393 files changed, 7224 insertions, 2083 deletions

diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 1f89424c36a6..65bbd2622396 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -272,6 +272,8 @@ printk-formats.txt
         - how to get printk format specifiers right
 prio_tree.txt
         - info on radix-priority-search-tree use for indexing vmas.
+ramoops.txt
+        - documentation of the ramoops oops/panic logging module.
 rbtree.txt
         - info on what red-black trees are and what they are for.
 robust-futex-ABI.txt
diff --git a/Documentation/PCI/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index 3f5e0b09bed5..53e6fca146d7 100644
--- a/Documentation/PCI/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
@@ -45,7 +45,7 @@ arrived in memory (this becomes more likely with devices behind PCI-PCI
 bridges).  In order to ensure that all the data has arrived in memory,
 the interrupt handler must read a register on the device which raised
 the interrupt.  PCI transaction ordering rules require that all the data
-arrives in memory before the value can be returned from the register.
+arrive in memory before the value may be returned from the register.
 Using MSIs avoids this problem as the interrupt-generating write cannot
 pass the data writes, so by the time the interrupt is raised, the driver
 knows that all the data has arrived in memory.
@@ -86,13 +86,13 @@ device.
 
 int pci_enable_msi(struct pci_dev *dev)
 
-A successful call will allocate ONE interrupt to the device, regardless
-of how many MSIs the device supports.  The device will be switched from
+A successful call allocates ONE interrupt to the device, regardless
+of how many MSIs the device supports.  The device is switched from
 pin-based interrupt mode to MSI mode.  The dev->irq number is changed
-to a new number which represents the message signaled interrupt.
-This function should be called before the driver calls request_irq()
-since enabling MSIs disables the pin-based IRQ and the driver will not
-receive interrupts on the old interrupt.
+to a new number which represents the message signaled interrupt;
+consequently, this function should be called before the driver calls
+request_irq(), because an MSI is delivered via a vector that is
+different from the vector of a pin-based interrupt.
 
 4.2.2 pci_enable_msi_block
 
@@ -111,20 +111,20 @@ the device are in the range dev->irq to dev->irq + count - 1.
 
 If this function returns a negative number, it indicates an error and
 the driver should not attempt to request any more MSI interrupts for
-this device.  If this function returns a positive number, it will be
-less than 'count' and indicate the number of interrupts that could have
-been allocated.  In neither case will the irq value have been
-updated, nor will the device have been switched into MSI mode.
+this device.  If this function returns a positive number, it is
+less than 'count' and indicates the number of interrupts that could have
+been allocated.  In neither case is the irq value updated or the device
+switched into MSI mode.
 
 The device driver must decide what action to take if
-pci_enable_msi_block() returns a value less than the number asked for.
-Some devices can make use of fewer interrupts than the maximum they
-request; in this case the driver should call pci_enable_msi_block()
+pci_enable_msi_block() returns a value less than the number requested.
+For instance, the driver could still make use of fewer interrupts;
+in this case the driver should call pci_enable_msi_block()
 again.  Note that it is not guaranteed to succeed, even when the
 'count' has been reduced to the value returned from a previous call to
 pci_enable_msi_block().  This is because there are multiple constraints
 on the number of vectors that can be allocated; pci_enable_msi_block()
-will return as soon as it finds any constraint that doesn't allow the
+returns as soon as it finds any constraint that doesn't allow the
 call to succeed.
 
 4.2.3 pci_disable_msi
@@ -137,10 +137,10 @@ interrupt number and frees the previously allocated message signaled
 interrupt(s).  The interrupt may subsequently be assigned to another
 device, so drivers should not cache the value of dev->irq.
 
-A device driver must always call free_irq() on the interrupt(s)
-for which it has called request_irq() before calling this function.
-Failure to do so will result in a BUG_ON(), the device will be left with
-MSI enabled and will leak its vector.
+Before calling this function, a device driver must always call free_irq()
+on any interrupt for which it previously called request_irq().
+Failure to do so results in a BUG_ON(), leaving the device with
+MSI enabled and thus leaking its vector.
 
 4.3 Using MSI-X
 
@@ -155,10 +155,10 @@ struct msix_entry {
 };
 
 This allows for the device to use these interrupts in a sparse fashion;
-for example it could use interrupts 3 and 1027 and allocate only a
+for example, it could use interrupts 3 and 1027 and yet allocate only a
 two-element array.  The driver is expected to fill in the 'entry' value
-in each element of the array to indicate which entries it wants the kernel
-to assign interrupts for.  It is invalid to fill in two entries with the
+in each element of the array to indicate for which entries the kernel
+should assign interrupts; it is invalid to fill in two entries with the
 same number.
 
 4.3.1 pci_enable_msix
@@ -168,10 +168,11 @@ int pci_enable_msix(struct pci_dev *dev, struct msix_entry *entries, int nvec)
 Calling this function asks the PCI subsystem to allocate 'nvec' MSIs.
 The 'entries' argument is a pointer to an array of msix_entry structs
 which should be at least 'nvec' entries in size.  On success, the
-function will return 0 and the device will have been switched into
-MSI-X interrupt mode.  The 'vector' elements in each entry will have
-been filled in with the interrupt number.  The driver should then call
-request_irq() for each 'vector' that it decides to use.
+device is switched into MSI-X mode and the function returns 0.
+The 'vector' member in each entry is populated with the interrupt number;
+the driver should then call request_irq() for each 'vector' that it
+decides to use.  The device driver is responsible for keeping track of the
+interrupts assigned to the MSI-X vectors so it can free them again later.
 
 If this function returns a negative number, it indicates an error and
 the driver should not attempt to allocate any more MSI-X interrupts for
@@ -181,16 +182,14 @@ below.
 
 This function, in contrast with pci_enable_msi(), does not adjust
 dev->irq.  The device will not generate interrupts for this interrupt
-number once MSI-X is enabled.  The device driver is responsible for
-keeping track of the interrupts assigned to the MSI-X vectors so it can
-free them again later.
+number once MSI-X is enabled.
 
 Device drivers should normally call this function once per device
 during the initialization phase.
 
-It is ideal if drivers can cope with a variable number of MSI-X interrupts,
+It is ideal if drivers can cope with a variable number of MSI-X interrupts;
 there are many reasons why the platform may not be able to provide the
-exact number a driver asks for.
+exact number that a driver asks for.
 
 A request loop to achieve that might look like:
 
@@ -212,15 +211,15 @@ static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 
 void pci_disable_msix(struct pci_dev *dev)
 
-This API should be used to undo the effect of pci_enable_msix().  It frees
+This function should be used to undo the effect of pci_enable_msix().  It frees
 the previously allocated message signaled interrupts.  The interrupts may
 subsequently be assigned to another device, so drivers should not cache
 the value of the 'vector' elements over a call to pci_disable_msix().
 
-A device driver must always call free_irq() on the interrupt(s)
-for which it has called request_irq() before calling this function.
-Failure to do so will result in a BUG_ON(), the device will be left with
-MSI enabled and will leak its vector.
+Before calling this function, a device driver must always call free_irq()
+on any interrupt for which it previously called request_irq().
+Failure to do so results in a BUG_ON(), leaving the device with
+MSI-X enabled and thus leaking its vector.
 
 4.3.3 The MSI-X Table
 
@@ -232,10 +231,10 @@ mask or unmask an interrupt, it should call disable_irq() / enable_irq().
 4.4 Handling devices implementing both MSI and MSI-X capabilities
 
 If a device implements both MSI and MSI-X capabilities, it can
-run in either MSI mode or MSI-X mode but not both simultaneously.
+run in either MSI mode or MSI-X mode, but not both simultaneously.
 This is a requirement of the PCI spec, and it is enforced by the
 PCI layer.  Calling pci_enable_msi() when MSI-X is already enabled or
-pci_enable_msix() when MSI is already enabled will result in an error.
+pci_enable_msix() when MSI is already enabled results in an error.
 If a device driver wishes to switch between MSI and MSI-X at runtime,
 it must first quiesce the device, then switch it back to pin-interrupt
 mode, before calling pci_enable_msi() or pci_enable_msix() and resuming
@@ -251,7 +250,7 @@ the MSI-X facilities in preference to the MSI facilities.  As mentioned
 above, MSI-X supports any number of interrupts between 1 and 2048.
 In constrast, MSI is restricted to a maximum of 32 interrupts (and
 must be a power of two).  In addition, the MSI interrupt vectors must
-be allocated consecutively, so the system may not be able to allocate
+be allocated consecutively, so the system might not be able to allocate
 as many vectors for MSI as it could for MSI-X.  On some platforms, MSI
 interrupts must all be targeted at the same set of CPUs whereas MSI-X
 interrupts can all be targeted at different CPUs.
@@ -281,7 +280,7 @@ disabled to enabled and back again.
 
 Using 'lspci -v' (as root) may show some devices with "MSI", "Message
 Signalled Interrupts" or "MSI-X" capabilities.  Each of these capabilities
-has an 'Enable' flag which will be followed with either "+" (enabled)
+has an 'Enable' flag which is followed with either "+" (enabled)
 or "-" (disabled).
 
 
@@ -298,7 +297,7 @@ The PCI stack provides three ways to disable MSIs:
 
 Some host chipsets simply don't support MSIs properly.  If we're
 lucky, the manufacturer knows this and has indicated it in the ACPI
-FADT table.  In this case, Linux will automatically disable MSIs.
+FADT table.  In this case, Linux automatically disables MSIs.
 Some boards don't include this information in the table and so we have
 to detect them ourselves.  The complete list of these is found near the
 quirk_disable_all_msi() function in drivers/pci/quirks.c.
@@ -317,7 +316,7 @@ Some bridges allow you to enable MSIs by changing some bits in their
 PCI configuration space (especially the Hypertransport chipsets such
 as the nVidia nForce and Serverworks HT2000).  As with host chipsets,
 Linux mostly knows about them and automatically enables MSIs if it can.
-If you have a bridge which Linux doesn't yet know about, you can enable
+If you have a bridge unknown to Linux, you can enable
 MSIs in configuration space using whatever method you know works, then
 enable MSIs on that bridge by doing:
 
@@ -327,7 +326,7 @@ where $bridge is the PCI address of the bridge you've enabled (eg
 0000:00:0e.0).
 
 To disable MSIs, echo 0 instead of 1.  Changing this value should be
-done with caution as it can break interrupt handling for all devices
+done with caution as it could break interrupt handling for all devices
 below this bridge.
 
 Again, please notify linux-pci@vger.kernel.org of any bridges that need
@@ -336,7 +335,7 @@ special handling.
 5.3. Disabling MSIs on a single device
 
 Some devices are known to have faulty MSI implementations.  Usually this
-is handled in the individual device driver but occasionally it's necessary
+is handled in the individual device driver, but occasionally it's necessary
 to handle this with a quirk.  Some drivers have an option to disable use
 of MSI.  While this is a convenient workaround for the driver author,
 it is not good practise, and should not be emulated.
@@ -350,7 +349,7 @@ for your machine.  You should also check your .config to be sure you
 have enabled CONFIG_PCI_MSI.
 
 Then, 'lspci -t' gives the list of bridges above a device.  Reading
-/sys/bus/pci/devices/*/msi_bus will tell you whether MSI are enabled (1)
+/sys/bus/pci/devices/*/msi_bus will tell you whether MSIs are enabled (1)
 or disabled (0).  If 0 is found in any of the msi_bus files belonging
 to bridges between the PCI root and the device, MSIs are disabled.
 
diff --git a/Documentation/SubmittingDrivers b/Documentation/SubmittingDrivers
index 319baa8b60dd..36d16bbf72c6 100644
--- a/Documentation/SubmittingDrivers
+++ b/Documentation/SubmittingDrivers
@@ -130,7 +130,7 @@ Linux kernel master tree:
         ftp.??.kernel.org:/pub/linux/kernel/...
         ?? == your country code, such as "us", "uk", "fr", etc.
 
-        http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git
+        http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git
 
 Linux kernel mailing list:
         linux-kernel@vger.kernel.org
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 569f3532e138..4468ce24427c 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -303,7 +303,7 @@ patches that are being emailed around.
 
 The sign-off is a simple line at the end of the explanation for the
 patch, which certifies that you wrote it or otherwise have the right to
-pass it on as a open-source patch.  The rules are pretty simple: if you
+pass it on as an open-source patch.  The rules are pretty simple: if you
 can certify the below:
 
         Developer's Certificate of Origin 1.1
diff --git a/Documentation/block/cfq-iosched.txt b/Documentation/block/cfq-iosched.txt
index e578feed6d81..6d670f570451 100644
--- a/Documentation/block/cfq-iosched.txt
+++ b/Documentation/block/cfq-iosched.txt
@@ -43,3 +43,74 @@ If one sets slice_idle=0 and if storage supports NCQ, CFQ internally switches
 to IOPS mode and starts providing fairness in terms of number of requests
 dispatched. Note that this mode switching takes effect only for group
 scheduling. For non-cgroup users nothing should change.
+
+CFQ IO scheduler Idling Theory
+===============================
+Idling on a queue is primarily about waiting for the next request to come
+on same queue after completion of a request. In this process CFQ will not
+dispatch requests from other cfq queues even if requests are pending there.
+
+The rationale behind idling is that it can cut down on number of seeks
+on rotational media. For example, if a process is doing dependent
+sequential reads (next read will come on only after completion of previous
+one), then not dispatching request from other queue should help as we
+did not move the disk head and kept on dispatching sequential IO from
+one queue.
+
+CFQ has following service trees and various queues are put on these trees.
+
+        sync-idle       sync-noidle     async
+
+All cfq queues doing synchronous sequential IO go on to sync-idle tree.
+On this tree we idle on each queue individually.
+
+All synchronous non-sequential queues go on sync-noidle tree. Also any
+request which are marked with REQ_NOIDLE go on this service tree. On this
+tree we do not idle on individual queues instead idle on the whole group
+of queues or the tree. So if there are 4 queues waiting for IO to dispatch
+we will idle only once last queue has dispatched the IO and there is
+no more IO on this service tree.
+
+All async writes go on async service tree. There is no idling on async
+queues.
+
+CFQ has some optimizations for SSDs and if it detects a non-rotational
+media which can support higher queue depth (multiple requests at in
+flight at a time), then it cuts down on idling of individual queues and
+all the queues move to sync-noidle tree and only tree idle remains. This
+tree idling provides isolation with buffered write queues on async tree.
+
+FAQ
+===
+Q1. Why to idle at all on queues marked with REQ_NOIDLE.
+
+A1. We only do tree idle (all queues on sync-noidle tree) on queues marked
+    with REQ_NOIDLE. This helps in providing isolation with all the sync-idle
+    queues. Otherwise in presence of many sequential readers, other
+    synchronous IO might not get fair share of disk.
+
+    For example, if there are 10 sequential readers doing IO and they get
+    100ms each. If a REQ_NOIDLE request comes in, it will be scheduled
+    roughly after 1 second. If after completion of REQ_NOIDLE request we
+    do not idle, and after a couple of milli seconds a another REQ_NOIDLE
+    request comes in, again it will be scheduled after 1second. Repeat it
+    and notice how a workload can lose its disk share and suffer due to
+    multiple sequential readers.
+
+    fsync can generate dependent IO where bunch of data is written in the
+    context of fsync, and later some journaling data is written. Journaling
+    data comes in only after fsync has finished its IO (atleast for ext4
+    that seemed to be the case). Now if one decides not to idle on fsync
+    thread due to REQ_NOIDLE, then next journaling write will not get
+    scheduled for another second. A process doing small fsync, will suffer
+    badly in presence of multiple sequential readers.
+
+    Hence doing tree idling on threads using REQ_NOIDLE flag on requests
+    provides isolation from multiple sequential readers and at the same
+    time we do not idle on individual threads.
+
+Q2. When to specify REQ_NOIDLE
+A2. I would think whenever one is doing synchronous write and not expecting
+    more writes to be dispatched from same context soon, should be able
+    to specify REQ_NOIDLE on writes and that probably should work well for
+    most of the cases.
diff --git a/Documentation/email-clients.txt b/Documentation/email-clients.txt
index a0b58e29f911..860c29a472ad 100644
--- a/Documentation/email-clients.txt
+++ b/Documentation/email-clients.txt
@@ -199,18 +199,16 @@ to coerce it into behaving.
 
 To beat some sense out of the internal editor, do this:
 
-- Under account settings, composition and addressing, uncheck "Compose
-  messages in HTML format".
-
 - Edit your Thunderbird config settings so that it won't use format=flowed.
   Go to "edit->preferences->advanced->config editor" to bring up the
   thunderbird's registry editor, and set "mailnews.send_plaintext_flowed" to
   "false".
 
-- Enable "preformat" mode: Shft-click on the Write icon to bring up the HTML
-  composer, select "Preformat" from the drop-down box just under the subject
-  line, then close the message without saving.  (This setting also applies to
-  the text composer, but the only control for it is in the HTML composer.)
+- Disable HTML Format: Set "mail.identity.id1.compose_html" to "false".
+
+- Enable "preformat" mode: Set "editor.quotesPreformatted" to "true".
+
+- Enable UTF8: Set "prefs.converted-to-utf8" to "true".
 
 - Install the "toggle wordwrap" extension.  Download the file from:
     https://addons.mozilla.org/thunderbird/addon/2351/
diff --git a/Documentation/filesystems/befs.txt b/Documentation/filesystems/befs.txt
index 6e49c363938e..da45e6c842b8 100644
--- a/Documentation/filesystems/befs.txt
+++ b/Documentation/filesystems/befs.txt
@@ -27,7 +27,7 @@ His original code can still be found at:
 Does anyone know of a more current email address for Makoto? He doesn't
 respond to the address given above...
 
-Current maintainer: Sergey S. Kostyliov <rathamahata@php4.ru>
+This filesystem doesn't have a maintainer.
 
 WHAT IS THIS DRIVER?
 ==================
diff --git a/Documentation/kernel-docs.txt b/Documentation/kernel-docs.txt
index 9a8674629a07..0e0734b509d8 100644
--- a/Documentation/kernel-docs.txt
+++ b/Documentation/kernel-docs.txt
@@ -620,17 +620,6 @@
        (including this document itself) have been moved there, and might
        be more up to date than the web version.
 
-     * Name: "Linux Source Driver"
-       URL: http://lsd.linux.cz
-       Keywords: Browsing source code.
-       Description: "Linux Source Driver (LSD) is an application, which
-       can make browsing source codes of Linux kernel easier than you can
-       imagine. You can select between multiple versions of kernel (e.g.
-       0.01, 1.0.0, 2.0.33, 2.0.34pre13, 2.0.0, 2.1.101 etc.). With LSD
-       you can search Linux kernel (fulltext, macros, types, functions
-       and variables) and LSD can generate patches for you on the fly
-       (files, directories or kernel)".
-
      * Name: "Linux Kernel Source Reference"
        Author: Thomas Graichen.
        URL: http://marc.info/?l=linux-kernel&m=96446640102205&w=4
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e279b7242912..614d0382e2cb 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -40,6 +40,7 @@ parameter is applicable:
         ALSA    ALSA sound support is enabled.
         APIC    APIC support is enabled.
         APM     Advanced Power Management support is enabled.
+        ARM     ARM architecture is enabled.
         AVR32   AVR32 architecture is enabled.
         AX25    Appropriate AX.25 support is enabled.
         BLACKFIN Blackfin architecture is enabled.
@@ -49,6 +50,7 @@ parameter is applicable:
         EFI     EFI Partitioning (GPT) is enabled
         EIDE    EIDE/ATAPI support is enabled.
         FB      The frame buffer device is enabled.
+        FTRACE  Function tracing enabled.
         GCOV    GCOV profiling is enabled.
         HW      Appropriate hardware is enabled.
         IA-64   IA-64 architecture is enabled.
@@ -69,6 +71,7 @@ parameter is applicable:
                         Documentation/m68k/kernel-options.txt.
         MCA     MCA bus support is enabled.
         MDA     MDA console support is enabled.
+        MIPS    MIPS architecture is enabled.
         MOUSE   Appropriate mouse support is enabled.
         MSI     Message Signaled Interrupts (PCI).
         MTD     MTD (Memory Technology Device) support is enabled.
@@ -100,7 +103,6 @@ parameter is applicable:
         SPARC   Sparc architecture is enabled.
         SWSUSP  Software suspend (hibernation) is enabled.
         SUSPEND System suspend states are enabled.
-        FTRACE  Function tracing enabled.
         TPM     TPM drivers are enabled.
         TS      Appropriate touchscreen support is enabled.
         UMS     USB Mass Storage support is enabled.
@@ -115,7 +117,7 @@ parameter is applicable:
         X86-64  X86-64 architecture is enabled.
                         More X86-64 boot options can be found in
                         Documentation/x86/x86_64/boot-options.txt .
-        X86     Either 32bit or 64bit x86 (same as X86-32+X86-64)
+        X86     Either 32-bit or 64-bit x86 (same as X86-32+X86-64)
         XEN     Xen support is enabled
 
 In addition, the following text indicates that the option:
@@ -376,7 +378,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         atkbd.softrepeat= [HW]
                         Use software keyboard repeat
 
-        autotest        [IA64]
+        autotest        [IA-64]
 
         baycom_epp=     [HW,AX25]
                         Format: <io>,<mode>
@@ -681,8 +683,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                 uart[8250],mmio32,<addr>[,options]
                         Start an early, polled-mode console on the 8250/16550
                         UART at the specified I/O port or MMIO address.
-                        MMIO inter-register address stride is either 8bit (mmio)
-                        or 32bit (mmio32).
+                        MMIO inter-register address stride is either 8-bit
+                        (mmio) or 32-bit (mmio32).
                         The options are the same as for ttyS, above.
 
         earlyprintk=    [X86,SH,BLACKFIN]
@@ -725,7 +727,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         See Documentation/block/as-iosched.txt and
                         Documentation/block/deadline-iosched.txt for details.
 
-        elfcorehdr=     [IA64,PPC,SH,X86]
+        elfcorehdr=     [IA-64,PPC,SH,X86]
                         Specifies physical address of start of kernel core
                         image elf header. Generally kexec loader will
                         pass this option to capture kernel.
@@ -791,7 +793,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         tracer at boot up. function-list is a comma separated
                         list of functions. This list can be changed at run
                         time by the set_ftrace_filter file in the debugfs
-                        tracing directory. 
+                        tracing directory.
 
         ftrace_notrace=[function-list]
                         [FTRACE] Do not trace the functions specified in
@@ -829,7 +831,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         hashdist=       [KNL,NUMA] Large hashes allocated during boot
                         are distributed across NUMA nodes.  Defaults on
-                        for 64bit NUMA, off otherwise.
+                        for 64-bit NUMA, off otherwise.
                         Format: 0 | 1 (for off | on)
 
         hcl=            [IA-64] SGI's Hardware Graph compatibility layer
@@ -998,10 +1000,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         DMA.
                 forcedac [x86_64]
                         With this option iommu will not optimize to look
-                        for io virtual address below 32 bit forcing dual
+                        for io virtual address below 32-bit forcing dual
                         address cycle on pci bus for cards supporting greater
-                        than 32 bit addressing. The default is to look
-                        for translation below 32 bit and if not available
+                        than 32-bit addressing. The default is to look
+                        for translation below 32-bit and if not available
                         then look in the higher range.
                 strict [Default Off]
                         With this option on every unmap_single operation will
@@ -1017,7 +1019,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         off     disable Interrupt Remapping
                         nosid   disable Source ID checking
 
-        inttest=        [IA64]
+        inttest=        [IA-64]
 
         iomem=          Disable strict checking of access to MMIO memory
                 strict  regions from userspace.
@@ -1034,7 +1036,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                 nomerge
                 forcesac
                 soft
-                pt      [x86, IA64]
+                pt      [x86, IA-64]
 
         io7=            [HW] IO7 for Marvel based alpha systems
                         See comment before marvel_specify_io7 in
@@ -1165,7 +1167,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         kvm-amd.npt=    [KVM,AMD] Disable nested paging (virtualized MMU)
                         for all guests.
-                        Default is 1 (enabled) if in 64bit or 32bit-PAE mode
+                        Default is 1 (enabled) if in 64-bit or 32-bit PAE mode.
 
         kvm-intel.ept=  [KVM,Intel] Disable extended page tables
                         (virtualized MMU) support on capable Intel chips.
@@ -1202,10 +1204,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         libata.dma=0      Disable all PATA and SATA DMA
                         libata.dma=1      PATA and SATA Disk DMA only
                         libata.dma=2      ATAPI (CDROM) DMA only
-                        libata.dma=4      Compact Flash DMA only 
+                        libata.dma=4      Compact Flash DMA only
                         Combinations also work, so libata.dma=3 enables DMA
                         for disks and CDROMs, but not CFs.
-        
+
         libata.ignore_hpa=      [LIBATA] Ignore HPA limit
                         libata.ignore_hpa=0       keep BIOS limits (default)
                         libata.ignore_hpa=1       ignore limits, using full disk
@@ -1331,7 +1333,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         ltpc=           [NET]
                         Format: <io>,<irq>,<dma>
 
-        machvec=        [IA64] Force the use of a particular machine-vector
+        machvec=        [IA-64] Force the use of a particular machine-vector
                         (machvec) in a generic kernel.
                         Example: machvec=hpzx1_swiotlb
 
@@ -1348,9 +1350,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         it is equivalent to "nosmp", which also disables
                         the IO APIC.
 
-        max_loop=       [LOOP] Maximum number of loopback devices that can
-                        be mounted
-                        Format: <1-256>
+        max_loop=       [LOOP] The number of loop block devices that get
+        (loop.max_loop) unconditionally pre-created at init time. The default
+                        number is configured by BLK_DEV_LOOP_MIN_COUNT. Instead
+                        of statically allocating a predefined number, loop
+                        devices can be requested on-demand with the
+                        /dev/loop-control interface.
 
         mcatest=        [IA-64]
 
@@ -1734,7 +1739,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         nointroute      [IA-64]
 
-        nojitter        [IA64] Disables jitter checking for ITC timers.
+        nojitter        [IA-64] Disables jitter checking for ITC timers.
 
         no-kvmclock     [X86,KVM] Disable paravirtualized KVM clock driver
 
@@ -1800,7 +1805,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         nox2apic        [X86-64,APIC] Do not enable x2APIC mode.
 
-        nptcg=          [IA64] Override max number of concurrent global TLB
+        nptcg=          [IA-64] Override max number of concurrent global TLB
                         purges which is reported from either PAL_VM_SUMMARY or
                         SAL PALO.
 
@@ -2077,7 +2082,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         Format: { parport<nr> | timid | 0 }
                         See also Documentation/parport.txt.
 
-        pmtmr=          [X86] Manual setup of pmtmr I/O Port. 
+        pmtmr=          [X86] Manual setup of pmtmr I/O Port.
                         Override pmtimer IOPort with a hex value.
                         e.g. pmtmr=0x508
 
@@ -2635,6 +2640,16 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                                         medium is write-protected).
                         Example: quirks=0419:aaf5:rl,0421:0433:rc
 
+        user_debug=     [KNL,ARM]
+                        Format: <int>
+                        See arch/arm/Kconfig.debug help text.
+                                 1 - undefined instruction events
+                                 2 - system calls
+                                 4 - invalid data aborts
+                                 8 - SIGSEGV faults
+                                16 - SIGBUS faults
+                        Example: user_debug=31
+
         userpte=
                         [X86] Flags controlling user PTE allocations.
 
@@ -2680,6 +2695,27 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         vmpoff=         [KNL,S390] Perform z/VM CP command after power off.
                         Format: <command>
 
+        vsyscall=       [X86-64]
+                        Controls the behavior of vsyscalls (i.e. calls to
+                        fixed addresses of 0xffffffffff600x00 from legacy
+                        code).  Most statically-linked binaries and older
+                        versions of glibc use these calls.  Because these
+                        functions are at fixed addresses, they make nice
+                        targets for exploits that can control RIP.
+
+                        emulate     [default] Vsyscalls turn into traps and are
+                                    emulated reasonably safely.
+
+                        native      Vsyscalls are native syscall instructions.
+                                    This is a little bit faster than trapping
+                                    and makes a few dynamic recompilers work
+                                    better than they would in emulation mode.
+                                    It also makes exploits much easier to write.
+
+                        none        Vsyscalls don't work at all.  This makes
+                                    them quite hard to use for exploits but
+                                    might break your system.
+
         vt.cur_default= [VT] Default cursor shape.
                         Format: 0xCCBBAA, where AA, BB, and CC are the same as
                         the parameters of the <Esc>[?A;B;Cc escape sequence;
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 5dd960d75174..91df678fb7f8 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -238,6 +238,18 @@ ad_select
 
         This option was added in bonding version 3.4.0.
 
+all_slaves_active
+
+        Specifies that duplicate frames (received on inactive ports) should be
+        dropped (0) or delivered (1).
+
+        Normally, bonding will drop duplicate frames (received on inactive
+        ports), which is desirable for most users. But there are some times
+        it is nice to allow duplicate frames to be delivered.
+
+        The default value is 0 (drop duplicate frames received on inactive
+        ports).
+
 arp_interval
 
         Specifies the ARP link monitoring frequency in milliseconds.
@@ -433,6 +445,23 @@ miimon
         determined.  See the High Availability section for additional
         information.  The default value is 0.
 
+min_links
+
+        Specifies the minimum number of links that must be active before
+        asserting carrier. It is similar to the Cisco EtherChannel min-links
+        feature. This allows setting the minimum number of member ports that
+        must be up (link-up state) before marking the bond device as up
+        (carrier on). This is useful for situations where higher level services
+        such as clustering want to ensure a minimum number of low bandwidth
+        links are active before switchover. This option only affect 802.3ad
+        mode.
+
+        The default value is 0. This will cause carrier to be asserted (for
+        802.3ad mode) whenever there is an active aggregator, regardless of the
+        number of available links in that aggregator. Note that, because an
+        aggregator cannot be active without at least one available link,
+        setting this option to 0 or to 1 has the exact same effect.
+
 mode
 
         Specifies one of the bonding policies. The default is
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
new file mode 100644
index 000000000000..7254b4b5910e
--- /dev/null
+++ b/Documentation/networking/scaling.txt
@@ -0,0 +1,371 @@
+Scaling in the Linux Networking Stack
+
+
+Introduction
+============
+
+This document describes a set of complementary techniques in the Linux
+networking stack to increase parallelism and improve performance for
+multi-processor systems.
+
+The following technologies are described:
+
+  RSS: Receive Side Scaling
+  RPS: Receive Packet Steering
+  RFS: Receive Flow Steering
+  Accelerated Receive Flow Steering
+  XPS: Transmit Packet Steering
+
+
+RSS: Receive Side Scaling
+=========================
+
+Contemporary NICs support multiple receive and transmit descriptor queues
+(multi-queue). On reception, a NIC can send different packets to different
+queues to distribute processing among CPUs. The NIC distributes packets by
+applying a filter to each packet that assigns it to one of a small number
+of logical flows. Packets for each flow are steered to a separate receive
+queue, which in turn can be processed by separate CPUs. This mechanism is
+generally known as “Receive-side Scaling” (RSS). The goal of RSS and
+the other scaling techniques to increase performance uniformly.
+Multi-queue distribution can also be used for traffic prioritization, but
+that is not the focus of these techniques.
+
+The filter used in RSS is typically a hash function over the network
+and/or transport layer headers-- for example, a 4-tuple hash over
+IP addresses and TCP ports of a packet. The most common hardware
+implementation of RSS uses a 128-entry indirection table where each entry
+stores a queue number. The receive queue for a packet is determined
+by masking out the low order seven bits of the computed hash for the
+packet (usually a Toeplitz hash), taking this number as a key into the
+indirection table and reading the corresponding value.
+
+Some advanced NICs allow steering packets to queues based on
+programmable filters. For example, webserver bound TCP port 80 packets
+can be directed to their own receive queue. Such “n-tuple” filters can
+be configured from ethtool (--config-ntuple).
+
+==== RSS Configuration
+
+The driver for a multi-queue capable NIC typically provides a kernel
+module parameter for specifying the number of hardware queues to
+configure. In the bnx2x driver, for instance, this parameter is called
+num_queues. A typical RSS configuration would be to have one receive queue
+for each CPU if the device supports enough queues, or otherwise at least
+one for each cache domain at a particular cache level (L1, L2, etc.).
+
+The indirection table of an RSS device, which resolves a queue by masked
+hash, is usually programmed by the driver at initialization. The
+default mapping is to distribute the queues evenly in the table, but the
+indirection table can be retrieved and modified at runtime using ethtool
+commands (--show-rxfh-indir and --set-rxfh-indir). Modifying the
+indirection table could be done to give different queues different
+relative weights.
+
+== RSS IRQ Configuration
+
+Each receive queue has a separate IRQ associated with it. The NIC triggers
+this to notify a CPU when new packets arrive on the given queue. The
+signaling path for PCIe devices uses message signaled interrupts (MSI-X),
+that can route each interrupt to a particular CPU. The active mapping
+of queues to IRQs can be determined from /proc/interrupts. By default,
+an IRQ may be handled on any CPU. Because a non-negligible part of packet
+processing takes place in receive interrupt handling, it is advantageous
+to spread receive interrupts between CPUs. To manually adjust the IRQ
+affinity of each interrupt see Documentation/IRQ-affinity. Some systems
+will be running irqbalance, a daemon that dynamically optimizes IRQ
+assignments and as a result may override any manual settings.
+
+== Suggested Configuration
+
+RSS should be enabled when latency is a concern or whenever receive
+interrupt processing forms a bottleneck. Spreading load between CPUs
+decreases queue length. For low latency networking, the optimal setting
+is to allocate as many queues as there are CPUs in the system (or the
+NIC maximum, if lower). Because the aggregate number of interrupts grows
+with each additional queue, the most efficient high-rate configuration
+is likely the one with the smallest number of receive queues where no
+CPU that processes receive interrupts reaches 100% utilization. Per-cpu
+load can be observed using the mpstat utility.
+
+
+RPS: Receive Packet Steering
+============================
+
+Receive Packet Steering (RPS) is logically a software implementation of
+RSS. Being in software, it is necessarily called later in the datapath.
+Whereas RSS selects the queue and hence CPU that will run the hardware
+interrupt handler, RPS selects the CPU to perform protocol processing
+above the interrupt handler. This is accomplished by placing the packet
+on the desired CPU’s backlog queue and waking up the CPU for processing.
+RPS has some advantages over RSS: 1) it can be used with any NIC,
+2) software filters can easily be added to hash over new protocols,
+3) it does not increase hardware device interrupt rate (although it does
+introduce inter-processor interrupts (IPIs)).
+
+RPS is called during bottom half of the receive interrupt handler, when
+a driver sends a packet up the network stack with netif_rx() or
+netif_receive_skb(). These call the get_rps_cpu() function, which
+selects the queue that should process a packet.
+
+The first step in determining the target CPU for RPS is to calculate a
+flow hash over the packet’s addresses or ports (2-tuple or 4-tuple hash
+depending on the protocol). This serves as a consistent hash of the
+associated flow of the packet. The hash is either provided by hardware
+or will be computed in the stack. Capable hardware can pass the hash in
+the receive descriptor for the packet; this would usually be the same
+hash used for RSS (e.g. computed Toeplitz hash). The hash is saved in
+skb->rx_hash and can be used elsewhere in the stack as a hash of the
+packet’s flow.
+
+Each receive hardware queue has an associated list of CPUs to which
+RPS may enqueue packets for processing. For each received packet,
+an index into the list is computed from the flow hash modulo the size
+of the list. The indexed CPU is the target for processing the packet,
+and the packet is queued to the tail of that CPU’s backlog queue. At
+the end of the bottom half routine, IPIs are sent to any CPUs for which
+packets have been queued to their backlog queue. The IPI wakes backlog
+processing on the remote CPU, and any queued packets are then processed
+up the networking stack.
+
+==== RPS Configuration
+
+RPS requires a kernel compiled with the CONFIG_RPS kconfig symbol (on
+by default for SMP). Even when compiled in, RPS remains disabled until
+explicitly configured. The list of CPUs to which RPS may forward traffic
+can be configured for each receive queue using a sysfs file entry:
+
+ /sys/class/net/<dev>/queues/rx-<n>/rps_cpus
+
+This file implements a bitmap of CPUs. RPS is disabled when it is zero
+(the default), in which case packets are processed on the interrupting
+CPU. Documentation/IRQ-affinity.txt explains how CPUs are assigned to
+the bitmap.
+
+== Suggested Configuration
+
+For a single queue device, a typical RPS configuration would be to set
+the rps_cpus to the CPUs in the same cache domain of the interrupting
+CPU. If NUMA locality is not an issue, this could also be all CPUs in
+the system. At high interrupt rate, it might be wise to exclude the
+interrupting CPU from the map since that already performs much work.
+
+For a multi-queue system, if RSS is configured so that a hardware
+receive queue is mapped to each CPU, then RPS is probably redundant
+and unnecessary. If there are fewer hardware queues than CPUs, then
+RPS might be beneficial if the rps_cpus for each queue are the ones that
+share the same cache domain as the interrupting CPU for that queue.
+
+
+RFS: Receive Flow Steering
+==========================
+
+While RPS steers packets solely based on hash, and thus generally
+provides good load distribution, it does not take into account
+application locality. This is accomplished by Receive Flow Steering
+(RFS). The goal of RFS is to increase datacache hitrate by steering
+kernel processing of packets to the CPU where the application thread
+consuming the packet is running. RFS relies on the same RPS mechanisms
+to enqueue packets onto the backlog of another CPU and to wake up that
+CPU.
+
+In RFS, packets are not forwarded directly by the value of their hash,
+but the hash is used as index into a flow lookup table. This table maps
+flows to the CPUs where those flows are being processed. The flow hash
+(see RPS section above) is used to calculate the index into this table.
+The CPU recorded in each entry is the one which last processed the flow.
+If an entry does not hold a valid CPU, then packets mapped to that entry
+are steered using plain RPS. Multiple table entries may point to the
+same CPU. Indeed, with many flows and few CPUs, it is very likely that
+a single application thread handles flows with many different flow hashes.
+
+rps_sock_table is a global flow table that contains the *desired* CPU for
+flows: the CPU that is currently processing the flow in userspace. Each
+table value is a CPU index that is updated during calls to recvmsg and
+sendmsg (specifically, inet_recvmsg(), inet_sendmsg(), inet_sendpage()
+and tcp_splice_read()).
+
+When the scheduler moves a thread to a new CPU while it has outstanding
+receive packets on the old CPU, packets may arrive out of order. To
+avoid this, RFS uses a second flow table to track outstanding packets
+for each flow: rps_dev_flow_table is a table specific to each hardware
+receive queue of each device. Each table value stores a CPU index and a
+counter. The CPU index represents the *current* CPU onto which packets
+for this flow are enqueued for further kernel processing. Ideally, kernel
+and userspace processing occur on the same CPU, and hence the CPU index
+in both tables is identical. This is likely false if the scheduler has
+recently migrated a userspace thread while the kernel still has packets
+enqueued for kernel processing on the old CPU.
+
+The counter in rps_dev_flow_table values records the length of the current
+CPU's backlog when a packet in this flow was last enqueued. Each backlog
+queue has a head counter that is incremented on dequeue. A tail counter
+is computed as head counter + queue length. In other words, the counter
+in rps_dev_flow_table[i] records the last element in flow i that has
+been enqueued onto the currently designated CPU for flow i (of course,
+entry i is actually selected by hash and multiple flows may hash to the
+same entry i).
+
+And now the trick for avoiding out of order packets: when selecting the
+CPU for packet processing (from get_rps_cpu()) the rps_sock_flow table
+and the rps_dev_flow table of the queue that the packet was received on
+are compared. If the desired CPU for the flow (found in the
+rps_sock_flow table) matches the current CPU (found in the rps_dev_flow
+table), the packet is enqueued onto that CPU’s backlog. If they differ,
+the current CPU is updated to match the desired CPU if one of the
+following is true:
+
+- The current CPU's queue head counter >= the recorded tail counter
+  value in rps_dev_flow[i]
+- The current CPU is unset (equal to NR_CPUS)
+- The current CPU is offline
+
+After this check, the packet is sent to the (possibly updated) current
+CPU. These rules aim to ensure that a flow only moves to a new CPU when
+there are no packets outstanding on the old CPU, as the outstanding
+packets could arrive later than those about to be processed on the new
+CPU.
+
+==== RFS Configuration
+
+RFS is only available if the kconfig symbol CONFIG_RFS is enabled (on
+by default for SMP). The functionality remains disabled until explicitly
+configured. The number of entries in the global flow table is set through:
+
+ /proc/sys/net/core/rps_sock_flow_entries
+
+The number of entries in the per-queue flow table are set through:
+
+ /sys/class/net/<dev>/queues/tx-<n>/rps_flow_cnt
+
+== Suggested Configuration
+
+Both of these need to be set before RFS is enabled for a receive queue.
+Values for both are rounded up to the nearest power of two. The
+suggested flow count depends on the expected number of active connections
+at any given time, which may be significantly less than the number of open
+connections. We have found that a value of 32768 for rps_sock_flow_entries
+works fairly well on a moderately loaded server.
+
+For a single queue device, the rps_flow_cnt value for the single queue
+would normally be configured to the same value as rps_sock_flow_entries.
+For a multi-queue device, the rps_flow_cnt for each queue might be
+configured as rps_sock_flow_entries / N, where N is the number of
+queues. So for instance, if rps_flow_entries is set to 32768 and there
+are 16 configured receive queues, rps_flow_cnt for each queue might be
+configured as 2048.
+
+
+Accelerated RFS
+===============
+
+Accelerated RFS is to RFS what RSS is to RPS: a hardware-accelerated load
+balancing mechanism that uses soft state to steer flows based on where
+the application thread consuming the packets of each flow is running.
+Accelerated RFS should perform better than RFS since packets are sent
+directly to a CPU local to the thread consuming the data. The target CPU
+will either be the same CPU where the application runs, or at least a CPU
+which is local to the application thread’s CPU in the cache hierarchy.
+
+To enable accelerated RFS, the networking stack calls the
+ndo_rx_flow_steer driver function to communicate the desired hardware
+queue for packets matching a particular flow. The network stack
+automatically calls this function every time a flow entry in
+rps_dev_flow_table is updated. The driver in turn uses a device specific
+method to program the NIC to steer the packets.
+
+The hardware queue for a flow is derived from the CPU recorded in
+rps_dev_flow_table. The stack consults a CPU to hardware queue map which
+is maintained by the NIC driver. This is an auto-generated reverse map of
+the IRQ affinity table shown by /proc/interrupts. Drivers can use
+functions in the cpu_rmap (“CPU affinity reverse map”) kernel library
+to populate the map. For each CPU, the corresponding queue in the map is
+set to be one whose processing CPU is closest in cache locality.
+
+==== Accelerated RFS Configuration
+
+Accelerated RFS is only available if the kernel is compiled with
+CONFIG_RFS_ACCEL and support is provided by the NIC device and driver.
+It also requires that ntuple filtering is enabled via ethtool. The map
+of CPU to queues is automatically deduced from the IRQ affinities
+configured for each receive queue by the driver, so no additional
+configuration should be necessary.
+
+== Suggested Configuration
+
+This technique should be enabled whenever one wants to use RFS and the
+NIC supports hardware acceleration.
+
+XPS: Transmit Packet Steering
+=============================
+
+Transmit Packet Steering is a mechanism for intelligently selecting
+which transmit queue to use when transmitting a packet on a multi-queue
+device. To accomplish this, a mapping from CPU to hardware queue(s) is
+recorded. The goal of this mapping is usually to assign queues
+exclusively to a subset of CPUs, where the transmit completions for
+these queues are processed on a CPU within this set. This choice
+provides two benefits. First, contention on the device queue lock is
+significantly reduced since fewer CPUs contend for the same queue
+(contention can be eliminated completely if each CPU has its own
+transmit queue). Secondly, cache miss rate on transmit completion is
+reduced, in particular for data cache lines that hold the sk_buff
+structures.
+
+XPS is configured per transmit queue by setting a bitmap of CPUs that
+may use that queue to transmit. The reverse mapping, from CPUs to
+transmit queues, is computed and maintained for each network device.
+When transmitting the first packet in a flow, the function
+get_xps_queue() is called to select a queue. This function uses the ID
+of the running CPU as a key into the CPU-to-queue lookup table. If the
+ID matches a single queue, that is used for transmission. If multiple
+queues match, one is selected by using the flow hash to compute an index
+into the set.
+
+The queue chosen for transmitting a particular flow is saved in the
+corresponding socket structure for the flow (e.g. a TCP connection).
+This transmit queue is used for subsequent packets sent on the flow to
+prevent out of order (ooo) packets. The choice also amortizes the cost
+of calling get_xps_queues() over all packets in the connection. To avoid
+ooo packets, the queue for a flow can subsequently only be changed if
+skb->ooo_okay is set for a packet in the flow. This flag indicates that
+there are no outstanding packets in the flow, so the transmit queue can
+change without the risk of generating out of order packets. The
+transport layer is responsible for setting ooo_okay appropriately. TCP,
+for instance, sets the flag when all data for a connection has been
+acknowledged.
+
+==== XPS Configuration
+
+XPS is only available if the kconfig symbol CONFIG_XPS is enabled (on by
+default for SMP). The functionality remains disabled until explicitly
+configured. To enable XPS, the bitmap of CPUs that may use a transmit
+queue is configured using the sysfs file entry:
+
+/sys/class/net/<dev>/queues/tx-<n>/xps_cpus
+
+== Suggested Configuration
+
+For a network device with a single transmission queue, XPS configuration
+has no effect, since there is no choice in this case. In a multi-queue
+system, XPS is preferably configured so that each CPU maps onto one queue.
+If there are as many queues as there are CPUs in the system, then each
+queue can also map onto one CPU, resulting in exclusive pairings that
+experience no contention. If there are fewer queues than CPUs, then the
+best CPUs to share a given queue are probably those that share the cache
+with the CPU that processes transmit completions for that queue
+(transmit interrupts).
+
+
+Further Information
+===================
+RPS and RFS were introduced in kernel 2.6.35. XPS was incorporated into
+2.6.38. Original patches were submitted by Tom Herbert
+(therbert@google.com)
+
+Accelerated RFS was introduced in 2.6.35. Original patches were
+submitted by Ben Hutchings (bhutchings@solarflare.com)
+
+Authors:
+Tom Herbert (therbert@google.com)
+Willem de Bruijn (willemb@google.com)
diff --git a/Documentation/ramoops.txt b/Documentation/ramoops.txt
new file mode 100644
index 000000000000..8fb1ba7fe7bf
--- /dev/null
+++ b/Documentation/ramoops.txt
@@ -0,0 +1,76 @@
+Ramoops oops/panic logger
+=========================
+
+Sergiu Iordache <sergiu@chromium.org>
+
+Updated: 8 August 2011
+
+0. Introduction
+
+Ramoops is an oops/panic logger that writes its logs to RAM before the system
+crashes. It works by logging oopses and panics in a circular buffer. Ramoops
+needs a system with persistent RAM so that the content of that area can
+survive after a restart.
+
+1. Ramoops concepts
+
+Ramoops uses a predefined memory area to store the dump. The start and size of
+the memory area are set using two variables:
+  * "mem_address" for the start
+  * "mem_size" for the size. The memory size will be rounded down to a
+  power of two.
+
+The memory area is divided into "record_size" chunks (also rounded down to
+power of two) and each oops/panic writes a "record_size" chunk of
+information.
+
+Dumping both oopses and panics can be done by setting 1 in the "dump_oops"
+variable while setting 0 in that variable dumps only the panics.
+
+The module uses a counter to record multiple dumps but the counter gets reset
+on restart (i.e. new dumps after the restart will overwrite old ones).
+
+2. Setting the parameters
+
+Setting the ramoops parameters can be done in 2 different manners:
+ 1. Use the module parameters (which have the names of the variables described
+ as before).
+ 2. Use a platform device and set the platform data. The parameters can then
+ be set through that platform data. An example of doing that is:
+
+#include <linux/ramoops.h>
+[...]
+
+static struct ramoops_platform_data ramoops_data = {
+        .mem_size               = <...>,
+        .mem_address            = <...>,
+        .record_size            = <...>,
+        .dump_oops              = <...>,
+};
+
+static struct platform_device ramoops_dev = {
+        .name = "ramoops",
+        .dev = {
+                .platform_data = &ramoops_data,
+        },
+};
+
+[... inside a function ...]
+int ret;
+
+ret = platform_device_register(&ramoops_dev);
+if (ret) {
+        printk(KERN_ERR "unable to register platform device\n");
+        return ret;
+}
+
+3. Dump format
+
+The data dump begins with a header, currently defined as "====" followed by a
+timestamp and a new line. The dump then continues with the actual data.
+
+4. Reading the data
+
+The dump data can be read from memory (through /dev/mem or other means).
+Getting the module parameters, which are needed in order to parse the data, can
+be done through /sys/module/ramoops/parameters/* .
diff --git a/Documentation/virtual/00-INDEX b/Documentation/virtual/00-INDEX
index fe0251c4cfb7..8e601991d91c 100644
--- a/Documentation/virtual/00-INDEX
+++ b/Documentation/virtual/00-INDEX
@@ -8,3 +8,6 @@ lguest/
         - Extremely simple hypervisor for experimental/educational use.
 uml/
         - User Mode Linux, builds/runs Linux kernel as a userspace program.
+virtio.txt
+        - Text version of draft virtio spec.
+          See http://ozlabs.org/~rusty/virtio-spec
diff --git a/Documentation/virtual/lguest/lguest.c b/Documentation/virtual/lguest/lguest.c
index 043bd7df3139..d928c134dee6 100644
--- a/Documentation/virtual/lguest/lguest.c
+++ b/Documentation/virtual/lguest/lguest.c
@@ -1996,6 +1996,9 @@ int main(int argc, char *argv[])
         /* We use a simple helper to copy the arguments separated by spaces. */
         concat((char *)(boot + 1), argv+optind+2);
 
+        /* Set kernel alignment to 16M (CONFIG_PHYSICAL_ALIGN) */
+        boot->hdr.kernel_alignment = 0x1000000;
+
         /* Boot protocol version: 2.07 supports the fields for lguest. */
         boot->hdr.version = 0x207;
 
diff --git a/Documentation/virtual/virtio-spec.txt b/Documentation/virtual/virtio-spec.txt
new file mode 100644
index 000000000000..a350ae135b8c
--- /dev/null
+++ b/Documentation/virtual/virtio-spec.txt
@@ -0,0 +1,2200 @@
+[Generated file: see http://ozlabs.org/~rusty/virtio-spec/]
+Virtio PCI Card Specification
+v0.9.1 DRAFT
+-
+
+Rusty Russell <rusty@rustcorp.com.au>IBM Corporation (Editor)
+
+2011 August 1.
+
+Purpose and Description
+
+This document describes the specifications of the “virtio” family
+of PCI[LaTeX Command: nomenclature] devices. These are devices
+are found in virtual environments[LaTeX Command: nomenclature],
+yet by design they are not all that different from physical PCI
+devices, and this document treats them as such. This allows the
+guest to use standard PCI drivers and discovery mechanisms.
+
+The purpose of virtio and this specification is that virtual
+environments and guests should have a straightforward, efficient,
+standard and extensible mechanism for virtual devices, rather
+than boutique per-environment or per-OS mechanisms.
+
+  Straightforward: Virtio PCI devices use normal PCI mechanisms
+  of interrupts and DMA which should be familiar to any device
+  driver author. There is no exotic page-flipping or COW
+  mechanism: it's just a PCI device.[footnote:
+This lack of page-sharing implies that the implementation of the
+device (e.g. the hypervisor or host) needs full access to the
+guest memory. Communication with untrusted parties (i.e.
+inter-guest communication) requires copying.
+]
+
+  Efficient: Virtio PCI devices consist of rings of descriptors
+  for input and output, which are neatly separated to avoid cache
+  effects from both guest and device writing to the same cache
+  lines.
+
+  Standard: Virtio PCI makes no assumptions about the environment
+  in which it operates, beyond supporting PCI. In fact the virtio
+  devices specified in the appendices do not require PCI at all:
+  they have been implemented on non-PCI buses.[footnote:
+The Linux implementation further separates the PCI virtio code
+from the specific virtio drivers: these drivers are shared with
+the non-PCI implementations (currently lguest and S/390).
+]
+
+  Extensible: Virtio PCI devices contain feature bits which are
+  acknowledged by the guest operating system during device setup.
+  This allows forwards and backwards compatibility: the device
+  offers all the features it knows about, and the driver
+  acknowledges those it understands and wishes to use.
+
+  Virtqueues
+
+The mechanism for bulk data transport on virtio PCI devices is
+pretentiously called a virtqueue. Each device can have zero or
+more virtqueues: for example, the network device has one for
+transmit and one for receive.
+
+Each virtqueue occupies two or more physically-contiguous pages
+(defined, for the purposes of this specification, as 4096 bytes),
+and consists of three parts:
+
+
++-------------------+-----------------------------------+-----------+
+| Descriptor Table  |   Available Ring     (padding)    | Used Ring |
++-------------------+-----------------------------------+-----------+
+
+
+When the driver wants to send buffers to the device, it puts them
+in one or more slots in the descriptor table, and writes the
+descriptor indices into the available ring. It then notifies the
+device. When the device has finished with the buffers, it writes
+the descriptors into the used ring, and sends an interrupt.
+
+Specification
+
+  PCI Discovery
+
+Any PCI device with Vendor ID 0x1AF4, and Device ID 0x1000
+through 0x103F inclusive is a virtio device[footnote:
+The actual value within this range is ignored
+]. The device must also have a Revision ID of 0 to match this
+specification.
+
+The Subsystem Device ID indicates which virtio device is
+supported by the device. The Subsystem Vendor ID should reflect
+the PCI Vendor ID of the environment (it's currently only used
+for informational purposes by the guest).
+
+
++----------------------+--------------------+---------------+
+| Subsystem Device ID  |   Virtio Device    | Specification |
++----------------------+--------------------+---------------+
++----------------------+--------------------+---------------+
+|          1           |   network card     |  Appendix C   |
++----------------------+--------------------+---------------+
+|          2           |   block device     |  Appendix D   |
++----------------------+--------------------+---------------+
+|          3           |      console       |  Appendix E   |
++----------------------+--------------------+---------------+
+|          4           |  entropy source    |  Appendix F   |
++----------------------+--------------------+---------------+
+|          5           | memory ballooning  |  Appendix G   |
++----------------------+--------------------+---------------+
+|          6           |     ioMemory       |       -       |
++----------------------+--------------------+---------------+
+|          9           |   9P transport     |       -       |
++----------------------+--------------------+---------------+
+
+
+  Device Configuration
+
+To configure the device, we use the first I/O region of the PCI
+device. This contains a virtio header followed by a
+device-specific region.
+
+There may be different widths of accesses to the I/O region; the “
+natural” access method for each field in the virtio header must
+be used (i.e. 32-bit accesses for 32-bit fields, etc), but the
+device-specific region can be accessed using any width accesses,
+and should obtain the same results.
+
+Note that this is possible because while the virtio header is PCI
+(i.e. little) endian, the device-specific region is encoded in
+the native endian of the guest (where such distinction is
+applicable).
+
+  Device Initialization Sequence
+
+We start with an overview of device initialization, then expand
+on the details of the device and how each step is preformed.
+
+  Reset the device. This is not required on initial start up.
+
+  The ACKNOWLEDGE status bit is set: we have noticed the device.
+
+  The DRIVER status bit is set: we know how to drive the device.
+
+  Device-specific setup, including reading the Device Feature
+  Bits, discovery of virtqueues for the device, optional MSI-X
+  setup, and reading and possibly writing the virtio
+  configuration space.
+
+  The subset of Device Feature Bits understood by the driver is
+  written to the device.
+
+  The DRIVER_OK status bit is set.
+
+  The device can now be used (ie. buffers added to the
+  virtqueues)[footnote:
+Historically, drivers have used the device before steps 5 and 6.
+This is only allowed if the driver does not use any features
+which would alter this early use of the device.
+]
+
+If any of these steps go irrecoverably wrong, the guest should
+set the FAILED status bit to indicate that it has given up on the
+device (it can reset the device later to restart if desired).
+
+We now cover the fields required for general setup in detail.
+
+  Virtio Header
+
+The virtio header looks as follows:
+
+
++------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Bits       || 32                  | 32                  | 32       | 16     | 16      | 16      | 8       | 8      |
++------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Read/Write || R                   | R+W                 | R+W      | R      | R+W     | R+W     | R+W     | R      |
++------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Purpose    || Device              | Guest               | Queue    | Queue  | Queue   | Queue   | Device  | ISR    |
+|            || Features bits 0:31  | Features bits 0:31  | Address  | Size   | Select  | Notify  | Status  | Status |
++------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+
+
+If MSI-X is enabled for the device, two additional fields
+immediately follow this header:
+
+
++------------++----------------+--------+
+| Bits       || 16             | 16     |
+              +----------------+--------+
++------------++----------------+--------+
+| Read/Write || R+W            | R+W    |
++------------++----------------+--------+
+| Purpose    || Configuration  | Queue  |
+| (MSI-X)    || Vector         | Vector |
++------------++----------------+--------+
+
+
+Finally, if feature bits (VIRTIO_F_FEATURES_HI) this is
+immediately followed by two additional fields:
+
+
++------------++----------------------+----------------------
+| Bits       || 32                   | 32
++------------++----------------------+----------------------
+| Read/Write || R                    | R+W
++------------++----------------------+----------------------
+| Purpose    || Device               | Guest
+|            || Features bits 32:63  | Features bits 32:63
++------------++----------------------+----------------------
+
+
+Immediately following these general headers, there may be
+device-specific headers:
+
+
++------------++--------------------+
+| Bits       || Device Specific    |
+              +--------------------+
++------------++--------------------+
+| Read/Write || Device Specific    |
++------------++--------------------+
+| Purpose    || Device Specific... |
+|            ||                    |
++------------++--------------------+
+
+
+  Device Status
+
+The Device Status field is updated by the guest to indicate its
+progress. This provides a simple low-level diagnostic: it's most
+useful to imagine them hooked up to traffic lights on the console
+indicating the status of each device.
+
+The device can be reset by writing a 0 to this field, otherwise
+at least one bit should be set:
+
+  ACKNOWLEDGE (1) Indicates that the guest OS has found the
+  device and recognized it as a valid virtio device.
+
+  DRIVER (2) Indicates that the guest OS knows how to drive the
+  device. Under Linux, drivers can be loadable modules so there
+  may be a significant (or infinite) delay before setting this
+  bit.
+
+  DRIVER_OK (3) Indicates that the driver is set up and ready to
+  drive the device.
+
+  FAILED (8) Indicates that something went wrong in the guest,
+  and it has given up on the device. This could be an internal
+  error, or the driver didn't like the device for some reason, or
+  even a fatal error during device operation. The device must be
+  reset before attempting to re-initialize.
+
+  Feature Bits
+
+The least significant 31 bits of the first configuration field
+indicates the features that the device supports (the high bit is
+reserved, and will be used to indicate the presence of future
+feature bits elsewhere). If more than 31 feature bits are
+supported, the device indicates so by setting feature bit 31 (see
+[cha:Reserved-Feature-Bits]). The bits are allocated as follows:
+
+  0 to 23 Feature bits for the specific device type
+
+  24 to 40 Feature bits reserved for extensions to the queue and
+  feature negotiation mechanisms
+
+  41 to 63 Feature bits reserved for future extensions
+
+For example, feature bit 0 for a network device (i.e. Subsystem
+Device ID 1) indicates that the device supports checksumming of
+packets.
+
+The feature bits are negotiated: the device lists all the
+features it understands in the Device Features field, and the
+guest writes the subset that it understands into the Guest
+Features field. The only way to renegotiate is to reset the
+device.
+
+In particular, new fields in the device configuration header are
+indicated by offering a feature bit, so the guest can check
+before accessing that part of the configuration space.
+
+This allows for forwards and backwards compatibility: if the
+device is enhanced with a new feature bit, older guests will not
+write that feature bit back to the Guest Features field and it
+can go into backwards compatibility mode. Similarly, if a guest
+is enhanced with a feature that the device doesn't support, it
+will not see that feature bit in the Device Features field and
+can go into backwards compatibility mode (or, for poor
+implementations, set the FAILED Device Status bit).
+
+Access to feature bits 32 to 63 is enabled by Guest by setting
+feature bit 31. If this bit is unset, Device must assume that all
+feature bits > 31 are unset.
+
+  Configuration/Queue Vectors
+
+When MSI-X capability is present and enabled in the device
+(through standard PCI configuration space) 4 bytes at byte offset
+20 are used to map configuration change and queue interrupts to
+MSI-X vectors. In this case, the ISR Status field is unused, and
+device specific configuration starts at byte offset 24 in virtio
+header structure. When MSI-X capability is not enabled, device
+specific configuration starts at byte offset 20 in virtio header.
+
+Writing a valid MSI-X Table entry number, 0 to 0x7FF, to one of
+Configuration/Queue Vector registers, maps interrupts triggered
+by the configuration change/selected queue events respectively to
+the corresponding MSI-X vector. To disable interrupts for a
+specific event type, unmap it by writing a special NO_VECTOR
+value:
+
+/* Vector value used to disable MSI for queue */
+
+#define VIRTIO_MSI_NO_VECTOR            0xffff
+
+Reading these registers returns vector mapped to a given event,
+or NO_VECTOR if unmapped. All queue and configuration change
+events are unmapped by default.
+
+Note that mapping an event to vector might require allocating
+internal device resources, and might fail. Devices report such
+failures by returning the NO_VECTOR value when the relevant
+Vector field is read. After mapping an event to vector, the
+driver must verify success by reading the Vector field value: on
+success, the previously written value is returned, and on
+failure, NO_VECTOR is returned. If a mapping failure is detected,
+the driver can retry mapping with fewervectors, or disable MSI-X.
+
+  Virtqueue Configuration
+
+As a device can have zero or more virtqueues for bulk data
+transport (for example, the network driver has two), the driver
+needs to configure them as part of the device-specific
+configuration.
+
+This is done as follows, for each virtqueue a device has:
+
+  Write the virtqueue index (first queue is 0) to the Queue
+  Select field.
+
+  Read the virtqueue size from the Queue Size field, which is
+  always a power of 2. This controls how big the virtqueue is
+  (see below). If this field is 0, the virtqueue does not exist.
+
+  Allocate and zero virtqueue in contiguous physical memory, on a
+  4096 byte alignment. Write the physical address, divided by
+  4096 to the Queue Address field.[footnote:
+The 4096 is based on the x86 page size, but it's also large
+enough to ensure that the separate parts of the virtqueue are on
+separate cache lines.
+]
+
+  Optionally, if MSI-X capability is present and enabled on the
+  device, select a vector to use to request interrupts triggered
+  by virtqueue events. Write the MSI-X Table entry number
+  corresponding to this vector in Queue Vector field. Read the
+  Queue Vector field: on success, previously written value is
+  returned; on failure, NO_VECTOR value is returned.
+
+The Queue Size field controls the total number of bytes required
+for the virtqueue according to the following formula:
+
+#define ALIGN(x) (((x) + 4095) & ~4095)
+
+static inline unsigned vring_size(unsigned int qsz)
+
+{
+
+     return ALIGN(sizeof(struct vring_desc)*qsz + sizeof(u16)*(2
++ qsz))
+
+          + ALIGN(sizeof(struct vring_used_elem)*qsz);
+
+}
+
+This currently wastes some space with padding, but also allows
+future extensions. The virtqueue layout structure looks like this
+(qsz is the Queue Size field, which is a variable, so this code
+won't compile):
+
+struct vring {
+
+    /* The actual descriptors (16 bytes each) */
+
+    struct vring_desc desc[qsz];
+
+
+
+    /* A ring of available descriptor heads with free-running
+index. */
+
+    struct vring_avail avail;
+
+
+
+    // Padding to the next 4096 boundary.
+
+    char pad[];
+
+
+
+    // A ring of used descriptor heads with free-running index.
+
+    struct vring_used used;
+
+};
+
+  A Note on Virtqueue Endianness
+
+Note that the endian of these fields and everything else in the
+virtqueue is the native endian of the guest, not little-endian as
+PCI normally is. This makes for simpler guest code, and it is
+assumed that the host already has to be deeply aware of the guest
+endian so such an “endian-aware” device is not a significant
+issue.
+
+  Descriptor Table
+
+The descriptor table refers to the buffers the guest is using for
+the device. The addresses are physical addresses, and the buffers
+can be chained via the next field. Each descriptor describes a
+buffer which is read-only or write-only, but a chain of
+descriptors can contain both read-only and write-only buffers.
+
+No descriptor chain may be more than 2^32 bytes long in total.struct vring_desc {
+
+    /* Address (guest-physical). */
+
+    u64 addr;
+
+    /* Length. */
+
+    u32 len;
+
+/* This marks a buffer as continuing via the next field. */
+
+#define VRING_DESC_F_NEXT   1
+
+/* This marks a buffer as write-only (otherwise read-only). */
+
+#define VRING_DESC_F_WRITE     2
+
+/* This means the buffer contains a list of buffer descriptors.
+*/
+
+#define VRING_DESC_F_INDIRECT   4
+
+    /* The flags as indicated above. */
+
+    u16 flags;
+
+    /* Next field if flags & NEXT */
+
+    u16 next;
+
+};
+
+The number of descriptors in the table is specified by the Queue
+Size field for this virtqueue.
+
+  <sub:Indirect-Descriptors>Indirect Descriptors
+
+Some devices benefit by concurrently dispatching a large number
+of large requests. The VIRTIO_RING_F_INDIRECT_DESC feature can be
+used to allow this (see [cha:Reserved-Feature-Bits]). To increase
+ring capacity it is possible to store a table of indirect
+descriptors anywhere in memory, and insert a descriptor in main
+virtqueue (with flags&INDIRECT on) that refers to memory buffer
+containing this indirect descriptor table; fields addr and len
+refer to the indirect table address and length in bytes,
+respectively. The indirect table layout structure looks like this
+(len is the length of the descriptor that refers to this table,
+which is a variable, so this code won't compile):
+
+struct indirect_descriptor_table {
+
+    /* The actual descriptors (16 bytes each) */
+
+    struct vring_desc desc[len / 16];
+
+};
+
+The first indirect descriptor is located at start of the indirect
+descriptor table (index 0), additional indirect descriptors are
+chained by next field. An indirect descriptor without next field
+(with flags&NEXT off) signals the end of the indirect descriptor
+table, and transfers control back to the main virtqueue. An
+indirect descriptor can not refer to another indirect descriptor
+table (flags&INDIRECT must be off). A single indirect descriptor
+table can include both read-only and write-only descriptors;
+write-only flag (flags&WRITE) in the descriptor that refers to it
+is ignored.
+
+  Available Ring
+
+The available ring refers to what descriptors we are offering the
+device: it refers to the head of a descriptor chain. The “flags”
+field is currently 0 or 1: 1 indicating that we do not need an
+interrupt when the device consumes a descriptor from the
+available ring. Alternatively, the guest can ask the device to
+delay interrupts until an entry with an index specified by the “
+used_event” field is written in the used ring (equivalently,
+until the idx field in the used ring will reach the value
+used_event + 1). The method employed by the device is controlled
+by the VIRTIO_RING_F_EVENT_IDX feature bit (see [cha:Reserved-Feature-Bits]
+). This interrupt suppression is merely an optimization; it may
+not suppress interrupts entirely.
+
+The “idx” field indicates where we would put the next descriptor
+entry (modulo the ring size). This starts at 0, and increases.
+
+struct vring_avail {
+
+#define VRING_AVAIL_F_NO_INTERRUPT      1
+
+   u16 flags;
+
+   u16 idx;
+
+   u16 ring[qsz]; /* qsz is the Queue Size field read from device
+*/
+
+   u16 used_event;
+
+};
+
+  Used Ring
+
+The used ring is where the device returns buffers once it is done
+with them. The flags field can be used by the device to hint that
+no notification is necessary when the guest adds to the available
+ring. Alternatively, the “avail_event” field can be used by the
+device to hint that no notification is necessary until an entry
+with an index specified by the “avail_event” is written in the
+available ring (equivalently, until the idx field in the
+available ring will reach the value avail_event + 1). The method
+employed by the device is controlled by the guest through the
+VIRTIO_RING_F_EVENT_IDX feature bit (see [cha:Reserved-Feature-Bits]
+). [footnote:
+These fields are kept here because this is the only part of the
+virtqueue written by the device
+].
+
+Each entry in the ring is a pair: the head entry of the
+descriptor chain describing the buffer (this matches an entry
+placed in the available ring by the guest earlier), and the total
+of bytes written into the buffer. The latter is extremely useful
+for guests using untrusted buffers: if you do not know exactly
+how much has been written by the device, you usually have to zero
+the buffer to ensure no data leakage occurs.
+
+/* u32 is used here for ids for padding reasons. */
+
+struct vring_used_elem {
+
+    /* Index of start of used descriptor chain. */
+
+    u32 id;
+
+    /* Total length of the descriptor chain which was used
+(written to) */
+
+    u32 len;
+
+};
+
+
+
+struct vring_used {
+
+#define VRING_USED_F_NO_NOTIFY  1
+
+    u16 flags;
+
+    u16 idx;
+
+    struct vring_used_elem ring[qsz];
+
+    u16 avail_event;
+
+};
+
+  Helpers for Managing Virtqueues
+
+The Linux Kernel Source code contains the definitions above and
+helper routines in a more usable form, in
+include/linux/virtio_ring.h. This was explicitly licensed by IBM
+and Red Hat under the (3-clause) BSD license so that it can be
+freely used by all other projects, and is reproduced (with slight
+variation to remove Linux assumptions) in Appendix A.
+
+  Device Operation
+
+There are two parts to device operation: supplying new buffers to
+the device, and processing used buffers from the device. As an
+example, the virtio network device has two virtqueues: the
+transmit virtqueue and the receive virtqueue. The driver adds
+outgoing (read-only) packets to the transmit virtqueue, and then
+frees them after they are used. Similarly, incoming (write-only)
+buffers are added to the receive virtqueue, and processed after
+they are used.
+
+  Supplying Buffers to The Device
+
+Actual transfer of buffers from the guest OS to the device
+operates as follows:
+
+  Place the buffer(s) into free descriptor(s).
+
+  If there are no free descriptors, the guest may choose to
+    notify the device even if notifications are suppressed (to
+    reduce latency).[footnote:
+The Linux drivers do this only for read-only buffers: for
+write-only buffers, it is assumed that the driver is merely
+trying to keep the receive buffer ring full, and no notification
+of this expected condition is necessary.
+]
+
+  Place the id of the buffer in the next ring entry of the
+  available ring.
+
+  The steps (1) and (2) may be performed repeatedly if batching
+  is possible.
+
+  A memory barrier should be executed to ensure the device sees
+  the updated descriptor table and available ring before the next
+  step.
+
+  The available “idx” field should be increased by the number of
+  entries added to the available ring.
+
+  A memory barrier should be executed to ensure that we update
+  the idx field before checking for notification suppression.
+
+  If notifications are not suppressed, the device should be
+  notified of the new buffers.
+
+Note that the above code does not take precautions against the
+available ring buffer wrapping around: this is not possible since
+the ring buffer is the same size as the descriptor table, so step
+(1) will prevent such a condition.
+
+In addition, the maximum queue size is 32768 (it must be a power
+of 2 which fits in 16 bits), so the 16-bit “idx” value can always
+distinguish between a full and empty buffer.
+
+Here is a description of each stage in more detail.
+
+  Placing Buffers Into The Descriptor Table
+
+A buffer consists of zero or more read-only physically-contiguous
+elements followed by zero or more physically-contiguous
+write-only elements (it must have at least one element). This
+algorithm maps it into the descriptor table:
+
+  for each buffer element, b:
+
+  Get the next free descriptor table entry, d
+
+  Set d.addr to the physical address of the start of b
+
+  Set d.len to the length of b.
+
+  If b is write-only, set d.flags to VRING_DESC_F_WRITE,
+    otherwise 0.
+
+  If there is a buffer element after this:
+
+    Set d.next to the index of the next free descriptor element.
+
+    Set the VRING_DESC_F_NEXT bit in d.flags.
+
+In practice, the d.next fields are usually used to chain free
+descriptors, and a separate count kept to check there are enough
+free descriptors before beginning the mappings.
+
+  Updating The Available Ring
+
+The head of the buffer we mapped is the first d in the algorithm
+above. A naive implementation would do the following:
+
+avail->ring[avail->idx % qsz] = head;
+
+However, in general we can add many descriptors before we update
+the “idx” field (at which point they become visible to the
+device), so we keep a counter of how many we've added:
+
+avail->ring[(avail->idx + added++) % qsz] = head;
+
+  Updating The Index Field
+
+Once the idx field of the virtqueue is updated, the device will
+be able to access the descriptor entries we've created and the
+memory they refer to. This is why a memory barrier is generally
+used before the idx update, to ensure it sees the most up-to-date
+copy.
+
+The idx field always increments, and we let it wrap naturally at
+65536:
+
+avail->idx += added;
+
+  <sub:Notifying-The-Device>Notifying The Device
+
+Device notification occurs by writing the 16-bit virtqueue index
+of this virtqueue to the Queue Notify field of the virtio header
+in the first I/O region of the PCI device. This can be expensive,
+however, so the device can suppress such notifications if it
+doesn't need them. We have to be careful to expose the new idx
+value before checking the suppression flag: it's OK to notify
+gratuitously, but not to omit a required notification. So again,
+we use a memory barrier here before reading the flags or the
+avail_event field.
+
+If the VIRTIO_F_RING_EVENT_IDX feature is not negotiated, and if
+the VRING_USED_F_NOTIFY flag is not set, we go ahead and write to
+the PCI configuration space.
+
+If the VIRTIO_F_RING_EVENT_IDX feature is negotiated, we read the
+avail_event field in the available ring structure. If the
+available index crossed_the avail_event field value since the
+last notification, we go ahead and write to the PCI configuration
+space. The avail_event field wraps naturally at 65536 as well:
+
+(u16)(new_idx - avail_event - 1) < (u16)(new_idx - old_idx)
+
+  <sub:Receiving-Used-Buffers>Receiving Used Buffers From The
+  Device
+
+Once the device has used a buffer (read from or written to it, or
+parts of both, depending on the nature of the virtqueue and the
+device), it sends an interrupt, following an algorithm very
+similar to the algorithm used for the driver to send the device a
+buffer:
+
+  Write the head descriptor number to the next field in the used
+  ring.
+
+  Update the used ring idx.
+
+  Determine whether an interrupt is necessary:
+
+  If the VIRTIO_F_RING_EVENT_IDX feature is not negotiated: check
+    if f the VRING_AVAIL_F_NO_INTERRUPT flag is not set in avail-
+    >flags
+
+  If the VIRTIO_F_RING_EVENT_IDX feature is negotiated: check
+    whether the used index crossed the used_event field value
+    since the last update. The used_event field wraps naturally
+    at 65536 as well:(u16)(new_idx - used_event - 1) < (u16)(new_idx - old_idx)
+
+  If an interrupt is necessary:
+
+  If MSI-X capability is disabled:
+
+    Set the lower bit of the ISR Status field for the device.
+
+    Send the appropriate PCI interrupt for the device.
+
+  If MSI-X capability is enabled:
+
+    Request the appropriate MSI-X interrupt message for the
+      device, Queue Vector field sets the MSI-X Table entry
+      number.
+
+    If Queue Vector field value is NO_VECTOR, no interrupt
+      message is requested for this event.
+
+The guest interrupt handler should:
+
+  If MSI-X capability is disabled: read the ISR Status field,
+  which will reset it to zero. If the lower bit is zero, the
+  interrupt was not for this device. Otherwise, the guest driver
+  should look through the used rings of each virtqueue for the
+  device, to see if any progress has been made by the device
+  which requires servicing.
+
+  If MSI-X capability is enabled: look through the used rings of
+  each virtqueue mapped to the specific MSI-X vector for the
+  device, to see if any progress has been made by the device
+  which requires servicing.
+
+For each ring, guest should then disable interrupts by writing
+VRING_AVAIL_F_NO_INTERRUPT flag in avail structure, if required.
+It can then process used ring entries finally enabling interrupts
+by clearing the VRING_AVAIL_F_NO_INTERRUPT flag or updating the
+EVENT_IDX field in the available structure, Guest should then
+execute a memory barrier, and then recheck the ring empty
+condition. This is necessary to handle the case where, after the
+last check and before enabling interrupts, an interrupt has been
+suppressed by the device:
+
+vring_disable_interrupts(vq);
+
+for (;;) {
+
+    if (vq->last_seen_used != vring->used.idx) {
+
+                vring_enable_interrupts(vq);
+
+                mb();
+
+                if (vq->last_seen_used != vring->used.idx)
+
+                        break;
+
+    }
+
+    struct vring_used_elem *e =
+vring.used->ring[vq->last_seen_used%vsz];
+
+    process_buffer(e);
+
+    vq->last_seen_used++;
+
+}
+
+  Dealing With Configuration Changes
+
+Some virtio PCI devices can change the device configuration
+state, as reflected in the virtio header in the PCI configuration
+space. In this case:
+
+  If MSI-X capability is disabled: an interrupt is delivered and
+  the second highest bit is set in the ISR Status field to
+  indicate that the driver should re-examine the configuration
+  space.Note that a single interrupt can indicate both that one
+  or more virtqueue has been used and that the configuration
+  space has changed: even if the config bit is set, virtqueues
+  must be scanned.
+
+  If MSI-X capability is enabled: an interrupt message is
+  requested. The Configuration Vector field sets the MSI-X Table
+  entry number to use. If Configuration Vector field value is
+  NO_VECTOR, no interrupt message is requested for this event.
+
+Creating New Device Types
+
+Various considerations are necessary when creating a new device
+type:
+
+  How Many Virtqueues?
+
+It is possible that a very simple device will operate entirely
+through its configuration space, but most will need at least one
+virtqueue in which it will place requests. A device with both
+input and output (eg. console and network devices described here)
+need two queues: one which the driver fills with buffers to
+receive input, and one which the driver places buffers to
+transmit output.
+
+  What Configuration Space Layout?
+
+Configuration space is generally used for rarely-changing or
+initialization-time parameters. But it is a limited resource, so
+it might be better to use a virtqueue to update configuration
+information (the network device does this for filtering,
+otherwise the table in the config space could potentially be very
+large).
+
+Note that this space is generally the guest's native endian,
+rather than PCI's little-endian.
+
+  What Device Number?
+
+Currently device numbers are assigned quite freely: a simple
+request mail to the author of this document or the Linux
+virtualization mailing list[footnote:
+
+https://lists.linux-foundation.org/mailman/listinfo/virtualization
+] will be sufficient to secure a unique one.
+
+Meanwhile for experimental drivers, use 65535 and work backwards.
+
+  How many MSI-X vectors?
+
+Using the optional MSI-X capability devices can speed up
+interrupt processing by removing the need to read ISR Status
+register by guest driver (which might be an expensive operation),
+reducing interrupt sharing between devices and queues within the
+device, and handling interrupts from multiple CPUs. However, some
+systems impose a limit (which might be as low as 256) on the
+total number of MSI-X vectors that can be allocated to all
+devices. Devices and/or device drivers should take this into
+account, limiting the number of vectors used unless the device is
+expected to cause a high volume of interrupts. Devices can
+control the number of vectors used by limiting the MSI-X Table
+Size or not presenting MSI-X capability in PCI configuration
+space. Drivers can control this by mapping events to as small
+number of vectors as possible, or disabling MSI-X capability
+altogether.
+
+  Message Framing
+
+The descriptors used for a buffer should not effect the semantics
+of the message, except for the total length of the buffer. For
+example, a network buffer consists of a 10 byte header followed
+by the network packet. Whether this is presented in the ring
+descriptor chain as (say) a 10 byte buffer and a 1514 byte
+buffer, or a single 1524 byte buffer, or even three buffers,
+should have no effect.
+
+In particular, no implementation should use the descriptor
+boundaries to determine the size of any header in a request.[footnote:
+The current qemu device implementations mistakenly insist that
+the first descriptor cover the header in these cases exactly, so
+a cautious driver should arrange it so.
+]
+
+  Device Improvements
+
+Any change to configuration space, or new virtqueues, or
+behavioural changes, should be indicated by negotiation of a new
+feature bit. This establishes clarity[footnote:
+Even if it does mean documenting design or implementation
+mistakes!
+] and avoids future expansion problems.
+
+Clusters of functionality which are always implemented together
+can use a single bit, but if one feature makes sense without the
+others they should not be gratuitously grouped together to
+conserve feature bits. We can always extend the spec when the
+first person needs more than 24 feature bits for their device.
+
+[LaTeX Command: printnomenclature]
+
+Appendix A: virtio_ring.h
+
+#ifndef VIRTIO_RING_H
+
+#define VIRTIO_RING_H
+
+/* An interface for efficient virtio implementation.
+
+ *
+
+ * This header is BSD licensed so anyone can use the definitions
+
+ * to implement compatible drivers/servers.
+
+ *
+
+ * Copyright 2007, 2009, IBM Corporation
+
+ * Copyright 2011, Red Hat, Inc
+
+ * All rights reserved.
+
+ *
+
+ * Redistribution and use in source and binary forms, with or
+without
+
+ * modification, are permitted provided that the following
+conditions
+
+ * are met:
+
+ * 1. Redistributions of source code must retain the above
+copyright
+
+ *    notice, this list of conditions and the following
+disclaimer.
+
+ * 2. Redistributions in binary form must reproduce the above
+copyright
+
+ *    notice, this list of conditions and the following
+disclaimer in the
+
+ *    documentation and/or other materials provided with the
+distribution.
+
+ * 3. Neither the name of IBM nor the names of its contributors
+
+ *    may be used to endorse or promote products derived from
+this software
+
+ *    without specific prior written permission.
+
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+CONTRIBUTORS ``AS IS'' AND
+
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE
+
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE
+
+ * ARE DISCLAIMED.  IN NO EVENT SHALL IBM OR CONTRIBUTORS BE
+LIABLE
+
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL
+
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS
+
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION)
+
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT
+
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+IN ANY WAY
+
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF
+
+ * SUCH DAMAGE.
+
+ */
+
+
+
+/* This marks a buffer as continuing via the next field. */
+
+#define VRING_DESC_F_NEXT       1
+
+/* This marks a buffer as write-only (otherwise read-only). */
+
+#define VRING_DESC_F_WRITE      2
+
+
+
+/* The Host uses this in used->flags to advise the Guest: don't
+kick me
+
+ * when you add a buffer.  It's unreliable, so it's simply an
+
+ * optimization.  Guest will still kick if it's out of buffers.
+*/
+
+#define VRING_USED_F_NO_NOTIFY  1
+
+/* The Guest uses this in avail->flags to advise the Host: don't
+
+ * interrupt me when you consume a buffer.  It's unreliable, so
+it's
+
+ * simply an optimization.  */
+
+#define VRING_AVAIL_F_NO_INTERRUPT      1
+
+
+
+/* Virtio ring descriptors: 16 bytes.
+
+ * These can chain together via "next". */
+
+struct vring_desc {
+
+        /* Address (guest-physical). */
+
+        uint64_t addr;
+
+        /* Length. */
+
+        uint32_t len;
+
+        /* The flags as indicated above. */
+
+        uint16_t flags;
+
+        /* We chain unused descriptors via this, too */
+
+        uint16_t next;
+
+};
+
+
+
+struct vring_avail {
+
+        uint16_t flags;
+
+        uint16_t idx;
+
+        uint16_t ring[];
+
+        uint16_t used_event;
+
+};
+
+
+
+/* u32 is used here for ids for padding reasons. */
+
+struct vring_used_elem {
+
+        /* Index of start of used descriptor chain. */
+
+        uint32_t id;
+
+        /* Total length of the descriptor chain which was written
+to. */
+
+        uint32_t len;
+
+};
+
+
+
+struct vring_used {
+
+        uint16_t flags;
+
+        uint16_t idx;
+
+        struct vring_used_elem ring[];
+
+        uint16_t avail_event;
+
+};
+
+
+
+struct vring {
+
+        unsigned int num;
+
+
+
+        struct vring_desc *desc;
+
+        struct vring_avail *avail;
+
+        struct vring_used *used;
+
+};
+
+
+
+/* The standard layout for the ring is a continuous chunk of
+memory which
+
+ * looks like this.  We assume num is a power of 2.
+
+ *
+
+ * struct vring {
+
+ *      // The actual descriptors (16 bytes each)
+
+ *      struct vring_desc desc[num];
+
+ *
+
+ *      // A ring of available descriptor heads with free-running
+index.
+
+ *      __u16 avail_flags;
+
+ *      __u16 avail_idx;
+
+ *      __u16 available[num];
+
+ *
+
+ *      // Padding to the next align boundary.
+
+ *      char pad[];
+
+ *
+
+ *      // A ring of used descriptor heads with free-running
+index.
+
+ *      __u16 used_flags;
+
+ *      __u16 EVENT_IDX;
+
+ *      struct vring_used_elem used[num];
+
+ * };
+
+ * Note: for virtio PCI, align is 4096.
+
+ */
+
+static inline void vring_init(struct vring *vr, unsigned int num,
+void *p,
+
+                              unsigned long align)
+
+{
+
+        vr->num = num;
+
+        vr->desc = p;
+
+        vr->avail = p + num*sizeof(struct vring_desc);
+
+        vr->used = (void *)(((unsigned long)&vr->avail->ring[num]
+
+                              + align-1)
+
+                            & ~(align - 1));
+
+}
+
+
+
+static inline unsigned vring_size(unsigned int num, unsigned long
+align)
+
+{
+
+        return ((sizeof(struct vring_desc)*num +
+sizeof(uint16_t)*(2+num)
+
+                 + align - 1) & ~(align - 1))
+
+                + sizeof(uint16_t)*3 + sizeof(struct
+vring_used_elem)*num;
+
+}
+
+
+
+static inline int vring_need_event(uint16_t event_idx, uint16_t
+new_idx, uint16_t old_idx)
+
+{
+
+         return (uint16_t)(new_idx - event_idx - 1) <
+(uint16_t)(new_idx - old_idx);
+
+}
+
+#endif /* VIRTIO_RING_H */
+
+<cha:Reserved-Feature-Bits>Appendix B: Reserved Feature Bits
+
+Currently there are five device-independent feature bits defined:
+
+  VIRTIO_F_NOTIFY_ON_EMPTY (24) Negotiating this feature
+  indicates that the driver wants an interrupt if the device runs
+  out of available descriptors on a virtqueue, even though
+  interrupts are suppressed using the VRING_AVAIL_F_NO_INTERRUPT
+  flag or the used_event field. An example of this is the
+  networking driver: it doesn't need to know every time a packet
+  is transmitted, but it does need to free the transmitted
+  packets a finite time after they are transmitted. It can avoid
+  using a timer if the device interrupts it when all the packets
+  are transmitted.
+
+  VIRTIO_F_RING_INDIRECT_DESC (28) Negotiating this feature
+  indicates that the driver can use descriptors with the
+  VRING_DESC_F_INDIRECT flag set, as described in [sub:Indirect-Descriptors]
+  .
+
+  VIRTIO_F_RING_EVENT_IDX(29) This feature enables the used_event
+  and the avail_event fields. If set, it indicates that the
+  device should ignore the flags field in the available ring
+  structure. Instead, the used_event field in this structure is
+  used by guest to suppress device interrupts. Further, the
+  driver should ignore the flags field in the used ring
+  structure. Instead, the avail_event field in this structure is
+  used by the device to suppress notifications. If unset, the
+  driver should ignore the used_event field; the device should
+  ignore the avail_event field; the flags field is used
+
+  VIRTIO_F_BAD_FEATURE(30) This feature should never be
+  negotiated by the guest; doing so is an indication that the
+  guest is faulty[footnote:
+An experimental virtio PCI driver contained in Linux version
+2.6.25 had this problem, and this feature bit can be used to
+detect it.
+]
+
+  VIRTIO_F_FEATURES_HIGH(31) This feature indicates that the
+  device supports feature bits 32:63. If unset, feature bits
+  32:63 are unset.
+
+Appendix C: Network Device
+
+The virtio network device is a virtual ethernet card, and is the
+most complex of the devices supported so far by virtio. It has
+enhanced rapidly and demonstrates clearly how support for new
+features should be added to an existing device. Empty buffers are
+placed in one virtqueue for receiving packets, and outgoing
+packets are enqueued into another for transmission in that order.
+A third command queue is used to control advanced filtering
+features.
+
+  Configuration
+
+  Subsystem Device ID 1
+
+  Virtqueues 0:receiveq. 1:transmitq. 2:controlq[footnote:
+Only if VIRTIO_NET_F_CTRL_VQ set
+]
+
+  Feature bits
+
+  VIRTIO_NET_F_CSUM (0) Device handles packets with partial
+    checksum
+
+  VIRTIO_NET_F_GUEST_CSUM (1) Guest handles packets with partial
+    checksum
+
+  VIRTIO_NET_F_MAC (5) Device has given MAC address.
+
+  VIRTIO_NET_F_GSO (6) (Deprecated) device handles packets with
+    any GSO type.[footnote:
+It was supposed to indicate segmentation offload support, but
+upon further investigation it became clear that multiple bits
+were required.
+]
+
+  VIRTIO_NET_F_GUEST_TSO4 (7) Guest can receive TSOv4.
+
+  VIRTIO_NET_F_GUEST_TSO6 (8) Guest can receive TSOv6.
+
+  VIRTIO_NET_F_GUEST_ECN (9) Guest can receive TSO with ECN.
+
+  VIRTIO_NET_F_GUEST_UFO (10) Guest can receive UFO.
+
+  VIRTIO_NET_F_HOST_TSO4 (11) Device can receive TSOv4.
+
+  VIRTIO_NET_F_HOST_TSO6 (12) Device can receive TSOv6.
+
+  VIRTIO_NET_F_HOST_ECN (13) Device can receive TSO with ECN.
+
+  VIRTIO_NET_F_HOST_UFO (14) Device can receive UFO.
+
+  VIRTIO_NET_F_MRG_RXBUF (15) Guest can merge receive buffers.
+
+  VIRTIO_NET_F_STATUS (16) Configuration status field is
+    available.
+
+  VIRTIO_NET_F_CTRL_VQ (17) Control channel is available.
+
+  VIRTIO_NET_F_CTRL_RX (18) Control channel RX mode support.
+
+  VIRTIO_NET_F_CTRL_VLAN (19) Control channel VLAN filtering.
+
+  Device configuration layout Two configuration fields are
+  currently defined. The mac address field always exists (though
+  is only valid if VIRTIO_NET_F_MAC is set), and the status field
+  only exists if VIRTIO_NET_F_STATUS is set. Only one bit is
+  currently defined for the status field: VIRTIO_NET_S_LINK_UP. #define VIRTIO_NET_S_LINK_UP    1
+
+
+
+struct virtio_net_config {
+
+    u8 mac[6];
+
+    u16 status;
+
+};
+
+  Device Initialization
+
+  The initialization routine should identify the receive and
+  transmission virtqueues.
+
+  If the VIRTIO_NET_F_MAC feature bit is set, the configuration
+  space “mac” entry indicates the “physical” address of the the
+  network card, otherwise a private MAC address should be
+  assigned. All guests are expected to negotiate this feature if
+  it is set.
+
+  If the VIRTIO_NET_F_CTRL_VQ feature bit is negotiated, identify
+  the control virtqueue.
+
+  If the VIRTIO_NET_F_STATUS feature bit is negotiated, the link
+  status can be read from the bottom bit of the “status” config
+  field. Otherwise, the link should be assumed active.
+
+  The receive virtqueue should be filled with receive buffers.
+  This is described in detail below in “Setting Up Receive
+  Buffers”.
+
+  A driver can indicate that it will generate checksumless
+  packets by negotating the VIRTIO_NET_F_CSUM feature. This “
+  checksum offload” is a common feature on modern network cards.
+
+  If that feature is negotiated, a driver can use TCP or UDP
+  segmentation offload by negotiating the VIRTIO_NET_F_HOST_TSO4
+  (IPv4 TCP), VIRTIO_NET_F_HOST_TSO6 (IPv6 TCP) and
+  VIRTIO_NET_F_HOST_UFO (UDP fragmentation) features. It should
+  not send TCP packets requiring segmentation offload which have
+  the Explicit Congestion Notification bit set, unless the
+  VIRTIO_NET_F_HOST_ECN feature is negotiated.[footnote:
+This is a common restriction in real, older network cards.
+]
+
+  The converse features are also available: a driver can save the
+  virtual device some work by negotiating these features.[footnote:
+For example, a network packet transported between two guests on
+the same system may not require checksumming at all, nor
+segmentation, if both guests are amenable.
+] The VIRTIO_NET_F_GUEST_CSUM feature indicates that partially
+  checksummed packets can be received, and if it can do that then
+  the VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
+  VIRTIO_NET_F_GUEST_UFO and VIRTIO_NET_F_GUEST_ECN are the input
+  equivalents of the features described above. See “Receiving
+  Packets” below.
+
+  Device Operation
+
+Packets are transmitted by placing them in the transmitq, and
+buffers for incoming packets are placed in the receiveq. In each
+case, the packet itself is preceeded by a header:
+
+struct virtio_net_hdr {
+
+#define VIRTIO_NET_HDR_F_NEEDS_CSUM    1
+
+        u8 flags;
+
+#define VIRTIO_NET_HDR_GSO_NONE        0
+
+#define VIRTIO_NET_HDR_GSO_TCPV4       1
+
+#define VIRTIO_NET_HDR_GSO_UDP           3
+
+#define VIRTIO_NET_HDR_GSO_TCPV6       4
+
+#define VIRTIO_NET_HDR_GSO_ECN      0x80
+
+        u8 gso_type;
+
+        u16 hdr_len;
+
+        u16 gso_size;
+
+        u16 csum_start;
+
+        u16 csum_offset;
+
+/* Only if VIRTIO_NET_F_MRG_RXBUF: */
+
+        u16 num_buffers
+
+};
+
+The controlq is used to control device features such as
+filtering.
+
+  Packet Transmission
+
+Transmitting a single packet is simple, but varies depending on
+the different features the driver negotiated.
+
+  If the driver negotiated VIRTIO_NET_F_CSUM, and the packet has
+  not been fully checksummed, then the virtio_net_hdr's fields
+  are set as follows. Otherwise, the packet must be fully
+  checksummed, and flags is zero.
+
+  flags has the VIRTIO_NET_HDR_F_NEEDS_CSUM set,
+
+  <ite:csum_start-is-set>csum_start is set to the offset within
+    the packet to begin checksumming, and
+
+  csum_offset indicates how many bytes after the csum_start the
+    new (16 bit ones' complement) checksum should be placed.[footnote:
+For example, consider a partially checksummed TCP (IPv4) packet.
+It will have a 14 byte ethernet header and 20 byte IP header
+followed by the TCP header (with the TCP checksum field 16 bytes
+into that header). csum_start will be 14+20 = 34 (the TCP
+checksum includes the header), and csum_offset will be 16. The
+value in the TCP checksum field will be the sum of the TCP pseudo
+header, so that replacing it by the ones' complement checksum of
+the TCP header and body will give the correct result.
+]
+
+  <enu:If-the-driver>If the driver negotiated
+  VIRTIO_NET_F_HOST_TSO4, TSO6 or UFO, and the packet requires
+  TCP segmentation or UDP fragmentation, then the “gso_type”
+  field is set to VIRTIO_NET_HDR_GSO_TCPV4, TCPV6 or UDP.
+  (Otherwise, it is set to VIRTIO_NET_HDR_GSO_NONE). In this
+  case, packets larger than 1514 bytes can be transmitted: the
+  metadata indicates how to replicate the packet header to cut it
+  into smaller packets. The other gso fields are set:
+
+  hdr_len is a hint to the device as to how much of the header
+    needs to be kept to copy into each packet, usually set to the
+    length of the headers, including the transport header.[footnote:
+Due to various bugs in implementations, this field is not useful
+as a guarantee of the transport header size.
+]
+
+  gso_size is the size of the packet beyond that header (ie.
+    MSS).
+
+  If the driver negotiated the VIRTIO_NET_F_HOST_ECN feature, the
+    VIRTIO_NET_HDR_GSO_ECN bit may be set in “gso_type” as well,
+    indicating that the TCP packet has the ECN bit set.[footnote:
+This case is not handled by some older hardware, so is called out
+specifically in the protocol.
+]
+
+  If the driver negotiated the VIRTIO_NET_F_MRG_RXBUF feature,
+  the num_buffers field is set to zero.
+
+  The header and packet are added as one output buffer to the
+  transmitq, and the device is notified of the new entry (see [sub:Notifying-The-Device]
+  ).[footnote:
+Note that the header will be two bytes longer for the
+VIRTIO_NET_F_MRG_RXBUF case.
+]
+
+  Packet Transmission Interrupt
+
+Often a driver will suppress transmission interrupts using the
+VRING_AVAIL_F_NO_INTERRUPT flag (see [sub:Receiving-Used-Buffers]
+) and check for used packets in the transmit path of following
+packets. However, it will still receive interrupts if the
+VIRTIO_F_NOTIFY_ON_EMPTY feature is negotiated, indicating that
+the transmission queue is completely emptied.
+
+The normal behavior in this interrupt handler is to retrieve and
+new descriptors from the used ring and free the corresponding
+headers and packets.
+
+  Setting Up Receive Buffers
+
+It is generally a good idea to keep the receive virtqueue as
+fully populated as possible: if it runs out, network performance
+will suffer.
+
+If the VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6 or
+VIRTIO_NET_F_GUEST_UFO features are used, the Guest will need to
+accept packets of up to 65550 bytes long (the maximum size of a
+TCP or UDP packet, plus the 14 byte ethernet header), otherwise
+1514 bytes. So unless VIRTIO_NET_F_MRG_RXBUF is negotiated, every
+buffer in the receive queue needs to be at least this length [footnote:
+Obviously each one can be split across multiple descriptor
+elements.
+].
+
+If VIRTIO_NET_F_MRG_RXBUF is negotiated, each buffer must be at
+least the size of the struct virtio_net_hdr.
+
+  Packet Receive Interrupt
+
+When a packet is copied into a buffer in the receiveq, the
+optimal path is to disable further interrupts for the receiveq
+(see [sub:Receiving-Used-Buffers]) and process packets until no
+more are found, then re-enable them.
+
+Processing packet involves:
+
+  If the driver negotiated the VIRTIO_NET_F_MRG_RXBUF feature,
+  then the “num_buffers” field indicates how many descriptors
+  this packet is spread over (including this one). This allows
+  receipt of large packets without having to allocate large
+  buffers. In this case, there will be at least “num_buffers” in
+  the used ring, and they should be chained together to form a
+  single packet. The other buffers will not begin with a struct
+  virtio_net_hdr.
+
+  If the VIRTIO_NET_F_MRG_RXBUF feature was not negotiated, or
+  the “num_buffers” field is one, then the entire packet will be
+  contained within this buffer, immediately following the struct
+  virtio_net_hdr.
+
+  If the VIRTIO_NET_F_GUEST_CSUM feature was negotiated, the
+  VIRTIO_NET_HDR_F_NEEDS_CSUM bit in the “flags” field may be
+  set: if so, the checksum on the packet is incomplete and the “
+  csum_start” and “csum_offset” fields indicate how to calculate
+  it (see [ite:csum_start-is-set]).
+
+  If the VIRTIO_NET_F_GUEST_TSO4, TSO6 or UFO options were
+  negotiated, then the “gso_type” may be something other than
+  VIRTIO_NET_HDR_GSO_NONE, and the “gso_size” field indicates the
+  desired MSS (see [enu:If-the-driver]).Control Virtqueue
+
+The driver uses the control virtqueue (if VIRTIO_NET_F_VTRL_VQ is
+negotiated) to send commands to manipulate various features of
+the device which would not easily map into the configuration
+space.
+
+All commands are of the following form:
+
+struct virtio_net_ctrl {
+
+        u8 class;
+
+        u8 command;
+
+        u8 command-specific-data[];
+
+        u8 ack;
+
+};
+
+
+
+/* ack values */
+
+#define VIRTIO_NET_OK     0
+
+#define VIRTIO_NET_ERR    1
+
+The class, command and command-specific-data are set by the
+driver, and the device sets the ack byte. There is little it can
+do except issue a diagnostic if the ack byte is not
+VIRTIO_NET_OK.
+
+  Packet Receive Filtering
+
+If the VIRTIO_NET_F_CTRL_RX feature is negotiated, the driver can
+send control commands for promiscuous mode, multicast receiving,
+and filtering of MAC addresses.
+
+Note that in general, these commands are best-effort: unwanted
+packets may still arrive.
+
+  Setting Promiscuous Mode
+
+#define VIRTIO_NET_CTRL_RX    0
+
+ #define VIRTIO_NET_CTRL_RX_PROMISC      0
+
+ #define VIRTIO_NET_CTRL_RX_ALLMULTI     1
+
+The class VIRTIO_NET_CTRL_RX has two commands:
+VIRTIO_NET_CTRL_RX_PROMISC turns promiscuous mode on and off, and
+VIRTIO_NET_CTRL_RX_ALLMULTI turns all-multicast receive on and
+off. The command-specific-data is one byte containing 0 (off) or
+1 (on).
+
+  Setting MAC Address Filtering
+
+struct virtio_net_ctrl_mac {
+
+        u32 entries;
+
+        u8 macs[entries][ETH_ALEN];
+
+};
+
+
+
+#define VIRTIO_NET_CTRL_MAC    1
+
+ #define VIRTIO_NET_CTRL_MAC_TABLE_SET        0
+
+The device can filter incoming packets by any number of
+destination MAC addresses.[footnote:
+Since there are no guarentees, it can use a hash filter
+orsilently switch to allmulti or promiscuous mode if it is given
+too many addresses.
+] This table is set using the class VIRTIO_NET_CTRL_MAC and the
+command VIRTIO_NET_CTRL_MAC_TABLE_SET. The command-specific-data
+is two variable length tables of 6-byte MAC addresses. The first
+table contains unicast addresses, and the second contains
+multicast addresses.
+
+  VLAN Filtering
+
+If the driver negotiates the VIRTION_NET_F_CTRL_VLAN feature, it
+can control a VLAN filter table in the device.
+
+#define VIRTIO_NET_CTRL_VLAN       2
+
+ #define VIRTIO_NET_CTRL_VLAN_ADD             0
+
+ #define VIRTIO_NET_CTRL_VLAN_DEL             1
+
+Both the VIRTIO_NET_CTRL_VLAN_ADD and VIRTIO_NET_CTRL_VLAN_DEL
+command take a 16-bit VLAN id as the command-specific-data.
+
+Appendix D: Block Device
+
+The virtio block device is a simple virtual block device (ie.
+disk). Read and write requests (and other exotic requests) are
+placed in the queue, and serviced (probably out of order) by the
+device except where noted.
+
+  Configuration
+
+  Subsystem Device ID 2
+
+  Virtqueues 0:requestq.
+
+  Feature bits
+
+  VIRTIO_BLK_F_BARRIER (0) Host supports request barriers.
+
+  VIRTIO_BLK_F_SIZE_MAX (1) Maximum size of any single segment is
+    in “size_max”.
+
+  VIRTIO_BLK_F_SEG_MAX (2) Maximum number of segments in a
+    request is in “seg_max”.
+
+  VIRTIO_BLK_F_GEOMETRY (4) Disk-style geometry specified in “
+    geometry”.
+
+  VIRTIO_BLK_F_RO (5) Device is read-only.
+
+  VIRTIO_BLK_F_BLK_SIZE (6) Block size of disk is in “blk_size”.
+
+  VIRTIO_BLK_F_SCSI (7) Device supports scsi packet commands.
+
+  VIRTIO_BLK_F_FLUSH (9) Cache flush command support.
+
+
+
+  Device configuration layout The capacity of the device
+  (expressed in 512-byte sectors) is always present. The
+  availability of the others all depend on various feature bits
+  as indicated above. struct virtio_blk_config {
+
+        u64 capacity;
+
+        u32 size_max;
+
+        u32 seg_max;
+
+        struct virtio_blk_geometry {
+
+                u16 cylinders;
+
+                u8 heads;
+
+                u8 sectors;
+
+        } geometry;
+
+        u32 blk_size;
+
+
+
+};
+
+  Device Initialization
+
+  The device size should be read from the “capacity”
+  configuration field. No requests should be submitted which goes
+  beyond this limit.
+
+  If the VIRTIO_BLK_F_BLK_SIZE feature is negotiated, the
+  blk_size field can be read to determine the optimal sector size
+  for the driver to use. This does not effect the units used in
+  the protocol (always 512 bytes), but awareness of the correct
+  value can effect performance.
+
+  If the VIRTIO_BLK_F_RO feature is set by the device, any write
+  requests will fail.
+
+
+
+  Device Operation
+
+The driver queues requests to the virtqueue, and they are used by
+the device (not necessarily in order). Each request is of form:
+
+struct virtio_blk_req {
+
+
+
+        u32 type;
+
+        u32 ioprio;
+
+        u64 sector;
+
+        char data[][512];
+
+        u8 status;
+
+};
+
+If the device has VIRTIO_BLK_F_SCSI feature, it can also support
+scsi packet command requests, each of these requests is of form:struct virtio_scsi_pc_req {
+
+        u32 type;
+
+        u32 ioprio;
+
+        u64 sector;
+
+    char cmd[];
+
+        char data[][512];
+
+#define SCSI_SENSE_BUFFERSIZE   96
+
+    u8 sense[SCSI_SENSE_BUFFERSIZE];
+
+    u32 errors;
+
+    u32 data_len;
+
+    u32 sense_len;
+
+    u32 residual;
+
+        u8 status;
+
+};
+
+The type of the request is either a read (VIRTIO_BLK_T_IN), a
+write (VIRTIO_BLK_T_OUT), a scsi packet command
+(VIRTIO_BLK_T_SCSI_CMD or VIRTIO_BLK_T_SCSI_CMD_OUT[footnote:
+the SCSI_CMD and SCSI_CMD_OUT types are equivalent, the device
+does not distinguish between them
+]) or a flush (VIRTIO_BLK_T_FLUSH or VIRTIO_BLK_T_FLUSH_OUT[footnote:
+the FLUSH and FLUSH_OUT types are equivalent, the device does not
+distinguish between them
+]). If the device has VIRTIO_BLK_F_BARRIER feature the high bit
+(VIRTIO_BLK_T_BARRIER) indicates that this request acts as a
+barrier and that all preceeding requests must be complete before
+this one, and all following requests must not be started until
+this is complete. Note that a barrier does not flush caches in
+the underlying backend device in host, and thus does not serve as
+data consistency guarantee. Driver must use FLUSH request to
+flush the host cache.
+
+#define VIRTIO_BLK_T_IN           0
+
+#define VIRTIO_BLK_T_OUT          1
+
+#define VIRTIO_BLK_T_SCSI_CMD     2
+
+#define VIRTIO_BLK_T_SCSI_CMD_OUT 3
+
+#define VIRTIO_BLK_T_FLUSH        4
+
+#define VIRTIO_BLK_T_FLUSH_OUT    5
+
+#define VIRTIO_BLK_T_BARRIER     0x80000000
+
+The ioprio field is a hint about the relative priorities of
+requests to the device: higher numbers indicate more important
+requests.
+
+The sector number indicates the offset (multiplied by 512) where
+the read or write is to occur. This field is unused and set to 0
+for scsi packet commands and for flush commands.
+
+The cmd field is only present for scsi packet command requests,
+and indicates the command to perform. This field must reside in a
+single, separate read-only buffer; command length can be derived
+from the length of this buffer.
+
+Note that these first three (four for scsi packet commands)
+fields are always read-only: the data field is either read-only
+or write-only, depending on the request. The size of the read or
+write can be derived from the total size of the request buffers.
+
+The sense field is only present for scsi packet command requests,
+and indicates the buffer for scsi sense data.
+
+The data_len field is only present for scsi packet command
+requests, this field is deprecated, and should be ignored by the
+driver. Historically, devices copied data length there.
+
+The sense_len field is only present for scsi packet command
+requests and indicates the number of bytes actually written to
+the sense buffer.
+
+The residual field is only present for scsi packet command
+requests and indicates the residual size, calculated as data
+length - number of bytes actually transferred.
+
+The final status byte is written by the device: either
+VIRTIO_BLK_S_OK for success, VIRTIO_BLK_S_IOERR for host or guest
+error or VIRTIO_BLK_S_UNSUPP for a request unsupported by host:#define VIRTIO_BLK_S_OK        0
+
+#define VIRTIO_BLK_S_IOERR     1
+
+#define VIRTIO_BLK_S_UNSUPP    2
+
+Historically, devices assumed that the fields type, ioprio and
+sector reside in a single, separate read-only buffer; the fields
+errors, data_len, sense_len and residual reside in a single,
+separate write-only buffer; the sense field in a separate
+write-only buffer of size 96 bytes, by itself; the fields errors,
+data_len, sense_len and residual in a single write-only buffer;
+and the status field is a separate read-only buffer of size 1
+byte, by itself.
+
+Appendix E: Console Device
+
+The virtio console device is a simple device for data input and
+output. A device may have one or more ports. Each port has a pair
+of input and output virtqueues. Moreover, a device has a pair of
+control IO virtqueues. The control virtqueues are used to
+communicate information between the device and the driver about
+ports being opened and closed on either side of the connection,
+indication from the host about whether a particular port is a
+console port, adding new ports, port hot-plug/unplug, etc., and
+indication from the guest about whether a port or a device was
+successfully added, port open/close, etc.. For data IO, one or
+more empty buffers are placed in the receive queue for incoming
+data and outgoing characters are placed in the transmit queue.
+
+  Configuration
+
+  Subsystem Device ID 3
+
+  Virtqueues 0:receiveq(port0). 1:transmitq(port0), 2:control
+  receiveq[footnote:
+Ports 2 onwards only if VIRTIO_CONSOLE_F_MULTIPORT is set
+], 3:control transmitq, 4:receiveq(port1), 5:transmitq(port1),
+  ...
+
+  Feature bits
+
+  VIRTIO_CONSOLE_F_SIZE (0) Configuration cols and rows fields
+    are valid.
+
+  VIRTIO_CONSOLE_F_MULTIPORT(1) Device has support for multiple
+    ports; configuration fields nr_ports and max_nr_ports are
+    valid and control virtqueues will be used.
+
+  Device configuration layout The size of the console is supplied
+  in the configuration space if the VIRTIO_CONSOLE_F_SIZE feature
+  is set. Furthermore, if the VIRTIO_CONSOLE_F_MULTIPORT feature
+  is set, the maximum number of ports supported by the device can
+  be fetched.struct virtio_console_config {
+
+        u16 cols;
+
+        u16 rows;
+
+
+
+        u32 max_nr_ports;
+
+};
+
+  Device Initialization
+
+  If the VIRTIO_CONSOLE_F_SIZE feature is negotiated, the driver
+  can read the console dimensions from the configuration fields.
+
+  If the VIRTIO_CONSOLE_F_MULTIPORT feature is negotiated, the
+  driver can spawn multiple ports, not all of which may be
+  attached to a console. Some could be generic ports. In this
+  case, the control virtqueues are enabled and according to the
+  max_nr_ports configuration-space value, the appropriate number
+  of virtqueues are created. A control message indicating the
+  driver is ready is sent to the host. The host can then send
+  control messages for adding new ports to the device. After
+  creating and initializing each port, a
+  VIRTIO_CONSOLE_PORT_READY control message is sent to the host
+  for that port so the host can let us know of any additional
+  configuration options set for that port.
+
+  The receiveq for each port is populated with one or more
+  receive buffers.
+
+  Device Operation
+
+  For output, a buffer containing the characters is placed in the
+  port's transmitq.[footnote:
+Because this is high importance and low bandwidth, the current
+Linux implementation polls for the buffer to be used, rather than
+waiting for an interrupt, simplifying the implementation
+significantly. However, for generic serial ports with the
+O_NONBLOCK flag set, the polling limitation is relaxed and the
+consumed buffers are freed upon the next write or poll call or
+when a port is closed or hot-unplugged.
+]
+
+  When a buffer is used in the receiveq (signalled by an
+  interrupt), the contents is the input to the port associated
+  with the virtqueue for which the notification was received.
+
+  If the driver negotiated the VIRTIO_CONSOLE_F_SIZE feature, a
+  configuration change interrupt may occur. The updated size can
+  be read from the configuration fields.
+
+  If the driver negotiated the VIRTIO_CONSOLE_F_MULTIPORT
+  feature, active ports are announced by the host using the
+  VIRTIO_CONSOLE_PORT_ADD control message. The same message is
+  used for port hot-plug as well.
+
+  If the host specified a port `name', a sysfs attribute is
+  created with the name filled in, so that udev rules can be
+  written that can create a symlink from the port's name to the
+  char device for port discovery by applications in the guest.
+
+  Changes to ports' state are effected by control messages.
+  Appropriate action is taken on the port indicated in the
+  control message. The layout of the structure of the control
+  buffer and the events associated are:struct virtio_console_control {
+
+        uint32_t id;    /* Port number */
+
+        uint16_t event; /* The kind of control event */
+
+        uint16_t value; /* Extra information for the event */
+
+};
+
+
+
+/* Some events for the internal messages (control packets) */
+
+
+
+#define VIRTIO_CONSOLE_DEVICE_READY     0
+
+#define VIRTIO_CONSOLE_PORT_ADD         1
+
+#define VIRTIO_CONSOLE_PORT_REMOVE      2
+
+#define VIRTIO_CONSOLE_PORT_READY       3
+
+#define VIRTIO_CONSOLE_CONSOLE_PORT     4
+
+#define VIRTIO_CONSOLE_RESIZE           5
+
+#define VIRTIO_CONSOLE_PORT_OPEN        6
+
+#define VIRTIO_CONSOLE_PORT_NAME        7
+
+Appendix F: Entropy Device
+
+The virtio entropy device supplies high-quality randomness for
+guest use.
+
+  Configuration
+
+  Subsystem Device ID 4
+
+  Virtqueues 0:requestq.
+
+  Feature bits None currently defined
+
+  Device configuration layout None currently defined.
+
+  Device Initialization
+
+  The virtqueue is initialized
+
+  Device Operation
+
+When the driver requires random bytes, it places the descriptor
+of one or more buffers in the queue. It will be completely filled
+by random data by the device.
+
+Appendix G: Memory Balloon Device
+
+The virtio memory balloon device is a primitive device for
+managing guest memory: the device asks for a certain amount of
+memory, and the guest supplies it (or withdraws it, if the device
+has more than it asks for). This allows the guest to adapt to
+changes in allowance of underlying physical memory. If the
+feature is negotiated, the device can also be used to communicate
+guest memory statistics to the host.
+
+  Configuration
+
+  Subsystem Device ID 5
+
+  Virtqueues 0:inflateq. 1:deflateq. 2:statsq.[footnote:
+Only if VIRTIO_BALLON_F_STATS_VQ set
+]
+
+  Feature bits
+
+  VIRTIO_BALLOON_F_MUST_TELL_HOST (0) Host must be told before
+    pages from the balloon are used.
+
+  VIRTIO_BALLOON_F_STATS_VQ (1) A virtqueue for reporting guest
+    memory statistics is present.
+
+  Device configuration layout Both fields of this configuration
+  are always available. Note that they are little endian, despite
+  convention that device fields are guest endian:struct virtio_balloon_config {
+
+        u32 num_pages;
+
+        u32 actual;
+
+};
+
+  Device Initialization
+
+  The inflate and deflate virtqueues are identified.
+
+  If the VIRTIO_BALLOON_F_STATS_VQ feature bit is negotiated:
+
+  Identify the stats virtqueue.
+
+  Add one empty buffer to the stats virtqueue and notify the
+    host.
+
+Device operation begins immediately.
+
+  Device Operation
+
+  Memory Ballooning The device is driven by the receipt of a
+  configuration change interrupt.
+
+  The “num_pages” configuration field is examined. If this is
+  greater than the “actual” number of pages, memory must be given
+  to the balloon. If it is less than the “actual” number of
+  pages, memory may be taken back from the balloon for general
+  use.
+
+  To supply memory to the balloon (aka. inflate):
+
+  The driver constructs an array of addresses of unused memory
+    pages. These addresses are divided by 4096[footnote:
+This is historical, and independent of the guest page size
+] and the descriptor describing the resulting 32-bit array is
+    added to the inflateq.
+
+  To remove memory from the balloon (aka. deflate):
+
+  The driver constructs an array of addresses of memory pages it
+    has previously given to the balloon, as described above. This
+    descriptor is added to the deflateq.
+
+  If the VIRTIO_BALLOON_F_MUST_TELL_HOST feature is set, the
+    guest may not use these requested pages until that descriptor
+    in the deflateq has been used by the device.
+
+  Otherwise, the guest may begin to re-use pages previously given
+    to the balloon before the device has acknowledged their
+    withdrawl. [footnote:
+In this case, deflation advice is merely a courtesy
+]
+
+  In either case, once the device has completed the inflation or
+  deflation, the “actual” field of the configuration should be
+  updated to reflect the new number of pages in the balloon.[footnote:
+As updates to configuration space are not atomic, this field
+isn't particularly reliable, but can be used to diagnose buggy
+guests.
+]
+
+  Memory Statistics
+
+The stats virtqueue is atypical because communication is driven
+by the device (not the driver). The channel becomes active at
+driver initialization time when the driver adds an empty buffer
+and notifies the device. A request for memory statistics proceeds
+as follows:
+
+  The device pushes the buffer onto the used ring and sends an
+  interrupt.
+
+  The driver pops the used buffer and discards it.
+
+  The driver collects memory statistics and writes them into a
+  new buffer.
+
+  The driver adds the buffer to the virtqueue and notifies the
+  device.
+
+  The device pops the buffer (retaining it to initiate a
+  subsequent request) and consumes the statistics.
+
+  Memory Statistics Format Each statistic consists of a 16 bit
+  tag and a 64 bit value. Both quantities are represented in the
+  native endian of the guest. All statistics are optional and the
+  driver may choose which ones to supply. To guarantee backwards
+  compatibility, unsupported statistics should be omitted.
+
+  struct virtio_balloon_stat {
+
+#define VIRTIO_BALLOON_S_SWAP_IN  0
+
+#define VIRTIO_BALLOON_S_SWAP_OUT 1
+
+#define VIRTIO_BALLOON_S_MAJFLT   2
+
+#define VIRTIO_BALLOON_S_MINFLT   3
+
+#define VIRTIO_BALLOON_S_MEMFREE  4
+
+#define VIRTIO_BALLOON_S_MEMTOT   5
+
+        u16 tag;
+
+        u64 val;
+
+} __attribute__((packed));
+
+  Tags
+
+  VIRTIO_BALLOON_S_SWAP_IN The amount of memory that has been
+  swapped in (in bytes).
+
+  VIRTIO_BALLOON_S_SWAP_OUT The amount of memory that has been
+  swapped out to disk (in bytes).
+
+  VIRTIO_BALLOON_S_MAJFLT The number of major page faults that
+  have occurred.
+
+  VIRTIO_BALLOON_S_MINFLT The number of minor page faults that
+  have occurred.
+
+  VIRTIO_BALLOON_S_MEMFREE The amount of memory not being used
+  for any purpose (in bytes).
+
+  VIRTIO_BALLOON_S_MEMTOT The total amount of memory available
+  (in bytes).
+
diff --git a/MAINTAINERS b/MAINTAINERS
index 46e3e6b99220..1d445f572987 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3905,9 +3905,9 @@ F:	arch/powerpc/platforms/powermac/
 F:      drivers/macintosh/
 
 LINUX FOR POWERPC EMBEDDED MPC5XXX
-M:      Grant Likely <grant.likely@secretlab.ca>
+M:      Anatolij Gustschin <agust@denx.de>
 L:      linuxppc-dev@lists.ozlabs.org
-T:      git git://git.secretlab.ca/git/linux-2.6.git
+T:      git git://git.denx.de/linux-2.6-agust.git
 S:      Maintained
 F:      arch/powerpc/platforms/512x/
 F:      arch/powerpc/platforms/52xx/
@@ -7357,7 +7357,7 @@ THE REST
 M:      Linus Torvalds <torvalds@linux-foundation.org>
 L:      linux-kernel@vger.kernel.org
 Q:      http://patchwork.kernel.org/project/LKML/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
 S:      Buried alive in reporters
 F:      *
 F:      */
diff --git a/Makefile b/Makefile
index b4ca4e111c9a..3241d41dfbff 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
-NAME = Sneaky Weasel
+EXTRAVERSION = -rc2
+NAME = Wet Seal
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 2c71a8f3535a..5ebc5d922ea1 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -195,8 +195,7 @@ config VECTORS_BASE
           The base address of exception vectors.
 
 config ARM_PATCH_PHYS_VIRT
-        bool "Patch physical to virtual translations at runtime (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        bool "Patch physical to virtual translations at runtime"
         depends on !XIP_KERNEL && MMU
         depends on !ARCH_REALVIEW || !SPARSEMEM
         help
diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S
index 7fa3bb0d2397..a08783823b32 100644
--- a/arch/arm/kernel/iwmmxt.S
+++ b/arch/arm/kernel/iwmmxt.S
@@ -195,10 +195,10 @@ ENTRY(iwmmxt_task_disable)
 
         @ enable access to CP0 and CP1
         XSC(mrc p15, 0, r4, c15, c1, 0)
-        XSC(orr r4, r4, #0xf)
+        XSC(orr r4, r4, #0x3)
         XSC(mcr p15, 0, r4, c15, c1, 0)
         PJ4(mrc p15, 0, r4, c1, c0, 2)
-        PJ4(orr r4, r4, #0x3)
+        PJ4(orr r4, r4, #0xf)
         PJ4(mcr p15, 0, r4, c1, c0, 2)
 
         mov     r0, #0                          @ nothing to load
@@ -313,7 +313,7 @@ ENTRY(iwmmxt_task_switch)
         teq     r2, r3                          @ next task owns it?
         movne   pc, lr                          @ no: leave Concan disabled
 
-1:      @ flip Conan access
+1:      @ flip Concan access
         XSC(eor r1, r1, #0x3)
         XSC(mcr p15, 0, r1, c15, c1, 0)
         PJ4(eor r1, r1, #0xf)
diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
index 05b377616fd5..cc2020c2c709 100644
--- a/arch/arm/kernel/module.c
+++ b/arch/arm/kernel/module.c
@@ -323,7 +323,11 @@ int module_finalize(const Elf32_Ehdr *hdr, const Elf_Shdr *sechdrs,
 #endif
         s = find_mod_section(hdr, sechdrs, ".alt.smp.init");
         if (s && !is_smp())
+#ifdef CONFIG_SMP_ON_UP
                 fixup_smp((void *)s->sh_addr, s->sh_size);
+#else
+                return -EINVAL;
+#endif
         return 0;
 }
 
diff --git a/arch/arm/mach-imx/clock-imx25.c b/arch/arm/mach-imx/clock-imx25.c
index 0fc7ba56d616..e63e23504fe5 100644
--- a/arch/arm/mach-imx/clock-imx25.c
+++ b/arch/arm/mach-imx/clock-imx25.c
@@ -331,6 +331,9 @@ int __init mx25_clocks_init(void)
         __raw_writel(__raw_readl(CRM_BASE+0x64) | (1 << 7) | (1 << 0),
                         CRM_BASE + 0x64);
 
+        /* Clock source for gpt is ahb_div */
+        __raw_writel(__raw_readl(CRM_BASE+0x64) & ~(1 << 5), CRM_BASE + 0x64);
+
         mxc_timer_init(&gpt_clk, MX25_IO_ADDRESS(MX25_GPT1_BASE_ADDR), 54);
 
         return 0;
diff --git a/arch/arm/mach-imx/mach-imx27_visstrim_m10.c b/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
index 6707de0ab716..6778f8193bc6 100644
--- a/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
+++ b/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
@@ -30,6 +30,7 @@
 #include <linux/input.h>
 #include <linux/gpio.h>
 #include <linux/delay.h>
+#include <sound/tlv320aic32x4.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/time.h>
@@ -196,6 +197,17 @@ static struct pca953x_platform_data visstrim_m10_pca9555_pdata = {
         .invert = 0,
 };
 
+static struct aic32x4_pdata visstrim_m10_aic32x4_pdata = {
+        .power_cfg = AIC32X4_PWR_MICBIAS_2075_LDOIN |
+                     AIC32X4_PWR_AVDD_DVDD_WEAK_DISABLE |
+                     AIC32X4_PWR_AIC32X4_LDO_ENABLE |
+                     AIC32X4_PWR_CMMODE_LDOIN_RANGE_18_36 |
+                     AIC32X4_PWR_CMMODE_HP_LDOIN_POWERED,
+        .micpga_routing = AIC32X4_MICPGA_ROUTE_LMIC_IN2R_10K |
+                         AIC32X4_MICPGA_ROUTE_RMIC_IN1L_10K,
+        .swapdacs = false,
+};
+
 static struct i2c_board_info visstrim_m10_i2c_devices[] = {
         {
                 I2C_BOARD_INFO("pca9555", 0x20),
@@ -203,6 +215,7 @@ static struct i2c_board_info visstrim_m10_i2c_devices[] = {
         },
         {
                 I2C_BOARD_INFO("tlv320aic32x4", 0x18),
+                .platform_data = &visstrim_m10_aic32x4_pdata,
         }
 };
 
diff --git a/arch/arm/mach-imx/mach-mx31ads.c b/arch/arm/mach-imx/mach-mx31ads.c
index 0ce49478a479..29ca8907a780 100644
--- a/arch/arm/mach-imx/mach-mx31ads.c
+++ b/arch/arm/mach-imx/mach-mx31ads.c
@@ -468,7 +468,7 @@ static struct i2c_board_info __initdata mx31ads_i2c1_devices[] = {
 #endif
 };
 
-static void mxc_init_i2c(void)
+static void __init mxc_init_i2c(void)
 {
         i2c_register_board_info(1, mx31ads_i2c1_devices,
                                 ARRAY_SIZE(mx31ads_i2c1_devices));
@@ -486,7 +486,7 @@ static unsigned int ssi_pins[] = {
         MX31_PIN_STXD5__STXD5,
 };
 
-static void mxc_init_audio(void)
+static void __init mxc_init_audio(void)
 {
         imx31_add_imx_ssi(0, NULL);
         mxc_iomux_setup_multiple_pins(ssi_pins, ARRAY_SIZE(ssi_pins), "ssi");
diff --git a/arch/arm/mach-imx/mach-mx31lilly.c b/arch/arm/mach-imx/mach-mx31lilly.c
index 750368ddf0f9..126913ad106a 100644
--- a/arch/arm/mach-imx/mach-mx31lilly.c
+++ b/arch/arm/mach-imx/mach-mx31lilly.c
@@ -192,7 +192,7 @@ static struct mxc_usbh_platform_data usbh2_pdata __initdata = {
         .portsc = MXC_EHCI_MODE_ULPI | MXC_EHCI_UTMI_8BIT,
 };
 
-static void lilly1131_usb_init(void)
+static void __init lilly1131_usb_init(void)
 {
         imx31_add_mxc_ehci_hs(1, &usbh1_pdata);
 
diff --git a/arch/arm/mach-mmp/gplugd.c b/arch/arm/mach-mmp/gplugd.c
index c070c24255f4..98e25d9aaab6 100644
--- a/arch/arm/mach-mmp/gplugd.c
+++ b/arch/arm/mach-mmp/gplugd.c
@@ -16,16 +16,18 @@
 #include <mach/gpio.h>
 #include <mach/pxa168.h>
 #include <mach/mfp-pxa168.h>
-#include <mach/mfp-gplugd.h>
 
 #include "common.h"
 
 static unsigned long gplugd_pin_config[] __initdata = {
         /* UART3 */
-        GPIO8_UART3_SOUT,
-        GPIO9_UART3_SIN,
-        GPI1O_UART3_CTS,
-        GPI11_UART3_RTS,
+        GPIO8_UART3_TXD,
+        GPIO9_UART3_RXD,
+        GPIO1O_UART3_CTS,
+        GPIO11_UART3_RTS,
+
+        /* USB OTG PEN */
+        GPIO18_GPIO,
 
         /* MMC2 */
         GPIO28_MMC2_CMD,
@@ -109,6 +111,12 @@ static unsigned long gplugd_pin_config[] __initdata = {
         GPIO105_CI2C_SDA,
         GPIO106_CI2C_SCL,
 
+        /* SPI NOR Flash on SSP2 */
+        GPIO107_SSP2_RXD,
+        GPIO108_SSP2_TXD,
+        GPIO110_GPIO,     /* SPI_CSn */
+        GPIO111_SSP2_CLK,
+
         /* Select JTAG */
         GPIO109_GPIO,
 
@@ -154,7 +162,7 @@ static void __init select_disp_freq(void)
                                 "frequency\n");
         } else {
                 gpio_direction_output(35, 1);
-                gpio_free(104);
+                gpio_free(35);
         }
 
         if (unlikely(gpio_request(85, "DISP_FREQ_SEL_2"))) {
@@ -162,7 +170,7 @@ static void __init select_disp_freq(void)
                                 "frequency\n");
         } else {
                 gpio_direction_output(85, 0);
-                gpio_free(104);
+                gpio_free(85);
         }
 }
 
diff --git a/arch/arm/mach-mmp/include/mach/mfp-gplugd.h b/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
deleted file mode 100644
index b8cf38d85600..000000000000
--- a/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * linux/arch/arm/mach-mmp/include/mach/mfp-gplugd.h
- *
- *   MFP definitions used in gplugD
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef __MACH_MFP_GPLUGD_H
-#define __MACH_MFP_GPLUGD_H
-
-#include <plat/mfp.h>
-#include <mach/mfp.h>
-
-/* UART3 */
-#define GPIO8_UART3_SOUT       MFP_CFG(GPIO8, AF2)
-#define GPIO9_UART3_SIN        MFP_CFG(GPIO9, AF2)
-#define GPI1O_UART3_CTS        MFP_CFG(GPIO10, AF2)
-#define GPI11_UART3_RTS        MFP_CFG(GPIO11, AF2)
-
-/* MMC2 */
-#define GPIO28_MMC2_CMD         MFP_CFG_DRV(GPIO28, AF6, FAST)
-#define GPIO29_MMC2_CLK         MFP_CFG_DRV(GPIO29, AF6, FAST)
-#define GPIO30_MMC2_DAT0        MFP_CFG_DRV(GPIO30, AF6, FAST)
-#define GPIO31_MMC2_DAT1        MFP_CFG_DRV(GPIO31, AF6, FAST)
-#define GPIO32_MMC2_DAT2        MFP_CFG_DRV(GPIO32, AF6, FAST)
-#define GPIO33_MMC2_DAT3        MFP_CFG_DRV(GPIO33, AF6, FAST)
-
-/* I2S */
-#undef GPIO114_I2S_FRM
-#undef GPIO115_I2S_BCLK
-
-#define GPIO114_I2S_FRM         MFP_CFG_DRV(GPIO114, AF1, FAST)
-#define GPIO115_I2S_BCLK        MFP_CFG_DRV(GPIO115, AF1, FAST)
-#define GPIO116_I2S_TXD         MFP_CFG_DRV(GPIO116, AF1, FAST)
-
-/* MMC4 */
-#define GPIO125_MMC4_DAT3       MFP_CFG_DRV(GPIO125, AF7, FAST)
-#define GPIO126_MMC4_DAT2       MFP_CFG_DRV(GPIO126, AF7, FAST)
-#define GPIO127_MMC4_DAT1       MFP_CFG_DRV(GPIO127, AF7, FAST)
-#define GPIO0_2_MMC4_DAT0       MFP_CFG_DRV(GPIO0_2, AF7, FAST)
-#define GPIO1_2_MMC4_CMD        MFP_CFG_DRV(GPIO1_2, AF7, FAST)
-#define GPIO2_2_MMC4_CLK        MFP_CFG_DRV(GPIO2_2, AF7, FAST)
-
-/* OTG GPIO */
-#define GPIO_USB_OTG_PEN        18
-#define GPIO_USB_OIDIR          20
-
-/* Other GPIOs are 35, 84, 85 */
-#endif /* __MACH_MFP_GPLUGD_H */
diff --git a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
index 8c782328b21c..92aaa3c19d61 100644
--- a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
+++ b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
@@ -203,6 +203,10 @@
 #define GPIO33_CF_nCD2          MFP_CFG(GPIO33, AF3)
 
 /* UART */
+#define GPIO8_UART3_TXD         MFP_CFG(GPIO8, AF2)
+#define GPIO9_UART3_RXD         MFP_CFG(GPIO9, AF2)
+#define GPIO1O_UART3_CTS        MFP_CFG(GPIO10, AF2)
+#define GPIO11_UART3_RTS        MFP_CFG(GPIO11, AF2)
 #define GPIO88_UART2_TXD        MFP_CFG(GPIO88, AF2)
 #define GPIO89_UART2_RXD        MFP_CFG(GPIO89, AF2)
 #define GPIO107_UART1_TXD       MFP_CFG_DRV(GPIO107, AF1, FAST)
@@ -232,6 +236,22 @@
 #define GPIO53_MMC1_CD          MFP_CFG(GPIO53, AF1)
 #define GPIO46_MMC1_WP          MFP_CFG(GPIO46, AF1)
 
+/* MMC2 */
+#define GPIO28_MMC2_CMD         MFP_CFG_DRV(GPIO28, AF6, FAST)
+#define GPIO29_MMC2_CLK         MFP_CFG_DRV(GPIO29, AF6, FAST)
+#define GPIO30_MMC2_DAT0        MFP_CFG_DRV(GPIO30, AF6, FAST)
+#define GPIO31_MMC2_DAT1        MFP_CFG_DRV(GPIO31, AF6, FAST)
+#define GPIO32_MMC2_DAT2        MFP_CFG_DRV(GPIO32, AF6, FAST)
+#define GPIO33_MMC2_DAT3        MFP_CFG_DRV(GPIO33, AF6, FAST)
+
+/* MMC4 */
+#define GPIO125_MMC4_DAT3       MFP_CFG_DRV(GPIO125, AF7, FAST)
+#define GPIO126_MMC4_DAT2       MFP_CFG_DRV(GPIO126, AF7, FAST)
+#define GPIO127_MMC4_DAT1       MFP_CFG_DRV(GPIO127, AF7, FAST)
+#define GPIO0_2_MMC4_DAT0       MFP_CFG_DRV(GPIO0_2, AF7, FAST)
+#define GPIO1_2_MMC4_CMD        MFP_CFG_DRV(GPIO1_2, AF7, FAST)
+#define GPIO2_2_MMC4_CLK        MFP_CFG_DRV(GPIO2_2, AF7, FAST)
+
 /* LCD */
 #define GPIO84_LCD_CS           MFP_CFG(GPIO84, AF1)
 #define GPIO60_LCD_DD0          MFP_CFG(GPIO60, AF1)
@@ -269,11 +289,12 @@
 #define GPIO106_CI2C_SCL        MFP_CFG(GPIO106, AF1)
 
 /* I2S */
-#define GPIO113_I2S_MCLK        MFP_CFG(GPIO113,AF6)
-#define GPIO114_I2S_FRM         MFP_CFG(GPIO114,AF1)
-#define GPIO115_I2S_BCLK        MFP_CFG(GPIO115,AF1)
-#define GPIO116_I2S_RXD         MFP_CFG(GPIO116,AF2)
-#define GPIO117_I2S_TXD         MFP_CFG(GPIO117,AF2)
+#define GPIO113_I2S_MCLK        MFP_CFG(GPIO113, AF6)
+#define GPIO114_I2S_FRM         MFP_CFG(GPIO114, AF1)
+#define GPIO115_I2S_BCLK        MFP_CFG(GPIO115, AF1)
+#define GPIO116_I2S_RXD         MFP_CFG(GPIO116, AF2)
+#define GPIO116_I2S_TXD         MFP_CFG(GPIO116, AF1)
+#define GPIO117_I2S_TXD         MFP_CFG(GPIO117, AF2)
 
 /* PWM */
 #define GPIO96_PWM3_OUT         MFP_CFG(GPIO96, AF1)
@@ -324,4 +345,10 @@
 #define GPIO101_MII_MDIO        MFP_CFG(GPIO101, AF5)
 #define GPIO103_RX_DV           MFP_CFG(GPIO103, AF5)
 
+/* SSP2 */
+#define GPIO107_SSP2_RXD        MFP_CFG(GPIO107, AF4)
+#define GPIO108_SSP2_TXD        MFP_CFG(GPIO108, AF4)
+#define GPIO111_SSP2_CLK        MFP_CFG(GPIO111, AF4)
+#define GPIO112_SSP2_FRM        MFP_CFG(GPIO112, AF4)
+
 #endif /* __ASM_MACH_MFP_PXA168_H */
diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c
index 99833b9485cf..4e91ee6e27c8 100644
--- a/arch/arm/mach-mmp/time.c
+++ b/arch/arm/mach-mmp/time.c
@@ -51,12 +51,12 @@ static inline uint32_t timer_read(void)
 {
         int delay = 100;
 
-        __raw_writel(1, TIMERS_VIRT_BASE + TMR_CVWR(0));
+        __raw_writel(1, TIMERS_VIRT_BASE + TMR_CVWR(1));
 
         while (delay--)
                 cpu_relax();
 
-        return __raw_readl(TIMERS_VIRT_BASE + TMR_CVWR(0));
+        return __raw_readl(TIMERS_VIRT_BASE + TMR_CVWR(1));
 }
 
 unsigned long long notrace sched_clock(void)
@@ -75,28 +75,51 @@ static irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
         struct clock_event_device *c = dev_id;
 
-        /* disable and clear pending interrupt status */
-        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(0));
-        __raw_writel(0x1, TIMERS_VIRT_BASE + TMR_ICR(0));
+        /*
+         * Clear pending interrupt status.
+         */
+        __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_ICR(0));
+
+        /*
+         * Disable timer 0.
+         */
+        __raw_writel(0x02, TIMERS_VIRT_BASE + TMR_CER);
+
         c->event_handler(c);
+
         return IRQ_HANDLED;
 }
 
 static int timer_set_next_event(unsigned long delta,
                                 struct clock_event_device *dev)
 {
-        unsigned long flags, next;
+        unsigned long flags;
 
         local_irq_save(flags);
 
-        /* clear pending interrupt status and enable */
+        /*
+         * Disable timer 0.
+         */
+        __raw_writel(0x02, TIMERS_VIRT_BASE + TMR_CER);
+
+        /*
+         * Clear and enable timer match 0 interrupt.
+         */
         __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_ICR(0));
         __raw_writel(0x01, TIMERS_VIRT_BASE + TMR_IER(0));
 
-        next = timer_read() + delta;
-        __raw_writel(next, TIMERS_VIRT_BASE + TMR_TN_MM(0, 0));
+        /*
+         * Setup new clockevent timer value.
+         */
+        __raw_writel(delta - 1, TIMERS_VIRT_BASE + TMR_TN_MM(0, 0));
+
+        /*
+         * Enable timer 0.
+         */
+        __raw_writel(0x03, TIMERS_VIRT_BASE + TMR_CER);
 
         local_irq_restore(flags);
+
         return 0;
 }
 
@@ -145,23 +168,26 @@ static struct clocksource cksrc = {
 static void __init timer_config(void)
 {
         uint32_t ccr = __raw_readl(TIMERS_VIRT_BASE + TMR_CCR);
-        uint32_t cer = __raw_readl(TIMERS_VIRT_BASE + TMR_CER);
-        uint32_t cmr = __raw_readl(TIMERS_VIRT_BASE + TMR_CMR);
 
-        __raw_writel(cer & ~0x1, TIMERS_VIRT_BASE + TMR_CER); /* disable */
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_CER); /* disable */
 
-        ccr &= (cpu_is_mmp2()) ? TMR_CCR_CS_0(0) : TMR_CCR_CS_0(3);
+        ccr &= (cpu_is_mmp2()) ? (TMR_CCR_CS_0(0) | TMR_CCR_CS_1(0)) :
+                (TMR_CCR_CS_0(3) | TMR_CCR_CS_1(3));
         __raw_writel(ccr, TIMERS_VIRT_BASE + TMR_CCR);
 
-        /* free-running mode */
-        __raw_writel(cmr | 0x01, TIMERS_VIRT_BASE + TMR_CMR);
+        /* set timer 0 to periodic mode, and timer 1 to free-running mode */
+        __raw_writel(0x2, TIMERS_VIRT_BASE + TMR_CMR);
 
-        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_PLCR(0)); /* free-running */
+        __raw_writel(0x1, TIMERS_VIRT_BASE + TMR_PLCR(0)); /* periodic */
         __raw_writel(0x7, TIMERS_VIRT_BASE + TMR_ICR(0));  /* clear status */
         __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(0));
 
-        /* enable timer counter */
-        __raw_writel(cer | 0x01, TIMERS_VIRT_BASE + TMR_CER);
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_PLCR(1)); /* free-running */
+        __raw_writel(0x7, TIMERS_VIRT_BASE + TMR_ICR(1));  /* clear status */
+        __raw_writel(0x0, TIMERS_VIRT_BASE + TMR_IER(1));
+
+        /* enable timer 1 counter */
+        __raw_writel(0x2, TIMERS_VIRT_BASE + TMR_CER);
 }
 
 static struct irqaction timer_irq = {
diff --git a/arch/arm/mach-mx5/board-cpuimx51.c b/arch/arm/mach-mx5/board-cpuimx51.c
index 7c893fa70266..68934ea8725a 100644
--- a/arch/arm/mach-mx5/board-cpuimx51.c
+++ b/arch/arm/mach-mx5/board-cpuimx51.c
@@ -81,7 +81,7 @@ static struct plat_serial8250_port serial_platform_data[] = {
                 .flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_IOREMAP,
         }, {
                 .mapbase = (unsigned long)(MX51_CS1_BASE_ADDR + 0x2000000),
-                .irq = irq_to_gpio(CPUIMX51_QUARTD_GPIO),
+                .irq = gpio_to_irq(CPUIMX51_QUARTD_GPIO),
                 .irqflags = IRQF_TRIGGER_HIGH,
                 .uartclk = CPUIMX51_QUART_XTAL,
                 .regshift = CPUIMX51_QUART_REGSHIFT,
diff --git a/arch/arm/mach-mx5/board-mx51_babbage.c b/arch/arm/mach-mx5/board-mx51_babbage.c
index e400b09109ce..11b0ff67f89d 100644
--- a/arch/arm/mach-mx5/board-mx51_babbage.c
+++ b/arch/arm/mach-mx5/board-mx51_babbage.c
@@ -369,7 +369,7 @@ static void __init mx51_babbage_init(void)
                                         ARRAY_SIZE(mx51babbage_pads));
 
         imx51_add_imx_uart(0, &uart_pdata);
-        imx51_add_imx_uart(1, &uart_pdata);
+        imx51_add_imx_uart(1, NULL);
         imx51_add_imx_uart(2, &uart_pdata);
 
         babbage_fec_reset();
diff --git a/arch/arm/mach-mx5/board-mx51_efikamx.c b/arch/arm/mach-mx5/board-mx51_efikamx.c
index f70700dc0ec1..551daf85ff8c 100644
--- a/arch/arm/mach-mx5/board-mx51_efikamx.c
+++ b/arch/arm/mach-mx5/board-mx51_efikamx.c
@@ -108,9 +108,9 @@ static void __init mx51_efikamx_board_id(void)
         gpio_request(EFIKAMX_PCBID2, "pcbid2");
         gpio_direction_input(EFIKAMX_PCBID2);
 
-        id = gpio_get_value(EFIKAMX_PCBID0);
-        id |= gpio_get_value(EFIKAMX_PCBID1) << 1;
-        id |= gpio_get_value(EFIKAMX_PCBID2) << 2;
+        id = gpio_get_value(EFIKAMX_PCBID0) ? 1 : 0;
+        id |= (gpio_get_value(EFIKAMX_PCBID1) ? 1 : 0) << 1;
+        id |= (gpio_get_value(EFIKAMX_PCBID2) ? 1 : 0) << 2;
 
         switch (id) {
         case 7:
diff --git a/arch/arm/mach-mx5/board-mx51_efikasb.c b/arch/arm/mach-mx5/board-mx51_efikasb.c
index 2e4d9d32a87c..8a9bca22beb5 100644
--- a/arch/arm/mach-mx5/board-mx51_efikasb.c
+++ b/arch/arm/mach-mx5/board-mx51_efikasb.c
@@ -156,23 +156,24 @@ static struct gpio_keys_button mx51_efikasb_keys[] = {
         {
                 .code = KEY_POWER,
                 .gpio = EFIKASB_PWRKEY,
-                .type = EV_PWR,
+                .type = EV_KEY,
                 .desc = "Power Button",
                 .wakeup = 1,
-                .debounce_interval = 10, /* ms */
+                .active_low = 1,
         },
         {
                 .code = SW_LID,
                 .gpio = EFIKASB_LID,
                 .type = EV_SW,
                 .desc = "Lid Switch",
+                .active_low = 1,
         },
         {
-                /* SW_RFKILLALL vs KEY_RFKILL ? */
-                .code = SW_RFKILL_ALL,
+                .code = KEY_RFKILL,
                 .gpio = EFIKASB_RFKILL,
-                .type = EV_SW,
+                .type = EV_KEY,
                 .desc = "rfkill",
+                .active_low = 1,
         },
 };
 
@@ -224,8 +225,8 @@ static void __init mx51_efikasb_board_id(void)
         gpio_request(EFIKASB_PCBID1, "pcb id1");
         gpio_direction_input(EFIKASB_PCBID1);
 
-        id = gpio_get_value(EFIKASB_PCBID0);
-        id |= gpio_get_value(EFIKASB_PCBID1) << 1;
+        id = gpio_get_value(EFIKASB_PCBID0) ? 1 : 0;
+        id |= (gpio_get_value(EFIKASB_PCBID1) ? 1 : 0) << 1;
 
         switch (id) {
         default:
diff --git a/arch/arm/mach-mx5/clock-mx51-mx53.c b/arch/arm/mach-mx5/clock-mx51-mx53.c
index 7f20308c4dbd..f7bf996f463b 100644
--- a/arch/arm/mach-mx5/clock-mx51-mx53.c
+++ b/arch/arm/mach-mx5/clock-mx51-mx53.c
@@ -271,7 +271,11 @@ static int _clk_pll_enable(struct clk *clk)
         int i = 0;
 
         pllbase = _get_pll_base(clk);
-        reg = __raw_readl(pllbase + MXC_PLL_DP_CTL) | MXC_PLL_DP_CTL_UPEN;
+        reg = __raw_readl(pllbase + MXC_PLL_DP_CTL);
+        if (reg & MXC_PLL_DP_CTL_UPEN)
+                return 0;
+
+        reg |= MXC_PLL_DP_CTL_UPEN;
         __raw_writel(reg, pllbase + MXC_PLL_DP_CTL);
 
         /* Wait for lock */
diff --git a/arch/arm/mach-mx5/mx51_efika.c b/arch/arm/mach-mx5/mx51_efika.c
index 4435e03cea5d..c9209454807a 100644
--- a/arch/arm/mach-mx5/mx51_efika.c
+++ b/arch/arm/mach-mx5/mx51_efika.c
@@ -186,7 +186,7 @@ static int initialize_usbh1_port(struct platform_device *pdev)
 
         mdelay(10);
 
-        return mx51_initialize_usb_hw(0, MXC_EHCI_ITC_NO_THRESHOLD);
+        return mx51_initialize_usb_hw(pdev->id, MXC_EHCI_ITC_NO_THRESHOLD);
 }
 
 static struct mxc_usbh_platform_data usbh1_config = {
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 4ae6257b39a4..57b66d590c52 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -7,7 +7,6 @@ config ARCH_OMAP2PLUS_TYPICAL
         default y
         select AEABI
         select REGULATOR
-        select PM
         select PM_RUNTIME
         select VFP
         select NEON if ARCH_OMAP3 || ARCH_OMAP4
diff --git a/arch/arm/mach-omap2/board-am3517crane.c b/arch/arm/mach-omap2/board-am3517crane.c
index 5f2b55ff04ff..933e9353cb37 100644
--- a/arch/arm/mach-omap2/board-am3517crane.c
+++ b/arch/arm/mach-omap2/board-am3517crane.c
@@ -45,8 +45,6 @@ static struct omap_board_config_kernel am3517_crane_config[] __initdata = {
 static struct omap_board_mux board_mux[] __initdata = {
         { .reg_offset = OMAP_MUX_TERMINATOR },
 };
-#else
-#define board_mux       NULL
 #endif
 
 static void __init am3517_crane_init_early(void)
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index 32f5f895568a..3ae16b4e3f52 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -491,23 +491,22 @@ static void __init beagle_opp_init(void)
 
         /* Custom OPP enabled for all xM versions */
         if (cpu_is_omap3630()) {
-                struct omap_hwmod *mh = omap_hwmod_lookup("mpu");
-                struct omap_hwmod *dh = omap_hwmod_lookup("iva");
-                struct device *dev;
+                struct device *mpu_dev, *iva_dev;
 
-                if (!mh || !dh) {
+                mpu_dev = omap2_get_mpuss_device();
+                iva_dev = omap2_get_iva_device();
+
+                if (!mpu_dev || !iva_dev) {
                         pr_err("%s: Aiee.. no mpu/dsp devices? %p %p\n",
-                                __func__, mh, dh);
+                                __func__, mpu_dev, iva_dev);
                         return;
                 }
                 /* Enable MPU 1GHz and lower opps */
-                dev = &mh->od->pdev.dev;
-                r = opp_enable(dev, 800000000);
+                r = opp_enable(mpu_dev, 800000000);
                 /* TODO: MPU 1GHz needs SR and ABB */
 
                 /* Enable IVA 800MHz and lower opps */
-                dev = &dh->od->pdev.dev;
-                r |= opp_enable(dev, 660000000);
+                r |= opp_enable(iva_dev, 660000000);
                 /* TODO: DSP 800MHz needs SR and ABB */
                 if (r) {
                         pr_err("%s: failed to enable higher opp %d\n",
@@ -516,10 +515,8 @@ static void __init beagle_opp_init(void)
                          * Cleanup - disable the higher freqs - we dont care
                          * about the results
                          */
-                        dev = &mh->od->pdev.dev;
-                        opp_disable(dev, 800000000);
-                        dev = &dh->od->pdev.dev;
-                        opp_disable(dev, 660000000);
+                        opp_disable(mpu_dev, 800000000);
+                        opp_disable(iva_dev, 660000000);
                 }
         }
         return;
diff --git a/arch/arm/mach-omap2/cminst44xx.h b/arch/arm/mach-omap2/cminst44xx.h
index f2ea6453ade0..a018a7327879 100644
--- a/arch/arm/mach-omap2/cminst44xx.h
+++ b/arch/arm/mach-omap2/cminst44xx.h
@@ -18,13 +18,36 @@ extern void omap4_cminst_clkdm_force_sleep(u8 part, s16 inst, u16 cdoffs);
 extern void omap4_cminst_clkdm_force_wakeup(u8 part, s16 inst, u16 cdoffs);
 
 extern int omap4_cminst_wait_module_ready(u8 part, u16 inst, s16 cdoffs, u16 clkctrl_offs);
-extern int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs, u16 clkctrl_offs);
+
+# ifdef CONFIG_ARCH_OMAP4
+extern int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs,
+                                         u16 clkctrl_offs);
 
 extern void omap4_cminst_module_enable(u8 mode, u8 part, u16 inst, s16 cdoffs,
                                        u16 clkctrl_offs);
 extern void omap4_cminst_module_disable(u8 part, u16 inst, s16 cdoffs,
                                         u16 clkctrl_offs);
 
+# else
+
+static inline int omap4_cminst_wait_module_idle(u8 part, u16 inst, s16 cdoffs,
+                                        u16 clkctrl_offs)
+{
+        return 0;
+}
+
+static inline void omap4_cminst_module_enable(u8 mode, u8 part, u16 inst,
+                                s16 cdoffs, u16 clkctrl_offs)
+{
+}
+
+static inline void omap4_cminst_module_disable(u8 part, u16 inst, s16 cdoffs,
+                                 u16 clkctrl_offs)
+{
+}
+
+# endif
+
 /*
  * In an ideal world, we would not export these low-level functions,
  * but this will probably take some time to fix properly
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index c7fb22abc219..655e9480eb98 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -821,11 +821,10 @@ static void __init omap_mux_set_cmdline_signals(void)
         if (!omap_mux_options)
                 return;
 
-        options = kmalloc(strlen(omap_mux_options) + 1, GFP_KERNEL);
+        options = kstrdup(omap_mux_options, GFP_KERNEL);
         if (!options)
                 return;
 
-        strcpy(options, omap_mux_options);
         next_opt = options;
 
         while ((token = strsep(&next_opt, ",")) != NULL) {
@@ -855,24 +854,19 @@ static int __init omap_mux_copy_names(struct omap_mux *src,
 
         for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
                 if (src->muxnames[i]) {
-                        dst->muxnames[i] =
-                                kmalloc(strlen(src->muxnames[i]) + 1,
-                                        GFP_KERNEL);
+                        dst->muxnames[i] = kstrdup(src->muxnames[i],
+                                                   GFP_KERNEL);
                         if (!dst->muxnames[i])
                                 goto free;
-                        strcpy(dst->muxnames[i], src->muxnames[i]);
                 }
         }
 
 #ifdef CONFIG_DEBUG_FS
         for (i = 0; i < OMAP_MUX_NR_SIDES; i++) {
                 if (src->balls[i]) {
-                        dst->balls[i] =
-                                kmalloc(strlen(src->balls[i]) + 1,
-                                        GFP_KERNEL);
+                        dst->balls[i] = kstrdup(src->balls[i], GFP_KERNEL);
                         if (!dst->balls[i])
                                 goto free;
-                        strcpy(dst->balls[i], src->balls[i]);
                 }
         }
 #endif
diff --git a/arch/arm/mach-omap2/smartreflex.c b/arch/arm/mach-omap2/smartreflex.c
index 2ce2fb7664bc..34c01a7de810 100644
--- a/arch/arm/mach-omap2/smartreflex.c
+++ b/arch/arm/mach-omap2/smartreflex.c
@@ -621,7 +621,7 @@ void sr_disable(struct voltagedomain *voltdm)
                         sr_v2_disable(sr);
         }
 
-        pm_runtime_put_sync(&sr->pdev->dev);
+        pm_runtime_put_sync_suspend(&sr->pdev->dev);
 }
 
 /**
@@ -860,6 +860,7 @@ static int __init omap_sr_probe(struct platform_device *pdev)
         irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
 
         pm_runtime_enable(&pdev->dev);
+        pm_runtime_irq_safe(&pdev->dev);
 
         sr_info->pdev = pdev;
         sr_info->srid = pdev->id;
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index e9640728239b..cf1de7d2630d 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -293,7 +293,8 @@ static void __init omap2_gp_clocksource_init(int gptimer_id,
         pr_info("OMAP clocksource: GPTIMER%d at %lu Hz\n",
                 gptimer_id, clksrc.rate);
 
-        __omap_dm_timer_load_start(clksrc.io_base, OMAP_TIMER_CTRL_ST, 0, 1);
+        __omap_dm_timer_load_start(clksrc.io_base,
+                        OMAP_TIMER_CTRL_ST | OMAP_TIMER_CTRL_AR, 0, 1);
         init_sched_clock(&cd, dmtimer_update_sched_clock, 32, clksrc.rate);
 
         if (clocksource_register_hz(&clocksource_gpt, clksrc.rate))
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 2543342dbccb..daa056ed8738 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -48,14 +48,7 @@ void __init omap_pmic_init(int bus, u32 clkrate,
         omap_register_i2c_bus(bus, clkrate, &pmic_i2c_board_info, 1);
 }
 
-static struct twl4030_usb_data omap4_usb_pdata = {
-        .phy_init       = omap4430_phy_init,
-        .phy_exit       = omap4430_phy_exit,
-        .phy_power      = omap4430_phy_power,
-        .phy_set_clock  = omap4430_phy_set_clk,
-        .phy_suspend    = omap4430_phy_suspend,
-};
-
+#if defined(CONFIG_ARCH_OMAP3)
 static struct twl4030_usb_data omap3_usb_pdata = {
         .usb_mode       = T2_USB_MODE_ULPI,
 };
@@ -122,6 +115,45 @@ static struct regulator_init_data omap3_vpll2_idata = {
         .consumer_supplies              = omap3_vpll2_supplies,
 };
 
+void __init omap3_pmic_get_config(struct twl4030_platform_data *pmic_data,
+                                  u32 pdata_flags, u32 regulators_flags)
+{
+        if (!pmic_data->irq_base)
+                pmic_data->irq_base = TWL4030_IRQ_BASE;
+        if (!pmic_data->irq_end)
+                pmic_data->irq_end = TWL4030_IRQ_END;
+
+        /* Common platform data configurations */
+        if (pdata_flags & TWL_COMMON_PDATA_USB && !pmic_data->usb)
+                pmic_data->usb = &omap3_usb_pdata;
+
+        if (pdata_flags & TWL_COMMON_PDATA_BCI && !pmic_data->bci)
+                pmic_data->bci = &omap3_bci_pdata;
+
+        if (pdata_flags & TWL_COMMON_PDATA_MADC && !pmic_data->madc)
+                pmic_data->madc = &omap3_madc_pdata;
+
+        if (pdata_flags & TWL_COMMON_PDATA_AUDIO && !pmic_data->audio)
+                pmic_data->audio = &omap3_audio_pdata;
+
+        /* Common regulator configurations */
+        if (regulators_flags & TWL_COMMON_REGULATOR_VDAC && !pmic_data->vdac)
+                pmic_data->vdac = &omap3_vdac_idata;
+
+        if (regulators_flags & TWL_COMMON_REGULATOR_VPLL2 && !pmic_data->vpll2)
+                pmic_data->vpll2 = &omap3_vpll2_idata;
+}
+#endif /* CONFIG_ARCH_OMAP3 */
+
+#if defined(CONFIG_ARCH_OMAP4)
+static struct twl4030_usb_data omap4_usb_pdata = {
+        .phy_init       = omap4430_phy_init,
+        .phy_exit       = omap4430_phy_exit,
+        .phy_power      = omap4430_phy_power,
+        .phy_set_clock  = omap4430_phy_set_clk,
+        .phy_suspend    = omap4430_phy_suspend,
+};
+
 static struct regulator_init_data omap4_vdac_idata = {
         .constraints = {
                 .min_uV                 = 1800000,
@@ -273,32 +305,4 @@ void __init omap4_pmic_get_config(struct twl4030_platform_data *pmic_data,
             !pmic_data->clk32kg)
                 pmic_data->clk32kg = &omap4_clk32kg_idata;
 }
-
-void __init omap3_pmic_get_config(struct twl4030_platform_data *pmic_data,
-                                  u32 pdata_flags, u32 regulators_flags)
-{
-        if (!pmic_data->irq_base)
-                pmic_data->irq_base = TWL4030_IRQ_BASE;
-        if (!pmic_data->irq_end)
-                pmic_data->irq_end = TWL4030_IRQ_END;
-
-        /* Common platform data configurations */
-        if (pdata_flags & TWL_COMMON_PDATA_USB && !pmic_data->usb)
-                pmic_data->usb = &omap3_usb_pdata;
-
-        if (pdata_flags & TWL_COMMON_PDATA_BCI && !pmic_data->bci)
-                pmic_data->bci = &omap3_bci_pdata;
-
-        if (pdata_flags & TWL_COMMON_PDATA_MADC && !pmic_data->madc)
-                pmic_data->madc = &omap3_madc_pdata;
-
-        if (pdata_flags & TWL_COMMON_PDATA_AUDIO && !pmic_data->audio)
-                pmic_data->audio = &omap3_audio_pdata;
-
-        /* Common regulator configurations */
-        if (regulators_flags & TWL_COMMON_REGULATOR_VDAC && !pmic_data->vdac)
-                pmic_data->vdac = &omap3_vdac_idata;
-
-        if (regulators_flags & TWL_COMMON_REGULATOR_VPLL2 && !pmic_data->vpll2)
-                pmic_data->vpll2 = &omap3_vpll2_idata;
-}
+#endif /* CONFIG_ARCH_OMAP4 */
diff --git a/arch/arm/mach-sa1100/pci-nanoengine.c b/arch/arm/mach-sa1100/pci-nanoengine.c
index 964c6c3cd7a6..dd39fee59549 100644
--- a/arch/arm/mach-sa1100/pci-nanoengine.c
+++ b/arch/arm/mach-sa1100/pci-nanoengine.c
@@ -28,6 +28,7 @@
 #include <asm/mach-types.h>
 
 #include <mach/nanoengine.h>
+#include <mach/hardware.h>
 
 static DEFINE_SPINLOCK(nano_lock);
 
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index be7c638b648b..cfbcf8b95599 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -22,6 +22,7 @@
 #include <linux/sched.h>
 #include <linux/uaccess.h>
 
+#include <asm/system.h>
 #include <asm/unaligned.h>
 
 #include "fault.h"
@@ -95,6 +96,33 @@ static const char *usermode_action[] = {
         "signal+warn"
 };
 
+/* Return true if and only if the ARMv6 unaligned access model is in use. */
+static bool cpu_is_v6_unaligned(void)
+{
+        return cpu_architecture() >= CPU_ARCH_ARMv6 && (cr_alignment & CR_U);
+}
+
+static int safe_usermode(int new_usermode, bool warn)
+{
+        /*
+         * ARMv6 and later CPUs can perform unaligned accesses for
+         * most single load and store instructions up to word size.
+         * LDM, STM, LDRD and STRD still need to be handled.
+         *
+         * Ignoring the alignment fault is not an option on these
+         * CPUs since we spin re-faulting the instruction without
+         * making any progress.
+         */
+        if (cpu_is_v6_unaligned() && !(new_usermode & (UM_FIXUP | UM_SIGNAL))) {
+                new_usermode |= UM_FIXUP;
+
+                if (warn)
+                        printk(KERN_WARNING "alignment: ignoring faults is unsafe on this CPU.  Defaulting to fixup mode.\n");
+        }
+
+        return new_usermode;
+}
+
 static int alignment_proc_show(struct seq_file *m, void *v)
 {
         seq_printf(m, "User:\t\t%lu\n", ai_user);
@@ -125,7 +153,7 @@ static ssize_t alignment_proc_write(struct file *file, const char __user *buffer
                 if (get_user(mode, buffer))
                         return -EFAULT;
                 if (mode >= '0' && mode <= '5')
-                        ai_usermode = mode - '0';
+                        ai_usermode = safe_usermode(mode - '0', true);
         }
         return count;
 }
@@ -886,9 +914,16 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
         if (ai_usermode & UM_FIXUP)
                 goto fixup;
 
-        if (ai_usermode & UM_SIGNAL)
-                force_sig(SIGBUS, current);
-        else {
+        if (ai_usermode & UM_SIGNAL) {
+                siginfo_t si;
+
+                si.si_signo = SIGBUS;
+                si.si_errno = 0;
+                si.si_code = BUS_ADRALN;
+                si.si_addr = (void __user *)addr;
+
+                force_sig_info(si.si_signo, &si, current);
+        } else {
                 /*
                  * We're about to disable the alignment trap and return to
                  * user space.  But if an interrupt occurs before actually
@@ -926,20 +961,11 @@ static int __init alignment_init(void)
                 return -ENOMEM;
 #endif
 
-        /*
-         * ARMv6 and later CPUs can perform unaligned accesses for
-         * most single load and store instructions up to word size.
-         * LDM, STM, LDRD and STRD still need to be handled.
-         *
-         * Ignoring the alignment fault is not an option on these
-         * CPUs since we spin re-faulting the instruction without
-         * making any progress.
-         */
-        if (cpu_architecture() >= CPU_ARCH_ARMv6 && (cr_alignment & CR_U)) {
+        if (cpu_is_v6_unaligned()) {
                 cr_alignment &= ~CR_A;
                 cr_no_alignment &= ~CR_A;
                 set_cr(cr_alignment);
-                ai_usermode = UM_FIXUP;
+                ai_usermode = safe_usermode(ai_usermode, false);
         }
 
         hook_fault_code(1, do_alignment, SIGBUS, BUS_ADRALN,
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 2fee782077c1..91bca355cd31 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -441,7 +441,7 @@ static inline int free_area(unsigned long pfn, unsigned long end, char *s)
 static inline void poison_init_mem(void *s, size_t count)
 {
         u32 *p = (u32 *)s;
-        while ((count = count - 4))
+        for (; count != 0; count -= 4)
                 *p++ = 0xe7fddef0;
 }
 
diff --git a/arch/arm/mm/proc-arm946.S b/arch/arm/mm/proc-arm946.S
index f8f7ea34bfc5..683af3a182b7 100644
--- a/arch/arm/mm/proc-arm946.S
+++ b/arch/arm/mm/proc-arm946.S
@@ -410,6 +410,7 @@ __arm946_proc_info:
         .long   0x41009460
         .long   0xff00fff0
         .long   0
+        .long   0
         b       __arm946_setup
         .long   cpu_arch_name
         .long   cpu_elf_name
@@ -418,6 +419,6 @@ __arm946_proc_info:
         .long   arm946_processor_functions
         .long   0
         .long   0
-        .long   arm940_cache_fns
+        .long   arm946_cache_fns
         .size   __arm946_proc_info, . - __arm946_proc_info
 
diff --git a/arch/arm/plat-mxc/include/mach/debug-macro.S b/arch/arm/plat-mxc/include/mach/debug-macro.S
index 91fc7cdb5dc9..e4dde91f0231 100644
--- a/arch/arm/plat-mxc/include/mach/debug-macro.S
+++ b/arch/arm/plat-mxc/include/mach/debug-macro.S
@@ -44,6 +44,14 @@
 #define UART_PADDR      MX51_UART1_BASE_ADDR
 #endif
 
+/* iMX50/53 have same addresses, but not iMX51 */
+#if defined(CONFIG_SOC_IMX50) || defined(CONFIG_SOC_IMX53)
+#ifdef UART_PADDR
+#error "CONFIG_DEBUG_LL is incompatible with multiple archs"
+#endif
+#define UART_PADDR      MX53_UART1_BASE_ADDR
+#endif
+
 #define UART_VADDR      IMX_IO_ADDRESS(UART_PADDR)
 
                 .macro  addruart, rp, rv
diff --git a/arch/arm/plat-mxc/include/mach/iomux-mx53.h b/arch/arm/plat-mxc/include/mach/iomux-mx53.h
index 9440b9e00e89..5408fd1fc736 100644
--- a/arch/arm/plat-mxc/include/mach/iomux-mx53.h
+++ b/arch/arm/plat-mxc/include/mach/iomux-mx53.h
@@ -30,6 +30,9 @@
 #define MX53_SDHC_PAD_CTRL      (PAD_CTL_HYS | PAD_CTL_PKE | PAD_CTL_PUE | \
                                 PAD_CTL_PUS_47K_UP | PAD_CTL_DSE_HIGH | \
                                 PAD_CTL_SRE_FAST)
+#define PAD_CTRL_I2C    (PAD_CTL_SRE_FAST | PAD_CTL_ODE | PAD_CTL_PKE | \
+                        PAD_CTL_PUE | PAD_CTL_DSE_HIGH | PAD_CTL_PUS_100K_UP \
+                        | PAD_CTL_HYS)
 
 #define _MX53_PAD_GPIO_19__KPP_COL_5            IOMUX_PAD(0x348, 0x20, 0, 0x840, 0, 0)
 #define _MX53_PAD_GPIO_19__GPIO4_5              IOMUX_PAD(0x348, 0x20, 1, 0x0, 0, 0)
@@ -1256,7 +1259,7 @@
 #define MX53_PAD_KEY_COL3__GPIO4_12             (_MX53_PAD_KEY_COL3__GPIO4_12 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__USBOH3_H2_DP         (_MX53_PAD_KEY_COL3__USBOH3_H2_DP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__SPDIF_IN1            (_MX53_PAD_KEY_COL3__SPDIF_IN1 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_KEY_COL3__I2C2_SCL             (_MX53_PAD_KEY_COL3__I2C2_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_KEY_COL3__I2C2_SCL             (_MX53_PAD_KEY_COL3__I2C2_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_KEY_COL3__ECSPI1_SS3           (_MX53_PAD_KEY_COL3__ECSPI1_SS3 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__FEC_CRS              (_MX53_PAD_KEY_COL3__FEC_CRS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_COL3__USBPHY1_SIECLOCK             (_MX53_PAD_KEY_COL3__USBPHY1_SIECLOCK | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1264,7 +1267,7 @@
 #define MX53_PAD_KEY_ROW3__GPIO4_13             (_MX53_PAD_KEY_ROW3__GPIO4_13 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__USBOH3_H2_DM         (_MX53_PAD_KEY_ROW3__USBOH3_H2_DM | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__CCM_ASRC_EXT_CLK             (_MX53_PAD_KEY_ROW3__CCM_ASRC_EXT_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_KEY_ROW3__I2C2_SDA             (_MX53_PAD_KEY_ROW3__I2C2_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_KEY_ROW3__I2C2_SDA             (_MX53_PAD_KEY_ROW3__I2C2_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_KEY_ROW3__OSC32K_32K_OUT               (_MX53_PAD_KEY_ROW3__OSC32K_32K_OUT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__CCM_PLL4_BYP         (_MX53_PAD_KEY_ROW3__CCM_PLL4_BYP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_KEY_ROW3__USBPHY1_LINESTATE_0          (_MX53_PAD_KEY_ROW3__USBPHY1_LINESTATE_0 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1536,7 +1539,7 @@
 #define MX53_PAD_CSI0_DAT8__KPP_COL_7           (_MX53_PAD_CSI0_DAT8__KPP_COL_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__ECSPI2_SCLK         (_MX53_PAD_CSI0_DAT8__ECSPI2_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__USBOH3_USBH3_OC             (_MX53_PAD_CSI0_DAT8__USBOH3_USBH3_OC | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_CSI0_DAT8__I2C1_SDA            (_MX53_PAD_CSI0_DAT8__I2C1_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_CSI0_DAT8__I2C1_SDA            (_MX53_PAD_CSI0_DAT8__I2C1_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_CSI0_DAT8__EMI_EMI_DEBUG_37            (_MX53_PAD_CSI0_DAT8__EMI_EMI_DEBUG_37 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT8__TPIU_TRACE_5                (_MX53_PAD_CSI0_DAT8__TPIU_TRACE_5 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__IPU_CSI0_D_9                (_MX53_PAD_CSI0_DAT9__IPU_CSI0_D_9 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1544,7 +1547,7 @@
 #define MX53_PAD_CSI0_DAT9__KPP_ROW_7           (_MX53_PAD_CSI0_DAT9__KPP_ROW_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__ECSPI2_MOSI         (_MX53_PAD_CSI0_DAT9__ECSPI2_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__USBOH3_USBH3_PWR            (_MX53_PAD_CSI0_DAT9__USBOH3_USBH3_PWR | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_CSI0_DAT9__I2C1_SCL            (_MX53_PAD_CSI0_DAT9__I2C1_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_CSI0_DAT9__I2C1_SCL            (_MX53_PAD_CSI0_DAT9__I2C1_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_CSI0_DAT9__EMI_EMI_DEBUG_38            (_MX53_PAD_CSI0_DAT9__EMI_EMI_DEBUG_38 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT9__TPIU_TRACE_6                (_MX53_PAD_CSI0_DAT9__TPIU_TRACE_6 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_CSI0_DAT10__IPU_CSI0_D_10              (_MX53_PAD_CSI0_DAT10__IPU_CSI0_D_10 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1631,25 +1634,25 @@
 #define MX53_PAD_EIM_EB2__CCM_DI1_EXT_CLK               (_MX53_PAD_EIM_EB2__CCM_DI1_EXT_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_EB2__IPU_SER_DISP1_CS              (_MX53_PAD_EIM_EB2__IPU_SER_DISP1_CS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_EB2__ECSPI1_SS0            (_MX53_PAD_EIM_EB2__ECSPI1_SS0 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_EB2__I2C2_SCL              (_MX53_PAD_EIM_EB2__I2C2_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_EB2__I2C2_SCL              (_MX53_PAD_EIM_EB2__I2C2_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D16__EMI_WEIM_D_16         (_MX53_PAD_EIM_D16__EMI_WEIM_D_16 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__GPIO3_16              (_MX53_PAD_EIM_D16__GPIO3_16 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__IPU_DI0_PIN5          (_MX53_PAD_EIM_D16__IPU_DI0_PIN5 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__IPU_DISPB1_SER_CLK            (_MX53_PAD_EIM_D16__IPU_DISPB1_SER_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D16__ECSPI1_SCLK           (_MX53_PAD_EIM_D16__ECSPI1_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D16__I2C2_SDA              (_MX53_PAD_EIM_D16__I2C2_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D16__I2C2_SDA              (_MX53_PAD_EIM_D16__I2C2_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D17__EMI_WEIM_D_17         (_MX53_PAD_EIM_D17__EMI_WEIM_D_17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__GPIO3_17              (_MX53_PAD_EIM_D17__GPIO3_17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__IPU_DI0_PIN6          (_MX53_PAD_EIM_D17__IPU_DI0_PIN6 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__IPU_DISPB1_SER_DIN            (_MX53_PAD_EIM_D17__IPU_DISPB1_SER_DIN | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D17__ECSPI1_MISO           (_MX53_PAD_EIM_D17__ECSPI1_MISO | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D17__I2C3_SCL              (_MX53_PAD_EIM_D17__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D17__I2C3_SCL              (_MX53_PAD_EIM_D17__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D18__EMI_WEIM_D_18         (_MX53_PAD_EIM_D18__EMI_WEIM_D_18 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__GPIO3_18              (_MX53_PAD_EIM_D18__GPIO3_18 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__IPU_DI0_PIN7          (_MX53_PAD_EIM_D18__IPU_DI0_PIN7 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__IPU_DISPB1_SER_DIO            (_MX53_PAD_EIM_D18__IPU_DISPB1_SER_DIO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D18__ECSPI1_MOSI           (_MX53_PAD_EIM_D18__ECSPI1_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D18__I2C3_SDA              (_MX53_PAD_EIM_D18__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D18__I2C3_SDA              (_MX53_PAD_EIM_D18__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D18__IPU_DI1_D0_CS         (_MX53_PAD_EIM_D18__IPU_DI1_D0_CS | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D19__EMI_WEIM_D_19         (_MX53_PAD_EIM_D19__EMI_WEIM_D_19 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D19__GPIO3_19              (_MX53_PAD_EIM_D19__GPIO3_19 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1672,7 +1675,7 @@
 #define MX53_PAD_EIM_D21__IPU_DI0_PIN17         (_MX53_PAD_EIM_D21__IPU_DI0_PIN17 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D21__IPU_DISPB0_SER_CLK            (_MX53_PAD_EIM_D21__IPU_DISPB0_SER_CLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D21__CSPI_SCLK             (_MX53_PAD_EIM_D21__CSPI_SCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D21__I2C1_SCL              (_MX53_PAD_EIM_D21__I2C1_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D21__I2C1_SCL              (_MX53_PAD_EIM_D21__I2C1_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D21__USBOH3_USBOTG_OC              (_MX53_PAD_EIM_D21__USBOH3_USBOTG_OC | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D22__EMI_WEIM_D_22         (_MX53_PAD_EIM_D22__EMI_WEIM_D_22 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D22__GPIO3_22              (_MX53_PAD_EIM_D22__GPIO3_22 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -1732,7 +1735,7 @@
 #define MX53_PAD_EIM_D28__UART2_CTS             (_MX53_PAD_EIM_D28__UART2_CTS | MUX_PAD_CTRL(MX53_UART_PAD_CTRL))
 #define MX53_PAD_EIM_D28__IPU_DISPB0_SER_DIO            (_MX53_PAD_EIM_D28__IPU_DISPB0_SER_DIO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D28__CSPI_MOSI             (_MX53_PAD_EIM_D28__CSPI_MOSI | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_EIM_D28__I2C1_SDA              (_MX53_PAD_EIM_D28__I2C1_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_EIM_D28__I2C1_SDA              (_MX53_PAD_EIM_D28__I2C1_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_EIM_D28__IPU_EXT_TRIG          (_MX53_PAD_EIM_D28__IPU_EXT_TRIG | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D28__IPU_DI0_PIN13         (_MX53_PAD_EIM_D28__IPU_DI0_PIN13 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_EIM_D29__EMI_WEIM_D_29         (_MX53_PAD_EIM_D29__EMI_WEIM_D_29 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2297,7 +2300,7 @@
 #define MX53_PAD_GPIO_9__SCC_FAIL_STATE         (_MX53_PAD_GPIO_9__SCC_FAIL_STATE | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__ESAI1_HCKR             (_MX53_PAD_GPIO_3__ESAI1_HCKR | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__GPIO1_3                (_MX53_PAD_GPIO_3__GPIO1_3 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_3__I2C3_SCL               (_MX53_PAD_GPIO_3__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_3__I2C3_SCL               (_MX53_PAD_GPIO_3__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_3__DPLLIP1_TOG_EN         (_MX53_PAD_GPIO_3__DPLLIP1_TOG_EN | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__CCM_CLKO2              (_MX53_PAD_GPIO_3__CCM_CLKO2 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_3__OBSERVE_MUX_OBSRV_INT_OUT0             (_MX53_PAD_GPIO_3__OBSERVE_MUX_OBSRV_INT_OUT0 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2305,7 +2308,7 @@
 #define MX53_PAD_GPIO_3__MLB_MLBCLK             (_MX53_PAD_GPIO_3__MLB_MLBCLK | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__ESAI1_SCKT             (_MX53_PAD_GPIO_6__ESAI1_SCKT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__GPIO1_6                (_MX53_PAD_GPIO_6__GPIO1_6 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_6__I2C3_SDA               (_MX53_PAD_GPIO_6__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_6__I2C3_SDA               (_MX53_PAD_GPIO_6__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_6__CCM_CCM_OUT_0          (_MX53_PAD_GPIO_6__CCM_CCM_OUT_0 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__CSU_CSU_INT_DEB                (_MX53_PAD_GPIO_6__CSU_CSU_INT_DEB | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_6__OBSERVE_MUX_OBSRV_INT_OUT1             (_MX53_PAD_GPIO_6__OBSERVE_MUX_OBSRV_INT_OUT1 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2333,7 +2336,7 @@
 #define MX53_PAD_GPIO_5__CCM_CLKO               (_MX53_PAD_GPIO_5__CCM_CLKO | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_5__CSU_CSU_ALARM_AUT_2            (_MX53_PAD_GPIO_5__CSU_CSU_ALARM_AUT_2 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_5__OBSERVE_MUX_OBSRV_INT_OUT4             (_MX53_PAD_GPIO_5__OBSERVE_MUX_OBSRV_INT_OUT4 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_5__I2C3_SCL               (_MX53_PAD_GPIO_5__I2C3_SCL | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_5__I2C3_SCL               (_MX53_PAD_GPIO_5__I2C3_SCL | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_5__CCM_PLL1_BYP           (_MX53_PAD_GPIO_5__CCM_PLL1_BYP | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_7__ESAI1_TX4_RX1          (_MX53_PAD_GPIO_7__ESAI1_TX4_RX1 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_7__GPIO1_7                (_MX53_PAD_GPIO_7__GPIO1_7 | MUX_PAD_CTRL(NO_PAD_CTRL))
@@ -2356,7 +2359,7 @@
 #define MX53_PAD_GPIO_16__TZIC_PWRFAIL_INT              (_MX53_PAD_GPIO_16__TZIC_PWRFAIL_INT | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_16__RTC_CE_RTC_EXT_TRIG1          (_MX53_PAD_GPIO_16__RTC_CE_RTC_EXT_TRIG1 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_16__SPDIF_IN1             (_MX53_PAD_GPIO_16__SPDIF_IN1 | MUX_PAD_CTRL(NO_PAD_CTRL))
-#define MX53_PAD_GPIO_16__I2C3_SDA              (_MX53_PAD_GPIO_16__I2C3_SDA | MUX_PAD_CTRL(NO_PAD_CTRL))
+#define MX53_PAD_GPIO_16__I2C3_SDA              (_MX53_PAD_GPIO_16__I2C3_SDA | MUX_PAD_CTRL(PAD_CTRL_I2C))
 #define MX53_PAD_GPIO_16__SJC_DE_B              (_MX53_PAD_GPIO_16__SJC_DE_B | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_17__ESAI1_TX0             (_MX53_PAD_GPIO_17__ESAI1_TX0 | MUX_PAD_CTRL(NO_PAD_CTRL))
 #define MX53_PAD_GPIO_17__GPIO7_12              (_MX53_PAD_GPIO_17__GPIO7_12 | MUX_PAD_CTRL(NO_PAD_CTRL))
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index 6e6735f04ee3..bb8f4a6b3e37 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -13,6 +13,7 @@ config ARCH_OMAP1
         bool "TI OMAP1"
         select CLKDEV_LOOKUP
         select CLKSRC_MMIO
+        select GENERIC_IRQ_CHIP
         help
           "Systems based on omap7xx, omap15xx or omap16xx"
 
diff --git a/arch/arm/plat-omap/include/plat/dma.h b/arch/arm/plat-omap/include/plat/dma.h
index d1c916fcf770..dc562a5c0a8a 100644
--- a/arch/arm/plat-omap/include/plat/dma.h
+++ b/arch/arm/plat-omap/include/plat/dma.h
@@ -195,6 +195,11 @@
 
 #define OMAP36XX_DMA_UART4_TX           81      /* S_DMA_80 */
 #define OMAP36XX_DMA_UART4_RX           82      /* S_DMA_81 */
+
+/* Only for AM35xx */
+#define AM35XX_DMA_UART4_TX             54
+#define AM35XX_DMA_UART4_RX             55
+
 /*----------------------------------------------------------------------------*/
 
 #define OMAP1_DMA_TOUT_IRQ              (1 << 0)
diff --git a/arch/arm/plat-omap/include/plat/irqs.h b/arch/arm/plat-omap/include/plat/irqs.h
index 926d25c780f3..30e10719b774 100644
--- a/arch/arm/plat-omap/include/plat/irqs.h
+++ b/arch/arm/plat-omap/include/plat/irqs.h
@@ -357,6 +357,7 @@
 #define INT_35XX_EMAC_C0_TX_PULSE_IRQ   69
 #define INT_35XX_EMAC_C0_MISC_PULSE_IRQ 70
 #define INT_35XX_USBOTG_IRQ             71
+#define INT_35XX_UART4                  84
 #define INT_35XX_CCDC_VD0_IRQ           88
 #define INT_35XX_CCDC_VD1_IRQ           92
 #define INT_35XX_CCDC_VD2_IRQ           93
diff --git a/arch/arm/plat-omap/include/plat/serial.h b/arch/arm/plat-omap/include/plat/serial.h
index 2723f9166ea2..de3b10c18127 100644
--- a/arch/arm/plat-omap/include/plat/serial.h
+++ b/arch/arm/plat-omap/include/plat/serial.h
@@ -56,6 +56,9 @@
 #define TI816X_UART2_BASE       0x48022000
 #define TI816X_UART3_BASE       0x48024000
 
+/* AM3505/3517 UART4 */
+#define AM35XX_UART4_BASE       0x4809E000      /* Only on AM3505/3517 */
+
 /* External port on Zoom2/3 */
 #define ZOOM_UART_BASE          0x10000000
 #define ZOOM_UART_VIRT          0xfa400000
diff --git a/arch/arm/plat-omap/iovmm.c b/arch/arm/plat-omap/iovmm.c
index c60737c49a32..79e7fedb8602 100644
--- a/arch/arm/plat-omap/iovmm.c
+++ b/arch/arm/plat-omap/iovmm.c
@@ -423,9 +423,6 @@ static void sgtable_fill_kmalloc(struct sg_table *sgt, u32 pa, u32 da,
 {
         unsigned int i;
         struct scatterlist *sg;
-        void *va;
-
-        va = phys_to_virt(pa);
 
         for_each_sg(sgt->sgl, sg, sgt->nents, i) {
                 unsigned bytes;
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 3b3776d0a1a7..fff68d0d521b 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -910,7 +910,7 @@ omapl138_case_a3	MACH_OMAPL138_CASE_A3	OMAPL138_CASE_A3	3280
 uemd                    MACH_UEMD               UEMD                    3281
 ccwmx51mut              MACH_CCWMX51MUT         CCWMX51MUT              3282
 rockhopper              MACH_ROCKHOPPER         ROCKHOPPER              3283
-nookcolor               MACH_NOOKCOLOR          NOOKCOLOR               3284
+encore                  MACH_ENCORE             ENCORE                  3284
 hkdkc100                MACH_HKDKC100           HKDKC100                3285
 ts42xx                  MACH_TS42XX             TS42XX                  3286
 aebl                    MACH_AEBL               AEBL                    3287
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 124854714958..3ff7785b3beb 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -162,7 +162,6 @@ config IA64_GENERIC
         select ACPI_NUMA
         select SWIOTLB
         select PCI_MSI
-        select DMAR
         help
           This selects the system type of your hardware.  A "generic" kernel
           will run on any supported IA-64 system.  However, if you configure
diff --git a/arch/ia64/configs/generic_defconfig b/arch/ia64/configs/generic_defconfig
index 1d7bca0a396d..0e5cd1405e0e 100644
--- a/arch/ia64/configs/generic_defconfig
+++ b/arch/ia64/configs/generic_defconfig
@@ -234,3 +234,4 @@ CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRC_T10DIF=y
 CONFIG_MISC_DEVICES=y
+CONFIG_DMAR=y
diff --git a/arch/powerpc/include/asm/jump_label.h b/arch/powerpc/include/asm/jump_label.h
index 1f780b95c0f0..938986e412f1 100644
--- a/arch/powerpc/include/asm/jump_label.h
+++ b/arch/powerpc/include/asm/jump_label.h
@@ -22,7 +22,6 @@ static __always_inline bool arch_static_branch(struct jump_label_key *key)
         asm goto("1:\n\t"
                  "nop\n\t"
                  ".pushsection __jump_table,  \"aw\"\n\t"
-                 ".align 4\n\t"
                  JUMP_ENTRY_TYPE "1b, %l[l_yes], %c0\n\t"
                  ".popsection \n\t"
                  : :  "i" (key) : : l_yes);
@@ -41,7 +40,6 @@ struct jump_entry {
         jump_label_t code;
         jump_label_t target;
         jump_label_t key;
-        jump_label_t pad;
 };
 
 #endif /* _ASM_POWERPC_JUMP_LABEL_H */
diff --git a/arch/powerpc/include/asm/kdump.h b/arch/powerpc/include/asm/kdump.h
index 6857af58b02e..bffd062adf79 100644
--- a/arch/powerpc/include/asm/kdump.h
+++ b/arch/powerpc/include/asm/kdump.h
@@ -3,17 +3,7 @@
 
 #include <asm/page.h>
 
-/*
- * If CONFIG_RELOCATABLE is enabled we can place the kdump kernel anywhere.
- * To keep enough space in the RMO for the first stage kernel on 64bit, we
- * place it at 64MB. If CONFIG_RELOCATABLE is not enabled we must place
- * the second stage at 32MB.
- */
-#if defined(CONFIG_RELOCATABLE) && defined(CONFIG_PPC64)
-#define KDUMP_KERNELBASE        0x4000000
-#else
 #define KDUMP_KERNELBASE        0x2000000
-#endif
 
 /* How many bytes to reserve at zero for kdump. The reserve limit should
  * be greater or equal to the trampoline's end address.
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index e8aaf6fce38b..559da199edb5 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -1003,7 +1003,6 @@
 #define PV_970          0x0039
 #define PV_POWER5       0x003A
 #define PV_POWER5p      0x003B
-#define PV_POWER7       0x003F
 #define PV_970FX        0x003C
 #define PV_POWER6       0x003E
 #define PV_POWER7       0x003F
@@ -1024,13 +1023,16 @@
 #define mtmsrd(v)       __mtmsrd((v), 0)
 #define mtmsr(v)        mtmsrd(v)
 #else
-#define mtmsr(v)        asm volatile("mtmsr %0" : : "r" (v) : "memory")
+#define mtmsr(v)        asm volatile("mtmsr %0" : \
+                                     : "r" ((unsigned long)(v)) \
+                                     : "memory")
 #endif
 
 #define mfspr(rn)       ({unsigned long rval; \
                         asm volatile("mfspr %0," __stringify(rn) \
                                 : "=r" (rval)); rval;})
-#define mtspr(rn, v)    asm volatile("mtspr " __stringify(rn) ",%0" : : "r" (v)\
+#define mtspr(rn, v)    asm volatile("mtspr " __stringify(rn) ",%0" : \
+                                     : "r" ((unsigned long)(v)) \
                                      : "memory")
 
 #ifdef __powerpc64__
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 9fb933248ab6..fa44ff538861 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -2051,7 +2051,8 @@ static struct cpu_spec __initdata cpu_specs[] = {
 
 static struct cpu_spec the_cpu_spec;
 
-static void __init setup_cpu_spec(unsigned long offset, struct cpu_spec *s)
+static struct cpu_spec * __init setup_cpu_spec(unsigned long offset,
+                                               struct cpu_spec *s)
 {
         struct cpu_spec *t = &the_cpu_spec;
         struct cpu_spec old;
@@ -2114,6 +2115,8 @@ static void __init setup_cpu_spec(unsigned long offset, struct cpu_spec *s)
                 t->cpu_setup(offset, t);
         }
 #endif /* CONFIG_PPC64 || CONFIG_BOOKE */
+
+        return t;
 }
 
 struct cpu_spec * __init identify_cpu(unsigned long offset, unsigned int pvr)
@@ -2124,10 +2127,8 @@ struct cpu_spec * __init identify_cpu(unsigned long offset, unsigned int pvr)
         s = PTRRELOC(s);
 
         for (i = 0; i < ARRAY_SIZE(cpu_specs); i++,s++) {
-                if ((pvr & s->pvr_mask) == s->pvr_value) {
-                        setup_cpu_spec(offset, s);
-                        return s;
-                }
+                if ((pvr & s->pvr_mask) == s->pvr_value)
+                        return setup_cpu_spec(offset, s);
         }
 
         BUG();
diff --git a/arch/powerpc/kernel/iomap.c b/arch/powerpc/kernel/iomap.c
index 1577434f4088..b25f6325fc70 100644
--- a/arch/powerpc/kernel/iomap.c
+++ b/arch/powerpc/kernel/iomap.c
@@ -117,6 +117,7 @@ void ioport_unmap(void __iomem *addr)
 EXPORT_SYMBOL(ioport_map);
 EXPORT_SYMBOL(ioport_unmap);
 
+#ifdef CONFIG_PCI
 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max)
 {
         resource_size_t start = pci_resource_start(dev, bar);
@@ -146,3 +147,4 @@ void pci_iounmap(struct pci_dev *dev, void __iomem *addr)
 
 EXPORT_SYMBOL(pci_iomap);
 EXPORT_SYMBOL(pci_iounmap);
+#endif /* CONFIG_PCI */
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index 6658a1589955..9ce1672afb59 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -136,12 +136,16 @@ void __init reserve_crashkernel(void)
         crashk_res.start = KDUMP_KERNELBASE;
 #else
         if (!crashk_res.start) {
+#ifdef CONFIG_PPC64
                 /*
-                 * unspecified address, choose a region of specified size
-                 * can overlap with initrd (ignoring corruption when retained)
-                 * ppc64 requires kernel and some stacks to be in first segemnt
+                 * On 64bit we split the RMO in half but cap it at half of
+                 * a small SLB (128MB) since the crash kernel needs to place
+                 * itself and some stacks to be in the first segment.
                  */
+                crashk_res.start = min(0x80000000ULL, (ppc64_rma_size / 2));
+#else
                 crashk_res.start = KDUMP_KERNELBASE;
+#endif
         }
 
         crash_base = PAGE_ALIGN(crashk_res.start);
diff --git a/arch/powerpc/kernel/perf_callchain.c b/arch/powerpc/kernel/perf_callchain.c
index d05ae4204bbf..564c1d8bdb5c 100644
--- a/arch/powerpc/kernel/perf_callchain.c
+++ b/arch/powerpc/kernel/perf_callchain.c
@@ -154,8 +154,12 @@ static int read_user_stack_64(unsigned long __user *ptr, unsigned long *ret)
             ((unsigned long)ptr & 7))
                 return -EFAULT;
 
-        if (!__get_user_inatomic(*ret, ptr))
+        pagefault_disable();
+        if (!__get_user_inatomic(*ret, ptr)) {
+                pagefault_enable();
                 return 0;
+        }
+        pagefault_enable();
 
         return read_user_stack_slow(ptr, ret, 8);
 }
@@ -166,8 +170,12 @@ static int read_user_stack_32(unsigned int __user *ptr, unsigned int *ret)
             ((unsigned long)ptr & 3))
                 return -EFAULT;
 
-        if (!__get_user_inatomic(*ret, ptr))
+        pagefault_disable();
+        if (!__get_user_inatomic(*ret, ptr)) {
+                pagefault_enable();
                 return 0;
+        }
+        pagefault_enable();
 
         return read_user_stack_slow(ptr, ret, 4);
 }
@@ -294,11 +302,17 @@ static inline int current_is_64bit(void)
  */
 static int read_user_stack_32(unsigned int __user *ptr, unsigned int *ret)
 {
+        int rc;
+
         if ((unsigned long)ptr > TASK_SIZE - sizeof(unsigned int) ||
             ((unsigned long)ptr & 3))
                 return -EFAULT;
 
-        return __get_user_inatomic(*ret, ptr);
+        pagefault_disable();
+        rc = __get_user_inatomic(*ret, ptr);
+        pagefault_enable();
+
+        return rc;
 }
 
 static inline void perf_callchain_user_64(struct perf_callchain_entry *entry,
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index c016033ba78d..a909f4e9343b 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -1020,7 +1020,7 @@ static unsigned long __init alloc_up(unsigned long size, unsigned long align)
         }
         if (addr == 0)
                 return 0;
-        RELOC(alloc_bottom) = addr;
+        RELOC(alloc_bottom) = addr + size;
 
         prom_debug(" -> %x\n", addr);
         prom_debug("  alloc_bottom : %x\n", RELOC(alloc_bottom));
@@ -1830,11 +1830,13 @@ static void __init *make_room(unsigned long *mem_start, unsigned long *mem_end,
                 if (room > DEVTREE_CHUNK_SIZE)
                         room = DEVTREE_CHUNK_SIZE;
                 if (room < PAGE_SIZE)
-                        prom_panic("No memory for flatten_device_tree (no room)");
+                        prom_panic("No memory for flatten_device_tree "
+                                   "(no room)\n");
                 chunk = alloc_up(room, 0);
                 if (chunk == 0)
-                        prom_panic("No memory for flatten_device_tree (claim failed)");
-                *mem_end = RELOC(alloc_top);
+                        prom_panic("No memory for flatten_device_tree "
+                                   "(claim failed)\n");
+                *mem_end = chunk + room;
         }
 
         ret = (void *)*mem_start;
@@ -2042,7 +2044,7 @@ static void __init flatten_device_tree(void)
 
         /*
          * Check how much room we have between alloc top & bottom (+/- a
-         * few pages), crop to 4Mb, as this is our "chuck" size
+         * few pages), crop to 1MB, as this is our "chunk" size
          */
         room = RELOC(alloc_top) - RELOC(alloc_bottom) - 0x4000;
         if (room > DEVTREE_CHUNK_SIZE)
@@ -2053,7 +2055,7 @@ static void __init flatten_device_tree(void)
         mem_start = (unsigned long)alloc_up(room, PAGE_SIZE);
         if (mem_start == 0)
                 prom_panic("Can't allocate initial device-tree chunk\n");
-        mem_end = RELOC(alloc_top);
+        mem_end = mem_start + room;
 
         /* Get root of tree */
         root = call_prom("peer", 1, 1, (phandle)0);
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 6dd33581a228..de2950135e6e 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1251,7 +1251,7 @@ BEGIN_FTR_SECTION
         reg = 0
         .rept   32
         li      r6,reg*16+VCPU_VSRS
-        stxvd2x reg,r6,r3
+        STXVD2X(reg,r6,r3)
         reg = reg + 1
         .endr
 FTR_SECTION_ELSE
@@ -1313,7 +1313,7 @@ BEGIN_FTR_SECTION
         reg = 0
         .rept   32
         li      r7,reg*16+VCPU_VSRS
-        lxvd2x  reg,r7,r4
+        LXVD2X(reg,r7,r4)
         reg = reg + 1
         .endr
 FTR_SECTION_ELSE
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index d0af7fb2f344..b9ba86191aed 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -24,7 +24,7 @@ source "arch/powerpc/platforms/wsp/Kconfig"
 
 config KVM_GUEST
         bool "KVM Guest support"
-        default y
+        default n
         ---help---
           This option enables various optimizations for running under the KVM
           hypervisor. Overhead for the kernel when not running inside KVM should
diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
index e9190073bb97..0e8656370063 100644
--- a/arch/powerpc/platforms/pseries/dtl.c
+++ b/arch/powerpc/platforms/pseries/dtl.c
@@ -181,7 +181,7 @@ static void dtl_stop(struct dtl *dtl)
 
         lppaca_of(dtl->cpu).dtl_enable_mask = 0x0;
 
-        unregister_dtl(hwcpu, __pa(dtl->buf));
+        unregister_dtl(hwcpu);
 }
 
 static u64 dtl_current_index(struct dtl *dtl)
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index bc0288501f17..83a3ca2fd282 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -135,7 +135,7 @@ static void pseries_mach_cpu_die(void)
                 get_lppaca()->idle = 0;
 
                 if (get_preferred_offline_state(cpu) == CPU_STATE_ONLINE) {
-                        unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
+                        unregister_slb_shadow(hwcpu);
 
                         /*
                          * Call to start_secondary_resume() will not return.
@@ -150,7 +150,7 @@ static void pseries_mach_cpu_die(void)
         WARN_ON(get_preferred_offline_state(cpu) != CPU_STATE_OFFLINE);
 
         set_cpu_current_state(cpu, CPU_STATE_OFFLINE);
-        unregister_slb_shadow(hwcpu, __pa(get_slb_shadow()));
+        unregister_slb_shadow(hwcpu);
         rtas_stop_self();
 
         /* Should never get here... */
diff --git a/arch/powerpc/platforms/pseries/io_event_irq.c b/arch/powerpc/platforms/pseries/io_event_irq.c
index c829e6067d54..2c4dd1fb8333 100644
--- a/arch/powerpc/platforms/pseries/io_event_irq.c
+++ b/arch/powerpc/platforms/pseries/io_event_irq.c
@@ -212,17 +212,15 @@ static int __init ioei_init(void)
         struct device_node *np;
 
         ioei_check_exception_token = rtas_token("check-exception");
-        if (ioei_check_exception_token == RTAS_UNKNOWN_SERVICE) {
-                pr_warning("IO Event IRQ not supported on this system !\n");
+        if (ioei_check_exception_token == RTAS_UNKNOWN_SERVICE)
                 return -ENODEV;
-        }
+
         np = of_find_node_by_path("/event-sources/ibm,io-events");
         if (np) {
                 request_event_sources_irqs(np, ioei_interrupt, "IO_EVENT");
+                pr_info("IBM I/O event interrupts enabled\n");
                 of_node_put(np);
         } else {
-                pr_err("io_event_irq: No ibm,io-events on system! "
-                       "IO Event interrupt disabled.\n");
                 return -ENODEV;
         }
         return 0;
diff --git a/arch/powerpc/platforms/pseries/kexec.c b/arch/powerpc/platforms/pseries/kexec.c
index 54cf3a4aa16b..7d94bdc63d50 100644
--- a/arch/powerpc/platforms/pseries/kexec.c
+++ b/arch/powerpc/platforms/pseries/kexec.c
@@ -25,20 +25,30 @@ static void pseries_kexec_cpu_down(int crash_shutdown, int secondary)
 {
         /* Don't risk a hypervisor call if we're crashing */
         if (firmware_has_feature(FW_FEATURE_SPLPAR) && !crash_shutdown) {
-                unsigned long addr;
+                int ret;
+                int cpu = smp_processor_id();
+                int hwcpu = hard_smp_processor_id();
 
-                addr = __pa(get_slb_shadow());
-                if (unregister_slb_shadow(hard_smp_processor_id(), addr))
-                        printk("SLB shadow buffer deregistration of "
-                               "cpu %u (hw_cpu_id %d) failed\n",
-                               smp_processor_id(),
-                               hard_smp_processor_id());
+                if (get_lppaca()->dtl_enable_mask) {
+                        ret = unregister_dtl(hwcpu);
+                        if (ret) {
+                                pr_err("WARNING: DTL deregistration for cpu "
+                                       "%d (hw %d) failed with %d\n",
+                                       cpu, hwcpu, ret);
+                        }
+                }
+
+                ret = unregister_slb_shadow(hwcpu);
+                if (ret) {
+                        pr_err("WARNING: SLB shadow buffer deregistration "
+                               "for cpu %d (hw %d) failed with %d\n",
+                               cpu, hwcpu, ret);
+                }
 
-                addr = __pa(get_lppaca());
-                if (unregister_vpa(hard_smp_processor_id(), addr)) {
-                        printk("VPA deregistration of cpu %u (hw_cpu_id %d) "
-                                        "failed\n", smp_processor_id(),
-                                        hard_smp_processor_id());
+                ret = unregister_vpa(hwcpu);
+                if (ret) {
+                        pr_err("WARNING: VPA deregistration for cpu %d "
+                               "(hw %d) failed with %d\n", cpu, hwcpu, ret);
                 }
         }
 }
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index f7205d344efd..c9a29dae8c05 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -67,9 +67,8 @@ void vpa_init(int cpu)
         ret = register_vpa(hwcpu, addr);
 
         if (ret) {
-                printk(KERN_ERR "WARNING: vpa_init: VPA registration for "
-                                "cpu %d (hw %d) of area %lx returns %ld\n",
-                                cpu, hwcpu, addr, ret);
+                pr_err("WARNING: VPA registration for cpu %d (hw %d) of area "
+                       "%lx failed with %ld\n", cpu, hwcpu, addr, ret);
                 return;
         }
         /*
@@ -80,10 +79,9 @@ void vpa_init(int cpu)
         if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
                 ret = register_slb_shadow(hwcpu, addr);
                 if (ret)
-                        printk(KERN_ERR
-                               "WARNING: vpa_init: SLB shadow buffer "
-                               "registration for cpu %d (hw %d) of area %lx "
-                               "returns %ld\n", cpu, hwcpu, addr, ret);
+                        pr_err("WARNING: SLB shadow buffer registration for "
+                               "cpu %d (hw %d) of area %lx failed with %ld\n",
+                               cpu, hwcpu, addr, ret);
         }
 
         /*
@@ -100,8 +98,9 @@ void vpa_init(int cpu)
                 dtl->enqueue_to_dispatch_time = DISPATCH_LOG_BYTES;
                 ret = register_dtl(hwcpu, __pa(dtl));
                 if (ret)
-                        pr_warn("DTL registration failed for cpu %d (%ld)\n",
-                                cpu, ret);
+                        pr_err("WARNING: DTL registration of cpu %d (hw %d) "
+                               "failed with %ld\n", smp_processor_id(),
+                               hwcpu, ret);
                 lppaca_of(cpu).dtl_enable_mask = 2;
         }
 }
@@ -204,7 +203,7 @@ static void pSeries_lpar_hptab_clear(void)
                 unsigned long ptel;
         } ptes[4];
         long lpar_rc;
-        int i, j;
+        unsigned long i, j;
 
         /* Read in batches of 4,
          * invalidate only valid entries not in the VRMA
diff --git a/arch/powerpc/platforms/pseries/plpar_wrappers.h b/arch/powerpc/platforms/pseries/plpar_wrappers.h
index 4bf21207d7d3..41c24c146d6a 100644
--- a/arch/powerpc/platforms/pseries/plpar_wrappers.h
+++ b/arch/powerpc/platforms/pseries/plpar_wrappers.h
@@ -53,9 +53,9 @@ static inline long vpa_call(unsigned long flags, unsigned long cpu,
         return plpar_hcall_norets(H_REGISTER_VPA, flags, cpu, vpa);
 }
 
-static inline long unregister_vpa(unsigned long cpu, unsigned long vpa)
+static inline long unregister_vpa(unsigned long cpu)
 {
-        return vpa_call(0x5, cpu, vpa);
+        return vpa_call(0x5, cpu, 0);
 }
 
 static inline long register_vpa(unsigned long cpu, unsigned long vpa)
@@ -63,9 +63,9 @@ static inline long register_vpa(unsigned long cpu, unsigned long vpa)
         return vpa_call(0x1, cpu, vpa);
 }
 
-static inline long unregister_slb_shadow(unsigned long cpu, unsigned long vpa)
+static inline long unregister_slb_shadow(unsigned long cpu)
 {
-        return vpa_call(0x7, cpu, vpa);
+        return vpa_call(0x7, cpu, 0);
 }
 
 static inline long register_slb_shadow(unsigned long cpu, unsigned long vpa)
@@ -73,9 +73,9 @@ static inline long register_slb_shadow(unsigned long cpu, unsigned long vpa)
         return vpa_call(0x3, cpu, vpa);
 }
 
-static inline long unregister_dtl(unsigned long cpu, unsigned long vpa)
+static inline long unregister_dtl(unsigned long cpu)
 {
-        return vpa_call(0x6, cpu, vpa);
+        return vpa_call(0x6, cpu, 0);
 }
 
 static inline long register_dtl(unsigned long cpu, unsigned long vpa)
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index d00e52926b71..0969fd98c4fa 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -324,8 +324,9 @@ static int alloc_dispatch_logs(void)
         dtl->enqueue_to_dispatch_time = DISPATCH_LOG_BYTES;
         ret = register_dtl(hard_smp_processor_id(), __pa(dtl));
         if (ret)
-                pr_warn("DTL registration failed for boot cpu %d (%d)\n",
-                        smp_processor_id(), ret);
+                pr_err("WARNING: DTL registration of cpu %d (hw %d) failed "
+                       "with %d\n", smp_processor_id(),
+                       hard_smp_processor_id(), ret);
         get_paca()->lppaca_ptr->dtl_enable_mask = 2;
 
         return 0;
diff --git a/arch/powerpc/sysdev/ppc4xx_pci.c b/arch/powerpc/sysdev/ppc4xx_pci.c
index a59ba96d2c21..dbfe96bc878a 100644
--- a/arch/powerpc/sysdev/ppc4xx_pci.c
+++ b/arch/powerpc/sysdev/ppc4xx_pci.c
@@ -655,8 +655,6 @@ struct ppc4xx_pciex_hwops
 
 static struct ppc4xx_pciex_hwops *ppc4xx_pciex_hwops;
 
-#ifdef CONFIG_44x
-
 static int __init ppc4xx_pciex_wait_on_sdr(struct ppc4xx_pciex_port *port,
                                            unsigned int sdr_offset,
                                            unsigned int mask,
@@ -688,6 +686,7 @@ static int __init ppc4xx_pciex_port_reset_sdr(struct ppc4xx_pciex_port *port)
         return 0;
 }
 
+
 static void __init ppc4xx_pciex_check_link_sdr(struct ppc4xx_pciex_port *port)
 {
         printk(KERN_INFO "PCIE%d: Checking link...\n", port->index);
@@ -718,6 +717,8 @@ static void __init ppc4xx_pciex_check_link_sdr(struct ppc4xx_pciex_port *port)
                 printk(KERN_INFO "PCIE%d: No device detected.\n", port->index);
 }
 
+#ifdef CONFIG_44x
+
 /* Check various reset bits of the 440SPe PCIe core */
 static int __init ppc440spe_pciex_check_reset(struct device_node *np)
 {
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 42c67beadcae..1a6f20d4e7e6 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -55,6 +55,7 @@ config SPARC64
         select PERF_USE_VMALLOC
         select IRQ_PREFLOW_FASTEOI
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
+        select HAVE_C_RECORDMCOUNT
 
 config ARCH_DEFCONFIG
         string
diff --git a/arch/sparc/include/asm/spinlock_32.h b/arch/sparc/include/asm/spinlock_32.h
index 5f5b8bf3f50d..bcc98fc35281 100644
--- a/arch/sparc/include/asm/spinlock_32.h
+++ b/arch/sparc/include/asm/spinlock_32.h
@@ -131,6 +131,15 @@ static inline void arch_write_lock(arch_rwlock_t *rw)
         *(volatile __u32 *)&lp->lock = ~0U;
 }
 
+static void inline arch_write_unlock(arch_rwlock_t *lock)
+{
+        __asm__ __volatile__(
+"       st              %%g0, [%0]"
+        : /* no outputs */
+        : "r" (lock)
+        : "memory");
+}
+
 static inline int arch_write_trylock(arch_rwlock_t *rw)
 {
         unsigned int val;
@@ -175,8 +184,6 @@ static inline int __arch_read_trylock(arch_rwlock_t *rw)
         res; \
 })
 
-#define arch_write_unlock(rw)   do { (rw)->lock = 0; } while(0)
-
 #define arch_spin_lock_flags(lock, flags) arch_spin_lock(lock)
 #define arch_read_lock_flags(rw, flags)   arch_read_lock(rw)
 #define arch_write_lock_flags(rw, flags)  arch_write_lock(rw)
diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
index 073936a8b275..968917694978 100644
--- a/arch/sparc/include/asm/spinlock_64.h
+++ b/arch/sparc/include/asm/spinlock_64.h
@@ -210,14 +210,8 @@ static int inline arch_write_trylock(arch_rwlock_t *lock)
         return result;
 }
 
-#define arch_read_lock(p)       arch_read_lock(p)
 #define arch_read_lock_flags(p, f) arch_read_lock(p)
-#define arch_read_trylock(p)    arch_read_trylock(p)
-#define arch_read_unlock(p)     arch_read_unlock(p)
-#define arch_write_lock(p)      arch_write_lock(p)
 #define arch_write_lock_flags(p, f) arch_write_lock(p)
-#define arch_write_unlock(p)    arch_write_unlock(p)
-#define arch_write_trylock(p)   arch_write_trylock(p)
 
 #define arch_read_can_lock(rw)          (!((rw)->lock & 0x80000000UL))
 #define arch_write_can_lock(rw) (!(rw)->lock)
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index 490e5418740d..7429b47c3aca 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -1256,13 +1256,14 @@ static int __init ds_init(void)
 {
         unsigned long hv_ret, major, minor;
 
-        hv_ret = sun4v_get_version(HV_GRP_REBOOT_DATA, &major, &minor);
-        if (hv_ret == HV_EOK) {
-                pr_info("SUN4V: Reboot data supported (maj=%lu,min=%lu).\n",
-                        major, minor);
-                reboot_data_supported = 1;
+        if (tlb_type == hypervisor) {
+                hv_ret = sun4v_get_version(HV_GRP_REBOOT_DATA, &major, &minor);
+                if (hv_ret == HV_EOK) {
+                        pr_info("SUN4V: Reboot data supported (maj=%lu,min=%lu).\n",
+                                major, minor);
+                        reboot_data_supported = 1;
+                }
         }
-
         kthread_run(ds_thread, NULL, "kldomd");
 
         return vio_register_driver(&ds_driver);
diff --git a/arch/sparc/kernel/pcic.c b/arch/sparc/kernel/pcic.c
index a19f04195478..1aaf8c180be5 100644
--- a/arch/sparc/kernel/pcic.c
+++ b/arch/sparc/kernel/pcic.c
@@ -352,8 +352,8 @@ int __init pcic_probe(void)
         strcpy(pbm->prom_name, namebuf);
 
         {
-                extern volatile int t_nmi[1];
-                extern int pcic_nmi_trap_patch[1];
+                extern volatile int t_nmi[4];
+                extern int pcic_nmi_trap_patch[4];
 
                 t_nmi[0] = pcic_nmi_trap_patch[0];
                 t_nmi[1] = pcic_nmi_trap_patch[1];
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index 7b439d9aea2a..41935fadfdfc 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -27,8 +27,8 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
 
         desc->base2             = (info->base_addr & 0xff000000) >> 24;
         /*
-         * Don't allow setting of the lm bit. It is useless anyway
-         * because 64bit system calls require __USER_CS:
+         * Don't allow setting of the lm bit. It would confuse
+         * user_64bit_mode and would get overridden by sysret anyway.
          */
         desc->l                 = 0;
 }
diff --git a/arch/x86/include/asm/irq_vectors.h b/arch/x86/include/asm/irq_vectors.h
index f9a320984a10..7e50f06393aa 100644
--- a/arch/x86/include/asm/irq_vectors.h
+++ b/arch/x86/include/asm/irq_vectors.h
@@ -17,7 +17,6 @@
  *  Vectors   0 ...  31 : system traps and exceptions - hardcoded events
  *  Vectors  32 ... 127 : device interrupts
  *  Vector  128         : legacy int80 syscall interface
- *  Vector  204         : legacy x86_64 vsyscall emulation
  *  Vectors 129 ... INVALIDATE_TLB_VECTOR_START-1 except 204 : device interrupts
  *  Vectors INVALIDATE_TLB_VECTOR_START ... 255 : special interrupts
  *
@@ -51,9 +50,6 @@
 #ifdef CONFIG_X86_32
 # define SYSCALL_VECTOR                 0x80
 #endif
-#ifdef CONFIG_X86_64
-# define VSYSCALL_EMU_VECTOR            0xcc
-#endif
 
 /*
  * Vectors 0x30-0x3f are used for ISA interrupts.
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 2c7652163111..8e8b9a4987ee 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -41,6 +41,7 @@
 
 #include <asm/desc_defs.h>
 #include <asm/kmap_types.h>
+#include <asm/pgtable_types.h>
 
 struct page;
 struct thread_struct;
@@ -63,6 +64,11 @@ struct paravirt_callee_save {
 struct pv_info {
         unsigned int kernel_rpl;
         int shared_kernel_pmd;
+
+#ifdef CONFIG_X86_64
+        u16 extra_user_64bit_cs;  /* __USER_CS if none */
+#endif
+
         int paravirt_enabled;
         const char *name;
 };
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 94e7618fcac8..35664547125b 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -131,6 +131,9 @@ struct pt_regs {
 #ifdef __KERNEL__
 
 #include <linux/init.h>
+#ifdef CONFIG_PARAVIRT
+#include <asm/paravirt_types.h>
+#endif
 
 struct cpuinfo_x86;
 struct task_struct;
@@ -187,6 +190,22 @@ static inline int v8086_mode(struct pt_regs *regs)
 #endif
 }
 
+#ifdef CONFIG_X86_64
+static inline bool user_64bit_mode(struct pt_regs *regs)
+{
+#ifndef CONFIG_PARAVIRT
+        /*
+         * On non-paravirt systems, this is the only long mode CPL 3
+         * selector.  We do not allow long mode selectors in the LDT.
+         */
+        return regs->cs == __USER_CS;
+#else
+        /* Headers are too twisted for this to go in paravirt.h. */
+        return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
+#endif
+}
+#endif
+
 /*
  * X86_32 CPUs don't save ss and esp if the CPU is already in kernel mode
  * when it traps.  The previous stack will be directly underneath the saved
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 2bae0a513b40..0012d0902c5f 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -40,7 +40,6 @@ asmlinkage void alignment_check(void);
 asmlinkage void machine_check(void);
 #endif /* CONFIG_X86_MCE */
 asmlinkage void simd_coprocessor_error(void);
-asmlinkage void emulate_vsyscall(void);
 
 dotraplinkage void do_divide_error(struct pt_regs *, long);
 dotraplinkage void do_debug(struct pt_regs *, long);
@@ -67,7 +66,6 @@ dotraplinkage void do_alignment_check(struct pt_regs *, long);
 dotraplinkage void do_machine_check(struct pt_regs *, long);
 #endif
 dotraplinkage void do_simd_coprocessor_error(struct pt_regs *, long);
-dotraplinkage void do_emulate_vsyscall(struct pt_regs *, long);
 #ifdef CONFIG_X86_32
 dotraplinkage void do_iret_error(struct pt_regs *, long);
 #endif
diff --git a/arch/x86/include/asm/unistd_64.h b/arch/x86/include/asm/unistd_64.h
index 705bf139288c..d92641cc7acc 100644
--- a/arch/x86/include/asm/unistd_64.h
+++ b/arch/x86/include/asm/unistd_64.h
@@ -681,6 +681,8 @@ __SYSCALL(__NR_syncfs, sys_syncfs)
 __SYSCALL(__NR_sendmmsg, sys_sendmmsg)
 #define __NR_setns                              308
 __SYSCALL(__NR_setns, sys_setns)
+#define __NR_getcpu                             309
+__SYSCALL(__NR_getcpu, sys_getcpu)
 
 #ifndef __NO_STUBS
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
index 60107072c28b..eaea1d31f753 100644
--- a/arch/x86/include/asm/vsyscall.h
+++ b/arch/x86/include/asm/vsyscall.h
@@ -27,6 +27,12 @@ extern struct timezone sys_tz;
 
 extern void map_vsyscall(void);
 
+/*
+ * Called on instruction fetch fault in vsyscall page.
+ * Returns true if handled.
+ */
+extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address);
+
 #endif /* __KERNEL__ */
 
 #endif /* _ASM_X86_VSYSCALL_H */
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 04105574c8e9..82f2912155a5 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -17,19 +17,6 @@ CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_early_printk.o = -pg
 endif
 
-#
-# vsyscalls (which work on the user stack) should have
-# no stack-protector checks:
-#
-nostackp := $(call cc-option, -fno-stack-protector)
-CFLAGS_vsyscall_64.o    := $(PROFILING) -g0 $(nostackp)
-CFLAGS_hpet.o           := $(nostackp)
-CFLAGS_paravirt.o       := $(nostackp)
-GCOV_PROFILE_vsyscall_64.o      := n
-GCOV_PROFILE_hpet.o             := n
-GCOV_PROFILE_tsc.o              := n
-GCOV_PROFILE_paravirt.o         := n
-
 obj-y                   := process_$(BITS).o signal.o entry_$(BITS).o
 obj-y                   += traps.o irq.o irq_$(BITS).o dumpstack_$(BITS).o
 obj-y                   += time.o ioport.o ldt.o dumpstack.o
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 45fbb8f7f549..f88af2c2a561 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1590,6 +1590,7 @@ static __init int intel_pmu_init(void)
                 break;
 
         case 42: /* SandyBridge */
+        case 45: /* SandyBridge, "Romely-EP" */
                 memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
 
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index e13329d800c8..6419bb05ecd5 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1111,7 +1111,6 @@ zeroentry spurious_interrupt_bug do_spurious_interrupt_bug
 zeroentry coprocessor_error do_coprocessor_error
 errorentry alignment_check do_alignment_check
 zeroentry simd_coprocessor_error do_simd_coprocessor_error
-zeroentry emulate_vsyscall do_emulate_vsyscall
 
 
         /* Reload gs selector with exception handling */
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 613a7931ecc1..d90272e6bc40 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -307,6 +307,10 @@ struct pv_info pv_info = {
         .paravirt_enabled = 0,
         .kernel_rpl = 0,
         .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
+
+#ifdef CONFIG_X86_64
+        .extra_user_64bit_cs = __USER_CS,
+#endif
 };
 
 struct pv_init_ops pv_init_ops = {
diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
index 7977f0cfe339..c346d1161488 100644
--- a/arch/x86/kernel/step.c
+++ b/arch/x86/kernel/step.c
@@ -74,7 +74,7 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
 
 #ifdef CONFIG_X86_64
                 case 0x40 ... 0x4f:
-                        if (regs->cs != __USER_CS)
+                        if (!user_64bit_mode(regs))
                                 /* 32-bit mode: register increment */
                                 return 0;
                         /* 64-bit mode: REX prefix */
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 9682ec50180c..6913369c234c 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -872,12 +872,6 @@ void __init trap_init(void)
         set_bit(SYSCALL_VECTOR, used_vectors);
 #endif
 
-#ifdef CONFIG_X86_64
-        BUG_ON(test_bit(VSYSCALL_EMU_VECTOR, used_vectors));
-        set_system_intr_gate(VSYSCALL_EMU_VECTOR, &emulate_vsyscall);
-        set_bit(VSYSCALL_EMU_VECTOR, used_vectors);
-#endif
-
         /*
          * Should be a barrier for any external CPU state:
          */
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 4aa9c54a9b76..0f703f10901a 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -71,7 +71,6 @@ PHDRS {
         text PT_LOAD FLAGS(5);          /* R_E */
         data PT_LOAD FLAGS(6);          /* RW_ */
 #ifdef CONFIG_X86_64
-        user PT_LOAD FLAGS(5);          /* R_E */
 #ifdef CONFIG_SMP
         percpu PT_LOAD FLAGS(6);        /* RW_ */
 #endif
@@ -154,44 +153,16 @@ SECTIONS
 
 #ifdef CONFIG_X86_64
 
-#define VSYSCALL_ADDR (-10*1024*1024)
-
-#define VLOAD_OFFSET (VSYSCALL_ADDR - __vsyscall_0 + LOAD_OFFSET)
-#define VLOAD(x) (ADDR(x) - VLOAD_OFFSET)
-
-#define VVIRT_OFFSET (VSYSCALL_ADDR - __vsyscall_0)
-#define VVIRT(x) (ADDR(x) - VVIRT_OFFSET)
-
-        . = ALIGN(4096);
-        __vsyscall_0 = .;
-
-        . = VSYSCALL_ADDR;
-        .vsyscall : AT(VLOAD(.vsyscall)) {
-                *(.vsyscall_0)
-
-                . = 1024;
-                *(.vsyscall_1)
-
-                . = 2048;
-                *(.vsyscall_2)
-
-                . = 4096;  /* Pad the whole page. */
-        } :user =0xcc
-        . = ALIGN(__vsyscall_0 + PAGE_SIZE, PAGE_SIZE);
-
-#undef VSYSCALL_ADDR
-#undef VLOAD_OFFSET
-#undef VLOAD
-#undef VVIRT_OFFSET
-#undef VVIRT
-
+        . = ALIGN(PAGE_SIZE);
         __vvar_page = .;
 
         .vvar : AT(ADDR(.vvar) - LOAD_OFFSET) {
+                /* work around gold bug 13023 */
+                __vvar_beginning_hack = .;
 
-              /* Place all vvars at the offsets in asm/vvar.h. */
-#define EMIT_VVAR(name, offset)                 \
-                . = offset;             \
+                /* Place all vvars at the offsets in asm/vvar.h. */
+#define EMIT_VVAR(name, offset)                         \
+                . = __vvar_beginning_hack + offset;     \
                 *(.vvar_ ## name)
 #define __VVAR_KERNEL_LDS
 #include <asm/vvar.h>
diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
index dda7dff9cef7..18ae83dd1cd7 100644
--- a/arch/x86/kernel/vsyscall_64.c
+++ b/arch/x86/kernel/vsyscall_64.c
@@ -18,9 +18,6 @@
  *  use the vDSO.
  */
 
-/* Disable profiling for userspace code: */
-#define DISABLE_BRANCH_PROFILING
-
 #include <linux/time.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -50,12 +47,36 @@
 #include <asm/vgtod.h>
 #include <asm/traps.h>
 
+#define CREATE_TRACE_POINTS
+#include "vsyscall_trace.h"
+
 DEFINE_VVAR(int, vgetcpu_mode);
 DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
 {
         .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
 };
 
+static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
+
+static int __init vsyscall_setup(char *str)
+{
+        if (str) {
+                if (!strcmp("emulate", str))
+                        vsyscall_mode = EMULATE;
+                else if (!strcmp("native", str))
+                        vsyscall_mode = NATIVE;
+                else if (!strcmp("none", str))
+                        vsyscall_mode = NONE;
+                else
+                        return -EINVAL;
+
+                return 0;
+        }
+
+        return -EINVAL;
+}
+early_param("vsyscall", vsyscall_setup);
+
 void update_vsyscall_tz(void)
 {
         unsigned long flags;
@@ -100,7 +121,7 @@ static void warn_bad_vsyscall(const char *level, struct pt_regs *regs,
 
         printk("%s%s[%d] %s ip:%lx cs:%lx sp:%lx ax:%lx si:%lx di:%lx\n",
                level, tsk->comm, task_pid_nr(tsk),
-               message, regs->ip - 2, regs->cs,
+               message, regs->ip, regs->cs,
                regs->sp, regs->ax, regs->si, regs->di);
 }
 
@@ -118,46 +139,39 @@ static int addr_to_vsyscall_nr(unsigned long addr)
         return nr;
 }
 
-void dotraplinkage do_emulate_vsyscall(struct pt_regs *regs, long error_code)
+bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 {
         struct task_struct *tsk;
         unsigned long caller;
         int vsyscall_nr;
         long ret;
 
-        local_irq_enable();
-
         /*
-         * Real 64-bit user mode code has cs == __USER_CS.  Anything else
-         * is bogus.
+         * No point in checking CS -- the only way to get here is a user mode
+         * trap to a high address, which means that we're in 64-bit user code.
          */
-        if (regs->cs != __USER_CS) {
-                /*
-                 * If we trapped from kernel mode, we might as well OOPS now
-                 * instead of returning to some random address and OOPSing
-                 * then.
-                 */
-                BUG_ON(!user_mode(regs));
 
-                /* Compat mode and non-compat 32-bit CS should both segfault. */
-                warn_bad_vsyscall(KERN_WARNING, regs,
-                                  "illegal int 0xcc from 32-bit mode");
-                goto sigsegv;
+        WARN_ON_ONCE(address != regs->ip);
+
+        if (vsyscall_mode == NONE) {
+                warn_bad_vsyscall(KERN_INFO, regs,
+                                  "vsyscall attempted with vsyscall=none");
+                return false;
         }
 
-        /*
-         * x86-ism here: regs->ip points to the instruction after the int 0xcc,
-         * and int 0xcc is two bytes long.
-         */
-        vsyscall_nr = addr_to_vsyscall_nr(regs->ip - 2);
+        vsyscall_nr = addr_to_vsyscall_nr(address);
+
+        trace_emulate_vsyscall(vsyscall_nr);
+
         if (vsyscall_nr < 0) {
                 warn_bad_vsyscall(KERN_WARNING, regs,
-                                  "illegal int 0xcc (exploit attempt?)");
+                                  "misaligned vsyscall (exploit attempt or buggy program) -- look up the vsyscall kernel parameter if you need a workaround");
                 goto sigsegv;
         }
 
         if (get_user(caller, (unsigned long __user *)regs->sp) != 0) {
-                warn_bad_vsyscall(KERN_WARNING, regs, "int 0xcc with bad stack (exploit attempt?)");
+                warn_bad_vsyscall(KERN_WARNING, regs,
+                                  "vsyscall with bad stack (exploit attempt?)");
                 goto sigsegv;
         }
 
@@ -202,13 +216,11 @@ void dotraplinkage do_emulate_vsyscall(struct pt_regs *regs, long error_code)
         regs->ip = caller;
         regs->sp += 8;
 
-        local_irq_disable();
-        return;
+        return true;
 
 sigsegv:
-        regs->ip -= 2;  /* The faulting instruction should be the int 0xcc. */
         force_sig(SIGSEGV, current);
-        local_irq_disable();
+        return true;
 }
 
 /*
@@ -256,15 +268,21 @@ cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
 
 void __init map_vsyscall(void)
 {
-        extern char __vsyscall_0;
-        unsigned long physaddr_page0 = __pa_symbol(&__vsyscall_0);
+        extern char __vsyscall_page;
+        unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
         extern char __vvar_page;
         unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
 
-        /* Note that VSYSCALL_MAPPED_PAGES must agree with the code below. */
-        __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_page0, PAGE_KERNEL_VSYSCALL);
+        __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
+                     vsyscall_mode == NATIVE
+                     ? PAGE_KERNEL_VSYSCALL
+                     : PAGE_KERNEL_VVAR);
+        BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
+                     (unsigned long)VSYSCALL_START);
+
         __set_fixmap(VVAR_PAGE, physaddr_vvar_page, PAGE_KERNEL_VVAR);
-        BUILD_BUG_ON((unsigned long)__fix_to_virt(VVAR_PAGE) != (unsigned long)VVAR_ADDRESS);
+        BUILD_BUG_ON((unsigned long)__fix_to_virt(VVAR_PAGE) !=
+                     (unsigned long)VVAR_ADDRESS);
 }
 
 static int __init vsyscall_init(void)
diff --git a/arch/x86/kernel/vsyscall_emu_64.S b/arch/x86/kernel/vsyscall_emu_64.S
index ffa845eae5ca..c9596a9af159 100644
--- a/arch/x86/kernel/vsyscall_emu_64.S
+++ b/arch/x86/kernel/vsyscall_emu_64.S
@@ -7,21 +7,31 @@
  */
 
 #include <linux/linkage.h>
+
 #include <asm/irq_vectors.h>
+#include <asm/page_types.h>
+#include <asm/unistd_64.h>
+
+__PAGE_ALIGNED_DATA
+        .globl __vsyscall_page
+        .balign PAGE_SIZE, 0xcc
+        .type __vsyscall_page, @object
+__vsyscall_page:
+
+        mov $__NR_gettimeofday, %rax
+        syscall
+        ret
 
-/* The unused parts of the page are filled with 0xcc by the linker script. */
+        .balign 1024, 0xcc
+        mov $__NR_time, %rax
+        syscall
+        ret
 
-.section .vsyscall_0, "a"
-ENTRY(vsyscall_0)
-        int $VSYSCALL_EMU_VECTOR
-END(vsyscall_0)
+        .balign 1024, 0xcc
+        mov $__NR_getcpu, %rax
+        syscall
+        ret
 
-.section .vsyscall_1, "a"
-ENTRY(vsyscall_1)
-        int $VSYSCALL_EMU_VECTOR
-END(vsyscall_1)
+        .balign 4096, 0xcc
 
-.section .vsyscall_2, "a"
-ENTRY(vsyscall_2)
-        int $VSYSCALL_EMU_VECTOR
-END(vsyscall_2)
+        .size __vsyscall_page, 4096
diff --git a/arch/x86/kernel/vsyscall_trace.h b/arch/x86/kernel/vsyscall_trace.h
new file mode 100644
index 000000000000..a8b2edec54fe
--- /dev/null
+++ b/arch/x86/kernel/vsyscall_trace.h
@@ -0,0 +1,29 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM vsyscall
+
+#if !defined(__VSYSCALL_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define __VSYSCALL_TRACE_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(emulate_vsyscall,
+
+            TP_PROTO(int nr),
+
+            TP_ARGS(nr),
+
+            TP_STRUCT__entry(__field(int, nr)),
+
+            TP_fast_assign(
+                           __entry->nr = nr;
+                           ),
+
+            TP_printk("nr = %d", __entry->nr)
+);
+
+#endif
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH ../../arch/x86/kernel
+#define TRACE_INCLUDE_FILE vsyscall_trace
+#include <trace/define_trace.h>
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 988724b236b6..ff5790d8e990 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -22,6 +22,8 @@ config KVM
         depends on HAVE_KVM
         # for device assignment:
         depends on PCI
+        # for TASKSTATS/TASK_DELAY_ACCT:
+        depends on NET
         select PREEMPT_NOTIFIERS
         select MMU_NOTIFIER
         select ANON_INODES
@@ -31,6 +33,7 @@ config KVM
         select KVM_ASYNC_PF
         select USER_RETURN_NOTIFIER
         select KVM_MMIO
+        select TASKSTATS
         select TASK_DELAY_ACCT
         ---help---
           Support hosting fully virtualized guest machines using hardware
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 4d09df054e39..0d17c8c50acd 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -17,6 +17,7 @@
 #include <asm/traps.h>                  /* dotraplinkage, ...           */
 #include <asm/pgalloc.h>                /* pgd_*(), ...                 */
 #include <asm/kmemcheck.h>              /* kmemcheck_*(), ...           */
+#include <asm/vsyscall.h>
 
 /*
  * Page fault error code bits:
@@ -105,7 +106,7 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
                  * but for now it's good enough to assume that long
                  * mode only uses well known segments or kernel.
                  */
-                return (!user_mode(regs)) || (regs->cs == __USER_CS);
+                return (!user_mode(regs) || user_64bit_mode(regs));
 #endif
         case 0x60:
                 /* 0x64 thru 0x67 are valid prefixes in all modes. */
@@ -720,6 +721,18 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
                 if (is_errata100(regs, address))
                         return;
 
+#ifdef CONFIG_X86_64
+                /*
+                 * Instruction fetch faults in the vsyscall page might need
+                 * emulation.
+                 */
+                if (unlikely((error_code & PF_INSTR) &&
+                             ((address & ~0xfff) == VSYSCALL_START))) {
+                        if (emulate_vsyscall(regs, address))
+                                return;
+                }
+#endif
+
                 if (unlikely(show_unhandled_signals))
                         show_signal_msg(regs, error_code, address, tsk);
 
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index ae3cb23cd89b..c95330267f08 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -360,6 +360,15 @@ struct pci_bus * __devinit pci_acpi_scan_root(struct acpi_pci_root *root)
                 }
         }
 
+        /* After the PCI-E bus has been walked and all devices discovered,
+         * configure any settings of the fabric that might be necessary.
+         */
+        if (bus) {
+                struct pci_bus *child;
+                list_for_each_entry(child, &bus->children, node)
+                        pcie_bus_configure_settings(child, child->self->pcie_mpss);
+        }
+
         if (!bus)
                 kfree(sd);
 
diff --git a/arch/x86/vdso/vdso.S b/arch/x86/vdso/vdso.S
index 1b979c12ba85..01f5e3b4613c 100644
--- a/arch/x86/vdso/vdso.S
+++ b/arch/x86/vdso/vdso.S
@@ -9,6 +9,7 @@ __PAGE_ALIGNED_DATA
 vdso_start:
         .incbin "arch/x86/vdso/vdso.so"
 vdso_end:
+        .align PAGE_SIZE /* extra data here leaks to userspace. */
 
 .previous
 
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 974a528458a0..e2345af01af0 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -951,6 +951,10 @@ static const struct pv_info xen_info __initconst = {
         .paravirt_enabled = 1,
         .shared_kernel_pmd = 0,
 
+#ifdef CONFIG_X86_64
+        .extra_user_64bit_cs = FLAT_USER_CS64,
+#endif
+
         .name = "Xen",
 };
 
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index f987bde77c49..8cce339db5e7 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1916,6 +1916,7 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 # endif
 #else
         case VSYSCALL_LAST_PAGE ... VSYSCALL_FIRST_PAGE:
+        case VVAR_PAGE:
 #endif
         case FIX_TEXT_POKE0:
         case FIX_TEXT_POKE1:
@@ -1956,7 +1957,8 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 #ifdef CONFIG_X86_64
         /* Replicate changes to map the vsyscall page into the user
            pagetable vsyscall mapping. */
-        if (idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) {
+        if ((idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) ||
+            idx == VVAR_PAGE) {
                 unsigned long vaddr = __fix_to_virt(idx);
                 set_pte_vaddr_pud(level3_user_vsyscall, vaddr, pte);
         }
diff --git a/block/Kconfig b/block/Kconfig
index 60be1e0455da..e97934eececa 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -65,6 +65,16 @@ config BLK_DEV_BSG
 
           If unsure, say Y.
 
+config BLK_DEV_BSGLIB
+        bool "Block layer SG support v4 helper lib"
+        default n
+        select BLK_DEV_BSG
+        help
+          Subsystems will normally enable this if needed. Users will not
+          normally need to manually enable this.
+
+          If unsure, say N.
+
 config BLK_DEV_INTEGRITY
         bool "Block layer data integrity support"
         ---help---
diff --git a/block/Makefile b/block/Makefile
index 0fec4b3fab51..514c6e4f427a 100644
--- a/block/Makefile
+++ b/block/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_BLOCK) := elevator.o blk-core.o blk-tag.o blk-sysfs.o \
                         blk-iopoll.o blk-lib.o ioctl.o genhd.o scsi_ioctl.o
 
 obj-$(CONFIG_BLK_DEV_BSG)       += bsg.o
+obj-$(CONFIG_BLK_DEV_BSGLIB)    += bsg-lib.o
 obj-$(CONFIG_BLK_CGROUP)        += blk-cgroup.o
 obj-$(CONFIG_BLK_DEV_THROTTLING)        += blk-throttle.o
 obj-$(CONFIG_IOSCHED_NOOP)      += noop-iosched.o
diff --git a/block/blk-core.c b/block/blk-core.c
index b627558c461f..90e1ffdeb415 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1702,6 +1702,7 @@ EXPORT_SYMBOL_GPL(blk_rq_check_limits);
 int blk_insert_cloned_request(struct request_queue *q, struct request *rq)
 {
         unsigned long flags;
+        int where = ELEVATOR_INSERT_BACK;
 
         if (blk_rq_check_limits(q, rq))
                 return -EIO;
@@ -1718,7 +1719,10 @@ int blk_insert_cloned_request(struct request_queue *q, struct request *rq)
          */
         BUG_ON(blk_queued_rq(rq));
 
-        add_acct_request(q, rq, ELEVATOR_INSERT_BACK);
+        if (rq->cmd_flags & (REQ_FLUSH|REQ_FUA))
+                where = ELEVATOR_INSERT_FLUSH;
+
+        add_acct_request(q, rq, where);
         spin_unlock_irqrestore(q->queue_lock, flags);
 
         return 0;
@@ -2275,7 +2279,7 @@ static bool blk_end_bidi_request(struct request *rq, int error,
  *     %false - we are done with this request
  *     %true  - still buffers pending for this request
  **/
-static bool __blk_end_bidi_request(struct request *rq, int error,
+bool __blk_end_bidi_request(struct request *rq, int error,
                                    unsigned int nr_bytes, unsigned int bidi_bytes)
 {
         if (blk_update_bidi_request(rq, error, nr_bytes, bidi_bytes))
diff --git a/block/blk-flush.c b/block/blk-flush.c
index bb21e4c36f70..491eb30a242d 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -95,11 +95,12 @@ static unsigned int blk_flush_policy(unsigned int fflags, struct request *rq)
 {
         unsigned int policy = 0;
 
+        if (blk_rq_sectors(rq))
+                policy |= REQ_FSEQ_DATA;
+
         if (fflags & REQ_FLUSH) {
                 if (rq->cmd_flags & REQ_FLUSH)
                         policy |= REQ_FSEQ_PREFLUSH;
-                if (blk_rq_sectors(rq))
-                        policy |= REQ_FSEQ_DATA;
                 if (!(fflags & REQ_FUA) && (rq->cmd_flags & REQ_FUA))
                         policy |= REQ_FSEQ_POSTFLUSH;
         }
@@ -122,7 +123,7 @@ static void blk_flush_restore_request(struct request *rq)
 
         /* make @rq a normal request */
         rq->cmd_flags &= ~REQ_FLUSH_SEQ;
-        rq->end_io = NULL;
+        rq->end_io = rq->flush.saved_end_io;
 }
 
 /**
@@ -300,9 +301,6 @@ void blk_insert_flush(struct request *rq)
         unsigned int fflags = q->flush_flags;   /* may change, cache */
         unsigned int policy = blk_flush_policy(fflags, rq);
 
-        BUG_ON(rq->end_io);
-        BUG_ON(!rq->bio || rq->bio != rq->biotail);
-
         /*
          * @policy now records what operations need to be done.  Adjust
          * REQ_FLUSH and FUA for the driver.
@@ -312,6 +310,19 @@ void blk_insert_flush(struct request *rq)
                 rq->cmd_flags &= ~REQ_FUA;
 
         /*
+         * An empty flush handed down from a stacking driver may
+         * translate into nothing if the underlying device does not
+         * advertise a write-back cache.  In this case, simply
+         * complete the request.
+         */
+        if (!policy) {
+                __blk_end_bidi_request(rq, 0, 0, 0);
+                return;
+        }
+
+        BUG_ON(!rq->bio || rq->bio != rq->biotail);
+
+        /*
          * If there's data but flush is not necessary, the request can be
          * processed directly without going through flush machinery.  Queue
          * for normal execution.
@@ -319,6 +330,7 @@ void blk_insert_flush(struct request *rq)
         if ((policy & REQ_FSEQ_DATA) &&
             !(policy & (REQ_FSEQ_PREFLUSH | REQ_FSEQ_POSTFLUSH))) {
                 list_add_tail(&rq->queuelist, &q->queue_head);
+                blk_run_queue_async(q);
                 return;
         }
 
@@ -329,6 +341,7 @@ void blk_insert_flush(struct request *rq)
         memset(&rq->flush, 0, sizeof(rq->flush));
         INIT_LIST_HEAD(&rq->flush.list);
         rq->cmd_flags |= REQ_FLUSH_SEQ;
+        rq->flush.saved_end_io = rq->end_io; /* Usually NULL */
         rq->end_io = flush_data_end_io;
 
         blk_flush_complete_seq(rq, REQ_FSEQ_ACTIONS & ~policy, 0);
diff --git a/block/blk-softirq.c b/block/blk-softirq.c
index 475fab809a80..58340d0cb23a 100644
--- a/block/blk-softirq.c
+++ b/block/blk-softirq.c
@@ -124,6 +124,14 @@ void __blk_complete_request(struct request *req)
         } else
                 ccpu = cpu;
 
+        /*
+         * If current CPU and requested CPU are in the same group, running
+         * softirq in current CPU. One might concern this is just like
+         * QUEUE_FLAG_SAME_FORCE, but actually not. blk_complete_request() is
+         * running in interrupt handler, and currently I/O controller doesn't
+         * support multiple interrupts, so current CPU is unique actually. This
+         * avoids IPI sending from current CPU to the first CPU of a group.
+         */
         if (ccpu == cpu || ccpu == group_cpu) {
                 struct list_head *list;
 do_local:
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index f6a794120505..a19f58c6fc3a 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -746,7 +746,7 @@ static bool tg_may_dispatch(struct throtl_data *td, struct throtl_grp *tg,
 static void throtl_charge_bio(struct throtl_grp *tg, struct bio *bio)
 {
         bool rw = bio_data_dir(bio);
-        bool sync = bio->bi_rw & REQ_SYNC;
+        bool sync = rw_is_sync(bio->bi_rw);
 
         /* Charge the bio to the group */
         tg->bytes_disp[rw] += bio->bi_size;
@@ -1150,7 +1150,7 @@ int blk_throtl_bio(struct request_queue *q, struct bio **biop)
 
                 if (tg_no_rule_group(tg, rw)) {
                         blkiocg_update_dispatch_stats(&tg->blkg, bio->bi_size,
-                                        rw, bio->bi_rw & REQ_SYNC);
+                                        rw, rw_is_sync(bio->bi_rw));
                         rcu_read_unlock();
                         return 0;
                 }
diff --git a/block/blk.h b/block/blk.h
index d6586287adc9..20b900a377c9 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -17,6 +17,8 @@ int blk_rq_append_bio(struct request_queue *q, struct request *rq,
                       struct bio *bio);
 void blk_dequeue_request(struct request *rq);
 void __blk_queue_free_tags(struct request_queue *q);
+bool __blk_end_bidi_request(struct request *rq, int error,
+                            unsigned int nr_bytes, unsigned int bidi_bytes);
 
 void blk_rq_timed_out_timer(unsigned long data);
 void blk_delete_timer(struct request *);
diff --git a/block/bsg-lib.c b/block/bsg-lib.c
new file mode 100644
index 000000000000..6690e6e41037
--- /dev/null
+++ b/block/bsg-lib.c
@@ -0,0 +1,298 @@
+/*
+ *  BSG helper library
+ *
+ *  Copyright (C) 2008   James Smart, Emulex Corporation
+ *  Copyright (C) 2011   Red Hat, Inc.  All rights reserved.
+ *  Copyright (C) 2011   Mike Christie
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#include <linux/slab.h>
+#include <linux/blkdev.h>
+#include <linux/delay.h>
+#include <linux/scatterlist.h>
+#include <linux/bsg-lib.h>
+#include <linux/module.h>
+#include <scsi/scsi_cmnd.h>
+
+/**
+ * bsg_destroy_job - routine to teardown/delete a bsg job
+ * @job: bsg_job that is to be torn down
+ */
+static void bsg_destroy_job(struct bsg_job *job)
+{
+        put_device(job->dev);   /* release reference for the request */
+
+        kfree(job->request_payload.sg_list);
+        kfree(job->reply_payload.sg_list);
+        kfree(job);
+}
+
+/**
+ * bsg_job_done - completion routine for bsg requests
+ * @job: bsg_job that is complete
+ * @result: job reply result
+ * @reply_payload_rcv_len: length of payload recvd
+ *
+ * The LLD should call this when the bsg job has completed.
+ */
+void bsg_job_done(struct bsg_job *job, int result,
+                  unsigned int reply_payload_rcv_len)
+{
+        struct request *req = job->req;
+        struct request *rsp = req->next_rq;
+        int err;
+
+        err = job->req->errors = result;
+        if (err < 0)
+                /* we're only returning the result field in the reply */
+                job->req->sense_len = sizeof(u32);
+        else
+                job->req->sense_len = job->reply_len;
+        /* we assume all request payload was transferred, residual == 0 */
+        req->resid_len = 0;
+
+        if (rsp) {
+                WARN_ON(reply_payload_rcv_len > rsp->resid_len);
+
+                /* set reply (bidi) residual */
+                rsp->resid_len -= min(reply_payload_rcv_len, rsp->resid_len);
+        }
+        blk_complete_request(req);
+}
+EXPORT_SYMBOL_GPL(bsg_job_done);
+
+/**
+ * bsg_softirq_done - softirq done routine for destroying the bsg requests
+ * @rq: BSG request that holds the job to be destroyed
+ */
+static void bsg_softirq_done(struct request *rq)
+{
+        struct bsg_job *job = rq->special;
+
+        blk_end_request_all(rq, rq->errors);
+        bsg_destroy_job(job);
+}
+
+static int bsg_map_buffer(struct bsg_buffer *buf, struct request *req)
+{
+        size_t sz = (sizeof(struct scatterlist) * req->nr_phys_segments);
+
+        BUG_ON(!req->nr_phys_segments);
+
+        buf->sg_list = kzalloc(sz, GFP_KERNEL);
+        if (!buf->sg_list)
+                return -ENOMEM;
+        sg_init_table(buf->sg_list, req->nr_phys_segments);
+        buf->sg_cnt = blk_rq_map_sg(req->q, req, buf->sg_list);
+        buf->payload_len = blk_rq_bytes(req);
+        return 0;
+}
+
+/**
+ * bsg_create_job - create the bsg_job structure for the bsg request
+ * @dev: device that is being sent the bsg request
+ * @req: BSG request that needs a job structure
+ */
+static int bsg_create_job(struct device *dev, struct request *req)
+{
+        struct request *rsp = req->next_rq;
+        struct request_queue *q = req->q;
+        struct bsg_job *job;
+        int ret;
+
+        BUG_ON(req->special);
+
+        job = kzalloc(sizeof(struct bsg_job) + q->bsg_job_size, GFP_KERNEL);
+        if (!job)
+                return -ENOMEM;
+
+        req->special = job;
+        job->req = req;
+        if (q->bsg_job_size)
+                job->dd_data = (void *)&job[1];
+        job->request = req->cmd;
+        job->request_len = req->cmd_len;
+        job->reply = req->sense;
+        job->reply_len = SCSI_SENSE_BUFFERSIZE; /* Size of sense buffer
+                                                 * allocated */
+        if (req->bio) {
+                ret = bsg_map_buffer(&job->request_payload, req);
+                if (ret)
+                        goto failjob_rls_job;
+        }
+        if (rsp && rsp->bio) {
+                ret = bsg_map_buffer(&job->reply_payload, rsp);
+                if (ret)
+                        goto failjob_rls_rqst_payload;
+        }
+        job->dev = dev;
+        /* take a reference for the request */
+        get_device(job->dev);
+        return 0;
+
+failjob_rls_rqst_payload:
+        kfree(job->request_payload.sg_list);
+failjob_rls_job:
+        kfree(job);
+        return -ENOMEM;
+}
+
+/*
+ * bsg_goose_queue - restart queue in case it was stopped
+ * @q: request q to be restarted
+ */
+void bsg_goose_queue(struct request_queue *q)
+{
+        if (!q)
+                return;
+
+        blk_run_queue_async(q);
+}
+EXPORT_SYMBOL_GPL(bsg_goose_queue);
+
+/**
+ * bsg_request_fn - generic handler for bsg requests
+ * @q: request queue to manage
+ *
+ * On error the create_bsg_job function should return a -Exyz error value
+ * that will be set to the req->errors.
+ *
+ * Drivers/subsys should pass this to the queue init function.
+ */
+void bsg_request_fn(struct request_queue *q)
+{
+        struct device *dev = q->queuedata;
+        struct request *req;
+        struct bsg_job *job;
+        int ret;
+
+        if (!get_device(dev))
+                return;
+
+        while (1) {
+                req = blk_fetch_request(q);
+                if (!req)
+                        break;
+                spin_unlock_irq(q->queue_lock);
+
+                ret = bsg_create_job(dev, req);
+                if (ret) {
+                        req->errors = ret;
+                        blk_end_request_all(req, ret);
+                        spin_lock_irq(q->queue_lock);
+                        continue;
+                }
+
+                job = req->special;
+                ret = q->bsg_job_fn(job);
+                spin_lock_irq(q->queue_lock);
+                if (ret)
+                        break;
+        }
+
+        spin_unlock_irq(q->queue_lock);
+        put_device(dev);
+        spin_lock_irq(q->queue_lock);
+}
+EXPORT_SYMBOL_GPL(bsg_request_fn);
+
+/**
+ * bsg_setup_queue - Create and add the bsg hooks so we can receive requests
+ * @dev: device to attach bsg device to
+ * @q: request queue setup by caller
+ * @name: device to give bsg device
+ * @job_fn: bsg job handler
+ * @dd_job_size: size of LLD data needed for each job
+ *
+ * The caller should have setup the reuqest queue with bsg_request_fn
+ * as the request_fn.
+ */
+int bsg_setup_queue(struct device *dev, struct request_queue *q,
+                    char *name, bsg_job_fn *job_fn, int dd_job_size)
+{
+        int ret;
+
+        q->queuedata = dev;
+        q->bsg_job_size = dd_job_size;
+        q->bsg_job_fn = job_fn;
+        queue_flag_set_unlocked(QUEUE_FLAG_BIDI, q);
+        blk_queue_softirq_done(q, bsg_softirq_done);
+        blk_queue_rq_timeout(q, BLK_DEFAULT_SG_TIMEOUT);
+
+        ret = bsg_register_queue(q, dev, name, NULL);
+        if (ret) {
+                printk(KERN_ERR "%s: bsg interface failed to "
+                       "initialize - register queue\n", dev->kobj.name);
+                return ret;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(bsg_setup_queue);
+
+/**
+ * bsg_remove_queue - Deletes the bsg dev from the q
+ * @q:  the request_queue that is to be torn down.
+ *
+ * Notes:
+ *   Before unregistering the queue empty any requests that are blocked
+ */
+void bsg_remove_queue(struct request_queue *q)
+{
+        struct request *req; /* block request */
+        int counts; /* totals for request_list count and starved */
+
+        if (!q)
+                return;
+
+        /* Stop taking in new requests */
+        spin_lock_irq(q->queue_lock);
+        blk_stop_queue(q);
+
+        /* drain all requests in the queue */
+        while (1) {
+                /* need the lock to fetch a request
+                 * this may fetch the same reqeust as the previous pass
+                 */
+                req = blk_fetch_request(q);
+                /* save requests in use and starved */
+                counts = q->rq.count[0] + q->rq.count[1] +
+                         q->rq.starved[0] + q->rq.starved[1];
+                spin_unlock_irq(q->queue_lock);
+                /* any requests still outstanding? */
+                if (counts == 0)
+                        break;
+
+                /* This may be the same req as the previous iteration,
+                 * always send the blk_end_request_all after a prefetch.
+                 * It is not okay to not end the request because the
+                 * prefetch started the request.
+                 */
+                if (req) {
+                        /* return -ENXIO to indicate that this queue is
+                         * going away
+                         */
+                        req->errors = -ENXIO;
+                        blk_end_request_all(req, -ENXIO);
+                }
+
+                msleep(200); /* allow bsg to possibly finish */
+                spin_lock_irq(q->queue_lock);
+        }
+        bsg_unregister_queue(q);
+}
+EXPORT_SYMBOL_GPL(bsg_remove_queue);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 1f96ad6254f1..a33bd4377c61 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -130,6 +130,8 @@ struct cfq_queue {
         unsigned long slice_end;
         long slice_resid;
 
+        /* pending metadata requests */
+        int meta_pending;
         /* number of requests that are on the dispatch list or inside driver */
         int dispatched;
 
@@ -682,6 +684,9 @@ cfq_choose_req(struct cfq_data *cfqd, struct request *rq1, struct request *rq2,
         if (rq_is_sync(rq1) != rq_is_sync(rq2))
                 return rq_is_sync(rq1) ? rq1 : rq2;
 
+        if ((rq1->cmd_flags ^ rq2->cmd_flags) & REQ_META)
+                return rq1->cmd_flags & REQ_META ? rq1 : rq2;
+
         s1 = blk_rq_pos(rq1);
         s2 = blk_rq_pos(rq2);
 
@@ -1209,6 +1214,9 @@ static void cfq_destroy_cfqg(struct cfq_data *cfqd, struct cfq_group *cfqg)
 
         hlist_del_init(&cfqg->cfqd_node);
 
+        BUG_ON(cfqd->nr_blkcg_linked_grps <= 0);
+        cfqd->nr_blkcg_linked_grps--;
+
         /*
          * Put the reference taken at the time of creation so that when all
          * queues are gone, group can be destroyed.
@@ -1604,6 +1612,10 @@ static void cfq_remove_request(struct request *rq)
         cfqq->cfqd->rq_queued--;
         cfq_blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg,
                                         rq_data_dir(rq), rq_is_sync(rq));
+        if (rq->cmd_flags & REQ_META) {
+                WARN_ON(!cfqq->meta_pending);
+                cfqq->meta_pending--;
+        }
 }
 
 static int cfq_merge(struct request_queue *q, struct request **req,
@@ -3357,6 +3369,13 @@ cfq_should_preempt(struct cfq_data *cfqd, struct cfq_queue *new_cfqq,
                 return true;
 
         /*
+         * So both queues are sync. Let the new request get disk time if
+         * it's a metadata request and the current queue is doing regular IO.
+         */
+        if ((rq->cmd_flags & REQ_META) && !cfqq->meta_pending)
+                return true;
+
+        /*
          * Allow an RT request to pre-empt an ongoing non-RT cfqq timeslice.
          */
         if (cfq_class_rt(new_cfqq) && !cfq_class_rt(cfqq))
@@ -3420,6 +3439,8 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
         struct cfq_io_context *cic = RQ_CIC(rq);
 
         cfqd->rq_queued++;
+        if (rq->cmd_flags & REQ_META)
+                cfqq->meta_pending++;
 
         cfq_update_io_thinktime(cfqd, cfqq, cic);
         cfq_update_io_seektime(cfqd, cfqq, rq);
diff --git a/block/genhd.c b/block/genhd.c
index 5cb51c55f6d8..e2f67902dd02 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -1146,17 +1146,17 @@ static int diskstats_show(struct seq_file *seqf, void *v)
                 cpu = part_stat_lock();
                 part_round_stats(cpu, hd);
                 part_stat_unlock();
-                seq_printf(seqf, "%4d %7d %s %lu %lu %llu "
-                           "%u %lu %lu %llu %u %u %u %u\n",
+                seq_printf(seqf, "%4d %7d %s %lu %lu %lu "
+                           "%u %lu %lu %lu %u %u %u %u\n",
                            MAJOR(part_devt(hd)), MINOR(part_devt(hd)),
                            disk_name(gp, hd->partno, buf),
                            part_stat_read(hd, ios[READ]),
                            part_stat_read(hd, merges[READ]),
-                           (unsigned long long)part_stat_read(hd, sectors[READ]),
+                           part_stat_read(hd, sectors[READ]),
                            jiffies_to_msecs(part_stat_read(hd, ticks[READ])),
                            part_stat_read(hd, ios[WRITE]),
                            part_stat_read(hd, merges[WRITE]),
-                           (unsigned long long)part_stat_read(hd, sectors[WRITE]),
+                           part_stat_read(hd, sectors[WRITE]),
                            jiffies_to_msecs(part_stat_read(hd, ticks[WRITE])),
                            part_in_flight(hd),
                            jiffies_to_msecs(part_stat_read(hd, io_ticks)),
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index ca3e6be44a04..5987e0ba8c2d 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -468,6 +468,15 @@ config PATA_ICSIDE
           interface card.  This is not required for ICS partition support.
           If you are unsure, say N to this.
 
+config PATA_IMX
+        tristate "PATA support for Freescale iMX"
+        depends on ARCH_MXC
+        help
+          This option enables support for the PATA host available on Freescale
+          iMX SoCs.
+
+          If unsure, say N.
+
 config PATA_IT8213
         tristate "IT8213 PATA support (Experimental)"
         depends on PCI && EXPERIMENTAL
diff --git a/drivers/ata/Makefile b/drivers/ata/Makefile
index 8ac64e1aa051..9550d691fd19 100644
--- a/drivers/ata/Makefile
+++ b/drivers/ata/Makefile
@@ -48,6 +48,7 @@ obj-$(CONFIG_PATA_HPT37X)	+= pata_hpt37x.o
 obj-$(CONFIG_PATA_HPT3X2N)      += pata_hpt3x2n.o
 obj-$(CONFIG_PATA_HPT3X3)       += pata_hpt3x3.o
 obj-$(CONFIG_PATA_ICSIDE)       += pata_icside.o
+obj-$(CONFIG_PATA_IMX)          += pata_imx.o
 obj-$(CONFIG_PATA_IT8213)       += pata_it8213.o
 obj-$(CONFIG_PATA_IT821X)       += pata_it821x.o
 obj-$(CONFIG_PATA_JMICRON)      += pata_jmicron.o
diff --git a/drivers/ata/pata_imx.c b/drivers/ata/pata_imx.c
new file mode 100644
index 000000000000..ca9d9caedfa3
--- /dev/null
+++ b/drivers/ata/pata_imx.c
@@ -0,0 +1,253 @@
+/*
+ * Freescale iMX PATA driver
+ *
+ * Copyright (C) 2011 Arnaud Patard <arnaud.patard@rtp-net.org>
+ *
+ * Based on pata_platform - Copyright (C) 2006 - 2007  Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * TODO:
+ * - dmaengine support
+ * - check if timing stuff needed
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/blkdev.h>
+#include <scsi/scsi_host.h>
+#include <linux/ata.h>
+#include <linux/libata.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+
+#define DRV_NAME "pata_imx"
+
+#define PATA_IMX_ATA_CONTROL            0x24
+#define PATA_IMX_ATA_CTRL_FIFO_RST_B    (1<<7)
+#define PATA_IMX_ATA_CTRL_ATA_RST_B     (1<<6)
+#define PATA_IMX_ATA_CTRL_IORDY_EN      (1<<0)
+#define PATA_IMX_ATA_INT_EN             0x2C
+#define PATA_IMX_ATA_INTR_ATA_INTRQ2    (1<<3)
+#define PATA_IMX_DRIVE_DATA             0xA0
+#define PATA_IMX_DRIVE_CONTROL          0xD8
+
+struct pata_imx_priv {
+        struct clk *clk;
+        /* timings/interrupt/control regs */
+        u8 *host_regs;
+        u32 ata_ctl;
+};
+
+static int pata_imx_set_mode(struct ata_link *link, struct ata_device **unused)
+{
+        struct ata_device *dev;
+        struct ata_port *ap = link->ap;
+        struct pata_imx_priv *priv = ap->host->private_data;
+        u32 val;
+
+        ata_for_each_dev(dev, link, ENABLED) {
+                dev->pio_mode = dev->xfer_mode = XFER_PIO_0;
+                dev->xfer_shift = ATA_SHIFT_PIO;
+                dev->flags |= ATA_DFLAG_PIO;
+
+                val = __raw_readl(priv->host_regs + PATA_IMX_ATA_CONTROL);
+                if (ata_pio_need_iordy(dev))
+                        val |= PATA_IMX_ATA_CTRL_IORDY_EN;
+                else
+                        val &= ~PATA_IMX_ATA_CTRL_IORDY_EN;
+                __raw_writel(val, priv->host_regs + PATA_IMX_ATA_CONTROL);
+
+                ata_dev_printk(dev, KERN_INFO, "configured for PIO\n");
+        }
+        return 0;
+}
+
+static struct scsi_host_template pata_imx_sht = {
+        ATA_PIO_SHT(DRV_NAME),
+};
+
+static struct ata_port_operations pata_imx_port_ops = {
+        .inherits               = &ata_sff_port_ops,
+        .sff_data_xfer          = ata_sff_data_xfer_noirq,
+        .cable_detect           = ata_cable_unknown,
+        .set_mode               = pata_imx_set_mode,
+};
+
+static void pata_imx_setup_port(struct ata_ioports *ioaddr)
+{
+        /* Fixup the port shift for platforms that need it */
+        ioaddr->data_addr       = ioaddr->cmd_addr + (ATA_REG_DATA    << 2);
+        ioaddr->error_addr      = ioaddr->cmd_addr + (ATA_REG_ERR     << 2);
+        ioaddr->feature_addr    = ioaddr->cmd_addr + (ATA_REG_FEATURE << 2);
+        ioaddr->nsect_addr      = ioaddr->cmd_addr + (ATA_REG_NSECT   << 2);
+        ioaddr->lbal_addr       = ioaddr->cmd_addr + (ATA_REG_LBAL    << 2);
+        ioaddr->lbam_addr       = ioaddr->cmd_addr + (ATA_REG_LBAM    << 2);
+        ioaddr->lbah_addr       = ioaddr->cmd_addr + (ATA_REG_LBAH    << 2);
+        ioaddr->device_addr     = ioaddr->cmd_addr + (ATA_REG_DEVICE  << 2);
+        ioaddr->status_addr     = ioaddr->cmd_addr + (ATA_REG_STATUS  << 2);
+        ioaddr->command_addr    = ioaddr->cmd_addr + (ATA_REG_CMD     << 2);
+}
+
+static int __devinit pata_imx_probe(struct platform_device *pdev)
+{
+        struct ata_host *host;
+        struct ata_port *ap;
+        struct pata_imx_priv *priv;
+        int irq = 0;
+        struct resource *io_res;
+
+        io_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (io_res == NULL)
+                return -EINVAL;
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq <= 0)
+                return -EINVAL;
+
+        priv = devm_kzalloc(&pdev->dev,
+                                sizeof(struct pata_imx_priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        priv->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(priv->clk)) {
+                dev_err(&pdev->dev, "Failed to get clock\n");
+                return PTR_ERR(priv->clk);
+        }
+
+        clk_enable(priv->clk);
+
+        host = ata_host_alloc(&pdev->dev, 1);
+        if (!host)
+                goto free_priv;
+
+        host->private_data = priv;
+        ap = host->ports[0];
+
+        ap->ops = &pata_imx_port_ops;
+        ap->pio_mask = ATA_PIO0;
+        ap->flags |= ATA_FLAG_SLAVE_POSS;
+
+        priv->host_regs = devm_ioremap(&pdev->dev, io_res->start,
+                resource_size(io_res));
+        if (!priv->host_regs) {
+                dev_err(&pdev->dev, "failed to map IO/CTL base\n");
+                goto free_priv;
+        }
+
+        ap->ioaddr.cmd_addr = priv->host_regs + PATA_IMX_DRIVE_DATA;
+        ap->ioaddr.ctl_addr = priv->host_regs + PATA_IMX_DRIVE_CONTROL;
+
+        ap->ioaddr.altstatus_addr = ap->ioaddr.ctl_addr;
+
+        pata_imx_setup_port(&ap->ioaddr);
+
+        ata_port_desc(ap, "cmd 0x%llx ctl 0x%llx",
+                (unsigned long long)io_res->start + PATA_IMX_DRIVE_DATA,
+                (unsigned long long)io_res->start + PATA_IMX_DRIVE_CONTROL);
+
+        /* deassert resets */
+        __raw_writel(PATA_IMX_ATA_CTRL_FIFO_RST_B |
+                        PATA_IMX_ATA_CTRL_ATA_RST_B,
+                        priv->host_regs + PATA_IMX_ATA_CONTROL);
+        /* enable interrupts */
+        __raw_writel(PATA_IMX_ATA_INTR_ATA_INTRQ2,
+                        priv->host_regs + PATA_IMX_ATA_INT_EN);
+
+        /* activate */
+        return ata_host_activate(host, irq, ata_sff_interrupt, 0,
+                                &pata_imx_sht);
+
+free_priv:
+        clk_disable(priv->clk);
+        clk_put(priv->clk);
+        return -ENOMEM;
+}
+
+static int __devexit pata_imx_remove(struct platform_device *pdev)
+{
+        struct ata_host *host = dev_get_drvdata(&pdev->dev);
+        struct pata_imx_priv *priv = host->private_data;
+
+        ata_host_detach(host);
+
+        __raw_writel(0, priv->host_regs + PATA_IMX_ATA_INT_EN);
+
+        clk_disable(priv->clk);
+        clk_put(priv->clk);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int pata_imx_suspend(struct device *dev)
+{
+        struct ata_host *host = dev_get_drvdata(dev);
+        struct pata_imx_priv *priv = host->private_data;
+        int ret;
+
+        ret = ata_host_suspend(host, PMSG_SUSPEND);
+        if (!ret) {
+                __raw_writel(0, priv->host_regs + PATA_IMX_ATA_INT_EN);
+                priv->ata_ctl =
+                        __raw_readl(priv->host_regs + PATA_IMX_ATA_CONTROL);
+                clk_disable(priv->clk);
+        }
+
+        return ret;
+}
+
+static int pata_imx_resume(struct device *dev)
+{
+        struct ata_host *host = dev_get_drvdata(dev);
+        struct pata_imx_priv *priv = host->private_data;
+
+        clk_enable(priv->clk);
+
+        __raw_writel(priv->ata_ctl, priv->host_regs + PATA_IMX_ATA_CONTROL);
+
+        __raw_writel(PATA_IMX_ATA_INTR_ATA_INTRQ2,
+                        priv->host_regs + PATA_IMX_ATA_INT_EN);
+
+        ata_host_resume(host);
+
+        return 0;
+}
+
+static const struct dev_pm_ops pata_imx_pm_ops = {
+        .suspend        = pata_imx_suspend,
+        .resume         = pata_imx_resume,
+};
+#endif
+
+static struct platform_driver pata_imx_driver = {
+        .probe          = pata_imx_probe,
+        .remove         = __devexit_p(pata_imx_remove),
+        .driver = {
+                .name           = DRV_NAME,
+                .owner          = THIS_MODULE,
+#ifdef CONFIG_PM
+                .pm             = &pata_imx_pm_ops,
+#endif
+        },
+};
+
+static int __init pata_imx_init(void)
+{
+        return platform_driver_register(&pata_imx_driver);
+}
+
+static void __exit pata_imx_exit(void)
+{
+        platform_driver_unregister(&pata_imx_driver);
+}
+module_init(pata_imx_init);
+module_exit(pata_imx_exit);
+
+MODULE_AUTHOR("Arnaud Patard <arnaud.patard@rtp-net.org>");
+MODULE_DESCRIPTION("low-level driver for iMX PATA");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
index 65e4be6be220..8e9f5048a10a 100644
--- a/drivers/ata/pata_via.c
+++ b/drivers/ata/pata_via.c
@@ -124,6 +124,17 @@ static const struct via_isa_bridge {
         { NULL }
 };
 
+static const struct dmi_system_id no_atapi_dma_dmi_table[] = {
+        {
+                .ident = "AVERATEC 3200",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "AVERATEC"),
+                        DMI_MATCH(DMI_BOARD_NAME, "3200"),
+                },
+        },
+        { }
+};
+
 struct via_port {
         u8 cached_device;
 };
@@ -355,6 +366,13 @@ static unsigned long via_mode_filter(struct ata_device *dev, unsigned long mask)
                         mask &= ~ ATA_MASK_UDMA;
                 }
         }
+
+        if (dev->class == ATA_DEV_ATAPI &&
+            dmi_check_system(no_atapi_dma_dmi_table)) {
+                ata_dev_warn(dev, "controller locks up on ATAPI DMA, forcing PIO\n");
+                mask &= ATA_MASK_PIO;
+        }
+
         return mask;
 }
 
diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
index 0a9a774a7e1e..5c4237452f50 100644
--- a/drivers/ata/sata_dwc_460ex.c
+++ b/drivers/ata/sata_dwc_460ex.c
@@ -1329,7 +1329,7 @@ static int sata_dwc_port_start(struct ata_port *ap)
                         dev_err(ap->dev, "%s: dma_alloc_coherent failed\n",
                                  __func__);
                         err = -ENOMEM;
-                        goto CLEANUP;
+                        goto CLEANUP_ALLOC;
                 }
         }
 
@@ -1349,15 +1349,13 @@ static int sata_dwc_port_start(struct ata_port *ap)
         /* Clear any error bits before libata starts issuing commands */
         clear_serror();
         ap->private_data = hsdevp;
+        dev_dbg(ap->dev, "%s: done\n", __func__);
+        return 0;
 
+CLEANUP_ALLOC:
+        kfree(hsdevp);
 CLEANUP:
-        if (err) {
-                sata_dwc_port_stop(ap);
-                dev_dbg(ap->dev, "%s: fail\n", __func__);
-        } else {
-                dev_dbg(ap->dev, "%s: done\n", __func__);
-        }
-
+        dev_dbg(ap->dev, "%s: fail. ap->id = %d\n", __func__, ap->print_id);
         return err;
 }
 
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 98c1d780f552..9dfb40b8c2c9 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -438,7 +438,7 @@ static void sil_host_intr(struct ata_port *ap, u32 bmdma2)
         u8 status;
 
         if (unlikely(bmdma2 & SIL_DMA_SATA_IRQ)) {
-                u32 serror;
+                u32 serror = 0xffffffff;
 
                 /* SIEN doesn't mask SATA IRQs on some 3112s.  Those
                  * controllers continue to assert IRQ as long as
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index e18566a0fedd..1c374579407c 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -460,6 +460,21 @@ static int pm_genpd_runtime_resume(struct device *dev)
         return 0;
 }
 
+/**
+ * pm_genpd_poweroff_unused - Power off all PM domains with no devices in use.
+ */
+void pm_genpd_poweroff_unused(void)
+{
+        struct generic_pm_domain *genpd;
+
+        mutex_lock(&gpd_list_lock);
+
+        list_for_each_entry(genpd, &gpd_list, gpd_list_node)
+                genpd_queue_power_off_work(genpd);
+
+        mutex_unlock(&gpd_list_lock);
+}
+
 #else
 
 static inline void genpd_power_off_work_fn(struct work_struct *work) {}
@@ -1255,18 +1270,3 @@ void pm_genpd_init(struct generic_pm_domain *genpd,
         list_add(&genpd->gpd_list_node, &gpd_list);
         mutex_unlock(&gpd_list_lock);
 }
-
-/**
- * pm_genpd_poweroff_unused - Power off all PM domains with no devices in use.
- */
-void pm_genpd_poweroff_unused(void)
-{
-        struct generic_pm_domain *genpd;
-
-        mutex_lock(&gpd_list_lock);
-
-        list_for_each_entry(genpd, &gpd_list, gpd_list_node)
-                genpd_queue_power_off_work(genpd);
-
-        mutex_unlock(&gpd_list_lock);
-}
diff --git a/drivers/base/regmap/regmap-i2c.c b/drivers/base/regmap/regmap-i2c.c
index c2231ff06cbc..c4f7a45cd2c3 100644
--- a/drivers/base/regmap/regmap-i2c.c
+++ b/drivers/base/regmap/regmap-i2c.c
@@ -113,3 +113,4 @@ struct regmap *regmap_init_i2c(struct i2c_client *i2c,
 }
 EXPORT_SYMBOL_GPL(regmap_init_i2c);
 
+MODULE_LICENSE("GPL");
diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c
index 4deba0621bc7..f8396945d6ed 100644
--- a/drivers/base/regmap/regmap-spi.c
+++ b/drivers/base/regmap/regmap-spi.c
@@ -13,6 +13,7 @@
 #include <linux/regmap.h>
 #include <linux/spi/spi.h>
 #include <linux/init.h>
+#include <linux/module.h>
 
 static int regmap_spi_write(struct device *dev, const void *data, size_t count)
 {
@@ -70,3 +71,5 @@ struct regmap *regmap_init_spi(struct spi_device *spi,
         return regmap_init(&spi->dev, &regmap_spi, config);
 }
 EXPORT_SYMBOL_GPL(regmap_init_spi);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index cf3565cae93d..0eef4da1ac61 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -317,7 +317,7 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
                 u8[0] |= map->bus->read_flag_mask;
 
         ret = map->bus->read(map->dev, map->work_buf, map->format.reg_bytes,
-                             val, map->format.val_bytes);
+                             val, val_len);
         if (ret != 0)
                 return ret;
 
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 717d6e4e18d3..6f07ec1c2f58 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -256,6 +256,21 @@ config BLK_DEV_LOOP
 
           Most users will answer N here.
 
+config BLK_DEV_LOOP_MIN_COUNT
+        int "Number of loop devices to pre-create at init time"
+        depends on BLK_DEV_LOOP
+        default 8
+        help
+          Static number of loop devices to be unconditionally pre-created
+          at init time.
+
+          This default value can be overwritten on the kernel command
+          line or with module-parameter loop.max_loop.
+
+          The historic default is 8. If a late 2011 version of losetup(8)
+          is used, it can be set to 0, since needed loop devices can be
+          dynamically allocated with the /dev/loop-control interface.
+
 config BLK_DEV_CRYPTOLOOP
         tristate "Cryptoloop Support"
         select CRYPTO
@@ -471,7 +486,7 @@ config XEN_BLKDEV_FRONTEND
           in another domain which drives the actual block device.
 
 config XEN_BLKDEV_BACKEND
-        tristate "Block-device backend driver"
+        tristate "Xen block-device backend driver"
         depends on XEN_BACKEND
         help
           The block-device backend driver allows the kernel to export its
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 515bcd948a43..0feab261e295 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -1829,10 +1829,10 @@ static int drbd_nl_syncer_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *n
 
         /* silently ignore cpu mask on UP kernel */
         if (nr_cpu_ids > 1 && sc.cpu_mask[0] != 0) {
-                err = __bitmap_parse(sc.cpu_mask, 32, 0,
+                err = bitmap_parse(sc.cpu_mask, 32,
                                 cpumask_bits(new_cpu_mask), nr_cpu_ids);
                 if (err) {
-                        dev_warn(DEV, "__bitmap_parse() failed with %d\n", err);
+                        dev_warn(DEV, "bitmap_parse() failed with %d\n", err);
                         retcode = ERR_CPU_MASK_PARSE;
                         goto fail;
                 }
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 76c8da78212b..4720c7ade0ae 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -75,11 +75,11 @@
 #include <linux/kthread.h>
 #include <linux/splice.h>
 #include <linux/sysfs.h>
-
+#include <linux/miscdevice.h>
 #include <asm/uaccess.h>
 
-static LIST_HEAD(loop_devices);
-static DEFINE_MUTEX(loop_devices_mutex);
+static DEFINE_IDR(loop_index_idr);
+static DEFINE_MUTEX(loop_index_mutex);
 
 static int max_part;
 static int part_shift;
@@ -722,17 +722,10 @@ static inline int is_loop_device(struct file *file)
 static ssize_t loop_attr_show(struct device *dev, char *page,
                               ssize_t (*callback)(struct loop_device *, char *))
 {
-        struct loop_device *l, *lo = NULL;
-
-        mutex_lock(&loop_devices_mutex);
-        list_for_each_entry(l, &loop_devices, lo_list)
-                if (disk_to_dev(l->lo_disk) == dev) {
-                        lo = l;
-                        break;
-                }
-        mutex_unlock(&loop_devices_mutex);
+        struct gendisk *disk = dev_to_disk(dev);
+        struct loop_device *lo = disk->private_data;
 
-        return lo ? callback(lo, page) : -EIO;
+        return callback(lo, page);
 }
 
 #define LOOP_ATTR_RO(_name)                                             \
@@ -750,10 +743,10 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf)
         ssize_t ret;
         char *p = NULL;
 
-        mutex_lock(&lo->lo_ctl_mutex);
+        spin_lock_irq(&lo->lo_lock);
         if (lo->lo_backing_file)
                 p = d_path(&lo->lo_backing_file->f_path, buf, PAGE_SIZE - 1);
-        mutex_unlock(&lo->lo_ctl_mutex);
+        spin_unlock_irq(&lo->lo_lock);
 
         if (IS_ERR_OR_NULL(p))
                 ret = PTR_ERR(p);
@@ -1007,7 +1000,9 @@ static int loop_clr_fd(struct loop_device *lo, struct block_device *bdev)
 
         kthread_stop(lo->lo_thread);
 
+        spin_lock_irq(&lo->lo_lock);
         lo->lo_backing_file = NULL;
+        spin_unlock_irq(&lo->lo_lock);
 
         loop_release_xfer(lo);
         lo->transfer = NULL;
@@ -1485,13 +1480,22 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
 
 static int lo_open(struct block_device *bdev, fmode_t mode)
 {
-        struct loop_device *lo = bdev->bd_disk->private_data;
+        struct loop_device *lo;
+        int err = 0;
+
+        mutex_lock(&loop_index_mutex);
+        lo = bdev->bd_disk->private_data;
+        if (!lo) {
+                err = -ENXIO;
+                goto out;
+        }
 
         mutex_lock(&lo->lo_ctl_mutex);
         lo->lo_refcnt++;
         mutex_unlock(&lo->lo_ctl_mutex);
-
-        return 0;
+out:
+        mutex_unlock(&loop_index_mutex);
+        return err;
 }
 
 static int lo_release(struct gendisk *disk, fmode_t mode)
@@ -1557,40 +1561,71 @@ int loop_register_transfer(struct loop_func_table *funcs)
         return 0;
 }
 
+static int unregister_transfer_cb(int id, void *ptr, void *data)
+{
+        struct loop_device *lo = ptr;
+        struct loop_func_table *xfer = data;
+
+        mutex_lock(&lo->lo_ctl_mutex);
+        if (lo->lo_encryption == xfer)
+                loop_release_xfer(lo);
+        mutex_unlock(&lo->lo_ctl_mutex);
+        return 0;
+}
+
 int loop_unregister_transfer(int number)
 {
         unsigned int n = number;
-        struct loop_device *lo;
         struct loop_func_table *xfer;
 
         if (n == 0 || n >= MAX_LO_CRYPT || (xfer = xfer_funcs[n]) == NULL)
                 return -EINVAL;
 
         xfer_funcs[n] = NULL;
-
-        list_for_each_entry(lo, &loop_devices, lo_list) {
-                mutex_lock(&lo->lo_ctl_mutex);
-
-                if (lo->lo_encryption == xfer)
-                        loop_release_xfer(lo);
-
-                mutex_unlock(&lo->lo_ctl_mutex);
-        }
-
+        idr_for_each(&loop_index_idr, &unregister_transfer_cb, xfer);
         return 0;
 }
 
 EXPORT_SYMBOL(loop_register_transfer);
 EXPORT_SYMBOL(loop_unregister_transfer);
 
-static struct loop_device *loop_alloc(int i)
+static int loop_add(struct loop_device **l, int i)
 {
         struct loop_device *lo;
         struct gendisk *disk;
+        int err;
 
         lo = kzalloc(sizeof(*lo), GFP_KERNEL);
-        if (!lo)
+        if (!lo) {
+                err = -ENOMEM;
                 goto out;
+        }
+
+        err = idr_pre_get(&loop_index_idr, GFP_KERNEL);
+        if (err < 0)
+                goto out_free_dev;
+
+        if (i >= 0) {
+                int m;
+
+                /* create specific i in the index */
+                err = idr_get_new_above(&loop_index_idr, lo, i, &m);
+                if (err >= 0 && i != m) {
+                        idr_remove(&loop_index_idr, m);
+                        err = -EEXIST;
+                }
+        } else if (i == -1) {
+                int m;
+
+                /* get next free nr */
+                err = idr_get_new(&loop_index_idr, lo, &m);
+                if (err >= 0)
+                        i = m;
+        } else {
+                err = -EINVAL;
+        }
+        if (err < 0)
+                goto out_free_dev;
 
         lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
         if (!lo->lo_queue)
@@ -1611,81 +1646,158 @@ static struct loop_device *loop_alloc(int i)
         disk->private_data      = lo;
         disk->queue             = lo->lo_queue;
         sprintf(disk->disk_name, "loop%d", i);
-        return lo;
+        add_disk(disk);
+        *l = lo;
+        return lo->lo_number;
 
 out_free_queue:
         blk_cleanup_queue(lo->lo_queue);
 out_free_dev:
         kfree(lo);
 out:
-        return NULL;
+        return err;
 }
 
-static void loop_free(struct loop_device *lo)
+static void loop_remove(struct loop_device *lo)
 {
+        del_gendisk(lo->lo_disk);
         blk_cleanup_queue(lo->lo_queue);
         put_disk(lo->lo_disk);
-        list_del(&lo->lo_list);
         kfree(lo);
 }
 
-static struct loop_device *loop_init_one(int i)
+static int find_free_cb(int id, void *ptr, void *data)
+{
+        struct loop_device *lo = ptr;
+        struct loop_device **l = data;
+
+        if (lo->lo_state == Lo_unbound) {
+                *l = lo;
+                return 1;
+        }
+        return 0;
+}
+
+static int loop_lookup(struct loop_device **l, int i)
 {
         struct loop_device *lo;
+        int ret = -ENODEV;
 
-        list_for_each_entry(lo, &loop_devices, lo_list) {
-                if (lo->lo_number == i)
-                        return lo;
+        if (i < 0) {
+                int err;
+
+                err = idr_for_each(&loop_index_idr, &find_free_cb, &lo);
+                if (err == 1) {
+                        *l = lo;
+                        ret = lo->lo_number;
+                }
+                goto out;
         }
 
-        lo = loop_alloc(i);
+        /* lookup and return a specific i */
+        lo = idr_find(&loop_index_idr, i);
         if (lo) {
-                add_disk(lo->lo_disk);
-                list_add_tail(&lo->lo_list, &loop_devices);
+                *l = lo;
+                ret = lo->lo_number;
         }
-        return lo;
-}
-
-static void loop_del_one(struct loop_device *lo)
-{
-        del_gendisk(lo->lo_disk);
-        loop_free(lo);
+out:
+        return ret;
 }
 
 static struct kobject *loop_probe(dev_t dev, int *part, void *data)
 {
         struct loop_device *lo;
         struct kobject *kobj;
+        int err;
 
-        mutex_lock(&loop_devices_mutex);
-        lo = loop_init_one(MINOR(dev) >> part_shift);
-        kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM);
-        mutex_unlock(&loop_devices_mutex);
+        mutex_lock(&loop_index_mutex);
+        err = loop_lookup(&lo, MINOR(dev) >> part_shift);
+        if (err < 0)
+                err = loop_add(&lo, MINOR(dev) >> part_shift);
+        if (err < 0)
+                kobj = ERR_PTR(err);
+        else
+                kobj = get_disk(lo->lo_disk);
+        mutex_unlock(&loop_index_mutex);
 
         *part = 0;
         return kobj;
 }
 
+static long loop_control_ioctl(struct file *file, unsigned int cmd,
+                               unsigned long parm)
+{
+        struct loop_device *lo;
+        int ret = -ENOSYS;
+
+        mutex_lock(&loop_index_mutex);
+        switch (cmd) {
+        case LOOP_CTL_ADD:
+                ret = loop_lookup(&lo, parm);
+                if (ret >= 0) {
+                        ret = -EEXIST;
+                        break;
+                }
+                ret = loop_add(&lo, parm);
+                break;
+        case LOOP_CTL_REMOVE:
+                ret = loop_lookup(&lo, parm);
+                if (ret < 0)
+                        break;
+                mutex_lock(&lo->lo_ctl_mutex);
+                if (lo->lo_state != Lo_unbound) {
+                        ret = -EBUSY;
+                        mutex_unlock(&lo->lo_ctl_mutex);
+                        break;
+                }
+                if (lo->lo_refcnt > 0) {
+                        ret = -EBUSY;
+                        mutex_unlock(&lo->lo_ctl_mutex);
+                        break;
+                }
+                lo->lo_disk->private_data = NULL;
+                mutex_unlock(&lo->lo_ctl_mutex);
+                idr_remove(&loop_index_idr, lo->lo_number);
+                loop_remove(lo);
+                break;
+        case LOOP_CTL_GET_FREE:
+                ret = loop_lookup(&lo, -1);
+                if (ret >= 0)
+                        break;
+                ret = loop_add(&lo, -1);
+        }
+        mutex_unlock(&loop_index_mutex);
+
+        return ret;
+}
+
+static const struct file_operations loop_ctl_fops = {
+        .open           = nonseekable_open,
+        .unlocked_ioctl = loop_control_ioctl,
+        .compat_ioctl   = loop_control_ioctl,
+        .owner          = THIS_MODULE,
+        .llseek         = noop_llseek,
+};
+
+static struct miscdevice loop_misc = {
+        .minor          = LOOP_CTRL_MINOR,
+        .name           = "loop-control",
+        .fops           = &loop_ctl_fops,
+};
+
+MODULE_ALIAS_MISCDEV(LOOP_CTRL_MINOR);
+MODULE_ALIAS("devname:loop-control");
+
 static int __init loop_init(void)
 {
         int i, nr;
         unsigned long range;
-        struct loop_device *lo, *next;
+        struct loop_device *lo;
+        int err;
 
-        /*
-         * loop module now has a feature to instantiate underlying device
-         * structure on-demand, provided that there is an access dev node.
-         * However, this will not work well with user space tool that doesn't
-         * know about such "feature".  In order to not break any existing
-         * tool, we do the following:
-         *
-         * (1) if max_loop is specified, create that many upfront, and this
-         *     also becomes a hard limit.
-         * (2) if max_loop is not specified, create 8 loop device on module
-         *     load, user can further extend loop device by create dev node
-         *     themselves and have kernel automatically instantiate actual
-         *     device on-demand.
-         */
+        err = misc_register(&loop_misc);
+        if (err < 0)
+                return err;
 
         part_shift = 0;
         if (max_part > 0) {
@@ -1708,57 +1820,60 @@ static int __init loop_init(void)
         if (max_loop > 1UL << (MINORBITS - part_shift))
                 return -EINVAL;
 
+        /*
+         * If max_loop is specified, create that many devices upfront.
+         * This also becomes a hard limit. If max_loop is not specified,
+         * create CONFIG_BLK_DEV_LOOP_MIN_COUNT loop devices at module
+         * init time. Loop devices can be requested on-demand with the
+         * /dev/loop-control interface, or be instantiated by accessing
+         * a 'dead' device node.
+         */
         if (max_loop) {
                 nr = max_loop;
                 range = max_loop << part_shift;
         } else {
-                nr = 8;
+                nr = CONFIG_BLK_DEV_LOOP_MIN_COUNT;
                 range = 1UL << MINORBITS;
         }
 
         if (register_blkdev(LOOP_MAJOR, "loop"))
                 return -EIO;
 
-        for (i = 0; i < nr; i++) {
-                lo = loop_alloc(i);
-                if (!lo)
-                        goto Enomem;
-                list_add_tail(&lo->lo_list, &loop_devices);
-        }
-
-        /* point of no return */
-
-        list_for_each_entry(lo, &loop_devices, lo_list)
-                add_disk(lo->lo_disk);
-
         blk_register_region(MKDEV(LOOP_MAJOR, 0), range,
                                   THIS_MODULE, loop_probe, NULL, NULL);
 
+        /* pre-create number of devices given by config or max_loop */
+        mutex_lock(&loop_index_mutex);
+        for (i = 0; i < nr; i++)
+                loop_add(&lo, i);
+        mutex_unlock(&loop_index_mutex);
+
         printk(KERN_INFO "loop: module loaded\n");
         return 0;
+}
 
-Enomem:
-        printk(KERN_INFO "loop: out of memory\n");
-
-        list_for_each_entry_safe(lo, next, &loop_devices, lo_list)
-                loop_free(lo);
+static int loop_exit_cb(int id, void *ptr, void *data)
+{
+        struct loop_device *lo = ptr;
 
-        unregister_blkdev(LOOP_MAJOR, "loop");
-        return -ENOMEM;
+        loop_remove(lo);
+        return 0;
 }
 
 static void __exit loop_exit(void)
 {
         unsigned long range;
-        struct loop_device *lo, *next;
 
         range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
 
-        list_for_each_entry_safe(lo, next, &loop_devices, lo_list)
-                loop_del_one(lo);
+        idr_for_each(&loop_index_idr, &loop_exit_cb, NULL);
+        idr_remove_all(&loop_index_idr);
+        idr_destroy(&loop_index_idr);
 
         blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range);
         unregister_blkdev(LOOP_MAJOR, "loop");
+
+        misc_deregister(&loop_misc);
 }
 
 module_init(loop_init);
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index 773bfa792777..ae3e167e17ad 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -1184,6 +1184,7 @@ static struct of_device_id swim3_match[] =
         {
         .compatible     = "swim3"
         },
+        { /* end of list */ }
 };
 
 static struct macio_driver swim3_driver =
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index b536a9cef917..9ea8c2576c70 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -123,8 +123,8 @@ static DEFINE_SPINLOCK(minor_lock);
 #define BLKIF_MINOR_EXT(dev) ((dev)&(~EXTENDED))
 #define EMULATED_HD_DISK_MINOR_OFFSET (0)
 #define EMULATED_HD_DISK_NAME_OFFSET (EMULATED_HD_DISK_MINOR_OFFSET / 256)
-#define EMULATED_SD_DISK_MINOR_OFFSET (EMULATED_HD_DISK_MINOR_OFFSET + (4 * 16))
-#define EMULATED_SD_DISK_NAME_OFFSET (EMULATED_HD_DISK_NAME_OFFSET + 4)
+#define EMULATED_SD_DISK_MINOR_OFFSET (0)
+#define EMULATED_SD_DISK_NAME_OFFSET (EMULATED_SD_DISK_MINOR_OFFSET / 256)
 
 #define DEV_NAME        "xvd"   /* name in /dev */
 
@@ -529,7 +529,7 @@ static int xlvbd_alloc_gendisk(blkif_sector_t capacity,
                 minor = BLKIF_MINOR_EXT(info->vdevice);
                 nr_parts = PARTS_PER_EXT_DISK;
                 offset = minor / nr_parts;
-                if (xen_hvm_domain() && offset <= EMULATED_HD_DISK_NAME_OFFSET + 4)
+                if (xen_hvm_domain() && offset < EMULATED_HD_DISK_NAME_OFFSET + 4)
                         printk(KERN_WARNING "blkfront: vdevice 0x%x might conflict with "
                                         "emulated IDE disks,\n\t choose an xvd device name"
                                         "from xvde on\n", info->vdevice);
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 75fb965b8f72..f997c27d79e2 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -1929,11 +1929,17 @@ static int dvd_read_manufact(struct cdrom_device_info *cdi, dvd_struct *s,
                 goto out;
 
         s->manufact.len = buf[0] << 8 | buf[1];
-        if (s->manufact.len < 0 || s->manufact.len > 2048) {
+        if (s->manufact.len < 0) {
                 cdinfo(CD_WARNING, "Received invalid manufacture info length"
                                    " (%d)\n", s->manufact.len);
                 ret = -EIO;
         } else {
+                if (s->manufact.len > 2048) {
+                        cdinfo(CD_WARNING, "Received invalid manufacture info "
+                                        "length (%d): truncating to 2048\n",
+                                        s->manufact.len);
+                        s->manufact.len = 2048;
+                }
                 memcpy(s->manufact.value, &buf[4], s->manufact.len);
         }
 
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index 196a7378d332..be21e3f138a8 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -80,6 +80,7 @@
 #include <linux/interrupt.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
+#include <linux/dma-mapping.h>
 #include <linux/dmapool.h>
 #include <linux/dmaengine.h>
 #include <linux/amba/bus.h>
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 04f1e7ce02b1..f6cf448d69b4 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1670,7 +1670,7 @@ static void i7core_mce_output_error(struct mem_ctl_info *mci,
         char *type, *optype, *err, *msg;
         unsigned long error = m->status & 0x1ff0000l;
         u32 optypenum = (m->status >> 4) & 0x07;
-        u32 core_err_cnt = (m->status >> 38) && 0x7fff;
+        u32 core_err_cnt = (m->status >> 38) & 0x7fff;
         u32 dimm = (m->misc >> 16) & 0x3;
         u32 channel = (m->misc >> 18) & 0x3;
         u32 syndrome = m->misc >> 32;
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index e6ad3bb6c1a6..4799393247c8 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -216,15 +216,33 @@ struct inbound_phy_packet_event {
         struct fw_cdev_event_phy_packet phy_packet;
 };
 
-static inline void __user *u64_to_uptr(__u64 value)
+#ifdef CONFIG_COMPAT
+static void __user *u64_to_uptr(u64 value)
+{
+        if (is_compat_task())
+                return compat_ptr(value);
+        else
+                return (void __user *)(unsigned long)value;
+}
+
+static u64 uptr_to_u64(void __user *ptr)
+{
+        if (is_compat_task())
+                return ptr_to_compat(ptr);
+        else
+                return (u64)(unsigned long)ptr;
+}
+#else
+static inline void __user *u64_to_uptr(u64 value)
 {
         return (void __user *)(unsigned long)value;
 }
 
-static inline __u64 uptr_to_u64(void __user *ptr)
+static inline u64 uptr_to_u64(void __user *ptr)
 {
-        return (__u64)(unsigned long)ptr;
+        return (u64)(unsigned long)ptr;
 }
+#endif /* CONFIG_COMPAT */
 
 static int fw_device_op_open(struct inode *inode, struct file *file)
 {
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index bcf792fac442..57cd3a406edf 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2179,8 +2179,13 @@ static int ohci_enable(struct fw_card *card,
                         ohci_driver_name, ohci)) {
                 fw_error("Failed to allocate interrupt %d.\n", dev->irq);
                 pci_disable_msi(dev);
-                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
-                                  ohci->config_rom, ohci->config_rom_bus);
+
+                if (config_rom) {
+                        dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+                                          ohci->next_config_rom,
+                                          ohci->next_config_rom_bus);
+                        ohci->next_config_rom = NULL;
+                }
                 return -EIO;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index a8ab6263e0d7..3c395a59da35 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -499,7 +499,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
         seq_printf(m, "Interrupts received: %d\n",
                    atomic_read(&dev_priv->irq_received));
         for (i = 0; i < I915_NUM_RINGS; i++) {
-                if (IS_GEN6(dev)) {
+                if (IS_GEN6(dev) || IS_GEN7(dev)) {
                         seq_printf(m, "Graphics Interrupt mask (%s):    %08x\n",
                                    dev_priv->ring[i].name,
                                    I915_READ_IMR(&dev_priv->ring[i]));
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index feb4f164fd1b..7916bd97d5c1 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -36,6 +36,7 @@
 #include <linux/io-mapping.h>
 #include <linux/i2c.h>
 #include <drm/intel-gtt.h>
+#include <linux/backlight.h>
 
 /* General customization:
  */
@@ -690,6 +691,7 @@ typedef struct drm_i915_private {
         int child_dev_num;
         struct child_device_config *child_dev;
         struct drm_connector *int_lvds_connector;
+        struct drm_connector *int_edp_connector;
 
         bool mchbar_need_disable;
 
@@ -723,6 +725,8 @@ typedef struct drm_i915_private {
         /* list of fbdev register on this device */
         struct intel_fbdev *fbdev;
 
+        struct backlight_device *backlight;
+
         struct drm_property *broadcast_rgb_property;
         struct drm_property *force_audio_property;
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 02f96fd0d52d..9cbb0cd8f46a 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2058,8 +2058,10 @@ void intel_irq_init(struct drm_device *dev)
                 dev->driver->get_vblank_counter = gm45_get_vblank_counter;
         }
 
-
-        dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
+        else
+                dev->driver->get_vblank_timestamp = NULL;
         dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
 
         if (IS_IVYBRIDGE(dev)) {
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index d1331f771e2f..542453f7498c 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -375,6 +375,7 @@
 # define MI_FLUSH_ENABLE                                (1 << 11)
 
 #define GFX_MODE        0x02520
+#define GFX_MODE_GEN7   0x0229c
 #define   GFX_RUN_LIST_ENABLE           (1<<15)
 #define   GFX_TLB_INVALIDATE_ALWAYS     (1<<13)
 #define   GFX_SURFACE_FAULT_ENABLE      (1<<12)
@@ -382,6 +383,9 @@
 #define   GFX_PSMI_GRANULARITY          (1<<10)
 #define   GFX_PPGTT_ENABLE              (1<<9)
 
+#define GFX_MODE_ENABLE(bit) (((bit) << 16) | (bit))
+#define GFX_MODE_DISABLE(bit) (((bit) << 16) | (0))
+
 #define SCPD0           0x0209c /* 915+ only */
 #define IER             0x020a0
 #define IIR             0x020a4
@@ -1318,6 +1322,7 @@
 #define   ADPA_PIPE_SELECT_MASK (1<<30)
 #define   ADPA_PIPE_A_SELECT    0
 #define   ADPA_PIPE_B_SELECT    (1<<30)
+#define   ADPA_PIPE_SELECT(pipe) ((pipe) << 30)
 #define   ADPA_USE_VGA_HVPOLARITY (1<<15)
 #define   ADPA_SETS_HVPOLARITY  0
 #define   ADPA_VSYNC_CNTL_DISABLE (1<<11)
@@ -1460,6 +1465,7 @@
 /* Selects pipe B for LVDS data.  Must be set on pre-965. */
 #define   LVDS_PIPEB_SELECT             (1 << 30)
 #define   LVDS_PIPE_MASK                (1 << 30)
+#define   LVDS_PIPE(pipe)               ((pipe) << 30)
 /* LVDS dithering flag on 965/g4x platform */
 #define   LVDS_ENABLE_DITHER            (1 << 25)
 /* LVDS sync polarity flags. Set to invert (i.e. negative) */
@@ -1499,9 +1505,6 @@
 #define   LVDS_B0B3_POWER_DOWN          (0 << 2)
 #define   LVDS_B0B3_POWER_UP            (3 << 2)
 
-#define LVDS_PIPE_ENABLED(V, P) \
-        (((V) & (LVDS_PIPE_MASK | LVDS_PORT_EN)) == ((P) << 30 | LVDS_PORT_EN))
-
 /* Video Data Island Packet control */
 #define VIDEO_DIP_DATA          0x61178
 #define VIDEO_DIP_CTL           0x61170
@@ -3256,14 +3259,12 @@
 #define  ADPA_CRT_HOTPLUG_VOLREF_475MV  (1<<17)
 #define  ADPA_CRT_HOTPLUG_FORCE_TRIGGER (1<<16)
 
-#define ADPA_PIPE_ENABLED(V, P) \
-        (((V) & (ADPA_TRANS_SELECT_MASK | ADPA_DAC_ENABLE)) == ((P) << 30 | ADPA_DAC_ENABLE))
-
 /* or SDVOB */
 #define HDMIB   0xe1140
 #define  PORT_ENABLE    (1 << 31)
 #define  TRANSCODER_A   (0)
 #define  TRANSCODER_B   (1 << 30)
+#define  TRANSCODER(pipe)       ((pipe) << 30)
 #define  TRANSCODER_MASK   (1 << 30)
 #define  COLOR_FORMAT_8bpc      (0)
 #define  COLOR_FORMAT_12bpc     (3 << 26)
@@ -3280,9 +3281,6 @@
 #define  HSYNC_ACTIVE_HIGH      (1 << 3)
 #define  PORT_DETECTED          (1 << 2)
 
-#define HDMI_PIPE_ENABLED(V, P) \
-        (((V) & (TRANSCODER_MASK | PORT_ENABLE)) == ((P) << 30 | PORT_ENABLE))
-
 /* PCH SDVOB multiplex with HDMIB */
 #define PCH_SDVOB       HDMIB
 
@@ -3349,6 +3347,7 @@
 #define  PORT_TRANS_B_SEL_CPT   (1<<29)
 #define  PORT_TRANS_C_SEL_CPT   (2<<29)
 #define  PORT_TRANS_SEL_MASK    (3<<29)
+#define  PORT_TRANS_SEL_CPT(pipe)       ((pipe) << 29)
 
 #define TRANS_DP_CTL_A          0xe0300
 #define TRANS_DP_CTL_B          0xe1300
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 87677d60d0df..f10742359ec9 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -871,7 +871,8 @@ int i915_restore_state(struct drm_device *dev)
         }
         mutex_unlock(&dev->struct_mutex);
 
-        intel_init_clock_gating(dev);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                intel_init_clock_gating(dev);
 
         if (IS_IRONLAKE_M(dev)) {
                 ironlake_enable_drps(dev);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 35364e68a091..ee1d701317f7 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -980,8 +980,8 @@ static void assert_transcoder_disabled(struct drm_i915_private *dev_priv,
              pipe_name(pipe));
 }
 
-static bool dp_pipe_enabled(struct drm_i915_private *dev_priv, enum pipe pipe,
-                            int reg, u32 port_sel, u32 val)
+static bool dp_pipe_enabled(struct drm_i915_private *dev_priv,
+                            enum pipe pipe, u32 port_sel, u32 val)
 {
         if ((val & DP_PORT_EN) == 0)
                 return false;
@@ -998,11 +998,58 @@ static bool dp_pipe_enabled(struct drm_i915_private *dev_priv, enum pipe pipe,
         return true;
 }
 
+static bool hdmi_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & PORT_ENABLE) == 0)
+                return false;
+
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & TRANSCODER_MASK) != TRANSCODER(pipe))
+                        return false;
+        }
+        return true;
+}
+
+static bool lvds_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & LVDS_PORT_EN) == 0)
+                return false;
+
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & LVDS_PIPE_MASK) != LVDS_PIPE(pipe))
+                        return false;
+        }
+        return true;
+}
+
+static bool adpa_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & ADPA_DAC_ENABLE) == 0)
+                return false;
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & ADPA_PIPE_SELECT_MASK) != ADPA_PIPE_SELECT(pipe))
+                        return false;
+        }
+        return true;
+}
+
 static void assert_pch_dp_disabled(struct drm_i915_private *dev_priv,
                                    enum pipe pipe, int reg, u32 port_sel)
 {
         u32 val = I915_READ(reg);
-        WARN(dp_pipe_enabled(dev_priv, pipe, reg, port_sel, val),
+        WARN(dp_pipe_enabled(dev_priv, pipe, port_sel, val),
              "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
              reg, pipe_name(pipe));
 }
@@ -1011,7 +1058,7 @@ static void assert_pch_hdmi_disabled(struct drm_i915_private *dev_priv,
                                      enum pipe pipe, int reg)
 {
         u32 val = I915_READ(reg);
-        WARN(HDMI_PIPE_ENABLED(val, pipe),
+        WARN(hdmi_pipe_enabled(dev_priv, val, pipe),
              "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
              reg, pipe_name(pipe));
 }
@@ -1028,13 +1075,13 @@ static void assert_pch_ports_disabled(struct drm_i915_private *dev_priv,
 
         reg = PCH_ADPA;
         val = I915_READ(reg);
-        WARN(ADPA_PIPE_ENABLED(val, pipe),
+        WARN(adpa_pipe_enabled(dev_priv, val, pipe),
              "PCH VGA enabled on transcoder %c, should be disabled\n",
              pipe_name(pipe));
 
         reg = PCH_LVDS;
         val = I915_READ(reg);
-        WARN(LVDS_PIPE_ENABLED(val, pipe),
+        WARN(lvds_pipe_enabled(dev_priv, val, pipe),
              "PCH LVDS enabled on transcoder %c, should be disabled\n",
              pipe_name(pipe));
 
@@ -1360,7 +1407,7 @@ static void disable_pch_dp(struct drm_i915_private *dev_priv,
                            enum pipe pipe, int reg, u32 port_sel)
 {
         u32 val = I915_READ(reg);
-        if (dp_pipe_enabled(dev_priv, pipe, reg, port_sel, val)) {
+        if (dp_pipe_enabled(dev_priv, pipe, port_sel, val)) {
                 DRM_DEBUG_KMS("Disabling pch dp %x on pipe %d\n", reg, pipe);
                 I915_WRITE(reg, val & ~DP_PORT_EN);
         }
@@ -1370,7 +1417,7 @@ static void disable_pch_hdmi(struct drm_i915_private *dev_priv,
                              enum pipe pipe, int reg)
 {
         u32 val = I915_READ(reg);
-        if (HDMI_PIPE_ENABLED(val, pipe)) {
+        if (hdmi_pipe_enabled(dev_priv, val, pipe)) {
                 DRM_DEBUG_KMS("Disabling pch HDMI %x on pipe %d\n",
                               reg, pipe);
                 I915_WRITE(reg, val & ~PORT_ENABLE);
@@ -1392,12 +1439,13 @@ static void intel_disable_pch_ports(struct drm_i915_private *dev_priv,
 
         reg = PCH_ADPA;
         val = I915_READ(reg);
-        if (ADPA_PIPE_ENABLED(val, pipe))
+        if (adpa_pipe_enabled(dev_priv, val, pipe))
                 I915_WRITE(reg, val & ~ADPA_DAC_ENABLE);
 
         reg = PCH_LVDS;
         val = I915_READ(reg);
-        if (LVDS_PIPE_ENABLED(val, pipe)) {
+        if (lvds_pipe_enabled(dev_priv, val, pipe)) {
+                DRM_DEBUG_KMS("disable lvds on pipe %d val 0x%08x\n", pipe, val);
                 I915_WRITE(reg, val & ~LVDS_PORT_EN);
                 POSTING_READ(reg);
                 udelay(100);
@@ -5049,6 +5097,81 @@ static int i9xx_crtc_mode_set(struct drm_crtc *crtc,
         return ret;
 }
 
+static void ironlake_update_pch_refclk(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_mode_config *mode_config = &dev->mode_config;
+        struct drm_crtc *crtc;
+        struct intel_encoder *encoder;
+        struct intel_encoder *has_edp_encoder = NULL;
+        u32 temp;
+        bool has_lvds = false;
+
+        /* We need to take the global config into account */
+        list_for_each_entry(crtc, &mode_config->crtc_list, head) {
+                if (!crtc->enabled)
+                        continue;
+
+                list_for_each_entry(encoder, &mode_config->encoder_list,
+                                    base.head) {
+                        if (encoder->base.crtc != crtc)
+                                continue;
+
+                        switch (encoder->type) {
+                        case INTEL_OUTPUT_LVDS:
+                                has_lvds = true;
+                        case INTEL_OUTPUT_EDP:
+                                has_edp_encoder = encoder;
+                                break;
+                        }
+                }
+        }
+
+        /* Ironlake: try to setup display ref clock before DPLL
+         * enabling. This is only under driver's control after
+         * PCH B stepping, previous chipset stepping should be
+         * ignoring this setting.
+         */
+        temp = I915_READ(PCH_DREF_CONTROL);
+        /* Always enable nonspread source */
+        temp &= ~DREF_NONSPREAD_SOURCE_MASK;
+        temp |= DREF_NONSPREAD_SOURCE_ENABLE;
+        temp &= ~DREF_SSC_SOURCE_MASK;
+        temp |= DREF_SSC_SOURCE_ENABLE;
+        I915_WRITE(PCH_DREF_CONTROL, temp);
+
+        POSTING_READ(PCH_DREF_CONTROL);
+        udelay(200);
+
+        if (has_edp_encoder) {
+                if (intel_panel_use_ssc(dev_priv)) {
+                        temp |= DREF_SSC1_ENABLE;
+                        I915_WRITE(PCH_DREF_CONTROL, temp);
+
+                        POSTING_READ(PCH_DREF_CONTROL);
+                        udelay(200);
+                }
+                temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
+
+                /* Enable CPU source on CPU attached eDP */
+                if (!intel_encoder_is_pch_edp(&has_edp_encoder->base)) {
+                        if (intel_panel_use_ssc(dev_priv))
+                                temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD;
+                        else
+                                temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
+                } else {
+                        /* Enable SSC on PCH eDP if needed */
+                        if (intel_panel_use_ssc(dev_priv)) {
+                                DRM_ERROR("enabling SSC on PCH\n");
+                                temp |= DREF_SUPERSPREAD_SOURCE_ENABLE;
+                        }
+                }
+                I915_WRITE(PCH_DREF_CONTROL, temp);
+                POSTING_READ(PCH_DREF_CONTROL);
+                udelay(200);
+        }
+}
+
 static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
                                   struct drm_display_mode *mode,
                                   struct drm_display_mode *adjusted_mode,
@@ -5244,49 +5367,7 @@ static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
         ironlake_compute_m_n(intel_crtc->bpp, lane, target_clock, link_bw,
                              &m_n);
 
-        /* Ironlake: try to setup display ref clock before DPLL
-         * enabling. This is only under driver's control after
-         * PCH B stepping, previous chipset stepping should be
-         * ignoring this setting.
-         */
-        temp = I915_READ(PCH_DREF_CONTROL);
-        /* Always enable nonspread source */
-        temp &= ~DREF_NONSPREAD_SOURCE_MASK;
-        temp |= DREF_NONSPREAD_SOURCE_ENABLE;
-        temp &= ~DREF_SSC_SOURCE_MASK;
-        temp |= DREF_SSC_SOURCE_ENABLE;
-        I915_WRITE(PCH_DREF_CONTROL, temp);
-
-        POSTING_READ(PCH_DREF_CONTROL);
-        udelay(200);
-
-        if (has_edp_encoder) {
-                if (intel_panel_use_ssc(dev_priv)) {
-                        temp |= DREF_SSC1_ENABLE;
-                        I915_WRITE(PCH_DREF_CONTROL, temp);
-
-                        POSTING_READ(PCH_DREF_CONTROL);
-                        udelay(200);
-                }
-                temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
-
-                /* Enable CPU source on CPU attached eDP */
-                if (!intel_encoder_is_pch_edp(&has_edp_encoder->base)) {
-                        if (intel_panel_use_ssc(dev_priv))
-                                temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD;
-                        else
-                                temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
-                } else {
-                        /* Enable SSC on PCH eDP if needed */
-                        if (intel_panel_use_ssc(dev_priv)) {
-                                DRM_ERROR("enabling SSC on PCH\n");
-                                temp |= DREF_SUPERSPREAD_SOURCE_ENABLE;
-                        }
-                }
-                I915_WRITE(PCH_DREF_CONTROL, temp);
-                POSTING_READ(PCH_DREF_CONTROL);
-                udelay(200);
-        }
+        ironlake_update_pch_refclk(dev);
 
         fp = clock.n << 16 | clock.m1 << 8 | clock.m2;
         if (has_reduced_clock)
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 0feae908bb37..44fef5e1c490 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1841,6 +1841,11 @@ done:
 static void
 intel_dp_destroy (struct drm_connector *connector)
 {
+        struct drm_device *dev = connector->dev;
+
+        if (intel_dpd_is_edp(dev))
+                intel_panel_destroy_backlight(dev);
+
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
         kfree(connector);
@@ -2072,6 +2077,8 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                                         DRM_MODE_TYPE_PREFERRED;
                         }
                 }
+                dev_priv->int_edp_connector = connector;
+                intel_panel_setup_backlight(dev);
         }
 
         intel_dp_add_properties(intel_dp, connector);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 7b330e76a435..0b2ee9d39980 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -297,9 +297,10 @@ extern void intel_pch_panel_fitting(struct drm_device *dev,
 extern u32 intel_panel_get_max_backlight(struct drm_device *dev);
 extern u32 intel_panel_get_backlight(struct drm_device *dev);
 extern void intel_panel_set_backlight(struct drm_device *dev, u32 level);
-extern void intel_panel_setup_backlight(struct drm_device *dev);
+extern int intel_panel_setup_backlight(struct drm_device *dev);
 extern void intel_panel_enable_backlight(struct drm_device *dev);
 extern void intel_panel_disable_backlight(struct drm_device *dev);
+extern void intel_panel_destroy_backlight(struct drm_device *dev);
 extern enum drm_connector_status intel_panel_detect(struct drm_device *dev);
 
 extern void intel_crtc_load_lut(struct drm_crtc *crtc);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 2e8ddfcba40c..31da77f5c051 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -72,14 +72,16 @@ static void intel_lvds_enable(struct intel_lvds *intel_lvds)
 {
         struct drm_device *dev = intel_lvds->base.base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 ctl_reg, lvds_reg;
+        u32 ctl_reg, lvds_reg, stat_reg;
 
         if (HAS_PCH_SPLIT(dev)) {
                 ctl_reg = PCH_PP_CONTROL;
                 lvds_reg = PCH_LVDS;
+                stat_reg = PCH_PP_STATUS;
         } else {
                 ctl_reg = PP_CONTROL;
                 lvds_reg = LVDS;
+                stat_reg = PP_STATUS;
         }
 
         I915_WRITE(lvds_reg, I915_READ(lvds_reg) | LVDS_PORT_EN);
@@ -94,17 +96,16 @@ static void intel_lvds_enable(struct intel_lvds *intel_lvds)
                 DRM_DEBUG_KMS("applying panel-fitter: %x, %x\n",
                               intel_lvds->pfit_control,
                               intel_lvds->pfit_pgm_ratios);
-                if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000)) {
-                        DRM_ERROR("timed out waiting for panel to power off\n");
-                } else {
-                        I915_WRITE(PFIT_PGM_RATIOS, intel_lvds->pfit_pgm_ratios);
-                        I915_WRITE(PFIT_CONTROL, intel_lvds->pfit_control);
-                        intel_lvds->pfit_dirty = false;
-                }
+
+                I915_WRITE(PFIT_PGM_RATIOS, intel_lvds->pfit_pgm_ratios);
+                I915_WRITE(PFIT_CONTROL, intel_lvds->pfit_control);
+                intel_lvds->pfit_dirty = false;
         }
 
         I915_WRITE(ctl_reg, I915_READ(ctl_reg) | POWER_TARGET_ON);
         POSTING_READ(lvds_reg);
+        if (wait_for((I915_READ(stat_reg) & PP_ON) != 0, 1000))
+                DRM_ERROR("timed out waiting for panel to power on\n");
 
         intel_panel_enable_backlight(dev);
 }
@@ -113,24 +114,25 @@ static void intel_lvds_disable(struct intel_lvds *intel_lvds)
 {
         struct drm_device *dev = intel_lvds->base.base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 ctl_reg, lvds_reg;
+        u32 ctl_reg, lvds_reg, stat_reg;
 
         if (HAS_PCH_SPLIT(dev)) {
                 ctl_reg = PCH_PP_CONTROL;
                 lvds_reg = PCH_LVDS;
+                stat_reg = PCH_PP_STATUS;
         } else {
                 ctl_reg = PP_CONTROL;
                 lvds_reg = LVDS;
+                stat_reg = PP_STATUS;
         }
 
         intel_panel_disable_backlight(dev);
 
         I915_WRITE(ctl_reg, I915_READ(ctl_reg) & ~POWER_TARGET_ON);
+        if (wait_for((I915_READ(stat_reg) & PP_ON) == 0, 1000))
+                DRM_ERROR("timed out waiting for panel to power off\n");
 
         if (intel_lvds->pfit_control) {
-                if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000))
-                        DRM_ERROR("timed out waiting for panel to power off\n");
-
                 I915_WRITE(PFIT_CONTROL, 0);
                 intel_lvds->pfit_dirty = true;
         }
@@ -398,53 +400,21 @@ out:
 
 static void intel_lvds_prepare(struct drm_encoder *encoder)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
 
-        /* We try to do the minimum that is necessary in order to unlock
-         * the registers for mode setting.
-         *
-         * On Ironlake, this is quite simple as we just set the unlock key
-         * and ignore all subtleties. (This may cause some issues...)
-         *
+        /*
          * Prior to Ironlake, we must disable the pipe if we want to adjust
          * the panel fitter. However at all other times we can just reset
          * the registers regardless.
          */
-
-        if (HAS_PCH_SPLIT(dev)) {
-                I915_WRITE(PCH_PP_CONTROL,
-                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
-        } else if (intel_lvds->pfit_dirty) {
-                I915_WRITE(PP_CONTROL,
-                           (I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS)
-                           & ~POWER_TARGET_ON);
-        } else {
-                I915_WRITE(PP_CONTROL,
-                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
-        }
+        if (!HAS_PCH_SPLIT(encoder->dev) && intel_lvds->pfit_dirty)
+                intel_lvds_disable(intel_lvds);
 }
 
 static void intel_lvds_commit(struct drm_encoder *encoder)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
 
-        /* Undo any unlocking done in prepare to prevent accidental
-         * adjustment of the registers.
-         */
-        if (HAS_PCH_SPLIT(dev)) {
-                u32 val = I915_READ(PCH_PP_CONTROL);
-                if ((val & PANEL_UNLOCK_REGS) == PANEL_UNLOCK_REGS)
-                        I915_WRITE(PCH_PP_CONTROL, val & 0x3);
-        } else {
-                u32 val = I915_READ(PP_CONTROL);
-                if ((val & PANEL_UNLOCK_REGS) == PANEL_UNLOCK_REGS)
-                        I915_WRITE(PP_CONTROL, val & 0x3);
-        }
-
         /* Always do a full power on as we do not know what state
          * we were left in.
          */
@@ -582,6 +552,8 @@ static void intel_lvds_destroy(struct drm_connector *connector)
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
 
+        intel_panel_destroy_backlight(dev);
+
         if (dev_priv->lid_notifier.notifier_call)
                 acpi_lid_notifier_unregister(&dev_priv->lid_notifier);
         drm_sysfs_connector_remove(connector);
@@ -1040,6 +1012,19 @@ out:
                 pwm = I915_READ(BLC_PWM_PCH_CTL1);
                 pwm |= PWM_PCH_ENABLE;
                 I915_WRITE(BLC_PWM_PCH_CTL1, pwm);
+                /*
+                 * Unlock registers and just
+                 * leave them unlocked
+                 */
+                I915_WRITE(PCH_PP_CONTROL,
+                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+        } else {
+                /*
+                 * Unlock registers and just
+                 * leave them unlocked
+                 */
+                I915_WRITE(PP_CONTROL,
+                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
         }
         dev_priv->lid_notifier.notifier_call = intel_lid_notify;
         if (acpi_lid_notifier_register(&dev_priv->lid_notifier)) {
@@ -1049,6 +1034,9 @@ out:
         /* keep the LVDS connector */
         dev_priv->int_lvds_connector = connector;
         drm_sysfs_connector_add(connector);
+
+        intel_panel_setup_backlight(dev);
+
         return true;
 
 failed:
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index b7c5ddb564d1..b8e8158bb16e 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -227,7 +227,6 @@ void intel_opregion_asle_intr(struct drm_device *dev)
         asle->aslc = asle_stat;
 }
 
-/* Only present on Ironlake+ */
 void intel_opregion_gse_intr(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 05f500cd9c24..a9e0c7bcd317 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -277,7 +277,7 @@ void intel_panel_enable_backlight(struct drm_device *dev)
         dev_priv->backlight_enabled = true;
 }
 
-void intel_panel_setup_backlight(struct drm_device *dev)
+static void intel_panel_init_backlight(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
@@ -309,3 +309,73 @@ intel_panel_detect(struct drm_device *dev)
 
         return connector_status_unknown;
 }
+
+#ifdef CONFIG_BACKLIGHT_CLASS_DEVICE
+static int intel_panel_update_status(struct backlight_device *bd)
+{
+        struct drm_device *dev = bl_get_data(bd);
+        intel_panel_set_backlight(dev, bd->props.brightness);
+        return 0;
+}
+
+static int intel_panel_get_brightness(struct backlight_device *bd)
+{
+        struct drm_device *dev = bl_get_data(bd);
+        return intel_panel_get_backlight(dev);
+}
+
+static const struct backlight_ops intel_panel_bl_ops = {
+        .update_status = intel_panel_update_status,
+        .get_brightness = intel_panel_get_brightness,
+};
+
+int intel_panel_setup_backlight(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct backlight_properties props;
+        struct drm_connector *connector;
+
+        intel_panel_init_backlight(dev);
+
+        if (dev_priv->int_lvds_connector)
+                connector = dev_priv->int_lvds_connector;
+        else if (dev_priv->int_edp_connector)
+                connector = dev_priv->int_edp_connector;
+        else
+                return -ENODEV;
+
+        props.type = BACKLIGHT_RAW;
+        props.max_brightness = intel_panel_get_max_backlight(dev);
+        dev_priv->backlight =
+                backlight_device_register("intel_backlight",
+                                          &connector->kdev, dev,
+                                          &intel_panel_bl_ops, &props);
+
+        if (IS_ERR(dev_priv->backlight)) {
+                DRM_ERROR("Failed to register backlight: %ld\n",
+                          PTR_ERR(dev_priv->backlight));
+                dev_priv->backlight = NULL;
+                return -ENODEV;
+        }
+        dev_priv->backlight->props.brightness = intel_panel_get_backlight(dev);
+        return 0;
+}
+
+void intel_panel_destroy_backlight(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (dev_priv->backlight)
+                backlight_device_unregister(dev_priv->backlight);
+}
+#else
+int intel_panel_setup_backlight(struct drm_device *dev)
+{
+        intel_panel_init_backlight(dev);
+        return 0;
+}
+
+void intel_panel_destroy_backlight(struct drm_device *dev)
+{
+        return;
+}
+#endif
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 47b9b2777038..c30626ea9f93 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -290,6 +290,10 @@ static int init_render_ring(struct intel_ring_buffer *ring)
                 if (IS_GEN6(dev) || IS_GEN7(dev))
                         mode |= MI_FLUSH_ENABLE << 16 | MI_FLUSH_ENABLE;
                 I915_WRITE(MI_MODE, mode);
+                if (IS_GEN7(dev))
+                        I915_WRITE(GFX_MODE_GEN7,
+                                   GFX_MODE_DISABLE(GFX_TLB_INVALIDATE_ALWAYS) |
+                                   GFX_MODE_ENABLE(GFX_REPLAY_MODE));
         }
 
         if (INTEL_INFO(dev)->gen >= 6) {
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 645b84b3d203..7ad43c6b1db7 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -613,6 +613,18 @@ static bool radeon_dp_get_link_status(struct radeon_connector *radeon_connector,
         return true;
 }
 
+bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector)
+{
+        u8 link_status[DP_LINK_STATUS_SIZE];
+        struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
+
+        if (!radeon_dp_get_link_status(radeon_connector, link_status))
+                return false;
+        if (dp_channel_eq_ok(link_status, dig->dp_lane_count))
+                return false;
+        return true;
+}
+
 struct radeon_dp_link_train_info {
         struct radeon_device *rdev;
         struct drm_encoder *encoder;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 14dce9f22172..fb5fa0898868 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -743,7 +743,7 @@ static void evergreen_program_watermarks(struct radeon_device *rdev,
                     !evergreen_average_bandwidth_vs_available_bandwidth(&wm) ||
                     !evergreen_check_latency_hiding(&wm) ||
                     (rdev->disp_priority == 2)) {
-                        DRM_INFO("force priority to high\n");
+                        DRM_DEBUG_KMS("force priority to high\n");
                         priority_a_cnt |= PRIORITY_ALWAYS_ON;
                         priority_b_cnt |= PRIORITY_ALWAYS_ON;
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 6d6b5f16bc09..7f65940f918f 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -60,18 +60,20 @@ void radeon_connector_hotplug(struct drm_connector *connector)
 
         radeon_hpd_set_polarity(rdev, radeon_connector->hpd.hpd);
 
-        /* powering up/down the eDP panel generates hpd events which
-         * can interfere with modesetting.
-         */
-        if (connector->connector_type == DRM_MODE_CONNECTOR_eDP)
+        /* if the connector is already off, don't turn it back on */
+        if (connector->dpms != DRM_MODE_DPMS_ON)
                 return;
 
-        /* pre-r600 did not always have the hpd pins mapped accurately to connectors */
-        if (rdev->family >= CHIP_R600) {
-                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd))
+        /* just deal with DP (not eDP) here. */
+        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
+                int saved_dpms = connector->dpms;
+
+                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
+                    radeon_dp_needs_link_train(radeon_connector))
                         drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                 else
                         drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                connector->dpms = saved_dpms;
         }
 }
 
@@ -474,11 +476,19 @@ static void radeon_fixup_lvds_native_mode(struct drm_encoder *encoder,
 {
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+        struct drm_display_mode *t, *mode;
+
+        /* If the EDID preferred mode doesn't match the native mode, use it */
+        list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
+                if (mode->type & DRM_MODE_TYPE_PREFERRED) {
+                        if (mode->hdisplay != native_mode->hdisplay ||
+                            mode->vdisplay != native_mode->vdisplay)
+                                memcpy(native_mode, mode, sizeof(*mode));
+                }
+        }
 
         /* Try to get native mode details from EDID if necessary */
         if (!native_mode->clock) {
-                struct drm_display_mode *t, *mode;
-
                 list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
                         if (mode->hdisplay == native_mode->hdisplay &&
                             mode->vdisplay == native_mode->vdisplay) {
@@ -489,6 +499,7 @@ static void radeon_fixup_lvds_native_mode(struct drm_encoder *encoder,
                         }
                 }
         }
+
         if (!native_mode->clock) {
                 DRM_DEBUG_KMS("No LVDS native mode details, disabling RMX\n");
                 radeon_encoder->rmx_type = RMX_OFF;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 440e6ecccc40..a3b011b49465 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -32,6 +32,7 @@
 #include <drm/radeon_drm.h>
 #include <linux/vgaarb.h>
 #include <linux/vga_switcheroo.h>
+#include <linux/efi.h>
 #include "radeon_reg.h"
 #include "radeon.h"
 #include "atom.h"
@@ -348,6 +349,9 @@ bool radeon_card_posted(struct radeon_device *rdev)
 {
         uint32_t reg;
 
+        if (efi_enabled && rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
+                return false;
+
         /* first check CRTCs */
         if (ASIC_IS_DCE41(rdev)) {
                 reg = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET) |
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index b293487e5aa3..319d85d7e759 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -2323,6 +2323,9 @@ radeon_add_atom_encoder(struct drm_device *dev,
         default:
                 encoder->possible_crtcs = 0x3;
                 break;
+        case 4:
+                encoder->possible_crtcs = 0xf;
+                break;
         case 6:
                 encoder->possible_crtcs = 0x3f;
                 break;
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index d09031c03e26..68820f5f6303 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -479,6 +479,7 @@ extern void radeon_dp_set_link_config(struct drm_connector *connector,
                                       struct drm_display_mode *mode);
 extern void radeon_dp_link_train(struct drm_encoder *encoder,
                                  struct drm_connector *connector);
+extern bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector);
 extern u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector);
 extern bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector);
 extern void atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mode);
diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
index 1a409c5bc9bc..c316294c48b4 100644
--- a/drivers/hwmon/ibmaem.c
+++ b/drivers/hwmon/ibmaem.c
@@ -432,13 +432,15 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
         aem_send_message(ipmi);
 
         res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT);
-        if (!res)
-                return -ETIMEDOUT;
+        if (!res) {
+                res = -ETIMEDOUT;
+                goto out;
+        }
 
         if (ipmi->rx_result || ipmi->rx_msg_len != rs_size ||
             memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) {
-                kfree(rs_resp);
-                return -ENOENT;
+                res = -ENOENT;
+                goto out;
         }
 
         switch (size) {
@@ -463,8 +465,11 @@ static int aem_read_sensor(struct aem_data *data, u8 elt, u8 reg,
                 break;
         }
         }
+        res = 0;
 
-        return 0;
+out:
+        kfree(rs_resp);
+        return res;
 }
 
 /* Update AEM energy registers */
diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c
index d4bc114572de..ac254fba551b 100644
--- a/drivers/hwmon/pmbus/lm25066.c
+++ b/drivers/hwmon/pmbus/lm25066.c
@@ -161,6 +161,17 @@ static int lm25066_write_word_data(struct i2c_client *client, int page, int reg,
         return ret;
 }
 
+static int lm25066_write_byte(struct i2c_client *client, int page, u8 value)
+{
+        if (page > 1)
+                return -EINVAL;
+
+        if (page == 0)
+                return pmbus_write_byte(client, 0, value);
+
+        return 0;
+}
+
 static int lm25066_probe(struct i2c_client *client,
                           const struct i2c_device_id *id)
 {
@@ -204,6 +215,7 @@ static int lm25066_probe(struct i2c_client *client,
 
         info->read_word_data = lm25066_read_word_data;
         info->write_word_data = lm25066_write_word_data;
+        info->write_byte = lm25066_write_byte;
 
         switch (id->driver_data) {
         case lm25066:
diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h
index 0808d986d75b..a6ae20ffef6b 100644
--- a/drivers/hwmon/pmbus/pmbus.h
+++ b/drivers/hwmon/pmbus/pmbus.h
@@ -325,6 +325,7 @@ struct pmbus_driver_info {
         int (*read_word_data)(struct i2c_client *client, int page, int reg);
         int (*write_word_data)(struct i2c_client *client, int page, int reg,
                                u16 word);
+        int (*write_byte)(struct i2c_client *client, int page, u8 value);
         /*
          * The identify function determines supported PMBus functionality.
          * This function is only necessary if a chip driver supports multiple
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 5c1b6cf31701..a561c3a0e916 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -182,6 +182,24 @@ int pmbus_write_byte(struct i2c_client *client, int page, u8 value)
 }
 EXPORT_SYMBOL_GPL(pmbus_write_byte);
 
+/*
+ * _pmbus_write_byte() is similar to pmbus_write_byte(), but checks if
+ * a device specific mapping funcion exists and calls it if necessary.
+ */
+static int _pmbus_write_byte(struct i2c_client *client, int page, u8 value)
+{
+        struct pmbus_data *data = i2c_get_clientdata(client);
+        const struct pmbus_driver_info *info = data->info;
+        int status;
+
+        if (info->write_byte) {
+                status = info->write_byte(client, page, value);
+                if (status != -ENODATA)
+                        return status;
+        }
+        return pmbus_write_byte(client, page, value);
+}
+
 int pmbus_write_word_data(struct i2c_client *client, u8 page, u8 reg, u16 word)
 {
         int rv;
@@ -281,7 +299,7 @@ static int _pmbus_read_byte_data(struct i2c_client *client, int page, int reg)
 
 static void pmbus_clear_fault_page(struct i2c_client *client, int page)
 {
-        pmbus_write_byte(client, page, PMBUS_CLEAR_FAULTS);
+        _pmbus_write_byte(client, page, PMBUS_CLEAR_FAULTS);
 }
 
 void pmbus_clear_faults(struct i2c_client *client)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 43f89ba0a908..fe89c4660d55 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -717,11 +717,13 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_neigh *neigh;
-        struct neighbour *n;
+        struct neighbour *n = NULL;
         unsigned long flags;
 
-        n = dst_get_neighbour(skb_dst(skb));
-        if (likely(skb_dst(skb) && n)) {
+        if (likely(skb_dst(skb)))
+                n = dst_get_neighbour(skb_dst(skb));
+
+        if (likely(n)) {
                 if (unlikely(!*to_ipoib_neigh(n))) {
                         ipoib_path_lookup(skb, dev);
                         return NETDEV_TX_OK;
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 8db008de5392..9c61b9c2c597 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -101,13 +101,17 @@ iscsi_iser_recv(struct iscsi_conn *conn,
 
         /* verify PDU length */
         datalen = ntoh24(hdr->dlength);
-        if (datalen != rx_data_len) {
-                printk(KERN_ERR "iscsi_iser: datalen %d (hdr) != %d (IB) \n",
-                       datalen, rx_data_len);
+        if (datalen > rx_data_len || (datalen + 4) < rx_data_len) {
+                iser_err("wrong datalen %d (hdr), %d (IB)\n",
+                        datalen, rx_data_len);
                 rc = ISCSI_ERR_DATALEN;
                 goto error;
         }
 
+        if (datalen != rx_data_len)
+                iser_dbg("aligned datalen (%d) hdr, %d (IB)\n",
+                        datalen, rx_data_len);
+
         /* read AHS */
         ahslen = hdr->hlength * 4;
 
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 342cbc1bdaae..db6f3ce9f3bf 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -89,7 +89,7 @@
         } while (0)
 
 #define SHIFT_4K        12
-#define SIZE_4K (1UL << SHIFT_4K)
+#define SIZE_4K (1ULL << SHIFT_4K)
 #define MASK_4K (~(SIZE_4K-1))
 
                                         /* support up to 512KB in one RDMA */
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 5745b7fe158c..f299de6b419b 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -412,7 +412,7 @@ int iser_send_control(struct iscsi_conn *conn,
                 memcpy(iser_conn->ib_conn->login_buf, task->data,
                                                         task->data_count);
                 tx_dsg->addr    = iser_conn->ib_conn->login_dma;
-                tx_dsg->length  = data_seg_len;
+                tx_dsg->length  = task->data_count;
                 tx_dsg->lkey    = device->mr->lkey;
                 mdesc->num_sge = 2;
         }
diff --git a/drivers/misc/cb710/core.c b/drivers/misc/cb710/core.c
index efec4139c3f6..68cd05b6d829 100644
--- a/drivers/misc/cb710/core.c
+++ b/drivers/misc/cb710/core.c
@@ -33,7 +33,7 @@ EXPORT_SYMBOL_GPL(cb710_pci_update_config_reg);
 static int __devinit cb710_pci_configure(struct pci_dev *pdev)
 {
         unsigned int devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
-        struct pci_dev *pdev0 = pci_get_slot(pdev->bus, devfn);
+        struct pci_dev *pdev0;
         u32 val;
 
         cb710_pci_update_config_reg(pdev, 0x48,
@@ -43,6 +43,7 @@ static int __devinit cb710_pci_configure(struct pci_dev *pdev)
         if (val & 0x80000000)
                 return 0;
 
+        pdev0 = pci_get_slot(pdev->bus, devfn);
         if (!pdev0)
                 return -ENODEV;
 
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index 006a5e9f8ab8..2bf229acd3b8 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -224,7 +224,7 @@ static void mmc_test_prepare_mrq(struct mmc_test_card *test,
 static int mmc_test_busy(struct mmc_command *cmd)
 {
         return !(cmd->resp[0] & R1_READY_FOR_DATA) ||
-                (R1_CURRENT_STATE(cmd->resp[0]) == 7);
+                (R1_CURRENT_STATE(cmd->resp[0]) == R1_STATE_PRG);
 }
 
 /*
@@ -2900,7 +2900,7 @@ static const struct file_operations mmc_test_fops_testlist = {
         .release        = single_release,
 };
 
-static void mmc_test_free_file_test(struct mmc_card *card)
+static void mmc_test_free_dbgfs_file(struct mmc_card *card)
 {
         struct mmc_test_dbgfs_file *df, *dfs;
 
@@ -2917,34 +2917,21 @@ static void mmc_test_free_file_test(struct mmc_card *card)
         mutex_unlock(&mmc_test_lock);
 }
 
-static int mmc_test_register_file_test(struct mmc_card *card)
+static int __mmc_test_register_dbgfs_file(struct mmc_card *card,
+        const char *name, mode_t mode, const struct file_operations *fops)
 {
         struct dentry *file = NULL;
         struct mmc_test_dbgfs_file *df;
-        int ret = 0;
-
-        mutex_lock(&mmc_test_lock);
-
-        if (card->debugfs_root)
-                file = debugfs_create_file("test", S_IWUSR | S_IRUGO,
-                        card->debugfs_root, card, &mmc_test_fops_test);
-
-        if (IS_ERR_OR_NULL(file)) {
-                dev_err(&card->dev,
-                        "Can't create test. Perhaps debugfs is disabled.\n");
-                ret = -ENODEV;
-                goto err;
-        }
 
         if (card->debugfs_root)
-                file = debugfs_create_file("testlist", S_IRUGO,
-                        card->debugfs_root, card, &mmc_test_fops_testlist);
+                file = debugfs_create_file(name, mode, card->debugfs_root,
+                        card, fops);
 
         if (IS_ERR_OR_NULL(file)) {
                 dev_err(&card->dev,
-                        "Can't create testlist. Perhaps debugfs is disabled.\n");
-                ret = -ENODEV;
-                goto err;
+                        "Can't create %s. Perhaps debugfs is disabled.\n",
+                        name);
+                return -ENODEV;
         }
 
         df = kmalloc(sizeof(struct mmc_test_dbgfs_file), GFP_KERNEL);
@@ -2952,14 +2939,31 @@ static int mmc_test_register_file_test(struct mmc_card *card)
                 debugfs_remove(file);
                 dev_err(&card->dev,
                         "Can't allocate memory for internal usage.\n");
-                ret = -ENOMEM;
-                goto err;
+                return -ENOMEM;
         }
 
         df->card = card;
         df->file = file;
 
         list_add(&df->link, &mmc_test_file_test);
+        return 0;
+}
+
+static int mmc_test_register_dbgfs_file(struct mmc_card *card)
+{
+        int ret;
+
+        mutex_lock(&mmc_test_lock);
+
+        ret = __mmc_test_register_dbgfs_file(card, "test", S_IWUSR | S_IRUGO,
+                &mmc_test_fops_test);
+        if (ret)
+                goto err;
+
+        ret = __mmc_test_register_dbgfs_file(card, "testlist", S_IRUGO,
+                &mmc_test_fops_testlist);
+        if (ret)
+                goto err;
 
 err:
         mutex_unlock(&mmc_test_lock);
@@ -2974,7 +2978,7 @@ static int mmc_test_probe(struct mmc_card *card)
         if (!mmc_card_mmc(card) && !mmc_card_sd(card))
                 return -ENODEV;
 
-        ret = mmc_test_register_file_test(card);
+        ret = mmc_test_register_dbgfs_file(card);
         if (ret)
                 return ret;
 
@@ -2986,7 +2990,7 @@ static int mmc_test_probe(struct mmc_card *card)
 static void mmc_test_remove(struct mmc_card *card)
 {
         mmc_test_free_result(card);
-        mmc_test_free_file_test(card);
+        mmc_test_free_dbgfs_file(card);
 }
 
 static struct mmc_driver mmc_driver = {
@@ -3006,7 +3010,7 @@ static void __exit mmc_test_exit(void)
 {
         /* Clear stalled data if card is still plugged */
         mmc_test_free_result(NULL);
-        mmc_test_free_file_test(NULL);
+        mmc_test_free_dbgfs_file(NULL);
 
         mmc_unregister_driver(&mmc_driver);
 }
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 89bdeaec7182..91a0a7460ebb 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1502,7 +1502,7 @@ static int mmc_do_erase(struct mmc_card *card, unsigned int from,
                         goto out;
                 }
         } while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
-                 R1_CURRENT_STATE(cmd.resp[0]) == 7);
+                 R1_CURRENT_STATE(cmd.resp[0]) == R1_STATE_PRG);
 out:
         return err;
 }
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index aa7d1d79b8c5..5700b1cbdfec 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -259,7 +259,7 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
         }
 
         card->ext_csd.rev = ext_csd[EXT_CSD_REV];
-        if (card->ext_csd.rev > 5) {
+        if (card->ext_csd.rev > 6) {
                 printk(KERN_ERR "%s: unrecognised EXT_CSD revision %d\n",
                         mmc_hostname(card->host), card->ext_csd.rev);
                 err = -EINVAL;
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index 845ce7c533b9..770c3d06f5dc 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -407,7 +407,7 @@ int mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
                         break;
                 if (mmc_host_is_spi(card->host))
                         break;
-        } while (R1_CURRENT_STATE(status) == 7);
+        } while (R1_CURRENT_STATE(status) == R1_STATE_PRG);
 
         if (mmc_host_is_spi(card->host)) {
                 if (status & R1_SPI_ILLEGAL_COMMAND)
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 77f0b6b1681d..ff0f714b012c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -62,7 +62,7 @@ struct idmac_desc {
 
         u32             des1;   /* Buffer sizes */
 #define IDMAC_SET_BUFFER1_SIZE(d, s) \
-        ((d)->des1 = ((d)->des1 & 0x03ffc000) | ((s) & 0x3fff))
+        ((d)->des1 = ((d)->des1 & 0x03ffe000) | ((s) & 0x1fff))
 
         u32             des2;   /* buffer 1 physical address */
 
@@ -699,7 +699,7 @@ static void dw_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         }
 
         /* DDR mode set */
-        if (ios->ddr) {
+        if (ios->timing == MMC_TIMING_UHS_DDR50) {
                 regs = mci_readl(slot->host, UHS_REG);
                 regs |= (0x1 << slot->id) << 16;
                 mci_writel(slot->host, UHS_REG, regs);
@@ -1646,7 +1646,7 @@ static int __init dw_mci_init_slot(struct dw_mci *host, unsigned int id)
                         mmc->caps |= MMC_CAP_4_BIT_DATA;
 
         if (host->pdata->quirks & DW_MCI_QUIRK_HIGHSPEED)
-                mmc->caps |= MMC_CAP_SD_HIGHSPEED;
+                mmc->caps |= MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED;
 
 #ifdef CONFIG_MMC_DW_IDMAC
         mmc->max_segs = host->ring_size;
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 9ebfb4b482f5..0e9780f5a4a9 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -27,6 +27,7 @@
 #include "sdhci-pltfm.h"
 #include "sdhci-esdhc.h"
 
+#define SDHCI_CTRL_D3CD                 0x08
 /* VENDOR SPEC register */
 #define SDHCI_VENDOR_SPEC               0xC0
 #define  SDHCI_VENDOR_SPEC_SDIO_QUIRK   0x00000002
@@ -141,13 +142,32 @@ static void esdhc_writel_le(struct sdhci_host *host, u32 val, int reg)
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
         struct pltfm_imx_data *imx_data = pltfm_host->priv;
         struct esdhc_platform_data *boarddata = &imx_data->boarddata;
-
-        if (unlikely((reg == SDHCI_INT_ENABLE || reg == SDHCI_SIGNAL_ENABLE)
-                        && (boarddata->cd_type == ESDHC_CD_GPIO)))
-                /*
-                 * these interrupts won't work with a custom card_detect gpio
-                 */
-                val &= ~(SDHCI_INT_CARD_REMOVE | SDHCI_INT_CARD_INSERT);
+        u32 data;
+
+        if (unlikely(reg == SDHCI_INT_ENABLE || reg == SDHCI_SIGNAL_ENABLE)) {
+                if (boarddata->cd_type == ESDHC_CD_GPIO)
+                        /*
+                         * These interrupts won't work with a custom
+                         * card_detect gpio (only applied to mx25/35)
+                         */
+                        val &= ~(SDHCI_INT_CARD_REMOVE | SDHCI_INT_CARD_INSERT);
+
+                if (val & SDHCI_INT_CARD_INT) {
+                        /*
+                         * Clear and then set D3CD bit to avoid missing the
+                         * card interrupt.  This is a eSDHC controller problem
+                         * so we need to apply the following workaround: clear
+                         * and set D3CD bit will make eSDHC re-sample the card
+                         * interrupt. In case a card interrupt was lost,
+                         * re-sample it by the following steps.
+                         */
+                        data = readl(host->ioaddr + SDHCI_HOST_CONTROL);
+                        data &= ~SDHCI_CTRL_D3CD;
+                        writel(data, host->ioaddr + SDHCI_HOST_CONTROL);
+                        data |= SDHCI_CTRL_D3CD;
+                        writel(data, host->ioaddr + SDHCI_HOST_CONTROL);
+                }
+        }
 
         if (unlikely((imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT)
                                 && (reg == SDHCI_INT_STATUS)
@@ -217,8 +237,10 @@ static void esdhc_writeb_le(struct sdhci_host *host, u8 val, int reg)
                  */
                 return;
         case SDHCI_HOST_CONTROL:
-                /* FSL messed up here, so we can just keep those two */
-                new_val = val & (SDHCI_CTRL_LED | SDHCI_CTRL_4BITBUS);
+                /* FSL messed up here, so we can just keep those three */
+                new_val = val & (SDHCI_CTRL_LED | \
+                                SDHCI_CTRL_4BITBUS | \
+                                SDHCI_CTRL_D3CD);
                 /* ensure the endianess */
                 new_val |= ESDHC_HOST_CONTROL_LE;
                 /* DMA mode bits are shifted */
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index 4198dbbc5c20..fc7e4a515629 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -195,7 +195,8 @@ static int __devinit sdhci_pxav3_probe(struct platform_device *pdev)
         clk_enable(clk);
 
         host->quirks = SDHCI_QUIRK_BROKEN_TIMEOUT_VAL
-                | SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC;
+                | SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC
+                | SDHCI_QUIRK_32BIT_ADMA_SIZE;
 
         /* enable 1/8V DDR capable */
         host->mmc->caps |= MMC_CAP_1_8V_DDR;
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 460ffaf0f6d7..2bd7bf4fece7 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -19,6 +19,7 @@
 #include <linux/clk.h>
 #include <linux/io.h>
 #include <linux/gpio.h>
+#include <linux/module.h>
 
 #include <linux/mmc/host.h>
 
@@ -502,6 +503,9 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
         /* This host supports the Auto CMD12 */
         host->quirks |= SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12;
 
+        /* Samsung SoCs need BROKEN_ADMA_ZEROLEN_DESC */
+        host->quirks |= SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC;
+
         if (pdata->cd_type == S3C_SDHCI_CD_NONE ||
             pdata->cd_type == S3C_SDHCI_CD_PERMANENT)
                 host->quirks |= SDHCI_QUIRK_BROKEN_CARD_DETECTION;
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index c31a3343340d..0e02cc1df12e 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -628,12 +628,11 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
         /* timeout in us */
         if (!data)
                 target_timeout = cmd->cmd_timeout_ms * 1000;
-        else
-                target_timeout = data->timeout_ns / 1000 +
-                        data->timeout_clks / host->clock;
-
-        if (host->quirks & SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)
-                host->timeout_clk = host->clock / 1000;
+        else {
+                target_timeout = data->timeout_ns / 1000;
+                if (host->clock)
+                        target_timeout += data->timeout_clks / host->clock;
+        }
 
         /*
          * Figure out needed cycles.
@@ -645,7 +644,6 @@ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
          *     =>
          *     (1) / (2) > 2^6
          */
-        BUG_ON(!host->timeout_clk);
         count = 0;
         current_timeout = (1 << 13) * 1000 / host->timeout_clk;
         while (current_timeout < target_timeout) {
@@ -1867,9 +1865,6 @@ static void sdhci_tasklet_finish(unsigned long param)
 
         del_timer(&host->timer);
 
-        if (host->version >= SDHCI_SPEC_300)
-                del_timer(&host->tuning_timer);
-
         mrq = host->mrq;
 
         /*
@@ -2461,22 +2456,6 @@ int sdhci_add_host(struct sdhci_host *host)
                 host->max_clk = host->ops->get_max_clock(host);
         }
 
-        host->timeout_clk =
-                (caps[0] & SDHCI_TIMEOUT_CLK_MASK) >> SDHCI_TIMEOUT_CLK_SHIFT;
-        if (host->timeout_clk == 0) {
-                if (host->ops->get_timeout_clock) {
-                        host->timeout_clk = host->ops->get_timeout_clock(host);
-                } else if (!(host->quirks &
-                                SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)) {
-                        printk(KERN_ERR
-                               "%s: Hardware doesn't specify timeout clock "
-                               "frequency.\n", mmc_hostname(mmc));
-                        return -ENODEV;
-                }
-        }
-        if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT)
-                host->timeout_clk *= 1000;
-
         /*
          * In case of Host Controller v3.00, find out whether clock
          * multiplier is supported.
@@ -2509,10 +2488,26 @@ int sdhci_add_host(struct sdhci_host *host)
         } else
                 mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
 
+        host->timeout_clk =
+                (caps[0] & SDHCI_TIMEOUT_CLK_MASK) >> SDHCI_TIMEOUT_CLK_SHIFT;
+        if (host->timeout_clk == 0) {
+                if (host->ops->get_timeout_clock) {
+                        host->timeout_clk = host->ops->get_timeout_clock(host);
+                } else if (!(host->quirks &
+                                SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)) {
+                        printk(KERN_ERR
+                               "%s: Hardware doesn't specify timeout clock "
+                               "frequency.\n", mmc_hostname(mmc));
+                        return -ENODEV;
+                }
+        }
+        if (caps[0] & SDHCI_TIMEOUT_CLK_UNIT)
+                host->timeout_clk *= 1000;
+
         if (host->quirks & SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)
-                mmc->max_discard_to = (1 << 27) / (mmc->f_max / 1000);
-        else
-                mmc->max_discard_to = (1 << 27) / host->timeout_clk;
+                host->timeout_clk = mmc->f_max / 1000;
+
+        mmc->max_discard_to = (1 << 27) / host->timeout_clk;
 
         mmc->caps |= MMC_CAP_SDIO_IRQ | MMC_CAP_ERASE | MMC_CAP_CMD23;
 
diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
index 8d185de90d20..44a9668c4b7a 100644
--- a/drivers/mmc/host/tmio_mmc.c
+++ b/drivers/mmc/host/tmio_mmc.c
@@ -27,7 +27,6 @@
 static int tmio_mmc_suspend(struct platform_device *dev, pm_message_t state)
 {
         const struct mfd_cell *cell = mfd_get_cell(dev);
-        struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret;
 
         ret = tmio_mmc_host_suspend(&dev->dev);
@@ -42,7 +41,6 @@ static int tmio_mmc_suspend(struct platform_device *dev, pm_message_t state)
 static int tmio_mmc_resume(struct platform_device *dev)
 {
         const struct mfd_cell *cell = mfd_get_cell(dev);
-        struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret = 0;
 
         /* Tell the MFD core we are ready to be enabled */
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index d724a18b5285..37e5790681ad 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -63,8 +63,9 @@ static inline void bnx2x_bz_fp(struct bnx2x *bp, int index)
         fp->disable_tpa = ((bp->flags & TPA_ENABLE_FLAG) == 0);
 
 #ifdef BCM_CNIC
-        /* We don't want TPA on FCoE, FWD and OOO L2 rings */
-        bnx2x_fcoe(bp, disable_tpa) = 1;
+        /* We don't want TPA on an FCoE L2 ring */
+        if (IS_FCOE_FP(fp))
+                fp->disable_tpa = 1;
 #endif
 }
 
@@ -1404,10 +1405,9 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
         struct bnx2x *bp = netdev_priv(dev);
+
 #ifdef BCM_CNIC
-        if (NO_FCOE(bp))
-                return skb_tx_hash(dev, skb);
-        else {
+        if (!NO_FCOE(bp)) {
                 struct ethhdr *hdr = (struct ethhdr *)skb->data;
                 u16 ether_type = ntohs(hdr->h_proto);
 
@@ -1424,8 +1424,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
                         return bnx2x_fcoe_tx(bp, txq_index);
         }
 #endif
-        /* Select a none-FCoE queue:  if FCoE is enabled, exclude FCoE L2 ring
-         */
+        /* select a non-FCoE queue */
         return __skb_tx_hash(dev, skb, BNX2X_NUM_ETH_QUEUES(bp));
 }
 
@@ -1448,6 +1447,28 @@ void bnx2x_set_num_queues(struct bnx2x *bp)
         bp->num_queues += NON_ETH_CONTEXT_USE;
 }
 
+/**
+ * bnx2x_set_real_num_queues - configure netdev->real_num_[tx,rx]_queues
+ *
+ * @bp:         Driver handle
+ *
+ * We currently support for at most 16 Tx queues for each CoS thus we will
+ * allocate a multiple of 16 for ETH L2 rings according to the value of the
+ * bp->max_cos.
+ *
+ * If there is an FCoE L2 queue the appropriate Tx queue will have the next
+ * index after all ETH L2 indices.
+ *
+ * If the actual number of Tx queues (for each CoS) is less than 16 then there
+ * will be the holes at the end of each group of 16 ETh L2 indices (0..15,
+ * 16..31,...) with indicies that are not coupled with any real Tx queue.
+ *
+ * The proper configuration of skb->queue_mapping is handled by
+ * bnx2x_select_queue() and __skb_tx_hash().
+ *
+ * bnx2x_setup_tc() takes care of the proper TC mappings so that __skb_tx_hash()
+ * will return a proper Tx index if TC is enabled (netdev->num_tc > 0).
+ */
 static inline int bnx2x_set_real_num_queues(struct bnx2x *bp)
 {
         int rc, tx, rx;
diff --git a/drivers/net/bnx2x/bnx2x_dcb.c b/drivers/net/bnx2x/bnx2x_dcb.c
index a4ea35f6a456..a1e004a82f7a 100644
--- a/drivers/net/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/bnx2x/bnx2x_dcb.c
@@ -920,7 +920,7 @@ static void bnx2x_dcbx_admin_mib_updated_params(struct bnx2x *bp,
 
 void bnx2x_dcbx_set_state(struct bnx2x *bp, bool dcb_on, u32 dcbx_enabled)
 {
-        if (!CHIP_IS_E1x(bp)) {
+        if (!CHIP_IS_E1x(bp) && !CHIP_IS_E3(bp)) {
                 bp->dcb_state = dcb_on;
                 bp->dcbx_enabled = dcbx_enabled;
         } else {
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index 150709111548..f74582a22c68 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -5798,6 +5798,12 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
 
         DP(BNX2X_MSG_MCP, "starting common init  func %d\n", BP_ABS_FUNC(bp));
 
+        /*
+         * take the UNDI lock to protect undi_unload flow from accessing
+         * registers while we're resetting the chip
+         */
+        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+
         bnx2x_reset_common(bp);
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
 
@@ -5808,6 +5814,8 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
         }
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, val);
 
+        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+
         bnx2x_init_block(bp, BLOCK_MISC, PHASE_COMMON);
 
         if (!CHIP_IS_E1x(bp)) {
@@ -10251,10 +10259,17 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
         /* clean indirect addresses */
         pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                                PCICFG_VENDOR_ID_OFFSET);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0 + BP_PORT(bp)*16, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0 + BP_PORT(bp)*16, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0 + BP_PORT(bp)*16, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0 + BP_PORT(bp)*16, 0);
+        /* Clean the following indirect addresses for all functions since it
+         * is not used by the driver.
+         */
+        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
+        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
 
         /*
          * Enable internal target-read (in case we are probed after PF FLR).
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 27b5ecb11830..40266c14e6dc 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -3007,11 +3007,27 @@
 /* [R 6] Debug only: Number of used entries in the data FIFO */
 #define PXP2_REG_HST_DATA_FIFO_STATUS                            0x12047c
 /* [R 7] Debug only: Number of used entries in the header FIFO */
-#define PXP2_REG_HST_HEADER_FIFO_STATUS                          0x120478
-#define PXP2_REG_PGL_ADDR_88_F0                                  0x120534
-#define PXP2_REG_PGL_ADDR_8C_F0                                  0x120538
-#define PXP2_REG_PGL_ADDR_90_F0                                  0x12053c
-#define PXP2_REG_PGL_ADDR_94_F0                                  0x120540
+#define PXP2_REG_HST_HEADER_FIFO_STATUS                          0x120478
+#define PXP2_REG_PGL_ADDR_88_F0                                  0x120534
+/* [R 32] GRC address for configuration access to PCIE config address 0x88.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_88_F1                                  0x120544
+#define PXP2_REG_PGL_ADDR_8C_F0                                  0x120538
+/* [R 32] GRC address for configuration access to PCIE config address 0x8c.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_8C_F1                                  0x120548
+#define PXP2_REG_PGL_ADDR_90_F0                                  0x12053c
+/* [R 32] GRC address for configuration access to PCIE config address 0x90.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_90_F1                                  0x12054c
+#define PXP2_REG_PGL_ADDR_94_F0                                  0x120540
+/* [R 32] GRC address for configuration access to PCIE config address 0x94.
+ * any write to this PCIE address will cause a GRC write access to the
+ * address that's in t this register */
+#define PXP2_REG_PGL_ADDR_94_F1                                  0x120550
 #define PXP2_REG_PGL_CONTROL0                                    0x120490
 #define PXP2_REG_PGL_CONTROL1                                    0x120514
 #define PXP2_REG_PGL_DEBUG                                       0x120520
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index f523f1cc5142..4b70b7e8bdeb 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -197,7 +197,7 @@ static void slc_bump(struct slcan *sl)
         skb->ip_summed = CHECKSUM_UNNECESSARY;
         memcpy(skb_put(skb, sizeof(struct can_frame)),
                &cf, sizeof(struct can_frame));
-        netif_rx(skb);
+        netif_rx_ni(skb);
 
         sl->dev->stats.rx_packets++;
         sl->dev->stats.rx_bytes += cf.can_dlc;
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 480f2592f8a5..536b3a55c45f 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -2085,7 +2085,8 @@ struct e1000_info e1000_82574_info = {
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .flags2                   = FLAG2_CHECK_PHY_HANG
-                                  | FLAG2_DISABLE_ASPM_L0S,
+                                  | FLAG2_DISABLE_ASPM_L0S
+                                  | FLAG2_NO_DISABLE_RX,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -2104,7 +2105,8 @@ struct e1000_info e1000_82583_info = {
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_JUMBO_FRAMES
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
-        .flags2                 = FLAG2_DISABLE_ASPM_L0S,
+        .flags2                 = FLAG2_DISABLE_ASPM_L0S
+                                  | FLAG2_NO_DISABLE_RX,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 638d175792cf..35916f485028 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -453,6 +453,7 @@ struct e1000_info {
 #define FLAG2_DISABLE_ASPM_L0S            (1 << 7)
 #define FLAG2_DISABLE_AIM                 (1 << 8)
 #define FLAG2_CHECK_PHY_HANG              (1 << 9)
+#define FLAG2_NO_DISABLE_RX               (1 << 10)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 06d88f316dce..6a0526a59a8a 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -1206,7 +1206,8 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
         rx_ring->next_to_clean = 0;
 
         rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
         ew32(RDBAL, ((u64) rx_ring->dma & 0xFFFFFFFF));
         ew32(RDBAH, ((u64) rx_ring->dma >> 32));
         ew32(RDLEN, rx_ring->size);
diff --git a/drivers/net/e1000e/lib.c b/drivers/net/e1000e/lib.c
index 7898a67d6505..0893ab107adf 100644
--- a/drivers/net/e1000e/lib.c
+++ b/drivers/net/e1000e/lib.c
@@ -190,7 +190,8 @@ s32 e1000_check_alt_mac_addr_generic(struct e1000_hw *hw)
         /* Check for LOM (vs. NIC) or one of two valid mezzanine cards */
         if (!((nvm_data & NVM_COMPAT_LOM) ||
               (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_DUAL) ||
-              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)))
+              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD) ||
+              (hw->adapter->pdev->device == E1000_DEV_ID_82571EB_SERDES)))
                 goto out;
 
         ret_val = e1000_read_nvm(hw, NVM_ALT_MAC_ADDR_PTR, 1,
@@ -200,10 +201,10 @@ s32 e1000_check_alt_mac_addr_generic(struct e1000_hw *hw)
                 goto out;
         }
 
-        if (nvm_alt_mac_addr_offset == 0xFFFF) {
+        if ((nvm_alt_mac_addr_offset == 0xFFFF) ||
+            (nvm_alt_mac_addr_offset == 0x0000))
                 /* There is no Alternate MAC Address */
                 goto out;
-        }
 
         if (hw->bus.func == E1000_FUNC_1)
                 nvm_alt_mac_addr_offset += E1000_ALT_MAC_ADDRESS_OFFSET_LAN1;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index ab4be80f7ab5..362f70382cdd 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -56,7 +56,7 @@
 
 #define DRV_EXTRAVERSION "-k"
 
-#define DRV_VERSION "1.3.16" DRV_EXTRAVERSION
+#define DRV_VERSION "1.4.4" DRV_EXTRAVERSION
 char e1000e_driver_name[] = "e1000e";
 const char e1000e_driver_version[] = DRV_VERSION;
 
@@ -2915,7 +2915,8 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
 
         /* disable receives while setting up the descriptors */
         rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
         e1e_flush();
         usleep_range(10000, 20000);
 
@@ -3394,7 +3395,8 @@ void e1000e_down(struct e1000_adapter *adapter)
 
         /* disable receives in the hardware */
         rctl = er32(RCTL);
-        ew32(RCTL, rctl & ~E1000_RCTL_EN);
+        if (!(adapter->flags2 & FLAG2_NO_DISABLE_RX))
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
         /* flush and sleep below */
 
         netif_stop_queue(netdev);
@@ -3403,6 +3405,7 @@ void e1000e_down(struct e1000_adapter *adapter)
         tctl = er32(TCTL);
         tctl &= ~E1000_TCTL_EN;
         ew32(TCTL, tctl);
+
         /* flush both disables and wait for them to finish */
         e1e_flush();
         usleep_range(10000, 20000);
diff --git a/drivers/net/gianfar_ptp.c b/drivers/net/gianfar_ptp.c
index 1c97861596f0..f67b8aebc89c 100644
--- a/drivers/net/gianfar_ptp.c
+++ b/drivers/net/gianfar_ptp.c
@@ -193,14 +193,9 @@ static void set_alarm(struct etsects *etsects)
 /* Caller must hold etsects->lock. */
 static void set_fipers(struct etsects *etsects)
 {
-        u32 tmr_ctrl = gfar_read(&etsects->regs->tmr_ctrl);
-
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl & (~TE));
-        gfar_write(&etsects->regs->tmr_prsc,   etsects->tmr_prsc);
+        set_alarm(etsects);
         gfar_write(&etsects->regs->tmr_fiper1, etsects->tmr_fiper1);
         gfar_write(&etsects->regs->tmr_fiper2, etsects->tmr_fiper2);
-        set_alarm(etsects);
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|TE);
 }
 
 /*
@@ -511,7 +506,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
         gfar_write(&etsects->regs->tmr_fiper1, etsects->tmr_fiper1);
         gfar_write(&etsects->regs->tmr_fiper2, etsects->tmr_fiper2);
         set_alarm(etsects);
-        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|FS|RTPE|TE);
+        gfar_write(&etsects->regs->tmr_ctrl,   tmr_ctrl|FS|RTPE|TE|FRD);
 
         spin_unlock_irqrestore(&etsects->lock, flags);
 
diff --git a/drivers/net/irda/sh_irda.c b/drivers/net/irda/sh_irda.c
index 4488bd581eca..82660672dcd9 100644
--- a/drivers/net/irda/sh_irda.c
+++ b/drivers/net/irda/sh_irda.c
@@ -22,6 +22,8 @@
  *  - DMA transfer support
  *  - FIFO mode support
  */
+#include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 52a7c86af663..ed7d7d62bf68 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -12,6 +12,8 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
@@ -511,7 +513,7 @@ static void sh_sir_tx(struct sh_sir_self *self, int phase)
 
 static int sh_sir_read_data(struct sh_sir_self *self)
 {
-        u16 val;
+        u16 val = 0;
         int timeout = 1024;
 
         while (timeout--) {
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 8b3090dc4bcd..80b6f36a8074 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -82,7 +82,7 @@ static int cards_found;
 /*
  * VLB I/O addresses
  */
-static unsigned int pcnet32_portlist[] __initdata =
+static unsigned int pcnet32_portlist[] =
     { 0x300, 0x320, 0x340, 0x360, 0 };
 
 static int pcnet32_debug;
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 2cd8dc5847b4..cb6e0b486b1e 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -34,8 +34,7 @@
 #define PAGESEL         0x13
 #define LAYER4          0x02
 #define LAYER2          0x01
-#define MAX_RXTS        4
-#define MAX_TXTS        4
+#define MAX_RXTS        64
 #define N_EXT_TS        1
 #define PSF_PTPVER      2
 #define PSF_EVNT        0x4000
@@ -218,7 +217,7 @@ static void phy2rxts(struct phy_rxts *p, struct rxts *rxts)
         rxts->seqid = p->seqid;
         rxts->msgtype = (p->msgtype >> 12) & 0xf;
         rxts->hash = p->msgtype & 0x0fff;
-        rxts->tmo = jiffies + HZ;
+        rxts->tmo = jiffies + 2;
 }
 
 static u64 phy2txts(struct phy_txts *p)
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index f11b3f3df24f..4c617534f937 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -367,7 +367,7 @@ static void sl_bump(struct slip *sl)
         memcpy(skb_put(skb, count), sl->rbuff, count);
         skb_reset_mac_header(skb);
         skb->protocol = htons(ETH_P_IP);
-        netif_rx(skb);
+        netif_rx_ni(skb);
         dev->stats.rx_packets++;
 }
 
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 041fb7d43c4f..ef3b236b5145 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -977,7 +977,6 @@ static void rtl8150_disconnect(struct usb_interface *intf)
         usb_set_intfdata(intf, NULL);
         if (dev) {
                 set_bit(RTL8150_UNPLUG, &dev->flags);
-                tasklet_disable(&dev->tl);
                 tasklet_kill(&dev->tl);
                 unregister_netdev(dev->netdev);
                 unlink_all_urbs(dev);
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index f54dff44ed50..c3119a6caace 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1735,6 +1735,8 @@ ath5k_beacon_setup(struct ath5k_hw *ah, struct ath5k_buf *bf)
 
         if (dma_mapping_error(ah->dev, bf->skbaddr)) {
                 ATH5K_ERR(ah, "beacon DMA mapping failed\n");
+                dev_kfree_skb_any(skb);
+                bf->skb = NULL;
                 return -EIO;
         }
 
@@ -1819,8 +1821,6 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
         ath5k_txbuf_free_skb(ah, avf->bbuf);
         avf->bbuf->skb = skb;
         ret = ath5k_beacon_setup(ah, avf->bbuf);
-        if (ret)
-                avf->bbuf->skb = NULL;
 out:
         return ret;
 }
@@ -1840,6 +1840,7 @@ ath5k_beacon_send(struct ath5k_hw *ah)
         struct ath5k_vif *avf;
         struct ath5k_buf *bf;
         struct sk_buff *skb;
+        int err;
 
         ATH5K_DBG_UNLIMIT(ah, ATH5K_DEBUG_BEACON, "in beacon_send\n");
 
@@ -1888,11 +1889,6 @@ ath5k_beacon_send(struct ath5k_hw *ah)
 
         avf = (void *)vif->drv_priv;
         bf = avf->bbuf;
-        if (unlikely(bf->skb == NULL || ah->opmode == NL80211_IFTYPE_STATION ||
-                     ah->opmode == NL80211_IFTYPE_MONITOR)) {
-                ATH5K_WARN(ah, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL);
-                return;
-        }
 
         /*
          * Stop any current dma and put the new frame on the queue.
@@ -1906,8 +1902,17 @@ ath5k_beacon_send(struct ath5k_hw *ah)
 
         /* refresh the beacon for AP or MESH mode */
         if (ah->opmode == NL80211_IFTYPE_AP ||
-            ah->opmode == NL80211_IFTYPE_MESH_POINT)
-                ath5k_beacon_update(ah->hw, vif);
+            ah->opmode == NL80211_IFTYPE_MESH_POINT) {
+                err = ath5k_beacon_update(ah->hw, vif);
+                if (err)
+                        return;
+        }
+
+        if (unlikely(bf->skb == NULL || ah->opmode == NL80211_IFTYPE_STATION ||
+                     ah->opmode == NL80211_IFTYPE_MONITOR)) {
+                ATH5K_WARN(ah, "bf=%p bf_skb=%p\n", bf, bf->skb);
+                return;
+        }
 
         trace_ath5k_tx(ah, bf->skb, &ah->txqs[ah->bhalq]);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index d109c25417f4..c34bef1bf2b0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -307,7 +307,7 @@ static const struct ar9300_eeprom ar9300_default = {
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
@@ -884,7 +884,7 @@ static const struct ar9300_eeprom ar9300_x113 = {
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                  { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
@@ -2040,7 +2040,7 @@ static const struct ar9300_eeprom ar9300_x112 = {
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
@@ -3734,7 +3734,7 @@ static void ar9003_hw_internal_regulator_apply(struct ath_hw *ah)
                                 }
                         } else {
                                 reg_pmu_set = (5 << 1) | (7 << 4) |
-                                              (1 << 8) | (2 << 14) |
+                                              (2 << 8) | (2 << 14) |
                                               (6 << 17) | (1 << 20) |
                                               (3 << 24) | (1 << 28);
                         }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 6de3f0bc18e6..5c590429f120 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -850,7 +850,7 @@
 #define AR_PHY_TPC_11_B1         (AR_SM1_BASE + 0x220)
 #define AR_PHY_PDADC_TAB_1       (AR_SM1_BASE + 0x240)
 #define AR_PHY_TX_IQCAL_STATUS_B1   (AR_SM1_BASE + 0x48c)
-#define AR_PHY_TX_IQCAL_CORR_COEFF_B1(_i)    (AR_SM_BASE + 0x450 + ((_i) << 2))
+#define AR_PHY_TX_IQCAL_CORR_COEFF_B1(_i)    (AR_SM1_BASE + 0x450 + ((_i) << 2))
 
 /*
  * Channel 2 Register Map
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 83cba22ac6e8..481e534534eb 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -795,9 +795,23 @@ static u64 supported_dma_mask(struct b43_wldev *dev)
         u32 tmp;
         u16 mmio_base;
 
-        tmp = b43_read32(dev, SSB_TMSHIGH);
-        if (tmp & SSB_TMSHIGH_DMA64)
-                return DMA_BIT_MASK(64);
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
+                if (tmp & BCMA_IOST_DMA64)
+                        return DMA_BIT_MASK(64);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
+                if (tmp & SSB_TMSHIGH_DMA64)
+                        return DMA_BIT_MASK(64);
+                break;
+#endif
+        }
+
         mmio_base = b43_dmacontroller_base(0, 0);
         b43_write32(dev, mmio_base + B43_DMA32_TXCTL, B43_DMA32_TXADDREXT_MASK);
         tmp = b43_read32(dev, mmio_base + B43_DMA32_TXCTL);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 507559361d87..939563162fb3 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -921,6 +921,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c16) },
         /* Draytek */
         { USB_DEVICE(0x07fa, 0x7712) },
+        /* DVICO */
+        { USB_DEVICE(0x0fe9, 0xb307) },
         /* Edimax */
         { USB_DEVICE(0x7392, 0x7711) },
         { USB_DEVICE(0x7392, 0x7717) },
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 6a93939f44e8..0baeb894f093 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2420,6 +2420,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* Buffalo */
         { USB_DEVICE(0x0411, 0x00d8) },
         { USB_DEVICE(0x0411, 0x00d9) },
+        { USB_DEVICE(0x0411, 0x00e6) },
         { USB_DEVICE(0x0411, 0x00f4) },
         { USB_DEVICE(0x0411, 0x0116) },
         { USB_DEVICE(0x0411, 0x0119) },
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 942f7a3969a7..ef63c0df006a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -281,6 +281,8 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817d, rtl92cu_hal_cfg)},
         /* 8188CE-VAU USB minCard (b/g mode only) */
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817e, rtl92cu_hal_cfg)},
+        /* 8188RU in Alfa AWUS036NHR */
+        {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817f, rtl92cu_hal_cfg)},
         /* 8188 Combo for BC4 */
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8754, rtl92cu_hal_cfg)},
 
@@ -303,20 +305,23 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
         /* HP - Lite-On ,8188CUS Slim Combo */
         {RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
         {RTL_USB_DEVICE(0x2001, 0x3308, rtl92cu_hal_cfg)}, /*D-Link - Alpha*/
         {RTL_USB_DEVICE(0x2019, 0xab2a, rtl92cu_hal_cfg)}, /*Planex - Abocom*/
         {RTL_USB_DEVICE(0x2019, 0xed17, rtl92cu_hal_cfg)}, /*PCI - Edimax*/
         {RTL_USB_DEVICE(0x20f4, 0x648b, rtl92cu_hal_cfg)}, /*TRENDnet - Cameo*/
         {RTL_USB_DEVICE(0x7392, 0x7811, rtl92cu_hal_cfg)}, /*Edimax - Edimax*/
-        {RTL_USB_DEVICE(0x3358, 0x13d3, rtl92cu_hal_cfg)}, /*Azwave 8188CE-VAU*/
+        {RTL_USB_DEVICE(0x13d3, 0x3358, rtl92cu_hal_cfg)}, /*Azwave 8188CE-VAU*/
         /* Russian customer -Azwave (8188CE-VAU  b/g mode only) */
-        {RTL_USB_DEVICE(0x3359, 0x13d3, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x13d3, 0x3359, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(0x4855, 0x0090, rtl92cu_hal_cfg)}, /* Feixun */
+        {RTL_USB_DEVICE(0x4855, 0x0091, rtl92cu_hal_cfg)}, /* NetweeN-Feixun */
+        {RTL_USB_DEVICE(0x9846, 0x9041, rtl92cu_hal_cfg)}, /* Netgear Cameo */
 
         /****** 8192CU ********/
         {RTL_USB_DEVICE(0x0586, 0x341f, rtl92cu_hal_cfg)}, /*Zyxel -Abocom*/
         {RTL_USB_DEVICE(0x07aa, 0x0056, rtl92cu_hal_cfg)}, /*ATKK-Gemtek*/
         {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
-        {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Abocom -Abocom*/
         {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
         {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
         {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
diff --git a/drivers/net/wireless/wl1251/acx.c b/drivers/net/wireless/wl1251/acx.c
index ef8370edace7..ad87a1ac6462 100644
--- a/drivers/net/wireless/wl1251/acx.c
+++ b/drivers/net/wireless/wl1251/acx.c
@@ -140,8 +140,6 @@ int wl1251_acx_sleep_auth(struct wl1251 *wl, u8 sleep_auth)
         auth->sleep_auth = sleep_auth;
 
         ret = wl1251_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
-        if (ret < 0)
-                return ret;
 
 out:
         kfree(auth);
@@ -681,10 +679,8 @@ int wl1251_acx_cca_threshold(struct wl1251 *wl)
 
         ret = wl1251_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                    detection, sizeof(*detection));
-        if (ret < 0) {
+        if (ret < 0)
                 wl1251_warning("failed to set cca threshold: %d", ret);
-                return ret;
-        }
 
 out:
         kfree(detection);
diff --git a/drivers/net/wireless/wl1251/cmd.c b/drivers/net/wireless/wl1251/cmd.c
index 81f164bc4888..d14d69d733a0 100644
--- a/drivers/net/wireless/wl1251/cmd.c
+++ b/drivers/net/wireless/wl1251/cmd.c
@@ -241,7 +241,7 @@ int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
         if (ret < 0) {
                 wl1251_error("tx %s cmd for channel %d failed",
                              enable ? "start" : "stop", channel);
-                return ret;
+                goto out;
         }
 
         wl1251_debug(DEBUG_BOOT, "tx %s cmd channel %d",
diff --git a/drivers/pci/hotplug/pcihp_slot.c b/drivers/pci/hotplug/pcihp_slot.c
index 749fdf070319..753b21aaea61 100644
--- a/drivers/pci/hotplug/pcihp_slot.c
+++ b/drivers/pci/hotplug/pcihp_slot.c
@@ -158,47 +158,6 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
          */
 }
 
-/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */
-static int pci_set_payload(struct pci_dev *dev)
-{
-       int pos, ppos;
-       u16 pctl, psz;
-       u16 dctl, dsz, dcap, dmax;
-       struct pci_dev *parent;
-
-       parent = dev->bus->self;
-       pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
-       if (!pos)
-               return 0;
-
-       /* Read Device MaxPayload capability and setting */
-       pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl);
-       pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap);
-       dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5;
-       dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD);
-
-       /* Read Parent MaxPayload setting */
-       ppos = pci_find_capability(parent, PCI_CAP_ID_EXP);
-       if (!ppos)
-               return 0;
-       pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl);
-       psz = (pctl &  PCI_EXP_DEVCTL_PAYLOAD) >> 5;
-
-       /* If parent payload > device max payload -> error
-        * If parent payload > device payload -> set speed
-        * If parent payload <= device payload -> do nothing
-        */
-       if (psz > dmax)
-               return -1;
-       else if (psz > dsz) {
-               dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz);
-               pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
-                                     (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) +
-                                     (psz << 5));
-       }
-       return 0;
-}
-
 void pci_configure_slot(struct pci_dev *dev)
 {
         struct pci_dev *cdev;
@@ -210,9 +169,7 @@ void pci_configure_slot(struct pci_dev *dev)
                         (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
                 return;
 
-       ret = pci_set_payload(dev);
-       if (ret)
-               dev_warn(&dev->dev, "could not set device max payload\n");
+        pcie_bus_configure_settings(dev->bus, dev->bus->self->pcie_mpss);
 
         memset(&hpp, 0, sizeof(hpp));
         ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index c94d37ec55c8..f0929934bb7a 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -55,7 +55,7 @@ struct device_node * __weak pcibios_get_phb_of_node(struct pci_bus *bus)
          */
         if (bus->bridge->of_node)
                 return of_node_get(bus->bridge->of_node);
-        if (bus->bridge->parent->of_node)
+        if (bus->bridge->parent && bus->bridge->parent->of_node)
                 return of_node_get(bus->bridge->parent->of_node);
         return NULL;
 }
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 08a95b369d85..0ce67423a0a3 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -77,6 +77,8 @@ unsigned long pci_cardbus_mem_size = DEFAULT_CARDBUS_MEM_SIZE;
 unsigned long pci_hotplug_io_size  = DEFAULT_HOTPLUG_IO_SIZE;
 unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE;
 
+enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_PERFORMANCE;
+
 /*
  * The default CLS is used if arch didn't set CLS explicitly and not
  * all pci devices agree on the same value.  Arch can override either
@@ -3223,6 +3225,67 @@ out:
 EXPORT_SYMBOL(pcie_set_readrq);
 
 /**
+ * pcie_get_mps - get PCI Express maximum payload size
+ * @dev: PCI device to query
+ *
+ * Returns maximum payload size in bytes
+ *    or appropriate error value.
+ */
+int pcie_get_mps(struct pci_dev *dev)
+{
+        int ret, cap;
+        u16 ctl;
+
+        cap = pci_pcie_cap(dev);
+        if (!cap)
+                return -EINVAL;
+
+        ret = pci_read_config_word(dev, cap + PCI_EXP_DEVCTL, &ctl);
+        if (!ret)
+                ret = 128 << ((ctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5);
+
+        return ret;
+}
+
+/**
+ * pcie_set_mps - set PCI Express maximum payload size
+ * @dev: PCI device to query
+ * @mps: maximum payload size in bytes
+ *    valid values are 128, 256, 512, 1024, 2048, 4096
+ *
+ * If possible sets maximum payload size
+ */
+int pcie_set_mps(struct pci_dev *dev, int mps)
+{
+        int cap, err = -EINVAL;
+        u16 ctl, v;
+
+        if (mps < 128 || mps > 4096 || !is_power_of_2(mps))
+                goto out;
+
+        v = ffs(mps) - 8;
+        if (v > dev->pcie_mpss) 
+                goto out;
+        v <<= 5;
+
+        cap = pci_pcie_cap(dev);
+        if (!cap)
+                goto out;
+
+        err = pci_read_config_word(dev, cap + PCI_EXP_DEVCTL, &ctl);
+        if (err)
+                goto out;
+
+        if ((ctl & PCI_EXP_DEVCTL_PAYLOAD) != v) {
+                ctl &= ~PCI_EXP_DEVCTL_PAYLOAD;
+                ctl |= v;
+                err = pci_write_config_word(dev, cap + PCI_EXP_DEVCTL, ctl);
+        }
+out:
+        return err;
+}
+
+/**
  * pci_select_bars - Make BAR mask from the type of resource
  * @dev: the PCI device for which BAR mask is made
  * @flags: resource type mask to be selected
@@ -3505,6 +3568,10 @@ static int __init pci_setup(char *str)
                                 pci_hotplug_io_size = memparse(str + 9, &str);
                         } else if (!strncmp(str, "hpmemsize=", 10)) {
                                 pci_hotplug_mem_size = memparse(str + 10, &str);
+                        } else if (!strncmp(str, "pcie_bus_safe", 13)) {
+                                pcie_bus_config = PCIE_BUS_SAFE;
+                        } else if (!strncmp(str, "pcie_bus_perf", 13)) {
+                                pcie_bus_config = PCIE_BUS_PERFORMANCE;
                         } else {
                                 printk(KERN_ERR "PCI: Unknown option `%s'\n",
                                                 str);
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index c8cee764b0de..b74084e9ca12 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -283,6 +283,8 @@ static inline int pci_iov_bus_range(struct pci_bus *bus)
 
 #endif /* CONFIG_PCI_IOV */
 
+extern unsigned long pci_cardbus_resource_alignment(struct resource *);
+
 static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
                                          struct resource *res)
 {
@@ -292,6 +294,8 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
         if (resno >= PCI_IOV_RESOURCES && resno <= PCI_IOV_RESOURCE_END)
                 return pci_sriov_resource_alignment(dev, resno);
 #endif
+        if (dev->class >> 8  == PCI_CLASS_BRIDGE_CARDBUS)
+                return pci_cardbus_resource_alignment(res);
         return resource_alignment(res);
 }
 
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 795c9026d55f..8473727b29fa 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -856,6 +856,8 @@ void set_pcie_port_type(struct pci_dev *pdev)
         pdev->pcie_cap = pos;
         pci_read_config_word(pdev, pos + PCI_EXP_FLAGS, &reg16);
         pdev->pcie_type = (reg16 & PCI_EXP_FLAGS_TYPE) >> 4;
+        pci_read_config_word(pdev, pos + PCI_EXP_DEVCAP, &reg16);
+        pdev->pcie_mpss = reg16 & PCI_EXP_DEVCAP_PAYLOAD;
 }
 
 void set_pcie_hotplug_bridge(struct pci_dev *pdev)
@@ -1326,6 +1328,150 @@ int pci_scan_slot(struct pci_bus *bus, int devfn)
         return nr;
 }
 
+static int pcie_find_smpss(struct pci_dev *dev, void *data)
+{
+        u8 *smpss = data;
+
+        if (!pci_is_pcie(dev))
+                return 0;
+
+        /* For PCIE hotplug enabled slots not connected directly to a
+         * PCI-E root port, there can be problems when hotplugging
+         * devices.  This is due to the possibility of hotplugging a
+         * device into the fabric with a smaller MPS that the devices
+         * currently running have configured.  Modifying the MPS on the
+         * running devices could cause a fatal bus error due to an
+         * incoming frame being larger than the newly configured MPS.
+         * To work around this, the MPS for the entire fabric must be
+         * set to the minimum size.  Any devices hotplugged into this
+         * fabric will have the minimum MPS set.  If the PCI hotplug
+         * slot is directly connected to the root port and there are not
+         * other devices on the fabric (which seems to be the most
+         * common case), then this is not an issue and MPS discovery
+         * will occur as normal.
+         */
+        if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) ||
+            dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT))
+                *smpss = 0;
+
+        if (*smpss > dev->pcie_mpss)
+                *smpss = dev->pcie_mpss;
+
+        return 0;
+}
+
+static void pcie_write_mps(struct pci_dev *dev, int mps)
+{
+        int rc, dev_mpss;
+
+        dev_mpss = 128 << dev->pcie_mpss;
+
+        if (pcie_bus_config == PCIE_BUS_PERFORMANCE) {
+                if (dev->bus->self) {
+                        dev_dbg(&dev->bus->dev, "Bus MPSS %d\n",
+                                128 << dev->bus->self->pcie_mpss);
+
+                        /* For "MPS Force Max", the assumption is made that
+                         * downstream communication will never be larger than
+                         * the MRRS.  So, the MPS only needs to be configured
+                         * for the upstream communication.  This being the case,
+                         * walk from the top down and set the MPS of the child
+                         * to that of the parent bus.
+                         */
+                        mps = 128 << dev->bus->self->pcie_mpss;
+                        if (mps > dev_mpss)
+                                dev_warn(&dev->dev, "MPS configured higher than"
+                                         " maximum supported by the device.  If"
+                                         " a bus issue occurs, try running with"
+                                         " pci=pcie_bus_safe.\n");
+                }
+
+                dev->pcie_mpss = ffs(mps) - 8;
+        }
+
+        rc = pcie_set_mps(dev, mps);
+        if (rc)
+                dev_err(&dev->dev, "Failed attempting to set the MPS\n");
+}
+
+static void pcie_write_mrrs(struct pci_dev *dev, int mps)
+{
+        int rc, mrrs;
+
+        if (pcie_bus_config == PCIE_BUS_PERFORMANCE) {
+                int dev_mpss = 128 << dev->pcie_mpss;
+
+                /* For Max performance, the MRRS must be set to the largest
+                 * supported value.  However, it cannot be configured larger
+                 * than the MPS the device or the bus can support.  This assumes
+                 * that the largest MRRS available on the device cannot be
+                 * smaller than the device MPSS.
+                 */
+                mrrs = mps < dev_mpss ? mps : dev_mpss;
+        } else
+                /* In the "safe" case, configure the MRRS for fairness on the
+                 * bus by making all devices have the same size
+                 */
+                mrrs = mps;
+
+
+        /* MRRS is a R/W register.  Invalid values can be written, but a
+         * subsiquent read will verify if the value is acceptable or not.
+         * If the MRRS value provided is not acceptable (e.g., too large),
+         * shrink the value until it is acceptable to the HW.
+         */
+        while (mrrs != pcie_get_readrq(dev) && mrrs >= 128) {
+                rc = pcie_set_readrq(dev, mrrs);
+                if (rc)
+                        dev_err(&dev->dev, "Failed attempting to set the MRRS\n");
+
+                mrrs /= 2;
+        }
+}
+
+static int pcie_bus_configure_set(struct pci_dev *dev, void *data)
+{
+        int mps = 128 << *(u8 *)data;
+
+        if (!pci_is_pcie(dev))
+                return 0;
+
+        dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n",
+                 pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev));
+
+        pcie_write_mps(dev, mps);
+        pcie_write_mrrs(dev, mps);
+
+        dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n",
+                 pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev));
+
+        return 0;
+}
+
+/* pcie_bus_configure_mps requires that pci_walk_bus work in a top-down,
+ * parents then children fashion.  If this changes, then this code will not
+ * work as designed.
+ */
+void pcie_bus_configure_settings(struct pci_bus *bus, u8 mpss)
+{
+        u8 smpss = mpss;
+
+        if (!bus->self)
+                return;
+
+        if (!pci_is_pcie(bus->self))
+                return;
+
+        if (pcie_bus_config == PCIE_BUS_SAFE) {
+                pcie_find_smpss(bus->self, &smpss);
+                pci_walk_bus(bus, pcie_find_smpss, &smpss);
+        }
+
+        pcie_bus_configure_set(bus->self, &smpss);
+        pci_walk_bus(bus, pcie_bus_configure_set, &smpss);
+}
+EXPORT_SYMBOL_GPL(pcie_bus_configure_settings);
+
 unsigned int __devinit pci_scan_child_bus(struct pci_bus *bus)
 {
         unsigned int devfn, pass, max = bus->secondary;
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 8a1d3c7863a8..784da9d36029 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -34,6 +34,7 @@ struct resource_list_x {
         resource_size_t start;
         resource_size_t end;
         resource_size_t add_size;
+        resource_size_t min_align;
         unsigned long flags;
 };
 
@@ -65,7 +66,7 @@ void pci_realloc(void)
  */
 static void add_to_list(struct resource_list_x *head,
                  struct pci_dev *dev, struct resource *res,
-                 resource_size_t add_size)
+                 resource_size_t add_size, resource_size_t min_align)
 {
         struct resource_list_x *list = head;
         struct resource_list_x *ln = list->next;
@@ -84,13 +85,16 @@ static void add_to_list(struct resource_list_x *head,
         tmp->end = res->end;
         tmp->flags = res->flags;
         tmp->add_size = add_size;
+        tmp->min_align = min_align;
         list->next = tmp;
 }
 
 static void add_to_failed_list(struct resource_list_x *head,
                                 struct pci_dev *dev, struct resource *res)
 {
-        add_to_list(head, dev, res, 0);
+        add_to_list(head, dev, res,
+                        0 /* dont care */,
+                        0 /* dont care */);
 }
 
 static void __dev_sort_resources(struct pci_dev *dev,
@@ -121,18 +125,18 @@ static inline void reset_resource(struct resource *res)
 }
 
 /**
- * adjust_resources_sorted() - satisfy any additional resource requests
+ * reassign_resources_sorted() - satisfy any additional resource requests
  *
- * @add_head : head of the list tracking requests requiring additional
+ * @realloc_head : head of the list tracking requests requiring additional
  *             resources
  * @head     : head of the list tracking requests with allocated
  *             resources
  *
- * Walk through each element of the add_head and try to procure
+ * Walk through each element of the realloc_head and try to procure
  * additional resources for the element, provided the element
  * is in the head list.
  */
-static void adjust_resources_sorted(struct resource_list_x *add_head,
+static void reassign_resources_sorted(struct resource_list_x *realloc_head,
                 struct resource_list *head)
 {
         struct resource *res;
@@ -141,8 +145,8 @@ static void adjust_resources_sorted(struct resource_list_x *add_head,
         resource_size_t add_size;
         int idx;
 
-        prev = add_head;
-        for (list = add_head->next; list;) {
+        prev = realloc_head;
+        for (list = realloc_head->next; list;) {
                 res = list->res;
                 /* skip resource that has been reset */
                 if (!res->flags)
@@ -159,13 +163,17 @@ static void adjust_resources_sorted(struct resource_list_x *add_head,
 
                 idx = res - &list->dev->resource[0];
                 add_size=list->add_size;
-                if (!resource_size(res) && add_size) {
-                         res->end = res->start + add_size - 1;
-                         if(pci_assign_resource(list->dev, idx))
+                if (!resource_size(res)) {
+                        res->start = list->start;
+                        res->end = res->start + add_size - 1;
+                        if(pci_assign_resource(list->dev, idx))
                                 reset_resource(res);
-                } else if (add_size) {
-                        adjust_resource(res, res->start,
-                                resource_size(res) + add_size);
+                } else {
+                        resource_size_t align = list->min_align;
+                        res->flags |= list->flags & (IORESOURCE_STARTALIGN|IORESOURCE_SIZEALIGN);
+                        if (pci_reassign_resource(list->dev, idx, add_size, align))
+                                dev_printk(KERN_DEBUG, &list->dev->dev, "failed to add optional resources res=%pR\n",
+                                                        res);
                 }
 out:
                 tmp = list;
@@ -210,16 +218,16 @@ static void assign_requested_resources_sorted(struct resource_list *head,
 }
 
 static void __assign_resources_sorted(struct resource_list *head,
-                                 struct resource_list_x *add_head,
+                                 struct resource_list_x *realloc_head,
                                  struct resource_list_x *fail_head)
 {
         /* Satisfy the must-have resource requests */
         assign_requested_resources_sorted(head, fail_head);
 
-        /* Try to satisfy any additional nice-to-have resource
+        /* Try to satisfy any additional optional resource
                 requests */
-        if (add_head)
-                adjust_resources_sorted(add_head, head);
+        if (realloc_head)
+                reassign_resources_sorted(realloc_head, head);
         free_list(resource_list, head);
 }
 
@@ -235,7 +243,7 @@ static void pdev_assign_resources_sorted(struct pci_dev *dev,
 }
 
 static void pbus_assign_resources_sorted(const struct pci_bus *bus,
-                                         struct resource_list_x *add_head,
+                                         struct resource_list_x *realloc_head,
                                          struct resource_list_x *fail_head)
 {
         struct pci_dev *dev;
@@ -245,7 +253,7 @@ static void pbus_assign_resources_sorted(const struct pci_bus *bus,
         list_for_each_entry(dev, &bus->devices, bus_list)
                 __dev_sort_resources(dev, &head);
 
-        __assign_resources_sorted(&head, add_head, fail_head);
+        __assign_resources_sorted(&head, realloc_head, fail_head);
 }
 
 void pci_setup_cardbus(struct pci_bus *bus)
@@ -540,13 +548,27 @@ static resource_size_t calculate_memsize(resource_size_t size,
         return size;
 }
 
+static resource_size_t get_res_add_size(struct resource_list_x *realloc_head,
+                                        struct resource *res)
+{
+        struct resource_list_x *list;
+
+        /* check if it is in realloc_head list */
+        for (list = realloc_head->next; list && list->res != res;
+                        list = list->next);
+        if (list)
+                return list->add_size;
+
+        return 0;
+}
+
 /**
  * pbus_size_io() - size the io window of a given bus
  *
  * @bus : the bus
  * @min_size : the minimum io window that must to be allocated
  * @add_size : additional optional io window
- * @add_head : track the additional io window on this list
+ * @realloc_head : track the additional io window on this list
  *
  * Sizing the IO windows of the PCI-PCI bridge is trivial,
  * since these windows have 4K granularity and the IO ranges
@@ -554,11 +576,12 @@ static resource_size_t calculate_memsize(resource_size_t size,
  * We must be careful with the ISA aliasing though.
  */
 static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
-                resource_size_t add_size, struct resource_list_x *add_head)
+                resource_size_t add_size, struct resource_list_x *realloc_head)
 {
         struct pci_dev *dev;
         struct resource *b_res = find_free_bus_resource(bus, IORESOURCE_IO);
         unsigned long size = 0, size0 = 0, size1 = 0;
+        resource_size_t children_add_size = 0;
 
         if (!b_res)
                 return;
@@ -579,11 +602,16 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
                                 size += r_size;
                         else
                                 size1 += r_size;
+
+                        if (realloc_head)
+                                children_add_size += get_res_add_size(realloc_head, r);
                 }
         }
         size0 = calculate_iosize(size, min_size, size1,
                         resource_size(b_res), 4096);
-        size1 = (!add_head || (add_head && !add_size)) ? size0 :
+        if (children_add_size > add_size)
+                add_size = children_add_size;
+        size1 = (!realloc_head || (realloc_head && !add_size)) ? size0 :
                 calculate_iosize(size, min_size+add_size, size1,
                         resource_size(b_res), 4096);
         if (!size0 && !size1) {
@@ -598,8 +626,8 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
         b_res->start = 4096;
         b_res->end = b_res->start + size0 - 1;
         b_res->flags |= IORESOURCE_STARTALIGN;
-        if (size1 > size0 && add_head)
-                add_to_list(add_head, bus->self, b_res, size1-size0);
+        if (size1 > size0 && realloc_head)
+                add_to_list(realloc_head, bus->self, b_res, size1-size0, 4096);
 }
 
 /**
@@ -608,7 +636,7 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
  * @bus : the bus
  * @min_size : the minimum memory window that must to be allocated
  * @add_size : additional optional memory window
- * @add_head : track the additional memory window on this list
+ * @realloc_head : track the additional memory window on this list
  *
  * Calculate the size of the bus and minimal alignment which
  * guarantees that all child resources fit in this size.
@@ -616,7 +644,7 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
 static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                          unsigned long type, resource_size_t min_size,
                         resource_size_t add_size,
-                        struct resource_list_x *add_head)
+                        struct resource_list_x *realloc_head)
 {
         struct pci_dev *dev;
         resource_size_t min_align, align, size, size0, size1;
@@ -624,6 +652,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
         int order, max_order;
         struct resource *b_res = find_free_bus_resource(bus, type);
         unsigned int mem64_mask = 0;
+        resource_size_t children_add_size = 0;
 
         if (!b_res)
                 return 0;
@@ -645,6 +674,16 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                         if (r->parent || (r->flags & mask) != type)
                                 continue;
                         r_size = resource_size(r);
+#ifdef CONFIG_PCI_IOV
+                        /* put SRIOV requested res to the optional list */
+                        if (realloc_head && i >= PCI_IOV_RESOURCES &&
+                                        i <= PCI_IOV_RESOURCE_END) {
+                                r->end = r->start - 1;
+                                add_to_list(realloc_head, dev, r, r_size, 0/* dont' care */);
+                                children_add_size += r_size;
+                                continue;
+                        }
+#endif
                         /* For bridges size != alignment */
                         align = pci_resource_alignment(dev, r);
                         order = __ffs(align) - 20;
@@ -665,6 +704,9 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                         if (order > max_order)
                                 max_order = order;
                         mem64_mask &= r->flags & IORESOURCE_MEM_64;
+
+                        if (realloc_head)
+                                children_add_size += get_res_add_size(realloc_head, r);
                 }
         }
         align = 0;
@@ -681,7 +723,9 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                 align += aligns[order];
         }
         size0 = calculate_memsize(size, min_size, 0, resource_size(b_res), min_align);
-        size1 = (!add_head || (add_head && !add_size)) ? size0 :
+        if (children_add_size > add_size)
+                add_size = children_add_size;
+        size1 = (!realloc_head || (realloc_head && !add_size)) ? size0 :
                 calculate_memsize(size, min_size+add_size, 0,
                                 resource_size(b_res), min_align);
         if (!size0 && !size1) {
@@ -695,12 +739,22 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
         b_res->start = min_align;
         b_res->end = size0 + min_align - 1;
         b_res->flags |= IORESOURCE_STARTALIGN | mem64_mask;
-        if (size1 > size0 && add_head)
-                add_to_list(add_head, bus->self, b_res, size1-size0);
+        if (size1 > size0 && realloc_head)
+                add_to_list(realloc_head, bus->self, b_res, size1-size0, min_align);
         return 1;
 }
 
-static void pci_bus_size_cardbus(struct pci_bus *bus)
+unsigned long pci_cardbus_resource_alignment(struct resource *res)
+{
+        if (res->flags & IORESOURCE_IO)
+                return pci_cardbus_io_size;
+        if (res->flags & IORESOURCE_MEM)
+                return pci_cardbus_mem_size;
+        return 0;
+}
+
+static void pci_bus_size_cardbus(struct pci_bus *bus,
+                        struct resource_list_x *realloc_head)
 {
         struct pci_dev *bridge = bus->self;
         struct resource *b_res = &bridge->resource[PCI_BRIDGE_RESOURCES];
@@ -711,12 +765,14 @@ static void pci_bus_size_cardbus(struct pci_bus *bus)
          * a fixed amount of bus space for CardBus bridges.
          */
         b_res[0].start = 0;
-        b_res[0].end = pci_cardbus_io_size - 1;
         b_res[0].flags |= IORESOURCE_IO | IORESOURCE_SIZEALIGN;
+        if (realloc_head)
+                add_to_list(realloc_head, bridge, b_res, pci_cardbus_io_size, 0 /* dont care */);
 
         b_res[1].start = 0;
-        b_res[1].end = pci_cardbus_io_size - 1;
         b_res[1].flags |= IORESOURCE_IO | IORESOURCE_SIZEALIGN;
+        if (realloc_head)
+                add_to_list(realloc_head, bridge, b_res+1, pci_cardbus_io_size, 0 /* dont care */);
 
         /*
          * Check whether prefetchable memory is supported
@@ -736,21 +792,31 @@ static void pci_bus_size_cardbus(struct pci_bus *bus)
          */
         if (ctrl & PCI_CB_BRIDGE_CTL_PREFETCH_MEM0) {
                 b_res[2].start = 0;
-                b_res[2].end = pci_cardbus_mem_size - 1;
                 b_res[2].flags |= IORESOURCE_MEM | IORESOURCE_PREFETCH | IORESOURCE_SIZEALIGN;
+                if (realloc_head)
+                        add_to_list(realloc_head, bridge, b_res+2, pci_cardbus_mem_size, 0 /* dont care */);
 
                 b_res[3].start = 0;
-                b_res[3].end = pci_cardbus_mem_size - 1;
                 b_res[3].flags |= IORESOURCE_MEM | IORESOURCE_SIZEALIGN;
+                if (realloc_head)
+                        add_to_list(realloc_head, bridge, b_res+3, pci_cardbus_mem_size, 0 /* dont care */);
         } else {
                 b_res[3].start = 0;
-                b_res[3].end = pci_cardbus_mem_size * 2 - 1;
                 b_res[3].flags |= IORESOURCE_MEM | IORESOURCE_SIZEALIGN;
+                if (realloc_head)
+                        add_to_list(realloc_head, bridge, b_res+3, pci_cardbus_mem_size * 2, 0 /* dont care */);
         }
+
+        /* set the size of the resource to zero, so that the resource does not
+         * get assigned during required-resource allocation cycle but gets assigned
+         * during the optional-resource allocation cycle.
+         */
+        b_res[0].start = b_res[1].start = b_res[2].start = b_res[3].start = 1;
+        b_res[0].end = b_res[1].end = b_res[2].end = b_res[3].end = 0;
 }
 
 void __ref __pci_bus_size_bridges(struct pci_bus *bus,
-                        struct resource_list_x *add_head)
+                        struct resource_list_x *realloc_head)
 {
         struct pci_dev *dev;
         unsigned long mask, prefmask;
@@ -763,12 +829,12 @@ void __ref __pci_bus_size_bridges(struct pci_bus *bus,
 
                 switch (dev->class >> 8) {
                 case PCI_CLASS_BRIDGE_CARDBUS:
-                        pci_bus_size_cardbus(b);
+                        pci_bus_size_cardbus(b, realloc_head);
                         break;
 
                 case PCI_CLASS_BRIDGE_PCI:
                 default:
-                        __pci_bus_size_bridges(b, add_head);
+                        __pci_bus_size_bridges(b, realloc_head);
                         break;
                 }
         }
@@ -792,7 +858,7 @@ void __ref __pci_bus_size_bridges(struct pci_bus *bus,
                  * Follow thru
                  */
         default:
-                pbus_size_io(bus, 0, additional_io_size, add_head);
+                pbus_size_io(bus, 0, additional_io_size, realloc_head);
                 /* If the bridge supports prefetchable range, size it
                    separately. If it doesn't, or its prefetchable window
                    has already been allocated by arch code, try
@@ -800,11 +866,11 @@ void __ref __pci_bus_size_bridges(struct pci_bus *bus,
                    resources. */
                 mask = IORESOURCE_MEM;
                 prefmask = IORESOURCE_MEM | IORESOURCE_PREFETCH;
-                if (pbus_size_mem(bus, prefmask, prefmask, 0, additional_mem_size, add_head))
+                if (pbus_size_mem(bus, prefmask, prefmask, 0, additional_mem_size, realloc_head))
                         mask = prefmask; /* Success, size non-prefetch only. */
                 else
                         additional_mem_size += additional_mem_size;
-                pbus_size_mem(bus, mask, IORESOURCE_MEM, 0, additional_mem_size, add_head);
+                pbus_size_mem(bus, mask, IORESOURCE_MEM, 0, additional_mem_size, realloc_head);
                 break;
         }
 }
@@ -816,20 +882,20 @@ void __ref pci_bus_size_bridges(struct pci_bus *bus)
 EXPORT_SYMBOL(pci_bus_size_bridges);
 
 static void __ref __pci_bus_assign_resources(const struct pci_bus *bus,
-                                         struct resource_list_x *add_head,
+                                         struct resource_list_x *realloc_head,
                                          struct resource_list_x *fail_head)
 {
         struct pci_bus *b;
         struct pci_dev *dev;
 
-        pbus_assign_resources_sorted(bus, add_head, fail_head);
+        pbus_assign_resources_sorted(bus, realloc_head, fail_head);
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 b = dev->subordinate;
                 if (!b)
                         continue;
 
-                __pci_bus_assign_resources(b, add_head, fail_head);
+                __pci_bus_assign_resources(b, realloc_head, fail_head);
 
                 switch (dev->class >> 8) {
                 case PCI_CLASS_BRIDGE_PCI:
@@ -1039,7 +1105,7 @@ void __init
 pci_assign_unassigned_resources(void)
 {
         struct pci_bus *bus;
-        struct resource_list_x add_list; /* list of resources that
+        struct resource_list_x realloc_list; /* list of resources that
                                         want additional resources */
         int tried_times = 0;
         enum release_type rel_type = leaf_only;
@@ -1052,7 +1118,7 @@ pci_assign_unassigned_resources(void)
 
 
         head.next = NULL;
-        add_list.next = NULL;
+        realloc_list.next = NULL;
 
         pci_try_num = max_depth + 1;
         printk(KERN_DEBUG "PCI: max bus depth: %d pci_try_num: %d\n",
@@ -1062,12 +1128,12 @@ again:
         /* Depth first, calculate sizes and alignments of all
            subordinate buses. */
         list_for_each_entry(bus, &pci_root_buses, node)
-                __pci_bus_size_bridges(bus, &add_list);
+                __pci_bus_size_bridges(bus, &realloc_list);
 
         /* Depth last, allocate resources and update the hardware. */
         list_for_each_entry(bus, &pci_root_buses, node)
-                __pci_bus_assign_resources(bus, &add_list, &head);
-        BUG_ON(add_list.next);
+                __pci_bus_assign_resources(bus, &realloc_list, &head);
+        BUG_ON(realloc_list.next);
         tried_times++;
 
         /* any device complain? */
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 319f359906e8..51a9095c7da4 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -128,16 +128,16 @@ void pci_disable_bridge_window(struct pci_dev *dev)
 }
 #endif  /* CONFIG_PCI_QUIRKS */
 
+
+
 static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
-                                 int resno)
+                int resno, resource_size_t size, resource_size_t align)
 {
         struct resource *res = dev->resource + resno;
-        resource_size_t size, min, align;
+        resource_size_t min;
         int ret;
 
-        size = resource_size(res);
         min = (res->flags & IORESOURCE_IO) ? PCIBIOS_MIN_IO : PCIBIOS_MIN_MEM;
-        align = pci_resource_alignment(dev, res);
 
         /* First, try exact prefetching match.. */
         ret = pci_bus_alloc_resource(bus, res, size, align, min,
@@ -154,56 +154,101 @@ static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
                 ret = pci_bus_alloc_resource(bus, res, size, align, min, 0,
                                              pcibios_align_resource, dev);
         }
+        return ret;
+}
 
-        if (ret < 0 && dev->fw_addr[resno]) {
-                struct resource *root, *conflict;
-                resource_size_t start, end;
+static int pci_revert_fw_address(struct resource *res, struct pci_dev *dev, 
+                int resno, resource_size_t size)
+{
+        struct resource *root, *conflict;
+        resource_size_t start, end;
+        int ret = 0;
 
-                /*
-                 * If we failed to assign anything, let's try the address
-                 * where firmware left it.  That at least has a chance of
-                 * working, which is better than just leaving it disabled.
-                 */
+        if (res->flags & IORESOURCE_IO)
+                root = &ioport_resource;
+        else
+                root = &iomem_resource;
+
+        start = res->start;
+        end = res->end;
+        res->start = dev->fw_addr[resno];
+        res->end = res->start + size - 1;
+        dev_info(&dev->dev, "BAR %d: trying firmware assignment %pR\n",
+                 resno, res);
+        conflict = request_resource_conflict(root, res);
+        if (conflict) {
+                dev_info(&dev->dev,
+                         "BAR %d: %pR conflicts with %s %pR\n", resno,
+                         res, conflict->name, conflict);
+                res->start = start;
+                res->end = end;
+                ret = 1;
+        }
+        return ret;
+}
+
+static int _pci_assign_resource(struct pci_dev *dev, int resno, int size, resource_size_t min_align)
+{
+        struct resource *res = dev->resource + resno;
+        struct pci_bus *bus;
+        int ret;
+        char *type;
 
-                if (res->flags & IORESOURCE_IO)
-                        root = &ioport_resource;
+        bus = dev->bus;
+        while ((ret = __pci_assign_resource(bus, dev, resno, size, min_align))) {
+                if (!bus->parent || !bus->self->transparent)
+                        break;
+                bus = bus->parent;
+        }
+
+        if (ret) {
+                if (res->flags & IORESOURCE_MEM)
+                        if (res->flags & IORESOURCE_PREFETCH)
+                                type = "mem pref";
+                        else
+                                type = "mem";
+                else if (res->flags & IORESOURCE_IO)
+                        type = "io";
                 else
-                        root = &iomem_resource;
-
-                start = res->start;
-                end = res->end;
-                res->start = dev->fw_addr[resno];
-                res->end = res->start + size - 1;
-                dev_info(&dev->dev, "BAR %d: trying firmware assignment %pR\n",
-                         resno, res);
-                conflict = request_resource_conflict(root, res);
-                if (conflict) {
-                        dev_info(&dev->dev,
-                                 "BAR %d: %pR conflicts with %s %pR\n", resno,
-                                 res, conflict->name, conflict);
-                        res->start = start;
-                        res->end = end;
-                } else
-                        ret = 0;
+                        type = "unknown";
+                dev_info(&dev->dev,
+                         "BAR %d: can't assign %s (size %#llx)\n",
+                         resno, type, (unsigned long long) resource_size(res));
         }
 
+        return ret;
+}
+
+int pci_reassign_resource(struct pci_dev *dev, int resno, resource_size_t addsize,
+                        resource_size_t min_align)
+{
+        struct resource *res = dev->resource + resno;
+        resource_size_t new_size;
+        int ret;
+
+        if (!res->parent) {
+                dev_info(&dev->dev, "BAR %d: can't reassign an unassigned resouce %pR "
+                         "\n", resno, res);
+                return -EINVAL;
+        }
+
+        new_size = resource_size(res) + addsize + min_align;
+        ret = _pci_assign_resource(dev, resno, new_size, min_align);
         if (!ret) {
                 res->flags &= ~IORESOURCE_STARTALIGN;
                 dev_info(&dev->dev, "BAR %d: assigned %pR\n", resno, res);
                 if (resno < PCI_BRIDGE_RESOURCES)
                         pci_update_resource(dev, resno);
         }
-
         return ret;
 }
 
 int pci_assign_resource(struct pci_dev *dev, int resno)
 {
         struct resource *res = dev->resource + resno;
-        resource_size_t align;
+        resource_size_t align, size;
         struct pci_bus *bus;
         int ret;
-        char *type;
 
         align = pci_resource_alignment(dev, res);
         if (!align) {
@@ -213,34 +258,27 @@ int pci_assign_resource(struct pci_dev *dev, int resno)
         }
 
         bus = dev->bus;
-        while ((ret = __pci_assign_resource(bus, dev, resno))) {
-                if (bus->parent && bus->self->transparent)
-                        bus = bus->parent;
-                else
-                        bus = NULL;
-                if (bus)
-                        continue;
-                break;
-        }
+        size = resource_size(res);
+        ret = _pci_assign_resource(dev, resno, size, align);
 
-        if (ret) {
-                if (res->flags & IORESOURCE_MEM)
-                        if (res->flags & IORESOURCE_PREFETCH)
-                                type = "mem pref";
-                        else
-                                type = "mem";
-                else if (res->flags & IORESOURCE_IO)
-                        type = "io";
-                else
-                        type = "unknown";
-                dev_info(&dev->dev,
-                         "BAR %d: can't assign %s (size %#llx)\n",
-                         resno, type, (unsigned long long) resource_size(res));
-        }
+        /*
+         * If we failed to assign anything, let's try the address
+         * where firmware left it.  That at least has a chance of
+         * working, which is better than just leaving it disabled.
+         */
+        if (ret < 0 && dev->fw_addr[resno])
+                ret = pci_revert_fw_address(res, dev, resno, size);
 
+        if (!ret) {
+                res->flags &= ~IORESOURCE_STARTALIGN;
+                dev_info(&dev->dev, "BAR %d: assigned %pR\n", resno, res);
+                if (resno < PCI_BRIDGE_RESOURCES)
+                        pci_update_resource(dev, resno);
+        }
         return ret;
 }
 
+
 /* Sort resources by alignment */
 void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
 {
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 3195dbd3ec34..44e91e598f8d 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -639,7 +639,7 @@ EXPORT_SYMBOL_GPL(rtc_irq_unregister);
 static int rtc_update_hrtimer(struct rtc_device *rtc, int enabled)
 {
         /*
-         * We unconditionally cancel the timer here, because otherwise
+         * We always cancel the timer here first, because otherwise
          * we could run into BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
          * when we manage to start the timer before the callback
          * returns HRTIMER_RESTART.
@@ -708,7 +708,7 @@ int rtc_irq_set_freq(struct rtc_device *rtc, struct rtc_task *task, int freq)
         int err = 0;
         unsigned long flags;
 
-        if (freq <= 0 || freq > 5000)
+        if (freq <= 0 || freq > RTC_MAX_FREQ)
                 return -EINVAL;
 retry:
         spin_lock_irqsave(&rtc->irq_task_lock, flags);
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
index c01c0cb0af4e..b99a11a9dd69 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsparser.c
@@ -812,7 +812,7 @@ int AthCreateCommandList(struct ps_cmd_packet **HciPacketList, u32 *numPackets)
     for(count = 0; count < Patch_Count; count++) {
 
         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Freeing Patch Buffer %d \r\n",count));
-        kfree(RamPatch[Patch_Count].Data);
+        kfree(RamPatch[count].Data);
     }
 
     for(count = 0; count < Tag_Count; count++) {
diff --git a/drivers/staging/dt3155v4l/dt3155v4l.c b/drivers/staging/dt3155v4l/dt3155v4l.c
index fe02d22274b4..05aa41cf875b 100644
--- a/drivers/staging/dt3155v4l/dt3155v4l.c
+++ b/drivers/staging/dt3155v4l/dt3155v4l.c
@@ -22,6 +22,7 @@
 #include <linux/stringify.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include <media/v4l2-dev.h>
 #include <media/v4l2-ioctl.h>
 #include <media/videobuf2-dma-contig.h>
diff --git a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
index 627a98b4ec30..9e728b3415e3 100644
--- a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
+++ b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
@@ -22,6 +22,7 @@
 #include <linux/string.h>
 #include <linux/vmalloc.h>
 #include <linux/netdevice.h>
+#include <asm/io.h>
 #include <asm/uaccess.h>
 #include "ft1000.h"
 
diff --git a/drivers/staging/gma500/gem_glue.c b/drivers/staging/gma500/gem_glue.c
index 779ac1a12d24..daac12120653 100644
--- a/drivers/staging/gma500/gem_glue.c
+++ b/drivers/staging/gma500/gem_glue.c
@@ -20,26 +20,6 @@
 #include <drm/drmP.h>
 #include <drm/drm.h>
 
-/**
- * Initialize an already allocated GEM object of the specified size with
- * no GEM provided backing store. Instead the caller is responsible for
- * backing the object and handling it.
- */
-int drm_gem_private_object_init(struct drm_device *dev,
-                        struct drm_gem_object *obj, size_t size)
-{
-        BUG_ON((size & (PAGE_SIZE - 1)) != 0);
-
-        obj->dev = dev;
-        obj->filp = NULL;
-
-        kref_init(&obj->refcount);
-        atomic_set(&obj->handle_count, 0);
-        obj->size = size;
-
-        return 0;
-}
-
 void drm_gem_object_release_wrap(struct drm_gem_object *obj)
 {
         /* Remove the list map if one is present */
@@ -51,8 +31,7 @@ void drm_gem_object_release_wrap(struct drm_gem_object *obj)
                 kfree(list->map);
                 list->map = NULL;
         }
-        if (obj->filp)
-                drm_gem_object_release(obj);
+        drm_gem_object_release(obj);
 }
 
 /**
diff --git a/drivers/staging/gma500/gem_glue.h b/drivers/staging/gma500/gem_glue.h
index a0f2bc4e4ae7..ce5ce30f74db 100644
--- a/drivers/staging/gma500/gem_glue.h
+++ b/drivers/staging/gma500/gem_glue.h
@@ -1,4 +1,2 @@
 extern void drm_gem_object_release_wrap(struct drm_gem_object *obj);
-extern int drm_gem_private_object_init(struct drm_device *dev,
-                        struct drm_gem_object *obj, size_t size);
 extern int gem_create_mmap_offset(struct drm_gem_object *obj);
diff --git a/drivers/staging/gma500/mdfld_dsi_dbi.c b/drivers/staging/gma500/mdfld_dsi_dbi.c
index 02e17c9c8637..fd211f3467c4 100644
--- a/drivers/staging/gma500/mdfld_dsi_dbi.c
+++ b/drivers/staging/gma500/mdfld_dsi_dbi.c
@@ -711,10 +711,11 @@ struct mdfld_dsi_encoder *mdfld_dsi_dbi_init(struct drm_device *dev,
         /* Create drm encoder object */
         connector = &dsi_connector->base.base;
         encoder = &dbi_output->base.base;
+        /* Review this if we ever get MIPI-HDMI bridges or similar */
         drm_encoder_init(dev,
                         encoder,
                         p_funcs->encoder_funcs,
-                        DRM_MODE_ENCODER_MIPI);
+                        DRM_MODE_ENCODER_LVDS);
         drm_encoder_helper_add(encoder, p_funcs->encoder_helper_funcs);
 
         /* Attach to given connector */
diff --git a/drivers/staging/gma500/mdfld_dsi_dbi.h b/drivers/staging/gma500/mdfld_dsi_dbi.h
index dc6242c51d0b..f0fa986fd934 100644
--- a/drivers/staging/gma500/mdfld_dsi_dbi.h
+++ b/drivers/staging/gma500/mdfld_dsi_dbi.h
@@ -42,9 +42,6 @@
 #include "mdfld_dsi_output.h"
 #include "mdfld_output.h"
 
-#define DRM_MODE_ENCODER_MIPI  5
-
-
 /*
  * DBI encoder which inherits from mdfld_dsi_encoder
  */
diff --git a/drivers/staging/gma500/mdfld_dsi_dpi.c b/drivers/staging/gma500/mdfld_dsi_dpi.c
index 6e03a91e947e..e685f1217baa 100644
--- a/drivers/staging/gma500/mdfld_dsi_dpi.c
+++ b/drivers/staging/gma500/mdfld_dsi_dpi.c
@@ -777,10 +777,15 @@ struct mdfld_dsi_encoder *mdfld_dsi_dpi_init(struct drm_device *dev,
         /* Create drm encoder object */
         connector = &dsi_connector->base.base;
         encoder = &dpi_output->base.base;
+        /*
+         * On existing hardware this will be a panel of some form,
+         * if future devices also have HDMI bridges this will need
+         * revisiting
+         */
         drm_encoder_init(dev,
                         encoder,
                         p_funcs->encoder_funcs,
-                        DRM_MODE_ENCODER_MIPI);
+                        DRM_MODE_ENCODER_LVDS);
         drm_encoder_helper_add(encoder,
                                 p_funcs->encoder_helper_funcs);
         
diff --git a/drivers/staging/gma500/mdfld_dsi_output.c b/drivers/staging/gma500/mdfld_dsi_output.c
index 7536095c30a0..9050c0f78b15 100644
--- a/drivers/staging/gma500/mdfld_dsi_output.c
+++ b/drivers/staging/gma500/mdfld_dsi_output.c
@@ -955,7 +955,9 @@ void mdfld_dsi_output_init(struct drm_device *dev,
         psb_output->type = (pipe == 0) ? INTEL_OUTPUT_MIPI : INTEL_OUTPUT_MIPI2;
 
         connector = &psb_output->base;
-        drm_connector_init(dev, connector, &mdfld_dsi_connector_funcs, DRM_MODE_CONNECTOR_MIPI);
+        /* Revisit type if MIPI/HDMI bridges ever appear on Medfield */
+        drm_connector_init(dev, connector, &mdfld_dsi_connector_funcs,
+                                                DRM_MODE_CONNECTOR_LVDS);
         drm_connector_helper_add(connector, &mdfld_dsi_connector_helper_funcs);
         
         connector->display_info.subpixel_order = SubPixelHorizontalRGB;
diff --git a/drivers/staging/gma500/medfield.h b/drivers/staging/gma500/medfield.h
index 38165e8367e5..09e9687431f1 100644
--- a/drivers/staging/gma500/medfield.h
+++ b/drivers/staging/gma500/medfield.h
@@ -21,8 +21,6 @@
  * DEALINGS IN THE SOFTWARE.
  */
 
-#define DRM_MODE_ENCODER_MIPI  5
-
 /* Medfield DSI controller registers */
 
 #define MIPIA_DEVICE_READY_REG                          0xb000
diff --git a/drivers/staging/gma500/psb_drv.h b/drivers/staging/gma500/psb_drv.h
index 72f487a2a1b7..fd4732dd783a 100644
--- a/drivers/staging/gma500/psb_drv.h
+++ b/drivers/staging/gma500/psb_drv.h
@@ -35,7 +35,6 @@
 
 /* Append new drm mode definition here, align with libdrm definition */
 #define DRM_MODE_SCALE_NO_SCALE         2
-#define DRM_MODE_CONNECTOR_MIPI         15
 
 enum {
         CHIP_PSB_8108 = 0,              /* Poulsbo */
diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
index 3612574ca520..d286b2223181 100644
--- a/drivers/staging/hv/blkvsc_drv.c
+++ b/drivers/staging/hv/blkvsc_drv.c
@@ -325,7 +325,7 @@ static int blkvsc_do_operation(struct block_device_context *blkdev,
 
         page_buf = alloc_page(GFP_KERNEL);
         if (!page_buf) {
-                kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
+                kmem_cache_free(blkdev->request_pool, blkvsc_req);
                 return -ENOMEM;
         }
 
@@ -422,7 +422,7 @@ cleanup:
 
         __free_page(page_buf);
 
-        kmem_cache_free(blkvsc_req->dev->request_pool, blkvsc_req);
+        kmem_cache_free(blkdev->request_pool, blkvsc_req);
 
         return ret;
 }
diff --git a/drivers/staging/iio/accel/adis16203_core.c b/drivers/staging/iio/accel/adis16203_core.c
index bf1988884e93..cf5d15da76ad 100644
--- a/drivers/staging/iio/accel/adis16203_core.c
+++ b/drivers/staging/iio/accel/adis16203_core.c
@@ -311,13 +311,17 @@ static int adis16203_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16203_addresses[chan->address][0];
                 ret = adis16203_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16203_ERROR_ACTIVE) {
                         ret = adis16203_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16204_core.c b/drivers/staging/iio/accel/adis16204_core.c
index cfd09b3b9937..3e2b62654b7d 100644
--- a/drivers/staging/iio/accel/adis16204_core.c
+++ b/drivers/staging/iio/accel/adis16204_core.c
@@ -341,13 +341,17 @@ static int adis16204_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16204_addresses[chan->address][0];
                 ret = adis16204_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16204_ERROR_ACTIVE) {
                         ret = adis16204_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16209_core.c b/drivers/staging/iio/accel/adis16209_core.c
index 55f3a7bcaf0a..bec1fa8de9b9 100644
--- a/drivers/staging/iio/accel/adis16209_core.c
+++ b/drivers/staging/iio/accel/adis16209_core.c
@@ -337,13 +337,17 @@ static int adis16209_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16209_addresses[chan->address][0];
                 ret = adis16209_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16209_ERROR_ACTIVE) {
                         ret = adis16209_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/accel/adis16240_core.c b/drivers/staging/iio/accel/adis16240_core.c
index 4a4eafc58630..aee8b69173c4 100644
--- a/drivers/staging/iio/accel/adis16240_core.c
+++ b/drivers/staging/iio/accel/adis16240_core.c
@@ -370,13 +370,17 @@ static int adis16240_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16240_addresses[chan->address][0];
                 ret = adis16240_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16240_ERROR_ACTIVE) {
                         ret = adis16240_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/iio/gyro/adis16260_core.c b/drivers/staging/iio/gyro/adis16260_core.c
index 05797f404bea..f2d43cfcc493 100644
--- a/drivers/staging/iio/gyro/adis16260_core.c
+++ b/drivers/staging/iio/gyro/adis16260_core.c
@@ -446,13 +446,17 @@ static int adis16260_read_raw(struct iio_dev *indio_dev,
                 mutex_lock(&indio_dev->mlock);
                 addr = adis16260_addresses[chan->address][0];
                 ret = adis16260_spi_read_reg_16(indio_dev, addr, &val16);
-                if (ret)
+                if (ret) {
+                        mutex_unlock(&indio_dev->mlock);
                         return ret;
+                }
 
                 if (val16 & ADIS16260_ERROR_ACTIVE) {
                         ret = adis16260_check_status(indio_dev);
-                        if (ret)
+                        if (ret) {
+                                mutex_unlock(&indio_dev->mlock);
                                 return ret;
+                        }
                 }
                 val16 = val16 & ((1 << chan->scan_type.realbits) - 1);
                 if (chan->scan_type.sign == 's')
diff --git a/drivers/staging/nvec/TODO b/drivers/staging/nvec/TODO
index 77b47f763f22..649d6b70deaa 100644
--- a/drivers/staging/nvec/TODO
+++ b/drivers/staging/nvec/TODO
@@ -4,5 +4,7 @@ ToDo list (incomplete, unordered)
         - add compile as module support
         - move nvec devices to mfd cells?
         - adjust to kernel style
-
-
+        - fix clk usage
+          should not be using clk_get_sys(), but clk_get(&pdev->dev, conn)
+          where conn is either NULL if the device only has one clock, or
+          the device specific name if it has multiple clocks.
diff --git a/drivers/staging/rtl8192u/r819xU_firmware.c b/drivers/staging/rtl8192u/r819xU_firmware.c
index 6766f468639f..4bb5fffca5b9 100644
--- a/drivers/staging/rtl8192u/r819xU_firmware.c
+++ b/drivers/staging/rtl8192u/r819xU_firmware.c
@@ -399,10 +399,7 @@ download_firmware_fail:
 
 }
 
-
-
-
-
-
-
+MODULE_FIRMWARE("RTL8192U/boot.img");
+MODULE_FIRMWARE("RTL8192U/main.img");
+MODULE_FIRMWARE("RTL8192U/data.img");
 
diff --git a/drivers/staging/rts_pstor/rtsx.c b/drivers/staging/rts_pstor/rtsx.c
index 5ff59f27d101..16c73fbff51f 100644
--- a/drivers/staging/rts_pstor/rtsx.c
+++ b/drivers/staging/rts_pstor/rtsx.c
@@ -66,12 +66,6 @@ static int msi_en;
 module_param(msi_en, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(msi_en, "enable msi");
 
-/* These are used to make sure the module doesn't unload before all the
- * threads have exited.
- */
-static atomic_t total_threads = ATOMIC_INIT(0);
-static DECLARE_COMPLETION(threads_gone);
-
 static irqreturn_t rtsx_interrupt(int irq, void *dev_id);
 
 /***********************************************************************
@@ -192,7 +186,7 @@ static int queuecommand_lck(struct scsi_cmnd *srb,
         /* enqueue the command and wake up the control thread */
         srb->scsi_done = done;
         chip->srb = srb;
-        up(&(dev->sema));
+        complete(&dev->cmnd_ready);
 
         return 0;
 }
@@ -475,7 +469,7 @@ static int rtsx_control_thread(void *__dev)
         current->flags |= PF_NOFREEZE;
 
         for (;;) {
-                if (down_interruptible(&dev->sema))
+                if (wait_for_completion_interruptible(&dev->cmnd_ready))
                         break;
 
                 /* lock the device pointers */
@@ -557,8 +551,6 @@ SkipForAbort:
                 mutex_unlock(&dev->dev_mutex);
         } /* for (;;) */
 
-        scsi_host_put(host);
-
         /* notify the exit routine that we're actually exiting now
          *
          * complete()/wait_for_completion() is similar to up()/down(),
@@ -573,7 +565,7 @@ SkipForAbort:
          * This is important in preemption kernels, which transfer the flow
          * of execution immediately upon a complete().
          */
-        complete_and_exit(&threads_gone, 0);
+        complete_and_exit(&dev->control_exit, 0);
 }
 
 
@@ -581,7 +573,6 @@ static int rtsx_polling_thread(void *__dev)
 {
         struct rtsx_dev *dev = (struct rtsx_dev *)__dev;
         struct rtsx_chip *chip = dev->chip;
-        struct Scsi_Host *host = rtsx_to_host(dev);
         struct sd_info *sd_card = &(chip->sd_card);
         struct xd_info *xd_card = &(chip->xd_card);
         struct ms_info *ms_card = &(chip->ms_card);
@@ -621,8 +612,7 @@ static int rtsx_polling_thread(void *__dev)
                 mutex_unlock(&dev->dev_mutex);
         }
 
-        scsi_host_put(host);
-        complete_and_exit(&threads_gone, 0);
+        complete_and_exit(&dev->polling_exit, 0);
 }
 
 /*
@@ -699,29 +689,38 @@ static void rtsx_release_resources(struct rtsx_dev *dev)
 {
         printk(KERN_INFO "-- %s\n", __func__);
 
+        /* Tell the control thread to exit.  The SCSI host must
+         * already have been removed so it won't try to queue
+         * any more commands.
+         */
+        printk(KERN_INFO "-- sending exit command to thread\n");
+        complete(&dev->cmnd_ready);
+        if (dev->ctl_thread)
+                wait_for_completion(&dev->control_exit);
+        if (dev->polling_thread)
+                wait_for_completion(&dev->polling_exit);
+
+        wait_timeout(200);
+
         if (dev->rtsx_resv_buf) {
-                dma_free_coherent(&(dev->pci->dev), HOST_CMDS_BUF_LEN,
+                dma_free_coherent(&(dev->pci->dev), RTSX_RESV_BUF_LEN,
                                 dev->rtsx_resv_buf, dev->rtsx_resv_buf_addr);
                 dev->chip->host_cmds_ptr = NULL;
                 dev->chip->host_sg_tbl_ptr = NULL;
         }
 
-        pci_disable_device(dev->pci);
-        pci_release_regions(dev->pci);
-
-        if (dev->irq > 0) {
+        if (dev->irq > 0)
                 free_irq(dev->irq, (void *)dev);
-        }
-        if (dev->chip->msi_en) {
+        if (dev->chip->msi_en)
                 pci_disable_msi(dev->pci);
-        }
+        if (dev->remap_addr)
+                iounmap(dev->remap_addr);
 
-        /* Tell the control thread to exit.  The SCSI host must
-         * already have been removed so it won't try to queue
-         * any more commands.
-         */
-        printk(KERN_INFO "-- sending exit command to thread\n");
-        up(&dev->sema);
+        pci_disable_device(dev->pci);
+        pci_release_regions(dev->pci);
+
+        rtsx_release_chip(dev->chip);
+        kfree(dev->chip);
 }
 
 /* First stage of disconnect processing: stop all commands and remove
@@ -739,6 +738,7 @@ static void quiesce_and_remove_host(struct rtsx_dev *dev)
         scsi_unlock(host);
         mutex_unlock(&dev->dev_mutex);
         wake_up(&dev->delay_wait);
+        wait_for_completion(&dev->scanning_done);
 
         /* Wait some time to let other threads exist */
         wait_timeout(100);
@@ -793,8 +793,7 @@ static int rtsx_scan_thread(void *__dev)
                 /* Should we unbind if no devices were detected? */
         }
 
-        scsi_host_put(rtsx_to_host(dev));
-        complete_and_exit(&threads_gone, 0);
+        complete_and_exit(&dev->scanning_done, 0);
 }
 
 static void rtsx_init_options(struct rtsx_chip *chip)
@@ -941,8 +940,11 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
 
         spin_lock_init(&dev->reg_lock);
         mutex_init(&(dev->dev_mutex));
-        sema_init(&(dev->sema), 0);
+        init_completion(&dev->cmnd_ready);
+        init_completion(&dev->control_exit);
+        init_completion(&dev->polling_exit);
         init_completion(&(dev->notify));
+        init_completion(&dev->scanning_done);
         init_waitqueue_head(&dev->delay_wait);
 
         dev->pci = pci;
@@ -992,28 +994,22 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
         pci_set_master(pci);
         synchronize_irq(dev->irq);
 
-        err = scsi_add_host(host, &pci->dev);
-        if (err) {
-                printk(KERN_ERR "Unable to add the scsi host\n");
-                goto errout;
-        }
-
         rtsx_init_chip(dev->chip);
 
         /* Start up our control thread */
-        th = kthread_create(rtsx_control_thread, dev, CR_DRIVER_NAME);
+        th = kthread_run(rtsx_control_thread, dev, CR_DRIVER_NAME);
         if (IS_ERR(th)) {
                 printk(KERN_ERR "Unable to start control thread\n");
                 err = PTR_ERR(th);
                 goto errout;
         }
+        dev->ctl_thread = th;
 
-        /* Take a reference to the host for the control thread and
-         * count it among all the threads we have launched.  Then
-         * start it up. */
-        scsi_host_get(rtsx_to_host(dev));
-        atomic_inc(&total_threads);
-        wake_up_process(th);
+        err = scsi_add_host(host, &pci->dev);
+        if (err) {
+                printk(KERN_ERR "Unable to add the scsi host\n");
+                goto errout;
+        }
 
         /* Start up the thread for delayed SCSI-device scanning */
         th = kthread_create(rtsx_scan_thread, dev, "rtsx-scan");
@@ -1024,28 +1020,17 @@ static int __devinit rtsx_probe(struct pci_dev *pci, const struct pci_device_id
                 goto errout;
         }
 
-        /* Take a reference to the host for the scanning thread and
-         * count it among all the threads we have launched.  Then
-         * start it up. */
-        scsi_host_get(rtsx_to_host(dev));
-        atomic_inc(&total_threads);
         wake_up_process(th);
 
         /* Start up the thread for polling thread */
-        th = kthread_create(rtsx_polling_thread, dev, "rtsx-polling");
+        th = kthread_run(rtsx_polling_thread, dev, "rtsx-polling");
         if (IS_ERR(th)) {
                 printk(KERN_ERR "Unable to start the device-polling thread\n");
                 quiesce_and_remove_host(dev);
                 err = PTR_ERR(th);
                 goto errout;
         }
-
-        /* Take a reference to the host for the polling thread and
-         * count it among all the threads we have launched.  Then
-         * start it up. */
-        scsi_host_get(rtsx_to_host(dev));
-        atomic_inc(&total_threads);
-        wake_up_process(th);
+        dev->polling_thread = th;
 
         pci_set_drvdata(pci, dev);
 
@@ -1108,16 +1093,6 @@ static void __exit rtsx_exit(void)
 
         pci_unregister_driver(&driver);
 
-        /* Don't return until all of our control and scanning threads
-         * have exited.  Since each thread signals threads_gone as its
-         * last act, we have to call wait_for_completion the right number
-         * of times.
-         */
-        while (atomic_read(&total_threads) > 0) {
-                wait_for_completion(&threads_gone);
-                atomic_dec(&total_threads);
-        }
-
         printk(KERN_INFO "%s module exit\n", CR_DRIVER_NAME);
 }
 
diff --git a/drivers/staging/rts_pstor/rtsx.h b/drivers/staging/rts_pstor/rtsx.h
index 247615ba1d2a..86e47c2e3e3c 100644
--- a/drivers/staging/rts_pstor/rtsx.h
+++ b/drivers/staging/rts_pstor/rtsx.h
@@ -112,9 +112,16 @@ struct rtsx_dev {
         /* locks */
         spinlock_t              reg_lock;
 
+        struct task_struct      *ctl_thread;     /* the control thread   */
+        struct task_struct      *polling_thread; /* the polling thread   */
+
         /* mutual exclusion and synchronization structures */
-        struct semaphore        sema;            /* to sleep thread on      */
+        struct completion       cmnd_ready;      /* to sleep thread on      */
+        struct completion       control_exit;    /* control thread exit     */
+        struct completion       polling_exit;    /* polling thread exit     */
         struct completion       notify;          /* thread begin/end        */
+        struct completion       scanning_done;   /* wait for scan thread    */
+
         wait_queue_head_t       delay_wait;      /* wait during scan, reset */
         struct mutex            dev_mutex;
 
diff --git a/drivers/staging/solo6x10/core.c b/drivers/staging/solo6x10/core.c
index 76779949f141..f974f6412ad7 100644
--- a/drivers/staging/solo6x10/core.c
+++ b/drivers/staging/solo6x10/core.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 #include <linux/videodev2.h>
 #include "solo6x10.h"
 #include "tw28.h"
diff --git a/drivers/staging/solo6x10/enc.c b/drivers/staging/solo6x10/enc.c
index 285f7f350062..de502599bb19 100644
--- a/drivers/staging/solo6x10/enc.c
+++ b/drivers/staging/solo6x10/enc.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include "solo6x10.h"
 #include "osd-font.h"
 
diff --git a/drivers/staging/solo6x10/g723.c b/drivers/staging/solo6x10/g723.c
index bd8eb92c94b1..59274bfca95b 100644
--- a/drivers/staging/solo6x10/g723.c
+++ b/drivers/staging/solo6x10/g723.c
@@ -21,6 +21,7 @@
 #include <linux/mempool.h>
 #include <linux/poll.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include <linux/freezer.h>
 #include <sound/core.h>
 #include <sound/initval.h>
diff --git a/drivers/staging/solo6x10/p2m.c b/drivers/staging/solo6x10/p2m.c
index 5717eabb04a4..56210f0fc5ec 100644
--- a/drivers/staging/solo6x10/p2m.c
+++ b/drivers/staging/solo6x10/p2m.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/scatterlist.h>
 #include "solo6x10.h"
 
diff --git a/drivers/staging/solo6x10/solo6x10.h b/drivers/staging/solo6x10/solo6x10.h
index 17c06bd6cc91..abee7213202f 100644
--- a/drivers/staging/solo6x10/solo6x10.h
+++ b/drivers/staging/solo6x10/solo6x10.h
@@ -28,6 +28,7 @@
 #include <linux/list.h>
 #include <linux/wait.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <linux/atomic.h>
 #include <linux/videodev2.h>
diff --git a/drivers/staging/speakup/devsynth.c b/drivers/staging/speakup/devsynth.c
index 39dc586fc8bb..940769ef883f 100644
--- a/drivers/staging/speakup/devsynth.c
+++ b/drivers/staging/speakup/devsynth.c
@@ -18,13 +18,14 @@ static ssize_t speakup_file_write(struct file *fp, const char *buffer,
 {
         size_t count = nbytes;
         const char *ptr = buffer;
-        int bytes;
+        size_t bytes;
         unsigned long flags;
         u_char buf[256];
+
         if (synth == NULL)
                 return -ENODEV;
         while (count > 0) {
-                bytes = min_t(size_t, count, sizeof(buf));
+                bytes = min(count, sizeof(buf));
                 if (copy_from_user(buf, ptr, bytes))
                         return -EFAULT;
                 count -= bytes;
diff --git a/drivers/staging/zcache/Makefile b/drivers/staging/zcache/Makefile
index f5ec64f94470..60daa272c204 100644
--- a/drivers/staging/zcache/Makefile
+++ b/drivers/staging/zcache/Makefile
@@ -1,3 +1,3 @@
-zcache-y        :=      tmem.o
+zcache-y        :=      zcache-main.o tmem.o
 
 obj-$(CONFIG_ZCACHE)    +=      zcache.o
diff --git a/drivers/staging/zcache/zcache.c b/drivers/staging/zcache/zcache-main.c
index 65a81a0d7c49..855a5bb56a47 100644
--- a/drivers/staging/zcache/zcache.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -19,6 +19,7 @@
  *   http://marc.info/?l=linux-mm&m=127811271605009
  */
 
+#include <linux/module.h>
 #include <linux/cpu.h>
 #include <linux/highmem.h>
 #include <linux/list.h>
@@ -27,6 +28,7 @@
 #include <linux/spinlock.h>
 #include <linux/types.h>
 #include <linux/atomic.h>
+#include <linux/math64.h>
 #include "tmem.h"
 
 #include "../zram/xvmalloc.h" /* if built in drivers/staging */
@@ -53,6 +55,9 @@
 
 #define MAX_CLIENTS 16
 #define LOCAL_CLIENT ((uint16_t)-1)
+
+MODULE_LICENSE("GPL");
+
 struct zcache_client {
         struct tmem_pool *tmem_pools[MAX_POOLS_PER_CLIENT];
         struct xv_pool *xvpool;
@@ -1158,6 +1163,7 @@ static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph,
         uint16_t client_id = get_client_id_from_client(cli);
         unsigned long zv_mean_zsize;
         unsigned long curr_pers_pampd_count;
+        u64 total_zsize;
 
         if (eph) {
                 ret = zcache_compress(page, &cdata, &clen);
@@ -1190,8 +1196,9 @@ static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph,
                 }
                 /* reject if mean compression is too poor */
                 if ((clen > zv_max_mean_zsize) && (curr_pers_pampd_count > 0)) {
-                        zv_mean_zsize = xv_get_total_size_bytes(cli->xvpool) /
-                                                curr_pers_pampd_count;
+                        total_zsize = xv_get_total_size_bytes(cli->xvpool);
+                        zv_mean_zsize = div_u64(total_zsize,
+                                                curr_pers_pampd_count);
                         if (zv_mean_zsize > zv_max_mean_zsize) {
                                 zcache_mean_compress_poor++;
                                 goto out;
@@ -1929,9 +1936,9 @@ __setup("nofrontswap", no_frontswap);
 
 static int __init zcache_init(void)
 {
-#ifdef CONFIG_SYSFS
         int ret = 0;
 
+#ifdef CONFIG_SYSFS
         ret = sysfs_create_group(mm_kobj, &zcache_attr_group);
         if (ret) {
                 pr_err("zcache: can't create sysfs\n");
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 385acb895ab3..3f94ac34dce3 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -268,7 +268,7 @@ usbtmc_abort_bulk_in_status:
                                 dev_err(dev, "usb_bulk_msg returned %d\n", rv);
                                 goto exit;
                         }
-                } while ((actual = max_size) &&
+                } while ((actual == max_size) &&
                          (n < USBTMC_MAX_READS_TO_CLEAR_BULK_IN));
 
         if (actual == max_size) {
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index c962608b4b9a..26678cadfb21 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -123,10 +123,11 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
         }
 
         if (usb_endpoint_xfer_isoc(&ep->desc))
-                max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1) *
-                        (desc->bmAttributes + 1);
+                max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
+                        le16_to_cpu(ep->desc.wMaxPacketSize);
         else if (usb_endpoint_xfer_int(&ep->desc))
-                max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1);
+                max_tx = le16_to_cpu(ep->desc.wMaxPacketSize) *
+                        (desc->bMaxBurst + 1);
         else
                 max_tx = 999999;
         if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) {
@@ -134,10 +135,10 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                                 "config %d interface %d altsetting %d ep %d: "
                                 "setting to %d\n",
                                 usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int",
-                                desc->wBytesPerInterval,
+                                le16_to_cpu(desc->wBytesPerInterval),
                                 cfgno, inum, asnum, ep->desc.bEndpointAddress,
                                 max_tx);
-                ep->ss_ep_comp.wBytesPerInterval = max_tx;
+                ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx);
         }
 }
 
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 44b6b40aafb4..5a084b9cfa3c 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -310,7 +310,7 @@ config USB_PXA_U2O
 # musb builds in ../musb along with host support
 config USB_GADGET_MUSB_HDRC
         tristate "Inventra HDRC USB Peripheral (TI, ADI, ...)"
-        depends on USB_MUSB_HDRC && (USB_MUSB_PERIPHERAL || USB_MUSB_OTG)
+        depends on USB_MUSB_HDRC
         select USB_GADGET_DUALSPEED
         help
           This OTG-capable silicon IP is used in dual designs including
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 98cbc06c30fd..ddb118a76807 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -35,6 +35,7 @@
 #include <linux/list.h>
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
+#include <linux/prefetch.h>
 #include <linux/clk.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 5ef87794fd32..aef47414f5d5 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1079,10 +1079,12 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                         cdev->desc.bMaxPacketSize0 =
                                 cdev->gadget->ep0->maxpacket;
                         if (gadget_is_superspeed(gadget)) {
-                                if (gadget->speed >= USB_SPEED_SUPER)
+                                if (gadget->speed >= USB_SPEED_SUPER) {
                                         cdev->desc.bcdUSB = cpu_to_le16(0x0300);
-                                else
+                                        cdev->desc.bMaxPacketSize0 = 9;
+                                } else {
                                         cdev->desc.bcdUSB = cpu_to_le16(0x0210);
+                                }
                         }
 
                         value = min(w_length, (u16) sizeof cdev->desc);
diff --git a/drivers/usb/gadget/f_hid.c b/drivers/usb/gadget/f_hid.c
index 403a48bcf560..83a266bdb40e 100644
--- a/drivers/usb/gadget/f_hid.c
+++ b/drivers/usb/gadget/f_hid.c
@@ -367,6 +367,13 @@ static int hidg_setup(struct usb_function *f,
         case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8
                   | USB_REQ_GET_DESCRIPTOR):
                 switch (value >> 8) {
+                case HID_DT_HID:
+                        VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: HID\n");
+                        length = min_t(unsigned short, length,
+                                                   hidg_desc.bLength);
+                        memcpy(req->buf, &hidg_desc, length);
+                        goto respond;
+                        break;
                 case HID_DT_REPORT:
                         VDBG(cdev, "USB_REQ_GET_DESCRIPTOR: REPORT\n");
                         length = min_t(unsigned short, length,
diff --git a/drivers/usb/gadget/fusb300_udc.c b/drivers/usb/gadget/fusb300_udc.c
index 24a924330c81..4ec888f90002 100644
--- a/drivers/usb/gadget/fusb300_udc.c
+++ b/drivers/usb/gadget/fusb300_udc.c
@@ -609,107 +609,6 @@ void fusb300_rdcxf(struct fusb300 *fusb300,
         }
 }
 
-#if 0
-static void fusb300_dbg_fifo(struct fusb300_ep *ep,
-                                u8 entry, u16 length)
-{
-        u32 reg;
-        u32 i = 0;
-        u32 j = 0;
-
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_GTM);
-        reg &= ~(FUSB300_GTM_TST_EP_ENTRY(0xF) |
-                FUSB300_GTM_TST_EP_NUM(0xF) | FUSB300_GTM_TST_FIFO_DEG);
-        reg |= (FUSB300_GTM_TST_EP_ENTRY(entry) |
-                FUSB300_GTM_TST_EP_NUM(ep->epnum) | FUSB300_GTM_TST_FIFO_DEG);
-        iowrite32(reg, ep->fusb300->reg + FUSB300_OFFSET_GTM);
-
-        for (i = 0; i < (length >> 2); i++) {
-                if (i * 4 == 1024)
-                        break;
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i * 4);
-                printk(KERN_DEBUG"  0x%-8x", reg);
-                j++;
-                if ((j % 4)  == 0)
-                        printk(KERN_DEBUG "\n");
-        }
-
-        if (length % 4) {
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i * 4);
-                printk(KERN_DEBUG "  0x%x\n", reg);
-        }
-
-        if ((j % 4)  != 0)
-                printk(KERN_DEBUG "\n");
-
-        fusb300_disable_bit(ep->fusb300, FUSB300_OFFSET_GTM,
-                FUSB300_GTM_TST_FIFO_DEG);
-}
-
-static void fusb300_cmp_dbg_fifo(struct fusb300_ep *ep,
-                                u8 entry, u16 length, u8 *golden)
-{
-        u32 reg;
-        u32 i = 0;
-        u32 golden_value;
-        u8 *tmp;
-
-        tmp = golden;
-
-        printk(KERN_DEBUG "fusb300_cmp_dbg_fifo (entry %d) : start\n", entry);
-
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_GTM);
-        reg &= ~(FUSB300_GTM_TST_EP_ENTRY(0xF) |
-                FUSB300_GTM_TST_EP_NUM(0xF) | FUSB300_GTM_TST_FIFO_DEG);
-        reg |= (FUSB300_GTM_TST_EP_ENTRY(entry) |
-                FUSB300_GTM_TST_EP_NUM(ep->epnum) | FUSB300_GTM_TST_FIFO_DEG);
-        iowrite32(reg, ep->fusb300->reg + FUSB300_OFFSET_GTM);
-
-        for (i = 0; i < (length >> 2); i++) {
-                if (i * 4 == 1024)
-                        break;
-                golden_value = *tmp | *(tmp + 1) << 8 |
-                                *(tmp + 2) << 16 | *(tmp + 3) << 24;
-
-                reg = ioread32(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i*4);
-
-                if (reg != golden_value) {
-                        printk(KERN_DEBUG "0x%x  :  ", (u32)(ep->fusb300->reg +
-                                FUSB300_OFFSET_BUFDBG_START + i*4));
-                        printk(KERN_DEBUG "    golden = 0x%x, reg = 0x%x\n",
-                                golden_value, reg);
-                }
-                tmp += 4;
-        }
-
-        switch (length % 4) {
-        case 1:
-                golden_value = *tmp;
-        case 2:
-                golden_value = *tmp | *(tmp + 1) << 8;
-        case 3:
-                golden_value = *tmp | *(tmp + 1) << 8 | *(tmp + 2) << 16;
-        default:
-                break;
-
-        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_BUFDBG_START + i*4);
-        if (reg != golden_value) {
-                printk(KERN_DEBUG "0x%x:", (u32)(ep->fusb300->reg +
-                        FUSB300_OFFSET_BUFDBG_START + i*4));
-                printk(KERN_DEBUG "  golden = 0x%x, reg = 0x%x\n",
-                        golden_value, reg);
-        }
-        }
-
-        printk(KERN_DEBUG "fusb300_cmp_dbg_fifo : end\n");
-        fusb300_disable_bit(ep->fusb300, FUSB300_OFFSET_GTM,
-                FUSB300_GTM_TST_FIFO_DEG);
-}
-#endif
-
 static void fusb300_rdfifo(struct fusb300_ep *ep,
                           struct fusb300_request *req,
                           u32 length)
diff --git a/drivers/usb/gadget/net2272.c b/drivers/usb/gadget/net2272.c
index 7c7b0e120d88..ab98ea926a11 100644
--- a/drivers/usb/gadget/net2272.c
+++ b/drivers/usb/gadget/net2272.c
@@ -27,13 +27,13 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
-#include <linux/irq.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/pci.h>
 #include <linux/platform_device.h>
+#include <linux/prefetch.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/timer.h>
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index 85c1b0d66293..8d31848aab09 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -2060,6 +2060,7 @@ static int s3c2410_udc_resume(struct platform_device *pdev)
 static const struct platform_device_id s3c_udc_ids[] = {
         { "s3c2410-usbgadget", },
         { "s3c2440-usbgadget", },
+        { }
 };
 MODULE_DEVICE_TABLE(platform, s3c_udc_ids);
 
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index bf2c8f65e1ae..e051b30c1847 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -1046,7 +1046,19 @@ static int ehci_hub_control (
                         if (!selector || selector > 5)
                                 goto error;
                         ehci_quiesce(ehci);
+
+                        /* Put all enabled ports into suspend */
+                        while (ports--) {
+                                u32 __iomem *sreg =
+                                                &ehci->regs->port_status[ports];
+
+                                temp = ehci_readl(ehci, sreg) & ~PORT_RWC_BITS;
+                                if (temp & PORT_PE)
+                                        ehci_writel(ehci, temp | PORT_SUSPEND,
+                                                        sreg);
+                        }
                         ehci_halt(ehci);
+                        temp = ehci_readl(ehci, status_reg);
                         temp |= selector << 16;
                         ehci_writel(ehci, temp, status_reg);
                         break;
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index 0c058be35a38..555a73c864b5 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -24,6 +24,7 @@
 #include <linux/usb/ulpi.h>
 #include <linux/slab.h>
 
+#include <mach/hardware.h>
 #include <mach/mxc_ehci.h>
 
 #include <asm/mach-types.h>
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 55a57c23dd0f..45240321ca09 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -98,6 +98,18 @@ static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
         }
 }
 
+static void disable_put_regulator(
+                struct ehci_hcd_omap_platform_data *pdata)
+{
+        int i;
+
+        for (i = 0 ; i < OMAP3_HS_USB_PORTS ; i++) {
+                if (pdata->regulator[i]) {
+                        regulator_disable(pdata->regulator[i]);
+                        regulator_put(pdata->regulator[i]);
+                }
+        }
+}
 
 /* configure so an HC device and id are always provided */
 /* always called with process context; sleeping is OK */
@@ -231,9 +243,11 @@ err_add_hcd:
         omap_usbhs_disable(dev);
 
 err_enable:
+        disable_put_regulator(pdata);
         usb_put_hcd(hcd);
 
 err_io:
+        iounmap(regs);
         return ret;
 }
 
@@ -253,6 +267,8 @@ static int ehci_hcd_omap_remove(struct platform_device *pdev)
 
         usb_remove_hcd(hcd);
         omap_usbhs_disable(dev);
+        disable_put_regulator(dev->platform_data);
+        iounmap(hcd->regs);
         usb_put_hcd(hcd);
         return 0;
 }
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index 55d3d5859ac5..840beda66dd9 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1583,6 +1583,9 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
         int retval = 0;
 
         spin_lock_irqsave(&priv->lock, spinflags);
+        retval = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (retval)
+                goto out;
 
         qh = urb->ep->hcpriv;
         if (!qh) {
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index a9d315906e3d..629a96813fd6 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -535,7 +535,7 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
         iounmap(base);
 }
 
-static const struct dmi_system_id __initconst ehci_dmi_nohandoff_table[] = {
+static const struct dmi_system_id __devinitconst ehci_dmi_nohandoff_table[] = {
         {
                 /*  Pegatron Lucid (ExoPC) */
                 .matches = {
@@ -817,7 +817,7 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
 
         /* If the BIOS owns the HC, signal that the OS wants it, and wait */
         if (val & XHCI_HC_BIOS_OWNED) {
-                writel(val & XHCI_HC_OS_OWNED, base + ext_cap_offset);
+                writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
 
                 /* Wait for 5 seconds with 10 microsecond polling interval */
                 timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 763f484bc092..1c4432d8fc10 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -345,7 +345,8 @@ static void xhci_event_ring_work(unsigned long arg)
         spin_lock_irqsave(&xhci->lock, flags);
         temp = xhci_readl(xhci, &xhci->op_regs->status);
         xhci_dbg(xhci, "op reg status = 0x%x\n", temp);
-        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
+        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg(xhci, "HW died, polling stopped.\n");
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 return;
@@ -939,8 +940,11 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
                 return 0;
         }
 
+        xhci = hcd_to_xhci(hcd);
+        if (xhci->xhc_state & XHCI_STATE_HALTED)
+                return -ENODEV;
+
         if (check_virt_dev) {
-                xhci = hcd_to_xhci(hcd);
                 if (!udev->slot_id || !xhci->devs
                         || !xhci->devs[udev->slot_id]) {
                         printk(KERN_DEBUG "xHCI %s called with unaddressed "
@@ -1242,7 +1246,8 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 xhci_urb_free_priv(xhci, urb_priv);
                 return ret;
         }
-        if (xhci->xhc_state & XHCI_STATE_DYING) {
+        if ((xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg(xhci, "Ep 0x%x: URB %p to be canceled on "
                                 "non-responsive xHCI host.\n",
                                 urb->ep->desc.bEndpointAddress, urb);
@@ -2665,7 +2670,10 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         int i, ret;
 
         ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
-        if (ret <= 0)
+        /* If the host is halted due to driver unload, we still need to free the
+         * device.
+         */
+        if (ret <= 0 && ret != -ENODEV)
                 return;
 
         virt_dev = xhci->devs[udev->slot_id];
@@ -2679,7 +2687,8 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         spin_lock_irqsave(&xhci->lock, flags);
         /* Don't disable the slot if the host controller is dead. */
         state = xhci_readl(xhci, &xhci->op_regs->status);
-        if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
+        if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_free_virt_device(xhci, udev->slot_id);
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 return;
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 6192b45959f4..fc34b8b11910 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -3,9 +3,6 @@
 # for silicon based on Mentor Graphics INVENTRA designs
 #
 
-comment "Enable Host or Gadget support to see Inventra options"
-        depends on !USB && USB_GADGET=n
-
 # (M)HDRC = (Multipoint) Highspeed Dual-Role Controller
 config USB_MUSB_HDRC
         depends on USB && USB_GADGET
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index b67a062f556b..8c41a2e6ea77 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1698,6 +1698,8 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
 
         is_on = !!is_on;
 
+        pm_runtime_get_sync(musb->controller);
+
         /* NOTE: this assumes we are sensing vbus; we'd rather
          * not pullup unless the B-session is active.
          */
@@ -1707,6 +1709,9 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
                 musb_pullup(musb, is_on);
         }
         spin_unlock_irqrestore(&musb->lock, flags);
+
+        pm_runtime_put(musb->controller);
+
         return 0;
 }
 
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index c784e6c03aac..07c8a73dfe41 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -89,7 +89,7 @@ static inline int tusb_omap_use_shared_dmareq(struct tusb_omap_dma_ch *chdat)
         u32             reg = musb_readl(chdat->tbase, TUSB_DMA_EP_MAP);
 
         if (reg != 0) {
-                dev_dbg(musb->controller, "ep%i dmareq0 is busy for ep%i\n",
+                dev_dbg(chdat->musb->controller, "ep%i dmareq0 is busy for ep%i\n",
                         chdat->epnum, reg & 0xf);
                 return -EAGAIN;
         }
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index ba79dbf5adbc..cb2d451d511e 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -14,6 +14,7 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
+#include <linux/dma-mapping.h>
 #include <linux/io.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -76,7 +77,7 @@ struct usbhsg_recip_handle {
                 struct usbhsg_gpriv, mod)
 
 #define __usbhsg_for_each_uep(start, pos, g, i) \
-        for (i = start, pos = (g)->uep;         \
+        for (i = start, pos = (g)->uep + i;     \
              i < (g)->uep_size;                 \
              i++, pos = (g)->uep + i)
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 2e06b90aa1f8..78a2cf9551cc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -151,6 +151,7 @@ static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
  * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
  */
 static struct usb_device_id id_table_combined [] = {
+        { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
@@ -1171,7 +1172,7 @@ static __u32 get_ftdi_divisor(struct tty_struct *tty,
         case FT2232H: /* FT2232H chip */
         case FT4232H: /* FT4232H chip */
         case FT232H:  /* FT232H chip */
-                if ((baud <= 12000000) & (baud >= 1200)) {
+                if ((baud <= 12000000) && (baud >= 1200)) {
                         div_value = ftdi_2232h_baud_to_divisor(baud);
                 } else if (baud < 1200) {
                         div_value = ftdi_232bm_baud_to_divisor(baud);
@@ -1205,7 +1206,10 @@ static int change_speed(struct tty_struct *tty, struct usb_serial_port *port)
         urb_index_value = get_ftdi_divisor(tty, port);
         urb_value = (__u16)urb_index_value;
         urb_index = (__u16)(urb_index_value >> 16);
-        if (priv->interface) {  /* FT2232C */
+        if ((priv->chip_type == FT2232C) || (priv->chip_type == FT2232H) ||
+                (priv->chip_type == FT4232H) || (priv->chip_type == FT232H)) {
+                /* Probably the BM type needs the MSB of the encoded fractional
+                 * divider also moved like for the chips above. Any infos? */
                 urb_index = (__u16)((urb_index << 8) | priv->interface);
         }
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 19156d1049fe..bf5227ad3ef7 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1159,4 +1159,8 @@
 /* USB-Nano-485*/
 #define FTDI_CTI_NANO_PID       0xF60B
 
-
+/*
+ * ZeitControl cardsystems GmbH rfid-readers http://zeitconrol.de
+ */
+/* TagTracer MIFARE*/
+#define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID    0xF7C0
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 60b25d8ea0e2..815656198914 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -148,6 +148,10 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_E14AC                    0x14AC
+#define HUAWEI_PRODUCT_K3770                    0x14C9
+#define HUAWEI_PRODUCT_K3771                    0x14CA
+#define HUAWEI_PRODUCT_K4510                    0x14CB
+#define HUAWEI_PRODUCT_K4511                    0x14CC
 #define HUAWEI_PRODUCT_ETS1220                  0x1803
 #define HUAWEI_PRODUCT_E353                     0x1506
 
@@ -547,6 +551,14 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4510, 0xff, 0x01, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x32) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 54a9dab1f33b..aeccc7f0a93c 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -45,6 +45,7 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE(0x05c6, 0x9203)},   /* Generic Gobi Modem device */
         {USB_DEVICE(0x05c6, 0x9222)},   /* Generic Gobi Modem device */
         {USB_DEVICE(0x05c6, 0x9008)},   /* Generic Gobi QDL device */
+        {USB_DEVICE(0x05c6, 0x9009)},   /* Generic Gobi Modem device */
         {USB_DEVICE(0x05c6, 0x9201)},   /* Generic Gobi QDL device */
         {USB_DEVICE(0x05c6, 0x9221)},   /* Generic Gobi QDL device */
         {USB_DEVICE(0x05c6, 0x9231)},   /* Generic Gobi QDL device */
@@ -78,6 +79,7 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE(0x1199, 0x9008)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
         {USB_DEVICE(0x1199, 0x9009)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
         {USB_DEVICE(0x1199, 0x900a)},   /* Sierra Wireless Gobi 2000 Modem device (VT773) */
+        {USB_DEVICE(0x1199, 0x9011)},   /* Sierra Wireless Gobi 2000 Modem device (MC8305) */
         {USB_DEVICE(0x16d8, 0x8001)},   /* CMDTech Gobi 2000 QDL device (VU922) */
         {USB_DEVICE(0x16d8, 0x8002)},   /* CMDTech Gobi 2000 Modem device (VU922) */
         {USB_DEVICE(0x05c6, 0x9204)},   /* Gobi 2000 QDL device */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index ccff3483eebc..3041a974faf3 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1988,6 +1988,16 @@ UNUSUAL_DEV(  0x4146, 0xba01, 0x0100, 0x0100,
                 "Micro Mini 1GB",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
 
+/*
+ * Nick Bowler <nbowler@elliptictech.com>
+ * SCSI stack spams (otherwise harmless) error messages.
+ */
+UNUSUAL_DEV(  0xc251, 0x4003, 0x0100, 0x0100,
+                "Keil Software, Inc.",
+                "V2M MotherBoard",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NOT_LOCKABLE),
+
 /* Reported by Andrew Simmons <andrew.simmons@gmail.com> */
 UNUSUAL_DEV(  0xed06, 0x4500, 0x0001, 0x0001,
                 "DataStor",
diff --git a/drivers/xen/xen-selfballoon.c b/drivers/xen/xen-selfballoon.c
index 1b4afd81f872..6ea852e25162 100644
--- a/drivers/xen/xen-selfballoon.c
+++ b/drivers/xen/xen-selfballoon.c
@@ -70,6 +70,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
+#include <linux/module.h>
 #include <linux/workqueue.h>
 #include <xen/balloon.h>
 #include <xen/tmem.h>
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index 475f9c597cb7..326dc08d3e3f 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -39,27 +39,17 @@
 
 /* #define DEBUG */
 
-#ifdef DEBUG
-#define DPRINTK(fmt, args...)                           \
-do {                                                    \
-        printk(KERN_DEBUG "pid %d: %s: " fmt "\n",      \
-                current->pid, __func__, ##args);        \
-} while (0)
-#else
-#define DPRINTK(fmt, args...) do {} while (0)
-#endif
-
-#define AUTOFS_WARN(fmt, args...)                       \
-do {                                                    \
+#define DPRINTK(fmt, ...)                               \
+        pr_debug("pid %d: %s: " fmt "\n",               \
+                current->pid, __func__, ##__VA_ARGS__)
+
+#define AUTOFS_WARN(fmt, ...)                           \
         printk(KERN_WARNING "pid %d: %s: " fmt "\n",    \
-                current->pid, __func__, ##args);        \
-} while (0)
+                current->pid, __func__, ##__VA_ARGS__)
 
-#define AUTOFS_ERROR(fmt, args...)                      \
-do {                                                    \
+#define AUTOFS_ERROR(fmt, ...)                          \
         printk(KERN_ERR "pid %d: %s: " fmt "\n",        \
-                current->pid, __func__, ##args);        \
-} while (0)
+                current->pid, __func__, ##__VA_ARGS__)
 
 /* Unified info structure.  This is pointed to by both the dentry and
    inode structures.  Each file in the filesystem has an instance of this
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 25435987d6ae..e1fbdeef85db 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -104,7 +104,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
         size_t pktsz;
 
         DPRINTK("wait id = 0x%08lx, name = %.*s, type=%d",
-                wq->wait_queue_token, wq->name.len, wq->name.name, type);
+                (unsigned long) wq->wait_queue_token, wq->name.len, wq->name.name, type);
 
         memset(&pkt,0,sizeof pkt); /* For security reasons */
 
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 54b8c28bebc8..720d885e8dca 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -474,17 +474,22 @@ befs_follow_link(struct dentry *dentry, struct nameidata *nd)
                 befs_data_stream *data = &befs_ino->i_data.ds;
                 befs_off_t len = data->size;
 
-                befs_debug(sb, "Follow long symlink");
-
-                link = kmalloc(len, GFP_NOFS);
-                if (!link) {
-                        link = ERR_PTR(-ENOMEM);
-                } else if (befs_read_lsymlink(sb, data, link, len) != len) {
-                        kfree(link);
-                        befs_error(sb, "Failed to read entire long symlink");
+                if (len == 0) {
+                        befs_error(sb, "Long symlink with illegal length");
                         link = ERR_PTR(-EIO);
                 } else {
-                        link[len - 1] = '\0';
+                        befs_debug(sb, "Follow long symlink");
+
+                        link = kmalloc(len, GFP_NOFS);
+                        if (!link) {
+                                link = ERR_PTR(-ENOMEM);
+                        } else if (befs_read_lsymlink(sb, data, link, len) != len) {
+                                kfree(link);
+                                befs_error(sb, "Failed to read entire long symlink");
+                                link = ERR_PTR(-EIO);
+                        } else {
+                                link[len - 1] = '\0';
+                        }
                 }
         } else {
                 link = befs_ino->i_data.symlink;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 0469263e327e..03912c5c6f49 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1415,17 +1415,15 @@ void btrfs_set_##name(struct extent_buffer *eb, type *s, u##bits val);
 #define BTRFS_SETGET_HEADER_FUNCS(name, type, member, bits)             \
 static inline u##bits btrfs_##name(struct extent_buffer *eb)            \
 {                                                                       \
-        type *p = kmap_atomic(eb->first_page, KM_USER0);                \
+        type *p = page_address(eb->first_page);                         \
         u##bits res = le##bits##_to_cpu(p->member);                     \
-        kunmap_atomic(p, KM_USER0);                                     \
         return res;                                                     \
 }                                                                       \
 static inline void btrfs_set_##name(struct extent_buffer *eb,           \
                                     u##bits val)                        \
 {                                                                       \
-        type *p = kmap_atomic(eb->first_page, KM_USER0);                \
+        type *p = page_address(eb->first_page);                         \
         p->member = cpu_to_le##bits(val);                               \
-        kunmap_atomic(p, KM_USER0);                                     \
 }
 
 #define BTRFS_SETGET_STACK_FUNCS(name, type, member, bits)              \
@@ -2367,8 +2365,8 @@ static inline int btrfs_insert_empty_item(struct btrfs_trans_handle *trans,
 int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path);
 int btrfs_prev_leaf(struct btrfs_root *root, struct btrfs_path *path);
 int btrfs_leaf_free_space(struct btrfs_root *root, struct extent_buffer *leaf);
-int btrfs_drop_snapshot(struct btrfs_root *root,
-                        struct btrfs_block_rsv *block_rsv, int update_ref);
+void btrfs_drop_snapshot(struct btrfs_root *root,
+                         struct btrfs_block_rsv *block_rsv, int update_ref);
 int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
                         struct btrfs_root *root,
                         struct extent_buffer *node,
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 66bac226944e..80d6148f60ac 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1782,6 +1782,9 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
 
 
                 for (i = 0; i < multi->num_stripes; i++, stripe++) {
+                        if (!stripe->dev->can_discard)
+                                continue;
+
                         ret = btrfs_issue_discard(stripe->dev->bdev,
                                                   stripe->physical,
                                                   stripe->length);
@@ -1789,11 +1792,16 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
                                 discarded_bytes += stripe->length;
                         else if (ret != -EOPNOTSUPP)
                                 break;
+
+                        /*
+                         * Just in case we get back EOPNOTSUPP for some reason,
+                         * just ignore the return value so we don't screw up
+                         * people calling discard_extent.
+                         */
+                        ret = 0;
                 }
                 kfree(multi);
         }
-        if (discarded_bytes && ret == -EOPNOTSUPP)
-                ret = 0;
 
         if (actual_bytes)
                 *actual_bytes = discarded_bytes;
@@ -6269,8 +6277,8 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
  * also make sure backrefs for the shared block and all lower level
  * blocks are properly updated.
  */
-int btrfs_drop_snapshot(struct btrfs_root *root,
-                        struct btrfs_block_rsv *block_rsv, int update_ref)
+void btrfs_drop_snapshot(struct btrfs_root *root,
+                         struct btrfs_block_rsv *block_rsv, int update_ref)
 {
         struct btrfs_path *path;
         struct btrfs_trans_handle *trans;
@@ -6283,13 +6291,16 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
         int level;
 
         path = btrfs_alloc_path();
-        if (!path)
-                return -ENOMEM;
+        if (!path) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         wc = kzalloc(sizeof(*wc), GFP_NOFS);
         if (!wc) {
                 btrfs_free_path(path);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto out;
         }
 
         trans = btrfs_start_transaction(tree_root, 0);
@@ -6318,7 +6329,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
                 path->lowest_level = 0;
                 if (ret < 0) {
                         err = ret;
-                        goto out;
+                        goto out_free;
                 }
                 WARN_ON(ret > 0);
 
@@ -6425,11 +6436,14 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
                 free_extent_buffer(root->commit_root);
                 kfree(root);
         }
-out:
+out_free:
         btrfs_end_transaction_throttle(trans, tree_root);
         kfree(wc);
         btrfs_free_path(path);
-        return err;
+out:
+        if (err)
+                btrfs_std_error(root->fs_info, err);
+        return;
 }
 
 /*
@@ -6720,6 +6734,10 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
         struct btrfs_space_info *space_info;
         struct btrfs_fs_devices *fs_devices = root->fs_info->fs_devices;
         struct btrfs_device *device;
+        u64 min_free;
+        int index;
+        int dev_nr = 0;
+        int dev_min = 1;
         int full = 0;
         int ret = 0;
 
@@ -6729,8 +6747,10 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
         if (!block_group)
                 return -1;
 
+        min_free = btrfs_block_group_used(&block_group->item);
+
         /* no bytes used, we're good */
-        if (!btrfs_block_group_used(&block_group->item))
+        if (!min_free)
                 goto out;
 
         space_info = block_group->space_info;
@@ -6746,10 +6766,9 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
          * all of the extents from this block group.  If we can, we're good
          */
         if ((space_info->total_bytes != block_group->key.offset) &&
-           (space_info->bytes_used + space_info->bytes_reserved +
-            space_info->bytes_pinned + space_info->bytes_readonly +
-            btrfs_block_group_used(&block_group->item) <
-            space_info->total_bytes)) {
+            (space_info->bytes_used + space_info->bytes_reserved +
+             space_info->bytes_pinned + space_info->bytes_readonly +
+             min_free < space_info->total_bytes)) {
                 spin_unlock(&space_info->lock);
                 goto out;
         }
@@ -6766,9 +6785,29 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
         if (full)
                 goto out;
 
+        /*
+         * index:
+         *      0: raid10
+         *      1: raid1
+         *      2: dup
+         *      3: raid0
+         *      4: single
+         */
+        index = get_block_group_index(block_group);
+        if (index == 0) {
+                dev_min = 4;
+                min_free /= 2;
+        } else if (index == 1) {
+                dev_min = 2;
+        } else if (index == 2) {
+                min_free *= 2;
+        } else if (index == 3) {
+                dev_min = fs_devices->rw_devices;
+                min_free /= dev_min;
+        }
+
         mutex_lock(&root->fs_info->chunk_mutex);
         list_for_each_entry(device, &fs_devices->alloc_list, dev_alloc_list) {
-                u64 min_free = btrfs_block_group_used(&block_group->item);
                 u64 dev_offset;
 
                 /*
@@ -6779,7 +6818,11 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
                         ret = find_free_dev_extent(NULL, device, min_free,
                                                    &dev_offset, NULL);
                         if (!ret)
+                                dev_nr++;
+
+                        if (dev_nr >= dev_min)
                                 break;
+
                         ret = -1;
                 }
         }
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 658d66959abe..e7872e485f13 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -150,6 +150,8 @@ int btrfs_add_inode_defrag(struct btrfs_trans_handle *trans,
         spin_lock(&root->fs_info->defrag_inodes_lock);
         if (!BTRFS_I(inode)->in_defrag)
                 __btrfs_add_inode_defrag(inode, defrag);
+        else
+                kfree(defrag);
         spin_unlock(&root->fs_info->defrag_inodes_lock);
         return 0;
 }
@@ -1638,11 +1640,15 @@ static long btrfs_fallocate(struct file *file, int mode,
 
         cur_offset = alloc_start;
         while (1) {
+                u64 actual_end;
+
                 em = btrfs_get_extent(inode, NULL, 0, cur_offset,
                                       alloc_end - cur_offset, 0);
                 BUG_ON(IS_ERR_OR_NULL(em));
                 last_byte = min(extent_map_end(em), alloc_end);
+                actual_end = min_t(u64, extent_map_end(em), offset + len);
                 last_byte = (last_byte + mask) & ~mask;
+
                 if (em->block_start == EXTENT_MAP_HOLE ||
                     (cur_offset >= inode->i_size &&
                      !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
@@ -1655,6 +1661,16 @@ static long btrfs_fallocate(struct file *file, int mode,
                                 free_extent_map(em);
                                 break;
                         }
+                } else if (actual_end > inode->i_size &&
+                           !(mode & FALLOC_FL_KEEP_SIZE)) {
+                        /*
+                         * We didn't need to allocate any more space, but we
+                         * still extended the size of the file so we need to
+                         * update i_size.
+                         */
+                        inode->i_ctime = CURRENT_TIME;
+                        i_size_write(inode, actual_end);
+                        btrfs_ordered_update_i_size(inode, actual_end, NULL);
                 }
                 free_extent_map(em);
 
@@ -1804,10 +1820,14 @@ static loff_t btrfs_file_llseek(struct file *file, loff_t offset, int origin)
                 }
         }
 
-        if (offset < 0 && !(file->f_mode & FMODE_UNSIGNED_OFFSET))
-                return -EINVAL;
-        if (offset > inode->i_sb->s_maxbytes)
-                return -EINVAL;
+        if (offset < 0 && !(file->f_mode & FMODE_UNSIGNED_OFFSET)) {
+                ret = -EINVAL;
+                goto out;
+        }
+        if (offset > inode->i_sb->s_maxbytes) {
+                ret = -EINVAL;
+                goto out;
+        }
 
         /* Special lock needed here? */
         if (offset != file->f_pos) {
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 6377713f639c..6a265b9f85f2 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1168,9 +1168,9 @@ static void recalculate_thresholds(struct btrfs_free_space_ctl *ctl)
                 div64_u64(extent_bytes, (sizeof(struct btrfs_free_space)));
 }
 
-static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
-                              struct btrfs_free_space *info, u64 offset,
-                              u64 bytes)
+static inline void __bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+                                       struct btrfs_free_space *info,
+                                       u64 offset, u64 bytes)
 {
         unsigned long start, count;
 
@@ -1181,6 +1181,13 @@ static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
         bitmap_clear(info->bitmap, start, count);
 
         info->bytes -= bytes;
+}
+
+static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+                              struct btrfs_free_space *info, u64 offset,
+                              u64 bytes)
+{
+        __bitmap_clear_bits(ctl, info, offset, bytes);
         ctl->free_space -= bytes;
 }
 
@@ -1984,7 +1991,7 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
                 return 0;
 
         ret = search_start;
-        bitmap_clear_bits(ctl, entry, ret, bytes);
+        __bitmap_clear_bits(ctl, entry, ret, bytes);
 
         return ret;
 }
@@ -2039,7 +2046,6 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                                 continue;
                         }
                 } else {
-
                         ret = entry->offset;
 
                         entry->offset += bytes;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 15fceefbca0a..0ccc7438ad34 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7354,11 +7354,15 @@ static int btrfs_set_page_dirty(struct page *page)
 static int btrfs_permission(struct inode *inode, int mask)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
+        umode_t mode = inode->i_mode;
 
-        if (btrfs_root_readonly(root) && (mask & MAY_WRITE))
-                return -EROFS;
-        if ((BTRFS_I(inode)->flags & BTRFS_INODE_READONLY) && (mask & MAY_WRITE))
-                return -EACCES;
+        if (mask & MAY_WRITE &&
+            (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) {
+                if (btrfs_root_readonly(root))
+                        return -EROFS;
+                if (BTRFS_I(inode)->flags & BTRFS_INODE_READONLY)
+                        return -EACCES;
+        }
         return generic_permission(inode, mask);
 }
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 7cf013349941..970977aab224 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2236,6 +2236,10 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                 btrfs_wait_ordered_range(src, off, len);
         }
 
+        /* truncate page cache pages from target inode range */
+        truncate_inode_pages_range(&inode->i_data, off,
+                                   ALIGN(off + len, PAGE_CACHE_SIZE) - 1);
+
         /* clone data */
         key.objectid = btrfs_ino(src);
         key.type = BTRFS_EXTENT_DATA_KEY;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index babee65f8eda..786639fca067 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -799,14 +799,15 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
                                   struct extent_buffer *eb, int slot,
                                   struct btrfs_key *key)
 {
-        struct inode *dir;
-        int ret;
         struct btrfs_inode_ref *ref;
+        struct btrfs_dir_item *di;
+        struct inode *dir;
         struct inode *inode;
-        char *name;
-        int namelen;
         unsigned long ref_ptr;
         unsigned long ref_end;
+        char *name;
+        int namelen;
+        int ret;
         int search_done = 0;
 
         /*
@@ -909,6 +910,25 @@ again:
         }
         btrfs_release_path(path);
 
+        /* look for a conflicting sequence number */
+        di = btrfs_lookup_dir_index_item(trans, root, path, btrfs_ino(dir),
+                                         btrfs_inode_ref_index(eb, ref),
+                                         name, namelen, 0);
+        if (di && !IS_ERR(di)) {
+                ret = drop_one_dir_item(trans, root, path, dir, di);
+                BUG_ON(ret);
+        }
+        btrfs_release_path(path);
+
+        /* look for a conflicing name */
+        di = btrfs_lookup_dir_item(trans, root, path, btrfs_ino(dir),
+                                   name, namelen, 0);
+        if (di && !IS_ERR(di)) {
+                ret = drop_one_dir_item(trans, root, path, dir, di);
+                BUG_ON(ret);
+        }
+        btrfs_release_path(path);
+
 insert:
         /* insert our name */
         ret = btrfs_add_link(trans, dir, inode, name, namelen, 0,
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 53875ae73ad4..f2a4cc79da61 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -142,6 +142,7 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
         unsigned long limit;
         unsigned long last_waited = 0;
         int force_reg = 0;
+        int sync_pending = 0;
         struct blk_plug plug;
 
         /*
@@ -229,6 +230,22 @@ loop_lock:
 
                 BUG_ON(atomic_read(&cur->bi_cnt) == 0);
 
+                /*
+                 * if we're doing the sync list, record that our
+                 * plug has some sync requests on it
+                 *
+                 * If we're doing the regular list and there are
+                 * sync requests sitting around, unplug before
+                 * we add more
+                 */
+                if (pending_bios == &device->pending_sync_bios) {
+                        sync_pending = 1;
+                } else if (sync_pending) {
+                        blk_finish_plug(&plug);
+                        blk_start_plug(&plug);
+                        sync_pending = 0;
+                }
+
                 submit_bio(cur->bi_rw, cur);
                 num_run++;
                 batch_run++;
@@ -500,6 +517,9 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                         fs_devices->rw_devices--;
                 }
 
+                if (device->can_discard)
+                        fs_devices->num_can_discard--;
+
                 new_device = kmalloc(sizeof(*new_device), GFP_NOFS);
                 BUG_ON(!new_device);
                 memcpy(new_device, device, sizeof(*new_device));
@@ -508,6 +528,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                 new_device->bdev = NULL;
                 new_device->writeable = 0;
                 new_device->in_fs_metadata = 0;
+                new_device->can_discard = 0;
                 list_replace_rcu(&device->dev_list, &new_device->dev_list);
 
                 call_rcu(&device->rcu, free_device);
@@ -547,6 +568,7 @@ int btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
 static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                                 fmode_t flags, void *holder)
 {
+        struct request_queue *q;
         struct block_device *bdev;
         struct list_head *head = &fs_devices->devices;
         struct btrfs_device *device;
@@ -603,6 +625,12 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                         seeding = 0;
                 }
 
+                q = bdev_get_queue(bdev);
+                if (blk_queue_discard(q)) {
+                        device->can_discard = 1;
+                        fs_devices->num_can_discard++;
+                }
+
                 device->bdev = bdev;
                 device->in_fs_metadata = 0;
                 device->mode = flags;
@@ -835,6 +863,7 @@ int find_free_dev_extent(struct btrfs_trans_handle *trans,
 
         max_hole_start = search_start;
         max_hole_size = 0;
+        hole_size = 0;
 
         if (search_start >= search_end) {
                 ret = -ENOSPC;
@@ -917,7 +946,14 @@ next:
                 cond_resched();
         }
 
-        hole_size = search_end- search_start;
+        /*
+         * At this point, search_start should be the end of
+         * allocated dev extents, and when shrinking the device,
+         * search_end may be smaller than search_start.
+         */
+        if (search_end > search_start)
+                hole_size = search_end - search_start;
+
         if (hole_size > max_hole_size) {
                 max_hole_start = search_start;
                 max_hole_size = hole_size;
@@ -1543,6 +1579,7 @@ error:
 
 int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
 {
+        struct request_queue *q;
         struct btrfs_trans_handle *trans;
         struct btrfs_device *device;
         struct block_device *bdev;
@@ -1612,6 +1649,9 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
 
         lock_chunks(root);
 
+        q = bdev_get_queue(bdev);
+        if (blk_queue_discard(q))
+                device->can_discard = 1;
         device->writeable = 1;
         device->work.func = pending_bios_fn;
         generate_random_uuid(device->uuid);
@@ -1647,6 +1687,8 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         root->fs_info->fs_devices->num_devices++;
         root->fs_info->fs_devices->open_devices++;
         root->fs_info->fs_devices->rw_devices++;
+        if (device->can_discard)
+                root->fs_info->fs_devices->num_can_discard++;
         root->fs_info->fs_devices->total_rw_bytes += device->total_bytes;
 
         if (!blk_queue_nonrot(bdev_get_queue(bdev)))
@@ -2413,9 +2455,10 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                         total_avail = device->total_bytes - device->bytes_used;
                 else
                         total_avail = 0;
-                /* avail is off by max(alloc_start, 1MB), but that is the same
-                 * for all devices, so it doesn't hurt the sorting later on
-                 */
+
+                /* If there is no space on this device, skip it. */
+                if (total_avail == 0)
+                        continue;
 
                 ret = find_free_dev_extent(trans, device,
                                            max_stripe_size * dev_stripes,
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 7c12d61ae7ae..6d866db4e177 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -48,6 +48,7 @@ struct btrfs_device {
         int writeable;
         int in_fs_metadata;
         int missing;
+        int can_discard;
 
         spinlock_t io_lock;
 
@@ -104,6 +105,7 @@ struct btrfs_fs_devices {
         u64 rw_devices;
         u64 missing_devices;
         u64 total_rw_bytes;
+        u64 num_can_discard;
         struct block_device *latest_bdev;
 
         /* all of the devices in the FS, protected by a mutex
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 2fe3cf13b2e9..6d40656e1e29 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -176,7 +176,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
 
 #ifdef CONFIG_CIFS_STATS2
                         seq_printf(m, " In Send: %d In MaxReq Wait: %d",
-                                atomic_read(&server->inSend),
+                                atomic_read(&server->in_send),
                                 atomic_read(&server->num_waiters));
 #endif
 
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 21de1d6d5849..d0f59faefb78 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -991,24 +991,6 @@ struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
         return pntsd;
 }
 
-static int set_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, __u16 fid,
-                struct cifs_ntsd *pnntsd, u32 acllen)
-{
-        int xid, rc;
-        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
-
-        if (IS_ERR(tlink))
-                return PTR_ERR(tlink);
-
-        xid = GetXid();
-        rc = CIFSSMBSetCIFSACL(xid, tlink_tcon(tlink), fid, pnntsd, acllen);
-        FreeXid(xid);
-        cifs_put_tlink(tlink);
-
-        cFYI(DBG2, "SetCIFSACL rc = %d", rc);
-        return rc;
-}
-
 static int set_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, const char *path,
                 struct cifs_ntsd *pnntsd, u32 acllen)
 {
@@ -1047,18 +1029,10 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
                                 struct inode *inode, const char *path)
 {
         struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
-        struct cifsFileInfo *open_file;
-        int rc;
 
         cFYI(DBG2, "set ACL for %s from mode 0x%x", path, inode->i_mode);
 
-        open_file = find_readable_file(CIFS_I(inode), true);
-        if (!open_file)
-                return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
-
-        rc = set_cifs_acl_by_fid(cifs_sb, open_file->netfid, pnntsd, acllen);
-        cifsFileInfo_put(open_file);
-        return rc;
+        return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
 }
 
 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index cb71dc1f94d1..95da8027983d 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -125,5 +125,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "1.74"
+#define CIFS_VERSION   "1.75"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 38ce6d44b145..95dad9d14cf1 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -291,7 +291,7 @@ struct TCP_Server_Info {
         struct fscache_cookie   *fscache; /* client index cache cookie */
 #endif
 #ifdef CONFIG_CIFS_STATS2
-        atomic_t inSend; /* requests trying to send */
+        atomic_t in_send; /* requests trying to send */
         atomic_t num_waiters;   /* blocked waiting to get in sendrecv */
 #endif
 };
@@ -672,12 +672,54 @@ struct mid_q_entry {
         bool multiEnd:1;        /* both received */
 };
 
-struct oplock_q_entry {
-        struct list_head qhead;
-        struct inode *pinode;
-        struct cifs_tcon *tcon;
-        __u16 netfid;
-};
+/*      Make code in transport.c a little cleaner by moving
+        update of optional stats into function below */
+#ifdef CONFIG_CIFS_STATS2
+
+static inline void cifs_in_send_inc(struct TCP_Server_Info *server)
+{
+        atomic_inc(&server->in_send);
+}
+
+static inline void cifs_in_send_dec(struct TCP_Server_Info *server)
+{
+        atomic_dec(&server->in_send);
+}
+
+static inline void cifs_num_waiters_inc(struct TCP_Server_Info *server)
+{
+        atomic_inc(&server->num_waiters);
+}
+
+static inline void cifs_num_waiters_dec(struct TCP_Server_Info *server)
+{
+        atomic_dec(&server->num_waiters);
+}
+
+static inline void cifs_save_when_sent(struct mid_q_entry *mid)
+{
+        mid->when_sent = jiffies;
+}
+#else
+static inline void cifs_in_send_inc(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_in_send_dec(struct TCP_Server_Info *server)
+{
+}
+
+static inline void cifs_num_waiters_inc(struct TCP_Server_Info *server)
+{
+}
+
+static inline void cifs_num_waiters_dec(struct TCP_Server_Info *server)
+{
+}
+
+static inline void cifs_save_when_sent(struct mid_q_entry *mid)
+{
+}
+#endif
 
 /* for pending dnotify requests */
 struct dir_notify_req {
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 80c2e3add3a2..633c246b6775 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2878,7 +2878,8 @@ cleanup_volume_info_contents(struct smb_vol *volume_info)
         kfree(volume_info->username);
         kzfree(volume_info->password);
         kfree(volume_info->UNC);
-        kfree(volume_info->UNCip);
+        if (volume_info->UNCip != volume_info->UNC + 2)
+                kfree(volume_info->UNCip);
         kfree(volume_info->domainname);
         kfree(volume_info->iocharset);
         kfree(volume_info->prepath);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index ae576fbb5142..72d448bf96ce 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -105,8 +105,8 @@ cifs_bp_rename_retry:
         }
         rcu_read_unlock();
         if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
-                cERROR(1, "did not end path lookup where expected namelen is %d",
-                        namelen);
+                cFYI(1, "did not end path lookup where expected. namelen=%d "
+                        "dfsplen=%d", namelen, dfsplen);
                 /* presumably this is only possible if racing with a rename
                 of one of the parent directories  (we can not lock the dentries
                 above us to prevent this, but retrying should be harmless) */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index c1b9c4b10739..10ca6b2c26b7 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -266,15 +266,11 @@ static int wait_for_free_request(struct TCP_Server_Info *server,
         while (1) {
                 if (atomic_read(&server->inFlight) >= cifs_max_pending) {
                         spin_unlock(&GlobalMid_Lock);
-#ifdef CONFIG_CIFS_STATS2
-                        atomic_inc(&server->num_waiters);
-#endif
+                        cifs_num_waiters_inc(server);
                         wait_event(server->request_q,
                                    atomic_read(&server->inFlight)
                                      < cifs_max_pending);
-#ifdef CONFIG_CIFS_STATS2
-                        atomic_dec(&server->num_waiters);
-#endif
+                        cifs_num_waiters_dec(server);
                         spin_lock(&GlobalMid_Lock);
                 } else {
                         if (server->tcpStatus == CifsExiting) {
@@ -381,15 +377,13 @@ cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
         mid->callback = callback;
         mid->callback_data = cbdata;
         mid->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
-        atomic_inc(&server->inSend);
-#endif
+
+        cifs_in_send_inc(server);
         rc = smb_sendv(server, iov, nvec);
-#ifdef CONFIG_CIFS_STATS2
-        atomic_dec(&server->inSend);
-        mid->when_sent = jiffies;
-#endif
+        cifs_in_send_dec(server);
+        cifs_save_when_sent(mid);
         mutex_unlock(&server->srv_mutex);
+
         if (rc)
                 goto out_err;
 
@@ -575,14 +569,10 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
         }
 
         midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
-        atomic_inc(&ses->server->inSend);
-#endif
+        cifs_in_send_inc(ses->server);
         rc = smb_sendv(ses->server, iov, n_vec);
-#ifdef CONFIG_CIFS_STATS2
-        atomic_dec(&ses->server->inSend);
-        midQ->when_sent = jiffies;
-#endif
+        cifs_in_send_dec(ses->server);
+        cifs_save_when_sent(midQ);
 
         mutex_unlock(&ses->server->srv_mutex);
 
@@ -703,14 +693,11 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
         }
 
         midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
-        atomic_inc(&ses->server->inSend);
-#endif
+
+        cifs_in_send_inc(ses->server);
         rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
-#ifdef CONFIG_CIFS_STATS2
-        atomic_dec(&ses->server->inSend);
-        midQ->when_sent = jiffies;
-#endif
+        cifs_in_send_dec(ses->server);
+        cifs_save_when_sent(midQ);
         mutex_unlock(&ses->server->srv_mutex);
 
         if (rc < 0)
@@ -843,14 +830,10 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
         }
 
         midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
-        atomic_inc(&ses->server->inSend);
-#endif
+        cifs_in_send_inc(ses->server);
         rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
-#ifdef CONFIG_CIFS_STATS2
-        atomic_dec(&ses->server->inSend);
-        midQ->when_sent = jiffies;
-#endif
+        cifs_in_send_dec(ses->server);
+        cifs_save_when_sent(midQ);
         mutex_unlock(&ses->server->srv_mutex);
 
         if (rc < 0) {
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 8be086e9abe4..51352de88ef1 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1003,6 +1003,7 @@ COMPATIBLE_IOCTL(PPPIOCCONNECT)
 COMPATIBLE_IOCTL(PPPIOCDISCONN)
 COMPATIBLE_IOCTL(PPPIOCATTCHAN)
 COMPATIBLE_IOCTL(PPPIOCGCHAN)
+COMPATIBLE_IOCTL(PPPIOCGL2TPSTATS)
 /* PPPOX */
 COMPATIBLE_IOCTL(PPPOEIOCSFWD)
 COMPATIBLE_IOCTL(PPPOEIOCDFWD)
diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
index 1cd6d9d3e29a..cc16562654de 100644
--- a/fs/ecryptfs/Kconfig
+++ b/fs/ecryptfs/Kconfig
@@ -1,6 +1,6 @@
 config ECRYPT_FS
         tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && KEYS && CRYPTO
+        depends on EXPERIMENTAL && KEYS && CRYPTO && (ENCRYPTED_KEYS || ENCRYPTED_KEYS=n)
         select CRYPTO_ECB
         select CRYPTO_CBC
         select CRYPTO_MD5
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 08a2b52bf565..ac1ad48c2376 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1973,7 +1973,7 @@ pki_encrypt_session_key(struct key *auth_tok_key,
 {
         struct ecryptfs_msg_ctx *msg_ctx = NULL;
         char *payload = NULL;
-        size_t payload_len;
+        size_t payload_len = 0;
         struct ecryptfs_message *msg;
         int rc;
 
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 9f1bb747d77d..b4a6befb1216 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -175,6 +175,7 @@ enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,
        ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
        ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
        ecryptfs_opt_unlink_sigs, ecryptfs_opt_mount_auth_tok_only,
+       ecryptfs_opt_check_dev_ruid,
        ecryptfs_opt_err };
 
 static const match_table_t tokens = {
@@ -191,6 +192,7 @@ static const match_table_t tokens = {
         {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
         {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},
         {ecryptfs_opt_mount_auth_tok_only, "ecryptfs_mount_auth_tok_only"},
+        {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},
         {ecryptfs_opt_err, NULL}
 };
 
@@ -236,6 +238,7 @@ static void ecryptfs_init_mount_crypt_stat(
  * ecryptfs_parse_options
  * @sb: The ecryptfs super block
  * @options: The options passed to the kernel
+ * @check_ruid: set to 1 if device uid should be checked against the ruid
  *
  * Parse mount options:
  * debug=N         - ecryptfs_verbosity level for debug output
@@ -251,7 +254,8 @@ static void ecryptfs_init_mount_crypt_stat(
  *
  * Returns zero on success; non-zero on error
  */
-static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
+static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
+                                  uid_t *check_ruid)
 {
         char *p;
         int rc = 0;
@@ -276,6 +280,8 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
         char *cipher_key_bytes_src;
         char *fn_cipher_key_bytes_src;
 
+        *check_ruid = 0;
+
         if (!options) {
                 rc = -EINVAL;
                 goto out;
@@ -380,6 +386,9 @@ static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options)
                         mount_crypt_stat->flags |=
                                 ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY;
                         break;
+                case ecryptfs_opt_check_dev_ruid:
+                        *check_ruid = 1;
+                        break;
                 case ecryptfs_opt_err:
                 default:
                         printk(KERN_WARNING
@@ -475,6 +484,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
         const char *err = "Getting sb failed";
         struct inode *inode;
         struct path path;
+        uid_t check_ruid;
         int rc;
 
         sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);
@@ -483,7 +493,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
                 goto out;
         }
 
-        rc = ecryptfs_parse_options(sbi, raw_data);
+        rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
         if (rc) {
                 err = "Error parsing options";
                 goto out;
@@ -521,6 +531,15 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
                         "known incompatibilities\n");
                 goto out_free;
         }
+
+        if (check_ruid && path.dentry->d_inode->i_uid != current_uid()) {
+                rc = -EPERM;
+                printk(KERN_ERR "Mount of device (uid: %d) not owned by "
+                       "requested user (uid: %d)\n",
+                       path.dentry->d_inode->i_uid, current_uid());
+                goto out_free;
+        }
+
         ecryptfs_set_superblock_lower(s, path.dentry->d_sb);
         s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
         s->s_blocksize = path.dentry->d_sb->s_blocksize;
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index 85d430963116..3745f7c2b9c2 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -39,15 +39,16 @@
 int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
                          loff_t offset, size_t size)
 {
-        struct ecryptfs_inode_info *inode_info;
+        struct file *lower_file;
         mm_segment_t fs_save;
         ssize_t rc;
 
-        inode_info = ecryptfs_inode_to_private(ecryptfs_inode);
-        BUG_ON(!inode_info->lower_file);
+        lower_file = ecryptfs_inode_to_private(ecryptfs_inode)->lower_file;
+        if (!lower_file)
+                return -EIO;
         fs_save = get_fs();
         set_fs(get_ds());
-        rc = vfs_write(inode_info->lower_file, data, size, &offset);
+        rc = vfs_write(lower_file, data, size, &offset);
         set_fs(fs_save);
         mark_inode_dirty_sync(ecryptfs_inode);
         return rc;
@@ -225,15 +226,16 @@ out:
 int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
                         struct inode *ecryptfs_inode)
 {
-        struct ecryptfs_inode_info *inode_info =
-                ecryptfs_inode_to_private(ecryptfs_inode);
+        struct file *lower_file;
         mm_segment_t fs_save;
         ssize_t rc;
 
-        BUG_ON(!inode_info->lower_file);
+        lower_file = ecryptfs_inode_to_private(ecryptfs_inode)->lower_file;
+        if (!lower_file)
+                return -EIO;
         fs_save = get_fs();
         set_fs(get_ds());
-        rc = vfs_read(inode_info->lower_file, data, size, &offset);
+        rc = vfs_read(lower_file, data, size, &offset);
         set_fs(fs_save);
         return rc;
 }
diff --git a/fs/exec.c b/fs/exec.c
index da80612a35f4..25dcbe5fc356 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1459,6 +1459,23 @@ static int do_execve_common(const char *filename,
         struct files_struct *displaced;
         bool clear_in_exec;
         int retval;
+        const struct cred *cred = current_cred();
+
+        /*
+         * We move the actual failure in case of RLIMIT_NPROC excess from
+         * set*uid() to execve() because too many poorly written programs
+         * don't check setuid() return code.  Here we additionally recheck
+         * whether NPROC limit is still exceeded.
+         */
+        if ((current->flags & PF_NPROC_EXCEEDED) &&
+            atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) {
+                retval = -EAGAIN;
+                goto out_ret;
+        }
+
+        /* We're below the limit (still or again), so we don't want to make
+         * further execve() calls fail. */
+        current->flags &= ~PF_NPROC_EXCEEDED;
 
         retval = unshare_files(&displaced);
         if (retval)
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 6e18a0b7750d..5571708b6a58 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -2209,9 +2209,11 @@ static int ext3_symlink (struct inode * dir,
                 /*
                  * For non-fast symlinks, we just allocate inode and put it on
                  * orphan list in the first transaction => we need bitmap,
-                 * group descriptor, sb, inode block, quota blocks.
+                 * group descriptor, sb, inode block, quota blocks, and
+                 * possibly selinux xattr blocks.
                  */
-                credits = 4 + EXT3_MAXQUOTAS_INIT_BLOCKS(dir->i_sb);
+                credits = 4 + EXT3_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) +
+                          EXT3_XATTR_TRANS_BLOCKS;
         } else {
                 /*
                  * Fast symlink. We have to add entry to directory
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 565a154e22d4..f8068c7bae9f 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -2253,9 +2253,11 @@ static int ext4_symlink(struct inode *dir,
                 /*
                  * For non-fast symlinks, we just allocate inode and put it on
                  * orphan list in the first transaction => we need bitmap,
-                 * group descriptor, sb, inode block, quota blocks.
+                 * group descriptor, sb, inode block, quota blocks, and
+                 * possibly selinux xattr blocks.
                  */
-                credits = 4 + EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb);
+                credits = 4 + EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) +
+                          EXT4_XATTR_TRANS_BLOCKS;
         } else {
                 /*
                  * Fast symlink. We have to add entry to directory
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 4ad64732cbce..5efbd5d7701a 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -1231,7 +1231,7 @@ int fat_add_entries(struct inode *dir, void *slots, int nr_slots,
         struct super_block *sb = dir->i_sb;
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
         struct buffer_head *bh, *prev, *bhs[3]; /* 32*slots (672bytes) */
-        struct msdos_dir_entry *de;
+        struct msdos_dir_entry *uninitialized_var(de);
         int err, free_slots, i, nr_bhs;
         loff_t pos, i_pos;
 
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 5942fec22c65..1726d7303047 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1188,9 +1188,9 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
 out:
         /* UTF-8 doesn't provide FAT semantics */
         if (!strcmp(opts->iocharset, "utf8")) {
-                fat_msg(sb, KERN_ERR, "utf8 is not a recommended IO charset"
+                fat_msg(sb, KERN_WARNING, "utf8 is not a recommended IO charset"
                        " for FAT filesystems, filesystem will be "
-                       "case sensitive!\n");
+                       "case sensitive!");
         }
 
         /* If user doesn't specify allow_utime, it's initialized from dmask. */
@@ -1367,6 +1367,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
         sbi->free_clusters = -1;        /* Don't know yet */
         sbi->free_clus_valid = 0;
         sbi->prev_free = FAT_START_ENT;
+        sb->s_maxbytes = 0xffffffff;
 
         if (!sbi->fat_length && b->fat32_length) {
                 struct fat_boot_fsinfo *fsinfo;
@@ -1377,8 +1378,6 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
                 sbi->fat_length = le32_to_cpu(b->fat32_length);
                 sbi->root_cluster = le32_to_cpu(b->root_cluster);
 
-                sb->s_maxbytes = 0xffffffff;
-
                 /* MC - if info_sector is 0, don't multiply by 0 */
                 sbi->fsinfo_sector = le16_to_cpu(b->info_sector);
                 if (sbi->fsinfo_sector == 0)
diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index adcf92d3b603..7971f37534a3 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -68,7 +68,7 @@ int jfs_umount(struct super_block *sb)
                 /*
                  * Wait for outstanding transactions to be written to log:
                  */
-                jfs_flush_journal(log, 1);
+                jfs_flush_journal(log, 2);
 
         /*
          * close fileset inode allocation map (aka fileset inode)
@@ -146,7 +146,7 @@ int jfs_umount_rw(struct super_block *sb)
          *
          * remove file system from log active file system list.
          */
-        jfs_flush_journal(log, 1);
+        jfs_flush_journal(log, 2);
 
         /*
          * Make sure all metadata makes it to disk
diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index be020771c6b4..dbcd82126aed 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -79,12 +79,9 @@ config NFS_V4_1
         depends on NFS_FS && NFS_V4 && EXPERIMENTAL
         select SUNRPC_BACKCHANNEL
         select PNFS_FILE_LAYOUT
-        select PNFS_BLOCK
-        select MD
-        select BLK_DEV_DM
         help
           This option enables support for minor version 1 of the NFSv4 protocol
-          (RFC 5661 and RFC 5663) in the kernel's NFS client.
+          (RFC 5661) in the kernel's NFS client.
 
           If unsure, say N.
 
@@ -93,16 +90,13 @@ config PNFS_FILE_LAYOUT
 
 config PNFS_BLOCK
         tristate
+        depends on NFS_FS && NFS_V4_1 && BLK_DEV_DM
+        default m
 
 config PNFS_OBJLAYOUT
-        tristate "Provide support for the pNFS Objects Layout Driver for NFSv4.1 pNFS (EXPERIMENTAL)"
+        tristate
         depends on NFS_FS && NFS_V4_1 && SCSI_OSD_ULD
-        help
-          Say M here if you want your pNFS client to support the Objects Layout Driver.
-          Requires the SCSI osd initiator library (SCSI_OSD_INITIATOR) and
-          upper level driver (SCSI_OSD_ULD).
-
-          If unsure, say N.
+        default m
 
 config ROOT_NFS
         bool "Root file system on NFS"
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index e56564d2ef95..9561c8fc8bdb 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -36,6 +36,7 @@
 #include <linux/namei.h>
 #include <linux/bio.h>          /* struct bio */
 #include <linux/buffer_head.h>  /* various write calls */
+#include <linux/prefetch.h>
 
 #include "blocklayout.h"
 
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index b257383bb565..07df5f1d85e5 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -38,6 +38,7 @@ enum nfs4_callback_opnum {
 struct cb_process_state {
         __be32                  drc_status;
         struct nfs_client       *clp;
+        int                     slotid;
 };
 
 struct cb_compound_hdr_arg {
@@ -166,7 +167,6 @@ extern unsigned nfs4_callback_layoutrecall(
         void *dummy, struct cb_process_state *cps);
 
 extern void nfs4_check_drain_bc_complete(struct nfs4_session *ses);
-extern void nfs4_cb_take_slot(struct nfs_client *clp);
 
 struct cb_devicenotifyitem {
         uint32_t                cbd_notify_type;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 74780f9f852c..43926add945b 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -348,7 +348,7 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
         /* Normal */
         if (likely(args->csa_sequenceid == slot->seq_nr + 1)) {
                 slot->seq_nr++;
-                return htonl(NFS4_OK);
+                goto out_ok;
         }
 
         /* Replay */
@@ -367,11 +367,14 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
         /* Wraparound */
         if (args->csa_sequenceid == 1 && (slot->seq_nr + 1) == 0) {
                 slot->seq_nr = 1;
-                return htonl(NFS4_OK);
+                goto out_ok;
         }
 
         /* Misordered request */
         return htonl(NFS4ERR_SEQ_MISORDERED);
+out_ok:
+        tbl->highest_used_slotid = args->csa_slotid;
+        return htonl(NFS4_OK);
 }
 
 /*
@@ -433,26 +436,37 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                               struct cb_sequenceres *res,
                               struct cb_process_state *cps)
 {
+        struct nfs4_slot_table *tbl;
         struct nfs_client *clp;
         int i;
         __be32 status = htonl(NFS4ERR_BADSESSION);
 
-        cps->clp = NULL;
-
         clp = nfs4_find_client_sessionid(args->csa_addr, &args->csa_sessionid);
         if (clp == NULL)
                 goto out;
 
+        tbl = &clp->cl_session->bc_slot_table;
+
+        spin_lock(&tbl->slot_tbl_lock);
         /* state manager is resetting the session */
         if (test_bit(NFS4_SESSION_DRAINING, &clp->cl_session->session_state)) {
-                status = NFS4ERR_DELAY;
+                spin_unlock(&tbl->slot_tbl_lock);
+                status = htonl(NFS4ERR_DELAY);
+                /* Return NFS4ERR_BADSESSION if we're draining the session
+                 * in order to reset it.
+                 */
+                if (test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state))
+                        status = htonl(NFS4ERR_BADSESSION);
                 goto out;
         }
 
         status = validate_seqid(&clp->cl_session->bc_slot_table, args);
+        spin_unlock(&tbl->slot_tbl_lock);
         if (status)
                 goto out;
 
+        cps->slotid = args->csa_slotid;
+
         /*
          * Check for pending referring calls.  If a match is found, a
          * related callback was received before the response to the original
@@ -469,7 +483,6 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
         res->csr_slotid = args->csa_slotid;
         res->csr_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
         res->csr_target_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
-        nfs4_cb_take_slot(clp);
 
 out:
         cps->clp = clp; /* put in nfs4_callback_compound */
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index c6c86a77e043..918ad647afea 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -754,26 +754,15 @@ static void nfs4_callback_free_slot(struct nfs4_session *session)
          * Let the state manager know callback processing done.
          * A single slot, so highest used slotid is either 0 or -1
          */
-        tbl->highest_used_slotid--;
+        tbl->highest_used_slotid = -1;
         nfs4_check_drain_bc_complete(session);
         spin_unlock(&tbl->slot_tbl_lock);
 }
 
-static void nfs4_cb_free_slot(struct nfs_client *clp)
+static void nfs4_cb_free_slot(struct cb_process_state *cps)
 {
-        if (clp && clp->cl_session)
-                nfs4_callback_free_slot(clp->cl_session);
-}
-
-/* A single slot, so highest used slotid is either 0 or -1 */
-void nfs4_cb_take_slot(struct nfs_client *clp)
-{
-        struct nfs4_slot_table *tbl = &clp->cl_session->bc_slot_table;
-
-        spin_lock(&tbl->slot_tbl_lock);
-        tbl->highest_used_slotid++;
-        BUG_ON(tbl->highest_used_slotid != 0);
-        spin_unlock(&tbl->slot_tbl_lock);
+        if (cps->slotid != -1)
+                nfs4_callback_free_slot(cps->clp->cl_session);
 }
 
 #else /* CONFIG_NFS_V4_1 */
@@ -784,7 +773,7 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
         return htonl(NFS4ERR_MINOR_VERS_MISMATCH);
 }
 
-static void nfs4_cb_free_slot(struct nfs_client *clp)
+static void nfs4_cb_free_slot(struct cb_process_state *cps)
 {
 }
 #endif /* CONFIG_NFS_V4_1 */
@@ -866,6 +855,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
         struct cb_process_state cps = {
                 .drc_status = 0,
                 .clp = NULL,
+                .slotid = -1,
         };
         unsigned int nops = 0;
 
@@ -906,7 +896,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
 
         *hdr_res.status = status;
         *hdr_res.nops = htonl(nops);
-        nfs4_cb_free_slot(cps.clp);
+        nfs4_cb_free_slot(&cps);
         nfs_put_client(cps.clp);
         dprintk("%s: done, status = %u\n", __func__, ntohl(status));
         return rpc_success;
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index 9383ca7245bc..d0cda12fddc3 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -479,7 +479,6 @@ static int _io_check(struct objio_state *ios, bool is_write)
         for (i = 0; i <  ios->numdevs; i++) {
                 struct osd_sense_info osi;
                 struct osd_request *or = ios->per_dev[i].or;
-                unsigned dev;
                 int ret;
 
                 if (!or)
@@ -500,9 +499,8 @@ static int _io_check(struct objio_state *ios, bool is_write)
 
                         continue; /* we recovered */
                 }
-                dev = ios->per_dev[i].dev;
-                objlayout_io_set_result(&ios->ol_state, dev,
-                                        &ios->layout->comps[dev].oc_object_id,
+                objlayout_io_set_result(&ios->ol_state, i,
+                                        &ios->layout->comps[i].oc_object_id,
                                         osd_pri_2_pnfs_err(osi.osd_err_pri),
                                         ios->per_dev[i].offset,
                                         ios->per_dev[i].length,
@@ -589,22 +587,19 @@ static void _calc_stripe_info(struct objio_state *ios, u64 file_offset,
 }
 
 static int _add_stripe_unit(struct objio_state *ios,  unsigned *cur_pg,
-                unsigned pgbase, struct _objio_per_comp *per_dev, int cur_len,
+                unsigned pgbase, struct _objio_per_comp *per_dev, int len,
                 gfp_t gfp_flags)
 {
         unsigned pg = *cur_pg;
+        int cur_len = len;
         struct request_queue *q =
                         osd_request_queue(_io_od(ios, per_dev->dev));
 
-        per_dev->length += cur_len;
-
         if (per_dev->bio == NULL) {
-                unsigned stripes = ios->layout->num_comps /
-                                                     ios->layout->mirrors_p1;
-                unsigned pages_in_stripe = stripes *
+                unsigned pages_in_stripe = ios->layout->group_width *
                                       (ios->layout->stripe_unit / PAGE_SIZE);
                 unsigned bio_size = (ios->ol_state.nr_pages + pages_in_stripe) /
-                                    stripes;
+                                    ios->layout->group_width;
 
                 if (BIO_MAX_PAGES_KMALLOC < bio_size)
                         bio_size = BIO_MAX_PAGES_KMALLOC;
@@ -632,6 +627,7 @@ static int _add_stripe_unit(struct objio_state *ios,  unsigned *cur_pg,
         }
         BUG_ON(cur_len);
 
+        per_dev->length += len;
         *cur_pg = pg;
         return 0;
 }
@@ -650,7 +646,7 @@ static int _prepare_one_group(struct objio_state *ios, u64 length,
         int ret = 0;
 
         while (length) {
-                struct _objio_per_comp *per_dev = &ios->per_dev[dev];
+                struct _objio_per_comp *per_dev = &ios->per_dev[dev - first_dev];
                 unsigned cur_len, page_off = 0;
 
                 if (!per_dev->length) {
@@ -670,8 +666,8 @@ static int _prepare_one_group(struct objio_state *ios, u64 length,
                                 cur_len = stripe_unit;
                         }
 
-                        if (max_comp < dev)
-                                max_comp = dev;
+                        if (max_comp < dev - first_dev)
+                                max_comp = dev - first_dev;
                 } else {
                         cur_len = stripe_unit;
                 }
@@ -806,7 +802,7 @@ static int _read_mirrors(struct objio_state *ios, unsigned cur_comp)
         struct _objio_per_comp *per_dev = &ios->per_dev[cur_comp];
         unsigned dev = per_dev->dev;
         struct pnfs_osd_object_cred *cred =
-                        &ios->layout->comps[dev];
+                        &ios->layout->comps[cur_comp];
         struct osd_obj_id obj = {
                 .partition = cred->oc_object_id.oid_partition_id,
                 .id = cred->oc_object_id.oid_object_id,
@@ -904,7 +900,7 @@ static int _write_mirrors(struct objio_state *ios, unsigned cur_comp)
         for (; cur_comp < last_comp; ++cur_comp, ++dev) {
                 struct osd_request *or = NULL;
                 struct pnfs_osd_object_cred *cred =
-                                        &ios->layout->comps[dev];
+                                        &ios->layout->comps[cur_comp];
                 struct osd_obj_id obj = {
                         .partition = cred->oc_object_id.oid_partition_id,
                         .id = cred->oc_object_id.oid_object_id,
diff --git a/fs/nfs/objlayout/pnfs_osd_xdr_cli.c b/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
index 16fc758e9123..b3918f7ac34d 100644
--- a/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
+++ b/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
@@ -170,6 +170,9 @@ int pnfs_osd_xdr_decode_layout_map(struct pnfs_osd_layout *layout,
         p = _osd_xdr_decode_data_map(p, &layout->olo_map);
         layout->olo_comps_index = be32_to_cpup(p++);
         layout->olo_num_comps = be32_to_cpup(p++);
+        dprintk("%s: olo_comps_index=%d olo_num_comps=%d\n", __func__,
+                layout->olo_comps_index, layout->olo_num_comps);
+
         iter->total_comps = layout->olo_num_comps;
         return 0;
 }
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index d1fe74506c4c..c57836dc778f 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -596,7 +596,7 @@ _xfs_buf_read(
         bp->b_flags |= flags & (XBF_READ | XBF_ASYNC | XBF_READ_AHEAD);
 
         status = xfs_buf_iorequest(bp);
-        if (status || XFS_BUF_ISERROR(bp) || (flags & XBF_ASYNC))
+        if (status || bp->b_error || (flags & XBF_ASYNC))
                 return status;
         return xfs_buf_iowait(bp);
 }
@@ -679,7 +679,6 @@ xfs_buf_read_uncached(
         /* set up the buffer for a read IO */
         XFS_BUF_SET_ADDR(bp, daddr);
         XFS_BUF_READ(bp);
-        XFS_BUF_BUSY(bp);
 
         xfsbdstrat(mp, bp);
         error = xfs_buf_iowait(bp);
@@ -1069,7 +1068,7 @@ xfs_bioerror(
         /*
          * No need to wait until the buffer is unpinned, we aren't flushing it.
          */
-        XFS_BUF_ERROR(bp, EIO);
+        xfs_buf_ioerror(bp, EIO);
 
         /*
          * We're calling xfs_buf_ioend, so delete XBF_DONE flag.
@@ -1094,7 +1093,7 @@ STATIC int
 xfs_bioerror_relse(
         struct xfs_buf  *bp)
 {
-        int64_t         fl = XFS_BUF_BFLAGS(bp);
+        int64_t         fl = bp->b_flags;
         /*
          * No need to wait until the buffer is unpinned.
          * We aren't flushing it.
@@ -1115,7 +1114,7 @@ xfs_bioerror_relse(
                  * There's no reason to mark error for
                  * ASYNC buffers.
                  */
-                XFS_BUF_ERROR(bp, EIO);
+                xfs_buf_ioerror(bp, EIO);
                 XFS_BUF_FINISH_IOWAIT(bp);
         } else {
                 xfs_buf_relse(bp);
@@ -1324,7 +1323,7 @@ xfs_buf_offset(
         struct page             *page;
 
         if (bp->b_flags & XBF_MAPPED)
-                return XFS_BUF_PTR(bp) + offset;
+                return bp->b_addr + offset;
 
         offset += bp->b_offset;
         page = bp->b_pages[offset >> PAGE_SHIFT];
@@ -1484,7 +1483,7 @@ xfs_setsize_buftarg_flags(
         if (set_blocksize(btp->bt_bdev, sectorsize)) {
                 xfs_warn(btp->bt_mount,
                         "Cannot set_blocksize to %u on device %s\n",
-                        sectorsize, XFS_BUFTARG_NAME(btp));
+                        sectorsize, xfs_buf_target_name(btp));
                 return EINVAL;
         }
 
@@ -1681,7 +1680,7 @@ xfs_buf_delwri_split(
         list_for_each_entry_safe(bp, n, dwq, b_list) {
                 ASSERT(bp->b_flags & XBF_DELWRI);
 
-                if (!XFS_BUF_ISPINNED(bp) && xfs_buf_trylock(bp)) {
+                if (!xfs_buf_ispinned(bp) && xfs_buf_trylock(bp)) {
                         if (!force &&
                             time_before(jiffies, bp->b_queuetime + age)) {
                                 xfs_buf_unlock(bp);
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 6a83b46b4bcf..620972b8094d 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -228,11 +228,15 @@ extern void xfs_buf_delwri_promote(xfs_buf_t *);
 extern int xfs_buf_init(void);
 extern void xfs_buf_terminate(void);
 
-#define xfs_buf_target_name(target)     \
-        ({ char __b[BDEVNAME_SIZE]; bdevname((target)->bt_bdev, __b); __b; })
+static inline const char *
+xfs_buf_target_name(struct xfs_buftarg *target)
+{
+        static char __b[BDEVNAME_SIZE];
+
+        return bdevname(target->bt_bdev, __b);
+}
 
 
-#define XFS_BUF_BFLAGS(bp)      ((bp)->b_flags)
 #define XFS_BUF_ZEROFLAGS(bp) \
         ((bp)->b_flags &= ~(XBF_READ|XBF_WRITE|XBF_ASYNC|XBF_DELWRI| \
                             XBF_SYNCIO|XBF_FUA|XBF_FLUSH))
@@ -251,23 +255,14 @@ void xfs_buf_stale(struct xfs_buf *bp);
 #define XFS_BUF_UNDELAYWRITE(bp)        xfs_buf_delwri_dequeue(bp)
 #define XFS_BUF_ISDELAYWRITE(bp)        ((bp)->b_flags & XBF_DELWRI)
 
-#define XFS_BUF_ERROR(bp,no)    xfs_buf_ioerror(bp,no)
-#define XFS_BUF_GETERROR(bp)    xfs_buf_geterror(bp)
-#define XFS_BUF_ISERROR(bp)     (xfs_buf_geterror(bp) ? 1 : 0)
-
 #define XFS_BUF_DONE(bp)        ((bp)->b_flags |= XBF_DONE)
 #define XFS_BUF_UNDONE(bp)      ((bp)->b_flags &= ~XBF_DONE)
 #define XFS_BUF_ISDONE(bp)      ((bp)->b_flags & XBF_DONE)
 
-#define XFS_BUF_BUSY(bp)        do { } while (0)
-#define XFS_BUF_UNBUSY(bp)      do { } while (0)
-#define XFS_BUF_ISBUSY(bp)      (1)
-
 #define XFS_BUF_ASYNC(bp)       ((bp)->b_flags |= XBF_ASYNC)
 #define XFS_BUF_UNASYNC(bp)     ((bp)->b_flags &= ~XBF_ASYNC)
 #define XFS_BUF_ISASYNC(bp)     ((bp)->b_flags & XBF_ASYNC)
 
-#define XFS_BUF_HOLD(bp)        xfs_buf_hold(bp)
 #define XFS_BUF_READ(bp)        ((bp)->b_flags |= XBF_READ)
 #define XFS_BUF_UNREAD(bp)      ((bp)->b_flags &= ~XBF_READ)
 #define XFS_BUF_ISREAD(bp)      ((bp)->b_flags & XBF_READ)
@@ -276,10 +271,6 @@ void xfs_buf_stale(struct xfs_buf *bp);
 #define XFS_BUF_UNWRITE(bp)     ((bp)->b_flags &= ~XBF_WRITE)
 #define XFS_BUF_ISWRITE(bp)     ((bp)->b_flags & XBF_WRITE)
 
-#define XFS_BUF_SET_START(bp)                   do { } while (0)
-
-#define XFS_BUF_PTR(bp)                 (xfs_caddr_t)((bp)->b_addr)
-#define XFS_BUF_SET_PTR(bp, val, cnt)   xfs_buf_associate_memory(bp, val, cnt)
 #define XFS_BUF_ADDR(bp)                ((bp)->b_bn)
 #define XFS_BUF_SET_ADDR(bp, bno)       ((bp)->b_bn = (xfs_daddr_t)(bno))
 #define XFS_BUF_OFFSET(bp)              ((bp)->b_file_offset)
@@ -299,14 +290,13 @@ xfs_buf_set_ref(
 #define XFS_BUF_SET_VTYPE_REF(bp, type, ref)    xfs_buf_set_ref(bp, ref)
 #define XFS_BUF_SET_VTYPE(bp, type)             do { } while (0)
 
-#define XFS_BUF_ISPINNED(bp)    atomic_read(&((bp)->b_pin_count))
+static inline int xfs_buf_ispinned(struct xfs_buf *bp)
+{
+        return atomic_read(&bp->b_pin_count);
+}
 
 #define XFS_BUF_FINISH_IOWAIT(bp)       complete(&bp->b_iowait);
 
-#define XFS_BUF_SET_TARGET(bp, target)  ((bp)->b_target = (target))
-#define XFS_BUF_TARGET(bp)              ((bp)->b_target)
-#define XFS_BUFTARG_NAME(target)        xfs_buf_target_name(target)
-
 static inline void xfs_buf_relse(xfs_buf_t *bp)
 {
         xfs_buf_unlock(bp);
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index e4c938afb910..4604f90f86a3 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -332,7 +332,7 @@ xfs_sync_fsdata(
          * between there and here.
          */
         bp = xfs_getsb(mp, 0);
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                 xfs_log_force(mp, 0);
 
         return xfs_bwrite(mp, bp);
diff --git a/fs/xfs/quota/xfs_dquot.c b/fs/xfs/quota/xfs_dquot.c
index 837f31158d43..db62959bed13 100644
--- a/fs/xfs/quota/xfs_dquot.c
+++ b/fs/xfs/quota/xfs_dquot.c
@@ -318,10 +318,9 @@ xfs_qm_init_dquot_blk(
         int             curid, i;
 
         ASSERT(tp);
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
 
-        d = (xfs_dqblk_t *)XFS_BUF_PTR(bp);
+        d = bp->b_addr;
 
         /*
          * ID of the first dquot in the block - id's are zero based.
@@ -403,7 +402,7 @@ xfs_qm_dqalloc(
                                dqp->q_blkno,
                                mp->m_quotainfo->qi_dqchunklen,
                                0);
-        if (!bp || (error = XFS_BUF_GETERROR(bp)))
+        if (!bp || (error = xfs_buf_geterror(bp)))
                 goto error1;
         /*
          * Make a chunk of dquots out of this buffer and log
@@ -534,13 +533,12 @@ xfs_qm_dqtobp(
                         return XFS_ERROR(error);
         }
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
 
         /*
          * calculate the location of the dquot inside the buffer.
          */
-        ddq = (struct xfs_disk_dquot *)(XFS_BUF_PTR(bp) + dqp->q_bufoffset);
+        ddq = bp->b_addr + dqp->q_bufoffset;
 
         /*
          * A simple sanity check in case we got a corrupted dquot...
@@ -553,7 +551,6 @@ xfs_qm_dqtobp(
                         xfs_trans_brelse(tp, bp);
                         return XFS_ERROR(EIO);
                 }
-                XFS_BUF_BUSY(bp); /* We dirtied this */
         }
 
         *O_bpp = bp;
@@ -622,7 +619,6 @@ xfs_qm_dqread(
          * this particular dquot was repaired. We still aren't afraid to
          * brelse it because we have the changes incore.
          */
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
         xfs_trans_brelse(tp, bp);
 
@@ -1204,7 +1200,7 @@ xfs_qm_dqflush(
         /*
          * Calculate the location of the dquot inside the buffer.
          */
-        ddqp = (struct xfs_disk_dquot *)(XFS_BUF_PTR(bp) + dqp->q_bufoffset);
+        ddqp = bp->b_addr + dqp->q_bufoffset;
 
         /*
          * A simple sanity check in case we got a corrupted dquot..
@@ -1240,7 +1236,7 @@ xfs_qm_dqflush(
          * If the buffer is pinned then push on the log so we won't
          * get stuck waiting in the write for too long.
          */
-        if (XFS_BUF_ISPINNED(bp)) {
+        if (xfs_buf_ispinned(bp)) {
                 trace_xfs_dqflush_force(dqp);
                 xfs_log_force(mp, 0);
         }
@@ -1447,7 +1443,7 @@ xfs_qm_dqflock_pushbuf_wait(
                 goto out_lock;
 
         if (XFS_BUF_ISDELAYWRITE(bp)) {
-                if (XFS_BUF_ISPINNED(bp))
+                if (xfs_buf_ispinned(bp))
                         xfs_log_force(mp, 0);
                 xfs_buf_delwri_promote(bp);
                 wake_up_process(bp->b_target->bt_task);
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 46e54ad9a2dc..9a0aa76facdf 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1240,7 +1240,7 @@ xfs_qm_reset_dqcounts(
         do_div(j, sizeof(xfs_dqblk_t));
         ASSERT(mp->m_quotainfo->qi_dqperchunk == j);
 #endif
-        ddq = (xfs_disk_dquot_t *)XFS_BUF_PTR(bp);
+        ddq = bp->b_addr;
         for (j = 0; j < mp->m_quotainfo->qi_dqperchunk; j++) {
                 /*
                  * Do a sanity check, and if needed, repair the dqblk. Don't
diff --git a/fs/xfs/xfs_ag.h b/fs/xfs/xfs_ag.h
index 6530769a999b..4805f009f923 100644
--- a/fs/xfs/xfs_ag.h
+++ b/fs/xfs/xfs_ag.h
@@ -103,7 +103,7 @@ typedef struct xfs_agf {
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
 #define XFS_AGF_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGF_DADDR(mp))
-#define XFS_BUF_TO_AGF(bp)      ((xfs_agf_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGF(bp)      ((xfs_agf_t *)((bp)->b_addr))
 
 extern int xfs_read_agf(struct xfs_mount *mp, struct xfs_trans *tp,
                         xfs_agnumber_t agno, int flags, struct xfs_buf **bpp);
@@ -156,7 +156,7 @@ typedef struct xfs_agi {
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGI_DADDR(mp)       ((xfs_daddr_t)(2 << (mp)->m_sectbb_log))
 #define XFS_AGI_BLOCK(mp)       XFS_HDR_BLOCK(mp, XFS_AGI_DADDR(mp))
-#define XFS_BUF_TO_AGI(bp)      ((xfs_agi_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGI(bp)      ((xfs_agi_t *)((bp)->b_addr))
 
 extern int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
                                 xfs_agnumber_t agno, struct xfs_buf **bpp);
@@ -168,7 +168,7 @@ extern int xfs_read_agi(struct xfs_mount *mp, struct xfs_trans *tp,
 #define XFS_AGFL_DADDR(mp)      ((xfs_daddr_t)(3 << (mp)->m_sectbb_log))
 #define XFS_AGFL_BLOCK(mp)      XFS_HDR_BLOCK(mp, XFS_AGFL_DADDR(mp))
 #define XFS_AGFL_SIZE(mp)       ((mp)->m_sb.sb_sectsize / sizeof(xfs_agblock_t))
-#define XFS_BUF_TO_AGFL(bp)     ((xfs_agfl_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_AGFL(bp)     ((xfs_agfl_t *)((bp)->b_addr))
 
 typedef struct xfs_agfl {
         __be32          agfl_bno[1];    /* actually XFS_AGFL_SIZE(mp) */
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 1e00b3ef6274..bdd9cb54d63b 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -451,8 +451,7 @@ xfs_alloc_read_agfl(
                         XFS_FSS_TO_BB(mp, 1), 0, &bp);
         if (error)
                 return error;
-        ASSERT(bp);
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         XFS_BUF_SET_VTYPE_REF(bp, B_FS_AGFL, XFS_AGFL_REF);
         *bpp = bp;
         return 0;
@@ -2116,7 +2115,7 @@ xfs_read_agf(
         if (!*bpp)
                 return 0;
 
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!(*bpp)->b_error);
         agf = XFS_BUF_TO_AGF(*bpp);
 
         /*
@@ -2168,7 +2167,7 @@ xfs_alloc_read_agf(
                 return error;
         if (!*bpp)
                 return 0;
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!(*bpp)->b_error);
 
         agf = XFS_BUF_TO_AGF(*bpp);
         pag = xfs_perag_get(mp, agno);
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index cbae424fe1ba..160bcdc34a6e 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -2121,8 +2121,7 @@ xfs_attr_rmtval_set(xfs_da_args_t *args)
 
                 bp = xfs_buf_get(mp->m_ddev_targp, dblkno, blkcnt,
                                  XBF_LOCK | XBF_DONT_BLOCK);
-                ASSERT(bp);
-                ASSERT(!XFS_BUF_GETERROR(bp));
+                ASSERT(!xfs_buf_geterror(bp));
 
                 tmp = (valuelen < XFS_BUF_SIZE(bp)) ? valuelen :
                                                         XFS_BUF_SIZE(bp);
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index ab3e5c6c4642..452a291383ab 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -3383,8 +3383,7 @@ xfs_bmap_local_to_extents(
                 ASSERT(args.len == 1);
                 *firstblock = args.fsbno;
                 bp = xfs_btree_get_bufl(args.mp, tp, args.fsbno, 0);
-                memcpy((char *)XFS_BUF_PTR(bp), ifp->if_u1.if_data,
-                        ifp->if_bytes);
+                memcpy(bp->b_addr, ifp->if_u1.if_data, ifp->if_bytes);
                 xfs_trans_log_buf(tp, bp, 0, ifp->if_bytes - 1);
                 xfs_bmap_forkoff_reset(args.mp, ip, whichfork);
                 xfs_idata_realloc(ip, -ifp->if_bytes, whichfork);
diff --git a/fs/xfs/xfs_btree.c b/fs/xfs/xfs_btree.c
index cabf4b5604aa..2b9fd385e27d 100644
--- a/fs/xfs/xfs_btree.c
+++ b/fs/xfs/xfs_btree.c
@@ -275,8 +275,7 @@ xfs_btree_dup_cursor(
                                 return error;
                         }
                         new->bc_bufs[i] = bp;
-                        ASSERT(bp);
-                        ASSERT(!XFS_BUF_GETERROR(bp));
+                        ASSERT(!xfs_buf_geterror(bp));
                 } else
                         new->bc_bufs[i] = NULL;
         }
@@ -467,8 +466,7 @@ xfs_btree_get_bufl(
         ASSERT(fsbno != NULLFSBLOCK);
         d = XFS_FSB_TO_DADDR(mp, fsbno);
         bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d, mp->m_bsize, lock);
-        ASSERT(bp);
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         return bp;
 }
 
@@ -491,8 +489,7 @@ xfs_btree_get_bufs(
         ASSERT(agbno != NULLAGBLOCK);
         d = XFS_AGB_TO_DADDR(mp, agno, agbno);
         bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d, mp->m_bsize, lock);
-        ASSERT(bp);
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         return bp;
 }
 
@@ -632,7 +629,7 @@ xfs_btree_read_bufl(
                         mp->m_bsize, lock, &bp))) {
                 return error;
         }
-        ASSERT(!bp || !XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         if (bp)
                 XFS_BUF_SET_VTYPE_REF(bp, B_FS_MAP, refval);
         *bpp = bp;
@@ -973,8 +970,7 @@ xfs_btree_get_buf_block(
         *bpp = xfs_trans_get_buf(cur->bc_tp, mp->m_ddev_targp, d,
                                  mp->m_bsize, flags);
 
-        ASSERT(*bpp);
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!xfs_buf_geterror(*bpp));
 
         *block = XFS_BUF_TO_BLOCK(*bpp);
         return 0;
@@ -1006,8 +1002,7 @@ xfs_btree_read_buf_block(
         if (error)
                 return error;
 
-        ASSERT(*bpp != NULL);
-        ASSERT(!XFS_BUF_GETERROR(*bpp));
+        ASSERT(!xfs_buf_geterror(*bpp));
 
         xfs_btree_set_refs(cur, *bpp);
         *block = XFS_BUF_TO_BLOCK(*bpp);
diff --git a/fs/xfs/xfs_btree.h b/fs/xfs/xfs_btree.h
index 8d05a6a46ce3..5b240de104c0 100644
--- a/fs/xfs/xfs_btree.h
+++ b/fs/xfs/xfs_btree.h
@@ -262,7 +262,7 @@ typedef struct xfs_btree_cur
 /*
  * Convert from buffer to btree block header.
  */
-#define XFS_BUF_TO_BLOCK(bp)    ((struct xfs_btree_block *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_BLOCK(bp)    ((struct xfs_btree_block *)((bp)->b_addr))
 
 
 /*
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 88492916c3dc..cac2ecfa6746 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -124,9 +124,9 @@ xfs_buf_item_log_check(
 
         bp = bip->bli_buf;
         ASSERT(XFS_BUF_COUNT(bp) > 0);
-        ASSERT(XFS_BUF_PTR(bp) != NULL);
+        ASSERT(bp->b_addr != NULL);
         orig = bip->bli_orig;
-        buffer = XFS_BUF_PTR(bp);
+        buffer = bp->b_addr;
         for (x = 0; x < XFS_BUF_COUNT(bp); x++) {
                 if (orig[x] != buffer[x] && !btst(bip->bli_logged, x)) {
                         xfs_emerg(bp->b_mount,
@@ -371,7 +371,6 @@ xfs_buf_item_pin(
 {
         struct xfs_buf_log_item *bip = BUF_ITEM(lip);
 
-        ASSERT(XFS_BUF_ISBUSY(bip->bli_buf));
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
         ASSERT((bip->bli_flags & XFS_BLI_LOGGED) ||
                (bip->bli_flags & XFS_BLI_STALE));
@@ -479,13 +478,13 @@ xfs_buf_item_trylock(
         struct xfs_buf_log_item *bip = BUF_ITEM(lip);
         struct xfs_buf          *bp = bip->bli_buf;
 
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                 return XFS_ITEM_PINNED;
         if (!xfs_buf_trylock(bp))
                 return XFS_ITEM_LOCKED;
 
         /* take a reference to the buffer.  */
-        XFS_BUF_HOLD(bp);
+        xfs_buf_hold(bp);
 
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
         trace_xfs_buf_item_trylock(bip);
@@ -726,7 +725,7 @@ xfs_buf_item_init(
          * to have logged.
          */
         bip->bli_orig = (char *)kmem_alloc(XFS_BUF_COUNT(bp), KM_SLEEP);
-        memcpy(bip->bli_orig, XFS_BUF_PTR(bp), XFS_BUF_COUNT(bp));
+        memcpy(bip->bli_orig, bp->b_addr, XFS_BUF_COUNT(bp));
         bip->bli_logged = (char *)kmem_zalloc(XFS_BUF_COUNT(bp) / NBBY, KM_SLEEP);
 #endif
 
@@ -895,7 +894,6 @@ xfs_buf_attach_iodone(
 {
         xfs_log_item_t  *head_lip;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
 
         lip->li_cb = cb;
@@ -960,7 +958,7 @@ xfs_buf_iodone_callbacks(
         static ulong            lasttime;
         static xfs_buftarg_t    *lasttarg;
 
-        if (likely(!XFS_BUF_GETERROR(bp)))
+        if (likely(!xfs_buf_geterror(bp)))
                 goto do_callbacks;
 
         /*
@@ -973,14 +971,14 @@ xfs_buf_iodone_callbacks(
                 goto do_callbacks;
         }
 
-        if (XFS_BUF_TARGET(bp) != lasttarg ||
+        if (bp->b_target != lasttarg ||
             time_after(jiffies, (lasttime + 5*HZ))) {
                 lasttime = jiffies;
                 xfs_alert(mp, "Device %s: metadata write error block 0x%llx",
-                        XFS_BUFTARG_NAME(XFS_BUF_TARGET(bp)),
+                        xfs_buf_target_name(bp->b_target),
                       (__uint64_t)XFS_BUF_ADDR(bp));
         }
-        lasttarg = XFS_BUF_TARGET(bp);
+        lasttarg = bp->b_target;
 
         /*
          * If the write was asynchronous then no one will be looking for the
@@ -991,12 +989,11 @@ xfs_buf_iodone_callbacks(
          * around.
          */
         if (XFS_BUF_ISASYNC(bp)) {
-                XFS_BUF_ERROR(bp, 0); /* errno of 0 unsets the flag */
+                xfs_buf_ioerror(bp, 0); /* errno of 0 unsets the flag */
 
                 if (!XFS_BUF_ISSTALE(bp)) {
                         XFS_BUF_DELAYWRITE(bp);
                         XFS_BUF_DONE(bp);
-                        XFS_BUF_SET_START(bp);
                 }
                 ASSERT(bp->b_iodone != NULL);
                 trace_xfs_buf_item_iodone_async(bp, _RET_IP_);
@@ -1013,7 +1010,6 @@ xfs_buf_iodone_callbacks(
         XFS_BUF_UNDELAYWRITE(bp);
 
         trace_xfs_buf_error_relse(bp, _RET_IP_);
-        xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
 
 do_callbacks:
         xfs_buf_do_callbacks(bp);
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index 5bfcb8779f9f..ee9d5427fcd4 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -2050,7 +2050,7 @@ xfs_da_do_buf(
                 case 0:
                         bp = xfs_trans_get_buf(trans, mp->m_ddev_targp,
                                 mappedbno, nmapped, 0);
-                        error = bp ? XFS_BUF_GETERROR(bp) : XFS_ERROR(EIO);
+                        error = bp ? bp->b_error : XFS_ERROR(EIO);
                         break;
                 case 1:
                 case 2:
@@ -2268,7 +2268,7 @@ xfs_da_buf_make(int nbuf, xfs_buf_t **bps)
                 dabuf->nbuf = 1;
                 bp = bps[0];
                 dabuf->bbcount = (short)BTOBB(XFS_BUF_COUNT(bp));
-                dabuf->data = XFS_BUF_PTR(bp);
+                dabuf->data = bp->b_addr;
                 dabuf->bps[0] = bp;
         } else {
                 dabuf->nbuf = nbuf;
@@ -2279,7 +2279,7 @@ xfs_da_buf_make(int nbuf, xfs_buf_t **bps)
                 dabuf->data = kmem_alloc(BBTOB(dabuf->bbcount), KM_SLEEP);
                 for (i = off = 0; i < nbuf; i++, off += XFS_BUF_COUNT(bp)) {
                         bp = bps[i];
-                        memcpy((char *)dabuf->data + off, XFS_BUF_PTR(bp),
+                        memcpy((char *)dabuf->data + off, bp->b_addr,
                                 XFS_BUF_COUNT(bp));
                 }
         }
@@ -2302,8 +2302,8 @@ xfs_da_buf_clean(xfs_dabuf_t *dabuf)
                 for (i = off = 0; i < dabuf->nbuf;
                                 i++, off += XFS_BUF_COUNT(bp)) {
                         bp = dabuf->bps[i];
-                        memcpy(XFS_BUF_PTR(bp), (char *)dabuf->data + off,
-                                XFS_BUF_COUNT(bp));
+                        memcpy(bp->b_addr, dabuf->data + off,
+                                                XFS_BUF_COUNT(bp));
                 }
         }
 }
@@ -2340,7 +2340,7 @@ xfs_da_log_buf(xfs_trans_t *tp, xfs_dabuf_t *dabuf, uint first, uint last)
 
         ASSERT(dabuf->nbuf && dabuf->data && dabuf->bbcount && dabuf->bps[0]);
         if (dabuf->nbuf == 1) {
-                ASSERT(dabuf->data == (void *)XFS_BUF_PTR(dabuf->bps[0]));
+                ASSERT(dabuf->data == dabuf->bps[0]->b_addr);
                 xfs_trans_log_buf(tp, dabuf->bps[0], first, last);
                 return;
         }
diff --git a/fs/xfs/xfs_dinode.h b/fs/xfs/xfs_dinode.h
index dffba9ba0db6..a3721633abc8 100644
--- a/fs/xfs/xfs_dinode.h
+++ b/fs/xfs/xfs_dinode.h
@@ -148,7 +148,7 @@ typedef enum xfs_dinode_fmt {
                 be32_to_cpu((dip)->di_nextents) : \
                 be16_to_cpu((dip)->di_anextents))
 
-#define XFS_BUF_TO_DINODE(bp)   ((xfs_dinode_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_DINODE(bp)   ((xfs_dinode_t *)((bp)->b_addr))
 
 /*
  * For block and character special files the 32bit dev_t is stored at the
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index dd5628bd8d0b..9f24ec28283b 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -202,8 +202,7 @@ xfs_ialloc_inode_init(
                 fbuf = xfs_trans_get_buf(tp, mp->m_ddev_targp, d,
                                          mp->m_bsize * blks_per_cluster,
                                          XBF_LOCK);
-                ASSERT(fbuf);
-                ASSERT(!XFS_BUF_GETERROR(fbuf));
+                ASSERT(!xfs_buf_geterror(fbuf));
 
                 /*
                  * Initialize all inodes in this buffer and then log them.
@@ -1486,7 +1485,7 @@ xfs_read_agi(
         if (error)
                 return error;
 
-        ASSERT(*bpp && !XFS_BUF_GETERROR(*bpp));
+        ASSERT(!xfs_buf_geterror(*bpp));
         agi = XFS_BUF_TO_AGI(*bpp);
 
         /*
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 2fcca4b03ed3..0239a7c7c886 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2473,7 +2473,7 @@ cluster_corrupt_out:
                 if (bp->b_iodone) {
                         XFS_BUF_UNDONE(bp);
                         XFS_BUF_STALE(bp);
-                        XFS_BUF_ERROR(bp,EIO);
+                        xfs_buf_ioerror(bp, EIO);
                         xfs_buf_ioend(bp, 0);
                 } else {
                         XFS_BUF_STALE(bp);
@@ -2585,7 +2585,7 @@ xfs_iflush(
          * If the buffer is pinned then push on the log now so we won't
          * get stuck waiting in the write for too long.
          */
-        if (XFS_BUF_ISPINNED(bp))
+        if (xfs_buf_ispinned(bp))
                 xfs_log_force(mp, 0);
 
         /*
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 06ff8437ed8e..3a8d4f66d702 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -878,7 +878,7 @@ xlog_iodone(xfs_buf_t *bp)
         /*
          * Race to shutdown the filesystem if we see an error.
          */
-        if (XFS_TEST_ERROR((XFS_BUF_GETERROR(bp)), l->l_mp,
+        if (XFS_TEST_ERROR((xfs_buf_geterror(bp)), l->l_mp,
                         XFS_ERRTAG_IODONE_IOERR, XFS_RANDOM_IODONE_IOERR)) {
                 xfs_ioerror_alert("xlog_iodone", l->l_mp, bp, XFS_BUF_ADDR(bp));
                 XFS_BUF_STALE(bp);
@@ -1051,7 +1051,6 @@ xlog_alloc_log(xfs_mount_t	*mp,
         if (!bp)
                 goto out_free_log;
         bp->b_iodone = xlog_iodone;
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(xfs_buf_islocked(bp));
         log->l_xbuf = bp;
 
@@ -1108,7 +1107,6 @@ xlog_alloc_log(xfs_mount_t	*mp,
                 iclog->ic_callback_tail = &(iclog->ic_callback);
                 iclog->ic_datap = (char *)iclog->ic_data + log->l_iclog_hsize;
 
-                ASSERT(XFS_BUF_ISBUSY(iclog->ic_bp));
                 ASSERT(xfs_buf_islocked(iclog->ic_bp));
                 init_waitqueue_head(&iclog->ic_force_wait);
                 init_waitqueue_head(&iclog->ic_write_wait);
@@ -1248,7 +1246,7 @@ xlog_bdstrat(
         struct xlog_in_core     *iclog = bp->b_fspriv;
 
         if (iclog->ic_state & XLOG_STATE_IOERROR) {
-                XFS_BUF_ERROR(bp, EIO);
+                xfs_buf_ioerror(bp, EIO);
                 XFS_BUF_STALE(bp);
                 xfs_buf_ioend(bp, 0);
                 /*
@@ -1355,7 +1353,6 @@ xlog_sync(xlog_t		*log,
         XFS_BUF_SET_COUNT(bp, count);
         bp->b_fspriv = iclog;
         XFS_BUF_ZEROFLAGS(bp);
-        XFS_BUF_BUSY(bp);
         XFS_BUF_ASYNC(bp);
         bp->b_flags |= XBF_SYNCIO;
 
@@ -1398,16 +1395,15 @@ xlog_sync(xlog_t		*log,
         if (split) {
                 bp = iclog->ic_log->l_xbuf;
                 XFS_BUF_SET_ADDR(bp, 0);             /* logical 0 */
-                XFS_BUF_SET_PTR(bp, (xfs_caddr_t)((__psint_t)&(iclog->ic_header)+
-                                            (__psint_t)count), split);
+                xfs_buf_associate_memory(bp,
+                                (char *)&iclog->ic_header + count, split);
                 bp->b_fspriv = iclog;
                 XFS_BUF_ZEROFLAGS(bp);
-                XFS_BUF_BUSY(bp);
                 XFS_BUF_ASYNC(bp);
                 bp->b_flags |= XBF_SYNCIO;
                 if (log->l_mp->m_flags & XFS_MOUNT_BARRIER)
                         bp->b_flags |= XBF_FUA;
-                dptr = XFS_BUF_PTR(bp);
+                dptr = bp->b_addr;
                 /*
                  * Bump the cycle numbers at the start of each block
                  * since this part of the buffer is at the start of
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 052a2c0ec5fb..a199dbcee7d8 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -147,7 +147,7 @@ xlog_align(
         xfs_daddr_t     offset = blk_no & ((xfs_daddr_t)log->l_sectBBsize - 1);
 
         ASSERT(BBTOB(offset + nbblks) <= XFS_BUF_SIZE(bp));
-        return XFS_BUF_PTR(bp) + BBTOB(offset);
+        return bp->b_addr + BBTOB(offset);
 }
 
 
@@ -178,9 +178,7 @@ xlog_bread_noalign(
 
         XFS_BUF_SET_ADDR(bp, log->l_logBBstart + blk_no);
         XFS_BUF_READ(bp);
-        XFS_BUF_BUSY(bp);
         XFS_BUF_SET_COUNT(bp, BBTOB(nbblks));
-        XFS_BUF_SET_TARGET(bp, log->l_mp->m_logdev_targp);
 
         xfsbdstrat(log->l_mp, bp);
         error = xfs_buf_iowait(bp);
@@ -220,18 +218,18 @@ xlog_bread_offset(
         xfs_buf_t       *bp,
         xfs_caddr_t     offset)
 {
-        xfs_caddr_t     orig_offset = XFS_BUF_PTR(bp);
+        xfs_caddr_t     orig_offset = bp->b_addr;
         int             orig_len = bp->b_buffer_length;
         int             error, error2;
 
-        error = XFS_BUF_SET_PTR(bp, offset, BBTOB(nbblks));
+        error = xfs_buf_associate_memory(bp, offset, BBTOB(nbblks));
         if (error)
                 return error;
 
         error = xlog_bread_noalign(log, blk_no, nbblks, bp);
 
         /* must reset buffer pointer even on error */
-        error2 = XFS_BUF_SET_PTR(bp, orig_offset, orig_len);
+        error2 = xfs_buf_associate_memory(bp, orig_offset, orig_len);
         if (error)
                 return error;
         return error2;
@@ -266,11 +264,9 @@ xlog_bwrite(
 
         XFS_BUF_SET_ADDR(bp, log->l_logBBstart + blk_no);
         XFS_BUF_ZEROFLAGS(bp);
-        XFS_BUF_BUSY(bp);
-        XFS_BUF_HOLD(bp);
+        xfs_buf_hold(bp);
         xfs_buf_lock(bp);
         XFS_BUF_SET_COUNT(bp, BBTOB(nbblks));
-        XFS_BUF_SET_TARGET(bp, log->l_mp->m_logdev_targp);
 
         if ((error = xfs_bwrite(log->l_mp, bp)))
                 xfs_ioerror_alert("xlog_bwrite", log->l_mp,
@@ -360,7 +356,7 @@ STATIC void
 xlog_recover_iodone(
         struct xfs_buf  *bp)
 {
-        if (XFS_BUF_GETERROR(bp)) {
+        if (bp->b_error) {
                 /*
                  * We're not going to bother about retrying
                  * this during recovery. One strike!
@@ -1262,7 +1258,7 @@ xlog_write_log_records(
                  */
                 ealign = round_down(end_block, sectbb);
                 if (j == 0 && (start_block + endcount > ealign)) {
-                        offset = XFS_BUF_PTR(bp) + BBTOB(ealign - start_block);
+                        offset = bp->b_addr + BBTOB(ealign - start_block);
                         error = xlog_bread_offset(log, ealign, sectbb,
                                                         bp, offset);
                         if (error)
@@ -2135,15 +2131,16 @@ xlog_recover_buffer_pass2(
 
         bp = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len,
                           buf_flags);
-        if (XFS_BUF_ISERROR(bp)) {
+        if (!bp)
+                return XFS_ERROR(ENOMEM);
+        error = bp->b_error;
+        if (error) {
                 xfs_ioerror_alert("xlog_recover_do..(read#1)", mp,
                                   bp, buf_f->blf_blkno);
-                error = XFS_BUF_GETERROR(bp);
                 xfs_buf_relse(bp);
                 return error;
         }
 
-        error = 0;
         if (buf_f->blf_flags & XFS_BLF_INODE_BUF) {
                 error = xlog_recover_do_inode_buffer(mp, item, bp, buf_f);
         } else if (buf_f->blf_flags &
@@ -2227,14 +2224,17 @@ xlog_recover_inode_pass2(
 
         bp = xfs_buf_read(mp->m_ddev_targp, in_f->ilf_blkno, in_f->ilf_len,
                           XBF_LOCK);
-        if (XFS_BUF_ISERROR(bp)) {
+        if (!bp) {
+                error = ENOMEM;
+                goto error;
+        }
+        error = bp->b_error;
+        if (error) {
                 xfs_ioerror_alert("xlog_recover_do..(read#2)", mp,
                                   bp, in_f->ilf_blkno);
-                error = XFS_BUF_GETERROR(bp);
                 xfs_buf_relse(bp);
                 goto error;
         }
-        error = 0;
         ASSERT(in_f->ilf_fields & XFS_ILOG_CORE);
         dip = (xfs_dinode_t *)xfs_buf_offset(bp, in_f->ilf_boffset);
 
@@ -3437,7 +3437,7 @@ xlog_do_recovery_pass(
                         /*
                          * Check for header wrapping around physical end-of-log
                          */
-                        offset = XFS_BUF_PTR(hbp);
+                        offset = hbp->b_addr;
                         split_hblks = 0;
                         wrapped_hblks = 0;
                         if (blk_no + hblks <= log->l_logBBsize) {
@@ -3497,7 +3497,7 @@ xlog_do_recovery_pass(
                         } else {
                                 /* This log record is split across the
                                  * physical end of log */
-                                offset = XFS_BUF_PTR(dbp);
+                                offset = dbp->b_addr;
                                 split_bblks = 0;
                                 if (blk_no != log->l_logBBsize) {
                                         /* some data is before the physical
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 092e16ae4d9d..0081657ad985 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1615,7 +1615,7 @@ xfs_unmountfs_writesb(xfs_mount_t *mp)
                 XFS_BUF_UNDELAYWRITE(sbp);
                 XFS_BUF_WRITE(sbp);
                 XFS_BUF_UNASYNC(sbp);
-                ASSERT(XFS_BUF_TARGET(sbp) == mp->m_ddev_targp);
+                ASSERT(sbp->b_target == mp->m_ddev_targp);
                 xfsbdstrat(mp, sbp);
                 error = xfs_buf_iowait(sbp);
                 if (error)
@@ -1938,7 +1938,7 @@ xfs_getsb(
                 xfs_buf_lock(bp);
         }
 
-        XFS_BUF_HOLD(bp);
+        xfs_buf_hold(bp);
         ASSERT(XFS_BUF_ISDONE(bp));
         return bp;
 }
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 8f76fdff4f46..35561a511b57 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -168,7 +168,7 @@ error_cancel:
                                 xfs_trans_cancel(tp, cancelflags);
                                 goto error;
                         }
-                        memset(XFS_BUF_PTR(bp), 0, mp->m_sb.sb_blocksize);
+                        memset(bp->b_addr, 0, mp->m_sb.sb_blocksize);
                         xfs_trans_log_buf(tp, bp, 0, mp->m_sb.sb_blocksize - 1);
                         /*
                          * Commit the transaction.
@@ -883,7 +883,7 @@ xfs_rtbuf_get(
         if (error) {
                 return error;
         }
-        ASSERT(bp && !XFS_BUF_GETERROR(bp));
+        ASSERT(!xfs_buf_geterror(bp));
         *bpp = bp;
         return 0;
 }
@@ -943,7 +943,7 @@ xfs_rtcheck_range(
         if (error) {
                 return error;
         }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
         /*
          * Compute the starting word's address, and starting bit.
          */
@@ -994,7 +994,7 @@ xfs_rtcheck_range(
                         if (error) {
                                 return error;
                         }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1040,7 +1040,7 @@ xfs_rtcheck_range(
                         if (error) {
                                 return error;
                         }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1158,7 +1158,7 @@ xfs_rtfind_back(
         if (error) {
                 return error;
         }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
         /*
          * Get the first word's index & point to it.
          */
@@ -1210,7 +1210,7 @@ xfs_rtfind_back(
                         if (error) {
                                 return error;
                         }
-                        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        bufp = bp->b_addr;
                         word = XFS_BLOCKWMASK(mp);
                         b = &bufp[word];
                 } else {
@@ -1256,7 +1256,7 @@ xfs_rtfind_back(
                         if (error) {
                                 return error;
                         }
-                        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        bufp = bp->b_addr;
                         word = XFS_BLOCKWMASK(mp);
                         b = &bufp[word];
                 } else {
@@ -1333,7 +1333,7 @@ xfs_rtfind_forw(
         if (error) {
                 return error;
         }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
         /*
          * Get the first word's index & point to it.
          */
@@ -1384,7 +1384,7 @@ xfs_rtfind_forw(
                         if (error) {
                                 return error;
                         }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1429,7 +1429,7 @@ xfs_rtfind_forw(
                         if (error) {
                                 return error;
                         }
-                        b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1649,7 +1649,7 @@ xfs_rtmodify_range(
         if (error) {
                 return error;
         }
-        bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+        bufp = bp->b_addr;
         /*
          * Compute the starting word's address, and starting bit.
          */
@@ -1694,7 +1694,7 @@ xfs_rtmodify_range(
                         if (error) {
                                 return error;
                         }
-                        first = b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        first = b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1734,7 +1734,7 @@ xfs_rtmodify_range(
                         if (error) {
                                 return error;
                         }
-                        first = b = bufp = (xfs_rtword_t *)XFS_BUF_PTR(bp);
+                        first = b = bufp = bp->b_addr;
                         word = 0;
                 } else {
                         /*
@@ -1832,8 +1832,8 @@ xfs_rtmodify_summary(
          */
         sp = XFS_SUMPTR(mp, bp, so);
         *sp += delta;
-        xfs_trans_log_buf(tp, bp, (uint)((char *)sp - (char *)XFS_BUF_PTR(bp)),
-                (uint)((char *)sp - (char *)XFS_BUF_PTR(bp) + sizeof(*sp) - 1));
+        xfs_trans_log_buf(tp, bp, (uint)((char *)sp - (char *)bp->b_addr),
+                (uint)((char *)sp - (char *)bp->b_addr + sizeof(*sp) - 1));
         return 0;
 }
 
diff --git a/fs/xfs/xfs_rtalloc.h b/fs/xfs/xfs_rtalloc.h
index 09e1f4f35e97..f7f3a359c1c5 100644
--- a/fs/xfs/xfs_rtalloc.h
+++ b/fs/xfs/xfs_rtalloc.h
@@ -47,7 +47,7 @@ struct xfs_trans;
 #define XFS_SUMOFFSTOBLOCK(mp,s)        \
         (((s) * (uint)sizeof(xfs_suminfo_t)) >> (mp)->m_sb.sb_blocklog)
 #define XFS_SUMPTR(mp,bp,so)    \
-        ((xfs_suminfo_t *)((char *)XFS_BUF_PTR(bp) + \
+        ((xfs_suminfo_t *)((bp)->b_addr + \
                 (((so) * (uint)sizeof(xfs_suminfo_t)) & XFS_BLOCKMASK(mp))))
 
 #define XFS_BITTOBLOCK(mp,bi)   ((bi) >> (mp)->m_blkbit_log)
diff --git a/fs/xfs/xfs_rw.c b/fs/xfs/xfs_rw.c
index d6d6fdfe9422..c96a8a05ac03 100644
--- a/fs/xfs/xfs_rw.c
+++ b/fs/xfs/xfs_rw.c
@@ -104,9 +104,9 @@ xfs_ioerror_alert(
         xfs_alert(mp,
                  "I/O error occurred: meta-data dev %s block 0x%llx"
                  "       (\"%s\") error %d buf count %zd",
-                XFS_BUFTARG_NAME(XFS_BUF_TARGET(bp)),
+                xfs_buf_target_name(bp->b_target),
                 (__uint64_t)blkno, func,
-                XFS_BUF_GETERROR(bp), XFS_BUF_COUNT(bp));
+                bp->b_error, XFS_BUF_COUNT(bp));
 }
 
 /*
@@ -137,8 +137,8 @@ xfs_read_buf(
         bp = xfs_buf_read(target, blkno, len, flags);
         if (!bp)
                 return XFS_ERROR(EIO);
-        error = XFS_BUF_GETERROR(bp);
-        if (bp && !error && !XFS_FORCED_SHUTDOWN(mp)) {
+        error = bp->b_error;
+        if (!error && !XFS_FORCED_SHUTDOWN(mp)) {
                 *bpp = bp;
         } else {
                 *bpp = NULL;
diff --git a/fs/xfs/xfs_sb.h b/fs/xfs/xfs_sb.h
index 1eb2ba586814..cb6ae715814a 100644
--- a/fs/xfs/xfs_sb.h
+++ b/fs/xfs/xfs_sb.h
@@ -509,7 +509,7 @@ static inline int xfs_sb_version_hasprojid32bit(xfs_sb_t *sbp)
 
 #define XFS_SB_DADDR            ((xfs_daddr_t)0) /* daddr in filesystem/ag */
 #define XFS_SB_BLOCK(mp)        XFS_HDR_BLOCK(mp, XFS_SB_DADDR)
-#define XFS_BUF_TO_SBP(bp)      ((xfs_dsb_t *)XFS_BUF_PTR(bp))
+#define XFS_BUF_TO_SBP(bp)      ((xfs_dsb_t *)((bp)->b_addr))
 
 #define XFS_HDR_BLOCK(mp,d)     ((xfs_agblock_t)XFS_BB_TO_FSBT(mp,d))
 #define XFS_DADDR_TO_FSB(mp,d)  XFS_AGB_TO_FSB(mp, \
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 43233e92f0f6..c15aa29fa169 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -299,7 +299,7 @@ xfs_trans_ail_cursor_last(
  * Splice the log item list into the AIL at the given LSN. We splice to the
  * tail of the given LSN to maintain insert order for push traversals. The
  * cursor is optional, allowing repeated updates to the same LSN to avoid
- * repeated traversals.
+ * repeated traversals.  This should not be called with an empty list.
  */
 static void
 xfs_ail_splice(
@@ -308,50 +308,39 @@ xfs_ail_splice(
         struct list_head        *list,
         xfs_lsn_t               lsn)
 {
-        struct xfs_log_item     *lip = cur ? cur->item : NULL;
-        struct xfs_log_item     *next_lip;
+        struct xfs_log_item     *lip;
+
+        ASSERT(!list_empty(list));
 
         /*
-         * Get a new cursor if we don't have a placeholder or the existing one
-         * has been invalidated.
+         * Use the cursor to determine the insertion point if one is
+         * provided.  If not, or if the one we got is not valid,
+         * find the place in the AIL where the items belong.
          */
-        if (!lip || (__psint_t)lip & 1) {
+        lip = cur ? cur->item : NULL;
+        if (!lip || (__psint_t) lip & 1)
                 lip = __xfs_trans_ail_cursor_last(ailp, lsn);
 
-                if (!lip) {
-                        /* The list is empty, so just splice and return.  */
-                        if (cur)
-                                cur->item = NULL;
-                        list_splice(list, &ailp->xa_ail);
-                        return;
-                }
-        }
+        /*
+         * If a cursor is provided, we know we're processing the AIL
+         * in lsn order, and future items to be spliced in will
+         * follow the last one being inserted now.  Update the
+         * cursor to point to that last item, now while we have a
+         * reliable pointer to it.
+         */
+        if (cur)
+                cur->item = list_entry(list->prev, struct xfs_log_item, li_ail);
 
         /*
-         * Our cursor points to the item we want to insert _after_, so we have
-         * to update the cursor to point to the end of the list we are splicing
-         * in so that it points to the correct location for the next splice.
-         * i.e. before the splice
-         *
-         *  lsn -> lsn -> lsn + x -> lsn + x ...
-         *          ^
-         *          | cursor points here
-         *
-         * After the splice we have:
-         *
-         *  lsn -> lsn -> lsn -> lsn -> .... -> lsn -> lsn + x -> lsn + x ...
-         *          ^                            ^
-         *          | cursor points here         | needs to move here
-         *
-         * So we set the cursor to the last item in the list to be spliced
-         * before we execute the splice, resulting in the cursor pointing to
-         * the correct item after the splice occurs.
+         * Finally perform the splice.  Unless the AIL was empty,
+         * lip points to the item in the AIL _after_ which the new
+         * items should go.  If lip is null the AIL was empty, so
+         * the new items go at the head of the AIL.
          */
-        if (cur) {
-                next_lip = list_entry(list->prev, struct xfs_log_item, li_ail);
-                cur->item = next_lip;
-        }
-        list_splice(list, &lip->li_ail);
+        if (lip)
+                list_splice(list, &lip->li_ail);
+        else
+                list_splice(list, &ailp->xa_ail);
 }
 
 /*
@@ -682,6 +671,7 @@ xfs_trans_ail_update_bulk(
         int                     i;
         LIST_HEAD(tmp);
 
+        ASSERT(nr_items > 0);           /* Not required, but true. */
         mlip = xfs_ail_min(ailp);
 
         for (i = 0; i < nr_items; i++) {
@@ -701,7 +691,8 @@ xfs_trans_ail_update_bulk(
                 list_add(&lip->li_ail, &tmp);
         }
 
-        xfs_ail_splice(ailp, cur, &tmp, lsn);
+        if (!list_empty(&tmp))
+                xfs_ail_splice(ailp, cur, &tmp, lsn);
 
         if (!mlip_changed) {
                 spin_unlock(&ailp->xa_lock);
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index 15584fc3ed7d..137e2b9e2948 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -54,7 +54,7 @@ xfs_trans_buf_item_match(
         list_for_each_entry(lidp, &tp->t_items, lid_trans) {
                 blip = (struct xfs_buf_log_item *)lidp->lid_item;
                 if (blip->bli_item.li_type == XFS_LI_BUF &&
-                    XFS_BUF_TARGET(blip->bli_buf) == target &&
+                    blip->bli_buf->b_target == target &&
                     XFS_BUF_ADDR(blip->bli_buf) == blkno &&
                     XFS_BUF_COUNT(blip->bli_buf) == len)
                         return blip->bli_buf;
@@ -80,7 +80,6 @@ _xfs_trans_bjoin(
 {
         struct xfs_buf_log_item *bip;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == NULL);
 
         /*
@@ -194,7 +193,7 @@ xfs_trans_get_buf(xfs_trans_t	*tp,
                 return NULL;
         }
 
-        ASSERT(!XFS_BUF_GETERROR(bp));
+        ASSERT(!bp->b_error);
 
         _xfs_trans_bjoin(tp, bp, 1);
         trace_xfs_trans_get_buf(bp->b_fspriv);
@@ -293,10 +292,10 @@ xfs_trans_read_buf(
                         return (flags & XBF_TRYLOCK) ?
                                         EAGAIN : XFS_ERROR(ENOMEM);
 
-                if (XFS_BUF_GETERROR(bp) != 0) {
+                if (bp->b_error) {
+                        error = bp->b_error;
                         xfs_ioerror_alert("xfs_trans_read_buf", mp,
                                           bp, blkno);
-                        error = XFS_BUF_GETERROR(bp);
                         xfs_buf_relse(bp);
                         return error;
                 }
@@ -330,7 +329,7 @@ xfs_trans_read_buf(
                 ASSERT(xfs_buf_islocked(bp));
                 ASSERT(bp->b_transp == tp);
                 ASSERT(bp->b_fspriv != NULL);
-                ASSERT((XFS_BUF_ISERROR(bp)) == 0);
+                ASSERT(!bp->b_error);
                 if (!(XFS_BUF_ISDONE(bp))) {
                         trace_xfs_trans_read_buf_io(bp, _RET_IP_);
                         ASSERT(!XFS_BUF_ISASYNC(bp));
@@ -386,10 +385,9 @@ xfs_trans_read_buf(
                 return (flags & XBF_TRYLOCK) ?
                                         0 : XFS_ERROR(ENOMEM);
         }
-        if (XFS_BUF_GETERROR(bp) != 0) {
-            XFS_BUF_SUPER_STALE(bp);
-                error = XFS_BUF_GETERROR(bp);
-
+        if (bp->b_error) {
+                error = bp->b_error;
+                XFS_BUF_SUPER_STALE(bp);
                 xfs_ioerror_alert("xfs_trans_read_buf", mp,
                                   bp, blkno);
                 if (tp->t_flags & XFS_TRANS_DIRTY)
@@ -430,7 +428,7 @@ shutdown_abort:
         if (XFS_BUF_ISSTALE(bp) && XFS_BUF_ISDELAYWRITE(bp))
                 xfs_notice(mp, "about to pop assert, bp == 0x%p", bp);
 #endif
-        ASSERT((XFS_BUF_BFLAGS(bp) & (XBF_STALE|XBF_DELWRI)) !=
+        ASSERT((bp->b_flags & (XBF_STALE|XBF_DELWRI)) !=
                                      (XBF_STALE|XBF_DELWRI));
 
         trace_xfs_trans_read_buf_shut(bp, _RET_IP_);
@@ -581,7 +579,6 @@ xfs_trans_bhold(xfs_trans_t	*tp,
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
@@ -602,7 +599,6 @@ xfs_trans_bhold_release(xfs_trans_t	*tp,
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
@@ -631,7 +627,6 @@ xfs_trans_log_buf(xfs_trans_t	*tp,
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT((first <= last) && (last < XFS_BUF_COUNT(bp)));
@@ -702,7 +697,6 @@ xfs_trans_binval(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -774,7 +768,6 @@ xfs_trans_inode_buf(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -798,7 +791,6 @@ xfs_trans_stale_inode_buf(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -823,7 +815,6 @@ xfs_trans_inode_alloc_buf(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
@@ -851,7 +842,6 @@ xfs_trans_dquot_buf(
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
 
-        ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(type == XFS_BLF_UDQUOT_BUF ||
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 9322e13f0c63..51fc429527bc 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -83,7 +83,9 @@ xfs_readlink_bmap(
 
                 bp = xfs_buf_read(mp->m_ddev_targp, d, BTOBB(byte_cnt),
                                   XBF_LOCK | XBF_MAPPED | XBF_DONT_BLOCK);
-                error = XFS_BUF_GETERROR(bp);
+                if (!bp)
+                        return XFS_ERROR(ENOMEM);
+                error = bp->b_error;
                 if (error) {
                         xfs_ioerror_alert("xfs_readlink",
                                   ip->i_mount, bp, XFS_BUF_ADDR(bp));
@@ -94,7 +96,7 @@ xfs_readlink_bmap(
                         byte_cnt = pathlen;
                 pathlen -= byte_cnt;
 
-                memcpy(link, XFS_BUF_PTR(bp), byte_cnt);
+                memcpy(link, bp->b_addr, byte_cnt);
                 xfs_buf_relse(bp);
         }
 
@@ -1648,13 +1650,13 @@ xfs_symlink(
                         byte_cnt = XFS_FSB_TO_B(mp, mval[n].br_blockcount);
                         bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, d,
                                                BTOBB(byte_cnt), 0);
-                        ASSERT(bp && !XFS_BUF_GETERROR(bp));
+                        ASSERT(!xfs_buf_geterror(bp));
                         if (pathlen < byte_cnt) {
                                 byte_cnt = pathlen;
                         }
                         pathlen -= byte_cnt;
 
-                        memcpy(XFS_BUF_PTR(bp), cur_chunk, byte_cnt);
+                        memcpy(bp->b_addr, cur_chunk, byte_cnt);
                         cur_chunk += byte_cnt;
 
                         xfs_trans_log_buf(tp, bp, 0, byte_cnt - 1);
@@ -1999,7 +2001,7 @@ xfs_zero_remaining_bytes(
                                           mp, bp, XFS_BUF_ADDR(bp));
                         break;
                 }
-                memset(XFS_BUF_PTR(bp) +
+                memset(bp->b_addr +
                         (offset - XFS_FSB_TO_B(mp, imap.br_startoff)),
                       0, lastoffset - offset + 1);
                 XFS_BUF_UNDONE(bp);
diff --git a/include/asm-generic/memory_model.h b/include/asm-generic/memory_model.h
index fb2d63f13f4c..aea9e45efce6 100644
--- a/include/asm-generic/memory_model.h
+++ b/include/asm-generic/memory_model.h
@@ -39,7 +39,7 @@
 })
 
 #define __page_to_pfn(pg)                                               \
-({      struct page *__pg = (pg);                                       \
+({      const struct page *__pg = (pg);                                 \
         struct pglist_data *__pgdat = NODE_DATA(page_to_nid(__pg));     \
         (unsigned long)(__pg - __pgdat->node_mem_map) +                 \
          __pgdat->node_start_pfn;                                       \
@@ -57,7 +57,7 @@
  * section[i].section_mem_map == mem_map's address - start_pfn;
  */
 #define __page_to_pfn(pg)                                       \
-({      struct page *__pg = (pg);                               \
+({      const struct page *__pg = (pg);                         \
         int __sec = page_to_section(__pg);                      \
         (unsigned long)(__pg - __section_mem_map_addr(__nr_to_section(__sec))); \
 })
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 6395692b2e7a..32f0076e844b 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -125,7 +125,11 @@ enum rq_flag_bits {
         __REQ_SYNC,             /* request is sync (sync write or read) */
         __REQ_META,             /* metadata io request */
         __REQ_DISCARD,          /* request to discard sectors */
+        __REQ_SECURE,           /* secure discard (used with __REQ_DISCARD) */
+
         __REQ_NOIDLE,           /* don't anticipate more IO after this one */
+        __REQ_FUA,              /* forced unit access */
+        __REQ_FLUSH,            /* request for cache flush */
 
         /* bio only flags */
         __REQ_RAHEAD,           /* read ahead, can fail anytime */
@@ -135,7 +139,6 @@ enum rq_flag_bits {
         /* request only flags */
         __REQ_SORTED,           /* elevator knows about this request */
         __REQ_SOFTBARRIER,      /* may not be passed by ioscheduler */
-        __REQ_FUA,              /* forced unit access */
         __REQ_NOMERGE,          /* don't touch this for merging */
         __REQ_STARTED,          /* drive already may have started this one */
         __REQ_DONTPREP,         /* don't call prep for this one */
@@ -146,11 +149,9 @@ enum rq_flag_bits {
         __REQ_PREEMPT,          /* set for "ide_preempt" requests */
         __REQ_ALLOCED,          /* request came from our alloc pool */
         __REQ_COPY_USER,        /* contains copies of user pages */
-        __REQ_FLUSH,            /* request for cache flush */
         __REQ_FLUSH_SEQ,        /* request for flush sequence */
         __REQ_IO_STAT,          /* account I/O stat */
         __REQ_MIXED_MERGE,      /* merge of different types, fail separately */
-        __REQ_SECURE,           /* secure discard (used with __REQ_DISCARD) */
         __REQ_NR_BITS,          /* stops here */
 };
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0e67c45b3bc9..84b15d54f8c2 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -30,6 +30,7 @@ struct request_pm_state;
 struct blk_trace;
 struct request;
 struct sg_io_hdr;
+struct bsg_job;
 
 #define BLKDEV_MIN_RQ   4
 #define BLKDEV_MAX_RQ   128     /* Default maximum */
@@ -117,6 +118,7 @@ struct request {
                 struct {
                         unsigned int            seq;
                         struct list_head        list;
+                        rq_end_io_fn            *saved_end_io;
                 } flush;
         };
 
@@ -209,6 +211,7 @@ typedef int (merge_bvec_fn) (struct request_queue *, struct bvec_merge_data *,
 typedef void (softirq_done_fn)(struct request *);
 typedef int (dma_drain_needed_fn)(struct request *);
 typedef int (lld_busy_fn) (struct request_queue *q);
+typedef int (bsg_job_fn) (struct bsg_job *);
 
 enum blk_eh_timer_return {
         BLK_EH_NOT_HANDLED,
@@ -375,6 +378,8 @@ struct request_queue {
         struct mutex            sysfs_lock;
 
 #if defined(CONFIG_BLK_DEV_BSG)
+        bsg_job_fn              *bsg_job_fn;
+        int                     bsg_job_size;
         struct bsg_class_device bsg_dev;
 #endif
 
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index 8c7c2de7631a..8e9e4bc6d73b 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -14,7 +14,7 @@
 enum blktrace_cat {
         BLK_TC_READ     = 1 << 0,       /* reads */
         BLK_TC_WRITE    = 1 << 1,       /* writes */
-        BLK_TC_BARRIER  = 1 << 2,       /* barrier */
+        BLK_TC_FLUSH    = 1 << 2,       /* flush */
         BLK_TC_SYNC     = 1 << 3,       /* sync IO */
         BLK_TC_SYNCIO   = BLK_TC_SYNC,
         BLK_TC_QUEUE    = 1 << 4,       /* queueing/merging */
@@ -28,8 +28,9 @@ enum blktrace_cat {
         BLK_TC_META     = 1 << 12,      /* metadata */
         BLK_TC_DISCARD  = 1 << 13,      /* discard requests */
         BLK_TC_DRV_DATA = 1 << 14,      /* binary per-driver data */
+        BLK_TC_FUA      = 1 << 15,      /* fua requests */
 
-        BLK_TC_END      = 1 << 15,      /* only 16-bits, reminder */
+        BLK_TC_END      = 1 << 15,      /* we've run out of bits! */
 };
 
 #define BLK_TC_SHIFT            (16)
diff --git a/include/linux/bsg-lib.h b/include/linux/bsg-lib.h
new file mode 100644
index 000000000000..f55ab8cdc106
--- /dev/null
+++ b/include/linux/bsg-lib.h
@@ -0,0 +1,73 @@
+/*
+ *  BSG helper library
+ *
+ *  Copyright (C) 2008   James Smart, Emulex Corporation
+ *  Copyright (C) 2011   Red Hat, Inc.  All rights reserved.
+ *  Copyright (C) 2011   Mike Christie
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#ifndef _BLK_BSG_
+#define _BLK_BSG_
+
+#include <linux/blkdev.h>
+
+struct request;
+struct device;
+struct scatterlist;
+struct request_queue;
+
+struct bsg_buffer {
+        unsigned int payload_len;
+        int sg_cnt;
+        struct scatterlist *sg_list;
+};
+
+struct bsg_job {
+        struct device *dev;
+        struct request *req;
+
+        /* Transport/driver specific request/reply structs */
+        void *request;
+        void *reply;
+
+        unsigned int request_len;
+        unsigned int reply_len;
+        /*
+         * On entry : reply_len indicates the buffer size allocated for
+         * the reply.
+         *
+         * Upon completion : the message handler must set reply_len
+         *  to indicates the size of the reply to be returned to the
+         *  caller.
+         */
+
+        /* DMA payloads for the request/response */
+        struct bsg_buffer request_payload;
+        struct bsg_buffer reply_payload;
+
+        void *dd_data;          /* Used for driver-specific storage */
+};
+
+void bsg_job_done(struct bsg_job *job, int result,
+                  unsigned int reply_payload_rcv_len);
+int bsg_setup_queue(struct device *dev, struct request_queue *q, char *name,
+                    bsg_job_fn *job_fn, int dd_job_size);
+void bsg_request_fn(struct request_queue *q);
+void bsg_remove_queue(struct request_queue *q);
+void bsg_goose_queue(struct request_queue *q);
+
+#endif
diff --git a/include/linux/cred.h b/include/linux/cred.h
index 98f46efbe2d2..40308969ed00 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -269,7 +269,7 @@ static inline void put_cred(const struct cred *_cred)
  * since nobody else can modify it.
  */
 #define current_cred() \
-        (*(__force struct cred **)&current->cred)
+        rcu_dereference_protected(current->cred, 1)
 
 /**
  * __task_cred - Access a task's objective credentials
@@ -307,7 +307,7 @@ static inline void put_cred(const struct cred *_cred)
 #define get_current_user()                              \
 ({                                                      \
         struct user_struct *__u;                        \
-        struct cred *__cred;                            \
+        const struct cred *__cred;                      \
         __cred = current_cred();                        \
         __u = get_uid(__cred->user);                    \
         __u;                                            \
@@ -322,7 +322,7 @@ static inline void put_cred(const struct cred *_cred)
 #define get_current_groups()                            \
 ({                                                      \
         struct group_info *__groups;                    \
-        struct cred *__cred;                            \
+        const struct cred *__cred;                      \
         __cred = current_cred();                        \
         __groups = get_group_info(__cred->group_info);  \
         __groups;                                       \
diff --git a/include/linux/hash.h b/include/linux/hash.h
index 06d25c189cc5..b80506bdd733 100644
--- a/include/linux/hash.h
+++ b/include/linux/hash.h
@@ -63,7 +63,7 @@ static inline u32 hash_32(u32 val, unsigned int bits)
         return hash >> (32 - bits);
 }
 
-static inline unsigned long hash_ptr(void *ptr, unsigned int bits)
+static inline unsigned long hash_ptr(const void *ptr, unsigned int bits)
 {
         return hash_long((unsigned long)ptr, bits);
 }
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 87a06f345bd2..59517300a315 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -23,6 +23,7 @@
 #include <linux/errno.h>
 #include <linux/topology.h>
 #include <linux/wait.h>
+#include <linux/module.h>
 
 #include <asm/irq.h>
 #include <asm/ptrace.h>
@@ -547,7 +548,15 @@ static inline struct msi_desc *irq_data_get_msi(struct irq_data *d)
         return d->msi_desc;
 }
 
-int irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node);
+int __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
+                struct module *owner);
+
+static inline int irq_alloc_descs(int irq, unsigned int from, unsigned int cnt,
+                int node)
+{
+        return __irq_alloc_descs(irq, from, cnt, node, THIS_MODULE);
+}
+
 void irq_free_descs(unsigned int irq, unsigned int cnt);
 int irq_reserve_irqs(unsigned int from, unsigned int cnt);
 
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 2d921b35212c..150134ac709a 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -66,6 +66,7 @@ struct irq_desc {
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry   *dir;
 #endif
+        struct module           *owner;
         const char              *name;
 } ____cacheline_internodealigned_in_smp;
 
diff --git a/include/linux/loop.h b/include/linux/loop.h
index 66c194e2d9b9..683d69890119 100644
--- a/include/linux/loop.h
+++ b/include/linux/loop.h
@@ -64,7 +64,6 @@ struct loop_device {
 
         struct request_queue    *lo_queue;
         struct gendisk          *lo_disk;
-        struct list_head        lo_list;
 };
 
 #endif /* __KERNEL__ */
@@ -161,4 +160,8 @@ int loop_unregister_transfer(int number);
 #define LOOP_CHANGE_FD          0x4C06
 #define LOOP_SET_CAPACITY       0x4C07
 
+/* /dev/loop-control interface */
+#define LOOP_CTL_ADD            0x4C80
+#define LOOP_CTL_REMOVE         0x4C81
+#define LOOP_CTL_GET_FREE       0x4C82
 #endif
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index 18fd13028ba1..c309b1ecdc1c 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -40,6 +40,7 @@
 #define BTRFS_MINOR             234
 #define AUTOFS_MINOR            235
 #define MAPPER_CTRL_MINOR       236
+#define LOOP_CTRL_MINOR         237
 #define MISC_DYNAMIC_MINOR      255
 
 struct device;
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f2690cf49827..7438071b44aa 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -685,7 +685,7 @@ static inline void set_page_section(struct page *page, unsigned long section)
         page->flags |= (section & SECTIONS_MASK) << SECTIONS_PGSHIFT;
 }
 
-static inline unsigned long page_to_section(struct page *page)
+static inline unsigned long page_to_section(const struct page *page)
 {
         return (page->flags >> SECTIONS_PGSHIFT) & SECTIONS_MASK;
 }
@@ -720,7 +720,7 @@ static inline void set_page_links(struct page *page, enum zone_type zone,
 
 static __always_inline void *lowmem_page_address(const struct page *page)
 {
-        return __va(PFN_PHYS(page_to_pfn((struct page *)page)));
+        return __va(PFN_PHYS(page_to_pfn(page)));
 }
 
 #if defined(CONFIG_HIGHMEM) && !defined(WANT_PAGE_VIRTUAL)
@@ -737,7 +737,7 @@ static __always_inline void *lowmem_page_address(const struct page *page)
 #endif
 
 #if defined(HASHED_PAGE_VIRTUAL)
-void *page_address(struct page *page);
+void *page_address(const struct page *page);
 void set_page_address(struct page *page, void *virtual);
 void page_address_init(void);
 #endif
@@ -962,6 +962,8 @@ int invalidate_inode_page(struct page *page);
 #ifdef CONFIG_MMU
 extern int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                         unsigned long address, unsigned int flags);
+extern int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+                            unsigned long address, unsigned int fault_flags);
 #else
 static inline int handle_mm_fault(struct mm_struct *mm,
                         struct vm_area_struct *vma, unsigned long address,
@@ -971,6 +973,14 @@ static inline int handle_mm_fault(struct mm_struct *mm,
         BUG();
         return VM_FAULT_SIGBUS;
 }
+static inline int fixup_user_fault(struct task_struct *tsk,
+                struct mm_struct *mm, unsigned long address,
+                unsigned int fault_flags)
+{
+        /* should never happen if there's no MMU */
+        BUG();
+        return -EFAULT;
+}
 #endif
 
 extern int make_pages_present(unsigned long addr, unsigned long end);
@@ -988,8 +998,6 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 int get_user_pages_fast(unsigned long start, int nr_pages, int write,
                         struct page **pages);
 struct page *get_dump_page(unsigned long addr);
-extern int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
-                            unsigned long address, unsigned int fault_flags);
 
 extern int try_to_release_page(struct page * page, gfp_t gfp_mask);
 extern void do_invalidatepage(struct page *page, unsigned long offset);
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index 0f83858147a6..1d09562ccf73 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -56,8 +56,6 @@ struct mmc_ios {
 #define MMC_TIMING_UHS_SDR104   4
 #define MMC_TIMING_UHS_DDR50    5
 
-        unsigned char   ddr;                    /* dual data rate used */
-
 #define MMC_SDR_MODE            0
 #define MMC_1_2V_DDR_MODE       1
 #define MMC_1_8V_DDR_MODE       2
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 2e17c5dbdcb8..180540a84d37 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -29,7 +29,7 @@
 #define MAX_LINKS 32            
 
 struct sockaddr_nl {
-        sa_family_t     nl_family;      /* AF_NETLINK   */
+        __kernel_sa_family_t    nl_family;      /* AF_NETLINK   */
         unsigned short  nl_pad;         /* zero         */
         __u32           nl_pid;         /* port ID      */
         __u32           nl_groups;      /* multicast groups mask */
diff --git a/include/linux/of.h b/include/linux/of.h
index 0085bb01c041..9180dc5cb00b 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -256,6 +256,13 @@ static inline int of_property_read_string(struct device_node *np,
         return -ENOSYS;
 }
 
+static inline const void *of_get_property(const struct device_node *node,
+                                const char *name,
+                                int *lenp)
+{
+        return NULL;
+}
+
 #endif /* CONFIG_OF */
 
 static inline int of_property_read_u32(const struct device_node *np,
diff --git a/include/linux/pci.h b/include/linux/pci.h
index f27893b3b724..8c230cbcbb48 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -251,7 +251,8 @@ struct pci_dev {
         u8              revision;       /* PCI revision, low byte of class word */
         u8              hdr_type;       /* PCI header type (`multi' flag masked out) */
         u8              pcie_cap;       /* PCI-E capability offset */
-        u8              pcie_type;      /* PCI-E device/port type */
+        u8              pcie_type:4;    /* PCI-E device/port type */
+        u8              pcie_mpss:3;    /* PCI-E Max Payload Size Supported */
         u8              rom_base_reg;   /* which config register controls the ROM */
         u8              pin;            /* which interrupt pin this device uses */
 
@@ -617,6 +618,16 @@ struct pci_driver {
 /* these external functions are only available when PCI support is enabled */
 #ifdef CONFIG_PCI
 
+extern void pcie_bus_configure_settings(struct pci_bus *bus, u8 smpss);
+
+enum pcie_bus_config_types {
+        PCIE_BUS_PERFORMANCE,
+        PCIE_BUS_SAFE,
+        PCIE_BUS_PEER2PEER,
+};
+
+extern enum pcie_bus_config_types pcie_bus_config;
+
 extern struct bus_type pci_bus_type;
 
 /* Do NOT directly access these two variables, unless you are arch specific pci
@@ -796,10 +807,13 @@ int pcix_get_mmrbc(struct pci_dev *dev);
 int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc);
 int pcie_get_readrq(struct pci_dev *dev);
 int pcie_set_readrq(struct pci_dev *dev, int rq);
+int pcie_get_mps(struct pci_dev *dev);
+int pcie_set_mps(struct pci_dev *dev, int mps);
 int __pci_reset_function(struct pci_dev *dev);
 int pci_reset_function(struct pci_dev *dev);
 void pci_update_resource(struct pci_dev *dev, int resno);
 int __must_check pci_assign_resource(struct pci_dev *dev, int i);
+int __must_check pci_reassign_resource(struct pci_dev *dev, int i, resource_size_t add_size, resource_size_t align);
 int pci_select_bars(struct pci_dev *dev, unsigned long flags);
 
 /* ROM control related routines */
diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
index 21097cb086fe..f9ec1736a116 100644
--- a/include/linux/pm_domain.h
+++ b/include/linux/pm_domain.h
@@ -72,8 +72,6 @@ extern int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
 extern void pm_genpd_init(struct generic_pm_domain *genpd,
                           struct dev_power_governor *gov, bool is_off);
 extern int pm_genpd_poweron(struct generic_pm_domain *genpd);
-extern void pm_genpd_poweroff_unused(void);
-extern void genpd_queue_power_off_work(struct generic_pm_domain *genpd);
 #else
 static inline int pm_genpd_add_device(struct generic_pm_domain *genpd,
                                       struct device *dev)
@@ -101,8 +99,14 @@ static inline int pm_genpd_poweron(struct generic_pm_domain *genpd)
 {
         return -ENOSYS;
 }
-static inline void pm_genpd_poweroff_unused(void) {}
+#endif
+
+#ifdef CONFIG_PM_GENERIC_DOMAINS_RUNTIME
+extern void genpd_queue_power_off_work(struct generic_pm_domain *genpd);
+extern void pm_genpd_poweroff_unused(void);
+#else
 static inline void genpd_queue_power_off_work(struct generic_pm_domain *gpd) {}
+static inline void pm_genpd_poweroff_unused(void) {}
 #endif
 
 #endif /* _LINUX_PM_DOMAIN_H */
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index b27ebea25660..93f4d035076b 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -97,6 +97,9 @@ struct rtc_pll_info {
 #define RTC_AF 0x20     /* Alarm interrupt */
 #define RTC_UF 0x10     /* Update interrupt for 1Hz RTC */
 
+
+#define RTC_MAX_FREQ    8192
+
 #ifdef __KERNEL__
 
 #include <linux/types.h>
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 20b03bf94748..4ac2c0578e0f 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1767,6 +1767,7 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
 #define PF_DUMPCORE     0x00000200      /* dumped core */
 #define PF_SIGNALED     0x00000400      /* killed by a signal */
 #define PF_MEMALLOC     0x00000800      /* Allocating memory */
+#define PF_NPROC_EXCEEDED 0x00001000    /* set_user noticed that RLIMIT_NPROC was exceeded */
 #define PF_USED_MATH    0x00002000      /* if unset the fpu must be initialized before use */
 #define PF_FREEZING     0x00004000      /* freeze in progress. do not account to load */
 #define PF_NOFREEZE     0x00008000      /* this thread should not be frozen */
diff --git a/include/linux/socket.h b/include/linux/socket.h
index e17f82266639..d0e77f607a79 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -8,8 +8,10 @@
 #define _K_SS_ALIGNSIZE (__alignof__ (struct sockaddr *))
                                 /* Implementation specific desired alignment */
 
+typedef unsigned short __kernel_sa_family_t;
+
 struct __kernel_sockaddr_storage {
-        unsigned short  ss_family;              /* address family */
+        __kernel_sa_family_t    ss_family;              /* address family */
         /* Following field(s) are implementation specific */
         char            __data[_K_SS_MAXSIZE - sizeof(unsigned short)];
                                 /* space to achieve desired size, */
@@ -35,7 +37,7 @@ struct seq_file;
 extern void socket_seq_show(struct seq_file *seq);
 #endif
 
-typedef unsigned short  sa_family_t;
+typedef __kernel_sa_family_t    sa_family_t;
 
 /*
  *      1003.1g requires sa_family_t and that sa_data is char.
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index caaff5f5f39f..b897d6e6d0a5 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -238,7 +238,7 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
 {
         __u8 flags = 0;
 
-        if (inet_sk(sk)->transparent)
+        if (inet_sk(sk)->transparent || inet_sk(sk)->hdrincl)
                 flags |= FLOWI_FLAG_ANYSRC;
         if (sk->sk_protocol == IPPROTO_TCP)
                 flags |= FLOWI_FLAG_PRECOW_METRICS;
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index bf366547da25..05c5e61f0a7c 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -8,6 +8,8 @@
 #include <linux/blkdev.h>
 #include <linux/tracepoint.h>
 
+#define RWBS_LEN        8
+
 DECLARE_EVENT_CLASS(block_rq_with_error,
 
         TP_PROTO(struct request_queue *q, struct request *rq),
@@ -19,7 +21,7 @@ DECLARE_EVENT_CLASS(block_rq_with_error,
                 __field(  sector_t,     sector                  )
                 __field(  unsigned int, nr_sector               )
                 __field(  int,          errors                  )
-                __array(  char,         rwbs,   6               )
+                __array(  char,         rwbs,   RWBS_LEN        )
                 __dynamic_array( char,  cmd,    blk_cmd_buf_len(rq)     )
         ),
 
@@ -104,7 +106,7 @@ DECLARE_EVENT_CLASS(block_rq,
                 __field(  sector_t,     sector                  )
                 __field(  unsigned int, nr_sector               )
                 __field(  unsigned int, bytes                   )
-                __array(  char,         rwbs,   6               )
+                __array(  char,         rwbs,   RWBS_LEN        )
                 __array(  char,         comm,   TASK_COMM_LEN   )
                 __dynamic_array( char,  cmd,    blk_cmd_buf_len(rq)     )
         ),
@@ -183,7 +185,7 @@ TRACE_EVENT(block_bio_bounce,
                 __field( dev_t,         dev                     )
                 __field( sector_t,      sector                  )
                 __field( unsigned int,  nr_sector               )
-                __array( char,          rwbs,   6               )
+                __array( char,          rwbs,   RWBS_LEN        )
                 __array( char,          comm,   TASK_COMM_LEN   )
         ),
 
@@ -222,7 +224,7 @@ TRACE_EVENT(block_bio_complete,
                 __field( sector_t,      sector          )
                 __field( unsigned,      nr_sector       )
                 __field( int,           error           )
-                __array( char,          rwbs,   6       )
+                __array( char,          rwbs,   RWBS_LEN)
         ),
 
         TP_fast_assign(
@@ -249,7 +251,7 @@ DECLARE_EVENT_CLASS(block_bio,
                 __field( dev_t,         dev                     )
                 __field( sector_t,      sector                  )
                 __field( unsigned int,  nr_sector               )
-                __array( char,          rwbs,   6               )
+                __array( char,          rwbs,   RWBS_LEN        )
                 __array( char,          comm,   TASK_COMM_LEN   )
         ),
 
@@ -321,7 +323,7 @@ DECLARE_EVENT_CLASS(block_get_rq,
                 __field( dev_t,         dev                     )
                 __field( sector_t,      sector                  )
                 __field( unsigned int,  nr_sector               )
-                __array( char,          rwbs,   6               )
+                __array( char,          rwbs,   RWBS_LEN        )
                 __array( char,          comm,   TASK_COMM_LEN   )
         ),
 
@@ -456,7 +458,7 @@ TRACE_EVENT(block_split,
                 __field( dev_t,         dev                             )
                 __field( sector_t,      sector                          )
                 __field( sector_t,      new_sector                      )
-                __array( char,          rwbs,           6               )
+                __array( char,          rwbs,           RWBS_LEN        )
                 __array( char,          comm,           TASK_COMM_LEN   )
         ),
 
@@ -498,7 +500,7 @@ TRACE_EVENT(block_bio_remap,
                 __field( unsigned int,  nr_sector       )
                 __field( dev_t,         old_dev         )
                 __field( sector_t,      old_sector      )
-                __array( char,          rwbs,   6       )
+                __array( char,          rwbs,   RWBS_LEN)
         ),
 
         TP_fast_assign(
@@ -542,7 +544,7 @@ TRACE_EVENT(block_rq_remap,
                 __field( unsigned int,  nr_sector       )
                 __field( dev_t,         old_dev         )
                 __field( sector_t,      old_sector      )
-                __array( char,          rwbs,   6       )
+                __array( char,          rwbs,   RWBS_LEN)
         ),
 
         TP_fast_assign(
diff --git a/kernel/Makefile b/kernel/Makefile
index d06467fc8f7c..eca595e2fd52 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -10,7 +10,7 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o \
             kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
             hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
             notifier.o ksysfs.o pm_qos_params.o sched_clock.o cred.o \
-            async.o range.o jump_label.o
+            async.o range.o
 obj-y += groups.o
 
 ifdef CONFIG_FUNCTION_TRACER
@@ -107,6 +107,7 @@ obj-$(CONFIG_PERF_EVENTS) += events/
 obj-$(CONFIG_USER_RETURN_NOTIFIER) += user-return-notifier.o
 obj-$(CONFIG_PADATA) += padata.o
 obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
+obj-$(CONFIG_JUMP_LABEL) += jump_label.o
 
 ifneq ($(CONFIG_SCHED_OMIT_FRAME_POINTER),y)
 # According to Alan Modra <alan@linuxcare.com.au>, the -fno-omit-frame-pointer is
diff --git a/kernel/cred.c b/kernel/cred.c
index 174fa84eca30..8ef31f53c44c 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -508,10 +508,8 @@ int commit_creds(struct cred *new)
                 key_fsgid_changed(task);
 
         /* do it
-         * - What if a process setreuid()'s and this brings the
-         *   new uid over his NPROC rlimit?  We can check this now
-         *   cheaply with the new uid cache, so if it matters
-         *   we should be checking for it.  -DaveM
+         * RLIMIT_NPROC limits on user->processes have already been checked
+         * in set_user().
          */
         alter_cred_subscribers(new, 2);
         if (new->user != old->user)
diff --git a/kernel/fork.c b/kernel/fork.c
index e7ceaca89609..8e6b6f4fb272 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1111,6 +1111,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                     p->real_cred->user != INIT_USER)
                         goto bad_fork_free;
         }
+        current->flags &= ~PF_NPROC_EXCEEDED;
 
         retval = copy_creds(p, clone_flags);
         if (retval < 0)
diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index 3a2cab407b93..e38544dddb18 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -246,7 +246,7 @@ void irq_setup_generic_chip(struct irq_chip_generic *gc, u32 msk,
                 gc->mask_cache = irq_reg_readl(gc->reg_base + ct->regs.mask);
 
         for (i = gc->irq_base; msk; msk >>= 1, i++) {
-                if (!msk & 0x01)
+                if (!(msk & 0x01))
                         continue;
 
                 if (flags & IRQ_GC_INIT_NESTED_LOCK)
@@ -301,7 +301,7 @@ void irq_remove_generic_chip(struct irq_chip_generic *gc, u32 msk,
         raw_spin_unlock(&gc_lock);
 
         for (; msk; msk >>= 1, i++) {
-                if (!msk & 0x01)
+                if (!(msk & 0x01))
                         continue;
 
                 /* Remove handler first. That will mask the irq line */
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 4c60a50e66b2..039b889ea053 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -70,7 +70,8 @@ static inline void desc_smp_init(struct irq_desc *desc, int node) { }
 static inline int desc_node(struct irq_desc *desc) { return 0; }
 #endif
 
-static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node)
+static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
+                struct module *owner)
 {
         int cpu;
 
@@ -86,6 +87,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node)
         desc->irq_count = 0;
         desc->irqs_unhandled = 0;
         desc->name = NULL;
+        desc->owner = owner;
         for_each_possible_cpu(cpu)
                 *per_cpu_ptr(desc->kstat_irqs, cpu) = 0;
         desc_smp_init(desc, node);
@@ -128,7 +130,7 @@ static void free_masks(struct irq_desc *desc)
 static inline void free_masks(struct irq_desc *desc) { }
 #endif
 
-static struct irq_desc *alloc_desc(int irq, int node)
+static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
 {
         struct irq_desc *desc;
         gfp_t gfp = GFP_KERNEL;
@@ -147,7 +149,7 @@ static struct irq_desc *alloc_desc(int irq, int node)
         raw_spin_lock_init(&desc->lock);
         lockdep_set_class(&desc->lock, &irq_desc_lock_class);
 
-        desc_set_defaults(irq, desc, node);
+        desc_set_defaults(irq, desc, node, owner);
 
         return desc;
 
@@ -173,13 +175,14 @@ static void free_desc(unsigned int irq)
         kfree(desc);
 }
 
-static int alloc_descs(unsigned int start, unsigned int cnt, int node)
+static int alloc_descs(unsigned int start, unsigned int cnt, int node,
+                       struct module *owner)
 {
         struct irq_desc *desc;
         int i;
 
         for (i = 0; i < cnt; i++) {
-                desc = alloc_desc(start + i, node);
+                desc = alloc_desc(start + i, node, owner);
                 if (!desc)
                         goto err;
                 mutex_lock(&sparse_irq_lock);
@@ -227,7 +230,7 @@ int __init early_irq_init(void)
                 nr_irqs = initcnt;
 
         for (i = 0; i < initcnt; i++) {
-                desc = alloc_desc(i, node);
+                desc = alloc_desc(i, node, NULL);
                 set_bit(i, allocated_irqs);
                 irq_insert_desc(i, desc);
         }
@@ -261,7 +264,7 @@ int __init early_irq_init(void)
                 alloc_masks(&desc[i], GFP_KERNEL, node);
                 raw_spin_lock_init(&desc[i].lock);
                 lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
-                desc_set_defaults(i, &desc[i], node);
+                desc_set_defaults(i, &desc[i], node, NULL);
         }
         return arch_early_irq_init();
 }
@@ -276,8 +279,16 @@ static void free_desc(unsigned int irq)
         dynamic_irq_cleanup(irq);
 }
 
-static inline int alloc_descs(unsigned int start, unsigned int cnt, int node)
+static inline int alloc_descs(unsigned int start, unsigned int cnt, int node,
+                              struct module *owner)
 {
+        u32 i;
+
+        for (i = 0; i < cnt; i++) {
+                struct irq_desc *desc = irq_to_desc(start + i);
+
+                desc->owner = owner;
+        }
         return start;
 }
 
@@ -333,11 +344,13 @@ EXPORT_SYMBOL_GPL(irq_free_descs);
  * @from:       Start the search from this irq number
  * @cnt:        Number of consecutive irqs to allocate.
  * @node:       Preferred node on which the irq descriptor should be allocated
+ * @owner:      Owning module (can be NULL)
  *
  * Returns the first irq number or error code
  */
 int __ref
-irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)
+__irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
+                  struct module *owner)
 {
         int start, ret;
 
@@ -366,13 +379,13 @@ irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)
 
         bitmap_set(allocated_irqs, start, cnt);
         mutex_unlock(&sparse_irq_lock);
-        return alloc_descs(start, cnt, node);
+        return alloc_descs(start, cnt, node, owner);
 
 err:
         mutex_unlock(&sparse_irq_lock);
         return ret;
 }
-EXPORT_SYMBOL_GPL(irq_alloc_descs);
+EXPORT_SYMBOL_GPL(__irq_alloc_descs);
 
 /**
  * irq_reserve_irqs - mark irqs allocated
@@ -440,7 +453,7 @@ void dynamic_irq_cleanup(unsigned int irq)
         unsigned long flags;
 
         raw_spin_lock_irqsave(&desc->lock, flags);
-        desc_set_defaults(irq, desc, desc_node(desc));
+        desc_set_defaults(irq, desc, desc_node(desc), NULL);
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
 
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 0a7840aeb0fb..2e9425889fa8 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -883,6 +883,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
         if (desc->irq_data.chip == &no_irq_chip)
                 return -ENOSYS;
+        if (!try_module_get(desc->owner))
+                return -ENODEV;
         /*
          * Some drivers like serial.c use request_irq() heavily,
          * so we have to be careful not to interfere with a
@@ -906,8 +908,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
          */
         nested = irq_settings_is_nested_thread(desc);
         if (nested) {
-                if (!new->thread_fn)
-                        return -EINVAL;
+                if (!new->thread_fn) {
+                        ret = -EINVAL;
+                        goto out_mput;
+                }
                 /*
                  * Replace the primary handler which was provided from
                  * the driver for non nested interrupt handling by the
@@ -929,8 +933,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
                 t = kthread_create(irq_thread, new, "irq/%d-%s", irq,
                                    new->name);
-                if (IS_ERR(t))
-                        return PTR_ERR(t);
+                if (IS_ERR(t)) {
+                        ret = PTR_ERR(t);
+                        goto out_mput;
+                }
                 /*
                  * We keep the reference to the task struct even if
                  * the thread dies to avoid that the interrupt code
@@ -1095,6 +1101,8 @@ out_thread:
                         kthread_stop(t);
                 put_task_struct(t);
         }
+out_mput:
+        module_put(desc->owner);
         return ret;
 }
 
@@ -1203,6 +1211,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                 put_task_struct(action->thread);
         }
 
+        module_put(desc->owner);
         return action;
 }
 
@@ -1322,6 +1331,7 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
                 if (!thread_fn)
                         return -EINVAL;
                 handler = irq_default_primary_handler;
+                irqflags |= IRQF_ONESHOT;
         }
 
         action = kzalloc(sizeof(struct irqaction), GFP_KERNEL);
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 8c24294e477f..91d67ce3a8d5 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -3111,7 +3111,13 @@ static int match_held_lock(struct held_lock *hlock, struct lockdep_map *lock)
                 if (!class)
                         class = look_up_lock_class(lock, 0);
 
-                if (DEBUG_LOCKS_WARN_ON(!class))
+                /*
+                 * If look_up_lock_class() failed to find a class, we're trying
+                 * to test if we hold a lock that has never yet been acquired.
+                 * Clearly if the lock hasn't been acquired _ever_, we're not
+                 * holding it either, so report failure.
+                 */
+                if (!class)
                         return 0;
 
                 if (DEBUG_LOCKS_WARN_ON(!hlock->nest_lock))
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index b1914cb9095c..3744c594b19b 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -231,3 +231,7 @@ config PM_CLK
 config PM_GENERIC_DOMAINS
         bool
         depends on PM
+
+config PM_GENERIC_DOMAINS_RUNTIME
+        def_bool y
+        depends on PM_RUNTIME && PM_GENERIC_DOMAINS
diff --git a/kernel/printk.c b/kernel/printk.c
index 37dff3429adb..836a2ae0ac31 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -318,8 +318,10 @@ static int check_syslog_permissions(int type, bool from_file)
                         return 0;
                 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
                 if (capable(CAP_SYS_ADMIN)) {
-                        WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
-                                 "but no CAP_SYSLOG (deprecated).\n");
+                        printk_once(KERN_WARNING "%s (%d): "
+                                 "Attempt to access syslog with CAP_SYS_ADMIN "
+                                 "but no CAP_SYSLOG (deprecated).\n",
+                                 current->comm, task_pid_nr(current));
                         return 0;
                 }
                 return -EPERM;
diff --git a/kernel/sys.c b/kernel/sys.c
index a101ba36c444..dd948a1fca4c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -621,11 +621,18 @@ static int set_user(struct cred *new)
         if (!new_user)
                 return -EAGAIN;
 
+        /*
+         * We don't fail in case of NPROC limit excess here because too many
+         * poorly written programs don't check set*uid() return code, assuming
+         * it never fails if called by root.  We may still enforce NPROC limit
+         * for programs doing set*uid()+execve() by harmlessly deferring the
+         * failure to the execve() stage.
+         */
         if (atomic_read(&new_user->processes) >= rlimit(RLIMIT_NPROC) &&
-                        new_user != INIT_USER) {
-                free_uid(new_user);
-                return -EAGAIN;
-        }
+                        new_user != INIT_USER)
+                current->flags |= PF_NPROC_EXCEEDED;
+        else
+                current->flags &= ~PF_NPROC_EXCEEDED;
 
         free_uid(new->user);
         new->user = new_user;
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 2ad39e556cb4..cd3134510f3d 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -82,7 +82,7 @@ config EVENT_POWER_TRACING_DEPRECATED
           power:power_frequency
           This is for userspace compatibility
           and will vanish after 5 kernel iterations,
-          namely 2.6.41.
+          namely 3.1.
 
 config CONTEXT_SWITCH_TRACER
         bool
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 6957aa298dfa..7c910a5593a6 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -206,6 +206,8 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
         what |= MASK_TC_BIT(rw, RAHEAD);
         what |= MASK_TC_BIT(rw, META);
         what |= MASK_TC_BIT(rw, DISCARD);
+        what |= MASK_TC_BIT(rw, FLUSH);
+        what |= MASK_TC_BIT(rw, FUA);
 
         pid = tsk->pid;
         if (act_log_check(bt, what, sector, pid))
@@ -1054,6 +1056,9 @@ static void fill_rwbs(char *rwbs, const struct blk_io_trace *t)
                 goto out;
         }
 
+        if (tc & BLK_TC_FLUSH)
+                rwbs[i++] = 'F';
+
         if (tc & BLK_TC_DISCARD)
                 rwbs[i++] = 'D';
         else if (tc & BLK_TC_WRITE)
@@ -1063,10 +1068,10 @@ static void fill_rwbs(char *rwbs, const struct blk_io_trace *t)
         else
                 rwbs[i++] = 'N';
 
+        if (tc & BLK_TC_FUA)
+                rwbs[i++] = 'F';
         if (tc & BLK_TC_AHEAD)
                 rwbs[i++] = 'A';
-        if (tc & BLK_TC_BARRIER)
-                rwbs[i++] = 'B';
         if (tc & BLK_TC_SYNC)
                 rwbs[i++] = 'S';
         if (tc & BLK_TC_META)
@@ -1132,7 +1137,7 @@ typedef int (blk_log_action_t) (struct trace_iterator *iter, const char *act);
 
 static int blk_log_action_classic(struct trace_iterator *iter, const char *act)
 {
-        char rwbs[6];
+        char rwbs[RWBS_LEN];
         unsigned long long ts  = iter->ts;
         unsigned long nsec_rem = do_div(ts, NSEC_PER_SEC);
         unsigned secs          = (unsigned long)ts;
@@ -1148,7 +1153,7 @@ static int blk_log_action_classic(struct trace_iterator *iter, const char *act)
 
 static int blk_log_action(struct trace_iterator *iter, const char *act)
 {
-        char rwbs[6];
+        char rwbs[RWBS_LEN];
         const struct blk_io_trace *t = te_blk_io_trace(iter->ent);
 
         fill_rwbs(rwbs, t);
@@ -1561,7 +1566,7 @@ static const struct {
 } mask_maps[] = {
         { BLK_TC_READ,          "read"          },
         { BLK_TC_WRITE,         "write"         },
-        { BLK_TC_BARRIER,       "barrier"       },
+        { BLK_TC_FLUSH,         "flush"         },
         { BLK_TC_SYNC,          "sync"          },
         { BLK_TC_QUEUE,         "queue"         },
         { BLK_TC_REQUEUE,       "requeue"       },
@@ -1573,6 +1578,7 @@ static const struct {
         { BLK_TC_META,          "meta"          },
         { BLK_TC_DISCARD,       "discard"       },
         { BLK_TC_DRV_DATA,      "drv_data"      },
+        { BLK_TC_FUA,           "fua"           },
 };
 
 static int blk_trace_str2mask(const char *str)
@@ -1788,6 +1794,9 @@ void blk_fill_rwbs(char *rwbs, u32 rw, int bytes)
 {
         int i = 0;
 
+        if (rw & REQ_FLUSH)
+                rwbs[i++] = 'F';
+
         if (rw & WRITE)
                 rwbs[i++] = 'W';
         else if (rw & REQ_DISCARD)
@@ -1797,6 +1806,8 @@ void blk_fill_rwbs(char *rwbs, u32 rw, int bytes)
         else
                 rwbs[i++] = 'N';
 
+        if (rw & REQ_FUA)
+                rwbs[i++] = 'F';
         if (rw & REQ_RAHEAD)
                 rwbs[i++] = 'A';
         if (rw & REQ_SYNC)
diff --git a/mm/highmem.c b/mm/highmem.c
index 693394daa2ed..5ef672c07f75 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -326,7 +326,7 @@ static struct page_address_slot {
         spinlock_t lock;                        /* Protect this bucket's list */
 } ____cacheline_aligned_in_smp page_address_htable[1<<PA_HASH_ORDER];
 
-static struct page_address_slot *page_slot(struct page *page)
+static struct page_address_slot *page_slot(const struct page *page)
 {
         return &page_address_htable[hash_ptr(page, PA_HASH_ORDER)];
 }
@@ -337,7 +337,7 @@ static struct page_address_slot *page_slot(struct page *page)
  *
  * Returns the page's virtual address.
  */
-void *page_address(struct page *page)
+void *page_address(const struct page *page)
 {
         unsigned long flags;
         void *ret;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f4ec4e7ca4cd..930de9437271 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2091,6 +2091,7 @@ struct memcg_stock_pcp {
 #define FLUSHING_CACHED_CHARGE  (0)
 };
 static DEFINE_PER_CPU(struct memcg_stock_pcp, memcg_stock);
+static DEFINE_MUTEX(percpu_charge_mutex);
 
 /*
  * Try to consume stocked charge on this cpu. If success, one page is consumed
@@ -2197,8 +2198,7 @@ static void drain_all_stock(struct mem_cgroup *root_mem, bool sync)
 
         for_each_online_cpu(cpu) {
                 struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu);
-                if (mem_cgroup_same_or_subtree(root_mem, stock->cached) &&
-                                test_bit(FLUSHING_CACHED_CHARGE, &stock->flags))
+                if (test_bit(FLUSHING_CACHED_CHARGE, &stock->flags))
                         flush_work(&stock->work);
         }
 out:
@@ -2213,14 +2213,22 @@ out:
  */
 static void drain_all_stock_async(struct mem_cgroup *root_mem)
 {
+        /*
+         * If someone calls draining, avoid adding more kworker runs.
+         */
+        if (!mutex_trylock(&percpu_charge_mutex))
+                return;
         drain_all_stock(root_mem, false);
+        mutex_unlock(&percpu_charge_mutex);
 }
 
 /* This is a synchronous drain interface. */
 static void drain_all_stock_sync(struct mem_cgroup *root_mem)
 {
         /* called when force_empty is called */
+        mutex_lock(&percpu_charge_mutex);
         drain_all_stock(root_mem, true);
+        mutex_unlock(&percpu_charge_mutex);
 }
 
 /*
diff --git a/mm/slub.c b/mm/slub.c
index eb5a8f93338a..9f662d70eb47 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -701,7 +701,7 @@ static u8 *check_bytes(u8 *start, u8 value, unsigned int bytes)
                 return check_bytes8(start, value, bytes);
 
         value64 = value | value << 8 | value << 16 | value << 24;
-        value64 = value64 | value64 << 32;
+        value64 = (value64 & 0xffffffff) | value64 << 32;
         prefix = 8 - ((unsigned long)start) % 8;
 
         if (prefix) {
@@ -1854,7 +1854,7 @@ redo:
 
         new.frozen = 0;
 
-        if (!new.inuse && n->nr_partial < s->min_partial)
+        if (!new.inuse && n->nr_partial > s->min_partial)
                 m = M_FREE;
         else if (new.freelist) {
                 m = M_PARTIAL;
@@ -2387,11 +2387,13 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
 slab_empty:
         if (prior) {
                 /*
-                 * Slab still on the partial list.
+                 * Slab on the partial list.
                  */
                 remove_partial(n, page);
                 stat(s, FREE_REMOVE_PARTIAL);
-        }
+        } else
+                /* Slab must be on the full list */
+                remove_full(s, page);
 
         spin_unlock_irqrestore(&n->list_lock, flags);
         stat(s, FREE_SLAB);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 464621d18eb2..7ef0903058ee 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -725,9 +725,10 @@ static void free_unmap_vmap_area_addr(unsigned long addr)
 #define VMAP_BBMAP_BITS_MIN     (VMAP_MAX_ALLOC*2)
 #define VMAP_MIN(x, y)          ((x) < (y) ? (x) : (y)) /* can't use min() */
 #define VMAP_MAX(x, y)          ((x) > (y) ? (x) : (y)) /* can't use max() */
-#define VMAP_BBMAP_BITS         VMAP_MIN(VMAP_BBMAP_BITS_MAX,           \
-                                        VMAP_MAX(VMAP_BBMAP_BITS_MIN,   \
-                                                VMALLOC_PAGES / NR_CPUS / 16))
+#define VMAP_BBMAP_BITS         \
+                VMAP_MIN(VMAP_BBMAP_BITS_MAX,   \
+                VMAP_MAX(VMAP_BBMAP_BITS_MIN,   \
+                        VMALLOC_PAGES / roundup_pow_of_two(NR_CPUS) / 16))
 
 #define VMAP_BLOCK_SIZE         (VMAP_BBMAP_BITS * PAGE_SIZE)
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 3176e2e13d9b..2cdf0070419f 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -417,6 +417,7 @@ put_back:
 int br_del_if(struct net_bridge *br, struct net_device *dev)
 {
         struct net_bridge_port *p;
+        bool changed_addr;
 
         p = br_port_get_rtnl(dev);
         if (!p || p->br != br)
@@ -425,9 +426,12 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         del_nbp(p);
 
         spin_lock_bh(&br->lock);
-        br_stp_recalculate_bridge_id(br);
+        changed_addr = br_stp_recalculate_bridge_id(br);
         spin_unlock_bh(&br->lock);
 
+        if (changed_addr)
+                call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
+
         netdev_update_features(br->dev);
 
         return 0;
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 6545ee9591d1..a76b62135558 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -34,6 +34,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         struct net_device *dev = ptr;
         struct net_bridge_port *p;
         struct net_bridge *br;
+        bool changed_addr;
         int err;
 
         /* register of bridge completed, add sysfs entries */
@@ -57,8 +58,12 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         case NETDEV_CHANGEADDR:
                 spin_lock_bh(&br->lock);
                 br_fdb_changeaddr(p, dev->dev_addr);
-                br_stp_recalculate_bridge_id(br);
+                changed_addr = br_stp_recalculate_bridge_id(br);
                 spin_unlock_bh(&br->lock);
+
+                if (changed_addr)
+                        call_netdevice_notifiers(NETDEV_CHANGEADDR, br->dev);
+
                 break;
 
         case NETDEV_CHANGE:
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 2b5ca1a0054d..5864cc491369 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1198,7 +1198,8 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table)
 
         if (table->check && table->check(newinfo, table->valid_hooks)) {
                 BUGPRINT("The table doesn't like its own initial data, lol\n");
-                return ERR_PTR(-EINVAL);
+                ret = -EINVAL;
+                goto free_chainstack;
         }
 
         table->private = newinfo;
diff --git a/net/core/scm.c b/net/core/scm.c
index 4c1ef026d695..811b53fb330e 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -192,7 +192,7 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                                         goto error;
 
                                 cred->uid = cred->euid = p->creds.uid;
-                                cred->gid = cred->egid = p->creds.uid;
+                                cred->gid = cred->egid = p->creds.gid;
                                 put_cred(p->cred);
                                 p->cred = cred;
                         }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 77d3eded665a..8c6563361ab5 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -122,6 +122,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
+        skb_dst_force(newskb);
         netif_rx_ni(newskb);
         return 0;
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ab0c9efd1efa..8905e92f896a 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1067,7 +1067,7 @@ EXPORT_SYMBOL(compat_ip_setsockopt);
  */
 
 static int do_ip_getsockopt(struct sock *sk, int level, int optname,
-                            char __user *optval, int __user *optlen)
+                            char __user *optval, int __user *optlen, unsigned flags)
 {
         struct inet_sock *inet = inet_sk(sk);
         int val;
@@ -1240,7 +1240,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
 
                 msg.msg_control = optval;
                 msg.msg_controllen = len;
-                msg.msg_flags = 0;
+                msg.msg_flags = flags;
 
                 if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                         struct in_pktinfo info;
@@ -1294,7 +1294,7 @@ int ip_getsockopt(struct sock *sk, int level,
 {
         int err;
 
-        err = do_ip_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ip_getsockopt(sk, level, optname, optval, optlen, 0);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
         if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS &&
@@ -1327,7 +1327,8 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
                 return compat_mc_getsockopt(sk, level, optname, optval, optlen,
                         ip_getsockopt);
 
-        err = do_ip_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ip_getsockopt(sk, level, optname, optval, optlen,
+                MSG_CMSG_COMPAT);
 
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 2e97e3ec1eb7..929b27bdeb79 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -18,17 +18,15 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         struct rtable *rt;
         struct flowi4 fl4 = {};
         __be32 saddr = iph->saddr;
-        __u8 flags = 0;
+        __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
         unsigned int hh_len;
 
-        if (!skb->sk && addr_type != RTN_LOCAL) {
-                if (addr_type == RTN_UNSPEC)
-                        addr_type = inet_addr_type(net, saddr);
-                if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
-                        flags |= FLOWI_FLAG_ANYSRC;
-                else
-                        saddr = 0;
-        }
+        if (addr_type == RTN_UNSPEC)
+                addr_type = inet_addr_type(net, saddr);
+        if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
+                flags |= FLOWI_FLAG_ANYSRC;
+        else
+                saddr = 0;
 
         /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
          * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
@@ -38,7 +36,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         fl4.flowi4_tos = RT_TOS(iph->tos);
         fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
         fl4.flowi4_mark = skb->mark;
-        fl4.flowi4_flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : flags;
+        fl4.flowi4_flags = flags;
         rt = ip_route_output_key(net, &fl4);
         if (IS_ERR(rt))
                 return -1;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 1457acb39cec..61714bd52925 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -563,7 +563,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                            RT_SCOPE_UNIVERSE,
                            inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           FLOWI_FLAG_CAN_SLEEP, daddr, saddr, 0, 0);
+                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP,
+                           daddr, saddr, 0, 0);
 
         if (!inet->hdrincl) {
                 err = raw_probe_proto_opt(&fl4, msg);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e3dec1c9f09d..075212e41b83 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -722,7 +722,7 @@ static inline bool compare_hash_inputs(const struct rtable *rt1,
 {
         return ((((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
                 ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0);
+                (rt1->rt_route_iif ^ rt2->rt_route_iif)) == 0);
 }
 
 static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
@@ -731,8 +731,8 @@ static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
                 ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
                 (rt1->rt_mark ^ rt2->rt_mark) |
                 (rt1->rt_key_tos ^ rt2->rt_key_tos) |
-                (rt1->rt_oif ^ rt2->rt_oif) |
-                (rt1->rt_iif ^ rt2->rt_iif)) == 0;
+                (rt1->rt_route_iif ^ rt2->rt_route_iif) |
+                (rt1->rt_oif ^ rt2->rt_oif)) == 0;
 }
 
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
@@ -2320,8 +2320,7 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
              rth = rcu_dereference(rth->dst.rt_next)) {
                 if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
                      ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
-                     (rth->rt_iif ^ iif) |
-                     rth->rt_oif |
+                     (rth->rt_route_iif ^ iif) |
                      (rth->rt_key_tos ^ tos)) == 0 &&
                     rth->rt_mark == skb->mark &&
                     net_eq(dev_net(rth->dst.dev), net) &&
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 92bb9434b338..3bc5c8f7c71b 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -276,7 +276,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         int mss;
         struct rtable *rt;
         __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
 
         if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                 goto out;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 89d5bf806222..ac838965ff34 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -165,7 +165,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         int mss;
         struct dst_entry *dst;
         __u8 rcv_wscale;
-        bool ecn_ok;
+        bool ecn_ok = false;
 
         if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                 goto out;
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 5b466cd1272f..84d0fd47636a 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -312,6 +312,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
                 }
                 break;
         case NF_STOLEN:
+                break;
         default:
                 kfree_skb(skb);
         }
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 58107d060846..9c24de10a657 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -341,11 +341,11 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
 
         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
         if (entry == NULL)
-                return -ENOMEM;
+                goto out_entry;
         if (domain != NULL) {
                 entry->domain = kstrdup(domain, GFP_ATOMIC);
                 if (entry->domain == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_domain;
         }
 
         if (addr == NULL && mask == NULL) {
@@ -354,13 +354,13 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
         } else if (addr != NULL && mask != NULL) {
                 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                 if (addrmap == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_addrmap;
                 INIT_LIST_HEAD(&addrmap->list4);
                 INIT_LIST_HEAD(&addrmap->list6);
 
                 addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                 if (addrinfo == NULL)
-                        goto cfg_cipsov4_map_add_failure;
+                        goto out_addrinfo;
                 addrinfo->type_def.cipsov4 = doi_def;
                 addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
                 addrinfo->list.addr = addr->s_addr & mask->s_addr;
@@ -374,7 +374,7 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                 entry->type = NETLBL_NLTYPE_ADDRSELECT;
         } else {
                 ret_val = -EINVAL;
-                goto cfg_cipsov4_map_add_failure;
+                goto out_addrmap;
         }
 
         ret_val = netlbl_domhsh_add(entry, audit_info);
@@ -384,11 +384,15 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
         return 0;
 
 cfg_cipsov4_map_add_failure:
-        cipso_v4_doi_putdef(doi_def);
+        kfree(addrinfo);
+out_addrinfo:
+        kfree(addrmap);
+out_addrmap:
         kfree(entry->domain);
+out_domain:
         kfree(entry);
-        kfree(addrmap);
-        kfree(addrinfo);
+out_entry:
+        cipso_v4_doi_putdef(doi_def);
         return ret_val;
 }
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 2a318f2dc3e5..b5d56a22b1d2 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -112,7 +112,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc *sch)
 
         for (prio = 0; prio < q->bands; prio++) {
                 struct Qdisc *qdisc = q->queues[prio];
-                struct sk_buff *skb = qdisc->dequeue(qdisc);
+                struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
                 if (skb) {
                         qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index c8439cf2a448..2e43aec1c36b 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -710,8 +710,10 @@ static void tomoyo_read_profile(struct tomoyo_io_buffer *head)
                       head->r.index++)
                         if (ns->profile_ptr[head->r.index])
                                 break;
-                if (head->r.index == TOMOYO_MAX_PROFILES)
+                if (head->r.index == TOMOYO_MAX_PROFILES) {
+                        head->r.eof = true;
                         return;
+                }
                 head->r.step++;
                 break;
         case 2:
@@ -723,6 +725,7 @@ static void tomoyo_read_profile(struct tomoyo_io_buffer *head)
                         tomoyo_io_printf(head, "%u-COMMENT=", index);
                         tomoyo_set_string(head, comment ? comment->name : "");
                         tomoyo_set_lf(head);
+                        tomoyo_print_namespace(head);
                         tomoyo_io_printf(head, "%u-PREFERENCE={ ", index);
                         for (i = 0; i < TOMOYO_MAX_PREF; i++)
                                 tomoyo_io_printf(head, "%s=%u ",
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 56d62d3fb167..3b8f7b80376b 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -181,9 +181,9 @@ strip-libs = $(filter-out -l%,$(1))
 
 $(OUTPUT)python/perf.so: $(PYRF_OBJS)
         $(QUIET_GEN)CFLAGS='$(BASIC_CFLAGS)' $(PYTHON_WORD) util/setup.py \
-          --quiet build_ext \
-          --build-lib='$(OUTPUT)python' \
-          --build-temp='$(OUTPUT)python/temp'
+          --quiet build_ext; \
+        mkdir -p $(OUTPUT)python && \
+        cp $(PYTHON_EXTBUILD_LIB)perf.so $(OUTPUT)python/
 #
 # No Perl scripts right now:
 #
@@ -509,9 +509,13 @@ else
 
   PYTHON_WORD := $(call shell-wordify,$(PYTHON))
 
-  python-clean := $(PYTHON_WORD) util/setup.py clean \
-    --build-lib='$(OUTPUT)python' \
-    --build-temp='$(OUTPUT)python/temp'
+  # python extension build directories
+  PYTHON_EXTBUILD     := $(OUTPUT)python_ext_build/
+  PYTHON_EXTBUILD_LIB := $(PYTHON_EXTBUILD)lib/
+  PYTHON_EXTBUILD_TMP := $(PYTHON_EXTBUILD)tmp/
+  export PYTHON_EXTBUILD_LIB PYTHON_EXTBUILD_TMP
+
+  python-clean := rm -rf $(PYTHON_EXTBUILD) $(OUTPUT)python/perf.so
 
   ifdef NO_LIBPYTHON
     $(call disable-python)
@@ -868,6 +872,9 @@ install: all
         $(INSTALL) scripts/python/*.py -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/scripts/python'
         $(INSTALL) scripts/python/bin/* -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/scripts/python/bin'
 
+install-python_ext:
+        $(PYTHON_WORD) util/setup.py --quiet install --root='/$(DESTDIR_SQ)'
+
 install-doc:
         $(MAKE) -C Documentation install
 
@@ -895,7 +902,7 @@ quick-install-html:
 ### Cleaning rules
 
 clean:
-        $(RM) $(OUTPUT){*.o,*/*.o,*/*/*.o,*/*/*/*.o,$(LIB_FILE),perf-archive}
+        $(RM) $(LIB_OBJS) $(BUILTIN_OBJS) $(LIB_FILE) $(OUTPUT)perf-archive $(OUTPUT)perf.o $(LANG_BINDINGS)
         $(RM) $(ALL_PROGRAMS) perf
         $(RM) *.spec *.pyc *.pyo */*.pyc */*.pyo $(OUTPUT)common-cmds.h TAGS tags cscope*
         $(MAKE) -C Documentation/ clean
diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
index 9ac05aafd9b2..899080ace267 100644
--- a/tools/perf/builtin-lock.c
+++ b/tools/perf/builtin-lock.c
@@ -942,10 +942,10 @@ static const char *record_args[] = {
         "-f",
         "-m", "1024",
         "-c", "1",
-        "-e", "lock:lock_acquire:r",
-        "-e", "lock:lock_acquired:r",
-        "-e", "lock:lock_contended:r",
-        "-e", "lock:lock_release:r",
+        "-e", "lock:lock_acquire",
+        "-e", "lock:lock_acquired",
+        "-e", "lock:lock_contended",
+        "-e", "lock:lock_release",
 };
 
 static int __cmd_record(int argc, const char **argv)
diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
index 5f2a5c7046df..710ae3d0a489 100644
--- a/tools/perf/builtin-probe.c
+++ b/tools/perf/builtin-probe.c
@@ -134,10 +134,18 @@ static int opt_show_lines(const struct option *opt __used,
 {
         int ret = 0;
 
-        if (str)
-                ret = parse_line_range_desc(str, &params.line_range);
-        INIT_LIST_HEAD(&params.line_range.line_list);
+        if (!str)
+                return 0;
+
+        if (params.show_lines) {
+                pr_warning("Warning: more than one --line options are"
+                           " detected. Only the first one is valid.\n");
+                return 0;
+        }
+
         params.show_lines = true;
+        ret = parse_line_range_desc(str, &params.line_range);
+        INIT_LIST_HEAD(&params.line_range.line_list);
 
         return ret;
 }
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 80dc5b790e47..f6426b496f4a 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -30,8 +30,6 @@
 #include <sched.h>
 #include <sys/mman.h>
 
-#define FD(e, x, y) (*(int *)xyarray__entry(e->fd, x, y))
-
 enum write_mode_t {
         WRITE_FORCE,
         WRITE_APPEND
@@ -438,7 +436,6 @@ static void mmap_read_all(void)
 
 static int __cmd_record(int argc, const char **argv)
 {
-        int i;
         struct stat st;
         int flags;
         int err;
@@ -682,7 +679,6 @@ static int __cmd_record(int argc, const char **argv)
 
         for (;;) {
                 int hits = samples;
-                int thread;
 
                 mmap_read_all();
 
@@ -693,19 +689,8 @@ static int __cmd_record(int argc, const char **argv)
                         waking++;
                 }
 
-                if (done) {
-                        for (i = 0; i < evsel_list->cpus->nr; i++) {
-                                struct perf_evsel *pos;
-
-                                list_for_each_entry(pos, &evsel_list->entries, node) {
-                                        for (thread = 0;
-                                                thread < evsel_list->threads->nr;
-                                                thread++)
-                                                ioctl(FD(pos, i, thread),
-                                                        PERF_EVENT_IOC_DISABLE);
-                                }
-                        }
-                }
+                if (done)
+                        perf_evlist__disable(evsel_list);
         }
 
         if (quiet || signr == SIGUSR1)
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index f854efda7686..d7ff277bdb78 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -162,23 +162,22 @@ static int perf_session__setup_sample_type(struct perf_session *self)
 {
         if (!(self->sample_type & PERF_SAMPLE_CALLCHAIN)) {
                 if (sort__has_parent) {
-                        fprintf(stderr, "selected --sort parent, but no"
-                                        " callchain data. Did you call"
-                                        " perf record without -g?\n");
+                        ui__warning("Selected --sort parent, but no "
+                                    "callchain data. Did you call "
+                                    "'perf record' without -g?\n");
                         return -EINVAL;
                 }
                 if (symbol_conf.use_callchain) {
-                        fprintf(stderr, "selected -g but no callchain data."
-                                        " Did you call perf record without"
-                                        " -g?\n");
+                        ui__warning("Selected -g but no callchain data. Did "
+                                    "you call 'perf record' without -g?\n");
                         return -1;
                 }
         } else if (!dont_use_callchains && callchain_param.mode != CHAIN_NONE &&
                    !symbol_conf.use_callchain) {
                         symbol_conf.use_callchain = true;
                         if (callchain_register_param(&callchain_param) < 0) {
-                                fprintf(stderr, "Can't register callchain"
-                                                " params\n");
+                                ui__warning("Can't register callchain "
+                                            "params.\n");
                                 return -EINVAL;
                         }
         }
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index dcfe8873c9a1..5177964943e7 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -1637,23 +1637,29 @@ static struct perf_event_ops event_ops = {
         .ordered_samples        = true,
 };
 
-static int read_events(void)
+static void read_events(bool destroy, struct perf_session **psession)
 {
         int err = -EINVAL;
         struct perf_session *session = perf_session__new(input_name, O_RDONLY,
                                                          0, false, &event_ops);
         if (session == NULL)
-                return -ENOMEM;
+                die("No Memory");
 
         if (perf_session__has_traces(session, "record -R")) {
                 err = perf_session__process_events(session, &event_ops);
+                if (err)
+                        die("Failed to process events, error %d", err);
+
                 nr_events      = session->hists.stats.nr_events[0];
                 nr_lost_events = session->hists.stats.total_lost;
                 nr_lost_chunks = session->hists.stats.nr_events[PERF_RECORD_LOST];
         }
 
-        perf_session__delete(session);
-        return err;
+        if (destroy)
+                perf_session__delete(session);
+
+        if (psession)
+                *psession = session;
 }
 
 static void print_bad_events(void)
@@ -1689,9 +1695,10 @@ static void print_bad_events(void)
 static void __cmd_lat(void)
 {
         struct rb_node *next;
+        struct perf_session *session;
 
         setup_pager();
-        read_events();
+        read_events(false, &session);
         sort_lat();
 
         printf("\n ---------------------------------------------------------------------------------------------------------------\n");
@@ -1717,6 +1724,7 @@ static void __cmd_lat(void)
         print_bad_events();
         printf("\n");
 
+        perf_session__delete(session);
 }
 
 static struct trace_sched_handler map_ops  = {
@@ -1731,7 +1739,7 @@ static void __cmd_map(void)
         max_cpu = sysconf(_SC_NPROCESSORS_CONF);
 
         setup_pager();
-        read_events();
+        read_events(true, NULL);
         print_bad_events();
 }
 
@@ -1744,7 +1752,7 @@ static void __cmd_replay(void)
 
         test_calibrations();
 
-        read_events();
+        read_events(true, NULL);
 
         printf("nr_run_events:        %ld\n", nr_run_events);
         printf("nr_sleep_events:      %ld\n", nr_sleep_events);
@@ -1769,7 +1777,7 @@ static void __cmd_replay(void)
 
 
 static const char * const sched_usage[] = {
-        "perf sched [<options>] {record|latency|map|replay|trace}",
+        "perf sched [<options>] {record|latency|map|replay|script}",
         NULL
 };
 
diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
index e02d78cae70f..fe02903f7d0f 100644
--- a/tools/perf/util/config.c
+++ b/tools/perf/util/config.c
@@ -399,7 +399,6 @@ static int perf_config_global(void)
 int perf_config(config_fn_t fn, void *data)
 {
         int ret = 0, found = 0;
-        char *repo_config = NULL;
         const char *home = NULL;
 
         /* Setting $PERF_CONFIG makes perf read _only_ the given config file. */
@@ -414,19 +413,32 @@ int perf_config(config_fn_t fn, void *data)
         home = getenv("HOME");
         if (perf_config_global() && home) {
                 char *user_config = strdup(mkpath("%s/.perfconfig", home));
-                if (!access(user_config, R_OK)) {
-                        ret += perf_config_from_file(fn, user_config, data);
-                        found += 1;
+                struct stat st;
+
+                if (user_config == NULL) {
+                        warning("Not enough memory to process %s/.perfconfig, "
+                                "ignoring it.", home);
+                        goto out;
                 }
-                free(user_config);
-        }
 
-        repo_config = perf_pathdup("config");
-        if (!access(repo_config, R_OK)) {
-                ret += perf_config_from_file(fn, repo_config, data);
+                if (stat(user_config, &st) < 0)
+                        goto out_free;
+
+                if (st.st_uid && (st.st_uid != geteuid())) {
+                        warning("File %s not owned by current user or root, "
+                                "ignoring it.", user_config);
+                        goto out_free;
+                }
+
+                if (!st.st_size)
+                        goto out_free;
+
+                ret += perf_config_from_file(fn, user_config, data);
                 found += 1;
+out_free:
+                free(user_config);
         }
-        free(repo_config);
+out:
         if (found == 0)
                 return -1;
         return ret;
diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
index fddf40f30d3e..ee51e9b4dc09 100644
--- a/tools/perf/util/dwarf-aux.c
+++ b/tools/perf/util/dwarf-aux.c
@@ -96,6 +96,39 @@ int cu_find_lineinfo(Dwarf_Die *cu_die, unsigned long addr,
         return *lineno ?: -ENOENT;
 }
 
+static int __die_find_inline_cb(Dwarf_Die *die_mem, void *data);
+
+/**
+ * cu_walk_functions_at - Walk on function DIEs at given address
+ * @cu_die: A CU DIE
+ * @addr: An address
+ * @callback: A callback which called with found DIEs
+ * @data: A user data
+ *
+ * Walk on function DIEs at given @addr in @cu_die. Passed DIEs
+ * should be subprogram or inlined-subroutines.
+ */
+int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr,
+                    int (*callback)(Dwarf_Die *, void *), void *data)
+{
+        Dwarf_Die die_mem;
+        Dwarf_Die *sc_die;
+        int ret = -ENOENT;
+
+        /* Inlined function could be recursive. Trace it until fail */
+        for (sc_die = die_find_realfunc(cu_die, addr, &die_mem);
+             sc_die != NULL;
+             sc_die = die_find_child(sc_die, __die_find_inline_cb, &addr,
+                                     &die_mem)) {
+                ret = callback(sc_die, data);
+                if (ret)
+                        break;
+        }
+
+        return ret;
+
+}
+
 /**
  * die_compare_name - Compare diename and tname
  * @dw_die: a DIE
@@ -198,6 +231,19 @@ static int die_get_attr_udata(Dwarf_Die *tp_die, unsigned int attr_name,
         return 0;
 }
 
+/* Get attribute and translate it as a sdata */
+static int die_get_attr_sdata(Dwarf_Die *tp_die, unsigned int attr_name,
+                              Dwarf_Sword *result)
+{
+        Dwarf_Attribute attr;
+
+        if (dwarf_attr(tp_die, attr_name, &attr) == NULL ||
+            dwarf_formsdata(&attr, result) != 0)
+                return -ENOENT;
+
+        return 0;
+}
+
 /**
  * die_is_signed_type - Check whether a type DIE is signed or not
  * @tp_die: a DIE of a type
@@ -250,6 +296,50 @@ int die_get_data_member_location(Dwarf_Die *mb_die, Dwarf_Word *offs)
         return 0;
 }
 
+/* Get the call file index number in CU DIE */
+static int die_get_call_fileno(Dwarf_Die *in_die)
+{
+        Dwarf_Sword idx;
+
+        if (die_get_attr_sdata(in_die, DW_AT_call_file, &idx) == 0)
+                return (int)idx;
+        else
+                return -ENOENT;
+}
+
+/* Get the declared file index number in CU DIE */
+static int die_get_decl_fileno(Dwarf_Die *pdie)
+{
+        Dwarf_Sword idx;
+
+        if (die_get_attr_sdata(pdie, DW_AT_decl_file, &idx) == 0)
+                return (int)idx;
+        else
+                return -ENOENT;
+}
+
+/**
+ * die_get_call_file - Get callsite file name of inlined function instance
+ * @in_die: a DIE of an inlined function instance
+ *
+ * Get call-site file name of @in_die. This means from which file the inline
+ * function is called.
+ */
+const char *die_get_call_file(Dwarf_Die *in_die)
+{
+        Dwarf_Die cu_die;
+        Dwarf_Files *files;
+        int idx;
+
+        idx = die_get_call_fileno(in_die);
+        if (idx < 0 || !dwarf_diecu(in_die, &cu_die, NULL, NULL) ||
+            dwarf_getsrcfiles(&cu_die, &files, NULL) != 0)
+                return NULL;
+
+        return dwarf_filesrc(files, idx, NULL, NULL);
+}
+
+
 /**
  * die_find_child - Generic DIE search function in DIE tree
  * @rt_die: a root DIE
@@ -374,9 +464,78 @@ Dwarf_Die *die_find_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
         return die_mem;
 }
 
+struct __instance_walk_param {
+        void    *addr;
+        int     (*callback)(Dwarf_Die *, void *);
+        void    *data;
+        int     retval;
+};
+
+static int __die_walk_instances_cb(Dwarf_Die *inst, void *data)
+{
+        struct __instance_walk_param *iwp = data;
+        Dwarf_Attribute attr_mem;
+        Dwarf_Die origin_mem;
+        Dwarf_Attribute *attr;
+        Dwarf_Die *origin;
+        int tmp;
+
+        attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem);
+        if (attr == NULL)
+                return DIE_FIND_CB_CONTINUE;
+
+        origin = dwarf_formref_die(attr, &origin_mem);
+        if (origin == NULL || origin->addr != iwp->addr)
+                return DIE_FIND_CB_CONTINUE;
+
+        /* Ignore redundant instances */
+        if (dwarf_tag(inst) == DW_TAG_inlined_subroutine) {
+                dwarf_decl_line(origin, &tmp);
+                if (die_get_call_lineno(inst) == tmp) {
+                        tmp = die_get_decl_fileno(origin);
+                        if (die_get_call_fileno(inst) == tmp)
+                                return DIE_FIND_CB_CONTINUE;
+                }
+        }
+
+        iwp->retval = iwp->callback(inst, iwp->data);
+
+        return (iwp->retval) ? DIE_FIND_CB_END : DIE_FIND_CB_CONTINUE;
+}
+
+/**
+ * die_walk_instances - Walk on instances of given DIE
+ * @or_die: an abstract original DIE
+ * @callback: a callback function which is called with instance DIE
+ * @data: user data
+ *
+ * Walk on the instances of give @in_die. @in_die must be an inlined function
+ * declartion. This returns the return value of @callback if it returns
+ * non-zero value, or -ENOENT if there is no instance.
+ */
+int die_walk_instances(Dwarf_Die *or_die, int (*callback)(Dwarf_Die *, void *),
+                       void *data)
+{
+        Dwarf_Die cu_die;
+        Dwarf_Die die_mem;
+        struct __instance_walk_param iwp = {
+                .addr = or_die->addr,
+                .callback = callback,
+                .data = data,
+                .retval = -ENOENT,
+        };
+
+        if (dwarf_diecu(or_die, &cu_die, NULL, NULL) == NULL)
+                return -ENOENT;
+
+        die_find_child(&cu_die, __die_walk_instances_cb, &iwp, &die_mem);
+
+        return iwp.retval;
+}
+
 /* Line walker internal parameters */
 struct __line_walk_param {
-        const char *fname;
+        bool recursive;
         line_walk_callback_t callback;
         void *data;
         int retval;
@@ -385,39 +544,56 @@ struct __line_walk_param {
 static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data)
 {
         struct __line_walk_param *lw = data;
-        Dwarf_Addr addr;
+        Dwarf_Addr addr = 0;
+        const char *fname;
         int lineno;
 
         if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) {
+                fname = die_get_call_file(in_die);
                 lineno = die_get_call_lineno(in_die);
-                if (lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) {
-                        lw->retval = lw->callback(lw->fname, lineno, addr,
-                                                  lw->data);
+                if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) {
+                        lw->retval = lw->callback(fname, lineno, addr, lw->data);
                         if (lw->retval != 0)
                                 return DIE_FIND_CB_END;
                 }
         }
-        return DIE_FIND_CB_SIBLING;
+        if (!lw->recursive)
+                /* Don't need to search recursively */
+                return DIE_FIND_CB_SIBLING;
+
+        if (addr) {
+                fname = dwarf_decl_file(in_die);
+                if (fname && dwarf_decl_line(in_die, &lineno) == 0) {
+                        lw->retval = lw->callback(fname, lineno, addr, lw->data);
+                        if (lw->retval != 0)
+                                return DIE_FIND_CB_END;
+                }
+        }
+
+        /* Continue to search nested inlined function call-sites */
+        return DIE_FIND_CB_CONTINUE;
 }
 
 /* Walk on lines of blocks included in given DIE */
-static int __die_walk_funclines(Dwarf_Die *sp_die,
+static int __die_walk_funclines(Dwarf_Die *sp_die, bool recursive,
                                 line_walk_callback_t callback, void *data)
 {
         struct __line_walk_param lw = {
+                .recursive = recursive,
                 .callback = callback,
                 .data = data,
                 .retval = 0,
         };
         Dwarf_Die die_mem;
         Dwarf_Addr addr;
+        const char *fname;
         int lineno;
 
         /* Handle function declaration line */
-        lw.fname = dwarf_decl_file(sp_die);
-        if (lw.fname && dwarf_decl_line(sp_die, &lineno) == 0 &&
+        fname = dwarf_decl_file(sp_die);
+        if (fname && dwarf_decl_line(sp_die, &lineno) == 0 &&
             dwarf_entrypc(sp_die, &addr) == 0) {
-                lw.retval = callback(lw.fname, lineno, addr, data);
+                lw.retval = callback(fname, lineno, addr, data);
                 if (lw.retval != 0)
                         goto done;
         }
@@ -430,7 +606,7 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data)
 {
         struct __line_walk_param *lw = data;
 
-        lw->retval = __die_walk_funclines(sp_die, lw->callback, lw->data);
+        lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data);
         if (lw->retval != 0)
                 return DWARF_CB_ABORT;
 
@@ -439,7 +615,7 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data)
 
 /**
  * die_walk_lines - Walk on lines inside given DIE
- * @rt_die: a root DIE (CU or subprogram)
+ * @rt_die: a root DIE (CU, subprogram or inlined_subroutine)
  * @callback: callback routine
  * @data: user data
  *
@@ -460,12 +636,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
         size_t nlines, i;
 
         /* Get the CU die */
-        if (dwarf_tag(rt_die) == DW_TAG_subprogram)
+        if (dwarf_tag(rt_die) != DW_TAG_compile_unit)
                 cu_die = dwarf_diecu(rt_die, &die_mem, NULL, NULL);
         else
                 cu_die = rt_die;
         if (!cu_die) {
-                pr_debug2("Failed to get CU from subprogram\n");
+                pr_debug2("Failed to get CU from given DIE.\n");
                 return -EINVAL;
         }
 
@@ -509,7 +685,11 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
          * subroutines. We have to check functions list or given function.
          */
         if (rt_die != cu_die)
-                ret = __die_walk_funclines(rt_die, callback, data);
+                /*
+                 * Don't need walk functions recursively, because nested
+                 * inlined functions don't have lines of the specified DIE.
+                 */
+                ret = __die_walk_funclines(rt_die, false, callback, data);
         else {
                 struct __line_walk_param param = {
                         .callback = callback,
diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h
index bc3b21167e70..6ce1717784b7 100644
--- a/tools/perf/util/dwarf-aux.h
+++ b/tools/perf/util/dwarf-aux.h
@@ -34,12 +34,19 @@ extern const char *cu_get_comp_dir(Dwarf_Die *cu_die);
 extern int cu_find_lineinfo(Dwarf_Die *cudie, unsigned long addr,
                             const char **fname, int *lineno);
 
+/* Walk on funcitons at given address */
+extern int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr,
+                        int (*callback)(Dwarf_Die *, void *), void *data);
+
 /* Compare diename and tname */
 extern bool die_compare_name(Dwarf_Die *dw_die, const char *tname);
 
 /* Get callsite line number of inline-function instance */
 extern int die_get_call_lineno(Dwarf_Die *in_die);
 
+/* Get callsite file name of inlined function instance */
+extern const char *die_get_call_file(Dwarf_Die *in_die);
+
 /* Get type die */
 extern Dwarf_Die *die_get_type(Dwarf_Die *vr_die, Dwarf_Die *die_mem);
 
@@ -73,6 +80,10 @@ extern Dwarf_Die *die_find_realfunc(Dwarf_Die *cu_die, Dwarf_Addr addr,
 extern Dwarf_Die *die_find_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
                                       Dwarf_Die *die_mem);
 
+/* Walk on the instances of given DIE */
+extern int die_walk_instances(Dwarf_Die *in_die,
+                              int (*callback)(Dwarf_Die *, void *), void *data);
+
 /* Walker on lines (Note: line number will not be sorted) */
 typedef int (* line_walk_callback_t) (const char *fname, int lineno,
                                       Dwarf_Addr addr, void *data);
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index b021ea9265c3..e03e7bc8205e 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -91,6 +91,19 @@ int perf_evlist__add_default(struct perf_evlist *evlist)
         return 0;
 }
 
+void perf_evlist__disable(struct perf_evlist *evlist)
+{
+        int cpu, thread;
+        struct perf_evsel *pos;
+
+        for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
+                list_for_each_entry(pos, &evlist->entries, node) {
+                        for (thread = 0; thread < evlist->threads->nr; thread++)
+                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_DISABLE);
+                }
+        }
+}
+
 int perf_evlist__alloc_pollfd(struct perf_evlist *evlist)
 {
         int nfds = evlist->cpus->nr * evlist->threads->nr * evlist->nr_entries;
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index b2b862374f37..ce85ae9ae57a 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -53,6 +53,8 @@ int perf_evlist__alloc_mmap(struct perf_evlist *evlist);
 int perf_evlist__mmap(struct perf_evlist *evlist, int pages, bool overwrite);
 void perf_evlist__munmap(struct perf_evlist *evlist);
 
+void perf_evlist__disable(struct perf_evlist *evlist);
+
 static inline void perf_evlist__set_maps(struct perf_evlist *evlist,
                                          struct cpu_map *cpus,
                                          struct thread_map *threads)
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index cb2959a3fb43..b6c1ad123ca9 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -189,8 +189,8 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir,
                           const char *name, bool is_kallsyms)
 {
         const size_t size = PATH_MAX;
-        char *realname, *filename = malloc(size),
-             *linkname = malloc(size), *targetname;
+        char *realname, *filename = zalloc(size),
+             *linkname = zalloc(size), *targetname;
         int len, err = -1;
 
         if (is_kallsyms) {
@@ -254,8 +254,8 @@ static int build_id_cache__add_b(const u8 *build_id, size_t build_id_size,
 int build_id_cache__remove_s(const char *sbuild_id, const char *debugdir)
 {
         const size_t size = PATH_MAX;
-        char *filename = malloc(size),
-             *linkname = malloc(size);
+        char *filename = zalloc(size),
+             *linkname = zalloc(size);
         int err = -1;
 
         if (filename == NULL || linkname == NULL)
@@ -726,7 +726,16 @@ static int perf_header__read_build_ids_abi_quirk(struct perf_header *header,
                         return -1;
 
                 bev.header = old_bev.header;
-                bev.pid    = 0;
+
+                /*
+                 * As the pid is the missing value, we need to fill
+                 * it properly. The header.misc value give us nice hint.
+                 */
+                bev.pid = HOST_KERNEL_ID;
+                if (bev.header.misc == PERF_RECORD_MISC_GUEST_USER ||
+                    bev.header.misc == PERF_RECORD_MISC_GUEST_KERNEL)
+                        bev.pid = DEFAULT_GUEST_KERNEL_ID;
+
                 memcpy(bev.build_id, old_bev.build_id, sizeof(bev.build_id));
                 __event_process_build_id(&bev, filename, session);
 
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index b82d54fa2c56..1c7bfa5fe0a8 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -1820,11 +1820,15 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                 ret = -ENOMEM;
                 goto error;
         }
-        tev->point.module = strdup(module);
-        if (tev->point.module == NULL) {
-                ret = -ENOMEM;
-                goto error;
+
+        if (module) {
+                tev->point.module = strdup(module);
+                if (tev->point.module == NULL) {
+                        ret = -ENOMEM;
+                        goto error;
+                }
         }
+
         tev->point.offset = pev->point.offset;
         tev->point.retprobe = pev->point.retprobe;
         tev->nargs = pev->nargs;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 3e44a3e36519..555fc3864b90 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -612,12 +612,12 @@ static int convert_variable(Dwarf_Die *vr_die, struct probe_finder *pf)
         return ret;
 }
 
-/* Find a variable in a subprogram die */
-static int find_variable(Dwarf_Die *sp_die, struct probe_finder *pf)
+/* Find a variable in a scope DIE */
+static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
 {
-        Dwarf_Die vr_die, *scopes;
+        Dwarf_Die vr_die;
         char buf[32], *ptr;
-        int ret, nscopes;
+        int ret = 0;
 
         if (!is_c_varname(pf->pvar->var)) {
                 /* Copy raw parameters */
@@ -652,30 +652,16 @@ static int find_variable(Dwarf_Die *sp_die, struct probe_finder *pf)
         if (pf->tvar->name == NULL)
                 return -ENOMEM;
 
-        pr_debug("Searching '%s' variable in context.\n",
-                 pf->pvar->var);
+        pr_debug("Searching '%s' variable in context.\n", pf->pvar->var);
         /* Search child die for local variables and parameters. */
-        if (die_find_variable_at(sp_die, pf->pvar->var, pf->addr, &vr_die))
-                ret = convert_variable(&vr_die, pf);
-        else {
-                /* Search upper class */
-                nscopes = dwarf_getscopes_die(sp_die, &scopes);
-                while (nscopes-- > 1) {
-                        pr_debug("Searching variables in %s\n",
-                                 dwarf_diename(&scopes[nscopes]));
-                        /* We should check this scope, so give dummy address */
-                        if (die_find_variable_at(&scopes[nscopes],
-                                                 pf->pvar->var, 0,
-                                                 &vr_die)) {
-                                ret = convert_variable(&vr_die, pf);
-                                goto found;
-                        }
-                }
-                if (scopes)
-                        free(scopes);
-                ret = -ENOENT;
+        if (!die_find_variable_at(sc_die, pf->pvar->var, pf->addr, &vr_die)) {
+                /* Search again in global variables */
+                if (!die_find_variable_at(&pf->cu_die, pf->pvar->var, 0, &vr_die))
+                        ret = -ENOENT;
         }
-found:
+        if (ret == 0)
+                ret = convert_variable(&vr_die, pf);
+
         if (ret < 0)
                 pr_warning("Failed to find '%s' in this function.\n",
                            pf->pvar->var);
@@ -718,26 +704,30 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
         return 0;
 }
 
-/* Call probe_finder callback with real subprogram DIE */
-static int call_probe_finder(Dwarf_Die *sp_die, struct probe_finder *pf)
+/* Call probe_finder callback with scope DIE */
+static int call_probe_finder(Dwarf_Die *sc_die, struct probe_finder *pf)
 {
-        Dwarf_Die die_mem;
         Dwarf_Attribute fb_attr;
         size_t nops;
         int ret;
 
-        /* If no real subprogram, find a real one */
-        if (!sp_die || dwarf_tag(sp_die) != DW_TAG_subprogram) {
-                sp_die = die_find_realfunc(&pf->cu_die, pf->addr, &die_mem);
-                if (!sp_die) {
+        if (!sc_die) {
+                pr_err("Caller must pass a scope DIE. Program error.\n");
+                return -EINVAL;
+        }
+
+        /* If not a real subprogram, find a real one */
+        if (dwarf_tag(sc_die) != DW_TAG_subprogram) {
+                if (!die_find_realfunc(&pf->cu_die, pf->addr, &pf->sp_die)) {
                         pr_warning("Failed to find probe point in any "
                                    "functions.\n");
                         return -ENOENT;
                 }
-        }
+        } else
+                memcpy(&pf->sp_die, sc_die, sizeof(Dwarf_Die));
 
-        /* Get the frame base attribute/ops */
-        dwarf_attr(sp_die, DW_AT_frame_base, &fb_attr);
+        /* Get the frame base attribute/ops from subprogram */
+        dwarf_attr(&pf->sp_die, DW_AT_frame_base, &fb_attr);
         ret = dwarf_getlocation_addr(&fb_attr, pf->addr, &pf->fb_ops, &nops, 1);
         if (ret <= 0 || nops == 0) {
                 pf->fb_ops = NULL;
@@ -755,7 +745,7 @@ static int call_probe_finder(Dwarf_Die *sp_die, struct probe_finder *pf)
         }
 
         /* Call finder's callback handler */
-        ret = pf->callback(sp_die, pf);
+        ret = pf->callback(sc_die, pf);
 
         /* *pf->fb_ops will be cached in libdw. Don't free it. */
         pf->fb_ops = NULL;
@@ -763,17 +753,82 @@ static int call_probe_finder(Dwarf_Die *sp_die, struct probe_finder *pf)
         return ret;
 }
 
+struct find_scope_param {
+        const char *function;
+        const char *file;
+        int line;
+        int diff;
+        Dwarf_Die *die_mem;
+        bool found;
+};
+
+static int find_best_scope_cb(Dwarf_Die *fn_die, void *data)
+{
+        struct find_scope_param *fsp = data;
+        const char *file;
+        int lno;
+
+        /* Skip if declared file name does not match */
+        if (fsp->file) {
+                file = dwarf_decl_file(fn_die);
+                if (!file || strcmp(fsp->file, file) != 0)
+                        return 0;
+        }
+        /* If the function name is given, that's what user expects */
+        if (fsp->function) {
+                if (die_compare_name(fn_die, fsp->function)) {
+                        memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die));
+                        fsp->found = true;
+                        return 1;
+                }
+        } else {
+                /* With the line number, find the nearest declared DIE */
+                dwarf_decl_line(fn_die, &lno);
+                if (lno < fsp->line && fsp->diff > fsp->line - lno) {
+                        /* Keep a candidate and continue */
+                        fsp->diff = fsp->line - lno;
+                        memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die));
+                        fsp->found = true;
+                }
+        }
+        return 0;
+}
+
+/* Find an appropriate scope fits to given conditions */
+static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem)
+{
+        struct find_scope_param fsp = {
+                .function = pf->pev->point.function,
+                .file = pf->fname,
+                .line = pf->lno,
+                .diff = INT_MAX,
+                .die_mem = die_mem,
+                .found = false,
+        };
+
+        cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp);
+
+        return fsp.found ? die_mem : NULL;
+}
+
 static int probe_point_line_walker(const char *fname, int lineno,
                                    Dwarf_Addr addr, void *data)
 {
         struct probe_finder *pf = data;
+        Dwarf_Die *sc_die, die_mem;
         int ret;
 
         if (lineno != pf->lno || strtailcmp(fname, pf->fname) != 0)
                 return 0;
 
         pf->addr = addr;
-        ret = call_probe_finder(NULL, pf);
+        sc_die = find_best_scope(pf, &die_mem);
+        if (!sc_die) {
+                pr_warning("Failed to find scope of probe point.\n");
+                return -ENOENT;
+        }
+
+        ret = call_probe_finder(sc_die, pf);
 
         /* Continue if no error, because the line will be in inline function */
         return ret < 0 ? ret : 0;
@@ -827,6 +882,7 @@ static int probe_point_lazy_walker(const char *fname, int lineno,
                                    Dwarf_Addr addr, void *data)
 {
         struct probe_finder *pf = data;
+        Dwarf_Die *sc_die, die_mem;
         int ret;
 
         if (!line_list__has_line(&pf->lcache, lineno) ||
@@ -836,7 +892,14 @@ static int probe_point_lazy_walker(const char *fname, int lineno,
         pr_debug("Probe line found: line:%d addr:0x%llx\n",
                  lineno, (unsigned long long)addr);
         pf->addr = addr;
-        ret = call_probe_finder(NULL, pf);
+        pf->lno = lineno;
+        sc_die = find_best_scope(pf, &die_mem);
+        if (!sc_die) {
+                pr_warning("Failed to find scope of probe point.\n");
+                return -ENOENT;
+        }
+
+        ret = call_probe_finder(sc_die, pf);
 
         /*
          * Continue if no error, because the lazy pattern will match
@@ -861,42 +924,39 @@ static int find_probe_point_lazy(Dwarf_Die *sp_die, struct probe_finder *pf)
         return die_walk_lines(sp_die, probe_point_lazy_walker, pf);
 }
 
-/* Callback parameter with return value */
-struct dwarf_callback_param {
-        void *data;
-        int retval;
-};
-
 static int probe_point_inline_cb(Dwarf_Die *in_die, void *data)
 {
-        struct dwarf_callback_param *param = data;
-        struct probe_finder *pf = param->data;
+        struct probe_finder *pf = data;
         struct perf_probe_point *pp = &pf->pev->point;
         Dwarf_Addr addr;
+        int ret;
 
         if (pp->lazy_line)
-                param->retval = find_probe_point_lazy(in_die, pf);
+                ret = find_probe_point_lazy(in_die, pf);
         else {
                 /* Get probe address */
                 if (dwarf_entrypc(in_die, &addr) != 0) {
                         pr_warning("Failed to get entry address of %s.\n",
                                    dwarf_diename(in_die));
-                        param->retval = -ENOENT;
-                        return DWARF_CB_ABORT;
+                        return -ENOENT;
                 }
                 pf->addr = addr;
                 pf->addr += pp->offset;
                 pr_debug("found inline addr: 0x%jx\n",
                          (uintmax_t)pf->addr);
 
-                param->retval = call_probe_finder(in_die, pf);
-                if (param->retval < 0)
-                        return DWARF_CB_ABORT;
+                ret = call_probe_finder(in_die, pf);
         }
 
-        return DWARF_CB_OK;
+        return ret;
 }
 
+/* Callback parameter with return value for libdw */
+struct dwarf_callback_param {
+        void *data;
+        int retval;
+};
+
 /* Search function from function name */
 static int probe_point_search_cb(Dwarf_Die *sp_die, void *data)
 {
@@ -933,14 +993,10 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data)
                         /* TODO: Check the address in this function */
                         param->retval = call_probe_finder(sp_die, pf);
                 }
-        } else {
-                struct dwarf_callback_param _param = {.data = (void *)pf,
-                                                      .retval = 0};
+        } else
                 /* Inlined function: search instances */
-                dwarf_func_inline_instances(sp_die, probe_point_inline_cb,
-                                            &_param);
-                param->retval = _param.retval;
-        }
+                param->retval = die_walk_instances(sp_die,
+                                        probe_point_inline_cb, (void *)pf);
 
         return DWARF_CB_ABORT; /* Exit; no same symbol in this CU. */
 }
@@ -1060,7 +1116,7 @@ found:
 }
 
 /* Add a found probe point into trace event list */
-static int add_probe_trace_event(Dwarf_Die *sp_die, struct probe_finder *pf)
+static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
 {
         struct trace_event_finder *tf =
                         container_of(pf, struct trace_event_finder, pf);
@@ -1075,8 +1131,9 @@ static int add_probe_trace_event(Dwarf_Die *sp_die, struct probe_finder *pf)
         }
         tev = &tf->tevs[tf->ntevs++];
 
-        ret = convert_to_trace_point(sp_die, pf->addr, pf->pev->point.retprobe,
-                                     &tev->point);
+        /* Trace point should be converted from subprogram DIE */
+        ret = convert_to_trace_point(&pf->sp_die, pf->addr,
+                                     pf->pev->point.retprobe, &tev->point);
         if (ret < 0)
                 return ret;
 
@@ -1091,7 +1148,8 @@ static int add_probe_trace_event(Dwarf_Die *sp_die, struct probe_finder *pf)
         for (i = 0; i < pf->pev->nargs; i++) {
                 pf->pvar = &pf->pev->args[i];
                 pf->tvar = &tev->args[i];
-                ret = find_variable(sp_die, pf);
+                /* Variable should be found from scope DIE */
+                ret = find_variable(sc_die, pf);
                 if (ret != 0)
                         return ret;
         }
@@ -1159,13 +1217,13 @@ static int collect_variables_cb(Dwarf_Die *die_mem, void *data)
 }
 
 /* Add a found vars into available variables list */
-static int add_available_vars(Dwarf_Die *sp_die, struct probe_finder *pf)
+static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf)
 {
         struct available_var_finder *af =
                         container_of(pf, struct available_var_finder, pf);
         struct variable_list *vl;
-        Dwarf_Die die_mem, *scopes = NULL;
-        int ret, nscopes;
+        Dwarf_Die die_mem;
+        int ret;
 
         /* Check number of tevs */
         if (af->nvls == af->max_vls) {
@@ -1174,8 +1232,9 @@ static int add_available_vars(Dwarf_Die *sp_die, struct probe_finder *pf)
         }
         vl = &af->vls[af->nvls++];
 
-        ret = convert_to_trace_point(sp_die, pf->addr, pf->pev->point.retprobe,
-                                     &vl->point);
+        /* Trace point should be converted from subprogram DIE */
+        ret = convert_to_trace_point(&pf->sp_die, pf->addr,
+                                     pf->pev->point.retprobe, &vl->point);
         if (ret < 0)
                 return ret;
 
@@ -1187,19 +1246,14 @@ static int add_available_vars(Dwarf_Die *sp_die, struct probe_finder *pf)
         if (vl->vars == NULL)
                 return -ENOMEM;
         af->child = true;
-        die_find_child(sp_die, collect_variables_cb, (void *)af, &die_mem);
+        die_find_child(sc_die, collect_variables_cb, (void *)af, &die_mem);
 
         /* Find external variables */
         if (!af->externs)
                 goto out;
         /* Don't need to search child DIE for externs. */
         af->child = false;
-        nscopes = dwarf_getscopes_die(sp_die, &scopes);
-        while (nscopes-- > 1)
-                die_find_child(&scopes[nscopes], collect_variables_cb,
-                               (void *)af, &die_mem);
-        if (scopes)
-                free(scopes);
+        die_find_child(&pf->cu_die, collect_variables_cb, (void *)af, &die_mem);
 
 out:
         if (strlist__empty(vl->vars)) {
@@ -1391,10 +1445,14 @@ static int find_line_range_by_line(Dwarf_Die *sp_die, struct line_finder *lf)
 
 static int line_range_inline_cb(Dwarf_Die *in_die, void *data)
 {
-        struct dwarf_callback_param *param = data;
+        find_line_range_by_line(in_die, data);
 
-        param->retval = find_line_range_by_line(in_die, param->data);
-        return DWARF_CB_ABORT;  /* No need to find other instances */
+        /*
+         * We have to check all instances of inlined function, because
+         * some execution paths can be optimized out depends on the
+         * function argument of instances
+         */
+        return 0;
 }
 
 /* Search function from function name */
@@ -1422,15 +1480,10 @@ static int line_range_search_cb(Dwarf_Die *sp_die, void *data)
                 pr_debug("New line range: %d to %d\n", lf->lno_s, lf->lno_e);
                 lr->start = lf->lno_s;
                 lr->end = lf->lno_e;
-                if (dwarf_func_inline(sp_die)) {
-                        struct dwarf_callback_param _param;
-                        _param.data = (void *)lf;
-                        _param.retval = 0;
-                        dwarf_func_inline_instances(sp_die,
-                                                    line_range_inline_cb,
-                                                    &_param);
-                        param->retval = _param.retval;
-                } else
+                if (dwarf_func_inline(sp_die))
+                        param->retval = die_walk_instances(sp_die,
+                                                line_range_inline_cb, lf);
+                else
                         param->retval = find_line_range_by_line(sp_die, lf);
                 return DWARF_CB_ABORT;
         }
diff --git a/tools/perf/util/probe-finder.h b/tools/perf/util/probe-finder.h
index c478b42a2473..1132c8f0ce89 100644
--- a/tools/perf/util/probe-finder.h
+++ b/tools/perf/util/probe-finder.h
@@ -57,7 +57,7 @@ struct probe_finder {
         struct perf_probe_event *pev;           /* Target probe event */
 
         /* Callback when a probe point is found */
-        int (*callback)(Dwarf_Die *sp_die, struct probe_finder *pf);
+        int (*callback)(Dwarf_Die *sc_die, struct probe_finder *pf);
 
         /* For function searching */
         int                     lno;            /* Line number */
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 8e0b5a39d8a7..cbc8f215d4b7 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -187,16 +187,119 @@ static PyTypeObject pyrf_throttle_event__type = {
         .tp_repr        = (reprfunc)pyrf_throttle_event__repr,
 };
 
+static char pyrf_lost_event__doc[] = PyDoc_STR("perf lost event object.");
+
+static PyMemberDef pyrf_lost_event__members[] = {
+        sample_members
+        member_def(lost_event, id, T_ULONGLONG, "event id"),
+        member_def(lost_event, lost, T_ULONGLONG, "number of lost events"),
+        { .name = NULL, },
+};
+
+static PyObject *pyrf_lost_event__repr(struct pyrf_event *pevent)
+{
+        PyObject *ret;
+        char *s;
+
+        if (asprintf(&s, "{ type: lost, id: %#" PRIx64 ", "
+                         "lost: %#" PRIx64 " }",
+                     pevent->event.lost.id, pevent->event.lost.lost) < 0) {
+                ret = PyErr_NoMemory();
+        } else {
+                ret = PyString_FromString(s);
+                free(s);
+        }
+        return ret;
+}
+
+static PyTypeObject pyrf_lost_event__type = {
+        PyVarObject_HEAD_INIT(NULL, 0)
+        .tp_name        = "perf.lost_event",
+        .tp_basicsize   = sizeof(struct pyrf_event),
+        .tp_flags       = Py_TPFLAGS_DEFAULT|Py_TPFLAGS_BASETYPE,
+        .tp_doc         = pyrf_lost_event__doc,
+        .tp_members     = pyrf_lost_event__members,
+        .tp_repr        = (reprfunc)pyrf_lost_event__repr,
+};
+
+static char pyrf_read_event__doc[] = PyDoc_STR("perf read event object.");
+
+static PyMemberDef pyrf_read_event__members[] = {
+        sample_members
+        member_def(read_event, pid, T_UINT, "event pid"),
+        member_def(read_event, tid, T_UINT, "event tid"),
+        { .name = NULL, },
+};
+
+static PyObject *pyrf_read_event__repr(struct pyrf_event *pevent)
+{
+        return PyString_FromFormat("{ type: read, pid: %u, tid: %u }",
+                                   pevent->event.read.pid,
+                                   pevent->event.read.tid);
+        /*
+         * FIXME: return the array of read values,
+         * making this method useful ;-)
+         */
+}
+
+static PyTypeObject pyrf_read_event__type = {
+        PyVarObject_HEAD_INIT(NULL, 0)
+        .tp_name        = "perf.read_event",
+        .tp_basicsize   = sizeof(struct pyrf_event),
+        .tp_flags       = Py_TPFLAGS_DEFAULT|Py_TPFLAGS_BASETYPE,
+        .tp_doc         = pyrf_read_event__doc,
+        .tp_members     = pyrf_read_event__members,
+        .tp_repr        = (reprfunc)pyrf_read_event__repr,
+};
+
+static char pyrf_sample_event__doc[] = PyDoc_STR("perf sample event object.");
+
+static PyMemberDef pyrf_sample_event__members[] = {
+        sample_members
+        member_def(perf_event_header, type, T_UINT, "event type"),
+        { .name = NULL, },
+};
+
+static PyObject *pyrf_sample_event__repr(struct pyrf_event *pevent)
+{
+        PyObject *ret;
+        char *s;
+
+        if (asprintf(&s, "{ type: sample }") < 0) {
+                ret = PyErr_NoMemory();
+        } else {
+                ret = PyString_FromString(s);
+                free(s);
+        }
+        return ret;
+}
+
+static PyTypeObject pyrf_sample_event__type = {
+        PyVarObject_HEAD_INIT(NULL, 0)
+        .tp_name        = "perf.sample_event",
+        .tp_basicsize   = sizeof(struct pyrf_event),
+        .tp_flags       = Py_TPFLAGS_DEFAULT|Py_TPFLAGS_BASETYPE,
+        .tp_doc         = pyrf_sample_event__doc,
+        .tp_members     = pyrf_sample_event__members,
+        .tp_repr        = (reprfunc)pyrf_sample_event__repr,
+};
+
 static int pyrf_event__setup_types(void)
 {
         int err;
         pyrf_mmap_event__type.tp_new =
         pyrf_task_event__type.tp_new =
         pyrf_comm_event__type.tp_new =
+        pyrf_lost_event__type.tp_new =
+        pyrf_read_event__type.tp_new =
+        pyrf_sample_event__type.tp_new =
         pyrf_throttle_event__type.tp_new = PyType_GenericNew;
         err = PyType_Ready(&pyrf_mmap_event__type);
         if (err < 0)
                 goto out;
+        err = PyType_Ready(&pyrf_lost_event__type);
+        if (err < 0)
+                goto out;
         err = PyType_Ready(&pyrf_task_event__type);
         if (err < 0)
                 goto out;
@@ -206,20 +309,26 @@ static int pyrf_event__setup_types(void)
         err = PyType_Ready(&pyrf_throttle_event__type);
         if (err < 0)
                 goto out;
+        err = PyType_Ready(&pyrf_read_event__type);
+        if (err < 0)
+                goto out;
+        err = PyType_Ready(&pyrf_sample_event__type);
+        if (err < 0)
+                goto out;
 out:
         return err;
 }
 
 static PyTypeObject *pyrf_event__type[] = {
         [PERF_RECORD_MMAP]       = &pyrf_mmap_event__type,
-        [PERF_RECORD_LOST]       = &pyrf_mmap_event__type,
+        [PERF_RECORD_LOST]       = &pyrf_lost_event__type,
         [PERF_RECORD_COMM]       = &pyrf_comm_event__type,
         [PERF_RECORD_EXIT]       = &pyrf_task_event__type,
         [PERF_RECORD_THROTTLE]   = &pyrf_throttle_event__type,
         [PERF_RECORD_UNTHROTTLE] = &pyrf_throttle_event__type,
         [PERF_RECORD_FORK]       = &pyrf_task_event__type,
-        [PERF_RECORD_READ]       = &pyrf_mmap_event__type,
-        [PERF_RECORD_SAMPLE]     = &pyrf_mmap_event__type,
+        [PERF_RECORD_READ]       = &pyrf_read_event__type,
+        [PERF_RECORD_SAMPLE]     = &pyrf_sample_event__type,
 };
 
 static PyObject *pyrf_event__new(union perf_event *event)
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
index bbc982f5dd8b..95d370074928 100644
--- a/tools/perf/util/setup.py
+++ b/tools/perf/util/setup.py
@@ -3,9 +3,27 @@
 from distutils.core import setup, Extension
 from os import getenv
 
+from distutils.command.build_ext   import build_ext   as _build_ext
+from distutils.command.install_lib import install_lib as _install_lib
+
+class build_ext(_build_ext):
+    def finalize_options(self):
+        _build_ext.finalize_options(self)
+        self.build_lib  = build_lib
+        self.build_temp = build_tmp
+
+class install_lib(_install_lib):
+    def finalize_options(self):
+        _install_lib.finalize_options(self)
+        self.build_dir = build_lib
+
+
 cflags = ['-fno-strict-aliasing', '-Wno-write-strings']
 cflags += getenv('CFLAGS', '').split()
 
+build_lib = getenv('PYTHON_EXTBUILD_LIB')
+build_tmp = getenv('PYTHON_EXTBUILD_TMP')
+
 perf = Extension('perf',
                   sources = ['util/python.c', 'util/ctype.c', 'util/evlist.c',
                              'util/evsel.c', 'util/cpumap.c', 'util/thread_map.c',
@@ -21,4 +39,5 @@ setup(name='perf',
       author_email='acme@redhat.com',
       license='GPLv2',
       url='http://perf.wiki.kernel.org',
-      ext_modules=[perf])
+      ext_modules=[perf],
+      cmdclass={'build_ext': build_ext, 'install_lib': install_lib})
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index eec196329fd9..469c0264ed29 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1504,6 +1504,17 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
         dso->adjust_symbols = 0;
 
         if (strncmp(dso->name, "/tmp/perf-", 10) == 0) {
+                struct stat st;
+
+                if (lstat(dso->name, &st) < 0)
+                        return -1;
+
+                if (st.st_uid && (st.st_uid != geteuid())) {
+                        pr_warning("File %s not owned by current user or root, "
+                                "ignoring it.\n", dso->name);
+                        return -1;
+                }
+
                 ret = dso__load_perf_map(dso, map, filter);
                 dso->symtab_type = ret > 0 ? SYMTAB__JAVA_JIT :
                                               SYMTAB__NOT_FOUND;
@@ -2170,27 +2181,22 @@ size_t machines__fprintf_dsos_buildid(struct rb_root *machines,
         return ret;
 }
 
-struct dso *dso__new_kernel(const char *name)
+static struct dso*
+dso__kernel_findnew(struct machine *machine, const char *name,
+                    const char *short_name, int dso_type)
 {
-        struct dso *dso = dso__new(name ?: "[kernel.kallsyms]");
-
-        if (dso != NULL) {
-                dso__set_short_name(dso, "[kernel]");
-                dso->kernel = DSO_TYPE_KERNEL;
-        }
-
-        return dso;
-}
+        /*
+         * The kernel dso could be created by build_id processing.
+         */
+        struct dso *dso = __dsos__findnew(&machine->kernel_dsos, name);
 
-static struct dso *dso__new_guest_kernel(struct machine *machine,
-                                        const char *name)
-{
-        char bf[PATH_MAX];
-        struct dso *dso = dso__new(name ?: machine__mmap_name(machine, bf,
-                                                              sizeof(bf)));
+        /*
+         * We need to run this in all cases, since during the build_id
+         * processing we had no idea this was the kernel dso.
+         */
         if (dso != NULL) {
-                dso__set_short_name(dso, "[guest.kernel]");
-                dso->kernel = DSO_TYPE_GUEST_KERNEL;
+                dso__set_short_name(dso, short_name);
+                dso->kernel = dso_type;
         }
 
         return dso;
@@ -2208,24 +2214,36 @@ void dso__read_running_kernel_build_id(struct dso *dso, struct machine *machine)
                 dso->has_build_id = true;
 }
 
-static struct dso *machine__create_kernel(struct machine *machine)
+static struct dso *machine__get_kernel(struct machine *machine)
 {
         const char *vmlinux_name = NULL;
         struct dso *kernel;
 
         if (machine__is_host(machine)) {
                 vmlinux_name = symbol_conf.vmlinux_name;
-                kernel = dso__new_kernel(vmlinux_name);
+                if (!vmlinux_name)
+                        vmlinux_name = "[kernel.kallsyms]";
+
+                kernel = dso__kernel_findnew(machine, vmlinux_name,
+                                             "[kernel]",
+                                             DSO_TYPE_KERNEL);
         } else {
+                char bf[PATH_MAX];
+
                 if (machine__is_default_guest(machine))
                         vmlinux_name = symbol_conf.default_guest_vmlinux_name;
-                kernel = dso__new_guest_kernel(machine, vmlinux_name);
+                if (!vmlinux_name)
+                        vmlinux_name = machine__mmap_name(machine, bf,
+                                                          sizeof(bf));
+
+                kernel = dso__kernel_findnew(machine, vmlinux_name,
+                                             "[guest.kernel]",
+                                             DSO_TYPE_GUEST_KERNEL);
         }
 
-        if (kernel != NULL) {
+        if (kernel != NULL && (!kernel->has_build_id))
                 dso__read_running_kernel_build_id(kernel, machine);
-                dsos__add(&machine->kernel_dsos, kernel);
-        }
+
         return kernel;
 }
 
@@ -2329,7 +2347,7 @@ void machine__destroy_kernel_maps(struct machine *machine)
 
 int machine__create_kernel_maps(struct machine *machine)
 {
-        struct dso *kernel = machine__create_kernel(machine);
+        struct dso *kernel = machine__get_kernel(machine);
 
         if (kernel == NULL ||
             __machine__create_kernel_maps(machine, kernel) < 0)
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 325ee36a9d29..4f377d92e75a 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -155,7 +155,6 @@ struct dso {
 };
 
 struct dso *dso__new(const char *name);
-struct dso *dso__new_kernel(const char *name);
 void dso__delete(struct dso *dso);
 
 int dso__name_len(const struct dso *dso);
diff --git a/tools/perf/util/ui/browsers/top.c b/tools/perf/util/ui/browsers/top.c
index 5a06538532af..88403cf8396a 100644
--- a/tools/perf/util/ui/browsers/top.c
+++ b/tools/perf/util/ui/browsers/top.c
@@ -208,6 +208,5 @@ int perf_top__tui_browser(struct perf_top *top)
                 },
         };
 
-        ui_helpline__push("Press <- or ESC to exit");
         return perf_top_browser__run(&browser);
 }