/usb/wusbcore/wusbhc.h
index 711b1952b114..6bd3b819a6b5 100644
--- a/drivers/usb/wusbcore/wusbhc.h
+++ b/drivers/usb/wusbcore/wusbhc.h
@@ -97,6 +97,7 @@ struct wusb_dev {
        struct kref refcnt;
        struct wusbhc *wusbhc;
        struct list_head cack_node;     /* Connect-Ack list */
+        struct list_head rekey_node;    /* GTK rekey list */
        u8 port_idx;
        u8 addr;
        u8 beacon_type:4;
@@ -107,8 +108,6 @@ struct wusb_dev {
        struct usb_wireless_cap_descriptor *wusb_cap_descr;
        struct uwb_mas_bm availability;
        struct work_struct devconnect_acked_work;
-        struct urb *set_gtk_urb;
-        struct usb_ctrlrequest *set_gtk_req;
        struct usb_device *usb_dev;
 };
@@ -296,8 +295,7 @@ struct wusbhc {
        } __attribute__((packed)) gtk;
        u8 gtk_index;
        u32 gtk_tkid;
-        struct work_struct gtk_rekey_done_work;
+        struct work_struct gtk_rekey_work;
-        int pending_set_gtks;
        struct usb_encryption_descriptor *ccm1_etd;
 };
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 8521051cf946..cd961622f9c1 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -131,6 +131,7 @@ static const struct platform_device_id atmel_lcdfb_devtypes[] = {
                /* terminator */
        }
 };
+MODULE_DEVICE_TABLE(platform, atmel_lcdfb_devtypes);
 static struct atmel_lcdfb_config *
 atmel_lcdfb_get_config(struct platform_device *pdev)
diff --git a/drivers/video/kyro/fbdev.c b/drivers/video/kyro/fbdev.c
index 50c857477e4f..65041e15fd59 100644
--- a/drivers/video/kyro/fbdev.c
+++ b/drivers/video/kyro/fbdev.c
@@ -624,15 +624,15 @@ static int kyrofb_ioctl(struct fb_info *info,
                        return -EINVAL;
                }
        case KYRO_IOCTL_UVSTRIDE:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(deviceInfo.ulOverlayUVStride)))
                        return -EFAULT;
                break;
        case KYRO_IOCTL_STRIDE:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(deviceInfo.ulOverlayStride)))
                        return -EFAULT;
                break;
        case KYRO_IOCTL_OVERLAY_OFFSET:
-                if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long)))
+                if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(deviceInfo.ulOverlayOffset)))
                        return -EFAULT;
                break;
        }
diff --git a/drivers/video/offb.c b/drivers/video/offb.c
index 9dbea2223401..7d44d669d5b6 100644
--- a/drivers/video/offb.c
+++ b/drivers/video/offb.c
@@ -91,6 +91,15 @@ extern boot_infos_t *boot_infos;
 #define AVIVO_DC_LUTB_WHITE_OFFSET_GREEN        0x6cd4
 #define AVIVO_DC_LUTB_WHITE_OFFSET_RED          0x6cd8
+#define FB_RIGHT_POS(p, bpp)         (fb_be_math(p) ? 0 : (32 - (bpp)))
+static inline u32 offb_cmap_byteswap(struct fb_info *info, u32 value)
+{
+        u32 bpp = info->var.bits_per_pixel;
+        return cpu_to_be32(value) >> FB_RIGHT_POS(info, bpp);
+}
    /*
     *  Set a single color register. The values supplied are already
     *  rounded down to the hardware's capabilities (according to the
@@ -120,7 +129,7 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                        mask <<= info->var.transp.offset;
                        value |= mask;
                }
-                pal[regno] = value;
+                pal[regno] = offb_cmap_byteswap(info, value);
                return 0;
        }
@@ -301,7 +310,7 @@ static struct fb_ops offb_ops = {
 static void __iomem *offb_map_reg(struct device_node *np, int index,
                                  unsigned long offset, unsigned long size)
 {
-        const u32 *addrp;
+        const __be32 *addrp;
        u64 asize, taddr;
        unsigned int flags;
@@ -369,7 +378,11 @@ static void offb_init_palette_hacks(struct fb_info *info, struct device_node *dp
                }
                of_node_put(pciparent);
        } else if (dp && of_device_is_compatible(dp, "qemu,std-vga")) {
-                const u32 io_of_addr[3] = { 0x01000000, 0x0, 0x0 };
+#ifdef __BIG_ENDIAN
+                const __be32 io_of_addr[3] = { 0x01000000, 0x0, 0x0 };
+#else
+                const __be32 io_of_addr[3] = { 0x00000001, 0x0, 0x0 };
+#endif
                u64 io_addr = of_translate_address(dp, io_of_addr);
                if (io_addr != OF_BAD_ADDR) {
                        par->cmap_adr = ioremap(io_addr + 0x3c8, 2);
@@ -535,7 +548,7 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
        unsigned int flags, rsize, addr_prop = 0;
        unsigned long max_size = 0;
        u64 rstart, address = OF_BAD_ADDR;
-        const u32 *pp, *addrp, *up;
+        const __be32 *pp, *addrp, *up;
        u64 asize;
        int foreign_endian = 0;
@@ -551,25 +564,25 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
        if (pp == NULL)
                pp = of_get_property(dp, "depth", &len);
        if (pp && len == sizeof(u32))
-                depth = *pp;
+                depth = be32_to_cpup(pp);
        pp = of_get_property(dp, "linux,bootx-width", &len);
        if (pp == NULL)
                pp = of_get_property(dp, "width", &len);
        if (pp && len == sizeof(u32))
-                width = *pp;
+                width = be32_to_cpup(pp);
        pp = of_get_property(dp, "linux,bootx-height", &len);
        if (pp == NULL)
                pp = of_get_property(dp, "height", &len);
        if (pp && len == sizeof(u32))
-                height = *pp;
+                height = be32_to_cpup(pp);
        pp = of_get_property(dp, "linux,bootx-linebytes", &len);
        if (pp == NULL)
                pp = of_get_property(dp, "linebytes", &len);
        if (pp && len == sizeof(u32) && (*pp != 0xffffffffu))
-                pitch = *pp;
+                pitch = be32_to_cpup(pp);
        else
                pitch = width * ((depth + 7) / 8);
diff --git a/drivers/video/omap2/displays-new/panel-sony-acx565akm.c b/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
index e6d56f714ae4..d94f35dbd536 100644
--- a/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
+++ b/drivers/video/omap2/displays-new/panel-sony-acx565akm.c
@@ -526,6 +526,8 @@ static int acx565akm_panel_power_on(struct omap_dss_device *dssdev)
        struct omap_dss_device *in = ddata->in;
        int r;
+        mutex_lock(&ddata->mutex);
        dev_dbg(&ddata->spi->dev, "%s\n", __func__);
        in->ops.sdi->set_timings(in, &ddata->videomode);
@@ -614,10 +616,7 @@ static int acx565akm_enable(struct omap_dss_device *dssdev)
        if (omapdss_device_is_enabled(dssdev))
                return 0;
-        mutex_lock(&ddata->mutex);
        r = acx565akm_panel_power_on(dssdev);
-        mutex_unlock(&ddata->mutex);
        if (r)
                return r;
diff --git a/drivers/video/sh_mobile_meram.c b/drivers/video/sh_mobile_meram.c
index e0f098562a74..a297de5cc859 100644
--- a/drivers/video/sh_mobile_meram.c
+++ b/drivers/video/sh_mobile_meram.c
@@ -569,6 +569,7 @@ EXPORT_SYMBOL_GPL(sh_mobile_meram_cache_update);
 * Power management
 */
+#if defined(CONFIG_PM_SLEEP) || defined(CONFIG_PM_RUNTIME)
 static int sh_mobile_meram_suspend(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
@@ -611,6 +612,7 @@ static int sh_mobile_meram_resume(struct device *dev)
                meram_write_reg(priv->base, common_regs[i], priv->regs[i]);
        return 0;
 }
+#endif /* CONFIG_PM_SLEEP || CONFIG_PM_RUNTIME */
 static UNIVERSAL_DEV_PM_OPS(sh_mobile_meram_dev_pm_ops,
                            sh_mobile_meram_suspend,
diff --git a/drivers/video/vt8500lcdfb.c b/drivers/video/vt8500lcdfb.c
index b30e5a439d1f..a8f2b280f796 100644
--- a/drivers/video/vt8500lcdfb.c
+++ b/drivers/video/vt8500lcdfb.c
@@ -293,8 +293,7 @@ static int vt8500lcd_probe(struct platform_device *pdev)
                        + sizeof(u32) * 16, GFP_KERNEL);
        if (!fbi) {
                dev_err(&pdev->dev, "Failed to initialize framebuffer device\n");
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto failed;
        }
        strcpy(fbi->fb.fix.id, "VT8500 LCD");
@@ -327,15 +326,13 @@ static int vt8500lcd_probe(struct platform_device *pdev)
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (res == NULL) {
                dev_err(&pdev->dev, "no I/O memory resource defined\n");
-                ret = -ENODEV;
+                return -ENODEV;
-                goto failed_fbi;
        }
        res = request_mem_region(res->start, resource_size(res), "vt8500lcd");
        if (res == NULL) {
                dev_err(&pdev->dev, "failed to request I/O memory\n");
-                ret = -EBUSY;
+                return -EBUSY;
-                goto failed_fbi;
        }
        fbi->regbase = ioremap(res->start, resource_size(res));
@@ -346,17 +343,19 @@ static int vt8500lcd_probe(struct platform_device *pdev)
        }
        disp_timing = of_get_display_timings(pdev->dev.of_node);
-        if (!disp_timing)
+        if (!disp_timing) {
-                return -EINVAL;
+                ret = -EINVAL;
+                goto failed_free_io;
+        }
        ret = of_get_fb_videomode(pdev->dev.of_node, &of_mode,
                                                        OF_USE_NATIVE_MODE);
        if (ret)
-                return ret;
+                goto failed_free_io;
        ret = of_property_read_u32(pdev->dev.of_node, "bits-per-pixel", &bpp);
        if (ret)
-                return ret;
+                goto failed_free_io;
        /* try allocating the framebuffer */
        fb_mem_len = of_mode.xres * of_mode.yres * 2 * (bpp / 8);
@@ -364,7 +363,8 @@ static int vt8500lcd_probe(struct platform_device *pdev)
                                GFP_KERNEL);
        if (!fb_mem_virt) {
                pr_err("%s: Failed to allocate framebuffer\n", __func__);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto failed_free_io;
        }
        fbi->fb.fix.smem_start  = fb_mem_phys;
@@ -447,9 +447,6 @@ failed_free_io:
        iounmap(fbi->regbase);
 failed_free_res:
        release_mem_region(res->start, resource_size(res));
-failed_fbi:
-        kfree(fbi);
-failed:
        return ret;
 }
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index a6a2cebb2587..cafa973c43be 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -19,7 +19,6 @@
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
 #include <linux/of_address.h>
-#include <linux/miscdevice.h>
 #define PM_RSTC                         0x1c
 #define PM_WDOG                         0x24
diff --git a/drivers/watchdog/ep93xx_wdt.c b/drivers/watchdog/ep93xx_wdt.c
index 833e81311848..d1d07f2f69df 100644
--- a/drivers/watchdog/ep93xx_wdt.c
+++ b/drivers/watchdog/ep93xx_wdt.c
@@ -28,7 +28,6 @@
 #include <linux/platform_device.h>
 #include <linux/module.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/timer.h>
 #include <linux/io.h>
diff --git a/drivers/watchdog/ie6xx_wdt.c b/drivers/watchdog/ie6xx_wdt.c
index 70a240297c6d..07f88f54e5c0 100644
--- a/drivers/watchdog/ie6xx_wdt.c
+++ b/drivers/watchdog/ie6xx_wdt.c
@@ -28,7 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/watchdog.h>
-#include <linux/miscdevice.h>
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
diff --git a/drivers/watchdog/jz4740_wdt.c b/drivers/watchdog/jz4740_wdt.c
index 2de486a7eea1..3aa50cfa335f 100644
--- a/drivers/watchdog/jz4740_wdt.c
+++ b/drivers/watchdog/jz4740_wdt.c
@@ -17,7 +17,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c
index a1a3638c579c..20dc73844737 100644
--- a/drivers/watchdog/kempld_wdt.c
+++ b/drivers/watchdog/kempld_wdt.c
@@ -26,7 +26,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/miscdevice.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/max63xx_wdt.c b/drivers/watchdog/max63xx_wdt.c
index 6d4f3998e1f6..bdb3f4a5b27c 100644
--- a/drivers/watchdog/max63xx_wdt.c
+++ b/drivers/watchdog/max63xx_wdt.c
@@ -19,7 +19,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/bitops.h>
diff --git a/drivers/watchdog/orion_wdt.c b/drivers/watchdog/orion_wdt.c
index 44edca66d564..f7722a424676 100644
--- a/drivers/watchdog/orion_wdt.c
+++ b/drivers/watchdog/orion_wdt.c
@@ -16,7 +16,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/platform_device.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 1bdcc313e1d9..5bec20f5dc2d 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -23,7 +23,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
index 53d37fea183e..d92c2d5859ce 100644
--- a/drivers/watchdog/rt2880_wdt.c
+++ b/drivers/watchdog/rt2880_wdt.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/watchdog.h>
-#include <linux/miscdevice.h>
 #include <linux/moduleparam.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/sc1200wdt.c b/drivers/watchdog/sc1200wdt.c
index 3b9fff9dcf65..131193a7acdf 100644
--- a/drivers/watchdog/sc1200wdt.c
+++ b/drivers/watchdog/sc1200wdt.c
@@ -409,8 +409,9 @@ static int __init sc1200wdt_init(void)
 #if defined CONFIG_PNP
        /* now that the user has specified an IO port and we haven't detected
         * any devices, disable pnp support */
+        if (isapnp)
+                pnp_unregister_driver(&scl200wdt_pnp_driver);
        isapnp = 0;
-        pnp_unregister_driver(&scl200wdt_pnp_driver);
 #endif
        if (!request_region(io, io_len, SC1200_MODULE_NAME)) {
diff --git a/drivers/watchdog/shwdt.c b/drivers/watchdog/shwdt.c
index f9b8e06f3558..af3528f84d65 100644
--- a/drivers/watchdog/shwdt.c
+++ b/drivers/watchdog/shwdt.c
@@ -26,7 +26,6 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/spinlock.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/pm_runtime.h>
 #include <linux/fs.h>
diff --git a/drivers/watchdog/softdog.c b/drivers/watchdog/softdog.c
index ef2638fee4a8..c04a1aa158e2 100644
--- a/drivers/watchdog/softdog.c
+++ b/drivers/watchdog/softdog.c
@@ -42,7 +42,6 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/timer.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/notifier.h>
 #include <linux/reboot.h>
diff --git a/drivers/watchdog/stmp3xxx_rtc_wdt.c b/drivers/watchdog/stmp3xxx_rtc_wdt.c
index d667f6b51d35..bb64ae3f47da 100644
--- a/drivers/watchdog/stmp3xxx_rtc_wdt.c
+++ b/drivers/watchdog/stmp3xxx_rtc_wdt.c
@@ -12,7 +12,6 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/platform_device.h>
 #include <linux/stmp3xxx_rtc_wdt.h>
diff --git a/drivers/watchdog/txx9wdt.c b/drivers/watchdog/txx9wdt.c
index 0fd0e8ae62a8..6a447e321dd0 100644
--- a/drivers/watchdog/txx9wdt.c
+++ b/drivers/watchdog/txx9wdt.c
@@ -13,7 +13,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/types.h>
-#include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/watchdog/ux500_wdt.c b/drivers/watchdog/ux500_wdt.c
index e029b5768f2c..5aed9d7ad47e 100644
--- a/drivers/watchdog/ux500_wdt.c
+++ b/drivers/watchdog/ux500_wdt.c
@@ -12,7 +12,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/moduleparam.h>
-#include <linux/miscdevice.h>
 #include <linux/err.h>
 #include <linux/uaccess.h>
 #include <linux/watchdog.h>