181 files changed, 2160 insertions, 1236 deletions
diff --git a/Documentation/devicetree/bindings/clock/imx27-clock.txt b/Documentation/devicetree/bindings/clock/imx27-clock.txt
index ab1a56e9de9d..7a2070393732 100644
--- a/Documentation/devicetree/bindings/clock/imx27-clock.txt
+++ b/Documentation/devicetree/bindings/clock/imx27-clock.txt
@@ -98,6 +98,7 @@ clocks and IDs.
        fpm                  83
        mpll_osc_sel         84
        mpll_sel             85
+        spll_gate            86
 Examples:
diff --git a/Documentation/ja_JP/HOWTO b/Documentation/ja_JP/HOWTO
index 050d37fe6d40..8148a47fc70e 100644
--- a/Documentation/ja_JP/HOWTO
+++ b/Documentation/ja_JP/HOWTO
@@ -11,14 +11,14 @@ for non English (read: Japanese) speakers and is not intended as a
 fork. So if you have any comments or updates for this file, please try
 to update the original English file first.
-Last Updated: 2011/03/31
+Last Updated: 2013/07/19
 ==================================
 これは、
-linux-2.6.38/Documentation/HOWTO
+linux-3.10/Documentation/HOWTO
 の和訳です。
-翻訳団体： JF プロジェクト < http://www.linux.or.jp/JF/ >
+翻訳団体： JF プロジェクト < http://linuxjf.sourceforge.jp/ >
-翻訳日： 2011/3/28
+翻訳日： 2013/7/19
 翻訳者： Tsugikazu Shibata <tshibata at ab dot jp dot nec dot com>
 校正者： 松倉さん <nbh--mats at nifty dot com>
         小林 雅典さん (Masanori Kobayasi) <zap03216 at nifty dot ne dot jp>
@@ -245,7 +245,7 @@ Linux カーネルソースツリーの中に含まれる、きれいにし、�
 自己参照方式で、索引がついた web 形式で、ソースコードを参照することが
 できます。この最新の素晴しいカーネルコードのリポジトリは以下で見つかり
 ます-
-        http://sosdg.org/~qiyong/lxr/
+        http://lxr.linux.no/+trees
 開発プロセス
 -----------------------
@@ -253,24 +253,24 @@ Linux カーネルソースツリーの中に含まれる、きれいにし、�
 Linux カーネルの開発プロセスは現在幾つかの異なるメインカーネル「ブラン
 チ」と多数のサブシステム毎のカーネルブランチから構成されます。
 これらのブランチとは-
-  - メインの 2.6.x カーネルツリー
+  - メインの 3.x カーネルツリー
-  - 2.6.x.y -stable カーネルツリー
+  - 3.x.y -stable カーネルツリー
-  - 2.6.x -git カーネルパッチ
+  - 3.x -git カーネルパッチ
  - サブシステム毎のカーネルツリーとパッチ
-  - 統合テストのための 2.6.x -next カーネルツリー
+  - 統合テストのための 3.x -next カーネルツリー
-2.6.x カーネルツリー
+3.x カーネルツリー
 -----------------
-2.6.x カーネルは Linus Torvalds によってメンテナンスされ、kernel.org
+3.x カーネルは Linus Torvalds によってメンテナンスされ、kernel.org
-の pub/linux/kernel/v2.6/ ディレクトリに存在します。この開発プロセスは
+の pub/linux/kernel/v3.x/ ディレクトリに存在します。この開発プロセスは
 以下のとおり-
  - 新しいカーネルがリリースされた直後に、2週間の特別期間が設けられ、
    この期間中に、メンテナ達は Linus に大きな差分を送ることができます。
    このような差分は通常 -next カーネルに数週間含まれてきたパッチです。
    大きな変更は git(カーネルのソース管理ツール、詳細は
-    http://git-scm.com/  参照) を使って送るのが好ましいやり方ですが、パッ
+    http://git-scm.com/ 参照) を使って送るのが好ましいやり方ですが、パッ
    チファイルの形式のまま送るのでも十分です。
  - 2週間後、-rc1 カーネルがリリースされ、この後にはカーネル全体の安定
@@ -302,20 +302,20 @@ Andrew Morton が Linux-kernel メーリングリストにカーネルリリー�
  実に認識されたバグの状況によりリリースされるのであり、前もって決めら
  れた計画によってリリースされるものではないからです。」
-2.6.x.y -stable カーネルツリー
+3.x.y -stable カーネルツリー
 ---------------------------
-バージョン番号が4つの数字に分かれているカーネルは -stable カーネルです。
+バージョン番号が3つの数字に分かれているカーネルは -stable カーネルです。
-これには、2.6.x カーネルで見つかったセキュリティ問題や重大な後戻りに対
+これには、3.x カーネルで見つかったセキュリティ問題や重大な後戻りに対
 する比較的小さい重要な修正が含まれます。
 これは、開発/実験的バージョンのテストに協力することに興味が無く、
 最新の安定したカーネルを使いたいユーザに推奨するブランチです。
-もし、2.6.x.y カーネルが存在しない場合には、番号が一番大きい 2.6.x が
+もし、3.x.y カーネルが存在しない場合には、番号が一番大きい 3.x が
 最新の安定版カーネルです。
-2.6.x.y は "stable" チーム <stable@kernel.org> でメンテされており、必
+3.x.y は "stable" チーム <stable@kernel.org> でメンテされており、必
 要に応じてリリースされます。通常のリリース期間は 2週間毎ですが、差し迫っ
 た問題がなければもう少し長くなることもあります。セキュリティ関連の問題
 の場合はこれに対してだいたいの場合、すぐにリリースがされます。
@@ -324,7 +324,7 @@ Andrew Morton が Linux-kernel メーリングリストにカーネルリリー�
 イルにはどのような種類の変更が -stable ツリーに受け入れ可能か、またリ
 リースプロセスがどう動くかが記述されています。
-2.6.x -git パッチ
+3.x -git パッチ
 ------------------
 git リポジトリで管理されているLinus のカーネルツリーの毎日のスナップ
@@ -358,14 +358,14 @@ quilt シリーズとして公開されているパッチキューも使われ�
 をつけることができます。大部分のこれらの patchwork のサイトは
 http://patchwork.kernel.org/ でリストされています。
-統合テストのための 2.6.x -next カーネルツリー
+統合テストのための 3.x -next カーネルツリー
 ---------------------------------------------
-サブシステムツリーの更新内容がメインラインの 2.6.x ツリーにマージされ
+サブシステムツリーの更新内容がメインラインの 3.x ツリーにマージされ
 る前に、それらは統合テストされる必要があります。この目的のため、実質的
 に全サブシステムツリーからほぼ毎日プルされてできる特別なテスト用のリ
 ポジトリが存在します-
-       http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git
+       http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git
       http://linux.f-seidel.de/linux-next/pmwiki/
 このやり方によって、-next カーネルは次のマージ機会でどんなものがメイン
diff --git a/MAINTAINERS b/MAINTAINERS
index f817ae196a8e..a26b10e52aea 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7818,7 +7818,7 @@ F:	drivers/staging/asus_oled/
 STAGING - COMEDI
 M:      Ian Abbott <abbotti@mev.co.uk>
-M:      Mori Hess <fmhess@users.sourceforge.net>
+M:      H Hartley Sweeten <hsweeten@visionengravers.com>
 S:      Odd Fixes
 F:      drivers/staging/comedi/
diff --git a/Makefile b/Makefile
index a35f72a420c0..95a8e55feceb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 11
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Linux for Workgroups
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index ba412e02ec0c..37c0f4e978d4 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1600,8 +1600,7 @@ config LOCAL_TIMERS
 config ARCH_NR_GPIO
        int
        default 1024 if ARCH_SHMOBILE || ARCH_TEGRA
-        default 512 if SOC_OMAP5
+        default 512 if ARCH_EXYNOS || ARCH_KEYSTONE || SOC_OMAP5
-        default 512 if ARCH_KEYSTONE
        default 392 if ARCH_U8500
        default 352 if ARCH_VT8500
        default 288 if ARCH_SUNXI
diff --git a/arch/arm/boot/dts/atlas6.dtsi b/arch/arm/boot/dts/atlas6.dtsi
index 9866cd736dee..a0f2721ea583 100644
--- a/arch/arm/boot/dts/atlas6.dtsi
+++ b/arch/arm/boot/dts/atlas6.dtsi
@@ -485,6 +485,12 @@
                                                sirf,function = "usp0";
                                        };
                                };
+                                usp0_uart_nostreamctrl_pins_a: usp0@1 {
+                                        usp0 {
+                                                sirf,pins = "usp0_uart_nostreamctrl_grp";
+                                                sirf,function = "usp0_uart_nostreamctrl";
+                                        };
+                                };
                                usp1_pins_a: usp1@0 {
                                        usp1 {
                                                sirf,pins = "usp1grp";
@@ -515,16 +521,16 @@
                                                sirf,function = "pulse_count";
                                        };
                                };
-                                cko0_rst_pins_a: cko0_rst@0 {
+                                cko0_pins_a: cko0@0 {
-                                        cko0_rst {
+                                        cko0 {
-                                                sirf,pins = "cko0_rstgrp";
+                                                sirf,pins = "cko0grp";
-                                                sirf,function = "cko0_rst";
+                                                sirf,function = "cko0";
                                        };
                                };
-                                cko1_rst_pins_a: cko1_rst@0 {
+                                cko1_pins_a: cko1@0 {
-                                        cko1_rst {
+                                        cko1 {
-                                                sirf,pins = "cko1_rstgrp";
+                                                sirf,pins = "cko1grp";
-                                                sirf,function = "cko1_rst";
+                                                sirf,function = "cko1";
                                        };
                                };
                        };
diff --git a/arch/arm/boot/dts/imx28-apx4devkit.dts b/arch/arm/boot/dts/imx28-apx4devkit.dts
index 43bf3c796cba..0e7fed47bd8d 100644
--- a/arch/arm/boot/dts/imx28-apx4devkit.dts
+++ b/arch/arm/boot/dts/imx28-apx4devkit.dts
@@ -147,7 +147,7 @@
                                        reg = <0x0a>;
                                        VDDA-supply = <&reg_3p3v>;
                                        VDDIO-supply = <&reg_3p3v>;
+                                        clocks = <&saif0>;
                                };
                                pcf8563: rtc@51 {
diff --git a/arch/arm/boot/dts/imx28-evk.dts b/arch/arm/boot/dts/imx28-evk.dts
index 1f0d38d7b16f..e035f4664b97 100644
--- a/arch/arm/boot/dts/imx28-evk.dts
+++ b/arch/arm/boot/dts/imx28-evk.dts
@@ -195,7 +195,7 @@
                                        reg = <0x0a>;
                                        VDDA-supply = <&reg_3p3v>;
                                        VDDIO-supply = <&reg_3p3v>;
+                                        clocks = <&saif0>;
                                };
                                at24@51 {
diff --git a/arch/arm/boot/dts/imx28-m28evk.dts b/arch/arm/boot/dts/imx28-m28evk.dts
index 880df2f13be8..44d9da57736e 100644
--- a/arch/arm/boot/dts/imx28-m28evk.dts
+++ b/arch/arm/boot/dts/imx28-m28evk.dts
@@ -184,7 +184,7 @@
                                        reg = <0x0a>;
                                        VDDA-supply = <&reg_3p3v>;
                                        VDDIO-supply = <&reg_3p3v>;
+                                        clocks = <&saif0>;
                                };
                                eeprom: eeprom@51 {
diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
index 6a8acb01b1d3..9524a0571281 100644
--- a/arch/arm/boot/dts/imx28.dtsi
+++ b/arch/arm/boot/dts/imx28.dtsi
@@ -837,6 +837,7 @@
                                compatible = "fsl,imx28-saif";
                                reg = <0x80042000 0x2000>;
                                interrupts = <59 80>;
+                                #clock-cells = <0>;
                                clocks = <&clks 53>;
                                dmas = <&dma_apbx 4>;
                                dma-names = "rx-tx";
diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
index 6dd9486c755b..ad3471ca17c7 100644
--- a/arch/arm/boot/dts/imx51-babbage.dts
+++ b/arch/arm/boot/dts/imx51-babbage.dts
@@ -61,6 +61,16 @@
                mux-int-port = <2>;
                mux-ext-port = <3>;
        };
+        clocks {
+                clk_26M: codec_clock {
+                        compatible = "fixed-clock";
+                        reg=<0>;
+                        #clock-cells = <0>;
+                        clock-frequency = <26000000>;
+                        gpios = <&gpio4 26 1>;
+                };
+        };
 };
 &esdhc1 {
@@ -229,6 +239,7 @@
                                MX51_PAD_EIM_A27__GPIO2_21   0x5
                                MX51_PAD_CSPI1_SS0__GPIO4_24 0x85
                                MX51_PAD_CSPI1_SS1__GPIO4_25 0x85
+                                MX51_PAD_CSPI1_RDY__GPIO4_26 0x80000000
                        >;
                };
        };
@@ -255,7 +266,7 @@
        sgtl5000: codec@0a {
                compatible = "fsl,sgtl5000";
                reg = <0x0a>;
-                clock-frequency = <26000000>;
+                clocks = <&clk_26M>;
                VDDA-supply = <&vdig_reg>;
                VDDIO-supply = <&vvideo_reg>;
        };
diff --git a/arch/arm/boot/dts/imx53-mba53.dts b/arch/arm/boot/dts/imx53-mba53.dts
index aaa33bc99f78..a63090267941 100644
--- a/arch/arm/boot/dts/imx53-mba53.dts
+++ b/arch/arm/boot/dts/imx53-mba53.dts
@@ -27,7 +27,7 @@
        backlight {
                compatible = "pwm-backlight";
-                pwms = <&pwm2 0 50000 0 0>;
+                pwms = <&pwm2 0 50000>;
                brightness-levels = <0 24 28 32 36 40 44 48 52 56 60 64 68 72 76 80 84 88 92 96 100>;
                default-brightness-level = <10>;
                enable-gpios = <&gpio7 7 0>;
diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
index 3895fbba8fce..569aa9f2c4ed 100644
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -725,15 +725,15 @@
                                uart1 {
                                        pinctrl_uart1_1: uart1grp-1 {
                                                fsl,pins = <
-                                                        MX53_PAD_CSI0_DAT10__UART1_TXD_MUX 0x1c5
+                                                        MX53_PAD_CSI0_DAT10__UART1_TXD_MUX 0x1e4
-                                                        MX53_PAD_CSI0_DAT11__UART1_RXD_MUX 0x1c5
+                                                        MX53_PAD_CSI0_DAT11__UART1_RXD_MUX 0x1e4
                                                >;
                                        };
                                        pinctrl_uart1_2: uart1grp-2 {
                                                fsl,pins = <
-                                                        MX53_PAD_PATA_DIOW__UART1_TXD_MUX  0x1c5
+                                                        MX53_PAD_PATA_DIOW__UART1_TXD_MUX  0x1e4
-                                                        MX53_PAD_PATA_DMACK__UART1_RXD_MUX 0x1c5
+                                                        MX53_PAD_PATA_DMACK__UART1_RXD_MUX 0x1e4
                                                >;
                                        };
@@ -748,8 +748,8 @@
                                uart2 {
                                        pinctrl_uart2_1: uart2grp-1 {
                                                fsl,pins = <
-                                                        MX53_PAD_PATA_BUFFER_EN__UART2_RXD_MUX 0x1c5
+                                                        MX53_PAD_PATA_BUFFER_EN__UART2_RXD_MUX 0x1e4
-                                                        MX53_PAD_PATA_DMARQ__UART2_TXD_MUX     0x1c5
+                                                        MX53_PAD_PATA_DMARQ__UART2_TXD_MUX     0x1e4
                                                >;
                                        };
@@ -766,17 +766,17 @@
                                uart3 {
                                        pinctrl_uart3_1: uart3grp-1 {
                                                fsl,pins = <
-                                                        MX53_PAD_PATA_CS_0__UART3_TXD_MUX 0x1c5
+                                                        MX53_PAD_PATA_CS_0__UART3_TXD_MUX 0x1e4
-                                                        MX53_PAD_PATA_CS_1__UART3_RXD_MUX 0x1c5
+                                                        MX53_PAD_PATA_CS_1__UART3_RXD_MUX 0x1e4
-                                                        MX53_PAD_PATA_DA_1__UART3_CTS     0x1c5
+                                                        MX53_PAD_PATA_DA_1__UART3_CTS     0x1e4
-                                                        MX53_PAD_PATA_DA_2__UART3_RTS     0x1c5
+                                                        MX53_PAD_PATA_DA_2__UART3_RTS     0x1e4
                                                >;
                                        };
                                        pinctrl_uart3_2: uart3grp-2 {
                                                fsl,pins = <
-                                                        MX53_PAD_PATA_CS_0__UART3_TXD_MUX 0x1c5
+                                                        MX53_PAD_PATA_CS_0__UART3_TXD_MUX 0x1e4
-                                                        MX53_PAD_PATA_CS_1__UART3_RXD_MUX 0x1c5
+                                                        MX53_PAD_PATA_CS_1__UART3_RXD_MUX 0x1e4
                                                >;
                                        };
@@ -785,8 +785,8 @@
                                uart4 {
                                        pinctrl_uart4_1: uart4grp-1 {
                                                fsl,pins = <
-                                                        MX53_PAD_KEY_COL0__UART4_TXD_MUX 0x1c5
+                                                        MX53_PAD_KEY_COL0__UART4_TXD_MUX 0x1e4
-                                                        MX53_PAD_KEY_ROW0__UART4_RXD_MUX 0x1c5
+                                                        MX53_PAD_KEY_ROW0__UART4_RXD_MUX 0x1e4
                                                >;
                                        };
                                };
@@ -794,8 +794,8 @@
                                uart5 {
                                        pinctrl_uart5_1: uart5grp-1 {
                                                fsl,pins = <
-                                                        MX53_PAD_KEY_COL1__UART5_TXD_MUX 0x1c5
+                                                        MX53_PAD_KEY_COL1__UART5_TXD_MUX 0x1e4
-                                                        MX53_PAD_KEY_ROW1__UART5_RXD_MUX 0x1c5
+                                                        MX53_PAD_KEY_ROW1__UART5_RXD_MUX 0x1e4
                                                >;
                                        };
                                };
diff --git a/arch/arm/boot/dts/prima2.dtsi b/arch/arm/boot/dts/prima2.dtsi
index 05e9489cf95c..bbeb623fc2c6 100644
--- a/arch/arm/boot/dts/prima2.dtsi
+++ b/arch/arm/boot/dts/prima2.dtsi
@@ -515,16 +515,16 @@
                                                sirf,function = "pulse_count";
                                        };
                                };
-                                cko0_rst_pins_a: cko0_rst@0 {
+                                cko0_pins_a: cko0@0 {
-                                        cko0_rst {
+                                        cko0 {
-                                                sirf,pins = "cko0_rstgrp";
+                                                sirf,pins = "cko0grp";
-                                                sirf,function = "cko0_rst";
+                                                sirf,function = "cko0";
                                        };
                                };
-                                cko1_rst_pins_a: cko1_rst@0 {
+                                cko1_pins_a: cko1@0 {
-                                        cko1_rst {
+                                        cko1 {
-                                                sirf,pins = "cko1_rstgrp";
+                                                sirf,pins = "cko1grp";
-                                                sirf,function = "cko1_rst";
+                                                sirf,function = "cko1";
                                        };
                                };
                        };
diff --git a/arch/arm/boot/dts/stih416-pinctrl.dtsi b/arch/arm/boot/dts/stih416-pinctrl.dtsi
index 957b21a71b4b..0f246c979262 100644
--- a/arch/arm/boot/dts/stih416-pinctrl.dtsi
+++ b/arch/arm/boot/dts/stih416-pinctrl.dtsi
@@ -166,6 +166,15 @@
                                reg             = <0x9000 0x100>;
                                st,bank-name    = "PIO31";
                        };
+                        serial2-oe {
+                                pinctrl_serial2_oe: serial2-1 {
+                                        st,pins {
+                                                output-enable   = <&PIO11 3 ALT2 OUT>;
+                                        };
+                                };
+                        };
                };
                pin-controller-rear {
@@ -218,7 +227,6 @@
                                        st,pins {
                                                tx      = <&PIO17 4 ALT2 OUT>;
                                                rx      = <&PIO17 5 ALT2 IN>;
-                                                output-enable   = <&PIO11 3 ALT2 OUT>;
                                        };
                                };
                        };
diff --git a/arch/arm/boot/dts/stih416.dtsi b/arch/arm/boot/dts/stih416.dtsi
index 3cecd9689a49..1a0326ea7d07 100644
--- a/arch/arm/boot/dts/stih416.dtsi
+++ b/arch/arm/boot/dts/stih416.dtsi
@@ -79,7 +79,7 @@
                        interrupts      = <0 197 0>;
                        clocks          = <&CLK_S_ICN_REG_0>;
                        pinctrl-names   = "default";
-                        pinctrl-0       = <&pinctrl_serial2>;
+                        pinctrl-0       = <&pinctrl_serial2 &pinctrl_serial2_oe>;
                };
                /* SBC_UART1 */
diff --git a/arch/arm/boot/dts/twl4030.dtsi b/arch/arm/boot/dts/twl4030.dtsi
index b3034da00a37..ae6a17aed9ee 100644
--- a/arch/arm/boot/dts/twl4030.dtsi
+++ b/arch/arm/boot/dts/twl4030.dtsi
@@ -47,6 +47,12 @@
                regulator-max-microvolt = <3150000>;
        };
+        vmmc2: regulator-vmmc2 {
+                compatible = "ti,twl4030-vmmc2";
+                regulator-min-microvolt = <1850000>;
+                regulator-max-microvolt = <3150000>;
+        };
        vusb1v5: regulator-vusb1v5 {
                compatible = "ti,twl4030-vusb1v5";
        };
diff --git a/arch/arm/boot/dts/vf610.dtsi b/arch/arm/boot/dts/vf610.dtsi
index e1eb7dadda80..67d929cf9804 100644
--- a/arch/arm/boot/dts/vf610.dtsi
+++ b/arch/arm/boot/dts/vf610.dtsi
@@ -442,8 +442,8 @@
                                compatible = "fsl,mvf600-fec";
                                reg = <0x400d0000 0x1000>;
                                interrupts = <0 78 0x04>;
-                                clocks = <&clks VF610_CLK_ENET>,
+                                clocks = <&clks VF610_CLK_ENET0>,
-                                        <&clks VF610_CLK_ENET>,
+                                        <&clks VF610_CLK_ENET0>,
                                        <&clks VF610_CLK_ENET>;
                                clock-names = "ipg", "ahb", "ptp";
                                status = "disabled";
@@ -453,8 +453,8 @@
                                compatible = "fsl,mvf600-fec";
                                reg = <0x400d1000 0x1000>;
                                interrupts = <0 79 0x04>;
-                                clocks = <&clks VF610_CLK_ENET>,
+                                clocks = <&clks VF610_CLK_ENET1>,
-                                        <&clks VF610_CLK_ENET>,
+                                        <&clks VF610_CLK_ENET1>,
                                        <&clks VF610_CLK_ENET>;
                                clock-names = "ipg", "ahb", "ptp";
                                status = "disabled";
diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
index a432e6c1dac1..39ad030ac0c7 100644
--- a/arch/arm/common/edma.c
+++ b/arch/arm/common/edma.c
@@ -26,7 +26,6 @@
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/edma.h>
-#include <linux/err.h>
 #include <linux/of_address.h>
 #include <linux/of_device.h>
 #include <linux/of_dma.h>
diff --git a/arch/arm/configs/da8xx_omapl_defconfig b/arch/arm/configs/da8xx_omapl_defconfig
index 7c868139bdb0..1571bea48bed 100644
--- a/arch/arm/configs/da8xx_omapl_defconfig
+++ b/arch/arm/configs/da8xx_omapl_defconfig
@@ -102,6 +102,8 @@ CONFIG_SND_SOC=m
 CONFIG_SND_DAVINCI_SOC=m
 # CONFIG_HID_SUPPORT is not set
 # CONFIG_USB_SUPPORT is not set
+CONFIG_DMADEVICES=y
+CONFIG_TI_EDMA=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_XFS_FS=m
diff --git a/arch/arm/configs/davinci_all_defconfig b/arch/arm/configs/davinci_all_defconfig
index c86fd75e181a..ab2f7378352c 100644
--- a/arch/arm/configs/davinci_all_defconfig
+++ b/arch/arm/configs/davinci_all_defconfig
@@ -162,6 +162,8 @@ CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=m
 CONFIG_LEDS_TRIGGER_HEARTBEAT=m
 CONFIG_RTC_CLASS=y
+CONFIG_DMADEVICES=y
+CONFIG_TI_EDMA=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_XFS_FS=m
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index fe0bdc361d2c..6e572c64cf5a 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -53,6 +53,7 @@ CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_OMAP_OCP2SCP=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_ATA=y
 CONFIG_SATA_AHCI_PLATFORM=y
@@ -61,6 +62,7 @@ CONFIG_SATA_MV=y
 CONFIG_NETDEVICES=y
 CONFIG_SUN4I_EMAC=y
 CONFIG_NET_CALXEDA_XGMAC=y
+CONFIG_KS8851=y
 CONFIG_SMSC911X=y
 CONFIG_STMMAC_ETH=y
 CONFIG_MDIO_SUN4I=y
@@ -89,6 +91,7 @@ CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_SIRF=y
 CONFIG_I2C_TEGRA=y
 CONFIG_SPI=y
+CONFIG_SPI_OMAP24XX=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_SIRF=y
 CONFIG_SPI_TEGRA114=y
@@ -111,11 +114,12 @@ CONFIG_FB_SIMPLE=y
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_EHCI_MXC=y
 CONFIG_USB_EHCI_TEGRA=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
 CONFIG_USB_ISP1760_HCD=y
 CONFIG_USB_STORAGE=y
+CONFIG_USB_CHIPIDEA=y
+CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_AB8500_USB=y
 CONFIG_NOP_USB_XCEIV=y
 CONFIG_OMAP_USB2=y
diff --git a/arch/arm/configs/nhk8815_defconfig b/arch/arm/configs/nhk8815_defconfig
index 35f8cf299fa2..263ae3869e32 100644
--- a/arch/arm/configs/nhk8815_defconfig
+++ b/arch/arm/configs/nhk8815_defconfig
@@ -1,6 +1,8 @@
 # CONFIG_LOCALVERSION_AUTO is not set
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
@@ -48,7 +50,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_MTD=y
 CONFIG_MTD_TESTS=m
 CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_NAND_ECC_SMC=y
 CONFIG_MTD_NAND=y
@@ -94,8 +95,10 @@ CONFIG_I2C_GPIO=y
 CONFIG_I2C_NOMADIK=y
 CONFIG_DEBUG_GPIO=y
 # CONFIG_HWMON is not set
+CONFIG_REGULATOR=y
 CONFIG_MMC=y
-CONFIG_MMC_CLKGATE=y
+CONFIG_MMC_UNSAFE_RESUME=y
+# CONFIG_MMC_BLOCK_BOUNCE is not set
 CONFIG_MMC_ARMMMCI=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c
index afbc439f11d4..4cdb61c54459 100644
--- a/arch/arm/mach-davinci/board-dm365-evm.c
+++ b/arch/arm/mach-davinci/board-dm365-evm.c
@@ -505,7 +505,7 @@ static struct vpbe_output dm365evm_vpbe_outputs[] = {
 /*
 * Amplifiers on the board
 */
-struct ths7303_platform_data ths7303_pdata = {
+static struct ths7303_platform_data ths7303_pdata = {
        .ch_1 = 3,
        .ch_2 = 3,
        .ch_3 = 3,
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index 42ef53f62c6c..86100d179694 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -860,7 +860,7 @@ static struct platform_device dm355_vpbe_display = {
        },
 };
-struct venc_platform_data dm355_venc_pdata = {
+static struct venc_platform_data dm355_venc_pdata = {
        .setup_pinmux   = dm355_vpbe_setup_pinmux,
        .setup_clock    = dm355_venc_setup_clock,
 };
diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
index fa7af5eda52d..dad28029ba9b 100644
--- a/arch/arm/mach-davinci/dm365.c
+++ b/arch/arm/mach-davinci/dm365.c
@@ -1349,7 +1349,7 @@ static struct platform_device dm365_vpbe_display = {
        },
 };
-struct venc_platform_data dm365_venc_pdata = {
+static struct venc_platform_data dm365_venc_pdata = {
        .setup_pinmux   = dm365_vpbe_setup_pinmux,
        .setup_clock    = dm365_venc_setup_clock,
 };
diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
index 855d4a7b462d..5952e68c76c4 100644
--- a/arch/arm/mach-exynos/Kconfig
+++ b/arch/arm/mach-exynos/Kconfig
@@ -92,6 +92,7 @@ config SOC_EXYNOS5440
        bool "SAMSUNG EXYNOS5440"
        default y
        depends on ARCH_EXYNOS5
+        select ARCH_DMA_ADDR_T_64BIT if ARM_LPAE
        select ARCH_HAS_OPP
        select HAVE_ARM_ARCH_TIMER
        select AUTO_ZRELADDR
diff --git a/arch/arm/mach-exynos/Makefile b/arch/arm/mach-exynos/Makefile
index e970a7a4e278..53696154aead 100644
--- a/arch/arm/mach-exynos/Makefile
+++ b/arch/arm/mach-exynos/Makefile
@@ -14,7 +14,7 @@ obj-				:=
 obj-$(CONFIG_ARCH_EXYNOS)       += common.o
-obj-$(CONFIG_PM)                += pm.o
+obj-$(CONFIG_S5P_PM)            += pm.o
 obj-$(CONFIG_PM_GENERIC_DOMAINS) += pm_domains.o
 obj-$(CONFIG_CPU_IDLE)          += cpuidle.o
diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
index 164685bd25c8..ba95e5db2501 100644
--- a/arch/arm/mach-exynos/common.c
+++ b/arch/arm/mach-exynos/common.c
@@ -58,7 +58,6 @@ static const char name_exynos5440[] = "EXYNOS5440";
 static void exynos4_map_io(void);
 static void exynos5_map_io(void);
-static void exynos5440_map_io(void);
 static int exynos_init(void);
 static struct cpu_table cpu_ids[] __initdata = {
@@ -95,7 +94,6 @@ static struct cpu_table cpu_ids[] __initdata = {
        }, {
                .idcode         = EXYNOS5440_SOC_ID,
                .idmask         = EXYNOS5_SOC_MASK,
-                .map_io         = exynos5440_map_io,
                .init           = exynos_init,
                .name           = name_exynos5440,
        },
@@ -150,11 +148,6 @@ static struct map_desc exynos4_iodesc[] __initdata = {
                .length         = SZ_64K,
                .type           = MT_DEVICE,
        }, {
-                .virtual        = (unsigned long)S3C_VA_UART,
-                .pfn            = __phys_to_pfn(EXYNOS4_PA_UART),
-                .length         = SZ_512K,
-                .type           = MT_DEVICE,
-        }, {
                .virtual        = (unsigned long)S5P_VA_CMU,
                .pfn            = __phys_to_pfn(EXYNOS4_PA_CMU),
                .length         = SZ_128K,
@@ -268,20 +261,6 @@ static struct map_desc exynos5_iodesc[] __initdata = {
                .pfn            = __phys_to_pfn(EXYNOS5_PA_PMU),
                .length         = SZ_64K,
                .type           = MT_DEVICE,
-        }, {
-                .virtual        = (unsigned long)S3C_VA_UART,
-                .pfn            = __phys_to_pfn(EXYNOS5_PA_UART),
-                .length         = SZ_512K,
-                .type           = MT_DEVICE,
-        },
-};
-static struct map_desc exynos5440_iodesc0[] __initdata = {
-        {
-                .virtual        = (unsigned long)S3C_VA_UART,
-                .pfn            = __phys_to_pfn(EXYNOS5440_PA_UART0),
-                .length         = SZ_512K,
-                .type           = MT_DEVICE,
        },
 };
@@ -388,11 +367,6 @@ static void __init exynos5_map_io(void)
                iotable_init(exynos5250_iodesc, ARRAY_SIZE(exynos5250_iodesc));
 }
-static void __init exynos5440_map_io(void)
-{
-        iotable_init(exynos5440_iodesc0, ARRAY_SIZE(exynos5440_iodesc0));
-}
 void __init exynos_init_time(void)
 {
        of_clk_init(NULL);
diff --git a/arch/arm/mach-exynos/common.h b/arch/arm/mach-exynos/common.h
index 3e156bcddcb4..972490fc09d6 100644
--- a/arch/arm/mach-exynos/common.h
+++ b/arch/arm/mach-exynos/common.h
@@ -97,6 +97,5 @@ struct exynos_pmu_conf {
 };
 extern void exynos_sys_powerdown_conf(enum sys_powerdown mode);
-extern void s3c_cpu_resume(void);
 #endif /* __ARCH_ARM_MACH_EXYNOS_COMMON_H */
diff --git a/arch/arm/mach-exynos/cpuidle.c b/arch/arm/mach-exynos/cpuidle.c
index 17a18ff3d71e..225ee8431c72 100644
--- a/arch/arm/mach-exynos/cpuidle.c
+++ b/arch/arm/mach-exynos/cpuidle.c
@@ -25,6 +25,7 @@
 #include <mach/regs-pmu.h>
 #include <plat/cpu.h>
+#include <plat/pm.h>
 #include "common.h"
diff --git a/arch/arm/mach-exynos/include/mach/memory.h b/arch/arm/mach-exynos/include/mach/memory.h
index 374ef2cf7152..2a4cdb7cb326 100644
--- a/arch/arm/mach-exynos/include/mach/memory.h
+++ b/arch/arm/mach-exynos/include/mach/memory.h
@@ -15,8 +15,13 @@
 #define PLAT_PHYS_OFFSET                UL(0x40000000)
+#ifndef CONFIG_ARM_LPAE
 /* Maximum of 256MiB in one bank */
 #define MAX_PHYSMEM_BITS        32
 #define SECTION_SIZE_BITS       28
+#else
+#define MAX_PHYSMEM_BITS        36
+#define SECTION_SIZE_BITS       31
+#endif
 #endif /* __ASM_ARCH_MEMORY_H */
diff --git a/arch/arm/mach-exynos/pm.c b/arch/arm/mach-exynos/pm.c
index 41c20692a13f..c679db577269 100644
--- a/arch/arm/mach-exynos/pm.c
+++ b/arch/arm/mach-exynos/pm.c
@@ -217,6 +217,9 @@ static __init int exynos_pm_drvinit(void)
        struct clk *pll_base;
        unsigned int tmp;
+        if (soc_is_exynos5440())
+                return 0;
        s3c_pm_init();
        /* All wakeup disable */
@@ -340,6 +343,9 @@ static struct syscore_ops exynos_pm_syscore_ops = {
 static __init int exynos_pm_syscore_init(void)
 {
+        if (soc_is_exynos5440())
+                return 0;
        register_syscore_ops(&exynos_pm_syscore_ops);
        return 0;
 }
diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
index a7cd2cf5e08d..3490a24f969e 100644
--- a/arch/arm/mach-footbridge/dc21285.c
+++ b/arch/arm/mach-footbridge/dc21285.c
@@ -276,8 +276,6 @@ int __init dc21285_setup(int nr, struct pci_sys_data *sys)
        sys->mem_offset  = DC21285_PCI_MEM;
-        pci_ioremap_io(0, DC21285_PCI_IO);
        pci_add_resource_offset(&sys->resources, &res[0], sys->mem_offset);
        pci_add_resource_offset(&sys->resources, &res[1], sys->mem_offset);
diff --git a/arch/arm/mach-highbank/highbank.c b/arch/arm/mach-highbank/highbank.c
index dc5d6becd8c7..88815795fe26 100644
--- a/arch/arm/mach-highbank/highbank.c
+++ b/arch/arm/mach-highbank/highbank.c
@@ -115,6 +115,7 @@ static int highbank_platform_notifier(struct notifier_block *nb,
 {
        struct resource *res;
        int reg = -1;
+        u32 val;
        struct device *dev = __dev;
        if (event != BUS_NOTIFY_ADD_DEVICE)
@@ -141,10 +142,10 @@ static int highbank_platform_notifier(struct notifier_block *nb,
                return NOTIFY_DONE;
        if (of_property_read_bool(dev->of_node, "dma-coherent")) {
-                writel(0xff31, sregs_base + reg);
+                val = readl(sregs_base + reg);
+                writel(val | 0xff01, sregs_base + reg);
                set_dma_ops(dev, &arm_coherent_dma_ops);
-        } else
+        }
-                writel(0, sregs_base + reg);
        return NOTIFY_OK;
 }
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 4282e99f5ca1..86567d980b07 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -199,7 +199,8 @@ static const char *pcie_axi_sels[]	= { "axi", "ahb", };
 static const char *ssi_sels[]           = { "pll3_pfd2_508m", "pll3_pfd3_454m", "pll4_post_div", };
 static const char *usdhc_sels[] = { "pll2_pfd2_396m", "pll2_pfd0_352m", };
 static const char *enfc_sels[]  = { "pll2_pfd0_352m", "pll2_bus", "pll3_usb_otg", "pll2_pfd2_396m", };
-static const char *emi_sels[]           = { "axi", "pll3_usb_otg", "pll2_pfd2_396m", "pll2_pfd0_352m", };
+static const char *emi_sels[]           = { "pll2_pfd2_396m", "pll3_usb_otg", "axi", "pll2_pfd0_352m", };
+static const char *emi_slow_sels[]      = { "axi", "pll3_usb_otg", "pll2_pfd2_396m", "pll2_pfd0_352m", };
 static const char *vdo_axi_sels[]       = { "axi", "ahb", };
 static const char *vpu_axi_sels[]       = { "axi", "pll2_pfd2_396m", "pll2_pfd0_352m", };
 static const char *cko1_sels[]  = { "pll3_usb_otg", "pll2_bus", "pll1_sys", "pll5_video_div",
@@ -392,7 +393,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
        clk[usdhc4_sel]       = imx_clk_mux("usdhc4_sel",       base + 0x1c, 19, 1, usdhc_sels,        ARRAY_SIZE(usdhc_sels));
        clk[enfc_sel]         = imx_clk_mux("enfc_sel",         base + 0x2c, 16, 2, enfc_sels,         ARRAY_SIZE(enfc_sels));
        clk[emi_sel]          = imx_clk_mux("emi_sel",          base + 0x1c, 27, 2, emi_sels,          ARRAY_SIZE(emi_sels));
-        clk[emi_slow_sel]     = imx_clk_mux("emi_slow_sel",     base + 0x1c, 29, 2, emi_sels,          ARRAY_SIZE(emi_sels));
+        clk[emi_slow_sel]     = imx_clk_mux("emi_slow_sel",     base + 0x1c, 29, 2, emi_slow_sels,     ARRAY_SIZE(emi_slow_sels));
        clk[vdo_axi_sel]      = imx_clk_mux("vdo_axi_sel",      base + 0x18, 11, 1, vdo_axi_sels,      ARRAY_SIZE(vdo_axi_sels));
        clk[vpu_axi_sel]      = imx_clk_mux("vpu_axi_sel",      base + 0x18, 14, 2, vpu_axi_sels,      ARRAY_SIZE(vpu_axi_sels));
        clk[cko1_sel]         = imx_clk_mux("cko1_sel",         base + 0x60, 0,  4, cko1_sels,         ARRAY_SIZE(cko1_sels));
diff --git a/arch/arm/mach-imx/clk-vf610.c b/arch/arm/mach-imx/clk-vf610.c
index d617c0b7c809..b169a396d93b 100644
--- a/arch/arm/mach-imx/clk-vf610.c
+++ b/arch/arm/mach-imx/clk-vf610.c
@@ -183,6 +183,8 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
        clk[VF610_CLK_ENET_TS_SEL] = imx_clk_mux("enet_ts_sel", CCM_CSCMR2, 0, 3, enet_ts_sels, 7);
        clk[VF610_CLK_ENET] = imx_clk_gate("enet", "enet_sel", CCM_CSCDR1, 24);
        clk[VF610_CLK_ENET_TS] = imx_clk_gate("enet_ts", "enet_ts_sel", CCM_CSCDR1, 23);
+        clk[VF610_CLK_ENET0] = imx_clk_gate2("enet0", "ipg_bus", CCM_CCGR9, CCM_CCGRx_CGn(0));
+        clk[VF610_CLK_ENET1] = imx_clk_gate2("enet1", "ipg_bus", CCM_CCGR9, CCM_CCGRx_CGn(1));
        clk[VF610_CLK_PIT] = imx_clk_gate2("pit", "ipg_bus", CCM_CCGR1, CCM_CCGRx_CGn(7));
diff --git a/arch/arm/mach-imx/mx27.h b/arch/arm/mach-imx/mx27.h
index e074616d54ca..8a65f192e7f3 100644
--- a/arch/arm/mach-imx/mx27.h
+++ b/arch/arm/mach-imx/mx27.h
@@ -135,7 +135,7 @@
 #define MX27_INT_GPT4           (NR_IRQS_LEGACY + 4)
 #define MX27_INT_RTIC           (NR_IRQS_LEGACY + 5)
 #define MX27_INT_CSPI3          (NR_IRQS_LEGACY + 6)
-#define MX27_INT_SDHC           (NR_IRQS_LEGACY + 7)
+#define MX27_INT_MSHC           (NR_IRQS_LEGACY + 7)
 #define MX27_INT_GPIO           (NR_IRQS_LEGACY + 8)
 #define MX27_INT_SDHC3          (NR_IRQS_LEGACY + 9)
 #define MX27_INT_SDHC2          (NR_IRQS_LEGACY + 10)
diff --git a/arch/arm/mach-keystone/keystone.c b/arch/arm/mach-keystone/keystone.c
index fe4d9ff93a7e..b661c5c2870a 100644
--- a/arch/arm/mach-keystone/keystone.c
+++ b/arch/arm/mach-keystone/keystone.c
@@ -49,7 +49,7 @@ static const char *keystone_match[] __initconst = {
        NULL,
 };
-void keystone_restart(char mode, const char *cmd)
+void keystone_restart(enum reboot_mode mode, const char *cmd)
 {
        u32 val;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 627fa7e41fba..3eed0006d189 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -62,7 +62,7 @@ config SOC_OMAP5
        select HAVE_SMP
        select COMMON_CLK
        select HAVE_ARM_ARCH_TIMER
-        select ARM_ERRATA_798181
+        select ARM_ERRATA_798181 if SMP
 config SOC_AM33XX
        bool "AM33XX support"
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index e5fbfed69aa2..be5d005ebad2 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -15,6 +15,7 @@
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
 #include <linux/irqdomain.h>
+#include <linux/clk.h>
 #include <asm/mach/arch.h>
@@ -35,6 +36,21 @@ static struct of_device_id omap_dt_match_table[] __initdata = {
        { }
 };
+/*
+ * Create alias for USB host PHY clock.
+ * Remove this when clock phandle can be provided via DT
+ */
+static void __init legacy_init_ehci_clk(char *clkname)
+{
+        int ret;
+        ret = clk_add_alias("main_clk", NULL, clkname, NULL);
+        if (ret) {
+                pr_err("%s:Failed to add main_clk alias to %s :%d\n",
+                                                __func__, clkname, ret);
+        }
+}
 static void __init omap_generic_init(void)
 {
        omap_sdrc_init(NULL, NULL);
@@ -45,10 +61,15 @@ static void __init omap_generic_init(void)
         * HACK: call display setup code for selected boards to enable omapdss.
         * This will be removed when omapdss supports DT.
         */
-        if (of_machine_is_compatible("ti,omap4-panda"))
+        if (of_machine_is_compatible("ti,omap4-panda")) {
                omap4_panda_display_init_of();
+                legacy_init_ehci_clk("auxclk3_ck");
+        }
        else if (of_machine_is_compatible("ti,omap4-sdp"))
                omap_4430sdp_display_init_of();
+        else if (of_machine_is_compatible("ti,omap5-uevm"))
+                legacy_init_ehci_clk("auxclk1_ck");
 }
 #ifdef CONFIG_SOC_OMAP2420
diff --git a/arch/arm/mach-pxa/em-x270.c b/arch/arm/mach-pxa/em-x270.c
index f6726bb4eb95..3a3362fa793e 100644
--- a/arch/arm/mach-pxa/em-x270.c
+++ b/arch/arm/mach-pxa/em-x270.c
@@ -477,16 +477,24 @@ static int em_x270_usb_hub_init(void)
        /* USB Hub power-on and reset */
        gpio_direction_output(usb_hub_reset, 1);
        gpio_direction_output(GPIO9_USB_VBUS_EN, 0);
-        regulator_enable(em_x270_usb_ldo);
+        err = regulator_enable(em_x270_usb_ldo);
+        if (err)
+                goto err_free_rst_gpio;
        gpio_set_value(usb_hub_reset, 0);
        gpio_set_value(usb_hub_reset, 1);
        regulator_disable(em_x270_usb_ldo);
-        regulator_enable(em_x270_usb_ldo);
+        err = regulator_enable(em_x270_usb_ldo);
+        if (err)
+                goto err_free_rst_gpio;
        gpio_set_value(usb_hub_reset, 0);
        gpio_set_value(GPIO9_USB_VBUS_EN, 1);
        return 0;
+err_free_rst_gpio:
+        gpio_free(usb_hub_reset);
 err_free_vbus_gpio:
        gpio_free(GPIO9_USB_VBUS_EN);
 err_free_usb_ldo:
@@ -592,7 +600,7 @@ err_irq:
        return err;
 }
-static void em_x270_mci_setpower(struct device *dev, unsigned int vdd)
+static int em_x270_mci_setpower(struct device *dev, unsigned int vdd)
 {
        struct pxamci_platform_data* p_d = dev->platform_data;
@@ -600,10 +608,11 @@ static void em_x270_mci_setpower(struct device *dev, unsigned int vdd)
                int vdd_uV = (2000 + (vdd - __ffs(MMC_VDD_20_21)) * 100) * 1000;
                regulator_set_voltage(em_x270_sdio_ldo, vdd_uV, vdd_uV);
-                regulator_enable(em_x270_sdio_ldo);
+                return regulator_enable(em_x270_sdio_ldo);
        } else {
                regulator_disable(em_x270_sdio_ldo);
        }
+        return 0;
 }
 static void em_x270_mci_exit(struct device *dev, void *data)
diff --git a/arch/arm/mach-pxa/mainstone.c b/arch/arm/mach-pxa/mainstone.c
index d2c652318376..dd70343c8708 100644
--- a/arch/arm/mach-pxa/mainstone.c
+++ b/arch/arm/mach-pxa/mainstone.c
@@ -408,7 +408,7 @@ static int mainstone_mci_init(struct device *dev, irq_handler_t mstone_detect_in
        return err;
 }
-static void mainstone_mci_setpower(struct device *dev, unsigned int vdd)
+static int mainstone_mci_setpower(struct device *dev, unsigned int vdd)
 {
        struct pxamci_platform_data* p_d = dev->platform_data;
@@ -420,6 +420,7 @@ static void mainstone_mci_setpower(struct device *dev, unsigned int vdd)
                printk(KERN_DEBUG "%s: off\n", __func__);
                MST_MSCWR1 &= ~MST_MSCWR1_MMC_ON;
        }
+        return 0;
 }
 static void mainstone_mci_exit(struct device *dev, void *data)
diff --git a/arch/arm/mach-pxa/pcm990-baseboard.c b/arch/arm/mach-pxa/pcm990-baseboard.c
index fb7f1d1627dc..13e5b00eae90 100644
--- a/arch/arm/mach-pxa/pcm990-baseboard.c
+++ b/arch/arm/mach-pxa/pcm990-baseboard.c
@@ -335,7 +335,7 @@ static int pcm990_mci_init(struct device *dev, irq_handler_t mci_detect_int,
        return err;
 }
-static void pcm990_mci_setpower(struct device *dev, unsigned int vdd)
+static int pcm990_mci_setpower(struct device *dev, unsigned int vdd)
 {
        struct pxamci_platform_data *p_d = dev->platform_data;
        u8 val;
@@ -348,6 +348,7 @@ static void pcm990_mci_setpower(struct device *dev, unsigned int vdd)
                val &= ~PCM990_CTRL_MMC2PWR;
        pcm990_cpld_writeb(PCM990_CTRL_MMC2PWR, PCM990_CTRL_REG5);
+        return 0;
 }
 static void pcm990_mci_exit(struct device *dev, void *data)
diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c
index 711d37e26bd8..aedf053a1de5 100644
--- a/arch/arm/mach-pxa/poodle.c
+++ b/arch/arm/mach-pxa/poodle.c
@@ -258,7 +258,7 @@ err_free_2:
        return err;
 }
-static void poodle_mci_setpower(struct device *dev, unsigned int vdd)
+static int poodle_mci_setpower(struct device *dev, unsigned int vdd)
 {
        struct pxamci_platform_data* p_d = dev->platform_data;
@@ -270,6 +270,8 @@ static void poodle_mci_setpower(struct device *dev, unsigned int vdd)
                gpio_set_value(POODLE_GPIO_SD_PWR1, 0);
                gpio_set_value(POODLE_GPIO_SD_PWR, 0);
        }
+        return 0;
 }
 static void poodle_mci_exit(struct device *dev, void *data)
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index 2125df0444e7..4c29173026e8 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -598,7 +598,7 @@ static inline void spitz_spi_init(void) {}
 * NOTE: The card detect interrupt isn't debounced so we delay it by 250ms to
 * give the card a chance to fully insert/eject.
 */
-static void spitz_mci_setpower(struct device *dev, unsigned int vdd)
+static int spitz_mci_setpower(struct device *dev, unsigned int vdd)
 {
        struct pxamci_platform_data* p_d = dev->platform_data;
@@ -606,6 +606,8 @@ static void spitz_mci_setpower(struct device *dev, unsigned int vdd)
                spitz_card_pwr_ctrl(SCOOP_CPR_SD_3V, SCOOP_CPR_SD_3V);
        else
                spitz_card_pwr_ctrl(SCOOP_CPR_SD_3V, 0x0);
+        return 0;
 }
 static struct pxamci_platform_data spitz_mci_platform_data = {
diff --git a/arch/arm/mach-pxa/stargate2.c b/arch/arm/mach-pxa/stargate2.c
index 88fde43c948c..62aea3e835f3 100644
--- a/arch/arm/mach-pxa/stargate2.c
+++ b/arch/arm/mach-pxa/stargate2.c
@@ -734,9 +734,10 @@ static int stargate2_mci_init(struct device *dev,
 *
 * Very simple control. Either it is on or off and is controlled by
 * a gpio pin */
-static void stargate2_mci_setpower(struct device *dev, unsigned int vdd)
+static int stargate2_mci_setpower(struct device *dev, unsigned int vdd)
 {
        gpio_set_value(SG2_SD_POWER_ENABLE, !!vdd);
+        return 0;
 }
 static void stargate2_mci_exit(struct device *dev, void *data)
diff --git a/arch/arm/mach-s3c24xx/clock-s3c2410.c b/arch/arm/mach-s3c24xx/clock-s3c2410.c
index 34fffdf6fc1d..564553694b54 100644
--- a/arch/arm/mach-s3c24xx/clock-s3c2410.c
+++ b/arch/arm/mach-s3c24xx/clock-s3c2410.c
@@ -119,66 +119,101 @@ static struct clk init_clocks_off[] = {
        }
 };
-static struct clk init_clocks[] = {
+static struct clk clk_lcd = {
-        {
+        .name           = "lcd",
-                .name           = "lcd",
+        .parent         = &clk_h,
-                .parent         = &clk_h,
+        .enable         = s3c2410_clkcon_enable,
-                .enable         = s3c2410_clkcon_enable,
+        .ctrlbit        = S3C2410_CLKCON_LCDC,
-                .ctrlbit        = S3C2410_CLKCON_LCDC,
+};
-        }, {
-                .name           = "gpio",
+static struct clk clk_gpio = {
-                .parent         = &clk_p,
+        .name           = "gpio",
-                .enable         = s3c2410_clkcon_enable,
+        .parent         = &clk_p,
-                .ctrlbit        = S3C2410_CLKCON_GPIO,
+        .enable         = s3c2410_clkcon_enable,
-        }, {
+        .ctrlbit        = S3C2410_CLKCON_GPIO,
-                .name           = "usb-host",
+};
-                .parent         = &clk_h,
-                .enable         = s3c2410_clkcon_enable,
+static struct clk clk_usb_host = {
-                .ctrlbit        = S3C2410_CLKCON_USBH,
+        .name           = "usb-host",
-        }, {
+        .parent         = &clk_h,
-                .name           = "usb-device",
+        .enable         = s3c2410_clkcon_enable,
-                .parent         = &clk_h,
+        .ctrlbit        = S3C2410_CLKCON_USBH,
-                .enable         = s3c2410_clkcon_enable,
+};
-                .ctrlbit        = S3C2410_CLKCON_USBD,
-        }, {
+static struct clk clk_usb_device = {
-                .name           = "timers",
+        .name           = "usb-device",
-                .parent         = &clk_p,
+        .parent         = &clk_h,
-                .enable         = s3c2410_clkcon_enable,
+        .enable         = s3c2410_clkcon_enable,
-                .ctrlbit        = S3C2410_CLKCON_PWMT,
+        .ctrlbit        = S3C2410_CLKCON_USBD,
-        }, {
+};
-                .name           = "uart",
-                .devname        = "s3c2410-uart.0",
+static struct clk clk_timers = {
-                .parent         = &clk_p,
+        .name           = "timers",
-                .enable         = s3c2410_clkcon_enable,
+        .parent         = &clk_p,
-                .ctrlbit        = S3C2410_CLKCON_UART0,
+        .enable         = s3c2410_clkcon_enable,
-        }, {
+        .ctrlbit        = S3C2410_CLKCON_PWMT,
-                .name           = "uart",
+};
-                .devname        = "s3c2410-uart.1",
-                .parent         = &clk_p,
+struct clk s3c24xx_clk_uart0 = {
-                .enable         = s3c2410_clkcon_enable,
+        .name           = "uart",
-                .ctrlbit        = S3C2410_CLKCON_UART1,
+        .devname        = "s3c2410-uart.0",
-        }, {
+        .parent         = &clk_p,
-                .name           = "uart",
+        .enable         = s3c2410_clkcon_enable,
-                .devname        = "s3c2410-uart.2",
+        .ctrlbit        = S3C2410_CLKCON_UART0,
-                .parent         = &clk_p,
+};
-                .enable         = s3c2410_clkcon_enable,
-                .ctrlbit        = S3C2410_CLKCON_UART2,
+struct clk s3c24xx_clk_uart1 = {
-        }, {
+        .name           = "uart",
-                .name           = "rtc",
+        .devname        = "s3c2410-uart.1",
-                .parent         = &clk_p,
+        .parent         = &clk_p,
-                .enable         = s3c2410_clkcon_enable,
+        .enable         = s3c2410_clkcon_enable,
-                .ctrlbit        = S3C2410_CLKCON_RTC,
+        .ctrlbit        = S3C2410_CLKCON_UART1,
-        }, {
+};
-                .name           = "watchdog",
-                .parent         = &clk_p,
+struct clk s3c24xx_clk_uart2 = {
-                .ctrlbit        = 0,
+        .name           = "uart",
-        }, {
+        .devname        = "s3c2410-uart.2",
-                .name           = "usb-bus-host",
+        .parent         = &clk_p,
-                .parent         = &clk_usb_bus,
+        .enable         = s3c2410_clkcon_enable,
-        }, {
+        .ctrlbit        = S3C2410_CLKCON_UART2,
-                .name           = "usb-bus-gadget",
+};
-                .parent         = &clk_usb_bus,
-        },
+static struct clk clk_rtc = {
+        .name           = "rtc",
+        .parent         = &clk_p,
+        .enable         = s3c2410_clkcon_enable,
+        .ctrlbit        = S3C2410_CLKCON_RTC,
+};
+static struct clk clk_watchdog = {
+        .name           = "watchdog",
+        .parent         = &clk_p,
+        .ctrlbit        = 0,
+};
+static struct clk clk_usb_bus_host = {
+        .name           = "usb-bus-host",
+        .parent         = &clk_usb_bus,
+};
+static struct clk clk_usb_bus_gadget = {
+        .name           = "usb-bus-gadget",
+        .parent         = &clk_usb_bus,
+};
+static struct clk *init_clocks[] = {
+        &clk_lcd,
+        &clk_gpio,
+        &clk_usb_host,
+        &clk_usb_device,
+        &clk_timers,
+        &s3c24xx_clk_uart0,
+        &s3c24xx_clk_uart1,
+        &s3c24xx_clk_uart2,
+        &clk_rtc,
+        &clk_watchdog,
+        &clk_usb_bus_host,
+        &clk_usb_bus_gadget,
 };
 /* s3c2410_baseclk_add()
@@ -195,7 +230,6 @@ int __init s3c2410_baseclk_add(void)
 {
        unsigned long clkslow = __raw_readl(S3C2410_CLKSLOW);
        unsigned long clkcon  = __raw_readl(S3C2410_CLKCON);
-        struct clk *clkp;
        struct clk *xtal;
        int ret;
        int ptr;
@@ -207,8 +241,9 @@ int __init s3c2410_baseclk_add(void)
        /* register clocks from clock array */
-        clkp = init_clocks;
+        for (ptr = 0; ptr < ARRAY_SIZE(init_clocks); ptr++) {
-        for (ptr = 0; ptr < ARRAY_SIZE(init_clocks); ptr++, clkp++) {
+                struct clk *clkp = init_clocks[ptr];
                /* ensure that we note the clock state */
                clkp->usage = clkcon & clkp->ctrlbit ? 1 : 0;
diff --git a/arch/arm/mach-s3c24xx/clock-s3c2440.c b/arch/arm/mach-s3c24xx/clock-s3c2440.c
index 1069b5680826..aaf006d1d6dc 100644
--- a/arch/arm/mach-s3c24xx/clock-s3c2440.c
+++ b/arch/arm/mach-s3c24xx/clock-s3c2440.c
@@ -166,6 +166,9 @@ static struct clk_lookup s3c2440_clk_lookup[] = {
        CLKDEV_INIT(NULL, "clk_uart_baud1", &s3c24xx_uclk),
        CLKDEV_INIT(NULL, "clk_uart_baud2", &clk_p),
        CLKDEV_INIT(NULL, "clk_uart_baud3", &s3c2440_clk_fclk_n),
+        CLKDEV_INIT("s3c2440-uart.0", "uart", &s3c24xx_clk_uart0),
+        CLKDEV_INIT("s3c2440-uart.1", "uart", &s3c24xx_clk_uart1),
+        CLKDEV_INIT("s3c2440-uart.2", "uart", &s3c24xx_clk_uart2),
        CLKDEV_INIT("s3c2440-camif", "camera", &s3c2440_clk_cam_upll),
 };
diff --git a/arch/arm/mach-sti/Kconfig b/arch/arm/mach-sti/Kconfig
index d04e3bfe1918..835833e3c4f8 100644
--- a/arch/arm/mach-sti/Kconfig
+++ b/arch/arm/mach-sti/Kconfig
@@ -11,8 +11,9 @@ menuconfig ARCH_STI
        select HAVE_SMP
        select HAVE_ARM_SCU if SMP
        select ARCH_REQUIRE_GPIOLIB
-        select ARM_ERRATA_720789
        select ARM_ERRATA_754322
+        select ARM_ERRATA_764369
+        select ARM_ERRATA_775420
        select PL310_ERRATA_753970 if CACHE_PL310
        select PL310_ERRATA_769419 if CACHE_PL310
        help
diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c
index 5b799c29886e..5f252569c689 100644
--- a/arch/arm/mach-zynq/common.c
+++ b/arch/arm/mach-zynq/common.c
@@ -91,7 +91,7 @@ static void __init zynq_map_io(void)
        zynq_scu_map_io();
 }
-static void zynq_system_reset(char mode, const char *cmd)
+static void zynq_system_reset(enum reboot_mode mode, const char *cmd)
 {
        zynq_slcr_system_reset();
 }
diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig
index 3dc5cbea86cc..a5b5ff6e68d2 100644
--- a/arch/arm/plat-samsung/Kconfig
+++ b/arch/arm/plat-samsung/Kconfig
@@ -29,6 +29,13 @@ config PLAT_S5P
        help
          Base platform code for Samsung's S5P series SoC.
+config SAMSUNG_PM
+        bool
+        depends on PM && (PLAT_S3C24XX || ARCH_S3C64XX || ARCH_S5P64X0 || S5P_PM)
+        default y
+        help
+          Base platform power management code for samsung code
 if PLAT_SAMSUNG
 # boot configurations
diff --git a/arch/arm/plat-samsung/Makefile b/arch/arm/plat-samsung/Makefile
index 98d07d8fc7a7..199bbe304d02 100644
--- a/arch/arm/plat-samsung/Makefile
+++ b/arch/arm/plat-samsung/Makefile
@@ -51,7 +51,7 @@ obj-$(CONFIG_SAMSUNG_DMADEV)	+= dma-ops.o
 # PM support
-obj-$(CONFIG_PM)                += pm.o
+obj-$(CONFIG_SAMSUNG_PM)        += pm.o
 obj-$(CONFIG_SAMSUNG_PM_GPIO)   += pm-gpio.o
 obj-$(CONFIG_SAMSUNG_PM_CHECK)  += pm-check.o
diff --git a/arch/arm/plat-samsung/include/plat/clock.h b/arch/arm/plat-samsung/include/plat/clock.h
index a62753dc15ba..df45d6edc98d 100644
--- a/arch/arm/plat-samsung/include/plat/clock.h
+++ b/arch/arm/plat-samsung/include/plat/clock.h
@@ -83,6 +83,11 @@ extern struct clk clk_ext;
 extern struct clksrc_clk clk_epllref;
 extern struct clksrc_clk clk_esysclk;
+/* S3C24XX UART clocks */
+extern struct clk s3c24xx_clk_uart0;
+extern struct clk s3c24xx_clk_uart1;
+extern struct clk s3c24xx_clk_uart2;
 /* S3C64XX specific clocks */
 extern struct clk clk_h2;
 extern struct clk clk_27m;
diff --git a/arch/arm/plat-samsung/include/plat/pm.h b/arch/arm/plat-samsung/include/plat/pm.h
index 5d47ca35cabd..6bc1a8f471e3 100644
--- a/arch/arm/plat-samsung/include/plat/pm.h
+++ b/arch/arm/plat-samsung/include/plat/pm.h
@@ -19,7 +19,7 @@
 struct device;
-#ifdef CONFIG_PM
+#ifdef CONFIG_SAMSUNG_PM
 extern __init int s3c_pm_init(void);
 extern __init int s3c64xx_pm_init(void);
@@ -58,8 +58,6 @@ extern unsigned char pm_uart_udivslot;  /* true to save UART UDIVSLOT */
 /* from sleep.S */
-extern void s3c_cpu_resume(void);
 extern int s3c2410_cpu_suspend(unsigned long);
 /* sleep save info */
@@ -106,12 +104,14 @@ extern void s3c_pm_do_save(struct sleep_save *ptr, int count);
 extern void s3c_pm_do_restore(struct sleep_save *ptr, int count);
 extern void s3c_pm_do_restore_core(struct sleep_save *ptr, int count);
-#ifdef CONFIG_PM
+#ifdef CONFIG_SAMSUNG_PM
 extern int s3c_irq_wake(struct irq_data *data, unsigned int state);
 extern int s3c_irqext_wake(struct irq_data *data, unsigned int state);
+extern void s3c_cpu_resume(void);
 #else
 #define s3c_irq_wake NULL
 #define s3c_irqext_wake NULL
+#define s3c_cpu_resume NULL
 #endif
 /* PM debug functions */
diff --git a/arch/arm/plat-samsung/pm.c b/arch/arm/plat-samsung/pm.c
index ea3613642451..d0c23010b693 100644
--- a/arch/arm/plat-samsung/pm.c
+++ b/arch/arm/plat-samsung/pm.c
@@ -80,7 +80,7 @@ unsigned char pm_uart_udivslot;
 #ifdef CONFIG_SAMSUNG_PM_DEBUG
-static struct pm_uart_save uart_save[CONFIG_SERIAL_SAMSUNG_UARTS];
+static struct pm_uart_save uart_save;
 static void s3c_pm_save_uart(unsigned int uart, struct pm_uart_save *save)
 {
@@ -101,11 +101,7 @@ static void s3c_pm_save_uart(unsigned int uart, struct pm_uart_save *save)
 static void s3c_pm_save_uarts(void)
 {
-        struct pm_uart_save *save = uart_save;
+        s3c_pm_save_uart(CONFIG_DEBUG_S3C_UART, &uart_save);
-        unsigned int uart;
-        for (uart = 0; uart < CONFIG_SERIAL_SAMSUNG_UARTS; uart++, save++)
-                s3c_pm_save_uart(uart, save);
 }
 static void s3c_pm_restore_uart(unsigned int uart, struct pm_uart_save *save)
@@ -126,11 +122,7 @@ static void s3c_pm_restore_uart(unsigned int uart, struct pm_uart_save *save)
 static void s3c_pm_restore_uarts(void)
 {
-        struct pm_uart_save *save = uart_save;
+        s3c_pm_restore_uart(CONFIG_DEBUG_S3C_UART, &uart_save);
-        unsigned int uart;
-        for (uart = 0; uart < CONFIG_SERIAL_SAMSUNG_UARTS; uart++, save++)
-                s3c_pm_restore_uart(uart, save);
 }
 #else
 static void s3c_pm_save_uarts(void) { }
diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h
index 3659e460071d..23a3c4791d86 100644
--- a/arch/arm64/include/asm/thread_info.h
+++ b/arch/arm64/include/asm/thread_info.h
@@ -24,10 +24,10 @@
 #include <linux/compiler.h>
 #ifndef CONFIG_ARM64_64K_PAGES
-#define THREAD_SIZE_ORDER       1
+#define THREAD_SIZE_ORDER       2
 #endif
-#define THREAD_SIZE             8192
+#define THREAD_SIZE             16384
 #define THREAD_START_SP         (THREAD_SIZE - 16)
 #ifndef __ASSEMBLY__
diff --git a/arch/arm64/include/asm/virt.h b/arch/arm64/include/asm/virt.h
index 439827271e3d..26e310c54344 100644
--- a/arch/arm64/include/asm/virt.h
+++ b/arch/arm64/include/asm/virt.h
@@ -21,6 +21,7 @@
 #define BOOT_CPU_MODE_EL2       (0x0e12b007)
 #ifndef __ASSEMBLY__
+#include <asm/cacheflush.h>
 /*
 * __boot_cpu_mode records what mode CPUs were booted in.
@@ -36,9 +37,20 @@ extern u32 __boot_cpu_mode[2];
 void __hyp_set_vectors(phys_addr_t phys_vector_base);
 phys_addr_t __hyp_get_vectors(void);
+static inline void sync_boot_mode(void)
+{
+        /*
+         * As secondaries write to __boot_cpu_mode with caches disabled, we
+         * must flush the corresponding cache entries to ensure the visibility
+         * of their writes.
+         */
+        __flush_dcache_area(__boot_cpu_mode, sizeof(__boot_cpu_mode));
+}
 /* Reports the availability of HYP mode */
 static inline bool is_hyp_mode_available(void)
 {
+        sync_boot_mode();
        return (__boot_cpu_mode[0] == BOOT_CPU_MODE_EL2 &&
                __boot_cpu_mode[1] == BOOT_CPU_MODE_EL2);
 }
@@ -46,6 +58,7 @@ static inline bool is_hyp_mode_available(void)
 /* Check if the bootloader has booted CPUs in different modes */
 static inline bool is_hyp_mode_mismatched(void)
 {
+        sync_boot_mode();
        return __boot_cpu_mode[0] != __boot_cpu_mode[1];
 }
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 1d1314280a03..6ad781b21c08 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -121,7 +121,7 @@
        .macro  get_thread_info, rd
        mov     \rd, sp
-        and     \rd, \rd, #~((1 << 13) - 1)     // top of 8K stack
+        and     \rd, \rd, #~(THREAD_SIZE - 1)   // top of stack
        .endm
 /*
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 1788bf6b471f..57fb55c44c90 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -81,7 +81,7 @@ void soft_restart(unsigned long addr)
 void (*pm_power_off)(void);
 EXPORT_SYMBOL_GPL(pm_power_off);
-void (*arm_pm_restart)(char str, const char *cmd);
+void (*arm_pm_restart)(enum reboot_mode reboot_mode, const char *cmd);
 EXPORT_SYMBOL_GPL(arm_pm_restart);
 void arch_cpu_idle_prepare(void)
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 227aca77ee1e..5da44e81dd4d 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -169,10 +169,8 @@ int acpi_create_platform_device(struct acpi_device *adev,
  -------------------------------------------------------------------------- */
 #if defined(CONFIG_ACPI_VIDEO) || defined(CONFIG_ACPI_VIDEO_MODULE)
 bool acpi_video_backlight_quirks(void);
-bool acpi_video_verify_backlight_support(void);
 #else
 static inline bool acpi_video_backlight_quirks(void) { return false; }
-static inline bool acpi_video_verify_backlight_support(void) { return false; }
 #endif
 #endif /* _ACPI_INTERNAL_H_ */
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 6dd237e79b4f..0ec434d2586d 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -911,7 +911,7 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
        if (acpi_video_init_brightness(device))
                return;
-        if (acpi_video_verify_backlight_support()) {
+        if (acpi_video_backlight_support()) {
                struct backlight_properties props;
                struct pci_dev *pdev;
                acpi_handle acpi_parent;
@@ -1366,8 +1366,8 @@ acpi_video_switch_brightness(struct acpi_video_device *device, int event)
        unsigned long long level_current, level_next;
        int result = -EINVAL;
-        /* no warning message if acpi_backlight=vendor or a quirk is used */
+        /* no warning message if acpi_backlight=vendor is used */
-        if (!acpi_video_verify_backlight_support())
+        if (!acpi_video_backlight_support())
                return 0;
        if (!device->brightness)
@@ -1875,46 +1875,6 @@ static int acpi_video_bus_remove(struct acpi_device *device)
        return 0;
 }
-static acpi_status video_unregister_backlight(acpi_handle handle, u32 lvl,
-                                              void *context, void **rv)
-{
-        struct acpi_device *acpi_dev;
-        struct acpi_video_bus *video;
-        struct acpi_video_device *dev, *next;
-        if (acpi_bus_get_device(handle, &acpi_dev))
-                return AE_OK;
-        if (acpi_match_device_ids(acpi_dev, video_device_ids))
-                return AE_OK;
-        video = acpi_driver_data(acpi_dev);
-        if (!video)
-                return AE_OK;
-        acpi_video_bus_stop_devices(video);
-        mutex_lock(&video->device_list_lock);
-        list_for_each_entry_safe(dev, next, &video->video_device_list, entry) {
-                if (dev->backlight) {
-                        backlight_device_unregister(dev->backlight);
-                        dev->backlight = NULL;
-                        kfree(dev->brightness->levels);
-                        kfree(dev->brightness);
-                }
-                if (dev->cooling_dev) {
-                        sysfs_remove_link(&dev->dev->dev.kobj,
-                                          "thermal_cooling");
-                        sysfs_remove_link(&dev->cooling_dev->device.kobj,
-                                          "device");
-                        thermal_cooling_device_unregister(dev->cooling_dev);
-                        dev->cooling_dev = NULL;
-                }
-        }
-        mutex_unlock(&video->device_list_lock);
-        acpi_video_bus_start_devices(video);
-        return AE_OK;
-}
 static int __init is_i740(struct pci_dev *dev)
 {
        if (dev->device == 0x00D1)
@@ -1946,25 +1906,14 @@ static int __init intel_opregion_present(void)
        return opregion;
 }
-int __acpi_video_register(bool backlight_quirks)
+int acpi_video_register(void)
 {
-        bool no_backlight;
+        int result = 0;
-        int result;
-        no_backlight = backlight_quirks ? acpi_video_backlight_quirks() : false;
        if (register_count) {
                /*
-                 * If acpi_video_register() has been called already, don't try
+                 * if the function of acpi_video_register is already called,
-                 * to register acpi_video_bus, but unregister backlight devices
+                 * don't register the acpi_vide_bus again and return no error.
-                 * if no backlight support is requested.
                 */
-                if (no_backlight)
-                        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
-                                            ACPI_UINT32_MAX,
-                                            video_unregister_backlight,
-                                            NULL, NULL, NULL);
                return 0;
        }
@@ -1980,7 +1929,7 @@ int __acpi_video_register(bool backlight_quirks)
        return 0;
 }
-EXPORT_SYMBOL(__acpi_video_register);
+EXPORT_SYMBOL(acpi_video_register);
 void acpi_video_unregister(void)
 {
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 826e52def080..c3397748ba46 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -238,12 +238,7 @@ static void acpi_video_caps_check(void)
 bool acpi_video_backlight_quirks(void)
 {
-        if (acpi_gbl_osi_data >= ACPI_OSI_WIN_8) {
+        return acpi_gbl_osi_data >= ACPI_OSI_WIN_8;
-                acpi_video_caps_check();
-                acpi_video_support |= ACPI_VIDEO_SKIP_BACKLIGHT;
-                return true;
-        }
-        return false;
 }
 EXPORT_SYMBOL(acpi_video_backlight_quirks);
@@ -291,14 +286,6 @@ int acpi_video_backlight_support(void)
 }
 EXPORT_SYMBOL(acpi_video_backlight_support);
-/* For the ACPI video driver use only. */
-bool acpi_video_verify_backlight_support(void)
-{
-        return (acpi_video_support & ACPI_VIDEO_SKIP_BACKLIGHT) ?
-                false : acpi_video_backlight_support();
-}
-EXPORT_SYMBOL(acpi_video_verify_backlight_support);
 /*
 * Use acpi_backlight=vendor/video to force that backlight switching
 * is processed by vendor specific acpi drivers or video.ko driver.
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 80dc988f01e4..4e737728aee2 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -97,6 +97,15 @@ config SATA_AHCI_PLATFORM
          If unsure, say N.
+config AHCI_IMX
+        tristate "Freescale i.MX AHCI SATA support"
+        depends on SATA_AHCI_PLATFORM && MFD_SYSCON
+        help
+          This option enables support for the Freescale i.MX SoC's
+          onboard AHCI SATA.
+          If unsure, say N.
 config SATA_FSL
        tristate "Freescale 3.0Gbps SATA support"
        depends on FSL_SOC
@@ -107,7 +116,7 @@ config SATA_FSL
          If unsure, say N.
 config SATA_INIC162X
-        tristate "Initio 162x SATA support"
+        tristate "Initio 162x SATA support (Very Experimental)"
        depends on PCI
        help
          This option enables support for Initio 162x Serial ATA.
diff --git a/drivers/ata/Makefile b/drivers/ata/Makefile
index c04d0fd038a3..46518c622460 100644
--- a/drivers/ata/Makefile
+++ b/drivers/ata/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_SATA_INIC162X)	+= sata_inic162x.o
 obj-$(CONFIG_SATA_SIL24)        += sata_sil24.o
 obj-$(CONFIG_SATA_DWC)          += sata_dwc_460ex.o
 obj-$(CONFIG_SATA_HIGHBANK)     += sata_highbank.o libahci.o
+obj-$(CONFIG_AHCI_IMX)          += ahci_imx.o
 # SFF w/ custom DMA
 obj-$(CONFIG_PDC_ADMA)          += pdc_adma.o
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 5064f3ea20f1..db4380d70031 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1146,11 +1146,18 @@ int ahci_host_activate(struct ata_host *host, int irq, unsigned int n_msis)
                return rc;
        for (i = 0; i < host->n_ports; i++) {
+                const char* desc;
                struct ahci_port_priv *pp = host->ports[i]->private_data;
+                /* pp is NULL for dummy ports */
+                if (pp)
+                        desc = pp->irq_desc;
+                else
+                        desc = dev_driver_string(host->dev);
                rc = devm_request_threaded_irq(host->dev,
                        irq + i, ahci_hw_interrupt, ahci_thread_fn, IRQF_SHARED,
-                        pp->irq_desc, host->ports[i]);
+                        desc, host->ports[i]);
                if (rc)
                        goto out_free_irqs;
        }
diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
new file mode 100644
index 000000000000..58debb0acc3a
--- /dev/null
+++ b/drivers/ata/ahci_imx.c
@@ -0,0 +1,236 @@
+/*
+ * Freescale IMX AHCI SATA platform driver
+ * Copyright 2013 Freescale Semiconductor, Inc.
+ *
+ * based on the AHCI SATA platform driver by Jeff Garzik and Anton Vorontsov
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/ahci_platform.h>
+#include <linux/of_device.h>
+#include <linux/mfd/syscon.h>
+#include <linux/mfd/syscon/imx6q-iomuxc-gpr.h>
+#include "ahci.h"
+enum {
+        HOST_TIMER1MS = 0xe0, /* Timer 1-ms */
+};
+struct imx_ahci_priv {
+        struct platform_device *ahci_pdev;
+        struct clk *sata_ref_clk;
+        struct clk *ahb_clk;
+        struct regmap *gpr;
+};
+static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
+{
+        int ret = 0;
+        unsigned int reg_val;
+        struct imx_ahci_priv *imxpriv = dev_get_drvdata(dev->parent);
+        imxpriv->gpr =
+                syscon_regmap_lookup_by_compatible("fsl,imx6q-iomuxc-gpr");
+        if (IS_ERR(imxpriv->gpr)) {
+                dev_err(dev, "failed to find fsl,imx6q-iomux-gpr regmap\n");
+                return PTR_ERR(imxpriv->gpr);
+        }
+        ret = clk_prepare_enable(imxpriv->sata_ref_clk);
+        if (ret < 0) {
+                dev_err(dev, "prepare-enable sata_ref clock err:%d\n", ret);
+                return ret;
+        }
+        /*
+         * set PHY Paremeters, two steps to configure the GPR13,
+         * one write for rest of parameters, mask of first write
+         * is 0x07fffffd, and the other one write for setting
+         * the mpll_clk_en.
+         */
+        regmap_update_bits(imxpriv->gpr, 0x34, IMX6Q_GPR13_SATA_RX_EQ_VAL_MASK
+                        | IMX6Q_GPR13_SATA_RX_LOS_LVL_MASK
+                        | IMX6Q_GPR13_SATA_RX_DPLL_MODE_MASK
+                        | IMX6Q_GPR13_SATA_SPD_MODE_MASK
+                        | IMX6Q_GPR13_SATA_MPLL_SS_EN
+                        | IMX6Q_GPR13_SATA_TX_ATTEN_MASK
+                        | IMX6Q_GPR13_SATA_TX_BOOST_MASK
+                        | IMX6Q_GPR13_SATA_TX_LVL_MASK
+                        | IMX6Q_GPR13_SATA_TX_EDGE_RATE
+                        , IMX6Q_GPR13_SATA_RX_EQ_VAL_3_0_DB
+                        | IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA2M
+                        | IMX6Q_GPR13_SATA_RX_DPLL_MODE_2P_4F
+                        | IMX6Q_GPR13_SATA_SPD_MODE_3P0G
+                        | IMX6Q_GPR13_SATA_MPLL_SS_EN
+                        | IMX6Q_GPR13_SATA_TX_ATTEN_9_16
+                        | IMX6Q_GPR13_SATA_TX_BOOST_3_33_DB
+                        | IMX6Q_GPR13_SATA_TX_LVL_1_025_V);
+        regmap_update_bits(imxpriv->gpr, 0x34, IMX6Q_GPR13_SATA_MPLL_CLK_EN,
+                        IMX6Q_GPR13_SATA_MPLL_CLK_EN);
+        usleep_range(100, 200);
+        /*
+         * Configure the HWINIT bits of the HOST_CAP and HOST_PORTS_IMPL,
+         * and IP vendor specific register HOST_TIMER1MS.
+         * Configure CAP_SSS (support stagered spin up).
+         * Implement the port0.
+         * Get the ahb clock rate, and configure the TIMER1MS register.
+         */
+        reg_val = readl(mmio + HOST_CAP);
+        if (!(reg_val & HOST_CAP_SSS)) {
+                reg_val |= HOST_CAP_SSS;
+                writel(reg_val, mmio + HOST_CAP);
+        }
+        reg_val = readl(mmio + HOST_PORTS_IMPL);
+        if (!(reg_val & 0x1)) {
+                reg_val |= 0x1;
+                writel(reg_val, mmio + HOST_PORTS_IMPL);
+        }
+        reg_val = clk_get_rate(imxpriv->ahb_clk) / 1000;
+        writel(reg_val, mmio + HOST_TIMER1MS);
+        return 0;
+}
+static void imx6q_sata_exit(struct device *dev)
+{
+        struct imx_ahci_priv *imxpriv =  dev_get_drvdata(dev->parent);
+        regmap_update_bits(imxpriv->gpr, 0x34, IMX6Q_GPR13_SATA_MPLL_CLK_EN,
+                        !IMX6Q_GPR13_SATA_MPLL_CLK_EN);
+        clk_disable_unprepare(imxpriv->sata_ref_clk);
+}
+static struct ahci_platform_data imx6q_sata_pdata = {
+        .init = imx6q_sata_init,
+        .exit = imx6q_sata_exit,
+};
+static const struct of_device_id imx_ahci_of_match[] = {
+        { .compatible = "fsl,imx6q-ahci", .data = &imx6q_sata_pdata},
+        {},
+};
+MODULE_DEVICE_TABLE(of, imx_ahci_of_match);
+static int imx_ahci_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct resource *mem, *irq, res[2];
+        const struct of_device_id *of_id;
+        const struct ahci_platform_data *pdata = NULL;
+        struct imx_ahci_priv *imxpriv;
+        struct device *ahci_dev;
+        struct platform_device *ahci_pdev;
+        int ret;
+        imxpriv = devm_kzalloc(dev, sizeof(*imxpriv), GFP_KERNEL);
+        if (!imxpriv) {
+                dev_err(dev, "can't alloc ahci_host_priv\n");
+                return -ENOMEM;
+        }
+        ahci_pdev = platform_device_alloc("ahci", -1);
+        if (!ahci_pdev)
+                return -ENODEV;
+        ahci_dev = &ahci_pdev->dev;
+        ahci_dev->parent = dev;
+        imxpriv->ahb_clk = devm_clk_get(dev, "ahb");
+        if (IS_ERR(imxpriv->ahb_clk)) {
+                dev_err(dev, "can't get ahb clock.\n");
+                ret = PTR_ERR(imxpriv->ahb_clk);
+                goto err_out;
+        }
+        imxpriv->sata_ref_clk = devm_clk_get(dev, "sata_ref");
+        if (IS_ERR(imxpriv->sata_ref_clk)) {
+                dev_err(dev, "can't get sata_ref clock.\n");
+                ret = PTR_ERR(imxpriv->sata_ref_clk);
+                goto err_out;
+        }
+        imxpriv->ahci_pdev = ahci_pdev;
+        platform_set_drvdata(pdev, imxpriv);
+        of_id = of_match_device(imx_ahci_of_match, dev);
+        if (of_id) {
+                pdata = of_id->data;
+        } else {
+                ret = -EINVAL;
+                goto err_out;
+        }
+        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!mem || !irq) {
+                dev_err(dev, "no mmio/irq resource\n");
+                ret = -ENOMEM;
+                goto err_out;
+        }
+        res[0] = *mem;
+        res[1] = *irq;
+        ahci_dev->coherent_dma_mask = DMA_BIT_MASK(32);
+        ahci_dev->dma_mask = &ahci_dev->coherent_dma_mask;
+        ahci_dev->of_node = dev->of_node;
+        ret = platform_device_add_resources(ahci_pdev, res, 2);
+        if (ret)
+                goto err_out;
+        ret = platform_device_add_data(ahci_pdev, pdata, sizeof(*pdata));
+        if (ret)
+                goto err_out;
+        ret = platform_device_add(ahci_pdev);
+        if (ret) {
+err_out:
+                platform_device_put(ahci_pdev);
+                return ret;
+        }
+        return 0;
+}
+static int imx_ahci_remove(struct platform_device *pdev)
+{
+        struct imx_ahci_priv *imxpriv = platform_get_drvdata(pdev);
+        struct platform_device *ahci_pdev = imxpriv->ahci_pdev;
+        platform_device_unregister(ahci_pdev);
+        return 0;
+}
+static struct platform_driver imx_ahci_driver = {
+        .probe = imx_ahci_probe,
+        .remove = imx_ahci_remove,
+        .driver = {
+                .name = "ahci-imx",
+                .owner = THIS_MODULE,
+                .of_match_table = imx_ahci_of_match,
+        },
+};
+module_platform_driver(imx_ahci_driver);
+MODULE_DESCRIPTION("Freescale i.MX AHCI SATA platform driver");
+MODULE_AUTHOR("Richard Zhu <Hong-Xing.Zhu@freescale.com>");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ahci:imx");
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index b52a10c8eeb9..513ad7ed0c99 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -330,7 +330,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
        /* SATA Controller IDE (Wellsburg) */
        { 0x8086, 0x8d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
        /* SATA Controller IDE (Wellsburg) */
-        { 0x8086, 0x8d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        { 0x8086, 0x8d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
        /* SATA Controller IDE (Wellsburg) */
        { 0x8086, 0x8d60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
        /* SATA Controller IDE (Wellsburg) */
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 83c08907e042..b1e880a3c3da 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -206,8 +206,10 @@ static ssize_t ata_scsi_park_store(struct device *device,
        unsigned long flags;
        int rc;
-        rc = strict_strtol(buf, 10, &input);
+        rc = kstrtol(buf, 10, &input);
-        if (rc || input < -2)
+        if (rc)
+                return rc;
+        if (input < -2)
                return -EINVAL;
        if (input > ATA_TMOUT_MAX_PARK) {
                rc = -EOVERFLOW;
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index e45131748248..5c54d957370a 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -6,6 +6,18 @@
 *
 * This file is released under GPL v2.
 *
+ * **** WARNING ****
+ *
+ * This driver never worked properly and unfortunately data corruption is
+ * relatively common.  There isn't anyone working on the driver and there's
+ * no support from the vendor.  Do not use this driver in any production
+ * environment.
+ *
+ * http://thread.gmane.org/gmane.linux.debian.devel.bugs.rc/378525/focus=54491
+ * https://bugzilla.kernel.org/show_bug.cgi?id=60565
+ *
+ * *****************
+ *
 * This controller is eccentric and easily locks up if something isn't
 * right.  Documentation is available at initio's website but it only
 * documents registers (not programming model).
@@ -807,6 +819,8 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        ata_print_version_once(&pdev->dev, DRV_VERSION);
+        dev_alert(&pdev->dev, "inic162x support is broken with common data corruption issues and will be disabled by default, contact linux-ide@vger.kernel.org if in production use\n");
        /* alloc host */
        host = ata_host_alloc_pinfo(&pdev->dev, ppi, NR_PORTS);
        hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b012d7600e1a..7cde885011ed 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -103,10 +103,10 @@ struct pstate_adjust_policy {
 static struct pstate_adjust_policy default_policy = {
        .sample_rate_ms = 10,
        .deadband = 0,
-        .setpoint = 109,
+        .setpoint = 97,
-        .p_gain_pct = 17,
+        .p_gain_pct = 20,
        .d_gain_pct = 0,
-        .i_gain_pct = 4,
+        .i_gain_pct = 0,
 };
 struct perf_limits {
@@ -468,12 +468,12 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
 static inline int intel_pstate_get_scaled_busy(struct cpudata *cpu)
 {
        int32_t busy_scaled;
-        int32_t core_busy, turbo_pstate, current_pstate;
+        int32_t core_busy, max_pstate, current_pstate;
        core_busy = int_tofp(cpu->samples[cpu->sample_ptr].core_pct_busy);
-        turbo_pstate = int_tofp(cpu->pstate.turbo_pstate);
+        max_pstate = int_tofp(cpu->pstate.max_pstate);
        current_pstate = int_tofp(cpu->pstate.current_pstate);
-        busy_scaled = mul_fp(core_busy, div_fp(turbo_pstate, current_pstate));
+        busy_scaled = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
        return fp_toint(busy_scaled);
 }
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index b1520682cb23..66c63808fa35 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1649,7 +1649,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (INTEL_INFO(dev)->num_pipes) {
                /* Must be done after probing outputs */
                intel_opregion_init(dev);
-                acpi_video_register_with_quirks();
+                acpi_video_register();
        }
        if (IS_GEN5(dev))
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index 251784aa2225..503a414cbdad 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -29,6 +29,7 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
        struct mga_crtc *mga_crtc = to_mga_crtc(crtc);
        struct drm_device *dev = crtc->dev;
        struct mga_device *mdev = dev->dev_private;
+        struct drm_framebuffer *fb = crtc->fb;
        int i;
        if (!crtc->enabled)
@@ -36,6 +37,28 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
        WREG8(DAC_INDEX + MGA1064_INDEX, 0);
+        if (fb && fb->bits_per_pixel == 16) {
+                int inc = (fb->depth == 15) ? 8 : 4;
+                u8 r, b;
+                for (i = 0; i < MGAG200_LUT_SIZE; i += inc) {
+                        if (fb->depth == 16) {
+                                if (i > (MGAG200_LUT_SIZE >> 1)) {
+                                        r = b = 0;
+                                } else {
+                                        r = mga_crtc->lut_r[i << 1];
+                                        b = mga_crtc->lut_b[i << 1];
+                                }
+                        } else {
+                                r = mga_crtc->lut_r[i];
+                                b = mga_crtc->lut_b[i];
+                        }
+                        /* VGA registers */
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, r);
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, mga_crtc->lut_g[i]);
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, b);
+                }
+                return;
+        }
        for (i = 0; i < MGAG200_LUT_SIZE; i++) {
                /* VGA registers */
                WREG8(DAC_INDEX + MGA1064_COL_PAL, mga_crtc->lut_r[i]);
@@ -877,7 +900,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
        pitch = crtc->fb->pitches[0] / (crtc->fb->bits_per_pixel / 8);
        if (crtc->fb->bits_per_pixel == 24)
-                pitch = pitch >> (4 - bppshift);
+                pitch = (pitch * 3) >> (4 - bppshift);
        else
                pitch = pitch >> (4 - bppshift);
@@ -1251,6 +1274,24 @@ static void mga_crtc_destroy(struct drm_crtc *crtc)
        kfree(mga_crtc);
 }
+static void mga_crtc_disable(struct drm_crtc *crtc)
+{
+        int ret;
+        DRM_DEBUG_KMS("\n");
+        mga_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+        if (crtc->fb) {
+                struct mga_framebuffer *mga_fb = to_mga_framebuffer(crtc->fb);
+                struct drm_gem_object *obj = mga_fb->obj;
+                struct mgag200_bo *bo = gem_to_mga_bo(obj);
+                ret = mgag200_bo_reserve(bo, false);
+                if (ret)
+                        return;
+                mgag200_bo_push_sysram(bo);
+                mgag200_bo_unreserve(bo);
+        }
+        crtc->fb = NULL;
+}
 /* These provide the minimum set of functions required to handle a CRTC */
 static const struct drm_crtc_funcs mga_crtc_funcs = {
        .cursor_set = mga_crtc_cursor_set,
@@ -1261,6 +1302,7 @@ static const struct drm_crtc_funcs mga_crtc_funcs = {
 };
 static const struct drm_crtc_helper_funcs mga_helper_funcs = {
+        .disable = mga_crtc_disable,
        .dpms = mga_crtc_dpms,
        .mode_fixup = mga_crtc_mode_fixup,
        .mode_set = mga_crtc_mode_set,
@@ -1581,6 +1623,8 @@ static struct drm_connector *mga_vga_init(struct drm_device *dev)
        drm_connector_helper_add(connector, &mga_vga_connector_helper_funcs);
+        drm_sysfs_connector_add(connector);
        mga_connector->i2c = mgag200_i2c_create(dev);
        if (!mga_connector->i2c)
                DRM_ERROR("failed to add ddc bus\n");
diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
index 3acb2b044c7b..13878d5de063 100644
--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
@@ -353,6 +353,7 @@ int mgag200_bo_pin(struct mgag200_bo *bo, u32 pl_flag, u64 *gpu_addr)
                bo->pin_count++;
                if (gpu_addr)
                        *gpu_addr = mgag200_bo_gpu_offset(bo);
+                return 0;
        }
        mgag200_ttm_placement(bo, pl_flag);
diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
index 93c2f2cceb51..eb89653a7a17 100644
--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -179,9 +179,10 @@ qxl_push_command_ring_release(struct qxl_device *qdev, struct qxl_release *relea
                              uint32_t type, bool interruptible)
 {
        struct qxl_command cmd;
+        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
        cmd.type = type;
-        cmd.data = qxl_bo_physical_address(qdev, release->bos[0], release->release_offset);
+        cmd.data = qxl_bo_physical_address(qdev, to_qxl_bo(entry->tv.bo), release->release_offset);
        return qxl_ring_push(qdev->command_ring, &cmd, interruptible);
 }
@@ -191,9 +192,10 @@ qxl_push_cursor_ring_release(struct qxl_device *qdev, struct qxl_release *releas
                             uint32_t type, bool interruptible)
 {
        struct qxl_command cmd;
+        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
        cmd.type = type;
-        cmd.data = qxl_bo_physical_address(qdev, release->bos[0], release->release_offset);
+        cmd.data = qxl_bo_physical_address(qdev, to_qxl_bo(entry->tv.bo), release->release_offset);
        return qxl_ring_push(qdev->cursor_ring, &cmd, interruptible);
 }
@@ -214,7 +216,6 @@ int qxl_garbage_collect(struct qxl_device *qdev)
        struct qxl_release *release;
        uint64_t id, next_id;
        int i = 0;
-        int ret;
        union qxl_release_info *info;
        while (qxl_ring_pop(qdev->release_ring, &id)) {
@@ -224,17 +225,10 @@ int qxl_garbage_collect(struct qxl_device *qdev)
                        if (release == NULL)
                                break;
-                        ret = qxl_release_reserve(qdev, release, false);
-                        if (ret) {
-                                qxl_io_log(qdev, "failed to reserve release on garbage collect %lld\n", id);
-                                DRM_ERROR("failed to reserve release %lld\n", id);
-                        }
                        info = qxl_release_map(qdev, release);
                        next_id = info->next;
                        qxl_release_unmap(qdev, release, info);
-                        qxl_release_unreserve(qdev, release);
                        QXL_INFO(qdev, "popped %lld, next %lld\n", id,
                                next_id);
@@ -259,27 +253,29 @@ int qxl_garbage_collect(struct qxl_device *qdev)
        return i;
 }
-int qxl_alloc_bo_reserved(struct qxl_device *qdev, unsigned long size,
+int qxl_alloc_bo_reserved(struct qxl_device *qdev,
+                          struct qxl_release *release,
+                          unsigned long size,
                          struct qxl_bo **_bo)
 {
        struct qxl_bo *bo;
        int ret;
        ret = qxl_bo_create(qdev, size, false /* not kernel - device */,
-                            QXL_GEM_DOMAIN_VRAM, NULL, &bo);
+                            false, QXL_GEM_DOMAIN_VRAM, NULL, &bo);
        if (ret) {
                DRM_ERROR("failed to allocate VRAM BO\n");
                return ret;
        }
-        ret = qxl_bo_reserve(bo, false);
+        ret = qxl_release_list_add(release, bo);
-        if (unlikely(ret != 0))
+        if (ret)
                goto out_unref;
        *_bo = bo;
        return 0;
 out_unref:
        qxl_bo_unref(&bo);
-        return 0;
+        return ret;
 }
 static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port, bool intr)
@@ -503,6 +499,10 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
        if (ret)
                return ret;
+        ret = qxl_release_reserve_list(release, true);
+        if (ret)
+                return ret;
        cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
        cmd->type = QXL_SURFACE_CMD_CREATE;
        cmd->u.surface_create.format = surf->surf.format;
@@ -524,14 +524,11 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
        surf->surf_create = release;
-        /* no need to add a release to the fence for this bo,
+        /* no need to add a release to the fence for this surface bo,
           since it is only released when we ask to destroy the surface
           and it would never signal otherwise */
-        qxl_fence_releaseable(qdev, release);
        qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
+        qxl_release_fence_buffer_objects(release);
-        qxl_release_unreserve(qdev, release);
        surf->hw_surf_alloc = true;
        spin_lock(&qdev->surf_id_idr_lock);
@@ -573,12 +570,9 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev,
        cmd->surface_id = id;
        qxl_release_unmap(qdev, release, &cmd->release_info);
-        qxl_fence_releaseable(qdev, release);
        qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
-        qxl_release_unreserve(qdev, release);
+        qxl_release_fence_buffer_objects(release);
        return 0;
 }
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index f76f5dd7bfc4..835caba026d3 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -179,7 +179,7 @@ static void qxl_crtc_destroy(struct drm_crtc *crtc)
        kfree(qxl_crtc);
 }
-static void
+static int
 qxl_hide_cursor(struct qxl_device *qdev)
 {
        struct qxl_release *release;
@@ -188,14 +188,22 @@ qxl_hide_cursor(struct qxl_device *qdev)
        ret = qxl_alloc_release_reserved(qdev, sizeof(*cmd), QXL_RELEASE_CURSOR_CMD,
                                         &release, NULL);
+        if (ret)
+                return ret;
+        ret = qxl_release_reserve_list(release, true);
+        if (ret) {
+                qxl_release_free(qdev, release);
+                return ret;
+        }
        cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
        cmd->type = QXL_CURSOR_HIDE;
        qxl_release_unmap(qdev, release, &cmd->release_info);
-        qxl_fence_releaseable(qdev, release);
        qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
-        qxl_release_unreserve(qdev, release);
+        qxl_release_fence_buffer_objects(release);
+        return 0;
 }
 static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
@@ -216,10 +224,8 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
        int size = 64*64*4;
        int ret = 0;
-        if (!handle) {
+        if (!handle)
-                qxl_hide_cursor(qdev);
+                return qxl_hide_cursor(qdev);
-                return 0;
-        }
        obj = drm_gem_object_lookup(crtc->dev, file_priv, handle);
        if (!obj) {
@@ -234,8 +240,9 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
                goto out_unref;
        ret = qxl_bo_pin(user_bo, QXL_GEM_DOMAIN_CPU, NULL);
+        qxl_bo_unreserve(user_bo);
        if (ret)
-                goto out_unreserve;
+                goto out_unref;
        ret = qxl_bo_kmap(user_bo, &user_ptr);
        if (ret)
@@ -246,14 +253,20 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
                                         &release, NULL);
        if (ret)
                goto out_kunmap;
-        ret = qxl_alloc_bo_reserved(qdev, sizeof(struct qxl_cursor) + size,
-                                    &cursor_bo);
+        ret = qxl_alloc_bo_reserved(qdev, release, sizeof(struct qxl_cursor) + size,
+                           &cursor_bo);
        if (ret)
                goto out_free_release;
-        ret = qxl_bo_kmap(cursor_bo, (void **)&cursor);
+        ret = qxl_release_reserve_list(release, false);
        if (ret)
                goto out_free_bo;
+        ret = qxl_bo_kmap(cursor_bo, (void **)&cursor);
+        if (ret)
+                goto out_backoff;
        cursor->header.unique = 0;
        cursor->header.type = SPICE_CURSOR_TYPE_ALPHA;
        cursor->header.width = 64;
@@ -269,11 +282,7 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
        qxl_bo_kunmap(cursor_bo);
-        /* finish with the userspace bo */
        qxl_bo_kunmap(user_bo);
-        qxl_bo_unpin(user_bo);
-        qxl_bo_unreserve(user_bo);
-        drm_gem_object_unreference_unlocked(obj);
        cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
        cmd->type = QXL_CURSOR_SET;
@@ -281,30 +290,35 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc,
        cmd->u.set.position.y = qcrtc->cur_y;
        cmd->u.set.shape = qxl_bo_physical_address(qdev, cursor_bo, 0);
-        qxl_release_add_res(qdev, release, cursor_bo);
        cmd->u.set.visible = 1;
        qxl_release_unmap(qdev, release, &cmd->release_info);
-        qxl_fence_releaseable(qdev, release);
        qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
-        qxl_release_unreserve(qdev, release);
+        qxl_release_fence_buffer_objects(release);
+        /* finish with the userspace bo */
+        ret = qxl_bo_reserve(user_bo, false);
+        if (!ret) {
+                qxl_bo_unpin(user_bo);
+                qxl_bo_unreserve(user_bo);
+        }
+        drm_gem_object_unreference_unlocked(obj);
-        qxl_bo_unreserve(cursor_bo);
        qxl_bo_unref(&cursor_bo);
        return ret;
+out_backoff:
+        qxl_release_backoff_reserve_list(release);
 out_free_bo:
        qxl_bo_unref(&cursor_bo);
 out_free_release:
-        qxl_release_unreserve(qdev, release);
        qxl_release_free(qdev, release);
 out_kunmap:
        qxl_bo_kunmap(user_bo);
 out_unpin:
        qxl_bo_unpin(user_bo);
-out_unreserve:
-        qxl_bo_unreserve(user_bo);
 out_unref:
        drm_gem_object_unreference_unlocked(obj);
        return ret;
@@ -322,6 +336,14 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc,
        ret = qxl_alloc_release_reserved(qdev, sizeof(*cmd), QXL_RELEASE_CURSOR_CMD,
                                   &release, NULL);
+        if (ret)
+                return ret;
+        ret = qxl_release_reserve_list(release, true);
+        if (ret) {
+                qxl_release_free(qdev, release);
+                return ret;
+        }
        qcrtc->cur_x = x;
        qcrtc->cur_y = y;
@@ -332,9 +354,9 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc,
        cmd->u.position.y = qcrtc->cur_y;
        qxl_release_unmap(qdev, release, &cmd->release_info);
-        qxl_fence_releaseable(qdev, release);
        qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
-        qxl_release_unreserve(qdev, release);
+        qxl_release_fence_buffer_objects(release);
        return 0;
 }
diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c
index 3c8c3dbf9378..56e1d633875e 100644
--- a/drivers/gpu/drm/qxl/qxl_draw.c
+++ b/drivers/gpu/drm/qxl/qxl_draw.c
@@ -23,25 +23,29 @@
 #include "qxl_drv.h"
 #include "qxl_object.h"
+static int alloc_clips(struct qxl_device *qdev,
+                       struct qxl_release *release,
+                       unsigned num_clips,
+                       struct qxl_bo **clips_bo)
+{
+        int size = sizeof(struct qxl_clip_rects) + sizeof(struct qxl_rect) * num_clips;
+        return qxl_alloc_bo_reserved(qdev, release, size, clips_bo);
+}
 /* returns a pointer to the already allocated qxl_rect array inside
 * the qxl_clip_rects. This is *not* the same as the memory allocated
 * on the device, it is offset to qxl_clip_rects.chunk.data */
 static struct qxl_rect *drawable_set_clipping(struct qxl_device *qdev,
                                              struct qxl_drawable *drawable,
                                              unsigned num_clips,
-                                              struct qxl_bo **clips_bo,
+                                              struct qxl_bo *clips_bo)
-                                              struct qxl_release *release)
 {
        struct qxl_clip_rects *dev_clips;
        int ret;
-        int size = sizeof(*dev_clips) + sizeof(struct qxl_rect) * num_clips;
-        ret = qxl_alloc_bo_reserved(qdev, size, clips_bo);
-        if (ret)
-                return NULL;
-        ret = qxl_bo_kmap(*clips_bo, (void **)&dev_clips);
+        ret = qxl_bo_kmap(clips_bo, (void **)&dev_clips);
        if (ret) {
-                qxl_bo_unref(clips_bo);
                return NULL;
        }
        dev_clips->num_rects = num_clips;
@@ -52,20 +56,34 @@ static struct qxl_rect *drawable_set_clipping(struct qxl_device *qdev,
 }
 static int
+alloc_drawable(struct qxl_device *qdev, struct qxl_release **release)
+{
+        int ret;
+        ret = qxl_alloc_release_reserved(qdev, sizeof(struct qxl_drawable),
+                                         QXL_RELEASE_DRAWABLE, release,
+                                         NULL);
+        return ret;
+}
+static void
+free_drawable(struct qxl_device *qdev, struct qxl_release *release)
+{
+        qxl_release_free(qdev, release);
+}
+/* release needs to be reserved at this point */
+static int
 make_drawable(struct qxl_device *qdev, int surface, uint8_t type,
              const struct qxl_rect *rect,
-              struct qxl_release **release)
+              struct qxl_release *release)
 {
        struct qxl_drawable *drawable;
-        int i, ret;
+        int i;
-        ret = qxl_alloc_release_reserved(qdev, sizeof(*drawable),
+        drawable = (struct qxl_drawable *)qxl_release_map(qdev, release);
-                                         QXL_RELEASE_DRAWABLE, release,
+        if (!drawable)
-                                         NULL);
+                return -ENOMEM;
-        if (ret)
-                return ret;
-        drawable = (struct qxl_drawable *)qxl_release_map(qdev, *release);
        drawable->type = type;
        drawable->surface_id = surface;         /* Only primary for now */
@@ -91,14 +109,23 @@ make_drawable(struct qxl_device *qdev, int surface, uint8_t type,
                drawable->bbox = *rect;
        drawable->mm_time = qdev->rom->mm_clock;
-        qxl_release_unmap(qdev, *release, &drawable->release_info);
+        qxl_release_unmap(qdev, release, &drawable->release_info);
        return 0;
 }
-static int qxl_palette_create_1bit(struct qxl_bo **palette_bo,
+static int alloc_palette_object(struct qxl_device *qdev,
+                                struct qxl_release *release,
+                                struct qxl_bo **palette_bo)
+{
+        return qxl_alloc_bo_reserved(qdev, release,
+                                     sizeof(struct qxl_palette) + sizeof(uint32_t) * 2,
+                                     palette_bo);
+}
+static int qxl_palette_create_1bit(struct qxl_bo *palette_bo,
+                                   struct qxl_release *release,
                                   const struct qxl_fb_image *qxl_fb_image)
 {
-        struct qxl_device *qdev = qxl_fb_image->qdev;
        const struct fb_image *fb_image = &qxl_fb_image->fb_image;
        uint32_t visual = qxl_fb_image->visual;
        const uint32_t *pseudo_palette = qxl_fb_image->pseudo_palette;
@@ -108,12 +135,7 @@ static int qxl_palette_create_1bit(struct qxl_bo **palette_bo,
        static uint64_t unique; /* we make no attempt to actually set this
                                 * correctly globaly, since that would require
                                 * tracking all of our palettes. */
+        ret = qxl_bo_kmap(palette_bo, (void **)&pal);
-        ret = qxl_alloc_bo_reserved(qdev,
-                                    sizeof(struct qxl_palette) + sizeof(uint32_t) * 2,
-                                    palette_bo);
-        ret = qxl_bo_kmap(*palette_bo, (void **)&pal);
        pal->num_ents = 2;
        pal->unique = unique++;
        if (visual == FB_VISUAL_TRUECOLOR || visual == FB_VISUAL_DIRECTCOLOR) {
@@ -126,7 +148,7 @@ static int qxl_palette_create_1bit(struct qxl_bo **palette_bo,
        }
        pal->ents[0] = bgcolor;
        pal->ents[1] = fgcolor;
-        qxl_bo_kunmap(*palette_bo);
+        qxl_bo_kunmap(palette_bo);
        return 0;
 }
@@ -144,44 +166,63 @@ void qxl_draw_opaque_fb(const struct qxl_fb_image *qxl_fb_image,
        const char *src = fb_image->data;
        int depth = fb_image->depth;
        struct qxl_release *release;
-        struct qxl_bo *image_bo;
        struct qxl_image *image;
        int ret;
+        struct qxl_drm_image *dimage;
+        struct qxl_bo *palette_bo = NULL;
        if (stride == 0)
                stride = depth * width / 8;
+        ret = alloc_drawable(qdev, &release);
+        if (ret)
+                return;
+        ret = qxl_image_alloc_objects(qdev, release,
+                                      &dimage,
+                                      height, stride);
+        if (ret)
+                goto out_free_drawable;
+        if (depth == 1) {
+                ret = alloc_palette_object(qdev, release, &palette_bo);
+                if (ret)
+                        goto out_free_image;
+        }
+        /* do a reservation run over all the objects we just allocated */
+        ret = qxl_release_reserve_list(release, true);
+        if (ret)
+                goto out_free_palette;
        rect.left = x;
        rect.right = x + width;
        rect.top = y;
        rect.bottom = y + height;
-        ret = make_drawable(qdev, 0, QXL_DRAW_COPY, &rect, &release);
+        ret = make_drawable(qdev, 0, QXL_DRAW_COPY, &rect, release);
-        if (ret)
+        if (ret) {
-                return;
+                qxl_release_backoff_reserve_list(release);
+                goto out_free_palette;
+        }
-        ret = qxl_image_create(qdev, release, &image_bo,
+        ret = qxl_image_init(qdev, release, dimage,
-                               (const uint8_t *)src, 0, 0,
+                             (const uint8_t *)src, 0, 0,
-                               width, height, depth, stride);
+                             width, height, depth, stride);
        if (ret) {
-                qxl_release_unreserve(qdev, release);
+                qxl_release_backoff_reserve_list(release);
                qxl_release_free(qdev, release);
                return;
        }
        if (depth == 1) {
-                struct qxl_bo *palette_bo;
                void *ptr;
-                ret = qxl_palette_create_1bit(&palette_bo, qxl_fb_image);
+                ret = qxl_palette_create_1bit(palette_bo, release, qxl_fb_image);
-                qxl_release_add_res(qdev, release, palette_bo);
-                ptr = qxl_bo_kmap_atomic_page(qdev, image_bo, 0);
+                ptr = qxl_bo_kmap_atomic_page(qdev, dimage->bo, 0);
                image = ptr;
                image->u.bitmap.palette =
                        qxl_bo_physical_address(qdev, palette_bo, 0);
-                qxl_bo_kunmap_atomic_page(qdev, image_bo, ptr);
+                qxl_bo_kunmap_atomic_page(qdev, dimage->bo, ptr);
-                qxl_bo_unreserve(palette_bo);
-                qxl_bo_unref(&palette_bo);
        }
        drawable = (struct qxl_drawable *)qxl_release_map(qdev, release);
@@ -199,16 +240,20 @@ void qxl_draw_opaque_fb(const struct qxl_fb_image *qxl_fb_image,
        drawable->u.copy.mask.bitmap = 0;
        drawable->u.copy.src_bitmap =
-                qxl_bo_physical_address(qdev, image_bo, 0);
+                qxl_bo_physical_address(qdev, dimage->bo, 0);
        qxl_release_unmap(qdev, release, &drawable->release_info);
-        qxl_release_add_res(qdev, release, image_bo);
-        qxl_bo_unreserve(image_bo);
-        qxl_bo_unref(&image_bo);
-        qxl_fence_releaseable(qdev, release);
        qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
-        qxl_release_unreserve(qdev, release);
+        qxl_release_fence_buffer_objects(release);
+out_free_palette:
+        if (palette_bo)
+                qxl_bo_unref(&palette_bo);
+out_free_image:
+        qxl_image_free_objects(qdev, dimage);
+out_free_drawable:
+        if (ret)
+                free_drawable(qdev, release);
 }
 /* push a draw command using the given clipping rectangles as
@@ -243,10 +288,14 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
        int depth = qxl_fb->base.bits_per_pixel;
        uint8_t *surface_base;
        struct qxl_release *release;
-        struct qxl_bo *image_bo;
        struct qxl_bo *clips_bo;
+        struct qxl_drm_image *dimage;
        int ret;
+        ret = alloc_drawable(qdev, &release);
+        if (ret)
+                return;
        left = clips->x1;
        right = clips->x2;
        top = clips->y1;
@@ -263,36 +312,52 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
        width = right - left;
        height = bottom - top;
+        ret = alloc_clips(qdev, release, num_clips, &clips_bo);
+        if (ret)
+                goto out_free_drawable;
+        ret = qxl_image_alloc_objects(qdev, release,
+                                      &dimage,
+                                      height, stride);
+        if (ret)
+                goto out_free_clips;
+        /* do a reservation run over all the objects we just allocated */
+        ret = qxl_release_reserve_list(release, true);
+        if (ret)
+                goto out_free_image;
        drawable_rect.left = left;
        drawable_rect.right = right;
        drawable_rect.top = top;
        drawable_rect.bottom = bottom;
        ret = make_drawable(qdev, 0, QXL_DRAW_COPY, &drawable_rect,
-                            &release);
+                            release);
        if (ret)
-                return;
+                goto out_release_backoff;
        ret = qxl_bo_kmap(bo, (void **)&surface_base);
        if (ret)
-                goto out_unref;
+                goto out_release_backoff;
-        ret = qxl_image_create(qdev, release, &image_bo, surface_base,
-                               left, top, width, height, depth, stride);
+        ret = qxl_image_init(qdev, release, dimage, surface_base,
+                             left, top, width, height, depth, stride);
        qxl_bo_kunmap(bo);
        if (ret)
-                goto out_unref;
+                goto out_release_backoff;
+        rects = drawable_set_clipping(qdev, drawable, num_clips, clips_bo);
+        if (!rects)
+                goto out_release_backoff;
-        rects = drawable_set_clipping(qdev, drawable, num_clips, &clips_bo, release);
-        if (!rects) {
-                qxl_bo_unref(&image_bo);
-                goto out_unref;
-        }
        drawable = (struct qxl_drawable *)qxl_release_map(qdev, release);
        drawable->clip.type = SPICE_CLIP_TYPE_RECTS;
        drawable->clip.data = qxl_bo_physical_address(qdev,
                                                      clips_bo, 0);
-        qxl_release_add_res(qdev, release, clips_bo);
        drawable->u.copy.src_area.top = 0;
        drawable->u.copy.src_area.bottom = height;
@@ -306,11 +371,9 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
        drawable->u.copy.mask.pos.y = 0;
        drawable->u.copy.mask.bitmap = 0;
-        drawable->u.copy.src_bitmap = qxl_bo_physical_address(qdev, image_bo, 0);
+        drawable->u.copy.src_bitmap = qxl_bo_physical_address(qdev, dimage->bo, 0);
        qxl_release_unmap(qdev, release, &drawable->release_info);
-        qxl_release_add_res(qdev, release, image_bo);
-        qxl_bo_unreserve(image_bo);
-        qxl_bo_unref(&image_bo);
        clips_ptr = clips;
        for (i = 0; i < num_clips; i++, clips_ptr += inc) {
                rects[i].left   = clips_ptr->x1;
@@ -319,17 +382,22 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
                rects[i].bottom = clips_ptr->y2;
        }
        qxl_bo_kunmap(clips_bo);
-        qxl_bo_unreserve(clips_bo);
-        qxl_bo_unref(&clips_bo);
-        qxl_fence_releaseable(qdev, release);
        qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
-        qxl_release_unreserve(qdev, release);
+        qxl_release_fence_buffer_objects(release);
-        return;
+out_release_backoff:
+        if (ret)
+                qxl_release_backoff_reserve_list(release);
+out_free_image:
+        qxl_image_free_objects(qdev, dimage);
+out_free_clips:
+        qxl_bo_unref(&clips_bo);
+out_free_drawable:
+        /* only free drawable on error */
+        if (ret)
+                free_drawable(qdev, release);
-out_unref:
-        qxl_release_unreserve(qdev, release);
-        qxl_release_free(qdev, release);
 }
 void qxl_draw_copyarea(struct qxl_device *qdev,
@@ -342,22 +410,36 @@ void qxl_draw_copyarea(struct qxl_device *qdev,
        struct qxl_release *release;
        int ret;
+        ret = alloc_drawable(qdev, &release);
+        if (ret)
+                return;
+        /* do a reservation run over all the objects we just allocated */
+        ret = qxl_release_reserve_list(release, true);
+        if (ret)
+                goto out_free_release;
        rect.left = dx;
        rect.top = dy;
        rect.right = dx + width;
        rect.bottom = dy + height;
-        ret = make_drawable(qdev, 0, QXL_COPY_BITS, &rect, &release);
+        ret = make_drawable(qdev, 0, QXL_COPY_BITS, &rect, release);
-        if (ret)
+        if (ret) {
-                return;
+                qxl_release_backoff_reserve_list(release);
+                goto out_free_release;
+        }
        drawable = (struct qxl_drawable *)qxl_release_map(qdev, release);
        drawable->u.copy_bits.src_pos.x = sx;
        drawable->u.copy_bits.src_pos.y = sy;
        qxl_release_unmap(qdev, release, &drawable->release_info);
-        qxl_fence_releaseable(qdev, release);
        qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
-        qxl_release_unreserve(qdev, release);
+        qxl_release_fence_buffer_objects(release);
+out_free_release:
+        if (ret)
+                free_drawable(qdev, release);
 }
 void qxl_draw_fill(struct qxl_draw_fill *qxl_draw_fill_rec)
@@ -370,10 +452,21 @@ void qxl_draw_fill(struct qxl_draw_fill *qxl_draw_fill_rec)
        struct qxl_release *release;
        int ret;
-        ret = make_drawable(qdev, 0, QXL_DRAW_FILL, &rect, &release);
+        ret = alloc_drawable(qdev, &release);
        if (ret)
                return;
+        /* do a reservation run over all the objects we just allocated */
+        ret = qxl_release_reserve_list(release, true);
+        if (ret)
+                goto out_free_release;
+        ret = make_drawable(qdev, 0, QXL_DRAW_FILL, &rect, release);
+        if (ret) {
+                qxl_release_backoff_reserve_list(release);
+                goto out_free_release;
+        }
        drawable = (struct qxl_drawable *)qxl_release_map(qdev, release);
        drawable->u.fill.brush.type = SPICE_BRUSH_TYPE_SOLID;
        drawable->u.fill.brush.u.color = color;
@@ -384,7 +477,11 @@ void qxl_draw_fill(struct qxl_draw_fill *qxl_draw_fill_rec)
        drawable->u.fill.mask.bitmap = 0;
        qxl_release_unmap(qdev, release, &drawable->release_info);
-        qxl_fence_releaseable(qdev, release);
        qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
-        qxl_release_unreserve(qdev, release);
+        qxl_release_fence_buffer_objects(release);
+out_free_release:
+        if (ret)
+                free_drawable(qdev, release);
 }
diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
index aacb791464a3..7e96f4f11738 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.h
+++ b/drivers/gpu/drm/qxl/qxl_drv.h
@@ -42,6 +42,9 @@
 #include <ttm/ttm_placement.h>
 #include <ttm/ttm_module.h>
+/* just for ttm_validate_buffer */
+#include <ttm/ttm_execbuf_util.h>
 #include <drm/qxl_drm.h>
 #include "qxl_dev.h"
@@ -118,9 +121,9 @@ struct qxl_bo {
        uint32_t surface_id;
        struct qxl_fence fence; /* per bo fence  - list of releases */
        struct qxl_release *surf_create;
-        atomic_t reserve_count;
 };
 #define gem_to_qxl_bo(gobj) container_of((gobj), struct qxl_bo, gem_base)
+#define to_qxl_bo(tobj) container_of((tobj), struct qxl_bo, tbo)
 struct qxl_gem {
        struct mutex            mutex;
@@ -128,12 +131,7 @@ struct qxl_gem {
 };
 struct qxl_bo_list {
-        struct list_head lhead;
+        struct ttm_validate_buffer tv;
-        struct qxl_bo *bo;
-};
-struct qxl_reloc_list {
-        struct list_head bos;
 };
 struct qxl_crtc {
@@ -195,10 +193,20 @@ enum {
 struct qxl_release {
        int id;
        int type;
-        int bo_count;
        uint32_t release_offset;
        uint32_t surface_release_id;
-        struct qxl_bo *bos[QXL_MAX_RES];
+        struct ww_acquire_ctx ticket;
+        struct list_head bos;
+};
+struct qxl_drm_chunk {
+        struct list_head head;
+        struct qxl_bo *bo;
+};
+struct qxl_drm_image {
+        struct qxl_bo *bo;
+        struct list_head chunk_list;
 };
 struct qxl_fb_image {
@@ -314,6 +322,7 @@ struct qxl_device {
        struct workqueue_struct *gc_queue;
        struct work_struct gc_work;
+        struct work_struct fb_work;
 };
 /* forward declaration for QXL_INFO_IO */
@@ -433,12 +442,19 @@ int qxl_mmap(struct file *filp, struct vm_area_struct *vma);
 /* qxl image */
-int qxl_image_create(struct qxl_device *qdev,
+int qxl_image_init(struct qxl_device *qdev,
-                     struct qxl_release *release,
+                   struct qxl_release *release,
-                     struct qxl_bo **image_bo,
+                   struct qxl_drm_image *dimage,
-                     const uint8_t *data,
+                   const uint8_t *data,
-                     int x, int y, int width, int height,
+                   int x, int y, int width, int height,
-                     int depth, int stride);
+                   int depth, int stride);
+int
+qxl_image_alloc_objects(struct qxl_device *qdev,
+                        struct qxl_release *release,
+                        struct qxl_drm_image **image_ptr,
+                        int height, int stride);
+void qxl_image_free_objects(struct qxl_device *qdev, struct qxl_drm_image *dimage);
 void qxl_update_screen(struct qxl_device *qxl);
 /* qxl io operations (qxl_cmd.c) */
@@ -459,20 +475,15 @@ int qxl_ring_push(struct qxl_ring *ring, const void *new_elt, bool interruptible
 void qxl_io_flush_release(struct qxl_device *qdev);
 void qxl_io_flush_surfaces(struct qxl_device *qdev);
-int qxl_release_reserve(struct qxl_device *qdev,
-                        struct qxl_release *release, bool no_wait);
-void qxl_release_unreserve(struct qxl_device *qdev,
-                           struct qxl_release *release);
 union qxl_release_info *qxl_release_map(struct qxl_device *qdev,
                                        struct qxl_release *release);
 void qxl_release_unmap(struct qxl_device *qdev,
                       struct qxl_release *release,
                       union qxl_release_info *info);
-/*
+int qxl_release_list_add(struct qxl_release *release, struct qxl_bo *bo);
- * qxl_bo_add_resource.
+int qxl_release_reserve_list(struct qxl_release *release, bool no_intr);
- *
+void qxl_release_backoff_reserve_list(struct qxl_release *release);
- */
+void qxl_release_fence_buffer_objects(struct qxl_release *release);
-void qxl_bo_add_resource(struct qxl_bo *main_bo, struct qxl_bo *resource);
 int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
                                       enum qxl_surface_cmd_type surface_cmd_type,
@@ -481,15 +492,16 @@ int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
 int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
                               int type, struct qxl_release **release,
                               struct qxl_bo **rbo);
-int qxl_fence_releaseable(struct qxl_device *qdev,
-                          struct qxl_release *release);
 int
 qxl_push_command_ring_release(struct qxl_device *qdev, struct qxl_release *release,
                              uint32_t type, bool interruptible);
 int
 qxl_push_cursor_ring_release(struct qxl_device *qdev, struct qxl_release *release,
                             uint32_t type, bool interruptible);
-int qxl_alloc_bo_reserved(struct qxl_device *qdev, unsigned long size,
+int qxl_alloc_bo_reserved(struct qxl_device *qdev,
+                          struct qxl_release *release,
+                          unsigned long size,
                          struct qxl_bo **_bo);
 /* qxl drawing commands */
@@ -510,15 +522,9 @@ void qxl_draw_copyarea(struct qxl_device *qdev,
                       u32 sx, u32 sy,
                       u32 dx, u32 dy);
-uint64_t
-qxl_release_alloc(struct qxl_device *qdev, int type,
-                  struct qxl_release **ret);
 void qxl_release_free(struct qxl_device *qdev,
                      struct qxl_release *release);
-void qxl_release_add_res(struct qxl_device *qdev,
-                         struct qxl_release *release,
-                         struct qxl_bo *bo);
 /* used by qxl_debugfs_release */
 struct qxl_release *qxl_release_from_id_locked(struct qxl_device *qdev,
                                                   uint64_t id);
@@ -561,7 +567,7 @@ void qxl_surface_evict(struct qxl_device *qdev, struct qxl_bo *surf, bool freein
 int qxl_update_surface(struct qxl_device *qdev, struct qxl_bo *surf);
 /* qxl_fence.c */
-int qxl_fence_add_release(struct qxl_fence *qfence, uint32_t rel_id);
+void qxl_fence_add_release_locked(struct qxl_fence *qfence, uint32_t rel_id);
 int qxl_fence_remove_release(struct qxl_fence *qfence, uint32_t rel_id);
 int qxl_fence_init(struct qxl_device *qdev, struct qxl_fence *qfence);
 void qxl_fence_fini(struct qxl_fence *qfence);
diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
index 76f39d88d684..88722f233430 100644
--- a/drivers/gpu/drm/qxl/qxl_fb.c
+++ b/drivers/gpu/drm/qxl/qxl_fb.c
@@ -37,12 +37,29 @@
 #define QXL_DIRTY_DELAY (HZ / 30)
+#define QXL_FB_OP_FILLRECT 1
+#define QXL_FB_OP_COPYAREA 2
+#define QXL_FB_OP_IMAGEBLIT 3
+struct qxl_fb_op {
+        struct list_head head;
+        int op_type;
+        union {
+                struct fb_fillrect fr;
+                struct fb_copyarea ca;
+                struct fb_image ib;
+        } op;
+        void *img_data;
+};
 struct qxl_fbdev {
        struct drm_fb_helper helper;
        struct qxl_framebuffer  qfb;
        struct list_head        fbdev_list;
        struct qxl_device       *qdev;
+        spinlock_t delayed_ops_lock;
+        struct list_head delayed_ops;
        void *shadow;
        int size;
@@ -164,8 +181,69 @@ static struct fb_deferred_io qxl_defio = {
        .deferred_io    = qxl_deferred_io,
 };
-static void qxl_fb_fillrect(struct fb_info *info,
+static void qxl_fb_delayed_fillrect(struct qxl_fbdev *qfbdev,
-                            const struct fb_fillrect *fb_rect)
+                                    const struct fb_fillrect *fb_rect)
+{
+        struct qxl_fb_op *op;
+        unsigned long flags;
+        op = kmalloc(sizeof(struct qxl_fb_op), GFP_ATOMIC | __GFP_NOWARN);
+        if (!op)
+                return;
+        op->op.fr = *fb_rect;
+        op->img_data = NULL;
+        op->op_type = QXL_FB_OP_FILLRECT;
+        spin_lock_irqsave(&qfbdev->delayed_ops_lock, flags);
+        list_add_tail(&op->head, &qfbdev->delayed_ops);
+        spin_unlock_irqrestore(&qfbdev->delayed_ops_lock, flags);
+}
+static void qxl_fb_delayed_copyarea(struct qxl_fbdev *qfbdev,
+                                    const struct fb_copyarea *fb_copy)
+{
+        struct qxl_fb_op *op;
+        unsigned long flags;
+        op = kmalloc(sizeof(struct qxl_fb_op), GFP_ATOMIC | __GFP_NOWARN);
+        if (!op)
+                return;
+        op->op.ca = *fb_copy;
+        op->img_data = NULL;
+        op->op_type = QXL_FB_OP_COPYAREA;
+        spin_lock_irqsave(&qfbdev->delayed_ops_lock, flags);
+        list_add_tail(&op->head, &qfbdev->delayed_ops);
+        spin_unlock_irqrestore(&qfbdev->delayed_ops_lock, flags);
+}
+static void qxl_fb_delayed_imageblit(struct qxl_fbdev *qfbdev,
+                                     const struct fb_image *fb_image)
+{
+        struct qxl_fb_op *op;
+        unsigned long flags;
+        uint32_t size = fb_image->width * fb_image->height * (fb_image->depth >= 8 ? fb_image->depth / 8 : 1);
+        op = kmalloc(sizeof(struct qxl_fb_op) + size, GFP_ATOMIC | __GFP_NOWARN);
+        if (!op)
+                return;
+        op->op.ib = *fb_image;
+        op->img_data = (void *)(op + 1);
+        op->op_type = QXL_FB_OP_IMAGEBLIT;
+        memcpy(op->img_data, fb_image->data, size);
+        op->op.ib.data = op->img_data;
+        spin_lock_irqsave(&qfbdev->delayed_ops_lock, flags);
+        list_add_tail(&op->head, &qfbdev->delayed_ops);
+        spin_unlock_irqrestore(&qfbdev->delayed_ops_lock, flags);
+}
+static void qxl_fb_fillrect_internal(struct fb_info *info,
+                                     const struct fb_fillrect *fb_rect)
 {
        struct qxl_fbdev *qfbdev = info->par;
        struct qxl_device *qdev = qfbdev->qdev;
@@ -203,17 +281,28 @@ static void qxl_fb_fillrect(struct fb_info *info,
        qxl_draw_fill_rec.rect = rect;
        qxl_draw_fill_rec.color = color;
        qxl_draw_fill_rec.rop = rop;
+        qxl_draw_fill(&qxl_draw_fill_rec);
+}
+static void qxl_fb_fillrect(struct fb_info *info,
+                            const struct fb_fillrect *fb_rect)
+{
+        struct qxl_fbdev *qfbdev = info->par;
+        struct qxl_device *qdev = qfbdev->qdev;
        if (!drm_can_sleep()) {
-                qxl_io_log(qdev,
+                qxl_fb_delayed_fillrect(qfbdev, fb_rect);
-                        "%s: TODO use RCU, mysterious locks with spin_lock\n",
+                schedule_work(&qdev->fb_work);
-                        __func__);
                return;
        }
-        qxl_draw_fill(&qxl_draw_fill_rec);
+        /* make sure any previous work is done */
+        flush_work(&qdev->fb_work);
+        qxl_fb_fillrect_internal(info, fb_rect);
 }
-static void qxl_fb_copyarea(struct fb_info *info,
+static void qxl_fb_copyarea_internal(struct fb_info *info,
-                            const struct fb_copyarea *region)
+                                     const struct fb_copyarea *region)
 {
        struct qxl_fbdev *qfbdev = info->par;
@@ -223,37 +312,89 @@ static void qxl_fb_copyarea(struct fb_info *info,
                          region->dx, region->dy);
 }
+static void qxl_fb_copyarea(struct fb_info *info,
+                            const struct fb_copyarea *region)
+{
+        struct qxl_fbdev *qfbdev = info->par;
+        struct qxl_device *qdev = qfbdev->qdev;
+        if (!drm_can_sleep()) {
+                qxl_fb_delayed_copyarea(qfbdev, region);
+                schedule_work(&qdev->fb_work);
+                return;
+        }
+        /* make sure any previous work is done */
+        flush_work(&qdev->fb_work);
+        qxl_fb_copyarea_internal(info, region);
+}
 static void qxl_fb_imageblit_safe(struct qxl_fb_image *qxl_fb_image)
 {
        qxl_draw_opaque_fb(qxl_fb_image, 0);
 }
+static void qxl_fb_imageblit_internal(struct fb_info *info,
+                                      const struct fb_image *image)
+{
+        struct qxl_fbdev *qfbdev = info->par;
+        struct qxl_fb_image qxl_fb_image;
+        /* ensure proper order  rendering operations - TODO: must do this
+         * for everything. */
+        qxl_fb_image_init(&qxl_fb_image, qfbdev->qdev, info, image);
+        qxl_fb_imageblit_safe(&qxl_fb_image);
+}
 static void qxl_fb_imageblit(struct fb_info *info,
                             const struct fb_image *image)
 {
        struct qxl_fbdev *qfbdev = info->par;
        struct qxl_device *qdev = qfbdev->qdev;
-        struct qxl_fb_image qxl_fb_image;
        if (!drm_can_sleep()) {
-                /* we cannot do any ttm_bo allocation since that will fail on
+                qxl_fb_delayed_imageblit(qfbdev, image);
-                 * ioremap_wc..__get_vm_area_node, so queue the work item
+                schedule_work(&qdev->fb_work);
-                 * instead This can happen from printk inside an interrupt
-                 * context, i.e.: smp_apic_timer_interrupt..check_cpu_stall */
-                qxl_io_log(qdev,
-                        "%s: TODO use RCU, mysterious locks with spin_lock\n",
-                           __func__);
                return;
        }
+        /* make sure any previous work is done */
+        flush_work(&qdev->fb_work);
+        qxl_fb_imageblit_internal(info, image);
+}
-        /* ensure proper order of rendering operations - TODO: must do this
+static void qxl_fb_work(struct work_struct *work)
-         * for everything. */
+{
-        qxl_fb_image_init(&qxl_fb_image, qfbdev->qdev, info, image);
+        struct qxl_device *qdev = container_of(work, struct qxl_device, fb_work);
-        qxl_fb_imageblit_safe(&qxl_fb_image);
+        unsigned long flags;
+        struct qxl_fb_op *entry, *tmp;
+        struct qxl_fbdev *qfbdev = qdev->mode_info.qfbdev;
+        /* since the irq context just adds entries to the end of the
+           list dropping the lock should be fine, as entry isn't modified
+           in the operation code */
+        spin_lock_irqsave(&qfbdev->delayed_ops_lock, flags);
+        list_for_each_entry_safe(entry, tmp, &qfbdev->delayed_ops, head) {
+                spin_unlock_irqrestore(&qfbdev->delayed_ops_lock, flags);
+                switch (entry->op_type) {
+                case QXL_FB_OP_FILLRECT:
+                        qxl_fb_fillrect_internal(qfbdev->helper.fbdev, &entry->op.fr);
+                        break;
+                case QXL_FB_OP_COPYAREA:
+                        qxl_fb_copyarea_internal(qfbdev->helper.fbdev, &entry->op.ca);
+                        break;
+                case QXL_FB_OP_IMAGEBLIT:
+                        qxl_fb_imageblit_internal(qfbdev->helper.fbdev, &entry->op.ib);
+                        break;
+                }
+                spin_lock_irqsave(&qfbdev->delayed_ops_lock, flags);
+                list_del(&entry->head);
+                kfree(entry);
+        }
+        spin_unlock_irqrestore(&qfbdev->delayed_ops_lock, flags);
 }
 int qxl_fb_init(struct qxl_device *qdev)
 {
+        INIT_WORK(&qdev->fb_work, qxl_fb_work);
        return 0;
 }
@@ -536,7 +677,8 @@ int qxl_fbdev_init(struct qxl_device *qdev)
        qfbdev->qdev = qdev;
        qdev->mode_info.qfbdev = qfbdev;
        qfbdev->helper.funcs = &qxl_fb_helper_funcs;
+        spin_lock_init(&qfbdev->delayed_ops_lock);
+        INIT_LIST_HEAD(&qfbdev->delayed_ops);
        ret = drm_fb_helper_init(qdev->ddev, &qfbdev->helper,
                                 qxl_num_crtc /* num_crtc - QXL supports just 1 */,
                                 QXLFB_CONN_LIMIT);
diff --git a/drivers/gpu/drm/qxl/qxl_fence.c b/drivers/gpu/drm/qxl/qxl_fence.c
index 63c6715ad385..ae59e91cfb9a 100644
--- a/drivers/gpu/drm/qxl/qxl_fence.c
+++ b/drivers/gpu/drm/qxl/qxl_fence.c
@@ -49,17 +49,11 @@
   For some reason every so often qxl hw fails to release, things go wrong.
 */
+/* must be called with the fence lock held */
+void qxl_fence_add_release_locked(struct qxl_fence *qfence, uint32_t rel_id)
-int qxl_fence_add_release(struct qxl_fence *qfence, uint32_t rel_id)
 {
-        struct qxl_bo *bo = container_of(qfence, struct qxl_bo, fence);
-        spin_lock(&bo->tbo.bdev->fence_lock);
        radix_tree_insert(&qfence->tree, rel_id, qfence);
        qfence->num_active_releases++;
-        spin_unlock(&bo->tbo.bdev->fence_lock);
-        return 0;
 }
 int qxl_fence_remove_release(struct qxl_fence *qfence, uint32_t rel_id)
diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c
index a235693aabba..25e1777fb0a2 100644
--- a/drivers/gpu/drm/qxl/qxl_gem.c
+++ b/drivers/gpu/drm/qxl/qxl_gem.c
@@ -55,7 +55,7 @@ int qxl_gem_object_create(struct qxl_device *qdev, int size,
        /* At least align on page size */
        if (alignment < PAGE_SIZE)
                alignment = PAGE_SIZE;
-        r = qxl_bo_create(qdev, size, kernel, initial_domain, surf, &qbo);
+        r = qxl_bo_create(qdev, size, kernel, false, initial_domain, surf, &qbo);
        if (r) {
                if (r != -ERESTARTSYS)
                        DRM_ERROR(
diff --git a/drivers/gpu/drm/qxl/qxl_image.c b/drivers/gpu/drm/qxl/qxl_image.c
index cf856206996b..7fbcc35e8ad3 100644
--- a/drivers/gpu/drm/qxl/qxl_image.c
+++ b/drivers/gpu/drm/qxl/qxl_image.c
@@ -30,31 +30,100 @@
 #include "qxl_object.h"
 static int
-qxl_image_create_helper(struct qxl_device *qdev,
+qxl_allocate_chunk(struct qxl_device *qdev,
+                   struct qxl_release *release,
+                   struct qxl_drm_image *image,
+                   unsigned int chunk_size)
+{
+        struct qxl_drm_chunk *chunk;
+        int ret;
+        chunk = kmalloc(sizeof(struct qxl_drm_chunk), GFP_KERNEL);
+        if (!chunk)
+                return -ENOMEM;
+        ret = qxl_alloc_bo_reserved(qdev, release, chunk_size, &chunk->bo);
+        if (ret) {
+                kfree(chunk);
+                return ret;
+        }
+        list_add_tail(&chunk->head, &image->chunk_list);
+        return 0;
+}
+int
+qxl_image_alloc_objects(struct qxl_device *qdev,
                        struct qxl_release *release,
-                        struct qxl_bo **image_bo,
+                        struct qxl_drm_image **image_ptr,
-                        const uint8_t *data,
+                        int height, int stride)
-                        int width, int height,
+{
-                        int depth, unsigned int hash,
+        struct qxl_drm_image *image;
-                        int stride)
+        int ret;
+        image = kmalloc(sizeof(struct qxl_drm_image), GFP_KERNEL);
+        if (!image)
+                return -ENOMEM;
+        INIT_LIST_HEAD(&image->chunk_list);
+        ret = qxl_alloc_bo_reserved(qdev, release, sizeof(struct qxl_image), &image->bo);
+        if (ret) {
+                kfree(image);
+                return ret;
+        }
+        ret = qxl_allocate_chunk(qdev, release, image, sizeof(struct qxl_data_chunk) + stride * height);
+        if (ret) {
+                qxl_bo_unref(&image->bo);
+                kfree(image);
+                return ret;
+        }
+        *image_ptr = image;
+        return 0;
+}
+void qxl_image_free_objects(struct qxl_device *qdev, struct qxl_drm_image *dimage)
 {
+        struct qxl_drm_chunk *chunk, *tmp;
+        list_for_each_entry_safe(chunk, tmp, &dimage->chunk_list, head) {
+                qxl_bo_unref(&chunk->bo);
+                kfree(chunk);
+        }
+        qxl_bo_unref(&dimage->bo);
+        kfree(dimage);
+}
+static int
+qxl_image_init_helper(struct qxl_device *qdev,
+                      struct qxl_release *release,
+                      struct qxl_drm_image *dimage,
+                      const uint8_t *data,
+                      int width, int height,
+                      int depth, unsigned int hash,
+                      int stride)
+{
+        struct qxl_drm_chunk *drv_chunk;
        struct qxl_image *image;
        struct qxl_data_chunk *chunk;
        int i;
        int chunk_stride;
        int linesize = width * depth / 8;
-        struct qxl_bo *chunk_bo;
+        struct qxl_bo *chunk_bo, *image_bo;
-        int ret;
        void *ptr;
        /* Chunk */
        /* FIXME: Check integer overflow */
        /* TODO: variable number of chunks */
+        drv_chunk = list_first_entry(&dimage->chunk_list, struct qxl_drm_chunk, head);
+        chunk_bo = drv_chunk->bo;
        chunk_stride = stride; /* TODO: should use linesize, but it renders
                                  wrong (check the bitmaps are sent correctly
                                  first) */
-        ret = qxl_alloc_bo_reserved(qdev, sizeof(*chunk) + height * chunk_stride,
-                                    &chunk_bo);
-        
        ptr = qxl_bo_kmap_atomic_page(qdev, chunk_bo, 0);
        chunk = ptr;
        chunk->data_size = height * chunk_stride;
@@ -102,7 +171,6 @@ qxl_image_create_helper(struct qxl_device *qdev,
                                while (remain > 0) {
                                        page_base = out_offset & PAGE_MASK;
                                        page_offset = offset_in_page(out_offset);
-                                        
                                        size = min((int)(PAGE_SIZE - page_offset), remain);
                                        ptr = qxl_bo_kmap_atomic_page(qdev, chunk_bo, page_base);
@@ -116,14 +184,10 @@ qxl_image_create_helper(struct qxl_device *qdev,
                        }
                }
        }
        qxl_bo_kunmap(chunk_bo);
-        /* Image */
+        image_bo = dimage->bo;
-        ret = qxl_alloc_bo_reserved(qdev, sizeof(*image), image_bo);
+        ptr = qxl_bo_kmap_atomic_page(qdev, image_bo, 0);
-        ptr = qxl_bo_kmap_atomic_page(qdev, *image_bo, 0);
        image = ptr;
        image->descriptor.id = 0;
@@ -154,23 +218,20 @@ qxl_image_create_helper(struct qxl_device *qdev,
        image->u.bitmap.stride = chunk_stride;
        image->u.bitmap.palette = 0;
        image->u.bitmap.data = qxl_bo_physical_address(qdev, chunk_bo, 0);
-        qxl_release_add_res(qdev, release, chunk_bo);
-        qxl_bo_unreserve(chunk_bo);
-        qxl_bo_unref(&chunk_bo);
-        qxl_bo_kunmap_atomic_page(qdev, *image_bo, ptr);
+        qxl_bo_kunmap_atomic_page(qdev, image_bo, ptr);
        return 0;
 }
-int qxl_image_create(struct qxl_device *qdev,
+int qxl_image_init(struct qxl_device *qdev,
                     struct qxl_release *release,
-                     struct qxl_bo **image_bo,
+                     struct qxl_drm_image *dimage,
                     const uint8_t *data,
                     int x, int y, int width, int height,
                     int depth, int stride)
 {
        data += y * stride + x * (depth / 8);
-        return qxl_image_create_helper(qdev, release, image_bo, data,
+        return qxl_image_init_helper(qdev, release, dimage, data,
                                       width, height, depth, 0, stride);
 }
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 27f45e49250d..6de33563d6f1 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -68,55 +68,60 @@ static int qxl_map_ioctl(struct drm_device *dev, void *data,
                                  &qxl_map->offset);
 }
+struct qxl_reloc_info {
+        int type;
+        struct qxl_bo *dst_bo;
+        uint32_t dst_offset;
+        struct qxl_bo *src_bo;
+        int src_offset;
+};
 /*
 * dst must be validated, i.e. whole bo on vram/surfacesram (right now all bo's
 * are on vram).
 * *(dst + dst_off) = qxl_bo_physical_address(src, src_off)
 */
 static void
-apply_reloc(struct qxl_device *qdev, struct qxl_bo *dst, uint64_t dst_off,
+apply_reloc(struct qxl_device *qdev, struct qxl_reloc_info *info)
-            struct qxl_bo *src, uint64_t src_off)
 {
        void *reloc_page;
+        reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo, info->dst_offset & PAGE_MASK);
-        reloc_page = qxl_bo_kmap_atomic_page(qdev, dst, dst_off & PAGE_MASK);
+        *(uint64_t *)(reloc_page + (info->dst_offset & ~PAGE_MASK)) = qxl_bo_physical_address(qdev,
-        *(uint64_t *)(reloc_page + (dst_off & ~PAGE_MASK)) = qxl_bo_physical_address(qdev,
+                                                                                              info->src_bo,
-                                                                     src, src_off);
+                                                                                              info->src_offset);
-        qxl_bo_kunmap_atomic_page(qdev, dst, reloc_page);
+        qxl_bo_kunmap_atomic_page(qdev, info->dst_bo, reloc_page);
 }
 static void
-apply_surf_reloc(struct qxl_device *qdev, struct qxl_bo *dst, uint64_t dst_off,
+apply_surf_reloc(struct qxl_device *qdev, struct qxl_reloc_info *info)
-                 struct qxl_bo *src)
 {
        uint32_t id = 0;
        void *reloc_page;
-        if (src && !src->is_primary)
+        if (info->src_bo && !info->src_bo->is_primary)
-                id = src->surface_id;
+                id = info->src_bo->surface_id;
-        reloc_page = qxl_bo_kmap_atomic_page(qdev, dst, dst_off & PAGE_MASK);
+        reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo, info->dst_offset & PAGE_MASK);
-        *(uint32_t *)(reloc_page + (dst_off & ~PAGE_MASK)) = id;
+        *(uint32_t *)(reloc_page + (info->dst_offset & ~PAGE_MASK)) = id;
-        qxl_bo_kunmap_atomic_page(qdev, dst, reloc_page);
+        qxl_bo_kunmap_atomic_page(qdev, info->dst_bo, reloc_page);
 }
 /* return holding the reference to this object */
 static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
                                         struct drm_file *file_priv, uint64_t handle,
-                                         struct qxl_reloc_list *reloc_list)
+                                         struct qxl_release *release)
 {
        struct drm_gem_object *gobj;
        struct qxl_bo *qobj;
        int ret;
        gobj = drm_gem_object_lookup(qdev->ddev, file_priv, handle);
-        if (!gobj) {
+        if (!gobj)
-                DRM_ERROR("bad bo handle %lld\n", handle);
                return NULL;
-        }
        qobj = gem_to_qxl_bo(gobj);
-        ret = qxl_bo_list_add(reloc_list, qobj);
+        ret = qxl_release_list_add(release, qobj);
        if (ret)
                return NULL;
@@ -129,151 +134,177 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
 * However, the command as passed from user space must *not* contain the initial
 * QXLReleaseInfo struct (first XXX bytes)
 */
-static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+static int qxl_process_single_command(struct qxl_device *qdev,
-                                struct drm_file *file_priv)
+                                      struct drm_qxl_command *cmd,
+                                      struct drm_file *file_priv)
 {
-        struct qxl_device *qdev = dev->dev_private;
+        struct qxl_reloc_info *reloc_info;
-        struct drm_qxl_execbuffer *execbuffer = data;
+        int release_type;
-        struct drm_qxl_command user_cmd;
+        struct qxl_release *release;
-        int cmd_num;
+        struct qxl_bo *cmd_bo;
-        struct qxl_bo *reloc_src_bo;
-        struct qxl_bo *reloc_dst_bo;
-        struct drm_qxl_reloc reloc;
        void *fb_cmd;
-        int i, ret;
+        int i, j, ret, num_relocs;
-        struct qxl_reloc_list reloc_list;
        int unwritten;
-        uint32_t reloc_dst_offset;
-        INIT_LIST_HEAD(&reloc_list.bos);
-        for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) {
+        switch (cmd->type) {
-                struct qxl_release *release;
+        case QXL_CMD_DRAW:
-                struct qxl_bo *cmd_bo;
+                release_type = QXL_RELEASE_DRAWABLE;
-                int release_type;
+                break;
-                struct drm_qxl_command *commands =
+        case QXL_CMD_SURFACE:
-                        (struct drm_qxl_command *)(uintptr_t)execbuffer->commands;
+        case QXL_CMD_CURSOR:
+        default:
+                DRM_DEBUG("Only draw commands in execbuffers\n");
+                return -EINVAL;
+                break;
+        }
-                if (DRM_COPY_FROM_USER(&user_cmd, &commands[cmd_num],
+        if (cmd->command_size > PAGE_SIZE - sizeof(union qxl_release_info))
-                                       sizeof(user_cmd)))
+                return -EINVAL;
-                        return -EFAULT;
-                switch (user_cmd.type) {
-                case QXL_CMD_DRAW:
-                        release_type = QXL_RELEASE_DRAWABLE;
-                        break;
-                case QXL_CMD_SURFACE:
-                case QXL_CMD_CURSOR:
-                default:
-                        DRM_DEBUG("Only draw commands in execbuffers\n");
-                        return -EINVAL;
-                        break;
-                }
-                if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
+        if (!access_ok(VERIFY_READ,
-                        return -EINVAL;
+                       (void *)(unsigned long)cmd->command,
+                       cmd->command_size))
+                return -EFAULT;
-                if (!access_ok(VERIFY_READ,
+        reloc_info = kmalloc(sizeof(struct qxl_reloc_info) * cmd->relocs_num, GFP_KERNEL);
-                               (void *)(unsigned long)user_cmd.command,
+        if (!reloc_info)
-                               user_cmd.command_size))
+                return -ENOMEM;
-                        return -EFAULT;
-                ret = qxl_alloc_release_reserved(qdev,
+        ret = qxl_alloc_release_reserved(qdev,
-                                                 sizeof(union qxl_release_info) +
+                                         sizeof(union qxl_release_info) +
-                                                 user_cmd.command_size,
+                                         cmd->command_size,
-                                                 release_type,
+                                         release_type,
-                                                 &release,
+                                         &release,
-                                                 &cmd_bo);
+                                         &cmd_bo);
-                if (ret)
+        if (ret)
-                        return ret;
+                goto out_free_reloc;
-                /* TODO copy slow path code from i915 */
+        /* TODO copy slow path code from i915 */
-                fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
+        fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
-                unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void *)(unsigned long)user_cmd.command, user_cmd.command_size);
+        unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void *)(unsigned long)cmd->command, cmd->command_size);
-                {
+        {
-                        struct qxl_drawable *draw = fb_cmd;
+                struct qxl_drawable *draw = fb_cmd;
+                draw->mm_time = qdev->rom->mm_clock;
+        }
-                        draw->mm_time = qdev->rom->mm_clock;
+        qxl_bo_kunmap_atomic_page(qdev, cmd_bo, fb_cmd);
-                }
+        if (unwritten) {
-                qxl_bo_kunmap_atomic_page(qdev, cmd_bo, fb_cmd);
+                DRM_ERROR("got unwritten %d\n", unwritten);
-                if (unwritten) {
+                ret = -EFAULT;
-                        DRM_ERROR("got unwritten %d\n", unwritten);
+                goto out_free_release;
-                        qxl_release_unreserve(qdev, release);
+        }
-                        qxl_release_free(qdev, release);
-                        return -EFAULT;
+        /* fill out reloc info structs */
+        num_relocs = 0;
+        for (i = 0; i < cmd->relocs_num; ++i) {
+                struct drm_qxl_reloc reloc;
+                if (DRM_COPY_FROM_USER(&reloc,
+                                       &((struct drm_qxl_reloc *)(uintptr_t)cmd->relocs)[i],
+                                       sizeof(reloc))) {
+                        ret = -EFAULT;
+                        goto out_free_bos;
                }
-                for (i = 0 ; i < user_cmd.relocs_num; ++i) {
+                /* add the bos to the list of bos to validate -
-                        if (DRM_COPY_FROM_USER(&reloc,
+                   need to validate first then process relocs? */
-                                               &((struct drm_qxl_reloc *)(uintptr_t)user_cmd.relocs)[i],
+                if (reloc.reloc_type != QXL_RELOC_TYPE_BO && reloc.reloc_type != QXL_RELOC_TYPE_SURF) {
-                                               sizeof(reloc))) {
+                        DRM_DEBUG("unknown reloc type %d\n", reloc_info[i].type);
-                                qxl_bo_list_unreserve(&reloc_list, true);
-                                qxl_release_unreserve(qdev, release);
-                                qxl_release_free(qdev, release);
-                                return -EFAULT;
-                        }
-                        /* add the bos to the list of bos to validate -
+                        ret = -EINVAL;
-                           need to validate first then process relocs? */
+                        goto out_free_bos;
-                        if (reloc.dst_handle) {
+                }
-                                reloc_dst_bo = qxlhw_handle_to_bo(qdev, file_priv,
+                reloc_info[i].type = reloc.reloc_type;
-                                                                  reloc.dst_handle, &reloc_list);
-                                if (!reloc_dst_bo) {
+                if (reloc.dst_handle) {
-                                        qxl_bo_list_unreserve(&reloc_list, true);
+                        reloc_info[i].dst_bo = qxlhw_handle_to_bo(qdev, file_priv,
-                                        qxl_release_unreserve(qdev, release);
+                                                                  reloc.dst_handle, release);
-                                        qxl_release_free(qdev, release);
+                        if (!reloc_info[i].dst_bo) {
-                                        return -EINVAL;
+                                ret = -EINVAL;
-                                }
+                                reloc_info[i].src_bo = NULL;
-                                reloc_dst_offset = 0;
+                                goto out_free_bos;
-                        } else {
-                                reloc_dst_bo = cmd_bo;
-                                reloc_dst_offset = release->release_offset;
                        }
+                        reloc_info[i].dst_offset = reloc.dst_offset;
-                        /* reserve and validate the reloc dst bo */
+                } else {
-                        if (reloc.reloc_type == QXL_RELOC_TYPE_BO || reloc.src_handle > 0) {
+                        reloc_info[i].dst_bo = cmd_bo;
-                                reloc_src_bo =
+                        reloc_info[i].dst_offset = reloc.dst_offset + release->release_offset;
-                                        qxlhw_handle_to_bo(qdev, file_priv,
+                }
-                                                           reloc.src_handle, &reloc_list);
+                num_relocs++;
-                                if (!reloc_src_bo) {
-                                        if (reloc_dst_bo != cmd_bo)
+                /* reserve and validate the reloc dst bo */
-                                                drm_gem_object_unreference_unlocked(&reloc_dst_bo->gem_base);
+                if (reloc.reloc_type == QXL_RELOC_TYPE_BO || reloc.src_handle > 0) {
-                                        qxl_bo_list_unreserve(&reloc_list, true);
+                        reloc_info[i].src_bo =
-                                        qxl_release_unreserve(qdev, release);
+                                qxlhw_handle_to_bo(qdev, file_priv,
-                                        qxl_release_free(qdev, release);
+                                                   reloc.src_handle, release);
-                                        return -EINVAL;
+                        if (!reloc_info[i].src_bo) {
-                                }
+                                if (reloc_info[i].dst_bo != cmd_bo)
-                        } else
+                                        drm_gem_object_unreference_unlocked(&reloc_info[i].dst_bo->gem_base);
-                                reloc_src_bo = NULL;
+                                ret = -EINVAL;
-                        if (reloc.reloc_type == QXL_RELOC_TYPE_BO) {
+                                goto out_free_bos;
-                                apply_reloc(qdev, reloc_dst_bo, reloc_dst_offset + reloc.dst_offset,
-                                            reloc_src_bo, reloc.src_offset);
-                        } else if (reloc.reloc_type == QXL_RELOC_TYPE_SURF) {
-                                apply_surf_reloc(qdev, reloc_dst_bo, reloc_dst_offset + reloc.dst_offset, reloc_src_bo);
-                        } else {
-                                DRM_ERROR("unknown reloc type %d\n", reloc.reloc_type);
-                                return -EINVAL;
                        }
+                        reloc_info[i].src_offset = reloc.src_offset;
+                } else {
+                        reloc_info[i].src_bo = NULL;
+                        reloc_info[i].src_offset = 0;
+                }
+        }
-                        if (reloc_src_bo && reloc_src_bo != cmd_bo) {
+        /* validate all buffers */
-                                qxl_release_add_res(qdev, release, reloc_src_bo);
+        ret = qxl_release_reserve_list(release, false);
-                                drm_gem_object_unreference_unlocked(&reloc_src_bo->gem_base);
+        if (ret)
-                        }
+                goto out_free_bos;
-                        if (reloc_dst_bo != cmd_bo)
+        for (i = 0; i < cmd->relocs_num; ++i) {
-                                drm_gem_object_unreference_unlocked(&reloc_dst_bo->gem_base);
+                if (reloc_info[i].type == QXL_RELOC_TYPE_BO)
-                }
+                        apply_reloc(qdev, &reloc_info[i]);
-                qxl_fence_releaseable(qdev, release);
+                else if (reloc_info[i].type == QXL_RELOC_TYPE_SURF)
+                        apply_surf_reloc(qdev, &reloc_info[i]);
+        }
-                ret = qxl_push_command_ring_release(qdev, release, user_cmd.type, true);
+        ret = qxl_push_command_ring_release(qdev, release, cmd->type, true);
-                if (ret == -ERESTARTSYS) {
+        if (ret)
-                        qxl_release_unreserve(qdev, release);
+                qxl_release_backoff_reserve_list(release);
-                        qxl_release_free(qdev, release);
+        else
-                        qxl_bo_list_unreserve(&reloc_list, true);
+                qxl_release_fence_buffer_objects(release);
+out_free_bos:
+        for (j = 0; j < num_relocs; j++) {
+                if (reloc_info[j].dst_bo != cmd_bo)
+                        drm_gem_object_unreference_unlocked(&reloc_info[j].dst_bo->gem_base);
+                if (reloc_info[j].src_bo && reloc_info[j].src_bo != cmd_bo)
+                        drm_gem_object_unreference_unlocked(&reloc_info[j].src_bo->gem_base);
+        }
+out_free_release:
+        if (ret)
+                qxl_release_free(qdev, release);
+out_free_reloc:
+        kfree(reloc_info);
+        return ret;
+}
+static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+                                struct drm_file *file_priv)
+{
+        struct qxl_device *qdev = dev->dev_private;
+        struct drm_qxl_execbuffer *execbuffer = data;
+        struct drm_qxl_command user_cmd;
+        int cmd_num;
+        int ret;
+        for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) {
+                struct drm_qxl_command *commands =
+                        (struct drm_qxl_command *)(uintptr_t)execbuffer->commands;
+                if (DRM_COPY_FROM_USER(&user_cmd, &commands[cmd_num],
+                                       sizeof(user_cmd)))
+                        return -EFAULT;
+                ret = qxl_process_single_command(qdev, &user_cmd, file_priv);
+                if (ret)
                        return ret;
-                }
-                qxl_release_unreserve(qdev, release);
        }
-        qxl_bo_list_unreserve(&reloc_list, 0);
        return 0;
 }
@@ -305,7 +336,7 @@ static int qxl_update_area_ioctl(struct drm_device *dev, void *data,
                goto out;
        if (!qobj->pin_count) {
-                qxl_ttm_placement_from_domain(qobj, qobj->type);
+                qxl_ttm_placement_from_domain(qobj, qobj->type, false);
                ret = ttm_bo_validate(&qobj->tbo, &qobj->placement,
                                      true, false);
                if (unlikely(ret))
diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
index 1191fe7788c9..aa161cddd87e 100644
--- a/drivers/gpu/drm/qxl/qxl_object.c
+++ b/drivers/gpu/drm/qxl/qxl_object.c
@@ -51,20 +51,21 @@ bool qxl_ttm_bo_is_qxl_bo(struct ttm_buffer_object *bo)
        return false;
 }
-void qxl_ttm_placement_from_domain(struct qxl_bo *qbo, u32 domain)
+void qxl_ttm_placement_from_domain(struct qxl_bo *qbo, u32 domain, bool pinned)
 {
        u32 c = 0;
+        u32 pflag = pinned ? TTM_PL_FLAG_NO_EVICT : 0;
        qbo->placement.fpfn = 0;
        qbo->placement.lpfn = 0;
        qbo->placement.placement = qbo->placements;
        qbo->placement.busy_placement = qbo->placements;
        if (domain == QXL_GEM_DOMAIN_VRAM)
-                qbo->placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_VRAM;
+                qbo->placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_VRAM | pflag;
        if (domain == QXL_GEM_DOMAIN_SURFACE)
-                qbo->placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_PRIV0;
+                qbo->placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_PRIV0 | pflag;
        if (domain == QXL_GEM_DOMAIN_CPU)
-                qbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
+                qbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM | pflag;
        if (!c)
                qbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
        qbo->placement.num_placement = c;
@@ -73,7 +74,7 @@ void qxl_ttm_placement_from_domain(struct qxl_bo *qbo, u32 domain)
 int qxl_bo_create(struct qxl_device *qdev,
-                  unsigned long size, bool kernel, u32 domain,
+                  unsigned long size, bool kernel, bool pinned, u32 domain,
                  struct qxl_surface *surf,
                  struct qxl_bo **bo_ptr)
 {
@@ -99,15 +100,15 @@ int qxl_bo_create(struct qxl_device *qdev,
        }
        bo->gem_base.driver_private = NULL;
        bo->type = domain;
-        bo->pin_count = 0;
+        bo->pin_count = pinned ? 1 : 0;
        bo->surface_id = 0;
        qxl_fence_init(qdev, &bo->fence);
        INIT_LIST_HEAD(&bo->list);
-        atomic_set(&bo->reserve_count, 0);
        if (surf)
                bo->surf = *surf;
-        qxl_ttm_placement_from_domain(bo, domain);
+        qxl_ttm_placement_from_domain(bo, domain, pinned);
        r = ttm_bo_init(&qdev->mman.bdev, &bo->tbo, size, type,
                        &bo->placement, 0, !kernel, NULL, size,
@@ -228,7 +229,7 @@ struct qxl_bo *qxl_bo_ref(struct qxl_bo *bo)
 int qxl_bo_pin(struct qxl_bo *bo, u32 domain, u64 *gpu_addr)
 {
        struct qxl_device *qdev = (struct qxl_device *)bo->gem_base.dev->dev_private;
-        int r, i;
+        int r;
        if (bo->pin_count) {
                bo->pin_count++;
@@ -236,9 +237,7 @@ int qxl_bo_pin(struct qxl_bo *bo, u32 domain, u64 *gpu_addr)
                        *gpu_addr = qxl_bo_gpu_offset(bo);
                return 0;
        }
-        qxl_ttm_placement_from_domain(bo, domain);
+        qxl_ttm_placement_from_domain(bo, domain, true);
-        for (i = 0; i < bo->placement.num_placement; i++)
-                bo->placements[i] |= TTM_PL_FLAG_NO_EVICT;
        r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
        if (likely(r == 0)) {
                bo->pin_count = 1;
@@ -317,53 +316,6 @@ int qxl_bo_check_id(struct qxl_device *qdev, struct qxl_bo *bo)
        return 0;
 }
-void qxl_bo_list_unreserve(struct qxl_reloc_list *reloc_list, bool failed)
-{
-        struct qxl_bo_list *entry, *sf;
-        list_for_each_entry_safe(entry, sf, &reloc_list->bos, lhead) {
-                qxl_bo_unreserve(entry->bo);
-                list_del(&entry->lhead);
-                kfree(entry);
-        }
-}
-int qxl_bo_list_add(struct qxl_reloc_list *reloc_list, struct qxl_bo *bo)
-{
-        struct qxl_bo_list *entry;
-        int ret;
-        list_for_each_entry(entry, &reloc_list->bos, lhead) {
-                if (entry->bo == bo)
-                        return 0;
-        }
-        entry = kmalloc(sizeof(struct qxl_bo_list), GFP_KERNEL);
-        if (!entry)
-                return -ENOMEM;
-        entry->bo = bo;
-        list_add(&entry->lhead, &reloc_list->bos);
-        ret = qxl_bo_reserve(bo, false);
-        if (ret)
-                return ret;
-        if (!bo->pin_count) {
-                qxl_ttm_placement_from_domain(bo, bo->type);
-                ret = ttm_bo_validate(&bo->tbo, &bo->placement,
-                                      true, false);
-                if (ret)
-                        return ret;
-        }
-        /* allocate a surface for reserved + validated buffers */
-        ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo);
-        if (ret)
-                return ret;
-        return 0;
-}
 int qxl_surf_evict(struct qxl_device *qdev)
 {
        return ttm_bo_evict_mm(&qdev->mman.bdev, TTM_PL_PRIV0);
diff --git a/drivers/gpu/drm/qxl/qxl_object.h b/drivers/gpu/drm/qxl/qxl_object.h
index ee7ad79ce781..8cb6167038e5 100644
--- a/drivers/gpu/drm/qxl/qxl_object.h
+++ b/drivers/gpu/drm/qxl/qxl_object.h
@@ -88,7 +88,7 @@ static inline int qxl_bo_wait(struct qxl_bo *bo, u32 *mem_type,
 extern int qxl_bo_create(struct qxl_device *qdev,
                         unsigned long size,
-                         bool kernel, u32 domain,
+                         bool kernel, bool pinned, u32 domain,
                         struct qxl_surface *surf,
                         struct qxl_bo **bo_ptr);
 extern int qxl_bo_kmap(struct qxl_bo *bo, void **ptr);
@@ -99,9 +99,7 @@ extern struct qxl_bo *qxl_bo_ref(struct qxl_bo *bo);
 extern void qxl_bo_unref(struct qxl_bo **bo);
 extern int qxl_bo_pin(struct qxl_bo *bo, u32 domain, u64 *gpu_addr);
 extern int qxl_bo_unpin(struct qxl_bo *bo);
-extern void qxl_ttm_placement_from_domain(struct qxl_bo *qbo, u32 domain);
+extern void qxl_ttm_placement_from_domain(struct qxl_bo *qbo, u32 domain, bool pinned);
 extern bool qxl_ttm_bo_is_qxl_bo(struct ttm_buffer_object *bo);
-extern int qxl_bo_list_add(struct qxl_reloc_list *reloc_list, struct qxl_bo *bo);
-extern void qxl_bo_list_unreserve(struct qxl_reloc_list *reloc_list, bool failed);
 #endif
diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
index b443d6751d5f..b61449e52cd5 100644
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -38,7 +38,8 @@
 static const int release_size_per_bo[] = { RELEASE_SIZE, SURFACE_RELEASE_SIZE, RELEASE_SIZE };
 static const int releases_per_bo[] = { RELEASES_PER_BO, SURFACE_RELEASES_PER_BO, RELEASES_PER_BO };
-uint64_t
+static uint64_t
 qxl_release_alloc(struct qxl_device *qdev, int type,
                  struct qxl_release **ret)
 {
@@ -53,9 +54,9 @@ qxl_release_alloc(struct qxl_device *qdev, int type,
                return 0;
        }
        release->type = type;
-        release->bo_count = 0;
        release->release_offset = 0;
        release->surface_release_id = 0;
+        INIT_LIST_HEAD(&release->bos);
        idr_preload(GFP_KERNEL);
        spin_lock(&qdev->release_idr_lock);
@@ -77,20 +78,20 @@ void
 qxl_release_free(struct qxl_device *qdev,
                 struct qxl_release *release)
 {
-        int i;
+        struct qxl_bo_list *entry, *tmp;
+        QXL_INFO(qdev, "release %d, type %d\n", release->id,
-        QXL_INFO(qdev, "release %d, type %d, %d bos\n", release->id,
+                 release->type);
-                 release->type, release->bo_count);
        if (release->surface_release_id)
                qxl_surface_id_dealloc(qdev, release->surface_release_id);
-        for (i = 0 ; i < release->bo_count; ++i) {
+        list_for_each_entry_safe(entry, tmp, &release->bos, tv.head) {
+                struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
                QXL_INFO(qdev, "release %llx\n",
-                        release->bos[i]->tbo.addr_space_offset
+                        entry->tv.bo->addr_space_offset
                                                - DRM_FILE_OFFSET);
-                qxl_fence_remove_release(&release->bos[i]->fence, release->id);
+                qxl_fence_remove_release(&bo->fence, release->id);
-                qxl_bo_unref(&release->bos[i]);
+                qxl_bo_unref(&bo);
        }
        spin_lock(&qdev->release_idr_lock);
        idr_remove(&qdev->release_idr, release->id);
@@ -98,83 +99,117 @@ qxl_release_free(struct qxl_device *qdev,
        kfree(release);
 }
-void
-qxl_release_add_res(struct qxl_device *qdev, struct qxl_release *release,
-                    struct qxl_bo *bo)
-{
-        int i;
-        for (i = 0; i < release->bo_count; i++)
-                if (release->bos[i] == bo)
-                        return;
-        if (release->bo_count >= QXL_MAX_RES) {
-                DRM_ERROR("exceeded max resource on a qxl_release item\n");
-                return;
-        }
-        release->bos[release->bo_count++] = qxl_bo_ref(bo);
-}
 static int qxl_release_bo_alloc(struct qxl_device *qdev,
                                struct qxl_bo **bo)
 {
        int ret;
-        ret = qxl_bo_create(qdev, PAGE_SIZE, false, QXL_GEM_DOMAIN_VRAM, NULL,
+        /* pin releases bo's they are too messy to evict */
+        ret = qxl_bo_create(qdev, PAGE_SIZE, false, true,
+                            QXL_GEM_DOMAIN_VRAM, NULL,
                            bo);
        return ret;
 }
-int qxl_release_reserve(struct qxl_device *qdev,
+int qxl_release_list_add(struct qxl_release *release, struct qxl_bo *bo)
-                        struct qxl_release *release, bool no_wait)
+{
+        struct qxl_bo_list *entry;
+        list_for_each_entry(entry, &release->bos, tv.head) {
+                if (entry->tv.bo == &bo->tbo)
+                        return 0;
+        }
+        entry = kmalloc(sizeof(struct qxl_bo_list), GFP_KERNEL);
+        if (!entry)
+                return -ENOMEM;
+        qxl_bo_ref(bo);
+        entry->tv.bo = &bo->tbo;
+        list_add_tail(&entry->tv.head, &release->bos);
+        return 0;
+}
+static int qxl_release_validate_bo(struct qxl_bo *bo)
 {
        int ret;
-        if (atomic_inc_return(&release->bos[0]->reserve_count) == 1) {
-                ret = qxl_bo_reserve(release->bos[0], no_wait);
+        if (!bo->pin_count) {
+                qxl_ttm_placement_from_domain(bo, bo->type, false);
+                ret = ttm_bo_validate(&bo->tbo, &bo->placement,
+                                      true, false);
                if (ret)
                        return ret;
        }
+        /* allocate a surface for reserved + validated buffers */
+        ret = qxl_bo_check_id(bo->gem_base.dev->dev_private, bo);
+        if (ret)
+                return ret;
+        return 0;
+}
+int qxl_release_reserve_list(struct qxl_release *release, bool no_intr)
+{
+        int ret;
+        struct qxl_bo_list *entry;
+        /* if only one object on the release its the release itself
+           since these objects are pinned no need to reserve */
+        if (list_is_singular(&release->bos))
+                return 0;
+        ret = ttm_eu_reserve_buffers(&release->ticket, &release->bos);
+        if (ret)
+                return ret;
+        list_for_each_entry(entry, &release->bos, tv.head) {
+                struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
+                ret = qxl_release_validate_bo(bo);
+                if (ret) {
+                        ttm_eu_backoff_reservation(&release->ticket, &release->bos);
+                        return ret;
+                }
+        }
        return 0;
 }
-void qxl_release_unreserve(struct qxl_device *qdev,
+void qxl_release_backoff_reserve_list(struct qxl_release *release)
-                          struct qxl_release *release)
 {
-        if (atomic_dec_and_test(&release->bos[0]->reserve_count))
+        /* if only one object on the release its the release itself
-                qxl_bo_unreserve(release->bos[0]);
+           since these objects are pinned no need to reserve */
+        if (list_is_singular(&release->bos))
+                return;
+        ttm_eu_backoff_reservation(&release->ticket, &release->bos);
 }
 int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
                                       enum qxl_surface_cmd_type surface_cmd_type,
                                       struct qxl_release *create_rel,
                                       struct qxl_release **release)
 {
-        int ret;
        if (surface_cmd_type == QXL_SURFACE_CMD_DESTROY && create_rel) {
                int idr_ret;
+                struct qxl_bo_list *entry = list_first_entry(&create_rel->bos, struct qxl_bo_list, tv.head);
                struct qxl_bo *bo;
                union qxl_release_info *info;
                /* stash the release after the create command */
                idr_ret = qxl_release_alloc(qdev, QXL_RELEASE_SURFACE_CMD, release);
-                bo = qxl_bo_ref(create_rel->bos[0]);
+                bo = qxl_bo_ref(to_qxl_bo(entry->tv.bo));
                (*release)->release_offset = create_rel->release_offset + 64;
-                qxl_release_add_res(qdev, *release, bo);
+                qxl_release_list_add(*release, bo);
-                ret = qxl_release_reserve(qdev, *release, false);
-                if (ret) {
-                        DRM_ERROR("release reserve failed\n");
-                        goto out_unref;
-                }
                info = qxl_release_map(qdev, *release);
                info->id = idr_ret;
                qxl_release_unmap(qdev, *release, info);
-out_unref:
                qxl_bo_unref(&bo);
-                return ret;
+                return 0;
        }
        return qxl_alloc_release_reserved(qdev, sizeof(struct qxl_surface_cmd),
@@ -187,7 +222,7 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
 {
        struct qxl_bo *bo;
        int idr_ret;
-        int ret;
+        int ret = 0;
        union qxl_release_info *info;
        int cur_idx;
@@ -216,11 +251,6 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
                        mutex_unlock(&qdev->release_mutex);
                        return ret;
                }
-                /* pin releases bo's they are too messy to evict */
-                ret = qxl_bo_reserve(qdev->current_release_bo[cur_idx], false);
-                qxl_bo_pin(qdev->current_release_bo[cur_idx], QXL_GEM_DOMAIN_VRAM, NULL);
-                qxl_bo_unreserve(qdev->current_release_bo[cur_idx]);
        }
        bo = qxl_bo_ref(qdev->current_release_bo[cur_idx]);
@@ -231,36 +261,18 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
        if (rbo)
                *rbo = bo;
-        qxl_release_add_res(qdev, *release, bo);
-        ret = qxl_release_reserve(qdev, *release, false);
        mutex_unlock(&qdev->release_mutex);
-        if (ret)
-                goto out_unref;
+        qxl_release_list_add(*release, bo);
        info = qxl_release_map(qdev, *release);
        info->id = idr_ret;
        qxl_release_unmap(qdev, *release, info);
-out_unref:
        qxl_bo_unref(&bo);
        return ret;
 }
-int qxl_fence_releaseable(struct qxl_device *qdev,
-                          struct qxl_release *release)
-{
-        int i, ret;
-        for (i = 0; i < release->bo_count; i++) {
-                if (!release->bos[i]->tbo.sync_obj)
-                        release->bos[i]->tbo.sync_obj = &release->bos[i]->fence;
-                ret = qxl_fence_add_release(&release->bos[i]->fence, release->id);
-                if (ret)
-                        return ret;
-        }
-        return 0;
-}
 struct qxl_release *qxl_release_from_id_locked(struct qxl_device *qdev,
                                                   uint64_t id)
 {
@@ -273,10 +285,7 @@ struct qxl_release *qxl_release_from_id_locked(struct qxl_device *qdev,
                DRM_ERROR("failed to find id in release_idr\n");
                return NULL;
        }
-        if (release->bo_count < 1) {
-                DRM_ERROR("read a released resource with 0 bos\n");
-                return NULL;
-        }
        return release;
 }
@@ -285,9 +294,12 @@ union qxl_release_info *qxl_release_map(struct qxl_device *qdev,
 {
        void *ptr;
        union qxl_release_info *info;
-        struct qxl_bo *bo = release->bos[0];
+        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+        struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
        ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_SIZE);
+        if (!ptr)
+                return NULL;
        info = ptr + (release->release_offset & ~PAGE_SIZE);
        return info;
 }
@@ -296,9 +308,51 @@ void qxl_release_unmap(struct qxl_device *qdev,
                       struct qxl_release *release,
                       union qxl_release_info *info)
 {
-        struct qxl_bo *bo = release->bos[0];
+        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
+        struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
        void *ptr;
        ptr = ((void *)info) - (release->release_offset & ~PAGE_SIZE);
        qxl_bo_kunmap_atomic_page(qdev, bo, ptr);
 }
+void qxl_release_fence_buffer_objects(struct qxl_release *release)
+{
+        struct ttm_validate_buffer *entry;
+        struct ttm_buffer_object *bo;
+        struct ttm_bo_global *glob;
+        struct ttm_bo_device *bdev;
+        struct ttm_bo_driver *driver;
+        struct qxl_bo *qbo;
+        /* if only one object on the release its the release itself
+           since these objects are pinned no need to reserve */
+        if (list_is_singular(&release->bos))
+                return;
+        bo = list_first_entry(&release->bos, struct ttm_validate_buffer, head)->bo;
+        bdev = bo->bdev;
+        driver = bdev->driver;
+        glob = bo->glob;
+        spin_lock(&glob->lru_lock);
+        spin_lock(&bdev->fence_lock);
+        list_for_each_entry(entry, &release->bos, head) {
+                bo = entry->bo;
+                qbo = to_qxl_bo(bo);
+                if (!entry->bo->sync_obj)
+                        entry->bo->sync_obj = &qbo->fence;
+                qxl_fence_add_release_locked(&qbo->fence, release->id);
+                ttm_bo_add_to_lru(bo);
+                ww_mutex_unlock(&bo->resv->lock);
+                entry->reserved = false;
+        }
+        spin_unlock(&bdev->fence_lock);
+        spin_unlock(&glob->lru_lock);
+        ww_acquire_fini(&release->ticket);
+}
diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
index 489cb8cece4d..1dfd84cda2a1 100644
--- a/drivers/gpu/drm/qxl/qxl_ttm.c
+++ b/drivers/gpu/drm/qxl/qxl_ttm.c
@@ -206,7 +206,7 @@ static void qxl_evict_flags(struct ttm_buffer_object *bo,
                return;
        }
        qbo = container_of(bo, struct qxl_bo, tbo);
-        qxl_ttm_placement_from_domain(qbo, QXL_GEM_DOMAIN_CPU);
+        qxl_ttm_placement_from_domain(qbo, QXL_GEM_DOMAIN_CPU, false);
        *placement = qbo->placement;
 }
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index b0d3fb341417..bb9ea3641312 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -157,9 +157,9 @@ static void evergreen_audio_set_dto(struct drm_encoder *encoder, u32 clock)
         * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
         * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
         */
+        WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
        WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
        WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
-        WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
 }
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 559cf24d51af..4f9b9bc20daa 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -1054,10 +1054,6 @@ static int ni_restrict_performance_levels_before_switch(struct radeon_device *rd
 int ni_dpm_force_performance_level(struct radeon_device *rdev,
                                   enum radeon_dpm_forced_level level)
 {
-        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
-        struct ni_ps *ps = ni_get_ps(rps);
-        u32 levels;
        if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
                        return -EINVAL;
@@ -1068,8 +1064,7 @@ int ni_dpm_force_performance_level(struct radeon_device *rdev,
                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                        return -EINVAL;
-                levels = ps->performance_level_count - 1;
+                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 1) != PPSMC_Result_OK)
-                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                        return -EINVAL;
        } else if (level == RADEON_DPM_FORCED_LEVEL_AUTO) {
                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index e3f3e8841789..4ccd61f60eb6 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2782,7 +2782,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                                                             ATOM_PLL_CNTL_FLAG_PLL_POST_DIV_EN) ? true : false;
                                dividers->enable_dithen = (args.v3.ucCntlFlag &
                                                           ATOM_PLL_CNTL_FLAG_FRACTION_DISABLE) ? false : true;
-                                dividers->fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDiv);
+                                dividers->whole_fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDiv);
                                dividers->frac_fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDivFrac);
                                dividers->ref_div = args.v3.ucRefDiv;
                                dividers->vco_mode = (args.v3.ucCntlFlag &
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index d325280e2f9f..6ca904673a4f 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -5215,14 +5215,12 @@ static void si_enable_mc_ls(struct radeon_device *rdev,
 static void si_init_cg(struct radeon_device *rdev)
 {
-        bool has_uvd = true;
        si_enable_mgcg(rdev, true);
-        si_enable_cgcg(rdev, true);
+        si_enable_cgcg(rdev, false);
        /* disable MC LS on Tahiti */
        if (rdev->family == CHIP_TAHITI)
                si_enable_mc_ls(rdev, false);
-        if (has_uvd) {
+        if (rdev->has_uvd) {
                si_enable_uvd_mgcg(rdev, true);
                si_init_uvd_internal_cg(rdev);
        }
@@ -5230,9 +5228,7 @@ static void si_init_cg(struct radeon_device *rdev)
 static void si_fini_cg(struct radeon_device *rdev)
 {
-        bool has_uvd = true;
+        if (rdev->has_uvd)
-        if (has_uvd)
                si_enable_uvd_mgcg(rdev, false);
        si_enable_cgcg(rdev, false);
        si_enable_mgcg(rdev, false);
@@ -5241,11 +5237,11 @@ static void si_fini_cg(struct radeon_device *rdev)
 static void si_init_pg(struct radeon_device *rdev)
 {
        bool has_pg = false;
+#if 0
        /* only cape verde supports PG */
        if (rdev->family == CHIP_VERDE)
                has_pg = true;
+#endif
        if (has_pg) {
                si_init_ao_cu_mask(rdev);
                si_init_dma_pg(rdev);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 73aaa2e4c312..1604a87cf2fe 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -37,8 +37,6 @@
 #define SMC_RAM_END                 0x20000
-#define DDR3_DRAM_ROWS              0x2000
 #define SCLK_MIN_DEEPSLEEP_FREQ     1350
 static const struct si_cac_config_reg cac_weights_tahiti[] =
@@ -1931,6 +1929,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                        si_pi->cac_override = cac_override_pitcairn;
                        si_pi->powertune_data = &powertune_data_pitcairn;
                        si_pi->dte_data = dte_data_pitcairn;
+                        break;
                }
        } else if (rdev->family == CHIP_VERDE) {
                si_pi->lcac_config = lcac_cape_verde;
@@ -1941,6 +1940,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                case 0x683B:
                case 0x683F:
                case 0x6829:
+                case 0x6835:
                        si_pi->cac_weights = cac_weights_cape_verde_pro;
                        si_pi->dte_data = dte_data_cape_verde;
                        break;
@@ -2042,7 +2042,8 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
        ni_pi->enable_sq_ramping = false;
        si_pi->enable_dte = false;
-        if (si_pi->powertune_data->enable_powertune_by_default) {
+        /* XXX: fix me */
+        if (0/*si_pi->powertune_data->enable_powertune_by_default*/) {
                ni_pi->enable_power_containment= true;
                ni_pi->enable_cac = true;
                if (si_pi->dte_data.enable_dte_by_default) {
@@ -3237,10 +3238,10 @@ int si_dpm_force_performance_level(struct radeon_device *rdev,
 {
        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
        struct ni_ps *ps = ni_get_ps(rps);
-        u32 levels;
+        u32 levels = ps->performance_level_count;
        if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                        return -EINVAL;
                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 1) != PPSMC_Result_OK)
@@ -3249,14 +3250,13 @@ int si_dpm_force_performance_level(struct radeon_device *rdev,
                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                        return -EINVAL;
-                levels = ps->performance_level_count - 1;
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 1) != PPSMC_Result_OK)
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                        return -EINVAL;
        } else if (level == RADEON_DPM_FORCED_LEVEL_AUTO) {
                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                        return -EINVAL;
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                        return -EINVAL;
        }
@@ -3620,8 +3620,12 @@ static void si_enable_display_gap(struct radeon_device *rdev)
 {
        u32 tmp = RREG32(CG_DISPLAY_GAP_CNTL);
+        tmp &= ~(DISP1_GAP_MASK | DISP2_GAP_MASK);
+        tmp |= (DISP1_GAP(R600_PM_DISPLAY_GAP_IGNORE) |
+                DISP2_GAP(R600_PM_DISPLAY_GAP_IGNORE));
        tmp &= ~(DISP1_GAP_MCHG_MASK | DISP2_GAP_MCHG_MASK);
-        tmp |= (DISP1_GAP_MCHG(R600_PM_DISPLAY_GAP_IGNORE) |
+        tmp |= (DISP1_GAP_MCHG(R600_PM_DISPLAY_GAP_VBLANK) |
                DISP2_GAP_MCHG(R600_PM_DISPLAY_GAP_IGNORE));
        WREG32(CG_DISPLAY_GAP_CNTL, tmp);
 }
@@ -4036,16 +4040,15 @@ static int si_force_switch_to_arb_f0(struct radeon_device *rdev)
 static u32 si_calculate_memory_refresh_rate(struct radeon_device *rdev,
                                            u32 engine_clock)
 {
-        struct rv7xx_power_info *pi = rv770_get_pi(rdev);
        u32 dram_rows;
        u32 dram_refresh_rate;
        u32 mc_arb_rfsh_rate;
        u32 tmp = (RREG32(MC_ARB_RAMCFG) & NOOFROWS_MASK) >> NOOFROWS_SHIFT;
-        if (pi->mem_gddr5)
+        if (tmp >= 4)
-                dram_rows = 1 << (tmp + 10);
+                dram_rows = 16384;
        else
-                dram_rows = DDR3_DRAM_ROWS;
+                dram_rows = 1 << (tmp + 10);
        dram_refresh_rate = 1 << ((RREG32(MC_SEQ_MISC0) & 0x3) + 3);
        mc_arb_rfsh_rate = ((engine_clock * 10) * dram_refresh_rate / dram_rows - 32) / 64;
@@ -6013,16 +6016,11 @@ int si_dpm_set_power_state(struct radeon_device *rdev)
                return ret;
        }
-#if 0
-        /* XXX */
        ret = si_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
        if (ret) {
                DRM_ERROR("si_dpm_force_performance_level failed\n");
                return ret;
        }
-#else
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
-#endif
        return 0;
 }
diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
index 4c605c70ebf9..deb5c25305af 100644
--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -562,7 +562,7 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size,
                                struct hv_hotadd_state *has)
 {
        int ret = 0;
-        int i, nid, t;
+        int i, nid;
        unsigned long start_pfn;
        unsigned long processed_pfn;
        unsigned long total_pfn = pfn_count;
@@ -607,14 +607,11 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size,
                /*
                 * Wait for the memory block to be onlined.
+                 * Since the hot add has succeeded, it is ok to
+                 * proceed even if the pages in the hot added region
+                 * have not been "onlined" within the allowed time.
                 */
-                t = wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ);
+                wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ);
-                if (t == 0) {
-                        pr_info("hot_add memory timedout\n");
-                        has->ha_end_pfn -= HA_CHUNK;
-                        has->covered_end_pfn -=  processed_pfn;
-                        break;
-                }
        }
@@ -978,6 +975,14 @@ static void post_status(struct hv_dynmem_device *dm)
                                dm->num_pages_ballooned +
                                compute_balloon_floor();
+        /*
+         * If our transaction ID is no longer current, just don't
+         * send the status. This can happen if we were interrupted
+         * after we picked our transaction ID.
+         */
+        if (status.hdr.trans_id != atomic_read(&trans_id))
+                return;
        vmbus_sendpacket(dm->dev->channel, &status,
                                sizeof(struct dm_status),
                                (unsigned long)NULL,
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index a2464bf07c49..e8e071fc1d6d 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -690,7 +690,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
        if (ret)
                pr_err("Unable to register child device\n");
        else
-                pr_info("child device %s registered\n",
+                pr_debug("child device %s registered\n",
                        dev_name(&child_device_obj->device));
        return ret;
@@ -702,14 +702,14 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 */
 void vmbus_device_unregister(struct hv_device *device_obj)
 {
+        pr_debug("child device %s unregistered\n",
+                dev_name(&device_obj->device));
        /*
         * Kick off the process of unregistering the device.
         * This will call vmbus_remove() and eventually vmbus_device_release()
         */
        device_unregister(&device_obj->device);
-        pr_info("child device %s unregistered\n",
-                dev_name(&device_obj->device));
 }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 957a719e8c2f..df7b0a06b0ea 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2290,12 +2290,18 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
        d = r10_bio->devs[1].devnum;
        wbio = r10_bio->devs[1].bio;
        wbio2 = r10_bio->devs[1].repl_bio;
+        /* Need to test wbio2->bi_end_io before we call
+         * generic_make_request as if the former is NULL,
+         * the latter is free to free wbio2.
+         */
+        if (wbio2 && !wbio2->bi_end_io)
+                wbio2 = NULL;
        if (wbio->bi_end_io) {
                atomic_inc(&conf->mirrors[d].rdev->nr_pending);
                md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio));
                generic_make_request(wbio);
        }
-        if (wbio2 && wbio2->bi_end_io) {
+        if (wbio2) {
                atomic_inc(&conf->mirrors[d].replacement->nr_pending);
                md_sync_acct(conf->mirrors[d].replacement->bdev,
                             bio_sectors(wbio2));
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2bf094a587cb..78ea44336e75 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3462,6 +3462,7 @@ static void handle_stripe(struct stripe_head *sh)
                    test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
                        set_bit(STRIPE_SYNCING, &sh->state);
                        clear_bit(STRIPE_INSYNC, &sh->state);
+                        clear_bit(STRIPE_REPLACED, &sh->state);
                }
                spin_unlock(&sh->stripe_lock);
        }
@@ -3607,19 +3608,23 @@ static void handle_stripe(struct stripe_head *sh)
                        handle_parity_checks5(conf, sh, &s, disks);
        }
-        if (s.replacing && s.locked == 0
+        if ((s.replacing || s.syncing) && s.locked == 0
-            && !test_bit(STRIPE_INSYNC, &sh->state)) {
+            && !test_bit(STRIPE_COMPUTE_RUN, &sh->state)
+            && !test_bit(STRIPE_REPLACED, &sh->state)) {
                /* Write out to replacement devices where possible */
                for (i = 0; i < conf->raid_disks; i++)
-                        if (test_bit(R5_UPTODATE, &sh->dev[i].flags) &&
+                        if (test_bit(R5_NeedReplace, &sh->dev[i].flags)) {
-                            test_bit(R5_NeedReplace, &sh->dev[i].flags)) {
+                                WARN_ON(!test_bit(R5_UPTODATE, &sh->dev[i].flags));
                                set_bit(R5_WantReplace, &sh->dev[i].flags);
                                set_bit(R5_LOCKED, &sh->dev[i].flags);
                                s.locked++;
                        }
-                set_bit(STRIPE_INSYNC, &sh->state);
+                if (s.replacing)
+                        set_bit(STRIPE_INSYNC, &sh->state);
+                set_bit(STRIPE_REPLACED, &sh->state);
        }
        if ((s.syncing || s.replacing) && s.locked == 0 &&
+            !test_bit(STRIPE_COMPUTE_RUN, &sh->state) &&
            test_bit(STRIPE_INSYNC, &sh->state)) {
                md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
                clear_bit(STRIPE_SYNCING, &sh->state);
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index b0b663b119a8..70c49329ca9a 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -306,6 +306,7 @@ enum {
        STRIPE_SYNC_REQUESTED,
        STRIPE_SYNCING,
        STRIPE_INSYNC,
+        STRIPE_REPLACED,
        STRIPE_PREREAD_ACTIVE,
        STRIPE_DELAYED,
        STRIPE_DEGRADED,
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index f7b90661e321..e068a76a5f6f 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -66,14 +66,19 @@ EXPORT_SYMBOL(ssc_request);
 void ssc_free(struct ssc_device *ssc)
 {
+        bool disable_clk = true;
        spin_lock(&user_lock);
-        if (ssc->user) {
+        if (ssc->user)
                ssc->user--;
-                clk_disable_unprepare(ssc->clk);
+        else {
-        } else {
+                disable_clk = false;
                dev_dbg(&ssc->pdev->dev, "device already free\n");
        }
        spin_unlock(&user_lock);
+        if (disable_clk)
+                clk_disable_unprepare(ssc->clk);
 }
 EXPORT_SYMBOL(ssc_free);
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index f9296abcf02a..6127ab64bb39 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -167,7 +167,7 @@ int mei_hbm_start_req(struct mei_device *dev)
        dev->hbm_state = MEI_HBM_IDLE;
        if (mei_write_message(dev, mei_hdr, dev->wr_msg.data)) {
-                dev_err(&dev->pdev->dev, "version message writet failed\n");
+                dev_err(&dev->pdev->dev, "version message write failed\n");
                dev->dev_state = MEI_DEV_RESETTING;
                mei_reset(dev, 1);
                return -ENODEV;
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index e4f8dec4dc3c..b22c7e247225 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -239,14 +239,18 @@ static int mei_me_hw_ready_wait(struct mei_device *dev)
        if (mei_me_hw_is_ready(dev))
                return 0;
+        dev->recvd_hw_ready = false;
        mutex_unlock(&dev->device_lock);
        err = wait_event_interruptible_timeout(dev->wait_hw_ready,
-                        dev->recvd_hw_ready, MEI_INTEROP_TIMEOUT);
+                        dev->recvd_hw_ready,
+                        mei_secs_to_jiffies(MEI_INTEROP_TIMEOUT));
        mutex_lock(&dev->device_lock);
        if (!err && !dev->recvd_hw_ready) {
+                if (!err)
+                        err = -ETIMEDOUT;
                dev_err(&dev->pdev->dev,
-                        "wait hw ready failed. status = 0x%x\n", err);
+                        "wait hw ready failed. status = %d\n", err);
-                return -ETIMEDOUT;
+                return err;
        }
        dev->recvd_hw_ready = false;
@@ -483,7 +487,9 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
        /* check if ME wants a reset */
        if (!mei_hw_is_ready(dev) &&
            dev->dev_state != MEI_DEV_RESETTING &&
-            dev->dev_state != MEI_DEV_INITIALIZING) {
+            dev->dev_state != MEI_DEV_INITIALIZING &&
+            dev->dev_state != MEI_DEV_POWER_DOWN &&
+            dev->dev_state != MEI_DEV_POWER_UP) {
                dev_dbg(&dev->pdev->dev, "FW not ready.\n");
                mei_reset(dev, 1);
                mutex_unlock(&dev->device_lock);
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index ed1d75203af6..e6f16f83ecde 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -148,7 +148,8 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
        dev->hbm_state = MEI_HBM_IDLE;
-        if (dev->dev_state != MEI_DEV_INITIALIZING) {
+        if (dev->dev_state != MEI_DEV_INITIALIZING &&
+            dev->dev_state != MEI_DEV_POWER_UP) {
                if (dev->dev_state != MEI_DEV_DISABLED &&
                    dev->dev_state != MEI_DEV_POWER_DOWN)
                        dev->dev_state = MEI_DEV_RESETTING;
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 847b1996ce8e..2c5a91bb8ec3 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -128,7 +128,7 @@ static inline int pxamci_set_power(struct pxamci_host *host,
                               !!on ^ host->pdata->gpio_power_invert);
        }
        if (!host->vcc && host->pdata && host->pdata->setpower)
-                host->pdata->setpower(mmc_dev(host->mmc), vdd);
+                return host->pdata->setpower(mmc_dev(host->mmc), vdd);
        return 0;
 }
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 5b272bfd261d..2a00239661b3 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1193,6 +1193,7 @@ void pinctrl_unregister_map(struct pinctrl_map const *map)
        list_for_each_entry(maps_node, &pinctrl_maps, node) {
                if (maps_node->maps == map) {
                        list_del(&maps_node->node);
+                        kfree(maps_node);
                        mutex_unlock(&pinctrl_maps_mutex);
                        return;
                }
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 6866548fab31..7323cca440b5 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1483,6 +1483,7 @@ static int pcs_add_gpio_func(struct device_node *node, struct pcs_device *pcs)
        return ret;
 }
+#ifdef CONFIG_PM
 static int pinctrl_single_suspend(struct platform_device *pdev,
                                        pm_message_t state)
 {
@@ -1505,6 +1506,7 @@ static int pinctrl_single_resume(struct platform_device *pdev)
        return pinctrl_force_default(pcs->pctl);
 }
+#endif
 static int pcs_probe(struct platform_device *pdev)
 {
diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
index 7956df58d751..31f7d0e04aaa 100644
--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
@@ -3785,6 +3785,7 @@ static const struct regulator_desc sh73a0_vccq_mc0_desc = {
 static struct regulator_consumer_supply sh73a0_vccq_mc0_consumers[] = {
        REGULATOR_SUPPLY("vqmmc", "sh_mobile_sdhi.0"),
+        REGULATOR_SUPPLY("vqmmc", "ee100000.sdhi"),
 };
 static const struct regulator_init_data sh73a0_vccq_mc0_init_data = {
diff --git a/drivers/pinctrl/sirf/pinctrl-atlas6.c b/drivers/pinctrl/sirf/pinctrl-atlas6.c
index 1fa39a444171..867c9681763c 100644
--- a/drivers/pinctrl/sirf/pinctrl-atlas6.c
+++ b/drivers/pinctrl/sirf/pinctrl-atlas6.c
@@ -496,7 +496,7 @@ static const unsigned sdmmc5_pins[] = { 24, 25, 26 };
 static const struct sirfsoc_muxmask usp0_muxmask[] = {
        {
                .group = 1,
-                .mask = BIT(19) | BIT(20) | BIT(21) | BIT(22),
+                .mask = BIT(19) | BIT(20) | BIT(21) | BIT(22) | BIT(23),
        },
 };
@@ -507,8 +507,21 @@ static const struct sirfsoc_padmux usp0_padmux = {
        .funcval = 0,
 };
-static const unsigned usp0_pins[] = { 51, 52, 53, 54 };
+static const unsigned usp0_pins[] = { 51, 52, 53, 54, 55 };
+static const struct sirfsoc_muxmask usp0_uart_nostreamctrl_muxmask[] = {
+        {
+                .group = 1,
+                .mask = BIT(20) | BIT(21),
+        },
+};
+static const struct sirfsoc_padmux usp0_uart_nostreamctrl_padmux = {
+        .muxmask_counts = ARRAY_SIZE(usp0_uart_nostreamctrl_muxmask),
+        .muxmask = usp0_uart_nostreamctrl_muxmask,
+};
+static const unsigned usp0_uart_nostreamctrl_pins[] = { 52, 53 };
 static const struct sirfsoc_muxmask usp1_muxmask[] = {
        {
                .group = 0,
@@ -822,6 +835,8 @@ static const struct sirfsoc_pin_group sirfsoc_pin_groups[] = {
        SIRFSOC_PIN_GROUP("uart2grp", uart2_pins),
        SIRFSOC_PIN_GROUP("uart2_nostreamctrlgrp", uart2_nostreamctrl_pins),
        SIRFSOC_PIN_GROUP("usp0grp", usp0_pins),
+        SIRFSOC_PIN_GROUP("usp0_uart_nostreamctrl_grp",
+                                        usp0_uart_nostreamctrl_pins),
        SIRFSOC_PIN_GROUP("usp1grp", usp1_pins),
        SIRFSOC_PIN_GROUP("i2c0grp", i2c0_pins),
        SIRFSOC_PIN_GROUP("i2c1grp", i2c1_pins),
@@ -862,6 +877,8 @@ static const char * const uart0grp[] = { "uart0grp" };
 static const char * const uart1grp[] = { "uart1grp" };
 static const char * const uart2grp[] = { "uart2grp" };
 static const char * const uart2_nostreamctrlgrp[] = { "uart2_nostreamctrlgrp" };
+static const char * const usp0_uart_nostreamctrl_grp[] = {
+                                        "usp0_uart_nostreamctrl_grp" };
 static const char * const usp0grp[] = { "usp0grp" };
 static const char * const usp1grp[] = { "usp1grp" };
 static const char * const i2c0grp[] = { "i2c0grp" };
@@ -904,6 +921,9 @@ static const struct sirfsoc_pmx_func sirfsoc_pmx_functions[] = {
        SIRFSOC_PMX_FUNCTION("uart2", uart2grp, uart2_padmux),
        SIRFSOC_PMX_FUNCTION("uart2_nostreamctrl", uart2_nostreamctrlgrp, uart2_nostreamctrl_padmux),
        SIRFSOC_PMX_FUNCTION("usp0", usp0grp, usp0_padmux),
+        SIRFSOC_PMX_FUNCTION("usp0_uart_nostreamctrl",
+                                                usp0_uart_nostreamctrl_grp,
+                                                usp0_uart_nostreamctrl_padmux),
        SIRFSOC_PMX_FUNCTION("usp1", usp1grp, usp1_padmux),
        SIRFSOC_PMX_FUNCTION("i2c0", i2c0grp, i2c0_padmux),
        SIRFSOC_PMX_FUNCTION("i2c1", i2c1grp, i2c1_padmux),
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index 7b082157eb79..99d2930b18c8 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c
@@ -185,7 +185,7 @@ static void sci_io_request_build_ssp_command_iu(struct isci_request *ireq)
        cmd_iu->_r_c = 0;
        sci_swab32_cpy(&cmd_iu->cdb, task->ssp_task.cmd->cmnd,
-                       task->ssp_task.cmd->cmd_len / sizeof(u32));
+                       (task->ssp_task.cmd->cmd_len+3) / sizeof(u32));
 }
 static void sci_task_request_build_ssp_task_iu(struct isci_request *ireq)
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 9bb020ac089c..0d30ca849e8f 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -491,6 +491,7 @@ int isci_task_abort_task(struct sas_task *task)
        struct isci_tmf           tmf;
        int                       ret = TMF_RESP_FUNC_FAILED;
        unsigned long             flags;
+        int                       target_done_already = 0;
        /* Get the isci_request reference from the task.  Note that
         * this check does not depend on the pending request list
@@ -505,9 +506,11 @@ int isci_task_abort_task(struct sas_task *task)
        /* If task is already done, the request isn't valid */
        if (!(task->task_state_flags & SAS_TASK_STATE_DONE) &&
            (task->task_state_flags & SAS_TASK_AT_INITIATOR) &&
-            old_request)
+            old_request) {
                idev = isci_get_device(task->dev->lldd_dev);
+                target_done_already = test_bit(IREQ_COMPLETE_IN_TARGET,
+                                               &old_request->flags);
+        }
        spin_unlock(&task->task_state_lock);
        spin_unlock_irqrestore(&ihost->scic_lock, flags);
@@ -561,7 +564,7 @@ int isci_task_abort_task(struct sas_task *task)
        if (task->task_proto == SAS_PROTOCOL_SMP ||
            sas_protocol_ata(task->task_proto) ||
-            test_bit(IREQ_COMPLETE_IN_TARGET, &old_request->flags) ||
+            target_done_already ||
            test_bit(IDEV_GONE, &idev->flags)) {
                spin_unlock_irqrestore(&ihost->scic_lock, flags);
diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
index f14665a6293d..6b1b4e91e53f 100644
--- a/drivers/scsi/mvsas/mv_sas.c
+++ b/drivers/scsi/mvsas/mv_sas.c
@@ -1857,11 +1857,16 @@ int mvs_slot_complete(struct mvs_info *mvi, u32 rx_desc, u32 flags)
                goto out;
        }
-        /* error info record present */
+        /*
-        if (unlikely((rx_desc & RXQ_ERR) && (*(u64 *) slot->response))) {
+         * error info record present; slot->response is 32 bit aligned but may
+         * not be 64 bit aligned, so check for zero in two 32 bit reads
+         */
+        if (unlikely((rx_desc & RXQ_ERR)
+                     && (*((u32 *)slot->response)
+                         || *(((u32 *)slot->response) + 1)))) {
                mv_dprintk("port %d slot %d rx_desc %X has error info"
                        "%016llX.\n", slot->port->sas_port.id, slot_idx,
-                         rx_desc, (u64)(*(u64 *)slot->response));
+                         rx_desc, get_unaligned_le64(slot->response));
                tstat->stat = mvs_slot_err(mvi, task, slot_idx);
                tstat->resp = SAS_TASK_COMPLETE;
                goto out;
diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
index 60e2fb7f2dca..d6b19dc80bee 100644
--- a/drivers/scsi/mvsas/mv_sas.h
+++ b/drivers/scsi/mvsas/mv_sas.h
@@ -39,6 +39,7 @@
 #include <linux/irq.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
+#include <asm/unaligned.h>
 #include <scsi/libsas.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_tcq.h>
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 42ef481db942..ef0a5481b9dd 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -419,6 +419,8 @@ qla2x00_start_scsi(srb_t *sp)
                            __constant_cpu_to_le16(CF_SIMPLE_TAG);
                        break;
                }
+        } else {
+                cmd_pkt->control_flags = __constant_cpu_to_le16(CF_SIMPLE_TAG);
        }
        /* Load SCSI command packet. */
@@ -1307,11 +1309,11 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
                    fcp_cmnd->task_attribute = TSK_ORDERED;
                    break;
                default:
-                    fcp_cmnd->task_attribute = 0;
+                    fcp_cmnd->task_attribute = TSK_SIMPLE;
                    break;
                }
        } else {
-                fcp_cmnd->task_attribute = 0;
+                fcp_cmnd->task_attribute = TSK_SIMPLE;
        }
        cmd_pkt->fcp_rsp_dseg_len = 0; /* Let response come in status iocb */
@@ -1525,7 +1527,12 @@ qla24xx_start_scsi(srb_t *sp)
                case ORDERED_QUEUE_TAG:
                        cmd_pkt->task = TSK_ORDERED;
                        break;
+                default:
+                    cmd_pkt->task = TSK_SIMPLE;
+                    break;
                }
+        } else {
+                cmd_pkt->task = TSK_SIMPLE;
        }
        /* Load SCSI command packet. */
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 80f39b8b0223..86fcf2c313ad 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -838,10 +838,17 @@ static int scsi_setup_flush_cmnd(struct scsi_device *sdp, struct request *rq)
 static void sd_unprep_fn(struct request_queue *q, struct request *rq)
 {
+        struct scsi_cmnd *SCpnt = rq->special;
        if (rq->cmd_flags & REQ_DISCARD) {
                free_page((unsigned long)rq->buffer);
                rq->buffer = NULL;
        }
+        if (SCpnt->cmnd != rq->cmd) {
+                mempool_free(SCpnt->cmnd, sd_cdb_pool);
+                SCpnt->cmnd = NULL;
+                SCpnt->cmd_len = 0;
+        }
 }
 /**
@@ -1720,21 +1727,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
        if (rq_data_dir(SCpnt->request) == READ && scsi_prot_sg_count(SCpnt))
                sd_dif_complete(SCpnt, good_bytes);
-        if (scsi_host_dif_capable(sdkp->device->host, sdkp->protection_type)
-            == SD_DIF_TYPE2_PROTECTION && SCpnt->cmnd != SCpnt->request->cmd) {
-                /* We have to print a failed command here as the
-                 * extended CDB gets freed before scsi_io_completion()
-                 * is called.
-                 */
-                if (result)
-                        scsi_print_command(SCpnt);
-                mempool_free(SCpnt->cmnd, sd_cdb_pool);
-                SCpnt->cmnd = NULL;
-                SCpnt->cmd_len = 0;
-        }
        return good_bytes;
 }
diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
index 080abf2faf97..a8c344422a77 100644
--- a/drivers/staging/android/logger.c
+++ b/drivers/staging/android/logger.c
@@ -469,7 +469,7 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov,
                         unsigned long nr_segs, loff_t ppos)
 {
        struct logger_log *log = file_get_log(iocb->ki_filp);
-        size_t orig = log->w_off;
+        size_t orig;
        struct logger_entry header;
        struct timespec now;
        ssize_t ret = 0;
@@ -490,6 +490,8 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov,
        mutex_lock(&log->mutex);
+        orig = log->w_off;
        /*
         * Fix up any readers, pulling them forward to the first readable
         * entry after (what will be) the new write offset. We do this now
diff --git a/drivers/staging/comedi/TODO b/drivers/staging/comedi/TODO
index b10f739b7e3e..fa8da9aada30 100644
--- a/drivers/staging/comedi/TODO
+++ b/drivers/staging/comedi/TODO
@@ -9,4 +9,4 @@ TODO:
 Please send patches to Greg Kroah-Hartman <greg@kroah.com> and
 copy:
        Ian Abbott <abbotti@mev.co.uk>
-        Frank Mori Hess <fmhess@users.sourceforge.net>
+        H Hartley Sweeten <hsweeten@visionengravers.com>
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index 8647518259f6..f4a197b2d1fd 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1413,22 +1413,19 @@ static int do_cmd_ioctl(struct comedi_device *dev,
                DPRINTK("subdevice busy\n");
                return -EBUSY;
        }
-        s->busy = file;
        /* make sure channel/gain list isn't too long */
        if (cmd.chanlist_len > s->len_chanlist) {
                DPRINTK("channel/gain list too long %u > %d\n",
                        cmd.chanlist_len, s->len_chanlist);
-                ret = -EINVAL;
+                return -EINVAL;
-                goto cleanup;
        }
        /* make sure channel/gain list isn't too short */
        if (cmd.chanlist_len < 1) {
                DPRINTK("channel/gain list too short %u < 1\n",
                        cmd.chanlist_len);
-                ret = -EINVAL;
+                return -EINVAL;
-                goto cleanup;
        }
        async->cmd = cmd;
@@ -1438,8 +1435,7 @@ static int do_cmd_ioctl(struct comedi_device *dev,
            kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);
        if (!async->cmd.chanlist) {
                DPRINTK("allocation failed\n");
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto cleanup;
        }
        if (copy_from_user(async->cmd.chanlist, user_chanlist,
@@ -1491,6 +1487,9 @@ static int do_cmd_ioctl(struct comedi_device *dev,
        comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);
+        /* set s->busy _after_ setting SRF_RUNNING flag to avoid race with
+         * comedi_read() or comedi_write() */
+        s->busy = file;
        ret = s->do_cmd(dev, s);
        if (ret == 0)
                return 0;
@@ -1705,6 +1704,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
                           void *file)
 {
        struct comedi_subdevice *s;
+        int ret;
        if (arg >= dev->n_subdevices)
                return -EINVAL;
@@ -1721,7 +1721,11 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
        if (s->busy != file)
                return -EBUSY;
-        return do_cancel(dev, s);
+        ret = do_cancel(dev, s);
+        if (comedi_get_subdevice_runflags(s) & SRF_USER)
+                wake_up_interruptible(&s->async->wait_head);
+        return ret;
 }
 /*
@@ -2053,11 +2057,13 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
                if (!comedi_is_subdevice_running(s)) {
                        if (count == 0) {
+                                mutex_lock(&dev->mutex);
                                if (comedi_is_subdevice_in_error(s))
                                        retval = -EPIPE;
                                else
                                        retval = 0;
                                do_become_nonbusy(dev, s);
+                                mutex_unlock(&dev->mutex);
                        }
                        break;
                }
@@ -2156,11 +2162,13 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
                if (n == 0) {
                        if (!comedi_is_subdevice_running(s)) {
+                                mutex_lock(&dev->mutex);
                                do_become_nonbusy(dev, s);
                                if (comedi_is_subdevice_in_error(s))
                                        retval = -EPIPE;
                                else
                                        retval = 0;
+                                mutex_unlock(&dev->mutex);
                                break;
                        }
                        if (file->f_flags & O_NONBLOCK) {
@@ -2198,9 +2206,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
                buf += n;
                break;          /* makes device work like a pipe */
        }
-        if (comedi_is_subdevice_idle(s) &&
+        if (comedi_is_subdevice_idle(s)) {
-            async->buf_read_count - async->buf_write_count == 0) {
+                mutex_lock(&dev->mutex);
-                do_become_nonbusy(dev, s);
+                if (async->buf_read_count - async->buf_write_count == 0)
+                        do_become_nonbusy(dev, s);
+                mutex_unlock(&dev->mutex);
        }
        set_current_state(TASK_RUNNING);
        remove_wait_queue(&async->wait_head, &wait);
diff --git a/drivers/staging/frontier/alphatrack.c b/drivers/staging/frontier/alphatrack.c
index 5590ebf1da15..817f837b240d 100644
--- a/drivers/staging/frontier/alphatrack.c
+++ b/drivers/staging/frontier/alphatrack.c
@@ -827,11 +827,11 @@ static void usb_alphatrack_disconnect(struct usb_interface *intf)
                mutex_unlock(&dev->mtx);
                usb_alphatrack_delete(dev);
        } else {
+                atomic_set(&dev->writes_pending, 0);
                dev->intf = NULL;
                mutex_unlock(&dev->mtx);
        }
-        atomic_set(&dev->writes_pending, 0);
        mutex_unlock(&disconnect_mutex);
        dev_info(&intf->dev, "Alphatrack Surface #%d now disconnected\n",
diff --git a/drivers/staging/gdm72xx/gdm_qos.c b/drivers/staging/gdm72xx/gdm_qos.c
index b795353e8348..cc3692439a5c 100644
--- a/drivers/staging/gdm72xx/gdm_qos.c
+++ b/drivers/staging/gdm72xx/gdm_qos.c
@@ -250,8 +250,8 @@ static void send_qos_list(struct nic *nic, struct list_head *head)
        list_for_each_entry_safe(entry, n, head, list) {
                list_del(&entry->list);
-                free_qos_entry(entry);
                gdm_wimax_send_tx(entry->skb, entry->dev);
+                free_qos_entry(entry);
        }
 }
diff --git a/drivers/staging/imx-drm/Kconfig b/drivers/staging/imx-drm/Kconfig
index 22339059837f..bd0f2fd01db4 100644
--- a/drivers/staging/imx-drm/Kconfig
+++ b/drivers/staging/imx-drm/Kconfig
@@ -33,7 +33,6 @@ config DRM_IMX_TVE
 config DRM_IMX_LDB
        tristate "Support for LVDS displays"
        depends on DRM_IMX
-        select OF_VIDEOMODE
        help
          Choose this to enable the internal LVDS Display Bridge (LDB)
          found on i.MX53 and i.MX6 processors.
diff --git a/drivers/staging/tidspbridge/pmgr/dbll.c b/drivers/staging/tidspbridge/pmgr/dbll.c
index c191ae203565..41e88abe47af 100644
--- a/drivers/staging/tidspbridge/pmgr/dbll.c
+++ b/drivers/staging/tidspbridge/pmgr/dbll.c
@@ -1120,8 +1120,11 @@ static int dbll_rmm_alloc(struct dynamic_loader_allocate *this,
           or DYN_EXTERNAL, then mem granularity information is present
           within the section name - only process if there are at least three
           tokens within the section name (just a minor optimization) */
-        if (count >= 3)
+        if (count >= 3) {
-                strict_strtol(sz_last_token, 10, (long *)&req);
+                status = kstrtos32(sz_last_token, 10, &req);
+                if (status)
+                        goto func_cont;
+        }
        if ((req == 0) || (req == 1)) {
                if (strcmp(sz_sec_last_token, "DYN_DARAM") == 0) {
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index 82c7202fd5cc..e77fb6ea40c9 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -527,8 +527,11 @@ static void zram_reset_device(struct zram *zram)
        size_t index;
        struct zram_meta *meta;
-        if (!zram->init_done)
+        down_write(&zram->init_lock);
+        if (!zram->init_done) {
+                up_write(&zram->init_lock);
                return;
+        }
        meta = zram->meta;
        zram->init_done = 0;
@@ -549,6 +552,7 @@ static void zram_reset_device(struct zram *zram)
        zram->disksize = 0;
        set_capacity(zram->disk, 0);
+        up_write(&zram->init_lock);
 }
 static void zram_init_device(struct zram *zram, struct zram_meta *meta)
diff --git a/drivers/tty/serial/8250/8250_early.c b/drivers/tty/serial/8250/8250_early.c
index 721904f8efa9..946ddd2b3a54 100644
--- a/drivers/tty/serial/8250/8250_early.c
+++ b/drivers/tty/serial/8250/8250_early.c
@@ -193,7 +193,8 @@ static int __init parse_options(struct early_serial8250_device *device,
        if (options) {
                options++;
                device->baud = simple_strtoul(options, NULL, 0);
-                length = min(strcspn(options, " "), sizeof(device->options));
+                length = min(strcspn(options, " ") + 1,
+                             sizeof(device->options));
                strlcpy(device->options, options, length);
        } else {
                device->baud = probe_baud(port);
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 5e3d68917ffe..1456673bcca0 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -277,7 +277,7 @@ config SERIAL_TEGRA
        select SERIAL_CORE
        help
          Support for the on-chip UARTs on the NVIDIA Tegra series SOCs
-          providing /dev/ttyHS0, 1, 2, 3 and 4 (note, some machines may not
+          providing /dev/ttyTHS0, 1, 2, 3 and 4 (note, some machines may not
          provide all of these ports, depending on how the serial port
          are enabled). This driver uses the APB DMA to achieve higher baudrate
          and better performance.
diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c
index ff171384ea52..dc6e96996ead 100644
--- a/drivers/tty/synclinkmp.c
+++ b/drivers/tty/synclinkmp.c
@@ -3478,7 +3478,7 @@ static int alloc_buf_list(SLMP_INFO *info)
        for ( i = 0; i < info->rx_buf_count; i++ ) {
                /* calculate and store physical address of this buffer entry */
                info->rx_buf_list_ex[i].phys_entry =
-                        info->buffer_list_phys + (i * sizeof(SCABUFSIZE));
+                        info->buffer_list_phys + (i * SCABUFSIZE);
                /* calculate and store physical address of */
                /* next entry in cirular list of entries */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 4191db32f12c..4a8a1d68002c 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -668,6 +668,15 @@ resubmit:
 static inline int
 hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
 {
+        /* Need to clear both directions for control ep */
+        if (((devinfo >> 11) & USB_ENDPOINT_XFERTYPE_MASK) ==
+                        USB_ENDPOINT_XFER_CONTROL) {
+                int status = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+                                HUB_CLEAR_TT_BUFFER, USB_RT_PORT,
+                                devinfo ^ 0x8000, tt, NULL, 0, 1000);
+                if (status)
+                        return status;
+        }
        return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
                               HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo,
                               tt, NULL, 0, 1000);
@@ -2848,6 +2857,15 @@ static int usb_disable_function_remotewakeup(struct usb_device *udev)
                                USB_CTRL_SET_TIMEOUT);
 }
+/* Count of wakeup-enabled devices at or below udev */
+static unsigned wakeup_enabled_descendants(struct usb_device *udev)
+{
+        struct usb_hub *hub = usb_hub_to_struct_hub(udev);
+        return udev->do_remote_wakeup +
+                        (hub ? hub->wakeup_enabled_descendants : 0);
+}
 /*
 * usb_port_suspend - suspend a usb device's upstream port
 * @udev: device that's no longer in active use, not a root hub
@@ -2888,8 +2906,8 @@ static int usb_disable_function_remotewakeup(struct usb_device *udev)
 * Linux (2.6) currently has NO mechanisms to initiate that:  no khubd
 * timer, no SRP, no requests through sysfs.
 *
- * If Runtime PM isn't enabled or used, non-SuperSpeed devices really get
+ * If Runtime PM isn't enabled or used, non-SuperSpeed devices may not get
- * suspended only when their bus goes into global suspend (i.e., the root
+ * suspended until their bus goes into global suspend (i.e., the root
 * hub is suspended).  Nevertheless, we change @udev->state to
 * USB_STATE_SUSPENDED as this is the device's "logical" state.  The actual
 * upstream port setting is stored in @udev->port_is_suspended.
@@ -2960,15 +2978,21 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
        /* see 7.1.7.6 */
        if (hub_is_superspeed(hub->hdev))
                status = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_U3);
-        else if (PMSG_IS_AUTO(msg))
-                status = set_port_feature(hub->hdev, port1,
-                                                USB_PORT_FEAT_SUSPEND);
        /*
         * For system suspend, we do not need to enable the suspend feature
         * on individual USB-2 ports.  The devices will automatically go
         * into suspend a few ms after the root hub stops sending packets.
         * The USB 2.0 spec calls this "global suspend".
+         *
+         * However, many USB hubs have a bug: They don't relay wakeup requests
+         * from a downstream port if the port's suspend feature isn't on.
+         * Therefore we will turn on the suspend feature if udev or any of its
+         * descendants is enabled for remote wakeup.
         */
+        else if (PMSG_IS_AUTO(msg) || wakeup_enabled_descendants(udev) > 0)
+                status = set_port_feature(hub->hdev, port1,
+                                USB_PORT_FEAT_SUSPEND);
        else {
                really_suspend = false;
                status = 0;
@@ -3003,15 +3027,16 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
                if (!PMSG_IS_AUTO(msg))
                        status = 0;
        } else {
-                /* device has up to 10 msec to fully suspend */
                dev_dbg(&udev->dev, "usb %ssuspend, wakeup %d\n",
                                (PMSG_IS_AUTO(msg) ? "auto-" : ""),
                                udev->do_remote_wakeup);
-                usb_set_device_state(udev, USB_STATE_SUSPENDED);
                if (really_suspend) {
                        udev->port_is_suspended = 1;
+                        /* device has up to 10 msec to fully suspend */
                        msleep(10);
                }
+                usb_set_device_state(udev, USB_STATE_SUSPENDED);
        }
        /*
@@ -3293,7 +3318,11 @@ static int hub_suspend(struct usb_interface *intf, pm_message_t msg)
        unsigned                port1;
        int                     status;
-        /* Warn if children aren't already suspended */
+        /*
+         * Warn if children aren't already suspended.
+         * Also, add up the number of wakeup-enabled descendants.
+         */
+        hub->wakeup_enabled_descendants = 0;
        for (port1 = 1; port1 <= hdev->maxchild; port1++) {
                struct usb_device       *udev;
@@ -3303,6 +3332,9 @@ static int hub_suspend(struct usb_interface *intf, pm_message_t msg)
                        if (PMSG_IS_AUTO(msg))
                                return -EBUSY;
                }
+                if (udev)
+                        hub->wakeup_enabled_descendants +=
+                                        wakeup_enabled_descendants(udev);
        }
        if (hdev->do_remote_wakeup && hub->quirk_check_port_auto_suspend) {
diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h
index 6508e02b3dac..4e4790dea343 100644
--- a/drivers/usb/core/hub.h
+++ b/drivers/usb/core/hub.h
@@ -59,6 +59,9 @@ struct usb_hub {
        struct usb_tt           tt;             /* Transaction Translator */
        unsigned                mA_per_port;    /* current for each child */
+#ifdef  CONFIG_PM
+        unsigned                wakeup_enabled_descendants;
+#endif
        unsigned                limited_power:1;
        unsigned                quiescing:1;
diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
index 757aa18027d0..2378958ea63e 100644
--- a/drivers/usb/dwc3/Kconfig
+++ b/drivers/usb/dwc3/Kconfig
@@ -1,6 +1,6 @@
 config USB_DWC3
        tristate "DesignWare USB3 DRD Core Support"
-        depends on (USB || USB_GADGET) && GENERIC_HARDIRQS
+        depends on (USB || USB_GADGET) && GENERIC_HARDIRQS && HAS_DMA
        select USB_XHCI_PLATFORM if USB_SUPPORT && USB_XHCI_HCD
        help
          Say Y or M here if your system has a Dual Role SuperSpeed
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index c35d49d39b76..358375e0b291 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -450,7 +450,7 @@ static int dwc3_probe(struct platform_device *pdev)
        }
        if (IS_ERR(dwc->usb3_phy)) {
-                ret = PTR_ERR(dwc->usb2_phy);
+                ret = PTR_ERR(dwc->usb3_phy);
                /*
                 * if -ENXIO is returned, it means PHY layer wasn't
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index b69d322e3cab..27dad993b007 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -759,8 +759,8 @@ struct dwc3 {
 struct dwc3_event_type {
        u32     is_devspec:1;
-        u32     type:6;
+        u32     type:7;
-        u32     reserved8_31:25;
+        u32     reserved8_31:24;
 } __packed;
 #define DWC3_DEPEVT_XFERCOMPLETE        0x01
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index b5e5b35df49c..f77083fedc68 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1584,6 +1584,7 @@ err1:
        __dwc3_gadget_ep_disable(dwc->eps[0]);
 err0:
+        dwc->gadget_driver = NULL;
        spin_unlock_irqrestore(&dwc->lock, flags);
        return ret;
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 62f6802f6e0f..8e9368330b10 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -193,6 +193,7 @@ config USB_FUSB300
           Faraday usb device controller FUSB300 driver
 config USB_FOTG210_UDC
+        depends on HAS_DMA
        tristate "Faraday FOTG210 USB Peripheral Controller"
        help
           Faraday USB2.0 OTG controller which can be configured as
@@ -328,13 +329,14 @@ config USB_S3C_HSUDC
 config USB_MV_UDC
        tristate "Marvell USB2.0 Device Controller"
-        depends on GENERIC_HARDIRQS
+        depends on GENERIC_HARDIRQS && HAS_DMA
        help
          Marvell Socs (including PXA and MMP series) include a high speed
          USB2.0 OTG controller, which can be configured as high speed or
          full speed USB peripheral.
 config USB_MV_U3D
+        depends on HAS_DMA
        tristate "MARVELL PXA2128 USB 3.0 controller"
        help
          MARVELL PXA2128 Processor series include a super speed USB3.0 device
@@ -639,6 +641,7 @@ config USB_CONFIGFS_RNDIS
        depends on USB_CONFIGFS
        depends on NET
        select USB_U_ETHER
+        select USB_U_RNDIS
        select USB_F_RNDIS
        help
           Microsoft Windows XP bundles the "Remote NDIS" (RNDIS) protocol,
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 073b938f9135..d9a6add0c852 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -870,8 +870,8 @@ static void clk_on(struct at91_udc *udc)
        if (udc->clocked)
                return;
        udc->clocked = 1;
-        clk_enable(udc->iclk);
+        clk_prepare_enable(udc->iclk);
-        clk_enable(udc->fclk);
+        clk_prepare_enable(udc->fclk);
 }
 static void clk_off(struct at91_udc *udc)
@@ -880,8 +880,8 @@ static void clk_off(struct at91_udc *udc)
                return;
        udc->clocked = 0;
        udc->gadget.speed = USB_SPEED_UNKNOWN;
-        clk_disable(udc->fclk);
+        clk_disable_unprepare(udc->fclk);
-        clk_disable(udc->iclk);
+        clk_disable_unprepare(udc->iclk);
 }
 /*
@@ -1725,7 +1725,7 @@ static int at91udc_probe(struct platform_device *pdev)
        /* init software state */
        udc = &controller;
        udc->gadget.dev.parent = dev;
-        if (pdev->dev.of_node)
+        if (IS_ENABLED(CONFIG_OF) && pdev->dev.of_node)
                at91udc_of_init(udc, pdev->dev.of_node);
        else
                memcpy(&udc->board, dev->platform_data,
@@ -1782,12 +1782,14 @@ static int at91udc_probe(struct platform_device *pdev)
        }
        /* don't do anything until we have both gadget driver and VBUS */
-        clk_enable(udc->iclk);
+        retval = clk_prepare_enable(udc->iclk);
+        if (retval)
+                goto fail1;
        at91_udp_write(udc, AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
        at91_udp_write(udc, AT91_UDP_IDR, 0xffffffff);
        /* Clear all pending interrupts - UDP may be used by bootloader. */
        at91_udp_write(udc, AT91_UDP_ICR, 0xffffffff);
-        clk_disable(udc->iclk);
+        clk_disable_unprepare(udc->iclk);
        /* request UDC and maybe VBUS irqs */
        udc->udp_irq = platform_get_irq(pdev, 0);
diff --git a/drivers/usb/gadget/f_ecm.c b/drivers/usb/gadget/f_ecm.c
index 5d3561ea1c15..edab45da3741 100644
--- a/drivers/usb/gadget/f_ecm.c
+++ b/drivers/usb/gadget/f_ecm.c
@@ -959,8 +959,11 @@ static struct usb_function_instance *ecm_alloc_inst(void)
        mutex_init(&opts->lock);
        opts->func_inst.free_func_inst = ecm_free_inst;
        opts->net = gether_setup_default();
-        if (IS_ERR(opts->net))
+        if (IS_ERR(opts->net)) {
-                return ERR_PTR(PTR_ERR(opts->net));
+                struct net_device *net = opts->net;
+                kfree(opts);
+                return ERR_CAST(net);
+        }
        config_group_init_type_name(&opts->func_inst.group, "", &ecm_func_type);
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 90ee8022e8d8..d00392d879db 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -593,8 +593,11 @@ static struct usb_function_instance *eem_alloc_inst(void)
        mutex_init(&opts->lock);
        opts->func_inst.free_func_inst = eem_free_inst;
        opts->net = gether_setup_default();
-        if (IS_ERR(opts->net))
+        if (IS_ERR(opts->net)) {
-                return ERR_CAST(opts->net);
+                struct net_device *net = opts->net;
+                kfree(opts);
+                return ERR_CAST(net);
+        }
        config_group_init_type_name(&opts->func_inst.group, "", &eem_func_type);
diff --git a/drivers/usb/gadget/f_ncm.c b/drivers/usb/gadget/f_ncm.c
index 952177f7eb9b..1c28fe13328a 100644
--- a/drivers/usb/gadget/f_ncm.c
+++ b/drivers/usb/gadget/f_ncm.c
@@ -1350,8 +1350,11 @@ static struct usb_function_instance *ncm_alloc_inst(void)
        mutex_init(&opts->lock);
        opts->func_inst.free_func_inst = ncm_free_inst;
        opts->net = gether_setup_default();
-        if (IS_ERR(opts->net))
+        if (IS_ERR(opts->net)) {
-                return ERR_PTR(PTR_ERR(opts->net));
+                struct net_device *net = opts->net;
+                kfree(opts);
+                return ERR_CAST(net);
+        }
        config_group_init_type_name(&opts->func_inst.group, "", &ncm_func_type);
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 7944fb0efe3b..1bf26e9f38cd 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -656,8 +656,11 @@ static struct usb_function_instance *phonet_alloc_inst(void)
        opts->func_inst.free_func_inst = phonet_free_inst;
        opts->net = gphonet_setup_default();
-        if (IS_ERR(opts->net))
+        if (IS_ERR(opts->net)) {
-                return ERR_PTR(PTR_ERR(opts->net));
+                struct net_device *net = opts->net;
+                kfree(opts);
+                return ERR_CAST(net);
+        }
        config_group_init_type_name(&opts->func_inst.group, "",
                        &phonet_func_type);
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 191df35ae69d..717ed7f95639 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -963,8 +963,11 @@ static struct usb_function_instance *rndis_alloc_inst(void)
        mutex_init(&opts->lock);
        opts->func_inst.free_func_inst = rndis_free_inst;
        opts->net = gether_setup_default();
-        if (IS_ERR(opts->net))
+        if (IS_ERR(opts->net)) {
-                return ERR_CAST(opts->net);
+                struct net_device *net = opts->net;
+                kfree(opts);
+                return ERR_CAST(net);
+        }
        config_group_init_type_name(&opts->func_inst.group, "",
                                    &rndis_func_type);
diff --git a/drivers/usb/gadget/f_subset.c b/drivers/usb/gadget/f_subset.c
index 5601e1d96c4f..7c8674fa7e80 100644
--- a/drivers/usb/gadget/f_subset.c
+++ b/drivers/usb/gadget/f_subset.c
@@ -505,8 +505,11 @@ static struct usb_function_instance *geth_alloc_inst(void)
        mutex_init(&opts->lock);
        opts->func_inst.free_func_inst = geth_free_inst;
        opts->net = gether_setup_default();
-        if (IS_ERR(opts->net))
+        if (IS_ERR(opts->net)) {
-                return ERR_CAST(opts->net);
+                struct net_device *net = opts->net;
+                kfree(opts);
+                return ERR_CAST(net);
+        }
        config_group_init_type_name(&opts->func_inst.group, "",
                                    &gether_func_type);
diff --git a/drivers/usb/gadget/fotg210-udc.c b/drivers/usb/gadget/fotg210-udc.c
index cce5535b1dc6..10cd18ddd0d4 100644
--- a/drivers/usb/gadget/fotg210-udc.c
+++ b/drivers/usb/gadget/fotg210-udc.c
@@ -1074,7 +1074,7 @@ static struct usb_gadget_ops fotg210_gadget_ops = {
        .udc_stop               = fotg210_udc_stop,
 };
-static int __exit fotg210_udc_remove(struct platform_device *pdev)
+static int fotg210_udc_remove(struct platform_device *pdev)
 {
        struct fotg210_udc *fotg210 = dev_get_drvdata(&pdev->dev);
@@ -1088,7 +1088,7 @@ static int __exit fotg210_udc_remove(struct platform_device *pdev)
        return 0;
 }
-static int __init fotg210_udc_probe(struct platform_device *pdev)
+static int fotg210_udc_probe(struct platform_device *pdev)
 {
        struct resource *res, *ires;
        struct fotg210_udc *fotg210 = NULL;
diff --git a/drivers/usb/gadget/mv_u3d_core.c b/drivers/usb/gadget/mv_u3d_core.c
index 07fdb3eaf48a..ec6a2d290398 100644
--- a/drivers/usb/gadget/mv_u3d_core.c
+++ b/drivers/usb/gadget/mv_u3d_core.c
@@ -1776,7 +1776,7 @@ static int mv_u3d_remove(struct platform_device *dev)
        kfree(u3d->eps);
        if (u3d->irq)
-                free_irq(u3d->irq, &dev->dev);
+                free_irq(u3d->irq, u3d);
        if (u3d->cap_regs)
                iounmap(u3d->cap_regs);
@@ -1974,7 +1974,7 @@ static int mv_u3d_probe(struct platform_device *dev)
        return 0;
 err_unregister:
-        free_irq(u3d->irq, &dev->dev);
+        free_irq(u3d->irq, u3d);
 err_request_irq:
 err_get_irq:
        kfree(u3d->status_req);
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index ffd8fa541101..c28ac9872030 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -50,6 +50,8 @@ static DEFINE_MUTEX(udc_lock);
 /* ------------------------------------------------------------------------- */
+#ifdef  CONFIG_HAS_DMA
 int usb_gadget_map_request(struct usb_gadget *gadget,
                struct usb_request *req, int is_in)
 {
@@ -99,6 +101,8 @@ void usb_gadget_unmap_request(struct usb_gadget *gadget,
 }
 EXPORT_SYMBOL_GPL(usb_gadget_unmap_request);
+#endif  /* CONFIG_HAS_DMA */
 /* ------------------------------------------------------------------------- */
 void usb_gadget_set_state(struct usb_gadget *gadget,
@@ -194,9 +198,11 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
        dev_set_name(&gadget->dev, "gadget");
        gadget->dev.parent = parent;
+#ifdef  CONFIG_HAS_DMA
        dma_set_coherent_mask(&gadget->dev, parent->coherent_dma_mask);
        gadget->dev.dma_parms = parent->dma_parms;
        gadget->dev.dma_mask = parent->dma_mask;
+#endif
        if (release)
                gadget->dev.release = release;
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 2b702772d04d..6dce37555c4f 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -874,6 +874,7 @@ static int ehci_hub_control (
                                ehci->reset_done[wIndex] = jiffies
                                                + msecs_to_jiffies(20);
                                usb_hcd_start_port_resume(&hcd->self, wIndex);
+                                set_bit(wIndex, &ehci->resuming_ports);
                                /* check the port again */
                                mod_timer(&ehci_to_hcd(ehci)->rh_timer,
                                                ehci->reset_done[wIndex]);
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index 4b8a2092432f..978c849f9c9a 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -13,6 +13,7 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev);
 void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 void sb800_prefetch(struct device *dev, int on);
 #else
+struct pci_dev;
 static inline void usb_amd_quirk_pll_disable(void) {}
 static inline void usb_amd_quirk_pll_enable(void) {}
 static inline void usb_amd_dev_put(void) {}
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index cc24e39b97d5..f00cb203faea 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -93,7 +93,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
        }
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                        pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
-                xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
                xhci->quirks |= XHCI_EP_LIMIT_QUIRK;
                xhci->limit_active_eps = 64;
                xhci->quirks |= XHCI_SW_BW_CHECKING;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 1e57eafa6910..5b08cd85f8e7 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -434,7 +434,7 @@ static void ring_doorbell_for_active_rings(struct xhci_hcd *xhci,
        /* A ring has pending URBs if its TD list is not empty */
        if (!(ep->ep_state & EP_HAS_STREAMS)) {
-                if (!(list_empty(&ep->ring->td_list)))
+                if (ep->ring && !(list_empty(&ep->ring->td_list)))
                        xhci_ring_ep_doorbell(xhci, slot_id, ep_index, 0);
                return;
        }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2c49f00260ca..41eb4fc33453 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -329,7 +329,7 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci)
        return;
 }
-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+static void __maybe_unused xhci_msix_sync_irqs(struct xhci_hcd *xhci)
 {
        int i;
@@ -1181,9 +1181,6 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
        }
        xhci = hcd_to_xhci(hcd);
-        if (xhci->xhc_state & XHCI_STATE_HALTED)
-                return -ENODEV;
        if (check_virt_dev) {
                if (!udev->slot_id || !xhci->devs[udev->slot_id]) {
                        printk(KERN_DEBUG "xHCI %s called with unaddressed "
@@ -1199,6 +1196,9 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
                }
        }
+        if (xhci->xhc_state & XHCI_STATE_HALTED)
+                return -ENODEV;
        return 1;
 }
@@ -3898,7 +3898,7 @@ int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1)
 * Issue an Evaluate Context command to change the Maximum Exit Latency in the
 * slot context.  If that succeeds, store the new MEL in the xhci_virt_device.
 */
-static int xhci_change_max_exit_latency(struct xhci_hcd *xhci,
+static int __maybe_unused xhci_change_max_exit_latency(struct xhci_hcd *xhci,
                        struct usb_device *udev, u16 max_exit_latency)
 {
        struct xhci_virt_device *virt_dev;
@@ -4892,6 +4892,13 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
        get_quirks(dev, xhci);
+        /* In xhci controllers which follow xhci 1.0 spec gives a spurious
+         * success event after a short transfer. This quirk will ignore such
+         * spurious event.
+         */
+        if (xhci->hci_version > 0x96)
+                xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
        /* Make sure the HC is halted. */
        retval = xhci_halt(xhci);
        if (retval)
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index c21386ec5d35..de98906f786d 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3247,6 +3247,7 @@ static const struct usb_device_id sisusb_table[] = {
        { USB_DEVICE(0x0711, 0x0903) },
        { USB_DEVICE(0x0711, 0x0918) },
        { USB_DEVICE(0x0711, 0x0920) },
+        { USB_DEVICE(0x0711, 0x0950) },
        { USB_DEVICE(0x182d, 0x021c) },
        { USB_DEVICE(0x182d, 0x0269) },
        { }
diff --git a/drivers/usb/phy/phy-omap-usb3.c b/drivers/usb/phy/phy-omap-usb3.c
index efe6e1464f45..a2fb30bbb971 100644
--- a/drivers/usb/phy/phy-omap-usb3.c
+++ b/drivers/usb/phy/phy-omap-usb3.c
@@ -71,9 +71,9 @@ static struct usb_dpll_params omap_usb3_dpll_params[NUM_SYS_CLKS] = {
        {1250, 5, 4, 20, 0},            /* 12 MHz */
        {3125, 20, 4, 20, 0},           /* 16.8 MHz */
        {1172, 8, 4, 20, 65537},        /* 19.2 MHz */
+        {1000, 7, 4, 10, 0},            /* 20 MHz */
        {1250, 12, 4, 20, 0},           /* 26 MHz */
        {3125, 47, 4, 20, 92843},       /* 38.4 MHz */
-        {1000, 7, 4, 10, 0},            /* 20 MHz */
 };
diff --git a/drivers/usb/phy/phy-samsung-usb2.c b/drivers/usb/phy/phy-samsung-usb2.c
index 1011c16ade7e..758b86d0fcb3 100644
--- a/drivers/usb/phy/phy-samsung-usb2.c
+++ b/drivers/usb/phy/phy-samsung-usb2.c
@@ -388,7 +388,7 @@ static int samsung_usb2phy_probe(struct platform_device *pdev)
                clk = devm_clk_get(dev, "otg");
        if (IS_ERR(clk)) {
-                dev_err(dev, "Failed to get otg clock\n");
+                dev_err(dev, "Failed to get usbhost/otg clock\n");
                return PTR_ERR(clk);
        }
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index ed4949faa70d..805940c37353 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -855,10 +855,6 @@ static int usbhsg_gadget_stop(struct usb_gadget *gadget,
        struct usbhsg_gpriv *gpriv = usbhsg_gadget_to_gpriv(gadget);
        struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
-        if (!driver             ||
-            !driver->unbind)
-                return -EINVAL;
        usbhsg_try_stop(priv, USBHSG_STATUS_REGISTERD);
        gpriv->driver = NULL;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index d6ef2f8da37d..0eae4ba3760e 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -53,6 +53,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
        { USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
        { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */
+        { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
        { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
        { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
        { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
@@ -118,6 +119,8 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
        { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
        { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+        { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+        { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
@@ -148,6 +151,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
        { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
        { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+        { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
        { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
        { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
        { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 0a818b238508..603fb70dde80 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -905,20 +905,20 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        status = mos7840_get_reg_sync(port, mos7840_port->SpRegOffset, &Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Reading Spreg failed\n");
-                return -1;
+                goto err;
        }
        Data |= 0x80;
        status = mos7840_set_reg_sync(port, mos7840_port->SpRegOffset, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "writing Spreg failed\n");
-                return -1;
+                goto err;
        }
        Data &= ~0x80;
        status = mos7840_set_reg_sync(port, mos7840_port->SpRegOffset, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "writing Spreg failed\n");
-                return -1;
+                goto err;
        }
        /* End of block to be checked */
@@ -927,7 +927,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
                                                                        &Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Reading Controlreg failed\n");
-                return -1;
+                goto err;
        }
        Data |= 0x08;           /* Driver done bit */
        Data |= 0x20;           /* rx_disable */
@@ -935,7 +935,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
                                mos7840_port->ControlRegOffset, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "writing Controlreg failed\n");
-                return -1;
+                goto err;
        }
        /* do register settings here */
        /* Set all regs to the device default values. */
@@ -946,21 +946,21 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        status = mos7840_set_uart_reg(port, INTERRUPT_ENABLE_REGISTER, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "disabling interrupts failed\n");
-                return -1;
+                goto err;
        }
        /* Set FIFO_CONTROL_REGISTER to the default value */
        Data = 0x00;
        status = mos7840_set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Writing FIFO_CONTROL_REGISTER  failed\n");
-                return -1;
+                goto err;
        }
        Data = 0xcf;
        status = mos7840_set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Writing FIFO_CONTROL_REGISTER  failed\n");
-                return -1;
+                goto err;
        }
        Data = 0x03;
@@ -1103,6 +1103,15 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        /* mos7840_change_port_settings(mos7840_port,old_termios); */
        return 0;
+err:
+        for (j = 0; j < NUM_URBS; ++j) {
+                urb = mos7840_port->write_urb_pool[j];
+                if (!urb)
+                        continue;
+                kfree(urb->transfer_buffer);
+                usb_free_urb(urb);
+        }
+        return status;
 }
 /*****************************************************************************
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5dd857de05b0..1cf6f125f5f0 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -341,17 +341,12 @@ static void option_instat_callback(struct urb *urb);
 #define OLIVETTI_VENDOR_ID                      0x0b3c
 #define OLIVETTI_PRODUCT_OLICARD100             0xc000
 #define OLIVETTI_PRODUCT_OLICARD145             0xc003
+#define OLIVETTI_PRODUCT_OLICARD200             0xc005
 /* Celot products */
 #define CELOT_VENDOR_ID                         0x211f
 #define CELOT_PRODUCT_CT680M                    0x6801
-/* ONDA Communication vendor id */
-#define ONDA_VENDOR_ID       0x1ee8
-/* ONDA MT825UP HSDPA 14.2 modem */
-#define ONDA_MT825UP         0x000b
 /* Samsung products */
 #define SAMSUNG_VENDOR_ID                       0x04e8
 #define SAMSUNG_PRODUCT_GT_B3730                0x6889
@@ -444,7 +439,8 @@ static void option_instat_callback(struct urb *urb);
 /* Hyundai Petatel Inc. products */
 #define PETATEL_VENDOR_ID                       0x1ff4
-#define PETATEL_PRODUCT_NP10T                   0x600e
+#define PETATEL_PRODUCT_NP10T_600A              0x600a
+#define PETATEL_PRODUCT_NP10T_600E              0x600e
 /* TP-LINK Incorporated products */
 #define TPLINK_VENDOR_ID                        0x2357
@@ -782,6 +778,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
        { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
@@ -817,7 +814,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
@@ -1256,8 +1254,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
-        { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM610) },
@@ -1329,9 +1327,12 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
        { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
-        { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
+        { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
+        { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
        { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000),                                 /* TP-Link MA260 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) },    /* D-Link DWM-156 (variant) */
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) },    /* D-Link DWM-156 (variant) */
@@ -1339,6 +1340,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 7182bb774b79..375b5a400b6f 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -371,7 +371,7 @@ static int ti_startup(struct usb_serial *serial)
        usb_set_serial_data(serial, tdev);
        /* determine device type */
-        if (usb_match_id(serial->interface, ti_id_table_3410))
+        if (serial->type == &ti_1port_device)
                tdev->td_is_3410 = 1;
        dev_dbg(&dev->dev, "%s - device type is %s\n", __func__,
                tdev->td_is_3410 ? "3410" : "5052");
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 1799335288bd..c015f2c16729 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -665,6 +665,13 @@ UNUSUAL_DEV(  0x054c, 0x016a, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_FIX_INQUIRY ),
+/* Submitted by Ren Bigcren <bigcren.ren@sonymobile.com> */
+UNUSUAL_DEV(  0x054c, 0x02a5, 0x0100, 0x0100,
+                "Sony Corp.",
+                "MicroVault Flash Drive",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_READ_CAPACITY_16 ),
 /* floppy reports multiple luns */
 UNUSUAL_DEV(  0x055d, 0x2020, 0x0000, 0x0210,
                "SAMSUNG",
diff --git a/drivers/video/backlight/max8925_bl.c b/drivers/video/backlight/max8925_bl.c
index 5ca11b066b7e..886e797f75f9 100644
--- a/drivers/video/backlight/max8925_bl.c
+++ b/drivers/video/backlight/max8925_bl.c
@@ -101,33 +101,37 @@ static const struct backlight_ops max8925_backlight_ops = {
        .get_brightness = max8925_backlight_get_brightness,
 };
-#ifdef CONFIG_OF
+static void max8925_backlight_dt_init(struct platform_device *pdev)
-static int max8925_backlight_dt_init(struct platform_device *pdev,
-                              struct max8925_backlight_pdata *pdata)
 {
        struct device_node *nproot = pdev->dev.parent->of_node, *np;
-        int dual_string;
+        struct max8925_backlight_pdata *pdata;
+        u32 val;
+        if (!nproot || !IS_ENABLED(CONFIG_OF))
+                return;
+        pdata = devm_kzalloc(&pdev->dev,
+                             sizeof(struct max8925_backlight_pdata),
+                             GFP_KERNEL);
+        if (!pdata)
+                return;
-        if (!nproot)
-                return -ENODEV;
        np = of_find_node_by_name(nproot, "backlight");
        if (!np) {
                dev_err(&pdev->dev, "failed to find backlight node\n");
-                return -ENODEV;
+                return;
        }
-        of_property_read_u32(np, "maxim,max8925-dual-string", &dual_string);
+        if (!of_property_read_u32(np, "maxim,max8925-dual-string", &val))
-        pdata->dual_string = dual_string;
+                pdata->dual_string = val;
-        return 0;
+        pdev->dev.platform_data = pdata;
 }
-#else
-#define max8925_backlight_dt_init(x, y) (-1)
-#endif
 static int max8925_backlight_probe(struct platform_device *pdev)
 {
        struct max8925_chip *chip = dev_get_drvdata(pdev->dev.parent);
-        struct max8925_backlight_pdata *pdata = pdev->dev.platform_data;
+        struct max8925_backlight_pdata *pdata;
        struct max8925_backlight_data *data;
        struct backlight_device *bl;
        struct backlight_properties props;
@@ -170,13 +174,10 @@ static int max8925_backlight_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, bl);
        value = 0;
-        if (pdev->dev.parent->of_node && !pdata) {
+        if (!pdev->dev.platform_data)
-                pdata = devm_kzalloc(&pdev->dev,
+                max8925_backlight_dt_init(pdev);
-                                     sizeof(struct max8925_backlight_pdata),
-                                     GFP_KERNEL);
-                max8925_backlight_dt_init(pdev, pdata);
-        }
+        pdata = pdev->dev.platform_data;
        if (pdata) {
                if (pdata->lxw_scl)
                        value |= (1 << 7);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 8ff6a0019b0b..c827acb0e943 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -830,9 +830,10 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
                        flags = O_WRONLY|O_LARGEFILE;
        }
        *filp = dentry_open(&path, flags, current_cred());
-        if (IS_ERR(*filp))
+        if (IS_ERR(*filp)) {
                host_err = PTR_ERR(*filp);
-        else {
+                *filp = NULL;
+        } else {
                host_err = ima_file_check(*filp, may_flags);
                if (may_flags & NFSD_MAY_64BIT_COOKIE)
diff --git a/fs/xfs/xfs_dinode.h b/fs/xfs/xfs_dinode.h
index 07d735a80a0f..e5869b50dc41 100644
--- a/fs/xfs/xfs_dinode.h
+++ b/fs/xfs/xfs_dinode.h
@@ -39,6 +39,9 @@ typedef struct xfs_timestamp {
 * There is a very similar struct icdinode in xfs_inode which matches the
 * layout of the first 96 bytes of this structure, but is kept in native
 * format instead of big endian.
+ *
+ * Note: di_flushiter is only used by v1/2 inodes - it's effectively a zeroed
+ * padding field for v3 inodes.
 */
 typedef struct xfs_dinode {
        __be16          di_magic;       /* inode magic # = XFS_DINODE_MAGIC */
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index b78481f99d9d..bb262c25c8de 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -896,7 +896,6 @@ xfs_dinode_to_disk(
        to->di_projid_lo = cpu_to_be16(from->di_projid_lo);
        to->di_projid_hi = cpu_to_be16(from->di_projid_hi);
        memcpy(to->di_pad, from->di_pad, sizeof(to->di_pad));
-        to->di_flushiter = cpu_to_be16(from->di_flushiter);
        to->di_atime.t_sec = cpu_to_be32(from->di_atime.t_sec);
        to->di_atime.t_nsec = cpu_to_be32(from->di_atime.t_nsec);
        to->di_mtime.t_sec = cpu_to_be32(from->di_mtime.t_sec);
@@ -924,6 +923,9 @@ xfs_dinode_to_disk(
                to->di_lsn = cpu_to_be64(from->di_lsn);
                memcpy(to->di_pad2, from->di_pad2, sizeof(to->di_pad2));
                uuid_copy(&to->di_uuid, &from->di_uuid);
+                to->di_flushiter = 0;
+        } else {
+                to->di_flushiter = cpu_to_be16(from->di_flushiter);
        }
 }
@@ -1029,10 +1031,14 @@ xfs_dinode_calc_crc(
 /*
 * Read the disk inode attributes into the in-core inode structure.
 *
- * If we are initialising a new inode and we are not utilising the
+ * For version 5 superblocks, if we are initialising a new inode and we are not
- * XFS_MOUNT_IKEEP inode cluster mode, we can simple build the new inode core
+ * utilising the XFS_MOUNT_IKEEP inode cluster mode, we can simple build the new
- * with a random generation number. If we are keeping inodes around, we need to
+ * inode core with a random generation number. If we are keeping inodes around,
- * read the inode cluster to get the existing generation number off disk.
+ * we need to read the inode cluster to get the existing generation number off
+ * disk. Further, if we are using version 4 superblocks (i.e. v1/v2 inode
+ * format) then log recovery is dependent on the di_flushiter field being
+ * initialised from the current on-disk value and hence we must also read the
+ * inode off disk.
 */
 int
 xfs_iread(
@@ -1054,6 +1060,7 @@ xfs_iread(
        /* shortcut IO on inode allocation if possible */
        if ((iget_flags & XFS_IGET_CREATE) &&
+            xfs_sb_version_hascrc(&mp->m_sb) &&
            !(mp->m_flags & XFS_MOUNT_IKEEP)) {
                /* initialise the on-disk inode core */
                memset(&ip->i_d, 0, sizeof(ip->i_d));
@@ -2882,12 +2889,18 @@ xfs_iflush_int(
                        __func__, ip->i_ino, ip->i_d.di_forkoff, ip);
                goto corrupt_out;
        }
        /*
-         * bump the flush iteration count, used to detect flushes which
+         * Inode item log recovery for v1/v2 inodes are dependent on the
-         * postdate a log record during recovery. This is redundant as we now
+         * di_flushiter count for correct sequencing. We bump the flush
-         * log every change and hence this can't happen. Still, it doesn't hurt.
+         * iteration count so we can detect flushes which postdate a log record
+         * during recovery. This is redundant as we now log every change and
+         * hence this can't happen but we need to still do it to ensure
+         * backwards compatibility with old kernels that predate logging all
+         * inode changes.
         */
-        ip->i_d.di_flushiter++;
+        if (ip->i_d.di_version < 3)
+                ip->i_d.di_flushiter++;
        /*
         * Copy the dirty parts of the inode into the on-disk
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 6fcc910a50b9..7681b19aa5dc 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2592,8 +2592,16 @@ xlog_recover_inode_pass2(
                goto error;
        }
-        /* Skip replay when the on disk inode is newer than the log one */
+        /*
-        if (dicp->di_flushiter < be16_to_cpu(dip->di_flushiter)) {
+         * di_flushiter is only valid for v1/2 inodes. All changes for v3 inodes
+         * are transactional and if ordering is necessary we can determine that
+         * more accurately by the LSN field in the V3 inode core. Don't trust
+         * the inode versions we might be changing them here - use the
+         * superblock flag to determine whether we need to look at di_flushiter
+         * to skip replay when the on disk inode is newer than the log one
+         */
+        if (!xfs_sb_version_hascrc(&mp->m_sb) &&
+            dicp->di_flushiter < be16_to_cpu(dip->di_flushiter)) {
                /*
                 * Deal with the wrap case, DI_MAX_FLUSH is less
                 * than smaller numbers
@@ -2608,6 +2616,7 @@ xlog_recover_inode_pass2(
                        goto error;
                }
        }
        /* Take the opportunity to reset the flush iteration count */
        dicp->di_flushiter = 0;
diff --git a/include/acpi/video.h b/include/acpi/video.h
index b26dc4fb7ba8..61109f2609fc 100644
--- a/include/acpi/video.h
+++ b/include/acpi/video.h
@@ -17,21 +17,12 @@ struct acpi_device;
 #define ACPI_VIDEO_DISPLAY_LEGACY_TV      0x0200
 #if (defined CONFIG_ACPI_VIDEO || defined CONFIG_ACPI_VIDEO_MODULE)
-extern int __acpi_video_register(bool backlight_quirks);
+extern int acpi_video_register(void);
-static inline int acpi_video_register(void)
-{
-        return __acpi_video_register(false);
-}
-static inline int acpi_video_register_with_quirks(void)
-{
-        return __acpi_video_register(true);
-}
 extern void acpi_video_unregister(void);
 extern int acpi_video_get_edid(struct acpi_device *device, int type,
                               int device_id, void **edid);
 #else
 static inline int acpi_video_register(void) { return 0; }
-static inline int acpi_video_register_with_quirks(void) { return 0; }
 static inline void acpi_video_unregister(void) { return; }
 static inline int acpi_video_get_edid(struct acpi_device *device, int type,
                                      int device_id, void **edid)
diff --git a/include/dt-bindings/clock/vf610-clock.h b/include/dt-bindings/clock/vf610-clock.h
index 15e997fa78f2..4aa2b48cd151 100644
--- a/include/dt-bindings/clock/vf610-clock.h
+++ b/include/dt-bindings/clock/vf610-clock.h
@@ -158,6 +158,8 @@
 #define VF610_CLK_GPU_SEL               145
 #define VF610_CLK_GPU_EN                146
 #define VF610_CLK_GPU2D                 147
-#define VF610_CLK_END                   148
+#define VF610_CLK_ENET0                 148
+#define VF610_CLK_ENET1                 149
+#define VF610_CLK_END                   150
 #endif /* __DT_BINDINGS_CLOCK_VF610_H */
diff --git a/include/dt-bindings/pinctrl/am33xx.h b/include/dt-bindings/pinctrl/am33xx.h
index 469e0325e6f4..2fbc804e1a45 100644
--- a/include/dt-bindings/pinctrl/am33xx.h
+++ b/include/dt-bindings/pinctrl/am33xx.h
@@ -5,7 +5,7 @@
 #ifndef _DT_BINDINGS_PINCTRL_AM33XX_H
 #define _DT_BINDINGS_PINCTRL_AM33XX_H
-#include <include/dt-bindings/pinctrl/omap.h>
+#include <dt-bindings/pinctrl/omap.h>
 /* am33xx specific mux bit defines */
 #undef PULL_ENA
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 6ad72f92469c..353ba256f368 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -191,7 +191,6 @@ extern bool wmi_has_guid(const char *guid);
 #define ACPI_VIDEO_BACKLIGHT_DMI_VIDEO                  0x0200
 #define ACPI_VIDEO_OUTPUT_SWITCHING_DMI_VENDOR          0x0400
 #define ACPI_VIDEO_OUTPUT_SWITCHING_DMI_VIDEO           0x0800
-#define ACPI_VIDEO_SKIP_BACKLIGHT                       0x1000
 #if defined(CONFIG_ACPI_VIDEO) || defined(CONFIG_ACPI_VIDEO_MODULE)
diff --git a/include/linux/mfd/syscon/imx6q-iomuxc-gpr.h b/include/linux/mfd/syscon/imx6q-iomuxc-gpr.h
index dab34a1deb2c..b6bdcd66c07d 100644
--- a/include/linux/mfd/syscon/imx6q-iomuxc-gpr.h
+++ b/include/linux/mfd/syscon/imx6q-iomuxc-gpr.h
@@ -103,15 +103,15 @@
 #define IMX6Q_GPR1_EXC_MON_MASK                 BIT(22)
 #define IMX6Q_GPR1_EXC_MON_OKAY                 0x0
 #define IMX6Q_GPR1_EXC_MON_SLVE                 BIT(22)
-#define IMX6Q_GPR1_MIPI_IPU2_SEL_MASK           BIT(21)
+#define IMX6Q_GPR1_ENET_CLK_SEL_MASK            BIT(21)
-#define IMX6Q_GPR1_MIPI_IPU2_SEL_GASKET         0x0
+#define IMX6Q_GPR1_ENET_CLK_SEL_PAD             0
-#define IMX6Q_GPR1_MIPI_IPU2_SEL_IOMUX          BIT(21)
+#define IMX6Q_GPR1_ENET_CLK_SEL_ANATOP          BIT(21)
-#define IMX6Q_GPR1_MIPI_IPU1_MUX_MASK           BIT(20)
+#define IMX6Q_GPR1_MIPI_IPU2_MUX_MASK           BIT(20)
-#define IMX6Q_GPR1_MIPI_IPU1_MUX_GASKET         0x0
-#define IMX6Q_GPR1_MIPI_IPU1_MUX_IOMUX          BIT(20)
-#define IMX6Q_GPR1_MIPI_IPU2_MUX_MASK           BIT(19)
 #define IMX6Q_GPR1_MIPI_IPU2_MUX_GASKET         0x0
-#define IMX6Q_GPR1_MIPI_IPU2_MUX_IOMUX          BIT(19)
+#define IMX6Q_GPR1_MIPI_IPU2_MUX_IOMUX          BIT(20)
+#define IMX6Q_GPR1_MIPI_IPU1_MUX_MASK           BIT(19)
+#define IMX6Q_GPR1_MIPI_IPU1_MUX_GASKET         0x0
+#define IMX6Q_GPR1_MIPI_IPU1_MUX_IOMUX          BIT(19)
 #define IMX6Q_GPR1_PCIE_TEST_PD                 BIT(18)
 #define IMX6Q_GPR1_IPU_VPU_MUX_MASK             BIT(17)
 #define IMX6Q_GPR1_IPU_VPU_MUX_IPU1             0x0
@@ -279,41 +279,88 @@
 #define IMX6Q_GPR13_CAN2_STOP_REQ               BIT(29)
 #define IMX6Q_GPR13_CAN1_STOP_REQ               BIT(28)
 #define IMX6Q_GPR13_ENET_STOP_REQ               BIT(27)
-#define IMX6Q_GPR13_SATA_PHY_8_MASK             (0x7 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_MASK         (0x7 << 24)
-#define IMX6Q_GPR13_SATA_PHY_8_0_5_DB           (0x0 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_0_5_DB       (0x0 << 24)
-#define IMX6Q_GPR13_SATA_PHY_8_1_0_DB           (0x1 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_1_0_DB       (0x1 << 24)
-#define IMX6Q_GPR13_SATA_PHY_8_1_5_DB           (0x2 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_1_5_DB       (0x2 << 24)
-#define IMX6Q_GPR13_SATA_PHY_8_2_0_DB           (0x3 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_2_0_DB       (0x3 << 24)
-#define IMX6Q_GPR13_SATA_PHY_8_2_5_DB           (0x4 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_2_5_DB       (0x4 << 24)
-#define IMX6Q_GPR13_SATA_PHY_8_3_0_DB           (0x5 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_3_0_DB       (0x5 << 24)
-#define IMX6Q_GPR13_SATA_PHY_8_3_5_DB           (0x6 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_3_5_DB       (0x6 << 24)
-#define IMX6Q_GPR13_SATA_PHY_8_4_0_DB           (0x7 << 24)
+#define IMX6Q_GPR13_SATA_RX_EQ_VAL_4_0_DB       (0x7 << 24)
-#define IMX6Q_GPR13_SATA_PHY_7_MASK             (0x1f << 19)
+#define IMX6Q_GPR13_SATA_RX_LOS_LVL_MASK        (0x1f << 19)
-#define IMX6Q_GPR13_SATA_PHY_7_SATA1I           (0x10 << 19)
+#define IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA1I      (0x10 << 19)
-#define IMX6Q_GPR13_SATA_PHY_7_SATA1M           (0x10 << 19)
+#define IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA1M      (0x10 << 19)
-#define IMX6Q_GPR13_SATA_PHY_7_SATA1X           (0x1a << 19)
+#define IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA1X      (0x1a << 19)
-#define IMX6Q_GPR13_SATA_PHY_7_SATA2I           (0x12 << 19)
+#define IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA2I      (0x12 << 19)
-#define IMX6Q_GPR13_SATA_PHY_7_SATA2M           (0x12 << 19)
+#define IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA2M      (0x12 << 19)
-#define IMX6Q_GPR13_SATA_PHY_7_SATA2X           (0x1a << 19)
+#define IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA2X      (0x1a << 19)
-#define IMX6Q_GPR13_SATA_PHY_6_MASK             (0x7 << 16)
+#define IMX6Q_GPR13_SATA_RX_DPLL_MODE_MASK      (0x7 << 16)
-#define IMX6Q_GPR13_SATA_SPEED_MASK             BIT(15)
+#define IMX6Q_GPR13_SATA_RX_DPLL_MODE_1P_1F     (0x0 << 16)
-#define IMX6Q_GPR13_SATA_SPEED_1P5G             0x0
+#define IMX6Q_GPR13_SATA_RX_DPLL_MODE_2P_2F     (0x1 << 16)
-#define IMX6Q_GPR13_SATA_SPEED_3P0G             BIT(15)
+#define IMX6Q_GPR13_SATA_RX_DPLL_MODE_1P_4F     (0x2 << 16)
-#define IMX6Q_GPR13_SATA_PHY_5                  BIT(14)
+#define IMX6Q_GPR13_SATA_RX_DPLL_MODE_2P_4F     (0x3 << 16)
-#define IMX6Q_GPR13_SATA_PHY_4_MASK             (0x7 << 11)
+#define IMX6Q_GPR13_SATA_SPD_MODE_MASK          BIT(15)
-#define IMX6Q_GPR13_SATA_PHY_4_16_16            (0x0 << 11)
+#define IMX6Q_GPR13_SATA_SPD_MODE_1P5G          0x0
-#define IMX6Q_GPR13_SATA_PHY_4_14_16            (0x1 << 11)
+#define IMX6Q_GPR13_SATA_SPD_MODE_3P0G          BIT(15)
-#define IMX6Q_GPR13_SATA_PHY_4_12_16            (0x2 << 11)
+#define IMX6Q_GPR13_SATA_MPLL_SS_EN             BIT(14)
-#define IMX6Q_GPR13_SATA_PHY_4_10_16            (0x3 << 11)
+#define IMX6Q_GPR13_SATA_TX_ATTEN_MASK          (0x7 << 11)
-#define IMX6Q_GPR13_SATA_PHY_4_9_16             (0x4 << 11)
+#define IMX6Q_GPR13_SATA_TX_ATTEN_16_16         (0x0 << 11)
-#define IMX6Q_GPR13_SATA_PHY_4_8_16             (0x5 << 11)
+#define IMX6Q_GPR13_SATA_TX_ATTEN_14_16         (0x1 << 11)
-#define IMX6Q_GPR13_SATA_PHY_3_MASK             (0xf << 7)
+#define IMX6Q_GPR13_SATA_TX_ATTEN_12_16         (0x2 << 11)
-#define IMX6Q_GPR13_SATA_PHY_3_OFF              0x7
+#define IMX6Q_GPR13_SATA_TX_ATTEN_10_16         (0x3 << 11)
-#define IMX6Q_GPR13_SATA_PHY_2_MASK             (0x1f << 2)
+#define IMX6Q_GPR13_SATA_TX_ATTEN_9_16          (0x4 << 11)
-#define IMX6Q_GPR13_SATA_PHY_2_OFF              0x2
+#define IMX6Q_GPR13_SATA_TX_ATTEN_8_16          (0x5 << 11)
-#define IMX6Q_GPR13_SATA_PHY_1_MASK             (0x3 << 0)
+#define IMX6Q_GPR13_SATA_TX_BOOST_MASK          (0xf << 7)
-#define IMX6Q_GPR13_SATA_PHY_1_FAST             (0x0 << 0)
+#define IMX6Q_GPR13_SATA_TX_BOOST_0_00_DB       (0x0 << 7)
-#define IMX6Q_GPR13_SATA_PHY_1_MED              (0x1 << 0)
+#define IMX6Q_GPR13_SATA_TX_BOOST_0_37_DB       (0x1 << 7)
-#define IMX6Q_GPR13_SATA_PHY_1_SLOW             (0x2 << 0)
+#define IMX6Q_GPR13_SATA_TX_BOOST_0_74_DB       (0x2 << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_1_11_DB       (0x3 << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_1_48_DB       (0x4 << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_1_85_DB       (0x5 << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_2_22_DB       (0x6 << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_2_59_DB       (0x7 << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_2_96_DB       (0x8 << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_3_33_DB       (0x9 << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_3_70_DB       (0xa << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_4_07_DB       (0xb << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_4_44_DB       (0xc << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_4_81_DB       (0xd << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_5_28_DB       (0xe << 7)
+#define IMX6Q_GPR13_SATA_TX_BOOST_5_75_DB       (0xf << 7)
+#define IMX6Q_GPR13_SATA_TX_LVL_MASK            (0x1f << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_0_937_V         (0x00 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_0_947_V         (0x01 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_0_957_V         (0x02 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_0_966_V         (0x03 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_0_976_V         (0x04 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_0_986_V         (0x05 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_0_996_V         (0x06 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_005_V         (0x07 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_015_V         (0x08 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_025_V         (0x09 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_035_V         (0x0a << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_045_V         (0x0b << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_054_V         (0x0c << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_064_V         (0x0d << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_074_V         (0x0e << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_084_V         (0x0f << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_094_V         (0x10 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_104_V         (0x11 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_113_V         (0x12 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_123_V         (0x13 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_133_V         (0x14 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_143_V         (0x15 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_152_V         (0x16 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_162_V         (0x17 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_172_V         (0x18 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_182_V         (0x19 << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_191_V         (0x1a << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_201_V         (0x1b << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_211_V         (0x1c << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_221_V         (0x1d << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_230_V         (0x1e << 2)
+#define IMX6Q_GPR13_SATA_TX_LVL_1_240_V         (0x1f << 2)
+#define IMX6Q_GPR13_SATA_MPLL_CLK_EN            BIT(1)
+#define IMX6Q_GPR13_SATA_TX_EDGE_RATE           BIT(0)
 #endif /* __LINUX_IMX6Q_IOMUXC_GPR_H */
diff --git a/include/linux/platform_data/mmc-pxamci.h b/include/linux/platform_data/mmc-pxamci.h
index 9eb515bb799d..1706b3597ce0 100644
--- a/include/linux/platform_data/mmc-pxamci.h
+++ b/include/linux/platform_data/mmc-pxamci.h
@@ -12,7 +12,7 @@ struct pxamci_platform_data {
        unsigned long detect_delay_ms;          /* delay in millisecond before detecting cards after interrupt */
        int (*init)(struct device *, irq_handler_t , void *);
        int (*get_ro)(struct device *);
-        void (*setpower)(struct device *, unsigned int);
+        int (*setpower)(struct device *, unsigned int);
        void (*exit)(struct device *, void *);
        int gpio_card_detect;                   /* gpio detecting card insertion */
        int gpio_card_ro;                       /* gpio detecting read only toggle */
diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
index 382cf710ca9a..5b1c9848124c 100644
--- a/include/linux/shdma-base.h
+++ b/include/linux/shdma-base.h
@@ -124,6 +124,10 @@ void shdma_chan_remove(struct shdma_chan *schan);
 int shdma_init(struct device *dev, struct shdma_dev *sdev,
                    int chan_num);
 void shdma_cleanup(struct shdma_dev *sdev);
+#if IS_ENABLED(CONFIG_SH_DMAE_BASE)
 bool shdma_chan_filter(struct dma_chan *chan, void *arg);
+#else
+#define shdma_chan_filter NULL
+#endif
 #endif
diff --git a/include/linux/usb.h b/include/linux/usb.h
index a232b7ece1f6..0eec2689b955 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -367,17 +367,6 @@ struct usb_bus {
 /* ----------------------------------------------------------------------- */
-/* This is arbitrary.
- * From USB 2.0 spec Table 11-13, offset 7, a hub can
- * have up to 255 ports. The most yet reported is 10.
- *
- * Current Wireless USB host hardware (Intel i1480 for example) allows
- * up to 22 devices to connect. Upcoming hardware might raise that
- * limit. Because the arrays need to add a bit for hub status data, we
- * do 31, so plus one evens out to four bytes.
- */
-#define USB_MAXCHILDREN         (31)
 struct usb_tt;
 enum usb_device_removable {
diff --git a/include/uapi/linux/usb/ch11.h b/include/uapi/linux/usb/ch11.h
index 7692dc69ccf7..331499d597fa 100644
--- a/include/uapi/linux/usb/ch11.h
+++ b/include/uapi/linux/usb/ch11.h
@@ -11,6 +11,17 @@
 #include <linux/types.h>        /* __u8 etc */
+/* This is arbitrary.
+ * From USB 2.0 spec Table 11-13, offset 7, a hub can
+ * have up to 255 ports. The most yet reported is 10.
+ *
+ * Current Wireless USB host hardware (Intel i1480 for example) allows
+ * up to 22 devices to connect. Upcoming hardware might raise that
+ * limit. Because the arrays need to add a bit for hub status data, we
+ * use 31, so plus one evens out to four bytes.
+ */
+#define USB_MAXCHILDREN         31
 /*
 * Hub request types
 */
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 67708f46baae..8ce9eefc5bb4 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1441,12 +1441,22 @@ ftrace_hash_move(struct ftrace_ops *ops, int enable,
 * the hashes are freed with call_rcu_sched().
 */
 static int
-ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip)
+ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip, void *regs)
 {
        struct ftrace_hash *filter_hash;
        struct ftrace_hash *notrace_hash;
        int ret;
+#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
+        /*
+         * There's a small race when adding ops that the ftrace handler
+         * that wants regs, may be called without them. We can not
+         * allow that handler to be called if regs is NULL.
+         */
+        if (regs == NULL && (ops->flags & FTRACE_OPS_FL_SAVE_REGS))
+                return 0;
+#endif
        filter_hash = rcu_dereference_raw_notrace(ops->filter_hash);
        notrace_hash = rcu_dereference_raw_notrace(ops->notrace_hash);
@@ -4218,7 +4228,7 @@ static inline void ftrace_startup_enable(int command) { }
 # define ftrace_shutdown_sysctl()       do { } while (0)
 static inline int
-ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip)
+ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip, void *regs)
 {
        return 1;
 }
@@ -4241,7 +4251,7 @@ ftrace_ops_control_func(unsigned long ip, unsigned long parent_ip,
        do_for_each_ftrace_op(op, ftrace_control_list) {
                if (!(op->flags & FTRACE_OPS_FL_STUB) &&
                    !ftrace_function_local_disabled(op) &&
-                    ftrace_ops_test(op, ip))
+                    ftrace_ops_test(op, ip, regs))
                        op->func(ip, parent_ip, op, regs);
        } while_for_each_ftrace_op(op);
        trace_recursion_clear(TRACE_CONTROL_BIT);
@@ -4274,7 +4284,7 @@ __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
         */
        preempt_disable_notrace();
        do_for_each_ftrace_op(op, ftrace_ops_list) {
-                if (ftrace_ops_test(op, ip))
+                if (ftrace_ops_test(op, ip, regs))
                        op->func(ip, parent_ip, op, regs);
        } while_for_each_ftrace_op(op);
        preempt_enable_notrace();
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 3f2477713aca..882ec1dd1515 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1224,18 +1224,17 @@ void tracing_reset_current(int cpu)
        tracing_reset(&global_trace.trace_buffer, cpu);
 }
+/* Must have trace_types_lock held */
 void tracing_reset_all_online_cpus(void)
 {
        struct trace_array *tr;
-        mutex_lock(&trace_types_lock);
        list_for_each_entry(tr, &ftrace_trace_arrays, list) {
                tracing_reset_online_cpus(&tr->trace_buffer);
 #ifdef CONFIG_TRACER_MAX_TRACE
                tracing_reset_online_cpus(&tr->max_buffer);
 #endif
        }
-        mutex_unlock(&trace_types_lock);
 }
 #define SAVED_CMDLINES 128
@@ -2843,6 +2842,17 @@ static int s_show(struct seq_file *m, void *v)
        return 0;
 }
+/*
+ * Should be used after trace_array_get(), trace_types_lock
+ * ensures that i_cdev was already initialized.
+ */
+static inline int tracing_get_cpu(struct inode *inode)
+{
+        if (inode->i_cdev) /* See trace_create_cpu_file() */
+                return (long)inode->i_cdev - 1;
+        return RING_BUFFER_ALL_CPUS;
+}
 static const struct seq_operations tracer_seq_ops = {
        .start          = s_start,
        .next           = s_next,
@@ -2851,9 +2861,9 @@ static const struct seq_operations tracer_seq_ops = {
 };
 static struct trace_iterator *
-__tracing_open(struct trace_array *tr, struct trace_cpu *tc,
+__tracing_open(struct inode *inode, struct file *file, bool snapshot)
-               struct inode *inode, struct file *file, bool snapshot)
 {
+        struct trace_array *tr = inode->i_private;
        struct trace_iterator *iter;
        int cpu;
@@ -2894,8 +2904,8 @@ __tracing_open(struct trace_array *tr, struct trace_cpu *tc,
                iter->trace_buffer = &tr->trace_buffer;
        iter->snapshot = snapshot;
        iter->pos = -1;
+        iter->cpu_file = tracing_get_cpu(inode);
        mutex_init(&iter->mutex);
-        iter->cpu_file = tc->cpu;
        /* Notify the tracer early; before we stop tracing. */
        if (iter->trace && iter->trace->open)
@@ -2971,44 +2981,22 @@ static int tracing_open_generic_tr(struct inode *inode, struct file *filp)
        filp->private_data = inode->i_private;
        return 0;
-        
-}
-static int tracing_open_generic_tc(struct inode *inode, struct file *filp)
-{
-        struct trace_cpu *tc = inode->i_private;
-        struct trace_array *tr = tc->tr;
-        if (tracing_disabled)
-                return -ENODEV;
-        if (trace_array_get(tr) < 0)
-                return -ENODEV;
-        filp->private_data = inode->i_private;
-        return 0;
-        
 }
 static int tracing_release(struct inode *inode, struct file *file)
 {
+        struct trace_array *tr = inode->i_private;
        struct seq_file *m = file->private_data;
        struct trace_iterator *iter;
-        struct trace_array *tr;
        int cpu;
-        /* Writes do not use seq_file, need to grab tr from inode */
        if (!(file->f_mode & FMODE_READ)) {
-                struct trace_cpu *tc = inode->i_private;
+                trace_array_put(tr);
-                trace_array_put(tc->tr);
                return 0;
        }
+        /* Writes do not use seq_file */
        iter = m->private;
-        tr = iter->tr;
        mutex_lock(&trace_types_lock);
        for_each_tracing_cpu(cpu) {
@@ -3044,15 +3032,6 @@ static int tracing_release_generic_tr(struct inode *inode, struct file *file)
        return 0;
 }
-static int tracing_release_generic_tc(struct inode *inode, struct file *file)
-{
-        struct trace_cpu *tc = inode->i_private;
-        struct trace_array *tr = tc->tr;
-        trace_array_put(tr);
-        return 0;
-}
 static int tracing_single_release_tr(struct inode *inode, struct file *file)
 {
        struct trace_array *tr = inode->i_private;
@@ -3064,8 +3043,7 @@ static int tracing_single_release_tr(struct inode *inode, struct file *file)
 static int tracing_open(struct inode *inode, struct file *file)
 {
-        struct trace_cpu *tc = inode->i_private;
+        struct trace_array *tr = inode->i_private;
-        struct trace_array *tr = tc->tr;
        struct trace_iterator *iter;
        int ret = 0;
@@ -3073,16 +3051,17 @@ static int tracing_open(struct inode *inode, struct file *file)
                return -ENODEV;
        /* If this file was open for write, then erase contents */
-        if ((file->f_mode & FMODE_WRITE) &&
+        if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC)) {
-            (file->f_flags & O_TRUNC)) {
+                int cpu = tracing_get_cpu(inode);
-                if (tc->cpu == RING_BUFFER_ALL_CPUS)
+                if (cpu == RING_BUFFER_ALL_CPUS)
                        tracing_reset_online_cpus(&tr->trace_buffer);
                else
-                        tracing_reset(&tr->trace_buffer, tc->cpu);
+                        tracing_reset(&tr->trace_buffer, cpu);
        }
        if (file->f_mode & FMODE_READ) {
-                iter = __tracing_open(tr, tc, inode, file, false);
+                iter = __tracing_open(inode, file, false);
                if (IS_ERR(iter))
                        ret = PTR_ERR(iter);
                else if (trace_flags & TRACE_ITER_LATENCY_FMT)
@@ -3948,8 +3927,7 @@ tracing_max_lat_write(struct file *filp, const char __user *ubuf,
 static int tracing_open_pipe(struct inode *inode, struct file *filp)
 {
-        struct trace_cpu *tc = inode->i_private;
+        struct trace_array *tr = inode->i_private;
-        struct trace_array *tr = tc->tr;
        struct trace_iterator *iter;
        int ret = 0;
@@ -3995,9 +3973,9 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
        if (trace_clocks[tr->clock_id].in_ns)
                iter->iter_flags |= TRACE_FILE_TIME_IN_NS;
-        iter->cpu_file = tc->cpu;
+        iter->tr = tr;
-        iter->tr = tc->tr;
+        iter->trace_buffer = &tr->trace_buffer;
-        iter->trace_buffer = &tc->tr->trace_buffer;
+        iter->cpu_file = tracing_get_cpu(inode);
        mutex_init(&iter->mutex);
        filp->private_data = iter;
@@ -4020,8 +3998,7 @@ fail:
 static int tracing_release_pipe(struct inode *inode, struct file *file)
 {
        struct trace_iterator *iter = file->private_data;
-        struct trace_cpu *tc = inode->i_private;
+        struct trace_array *tr = inode->i_private;
-        struct trace_array *tr = tc->tr;
        mutex_lock(&trace_types_lock);
@@ -4374,15 +4351,16 @@ static ssize_t
 tracing_entries_read(struct file *filp, char __user *ubuf,
                     size_t cnt, loff_t *ppos)
 {
-        struct trace_cpu *tc = filp->private_data;
+        struct inode *inode = file_inode(filp);
-        struct trace_array *tr = tc->tr;
+        struct trace_array *tr = inode->i_private;
+        int cpu = tracing_get_cpu(inode);
        char buf[64];
        int r = 0;
        ssize_t ret;
        mutex_lock(&trace_types_lock);
-        if (tc->cpu == RING_BUFFER_ALL_CPUS) {
+        if (cpu == RING_BUFFER_ALL_CPUS) {
                int cpu, buf_size_same;
                unsigned long size;
@@ -4409,7 +4387,7 @@ tracing_entries_read(struct file *filp, char __user *ubuf,
                } else
                        r = sprintf(buf, "X\n");
        } else
-                r = sprintf(buf, "%lu\n", per_cpu_ptr(tr->trace_buffer.data, tc->cpu)->entries >> 10);
+                r = sprintf(buf, "%lu\n", per_cpu_ptr(tr->trace_buffer.data, cpu)->entries >> 10);
        mutex_unlock(&trace_types_lock);
@@ -4421,7 +4399,8 @@ static ssize_t
 tracing_entries_write(struct file *filp, const char __user *ubuf,
                      size_t cnt, loff_t *ppos)
 {
-        struct trace_cpu *tc = filp->private_data;
+        struct inode *inode = file_inode(filp);
+        struct trace_array *tr = inode->i_private;
        unsigned long val;
        int ret;
@@ -4435,8 +4414,7 @@ tracing_entries_write(struct file *filp, const char __user *ubuf,
        /* value is in KB */
        val <<= 10;
+        ret = tracing_resize_ring_buffer(tr, val, tracing_get_cpu(inode));
-        ret = tracing_resize_ring_buffer(tc->tr, val, tc->cpu);
        if (ret < 0)
                return ret;
@@ -4697,8 +4675,7 @@ struct ftrace_buffer_info {
 #ifdef CONFIG_TRACER_SNAPSHOT
 static int tracing_snapshot_open(struct inode *inode, struct file *file)
 {
-        struct trace_cpu *tc = inode->i_private;
+        struct trace_array *tr = inode->i_private;
-        struct trace_array *tr = tc->tr;
        struct trace_iterator *iter;
        struct seq_file *m;
        int ret = 0;
@@ -4707,7 +4684,7 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file)
                return -ENODEV;
        if (file->f_mode & FMODE_READ) {
-                iter = __tracing_open(tr, tc, inode, file, true);
+                iter = __tracing_open(inode, file, true);
                if (IS_ERR(iter))
                        ret = PTR_ERR(iter);
        } else {
@@ -4724,8 +4701,8 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file)
                ret = 0;
                iter->tr = tr;
-                iter->trace_buffer = &tc->tr->max_buffer;
+                iter->trace_buffer = &tr->max_buffer;
-                iter->cpu_file = tc->cpu;
+                iter->cpu_file = tracing_get_cpu(inode);
                m->private = iter;
                file->private_data = m;
        }
@@ -4884,11 +4861,11 @@ static const struct file_operations tracing_pipe_fops = {
 };
 static const struct file_operations tracing_entries_fops = {
-        .open           = tracing_open_generic_tc,
+        .open           = tracing_open_generic_tr,
        .read           = tracing_entries_read,
        .write          = tracing_entries_write,
        .llseek         = generic_file_llseek,
-        .release        = tracing_release_generic_tc,
+        .release        = tracing_release_generic_tr,
 };
 static const struct file_operations tracing_total_entries_fops = {
@@ -4940,8 +4917,7 @@ static const struct file_operations snapshot_raw_fops = {
 static int tracing_buffers_open(struct inode *inode, struct file *filp)
 {
-        struct trace_cpu *tc = inode->i_private;
+        struct trace_array *tr = inode->i_private;
-        struct trace_array *tr = tc->tr;
        struct ftrace_buffer_info *info;
        int ret;
@@ -4960,7 +4936,7 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp)
        mutex_lock(&trace_types_lock);
        info->iter.tr           = tr;
-        info->iter.cpu_file     = tc->cpu;
+        info->iter.cpu_file     = tracing_get_cpu(inode);
        info->iter.trace        = tr->current_trace;
        info->iter.trace_buffer = &tr->trace_buffer;
        info->spare             = NULL;
@@ -5277,14 +5253,14 @@ static ssize_t
 tracing_stats_read(struct file *filp, char __user *ubuf,
                   size_t count, loff_t *ppos)
 {
-        struct trace_cpu *tc = filp->private_data;
+        struct inode *inode = file_inode(filp);
-        struct trace_array *tr = tc->tr;
+        struct trace_array *tr = inode->i_private;
        struct trace_buffer *trace_buf = &tr->trace_buffer;
+        int cpu = tracing_get_cpu(inode);
        struct trace_seq *s;
        unsigned long cnt;
        unsigned long long t;
        unsigned long usec_rem;
-        int cpu = tc->cpu;
        s = kmalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
@@ -5337,10 +5313,10 @@ tracing_stats_read(struct file *filp, char __user *ubuf,
 }
 static const struct file_operations tracing_stats_fops = {
-        .open           = tracing_open_generic_tc,
+        .open           = tracing_open_generic_tr,
        .read           = tracing_stats_read,
        .llseek         = generic_file_llseek,
-        .release        = tracing_release_generic_tc,
+        .release        = tracing_release_generic_tr,
 };
 #ifdef CONFIG_DYNAMIC_FTRACE
@@ -5529,10 +5505,20 @@ static struct dentry *tracing_dentry_percpu(struct trace_array *tr, int cpu)
        return tr->percpu_dir;
 }
+static struct dentry *
+trace_create_cpu_file(const char *name, umode_t mode, struct dentry *parent,
+                      void *data, long cpu, const struct file_operations *fops)
+{
+        struct dentry *ret = trace_create_file(name, mode, parent, data, fops);
+        if (ret) /* See tracing_get_cpu() */
+                ret->d_inode->i_cdev = (void *)(cpu + 1);
+        return ret;
+}
 static void
 tracing_init_debugfs_percpu(struct trace_array *tr, long cpu)
 {
-        struct trace_array_cpu *data = per_cpu_ptr(tr->trace_buffer.data, cpu);
        struct dentry *d_percpu = tracing_dentry_percpu(tr, cpu);
        struct dentry *d_cpu;
        char cpu_dir[30]; /* 30 characters should be more than enough */
@@ -5548,28 +5534,28 @@ tracing_init_debugfs_percpu(struct trace_array *tr, long cpu)
        }
        /* per cpu trace_pipe */
-        trace_create_file("trace_pipe", 0444, d_cpu,
+        trace_create_cpu_file("trace_pipe", 0444, d_cpu,
-                        (void *)&data->trace_cpu, &tracing_pipe_fops);
+                                tr, cpu, &tracing_pipe_fops);
        /* per cpu trace */
-        trace_create_file("trace", 0644, d_cpu,
+        trace_create_cpu_file("trace", 0644, d_cpu,
-                        (void *)&data->trace_cpu, &tracing_fops);
+                                tr, cpu, &tracing_fops);
-        trace_create_file("trace_pipe_raw", 0444, d_cpu,
+        trace_create_cpu_file("trace_pipe_raw", 0444, d_cpu,
-                        (void *)&data->trace_cpu, &tracing_buffers_fops);
+                                tr, cpu, &tracing_buffers_fops);
-        trace_create_file("stats", 0444, d_cpu,
+        trace_create_cpu_file("stats", 0444, d_cpu,
-                        (void *)&data->trace_cpu, &tracing_stats_fops);
+                                tr, cpu, &tracing_stats_fops);
-        trace_create_file("buffer_size_kb", 0444, d_cpu,
+        trace_create_cpu_file("buffer_size_kb", 0444, d_cpu,
-                        (void *)&data->trace_cpu, &tracing_entries_fops);
+                                tr, cpu, &tracing_entries_fops);
 #ifdef CONFIG_TRACER_SNAPSHOT
-        trace_create_file("snapshot", 0644, d_cpu,
+        trace_create_cpu_file("snapshot", 0644, d_cpu,
-                          (void *)&data->trace_cpu, &snapshot_fops);
+                                tr, cpu, &snapshot_fops);
-        trace_create_file("snapshot_raw", 0444, d_cpu,
+        trace_create_cpu_file("snapshot_raw", 0444, d_cpu,
-                        (void *)&data->trace_cpu, &snapshot_raw_fops);
+                                tr, cpu, &snapshot_raw_fops);
 #endif
 }
@@ -5878,17 +5864,6 @@ struct dentry *trace_instance_dir;
 static void
 init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer);
-static void init_trace_buffers(struct trace_array *tr, struct trace_buffer *buf)
-{
-        int cpu;
-        for_each_tracing_cpu(cpu) {
-                memset(per_cpu_ptr(buf->data, cpu), 0, sizeof(struct trace_array_cpu));
-                per_cpu_ptr(buf->data, cpu)->trace_cpu.cpu = cpu;
-                per_cpu_ptr(buf->data, cpu)->trace_cpu.tr = tr;
-        }
-}
 static int
 allocate_trace_buffer(struct trace_array *tr, struct trace_buffer *buf, int size)
 {
@@ -5906,8 +5881,6 @@ allocate_trace_buffer(struct trace_array *tr, struct trace_buffer *buf, int size
                return -ENOMEM;
        }
-        init_trace_buffers(tr, buf);
        /* Allocate the first page for all buffers */
        set_buffer_entries(&tr->trace_buffer,
                           ring_buffer_size(tr->trace_buffer.buffer, 0));
@@ -5974,10 +5947,6 @@ static int new_instance_create(const char *name)
        if (allocate_trace_buffers(tr, trace_buf_size) < 0)
                goto out_free_tr;
-        /* Holder for file callbacks */
-        tr->trace_cpu.cpu = RING_BUFFER_ALL_CPUS;
-        tr->trace_cpu.tr = tr;
        tr->dir = debugfs_create_dir(name, trace_instance_dir);
        if (!tr->dir)
                goto out_free_tr;
@@ -6132,13 +6101,13 @@ init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer)
                          tr, &tracing_iter_fops);
        trace_create_file("trace", 0644, d_tracer,
-                        (void *)&tr->trace_cpu, &tracing_fops);
+                          tr, &tracing_fops);
        trace_create_file("trace_pipe", 0444, d_tracer,
-                        (void *)&tr->trace_cpu, &tracing_pipe_fops);
+                          tr, &tracing_pipe_fops);
        trace_create_file("buffer_size_kb", 0644, d_tracer,
-                        (void *)&tr->trace_cpu, &tracing_entries_fops);
+                          tr, &tracing_entries_fops);
        trace_create_file("buffer_total_size_kb", 0444, d_tracer,
                          tr, &tracing_total_entries_fops);
@@ -6153,11 +6122,11 @@ init_tracer_debugfs(struct trace_array *tr, struct dentry *d_tracer)
                          &trace_clock_fops);
        trace_create_file("tracing_on", 0644, d_tracer,
-                            tr, &rb_simple_fops);
+                          tr, &rb_simple_fops);
 #ifdef CONFIG_TRACER_SNAPSHOT
        trace_create_file("snapshot", 0644, d_tracer,
-                          (void *)&tr->trace_cpu, &snapshot_fops);
+                          tr, &snapshot_fops);
 #endif
        for_each_tracing_cpu(cpu)
@@ -6451,10 +6420,6 @@ __init static int tracer_alloc_buffers(void)
        global_trace.flags = TRACE_ARRAY_FL_GLOBAL;
-        /* Holder for file callbacks */
-        global_trace.trace_cpu.cpu = RING_BUFFER_ALL_CPUS;
-        global_trace.trace_cpu.tr = &global_trace;
        INIT_LIST_HEAD(&global_trace.systems);
        INIT_LIST_HEAD(&global_trace.events);
        list_add(&global_trace.list, &ftrace_trace_arrays);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index e7d643b8a907..afaae41b0a02 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -130,19 +130,12 @@ enum trace_flag_type {
 struct trace_array;
-struct trace_cpu {
-        struct trace_array      *tr;
-        struct dentry           *dir;
-        int                     cpu;
-};
 /*
 * The CPU trace array - it consists of thousands of trace entries
 * plus some other descriptor data: (for example which task started
 * the trace, etc.)
 */
 struct trace_array_cpu {
-        struct trace_cpu        trace_cpu;
        atomic_t                disabled;
        void                    *buffer_page;   /* ring buffer spare */
@@ -196,7 +189,6 @@ struct trace_array {
        bool                    allocated_snapshot;
 #endif
        int                     buffer_disabled;
-        struct trace_cpu        trace_cpu;      /* place holder */
 #ifdef CONFIG_FTRACE_SYSCALLS
        int                     sys_refcount_enter;
        int                     sys_refcount_exit;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index e2f83591161b..92b9b4324372 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -417,9 +417,11 @@ static void stac_update_outputs(struct hda_codec *codec)
                        val &= ~spec->eapd_mask;
                else
                        val |= spec->eapd_mask;
-                if (spec->gpio_data != val)
+                if (spec->gpio_data != val) {
+                        spec->gpio_data = val;
                        stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir,
                                      val);
+                }
        }
 }
@@ -3231,7 +3233,7 @@ static const struct hda_fixup stac927x_fixups[] = {
                        /* configure the analog microphone on some laptops */
                        { 0x0c, 0x90a79130 },
                        /* correct the front output jack as a hp out */
-                        { 0x0f, 0x0227011f },
+                        { 0x0f, 0x0221101f },
                        /* correct the front input jack as a mic */
                        { 0x0e, 0x02a79130 },
                        {}
@@ -3612,20 +3614,18 @@ static int stac_parse_auto_config(struct hda_codec *codec)
 static int stac_init(struct hda_codec *codec)
 {
        struct sigmatel_spec *spec = codec->spec;
-        unsigned int gpio;
        int i;
        /* override some hints */
        stac_store_hints(codec);
        /* set up GPIO */
-        gpio = spec->gpio_data;
        /* turn on EAPD statically when spec->eapd_switch isn't set.
         * otherwise, unsol event will turn it on/off dynamically
         */
        if (!spec->eapd_switch)
-                gpio |= spec->eapd_mask;
+                spec->gpio_data |= spec->eapd_mask;
-        stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir, gpio);
+        stac_gpio_set(codec, spec->gpio_mask, spec->gpio_dir, spec->gpio_data);
        snd_hda_gen_init(codec);
@@ -3915,6 +3915,7 @@ static void stac_setup_gpio(struct hda_codec *codec)
 {
        struct sigmatel_spec *spec = codec->spec;
+        spec->gpio_mask |= spec->eapd_mask;
        if (spec->gpio_led) {
                if (!spec->vref_mute_led_nid) {
                        spec->gpio_mask |= spec->gpio_led;
diff --git a/sound/soc/cirrus/ep93xx-ac97.c b/sound/soc/cirrus/ep93xx-ac97.c
index ac73c607410a..04491f0e8d1b 100644
--- a/sound/soc/cirrus/ep93xx-ac97.c
+++ b/sound/soc/cirrus/ep93xx-ac97.c
@@ -102,13 +102,13 @@ static struct ep93xx_ac97_info *ep93xx_ac97_info;
 static struct ep93xx_dma_data ep93xx_ac97_pcm_out = {
        .name           = "ac97-pcm-out",
-        .dma_port       = EP93XX_DMA_AAC1,
+        .port           = EP93XX_DMA_AAC1,
        .direction      = DMA_MEM_TO_DEV,
 };
 static struct ep93xx_dma_data ep93xx_ac97_pcm_in = {
        .name           = "ac97-pcm-in",
-        .dma_port       = EP93XX_DMA_AAC1,
+        .port           = EP93XX_DMA_AAC1,
        .direction      = DMA_DEV_TO_MEM,
 };
diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
index 3eeada57e87d..566a367c94fa 100644
--- a/sound/soc/codecs/max98088.c
+++ b/sound/soc/codecs/max98088.c
@@ -1612,7 +1612,7 @@ static int max98088_dai2_digital_mute(struct snd_soc_dai *codec_dai, int mute)
 static void max98088_sync_cache(struct snd_soc_codec *codec)
 {
-       u16 *reg_cache = codec->reg_cache;
+       u8 *reg_cache = codec->reg_cache;
       int i;
       if (!codec->cache_sync)
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index d659d3adcfb3..6c8a9e7bee25 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -1527,6 +1527,9 @@ static int sgtl5000_i2c_probe(struct i2c_client *client,
        if (IS_ERR(sgtl5000->mclk)) {
                ret = PTR_ERR(sgtl5000->mclk);
                dev_err(&client->dev, "Failed to get mclock: %d\n", ret);
+                /* Defer the probe to see if the clk will be provided later */
+                if (ret == -ENOENT)
+                        return -EPROBE_DEFER;
                return ret;
        }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 0ec070cf7231..d82ee386eab5 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3908,10 +3908,8 @@ int snd_soc_add_platform(struct device *dev, struct snd_soc_platform *platform,
 {
        /* create platform component name */
        platform->name = fmt_single_name(dev, &platform->id);
-        if (platform->name == NULL) {
+        if (platform->name == NULL)
-                kfree(platform);
                return -ENOMEM;
-        }
        platform->dev = dev;
        platform->driver = platform_drv;
diff --git a/sound/soc/tegra/tegra20_ac97.c b/sound/soc/tegra/tegra20_ac97.c
index e58233f7df61..6c486625321b 100644
--- a/sound/soc/tegra/tegra20_ac97.c
+++ b/sound/soc/tegra/tegra20_ac97.c
@@ -389,9 +389,9 @@ static int tegra20_ac97_platform_probe(struct platform_device *pdev)
        ac97->capture_dma_data.slave_id = of_dma[1];
        ac97->playback_dma_data.addr = mem->start + TEGRA20_AC97_FIFO_TX1;
-        ac97->capture_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+        ac97->playback_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        ac97->capture_dma_data.maxburst = 4;
+        ac97->playback_dma_data.maxburst = 4;
-        ac97->capture_dma_data.slave_id = of_dma[0];
+        ac97->playback_dma_data.slave_id = of_dma[1];
        ret = tegra_asoc_utils_init(&ac97->util_data, &pdev->dev);
        if (ret)
diff --git a/sound/soc/tegra/tegra20_spdif.c b/sound/soc/tegra/tegra20_spdif.c
index 5eaa12cdc6eb..551b3c93ce93 100644
--- a/sound/soc/tegra/tegra20_spdif.c
+++ b/sound/soc/tegra/tegra20_spdif.c
@@ -323,8 +323,8 @@ static int tegra20_spdif_platform_probe(struct platform_device *pdev)
        }
        spdif->playback_dma_data.addr = mem->start + TEGRA20_SPDIF_DATA_OUT;
-        spdif->capture_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+        spdif->playback_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        spdif->capture_dma_data.maxburst = 4;
+        spdif->playback_dma_data.maxburst = 4;
        spdif->playback_dma_data.slave_id = dmareq->start;
        pm_runtime_enable(&pdev->dev);
diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
index 2aa4e13063a8..3d2551cc10f2 100644
--- a/sound/usb/6fire/pcm.c
+++ b/sound/usb/6fire/pcm.c
@@ -543,7 +543,7 @@ static snd_pcm_uframes_t usb6fire_pcm_pointer(
        snd_pcm_uframes_t ret;
        if (rt->panic || !sub)
-                return SNDRV_PCM_STATE_XRUN;
+                return SNDRV_PCM_POS_XRUN;
        spin_lock_irqsave(&sub->lock, flags);
        ret = sub->dma_off;
diff --git a/sound/usb/hiface/pcm.c b/sound/usb/hiface/pcm.c
index 6430ed2a9f65..c21a3df9a0df 100644
--- a/sound/usb/hiface/pcm.c
+++ b/sound/usb/hiface/pcm.c
@@ -503,7 +503,7 @@ static snd_pcm_uframes_t hiface_pcm_pointer(struct snd_pcm_substream *alsa_sub)
        snd_pcm_uframes_t dma_offset;
        if (rt->panic || !sub)
-                return SNDRV_PCM_STATE_XRUN;
+                return SNDRV_PCM_POS_XRUN;
        spin_lock_irqsave(&sub->lock, flags);
        dma_offset = sub->dma_off;
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index ca9fa4d32e07..07819bfa7dba 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -1026,9 +1026,10 @@ kvp_get_ip_info(int family, char *if_name, int op,
                                if (sn_offset == 0)
                                        strcpy(sn_str, cidr_mask);
-                                else
+                                else {
+                                        strcat((char *)ip_buffer->sub_net, ";");
                                        strcat(sn_str, cidr_mask);
-                                strcat((char *)ip_buffer->sub_net, ";");
+                                }
                                sn_offset += strlen(sn_str) + 1;
                        }