121 files changed, 953 insertions, 467 deletions
diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
index f40acef80269..a6977e12d574 100644
--- a/drivers/acpi/acpi_ipmi.c
+++ b/drivers/acpi/acpi_ipmi.c
@@ -39,6 +39,7 @@
 #include <linux/ipmi.h>
 #include <linux/device.h>
 #include <linux/pnp.h>
+#include <linux/spinlock.h>
 MODULE_AUTHOR("Zhao Yakui");
 MODULE_DESCRIPTION("ACPI IPMI Opregion driver");
@@ -57,7 +58,7 @@ struct acpi_ipmi_device {
        struct list_head head;
        /* the IPMI request message list */
        struct list_head tx_msg_list;
-        struct mutex    tx_msg_lock;
+        spinlock_t      tx_msg_lock;
        acpi_handle handle;
        struct pnp_dev *pnp_dev;
        ipmi_user_t     user_interface;
@@ -147,6 +148,7 @@ static void acpi_format_ipmi_msg(struct acpi_ipmi_msg *tx_msg,
        struct kernel_ipmi_msg *msg;
        struct acpi_ipmi_buffer *buffer;
        struct acpi_ipmi_device *device;
+        unsigned long flags;
        msg = &tx_msg->tx_message;
        /*
@@ -177,10 +179,10 @@ static void acpi_format_ipmi_msg(struct acpi_ipmi_msg *tx_msg,
        /* Get the msgid */
        device = tx_msg->device;
-        mutex_lock(&device->tx_msg_lock);
+        spin_lock_irqsave(&device->tx_msg_lock, flags);
        device->curr_msgid++;
        tx_msg->tx_msgid = device->curr_msgid;
-        mutex_unlock(&device->tx_msg_lock);
+        spin_unlock_irqrestore(&device->tx_msg_lock, flags);
 }
 static void acpi_format_ipmi_response(struct acpi_ipmi_msg *msg,
@@ -242,6 +244,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
        int msg_found = 0;
        struct acpi_ipmi_msg *tx_msg;
        struct pnp_dev *pnp_dev = ipmi_device->pnp_dev;
+        unsigned long flags;
        if (msg->user != ipmi_device->user_interface) {
                dev_warn(&pnp_dev->dev, "Unexpected response is returned. "
@@ -250,7 +253,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
                ipmi_free_recv_msg(msg);
                return;
        }
-        mutex_lock(&ipmi_device->tx_msg_lock);
+        spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
        list_for_each_entry(tx_msg, &ipmi_device->tx_msg_list, head) {
                if (msg->msgid == tx_msg->tx_msgid) {
                        msg_found = 1;
@@ -258,7 +261,7 @@ static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
                }
        }
-        mutex_unlock(&ipmi_device->tx_msg_lock);
+        spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
        if (!msg_found) {
                dev_warn(&pnp_dev->dev, "Unexpected response (msg id %ld) is "
                        "returned.\n", msg->msgid);
@@ -378,6 +381,7 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
        struct acpi_ipmi_device *ipmi_device = handler_context;
        int err, rem_time;
        acpi_status status;
+        unsigned long flags;
        /*
         * IPMI opregion message.
         * IPMI message is firstly written to the BMC and system software
@@ -395,9 +399,9 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
                return AE_NO_MEMORY;
        acpi_format_ipmi_msg(tx_msg, address, value);
-        mutex_lock(&ipmi_device->tx_msg_lock);
+        spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
        list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
-        mutex_unlock(&ipmi_device->tx_msg_lock);
+        spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
        err = ipmi_request_settime(ipmi_device->user_interface,
                                        &tx_msg->addr,
                                        tx_msg->tx_msgid,
@@ -413,9 +417,9 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
        status = AE_OK;
 end_label:
-        mutex_lock(&ipmi_device->tx_msg_lock);
+        spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
        list_del(&tx_msg->head);
-        mutex_unlock(&ipmi_device->tx_msg_lock);
+        spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
        kfree(tx_msg);
        return status;
 }
@@ -457,7 +461,7 @@ static void acpi_add_ipmi_device(struct acpi_ipmi_device *ipmi_device)
        INIT_LIST_HEAD(&ipmi_device->head);
-        mutex_init(&ipmi_device->tx_msg_lock);
+        spin_lock_init(&ipmi_device->tx_msg_lock);
        INIT_LIST_HEAD(&ipmi_device->tx_msg_list);
        ipmi_install_space_handler(ipmi_device);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index fbdb82e70d10..611ce9061dc5 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1121,7 +1121,7 @@ int acpi_bus_register_driver(struct acpi_driver *driver)
 EXPORT_SYMBOL(acpi_bus_register_driver);
 /**
- * acpi_bus_unregister_driver - unregisters a driver with the APIC bus
+ * acpi_bus_unregister_driver - unregisters a driver with the ACPI bus
 * @driver: driver to unregister
 *
 * Unregisters a driver with the ACPI bus.  Searches the namespace for all
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 958ba2a420c3..97f4acb54ad6 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -2,7 +2,7 @@
 *  sata_promise.c - Promise SATA
 *
 *  Maintained by:  Tejun Heo <tj@kernel.org>
- *                  Mikael Pettersson <mikpe@it.uu.se>
+ *                  Mikael Pettersson
 *                  Please ALWAYS copy linux-ide@vger.kernel.org
 *                  on emails.
 *
diff --git a/drivers/base/core.c b/drivers/base/core.c
index c7cfadcf6752..34abf4d8a45f 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2017,7 +2017,7 @@ EXPORT_SYMBOL_GPL(device_move);
 */
 void device_shutdown(void)
 {
-        struct device *dev;
+        struct device *dev, *parent;
        spin_lock(&devices_kset->list_lock);
        /*
@@ -2034,7 +2034,7 @@ void device_shutdown(void)
                 * prevent it from being freed because parent's
                 * lock is to be held
                 */
-                get_device(dev->parent);
+                parent = get_device(dev->parent);
                get_device(dev);
                /*
                 * Make sure the device is off the kset list, in the
@@ -2044,8 +2044,8 @@ void device_shutdown(void)
                spin_unlock(&devices_kset->list_lock);
                /* hold lock to avoid race with probe/release */
-                if (dev->parent)
+                if (parent)
-                        device_lock(dev->parent);
+                        device_lock(parent);
                device_lock(dev);
                /* Don't allow any more runtime suspends */
@@ -2063,11 +2063,11 @@ void device_shutdown(void)
                }
                device_unlock(dev);
-                if (dev->parent)
+                if (parent)
-                        device_unlock(dev->parent);
+                        device_unlock(parent);
                put_device(dev);
-                put_device(dev->parent);
+                put_device(parent);
                spin_lock(&devices_kset->list_lock);
        }
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index d2d95ff5353b..edfa2515bc86 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1189,6 +1189,7 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
        int err;
        u32 cp;
+        memset(&arg64, 0, sizeof(arg64));
        err = 0;
        err |=
            copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 639d26b90b91..2b9440384536 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -1193,6 +1193,7 @@ out_passthru:
                ida_pci_info_struct pciinfo;
                if (!arg) return -EINVAL;
+                memset(&pciinfo, 0, sizeof(pciinfo));
                pciinfo.bus = host->pci_dev->bus->number;
                pciinfo.dev_fn = host->pci_dev->devfn;
                pciinfo.board_id = host->board_id;
diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
index 7a7929ba2658..06189e55b4e5 100644
--- a/drivers/char/tpm/xen-tpmfront.c
+++ b/drivers/char/tpm/xen-tpmfront.c
@@ -142,32 +142,6 @@ static int vtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
        return length;
 }
-ssize_t tpm_show_locality(struct device *dev, struct device_attribute *attr,
-                          char *buf)
-{
-        struct tpm_chip *chip = dev_get_drvdata(dev);
-        struct tpm_private *priv = TPM_VPRIV(chip);
-        u8 locality = priv->shr->locality;
-        return sprintf(buf, "%d\n", locality);
-}
-ssize_t tpm_store_locality(struct device *dev, struct device_attribute *attr,
-                        const char *buf, size_t len)
-{
-        struct tpm_chip *chip = dev_get_drvdata(dev);
-        struct tpm_private *priv = TPM_VPRIV(chip);
-        u8 val;
-        int rv = kstrtou8(buf, 0, &val);
-        if (rv)
-                return rv;
-        priv->shr->locality = val;
-        return len;
-}
 static const struct file_operations vtpm_ops = {
        .owner = THIS_MODULE,
        .llseek = no_llseek,
@@ -188,8 +162,6 @@ static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
 static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
 static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
-static DEVICE_ATTR(locality, S_IRUGO | S_IWUSR, tpm_show_locality,
-                tpm_store_locality);
 static struct attribute *vtpm_attrs[] = {
        &dev_attr_pubek.attr,
@@ -202,7 +174,6 @@ static struct attribute *vtpm_attrs[] = {
        &dev_attr_cancel.attr,
        &dev_attr_durations.attr,
        &dev_attr_timeouts.attr,
-        &dev_attr_locality.attr,
        NULL,
 };
@@ -210,8 +181,6 @@ static struct attribute_group vtpm_attr_grp = {
        .attrs = vtpm_attrs,
 };
-#define TPM_LONG_TIMEOUT   (10 * 60 * HZ)
 static const struct tpm_vendor_specific tpm_vtpm = {
        .status = vtpm_status,
        .recv = vtpm_recv,
@@ -224,11 +193,6 @@ static const struct tpm_vendor_specific tpm_vtpm = {
        .miscdev = {
                .fops = &vtpm_ops,
        },
-        .duration = {
-                TPM_LONG_TIMEOUT,
-                TPM_LONG_TIMEOUT,
-                TPM_LONG_TIMEOUT,
-        },
 };
 static irqreturn_t tpmif_interrupt(int dummy, void *dev_id)
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 41c69469ce20..971d796e071d 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -26,6 +26,7 @@ config DW_APB_TIMER_OF
 config ARMADA_370_XP_TIMER
        bool
+        select CLKSRC_OF
 config ORION_TIMER
        select CLKSRC_OF
diff --git a/drivers/clocksource/clksrc-of.c b/drivers/clocksource/clksrc-of.c
index 37f5325bec95..b9ddd9e3a2f5 100644
--- a/drivers/clocksource/clksrc-of.c
+++ b/drivers/clocksource/clksrc-of.c
@@ -30,6 +30,9 @@ void __init clocksource_of_init(void)
        clocksource_of_init_fn init_func;
        for_each_matching_node_and_match(np, __clksrc_of_table, &match) {
+                if (!of_device_is_available(np))
+                        continue;
                init_func = match->data;
                init_func(np);
        }
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index b9c81b7c3a3b..3a5909c12d42 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -301,7 +301,7 @@ static void em_sti_register_clockevent(struct em_sti_priv *p)
        ced->name = dev_name(&p->pdev->dev);
        ced->features = CLOCK_EVT_FEAT_ONESHOT;
        ced->rating = 200;
-        ced->cpumask = cpumask_of(0);
+        ced->cpumask = cpu_possible_mask;
        ced->set_next_event = em_sti_clock_event_next;
        ced->set_mode = em_sti_clock_event_mode;
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 5b34768f4d7c..62b0de6a1837 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -428,7 +428,6 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
                                evt->irq);
                        return -EIO;
                }
-                irq_set_affinity(evt->irq, cpumask_of(cpu));
        } else {
                enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
        }
@@ -449,6 +448,7 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                                           unsigned long action, void *hcpu)
 {
        struct mct_clock_event_device *mevt;
+        unsigned int cpu;
        /*
         * Grab cpu pointer in each case to avoid spurious
@@ -459,6 +459,12 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                mevt = this_cpu_ptr(&percpu_mct_tick);
                exynos4_local_timer_setup(&mevt->evt);
                break;
+        case CPU_ONLINE:
+                cpu = (unsigned long)hcpu;
+                if (mct_int_type == MCT_INT_SPI)
+                        irq_set_affinity(mct_irqs[MCT_L0_IRQ + cpu],
+                                                cpumask_of(cpu));
+                break;
        case CPU_DYING:
                mevt = this_cpu_ptr(&percpu_mct_tick);
                exynos4_local_timer_stop(&mevt->evt);
@@ -500,6 +506,8 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
                                         &percpu_mct_tick);
                WARN(err, "MCT: can't request IRQ %d (%d)\n",
                     mct_irqs[MCT_L0_IRQ], err);
+        } else {
+                irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
        }
        err = register_cpu_notifier(&exynos4_mct_cpu_nb);
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index a1260b4549db..d2c3253e015e 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -986,6 +986,10 @@ static int __init acpi_cpufreq_init(void)
 {
        int ret;
+        /* don't keep reloading if cpufreq_driver exists */
+        if (cpufreq_get_current_driver())
+                return 0;
        if (acpi_disabled)
                return 0;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 89b3c52cd5c3..04548f7023af 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1460,6 +1460,9 @@ unsigned int cpufreq_get(unsigned int cpu)
 {
        unsigned int ret_freq = 0;
+        if (cpufreq_disabled() || !cpufreq_driver)
+                return -ENOENT;
        if (!down_read_trylock(&cpufreq_rwsem))
                return 0;
diff --git a/drivers/cpufreq/exynos5440-cpufreq.c b/drivers/cpufreq/exynos5440-cpufreq.c
index d514c152fd1a..be5380ecdcd4 100644
--- a/drivers/cpufreq/exynos5440-cpufreq.c
+++ b/drivers/cpufreq/exynos5440-cpufreq.c
@@ -457,7 +457,7 @@ err_free_table:
        opp_free_cpufreq_table(dvfs_info->dev, &dvfs_info->freq_table);
 err_put_node:
        of_node_put(np);
-        dev_err(dvfs_info->dev, "%s: failed initialization\n", __func__);
+        dev_err(&pdev->dev, "%s: failed initialization\n", __func__);
        return ret;
 }
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index b1f8fc69023f..60e84043aa34 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -707,8 +707,7 @@ tda998x_encoder_dpms(struct drm_encoder *encoder, int mode)
                reg_write(encoder, REG_VIP_CNTRL_2, priv->vip_cntrl_2);
                break;
        case DRM_MODE_DPMS_OFF:
-                /* disable audio and video ports */
+                /* disable video ports */
-                reg_write(encoder, REG_ENA_AP, 0x00);
                reg_write(encoder, REG_ENA_VP_0, 0x00);
                reg_write(encoder, REG_ENA_VP_1, 0x00);
                reg_write(encoder, REG_ENA_VP_2, 0x00);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index df9253d890ee..cdfb9da0e4ce 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4800,10 +4800,10 @@ i915_gem_inactive_count(struct shrinker *shrinker, struct shrink_control *sc)
        if (!mutex_trylock(&dev->struct_mutex)) {
                if (!mutex_is_locked_by(&dev->struct_mutex, current))
-                        return SHRINK_STOP;
+                        return 0;
                if (dev_priv->mm.shrinker_no_lock_stealing)
-                        return SHRINK_STOP;
+                        return 0;
                unlock = false;
        }
@@ -4901,10 +4901,10 @@ i915_gem_inactive_scan(struct shrinker *shrinker, struct shrink_control *sc)
        if (!mutex_trylock(&dev->struct_mutex)) {
                if (!mutex_is_locked_by(&dev->struct_mutex, current))
-                        return 0;
+                        return SHRINK_STOP;
                if (dev_priv->mm.shrinker_no_lock_stealing)
-                        return 0;
+                        return SHRINK_STOP;
                unlock = false;
        }
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index aba9d7498996..dae364f0028c 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -143,8 +143,10 @@ static void i915_error_vprintf(struct drm_i915_error_state_buf *e,
        /* Seek the first printf which is hits start position */
        if (e->pos < e->start) {
-                len = vsnprintf(NULL, 0, f, args);
+                va_list tmp;
-                if (!__i915_error_seek(e, len))
+                va_copy(tmp, args);
+                if (!__i915_error_seek(e, vsnprintf(NULL, 0, f, tmp)))
                        return;
        }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index d8a1d98693e7..e5822e79f912 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4775,6 +4775,10 @@ static void i9xx_set_pipeconf(struct intel_crtc *intel_crtc)
        pipeconf = 0;
+        if (dev_priv->quirks & QUIRK_PIPEA_FORCE &&
+            I915_READ(PIPECONF(intel_crtc->pipe)) & PIPECONF_ENABLE)
+                pipeconf |= PIPECONF_ENABLE;
        if (intel_crtc->pipe == 0 && INTEL_INFO(dev)->gen < 4) {
                /* Enable pixel doubling when the dot clock is > 90% of the (display)
                 * core speed.
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 2151d13772b8..79c14e298ba6 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -588,7 +588,18 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
                        DRM_DEBUG_KMS("aux_ch native nack\n");
                        return -EREMOTEIO;
                case AUX_NATIVE_REPLY_DEFER:
-                        udelay(100);
+                        /*
+                         * For now, just give more slack to branch devices. We
+                         * could check the DPCD for I2C bit rate capabilities,
+                         * and if available, adjust the interval. We could also
+                         * be more careful with DP-to-Legacy adapters where a
+                         * long legacy cable may force very low I2C bit rates.
+                         */
+                        if (intel_dp->dpcd[DP_DOWNSTREAMPORT_PRESENT] &
+                            DP_DWN_STRM_PORT_PRESENT)
+                                usleep_range(500, 600);
+                        else
+                                usleep_range(300, 400);
                        continue;
                default:
                        DRM_ERROR("aux_ch invalid native reply 0x%02x\n",
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index f2c6d7909ae2..dd6f84bf6c22 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -916,6 +916,14 @@ intel_tv_compute_config(struct intel_encoder *encoder,
        DRM_DEBUG_KMS("forcing bpc to 8 for TV\n");
        pipe_config->pipe_bpp = 8*3;
+        /* TV has it's own notion of sync and other mode flags, so clear them. */
+        pipe_config->adjusted_mode.flags = 0;
+        /*
+         * FIXME: We don't check whether the input mode is actually what we want
+         * or whether userspace is doing something stupid.
+         */
        return true;
 }
diff --git a/drivers/gpu/drm/msm/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
index 5db5bbaedae2..bc7fd11ad8be 100644
--- a/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
@@ -19,8 +19,6 @@
 #include "msm_drv.h"
 #include "mdp4_kms.h"
-#include <mach/iommu.h>
 static struct mdp4_platform_config *mdp4_get_config(struct platform_device *dev);
 static int mdp4_hw_init(struct msm_kms *kms)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 008d772384c7..b3a2f1629041 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -18,8 +18,6 @@
 #include "msm_drv.h"
 #include "msm_gpu.h"
-#include <mach/iommu.h>
 static void msm_fb_output_poll_changed(struct drm_device *dev)
 {
        struct msm_drm_private *priv = dev->dev_private;
@@ -62,6 +60,8 @@ int msm_iommu_attach(struct drm_device *dev, struct iommu_domain *iommu,
        int i, ret;
        for (i = 0; i < cnt; i++) {
+                /* TODO maybe some day msm iommu won't require this hack: */
+                struct device *msm_iommu_get_ctx(const char *ctx_name);
                struct device *ctx = msm_iommu_get_ctx(names[i]);
                if (!ctx)
                        continue;
@@ -199,7 +199,7 @@ static int msm_load(struct drm_device *dev, unsigned long flags)
                 * imx drm driver on iMX5
                 */
                dev_err(dev->dev, "failed to load kms\n");
-                ret = PTR_ERR(priv->kms);
+                ret = PTR_ERR(kms);
                goto fail;
        }
@@ -697,7 +697,7 @@ static struct drm_driver msm_driver = {
        .gem_vm_ops         = &vm_ops,
        .dumb_create        = msm_gem_dumb_create,
        .dumb_map_offset    = msm_gem_dumb_map_offset,
-        .dumb_destroy       = msm_gem_dumb_destroy,
+        .dumb_destroy       = drm_gem_dumb_destroy,
 #ifdef CONFIG_DEBUG_FS
        .debugfs_init       = msm_debugfs_init,
        .debugfs_cleanup    = msm_debugfs_cleanup,
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 29eacfa29cfb..2bae46c66a30 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -319,13 +319,6 @@ int msm_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
                        MSM_BO_SCANOUT | MSM_BO_WC, &args->handle);
 }
-int msm_gem_dumb_destroy(struct drm_file *file, struct drm_device *dev,
-                uint32_t handle)
-{
-        /* No special work needed, drop the reference and see what falls out */
-        return drm_gem_handle_delete(file, handle);
-}
 int msm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,
                uint32_t handle, uint64_t *offset)
 {
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 05ff315e8e9e..b162e98a2953 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -1168,6 +1168,23 @@ static const struct radeon_blacklist_clocks btc_blacklist_clocks[] =
        { 25000, 30000, RADEON_SCLK_UP }
 };
+void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                     u32 *max_clock)
+{
+        u32 i, clock = 0;
+        if ((table == NULL) || (table->count == 0)) {
+                *max_clock = clock;
+                return;
+        }
+        for (i = 0; i < table->count; i++) {
+                if (clock < table->entries[i].clk)
+                        clock = table->entries[i].clk;
+        }
+        *max_clock = clock;
+}
 void btc_apply_voltage_dependency_rules(struct radeon_clock_voltage_dependency_table *table,
                                        u32 clock, u16 max_voltage, u16 *voltage)
 {
@@ -2080,6 +2097,7 @@ static void btc_apply_state_adjust_rules(struct radeon_device *rdev,
        bool disable_mclk_switching;
        u32 mclk, sclk;
        u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
            btc_dpm_vblank_too_short(rdev))
@@ -2121,6 +2139,39 @@ static void btc_apply_state_adjust_rules(struct radeon_device *rdev,
                        ps->low.vddci = max_limits->vddci;
        }
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+        if (max_sclk_vddc) {
+                if (ps->low.sclk > max_sclk_vddc)
+                        ps->low.sclk = max_sclk_vddc;
+                if (ps->medium.sclk > max_sclk_vddc)
+                        ps->medium.sclk = max_sclk_vddc;
+                if (ps->high.sclk > max_sclk_vddc)
+                        ps->high.sclk = max_sclk_vddc;
+        }
+        if (max_mclk_vddci) {
+                if (ps->low.mclk > max_mclk_vddci)
+                        ps->low.mclk = max_mclk_vddci;
+                if (ps->medium.mclk > max_mclk_vddci)
+                        ps->medium.mclk = max_mclk_vddci;
+                if (ps->high.mclk > max_mclk_vddci)
+                        ps->high.mclk = max_mclk_vddci;
+        }
+        if (max_mclk_vddc) {
+                if (ps->low.mclk > max_mclk_vddc)
+                        ps->low.mclk = max_mclk_vddc;
+                if (ps->medium.mclk > max_mclk_vddc)
+                        ps->medium.mclk = max_mclk_vddc;
+                if (ps->high.mclk > max_mclk_vddc)
+                        ps->high.mclk = max_mclk_vddc;
+        }
        /* XXX validate the min clocks required for display */
        if (disable_mclk_switching) {
diff --git a/drivers/gpu/drm/radeon/btc_dpm.h b/drivers/gpu/drm/radeon/btc_dpm.h
index 1a15e0e41950..3b6f12b7760b 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.h
+++ b/drivers/gpu/drm/radeon/btc_dpm.h
@@ -46,6 +46,8 @@ void btc_adjust_clock_combinations(struct radeon_device *rdev,
                                   struct rv7xx_pl *pl);
 void btc_apply_voltage_dependency_rules(struct radeon_clock_voltage_dependency_table *table,
                                        u32 clock, u16 max_voltage, u16 *voltage);
+void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                     u32 *max_clock);
 void btc_apply_voltage_delta_rules(struct radeon_device *rdev,
                                   u16 max_vddc, u16 max_vddci,
                                   u16 *vddc, u16 *vddci);
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 899627443030..51e947a97edf 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -146,6 +146,8 @@ static const struct ci_pt_config_reg didt_config_ci[] =
 };
 extern u8 rv770_get_memory_module_index(struct radeon_device *rdev);
+extern void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                            u32 *max_clock);
 extern int ni_copy_and_switch_arb_sets(struct radeon_device *rdev,
                                       u32 arb_freq_src, u32 arb_freq_dest);
 extern u8 si_get_ddr3_mclk_frequency_ratio(u32 memory_clock);
@@ -712,6 +714,7 @@ static void ci_apply_state_adjust_rules(struct radeon_device *rdev,
        struct radeon_clock_and_voltage_limits *max_limits;
        bool disable_mclk_switching;
        u32 sclk, mclk;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        int i;
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -739,6 +742,29 @@ static void ci_apply_state_adjust_rules(struct radeon_device *rdev,
                }
        }
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
        /* XXX validate the min clocks required for display */
        if (disable_mclk_switching) {
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index adbdb6503b05..d02fd1c045d5 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -2845,10 +2845,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
                rdev->config.cik.tile_config |= (3 << 0);
                break;
        }
-        if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
+        rdev->config.cik.tile_config |=
-                rdev->config.cik.tile_config |= 1 << 4;
+                ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
-        else
-                rdev->config.cik.tile_config |= 0 << 4;
        rdev->config.cik.tile_config |=
                ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
        rdev->config.cik.tile_config |=
@@ -4456,8 +4454,8 @@ static int cik_mc_init(struct radeon_device *rdev)
        rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
        rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
        /* size in MB on si */
-        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
+        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
-        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
+        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
        si_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
@@ -4735,12 +4733,13 @@ static void cik_vm_decode_fault(struct radeon_device *rdev,
        u32 mc_id = (status & MEMORY_CLIENT_ID_MASK) >> MEMORY_CLIENT_ID_SHIFT;
        u32 vmid = (status & FAULT_VMID_MASK) >> FAULT_VMID_SHIFT;
        u32 protections = (status & PROTECTIONS_MASK) >> PROTECTIONS_SHIFT;
-        char *block = (char *)&mc_client;
+        char block[5] = { mc_client >> 24, (mc_client >> 16) & 0xff,
+                (mc_client >> 8) & 0xff, mc_client & 0xff, 0 };
-        printk("VM fault (0x%02x, vmid %d) at page %u, %s from %s (%d)\n",
+        printk("VM fault (0x%02x, vmid %d) at page %u, %s from '%s' (0x%08x) (%d)\n",
               protections, vmid, addr,
               (status & MEMORY_CLIENT_RW_MASK) ? "write" : "read",
-               block, mc_id);
+               block, mc_client, mc_id);
 }
 /**
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 6c398a456d78..f26339028154 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -787,6 +787,7 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
        bool disable_mclk_switching;
        u32 mclk, sclk;
        u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        int i;
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -813,6 +814,29 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
                }
        }
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
        /* XXX validate the min clocks required for display */
        if (disable_mclk_switching) {
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 24175717307b..d71333033b2b 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2933,9 +2933,11 @@ static int r100_debugfs_cp_ring_info(struct seq_file *m, void *data)
        seq_printf(m, "CP_RB_RPTR 0x%08x\n", rdp);
        seq_printf(m, "%u free dwords in ring\n", ring->ring_free_dw);
        seq_printf(m, "%u dwords in ring\n", count);
-        for (j = 0; j <= count; j++) {
+        if (ring->ready) {
-                i = (rdp + j) & ring->ptr_mask;
+                for (j = 0; j <= count; j++) {
-                seq_printf(m, "r[%04d]=0x%08x\n", i, ring->ring[i]);
+                        i = (rdp + j) & ring->ptr_mask;
+                        seq_printf(m, "r[%04d]=0x%08x\n", i, ring->ring[i]);
+                }
        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index e65f211a7be0..5513d8f06252 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -1084,7 +1084,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                                rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries[i].dclk =
                                        le16_to_cpu(uvd_clk->usDClkLow) | (uvd_clk->ucDClkHigh << 16);
                                rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries[i].v =
-                                        le16_to_cpu(limits->entries[i].usVoltage);
+                                        le16_to_cpu(entry->usVoltage);
                                entry = (ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record *)
                                        ((u8 *)entry + sizeof(ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record));
                        }
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index f443010ce90b..b0fa6002af3e 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -257,10 +257,7 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
         */
-        if (ASIC_IS_DCE3(rdev)) {
+        if (ASIC_IS_DCE32(rdev)) {
-                /* according to the reg specs, this should DCE3.2 only, but in
-                 * practice it seems to cover DCE3.0 as well.
-                 */
                if (dig->dig_encoder == 0) {
                        dto_cntl = RREG32(DCCG_AUDIO_DTO0_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
                        dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
@@ -276,8 +273,21 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                        WREG32(DCCG_AUDIO_DTO1_MODULE, dto_modulo);
                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                }
+        } else if (ASIC_IS_DCE3(rdev)) {
+                /* according to the reg specs, this should DCE3.2 only, but in
+                 * practice it seems to cover DCE3.0/3.1 as well.
+                 */
+                if (dig->dig_encoder == 0) {
+                        WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
+                        WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
+                } else {
+                        WREG32(DCCG_AUDIO_DTO1_PHASE, base_rate * 100);
+                        WREG32(DCCG_AUDIO_DTO1_MODULE, clock * 100);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
+                }
        } else {
-                /* according to the reg specs, this should be DCE2.0 and DCE3.0 */
+                /* according to the reg specs, this should be DCE2.0 and DCE3.0/3.1 */
                WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
                       AUDIO_DTO_MODULE(clock / 10));
        }
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 5003385a7512..8f7e04538fd6 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -1004,6 +1004,8 @@ static struct radeon_asic rv6xx_asic = {
                .wait_for_vblank = &avivo_wait_for_vblank,
                .set_backlight_level = &atombios_set_backlight_level,
                .get_backlight_level = &atombios_get_backlight_level,
+                .hdmi_enable = &r600_hdmi_enable,
+                .hdmi_setmode = &r600_hdmi_setmode,
        },
        .copy = {
                .blit = &r600_copy_cpdma,
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 404e25d285ba..f79ee184ffd5 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1367,6 +1367,7 @@ bool radeon_atombios_get_ppll_ss_info(struct radeon_device *rdev,
        int index = GetIndexIntoMasterTable(DATA, PPLL_SS_Info);
        uint16_t data_offset, size;
        struct _ATOM_SPREAD_SPECTRUM_INFO *ss_info;
+        struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT *ss_assign;
        uint8_t frev, crev;
        int i, num_indices;
@@ -1378,18 +1379,21 @@ bool radeon_atombios_get_ppll_ss_info(struct radeon_device *rdev,
                num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                        sizeof(ATOM_SPREAD_SPECTRUM_ASSIGNMENT);
+                ss_assign = (struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT*)
+                        ((u8 *)&ss_info->asSS_Info[0]);
                for (i = 0; i < num_indices; i++) {
-                        if (ss_info->asSS_Info[i].ucSS_Id == id) {
+                        if (ss_assign->ucSS_Id == id) {
                                ss->percentage =
-                                        le16_to_cpu(ss_info->asSS_Info[i].usSpreadSpectrumPercentage);
+                                        le16_to_cpu(ss_assign->usSpreadSpectrumPercentage);
-                                ss->type = ss_info->asSS_Info[i].ucSpreadSpectrumType;
+                                ss->type = ss_assign->ucSpreadSpectrumType;
-                                ss->step = ss_info->asSS_Info[i].ucSS_Step;
+                                ss->step = ss_assign->ucSS_Step;
-                                ss->delay = ss_info->asSS_Info[i].ucSS_Delay;
+                                ss->delay = ss_assign->ucSS_Delay;
-                                ss->range = ss_info->asSS_Info[i].ucSS_Range;
+                                ss->range = ss_assign->ucSS_Range;
-                                ss->refdiv = ss_info->asSS_Info[i].ucRecommendedRef_Div;
+                                ss->refdiv = ss_assign->ucRecommendedRef_Div;
                                return true;
                        }
+                        ss_assign = (struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT*)
+                                ((u8 *)ss_assign + sizeof(struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT));
                }
        }
        return false;
@@ -1477,6 +1481,12 @@ union asic_ss_info {
        struct _ATOM_ASIC_INTERNAL_SS_INFO_V3 info_3;
 };
+union asic_ss_assignment {
+        struct _ATOM_ASIC_SS_ASSIGNMENT v1;
+        struct _ATOM_ASIC_SS_ASSIGNMENT_V2 v2;
+        struct _ATOM_ASIC_SS_ASSIGNMENT_V3 v3;
+};
 bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                                      struct radeon_atom_ss *ss,
                                      int id, u32 clock)
@@ -1485,6 +1495,7 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
        uint16_t data_offset, size;
        union asic_ss_info *ss_info;
+        union asic_ss_assignment *ss_assign;
        uint8_t frev, crev;
        int i, num_indices;
@@ -1509,45 +1520,52 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                        num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                sizeof(ATOM_ASIC_SS_ASSIGNMENT);
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info.asSpreadSpectrum[0]);
                        for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info.asSpreadSpectrum[i].ucClockIndication == id) &&
+                                if ((ss_assign->v1.ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                    (clock <= le32_to_cpu(ss_assign->v1.ulTargetClockRange))) {
                                        ss->percentage =
-                                                le16_to_cpu(ss_info->info.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
+                                                le16_to_cpu(ss_assign->v1.usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info.asSpreadSpectrum[i].ucSpreadSpectrumMode;
+                                        ss->type = ss_assign->v1.ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info.asSpreadSpectrum[i].usSpreadRateInKhz);
+                                        ss->rate = le16_to_cpu(ss_assign->v1.usSpreadRateInKhz);
                                        return true;
                                }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT));
                        }
                        break;
                case 2:
                        num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                sizeof(ATOM_ASIC_SS_ASSIGNMENT_V2);
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info_2.asSpreadSpectrum[0]);
                        for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info_2.asSpreadSpectrum[i].ucClockIndication == id) &&
+                                if ((ss_assign->v2.ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info_2.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                    (clock <= le32_to_cpu(ss_assign->v2.ulTargetClockRange))) {
                                        ss->percentage =
-                                                le16_to_cpu(ss_info->info_2.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
+                                                le16_to_cpu(ss_assign->v2.usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info_2.asSpreadSpectrum[i].ucSpreadSpectrumMode;
+                                        ss->type = ss_assign->v2.ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info_2.asSpreadSpectrum[i].usSpreadRateIn10Hz);
+                                        ss->rate = le16_to_cpu(ss_assign->v2.usSpreadRateIn10Hz);
                                        if ((crev == 2) &&
                                            ((id == ASIC_INTERNAL_ENGINE_SS) ||
                                             (id == ASIC_INTERNAL_MEMORY_SS)))
                                                ss->rate /= 100;
                                        return true;
                                }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT_V2));
                        }
                        break;
                case 3:
                        num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3);
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info_3.asSpreadSpectrum[0]);
                        for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info_3.asSpreadSpectrum[i].ucClockIndication == id) &&
+                                if ((ss_assign->v3.ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info_3.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                    (clock <= le32_to_cpu(ss_assign->v3.ulTargetClockRange))) {
                                        ss->percentage =
-                                                le16_to_cpu(ss_info->info_3.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
+                                                le16_to_cpu(ss_assign->v3.usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info_3.asSpreadSpectrum[i].ucSpreadSpectrumMode;
+                                        ss->type = ss_assign->v3.ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info_3.asSpreadSpectrum[i].usSpreadRateIn10Hz);
+                                        ss->rate = le16_to_cpu(ss_assign->v3.usSpreadRateIn10Hz);
                                        if ((id == ASIC_INTERNAL_ENGINE_SS) ||
                                            (id == ASIC_INTERNAL_MEMORY_SS))
                                                ss->rate /= 100;
@@ -1555,6 +1573,8 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                                                radeon_atombios_get_igp_ss_overrides(rdev, ss, id);
                                        return true;
                                }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3));
                        }
                        break;
                default:
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index ac6ece61a476..66c222836631 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -85,8 +85,9 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                   VRAM, also but everything into VRAM on AGP cards to avoid
                   image corruptions */
                if (p->ring == R600_RING_TYPE_UVD_INDEX &&
-                    (i == 0 || p->rdev->flags & RADEON_IS_AGP)) {
+                    p->rdev->family < CHIP_PALM &&
-                        /* TODO: is this still needed for NI+ ? */
+                    (i == 0 || drm_pci_device_is_agp(p->rdev->ddev))) {
                        p->relocs[i].lobj.domain =
                                RADEON_GEM_DOMAIN_VRAM;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index e29faa73b574..841d0e09be3e 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1320,13 +1320,22 @@ int radeon_device_init(struct radeon_device *rdev,
                        return r;
        }
        if ((radeon_testing & 1)) {
-                radeon_test_moves(rdev);
+                if (rdev->accel_working)
+                        radeon_test_moves(rdev);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping move tests\n");
        }
        if ((radeon_testing & 2)) {
-                radeon_test_syncing(rdev);
+                if (rdev->accel_working)
+                        radeon_test_syncing(rdev);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping sync tests\n");
        }
        if (radeon_benchmarking) {
-                radeon_benchmark(rdev, radeon_benchmarking);
+                if (rdev->accel_working)
+                        radeon_benchmark(rdev, radeon_benchmarking);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping benchmarks\n");
        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 87e1d69e8fdb..ac07ad1d4f8c 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -1002,7 +1002,7 @@ static void radeon_pm_resume_old(struct radeon_device *rdev)
 {
        /* set up the default clocks if the MC ucode is loaded */
        if ((rdev->family >= CHIP_BARTS) &&
-            (rdev->family <= CHIP_HAINAN) &&
+            (rdev->family <= CHIP_CAYMAN) &&
            rdev->mc_fw) {
                if (rdev->pm.default_vddc)
                        radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -1046,7 +1046,7 @@ static void radeon_pm_resume_dpm(struct radeon_device *rdev)
        if (ret) {
                DRM_ERROR("radeon: dpm resume failed\n");
                if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                    rdev->mc_fw) {
                        if (rdev->pm.default_vddc)
                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -1097,7 +1097,7 @@ static int radeon_pm_init_old(struct radeon_device *rdev)
                radeon_pm_init_profile(rdev);
                /* set up the default clocks if the MC ucode is loaded */
                if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                    rdev->mc_fw) {
                        if (rdev->pm.default_vddc)
                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -1183,7 +1183,7 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev)
        if (ret) {
                rdev->pm.dpm_enabled = false;
                if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                    rdev->mc_fw) {
                        if (rdev->pm.default_vddc)
                                radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 46a25f037b84..18254e1c3e71 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -839,9 +839,11 @@ static int radeon_debugfs_ring_info(struct seq_file *m, void *data)
         * packet that is the root issue
         */
        i = (ring->rptr + ring->ptr_mask + 1 - 32) & ring->ptr_mask;
-        for (j = 0; j <= (count + 32); j++) {
+        if (ring->ready) {
-                seq_printf(m, "r[%5d]=0x%08x\n", i, ring->ring[i]);
+                for (j = 0; j <= (count + 32); j++) {
-                i = (i + 1) & ring->ptr_mask;
+                        seq_printf(m, "r[%5d]=0x%08x\n", i, ring->ring[i]);
+                        i = (i + 1) & ring->ptr_mask;
+                }
        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 1a01bbff9bfa..a0f11856ddde 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -476,8 +476,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                return -EINVAL;
        }
-        /* TODO: is this still necessary on NI+ ? */
+        if (p->rdev->family < CHIP_PALM && (cmd == 0 || cmd == 0x3) &&
-        if ((cmd == 0 || cmd == 0x3) &&
            (start >> 28) != (p->rdev->uvd.gpu_addr >> 28)) {
                DRM_ERROR("msg/fb buffer %LX-%LX out of 256MB segment!\n",
                          start, end);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index cfe5d4d28915..9ace28702c76 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2910,6 +2910,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
        bool disable_sclk_switching = false;
        u32 mclk, sclk;
        u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
        int i;
        if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -2943,6 +2944,29 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                }
        }
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
        /* XXX validate the min clocks required for display */
        if (disable_mclk_switching) {
diff --git a/drivers/gpu/drm/radeon/uvd_v1_0.c b/drivers/gpu/drm/radeon/uvd_v1_0.c
index 7266805d9786..3100fa9cb52f 100644
--- a/drivers/gpu/drm/radeon/uvd_v1_0.c
+++ b/drivers/gpu/drm/radeon/uvd_v1_0.c
@@ -212,8 +212,8 @@ int uvd_v1_0_start(struct radeon_device *rdev)
        /* enable VCPU clock */
        WREG32(UVD_VCPU_CNTL,  1 << 9);
-        /* enable UMC */
+        /* enable UMC and NC0 */
-        WREG32_P(UVD_LMI_CTRL2, 0, ~(1 << 8));
+        WREG32_P(UVD_LMI_CTRL2, 1 << 13, ~((1 << 8) | (1 << 13)));
        /* boot up the VCPU */
        WREG32(UVD_SOFT_RESET, 0);
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index 4faea979975e..af6edf9b1936 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -194,7 +194,7 @@ int vmbus_connect(void)
        do {
                ret = vmbus_negotiate_version(msginfo, version);
-                if (ret)
+                if (ret == -ETIMEDOUT)
                        goto cleanup;
                if (vmbus_connection.conn_state == CONNECTED)
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index 28b03325b872..09988b289622 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -32,13 +32,17 @@
 /*
 * Pre win8 version numbers used in ws2008 and ws 2008 r2 (win7)
 */
+#define WS2008_SRV_MAJOR        1
+#define WS2008_SRV_MINOR        0
+#define WS2008_SRV_VERSION     (WS2008_SRV_MAJOR << 16 | WS2008_SRV_MINOR)
 #define WIN7_SRV_MAJOR   3
 #define WIN7_SRV_MINOR   0
-#define WIN7_SRV_MAJOR_MINOR     (WIN7_SRV_MAJOR << 16 | WIN7_SRV_MINOR)
+#define WIN7_SRV_VERSION     (WIN7_SRV_MAJOR << 16 | WIN7_SRV_MINOR)
 #define WIN8_SRV_MAJOR   4
 #define WIN8_SRV_MINOR   0
-#define WIN8_SRV_MAJOR_MINOR     (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR)
+#define WIN8_SRV_VERSION     (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR)
 /*
 * Global state maintained for transaction that is being processed.
@@ -587,6 +591,8 @@ void hv_kvp_onchannelcallback(void *context)
        struct icmsg_hdr *icmsghdrp;
        struct icmsg_negotiate *negop = NULL;
+        int util_fw_version;
+        int kvp_srv_version;
        if (kvp_transaction.active) {
                /*
@@ -606,17 +612,26 @@ void hv_kvp_onchannelcallback(void *context)
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                        /*
-                         * We start with win8 version and if the host cannot
+                         * Based on the host, select appropriate
-                         * support that we use the previous version.
+                         * framework and service versions we will
+                         * negotiate.
                         */
-                        if (vmbus_prep_negotiate_resp(icmsghdrp, negop,
+                        switch (vmbus_proto_version) {
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
+                        case (VERSION_WS2008):
-                                 WIN8_SRV_MAJOR_MINOR))
+                                util_fw_version = UTIL_WS2K8_FW_VERSION;
-                                goto done;
+                                kvp_srv_version = WS2008_SRV_VERSION;
+                                break;
+                        case (VERSION_WIN7):
+                                util_fw_version = UTIL_FW_VERSION;
+                                kvp_srv_version = WIN7_SRV_VERSION;
+                                break;
+                        default:
+                                util_fw_version = UTIL_FW_VERSION;
+                                kvp_srv_version = WIN8_SRV_VERSION;
+                        }
                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
+                                 recv_buffer, util_fw_version,
-                                 WIN7_SRV_MAJOR_MINOR);
+                                 kvp_srv_version);
                } else {
                        kvp_msg = (struct hv_kvp_msg *)&recv_buffer[
@@ -649,7 +664,6 @@ void hv_kvp_onchannelcallback(void *context)
                        return;
                }
-done:
                icmsghdrp->icflags = ICMSGHDRFLAG_TRANSACTION
                        | ICMSGHDRFLAG_RESPONSE;
diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index e4572f3f2834..0c3546224376 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -26,7 +26,7 @@
 #define VSS_MAJOR  5
 #define VSS_MINOR  0
-#define VSS_MAJOR_MINOR    (VSS_MAJOR << 16 | VSS_MINOR)
+#define VSS_VERSION    (VSS_MAJOR << 16 | VSS_MINOR)
@@ -190,8 +190,8 @@ void hv_vss_onchannelcallback(void *context)
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
+                                 recv_buffer, UTIL_FW_VERSION,
-                                 VSS_MAJOR_MINOR);
+                                 VSS_VERSION);
                } else {
                        vss_msg = (struct hv_vss_msg *)&recv_buffer[
                                sizeof(struct vmbuspipe_hdr) +
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 9113850edb43..62dfd246b948 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -28,17 +28,32 @@
 #include <linux/reboot.h>
 #include <linux/hyperv.h>
-#define SHUTDOWN_MAJOR  3
-#define SHUTDOWN_MINOR  0
-#define SHUTDOWN_MAJOR_MINOR    (SHUTDOWN_MAJOR << 16 | SHUTDOWN_MINOR)
-#define TIMESYNCH_MAJOR 3
+#define SD_MAJOR        3
-#define TIMESYNCH_MINOR 0
+#define SD_MINOR        0
-#define TIMESYNCH_MAJOR_MINOR   (TIMESYNCH_MAJOR << 16 | TIMESYNCH_MINOR)
+#define SD_VERSION      (SD_MAJOR << 16 | SD_MINOR)
-#define HEARTBEAT_MAJOR 3
+#define SD_WS2008_MAJOR         1
-#define HEARTBEAT_MINOR 0
+#define SD_WS2008_VERSION       (SD_WS2008_MAJOR << 16 | SD_MINOR)
-#define HEARTBEAT_MAJOR_MINOR   (HEARTBEAT_MAJOR << 16 | HEARTBEAT_MINOR)
+#define TS_MAJOR        3
+#define TS_MINOR        0
+#define TS_VERSION      (TS_MAJOR << 16 | TS_MINOR)
+#define TS_WS2008_MAJOR         1
+#define TS_WS2008_VERSION       (TS_WS2008_MAJOR << 16 | TS_MINOR)
+#define HB_MAJOR        3
+#define HB_MINOR 0
+#define HB_VERSION      (HB_MAJOR << 16 | HB_MINOR)
+#define HB_WS2008_MAJOR 1
+#define HB_WS2008_VERSION       (HB_WS2008_MAJOR << 16 | HB_MINOR)
+static int sd_srv_version;
+static int ts_srv_version;
+static int hb_srv_version;
+static int util_fw_version;
 static void shutdown_onchannelcallback(void *context);
 static struct hv_util_service util_shutdown = {
@@ -99,8 +114,8 @@ static void shutdown_onchannelcallback(void *context)
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                        shut_txf_buf, UTIL_FW_MAJOR_MINOR,
+                                        shut_txf_buf, util_fw_version,
-                                        SHUTDOWN_MAJOR_MINOR);
+                                        sd_srv_version);
                } else {
                        shutdown_msg =
                                (struct shutdown_msg_data *)&shut_txf_buf[
@@ -216,6 +231,7 @@ static void timesync_onchannelcallback(void *context)
        struct icmsg_hdr *icmsghdrp;
        struct ictimesync_data *timedatap;
        u8 *time_txf_buf = util_timesynch.recv_buffer;
+        struct icmsg_negotiate *negop = NULL;
        vmbus_recvpacket(channel, time_txf_buf,
                         PAGE_SIZE, &recvlen, &requestid);
@@ -225,9 +241,10 @@ static void timesync_onchannelcallback(void *context)
                                sizeof(struct vmbuspipe_hdr)];
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
-                        vmbus_prep_negotiate_resp(icmsghdrp, NULL, time_txf_buf,
+                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                                UTIL_FW_MAJOR_MINOR,
+                                                time_txf_buf,
-                                                TIMESYNCH_MAJOR_MINOR);
+                                                util_fw_version,
+                                                ts_srv_version);
                } else {
                        timedatap = (struct ictimesync_data *)&time_txf_buf[
                                sizeof(struct vmbuspipe_hdr) +
@@ -257,6 +274,7 @@ static void heartbeat_onchannelcallback(void *context)
        struct icmsg_hdr *icmsghdrp;
        struct heartbeat_msg_data *heartbeat_msg;
        u8 *hbeat_txf_buf = util_heartbeat.recv_buffer;
+        struct icmsg_negotiate *negop = NULL;
        vmbus_recvpacket(channel, hbeat_txf_buf,
                         PAGE_SIZE, &recvlen, &requestid);
@@ -266,9 +284,9 @@ static void heartbeat_onchannelcallback(void *context)
                                sizeof(struct vmbuspipe_hdr)];
                if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
-                        vmbus_prep_negotiate_resp(icmsghdrp, NULL,
+                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                hbeat_txf_buf, UTIL_FW_MAJOR_MINOR,
+                                hbeat_txf_buf, util_fw_version,
-                                HEARTBEAT_MAJOR_MINOR);
+                                hb_srv_version);
                } else {
                        heartbeat_msg =
                                (struct heartbeat_msg_data *)&hbeat_txf_buf[
@@ -321,6 +339,25 @@ static int util_probe(struct hv_device *dev,
                goto error;
        hv_set_drvdata(dev, srv);
+        /*
+         * Based on the host; initialize the framework and
+         * service version numbers we will negotiate.
+         */
+        switch (vmbus_proto_version) {
+        case (VERSION_WS2008):
+                util_fw_version = UTIL_WS2K8_FW_VERSION;
+                sd_srv_version = SD_WS2008_VERSION;
+                ts_srv_version = TS_WS2008_VERSION;
+                hb_srv_version = HB_WS2008_VERSION;
+                break;
+        default:
+                util_fw_version = UTIL_FW_VERSION;
+                sd_srv_version = SD_VERSION;
+                ts_srv_version = TS_VERSION;
+                hb_srv_version = HB_VERSION;
+        }
        return 0;
 error:
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 62c2e32e25ef..98814d12a604 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -525,16 +525,25 @@ static int applesmc_init_smcreg_try(void)
 {
        struct applesmc_registers *s = &smcreg;
        bool left_light_sensor, right_light_sensor;
+        unsigned int count;
        u8 tmp[1];
        int ret;
        if (s->init_complete)
                return 0;
-        ret = read_register_count(&s->key_count);
+        ret = read_register_count(&count);
        if (ret)
                return ret;
+        if (s->cache && s->key_count != count) {
+                pr_warn("key count changed from %d to %d\n",
+                        s->key_count, count);
+                kfree(s->cache);
+                s->cache = NULL;
+        }
+        s->key_count = count;
        if (!s->cache)
                s->cache = kcalloc(s->key_count, sizeof(*s->cache), GFP_KERNEL);
        if (!s->cache)
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index dbecf08399f8..5888feef1ac5 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -98,6 +98,8 @@
 #define DW_IC_ERR_TX_ABRT       0x1
+#define DW_IC_TAR_10BITADDR_MASTER BIT(12)
 /*
 * status codes
 */
@@ -388,22 +390,34 @@ static int i2c_dw_wait_bus_not_busy(struct dw_i2c_dev *dev)
 static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
 {
        struct i2c_msg *msgs = dev->msgs;
-        u32 ic_con;
+        u32 ic_con, ic_tar = 0;
        /* Disable the adapter */
        __i2c_dw_enable(dev, false);
-        /* set the slave (target) address */
-        dw_writel(dev, msgs[dev->msg_write_idx].addr, DW_IC_TAR);
        /* if the slave address is ten bit address, enable 10BITADDR */
        ic_con = dw_readl(dev, DW_IC_CON);
-        if (msgs[dev->msg_write_idx].flags & I2C_M_TEN)
+        if (msgs[dev->msg_write_idx].flags & I2C_M_TEN) {
                ic_con |= DW_IC_CON_10BITADDR_MASTER;
-        else
+                /*
+                 * If I2C_DYNAMIC_TAR_UPDATE is set, the 10-bit addressing
+                 * mode has to be enabled via bit 12 of IC_TAR register.
+                 * We set it always as I2C_DYNAMIC_TAR_UPDATE can't be
+                 * detected from registers.
+                 */
+                ic_tar = DW_IC_TAR_10BITADDR_MASTER;
+        } else {
                ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
+        }
        dw_writel(dev, ic_con, DW_IC_CON);
+        /*
+         * Set the slave (target) address and enable 10-bit addressing mode
+         * if applicable.
+         */
+        dw_writel(dev, msgs[dev->msg_write_idx].addr | ic_tar, DW_IC_TAR);
        /* Enable the adapter */
        __i2c_dw_enable(dev, true);
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index 8ed79a086f85..1672effbcebb 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -393,6 +393,9 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr,
        desc = &priv->hw[priv->head];
+        /* Initialize the DMA buffer */
+        memset(priv->dma_buffer, 0, sizeof(priv->dma_buffer));
        /* Initialize the descriptor */
        memset(desc, 0, sizeof(struct ismt_desc));
        desc->tgtaddr_rw = ISMT_DESC_ADDR_RW(addr, read_write);
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 7f3a47443494..d3e9cc3153a9 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -234,9 +234,9 @@ static int mv64xxx_i2c_offload_msg(struct mv64xxx_i2c_data *drv_data)
                ctrl_reg |= MV64XXX_I2C_BRIDGE_CONTROL_WR |
                    (msg->len - 1) << MV64XXX_I2C_BRIDGE_CONTROL_TX_SIZE_SHIFT;
-                writel_relaxed(data_reg_lo,
+                writel(data_reg_lo,
                        drv_data->reg_base + MV64XXX_I2C_REG_TX_DATA_LO);
-                writel_relaxed(data_reg_hi,
+                writel(data_reg_hi,
                        drv_data->reg_base + MV64XXX_I2C_REG_TX_DATA_HI);
        } else {
@@ -697,6 +697,7 @@ static const struct of_device_id mv64xxx_i2c_of_match_table[] = {
 MODULE_DEVICE_TABLE(of, mv64xxx_i2c_of_match_table);
 #ifdef CONFIG_OF
+#ifdef CONFIG_HAVE_CLK
 static int
 mv64xxx_calc_freq(const int tclk, const int n, const int m)
 {
@@ -726,16 +727,12 @@ mv64xxx_find_baud_factors(const u32 req_freq, const u32 tclk, u32 *best_n,
                return false;
        return true;
 }
+#endif /* CONFIG_HAVE_CLK */
 static int
 mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
                  struct device *dev)
 {
-        const struct of_device_id *device;
-        struct device_node *np = dev->of_node;
-        u32 bus_freq, tclk;
-        int rc = 0;
        /* CLK is mandatory when using DT to describe the i2c bus. We
         * need to know tclk in order to calculate bus clock
         * factors.
@@ -744,6 +741,11 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
        /* Have OF but no CLK */
        return -ENODEV;
 #else
+        const struct of_device_id *device;
+        struct device_node *np = dev->of_node;
+        u32 bus_freq, tclk;
+        int rc = 0;
        if (IS_ERR(drv_data->clk)) {
                rc = -ENODEV;
                goto out;
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 3535f3c0f7b4..3747b9bf67d6 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -1178,8 +1178,6 @@ static int s3c24xx_i2c_remove(struct platform_device *pdev)
        i2c_del_adapter(&i2c->adap);
-        clk_disable_unprepare(i2c->clk);
        if (pdev->dev.of_node && IS_ERR(i2c->pctrl))
                s3c24xx_i2c_dt_gpio_free(i2c);
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index b39f6f0b45f2..0f12382aa35d 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -498,7 +498,7 @@ struct cached_dev {
         */
        atomic_t                has_dirty;
-        struct ratelimit        writeback_rate;
+        struct bch_ratelimit    writeback_rate;
        struct delayed_work     writeback_rate_update;
        /*
@@ -507,10 +507,9 @@ struct cached_dev {
         */
        sector_t                last_read;
-        /* Number of writeback bios in flight */
+        /* Limit number of writeback bios in flight */
-        atomic_t                in_flight;
+        struct semaphore        in_flight;
        struct closure_with_timer writeback;
-        struct closure_waitlist writeback_wait;
        struct keybuf           writeback_keys;
diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
index 8010eed06a51..22d1ae72c282 100644
--- a/drivers/md/bcache/bset.c
+++ b/drivers/md/bcache/bset.c
@@ -926,28 +926,45 @@ struct bkey *bch_next_recurse_key(struct btree *b, struct bkey *search)
 /* Mergesort */
+static void sort_key_next(struct btree_iter *iter,
+                          struct btree_iter_set *i)
+{
+        i->k = bkey_next(i->k);
+        if (i->k == i->end)
+                *i = iter->data[--iter->used];
+}
 static void btree_sort_fixup(struct btree_iter *iter)
 {
        while (iter->used > 1) {
                struct btree_iter_set *top = iter->data, *i = top + 1;
-                struct bkey *k;
                if (iter->used > 2 &&
                    btree_iter_cmp(i[0], i[1]))
                        i++;
-                for (k = i->k;
+                if (bkey_cmp(top->k, &START_KEY(i->k)) <= 0)
-                     k != i->end && bkey_cmp(top->k, &START_KEY(k)) > 0;
-                     k = bkey_next(k))
-                        if (top->k > i->k)
-                                __bch_cut_front(top->k, k);
-                        else if (KEY_SIZE(k))
-                                bch_cut_back(&START_KEY(k), top->k);
-                if (top->k < i->k || k == i->k)
                        break;
-                heap_sift(iter, i - top, btree_iter_cmp);
+                if (!KEY_SIZE(i->k)) {
+                        sort_key_next(iter, i);
+                        heap_sift(iter, i - top, btree_iter_cmp);
+                        continue;
+                }
+                if (top->k > i->k) {
+                        if (bkey_cmp(top->k, i->k) >= 0)
+                                sort_key_next(iter, i);
+                        else
+                                bch_cut_front(top->k, i->k);
+                        heap_sift(iter, i - top, btree_iter_cmp);
+                } else {
+                        /* can't happen because of comparison func */
+                        BUG_ON(!bkey_cmp(&START_KEY(top->k), &START_KEY(i->k)));
+                        bch_cut_back(&START_KEY(i->k), top->k);
+                }
        }
 }
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index f9764e61978b..f42fc7ed9cd6 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -255,7 +255,7 @@ void bch_btree_node_read(struct btree *b)
        return;
 err:
-        bch_cache_set_error(b->c, "io error reading bucket %lu",
+        bch_cache_set_error(b->c, "io error reading bucket %zu",
                            PTR_BUCKET_NR(b->c, &b->key, 0));
 }
@@ -612,7 +612,7 @@ static unsigned long bch_mca_scan(struct shrinker *shrink,
                return SHRINK_STOP;
        /* Return -1 if we can't do anything right now */
-        if (sc->gfp_mask & __GFP_WAIT)
+        if (sc->gfp_mask & __GFP_IO)
                mutex_lock(&c->bucket_lock);
        else if (!mutex_trylock(&c->bucket_lock))
                return -1;
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index ba95ab84b2be..8435f81e5d85 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -153,7 +153,8 @@ int bch_journal_read(struct cache_set *c, struct list_head *list,
                bitmap_zero(bitmap, SB_JOURNAL_BUCKETS);
                pr_debug("%u journal buckets", ca->sb.njournal_buckets);
-                /* Read journal buckets ordered by golden ratio hash to quickly
+                /*
+                 * Read journal buckets ordered by golden ratio hash to quickly
                 * find a sequence of buckets with valid journal entries
                 */
                for (i = 0; i < ca->sb.njournal_buckets; i++) {
@@ -166,18 +167,20 @@ int bch_journal_read(struct cache_set *c, struct list_head *list,
                                goto bsearch;
                }
-                /* If that fails, check all the buckets we haven't checked
+                /*
+                 * If that fails, check all the buckets we haven't checked
                 * already
                 */
                pr_debug("falling back to linear search");
-                for (l = 0; l < ca->sb.njournal_buckets; l++) {
+                for (l = find_first_zero_bit(bitmap, ca->sb.njournal_buckets);
-                        if (test_bit(l, bitmap))
+                     l < ca->sb.njournal_buckets;
-                                continue;
+                     l = find_next_zero_bit(bitmap, ca->sb.njournal_buckets, l + 1))
                        if (read_bucket(l))
                                goto bsearch;
-                }
+                if (list_empty(list))
+                        continue;
 bsearch:
                /* Binary search */
                m = r = find_next_bit(bitmap, ca->sb.njournal_buckets, l + 1);
@@ -197,10 +200,12 @@ bsearch:
                                r = m;
                }
-                /* Read buckets in reverse order until we stop finding more
+                /*
+                 * Read buckets in reverse order until we stop finding more
                 * journal entries
                 */
-                pr_debug("finishing up");
+                pr_debug("finishing up: m %u njournal_buckets %u",
+                         m, ca->sb.njournal_buckets);
                l = m;
                while (1) {
@@ -228,9 +233,10 @@ bsearch:
                        }
        }
-        c->journal.seq = list_entry(list->prev,
+        if (!list_empty(list))
-                                    struct journal_replay,
+                c->journal.seq = list_entry(list->prev,
-                                    list)->j.seq;
+                                            struct journal_replay,
+                                            list)->j.seq;
        return 0;
 #undef read_bucket
@@ -428,7 +434,7 @@ static void do_journal_discard(struct cache *ca)
                return;
        }
-        switch (atomic_read(&ja->discard_in_flight) == DISCARD_IN_FLIGHT) {
+        switch (atomic_read(&ja->discard_in_flight)) {
        case DISCARD_IN_FLIGHT:
                return;
@@ -689,6 +695,7 @@ void bch_journal_meta(struct cache_set *c, struct closure *cl)
                if (cl)
                        BUG_ON(!closure_wait(&w->wait, cl));
+                closure_flush(&c->journal.io);
                __journal_try_write(c, true);
        }
 }
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 786a1a4f74d8..71eb233b9ace 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -997,14 +997,17 @@ static void request_write(struct cached_dev *dc, struct search *s)
        } else {
                bch_writeback_add(dc);
-                if (s->op.flush_journal) {
+                if (bio->bi_rw & REQ_FLUSH) {
                        /* Also need to send a flush to the backing device */
-                        s->op.cache_bio = bio_clone_bioset(bio, GFP_NOIO,
+                        struct bio *flush = bio_alloc_bioset(0, GFP_NOIO,
-                                                           dc->disk.bio_split);
+                                                             dc->disk.bio_split);
-                        bio->bi_size = 0;
+                        flush->bi_rw    = WRITE_FLUSH;
-                        bio->bi_vcnt = 0;
+                        flush->bi_bdev  = bio->bi_bdev;
-                        closure_bio_submit(bio, cl, s->d);
+                        flush->bi_end_io = request_endio;
+                        flush->bi_private = cl;
+                        closure_bio_submit(flush, cl, s->d);
                } else {
                        s->op.cache_bio = bio;
                }
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 4fe6ab2fbe2e..924dcfdae111 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -223,8 +223,13 @@ STORE(__cached_dev)
        }
        if (attr == &sysfs_label) {
-                /* note: endlines are preserved */
+                if (size > SB_LABEL_SIZE)
-                memcpy(dc->sb.label, buf, SB_LABEL_SIZE);
+                        return -EINVAL;
+                memcpy(dc->sb.label, buf, size);
+                if (size < SB_LABEL_SIZE)
+                        dc->sb.label[size] = '\0';
+                if (size && dc->sb.label[size - 1] == '\n')
+                        dc->sb.label[size - 1] = '\0';
                bch_write_bdev_super(dc, NULL);
                if (dc->disk.c) {
                        memcpy(dc->disk.c->uuids[dc->disk.id].label,
diff --git a/drivers/md/bcache/util.c b/drivers/md/bcache/util.c
index 98eb81159a22..420dad545c7d 100644
--- a/drivers/md/bcache/util.c
+++ b/drivers/md/bcache/util.c
@@ -190,7 +190,16 @@ void bch_time_stats_update(struct time_stats *stats, uint64_t start_time)
        stats->last = now ?: 1;
 }
-unsigned bch_next_delay(struct ratelimit *d, uint64_t done)
+/**
+ * bch_next_delay() - increment @d by the amount of work done, and return how
+ * long to delay until the next time to do some work.
+ *
+ * @d - the struct bch_ratelimit to update
+ * @done - the amount of work done, in arbitrary units
+ *
+ * Returns the amount of time to delay by, in jiffies
+ */
+uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done)
 {
        uint64_t now = local_clock();
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index 1ae2a73ad85f..ea345c6896f4 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -450,17 +450,23 @@ read_attribute(name ## _last_ ## frequency_units)
        (ewma) >> factor;                                               \
 })
-struct ratelimit {
+struct bch_ratelimit {
+        /* Next time we want to do some work, in nanoseconds */
        uint64_t                next;
+        /*
+         * Rate at which we want to do work, in units per nanosecond
+         * The units here correspond to the units passed to bch_next_delay()
+         */
        unsigned                rate;
 };
-static inline void ratelimit_reset(struct ratelimit *d)
+static inline void bch_ratelimit_reset(struct bch_ratelimit *d)
 {
        d->next = local_clock();
 }
-unsigned bch_next_delay(struct ratelimit *d, uint64_t done);
+uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done);
 #define __DIV_SAFE(n, d, zero)                                          \
 ({                                                                      \
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 22cbff551628..ba3ee48320f2 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -94,11 +94,15 @@ static void update_writeback_rate(struct work_struct *work)
 static unsigned writeback_delay(struct cached_dev *dc, unsigned sectors)
 {
+        uint64_t ret;
        if (atomic_read(&dc->disk.detaching) ||
            !dc->writeback_percent)
                return 0;
-        return bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
+        ret = bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
+        return min_t(uint64_t, ret, HZ);
 }
 /* Background writeback */
@@ -208,7 +212,7 @@ normal_refill:
        up_write(&dc->writeback_lock);
-        ratelimit_reset(&dc->writeback_rate);
+        bch_ratelimit_reset(&dc->writeback_rate);
        /* Punt to workqueue only so we don't recurse and blow the stack */
        continue_at(cl, read_dirty, dirty_wq);
@@ -318,9 +322,7 @@ static void write_dirty_finish(struct closure *cl)
        }
        bch_keybuf_del(&dc->writeback_keys, w);
-        atomic_dec_bug(&dc->in_flight);
+        up(&dc->in_flight);
-        closure_wake_up(&dc->writeback_wait);
        closure_return_with_destructor(cl, dirty_io_destructor);
 }
@@ -349,7 +351,7 @@ static void write_dirty(struct closure *cl)
        closure_bio_submit(&io->bio, cl, &io->dc->disk);
-        continue_at(cl, write_dirty_finish, dirty_wq);
+        continue_at(cl, write_dirty_finish, system_wq);
 }
 static void read_dirty_endio(struct bio *bio, int error)
@@ -369,7 +371,7 @@ static void read_dirty_submit(struct closure *cl)
        closure_bio_submit(&io->bio, cl, &io->dc->disk);
-        continue_at(cl, write_dirty, dirty_wq);
+        continue_at(cl, write_dirty, system_wq);
 }
 static void read_dirty(struct closure *cl)
@@ -394,12 +396,8 @@ static void read_dirty(struct closure *cl)
                if (delay > 0 &&
                    (KEY_START(&w->key) != dc->last_read ||
-                     jiffies_to_msecs(delay) > 50)) {
+                     jiffies_to_msecs(delay) > 50))
-                        w->private = NULL;
+                        delay = schedule_timeout_uninterruptible(delay);
-                        closure_delay(&dc->writeback, delay);
-                        continue_at(cl, read_dirty, dirty_wq);
-                }
                dc->last_read   = KEY_OFFSET(&w->key);
@@ -424,15 +422,10 @@ static void read_dirty(struct closure *cl)
                trace_bcache_writeback(&w->key);
-                closure_call(&io->cl, read_dirty_submit, NULL, &dc->disk.cl);
+                down(&dc->in_flight);
+                closure_call(&io->cl, read_dirty_submit, NULL, cl);
                delay = writeback_delay(dc, KEY_SIZE(&w->key));
-                atomic_inc(&dc->in_flight);
-                if (!closure_wait_event(&dc->writeback_wait, cl,
-                                        atomic_read(&dc->in_flight) < 64))
-                        continue_at(cl, read_dirty, dirty_wq);
        }
        if (0) {
@@ -442,7 +435,11 @@ err:
                bch_keybuf_del(&dc->writeback_keys, w);
        }
-        refill_dirty(cl);
+        /*
+         * Wait for outstanding writeback IOs to finish (and keybuf slots to be
+         * freed) before refilling again
+         */
+        continue_at(cl, refill_dirty, dirty_wq);
 }
 /* Init */
@@ -484,6 +481,7 @@ void bch_sectors_dirty_init(struct cached_dev *dc)
 void bch_cached_dev_writeback_init(struct cached_dev *dc)
 {
+        sema_init(&dc->in_flight, 64);
        closure_init_unlocked(&dc->writeback);
        init_rwsem(&dc->writeback_lock);
@@ -513,7 +511,7 @@ void bch_writeback_exit(void)
 int __init bch_writeback_init(void)
 {
-        dirty_wq = create_singlethread_workqueue("bcache_writeback");
+        dirty_wq = create_workqueue("bcache_writeback");
        if (!dirty_wq)
                return -ENOMEM;
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index ea49834377c8..2a20986a2fec 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -19,8 +19,6 @@
 #define DM_MSG_PREFIX "io"
 #define DM_IO_MAX_REGIONS       BITS_PER_LONG
-#define MIN_IOS         16
-#define MIN_BIOS        16
 struct dm_io_client {
        mempool_t *pool;
@@ -50,16 +48,17 @@ static struct kmem_cache *_dm_io_cache;
 struct dm_io_client *dm_io_client_create(void)
 {
        struct dm_io_client *client;
+        unsigned min_ios = dm_get_reserved_bio_based_ios();
        client = kmalloc(sizeof(*client), GFP_KERNEL);
        if (!client)
                return ERR_PTR(-ENOMEM);
-        client->pool = mempool_create_slab_pool(MIN_IOS, _dm_io_cache);
+        client->pool = mempool_create_slab_pool(min_ios, _dm_io_cache);
        if (!client->pool)
                goto bad;
-        client->bios = bioset_create(MIN_BIOS, 0);
+        client->bios = bioset_create(min_ios, 0);
        if (!client->bios)
                goto bad;
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index b759a127f9c3..de570a558764 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -7,6 +7,7 @@
 #include <linux/device-mapper.h>
+#include "dm.h"
 #include "dm-path-selector.h"
 #include "dm-uevent.h"
@@ -116,8 +117,6 @@ struct dm_mpath_io {
 typedef int (*action_fn) (struct pgpath *pgpath);
-#define MIN_IOS 256     /* Mempool size */
 static struct kmem_cache *_mpio_cache;
 static struct workqueue_struct *kmultipathd, *kmpath_handlerd;
@@ -190,6 +189,7 @@ static void free_priority_group(struct priority_group *pg,
 static struct multipath *alloc_multipath(struct dm_target *ti)
 {
        struct multipath *m;
+        unsigned min_ios = dm_get_reserved_rq_based_ios();
        m = kzalloc(sizeof(*m), GFP_KERNEL);
        if (m) {
@@ -202,7 +202,7 @@ static struct multipath *alloc_multipath(struct dm_target *ti)
                INIT_WORK(&m->trigger_event, trigger_event);
                init_waitqueue_head(&m->pg_init_wait);
                mutex_init(&m->work_mutex);
-                m->mpio_pool = mempool_create_slab_pool(MIN_IOS, _mpio_cache);
+                m->mpio_pool = mempool_create_slab_pool(min_ios, _mpio_cache);
                if (!m->mpio_pool) {
                        kfree(m);
                        return NULL;
@@ -1268,6 +1268,7 @@ static int noretry_error(int error)
        case -EREMOTEIO:
        case -EILSEQ:
        case -ENODATA:
+        case -ENOSPC:
                return 1;
        }
@@ -1298,8 +1299,17 @@ static int do_end_io(struct multipath *m, struct request *clone,
        if (!error && !clone->errors)
                return 0;       /* I/O complete */
-        if (noretry_error(error))
+        if (noretry_error(error)) {
+                if ((clone->cmd_flags & REQ_WRITE_SAME) &&
+                    !clone->q->limits.max_write_same_sectors) {
+                        struct queue_limits *limits;
+                        /* device doesn't really support WRITE SAME, disable it */
+                        limits = dm_get_queue_limits(dm_table_get_md(m->ti->table));
+                        limits->max_write_same_sectors = 0;
+                }
                return error;
+        }
        if (mpio->pgpath)
                fail_path(mpio->pgpath);
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 3ac415675b6c..4caa8e6d59d7 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -256,7 +256,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
         */
        INIT_WORK_ONSTACK(&req.work, do_metadata);
        queue_work(ps->metadata_wq, &req.work);
-        flush_work(&req.work);
+        flush_workqueue(ps->metadata_wq);
        return req.result;
 }
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index c434e5aab2df..aec57d76db5d 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -725,17 +725,16 @@ static int calc_max_buckets(void)
 */
 static int init_hash_tables(struct dm_snapshot *s)
 {
-        sector_t hash_size, cow_dev_size, origin_dev_size, max_buckets;
+        sector_t hash_size, cow_dev_size, max_buckets;
        /*
         * Calculate based on the size of the original volume or
         * the COW volume...
         */
        cow_dev_size = get_dev_size(s->cow->bdev);
-        origin_dev_size = get_dev_size(s->origin->bdev);
        max_buckets = calc_max_buckets();
-        hash_size = min(origin_dev_size, cow_dev_size) >> s->store->chunk_shift;
+        hash_size = cow_dev_size >> s->store->chunk_shift;
        hash_size = min(hash_size, max_buckets);
        if (hash_size < 64)
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 8ae31e8d3d64..3d404c1371ed 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -451,19 +451,26 @@ static void dm_stat_for_entry(struct dm_stat *s, size_t entry,
        struct dm_stat_percpu *p;
        /*
-         * For strict correctness we should use local_irq_disable/enable
+         * For strict correctness we should use local_irq_save/restore
         * instead of preempt_disable/enable.
         *
-         * This is racy if the driver finishes bios from non-interrupt
+         * preempt_disable/enable is racy if the driver finishes bios
-         * context as well as from interrupt context or from more different
+         * from non-interrupt context as well as from interrupt context
-         * interrupts.
+         * or from more different interrupts.
         *
-         * However, the race only results in not counting some events,
+         * On 64-bit architectures the race only results in not counting some
-         * so it is acceptable.
+         * events, so it is acceptable.  On 32-bit architectures the race could
+         * cause the counter going off by 2^32, so we need to do proper locking
+         * there.
         *
         * part_stat_lock()/part_stat_unlock() have this race too.
         */
+#if BITS_PER_LONG == 32
+        unsigned long flags;
+        local_irq_save(flags);
+#else
        preempt_disable();
+#endif
        p = &s->stat_percpu[smp_processor_id()][entry];
        if (!end) {
@@ -478,7 +485,11 @@ static void dm_stat_for_entry(struct dm_stat *s, size_t entry,
                p->ticks[idx] += duration;
        }
+#if BITS_PER_LONG == 32
+        local_irq_restore(flags);
+#else
        preempt_enable();
+#endif
 }
 static void __dm_stat_bio(struct dm_stat *s, unsigned long bi_rw,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index ed063427d676..2c0cf511ec23 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2095,6 +2095,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
         * them down to the data device.  The thin device's discard
         * processing will cause mappings to be removed from the btree.
         */
+        ti->discard_zeroes_data_unsupported = true;
        if (pf.discard_enabled && pf.discard_passdown) {
                ti->num_discard_bios = 1;
@@ -2104,7 +2105,6 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
                 * thin devices' discard limits consistent).
                 */
                ti->discards_supported = true;
-                ti->discard_zeroes_data_unsupported = true;
        }
        ti->private = pt;
@@ -2689,8 +2689,16 @@ static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
         * They get transferred to the live pool in bind_control_target()
         * called from pool_preresume().
         */
-        if (!pt->adjusted_pf.discard_enabled)
+        if (!pt->adjusted_pf.discard_enabled) {
+                /*
+                 * Must explicitly disallow stacking discard limits otherwise the
+                 * block layer will stack them if pool's data device has support.
+                 * QUEUE_FLAG_DISCARD wouldn't be set but there is no way for the
+                 * user to see that, so make sure to set all discard limits to 0.
+                 */
+                limits->discard_granularity = 0;
                return;
+        }
        disable_passdown_if_not_supported(pt);
@@ -2826,10 +2834,10 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
        ti->per_bio_data_size = sizeof(struct dm_thin_endio_hook);
        /* In case the pool supports discards, pass them on. */
+        ti->discard_zeroes_data_unsupported = true;
        if (tc->pool->pf.discard_enabled) {
                ti->discards_supported = true;
                ti->num_discard_bios = 1;
-                ti->discard_zeroes_data_unsupported = true;
                /* Discard bios must be split on a block boundary */
                ti->split_discard_bios = true;
        }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6a5e9ed2fcc3..b3e26c7d1417 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -211,10 +211,55 @@ struct dm_md_mempools {
        struct bio_set *bs;
 };
-#define MIN_IOS 256
+#define RESERVED_BIO_BASED_IOS          16
+#define RESERVED_REQUEST_BASED_IOS      256
+#define RESERVED_MAX_IOS                1024
 static struct kmem_cache *_io_cache;
 static struct kmem_cache *_rq_tio_cache;
+/*
+ * Bio-based DM's mempools' reserved IOs set by the user.
+ */
+static unsigned reserved_bio_based_ios = RESERVED_BIO_BASED_IOS;
+/*
+ * Request-based DM's mempools' reserved IOs set by the user.
+ */
+static unsigned reserved_rq_based_ios = RESERVED_REQUEST_BASED_IOS;
+static unsigned __dm_get_reserved_ios(unsigned *reserved_ios,
+                                      unsigned def, unsigned max)
+{
+        unsigned ios = ACCESS_ONCE(*reserved_ios);
+        unsigned modified_ios = 0;
+        if (!ios)
+                modified_ios = def;
+        else if (ios > max)
+                modified_ios = max;
+        if (modified_ios) {
+                (void)cmpxchg(reserved_ios, ios, modified_ios);
+                ios = modified_ios;
+        }
+        return ios;
+}
+unsigned dm_get_reserved_bio_based_ios(void)
+{
+        return __dm_get_reserved_ios(&reserved_bio_based_ios,
+                                     RESERVED_BIO_BASED_IOS, RESERVED_MAX_IOS);
+}
+EXPORT_SYMBOL_GPL(dm_get_reserved_bio_based_ios);
+unsigned dm_get_reserved_rq_based_ios(void)
+{
+        return __dm_get_reserved_ios(&reserved_rq_based_ios,
+                                     RESERVED_REQUEST_BASED_IOS, RESERVED_MAX_IOS);
+}
+EXPORT_SYMBOL_GPL(dm_get_reserved_rq_based_ios);
 static int __init local_init(void)
 {
        int r = -ENOMEM;
@@ -2278,6 +2323,17 @@ struct target_type *dm_get_immutable_target_type(struct mapped_device *md)
 }
 /*
+ * The queue_limits are only valid as long as you have a reference
+ * count on 'md'.
+ */
+struct queue_limits *dm_get_queue_limits(struct mapped_device *md)
+{
+        BUG_ON(!atomic_read(&md->holders));
+        return &md->queue->limits;
+}
+EXPORT_SYMBOL_GPL(dm_get_queue_limits);
+/*
 * Fully initialize a request-based queue (->elevator, ->request_fn, etc).
 */
 static int dm_init_request_based_queue(struct mapped_device *md)
@@ -2862,18 +2918,18 @@ struct dm_md_mempools *dm_alloc_md_mempools(unsigned type, unsigned integrity, u
        if (type == DM_TYPE_BIO_BASED) {
                cachep = _io_cache;
-                pool_size = 16;
+                pool_size = dm_get_reserved_bio_based_ios();
                front_pad = roundup(per_bio_data_size, __alignof__(struct dm_target_io)) + offsetof(struct dm_target_io, clone);
        } else if (type == DM_TYPE_REQUEST_BASED) {
                cachep = _rq_tio_cache;
-                pool_size = MIN_IOS;
+                pool_size = dm_get_reserved_rq_based_ios();
                front_pad = offsetof(struct dm_rq_clone_bio_info, clone);
                /* per_bio_data_size is not used. See __bind_mempools(). */
                WARN_ON(per_bio_data_size != 0);
        } else
                goto out;
-        pools->io_pool = mempool_create_slab_pool(MIN_IOS, cachep);
+        pools->io_pool = mempool_create_slab_pool(pool_size, cachep);
        if (!pools->io_pool)
                goto out;
@@ -2924,6 +2980,13 @@ module_exit(dm_exit);
 module_param(major, uint, 0);
 MODULE_PARM_DESC(major, "The major number of the device mapper");
+module_param(reserved_bio_based_ios, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(reserved_bio_based_ios, "Reserved IOs in bio-based mempools");
+module_param(reserved_rq_based_ios, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(reserved_rq_based_ios, "Reserved IOs in request-based mempools");
 MODULE_DESCRIPTION(DM_NAME " driver");
 MODULE_AUTHOR("Joe Thornber <dm-devel@redhat.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 5e604cc7b4aa..1d1ad7b7e527 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -184,6 +184,9 @@ void dm_free_md_mempools(struct dm_md_mempools *pools);
 /*
 * Helpers that are used by DM core
 */
+unsigned dm_get_reserved_bio_based_ios(void);
+unsigned dm_get_reserved_rq_based_ios(void);
 static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen)
 {
        return !maxlen || strlen(result) + 1 >= maxlen;
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index 04fd38567729..226c3f3cd3e8 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -57,6 +57,7 @@ void mei_amthif_reset_params(struct mei_device *dev)
        dev->iamthif_ioctl = false;
        dev->iamthif_state = MEI_IAMTHIF_IDLE;
        dev->iamthif_timer = 0;
+        dev->iamthif_stall_timer = 0;
 }
 /**
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 6d0282c08a06..cd2033cd7120 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -297,10 +297,13 @@ int __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
        if (cl->reading_state != MEI_READ_COMPLETE &&
            !waitqueue_active(&cl->rx_wait)) {
                mutex_unlock(&dev->device_lock);
                if (wait_event_interruptible(cl->rx_wait,
-                                (MEI_READ_COMPLETE == cl->reading_state))) {
+                                cl->reading_state == MEI_READ_COMPLETE  ||
+                                mei_cl_is_transitioning(cl))) {
                        if (signal_pending(current))
                                return -EINTR;
                        return -ERESTARTSYS;
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index 6374ed99e233..c8396e582f1c 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -90,6 +90,12 @@ static inline bool mei_cl_is_connected(struct mei_cl *cl)
                cl->dev->dev_state == MEI_DEV_ENABLED &&
                cl->state == MEI_FILE_CONNECTED);
 }
+static inline bool mei_cl_is_transitioning(struct mei_cl *cl)
+{
+        return (MEI_FILE_INITIALIZING == cl->state ||
+                MEI_FILE_DISCONNECTED == cl->state ||
+                MEI_FILE_DISCONNECTING == cl->state);
+}
 bool mei_cl_is_other_connecting(struct mei_cl *cl);
 int mei_cl_disconnect(struct mei_cl *cl);
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index f1c974a0bc0d..9b3a0fb7f265 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -35,11 +35,15 @@ static void mei_hbm_me_cl_allocate(struct mei_device *dev)
        struct mei_me_client *clients;
        int b;
+        dev->me_clients_num = 0;
+        dev->me_client_presentation_num = 0;
+        dev->me_client_index = 0;
        /* count how many ME clients we have */
        for_each_set_bit(b, dev->me_clients_map, MEI_CLIENTS_MAX)
                dev->me_clients_num++;
-        if (dev->me_clients_num <= 0)
+        if (dev->me_clients_num == 0)
                return;
        kfree(dev->me_clients);
@@ -221,7 +225,7 @@ static int mei_hbm_prop_req(struct mei_device *dev)
        struct hbm_props_request *prop_req;
        const size_t len = sizeof(struct hbm_props_request);
        unsigned long next_client_index;
-        u8 client_num;
+        unsigned long client_num;
        client_num = dev->me_client_presentation_num;
@@ -680,8 +684,6 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
                    dev->hbm_state == MEI_HBM_ENUM_CLIENTS) {
                                dev->init_clients_timer = 0;
-                                dev->me_client_presentation_num = 0;
-                                dev->me_client_index = 0;
                                mei_hbm_me_cl_allocate(dev);
                                dev->hbm_state = MEI_HBM_CLIENT_PROPERTIES;
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 92c73118b13c..6197018e2f16 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -175,6 +175,9 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
                memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg));
        }
+        /* we're already in reset, cancel the init timer */
+        dev->init_clients_timer = 0;
        dev->me_clients_num = 0;
        dev->rd_msg_hdr = 0;
        dev->wd_pending = false;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 9aa3b78067d3..c71420ef1e37 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -252,19 +252,16 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                mutex_unlock(&dev->device_lock);
                if (wait_event_interruptible(cl->rx_wait,
-                        (MEI_READ_COMPLETE == cl->reading_state ||
+                                MEI_READ_COMPLETE == cl->reading_state ||
-                         MEI_FILE_INITIALIZING == cl->state ||
+                                mei_cl_is_transitioning(cl))) {
-                         MEI_FILE_DISCONNECTED == cl->state ||
-                         MEI_FILE_DISCONNECTING == cl->state))) {
                        if (signal_pending(current))
                                return -EINTR;
                        return -ERESTARTSYS;
                }
                mutex_lock(&dev->device_lock);
-                if (MEI_FILE_INITIALIZING == cl->state ||
+                if (mei_cl_is_transitioning(cl)) {
-                    MEI_FILE_DISCONNECTED == cl->state ||
-                    MEI_FILE_DISCONNECTING == cl->state) {
                        rets = -EBUSY;
                        goto out;
                }
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 7b918b2fb894..456b322013e2 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -396,9 +396,9 @@ struct mei_device {
        struct mei_me_client *me_clients; /* Note: memory has to be allocated */
        DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX);
        DECLARE_BITMAP(host_clients_map, MEI_CLIENTS_MAX);
-        u8 me_clients_num;
+        unsigned long me_clients_num;
-        u8 me_client_presentation_num;
+        unsigned long me_client_presentation_num;
-        u8 me_client_index;
+        unsigned long me_client_index;
        struct mei_cl wd_cl;
        enum mei_wd_states wd_state;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e8ccf6c0f08a..bdd64b1b4817 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1155,8 +1155,14 @@ static void pci_enable_bridge(struct pci_dev *dev)
        pci_enable_bridge(dev->bus->self);
-        if (pci_is_enabled(dev))
+        if (pci_is_enabled(dev)) {
+                if (!dev->is_busmaster) {
+                        dev_warn(&dev->dev, "driver skip pci_set_master, fix it!\n");
+                        pci_set_master(dev);
+                }
                return;
+        }
        retval = pci_enable_device(dev);
        if (retval)
                dev_err(&dev->dev, "Error enabling bridge (%d), continuing\n",
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 47c5888461ff..a2e52a0c53c9 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -41,7 +41,6 @@ struct imx_drm_device {
        struct list_head                        encoder_list;
        struct list_head                        connector_list;
        struct mutex                            mutex;
-        int                                     references;
        int                                     pipes;
        struct drm_fbdev_cma                    *fbhelper;
 };
@@ -241,8 +240,6 @@ struct drm_device *imx_drm_device_get(void)
                }
        }
-        imxdrm->references++;
        return imxdrm->drm;
 unwind_crtc:
@@ -280,8 +277,6 @@ void imx_drm_device_put(void)
        list_for_each_entry(enc, &imxdrm->encoder_list, list)
                module_put(enc->owner);
-        imxdrm->references--;
        mutex_unlock(&imxdrm->mutex);
 }
 EXPORT_SYMBOL_GPL(imx_drm_device_put);
@@ -485,7 +480,7 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
        mutex_lock(&imxdrm->mutex);
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                ret = -EBUSY;
                goto err_busy;
        }
@@ -564,7 +559,7 @@ int imx_drm_add_encoder(struct drm_encoder *encoder,
        mutex_lock(&imxdrm->mutex);
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                ret = -EBUSY;
                goto err_busy;
        }
@@ -709,7 +704,7 @@ int imx_drm_add_connector(struct drm_connector *connector,
        mutex_lock(&imxdrm->mutex);
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                ret = -EBUSY;
                goto err_busy;
        }
diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/staging/lustre/lustre/obdecho/echo_client.c
index 2644edf438c1..c8b43442dc74 100644
--- a/drivers/staging/lustre/lustre/obdecho/echo_client.c
+++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c
@@ -1387,7 +1387,7 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
        if (nob > ulsm_nob)
                return (-EINVAL);
-        if (copy_to_user (ulsm, lsm, sizeof(ulsm)))
+        if (copy_to_user (ulsm, lsm, sizeof(*ulsm)))
                return (-EFAULT);
        for (i = 0; i < lsm->lsm_stripe_count; i++) {
diff --git a/drivers/staging/octeon-usb/cvmx-usb.c b/drivers/staging/octeon-usb/cvmx-usb.c
index d7b3c82b5ead..45dfe94199ae 100644
--- a/drivers/staging/octeon-usb/cvmx-usb.c
+++ b/drivers/staging/octeon-usb/cvmx-usb.c
@@ -604,7 +604,7 @@ int cvmx_usb_initialize(struct cvmx_usb_state *state, int usb_port_number,
                        }
        }
-        memset(usb, 0, sizeof(usb));
+        memset(usb, 0, sizeof(*usb));
        usb->init_flags = flags;
        /* Initialize the USB state structure */
diff --git a/drivers/staging/rtl8188eu/core/rtw_mp.c b/drivers/staging/rtl8188eu/core/rtw_mp.c
index c7ff2e4d1f23..9832dcbbd07f 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mp.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mp.c
@@ -907,7 +907,7 @@ u32 mp_query_psd(struct adapter *pAdapter, u8 *data)
                sscanf(data, "pts =%d, start =%d, stop =%d", &psd_pts, &psd_start, &psd_stop);
        }
-        _rtw_memset(data, '\0', sizeof(data));
+        _rtw_memset(data, '\0', sizeof(*data));
        i = psd_start;
        while (i < psd_stop) {
diff --git a/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c b/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
index 9c2e7a20c09e..ec0028d4e61a 100644
--- a/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
+++ b/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
@@ -57,7 +57,7 @@ static void Init_ODM_ComInfo_88E(struct adapter *Adapter)
        u8 cut_ver, fab_ver;
        /*  Init Value */
-        _rtw_memset(dm_odm, 0, sizeof(dm_odm));
+        _rtw_memset(dm_odm, 0, sizeof(*dm_odm));
        dm_odm->Adapter = Adapter;
diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index cd4100fb3645..95953ebc0279 100644
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -6973,7 +6973,7 @@ static int rtw_mp_ctx(struct net_device *dev,
        stop = strncmp(extra, "stop", 4);
        sscanf(extra, "count =%d, pkt", &count);
-        _rtw_memset(extra, '\0', sizeof(extra));
+        _rtw_memset(extra, '\0', sizeof(*extra));
        if (stop == 0) {
                bStartTest = 0; /*  To set Stop */
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index d3078d200e50..9ca3180ebaa0 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -54,6 +54,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
        /*=== Customer ID ===*/
        /****** 8188EUS ********/
        {USB_DEVICE(0x8179, 0x07B8)}, /* Abocom - Abocom */
+        {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
        {}      /* Terminating entry */
 };
diff --git a/drivers/staging/rtl8192u/r819xU_cmdpkt.c b/drivers/staging/rtl8192u/r819xU_cmdpkt.c
index 5bc361b16d4c..56144014b7c9 100644
--- a/drivers/staging/rtl8192u/r819xU_cmdpkt.c
+++ b/drivers/staging/rtl8192u/r819xU_cmdpkt.c
@@ -37,6 +37,8 @@ rt_status SendTxCommandPacket(struct net_device *dev, void *pData, u32 DataLen)
        /* Get TCB and local buffer from common pool.
           (It is shared by CmdQ, MgntQ, and USB coalesce DataQ) */
        skb  = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4);
+        if (!skb)
+                return RT_STATUS_FAILURE;
        memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
        tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
        tcb_desc->queue_index = TXCMD_QUEUE;
diff --git a/drivers/staging/vt6656/iwctl.c b/drivers/staging/vt6656/iwctl.c
index d0cf7d8a20e5..8872e0f84f40 100644
--- a/drivers/staging/vt6656/iwctl.c
+++ b/drivers/staging/vt6656/iwctl.c
@@ -1634,6 +1634,9 @@ int iwctl_siwencodeext(struct net_device *dev, struct iw_request_info *info,
        if (pMgmt == NULL)
                return -EFAULT;
+        if (!(pDevice->flags & DEVICE_FLAGS_OPENED))
+                return -ENODEV;
        buf = kzalloc(sizeof(struct viawget_wpa_param), GFP_KERNEL);
        if (buf == NULL)
                return -ENOMEM;
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index 536971786ae8..6f9d28182445 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -1098,6 +1098,8 @@ static int device_close(struct net_device *dev)
    memset(pMgmt->abyCurrBSSID, 0, 6);
    pMgmt->eCurrState = WMAC_STATE_IDLE;
+        pDevice->flags &= ~DEVICE_FLAGS_OPENED;
    device_free_tx_bufs(pDevice);
    device_free_rx_bufs(pDevice);
    device_free_int_bufs(pDevice);
@@ -1109,7 +1111,6 @@ static int device_close(struct net_device *dev)
    usb_free_urb(pDevice->pInterruptURB);
    BSSvClearNodeDBTable(pDevice, 0);
-    pDevice->flags &=(~DEVICE_FLAGS_OPENED);
    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "device_close2 \n");
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index fb743a8811bb..14f3e852215d 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -148,6 +148,8 @@ static void *s_vGetFreeContext(struct vnt_private *pDevice)
    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"GetFreeContext()\n");
    for (ii = 0; ii < pDevice->cbTD; ii++) {
+        if (!pDevice->apTD[ii])
+                return NULL;
        pContext = pDevice->apTD[ii];
        if (pContext->bBoolInUse == false) {
            pContext->bBoolInUse = true;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index c9a9ddd1d0bc..01bf5eb4f238 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1758,8 +1758,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
                canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
        if (canon_change) {
                bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
-                ldata->line_start = 0;
+                ldata->line_start = ldata->canon_head = ldata->read_tail;
-                ldata->canon_head = ldata->read_tail;
                ldata->erasing = 0;
                ldata->lnext = 0;
        }
diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index 52379e56a31e..44077c0b7670 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -667,30 +667,21 @@ static int pop_tx_x(struct eg20t_port *priv, unsigned char *buf)
 static int dma_push_rx(struct eg20t_port *priv, int size)
 {
-        struct tty_struct *tty;
        int room;
        struct uart_port *port = &priv->port;
        struct tty_port *tport = &port->state->port;
-        port = &priv->port;
-        tty = tty_port_tty_get(tport);
-        if (!tty) {
-                dev_dbg(priv->port.dev, "%s:tty is busy now", __func__);
-                return 0;
-        }
        room = tty_buffer_request_room(tport, size);
        if (room < size)
                dev_warn(port->dev, "Rx overrun: dropping %u bytes\n",
                         size - room);
        if (!room)
-                return room;
+                return 0;
        tty_insert_flip_string(tport, sg_virt(&priv->sg_rx), size);
        port->icount.rx += room;
-        tty_kref_put(tty);
        return room;
 }
@@ -1098,6 +1089,8 @@ static void pch_uart_err_ir(struct eg20t_port *priv, unsigned int lsr)
        if (tty == NULL) {
                for (i = 0; error_msg[i] != NULL; i++)
                        dev_err(&priv->pdev->dev, error_msg[i]);
+        } else {
+                tty_kref_put(tty);
        }
 }
diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index d0d972f7e43e..0489a2bdcdf9 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -732,7 +732,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data)
 static void tegra_uart_stop_rx(struct uart_port *u)
 {
        struct tegra_uart_port *tup = to_tegra_uport(u);
-        struct tty_struct *tty = tty_port_tty_get(&tup->uport.state->port);
+        struct tty_struct *tty;
        struct tty_port *port = &u->state->port;
        struct dma_tx_state state;
        unsigned long ier;
@@ -744,6 +744,8 @@ static void tegra_uart_stop_rx(struct uart_port *u)
        if (!tup->rx_in_progress)
                return;
+        tty = tty_port_tty_get(&tup->uport.state->port);
        tegra_uart_wait_sym_time(tup, 1); /* wait a character interval */
        ier = tup->ier_shadow;
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 03ba081c5772..6fd60fece6b4 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -1201,6 +1201,9 @@ int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
                }
                return 0;
        case TCFLSH:
+                retval = tty_check_change(tty);
+                if (retval)
+                        return retval;
                return __tty_perform_flush(tty, arg);
        default:
                /* Try the mode commands */
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index 4a851e15e58c..77b47d82c9a6 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -1,6 +1,6 @@
 config USB_CHIPIDEA
        tristate "ChipIdea Highspeed Dual Role Controller"
-        depends on (USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)
+        depends on ((USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)) && HAS_DMA
        help
          Say Y here if your system has a dual role high speed USB
          controller based on ChipIdea silicon IP. Currently, only the
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 74d998d9b45b..be822a2c1776 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -131,7 +131,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                if (ret) {
                        dev_err(&pdev->dev, "usbmisc init failed, ret=%d\n",
                                        ret);
-                        goto err_clk;
+                        goto err_phy;
                }
        }
@@ -143,7 +143,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                dev_err(&pdev->dev,
                        "Can't register ci_hdrc platform device, err=%d\n",
                        ret);
-                goto err_clk;
+                goto err_phy;
        }
        if (data->usbmisc_data) {
@@ -164,6 +164,9 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
 disable_device:
        ci_hdrc_remove_device(data->ci_pdev);
+err_phy:
+        if (data->phy)
+                usb_phy_shutdown(data->phy);
 err_clk:
        clk_disable_unprepare(data->clk);
        return ret;
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 94626409559a..23763dcec069 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -605,6 +605,7 @@ static int ci_hdrc_remove(struct platform_device *pdev)
        dbg_remove_files(ci);
        free_irq(ci->irq, ci);
        ci_role_destroy(ci);
+        kfree(ci->hw_bank.regmap);
        return 0;
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 6b4c2f2eb946..9333083dd111 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1600,6 +1600,8 @@ static void destroy_eps(struct ci_hdrc *ci)
        for (i = 0; i < ci->hw_ep_max; i++) {
                struct ci_hw_ep *hwep = &ci->ci_hw_ep[i];
+                if (hwep->pending_td)
+                        free_pending_td(hwep);
                dma_pool_free(ci->qh_pool, hwep->qh.ptr, hwep->qh.dma);
        }
 }
@@ -1667,13 +1669,13 @@ static int ci_udc_stop(struct usb_gadget *gadget,
                if (ci->platdata->notify_event)
                        ci->platdata->notify_event(ci,
                        CI_HDRC_CONTROLLER_STOPPED_EVENT);
-                ci->driver = NULL;
                spin_unlock_irqrestore(&ci->lock, flags);
                _gadget_stop_activity(&ci->gadget);
                spin_lock_irqsave(&ci->lock, flags);
                pm_runtime_put(&ci->gadget.dev);
        }
+        ci->driver = NULL;
        spin_unlock_irqrestore(&ci->lock, flags);
        return 0;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 737e3c19967b..71dc5d768fa5 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -742,6 +742,22 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
                if ((index & ~USB_DIR_IN) == 0)
                        return 0;
                ret = findintfep(ps->dev, index);
+                if (ret < 0) {
+                        /*
+                         * Some not fully compliant Win apps seem to get
+                         * index wrong and have the endpoint number here
+                         * rather than the endpoint address (with the
+                         * correct direction). Win does let this through,
+                         * so we'll not reject it here but leave it to
+                         * the device to not break KVM. But we warn.
+                         */
+                        ret = findintfep(ps->dev, index ^ 0x80);
+                        if (ret >= 0)
+                                dev_info(&ps->dev->dev,
+                                        "%s: process %i (%s) requesting ep %02x but needs %02x\n",
+                                        __func__, task_pid_nr(current),
+                                        current->comm, index, index ^ 0x80);
+                }
                if (ret >= 0)
                        ret = checkintf(ps, ret);
                break;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index dde4c83516a1..e6b682c6c236 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3426,6 +3426,9 @@ static int usb_req_set_sel(struct usb_device *udev, enum usb3_link_state state)
        unsigned long long u2_pel;
        int ret;
+        if (udev->state != USB_STATE_CONFIGURED)
+                return 0;
        /* Convert SEL and PEL stored in ns to us */
        u1_sel = DIV_ROUND_UP(udev->u1_params.sel, 1000);
        u1_pel = DIV_ROUND_UP(udev->u1_params.pel, 1000);
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 997ebe420bc9..2e252aae51ca 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -29,6 +29,7 @@
 #define PCI_VENDOR_ID_SYNOPSYS          0x16c3
 #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
 #define PCI_DEVICE_ID_INTEL_BYT         0x0f37
+#define PCI_DEVICE_ID_INTEL_MRFLD       0x119e
 struct dwc3_pci {
        struct device           *dev;
@@ -189,6 +190,7 @@ static DEFINE_PCI_DEVICE_TABLE(dwc3_pci_id_table) = {
                                PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3),
        },
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
        {  }    /* Terminating Entry */
 };
 MODULE_DEVICE_TABLE(pci, dwc3_pci_id_table);
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 1a66c5baa0d1..0658908d8968 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1034,37 +1034,19 @@ struct ffs_sb_fill_data {
        struct ffs_file_perms perms;
        umode_t root_mode;
        const char *dev_name;
-        union {
+        struct ffs_data *ffs_data;
-                /* set by ffs_fs_mount(), read by ffs_sb_fill() */
-                void *private_data;
-                /* set by ffs_sb_fill(), read by ffs_fs_mount */
-                struct ffs_data *ffs_data;
-        };
 };
 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
 {
        struct ffs_sb_fill_data *data = _data;
        struct inode    *inode;
-        struct ffs_data *ffs;
+        struct ffs_data *ffs = data->ffs_data;
        ENTER();
-        /* Initialise data */
-        ffs = ffs_data_new();
-        if (unlikely(!ffs))
-                goto Enomem;
        ffs->sb              = sb;
-        ffs->dev_name        = kstrdup(data->dev_name, GFP_KERNEL);
+        data->ffs_data       = NULL;
-        if (unlikely(!ffs->dev_name))
-                goto Enomem;
-        ffs->file_perms      = data->perms;
-        ffs->private_data    = data->private_data;
-        /* used by the caller of this function */
-        data->ffs_data       = ffs;
        sb->s_fs_info        = ffs;
        sb->s_blocksize      = PAGE_CACHE_SIZE;
        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
@@ -1080,17 +1062,14 @@ static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
                                  &data->perms);
        sb->s_root = d_make_root(inode);
        if (unlikely(!sb->s_root))
-                goto Enomem;
+                return -ENOMEM;
        /* EP0 file */
        if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
                                         &ffs_ep0_operations, NULL)))
-                goto Enomem;
+                return -ENOMEM;
        return 0;
-Enomem:
-        return -ENOMEM;
 }
 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
@@ -1193,6 +1172,7 @@ ffs_fs_mount(struct file_system_type *t, int flags,
        struct dentry *rv;
        int ret;
        void *ffs_dev;
+        struct ffs_data *ffs;
        ENTER();
@@ -1200,18 +1180,30 @@ ffs_fs_mount(struct file_system_type *t, int flags,
        if (unlikely(ret < 0))
                return ERR_PTR(ret);
+        ffs = ffs_data_new();
+        if (unlikely(!ffs))
+                return ERR_PTR(-ENOMEM);
+        ffs->file_perms = data.perms;
+        ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
+        if (unlikely(!ffs->dev_name)) {
+                ffs_data_put(ffs);
+                return ERR_PTR(-ENOMEM);
+        }
        ffs_dev = functionfs_acquire_dev_callback(dev_name);
-        if (IS_ERR(ffs_dev))
+        if (IS_ERR(ffs_dev)) {
-                return ffs_dev;
+                ffs_data_put(ffs);
+                return ERR_CAST(ffs_dev);
+        }
+        ffs->private_data = ffs_dev;
+        data.ffs_data = ffs;
-        data.dev_name = dev_name;
-        data.private_data = ffs_dev;
        rv = mount_nodev(t, flags, &data, ffs_sb_fill);
+        if (IS_ERR(rv) && data.ffs_data) {
-        /* data.ffs_data is set by ffs_sb_fill */
-        if (IS_ERR(rv))
                functionfs_release_dev_callback(data.ffs_data);
+                ffs_data_put(data.ffs_data);
+        }
        return rv;
 }
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 4449f565d6c6..f2407b2e8a99 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -130,7 +130,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
        }
        /* Enable USB controller, 83xx or 8536 */
-        if (pdata->have_sysif_regs)
+        if (pdata->have_sysif_regs && pdata->controller_ver < FSL_USB_VER_1_6)
                setbits32(hcd->regs + FSL_SOC_USB_CTRL, 0x4);
        /* Don't need to set host mode here. It will be done by tdi_reset() */
@@ -232,15 +232,9 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
        case FSL_USB2_PHY_ULPI:
                if (pdata->have_sysif_regs && pdata->controller_ver) {
                        /* controller version 1.6 or above */
+                        clrbits32(non_ehci + FSL_SOC_USB_CTRL, UTMI_PHY_EN);
                        setbits32(non_ehci + FSL_SOC_USB_CTRL,
-                                        ULPI_PHY_CLK_SEL);
+                                ULPI_PHY_CLK_SEL | USB_CTRL_USB_EN);
-                        /*
-                         * Due to controller issue of PHY_CLK_VALID in ULPI
-                         * mode, we set USB_CTRL_USB_EN before checking
-                         * PHY_CLK_VALID, otherwise PHY_CLK_VALID doesn't work.
-                         */
-                        clrsetbits_be32(non_ehci + FSL_SOC_USB_CTRL,
-                                        UTMI_PHY_EN, USB_CTRL_USB_EN);
                }
                portsc |= PORT_PTS_ULPI;
                break;
@@ -270,8 +264,9 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
        if (pdata->have_sysif_regs && pdata->controller_ver &&
            (phy_mode == FSL_USB2_PHY_ULPI)) {
                /* check PHY_CLK_VALID to get phy clk valid */
-                if (!spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
+                if (!(spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
-                                PHY_CLK_VALID, FSL_USB_PHY_CLK_TIMEOUT, 0)) {
+                                PHY_CLK_VALID, FSL_USB_PHY_CLK_TIMEOUT, 0) ||
+                                in_be32(non_ehci + FSL_SOC_USB_PRICTRL))) {
                        printk(KERN_WARNING "fsl-ehci: USB PHY clock invalid\n");
                        return -EINVAL;
                }
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 6bd299e61f58..854c2ec7b699 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -361,7 +361,7 @@ static struct pci_driver ehci_pci_driver = {
        .remove =       usb_hcd_pci_remove,
        .shutdown =     usb_hcd_pci_shutdown,
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        .driver =       {
                .pm =   &usb_hcd_pci_pm_ops
        },
diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c
index 60a5de505ca1..adb01d950a16 100644
--- a/drivers/usb/host/imx21-hcd.c
+++ b/drivers/usb/host/imx21-hcd.c
@@ -824,13 +824,13 @@ static int imx21_hc_urb_enqueue_isoc(struct usb_hcd *hcd,
                        i = DIV_ROUND_UP(wrap_frame(
                                        cur_frame - urb->start_frame),
                                        urb->interval);
-                        if (urb->transfer_flags & URB_ISO_ASAP) {
+                        /* Treat underruns as if URB_ISO_ASAP was set */
+                        if ((urb->transfer_flags & URB_ISO_ASAP) ||
+                                        i >= urb->number_of_packets) {
                                urb->start_frame = wrap_frame(urb->start_frame
                                                + i * urb->interval);
                                i = 0;
-                        } else if (i >= urb->number_of_packets) {
-                                ret = -EXDEV;
-                                goto alloc_dmem_failed;
                        }
                }
        }
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 8f6b695af6a4..604cad1bcf9c 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -216,31 +216,26 @@ static int ohci_urb_enqueue (
                        frame &= ~(ed->interval - 1);
                        frame |= ed->branch;
                        urb->start_frame = frame;
+                        ed->last_iso = frame + ed->interval * (size - 1);
                }
        } else if (ed->type == PIPE_ISOCHRONOUS) {
                u16     next = ohci_frame_no(ohci) + 1;
                u16     frame = ed->last_iso + ed->interval;
+                u16     length = ed->interval * (size - 1);
                /* Behind the scheduling threshold? */
                if (unlikely(tick_before(frame, next))) {
-                        /* USB_ISO_ASAP: Round up to the first available slot */
+                        /* URB_ISO_ASAP: Round up to the first available slot */
                        if (urb->transfer_flags & URB_ISO_ASAP) {
                                frame += (next - frame + ed->interval - 1) &
                                                -ed->interval;
                        /*
-                         * Not ASAP: Use the next slot in the stream.  If
+                         * Not ASAP: Use the next slot in the stream,
-                         * the entire URB falls before the threshold, fail.
+                         * no matter what.
                         */
                        } else {
-                                if (tick_before(frame + ed->interval *
-                                        (urb->number_of_packets - 1), next)) {
-                                        retval = -EXDEV;
-                                        usb_hcd_unlink_urb_from_ep(hcd, urb);
-                                        goto fail;
-                                }
                                /*
                                 * Some OHCI hardware doesn't handle late TDs
                                 * correctly.  After retiring them it proceeds
@@ -251,9 +246,16 @@ static int ohci_urb_enqueue (
                                urb_priv->td_cnt = DIV_ROUND_UP(
                                                (u16) (next - frame),
                                                ed->interval);
+                                if (urb_priv->td_cnt >= urb_priv->length) {
+                                        ++urb_priv->td_cnt;     /* Mark it */
+                                        ohci_dbg(ohci, "iso underrun %p (%u+%u < %u)\n",
+                                                        urb, frame, length,
+                                                        next);
+                                }
                        }
                }
                urb->start_frame = frame;
+                ed->last_iso = frame + length;
        }
        /* fill the TDs and link them to the ed; and
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index df4a6707322d..e7f577e63624 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -41,9 +41,13 @@ finish_urb(struct ohci_hcd *ohci, struct urb *urb, int status)
 __releases(ohci->lock)
 __acquires(ohci->lock)
 {
-         struct device *dev = ohci_to_hcd(ohci)->self.controller;
+        struct device *dev = ohci_to_hcd(ohci)->self.controller;
+        struct usb_host_endpoint *ep = urb->ep;
+        struct urb_priv *urb_priv;
        // ASSERT (urb->hcpriv != 0);
+ restart:
        urb_free_priv (ohci, urb->hcpriv);
        urb->hcpriv = NULL;
        if (likely(status == -EINPROGRESS))
@@ -80,6 +84,21 @@ __acquires(ohci->lock)
                ohci->hc_control &= ~(OHCI_CTRL_PLE|OHCI_CTRL_IE);
                ohci_writel (ohci, ohci->hc_control, &ohci->regs->control);
        }
+        /*
+         * An isochronous URB that is sumitted too late won't have any TDs
+         * (marked by the fact that the td_cnt value is larger than the
+         * actual number of TDs).  If the next URB on this endpoint is like
+         * that, give it back now.
+         */
+        if (!list_empty(&ep->urb_list)) {
+                urb = list_first_entry(&ep->urb_list, struct urb, urb_list);
+                urb_priv = urb->hcpriv;
+                if (urb_priv->td_cnt > urb_priv->length) {
+                        status = 0;
+                        goto restart;
+                }
+        }
 }
@@ -546,7 +565,6 @@ td_fill (struct ohci_hcd *ohci, u32 info,
                td->hwCBP = cpu_to_hc32 (ohci, data & 0xFFFFF000);
                *ohci_hwPSWp(ohci, td, 0) = cpu_to_hc16 (ohci,
                                                (data & 0x0FFF) | 0xE000);
-                td->ed->last_iso = info & 0xffff;
        } else {
                td->hwCBP = cpu_to_hc32 (ohci, data);
        }
@@ -996,7 +1014,7 @@ rescan_this:
                        urb_priv->td_cnt++;
                        /* if URB is done, clean up */
-                        if (urb_priv->td_cnt == urb_priv->length) {
+                        if (urb_priv->td_cnt >= urb_priv->length) {
                                modified = completed = 1;
                                finish_urb(ohci, urb, 0);
                        }
@@ -1086,7 +1104,7 @@ static void takeback_td(struct ohci_hcd *ohci, struct td *td)
        urb_priv->td_cnt++;
        /* If all this urb's TDs are done, call complete() */
-        if (urb_priv->td_cnt == urb_priv->length)
+        if (urb_priv->td_cnt >= urb_priv->length)
                finish_urb(ohci, urb, status);
        /* clean schedule:  unlink EDs that are no longer busy */
diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c
index c300bd2f7d1c..0f228c46eeda 100644
--- a/drivers/usb/host/uhci-pci.c
+++ b/drivers/usb/host/uhci-pci.c
@@ -293,7 +293,7 @@ static struct pci_driver uhci_pci_driver = {
        .remove =       usb_hcd_pci_remove,
        .shutdown =     uhci_shutdown,
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        .driver =       {
                .pm =   &usb_hcd_pci_pm_ops
        },
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 041c6ddb695c..da6f56d996ce 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -1303,7 +1303,7 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
                }
                /* Fell behind? */
-                if (uhci_frame_before_eq(frame, next)) {
+                if (!uhci_frame_before_eq(next, frame)) {
                        /* USB_ISO_ASAP: Round up to the first available slot */
                        if (urb->transfer_flags & URB_ISO_ASAP)
@@ -1311,13 +1311,17 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
                                                -qh->period;
                        /*
-                         * Not ASAP: Use the next slot in the stream.  If
+                         * Not ASAP: Use the next slot in the stream,
-                         * the entire URB falls before the threshold, fail.
+                         * no matter what.
                         */
                        else if (!uhci_frame_before_eq(next,
                                        frame + (urb->number_of_packets - 1) *
                                                qh->period))
-                                return -EXDEV;
+                                dev_dbg(uhci_dev(uhci), "iso underrun %p (%u+%u < %u)\n",
+                                                urb, frame,
+                                                (urb->number_of_packets - 1) *
+                                                        qh->period,
+                                                next);
                }
        }
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index fae697ed0b70..773a6b28c4f1 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -287,7 +287,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
                if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)
                        xhci_queue_stop_endpoint(xhci, slot_id, i, suspend);
        }
-        cmd->command_trb = xhci->cmd_ring->enqueue;
+        cmd->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
        list_add_tail(&cmd->cmd_list, &virt_dev->cmd_list);
        xhci_queue_stop_endpoint(xhci, slot_id, 0, suspend);
        xhci_ring_cmd_db(xhci);
@@ -552,11 +552,15 @@ void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
 *  - Mark a port as being done with device resume,
 *    and ring the endpoint doorbells.
 *  - Stop the Synopsys redriver Compliance Mode polling.
+ *  - Drop and reacquire the xHCI lock, in order to wait for port resume.
 */
 static u32 xhci_get_port_status(struct usb_hcd *hcd,
                struct xhci_bus_state *bus_state,
                __le32 __iomem **port_array,
-                u16 wIndex, u32 raw_port_status)
+                u16 wIndex, u32 raw_port_status,
+                unsigned long flags)
+        __releases(&xhci->lock)
+        __acquires(&xhci->lock)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        u32 status = 0;
@@ -591,21 +595,42 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                        return 0xffffffff;
                if (time_after_eq(jiffies,
                                        bus_state->resume_done[wIndex])) {
+                        int time_left;
                        xhci_dbg(xhci, "Resume USB2 port %d\n",
                                        wIndex + 1);
                        bus_state->resume_done[wIndex] = 0;
                        clear_bit(wIndex, &bus_state->resuming_ports);
+                        set_bit(wIndex, &bus_state->rexit_ports);
                        xhci_set_link_state(xhci, port_array, wIndex,
                                        XDEV_U0);
-                        xhci_dbg(xhci, "set port %d resume\n",
-                                        wIndex + 1);
+                        spin_unlock_irqrestore(&xhci->lock, flags);
-                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+                        time_left = wait_for_completion_timeout(
-                                        wIndex + 1);
+                                        &bus_state->rexit_done[wIndex],
-                        if (!slot_id) {
+                                        msecs_to_jiffies(
-                                xhci_dbg(xhci, "slot_id is zero\n");
+                                                XHCI_MAX_REXIT_TIMEOUT));
-                                return 0xffffffff;
+                        spin_lock_irqsave(&xhci->lock, flags);
+                        if (time_left) {
+                                slot_id = xhci_find_slot_id_by_port(hcd,
+                                                xhci, wIndex + 1);
+                                if (!slot_id) {
+                                        xhci_dbg(xhci, "slot_id is zero\n");
+                                        return 0xffffffff;
+                                }
+                                xhci_ring_device(xhci, slot_id);
+                        } else {
+                                int port_status = xhci_readl(xhci,
+                                                port_array[wIndex]);
+                                xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
+                                                XHCI_MAX_REXIT_TIMEOUT,
+                                                port_status);
+                                status |= USB_PORT_STAT_SUSPEND;
+                                clear_bit(wIndex, &bus_state->rexit_ports);
                        }
-                        xhci_ring_device(xhci, slot_id);
                        bus_state->port_c_suspend |= 1 << wIndex;
                        bus_state->suspended_ports &= ~(1 << wIndex);
                } else {
@@ -728,7 +753,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                        break;
                }
                status = xhci_get_port_status(hcd, bus_state, port_array,
-                                wIndex, temp);
+                                wIndex, temp, flags);
                if (status == 0xffffffff)
                        goto error;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 53b972c2a09f..83bcd13622c3 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2428,6 +2428,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
        for (i = 0; i < USB_MAXCHILDREN; ++i) {
                xhci->bus_state[0].resume_done[i] = 0;
                xhci->bus_state[1].resume_done[i] = 0;
+                /* Only the USB 2.0 completions will ever be used. */
+                init_completion(&xhci->bus_state[1].rexit_done[i]);
        }
        if (scratchpad_alloc(xhci, flags))
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index c2d495057eb5..236c3aabe940 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -351,7 +351,7 @@ static struct pci_driver xhci_pci_driver = {
        /* suspend and resume implemented later */
        .shutdown =     usb_hcd_pci_shutdown,
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
        .driver = {
                .pm = &usb_hcd_pci_pm_ops
        },
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 411da1fc7ae8..6bfbd80ec2b9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -123,6 +123,16 @@ static int enqueue_is_link_trb(struct xhci_ring *ring)
        return TRB_TYPE_LINK_LE32(link->control);
 }
+union xhci_trb *xhci_find_next_enqueue(struct xhci_ring *ring)
+{
+        /* Enqueue pointer can be left pointing to the link TRB,
+         * we must handle that
+         */
+        if (TRB_TYPE_LINK_LE32(ring->enqueue->link.control))
+                return ring->enq_seg->next->trbs;
+        return ring->enqueue;
+}
 /* Updates trb to point to the next TRB in the ring, and updates seg if the next
 * TRB is in a new segment.  This does not skip over link TRBs, and it does not
 * effect the ring dequeue or enqueue pointers.
@@ -859,8 +869,12 @@ remove_finished_td:
                /* Otherwise ring the doorbell(s) to restart queued transfers */
                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
        }
-        ep->stopped_td = NULL;
-        ep->stopped_trb = NULL;
+        /* Clear stopped_td and stopped_trb if endpoint is not halted */
+        if (!(ep->ep_state & EP_HALTED)) {
+                ep->stopped_td = NULL;
+                ep->stopped_trb = NULL;
+        }
        /*
         * Drop the lock and complete the URBs in the cancelled TD list.
@@ -1414,6 +1428,12 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                        inc_deq(xhci, xhci->cmd_ring);
                        return;
                }
+                /* There is no command to handle if we get a stop event when the
+                 * command ring is empty, event->cmd_trb points to the next
+                 * unset command
+                 */
+                if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)
+                        return;
        }
        switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
@@ -1743,6 +1763,19 @@ static void handle_port_status(struct xhci_hcd *xhci,
                }
        }
+        /*
+         * Check to see if xhci-hub.c is waiting on RExit to U0 transition (or
+         * RExit to a disconnect state).  If so, let the the driver know it's
+         * out of the RExit state.
+         */
+        if (!DEV_SUPERSPEED(temp) &&
+                        test_and_clear_bit(faked_port_index,
+                                &bus_state->rexit_ports)) {
+                complete(&bus_state->rexit_done[faked_port_index]);
+                bogus_port_status = true;
+                goto cleanup;
+        }
        if (hcd->speed != HCD_USB3)
                xhci_test_and_clear_bit(xhci, port_array, faked_port_index,
                                        PORT_PLC);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 49b6edb84a79..1e36dbb48366 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2598,15 +2598,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
        if (command) {
                cmd_completion = command->completion;
                cmd_status = &command->status;
-                command->command_trb = xhci->cmd_ring->enqueue;
+                command->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
-                /* Enqueue pointer can be left pointing to the link TRB,
-                 * we must handle that
-                 */
-                if (TRB_TYPE_LINK_LE32(command->command_trb->link.control))
-                        command->command_trb =
-                                xhci->cmd_ring->enq_seg->next->trbs;
                list_add_tail(&command->cmd_list, &virt_dev->cmd_list);
        } else {
                cmd_completion = &virt_dev->cmd_completion;
@@ -2614,7 +2606,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
        }
        init_completion(cmd_completion);
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
        if (!ctx_change)
                ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,
                                udev->slot_id, must_succeed);
@@ -3439,14 +3431,7 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
        /* Attempt to submit the Reset Device command to the command ring */
        spin_lock_irqsave(&xhci->lock, flags);
-        reset_device_cmd->command_trb = xhci->cmd_ring->enqueue;
+        reset_device_cmd->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
-        /* Enqueue pointer can be left pointing to the link TRB,
-         * we must handle that
-         */
-        if (TRB_TYPE_LINK_LE32(reset_device_cmd->command_trb->link.control))
-                reset_device_cmd->command_trb =
-                        xhci->cmd_ring->enq_seg->next->trbs;
        list_add_tail(&reset_device_cmd->cmd_list, &virt_dev->cmd_list);
        ret = xhci_queue_reset_device(xhci, slot_id);
@@ -3650,7 +3635,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
        union xhci_trb *cmd_trb;
        spin_lock_irqsave(&xhci->lock, flags);
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
        ret = xhci_queue_slot_control(xhci, TRB_ENABLE_SLOT, 0);
        if (ret) {
                spin_unlock_irqrestore(&xhci->lock, flags);
@@ -3785,7 +3770,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
                                slot_ctx->dev_info >> 27);
        spin_lock_irqsave(&xhci->lock, flags);
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
        ret = xhci_queue_address_device(xhci, virt_dev->in_ctx->dma,
                                        udev->slot_id);
        if (ret) {
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 46aa14894148..289fbfbae746 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1412,8 +1412,18 @@ struct xhci_bus_state {
        unsigned long           resume_done[USB_MAXCHILDREN];
        /* which ports have started to resume */
        unsigned long           resuming_ports;
+        /* Which ports are waiting on RExit to U0 transition. */
+        unsigned long           rexit_ports;
+        struct completion       rexit_done[USB_MAXCHILDREN];
 };
+/*
+ * It can take up to 20 ms to transition from RExit to U0 on the
+ * Intel Lynx Point LP xHCI host.
+ */
+#define XHCI_MAX_REXIT_TIMEOUT  (20 * 1000)
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
        if (hcd->speed == HCD_USB3)
@@ -1840,6 +1850,7 @@ int xhci_cancel_cmd(struct xhci_hcd *xhci, struct xhci_command *command,
                union xhci_trb *cmd_trb);
 void xhci_ring_ep_doorbell(struct xhci_hcd *xhci, unsigned int slot_id,
                unsigned int ep_index, unsigned int stream_id);
+union xhci_trb *xhci_find_next_enqueue(struct xhci_ring *ring);
 /* xHCI roothub code */
 void xhci_set_link_state(struct xhci_hcd *xhci, __le32 __iomem **port_array,
diff --git a/drivers/video/mmp/hw/mmp_ctrl.c b/drivers/video/mmp/hw/mmp_ctrl.c
index 75dca19bf214..6ac755270ab4 100644
--- a/drivers/video/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/mmp/hw/mmp_ctrl.c
@@ -514,7 +514,7 @@ static int mmphw_probe(struct platform_device *pdev)
        if (IS_ERR(ctrl->clk)) {
                dev_err(ctrl->dev, "unable to get clk %s\n", mi->clk_name);
                ret = -ENOENT;
-                goto failed_get_clk;
+                goto failed;
        }
        clk_prepare_enable(ctrl->clk);
@@ -551,21 +551,8 @@ failed_path_init:
                path_deinit(path_plat);
        }
-        if (ctrl->clk) {
+        clk_disable_unprepare(ctrl->clk);
-                devm_clk_put(ctrl->dev, ctrl->clk);
-                clk_disable_unprepare(ctrl->clk);
-        }
-failed_get_clk:
-        devm_free_irq(ctrl->dev, ctrl->irq, ctrl);
 failed:
-        if (ctrl) {
-                if (ctrl->reg_base)
-                        devm_iounmap(ctrl->dev, ctrl->reg_base);
-                devm_release_mem_region(ctrl->dev, res->start,
-                                resource_size(res));
-                devm_kfree(ctrl->dev, ctrl);
-        }
        dev_err(&pdev->dev, "device init failed\n");
        return ret;
diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c
index d250ed0f806d..27197a8048c0 100644
--- a/drivers/video/mxsfb.c
+++ b/drivers/video/mxsfb.c
@@ -620,6 +620,7 @@ static int mxsfb_restore_mode(struct mxsfb_info *host)
                break;
        case 3:
                bits_per_pixel = 32;
+                break;
        case 1:
        default:
                return -EINVAL;
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index 7ef079c146e7..c172a5281f9e 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -2075,6 +2075,7 @@ static int neofb_probe(struct pci_dev *dev, const struct pci_device_id *id)
        if (!fb_find_mode(&info->var, info, mode_option, NULL, 0,
                        info->monspecs.modedb, 16)) {
                printk(KERN_ERR "neofb: Unable to find usable video mode.\n");
+                err = -EINVAL;
                goto err_map_video;
        }
@@ -2097,7 +2098,8 @@ static int neofb_probe(struct pci_dev *dev, const struct pci_device_id *id)
               info->fix.smem_len >> 10, info->var.xres,
               info->var.yres, h_sync / 1000, h_sync % 1000, v_sync);
-        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0)
+        err = fb_alloc_cmap(&info->cmap, 256, 0);
+        if (err < 0)
                goto err_map_video;
        err = register_framebuffer(info);
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 171821ddd78d..ba5b40f581f6 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -120,7 +120,7 @@ int of_get_display_timing(struct device_node *np, const char *name,
                return -EINVAL;
        }
-        timing_np = of_find_node_by_name(np, name);
+        timing_np = of_get_child_by_name(np, name);
        if (!timing_np) {
                pr_err("%s: could not find node '%s'\n",
                        of_node_full_name(np), name);
@@ -143,11 +143,11 @@ struct display_timings *of_get_display_timings(struct device_node *np)
        struct display_timings *disp;
        if (!np) {
-                pr_err("%s: no devicenode given\n", of_node_full_name(np));
+                pr_err("%s: no device node given\n", of_node_full_name(np));
                return NULL;
        }
-        timings_np = of_find_node_by_name(np, "display-timings");
+        timings_np = of_get_child_by_name(np, "display-timings");
        if (!timings_np) {
                pr_err("%s: could not find display-timings node\n",
                        of_node_full_name(np));
diff --git a/drivers/video/omap2/displays-new/Kconfig b/drivers/video/omap2/displays-new/Kconfig
index 6c90885b0940..10b25e7cd878 100644
--- a/drivers/video/omap2/displays-new/Kconfig
+++ b/drivers/video/omap2/displays-new/Kconfig
@@ -35,6 +35,7 @@ config DISPLAY_PANEL_DPI
 config DISPLAY_PANEL_DSI_CM
        tristate "Generic DSI Command Mode Panel"
+        depends on BACKLIGHT_CLASS_DEVICE
        help
          Driver for generic DSI command mode panels.
diff --git a/drivers/video/omap2/displays-new/connector-analog-tv.c b/drivers/video/omap2/displays-new/connector-analog-tv.c
index 1b60698f141e..ccd9073f706f 100644
--- a/drivers/video/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/omap2/displays-new/connector-analog-tv.c
@@ -191,7 +191,7 @@ static int tvc_probe_pdata(struct platform_device *pdev)
        in = omap_dss_find_output(pdata->source);
        if (in == NULL) {
                dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        ddata->in = in;
diff --git a/drivers/video/omap2/displays-new/connector-dvi.c b/drivers/video/omap2/displays-new/connector-dvi.c
index bc5f8ceda371..63d88ee6dfe4 100644
--- a/drivers/video/omap2/displays-new/connector-dvi.c
+++ b/drivers/video/omap2/displays-new/connector-dvi.c
@@ -263,7 +263,7 @@ static int dvic_probe_pdata(struct platform_device *pdev)
        in = omap_dss_find_output(pdata->source);
        if (in == NULL) {
                dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        ddata->in = in;
diff --git a/drivers/video/omap2/displays-new/connector-hdmi.c b/drivers/video/omap2/displays-new/connector-hdmi.c
index c5826716d6ab..9abe2c039ae9 100644
--- a/drivers/video/omap2/displays-new/connector-hdmi.c
+++ b/drivers/video/omap2/displays-new/connector-hdmi.c
@@ -290,7 +290,7 @@ static int hdmic_probe_pdata(struct platform_device *pdev)
        in = omap_dss_find_output(pdata->source);
        if (in == NULL) {
                dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
        }
        ddata->in = in;
diff --git a/drivers/video/omap2/dss/dispc.c b/drivers/video/omap2/dss/dispc.c
index 02a7340111df..477975009eee 100644
--- a/drivers/video/omap2/dss/dispc.c
+++ b/drivers/video/omap2/dss/dispc.c
@@ -3691,6 +3691,7 @@ static int __init omap_dispchw_probe(struct platform_device *pdev)
        }
        pm_runtime_enable(&pdev->dev);
+        pm_runtime_irq_safe(&pdev->dev);
        r = dispc_runtime_get();
        if (r)
diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
index 47ca86c5c6c0..d838ba829459 100644
--- a/drivers/video/s3fb.c
+++ b/drivers/video/s3fb.c
@@ -1336,14 +1336,7 @@ static int s3_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                        (info->var.bits_per_pixel * info->var.xres_virtual);
        if (info->var.yres_virtual < info->var.yres) {
                dev_err(info->device, "virtual vertical size smaller than real\n");
-                goto err_find_mode;
+                rc = -EINVAL;
-        }
-        /* maximize virtual vertical size for fast scrolling */
-        info->var.yres_virtual = info->fix.smem_len * 8 /
-                        (info->var.bits_per_pixel * info->var.xres_virtual);
-        if (info->var.yres_virtual < info->var.yres) {
-                dev_err(info->device, "virtual vertical size smaller than real\n");
                goto err_find_mode;
        }
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index a50c6e3a7cc4..b232908a6192 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -398,8 +398,6 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
        if (nr_pages > ARRAY_SIZE(frame_list))
                nr_pages = ARRAY_SIZE(frame_list);
-        scratch_page = get_balloon_scratch_page();
        for (i = 0; i < nr_pages; i++) {
                page = alloc_page(gfp);
                if (page == NULL) {
@@ -413,6 +411,12 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                scrub_page(page);
+                /*
+                 * Ballooned out frames are effectively replaced with
+                 * a scratch frame.  Ensure direct mappings and the
+                 * p2m are consistent.
+                 */
+                scratch_page = get_balloon_scratch_page();
 #ifdef CONFIG_XEN_HAVE_PVMMU
                if (xen_pv_domain() && !PageHighMem(page)) {
                        ret = HYPERVISOR_update_va_mapping(
@@ -422,24 +426,19 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                        BUG_ON(ret);
                }
 #endif
-        }
-        /* Ensure that ballooned highmem pages don't have kmaps. */
-        kmap_flush_unused();
-        flush_tlb_all();
-        /* No more mappings: invalidate P2M and add to balloon. */
-        for (i = 0; i < nr_pages; i++) {
-                pfn = mfn_to_pfn(frame_list[i]);
                if (!xen_feature(XENFEAT_auto_translated_physmap)) {
                        unsigned long p;
                        p = page_to_pfn(scratch_page);
                        __set_phys_to_machine(pfn, pfn_to_mfn(p));
                }
+                put_balloon_scratch_page();
                balloon_append(pfn_to_page(pfn));
        }
-        put_balloon_scratch_page();
+        /* Ensure that ballooned highmem pages don't have kmaps. */
+        kmap_flush_unused();
+        flush_tlb_all();
        set_xen_guest_handle(reservation.extent_start, frame_list);
        reservation.nr_extents   = nr_pages;