265 files changed, 2379 insertions, 1877 deletions
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index 4c95c0034a4b..9b1067afb224 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -34,8 +34,7 @@ Current Status: linux-2.6.34-mmotm(development version of 2010/April)
 Features:
 - accounting anonymous pages, file caches, swap caches usage and limiting them.
- - private LRU and reclaim routine. (system's global LRU and private LRU
+ - pages are linked to per-memcg LRU exclusively, and there is no global LRU.
-   work independently from each other)
 - optionally, memory+swap usage can be accounted and limited.
 - hierarchical accounting
 - soft limit
@@ -154,7 +153,7 @@ updated. page_cgroup has its own LRU on cgroup.
 2.2.1 Accounting details
 All mapped anon pages (RSS) and cache pages (Page Cache) are accounted.
-Some pages which are never reclaimable and will not be on the global LRU
+Some pages which are never reclaimable and will not be on the LRU
 are not accounted. We just account pages under usual VM management.
 RSS pages are accounted at page_fault unless they've already been accounted
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index e916e3d36488..0d0492028082 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -114,7 +114,7 @@ members are defined:
 struct file_system_type {
        const char *name;
        int fs_flags;
-        struct dentry (*mount) (struct file_system_type *, int,
+        struct dentry *(*mount) (struct file_system_type *, int,
                       const char *, void *);
        void (*kill_sb) (struct super_block *);
        struct module *owner;
diff --git a/MAINTAINERS b/MAINTAINERS
index d710c000805f..6750036223d5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -228,7 +228,7 @@ M:	Len Brown <lenb@kernel.org>
 L:      linux-acpi@vger.kernel.org
 W:      http://www.lesswatts.org/projects/acpi/
 Q:      http://patchwork.kernel.org/project/linux-acpi/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
 S:      Supported
 F:      drivers/acpi/
 F:      drivers/pnp/pnpacpi/
@@ -1522,8 +1522,8 @@ M:	Gustavo Padovan <gustavo@padovan.org>
 M:      Johan Hedberg <johan.hedberg@gmail.com>
 L:      linux-bluetooth@vger.kernel.org
 W:      http://www.bluez.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jh/bluetooth.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
 S:      Maintained
 F:      drivers/bluetooth/
@@ -1533,8 +1533,8 @@ M:	Gustavo Padovan <gustavo@padovan.org>
 M:      Johan Hedberg <johan.hedberg@gmail.com>
 L:      linux-bluetooth@vger.kernel.org
 W:      http://www.bluez.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jh/bluetooth.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
 S:      Maintained
 F:      net/bluetooth/
 F:      include/net/bluetooth/
@@ -2451,17 +2451,17 @@ F:	fs/ecryptfs/
 EDAC-CORE
 M:      Doug Thompson <dougthompson@xmission.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Supported
 F:      Documentation/edac.txt
-F:      drivers/edac/edac_*
+F:      drivers/edac/
 F:      include/linux/edac.h
 EDAC-AMD64
 M:      Doug Thompson <dougthompson@xmission.com>
 M:      Borislav Petkov <borislav.petkov@amd.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Supported
 F:      drivers/edac/amd64_edac*
@@ -2469,35 +2469,35 @@ F:	drivers/edac/amd64_edac*
 EDAC-E752X
 M:      Mark Gross <mark.gross@intel.com>
 M:      Doug Thompson <dougthompson@xmission.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/e752x_edac.c
 EDAC-E7XXX
 M:      Doug Thompson <dougthompson@xmission.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/e7xxx_edac.c
 EDAC-I82443BXGX
 M:      Tim Small <tim@buttersideup.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/i82443bxgx_edac.c
 EDAC-I3000
 M:      Jason Uhlenkott <juhlenko@akamai.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/i3000_edac.c
 EDAC-I5000
 M:      Doug Thompson <dougthompson@xmission.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/i5000_edac.c
@@ -2526,21 +2526,21 @@ F:	drivers/edac/i7core_edac.c
 EDAC-I82975X
 M:      Ranganathan Desikan <ravi@jetztechnologies.com>
 M:      "Arvind R." <arvino55@gmail.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/i82975x_edac.c
 EDAC-PASEMI
 M:      Egor Martovetsky <egor@pasemi.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/pasemi_edac.c
 EDAC-R82600
 M:      Tim Small <tim@buttersideup.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/r82600_edac.c
@@ -4528,8 +4528,7 @@ S:	Supported
 F:      drivers/net/ethernet/myricom/myri10ge/
 NATSEMI ETHERNET DRIVER (DP8381x)
-M:      Tim Hockin <thockin@hockin.org>
+S:      Orphan
-S:      Maintained
 F:      drivers/net/ethernet/natsemi/natsemi.c
 NATIVE INSTRUMENTS USB SOUND INTERFACE DRIVER
@@ -4798,6 +4797,7 @@ F:	arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
 F:      arch/arm/mach-omap2/clockdomain44xx.c
 OMAP AUDIO SUPPORT
+M:      Peter Ujfalusi <peter.ujfalusi@ti.com>
 M:      Jarkko Nikula <jarkko.nikula@bitmer.com>
 L:      alsa-devel@alsa-project.org (subscribers-only)
 L:      linux-omap@vger.kernel.org
@@ -5112,6 +5112,11 @@ F:	drivers/i2c/busses/i2c-pca-*
 F:      include/linux/i2c-algo-pca.h
 F:      include/linux/i2c-pca-platform.h
+PCDP - PRIMARY CONSOLE AND DEBUG PORT
+M:      Khalid Aziz <khalid.aziz@hp.com>
+S:      Maintained
+F:      drivers/firmware/pcdp.*
 PCI ERROR RECOVERY
 M:     Linas Vepstas <linasvepstas@gmail.com>
 L:      linux-pci@vger.kernel.org
@@ -7456,8 +7461,7 @@ F:	include/linux/wm97xx.h
 WOLFSON MICROELECTRONICS DRIVERS
 M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
-M:      Ian Lartey <ian@opensource.wolfsonmicro.com>
+L:      patches@opensource.wolfsonmicro.com
-M:      Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-asoc
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-audioplus
 W:      http://opensource.wolfsonmicro.com/content/linux-drivers-wolfson-devices
diff --git a/Makefile b/Makefile
index 5e637c23974e..0df3d003a079 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Saber-toothed Squirrel
 # *DOCUMENTATION*
diff --git a/arch/c6x/include/asm/irq.h b/arch/c6x/include/asm/irq.h
index f13b78d5e1ca..ab4577f93d96 100644
--- a/arch/c6x/include/asm/irq.h
+++ b/arch/c6x/include/asm/irq.h
@@ -42,10 +42,6 @@
 /* This number is used when no interrupt has been assigned */
 #define NO_IRQ          0
-struct irq_data;
-extern irq_hw_number_t irqd_to_hwirq(struct irq_data *d);
-extern irq_hw_number_t virq_to_hw(unsigned int virq);
 extern void __init init_pic_c64xplus(void);
 extern void init_IRQ(void);
diff --git a/arch/c6x/kernel/irq.c b/arch/c6x/kernel/irq.c
index 65b8ddf54b44..c90fb5e82ad7 100644
--- a/arch/c6x/kernel/irq.c
+++ b/arch/c6x/kernel/irq.c
@@ -130,16 +130,3 @@ int arch_show_interrupts(struct seq_file *p, int prec)
        seq_printf(p, "%*s: %10lu\n", prec, "Err", irq_err_count);
        return 0;
 }
-irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
-{
-        return d->hwirq;
-}
-EXPORT_SYMBOL_GPL(irqd_to_hwirq);
-irq_hw_number_t virq_to_hw(unsigned int virq)
-{
-        struct irq_data *irq_data = irq_get_irq_data(virq);
-        return WARN_ON(!irq_data) ? 0 : irq_data->hwirq;
-}
-EXPORT_SYMBOL_GPL(virq_to_hw);
diff --git a/arch/powerpc/include/asm/irq.h b/arch/powerpc/include/asm/irq.h
index cf417e510736..e648af92ced1 100644
--- a/arch/powerpc/include/asm/irq.h
+++ b/arch/powerpc/include/asm/irq.h
@@ -33,8 +33,6 @@ extern atomic_t ppc_n_lost_interrupts;
 /* Same thing, used by the generic IRQ code */
 #define NR_IRQS_LEGACY          NUM_ISA_INTERRUPTS
-struct irq_data;
-extern irq_hw_number_t irqd_to_hwirq(struct irq_data *d);
 extern irq_hw_number_t virq_to_hw(unsigned int virq);
 /**
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index 3e57a00b8cba..ba3aeb4bc06a 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -206,40 +206,43 @@ reenable_mmu:				/* re-enable mmu so we can */
        andi.   r10,r10,MSR_EE          /* Did EE change? */
        beq     1f
-        /* Save handler and return address into the 2 unused words
-         * of the STACK_FRAME_OVERHEAD (sneak sneak sneak). Everything
-         * else can be recovered from the pt_regs except r3 which for
-         * normal interrupts has been set to pt_regs and for syscalls
-         * is an argument, so we temporarily use ORIG_GPR3 to save it
-         */
-        stw     r9,8(r1)
-        stw     r11,12(r1)
-        stw     r3,ORIG_GPR3(r1)
        /*
         * The trace_hardirqs_off will use CALLER_ADDR0 and CALLER_ADDR1.
         * If from user mode there is only one stack frame on the stack, and
         * accessing CALLER_ADDR1 will cause oops. So we need create a dummy
         * stack frame to make trace_hardirqs_off happy.
+         *
+         * This is handy because we also need to save a bunch of GPRs,
+         * r3 can be different from GPR3(r1) at this point, r9 and r11
+         * contains the old MSR and handler address respectively,
+         * r4 & r5 can contain page fault arguments that need to be passed
+         * along as well. r12, CCR, CTR, XER etc... are left clobbered as
+         * they aren't useful past this point (aren't syscall arguments),
+         * the rest is restored from the exception frame.
         */
+        stwu    r1,-32(r1)
+        stw     r9,8(r1)
+        stw     r11,12(r1)
+        stw     r3,16(r1)
+        stw     r4,20(r1)
+        stw     r5,24(r1)
        andi.   r12,r12,MSR_PR
-        beq     11f
+        b       11f
-        stwu    r1,-16(r1)
        bl      trace_hardirqs_off
-        addi    r1,r1,16
        b       12f
 11:
        bl      trace_hardirqs_off
 12:
+        lwz     r5,24(r1)
+        lwz     r4,20(r1)
+        lwz     r3,16(r1)
+        lwz     r11,12(r1)
+        lwz     r9,8(r1)
+        addi    r1,r1,32
        lwz     r0,GPR0(r1)
-        lwz     r3,ORIG_GPR3(r1)
-        lwz     r4,GPR4(r1)
-        lwz     r5,GPR5(r1)
        lwz     r6,GPR6(r1)
        lwz     r7,GPR7(r1)
        lwz     r8,GPR8(r1)
-        lwz     r9,8(r1)
-        lwz     r11,12(r1)
 1:      mtctr   r11
        mtlr    r9
        bctr                            /* jump to handler */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 243dbabfe74d..5ec1b2354ca6 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -560,12 +560,6 @@ void do_softirq(void)
        local_irq_restore(flags);
 }
-irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
-{
-        return d->hwirq;
-}
-EXPORT_SYMBOL_GPL(irqd_to_hwirq);
 irq_hw_number_t virq_to_hw(unsigned int virq)
 {
        struct irq_data *irq_data = irq_get_irq_data(virq);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index f88698c0f332..4937c9690090 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1235,7 +1235,7 @@ void __ppc64_runlatch_on(void)
        ctrl |= CTRL_RUNLATCH;
        mtspr(SPRN_CTRLT, ctrl);
-        ti->local_flags |= TLF_RUNLATCH;
+        ti->local_flags |= _TLF_RUNLATCH;
 }
 /* Called with hard IRQs off */
@@ -1244,7 +1244,7 @@ void __ppc64_runlatch_off(void)
        struct thread_info *ti = current_thread_info();
        unsigned long ctrl;
-        ti->local_flags &= ~TLF_RUNLATCH;
+        ti->local_flags &= ~_TLF_RUNLATCH;
        ctrl = mfspr(SPRN_CTRLF);
        ctrl &= ~CTRL_RUNLATCH;
diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c
index bed1279aa6a8..e1b60f56f2a1 100644
--- a/arch/powerpc/kvm/book3s_hv_builtin.c
+++ b/arch/powerpc/kvm/book3s_hv_builtin.c
@@ -173,9 +173,9 @@ static void __init kvm_linear_init_one(ulong size, int count, int type)
 static struct kvmppc_linear_info *kvm_alloc_linear(int type)
 {
-        struct kvmppc_linear_info *ri;
+        struct kvmppc_linear_info *ri, *ret;
-        ri = NULL;
+        ret = NULL;
        spin_lock(&linear_lock);
        list_for_each_entry(ri, &free_linears, list) {
                if (ri->type != type)
@@ -183,11 +183,12 @@ static struct kvmppc_linear_info *kvm_alloc_linear(int type)
                list_del(&ri->list);
                atomic_inc(&ri->use_count);
+                memset(ri->base_virt, 0, ri->npages << PAGE_SHIFT);
+                ret = ri;
                break;
        }
        spin_unlock(&linear_lock);
-        memset(ri->base_virt, 0, ri->npages << PAGE_SHIFT);
+        return ret;
-        return ri;
 }
 static void kvm_release_linear(struct kvmppc_linear_info *ri)
diff --git a/arch/powerpc/kvm/book3s_hv_interrupts.S b/arch/powerpc/kvm/book3s_hv_interrupts.S
index 3f7b674dd4bf..d3fb4df02c41 100644
--- a/arch/powerpc/kvm/book3s_hv_interrupts.S
+++ b/arch/powerpc/kvm/book3s_hv_interrupts.S
@@ -46,8 +46,10 @@ _GLOBAL(__kvmppc_vcore_entry)
        /* Save host state to the stack */
        stdu    r1, -SWITCH_FRAME_SIZE(r1)
-        /* Save non-volatile registers (r14 - r31) */
+        /* Save non-volatile registers (r14 - r31) and CR */
        SAVE_NVGPRS(r1)
+        mfcr    r3
+        std     r3, _CCR(r1)
        /* Save host DSCR */
 BEGIN_FTR_SECTION
@@ -157,8 +159,10 @@ kvmppc_handler_highmem:
         * R13      = PACA
         */
-        /* Restore non-volatile host registers (r14 - r31) */
+        /* Restore non-volatile host registers (r14 - r31) and CR */
        REST_NVGPRS(r1)
+        ld      r4, _CCR(r1)
+        mtcr    r4
        addi    r1, r1, SWITCH_FRAME_SIZE
        ld      r0, PPC_LR_STKOFF(r1)
diff --git a/arch/powerpc/kvm/book3s_interrupts.S b/arch/powerpc/kvm/book3s_interrupts.S
index 0a8515a5c042..3e35383bdb21 100644
--- a/arch/powerpc/kvm/book3s_interrupts.S
+++ b/arch/powerpc/kvm/book3s_interrupts.S
@@ -84,6 +84,10 @@ kvm_start_entry:
        /* Save non-volatile registers (r14 - r31) */
        SAVE_NVGPRS(r1)
+        /* Save CR */
+        mfcr    r14
+        stw     r14, _CCR(r1)
        /* Save LR */
        PPC_STL r0, _LINK(r1)
@@ -165,6 +169,9 @@ kvm_exit_loop:
        PPC_LL  r4, _LINK(r1)
        mtlr    r4
+        lwz     r14, _CCR(r1)
+        mtcr    r14
        /* Restore non-volatile host registers (r14 - r31) */
        REST_NVGPRS(r1)
diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
index 642d88574b07..7759053d391b 100644
--- a/arch/powerpc/kvm/book3s_pr.c
+++ b/arch/powerpc/kvm/book3s_pr.c
@@ -777,6 +777,7 @@ program_interrupt:
        }
        }
+        preempt_disable();
        if (!(r & RESUME_HOST)) {
                /* To avoid clobbering exit_reason, only check for signals if
                 * we aren't already exiting to userspace for some other
@@ -798,8 +799,6 @@ program_interrupt:
                        run->exit_reason = KVM_EXIT_INTR;
                        r = -EINTR;
                } else {
-                        preempt_disable();
                        /* In case an interrupt came in that was triggered
                         * from userspace (like DEC), we need to check what
                         * to inject now! */
@@ -881,7 +880,8 @@ int kvm_vcpu_ioctl_get_one_reg(struct kvm_vcpu *vcpu, struct kvm_one_reg *reg)
        switch (reg->id) {
        case KVM_REG_PPC_HIOR:
-                r = put_user(to_book3s(vcpu)->hior, (u64 __user *)reg->addr);
+                r = copy_to_user((u64 __user *)(long)reg->addr,
+                                &to_book3s(vcpu)->hior, sizeof(u64));
                break;
        default:
                break;
@@ -896,7 +896,8 @@ int kvm_vcpu_ioctl_set_one_reg(struct kvm_vcpu *vcpu, struct kvm_one_reg *reg)
        switch (reg->id) {
        case KVM_REG_PPC_HIOR:
-                r = get_user(to_book3s(vcpu)->hior, (u64 __user *)reg->addr);
+                r = copy_from_user(&to_book3s(vcpu)->hior,
+                                   (u64 __user *)(long)reg->addr, sizeof(u64));
                if (!r)
                        to_book3s(vcpu)->hior_explicit = true;
                break;
diff --git a/arch/powerpc/kvm/booke_interrupts.S b/arch/powerpc/kvm/booke_interrupts.S
index 10d8ef602e5c..c8c4b878795a 100644
--- a/arch/powerpc/kvm/booke_interrupts.S
+++ b/arch/powerpc/kvm/booke_interrupts.S
@@ -34,7 +34,8 @@
 /* r2 is special: it holds 'current', and it made nonvolatile in the
 * kernel with the -ffixed-r2 gcc option. */
 #define HOST_R2         12
-#define HOST_NV_GPRS    16
+#define HOST_CR         16
+#define HOST_NV_GPRS    20
 #define HOST_NV_GPR(n)  (HOST_NV_GPRS + ((n - 14) * 4))
 #define HOST_MIN_STACK_SIZE (HOST_NV_GPR(31) + 4)
 #define HOST_STACK_SIZE (((HOST_MIN_STACK_SIZE + 15) / 16) * 16) /* Align. */
@@ -296,8 +297,10 @@ heavyweight_exit:
        /* Return to kvm_vcpu_run(). */
        lwz     r4, HOST_STACK_LR(r1)
+        lwz     r5, HOST_CR(r1)
        addi    r1, r1, HOST_STACK_SIZE
        mtlr    r4
+        mtcr    r5
        /* r3 still contains the return code from kvmppc_handle_exit(). */
        blr
@@ -314,6 +317,8 @@ _GLOBAL(__kvmppc_vcpu_run)
        stw     r3, HOST_RUN(r1)
        mflr    r3
        stw     r3, HOST_STACK_LR(r1)
+        mfcr    r5
+        stw     r5, HOST_CR(r1)
        /* Save host non-volatile register state to stack. */
        stw     r14, HOST_NV_GPR(r14)(r1)
diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c
index db360fc4cf0e..d09f3e8e6867 100644
--- a/arch/powerpc/platforms/cell/axon_msi.c
+++ b/arch/powerpc/platforms/cell/axon_msi.c
@@ -392,7 +392,7 @@ static int axon_msi_probe(struct platform_device *device)
        }
        memset(msic->fifo_virt, 0xff, MSIC_FIFO_SIZE_BYTES);
-        msic->irq_domain = irq_domain_add_nomap(dn, &msic_host_ops, msic);
+        msic->irq_domain = irq_domain_add_nomap(dn, 0, &msic_host_ops, msic);
        if (!msic->irq_domain) {
                printk(KERN_ERR "axon_msi: couldn't allocate irq_domain for %s\n",
                       dn->full_name);
diff --git a/arch/powerpc/platforms/cell/beat_interrupt.c b/arch/powerpc/platforms/cell/beat_interrupt.c
index e5c3a2c6090d..f9a48af335cb 100644
--- a/arch/powerpc/platforms/cell/beat_interrupt.c
+++ b/arch/powerpc/platforms/cell/beat_interrupt.c
@@ -239,7 +239,7 @@ void __init beatic_init_IRQ(void)
        ppc_md.get_irq = beatic_get_irq;
        /* Allocate an irq host */
-        beatic_host = irq_domain_add_nomap(NULL, &beatic_pic_host_ops, NULL);
+        beatic_host = irq_domain_add_nomap(NULL, 0, &beatic_pic_host_ops, NULL);
        BUG_ON(beatic_host == NULL);
        irq_set_default_host(beatic_host);
 }
diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
index a81e5a88fbdf..b4ddaa3fbb29 100644
--- a/arch/powerpc/platforms/powermac/smp.c
+++ b/arch/powerpc/platforms/powermac/smp.c
@@ -192,7 +192,7 @@ static int psurge_secondary_ipi_init(void)
 {
        int rc = -ENOMEM;
-        psurge_host = irq_domain_add_nomap(NULL, &psurge_host_ops, NULL);
+        psurge_host = irq_domain_add_nomap(NULL, 0, &psurge_host_ops, NULL);
        if (psurge_host)
                psurge_secondary_virq = irq_create_direct_mapping(psurge_host);
diff --git a/arch/powerpc/platforms/ps3/interrupt.c b/arch/powerpc/platforms/ps3/interrupt.c
index 2a4ff86cc21f..5f3b23220b8e 100644
--- a/arch/powerpc/platforms/ps3/interrupt.c
+++ b/arch/powerpc/platforms/ps3/interrupt.c
@@ -753,9 +753,8 @@ void __init ps3_init_IRQ(void)
        unsigned cpu;
        struct irq_domain *host;
-        host = irq_domain_add_nomap(NULL, &ps3_host_ops, NULL);
+        host = irq_domain_add_nomap(NULL, PS3_PLUG_MAX + 1, &ps3_host_ops, NULL);
        irq_set_default_host(host);
-        irq_set_virq_count(PS3_PLUG_MAX + 1);
        for_each_possible_cpu(cpu) {
                struct ps3_private *pd = &per_cpu(ps3_private, cpu);
diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
index c1d5a820b1aa..5f2bb4242c0f 100644
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -61,6 +61,7 @@ config DUMP_CODE
 config DWARF_UNWINDER
        bool "Enable the DWARF unwinder for stacktraces"
        select FRAME_POINTER
+        depends on SUPERH32
        default n
        help
          Enabling this option will make stacktraces more accurate, at
diff --git a/arch/sh/boards/board-sh7785lcr.c b/arch/sh/boards/board-sh7785lcr.c
index d879848f3cdd..d0d6221d7c2e 100644
--- a/arch/sh/boards/board-sh7785lcr.c
+++ b/arch/sh/boards/board-sh7785lcr.c
@@ -28,6 +28,7 @@
 #include <cpu/sh7785.h>
 #include <asm/heartbeat.h>
 #include <asm/clock.h>
+#include <asm/bl_bit.h>
 /*
 * NOTE: This board has 2 physical memory maps.
diff --git a/arch/sh/boards/mach-hp6xx/pm.c b/arch/sh/boards/mach-hp6xx/pm.c
index adc9b4bba828..8b50cf763c06 100644
--- a/arch/sh/boards/mach-hp6xx/pm.c
+++ b/arch/sh/boards/mach-hp6xx/pm.c
@@ -14,6 +14,7 @@
 #include <linux/gfp.h>
 #include <asm/io.h>
 #include <asm/hd64461.h>
+#include <asm/bl_bit.h>
 #include <mach/hp6xx.h>
 #include <cpu/dac.h>
 #include <asm/freq.h>
diff --git a/arch/sh/drivers/dma/dma-sysfs.c b/arch/sh/drivers/dma/dma-sysfs.c
index b1cb2715ad6e..67ee95603813 100644
--- a/arch/sh/drivers/dma/dma-sysfs.c
+++ b/arch/sh/drivers/dma/dma-sysfs.c
@@ -54,7 +54,7 @@ static int __init dma_subsys_init(void)
        if (unlikely(ret))
                return ret;
-        return device_create_file(dma_subsys.dev_root, &dev_attr_devices.attr);
+        return device_create_file(dma_subsys.dev_root, &dev_attr_devices);
 }
 postcore_initcall(dma_subsys_init);
diff --git a/arch/sh/kernel/cpu/fpu.c b/arch/sh/kernel/cpu/fpu.c
index 7f1b70cace35..f8f7af51c128 100644
--- a/arch/sh/kernel/cpu/fpu.c
+++ b/arch/sh/kernel/cpu/fpu.c
@@ -2,6 +2,7 @@
 #include <linux/slab.h>
 #include <asm/processor.h>
 #include <asm/fpu.h>
+#include <asm/traps.h>
 int init_fpu(struct task_struct *tsk)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/fpu.c b/arch/sh/kernel/cpu/sh2a/fpu.c
index 488d24e0cdf0..98bbaa447c93 100644
--- a/arch/sh/kernel/cpu/sh2a/fpu.c
+++ b/arch/sh/kernel/cpu/sh2a/fpu.c
@@ -14,6 +14,7 @@
 #include <asm/processor.h>
 #include <asm/io.h>
 #include <asm/fpu.h>
+#include <asm/traps.h>
 /* The PR (precision) bit in the FP Status Register must be clear when
 * an frchg instruction is executed, otherwise the instruction is undefined.
diff --git a/arch/sh/kernel/cpu/sh4/fpu.c b/arch/sh/kernel/cpu/sh4/fpu.c
index e74cd6c0f10d..69ab4d3c8d41 100644
--- a/arch/sh/kernel/cpu/sh4/fpu.c
+++ b/arch/sh/kernel/cpu/sh4/fpu.c
@@ -16,6 +16,7 @@
 #include <cpu/fpu.h>
 #include <asm/processor.h>
 #include <asm/fpu.h>
+#include <asm/traps.h>
 /* The PR (precision) bit in the FP Status Register must be clear when
 * an frchg instruction is executed, otherwise the instruction is undefined.
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7757.c b/arch/sh/kernel/cpu/sh4a/clock-sh7757.c
index 5853989586ed..04ab5aeaf920 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7757.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7757.c
@@ -113,7 +113,7 @@ static struct clk_lookup lookups[] = {
        CLKDEV_CON_ID("cpu_clk", &div4_clks[DIV4_I]),
        /* MSTP32 clocks */
-        CLKDEV_CON_ID("sdhi0", &mstp_clks[MSTP004]),
+        CLKDEV_DEV_ID("sh_mobile_sdhi.0", &mstp_clks[MSTP004]),
        CLKDEV_CON_ID("riic0", &mstp_clks[MSTP000]),
        CLKDEV_CON_ID("riic1", &mstp_clks[MSTP000]),
        CLKDEV_CON_ID("riic2", &mstp_clks[MSTP000]),
diff --git a/arch/sh/kernel/cpu/shmobile/pm.c b/arch/sh/kernel/cpu/shmobile/pm.c
index a6f95ae4aae7..08d27fac8d08 100644
--- a/arch/sh/kernel/cpu/shmobile/pm.c
+++ b/arch/sh/kernel/cpu/shmobile/pm.c
@@ -16,6 +16,7 @@
 #include <asm/suspend.h>
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
+#include <asm/bl_bit.h>
 /*
 * Notifier lists for pre/post sleep notification
diff --git a/arch/sh/kernel/idle.c b/arch/sh/kernel/idle.c
index 64852ecc6881..ee226e20c20c 100644
--- a/arch/sh/kernel/idle.c
+++ b/arch/sh/kernel/idle.c
@@ -17,8 +17,8 @@
 #include <linux/irqflags.h>
 #include <linux/smp.h>
 #include <linux/cpuidle.h>
-#include <asm/pgalloc.h>
 #include <linux/atomic.h>
+#include <asm/pgalloc.h>
 #include <asm/smp.h>
 #include <asm/bl_bit.h>
diff --git a/arch/sh/kernel/kgdb.c b/arch/sh/kernel/kgdb.c
index efb6d398dec3..b117781bfea2 100644
--- a/arch/sh/kernel/kgdb.c
+++ b/arch/sh/kernel/kgdb.c
@@ -14,6 +14,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <asm/cacheflush.h>
+#include <asm/traps.h>
 /* Macros for single step instruction identification */
 #define OPCODE_BT(op)           (((op) & 0xff00) == 0x8900)
diff --git a/arch/sh/kernel/process_32.c b/arch/sh/kernel/process_32.c
index f72e3a951588..94273aaf78c1 100644
--- a/arch/sh/kernel/process_32.c
+++ b/arch/sh/kernel/process_32.c
@@ -26,6 +26,7 @@
 #include <asm/mmu_context.h>
 #include <asm/fpu.h>
 #include <asm/syscalls.h>
+#include <asm/switch_to.h>
 void show_regs(struct pt_regs * regs)
 {
diff --git a/arch/sh/kernel/smp.c b/arch/sh/kernel/smp.c
index a17a14d32340..eaebdf6a5c77 100644
--- a/arch/sh/kernel/smp.c
+++ b/arch/sh/kernel/smp.c
@@ -27,6 +27,7 @@
 #include <asm/smp.h>
 #include <asm/cacheflush.h>
 #include <asm/sections.h>
+#include <asm/setup.h>
 int __cpu_number_map[NR_CPUS];          /* Map physical to logical */
 int __cpu_logical_map[NR_CPUS];         /* Map logical to physical */
diff --git a/arch/sh/kernel/vsyscall/vsyscall-sigreturn.S b/arch/sh/kernel/vsyscall/vsyscall-sigreturn.S
index 555a64f124ca..23af17584054 100644
--- a/arch/sh/kernel/vsyscall/vsyscall-sigreturn.S
+++ b/arch/sh/kernel/vsyscall/vsyscall-sigreturn.S
@@ -34,6 +34,41 @@ __kernel_rt_sigreturn:
 1:      .short  __NR_rt_sigreturn
 .LEND_rt_sigreturn:
        .size __kernel_rt_sigreturn,.-.LSTART_rt_sigreturn
+        .previous
        .section .eh_frame,"a",@progbits
+.LCIE1:
+        .ualong .LCIE1_end - .LCIE1_start
+.LCIE1_start:
+        .ualong 0               /* CIE ID */
+        .byte   0x1             /* Version number */
+        .string "zRS"           /* NUL-terminated augmentation string */
+        .uleb128 0x1            /* Code alignment factor */
+        .sleb128 -4             /* Data alignment factor */
+        .byte   0x11            /* Return address register column */
+        .uleb128 0x1            /* Augmentation length and data */
+        .byte 0x1b              /* DW_EH_PE_pcrel | DW_EH_PE_sdata4. */
+        .byte   0xc, 0xf, 0x0   /* DW_CFA_def_cfa: r15 ofs 0 */
+        .align 2
+.LCIE1_end:
+        .ualong .LFDE0_end-.LFDE0_start /* Length FDE0 */
+.LFDE0_start:
+        .ualong .LFDE0_start-.LCIE1     /* CIE pointer */
+        .ualong .LSTART_sigreturn-.     /* PC-relative start address */
+        .ualong .LEND_sigreturn-.LSTART_sigreturn
+        .uleb128 0                      /* Augmentation */
+        .align 2
+.LFDE0_end:
+        .ualong .LFDE1_end-.LFDE1_start /* Length FDE1 */
+.LFDE1_start:
+        .ualong .LFDE1_start-.LCIE1     /* CIE pointer */
+        .ualong .LSTART_rt_sigreturn-.  /* PC-relative start address */
+        .ualong .LEND_rt_sigreturn-.LSTART_rt_sigreturn
+        .uleb128 0                      /* Augmentation */
+        .align 2
+.LFDE1_end:
        .previous
diff --git a/arch/sh/kernel/vsyscall/vsyscall-trapa.S b/arch/sh/kernel/vsyscall/vsyscall-trapa.S
index 3e70f851cdc6..0eb74d00690a 100644
--- a/arch/sh/kernel/vsyscall/vsyscall-trapa.S
+++ b/arch/sh/kernel/vsyscall/vsyscall-trapa.S
@@ -3,37 +3,34 @@
        .type __kernel_vsyscall,@function
 __kernel_vsyscall:
 .LSTART_vsyscall:
-        /* XXX: We'll have to do something here once we opt to use the vDSO
+        trapa   #0x10
-         * page for something other than the signal trampoline.. as well as
+         nop
-         * fill out .eh_frame -- PFM. */
 .LEND_vsyscall:
        .size __kernel_vsyscall,.-.LSTART_vsyscall
+        .previous
        .section .eh_frame,"a",@progbits
-        .previous
 .LCIE:
        .ualong .LCIE_end - .LCIE_start
 .LCIE_start:
        .ualong 0               /* CIE ID */
        .byte   0x1             /* Version number */
-        .string "zRS"           /* NUL-terminated augmentation string */
+        .string "zR"            /* NUL-terminated augmentation string */
        .uleb128 0x1            /* Code alignment factor */
        .sleb128 -4             /* Data alignment factor */
        .byte   0x11            /* Return address register column */
-                                /* Augmentation length and data (none) */
+        .uleb128 0x1            /* Augmentation length and data */
-        .byte   0xc             /* DW_CFA_def_cfa */
+        .byte 0x1b              /* DW_EH_PE_pcrel | DW_EH_PE_sdata4. */
-        .uleb128 0xf            /* r15 */
+        .byte   0xc,0xf,0x0     /* DW_CFA_def_cfa: r15 ofs 0 */
-        .uleb128 0x0            /* offset 0 */
        .align 2
 .LCIE_end:
        .ualong .LFDE_end-.LFDE_start   /* Length FDE */
 .LFDE_start:
-        .ualong .LCIE                   /* CIE pointer */
+        .ualong .LFDE_start-.LCIE       /* CIE pointer */
-        .ualong .LSTART_vsyscall-.      /* start address */
+        .ualong .LSTART_vsyscall-.      /* PC-relative start address */
        .ualong .LEND_vsyscall-.LSTART_vsyscall
-        .uleb128 0
+        .uleb128 0                      /* Augmentation */
        .align 2
 .LFDE_end:
        .previous
diff --git a/arch/sh/mm/cache-sh4.c b/arch/sh/mm/cache-sh4.c
index 112fea12522a..0e529285b28d 100644
--- a/arch/sh/mm/cache-sh4.c
+++ b/arch/sh/mm/cache-sh4.c
@@ -18,6 +18,7 @@
 #include <linux/highmem.h>
 #include <asm/pgtable.h>
 #include <asm/mmu_context.h>
+#include <asm/cache_insns.h>
 #include <asm/cacheflush.h>
 /*
diff --git a/arch/sh/mm/flush-sh4.c b/arch/sh/mm/flush-sh4.c
index 75a17f5bfa14..0b85dd9dd3a7 100644
--- a/arch/sh/mm/flush-sh4.c
+++ b/arch/sh/mm/flush-sh4.c
@@ -1,5 +1,6 @@
 #include <linux/mm.h>
 #include <asm/mmu_context.h>
+#include <asm/cache_insns.h>
 #include <asm/cacheflush.h>
 #include <asm/traps.h>
diff --git a/arch/sh/mm/sram.c b/arch/sh/mm/sram.c
index bc156ec4545e..2d8fa718d55e 100644
--- a/arch/sh/mm/sram.c
+++ b/arch/sh/mm/sram.c
@@ -9,6 +9,7 @@
 */
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/errno.h>
 #include <asm/sram.h>
 /*
diff --git a/arch/sparc/kernel/leon_pci.c b/arch/sparc/kernel/leon_pci.c
index aba6b958b2a5..19f56058742b 100644
--- a/arch/sparc/kernel/leon_pci.c
+++ b/arch/sparc/kernel/leon_pci.c
@@ -45,7 +45,6 @@ void leon_pci_init(struct platform_device *ofdev, struct leon_pci_info *info)
 void __devinit pcibios_fixup_bus(struct pci_bus *pbus)
 {
-        struct leon_pci_info *info = pbus->sysdata;
        struct pci_dev *dev;
        int i, has_io, has_mem;
        u16 cmd;
@@ -111,18 +110,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
        return pci_enable_resources(dev, mask);
 }
-struct device_node *pci_device_to_OF_node(struct pci_dev *pdev)
-{
-        /*
-         * Currently the OpenBoot nodes are not connected with the PCI device,
-         * this is because the LEON PROM does not create PCI nodes. Eventually
-         * this will change and the same approach as pcic.c can be used to
-         * match PROM nodes with pci devices.
-         */
-        return NULL;
-}
-EXPORT_SYMBOL(pci_device_to_OF_node);
 void __devinit pcibios_update_irq(struct pci_dev *dev, int irq)
 {
 #ifdef CONFIG_PCI_DEBUG
diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
index 7705c6731e28..df3155a17991 100644
--- a/arch/sparc/mm/fault_32.c
+++ b/arch/sparc/mm/fault_32.c
@@ -225,6 +225,8 @@ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
        unsigned long g2;
        int from_user = !(regs->psr & PSR_PS);
        int fault, code;
+        unsigned int flags = (FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+                              (write ? FAULT_FLAG_WRITE : 0));
        if(text_fault)
                address = regs->pc;
@@ -251,6 +253,7 @@ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
+retry:
        down_read(&mm->mmap_sem);
        /*
@@ -289,7 +292,11 @@ good_area:
         * make sure we exit gracefully rather than endlessly redo
         * the fault.
         */
-        fault = handle_mm_fault(mm, vma, address, write ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
@@ -297,13 +304,29 @@ good_area:
                        goto do_sigbus;
                BUG();
        }
-        if (fault & VM_FAULT_MAJOR) {
-                current->maj_flt++;
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
+                if (fault & VM_FAULT_MAJOR) {
-        } else {
+                        current->maj_flt++;
-                current->min_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ,
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
+                                      1, regs, address);
+                } else {
+                        current->min_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN,
+                                      1, regs, address);
+                }
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+                        /* No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+                        goto retry;
+                }
        }
        up_read(&mm->mmap_sem);
        return;
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
index 504c0622f729..1fe0429b6314 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -279,6 +279,7 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
        unsigned int insn = 0;
        int si_code, fault_code, fault;
        unsigned long address, mm_rss;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
        fault_code = get_thread_fault_code();
@@ -333,6 +334,8 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
                        insn = get_fault_insn(regs, insn);
                        goto handle_kernel_fault;
                }
+retry:
                down_read(&mm->mmap_sem);
        }
@@ -423,7 +426,12 @@ good_area:
                        goto bad_area;
        }
-        fault = handle_mm_fault(mm, vma, address, (fault_code & FAULT_CODE_WRITE) ? FAULT_FLAG_WRITE : 0);
+        flags |= ((fault_code & FAULT_CODE_WRITE) ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
                        goto out_of_memory;
@@ -431,12 +439,27 @@ good_area:
                        goto do_sigbus;
                BUG();
        }
-        if (fault & VM_FAULT_MAJOR) {
-                current->maj_flt++;
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
+                if (fault & VM_FAULT_MAJOR) {
-        } else {
+                        current->maj_flt++;
-                current->min_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ,
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
+                                      1, regs, address);
+                } else {
+                        current->min_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN,
+                                      1, regs, address);
+                }
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+                        /* No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+                        goto retry;
+                }
        }
        up_read(&mm->mmap_sem);
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 11270ca22c0a..96033e2d6845 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -12,7 +12,7 @@ config TILE
        select GENERIC_PENDING_IRQ if SMP
        select GENERIC_IRQ_SHOW
        select SYS_HYPERVISOR
-        select ARCH_HAVE_NMI_SAFE_CMPXCHG if !M386
+        select ARCH_HAVE_NMI_SAFE_CMPXCHG
 # FIXME: investigate whether we need/want these options.
 #       select HAVE_IOREMAP_PROT
@@ -69,6 +69,9 @@ config ARCH_PHYS_ADDR_T_64BIT
 config ARCH_DMA_ADDR_T_64BIT
        def_bool y
+config NEED_DMA_MAP_STATE
+        def_bool y
 config LOCKDEP_SUPPORT
        def_bool y
@@ -118,7 +121,7 @@ config 64BIT
 config ARCH_DEFCONFIG
        string
-        default "arch/tile/configs/tile_defconfig" if !TILEGX
+        default "arch/tile/configs/tilepro_defconfig" if !TILEGX
        default "arch/tile/configs/tilegx_defconfig" if TILEGX
 source "init/Kconfig"
@@ -240,6 +243,7 @@ endchoice
 config PAGE_OFFSET
        hex
+        depends on !64BIT
        default 0xF0000000 if VMSPLIT_3_75G
        default 0xE0000000 if VMSPLIT_3_5G
        default 0xB0000000 if VMSPLIT_2_75G
diff --git a/arch/tile/Makefile b/arch/tile/Makefile
index 17acce70569b..9520bc5a4b7f 100644
--- a/arch/tile/Makefile
+++ b/arch/tile/Makefile
@@ -30,7 +30,8 @@ ifneq ($(CONFIG_DEBUG_EXTRA_FLAGS),"")
 KBUILD_CFLAGS   += $(CONFIG_DEBUG_EXTRA_FLAGS)
 endif
-LIBGCC_PATH     := $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
+LIBGCC_PATH     := \
+  $(shell $(CC) $(KBUILD_CFLAGS) $(KCFLAGS) -print-libgcc-file-name)
 # Provide the path to use for "make defconfig".
 KBUILD_DEFCONFIG := $(ARCH)_defconfig
@@ -53,8 +54,6 @@ libs-y		+= $(LIBGCC_PATH)
 # See arch/tile/Kbuild for content of core part of the kernel
 core-y          += arch/tile/
-core-$(CONFIG_KVM) += arch/tile/kvm/
 ifdef TILERA_ROOT
 INSTALL_PATH ?= $(TILERA_ROOT)/tile/boot
 endif
diff --git a/arch/tile/include/arch/spr_def.h b/arch/tile/include/arch/spr_def.h
index f548efeb2de3..d6ba449b5363 100644
--- a/arch/tile/include/arch/spr_def.h
+++ b/arch/tile/include/arch/spr_def.h
@@ -60,8 +60,8 @@
        _concat4(SPR_IPI_EVENT_, CONFIG_KERNEL_PL,,)
 #define SPR_IPI_EVENT_RESET_K \
        _concat4(SPR_IPI_EVENT_RESET_, CONFIG_KERNEL_PL,,)
-#define SPR_IPI_MASK_SET_K \
+#define SPR_IPI_EVENT_SET_K \
-        _concat4(SPR_IPI_MASK_SET_, CONFIG_KERNEL_PL,,)
+        _concat4(SPR_IPI_EVENT_SET_, CONFIG_KERNEL_PL,,)
 #define INT_IPI_K \
        _concat4(INT_IPI_, CONFIG_KERNEL_PL,,)
diff --git a/arch/tile/include/asm/atomic.h b/arch/tile/include/asm/atomic.h
index bb696da5d7cd..f2461429a4a4 100644
--- a/arch/tile/include/asm/atomic.h
+++ b/arch/tile/include/asm/atomic.h
@@ -17,6 +17,8 @@
 #ifndef _ASM_TILE_ATOMIC_H
 #define _ASM_TILE_ATOMIC_H
+#include <asm/cmpxchg.h>
 #ifndef __ASSEMBLY__
 #include <linux/compiler.h>
@@ -121,54 +123,6 @@ static inline int atomic_read(const atomic_t *v)
 */
 #define atomic_add_negative(i, v)       (atomic_add_return((i), (v)) < 0)
-/* Nonexistent functions intended to cause link errors. */
-extern unsigned long __xchg_called_with_bad_pointer(void);
-extern unsigned long __cmpxchg_called_with_bad_pointer(void);
-#define xchg(ptr, x)                                                    \
-        ({                                                              \
-                typeof(*(ptr)) __x;                                     \
-                switch (sizeof(*(ptr))) {                               \
-                case 4:                                                 \
-                        __x = (typeof(__x))(typeof(__x-__x))atomic_xchg( \
-                                (atomic_t *)(ptr),                      \
-                                (u32)(typeof((x)-(x)))(x));             \
-                        break;                                          \
-                case 8:                                                 \
-                        __x = (typeof(__x))(typeof(__x-__x))atomic64_xchg( \
-                                (atomic64_t *)(ptr),                    \
-                                (u64)(typeof((x)-(x)))(x));             \
-                        break;                                          \
-                default:                                                \
-                        __xchg_called_with_bad_pointer();               \
-                }                                                       \
-                __x;                                                    \
-        })
-#define cmpxchg(ptr, o, n)                                              \
-        ({                                                              \
-                typeof(*(ptr)) __x;                                     \
-                switch (sizeof(*(ptr))) {                               \
-                case 4:                                                 \
-                        __x = (typeof(__x))(typeof(__x-__x))atomic_cmpxchg( \
-                                (atomic_t *)(ptr),                      \
-                                (u32)(typeof((o)-(o)))(o),              \
-                                (u32)(typeof((n)-(n)))(n));             \
-                        break;                                          \
-                case 8:                                                 \
-                        __x = (typeof(__x))(typeof(__x-__x))atomic64_cmpxchg( \
-                                (atomic64_t *)(ptr),                    \
-                                (u64)(typeof((o)-(o)))(o),              \
-                                (u64)(typeof((n)-(n)))(n));             \
-                        break;                                          \
-                default:                                                \
-                        __cmpxchg_called_with_bad_pointer();            \
-                }                                                       \
-                __x;                                                    \
-        })
-#define tas(ptr) (xchg((ptr), 1))
 #endif /* __ASSEMBLY__ */
 #ifndef __tilegx__
diff --git a/arch/tile/include/asm/atomic_32.h b/arch/tile/include/asm/atomic_32.h
index 466dc4a39a4f..54d1da826f93 100644
--- a/arch/tile/include/asm/atomic_32.h
+++ b/arch/tile/include/asm/atomic_32.h
@@ -200,7 +200,7 @@ static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
 * @u: ...unless v is equal to u.
 *
 * Atomically adds @a to @v, so long as @v was not already @u.
- * Returns the old value of @v.
+ * Returns non-zero if @v was not @u, and zero otherwise.
 */
 static inline u64 atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
 {
diff --git a/arch/tile/include/asm/bitops_64.h b/arch/tile/include/asm/bitops_64.h
index 58d021a9834f..60b87ee54fb8 100644
--- a/arch/tile/include/asm/bitops_64.h
+++ b/arch/tile/include/asm/bitops_64.h
@@ -38,10 +38,10 @@ static inline void clear_bit(unsigned nr, volatile unsigned long *addr)
 static inline void change_bit(unsigned nr, volatile unsigned long *addr)
 {
-        unsigned long old, mask = (1UL << (nr % BITS_PER_LONG));
+        unsigned long mask = (1UL << (nr % BITS_PER_LONG));
-        long guess, oldval;
+        unsigned long guess, oldval;
        addr += nr / BITS_PER_LONG;
-        old = *addr;
+        oldval = *addr;
        do {
                guess = oldval;
                oldval = atomic64_cmpxchg((atomic64_t *)addr,
@@ -85,7 +85,7 @@ static inline int test_and_change_bit(unsigned nr,
                                      volatile unsigned long *addr)
 {
        unsigned long mask = (1UL << (nr % BITS_PER_LONG));
-        long guess, oldval = *addr;
+        unsigned long guess, oldval;
        addr += nr / BITS_PER_LONG;
        oldval = *addr;
        do {
diff --git a/arch/tile/include/asm/cmpxchg.h b/arch/tile/include/asm/cmpxchg.h
new file mode 100644
index 000000000000..276f067e3640
--- /dev/null
+++ b/arch/tile/include/asm/cmpxchg.h
@@ -0,0 +1,73 @@
+/*
+ * cmpxchg.h -- forked from asm/atomic.h with this copyright:
+ *
+ * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ *
+ */
+#ifndef _ASM_TILE_CMPXCHG_H
+#define _ASM_TILE_CMPXCHG_H
+#ifndef __ASSEMBLY__
+/* Nonexistent functions intended to cause link errors. */
+extern unsigned long __xchg_called_with_bad_pointer(void);
+extern unsigned long __cmpxchg_called_with_bad_pointer(void);
+#define xchg(ptr, x)                                                    \
+        ({                                                              \
+                typeof(*(ptr)) __x;                                     \
+                switch (sizeof(*(ptr))) {                               \
+                case 4:                                                 \
+                        __x = (typeof(__x))(typeof(__x-__x))atomic_xchg( \
+                                (atomic_t *)(ptr),                      \
+                                (u32)(typeof((x)-(x)))(x));             \
+                        break;                                          \
+                case 8:                                                 \
+                        __x = (typeof(__x))(typeof(__x-__x))atomic64_xchg( \
+                                (atomic64_t *)(ptr),                    \
+                                (u64)(typeof((x)-(x)))(x));             \
+                        break;                                          \
+                default:                                                \
+                        __xchg_called_with_bad_pointer();               \
+                }                                                       \
+                __x;                                                    \
+        })
+#define cmpxchg(ptr, o, n)                                              \
+        ({                                                              \
+                typeof(*(ptr)) __x;                                     \
+                switch (sizeof(*(ptr))) {                               \
+                case 4:                                                 \
+                        __x = (typeof(__x))(typeof(__x-__x))atomic_cmpxchg( \
+                                (atomic_t *)(ptr),                      \
+                                (u32)(typeof((o)-(o)))(o),              \
+                                (u32)(typeof((n)-(n)))(n));             \
+                        break;                                          \
+                case 8:                                                 \
+                        __x = (typeof(__x))(typeof(__x-__x))atomic64_cmpxchg( \
+                                (atomic64_t *)(ptr),                    \
+                                (u64)(typeof((o)-(o)))(o),              \
+                                (u64)(typeof((n)-(n)))(n));             \
+                        break;                                          \
+                default:                                                \
+                        __cmpxchg_called_with_bad_pointer();            \
+                }                                                       \
+                __x;                                                    \
+        })
+#define tas(ptr) (xchg((ptr), 1))
+#endif /* __ASSEMBLY__ */
+#endif /* _ASM_TILE_CMPXCHG_H */
diff --git a/arch/tile/include/asm/irq.h b/arch/tile/include/asm/irq.h
index f80f8ceabc67..33cff9a3058b 100644
--- a/arch/tile/include/asm/irq.h
+++ b/arch/tile/include/asm/irq.h
@@ -21,7 +21,7 @@
 #define NR_IRQS 32
 /* IRQ numbers used for linux IPIs. */
-#define IRQ_RESCHEDULE 1
+#define IRQ_RESCHEDULE 0
 #define irq_canonicalize(irq)   (irq)
diff --git a/arch/tile/include/asm/spinlock_64.h b/arch/tile/include/asm/spinlock_64.h
index 72be5904e020..5f8b6a095fd8 100644
--- a/arch/tile/include/asm/spinlock_64.h
+++ b/arch/tile/include/asm/spinlock_64.h
@@ -137,7 +137,7 @@ static inline void arch_read_unlock(arch_rwlock_t *rw)
 static inline void arch_write_unlock(arch_rwlock_t *rw)
 {
        __insn_mf();
-        rw->lock = 0;
+        __insn_exch4(&rw->lock, 0);  /* Avoid waiting in the write buffer. */
 }
 static inline int arch_read_trylock(arch_rwlock_t *rw)
diff --git a/arch/tile/include/asm/stack.h b/arch/tile/include/asm/stack.h
index 4d97a2db932e..0e9d382a2d45 100644
--- a/arch/tile/include/asm/stack.h
+++ b/arch/tile/include/asm/stack.h
@@ -25,7 +25,6 @@
 struct KBacktraceIterator {
        BacktraceIterator it;
        struct task_struct *task;     /* task we are backtracing */
-        pte_t *pgtable;               /* page table for user space access */
        int end;                      /* iteration complete. */
        int new_context;              /* new context is starting */
        int profile;                  /* profiling, so stop on async intrpt */
diff --git a/arch/tile/include/asm/traps.h b/arch/tile/include/asm/traps.h
index 5f20f920f932..e28c3df4176a 100644
--- a/arch/tile/include/asm/traps.h
+++ b/arch/tile/include/asm/traps.h
@@ -64,7 +64,11 @@ void do_breakpoint(struct pt_regs *, int fault_num);
 #ifdef __tilegx__
+/* kernel/single_step.c */
 void gx_singlestep_handle(struct pt_regs *, int fault_num);
+/* kernel/intvec_64.S */
+void fill_ra_stack(void);
 #endif
-#endif /* _ASM_TILE_SYSCALLS_H */
+#endif /* _ASM_TILE_TRAPS_H */
diff --git a/arch/tile/kernel/entry.S b/arch/tile/kernel/entry.S
index 431e9ae60488..ec91568df880 100644
--- a/arch/tile/kernel/entry.S
+++ b/arch/tile/kernel/entry.S
@@ -85,6 +85,7 @@ STD_ENTRY(cpu_idle_on_new_stack)
 /* Loop forever on a nap during SMP boot. */
 STD_ENTRY(smp_nap)
        nap
+        nop       /* avoid provoking the icache prefetch with a jump */
        j smp_nap /* we are not architecturally guaranteed not to exit nap */
        jrp lr    /* clue in the backtracer */
        STD_ENDPROC(smp_nap)
@@ -105,5 +106,6 @@ STD_ENTRY(_cpu_idle)
        .global _cpu_idle_nap
 _cpu_idle_nap:
        nap
+        nop       /* avoid provoking the icache prefetch with a jump */
        jrp lr
        STD_ENDPROC(_cpu_idle)
diff --git a/arch/tile/kernel/intvec_32.S b/arch/tile/kernel/intvec_32.S
index aecc8ed5f39b..5d56a1ef5ba5 100644
--- a/arch/tile/kernel/intvec_32.S
+++ b/arch/tile/kernel/intvec_32.S
@@ -799,6 +799,10 @@ handle_interrupt:
 * This routine takes a boolean in r30 indicating if this is an NMI.
 * If so, we also expect a boolean in r31 indicating whether to
 * re-enable the oprofile interrupts.
+ *
+ * Note that .Lresume_userspace is jumped to directly in several
+ * places, and we need to make sure r30 is set correctly in those
+ * callers as well.
 */
 STD_ENTRY(interrupt_return)
        /* If we're resuming to kernel space, don't check thread flags. */
@@ -1237,7 +1241,10 @@ handle_syscall:
        bzt     r30, 1f
        jal     do_syscall_trace
        FEEDBACK_REENTER(handle_syscall)
-1:      j       .Lresume_userspace   /* jump into middle of interrupt_return */
+1:      {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
 .Linvalid_syscall:
        /* Report an invalid syscall back to the user program */
@@ -1246,7 +1253,10 @@ handle_syscall:
         movei  r28, -ENOSYS
        }
        sw      r29, r28
-        j       .Lresume_userspace   /* jump into middle of interrupt_return */
+        {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
        STD_ENDPROC(handle_syscall)
        /* Return the address for oprofile to suppress in backtraces. */
@@ -1262,7 +1272,10 @@ STD_ENTRY(ret_from_fork)
        jal     sim_notify_fork
        jal     schedule_tail
        FEEDBACK_REENTER(ret_from_fork)
-        j       .Lresume_userspace   /* jump into middle of interrupt_return */
+        {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
        STD_ENDPROC(ret_from_fork)
        /*
@@ -1376,7 +1389,10 @@ handle_ill:
        jal     send_sigtrap    /* issue a SIGTRAP */
        FEEDBACK_REENTER(handle_ill)
-        j       .Lresume_userspace   /* jump into middle of interrupt_return */
+        {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
 .Ldispatch_normal_ill:
        {
diff --git a/arch/tile/kernel/intvec_64.S b/arch/tile/kernel/intvec_64.S
index 79c93e10ba27..49d9d6621682 100644
--- a/arch/tile/kernel/intvec_64.S
+++ b/arch/tile/kernel/intvec_64.S
@@ -22,6 +22,7 @@
 #include <asm/irqflags.h>
 #include <asm/asm-offsets.h>
 #include <asm/types.h>
+#include <asm/signal.h>
 #include <hv/hypervisor.h>
 #include <arch/abi.h>
 #include <arch/interrupts.h>
@@ -605,6 +606,10 @@ handle_interrupt:
 * This routine takes a boolean in r30 indicating if this is an NMI.
 * If so, we also expect a boolean in r31 indicating whether to
 * re-enable the oprofile interrupts.
+ *
+ * Note that .Lresume_userspace is jumped to directly in several
+ * places, and we need to make sure r30 is set correctly in those
+ * callers as well.
 */
 STD_ENTRY(interrupt_return)
        /* If we're resuming to kernel space, don't check thread flags. */
@@ -1039,11 +1044,28 @@ handle_syscall:
        /* Do syscall trace again, if requested. */
        ld      r30, r31
-        andi    r30, r30, _TIF_SYSCALL_TRACE
+        andi    r0, r30, _TIF_SYSCALL_TRACE
-        beqzt   r30, 1f
+        {
+         andi    r0, r30, _TIF_SINGLESTEP
+         beqzt   r0, 1f
+        }
        jal     do_syscall_trace
        FEEDBACK_REENTER(handle_syscall)
-1:      j       .Lresume_userspace   /* jump into middle of interrupt_return */
+        andi    r0, r30, _TIF_SINGLESTEP
+1:      beqzt   r0, 2f
+        /* Single stepping -- notify ptrace. */
+        {
+         movei   r0, SIGTRAP
+         jal     ptrace_notify
+        }
+        FEEDBACK_REENTER(handle_syscall)
+2:      {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
 .Lcompat_syscall:
        /*
@@ -1077,7 +1099,10 @@ handle_syscall:
         movei  r28, -ENOSYS
        }
        st      r29, r28
-        j       .Lresume_userspace   /* jump into middle of interrupt_return */
+        {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
        STD_ENDPROC(handle_syscall)
        /* Return the address for oprofile to suppress in backtraces. */
@@ -1093,7 +1118,10 @@ STD_ENTRY(ret_from_fork)
        jal     sim_notify_fork
        jal     schedule_tail
        FEEDBACK_REENTER(ret_from_fork)
-        j       .Lresume_userspace
+        {
+         movei  r30, 0               /* not an NMI */
+         j      .Lresume_userspace   /* jump into middle of interrupt_return */
+        }
        STD_ENDPROC(ret_from_fork)
 /* Various stub interrupt handlers and syscall handlers */
@@ -1156,6 +1184,18 @@ int_unalign:
        push_extra_callee_saves r0
        j       do_trap
+/* Fill the return address stack with nonzero entries. */
+STD_ENTRY(fill_ra_stack)
+        {
+         move   r0, lr
+         jal    1f
+        }
+1:      jal     2f
+2:      jal     3f
+3:      jal     4f
+4:      jrp     r0
+        STD_ENDPROC(fill_ra_stack)
 /* Include .intrpt1 array of interrupt vectors */
        .section ".intrpt1", "ax"
@@ -1166,7 +1206,7 @@ int_unalign:
 #define do_hardwall_trap bad_intr
 #endif
-        int_hand     INT_MEM_ERROR, MEM_ERROR, bad_intr
+        int_hand     INT_MEM_ERROR, MEM_ERROR, do_trap
        int_hand     INT_SINGLE_STEP_3, SINGLE_STEP_3, bad_intr
 #if CONFIG_KERNEL_PL == 2
        int_hand     INT_SINGLE_STEP_2, SINGLE_STEP_2, gx_singlestep_handle
diff --git a/arch/tile/kernel/module.c b/arch/tile/kernel/module.c
index b90ab9925674..98d476920106 100644
--- a/arch/tile/kernel/module.c
+++ b/arch/tile/kernel/module.c
@@ -67,6 +67,8 @@ void *module_alloc(unsigned long size)
        area = __get_vm_area(size, VM_ALLOC, MEM_MODULE_START, MEM_MODULE_END);
        if (!area)
                goto error;
+        area->nr_pages = npages;
+        area->pages = pages;
        if (map_vm_area(area, prot_rwx, &pages)) {
                vunmap(area->addr);
diff --git a/arch/tile/kernel/proc.c b/arch/tile/kernel/proc.c
index 7a9327046404..446a7f52cc11 100644
--- a/arch/tile/kernel/proc.c
+++ b/arch/tile/kernel/proc.c
@@ -146,7 +146,6 @@ static ctl_table unaligned_table[] = {
        },
        {}
 };
-#endif
 static struct ctl_path tile_path[] = {
        { .procname = "tile" },
@@ -155,10 +154,9 @@ static struct ctl_path tile_path[] = {
 static int __init proc_sys_tile_init(void)
 {
-#ifndef __tilegx__  /* FIXME: GX: no support for unaligned access yet */
        register_sysctl_paths(tile_path, unaligned_table);
-#endif
        return 0;
 }
 arch_initcall(proc_sys_tile_init);
+#endif
diff --git a/arch/tile/kernel/process.c b/arch/tile/kernel/process.c
index 30caecac94dc..2d5ef617bb39 100644
--- a/arch/tile/kernel/process.c
+++ b/arch/tile/kernel/process.c
@@ -28,6 +28,7 @@
 #include <linux/tracehook.h>
 #include <linux/signal.h>
 #include <asm/stack.h>
+#include <asm/switch_to.h>
 #include <asm/homecache.h>
 #include <asm/syscalls.h>
 #include <asm/traps.h>
@@ -285,7 +286,7 @@ struct task_struct *validate_current(void)
        static struct task_struct corrupt = { .comm = "<corrupt>" };
        struct task_struct *tsk = current;
        if (unlikely((unsigned long)tsk < PAGE_OFFSET ||
-                     (void *)tsk > high_memory ||
+                     (high_memory && (void *)tsk > high_memory) ||
                     ((unsigned long)tsk & (__alignof__(*tsk) - 1)) != 0)) {
                pr_err("Corrupt 'current' %p (sp %#lx)\n", tsk, stack_pointer);
                tsk = &corrupt;
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 92a94f4920ad..bff23f476110 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -103,13 +103,11 @@ unsigned long __initdata pci_reserve_end_pfn = -1U;
 static int __init setup_maxmem(char *str)
 {
-        long maxmem_mb;
+        unsigned long long maxmem;
-        if (str == NULL || strict_strtol(str, 0, &maxmem_mb) != 0 ||
+        if (str == NULL || (maxmem = memparse(str, NULL)) == 0)
-            maxmem_mb == 0)
                return -EINVAL;
-        maxmem_pfn = (maxmem_mb >> (HPAGE_SHIFT - 20)) <<
+        maxmem_pfn = (maxmem >> HPAGE_SHIFT) << (HPAGE_SHIFT - PAGE_SHIFT);
-                (HPAGE_SHIFT - PAGE_SHIFT);
        pr_info("Forcing RAM used to no more than %dMB\n",
               maxmem_pfn >> (20 - PAGE_SHIFT));
        return 0;
@@ -119,14 +117,15 @@ early_param("maxmem", setup_maxmem);
 static int __init setup_maxnodemem(char *str)
 {
        char *endp;
-        long maxnodemem_mb, node;
+        unsigned long long maxnodemem;
+        long node;
        node = str ? simple_strtoul(str, &endp, 0) : INT_MAX;
-        if (node >= MAX_NUMNODES || *endp != ':' ||
+        if (node >= MAX_NUMNODES || *endp != ':')
-            strict_strtol(endp+1, 0, &maxnodemem_mb) != 0)
                return -EINVAL;
-        maxnodemem_pfn[node] = (maxnodemem_mb >> (HPAGE_SHIFT - 20)) <<
+        maxnodemem = memparse(endp+1, NULL);
+        maxnodemem_pfn[node] = (maxnodemem >> HPAGE_SHIFT) <<
                (HPAGE_SHIFT - PAGE_SHIFT);
        pr_info("Forcing RAM used on node %ld to no more than %dMB\n",
               node, maxnodemem_pfn[node] >> (20 - PAGE_SHIFT));
@@ -913,6 +912,13 @@ void __cpuinit setup_cpu(int boot)
 #ifdef CONFIG_BLK_DEV_INITRD
+/*
+ * Note that the kernel can potentially support other compression
+ * techniques than gz, though we don't do so by default.  If we ever
+ * decide to do so we can either look for other filename extensions,
+ * or just allow a file with this name to be compressed with an
+ * arbitrary compressor (somewhat counterintuitively).
+ */
 static int __initdata set_initramfs_file;
 static char __initdata initramfs_file[128] = "initramfs.cpio.gz";
@@ -928,9 +934,9 @@ static int __init setup_initramfs_file(char *str)
 early_param("initramfs_file", setup_initramfs_file);
 /*
- * We look for an additional "initramfs.cpio.gz" file in the hvfs.
+ * We look for an "initramfs.cpio.gz" file in the hvfs.
 * If there is one, we allocate some memory for it and it will be
- * unpacked to the initramfs after any built-in initramfs_data.
+ * unpacked to the initramfs.
 */
 static void __init load_hv_initrd(void)
 {
diff --git a/arch/tile/kernel/single_step.c b/arch/tile/kernel/single_step.c
index bc1eb586e24d..9efbc1391b3c 100644
--- a/arch/tile/kernel/single_step.c
+++ b/arch/tile/kernel/single_step.c
@@ -153,6 +153,25 @@ static tile_bundle_bits rewrite_load_store_unaligned(
        if (((unsigned long)addr % size) == 0)
                return bundle;
+        /*
+         * Return SIGBUS with the unaligned address, if requested.
+         * Note that we return SIGBUS even for completely invalid addresses
+         * as long as they are in fact unaligned; this matches what the
+         * tilepro hardware would be doing, if it could provide us with the
+         * actual bad address in an SPR, which it doesn't.
+         */
+        if (unaligned_fixup == 0) {
+                siginfo_t info = {
+                        .si_signo = SIGBUS,
+                        .si_code = BUS_ADRALN,
+                        .si_addr = addr
+                };
+                trace_unhandled_signal("unaligned trap", regs,
+                                       (unsigned long)addr, SIGBUS);
+                force_sig_info(info.si_signo, &info, current);
+                return (tilepro_bundle_bits) 0;
+        }
 #ifndef __LITTLE_ENDIAN
 # error We assume little-endian representation with copy_xx_user size 2 here
 #endif
@@ -192,18 +211,6 @@ static tile_bundle_bits rewrite_load_store_unaligned(
                return (tile_bundle_bits) 0;
        }
-        if (unaligned_fixup == 0) {
-                siginfo_t info = {
-                        .si_signo = SIGBUS,
-                        .si_code = BUS_ADRALN,
-                        .si_addr = addr
-                };
-                trace_unhandled_signal("unaligned trap", regs,
-                                       (unsigned long)addr, SIGBUS);
-                force_sig_info(info.si_signo, &info, current);
-                return (tile_bundle_bits) 0;
-        }
        if (unaligned_printk || unaligned_fixup_count == 0) {
                pr_info("Process %d/%s: PC %#lx: Fixup of"
                        " unaligned %s at %#lx.\n",
diff --git a/arch/tile/kernel/smp.c b/arch/tile/kernel/smp.c
index a44e103c5a63..91da0f721958 100644
--- a/arch/tile/kernel/smp.c
+++ b/arch/tile/kernel/smp.c
@@ -103,7 +103,7 @@ static void smp_stop_cpu_interrupt(void)
        set_cpu_online(smp_processor_id(), 0);
        arch_local_irq_disable_all();
        for (;;)
-                asm("nap");
+                asm("nap; nop");
 }
 /* This function calls the 'stop' function on all other CPUs in the system. */
@@ -113,6 +113,12 @@ void smp_send_stop(void)
        send_IPI_allbutself(MSG_TAG_STOP_CPU);
 }
+/* On panic, just wait; we may get an smp_send_stop() later on. */
+void panic_smp_self_stop(void)
+{
+        while (1)
+                asm("nap; nop");
+}
 /*
 * Dispatch code called from hv_message_intr() for HV_MSG_TILE hv messages.
diff --git a/arch/tile/kernel/smpboot.c b/arch/tile/kernel/smpboot.c
index b949edcec200..172aef7d3159 100644
--- a/arch/tile/kernel/smpboot.c
+++ b/arch/tile/kernel/smpboot.c
@@ -196,6 +196,8 @@ void __cpuinit online_secondary(void)
        /* This must be done before setting cpu_online_mask */
        wmb();
+        notify_cpu_starting(smp_processor_id());
        /*
         * We need to hold call_lock, so there is no inconsistency
         * between the time smp_call_function() determines number of
diff --git a/arch/tile/kernel/stack.c b/arch/tile/kernel/stack.c
index 37ee4d037e0b..b2f44c28dda6 100644
--- a/arch/tile/kernel/stack.c
+++ b/arch/tile/kernel/stack.c
@@ -21,10 +21,12 @@
 #include <linux/stacktrace.h>
 #include <linux/uaccess.h>
 #include <linux/mmzone.h>
+#include <linux/dcache.h>
+#include <linux/fs.h>
 #include <asm/backtrace.h>
 #include <asm/page.h>
-#include <asm/tlbflush.h>
 #include <asm/ucontext.h>
+#include <asm/switch_to.h>
 #include <asm/sigframe.h>
 #include <asm/stack.h>
 #include <arch/abi.h>
@@ -44,72 +46,23 @@ static int in_kernel_stack(struct KBacktraceIterator *kbt, unsigned long sp)
        return sp >= kstack_base && sp < kstack_base + THREAD_SIZE;
 }
-/* Is address valid for reading? */
-static int valid_address(struct KBacktraceIterator *kbt, unsigned long address)
-{
-        HV_PTE *l1_pgtable = kbt->pgtable;
-        HV_PTE *l2_pgtable;
-        unsigned long pfn;
-        HV_PTE pte;
-        struct page *page;
-        if (l1_pgtable == NULL)
-                return 0;       /* can't read user space in other tasks */
-#ifdef CONFIG_64BIT
-        /* Find the real l1_pgtable by looking in the l0_pgtable. */
-        pte = l1_pgtable[HV_L0_INDEX(address)];
-        if (!hv_pte_get_present(pte))
-                return 0;
-        pfn = hv_pte_get_pfn(pte);
-        if (pte_huge(pte)) {
-                if (!pfn_valid(pfn)) {
-                        pr_err("L0 huge page has bad pfn %#lx\n", pfn);
-                        return 0;
-                }
-                return hv_pte_get_present(pte) && hv_pte_get_readable(pte);
-        }
-        page = pfn_to_page(pfn);
-        BUG_ON(PageHighMem(page));  /* No HIGHMEM on 64-bit. */
-        l1_pgtable = (HV_PTE *)pfn_to_kaddr(pfn);
-#endif
-        pte = l1_pgtable[HV_L1_INDEX(address)];
-        if (!hv_pte_get_present(pte))
-                return 0;
-        pfn = hv_pte_get_pfn(pte);
-        if (pte_huge(pte)) {
-                if (!pfn_valid(pfn)) {
-                        pr_err("huge page has bad pfn %#lx\n", pfn);
-                        return 0;
-                }
-                return hv_pte_get_present(pte) && hv_pte_get_readable(pte);
-        }
-        page = pfn_to_page(pfn);
-        if (PageHighMem(page)) {
-                pr_err("L2 page table not in LOWMEM (%#llx)\n",
-                       HV_PFN_TO_CPA(pfn));
-                return 0;
-        }
-        l2_pgtable = (HV_PTE *)pfn_to_kaddr(pfn);
-        pte = l2_pgtable[HV_L2_INDEX(address)];
-        return hv_pte_get_present(pte) && hv_pte_get_readable(pte);
-}
 /* Callback for backtracer; basically a glorified memcpy */
 static bool read_memory_func(void *result, unsigned long address,
                             unsigned int size, void *vkbt)
 {
        int retval;
        struct KBacktraceIterator *kbt = (struct KBacktraceIterator *)vkbt;
+        if (address == 0)
+                return 0;
        if (__kernel_text_address(address)) {
                /* OK to read kernel code. */
        } else if (address >= PAGE_OFFSET) {
                /* We only tolerate kernel-space reads of this task's stack */
                if (!in_kernel_stack(kbt, address))
                        return 0;
-        } else if (!valid_address(kbt, address)) {
+        } else if (!kbt->is_current) {
-                return 0;       /* invalid user-space address */
+                return 0;       /* can't read from other user address spaces */
        }
        pagefault_disable();
        retval = __copy_from_user_inatomic(result,
@@ -127,6 +80,8 @@ static struct pt_regs *valid_fault_handler(struct KBacktraceIterator* kbt)
        unsigned long sp = kbt->it.sp;
        struct pt_regs *p;
+        if (sp % sizeof(long) != 0)
+                return NULL;
        if (!in_kernel_stack(kbt, sp))
                return NULL;
        if (!in_kernel_stack(kbt, sp + C_ABI_SAVE_AREA_SIZE + PTREGS_SIZE-1))
@@ -169,27 +124,27 @@ static int is_sigreturn(unsigned long pc)
 }
 /* Return a pt_regs pointer for a valid signal handler frame */
-static struct pt_regs *valid_sigframe(struct KBacktraceIterator* kbt)
+static struct pt_regs *valid_sigframe(struct KBacktraceIterator* kbt,
+                                      struct rt_sigframe* kframe)
 {
        BacktraceIterator *b = &kbt->it;
-        if (b->pc == VDSO_BASE) {
+        if (b->pc == VDSO_BASE && b->sp < PAGE_OFFSET &&
-                struct rt_sigframe *frame;
+            b->sp % sizeof(long) == 0) {
-                unsigned long sigframe_top =
+                int retval;
-                        b->sp + sizeof(struct rt_sigframe) - 1;
+                pagefault_disable();
-                if (!valid_address(kbt, b->sp) ||
+                retval = __copy_from_user_inatomic(
-                    !valid_address(kbt, sigframe_top)) {
+                        kframe, (void __user __force *)b->sp,
-                        if (kbt->verbose)
+                        sizeof(*kframe));
-                                pr_err("  (odd signal: sp %#lx?)\n",
+                pagefault_enable();
-                                       (unsigned long)(b->sp));
+                if (retval != 0 ||
+                    (unsigned int)(kframe->info.si_signo) >= _NSIG)
                        return NULL;
-                }
-                frame = (struct rt_sigframe *)b->sp;
                if (kbt->verbose) {
                        pr_err("  <received signal %d>\n",
-                               frame->info.si_signo);
+                               kframe->info.si_signo);
                }
-                return (struct pt_regs *)&frame->uc.uc_mcontext;
+                return (struct pt_regs *)&kframe->uc.uc_mcontext;
        }
        return NULL;
 }
@@ -202,10 +157,11 @@ static int KBacktraceIterator_is_sigreturn(struct KBacktraceIterator *kbt)
 static int KBacktraceIterator_restart(struct KBacktraceIterator *kbt)
 {
        struct pt_regs *p;
+        struct rt_sigframe kframe;
        p = valid_fault_handler(kbt);
        if (p == NULL)
-                p = valid_sigframe(kbt);
+                p = valid_sigframe(kbt, &kframe);
        if (p == NULL)
                return 0;
        backtrace_init(&kbt->it, read_memory_func, kbt,
@@ -265,41 +221,19 @@ void KBacktraceIterator_init(struct KBacktraceIterator *kbt,
        /*
         * Set up callback information.  We grab the kernel stack base
-         * so we will allow reads of that address range, and if we're
+         * so we will allow reads of that address range.
-         * asking about the current process we grab the page table
-         * so we can check user accesses before trying to read them.
-         * We flush the TLB to avoid any weird skew issues.
         */
-        is_current = (t == NULL);
+        is_current = (t == NULL || t == current);
        kbt->is_current = is_current;
        if (is_current)
                t = validate_current();
        kbt->task = t;
-        kbt->pgtable = NULL;
        kbt->verbose = 0;   /* override in caller if desired */
        kbt->profile = 0;   /* override in caller if desired */
        kbt->end = KBT_ONGOING;
-        kbt->new_context = 0;
+        kbt->new_context = 1;
-        if (is_current) {
+        if (is_current)
-                HV_PhysAddr pgdir_pa = hv_inquire_context().page_table;
-                if (pgdir_pa == (unsigned long)swapper_pg_dir - PAGE_OFFSET) {
-                        /*
-                         * Not just an optimization: this also allows
-                         * this to work at all before va/pa mappings
-                         * are set up.
-                         */
-                        kbt->pgtable = swapper_pg_dir;
-                } else {
-                        struct page *page = pfn_to_page(PFN_DOWN(pgdir_pa));
-                        if (!PageHighMem(page))
-                                kbt->pgtable = __va(pgdir_pa);
-                        else
-                                pr_err("page table not in LOWMEM"
-                                       " (%#llx)\n", pgdir_pa);
-                }
-                local_flush_tlb_all();
                validate_stack(regs);
-        }
        if (regs == NULL) {
                if (is_current || t->state == TASK_RUNNING) {
@@ -345,6 +279,78 @@ void KBacktraceIterator_next(struct KBacktraceIterator *kbt)
 }
 EXPORT_SYMBOL(KBacktraceIterator_next);
+static void describe_addr(struct KBacktraceIterator *kbt,
+                          unsigned long address,
+                          int have_mmap_sem, char *buf, size_t bufsize)
+{
+        struct vm_area_struct *vma;
+        size_t namelen, remaining;
+        unsigned long size, offset, adjust;
+        char *p, *modname;
+        const char *name;
+        int rc;
+        /*
+         * Look one byte back for every caller frame (i.e. those that
+         * aren't a new context) so we look up symbol data for the
+         * call itself, not the following instruction, which may be on
+         * a different line (or in a different function).
+         */
+        adjust = !kbt->new_context;
+        address -= adjust;
+        if (address >= PAGE_OFFSET) {
+                /* Handle kernel symbols. */
+                BUG_ON(bufsize < KSYM_NAME_LEN);
+                name = kallsyms_lookup(address, &size, &offset,
+                                       &modname, buf);
+                if (name == NULL) {
+                        buf[0] = '\0';
+                        return;
+                }
+                namelen = strlen(buf);
+                remaining = (bufsize - 1) - namelen;
+                p = buf + namelen;
+                rc = snprintf(p, remaining, "+%#lx/%#lx ",
+                              offset + adjust, size);
+                if (modname && rc < remaining)
+                        snprintf(p + rc, remaining - rc, "[%s] ", modname);
+                buf[bufsize-1] = '\0';
+                return;
+        }
+        /* If we don't have the mmap_sem, we can't show any more info. */
+        buf[0] = '\0';
+        if (!have_mmap_sem)
+                return;
+        /* Find vma info. */
+        vma = find_vma(kbt->task->mm, address);
+        if (vma == NULL || address < vma->vm_start) {
+                snprintf(buf, bufsize, "[unmapped address] ");
+                return;
+        }
+        if (vma->vm_file) {
+                char *s;
+                p = d_path(&vma->vm_file->f_path, buf, bufsize);
+                if (IS_ERR(p))
+                        p = "?";
+                s = strrchr(p, '/');
+                if (s)
+                        p = s+1;
+        } else {
+                p = "anon";
+        }
+        /* Generate a string description of the vma info. */
+        namelen = strlen(p);
+        remaining = (bufsize - 1) - namelen;
+        memmove(buf, p, namelen);
+        snprintf(buf + namelen, remaining, "[%lx+%lx] ",
+                 vma->vm_start, vma->vm_end - vma->vm_start);
+}
 /*
 * This method wraps the backtracer's more generic support.
 * It is only invoked from the architecture-specific code; show_stack()
@@ -353,6 +359,7 @@ EXPORT_SYMBOL(KBacktraceIterator_next);
 void tile_show_stack(struct KBacktraceIterator *kbt, int headers)
 {
        int i;
+        int have_mmap_sem = 0;
        if (headers) {
                /*
@@ -369,31 +376,16 @@ void tile_show_stack(struct KBacktraceIterator *kbt, int headers)
        kbt->verbose = 1;
        i = 0;
        for (; !KBacktraceIterator_end(kbt); KBacktraceIterator_next(kbt)) {
-                char *modname;
-                const char *name;
-                unsigned long address = kbt->it.pc;
-                unsigned long offset, size;
                char namebuf[KSYM_NAME_LEN+100];
+                unsigned long address = kbt->it.pc;
-                if (address >= PAGE_OFFSET)
+                /* Try to acquire the mmap_sem as we pass into userspace. */
-                        name = kallsyms_lookup(address, &size, &offset,
+                if (address < PAGE_OFFSET && !have_mmap_sem && kbt->task->mm)
-                                               &modname, namebuf);
+                        have_mmap_sem =
-                else
+                                down_read_trylock(&kbt->task->mm->mmap_sem);
-                        name = NULL;
+                describe_addr(kbt, address, have_mmap_sem,
-                if (!name)
+                              namebuf, sizeof(namebuf));
-                        namebuf[0] = '\0';
-                else {
-                        size_t namelen = strlen(namebuf);
-                        size_t remaining = (sizeof(namebuf) - 1) - namelen;
-                        char *p = namebuf + namelen;
-                        int rc = snprintf(p, remaining, "+%#lx/%#lx ",
-                                          offset, size);
-                        if (modname && rc < remaining)
-                                snprintf(p + rc, remaining - rc,
-                                         "[%s] ", modname);
-                        namebuf[sizeof(namebuf)-1] = '\0';
-                }
                pr_err("  frame %d: 0x%lx %s(sp 0x%lx)\n",
                       i++, address, namebuf, (unsigned long)(kbt->it.sp));
@@ -408,6 +400,8 @@ void tile_show_stack(struct KBacktraceIterator *kbt, int headers)
                pr_err("Stack dump stopped; next frame identical to this one\n");
        if (headers)
                pr_err("Stack dump complete\n");
+        if (have_mmap_sem)
+                up_read(&kbt->task->mm->mmap_sem);
 }
 EXPORT_SYMBOL(tile_show_stack);
diff --git a/arch/tile/kernel/traps.c b/arch/tile/kernel/traps.c
index 2bb6602a1ee7..73cff814ac57 100644
--- a/arch/tile/kernel/traps.c
+++ b/arch/tile/kernel/traps.c
@@ -200,7 +200,7 @@ void __kprobes do_trap(struct pt_regs *regs, int fault_num,
 {
        siginfo_t info = { 0 };
        int signo, code;
-        unsigned long address;
+        unsigned long address = 0;
        bundle_bits instr;
        /* Re-enable interrupts. */
@@ -223,6 +223,10 @@ void __kprobes do_trap(struct pt_regs *regs, int fault_num,
        }
        switch (fault_num) {
+        case INT_MEM_ERROR:
+                signo = SIGBUS;
+                code = BUS_OBJERR;
+                break;
        case INT_ILL:
                if (copy_from_user(&instr, (void __user *)regs->pc,
                                   sizeof(instr))) {
@@ -289,7 +293,10 @@ void __kprobes do_trap(struct pt_regs *regs, int fault_num,
                address = regs->pc;
                break;
 #ifdef __tilegx__
-        case INT_ILL_TRANS:
+        case INT_ILL_TRANS: {
+                /* Avoid a hardware erratum with the return address stack. */
+                fill_ra_stack();
                signo = SIGSEGV;
                code = SEGV_MAPERR;
                if (reason & SPR_ILL_TRANS_REASON__I_STREAM_VA_RMASK)
@@ -297,6 +304,7 @@ void __kprobes do_trap(struct pt_regs *regs, int fault_num,
                else
                        address = 0;  /* FIXME: GX: single-step for address */
                break;
+        }
 #endif
        default:
                panic("Unexpected do_trap interrupt number %d", fault_num);
@@ -308,7 +316,8 @@ void __kprobes do_trap(struct pt_regs *regs, int fault_num,
        info.si_addr = (void __user *)address;
        if (signo == SIGILL)
                info.si_trapno = fault_num;
-        trace_unhandled_signal("trap", regs, address, signo);
+        if (signo != SIGTRAP)
+                trace_unhandled_signal("trap", regs, address, signo);
        force_sig_info(signo, &info, current);
 }
diff --git a/arch/tile/lib/Makefile b/arch/tile/lib/Makefile
index 0c26086ecbef..985f59858234 100644
--- a/arch/tile/lib/Makefile
+++ b/arch/tile/lib/Makefile
@@ -7,6 +7,7 @@ lib-y = cacheflush.o checksum.o cpumask.o delay.o uaccess.o \
        strchr_$(BITS).o strlen_$(BITS).o
 ifeq ($(CONFIG_TILEGX),y)
+CFLAGS_REMOVE_memcpy_user_64.o = -fno-omit-frame-pointer
 lib-y += memcpy_user_64.o
 else
 lib-y += atomic_32.o atomic_asm_32.o memcpy_tile64.o
diff --git a/arch/tile/lib/cacheflush.c b/arch/tile/lib/cacheflush.c
index 8928aace7a64..db4fb89e12d8 100644
--- a/arch/tile/lib/cacheflush.c
+++ b/arch/tile/lib/cacheflush.c
@@ -39,7 +39,21 @@ void finv_buffer_remote(void *buffer, size_t size, int hfh)
 {
        char *p, *base;
        size_t step_size, load_count;
+        /*
+         * On TILEPro the striping granularity is a fixed 8KB; on
+         * TILE-Gx it is configurable, and we rely on the fact that
+         * the hypervisor always configures maximum striping, so that
+         * bits 9 and 10 of the PA are part of the stripe function, so
+         * every 512 bytes we hit a striping boundary.
+         *
+         */
+#ifdef __tilegx__
+        const unsigned long STRIPE_WIDTH = 512;
+#else
        const unsigned long STRIPE_WIDTH = 8192;
+#endif
 #ifdef __tilegx__
        /*
         * On TILE-Gx, we must disable the dstream prefetcher before doing
@@ -74,7 +88,7 @@ void finv_buffer_remote(void *buffer, size_t size, int hfh)
         * memory, that one load would be sufficient, but since we may
         * be, we also need to back up to the last load issued to
         * another memory controller, which would be the point where
-         * we crossed an 8KB boundary (the granularity of striping
+         * we crossed a "striping" boundary (the granularity of striping
         * across memory controllers).  Keep backing up and doing this
         * until we are before the beginning of the buffer, or have
         * hit all the controllers.
@@ -88,12 +102,22 @@ void finv_buffer_remote(void *buffer, size_t size, int hfh)
         * every cache line on a full memory stripe on each
         * controller" that we simply do that, to simplify the logic.
         *
-         * FIXME: See bug 9535 for some issues with this code.
+         * On TILE-Gx the hash-for-home function is much more complex,
+         * with the upshot being we can't readily guarantee we have
+         * hit both entries in the 128-entry AMT that were hit by any
+         * load in the entire range, so we just re-load them all.
+         * With larger buffers, we may want to consider using a hypervisor
+         * trap to issue loads directly to each hash-for-home tile for
+         * each controller (doing it from Linux would trash the TLB).
         */
        if (hfh) {
                step_size = L2_CACHE_BYTES;
+#ifdef __tilegx__
+                load_count = (size + L2_CACHE_BYTES - 1) / L2_CACHE_BYTES;
+#else
                load_count = (STRIPE_WIDTH / L2_CACHE_BYTES) *
                              (1 << CHIP_LOG_NUM_MSHIMS());
+#endif
        } else {
                step_size = STRIPE_WIDTH;
                load_count = (1 << CHIP_LOG_NUM_MSHIMS());
@@ -109,7 +133,7 @@ void finv_buffer_remote(void *buffer, size_t size, int hfh)
        /* Figure out how far back we need to go. */
        base = p - (step_size * (load_count - 2));
-        if ((long)base < (long)buffer)
+        if ((unsigned long)base < (unsigned long)buffer)
                base = buffer;
        /*
diff --git a/arch/tile/lib/memcpy_user_64.c b/arch/tile/lib/memcpy_user_64.c
index 4763b3aff1cc..37440caa7370 100644
--- a/arch/tile/lib/memcpy_user_64.c
+++ b/arch/tile/lib/memcpy_user_64.c
@@ -14,7 +14,13 @@
 * Do memcpy(), but trap and return "n" when a load or store faults.
 *
 * Note: this idiom only works when memcpy() compiles to a leaf function.
- * If "sp" is updated during memcpy, the "jrp lr" will be incorrect.
+ * Here leaf function not only means it does not have calls, but also
+ * requires no stack operations (sp, stack frame pointer) and no
+ * use of callee-saved registers, else "jrp lr" will be incorrect since
+ * unwinding stack frame is bypassed. Since memcpy() is not complex so
+ * these conditions are satisfied here, but we need to be careful when
+ * modifying this file. This is not a clean solution but is the best
+ * one so far.
 *
 * Also note that we are capturing "n" from the containing scope here.
 */
diff --git a/arch/tile/lib/spinlock_common.h b/arch/tile/lib/spinlock_common.h
index c10109809132..6ac37509faca 100644
--- a/arch/tile/lib/spinlock_common.h
+++ b/arch/tile/lib/spinlock_common.h
@@ -60,5 +60,5 @@ static void delay_backoff(int iterations)
        loops += __insn_crc32_32(stack_pointer, get_cycles_low()) &
                (loops - 1);
-        relax(1 << exponent);
+        relax(loops);
 }
diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
index cba30e9547b4..22e58f51ed23 100644
--- a/arch/tile/mm/fault.c
+++ b/arch/tile/mm/fault.c
@@ -130,7 +130,7 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
 }
 /*
- * Handle a fault on the vmalloc or module mapping area
+ * Handle a fault on the vmalloc area.
 */
 static inline int vmalloc_fault(pgd_t *pgd, unsigned long address)
 {
@@ -203,9 +203,14 @@ static pgd_t *get_current_pgd(void)
 * interrupt or a critical region, and must do as little as possible.
 * Similarly, we can't use atomic ops here, since we may be handling a
 * fault caused by an atomic op access.
+ *
+ * If we find a migrating PTE while we're in an NMI context, and we're
+ * at a PC that has a registered exception handler, we don't wait,
+ * since this thread may (e.g.) have been interrupted while migrating
+ * its own stack, which would then cause us to self-deadlock.
 */
 static int handle_migrating_pte(pgd_t *pgd, int fault_num,
-                                unsigned long address,
+                                unsigned long address, unsigned long pc,
                                int is_kernel_mode, int write)
 {
        pud_t *pud;
@@ -227,6 +232,8 @@ static int handle_migrating_pte(pgd_t *pgd, int fault_num,
                pte_offset_kernel(pmd, address);
        pteval = *pte;
        if (pte_migrating(pteval)) {
+                if (in_nmi() && search_exception_tables(pc))
+                        return 0;
                wait_for_migration(pte);
                return 1;
        }
@@ -300,7 +307,7 @@ static int handle_page_fault(struct pt_regs *regs,
         * rather than trying to patch up the existing PTE.
         */
        pgd = get_current_pgd();
-        if (handle_migrating_pte(pgd, fault_num, address,
+        if (handle_migrating_pte(pgd, fault_num, address, regs->pc,
                                 is_kernel_mode, write))
                return 1;
@@ -335,9 +342,12 @@ static int handle_page_fault(struct pt_regs *regs,
        /*
         * If we're trying to touch user-space addresses, we must
         * be either at PL0, or else with interrupts enabled in the
-         * kernel, so either way we can re-enable interrupts here.
+         * kernel, so either way we can re-enable interrupts here
+         * unless we are doing atomic access to user space with
+         * interrupts disabled.
         */
-        local_irq_enable();
+        if (!(regs->flags & PT_FLAGS_DISABLE_IRQ))
+                local_irq_enable();
        mm = tsk->mm;
@@ -665,7 +675,7 @@ struct intvec_state do_page_fault_ics(struct pt_regs *regs, int fault_num,
         */
        if (fault_num == INT_DTLB_ACCESS)
                write = 1;
-        if (handle_migrating_pte(pgd, fault_num, address, 1, write))
+        if (handle_migrating_pte(pgd, fault_num, address, pc, 1, write))
                return state;
        /* Return zero so that we continue on with normal fault handling. */
diff --git a/arch/tile/mm/homecache.c b/arch/tile/mm/homecache.c
index 1cc6ae477c98..499f73770b05 100644
--- a/arch/tile/mm/homecache.c
+++ b/arch/tile/mm/homecache.c
@@ -394,6 +394,7 @@ int page_home(struct page *page)
                return pte_to_home(*virt_to_pte(NULL, kva));
        }
 }
+EXPORT_SYMBOL(page_home);
 void homecache_change_page_home(struct page *page, int order, int home)
 {
diff --git a/arch/tile/mm/init.c b/arch/tile/mm/init.c
index 830c4908ea76..6a9d20ddc34f 100644
--- a/arch/tile/mm/init.c
+++ b/arch/tile/mm/init.c
@@ -254,11 +254,6 @@ static pgprot_t __init init_pgprot(ulong address)
                return construct_pgprot(PAGE_KERNEL_RO, PAGE_HOME_IMMUTABLE);
        }
-        /* As a performance optimization, keep the boot init stack here. */
-        if (address >= (ulong)&init_thread_union &&
-            address < (ulong)&init_thread_union + THREAD_SIZE)
-                return construct_pgprot(PAGE_KERNEL, smp_processor_id());
 #ifndef __tilegx__
 #if !ATOMIC_LOCKS_FOUND_VIA_TABLE()
        /* Force the atomic_locks[] array page to be hash-for-home. */
@@ -557,6 +552,7 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base)
        address = MEM_SV_INTRPT;
        pmd = get_pmd(pgtables, address);
+        pfn = 0;  /* code starts at PA 0 */
        if (ktext_small) {
                /* Allocate an L2 PTE for the kernel text */
                int cpu = 0;
@@ -579,10 +575,15 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base)
                }
                BUG_ON(address != (unsigned long)_stext);
-                pfn = 0;  /* code starts at PA 0 */
+                pte = NULL;
-                pte = alloc_pte();
+                for (; address < (unsigned long)_einittext;
-                for (pte_ofs = 0; address < (unsigned long)_einittext;
+                     pfn++, address += PAGE_SIZE) {
-                     pfn++, pte_ofs++, address += PAGE_SIZE) {
+                        pte_ofs = pte_index(address);
+                        if (pte_ofs == 0) {
+                                if (pte)
+                                        assign_pte(pmd++, pte);
+                                pte = alloc_pte();
+                        }
                        if (!ktext_local) {
                                prot = set_remote_cache_cpu(prot, cpu);
                                cpu = cpumask_next(cpu, &ktext_mask);
@@ -591,7 +592,8 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base)
                        }
                        pte[pte_ofs] = pfn_pte(pfn, prot);
                }
-                assign_pte(pmd, pte);
+                if (pte)
+                        assign_pte(pmd, pte);
        } else {
                pte_t pteval = pfn_pte(0, PAGE_KERNEL_EXEC);
                pteval = pte_mkhuge(pteval);
@@ -614,7 +616,9 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base)
                else
                        pteval = hv_pte_set_mode(pteval,
                                                 HV_PTE_MODE_CACHE_NO_L3);
-                *(pte_t *)pmd = pteval;
+                for (; address < (unsigned long)_einittext;
+                     pfn += PFN_DOWN(HPAGE_SIZE), address += HPAGE_SIZE)
+                        *(pte_t *)(pmd++) = pfn_pte(pfn, pteval);
        }
        /* Set swapper_pgprot here so it is flushed to memory right away. */
diff --git a/arch/tile/mm/pgtable.c b/arch/tile/mm/pgtable.c
index 87303693a072..2410aa899b3e 100644
--- a/arch/tile/mm/pgtable.c
+++ b/arch/tile/mm/pgtable.c
@@ -177,14 +177,10 @@ void shatter_huge_page(unsigned long addr)
        if (!pmd_huge_page(*pmd))
                return;
-        /*
+        spin_lock_irqsave(&init_mm.page_table_lock, flags);
-         * Grab the pgd_lock, since we may need it to walk the pgd_list,
-         * and since we need some kind of lock here to avoid races.
-         */
-        spin_lock_irqsave(&pgd_lock, flags);
        if (!pmd_huge_page(*pmd)) {
                /* Lost the race to convert the huge page. */
-                spin_unlock_irqrestore(&pgd_lock, flags);
+                spin_unlock_irqrestore(&init_mm.page_table_lock, flags);
                return;
        }
@@ -194,6 +190,7 @@ void shatter_huge_page(unsigned long addr)
 #ifdef __PAGETABLE_PMD_FOLDED
        /* Walk every pgd on the system and update the pmd there. */
+        spin_lock(&pgd_lock);
        list_for_each(pos, &pgd_list) {
                pmd_t *copy_pmd;
                pgd = list_to_pgd(pos) + pgd_index(addr);
@@ -201,6 +198,7 @@ void shatter_huge_page(unsigned long addr)
                copy_pmd = pmd_offset(pud, addr);
                __set_pmd(copy_pmd, *pmd);
        }
+        spin_unlock(&pgd_lock);
 #endif
        /* Tell every cpu to notice the change. */
@@ -208,7 +206,7 @@ void shatter_huge_page(unsigned long addr)
                     cpu_possible_mask, NULL, 0);
        /* Hold the lock until the TLB flush is finished to avoid races. */
-        spin_unlock_irqrestore(&pgd_lock, flags);
+        spin_unlock_irqrestore(&init_mm.page_table_lock, flags);
 }
 /*
@@ -217,9 +215,13 @@ void shatter_huge_page(unsigned long addr)
 * against pageattr.c; it is the unique case in which a valid change
 * of kernel pagetables can't be lazily synchronized by vmalloc faults.
 * vmalloc faults work because attached pagetables are never freed.
- * The locking scheme was chosen on the basis of manfred's
+ *
- * recommendations and having no core impact whatsoever.
+ * The lock is always taken with interrupts disabled, unlike on x86
- * -- wli
+ * and other platforms, because we need to take the lock in
+ * shatter_huge_page(), which may be called from an interrupt context.
+ * We are not at risk from the tlbflush IPI deadlock that was seen on
+ * x86, since we use the flush_remote() API to have the hypervisor do
+ * the TLB flushes regardless of irq disabling.
 */
 DEFINE_SPINLOCK(pgd_lock);
 LIST_HEAD(pgd_list);
@@ -469,10 +471,18 @@ void __set_pte(pte_t *ptep, pte_t pte)
 void set_pte(pte_t *ptep, pte_t pte)
 {
-        struct page *page = pfn_to_page(pte_pfn(pte));
+        if (pte_present(pte) &&
+            (!CHIP_HAS_MMIO() || hv_pte_get_mode(pte) != HV_PTE_MODE_MMIO)) {
-        /* Update the home of a PTE if necessary */
+                /* The PTE actually references physical memory. */
-        pte = pte_set_home(pte, page_home(page));
+                unsigned long pfn = pte_pfn(pte);
+                if (pfn_valid(pfn)) {
+                        /* Update the home of the PTE from the struct page. */
+                        pte = pte_set_home(pte, page_home(pfn_to_page(pfn)));
+                } else if (hv_pte_get_mode(pte) == 0) {
+                        /* remap_pfn_range(), etc, must supply PTE mode. */
+                        panic("set_pte(): out-of-range PFN and mode 0\n");
+                }
+        }
        __set_pte(ptep, pte);
 }
diff --git a/arch/um/drivers/cow.h b/arch/um/drivers/cow.h
index dc36b222100b..6673508f3426 100644
--- a/arch/um/drivers/cow.h
+++ b/arch/um/drivers/cow.h
@@ -3,41 +3,6 @@
 #include <asm/types.h>
-#if defined(__KERNEL__)
-# include <asm/byteorder.h>
-# if defined(__BIG_ENDIAN)
-#       define ntohll(x) (x)
-#       define htonll(x) (x)
-# elif defined(__LITTLE_ENDIAN)
-#       define ntohll(x)  be64_to_cpu(x)
-#       define htonll(x)  cpu_to_be64(x)
-# else
-#       error "Could not determine byte order"
-# endif
-#else
-/* For the definition of ntohl, htonl and __BYTE_ORDER */
-#include <endian.h>
-#include <netinet/in.h>
-#if defined(__BYTE_ORDER)
-#  if __BYTE_ORDER == __BIG_ENDIAN
-#       define ntohll(x) (x)
-#       define htonll(x) (x)
-#  elif __BYTE_ORDER == __LITTLE_ENDIAN
-#       define ntohll(x)  bswap_64(x)
-#       define htonll(x)  bswap_64(x)
-#  else
-#       error "Could not determine byte order: __BYTE_ORDER uncorrectly defined"
-#  endif
-#else  /* ! defined(__BYTE_ORDER) */
-#       error "Could not determine byte order: __BYTE_ORDER not defined"
-#endif
-#endif /* ! defined(__KERNEL__) */
 extern int init_cow_file(int fd, char *cow_file, char *backing_file,
                         int sectorsize, int alignment, int *bitmap_offset_out,
                         unsigned long *bitmap_len_out, int *data_offset_out);
diff --git a/arch/um/drivers/cow_user.c b/arch/um/drivers/cow_user.c
index 9cbb426c0b91..0ee9cc6cc4c7 100644
--- a/arch/um/drivers/cow_user.c
+++ b/arch/um/drivers/cow_user.c
@@ -8,11 +8,10 @@
 * that.
 */
 #include <unistd.h>
-#include <byteswap.h>
 #include <errno.h>
 #include <string.h>
 #include <arpa/inet.h>
-#include <asm/types.h>
+#include <endian.h>
 #include "cow.h"
 #include "cow_sys.h"
@@ -214,8 +213,8 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
                           "header\n");
                goto out;
        }
-        header->magic = htonl(COW_MAGIC);
+        header->magic = htobe32(COW_MAGIC);
-        header->version = htonl(COW_VERSION);
+        header->version = htobe32(COW_VERSION);
        err = -EINVAL;
        if (strlen(backing_file) > sizeof(header->backing_file) - 1) {
@@ -246,10 +245,10 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
                goto out_free;
        }
-        header->mtime = htonl(modtime);
+        header->mtime = htobe32(modtime);
-        header->size = htonll(*size);
+        header->size = htobe64(*size);
-        header->sectorsize = htonl(sectorsize);
+        header->sectorsize = htobe32(sectorsize);
-        header->alignment = htonl(alignment);
+        header->alignment = htobe32(alignment);
        header->cow_format = COW_BITMAP;
        err = cow_write_file(fd, header, sizeof(*header));
@@ -301,8 +300,8 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
        magic = header->v1.magic;
        if (magic == COW_MAGIC)
                version = header->v1.version;
-        else if (magic == ntohl(COW_MAGIC))
+        else if (magic == be32toh(COW_MAGIC))
-                version = ntohl(header->v1.version);
+                version = be32toh(header->v1.version);
        /* No error printed because the non-COW case comes through here */
        else goto out;
@@ -327,9 +326,9 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                                   "header\n");
                        goto out;
                }
-                *mtime_out = ntohl(header->v2.mtime);
+                *mtime_out = be32toh(header->v2.mtime);
-                *size_out = ntohll(header->v2.size);
+                *size_out = be64toh(header->v2.size);
-                *sectorsize_out = ntohl(header->v2.sectorsize);
+                *sectorsize_out = be32toh(header->v2.sectorsize);
                *bitmap_offset_out = sizeof(header->v2);
                *align_out = *sectorsize_out;
                file = header->v2.backing_file;
@@ -341,10 +340,10 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                                   "header\n");
                        goto out;
                }
-                *mtime_out = ntohl(header->v3.mtime);
+                *mtime_out = be32toh(header->v3.mtime);
-                *size_out = ntohll(header->v3.size);
+                *size_out = be64toh(header->v3.size);
-                *sectorsize_out = ntohl(header->v3.sectorsize);
+                *sectorsize_out = be32toh(header->v3.sectorsize);
-                *align_out = ntohl(header->v3.alignment);
+                *align_out = be32toh(header->v3.alignment);
                if (*align_out == 0) {
                        cow_printf("read_cow_header - invalid COW header, "
                                   "align == 0\n");
@@ -366,16 +365,16 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                 * this was used until Dec2005 - 64bits are needed to represent
                 * 2038+. I.e. we can safely do this truncating cast.
                 *
-                 * Additionally, we must use ntohl() instead of ntohll(), since
+                 * Additionally, we must use be32toh() instead of be64toh(), since
                 * the program used to use the former (tested - I got mtime
                 * mismatch "0 vs whatever").
                 *
                 * Ever heard about bug-to-bug-compatibility ? ;-) */
-                *mtime_out = (time32_t) ntohl(header->v3_b.mtime);
+                *mtime_out = (time32_t) be32toh(header->v3_b.mtime);
-                *size_out = ntohll(header->v3_b.size);
+                *size_out = be64toh(header->v3_b.size);
-                *sectorsize_out = ntohl(header->v3_b.sectorsize);
+                *sectorsize_out = be32toh(header->v3_b.sectorsize);
-                *align_out = ntohl(header->v3_b.alignment);
+                *align_out = be32toh(header->v3_b.alignment);
                if (*align_out == 0) {
                        cow_printf("read_cow_header - invalid COW header, "
                                   "align == 0\n");
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index e672bd6d43e3..43b39d61b538 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -22,6 +22,7 @@
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
+#include <asm/switch_to.h>
 #include "init.h"
 #include "irq_kern.h"
diff --git a/arch/um/include/asm/Kbuild b/arch/um/include/asm/Kbuild
index 8419f5cf2ac7..fff24352255d 100644
--- a/arch/um/include/asm/Kbuild
+++ b/arch/um/include/asm/Kbuild
@@ -1,3 +1,4 @@
 generic-y += bug.h cputime.h device.h emergency-restart.h futex.h hardirq.h
 generic-y += hw_irq.h irq_regs.h kdebug.h percpu.h sections.h topology.h xor.h
-generic-y += ftrace.h pci.h io.h param.h delay.h mutex.h current.h
+generic-y += ftrace.h pci.h io.h param.h delay.h mutex.h current.h exec.h
+generic-y += switch_to.h
diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
index 492bc4c1b62b..65a1c3d690ea 100644
--- a/arch/um/kernel/Makefile
+++ b/arch/um/kernel/Makefile
@@ -3,9 +3,10 @@
 # Licensed under the GPL
 #
-CPPFLAGS_vmlinux.lds := -DSTART=$(LDS_START) \
+CPPFLAGS_vmlinux.lds := -DSTART=$(LDS_START)            \
-                        -DELF_ARCH=$(LDS_ELF_ARCH)        \
+                        -DELF_ARCH=$(LDS_ELF_ARCH)      \
-                        -DELF_FORMAT=$(LDS_ELF_FORMAT)
+                        -DELF_FORMAT=$(LDS_ELF_FORMAT)  \
+                        $(LDS_EXTRA)
 extra-y := vmlinux.lds
 clean-files :=
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index f386d04a84a5..2b73dedb44ca 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -88,11 +88,8 @@ static inline void set_current(struct task_struct *task)
 extern void arch_switch_to(struct task_struct *to);
-void *_switch_to(void *prev, void *next, void *last)
+void *__switch_to(struct task_struct *from, struct task_struct *to)
 {
-        struct task_struct *from = prev;
-        struct task_struct *to = next;
        to->thread.prev_sched = from;
        set_current(to);
@@ -111,7 +108,6 @@ void *_switch_to(void *prev, void *next, void *last)
        } while (current->thread.saved_task);
        return current->thread.prev_sched;
 }
 void interrupt_end(void)
diff --git a/arch/um/kernel/skas/mmu.c b/arch/um/kernel/skas/mmu.c
index 4947b319f53a..0a49ef0c2bf4 100644
--- a/arch/um/kernel/skas/mmu.c
+++ b/arch/um/kernel/skas/mmu.c
@@ -103,7 +103,6 @@ int init_new_context(struct task_struct *task, struct mm_struct *mm)
 void uml_setup_stubs(struct mm_struct *mm)
 {
-        struct page **pages;
        int err, ret;
        if (!skas_needs_stub)
diff --git a/arch/x86/Makefile.um b/arch/x86/Makefile.um
index 4be406abeefd..36b62bc52638 100644
--- a/arch/x86/Makefile.um
+++ b/arch/x86/Makefile.um
@@ -14,6 +14,9 @@ LINK-y			+= $(call cc-option,-m32)
 export LDFLAGS
+LDS_EXTRA               := -Ui386
+export LDS_EXTRA
 # First of all, tune CFLAGS for the specific CPU. This actually sets cflags-y.
 include $(srctree)/arch/x86/Makefile_32.cpu
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 8be5f54d9360..e0544597cfe7 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -557,6 +557,8 @@ struct __large_struct { unsigned long buf[100]; };
 extern unsigned long
 copy_from_user_nmi(void *to, const void __user *from, unsigned long n);
+extern __must_check long
+strncpy_from_user(char *dst, const char __user *src, long count);
 /*
 * movsl can be slow when source and dest are not both 8-byte aligned
diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
index 566e803cc602..8084bc73b18c 100644
--- a/arch/x86/include/asm/uaccess_32.h
+++ b/arch/x86/include/asm/uaccess_32.h
@@ -213,11 +213,6 @@ static inline unsigned long __must_check copy_from_user(void *to,
        return n;
 }
-long __must_check strncpy_from_user(char *dst, const char __user *src,
-                                    long count);
-long __must_check __strncpy_from_user(char *dst,
-                                      const char __user *src, long count);
 /**
 * strlen_user: - Get the size of a string in user space.
 * @str: The string to measure.
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 1c66d30971ad..fcd4b6f3ef02 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -208,10 +208,6 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
        }
 }
-__must_check long
-strncpy_from_user(char *dst, const char __user *src, long count);
-__must_check long
-__strncpy_from_user(char *dst, const char __user *src, long count);
 __must_check long strnlen_user(const char __user *str, long n);
 __must_check long __strnlen_user(const char __user *str, long n);
 __must_check long strlen_user(const char __user *str);
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 694d801bf606..b8ba6e4a27e4 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -38,6 +38,7 @@
 #include <asm/traps.h>
 #include <asm/desc.h>
 #include <asm/tlbflush.h>
+#include <asm/idle.h>
 static int kvmapf = 1;
@@ -253,7 +254,10 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code)
                kvm_async_pf_task_wait((u32)read_cr2());
                break;
        case KVM_PV_REASON_PAGE_READY:
+                rcu_irq_enter();
+                exit_idle();
                kvm_async_pf_task_wake((u32)read_cr2());
+                rcu_irq_exit();
                break;
        }
 }
diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index a73f0c104813..173df38dbda5 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -369,7 +369,7 @@ int kvm_pmu_set_msr(struct kvm_vcpu *vcpu, u32 index, u64 data)
        case MSR_CORE_PERF_FIXED_CTR_CTRL:
                if (pmu->fixed_ctr_ctrl == data)
                        return 0;
-                if (!(data & 0xfffffffffffff444)) {
+                if (!(data & 0xfffffffffffff444ull)) {
                        reprogram_fixed_counters(pmu, data);
                        return 0;
                }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 280751c84724..ad85adfef843 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3906,7 +3906,9 @@ static int vmx_vcpu_reset(struct kvm_vcpu *vcpu)
                vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
        vmx->vcpu.arch.cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
+        vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
        vmx_set_cr0(&vmx->vcpu, kvm_read_cr0(vcpu)); /* enter rmode */
+        srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
        vmx_set_cr4(&vmx->vcpu, 0);
        vmx_set_efer(&vmx->vcpu, 0);
        vmx_fpu_activate(&vmx->vcpu);
diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
index 97be9cb54483..57252c928f56 100644
--- a/arch/x86/lib/usercopy.c
+++ b/arch/x86/lib/usercopy.c
@@ -7,6 +7,8 @@
 #include <linux/highmem.h>
 #include <linux/module.h>
+#include <asm/word-at-a-time.h>
 /*
 * best effort, GUP based copy_from_user() that is NMI-safe
 */
@@ -41,3 +43,104 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
        return len;
 }
 EXPORT_SYMBOL_GPL(copy_from_user_nmi);
+static inline unsigned long count_bytes(unsigned long mask)
+{
+        mask = (mask - 1) & ~mask;
+        mask >>= 7;
+        return count_masked_bytes(mask);
+}
+/*
+ * Do a strncpy, return length of string without final '\0'.
+ * 'count' is the user-supplied count (return 'count' if we
+ * hit it), 'max' is the address space maximum (and we return
+ * -EFAULT if we hit it).
+ */
+static inline long do_strncpy_from_user(char *dst, const char __user *src, long count, long max)
+{
+        long res = 0;
+        /*
+         * Truncate 'max' to the user-specified limit, so that
+         * we only have one limit we need to check in the loop
+         */
+        if (max > count)
+                max = count;
+        while (max >= sizeof(unsigned long)) {
+                unsigned long c;
+                /* Fall back to byte-at-a-time if we get a page fault */
+                if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
+                        break;
+                /* This can write a few bytes past the NUL character, but that's ok */
+                *(unsigned long *)(dst+res) = c;
+                c = has_zero(c);
+                if (c)
+                        return res + count_bytes(c);
+                res += sizeof(unsigned long);
+                max -= sizeof(unsigned long);
+        }
+        while (max) {
+                char c;
+                if (unlikely(__get_user(c,src+res)))
+                        return -EFAULT;
+                dst[res] = c;
+                if (!c)
+                        return res;
+                res++;
+                max--;
+        }
+        /*
+         * Uhhuh. We hit 'max'. But was that the user-specified maximum
+         * too? If so, that's ok - we got as much as the user asked for.
+         */
+        if (res >= count)
+                return count;
+        /*
+         * Nope: we hit the address space limit, and we still had more
+         * characters the caller would have wanted. That's an EFAULT.
+         */
+        return -EFAULT;
+}
+/**
+ * strncpy_from_user: - Copy a NUL terminated string from userspace.
+ * @dst:   Destination address, in kernel space.  This buffer must be at
+ *         least @count bytes long.
+ * @src:   Source address, in user space.
+ * @count: Maximum number of bytes to copy, including the trailing NUL.
+ *
+ * Copies a NUL-terminated string from userspace to kernel space.
+ *
+ * On success, returns the length of the string (not including the trailing
+ * NUL).
+ *
+ * If access to userspace fails, returns -EFAULT (some data may have been
+ * copied).
+ *
+ * If @count is smaller than the length of the string, copies @count bytes
+ * and returns @count.
+ */
+long
+strncpy_from_user(char *dst, const char __user *src, long count)
+{
+        unsigned long max_addr, src_addr;
+        if (unlikely(count <= 0))
+                return 0;
+        max_addr = current_thread_info()->addr_limit.seg;
+        src_addr = (unsigned long)src;
+        if (likely(src_addr < max_addr)) {
+                unsigned long max = max_addr - src_addr;
+                return do_strncpy_from_user(dst, src, count, max);
+        }
+        return -EFAULT;
+}
+EXPORT_SYMBOL(strncpy_from_user);
diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
index d9b094ca7aaa..ef2a6a5d78e3 100644
--- a/arch/x86/lib/usercopy_32.c
+++ b/arch/x86/lib/usercopy_32.c
@@ -33,93 +33,6 @@ static inline int __movsl_is_ok(unsigned long a1, unsigned long a2, unsigned lon
        __movsl_is_ok((unsigned long)(a1), (unsigned long)(a2), (n))
 /*
- * Copy a null terminated string from userspace.
- */
-#define __do_strncpy_from_user(dst, src, count, res)                       \
-do {                                                                       \
-        int __d0, __d1, __d2;                                              \
-        might_fault();                                                     \
-        __asm__ __volatile__(                                              \
-                "       testl %1,%1\n"                                     \
-                "       jz 2f\n"                                           \
-                "0:     lodsb\n"                                           \
-                "       stosb\n"                                           \
-                "       testb %%al,%%al\n"                                 \
-                "       jz 1f\n"                                           \
-                "       decl %1\n"                                         \
-                "       jnz 0b\n"                                          \
-                "1:     subl %1,%0\n"                                      \
-                "2:\n"                                                     \
-                ".section .fixup,\"ax\"\n"                                 \
-                "3:     movl %5,%0\n"                                      \
-                "       jmp 2b\n"                                          \
-                ".previous\n"                                              \
-                _ASM_EXTABLE(0b,3b)                                        \
-                : "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),    \
-                  "=&D" (__d2)                                             \
-                : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
-                : "memory");                                               \
-} while (0)
-/**
- * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
- * @dst:   Destination address, in kernel space.  This buffer must be at
- *         least @count bytes long.
- * @src:   Source address, in user space.
- * @count: Maximum number of bytes to copy, including the trailing NUL.
- *
- * Copies a NUL-terminated string from userspace to kernel space.
- * Caller must check the specified block with access_ok() before calling
- * this function.
- *
- * On success, returns the length of the string (not including the trailing
- * NUL).
- *
- * If access to userspace fails, returns -EFAULT (some data may have been
- * copied).
- *
- * If @count is smaller than the length of the string, copies @count bytes
- * and returns @count.
- */
-long
-__strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res;
-        __do_strncpy_from_user(dst, src, count, res);
-        return res;
-}
-EXPORT_SYMBOL(__strncpy_from_user);
-/**
- * strncpy_from_user: - Copy a NUL terminated string from userspace.
- * @dst:   Destination address, in kernel space.  This buffer must be at
- *         least @count bytes long.
- * @src:   Source address, in user space.
- * @count: Maximum number of bytes to copy, including the trailing NUL.
- *
- * Copies a NUL-terminated string from userspace to kernel space.
- *
- * On success, returns the length of the string (not including the trailing
- * NUL).
- *
- * If access to userspace fails, returns -EFAULT (some data may have been
- * copied).
- *
- * If @count is smaller than the length of the string, copies @count bytes
- * and returns @count.
- */
-long
-strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res = -EFAULT;
-        if (access_ok(VERIFY_READ, src, 1))
-                __do_strncpy_from_user(dst, src, count, res);
-        return res;
-}
-EXPORT_SYMBOL(strncpy_from_user);
-/*
 * Zero Userspace
 */
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
index b7c2849ffb66..0d0326f388c0 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -9,55 +9,6 @@
 #include <asm/uaccess.h>
 /*
- * Copy a null terminated string from userspace.
- */
-#define __do_strncpy_from_user(dst,src,count,res)                          \
-do {                                                                       \
-        long __d0, __d1, __d2;                                             \
-        might_fault();                                                     \
-        __asm__ __volatile__(                                              \
-                "       testq %1,%1\n"                                     \
-                "       jz 2f\n"                                           \
-                "0:     lodsb\n"                                           \
-                "       stosb\n"                                           \
-                "       testb %%al,%%al\n"                                 \
-                "       jz 1f\n"                                           \
-                "       decq %1\n"                                         \
-                "       jnz 0b\n"                                          \
-                "1:     subq %1,%0\n"                                      \
-                "2:\n"                                                     \
-                ".section .fixup,\"ax\"\n"                                 \
-                "3:     movq %5,%0\n"                                      \
-                "       jmp 2b\n"                                          \
-                ".previous\n"                                              \
-                _ASM_EXTABLE(0b,3b)                                        \
-                : "=&r"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),    \
-                  "=&D" (__d2)                                             \
-                : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
-                : "memory");                                               \
-} while (0)
-long
-__strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res;
-        __do_strncpy_from_user(dst, src, count, res);
-        return res;
-}
-EXPORT_SYMBOL(__strncpy_from_user);
-long
-strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res = -EFAULT;
-        if (access_ok(VERIFY_READ, src, 1))
-                return __strncpy_from_user(dst, src, count);
-        return res;
-}
-EXPORT_SYMBOL(strncpy_from_user);
-/*
 * Zero Userspace
 */
diff --git a/arch/x86/um/asm/barrier.h b/arch/x86/um/asm/barrier.h
new file mode 100644
index 000000000000..7d01b8c56c00
--- /dev/null
+++ b/arch/x86/um/asm/barrier.h
@@ -0,0 +1,75 @@
+#ifndef _ASM_UM_BARRIER_H_
+#define _ASM_UM_BARRIER_H_
+#include <asm/asm.h>
+#include <asm/segment.h>
+#include <asm/cpufeature.h>
+#include <asm/cmpxchg.h>
+#include <asm/nops.h>
+#include <linux/kernel.h>
+#include <linux/irqflags.h>
+/*
+ * Force strict CPU ordering.
+ * And yes, this is required on UP too when we're talking
+ * to devices.
+ */
+#ifdef CONFIG_X86_32
+#define mb()    alternative("lock; addl $0,0(%%esp)", "mfence", X86_FEATURE_XMM2)
+#define rmb()   alternative("lock; addl $0,0(%%esp)", "lfence", X86_FEATURE_XMM2)
+#define wmb()   alternative("lock; addl $0,0(%%esp)", "sfence", X86_FEATURE_XMM)
+#else /* CONFIG_X86_32 */
+#define mb()    asm volatile("mfence" : : : "memory")
+#define rmb()   asm volatile("lfence" : : : "memory")
+#define wmb()   asm volatile("sfence" : : : "memory")
+#endif /* CONFIG_X86_32 */
+#define read_barrier_depends()  do { } while (0)
+#ifdef CONFIG_SMP
+#define smp_mb()        mb()
+#ifdef CONFIG_X86_PPRO_FENCE
+#define smp_rmb()       rmb()
+#else /* CONFIG_X86_PPRO_FENCE */
+#define smp_rmb()       barrier()
+#endif /* CONFIG_X86_PPRO_FENCE */
+#ifdef CONFIG_X86_OOSTORE
+#define smp_wmb()       wmb()
+#else /* CONFIG_X86_OOSTORE */
+#define smp_wmb()       barrier()
+#endif /* CONFIG_X86_OOSTORE */
+#define smp_read_barrier_depends()      read_barrier_depends()
+#define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
+#else /* CONFIG_SMP */
+#define smp_mb()        barrier()
+#define smp_rmb()       barrier()
+#define smp_wmb()       barrier()
+#define smp_read_barrier_depends()      do { } while (0)
+#define set_mb(var, value) do { var = value; barrier(); } while (0)
+#endif /* CONFIG_SMP */
+/*
+ * Stop RDTSC speculation. This is needed when you need to use RDTSC
+ * (or get_cycles or vread that possibly accesses the TSC) in a defined
+ * code region.
+ *
+ * (Could use an alternative three way for this if there was one.)
+ */
+static inline void rdtsc_barrier(void)
+{
+        alternative(ASM_NOP3, "mfence", X86_FEATURE_MFENCE_RDTSC);
+        alternative(ASM_NOP3, "lfence", X86_FEATURE_LFENCE_RDTSC);
+}
+#endif
diff --git a/arch/x86/um/asm/system.h b/arch/x86/um/asm/system.h
deleted file mode 100644
index a459fd9b7598..000000000000
--- a/arch/x86/um/asm/system.h
+++ /dev/null
@@ -1,135 +0,0 @@
-#ifndef _ASM_X86_SYSTEM_H_
-#define _ASM_X86_SYSTEM_H_
-#include <asm/asm.h>
-#include <asm/segment.h>
-#include <asm/cpufeature.h>
-#include <asm/cmpxchg.h>
-#include <asm/nops.h>
-#include <linux/kernel.h>
-#include <linux/irqflags.h>
-/* entries in ARCH_DLINFO: */
-#ifdef CONFIG_IA32_EMULATION
-# define AT_VECTOR_SIZE_ARCH 2
-#else
-# define AT_VECTOR_SIZE_ARCH 1
-#endif
-extern unsigned long arch_align_stack(unsigned long sp);
-void default_idle(void);
-/*
- * Force strict CPU ordering.
- * And yes, this is required on UP too when we're talking
- * to devices.
- */
-#ifdef CONFIG_X86_32
-/*
- * Some non-Intel clones support out of order store. wmb() ceases to be a
- * nop for these.
- */
-#define mb() alternative("lock; addl $0,0(%%esp)", "mfence", X86_FEATURE_XMM2)
-#define rmb() alternative("lock; addl $0,0(%%esp)", "lfence", X86_FEATURE_XMM2)
-#define wmb() alternative("lock; addl $0,0(%%esp)", "sfence", X86_FEATURE_XMM)
-#else
-#define mb()    asm volatile("mfence":::"memory")
-#define rmb()   asm volatile("lfence":::"memory")
-#define wmb()   asm volatile("sfence" ::: "memory")
-#endif
-/**
- * read_barrier_depends - Flush all pending reads that subsequents reads
- * depend on.
- *
- * No data-dependent reads from memory-like regions are ever reordered
- * over this barrier.  All reads preceding this primitive are guaranteed
- * to access memory (but not necessarily other CPUs' caches) before any
- * reads following this primitive that depend on the data return by
- * any of the preceding reads.  This primitive is much lighter weight than
- * rmb() on most CPUs, and is never heavier weight than is
- * rmb().
- *
- * These ordering constraints are respected by both the local CPU
- * and the compiler.
- *
- * Ordering is not guaranteed by anything other than these primitives,
- * not even by data dependencies.  See the documentation for
- * memory_barrier() for examples and URLs to more information.
- *
- * For example, the following code would force ordering (the initial
- * value of "a" is zero, "b" is one, and "p" is "&a"):
- *
- * <programlisting>
- *      CPU 0                           CPU 1
- *
- *      b = 2;
- *      memory_barrier();
- *      p = &b;                         q = p;
- *                                      read_barrier_depends();
- *                                      d = *q;
- * </programlisting>
- *
- * because the read of "*q" depends on the read of "p" and these
- * two reads are separated by a read_barrier_depends().  However,
- * the following code, with the same initial values for "a" and "b":
- *
- * <programlisting>
- *      CPU 0                           CPU 1
- *
- *      a = 2;
- *      memory_barrier();
- *      b = 3;                          y = b;
- *                                      read_barrier_depends();
- *                                      x = a;
- * </programlisting>
- *
- * does not enforce ordering, since there is no data dependency between
- * the read of "a" and the read of "b".  Therefore, on some CPUs, such
- * as Alpha, "y" could be set to 3 and "x" to 0.  Use rmb()
- * in cases like this where there are no data dependencies.
- **/
-#define read_barrier_depends()  do { } while (0)
-#ifdef CONFIG_SMP
-#define smp_mb()        mb()
-#ifdef CONFIG_X86_PPRO_FENCE
-# define smp_rmb()      rmb()
-#else
-# define smp_rmb()      barrier()
-#endif
-#ifdef CONFIG_X86_OOSTORE
-# define smp_wmb()      wmb()
-#else
-# define smp_wmb()      barrier()
-#endif
-#define smp_read_barrier_depends()      read_barrier_depends()
-#define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
-#else
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      do { } while (0)
-#define set_mb(var, value) do { var = value; barrier(); } while (0)
-#endif
-/*
- * Stop RDTSC speculation. This is needed when you need to use RDTSC
- * (or get_cycles or vread that possibly accesses the TSC) in a defined
- * code region.
- *
- * (Could use an alternative three way for this if there was one.)
- */
-static inline void rdtsc_barrier(void)
-{
-        alternative(ASM_NOP3, "mfence", X86_FEATURE_MFENCE_RDTSC);
-        alternative(ASM_NOP3, "lfence", X86_FEATURE_LFENCE_RDTSC);
-}
-extern void *_switch_to(void *prev, void *next, void *last);
-#define switch_to(prev, next, last) prev = _switch_to(prev, next, last)
-#endif
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 988828b479ed..b8e279479a6b 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1859,6 +1859,7 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
 #endif  /* CONFIG_X86_64 */
 static unsigned char dummy_mapping[PAGE_SIZE] __page_aligned_bss;
+static unsigned char fake_ioapic_mapping[PAGE_SIZE] __page_aligned_bss;
 static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 {
@@ -1899,7 +1900,7 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
                 * We just don't map the IO APIC - all access is via
                 * hypercalls.  Keep the address in the pte for reference.
                 */
-                pte = pfn_pte(PFN_DOWN(__pa(dummy_mapping)), PAGE_KERNEL);
+                pte = pfn_pte(PFN_DOWN(__pa(fake_ioapic_mapping)), PAGE_KERNEL);
                break;
 #endif
@@ -2064,6 +2065,7 @@ void __init xen_init_mmu_ops(void)
        pv_mmu_ops = xen_mmu_ops;
        memset(dummy_mapping, 0xff, PAGE_SIZE);
+        memset(fake_ioapic_mapping, 0xfd, PAGE_SIZE);
 }
 /* Protected by xen_reservation_lock. */
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 02900e8ce26c..5fac6919b957 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -59,7 +59,7 @@ static irqreturn_t xen_reschedule_interrupt(int irq, void *dev_id)
 static void __cpuinit cpu_bringup(void)
 {
-        int cpu = smp_processor_id();
+        int cpu;
        cpu_init();
        touch_softlockup_watchdog();
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 21ff9d015432..8e84225c096b 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -627,7 +627,7 @@ config CRYPTO_BLOWFISH_COMMON
 config CRYPTO_BLOWFISH_X86_64
        tristate "Blowfish cipher algorithm (x86_64)"
-        depends on (X86 || UML_X86) && 64BIT
+        depends on X86 && 64BIT
        select CRYPTO_ALGAPI
        select CRYPTO_BLOWFISH_COMMON
        help
@@ -657,7 +657,7 @@ config CRYPTO_CAMELLIA
 config CRYPTO_CAMELLIA_X86_64
        tristate "Camellia cipher algorithm (x86_64)"
-        depends on (X86 || UML_X86) && 64BIT
+        depends on X86 && 64BIT
        depends on CRYPTO
        select CRYPTO_ALGAPI
        select CRYPTO_LRW
@@ -893,7 +893,7 @@ config CRYPTO_TWOFISH_X86_64
 config CRYPTO_TWOFISH_X86_64_3WAY
        tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
-        depends on (X86 || UML_X86) && 64BIT
+        depends on X86 && 64BIT
        select CRYPTO_ALGAPI
        select CRYPTO_TWOFISH_COMMON
        select CRYPTO_TWOFISH_X86_64
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index b3447f63e46b..f3decb30223f 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -786,7 +786,7 @@ static int acpi_idle_play_dead(struct cpuidle_device *dev, int index)
        while (1) {
                if (cx->entry_method == ACPI_CSTATE_HALT)
-                        halt();
+                        safe_halt();
                else if (cx->entry_method == ACPI_CSTATE_SYSTEMIO) {
                        inb(cx->address);
                        /* See comment in acpi_idle_do_entry() */
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index fb14a6343d4f..92b779ee002b 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -138,6 +138,7 @@ static int rbtree_show(struct seq_file *s, void *ignored)
        unsigned int base, top;
        int nodes = 0;
        int registers = 0;
+        int average;
        mutex_lock(&map->lock);
@@ -152,8 +153,13 @@ static int rbtree_show(struct seq_file *s, void *ignored)
                registers += top - base + 1;
        }
+        if (nodes)
+                average = registers / nodes;
+        else
+                average = 0;
        seq_printf(s, "%d nodes, %d registers, average %d registers\n",
-                   nodes, registers, registers / nodes);
+                   nodes, registers, average);
        mutex_unlock(&map->lock);
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 87f54dbf601b..74b69095def6 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -346,6 +346,7 @@ out:
        return ret;
 }
+EXPORT_SYMBOL_GPL(regcache_sync_region);
 /**
 * regcache_cache_only: Put a register map into cache only mode
diff --git a/drivers/bcma/Kconfig b/drivers/bcma/Kconfig
index c1172dafdffa..fb7c80fb721e 100644
--- a/drivers/bcma/Kconfig
+++ b/drivers/bcma/Kconfig
@@ -29,7 +29,7 @@ config BCMA_HOST_PCI
 config BCMA_DRIVER_PCI_HOSTMODE
        bool "Driver for PCI core working in hostmode"
-        depends on BCMA && MIPS
+        depends on BCMA && MIPS && BCMA_HOST_PCI
        help
          PCI core hostmode operation (external PCI bus).
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index 4e20bcfa7ec5..d2097a11c3c7 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -10,6 +10,7 @@
 */
 #include "bcma_private.h"
+#include <linux/pci.h>
 #include <linux/export.h>
 #include <linux/bcma/bcma.h>
 #include <asm/paccess.h>
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index d5e1ab956740..98cbeba8cd53 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1475,7 +1475,7 @@ static int __init xlblk_init(void)
        if (!xen_domain())
                return -ENODEV;
-        if (!xen_platform_pci_unplug)
+        if (xen_hvm_domain() && !xen_platform_pci_unplug)
                return -ENODEV;
        if (register_blkdev(XENVBD_MAJOR, DEV_NAME)) {
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 48442476ec00..ae9edca7b56d 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -72,7 +72,9 @@ static struct usb_device_id ath3k_table[] = {
        /* Atheros AR3012 with sflash firmware*/
        { USB_DEVICE(0x0CF3, 0x3004) },
+        { USB_DEVICE(0x0CF3, 0x311D) },
        { USB_DEVICE(0x13d3, 0x3375) },
+        { USB_DEVICE(0x04CA, 0x3005) },
        /* Atheros AR5BBU12 with sflash firmware */
        { USB_DEVICE(0x0489, 0xE02C) },
@@ -89,7 +91,9 @@ static struct usb_device_id ath3k_blist_tbl[] = {
        /* Atheros AR3012 with sflash firmware*/
        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { }     /* Terminating entry */
 };
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 480cad920048..3311b812a0c6 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -61,7 +61,7 @@ static struct usb_device_id btusb_table[] = {
        { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
        /* Broadcom SoftSailing reporting vendor specific */
-        { USB_DEVICE(0x05ac, 0x21e1) },
+        { USB_DEVICE(0x0a5c, 0x21e1) },
        /* Apple MacBookPro 7,1 */
        { USB_DEVICE(0x05ac, 0x8213) },
@@ -103,6 +103,7 @@ static struct usb_device_id btusb_table[] = {
        /* Broadcom BCM20702A0 */
        { USB_DEVICE(0x0a5c, 0x21e3) },
        { USB_DEVICE(0x0a5c, 0x21e6) },
+        { USB_DEVICE(0x0a5c, 0x21e8) },
        { USB_DEVICE(0x0a5c, 0x21f3) },
        { USB_DEVICE(0x413c, 0x8197) },
@@ -129,7 +130,9 @@ static struct usb_device_id blacklist_table[] = {
        /* Atheros 3012 with sflash firmware */
        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        /* Atheros AR5BBU12 with sflash firmware */
        { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index fd5adb408f44..98a8c05d4f23 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -299,11 +299,11 @@ static void hci_uart_tty_close(struct tty_struct *tty)
                        hci_uart_close(hdev);
                if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
-                        hu->proto->close(hu);
                        if (hdev) {
                                hci_unregister_dev(hdev);
                                hci_free_dev(hdev);
                        }
+                        hu->proto->close(hu);
                }
                kfree(hu);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 54ca8b23cde3..4ec04a754733 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1260,10 +1260,15 @@ static int proc_do_uuid(ctl_table *table, int write,
        uuid = table->data;
        if (!uuid) {
                uuid = tmp_uuid;
-                uuid[8] = 0;
-        }
-        if (uuid[8] == 0)
                generate_random_uuid(uuid);
+        } else {
+                static DEFINE_SPINLOCK(bootid_spinlock);
+                spin_lock(&bootid_spinlock);
+                if (!uuid[8])
+                        generate_random_uuid(uuid);
+                spin_unlock(&bootid_spinlock);
+        }
        sprintf(buf, "%pU", uuid);
diff --git a/drivers/char/tile-srom.c b/drivers/char/tile-srom.c
index 4dc019408fac..3b22a606f79d 100644
--- a/drivers/char/tile-srom.c
+++ b/drivers/char/tile-srom.c
@@ -194,17 +194,17 @@ static ssize_t srom_read(struct file *filp, char __user *buf,
                hv_retval = _srom_read(srom->hv_devhdl, kernbuf,
                                       *f_pos, bytes_this_pass);
-                if (hv_retval > 0) {
+                if (hv_retval <= 0) {
-                        if (copy_to_user(buf, kernbuf, hv_retval) != 0) {
-                                retval = -EFAULT;
-                                break;
-                        }
-                } else if (hv_retval <= 0) {
                        if (retval == 0)
                                retval = hv_retval;
                        break;
                }
+                if (copy_to_user(buf, kernbuf, hv_retval) != 0) {
+                        retval = -EFAULT;
+                        break;
+                }
                retval += hv_retval;
                *f_pos += hv_retval;
                buf += hv_retval;
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 87411cebc577..2f0083a51a9a 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -74,7 +74,7 @@ static cpuidle_enter_t cpuidle_enter_ops;
 /**
 * cpuidle_play_dead - cpu off-lining
 *
- * Only returns in case of an error
+ * Returns in case of an error or no driver
 */
 int cpuidle_play_dead(void)
 {
@@ -83,6 +83,9 @@ int cpuidle_play_dead(void)
        int i, dead_state = -1;
        int power_usage = -1;
+        if (!drv)
+                return -ENODEV;
        /* Find lowest-power state that supports long-term idle */
        for (i = CPUIDLE_DRIVER_STATE_START; i < drv->state_count; i++) {
                struct cpuidle_state *s = &drv->states[i];
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 767bcc31b365..2397f6f451b1 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -332,6 +332,20 @@ struct dma_chan *dma_find_channel(enum dma_transaction_type tx_type)
 }
 EXPORT_SYMBOL(dma_find_channel);
+/*
+ * net_dma_find_channel - find a channel for net_dma
+ * net_dma has alignment requirements
+ */
+struct dma_chan *net_dma_find_channel(void)
+{
+        struct dma_chan *chan = dma_find_channel(DMA_MEMCPY);
+        if (chan && !is_dma_copy_aligned(chan->device, 1, 1, 1))
+                return NULL;
+        return chan;
+}
+EXPORT_SYMBOL(net_dma_find_channel);
 /**
 * dma_issue_pending_all - flush all pending operations across all channels
 */
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 31493d80e0e9..73b2b65cb1de 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -546,9 +546,9 @@ void ioat_dma_unmap(struct ioat_chan_common *chan, enum dma_ctrl_flags flags,
                           PCI_DMA_TODEVICE, flags, 0);
 }
-unsigned long ioat_get_current_completion(struct ioat_chan_common *chan)
+dma_addr_t ioat_get_current_completion(struct ioat_chan_common *chan)
 {
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
        u64 completion;
        completion = *chan->completion;
@@ -569,7 +569,7 @@ unsigned long ioat_get_current_completion(struct ioat_chan_common *chan)
 }
 bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
-                           unsigned long *phys_complete)
+                           dma_addr_t *phys_complete)
 {
        *phys_complete = ioat_get_current_completion(chan);
        if (*phys_complete == chan->last_completion)
@@ -580,14 +580,14 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
        return true;
 }
-static void __cleanup(struct ioat_dma_chan *ioat, unsigned long phys_complete)
+static void __cleanup(struct ioat_dma_chan *ioat, dma_addr_t phys_complete)
 {
        struct ioat_chan_common *chan = &ioat->base;
        struct list_head *_desc, *n;
        struct dma_async_tx_descriptor *tx;
-        dev_dbg(to_dev(chan), "%s: phys_complete: %lx\n",
+        dev_dbg(to_dev(chan), "%s: phys_complete: %llx\n",
-                 __func__, phys_complete);
+                 __func__, (unsigned long long) phys_complete);
        list_for_each_safe(_desc, n, &ioat->used_desc) {
                struct ioat_desc_sw *desc;
@@ -652,7 +652,7 @@ static void __cleanup(struct ioat_dma_chan *ioat, unsigned long phys_complete)
 static void ioat1_cleanup(struct ioat_dma_chan *ioat)
 {
        struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
        prefetch(chan->completion);
@@ -698,7 +698,7 @@ static void ioat1_timer_event(unsigned long data)
                mod_timer(&chan->timer, jiffies + COMPLETION_TIMEOUT);
                spin_unlock_bh(&ioat->desc_lock);
        } else if (test_bit(IOAT_COMPLETION_PENDING, &chan->state)) {
-                unsigned long phys_complete;
+                dma_addr_t phys_complete;
                spin_lock_bh(&ioat->desc_lock);
                /* if we haven't made progress and we have already
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index c7888bccd974..5e8fe01ba69d 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -88,7 +88,7 @@ struct ioatdma_device {
 struct ioat_chan_common {
        struct dma_chan common;
        void __iomem *reg_base;
-        unsigned long last_completion;
+        dma_addr_t last_completion;
        spinlock_t cleanup_lock;
        unsigned long state;
        #define IOAT_COMPLETION_PENDING 0
@@ -310,7 +310,7 @@ int __devinit ioat_dma_self_test(struct ioatdma_device *device);
 void __devexit ioat_dma_remove(struct ioatdma_device *device);
 struct dca_provider * __devinit ioat_dca_init(struct pci_dev *pdev,
                                              void __iomem *iobase);
-unsigned long ioat_get_current_completion(struct ioat_chan_common *chan);
+dma_addr_t ioat_get_current_completion(struct ioat_chan_common *chan);
 void ioat_init_channel(struct ioatdma_device *device,
                       struct ioat_chan_common *chan, int idx);
 enum dma_status ioat_dma_tx_status(struct dma_chan *c, dma_cookie_t cookie,
@@ -318,7 +318,7 @@ enum dma_status ioat_dma_tx_status(struct dma_chan *c, dma_cookie_t cookie,
 void ioat_dma_unmap(struct ioat_chan_common *chan, enum dma_ctrl_flags flags,
                    size_t len, struct ioat_dma_descriptor *hw);
 bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
-                           unsigned long *phys_complete);
+                           dma_addr_t *phys_complete);
 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
 void ioat_kobject_del(struct ioatdma_device *device);
 extern const struct sysfs_ops ioat_sysfs_ops;
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index e8e110ff3d96..86895760b598 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -128,7 +128,7 @@ static void ioat2_start_null_desc(struct ioat2_dma_chan *ioat)
        spin_unlock_bh(&ioat->prep_lock);
 }
-static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
+static void __cleanup(struct ioat2_dma_chan *ioat, dma_addr_t phys_complete)
 {
        struct ioat_chan_common *chan = &ioat->base;
        struct dma_async_tx_descriptor *tx;
@@ -179,7 +179,7 @@ static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
 static void ioat2_cleanup(struct ioat2_dma_chan *ioat)
 {
        struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
        spin_lock_bh(&chan->cleanup_lock);
        if (ioat_cleanup_preamble(chan, &phys_complete))
@@ -260,7 +260,7 @@ int ioat2_reset_sync(struct ioat_chan_common *chan, unsigned long tmo)
 static void ioat2_restart_channel(struct ioat2_dma_chan *ioat)
 {
        struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
        ioat2_quiesce(chan, 0);
        if (ioat_cleanup_preamble(chan, &phys_complete))
@@ -275,7 +275,7 @@ void ioat2_timer_event(unsigned long data)
        struct ioat_chan_common *chan = &ioat->base;
        if (test_bit(IOAT_COMPLETION_PENDING, &chan->state)) {
-                unsigned long phys_complete;
+                dma_addr_t phys_complete;
                u64 status;
                status = ioat_chansts(chan);
@@ -572,9 +572,9 @@ bool reshape_ring(struct ioat2_dma_chan *ioat, int order)
         */
        struct ioat_chan_common *chan = &ioat->base;
        struct dma_chan *c = &chan->common;
-        const u16 curr_size = ioat2_ring_size(ioat);
+        const u32 curr_size = ioat2_ring_size(ioat);
        const u16 active = ioat2_ring_active(ioat);
-        const u16 new_size = 1 << order;
+        const u32 new_size = 1 << order;
        struct ioat_ring_ent **ring;
        u16 i;
diff --git a/drivers/dma/ioat/dma_v2.h b/drivers/dma/ioat/dma_v2.h
index a2c413b2b8d8..be2a55b95c23 100644
--- a/drivers/dma/ioat/dma_v2.h
+++ b/drivers/dma/ioat/dma_v2.h
@@ -74,7 +74,7 @@ static inline struct ioat2_dma_chan *to_ioat2_chan(struct dma_chan *c)
        return container_of(chan, struct ioat2_dma_chan, base);
 }
-static inline u16 ioat2_ring_size(struct ioat2_dma_chan *ioat)
+static inline u32 ioat2_ring_size(struct ioat2_dma_chan *ioat)
 {
        return 1 << ioat->alloc_order;
 }
@@ -91,7 +91,7 @@ static inline u16 ioat2_ring_pending(struct ioat2_dma_chan *ioat)
        return CIRC_CNT(ioat->head, ioat->issued, ioat2_ring_size(ioat));
 }
-static inline u16 ioat2_ring_space(struct ioat2_dma_chan *ioat)
+static inline u32 ioat2_ring_space(struct ioat2_dma_chan *ioat)
 {
        return ioat2_ring_size(ioat) - ioat2_ring_active(ioat);
 }
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 2c4476c0e405..f7f1dc62c15c 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -257,7 +257,7 @@ static bool desc_has_ext(struct ioat_ring_ent *desc)
 * The difference from the dma_v2.c __cleanup() is that this routine
 * handles extended descriptors and dma-unmapping raid operations.
 */
-static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
+static void __cleanup(struct ioat2_dma_chan *ioat, dma_addr_t phys_complete)
 {
        struct ioat_chan_common *chan = &ioat->base;
        struct ioat_ring_ent *desc;
@@ -314,7 +314,7 @@ static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
 static void ioat3_cleanup(struct ioat2_dma_chan *ioat)
 {
        struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
        spin_lock_bh(&chan->cleanup_lock);
        if (ioat_cleanup_preamble(chan, &phys_complete))
@@ -333,7 +333,7 @@ static void ioat3_cleanup_event(unsigned long data)
 static void ioat3_restart_channel(struct ioat2_dma_chan *ioat)
 {
        struct ioat_chan_common *chan = &ioat->base;
-        unsigned long phys_complete;
+        dma_addr_t phys_complete;
        ioat2_quiesce(chan, 0);
        if (ioat_cleanup_preamble(chan, &phys_complete))
@@ -348,7 +348,7 @@ static void ioat3_timer_event(unsigned long data)
        struct ioat_chan_common *chan = &ioat->base;
        if (test_bit(IOAT_COMPLETION_PENDING, &chan->state)) {
-                unsigned long phys_complete;
+                dma_addr_t phys_complete;
                u64 status;
                status = ioat_chansts(chan);
@@ -1149,6 +1149,44 @@ static int ioat3_reset_hw(struct ioat_chan_common *chan)
        return ioat2_reset_sync(chan, msecs_to_jiffies(200));
 }
+static bool is_jf_ioat(struct pci_dev *pdev)
+{
+        switch (pdev->device) {
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF0:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF1:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF2:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF3:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF4:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF5:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF6:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF7:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF8:
+        case PCI_DEVICE_ID_INTEL_IOAT_JSF9:
+                return true;
+        default:
+                return false;
+        }
+}
+static bool is_snb_ioat(struct pci_dev *pdev)
+{
+        switch (pdev->device) {
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB0:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB1:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB2:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB3:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB4:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB5:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB6:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB7:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB8:
+        case PCI_DEVICE_ID_INTEL_IOAT_SNB9:
+                return true;
+        default:
+                return false;
+        }
+}
 int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
 {
        struct pci_dev *pdev = device->pdev;
@@ -1169,6 +1207,9 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
        dma->device_alloc_chan_resources = ioat2_alloc_chan_resources;
        dma->device_free_chan_resources = ioat2_free_chan_resources;
+        if (is_jf_ioat(pdev) || is_snb_ioat(pdev))
+                dma->copy_align = 6;
        dma_cap_set(DMA_INTERRUPT, dma->cap_mask);
        dma->device_prep_dma_interrupt = ioat3_prep_interrupt_lock;
diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
index da6c4c2c066a..79e3eba29702 100644
--- a/drivers/dma/iop-adma.c
+++ b/drivers/dma/iop-adma.c
@@ -1252,8 +1252,8 @@ iop_adma_pq_zero_sum_self_test(struct iop_adma_device *device)
        struct page **pq_hw = &pq[IOP_ADMA_NUM_SRC_TEST+2];
        /* address conversion buffers (dma_map / page_address) */
        void *pq_sw[IOP_ADMA_NUM_SRC_TEST+2];
-        dma_addr_t pq_src[IOP_ADMA_NUM_SRC_TEST];
+        dma_addr_t pq_src[IOP_ADMA_NUM_SRC_TEST+2];
-        dma_addr_t pq_dest[2];
+        dma_addr_t *pq_dest = &pq_src[IOP_ADMA_NUM_SRC_TEST];
        int i;
        struct dma_async_tx_descriptor *tx;
diff --git a/drivers/edac/tile_edac.c b/drivers/edac/tile_edac.c
index 1d5cf06f6c6b..e99d00976189 100644
--- a/drivers/edac/tile_edac.c
+++ b/drivers/edac/tile_edac.c
@@ -145,7 +145,11 @@ static int __devinit tile_edac_mc_probe(struct platform_device *pdev)
        mci->edac_ctl_cap = EDAC_FLAG_SECDED;
        mci->mod_name = DRV_NAME;
+#ifdef __tilegx__
+        mci->ctl_name = "TILEGx_Memory_Controller";
+#else
        mci->ctl_name = "TILEPro_Memory_Controller";
+#endif
        mci->dev_name = dev_name(&pdev->dev);
        mci->edac_check = tile_edac_check;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_buf.c b/drivers/gpu/drm/exynos/exynos_drm_buf.c
index 4a3a5f72ed4a..de8d2090bce3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_buf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_buf.c
@@ -34,14 +34,14 @@
 static int lowlevel_buffer_allocate(struct drm_device *dev,
                unsigned int flags, struct exynos_drm_gem_buf *buf)
 {
-        dma_addr_t start_addr, end_addr;
+        dma_addr_t start_addr;
        unsigned int npages, page_size, i = 0;
        struct scatterlist *sgl;
        int ret = 0;
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (flags & EXYNOS_BO_NONCONTIG) {
+        if (IS_NONCONTIG_BUFFER(flags)) {
                DRM_DEBUG_KMS("not support allocation type.\n");
                return -EINVAL;
        }
@@ -52,13 +52,13 @@ static int lowlevel_buffer_allocate(struct drm_device *dev,
        }
        if (buf->size >= SZ_1M) {
-                npages = (buf->size >> SECTION_SHIFT) + 1;
+                npages = buf->size >> SECTION_SHIFT;
                page_size = SECTION_SIZE;
        } else if (buf->size >= SZ_64K) {
-                npages = (buf->size >> 16) + 1;
+                npages = buf->size >> 16;
                page_size = SZ_64K;
        } else {
-                npages = (buf->size >> PAGE_SHIFT) + 1;
+                npages = buf->size >> PAGE_SHIFT;
                page_size = PAGE_SIZE;
        }
@@ -76,26 +76,13 @@ static int lowlevel_buffer_allocate(struct drm_device *dev,
                return -ENOMEM;
        }
-                buf->kvaddr = dma_alloc_writecombine(dev->dev, buf->size,
+        buf->kvaddr = dma_alloc_writecombine(dev->dev, buf->size,
-                                &buf->dma_addr, GFP_KERNEL);
+                        &buf->dma_addr, GFP_KERNEL);
-                if (!buf->kvaddr) {
+        if (!buf->kvaddr) {
-                        DRM_ERROR("failed to allocate buffer.\n");
+                DRM_ERROR("failed to allocate buffer.\n");
-                        ret = -ENOMEM;
+                ret = -ENOMEM;
-                        goto err1;
+                goto err1;
-                }
+        }
-                start_addr = buf->dma_addr;
-                end_addr = buf->dma_addr + buf->size;
-                buf->pages = kzalloc(sizeof(struct page) * npages, GFP_KERNEL);
-                if (!buf->pages) {
-                        DRM_ERROR("failed to allocate pages.\n");
-                        ret = -ENOMEM;
-                        goto err2;
-                }
-        start_addr = buf->dma_addr;
-        end_addr = buf->dma_addr + buf->size;
        buf->pages = kzalloc(sizeof(struct page) * npages, GFP_KERNEL);
        if (!buf->pages) {
@@ -105,23 +92,17 @@ static int lowlevel_buffer_allocate(struct drm_device *dev,
        }
        sgl = buf->sgt->sgl;
+        start_addr = buf->dma_addr;
        while (i < npages) {
                buf->pages[i] = phys_to_page(start_addr);
                sg_set_page(sgl, buf->pages[i], page_size, 0);
                sg_dma_address(sgl) = start_addr;
                start_addr += page_size;
-                if (end_addr - start_addr < page_size)
-                        break;
                sgl = sg_next(sgl);
                i++;
        }
-        buf->pages[i] = phys_to_page(start_addr);
-        sgl = sg_next(sgl);
-        sg_set_page(sgl, buf->pages[i+1], end_addr - start_addr, 0);
        DRM_DEBUG_KMS("vaddr(0x%lx), dma_addr(0x%lx), size(0x%lx)\n",
                        (unsigned long)buf->kvaddr,
                        (unsigned long)buf->dma_addr,
@@ -150,7 +131,7 @@ static void lowlevel_buffer_deallocate(struct drm_device *dev,
         * non-continuous memory would be released by exynos
         * gem framework.
         */
-        if (flags & EXYNOS_BO_NONCONTIG) {
+        if (IS_NONCONTIG_BUFFER(flags)) {
                DRM_DEBUG_KMS("not support allocation type.\n");
                return;
        }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c
index 411832e8e17a..eaf630dc5dba 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_core.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_core.c
@@ -54,16 +54,18 @@ static int exynos_drm_subdrv_probe(struct drm_device *dev,
                 *
                 * P.S. note that this driver is considered for modularization.
                 */
-                ret = subdrv->probe(dev, subdrv->manager.dev);
+                ret = subdrv->probe(dev, subdrv->dev);
                if (ret)
                        return ret;
        }
-        if (subdrv->is_local)
+        if (!subdrv->manager)
                return 0;
+        subdrv->manager->dev = subdrv->dev;
        /* create and initialize a encoder for this sub driver. */
-        encoder = exynos_drm_encoder_create(dev, &subdrv->manager,
+        encoder = exynos_drm_encoder_create(dev, subdrv->manager,
                        (1 << MAX_CRTC) - 1);
        if (!encoder) {
                DRM_ERROR("failed to create encoder\n");
@@ -186,7 +188,7 @@ int exynos_drm_subdrv_open(struct drm_device *dev, struct drm_file *file)
        list_for_each_entry(subdrv, &exynos_drm_subdrv_list, list) {
                if (subdrv->open) {
-                        ret = subdrv->open(dev, subdrv->manager.dev, file);
+                        ret = subdrv->open(dev, subdrv->dev, file);
                        if (ret)
                                goto err;
                }
@@ -197,7 +199,7 @@ int exynos_drm_subdrv_open(struct drm_device *dev, struct drm_file *file)
 err:
        list_for_each_entry_reverse(subdrv, &subdrv->list, list) {
                if (subdrv->close)
-                        subdrv->close(dev, subdrv->manager.dev, file);
+                        subdrv->close(dev, subdrv->dev, file);
        }
        return ret;
 }
@@ -209,7 +211,7 @@ void exynos_drm_subdrv_close(struct drm_device *dev, struct drm_file *file)
        list_for_each_entry(subdrv, &exynos_drm_subdrv_list, list) {
                if (subdrv->close)
-                        subdrv->close(dev, subdrv->manager.dev, file);
+                        subdrv->close(dev, subdrv->dev, file);
        }
 }
 EXPORT_SYMBOL_GPL(exynos_drm_subdrv_close);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index fbd0a232c93d..1d814175cd49 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -225,24 +225,25 @@ struct exynos_drm_private {
 * Exynos drm sub driver structure.
 *
 * @list: sub driver has its own list object to register to exynos drm driver.
+ * @dev: pointer to device object for subdrv device driver.
 * @drm_dev: pointer to drm_device and this pointer would be set
 *      when sub driver calls exynos_drm_subdrv_register().
- * @is_local: appear encoder and connector disrelated device.
+ * @manager: subdrv has its own manager to control a hardware appropriately
+ *      and we can access a hardware drawing on this manager.
 * @probe: this callback would be called by exynos drm driver after
 *      subdrv is registered to it.
 * @remove: this callback is used to release resources created
 *      by probe callback.
 * @open: this would be called with drm device file open.
 * @close: this would be called with drm device file close.
- * @manager: subdrv has its own manager to control a hardware appropriately
- *      and we can access a hardware drawing on this manager.
 * @encoder: encoder object owned by this sub driver.
 * @connector: connector object owned by this sub driver.
 */
 struct exynos_drm_subdrv {
        struct list_head list;
+        struct device *dev;
        struct drm_device *drm_dev;
-        bool is_local;
+        struct exynos_drm_manager *manager;
        int (*probe)(struct drm_device *drm_dev, struct device *dev);
        void (*remove)(struct drm_device *dev);
@@ -251,7 +252,6 @@ struct exynos_drm_subdrv {
        void (*close)(struct drm_device *drm_dev, struct device *dev,
                        struct drm_file *file);
-        struct exynos_drm_manager manager;
        struct drm_encoder *encoder;
        struct drm_connector *connector;
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index ecb6db229700..29fdbfeb43cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -172,7 +172,7 @@ static void fimd_dpms(struct device *subdrv_dev, int mode)
 static void fimd_apply(struct device *subdrv_dev)
 {
        struct fimd_context *ctx = get_fimd_context(subdrv_dev);
-        struct exynos_drm_manager *mgr = &ctx->subdrv.manager;
+        struct exynos_drm_manager *mgr = ctx->subdrv.manager;
        struct exynos_drm_manager_ops *mgr_ops = mgr->ops;
        struct exynos_drm_overlay_ops *ovl_ops = mgr->overlay_ops;
        struct fimd_win_data *win_data;
@@ -577,6 +577,13 @@ static struct exynos_drm_overlay_ops fimd_overlay_ops = {
        .disable = fimd_win_disable,
 };
+static struct exynos_drm_manager fimd_manager = {
+        .pipe           = -1,
+        .ops            = &fimd_manager_ops,
+        .overlay_ops    = &fimd_overlay_ops,
+        .display_ops    = &fimd_display_ops,
+};
 static void fimd_finish_pageflip(struct drm_device *drm_dev, int crtc)
 {
        struct exynos_drm_private *dev_priv = drm_dev->dev_private;
@@ -628,7 +635,7 @@ static irqreturn_t fimd_irq_handler(int irq, void *dev_id)
        struct fimd_context *ctx = (struct fimd_context *)dev_id;
        struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
        struct drm_device *drm_dev = subdrv->drm_dev;
-        struct exynos_drm_manager *manager = &subdrv->manager;
+        struct exynos_drm_manager *manager = subdrv->manager;
        u32 val;
        val = readl(ctx->regs + VIDINTCON1);
@@ -744,7 +751,7 @@ static void fimd_clear_win(struct fimd_context *ctx, int win)
 static int fimd_power_on(struct fimd_context *ctx, bool enable)
 {
        struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
-        struct device *dev = subdrv->manager.dev;
+        struct device *dev = subdrv->dev;
        DRM_DEBUG_KMS("%s\n", __FILE__);
@@ -867,13 +874,10 @@ static int __devinit fimd_probe(struct platform_device *pdev)
        subdrv = &ctx->subdrv;
+        subdrv->dev = dev;
+        subdrv->manager = &fimd_manager;
        subdrv->probe = fimd_subdrv_probe;
        subdrv->remove = fimd_subdrv_remove;
-        subdrv->manager.pipe = -1;
-        subdrv->manager.ops = &fimd_manager_ops;
-        subdrv->manager.overlay_ops = &fimd_overlay_ops;
-        subdrv->manager.display_ops = &fimd_display_ops;
-        subdrv->manager.dev = dev;
        mutex_init(&ctx->lock);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index fa1aa94a3d8e..26d51979116b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -56,9 +56,28 @@ static unsigned int convert_to_vm_err_msg(int msg)
        return out_msg;
 }
-static unsigned int mask_gem_flags(unsigned int flags)
+static int check_gem_flags(unsigned int flags)
 {
-        return flags &= EXYNOS_BO_NONCONTIG;
+        if (flags & ~(EXYNOS_BO_MASK)) {
+                DRM_ERROR("invalid flags.\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+static unsigned long roundup_gem_size(unsigned long size, unsigned int flags)
+{
+        if (!IS_NONCONTIG_BUFFER(flags)) {
+                if (size >= SZ_1M)
+                        return roundup(size, SECTION_SIZE);
+                else if (size >= SZ_64K)
+                        return roundup(size, SZ_64K);
+                else
+                        goto out;
+        }
+out:
+        return roundup(size, PAGE_SIZE);
 }
 static struct page **exynos_gem_get_pages(struct drm_gem_object *obj,
@@ -319,10 +338,17 @@ struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_device *dev,
        struct exynos_drm_gem_buf *buf;
        int ret;
-        size = roundup(size, PAGE_SIZE);
+        if (!size) {
-        DRM_DEBUG_KMS("%s: size = 0x%lx\n", __FILE__, size);
+                DRM_ERROR("invalid size.\n");
+                return ERR_PTR(-EINVAL);
+        }
-        flags = mask_gem_flags(flags);
+        size = roundup_gem_size(size, flags);
+        DRM_DEBUG_KMS("%s\n", __FILE__);
+        ret = check_gem_flags(flags);
+        if (ret)
+                return ERR_PTR(ret);
        buf = exynos_drm_init_buf(dev, size);
        if (!buf)
@@ -331,7 +357,7 @@ struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_device *dev,
        exynos_gem_obj = exynos_drm_gem_init(dev, size);
        if (!exynos_gem_obj) {
                ret = -ENOMEM;
-                goto err;
+                goto err_fini_buf;
        }
        exynos_gem_obj->buffer = buf;
@@ -347,18 +373,19 @@ struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_device *dev,
                ret = exynos_drm_gem_get_pages(&exynos_gem_obj->base);
                if (ret < 0) {
                        drm_gem_object_release(&exynos_gem_obj->base);
-                        goto err;
+                        goto err_fini_buf;
                }
        } else {
                ret = exynos_drm_alloc_buf(dev, buf, flags);
                if (ret < 0) {
                        drm_gem_object_release(&exynos_gem_obj->base);
-                        goto err;
+                        goto err_fini_buf;
                }
        }
        return exynos_gem_obj;
-err:
+err_fini_buf:
        exynos_drm_fini_buf(dev, buf);
        return ERR_PTR(ret);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.h b/drivers/gpu/drm/exynos/exynos_drm_gem.h
index e40fbad8b705..4ed842039505 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.h
@@ -29,6 +29,8 @@
 #define to_exynos_gem_obj(x)    container_of(x,\
                        struct exynos_drm_gem_obj, base)
+#define IS_NONCONTIG_BUFFER(f)          (f & EXYNOS_BO_NONCONTIG)
 /*
 * exynos drm gem buffer structure.
 *
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index 14eb26b0ba1c..3424463676e0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -30,9 +30,8 @@
                                        struct drm_hdmi_context, subdrv);
 /* these callback points shoud be set by specific drivers. */
-static struct exynos_hdmi_display_ops *hdmi_display_ops;
+static struct exynos_hdmi_ops *hdmi_ops;
-static struct exynos_hdmi_manager_ops *hdmi_manager_ops;
+static struct exynos_mixer_ops *mixer_ops;
-static struct exynos_hdmi_overlay_ops *hdmi_overlay_ops;
 struct drm_hdmi_context {
        struct exynos_drm_subdrv        subdrv;
@@ -40,31 +39,20 @@ struct drm_hdmi_context {
        struct exynos_drm_hdmi_context  *mixer_ctx;
 };
-void exynos_drm_display_ops_register(struct exynos_hdmi_display_ops
+void exynos_hdmi_ops_register(struct exynos_hdmi_ops *ops)
-                                        *display_ops)
 {
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (display_ops)
+        if (ops)
-                hdmi_display_ops = display_ops;
+                hdmi_ops = ops;
 }
-void exynos_drm_manager_ops_register(struct exynos_hdmi_manager_ops
+void exynos_mixer_ops_register(struct exynos_mixer_ops *ops)
-                                        *manager_ops)
 {
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (manager_ops)
+        if (ops)
-                hdmi_manager_ops = manager_ops;
+                mixer_ops = ops;
-}
-void exynos_drm_overlay_ops_register(struct exynos_hdmi_overlay_ops
-                                        *overlay_ops)
-{
-        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (overlay_ops)
-                hdmi_overlay_ops = overlay_ops;
 }
 static bool drm_hdmi_is_connected(struct device *dev)
@@ -73,8 +61,8 @@ static bool drm_hdmi_is_connected(struct device *dev)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_display_ops && hdmi_display_ops->is_connected)
+        if (hdmi_ops && hdmi_ops->is_connected)
-                return hdmi_display_ops->is_connected(ctx->hdmi_ctx->ctx);
+                return hdmi_ops->is_connected(ctx->hdmi_ctx->ctx);
        return false;
 }
@@ -86,9 +74,9 @@ static int drm_hdmi_get_edid(struct device *dev,
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_display_ops && hdmi_display_ops->get_edid)
+        if (hdmi_ops && hdmi_ops->get_edid)
-                return hdmi_display_ops->get_edid(ctx->hdmi_ctx->ctx,
+                return hdmi_ops->get_edid(ctx->hdmi_ctx->ctx, connector, edid,
-                                connector, edid, len);
+                                          len);
        return 0;
 }
@@ -99,9 +87,8 @@ static int drm_hdmi_check_timing(struct device *dev, void *timing)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_display_ops && hdmi_display_ops->check_timing)
+        if (hdmi_ops && hdmi_ops->check_timing)
-                return hdmi_display_ops->check_timing(ctx->hdmi_ctx->ctx,
+                return hdmi_ops->check_timing(ctx->hdmi_ctx->ctx, timing);
-                                timing);
        return 0;
 }
@@ -112,8 +99,8 @@ static int drm_hdmi_power_on(struct device *dev, int mode)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_display_ops && hdmi_display_ops->power_on)
+        if (hdmi_ops && hdmi_ops->power_on)
-                return hdmi_display_ops->power_on(ctx->hdmi_ctx->ctx, mode);
+                return hdmi_ops->power_on(ctx->hdmi_ctx->ctx, mode);
        return 0;
 }
@@ -130,13 +117,13 @@ static int drm_hdmi_enable_vblank(struct device *subdrv_dev)
 {
        struct drm_hdmi_context *ctx = to_context(subdrv_dev);
        struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
-        struct exynos_drm_manager *manager = &subdrv->manager;
+        struct exynos_drm_manager *manager = subdrv->manager;
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_overlay_ops && hdmi_overlay_ops->enable_vblank)
+        if (mixer_ops && mixer_ops->enable_vblank)
-                return hdmi_overlay_ops->enable_vblank(ctx->mixer_ctx->ctx,
+                return mixer_ops->enable_vblank(ctx->mixer_ctx->ctx,
-                                                        manager->pipe);
+                                                manager->pipe);
        return 0;
 }
@@ -147,8 +134,8 @@ static void drm_hdmi_disable_vblank(struct device *subdrv_dev)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_overlay_ops && hdmi_overlay_ops->disable_vblank)
+        if (mixer_ops && mixer_ops->disable_vblank)
-                return hdmi_overlay_ops->disable_vblank(ctx->mixer_ctx->ctx);
+                return mixer_ops->disable_vblank(ctx->mixer_ctx->ctx);
 }
 static void drm_hdmi_mode_fixup(struct device *subdrv_dev,
@@ -160,9 +147,9 @@ static void drm_hdmi_mode_fixup(struct device *subdrv_dev,
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_manager_ops && hdmi_manager_ops->mode_fixup)
+        if (hdmi_ops && hdmi_ops->mode_fixup)
-                hdmi_manager_ops->mode_fixup(ctx->hdmi_ctx->ctx, connector,
+                hdmi_ops->mode_fixup(ctx->hdmi_ctx->ctx, connector, mode,
-                                                mode, adjusted_mode);
+                                     adjusted_mode);
 }
 static void drm_hdmi_mode_set(struct device *subdrv_dev, void *mode)
@@ -171,8 +158,8 @@ static void drm_hdmi_mode_set(struct device *subdrv_dev, void *mode)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_manager_ops && hdmi_manager_ops->mode_set)
+        if (hdmi_ops && hdmi_ops->mode_set)
-                hdmi_manager_ops->mode_set(ctx->hdmi_ctx->ctx, mode);
+                hdmi_ops->mode_set(ctx->hdmi_ctx->ctx, mode);
 }
 static void drm_hdmi_get_max_resol(struct device *subdrv_dev,
@@ -182,9 +169,8 @@ static void drm_hdmi_get_max_resol(struct device *subdrv_dev,
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_manager_ops && hdmi_manager_ops->get_max_resol)
+        if (hdmi_ops && hdmi_ops->get_max_resol)
-                hdmi_manager_ops->get_max_resol(ctx->hdmi_ctx->ctx, width,
+                hdmi_ops->get_max_resol(ctx->hdmi_ctx->ctx, width, height);
-                                                        height);
 }
 static void drm_hdmi_commit(struct device *subdrv_dev)
@@ -193,8 +179,8 @@ static void drm_hdmi_commit(struct device *subdrv_dev)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_manager_ops && hdmi_manager_ops->commit)
+        if (hdmi_ops && hdmi_ops->commit)
-                hdmi_manager_ops->commit(ctx->hdmi_ctx->ctx);
+                hdmi_ops->commit(ctx->hdmi_ctx->ctx);
 }
 static void drm_hdmi_dpms(struct device *subdrv_dev, int mode)
@@ -209,8 +195,8 @@ static void drm_hdmi_dpms(struct device *subdrv_dev, int mode)
        case DRM_MODE_DPMS_STANDBY:
        case DRM_MODE_DPMS_SUSPEND:
        case DRM_MODE_DPMS_OFF:
-                if (hdmi_manager_ops && hdmi_manager_ops->disable)
+                if (hdmi_ops && hdmi_ops->disable)
-                        hdmi_manager_ops->disable(ctx->hdmi_ctx->ctx);
+                        hdmi_ops->disable(ctx->hdmi_ctx->ctx);
                break;
        default:
                DRM_DEBUG_KMS("unkown dps mode: %d\n", mode);
@@ -235,8 +221,8 @@ static void drm_mixer_mode_set(struct device *subdrv_dev,
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_overlay_ops && hdmi_overlay_ops->win_mode_set)
+        if (mixer_ops && mixer_ops->win_mode_set)
-                hdmi_overlay_ops->win_mode_set(ctx->mixer_ctx->ctx, overlay);
+                mixer_ops->win_mode_set(ctx->mixer_ctx->ctx, overlay);
 }
 static void drm_mixer_commit(struct device *subdrv_dev, int zpos)
@@ -245,8 +231,8 @@ static void drm_mixer_commit(struct device *subdrv_dev, int zpos)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_overlay_ops && hdmi_overlay_ops->win_commit)
+        if (mixer_ops && mixer_ops->win_commit)
-                hdmi_overlay_ops->win_commit(ctx->mixer_ctx->ctx, zpos);
+                mixer_ops->win_commit(ctx->mixer_ctx->ctx, zpos);
 }
 static void drm_mixer_disable(struct device *subdrv_dev, int zpos)
@@ -255,8 +241,8 @@ static void drm_mixer_disable(struct device *subdrv_dev, int zpos)
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (hdmi_overlay_ops && hdmi_overlay_ops->win_disable)
+        if (mixer_ops && mixer_ops->win_disable)
-                hdmi_overlay_ops->win_disable(ctx->mixer_ctx->ctx, zpos);
+                mixer_ops->win_disable(ctx->mixer_ctx->ctx, zpos);
 }
 static struct exynos_drm_overlay_ops drm_hdmi_overlay_ops = {
@@ -265,6 +251,12 @@ static struct exynos_drm_overlay_ops drm_hdmi_overlay_ops = {
        .disable = drm_mixer_disable,
 };
+static struct exynos_drm_manager hdmi_manager = {
+        .pipe           = -1,
+        .ops            = &drm_hdmi_manager_ops,
+        .overlay_ops    = &drm_hdmi_overlay_ops,
+        .display_ops    = &drm_hdmi_display_ops,
+};
 static int hdmi_subdrv_probe(struct drm_device *drm_dev,
                struct device *dev)
@@ -332,12 +324,9 @@ static int __devinit exynos_drm_hdmi_probe(struct platform_device *pdev)
        subdrv = &ctx->subdrv;
+        subdrv->dev = dev;
+        subdrv->manager = &hdmi_manager;
        subdrv->probe = hdmi_subdrv_probe;
-        subdrv->manager.pipe = -1;
-        subdrv->manager.ops = &drm_hdmi_manager_ops;
-        subdrv->manager.overlay_ops = &drm_hdmi_overlay_ops;
-        subdrv->manager.display_ops = &drm_hdmi_display_ops;
-        subdrv->manager.dev = dev;
        platform_set_drvdata(pdev, subdrv);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.h b/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
index 44497cfb6c74..f3ae192c8dcf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
@@ -38,15 +38,15 @@ struct exynos_drm_hdmi_context {
        void                    *ctx;
 };
-struct exynos_hdmi_display_ops {
+struct exynos_hdmi_ops {
+        /* display */
        bool (*is_connected)(void *ctx);
        int (*get_edid)(void *ctx, struct drm_connector *connector,
                        u8 *edid, int len);
        int (*check_timing)(void *ctx, void *timing);
        int (*power_on)(void *ctx, int mode);
-};
-struct exynos_hdmi_manager_ops {
+        /* manager */
        void (*mode_fixup)(void *ctx, struct drm_connector *connector,
                                struct drm_display_mode *mode,
                                struct drm_display_mode *adjusted_mode);
@@ -57,22 +57,17 @@ struct exynos_hdmi_manager_ops {
        void (*disable)(void *ctx);
 };
-struct exynos_hdmi_overlay_ops {
+struct exynos_mixer_ops {
+        /* manager */
        int (*enable_vblank)(void *ctx, int pipe);
        void (*disable_vblank)(void *ctx);
+        /* overlay */
        void (*win_mode_set)(void *ctx, struct exynos_drm_overlay *overlay);
        void (*win_commit)(void *ctx, int zpos);
        void (*win_disable)(void *ctx, int zpos);
 };
-extern struct platform_driver hdmi_driver;
+void exynos_hdmi_ops_register(struct exynos_hdmi_ops *ops);
-extern struct platform_driver mixer_driver;
+void exynos_mixer_ops_register(struct exynos_mixer_ops *ops);
-void exynos_drm_display_ops_register(struct exynos_hdmi_display_ops
-                                        *display_ops);
-void exynos_drm_manager_ops_register(struct exynos_hdmi_manager_ops
-                                        *manager_ops);
-void exynos_drm_overlay_ops_register(struct exynos_hdmi_overlay_ops
-                                        *overlay_ops);
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index c277a3a445f5..f92fe4c6174a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -24,6 +24,10 @@ struct exynos_plane {
 static const uint32_t formats[] = {
        DRM_FORMAT_XRGB8888,
+        DRM_FORMAT_ARGB8888,
+        DRM_FORMAT_NV12,
+        DRM_FORMAT_NV12M,
+        DRM_FORMAT_NV12MT,
 };
 static int
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 8e1339f9fe1f..7b9c153dceb6 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -199,7 +199,7 @@ static void vidi_dpms(struct device *subdrv_dev, int mode)
 static void vidi_apply(struct device *subdrv_dev)
 {
        struct vidi_context *ctx = get_vidi_context(subdrv_dev);
-        struct exynos_drm_manager *mgr = &ctx->subdrv.manager;
+        struct exynos_drm_manager *mgr = ctx->subdrv.manager;
        struct exynos_drm_manager_ops *mgr_ops = mgr->ops;
        struct exynos_drm_overlay_ops *ovl_ops = mgr->overlay_ops;
        struct vidi_win_data *win_data;
@@ -374,6 +374,13 @@ static struct exynos_drm_overlay_ops vidi_overlay_ops = {
        .disable = vidi_win_disable,
 };
+static struct exynos_drm_manager vidi_manager = {
+        .pipe           = -1,
+        .ops            = &vidi_manager_ops,
+        .overlay_ops    = &vidi_overlay_ops,
+        .display_ops    = &vidi_display_ops,
+};
 static void vidi_finish_pageflip(struct drm_device *drm_dev, int crtc)
 {
        struct exynos_drm_private *dev_priv = drm_dev->dev_private;
@@ -425,7 +432,7 @@ static void vidi_fake_vblank_handler(struct work_struct *work)
        struct vidi_context *ctx = container_of(work, struct vidi_context,
                                        work);
        struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
-        struct exynos_drm_manager *manager = &subdrv->manager;
+        struct exynos_drm_manager *manager = subdrv->manager;
        if (manager->pipe < 0)
                return;
@@ -471,7 +478,7 @@ static void vidi_subdrv_remove(struct drm_device *drm_dev)
 static int vidi_power_on(struct vidi_context *ctx, bool enable)
 {
        struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
-        struct device *dev = subdrv->manager.dev;
+        struct device *dev = subdrv->dev;
        DRM_DEBUG_KMS("%s\n", __FILE__);
@@ -611,13 +618,10 @@ static int __devinit vidi_probe(struct platform_device *pdev)
        ctx->raw_edid = (struct edid *)fake_edid_info;
        subdrv = &ctx->subdrv;
+        subdrv->dev = dev;
+        subdrv->manager = &vidi_manager;
        subdrv->probe = vidi_subdrv_probe;
        subdrv->remove = vidi_subdrv_remove;
-        subdrv->manager.pipe = -1;
-        subdrv->manager.ops = &vidi_manager_ops;
-        subdrv->manager.overlay_ops = &vidi_overlay_ops;
-        subdrv->manager.display_ops = &vidi_display_ops;
-        subdrv->manager.dev = dev;
        mutex_init(&ctx->lock);
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 575a8cbd3533..b00353876458 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -40,7 +40,6 @@
 #include "exynos_hdmi.h"
-#define HDMI_OVERLAY_NUMBER     3
 #define MAX_WIDTH               1920
 #define MAX_HEIGHT              1080
 #define get_hdmi_context(dev)   platform_get_drvdata(to_platform_device(dev))
@@ -1194,7 +1193,7 @@ static int hdmi_conf_index(struct hdmi_context *hdata,
 static bool hdmi_is_connected(void *ctx)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
        u32 val = hdmi_reg_read(hdata, HDMI_HPD_STATUS);
        if (val)
@@ -1207,7 +1206,7 @@ static int hdmi_get_edid(void *ctx, struct drm_connector *connector,
                                u8 *edid, int len)
 {
        struct edid *raw_edid;
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
        DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1275,7 +1274,7 @@ static int hdmi_v14_check_timing(struct fb_videomode *check_timing)
 static int hdmi_check_timing(void *ctx, void *timing)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
        struct fb_videomode *check_timing = timing;
        DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1312,13 +1311,6 @@ static int hdmi_display_power_on(void *ctx, int mode)
        return 0;
 }
-static struct exynos_hdmi_display_ops display_ops = {
-        .is_connected   = hdmi_is_connected,
-        .get_edid       = hdmi_get_edid,
-        .check_timing   = hdmi_check_timing,
-        .power_on       = hdmi_display_power_on,
-};
 static void hdmi_set_acr(u32 freq, u8 *acr)
 {
        u32 n, cts;
@@ -1914,7 +1906,7 @@ static void hdmi_mode_fixup(void *ctx, struct drm_connector *connector,
                                struct drm_display_mode *adjusted_mode)
 {
        struct drm_display_mode *m;
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
        int index;
        DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1951,7 +1943,7 @@ static void hdmi_mode_fixup(void *ctx, struct drm_connector *connector,
 static void hdmi_mode_set(void *ctx, void *mode)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
        int conf_idx;
        DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1974,7 +1966,7 @@ static void hdmi_get_max_resol(void *ctx, unsigned int *width,
 static void hdmi_commit(void *ctx)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
        DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1985,7 +1977,7 @@ static void hdmi_commit(void *ctx)
 static void hdmi_disable(void *ctx)
 {
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx;
+        struct hdmi_context *hdata = ctx;
        DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
@@ -1996,7 +1988,14 @@ static void hdmi_disable(void *ctx)
        }
 }
-static struct exynos_hdmi_manager_ops manager_ops = {
+static struct exynos_hdmi_ops hdmi_ops = {
+        /* display */
+        .is_connected   = hdmi_is_connected,
+        .get_edid       = hdmi_get_edid,
+        .check_timing   = hdmi_check_timing,
+        .power_on       = hdmi_display_power_on,
+        /* manager */
        .mode_fixup     = hdmi_mode_fixup,
        .mode_set       = hdmi_mode_set,
        .get_max_resol  = hdmi_get_max_resol,
@@ -2020,7 +2019,7 @@ static void hdmi_hotplug_func(struct work_struct *work)
 static irqreturn_t hdmi_irq_handler(int irq, void *arg)
 {
        struct exynos_drm_hdmi_context *ctx = arg;
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx->ctx;
+        struct hdmi_context *hdata = ctx->ctx;
        u32 intc_flag;
        intc_flag = hdmi_reg_read(hdata, HDMI_INTC_FLAG);
@@ -2173,7 +2172,7 @@ static int hdmi_runtime_suspend(struct device *dev)
        DRM_DEBUG_KMS("%s\n", __func__);
-        hdmi_resource_poweroff((struct hdmi_context *)ctx->ctx);
+        hdmi_resource_poweroff(ctx->ctx);
        return 0;
 }
@@ -2184,7 +2183,7 @@ static int hdmi_runtime_resume(struct device *dev)
        DRM_DEBUG_KMS("%s\n", __func__);
-        hdmi_resource_poweron((struct hdmi_context *)ctx->ctx);
+        hdmi_resource_poweron(ctx->ctx);
        return 0;
 }
@@ -2322,8 +2321,7 @@ static int __devinit hdmi_probe(struct platform_device *pdev)
        hdata->irq = res->start;
        /* register specific callbacks to common hdmi. */
-        exynos_drm_display_ops_register(&display_ops);
+        exynos_hdmi_ops_register(&hdmi_ops);
-        exynos_drm_manager_ops_register(&manager_ops);
        hdmi_resource_poweron(hdata);
@@ -2351,7 +2349,7 @@ err_data:
 static int __devexit hdmi_remove(struct platform_device *pdev)
 {
        struct exynos_drm_hdmi_context *ctx = platform_get_drvdata(pdev);
-        struct hdmi_context *hdata = (struct hdmi_context *)ctx->ctx;
+        struct hdmi_context *hdata = ctx->ctx;
        DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 4d5f41e19527..e15438c01129 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -37,7 +37,8 @@
 #include "exynos_drm_drv.h"
 #include "exynos_drm_hdmi.h"
-#define HDMI_OVERLAY_NUMBER     3
+#define MIXER_WIN_NR            3
+#define MIXER_DEFAULT_WIN       0
 #define get_mixer_context(dev)  platform_get_drvdata(to_platform_device(dev))
@@ -75,16 +76,12 @@ struct mixer_resources {
 };
 struct mixer_context {
-        struct fb_videomode     *default_timing;
-        unsigned int            default_win;
-        unsigned int            default_bpp;
        unsigned int            irq;
        int                     pipe;
        bool                    interlace;
-        bool                    vp_enabled;
        struct mixer_resources  mixer_res;
-        struct hdmi_win_data    win_data[HDMI_OVERLAY_NUMBER];
+        struct hdmi_win_data    win_data[MIXER_WIN_NR];
 };
 static const u8 filter_y_horiz_tap8[] = {
@@ -643,9 +640,9 @@ static void mixer_win_mode_set(void *ctx,
        win = overlay->zpos;
        if (win == DEFAULT_ZPOS)
-                win = mixer_ctx->default_win;
+                win = MIXER_DEFAULT_WIN;
-        if (win < 0 || win > HDMI_OVERLAY_NUMBER) {
+        if (win < 0 || win > MIXER_WIN_NR) {
                DRM_ERROR("overlay plane[%d] is wrong\n", win);
                return;
        }
@@ -683,9 +680,9 @@ static void mixer_win_commit(void *ctx, int zpos)
        DRM_DEBUG_KMS("[%d] %s, win: %d\n", __LINE__, __func__, win);
        if (win == DEFAULT_ZPOS)
-                win = mixer_ctx->default_win;
+                win = MIXER_DEFAULT_WIN;
-        if (win < 0 || win > HDMI_OVERLAY_NUMBER) {
+        if (win < 0 || win > MIXER_WIN_NR) {
                DRM_ERROR("overlay plane[%d] is wrong\n", win);
                return;
        }
@@ -706,9 +703,9 @@ static void mixer_win_disable(void *ctx, int zpos)
        DRM_DEBUG_KMS("[%d] %s, win: %d\n", __LINE__, __func__, win);
        if (win == DEFAULT_ZPOS)
-                win = mixer_ctx->default_win;
+                win = MIXER_DEFAULT_WIN;
-        if (win < 0 || win > HDMI_OVERLAY_NUMBER) {
+        if (win < 0 || win > MIXER_WIN_NR) {
                DRM_ERROR("overlay plane[%d] is wrong\n", win);
                return;
        }
@@ -722,9 +719,12 @@ static void mixer_win_disable(void *ctx, int zpos)
        spin_unlock_irqrestore(&res->reg_slock, flags);
 }
-static struct exynos_hdmi_overlay_ops overlay_ops = {
+static struct exynos_mixer_ops mixer_ops = {
+        /* manager */
        .enable_vblank          = mixer_enable_vblank,
        .disable_vblank         = mixer_disable_vblank,
+        /* overlay */
        .win_mode_set           = mixer_win_mode_set,
        .win_commit             = mixer_win_commit,
        .win_disable            = mixer_win_disable,
@@ -771,8 +771,7 @@ static void mixer_finish_pageflip(struct drm_device *drm_dev, int crtc)
 static irqreturn_t mixer_irq_handler(int irq, void *arg)
 {
        struct exynos_drm_hdmi_context *drm_hdmi_ctx = arg;
-        struct mixer_context *ctx =
+        struct mixer_context *ctx = drm_hdmi_ctx->ctx;
-                        (struct mixer_context *)drm_hdmi_ctx->ctx;
        struct mixer_resources *res = &ctx->mixer_res;
        u32 val, val_base;
@@ -902,7 +901,7 @@ static int mixer_runtime_resume(struct device *dev)
        DRM_DEBUG_KMS("resume - start\n");
-        mixer_resource_poweron((struct mixer_context *)ctx->ctx);
+        mixer_resource_poweron(ctx->ctx);
        return 0;
 }
@@ -913,7 +912,7 @@ static int mixer_runtime_suspend(struct device *dev)
        DRM_DEBUG_KMS("suspend - start\n");
-        mixer_resource_poweroff((struct mixer_context *)ctx->ctx);
+        mixer_resource_poweroff(ctx->ctx);
        return 0;
 }
@@ -926,8 +925,7 @@ static const struct dev_pm_ops mixer_pm_ops = {
 static int __devinit mixer_resources_init(struct exynos_drm_hdmi_context *ctx,
                                 struct platform_device *pdev)
 {
-        struct mixer_context *mixer_ctx =
+        struct mixer_context *mixer_ctx = ctx->ctx;
-                        (struct mixer_context *)ctx->ctx;
        struct device *dev = &pdev->dev;
        struct mixer_resources *mixer_res = &mixer_ctx->mixer_res;
        struct resource *res;
@@ -1076,7 +1074,7 @@ static int __devinit mixer_probe(struct platform_device *pdev)
                goto fail;
        /* register specific callback point to common hdmi. */
-        exynos_drm_overlay_ops_register(&overlay_ops);
+        exynos_mixer_ops_register(&mixer_ops);
        mixer_resource_poweron(ctx);
@@ -1093,7 +1091,7 @@ static int mixer_remove(struct platform_device *pdev)
        struct device *dev = &pdev->dev;
        struct exynos_drm_hdmi_context *drm_hdmi_ctx =
                                        platform_get_drvdata(pdev);
-        struct mixer_context *ctx = (struct mixer_context *)drm_hdmi_ctx->ctx;
+        struct mixer_context *ctx = drm_hdmi_ctx->ctx;
        dev_info(dev, "remove successful\n");
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index dfa55e7478fb..ae8a64f9f845 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -64,7 +64,7 @@ MODULE_PARM_DESC(semaphores,
                "Use semaphores for inter-ring sync (default: -1 (use per-chip defaults))");
 int i915_enable_rc6 __read_mostly = -1;
-module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
+module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0400);
 MODULE_PARM_DESC(i915_enable_rc6,
                "Enable power-saving render C-state 6. "
                "Different stages can be selected via bitmask values "
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 4c65c639f772..0e3c6acde955 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1493,6 +1493,7 @@ i915_gem_object_move_off_active(struct drm_i915_gem_object *obj)
 {
        list_del_init(&obj->ring_list);
        obj->last_rendering_seqno = 0;
+        obj->last_fenced_seqno = 0;
 }
 static void
@@ -1521,6 +1522,7 @@ i915_gem_object_move_to_inactive(struct drm_i915_gem_object *obj)
        BUG_ON(!list_empty(&obj->gpu_write_list));
        BUG_ON(!obj->active);
        obj->ring = NULL;
+        obj->last_fenced_ring = NULL;
        i915_gem_object_move_off_active(obj);
        obj->fenced_gpu_access = false;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 2abf4eb94039..b4bb1ef77ddc 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -3728,6 +3728,9 @@
 #define  GT_FIFO_FREE_ENTRIES                   0x120008
 #define    GT_FIFO_NUM_RESERVED_ENTRIES         20
+#define GEN6_UCGCTL1                            0x9400
+# define GEN6_BLBUNIT_CLOCK_GATE_DISABLE                (1 << 5)
 #define GEN6_UCGCTL2                            0x9404
 # define GEN6_RCZUNIT_CLOCK_GATE_DISABLE                (1 << 13)
 # define GEN6_RCPBUNIT_CLOCK_GATE_DISABLE               (1 << 12)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 91b35fd1db8c..bae38acf44dc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2245,6 +2245,33 @@ intel_pipe_set_base_atomic(struct drm_crtc *crtc, struct drm_framebuffer *fb,
 }
 static int
+intel_finish_fb(struct drm_framebuffer *old_fb)
+{
+        struct drm_i915_gem_object *obj = to_intel_framebuffer(old_fb)->obj;
+        struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
+        bool was_interruptible = dev_priv->mm.interruptible;
+        int ret;
+        wait_event(dev_priv->pending_flip_queue,
+                   atomic_read(&dev_priv->mm.wedged) ||
+                   atomic_read(&obj->pending_flip) == 0);
+        /* Big Hammer, we also need to ensure that any pending
+         * MI_WAIT_FOR_EVENT inside a user batch buffer on the
+         * current scanout is retired before unpinning the old
+         * framebuffer.
+         *
+         * This should only fail upon a hung GPU, in which case we
+         * can safely continue.
+         */
+        dev_priv->mm.interruptible = false;
+        ret = i915_gem_object_finish_gpu(obj);
+        dev_priv->mm.interruptible = was_interruptible;
+        return ret;
+}
+static int
 intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
                    struct drm_framebuffer *old_fb)
 {
@@ -2282,25 +2309,8 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
                return ret;
        }
-        if (old_fb) {
+        if (old_fb)
-                struct drm_i915_private *dev_priv = dev->dev_private;
+                intel_finish_fb(old_fb);
-                struct drm_i915_gem_object *obj = to_intel_framebuffer(old_fb)->obj;
-                wait_event(dev_priv->pending_flip_queue,
-                           atomic_read(&dev_priv->mm.wedged) ||
-                           atomic_read(&obj->pending_flip) == 0);
-                /* Big Hammer, we also need to ensure that any pending
-                 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
-                 * current scanout is retired before unpinning the old
-                 * framebuffer.
-                 *
-                 * This should only fail upon a hung GPU, in which case we
-                 * can safely continue.
-                 */
-                ret = i915_gem_object_finish_gpu(obj);
-                (void) ret;
-        }
        ret = intel_pipe_set_base_atomic(crtc, crtc->fb, x, y,
                                         LEAVE_ATOMIC_MODE_SET);
@@ -3371,6 +3381,23 @@ static void intel_crtc_disable(struct drm_crtc *crtc)
        struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
        struct drm_device *dev = crtc->dev;
+        /* Flush any pending WAITs before we disable the pipe. Note that
+         * we need to drop the struct_mutex in order to acquire it again
+         * during the lowlevel dpms routines around a couple of the
+         * operations. It does not look trivial nor desirable to move
+         * that locking higher. So instead we leave a window for the
+         * submission of further commands on the fb before we can actually
+         * disable it. This race with userspace exists anyway, and we can
+         * only rely on the pipe being disabled by userspace after it
+         * receives the hotplug notification and has flushed any pending
+         * batches.
+         */
+        if (crtc->fb) {
+                mutex_lock(&dev->struct_mutex);
+                intel_finish_fb(crtc->fb);
+                mutex_unlock(&dev->struct_mutex);
+        }
        crtc_funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
        assert_plane_disabled(dev->dev_private, to_intel_crtc(crtc)->plane);
        assert_pipe_disabled(dev->dev_private, to_intel_crtc(crtc)->pipe);
@@ -8529,6 +8556,10 @@ static void gen6_init_clock_gating(struct drm_device *dev)
        I915_WRITE(WM2_LP_ILK, 0);
        I915_WRITE(WM1_LP_ILK, 0);
+        I915_WRITE(GEN6_UCGCTL1,
+                   I915_READ(GEN6_UCGCTL1) |
+                   GEN6_BLBUNIT_CLOCK_GATE_DISABLE);
        /* According to the BSpec vol1g, bit 12 (RCPBUNIT) clock
         * gating disable must be set.  Failure to set it results in
         * flickering pixels due to Z write ordering failures after
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 110552ff302c..4b637919f74f 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -219,14 +219,38 @@ intel_dp_max_data_rate(int max_link_clock, int max_lanes)
        return (max_link_clock * max_lanes * 8) / 10;
 }
+static bool
+intel_dp_adjust_dithering(struct intel_dp *intel_dp,
+                          struct drm_display_mode *mode,
+                          struct drm_display_mode *adjusted_mode)
+{
+        int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_dp));
+        int max_lanes = intel_dp_max_lane_count(intel_dp);
+        int max_rate, mode_rate;
+        mode_rate = intel_dp_link_required(mode->clock, 24);
+        max_rate = intel_dp_max_data_rate(max_link_clock, max_lanes);
+        if (mode_rate > max_rate) {
+                mode_rate = intel_dp_link_required(mode->clock, 18);
+                if (mode_rate > max_rate)
+                        return false;
+                if (adjusted_mode)
+                        adjusted_mode->private_flags
+                                |= INTEL_MODE_DP_FORCE_6BPC;
+                return true;
+        }
+        return true;
+}
 static int
 intel_dp_mode_valid(struct drm_connector *connector,
                    struct drm_display_mode *mode)
 {
        struct intel_dp *intel_dp = intel_attached_dp(connector);
-        int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_dp));
-        int max_lanes = intel_dp_max_lane_count(intel_dp);
-        int max_rate, mode_rate;
        if (is_edp(intel_dp) && intel_dp->panel_fixed_mode) {
                if (mode->hdisplay > intel_dp->panel_fixed_mode->hdisplay)
@@ -236,16 +260,8 @@ intel_dp_mode_valid(struct drm_connector *connector,
                        return MODE_PANEL;
        }
-        mode_rate = intel_dp_link_required(mode->clock, 24);
+        if (!intel_dp_adjust_dithering(intel_dp, mode, NULL))
-        max_rate = intel_dp_max_data_rate(max_link_clock, max_lanes);
+                return MODE_CLOCK_HIGH;
-        if (mode_rate > max_rate) {
-                        mode_rate = intel_dp_link_required(mode->clock, 18);
-                        if (mode_rate > max_rate)
-                                return MODE_CLOCK_HIGH;
-                        else
-                                mode->private_flags |= INTEL_MODE_DP_FORCE_6BPC;
-        }
        if (mode->clock < 10000)
                return MODE_CLOCK_LOW;
@@ -672,7 +688,7 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
        int lane_count, clock;
        int max_lane_count = intel_dp_max_lane_count(intel_dp);
        int max_clock = intel_dp_max_link_bw(intel_dp) == DP_LINK_BW_2_7 ? 1 : 0;
-        int bpp = mode->private_flags & INTEL_MODE_DP_FORCE_6BPC ? 18 : 24;
+        int bpp;
        static int bws[2] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7 };
        if (is_edp(intel_dp) && intel_dp->panel_fixed_mode) {
@@ -686,6 +702,11 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
                mode->clock = intel_dp->panel_fixed_mode->clock;
        }
+        if (!intel_dp_adjust_dithering(intel_dp, mode, adjusted_mode))
+                return false;
+        bpp = adjusted_mode->private_flags & INTEL_MODE_DP_FORCE_6BPC ? 18 : 24;
        for (lane_count = 1; lane_count <= max_lane_count; lane_count <<= 1) {
                for (clock = 0; clock <= max_clock; clock++) {
                        int link_avail = intel_dp_max_data_rate(intel_dp_link_clock(bws[clock]), lane_count);
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index 601c86e664af..8fdc95700218 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -390,7 +390,7 @@ int intel_setup_gmbus(struct drm_device *dev)
                bus->has_gpio = intel_gpio_setup(bus, i);
                /* XXX force bit banging until GMBUS is fully debugged */
-                if (bus->has_gpio && IS_GEN2(dev))
+                if (bus->has_gpio)
                        bus->force_bit = true;
        }
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index e25581a9f60f..f75806e5bff5 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1038,7 +1038,7 @@ int intel_init_ring_buffer(struct drm_device *dev,
         * of the buffer.
         */
        ring->effective_size = ring->size;
-        if (IS_I830(ring->dev))
+        if (IS_I830(ring->dev) || IS_845G(ring->dev))
                ring->effective_size -= 128;
        return 0;
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index a464771a7240..e90dfb625c42 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -95,7 +95,6 @@ ivb_update_plane(struct drm_plane *plane, struct drm_framebuffer *fb,
        /* must disable */
        sprctl |= SPRITE_TRICKLE_FEED_DISABLE;
        sprctl |= SPRITE_ENABLE;
-        sprctl |= SPRITE_DEST_KEY;
        /* Sizes are 0 based */
        src_w--;
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index e607c4d7dd98..2d39f9977e00 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -230,6 +230,10 @@ atombios_dvo_setup(struct drm_encoder *encoder, int action)
        if (!atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev))
                return;
+        /* some R4xx chips have the wrong frev */
+        if (rdev->family <= CHIP_RV410)
+                frev = 1;
        switch (frev) {
        case 1:
                switch (crev) {
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 81801c176aa5..fe33d35dae8c 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2553,7 +2553,7 @@ static void r100_pll_errata_after_data(struct radeon_device *rdev)
         * or the chip could hang on a subsequent access
         */
        if (rdev->pll_errata & CHIP_ERRATA_PLL_DELAY) {
-                udelay(5000);
+                mdelay(5);
        }
        /* This function is required to workaround a hardware bug in some (all?)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 391bd2636a80..de71243b591f 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2839,7 +2839,7 @@ void r600_rlc_stop(struct radeon_device *rdev)
                /* r7xx asics need to soft reset RLC before halting */
                WREG32(SRBM_SOFT_RESET, SOFT_RESET_RLC);
                RREG32(SRBM_SOFT_RESET);
-                udelay(15000);
+                mdelay(15);
                WREG32(SRBM_SOFT_RESET, 0);
                RREG32(SRBM_SOFT_RESET);
        }
diff --git a/drivers/gpu/drm/radeon/r600_cp.c b/drivers/gpu/drm/radeon/r600_cp.c
index 84c546250955..75ed17c96115 100644
--- a/drivers/gpu/drm/radeon/r600_cp.c
+++ b/drivers/gpu/drm/radeon/r600_cp.c
@@ -407,7 +407,7 @@ static void r600_cp_load_microcode(drm_radeon_private_t *dev_priv)
        RADEON_WRITE(R600_GRBM_SOFT_RESET, R600_SOFT_RESET_CP);
        RADEON_READ(R600_GRBM_SOFT_RESET);
-        DRM_UDELAY(15000);
+        mdelay(15);
        RADEON_WRITE(R600_GRBM_SOFT_RESET, 0);
        fw_data = (const __be32 *)dev_priv->me_fw->data;
@@ -500,7 +500,7 @@ static void r700_cp_load_microcode(drm_radeon_private_t *dev_priv)
        RADEON_WRITE(R600_GRBM_SOFT_RESET, R600_SOFT_RESET_CP);
        RADEON_READ(R600_GRBM_SOFT_RESET);
-        DRM_UDELAY(15000);
+        mdelay(15);
        RADEON_WRITE(R600_GRBM_SOFT_RESET, 0);
        fw_data = (const __be32 *)dev_priv->pfp_fw->data;
@@ -1797,7 +1797,7 @@ static void r600_cp_init_ring_buffer(struct drm_device *dev,
        RADEON_WRITE(R600_GRBM_SOFT_RESET, R600_SOFT_RESET_CP);
        RADEON_READ(R600_GRBM_SOFT_RESET);
-        DRM_UDELAY(15000);
+        mdelay(15);
        RADEON_WRITE(R600_GRBM_SOFT_RESET, 0);
diff --git a/drivers/gpu/drm/radeon/radeon_clocks.c b/drivers/gpu/drm/radeon/radeon_clocks.c
index 6ae0c75f016a..9c6b29a41927 100644
--- a/drivers/gpu/drm/radeon/radeon_clocks.c
+++ b/drivers/gpu/drm/radeon/radeon_clocks.c
@@ -633,7 +633,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                tmp &= ~(R300_SCLK_FORCE_VAP);
                                tmp |= RADEON_SCLK_FORCE_CP;
                                WREG32_PLL(RADEON_SCLK_CNTL, tmp);
-                                udelay(15000);
+                                mdelay(15);
                                tmp = RREG32_PLL(R300_SCLK_CNTL2);
                                tmp &= ~(R300_SCLK_FORCE_TCL |
@@ -651,12 +651,12 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                        tmp |= (RADEON_ENGIN_DYNCLK_MODE |
                                (0x01 << RADEON_ACTIVE_HILO_LAT_SHIFT));
                        WREG32_PLL(RADEON_CLK_PWRMGT_CNTL, tmp);
-                        udelay(15000);
+                        mdelay(15);
                        tmp = RREG32_PLL(RADEON_CLK_PIN_CNTL);
                        tmp |= RADEON_SCLK_DYN_START_CNTL;
                        WREG32_PLL(RADEON_CLK_PIN_CNTL, tmp);
-                        udelay(15000);
+                        mdelay(15);
                        /* When DRI is enabled, setting DYN_STOP_LAT to zero can cause some R200
                           to lockup randomly, leave them as set by BIOS.
@@ -696,7 +696,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                        tmp |= RADEON_SCLK_MORE_FORCEON;
                                }
                                WREG32_PLL(RADEON_SCLK_MORE_CNTL, tmp);
-                                udelay(15000);
+                                mdelay(15);
                        }
                        /* RV200::A11 A12, RV250::A11 A12 */
@@ -709,7 +709,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                tmp |= RADEON_TCL_BYPASS_DISABLE;
                                WREG32_PLL(RADEON_PLL_PWRMGT_CNTL, tmp);
                        }
-                        udelay(15000);
+                        mdelay(15);
                        /*enable dynamic mode for display clocks (PIXCLK and PIX2CLK) */
                        tmp = RREG32_PLL(RADEON_PIXCLKS_CNTL);
@@ -722,14 +722,14 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                RADEON_PIXCLK_TMDS_ALWAYS_ONb);
                        WREG32_PLL(RADEON_PIXCLKS_CNTL, tmp);
-                        udelay(15000);
+                        mdelay(15);
                        tmp = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
                        tmp |= (RADEON_PIXCLK_ALWAYS_ONb |
                                RADEON_PIXCLK_DAC_ALWAYS_ONb);
                        WREG32_PLL(RADEON_VCLK_ECP_CNTL, tmp);
-                        udelay(15000);
+                        mdelay(15);
                }
        } else {
                /* Turn everything OFF (ForceON to everything) */
@@ -861,7 +861,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                        }
                        WREG32_PLL(RADEON_SCLK_CNTL, tmp);
-                        udelay(16000);
+                        mdelay(16);
                        if ((rdev->family == CHIP_R300) ||
                            (rdev->family == CHIP_R350)) {
@@ -870,7 +870,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                        R300_SCLK_FORCE_GA |
                                        R300_SCLK_FORCE_CBA);
                                WREG32_PLL(R300_SCLK_CNTL2, tmp);
-                                udelay(16000);
+                                mdelay(16);
                        }
                        if (rdev->flags & RADEON_IS_IGP) {
@@ -878,7 +878,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                tmp &= ~(RADEON_FORCEON_MCLKA |
                                         RADEON_FORCEON_YCLKA);
                                WREG32_PLL(RADEON_MCLK_CNTL, tmp);
-                                udelay(16000);
+                                mdelay(16);
                        }
                        if ((rdev->family == CHIP_RV200) ||
@@ -887,7 +887,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                tmp = RREG32_PLL(RADEON_SCLK_MORE_CNTL);
                                tmp |= RADEON_SCLK_MORE_FORCEON;
                                WREG32_PLL(RADEON_SCLK_MORE_CNTL, tmp);
-                                udelay(16000);
+                                mdelay(16);
                        }
                        tmp = RREG32_PLL(RADEON_PIXCLKS_CNTL);
@@ -900,7 +900,7 @@ void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable)
                                 RADEON_PIXCLK_TMDS_ALWAYS_ONb);
                        WREG32_PLL(RADEON_PIXCLKS_CNTL, tmp);
-                        udelay(16000);
+                        mdelay(16);
                        tmp = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
                        tmp &= ~(RADEON_PIXCLK_ALWAYS_ONb |
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 81fc100be7e1..2cad9fde92fc 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2845,7 +2845,7 @@ bool radeon_combios_external_tmds_setup(struct drm_encoder *encoder)
                                        case 4:
                                                val = RBIOS16(index);
                                                index += 2;
-                                                udelay(val * 1000);
+                                                mdelay(val);
                                                break;
                                        case 6:
                                                slave_addr = id & 0xff;
@@ -3044,7 +3044,7 @@ static void combios_parse_pll_table(struct drm_device *dev, uint16_t offset)
                                        udelay(150);
                                        break;
                                case 2:
-                                        udelay(1000);
+                                        mdelay(1);
                                        break;
                                case 3:
                                        while (tmp--) {
@@ -3075,13 +3075,13 @@ static void combios_parse_pll_table(struct drm_device *dev, uint16_t offset)
                                                /*mclk_cntl |= 0x00001111;*//* ??? */
                                                WREG32_PLL(RADEON_MCLK_CNTL,
                                                           mclk_cntl);
-                                                udelay(10000);
+                                                mdelay(10);
 #endif
                                                WREG32_PLL
                                                    (RADEON_CLK_PWRMGT_CNTL,
                                                     tmp &
                                                     ~RADEON_CG_NO1_DEBUG_0);
-                                                udelay(10000);
+                                                mdelay(10);
                                        }
                                        break;
                                default:
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index 85bcfc8923a7..3edec1c198e3 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -900,6 +900,10 @@ struct radeon_i2c_chan *radeon_i2c_create(struct drm_device *dev,
        struct radeon_i2c_chan *i2c;
        int ret;
+        /* don't add the mm_i2c bus unless hw_i2c is enabled */
+        if (rec->mm_i2c && (radeon_hw_i2c == 0))
+                return NULL;
        i2c = kzalloc(sizeof(struct radeon_i2c_chan), GFP_KERNEL);
        if (i2c == NULL)
                return NULL;
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 2f46e0c8df53..42db254f6bb0 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -88,7 +88,7 @@ static void radeon_legacy_lvds_update(struct drm_encoder *encoder, int mode)
                lvds_pll_cntl = RREG32(RADEON_LVDS_PLL_CNTL);
                lvds_pll_cntl |= RADEON_LVDS_PLL_EN;
                WREG32(RADEON_LVDS_PLL_CNTL, lvds_pll_cntl);
-                udelay(1000);
+                mdelay(1);
                lvds_pll_cntl = RREG32(RADEON_LVDS_PLL_CNTL);
                lvds_pll_cntl &= ~RADEON_LVDS_PLL_RESET;
@@ -101,7 +101,7 @@ static void radeon_legacy_lvds_update(struct drm_encoder *encoder, int mode)
                                  (backlight_level << RADEON_LVDS_BL_MOD_LEVEL_SHIFT));
                if (is_mac)
                        lvds_gen_cntl |= RADEON_LVDS_BL_MOD_EN;
-                udelay(panel_pwr_delay * 1000);
+                mdelay(panel_pwr_delay);
                WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
                break;
        case DRM_MODE_DPMS_STANDBY:
@@ -118,10 +118,10 @@ static void radeon_legacy_lvds_update(struct drm_encoder *encoder, int mode)
                        WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
                        lvds_gen_cntl &= ~(RADEON_LVDS_ON | RADEON_LVDS_BLON | RADEON_LVDS_EN | RADEON_LVDS_DIGON);
                }
-                udelay(panel_pwr_delay * 1000);
+                mdelay(panel_pwr_delay);
                WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
                WREG32_PLL(RADEON_PIXCLKS_CNTL, pixclks_cntl);
-                udelay(panel_pwr_delay * 1000);
+                mdelay(panel_pwr_delay);
                break;
        }
@@ -656,7 +656,7 @@ static enum drm_connector_status radeon_legacy_primary_dac_detect(struct drm_enc
        WREG32(RADEON_DAC_MACRO_CNTL, tmp);
-        udelay(2000);
+        mdelay(2);
        if (RREG32(RADEON_DAC_CNTL) & RADEON_DAC_CMP_OUTPUT)
                found = connector_status_connected;
@@ -1499,7 +1499,7 @@ static enum drm_connector_status radeon_legacy_tv_dac_detect(struct drm_encoder
        tmp = dac_cntl2 | RADEON_DAC2_DAC2_CLK_SEL | RADEON_DAC2_CMP_EN;
        WREG32(RADEON_DAC_CNTL2, tmp);
-        udelay(10000);
+        mdelay(10);
        if (ASIC_IS_R300(rdev)) {
                if (RREG32(RADEON_DAC_CNTL2) & RADEON_DAC2_CMP_OUT_B)
diff --git a/drivers/gpu/drm/savage/savage_state.c b/drivers/gpu/drm/savage/savage_state.c
index 031aaaf79ac2..b6d8608375cd 100644
--- a/drivers/gpu/drm/savage/savage_state.c
+++ b/drivers/gpu/drm/savage/savage_state.c
@@ -988,7 +988,7 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
         * for locking on FreeBSD.
         */
        if (cmdbuf->size) {
-                kcmd_addr = kmalloc(cmdbuf->size * 8, GFP_KERNEL);
+                kcmd_addr = kmalloc_array(cmdbuf->size, 8, GFP_KERNEL);
                if (kcmd_addr == NULL)
                        return -ENOMEM;
@@ -1015,8 +1015,8 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
                cmdbuf->vb_addr = kvb_addr;
        }
        if (cmdbuf->nbox) {
-                kbox_addr = kmalloc(cmdbuf->nbox * sizeof(struct drm_clip_rect),
+                kbox_addr = kmalloc_array(cmdbuf->nbox, sizeof(struct drm_clip_rect),
-                                    GFP_KERNEL);
+                                          GFP_KERNEL);
                if (kbox_addr == NULL) {
                        ret = -ENOMEM;
                        goto done;
diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c
index 37f42113af31..00e8f213f56e 100644
--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
+++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
@@ -182,7 +182,6 @@ static int i2c_dw_pci_resume(struct device *dev)
        pci_restore_state(pdev);
        i2c_dw_init(i2c);
-        i2c_dw_enable(i2c);
        return 0;
 }
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 83b720ef6c34..246fdc151652 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -179,7 +179,7 @@ static ssize_t rate_show(struct ib_port *p, struct port_attribute *unused,
 {
        struct ib_port_attr attr;
        char *speed = "";
-        int rate = -1;          /* in deci-Gb/sec */
+        int rate;               /* in deci-Gb/sec */
        ssize_t ret;
        ret = ib_query_port(p->ibdev, p->port_num, &attr);
@@ -187,9 +187,6 @@ static ssize_t rate_show(struct ib_port *p, struct port_attribute *unused,
                return ret;
        switch (attr.active_speed) {
-        case IB_SPEED_SDR:
-                rate = 25;
-                break;
        case IB_SPEED_DDR:
                speed = " DDR";
                rate = 50;
@@ -210,6 +207,10 @@ static ssize_t rate_show(struct ib_port *p, struct port_attribute *unused,
                speed = " EDR";
                rate = 250;
                break;
+        case IB_SPEED_SDR:
+        default:                /* default to SDR for invalid rates */
+                rate = 25;
+                break;
        }
        rate *= ib_width_enum_to_int(attr.active_width);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 75d305629300..669673e81439 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -253,6 +253,11 @@ static int ib_link_query_port(struct ib_device *ibdev, u8 port,
                if (out_mad->data[15] & 0x1)
                        props->active_speed = IB_SPEED_FDR10;
        }
+        /* Avoid wrong speed value returned by FW if the IB link is down. */
+        if (props->state == IB_PORT_DOWN)
+                 props->active_speed = IB_SPEED_SDR;
 out:
        kfree(in_mad);
        kfree(out_mad);
diff --git a/drivers/input/misc/da9052_onkey.c b/drivers/input/misc/da9052_onkey.c
index 34aebb8cd080..3c843cd725fa 100644
--- a/drivers/input/misc/da9052_onkey.c
+++ b/drivers/input/misc/da9052_onkey.c
@@ -95,7 +95,8 @@ static int __devinit da9052_onkey_probe(struct platform_device *pdev)
        input_dev = input_allocate_device();
        if (!onkey || !input_dev) {
                dev_err(&pdev->dev, "Failed to allocate memory\n");
-                return -ENOMEM;
+                error = -ENOMEM;
+                goto err_free_mem;
        }
        onkey->input = input_dev;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index d2c0db159b18..479011004a11 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -486,7 +486,6 @@ static void elantech_input_sync_v4(struct psmouse *psmouse)
        unsigned char *packet = psmouse->packet;
        input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
-        input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
        input_mt_report_pointer_emulation(dev, true);
        input_sync(dev);
 }
@@ -967,6 +966,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
        if (elantech_set_range(psmouse, &x_min, &y_min, &x_max, &y_max, &width))
                return -1;
+        __set_bit(INPUT_PROP_POINTER, dev->propbit);
        __set_bit(EV_KEY, dev->evbit);
        __set_bit(EV_ABS, dev->evbit);
        __clear_bit(EV_REL, dev->evbit);
@@ -1017,7 +1017,9 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                         */
                        psmouse_warn(psmouse, "couldn't query resolution data.\n");
                }
+                /* v4 is clickpad, with only one button. */
+                __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
+                __clear_bit(BTN_RIGHT, dev->keybit);
                __set_bit(BTN_TOOL_QUADTAP, dev->keybit);
                /* For X to recognize me as touchpad. */
                input_set_abs_params(dev, ABS_X, x_min, x_max, 0, 0);
@@ -1245,6 +1247,8 @@ static void elantech_disconnect(struct psmouse *psmouse)
 */
 static int elantech_reconnect(struct psmouse *psmouse)
 {
+        psmouse_reset(psmouse);
        if (elantech_detect(psmouse, 0))
                return -1;
@@ -1324,6 +1328,8 @@ int elantech_init(struct psmouse *psmouse)
        if (!etd)
                return -ENOMEM;
+        psmouse_reset(psmouse);
        etd->parity[0] = 1;
        for (i = 1; i < 256; i++)
                etd->parity[i] = etd->parity[i & (i - 1)] ^ 1;
diff --git a/drivers/input/mouse/gpio_mouse.c b/drivers/input/mouse/gpio_mouse.c
index a9ad8e1402be..39fe9b737cae 100644
--- a/drivers/input/mouse/gpio_mouse.c
+++ b/drivers/input/mouse/gpio_mouse.c
@@ -12,9 +12,9 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/input-polldev.h>
+#include <linux/gpio.h>
 #include <linux/gpio_mouse.h>
-#include <asm/gpio.h>
 /*
 * Timer function which is run every scan_ms ms when the device is opened.
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index a977bfaa6821..661a0ca3b3d6 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -741,6 +741,14 @@ static psmouse_ret_t fsp_process_byte(struct psmouse *psmouse)
                        }
                } else {
                        /* SFAC packet */
+                        if ((packet[0] & (FSP_PB0_LBTN|FSP_PB0_PHY_BTN)) ==
+                                FSP_PB0_LBTN) {
+                                /* On-pad click in SFAC mode should be handled
+                                 * by userspace.  On-pad clicks in MFMC mode
+                                 * are real clickpad clicks, and not ignored.
+                                 */
+                                packet[0] &= ~FSP_PB0_LBTN;
+                        }
                        /* no multi-finger information */
                        ad->last_mt_fgr = 0;
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 22b218018137..f3102494237d 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -304,7 +304,7 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
                return 0;
        if (trackpoint_read(&psmouse->ps2dev, TP_EXT_BTN, &button_info)) {
-                printk(KERN_WARNING "trackpoint.c: failed to get extended button data\n");
+                psmouse_warn(psmouse, "failed to get extended button data\n");
                button_info = 0;
        }
@@ -326,16 +326,18 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
        error = sysfs_create_group(&ps2dev->serio->dev.kobj, &trackpoint_attr_group);
        if (error) {
-                printk(KERN_ERR
+                psmouse_err(psmouse,
-                        "trackpoint.c: failed to create sysfs attributes, error: %d\n",
+                            "failed to create sysfs attributes, error: %d\n",
-                        error);
+                            error);
                kfree(psmouse->private);
                psmouse->private = NULL;
                return -1;
        }
-        printk(KERN_INFO "IBM TrackPoint firmware: 0x%02x, buttons: %d/%d\n",
+        psmouse_info(psmouse,
-                firmware_id, (button_info & 0xf0) >> 4, button_info & 0x0f);
+                     "IBM TrackPoint firmware: 0x%02x, buttons: %d/%d\n",
+                     firmware_id,
+                     (button_info & 0xf0) >> 4, button_info & 0x0f);
        return 0;
 }
diff --git a/drivers/input/touchscreen/tps6507x-ts.c b/drivers/input/touchscreen/tps6507x-ts.c
index 6c6f6d8ea9b4..f7eda3d00fad 100644
--- a/drivers/input/touchscreen/tps6507x-ts.c
+++ b/drivers/input/touchscreen/tps6507x-ts.c
@@ -1,6 +1,4 @@
 /*
- * drivers/input/touchscreen/tps6507x_ts.c
- *
 * Touchscreen driver for the tps6507x chip.
 *
 * Copyright (c) 2009 RidgeRun (todd.fischer@ridgerun.com)
@@ -376,4 +374,4 @@ module_platform_driver(tps6507x_ts_driver);
 MODULE_AUTHOR("Todd Fischer <todd.fischer@ridgerun.com>");
 MODULE_DESCRIPTION("TPS6507x - TouchScreen driver");
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:tps6507x-tsc");
+MODULE_ALIAS("platform:tps6507x-ts");
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 3d0dfa7a89a2..97e73e555d11 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -539,9 +539,6 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
        bitmap->events_cleared = bitmap->mddev->events;
        sb->events_cleared = cpu_to_le64(bitmap->mddev->events);
-        bitmap->flags |= BITMAP_HOSTENDIAN;
-        sb->version = cpu_to_le32(BITMAP_MAJOR_HOSTENDIAN);
        kunmap_atomic(sb);
        return 0;
@@ -1788,7 +1785,9 @@ int bitmap_load(struct mddev *mddev)
                 * re-add of a missing device */
                start = mddev->recovery_cp;
+        mutex_lock(&mddev->bitmap_info.mutex);
        err = bitmap_init_from_disk(bitmap, start);
+        mutex_unlock(&mddev->bitmap_info.mutex);
        if (err)
                goto out;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d35e4c991e38..15dd59b84e94 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1712,6 +1712,7 @@ static int process_checks(struct r1bio *r1_bio)
        struct r1conf *conf = mddev->private;
        int primary;
        int i;
+        int vcnt;
        for (primary = 0; primary < conf->raid_disks * 2; primary++)
                if (r1_bio->bios[primary]->bi_end_io == end_sync_read &&
@@ -1721,9 +1722,9 @@ static int process_checks(struct r1bio *r1_bio)
                        break;
                }
        r1_bio->read_disk = primary;
+        vcnt = (r1_bio->sectors + PAGE_SIZE / 512 - 1) >> (PAGE_SHIFT - 9);
        for (i = 0; i < conf->raid_disks * 2; i++) {
                int j;
-                int vcnt = r1_bio->sectors >> (PAGE_SHIFT- 9);
                struct bio *pbio = r1_bio->bios[primary];
                struct bio *sbio = r1_bio->bios[i];
                int size;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index fff782189e48..c8dbb84d5357 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1788,6 +1788,7 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
        struct r10conf *conf = mddev->private;
        int i, first;
        struct bio *tbio, *fbio;
+        int vcnt;
        atomic_set(&r10_bio->remaining, 1);
@@ -1802,10 +1803,10 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
        first = i;
        fbio = r10_bio->devs[i].bio;
+        vcnt = (r10_bio->sectors + (PAGE_SIZE >> 9) - 1) >> (PAGE_SHIFT - 9);
        /* now find blocks with errors */
        for (i=0 ; i < conf->copies ; i++) {
                int  j, d;
-                int vcnt = r10_bio->sectors >> (PAGE_SHIFT-9);
                tbio = r10_bio->devs[i].bio;
@@ -1871,7 +1872,6 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
         */
        for (i = 0; i < conf->copies; i++) {
                int j, d;
-                int vcnt = r10_bio->sectors >> (PAGE_SHIFT-9);
                tbio = r10_bio->devs[i].repl_bio;
                if (!tbio || !tbio->bi_end_io)
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 4555baa383b2..39696c6a4ed7 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -143,10 +143,12 @@ struct dvb_frontend_private {
 static void dvb_frontend_wakeup(struct dvb_frontend *fe);
 static int dtv_get_frontend(struct dvb_frontend *fe,
                            struct dvb_frontend_parameters *p_out);
+static int dtv_property_legacy_params_sync(struct dvb_frontend *fe,
+                                           struct dvb_frontend_parameters *p);
 static bool has_get_frontend(struct dvb_frontend *fe)
 {
-        return fe->ops.get_frontend;
+        return fe->ops.get_frontend != NULL;
 }
 /*
@@ -697,6 +699,7 @@ restart:
                                        fepriv->algo_status |= DVBFE_ALGO_SEARCH_AGAIN;
                                        fepriv->delay = HZ / 2;
                                }
+                                dtv_property_legacy_params_sync(fe, &fepriv->parameters_out);
                                fe->ops.read_status(fe, &s);
                                if (s != fepriv->status) {
                                        dvb_frontend_add_event(fe, s); /* update event list */
@@ -1833,6 +1836,13 @@ static int dtv_set_frontend(struct dvb_frontend *fe)
                return -EINVAL;
        /*
+         * Initialize output parameters to match the values given by
+         * the user. FE_SET_FRONTEND triggers an initial frontend event
+         * with status = 0, which copies output parameters to userspace.
+         */
+        dtv_property_legacy_params_sync(fe, &fepriv->parameters_out);
+        /*
         * Be sure that the bandwidth will be filled for all
         * non-satellite systems, as tuners need to know what
         * low pass/Nyquist half filter should be applied, in
diff --git a/drivers/media/dvb/dvb-usb/it913x.c b/drivers/media/dvb/dvb-usb/it913x.c
index 3b7b102f20ae..482d249ca7f3 100644
--- a/drivers/media/dvb/dvb-usb/it913x.c
+++ b/drivers/media/dvb/dvb-usb/it913x.c
@@ -238,12 +238,27 @@ static int it913x_read_reg(struct usb_device *udev, u32 reg)
 static u32 it913x_query(struct usb_device *udev, u8 pro)
 {
-        int ret;
+        int ret, i;
        u8 data[4];
-        ret = it913x_io(udev, READ_LONG, pro, CMD_DEMOD_READ,
+        u8 ver;
-                0x1222, 0, &data[0], 3);
+        for (i = 0; i < 5; i++) {
+                ret = it913x_io(udev, READ_LONG, pro, CMD_DEMOD_READ,
+                        0x1222, 0, &data[0], 3);
+                ver = data[0];
+                if (ver > 0 && ver < 3)
+                        break;
+                msleep(100);
+        }
-        it913x_config.chip_ver = data[0];
+        if (ver < 1 || ver > 2) {
+                info("Failed to identify chip version applying 1");
+                it913x_config.chip_ver = 0x1;
+                it913x_config.chip_type = 0x9135;
+                return 0;
+        }
+        it913x_config.chip_ver = ver;
        it913x_config.chip_type = (u16)(data[2] << 8) + data[1];
        info("Chip Version=%02x Chip Type=%04x", it913x_config.chip_ver,
@@ -660,30 +675,41 @@ static int it913x_download_firmware(struct usb_device *udev,
                        if ((packet_size > min_pkt) || (i == fw->size)) {
                                fw_data = (u8 *)(fw->data + pos);
                                pos += packet_size;
-                                if (packet_size > 0)
+                                if (packet_size > 0) {
-                                        ret |= it913x_io(udev, WRITE_DATA,
+                                        ret = it913x_io(udev, WRITE_DATA,
                                                DEV_0, CMD_SCATTER_WRITE, 0,
                                                0, fw_data, packet_size);
+                                        if (ret < 0)
+                                                break;
+                                }
                                udelay(1000);
                        }
                }
                i++;
        }
-        ret |= it913x_io(udev, WRITE_CMD, DEV_0, CMD_BOOT, 0, 0, NULL, 0);
-        msleep(100);
        if (ret < 0)
-                info("FRM Firmware Download Failed (%04x)" , ret);
+                info("FRM Firmware Download Failed (%d)" , ret);
        else
                info("FRM Firmware Download Completed - Resetting Device");
-        ret |= it913x_return_status(udev);
+        msleep(30);
+        ret = it913x_io(udev, WRITE_CMD, DEV_0, CMD_BOOT, 0, 0, NULL, 0);
+        if (ret < 0)
+                info("FRM Device not responding to reboot");
+        ret = it913x_return_status(udev);
+        if (ret == 0) {
+                info("FRM Failed to reboot device");
+                return -ENODEV;
+        }
        msleep(30);
-        ret |= it913x_wr_reg(udev, DEV_0,  I2C_CLK, I2C_CLK_400);
+        ret = it913x_wr_reg(udev, DEV_0,  I2C_CLK, I2C_CLK_400);
+        msleep(30);
        /* Tuner function */
        if (it913x_config.dual_mode)
@@ -901,5 +927,5 @@ module_usb_driver(it913x_driver);
 MODULE_AUTHOR("Malcolm Priestley <tvboxspy@gmail.com>");
 MODULE_DESCRIPTION("it913x USB 2 Driver");
-MODULE_VERSION("1.27");
+MODULE_VERSION("1.28");
 MODULE_LICENSE("GPL");
diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
index 5452beef8e11..989e556913ed 100644
--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -1763,13 +1763,13 @@ static int ivtv_decoder_ioctls(struct file *filp, unsigned int cmd, void *arg)
                IVTV_DEBUG_IOCTL("AUDIO_CHANNEL_SELECT\n");
                if (iarg > AUDIO_STEREO_SWAPPED)
                        return -EINVAL;
-                return v4l2_ctrl_s_ctrl(itv->ctrl_audio_playback, iarg);
+                return v4l2_ctrl_s_ctrl(itv->ctrl_audio_playback, iarg + 1);
        case AUDIO_BILINGUAL_CHANNEL_SELECT:
                IVTV_DEBUG_IOCTL("AUDIO_BILINGUAL_CHANNEL_SELECT\n");
                if (iarg > AUDIO_STEREO_SWAPPED)
                        return -EINVAL;
-                return v4l2_ctrl_s_ctrl(itv->ctrl_audio_multilingual_playback, iarg);
+                return v4l2_ctrl_s_ctrl(itv->ctrl_audio_multilingual_playback, iarg + 1);
        default:
                return -EINVAL;
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index 4a44f9a1bae0..b76b0ac0958f 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -468,22 +468,30 @@ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
        spin_unlock_irqrestore(&stream->clock.lock, flags);
 }
-static int uvc_video_clock_init(struct uvc_streaming *stream)
+static void uvc_video_clock_reset(struct uvc_streaming *stream)
 {
        struct uvc_clock *clock = &stream->clock;
-        spin_lock_init(&clock->lock);
        clock->head = 0;
        clock->count = 0;
-        clock->size = 32;
        clock->last_sof = -1;
        clock->sof_offset = -1;
+}
+static int uvc_video_clock_init(struct uvc_streaming *stream)
+{
+        struct uvc_clock *clock = &stream->clock;
+        spin_lock_init(&clock->lock);
+        clock->size = 32;
        clock->samples = kmalloc(clock->size * sizeof(*clock->samples),
                                 GFP_KERNEL);
        if (clock->samples == NULL)
                return -ENOMEM;
+        uvc_video_clock_reset(stream);
        return 0;
 }
@@ -1424,8 +1432,6 @@ static void uvc_uninit_video(struct uvc_streaming *stream, int free_buffers)
        if (free_buffers)
                uvc_free_urb_buffers(stream);
-        uvc_video_clock_cleanup(stream);
 }
 /*
@@ -1555,10 +1561,6 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
        uvc_video_stats_start(stream);
-        ret = uvc_video_clock_init(stream);
-        if (ret < 0)
-                return ret;
        if (intf->num_altsetting > 1) {
                struct usb_host_endpoint *best_ep = NULL;
                unsigned int best_psize = 3 * 1024;
@@ -1683,6 +1685,8 @@ int uvc_video_resume(struct uvc_streaming *stream, int reset)
        stream->frozen = 0;
+        uvc_video_clock_reset(stream);
        ret = uvc_commit_video(stream, &stream->ctrl);
        if (ret < 0) {
                uvc_queue_enable(&stream->queue, 0);
@@ -1819,25 +1823,35 @@ int uvc_video_enable(struct uvc_streaming *stream, int enable)
                uvc_uninit_video(stream, 1);
                usb_set_interface(stream->dev->udev, stream->intfnum, 0);
                uvc_queue_enable(&stream->queue, 0);
+                uvc_video_clock_cleanup(stream);
                return 0;
        }
-        ret = uvc_queue_enable(&stream->queue, 1);
+        ret = uvc_video_clock_init(stream);
        if (ret < 0)
                return ret;
+        ret = uvc_queue_enable(&stream->queue, 1);
+        if (ret < 0)
+                goto error_queue;
        /* Commit the streaming parameters. */
        ret = uvc_commit_video(stream, &stream->ctrl);
-        if (ret < 0) {
+        if (ret < 0)
-                uvc_queue_enable(&stream->queue, 0);
+                goto error_commit;
-                return ret;
-        }
        ret = uvc_init_video(stream, GFP_KERNEL);
-        if (ret < 0) {
+        if (ret < 0)
-                usb_set_interface(stream->dev->udev, stream->intfnum, 0);
+                goto error_video;
-                uvc_queue_enable(&stream->queue, 0);
-        }
+        return 0;
+error_video:
+        usb_set_interface(stream->dev->udev, stream->intfnum, 0);
+error_commit:
+        uvc_queue_enable(&stream->queue, 0);
+error_queue:
+        uvc_video_clock_cleanup(stream);
        return ret;
 }
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index eed213a5c8cb..b1809650b7aa 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1623,24 +1623,6 @@ static int mmc_blk_alloc_parts(struct mmc_card *card, struct mmc_blk_data *md)
        return ret;
 }
-static int
-mmc_blk_set_blksize(struct mmc_blk_data *md, struct mmc_card *card)
-{
-        int err;
-        mmc_claim_host(card->host);
-        err = mmc_set_blocklen(card, 512);
-        mmc_release_host(card->host);
-        if (err) {
-                pr_err("%s: unable to set block size to 512: %d\n",
-                        md->disk->disk_name, err);
-                return -EINVAL;
-        }
-        return 0;
-}
 static void mmc_blk_remove_req(struct mmc_blk_data *md)
 {
        struct mmc_card *card;
@@ -1768,7 +1750,6 @@ static const struct mmc_fixup blk_fixups[] =
 static int mmc_blk_probe(struct mmc_card *card)
 {
        struct mmc_blk_data *md, *part_md;
-        int err;
        char cap_str[10];
        /*
@@ -1781,10 +1762,6 @@ static int mmc_blk_probe(struct mmc_card *card)
        if (IS_ERR(md))
                return PTR_ERR(md);
-        err = mmc_blk_set_blksize(md, card);
-        if (err)
-                goto out;
        string_get_size((u64)get_capacity(md->disk) << 9, STRING_UNITS_2,
                        cap_str, sizeof(cap_str));
        pr_info("%s: %s %s %s %s\n",
@@ -1809,7 +1786,7 @@ static int mmc_blk_probe(struct mmc_card *card)
 out:
        mmc_blk_remove_parts(card, md);
        mmc_blk_remove_req(md);
-        return err;
+        return 0;
 }
 static void mmc_blk_remove(struct mmc_card *card)
@@ -1845,8 +1822,6 @@ static int mmc_blk_resume(struct mmc_card *card)
        struct mmc_blk_data *md = mmc_get_drvdata(card);
        if (md) {
-                mmc_blk_set_blksize(md, card);
                /*
                 * Resume involves the card going into idle state,
                 * so current partition is always the main one.
diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
index 5d011a39dfff..3f606068d552 100644
--- a/drivers/mmc/core/bus.c
+++ b/drivers/mmc/core/bus.c
@@ -267,6 +267,15 @@ int mmc_add_card(struct mmc_card *card)
 {
        int ret;
        const char *type;
+        const char *uhs_bus_speed_mode = "";
+        static const char *const uhs_speeds[] = {
+                [UHS_SDR12_BUS_SPEED] = "SDR12 ",
+                [UHS_SDR25_BUS_SPEED] = "SDR25 ",
+                [UHS_SDR50_BUS_SPEED] = "SDR50 ",
+                [UHS_SDR104_BUS_SPEED] = "SDR104 ",
+                [UHS_DDR50_BUS_SPEED] = "DDR50 ",
+        };
        dev_set_name(&card->dev, "%s:%04x", mmc_hostname(card->host), card->rca);
@@ -296,6 +305,10 @@ int mmc_add_card(struct mmc_card *card)
                break;
        }
+        if (mmc_sd_card_uhs(card) &&
+                (card->sd_bus_speed < ARRAY_SIZE(uhs_speeds)))
+                uhs_bus_speed_mode = uhs_speeds[card->sd_bus_speed];
        if (mmc_host_is_spi(card->host)) {
                pr_info("%s: new %s%s%s card on SPI\n",
                        mmc_hostname(card->host),
@@ -303,13 +316,13 @@ int mmc_add_card(struct mmc_card *card)
                        mmc_card_ddr_mode(card) ? "DDR " : "",
                        type);
        } else {
-                pr_info("%s: new %s%s%s%s card at address %04x\n",
+                pr_info("%s: new %s%s%s%s%s card at address %04x\n",
                        mmc_hostname(card->host),
                        mmc_card_uhs(card) ? "ultra high speed " :
                        (mmc_card_highspeed(card) ? "high speed " : ""),
                        (mmc_card_hs200(card) ? "HS200 " : ""),
                        mmc_card_ddr_mode(card) ? "DDR " : "",
-                        type, card->rca);
+                        uhs_bus_speed_mode, type, card->rca);
        }
 #ifdef CONFIG_DEBUG_FS
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 14f262e9246d..7474c47b9c08 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -527,10 +527,14 @@ void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card)
                if (data->flags & MMC_DATA_WRITE)
                        /*
-                         * The limit is really 250 ms, but that is
+                         * The MMC spec "It is strongly recommended
-                         * insufficient for some crappy cards.
+                         * for hosts to implement more than 500ms
+                         * timeout value even if the card indicates
+                         * the 250ms maximum busy length."  Even the
+                         * previous value of 300ms is known to be
+                         * insufficient for some cards.
                         */
-                        limit_us = 300000;
+                        limit_us = 3000000;
                else
                        limit_us = 100000;
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 02914d609a91..54df5adc0413 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -695,6 +695,11 @@ static int mmc_select_powerclass(struct mmc_card *card,
                else if (host->ios.clock <= 200000000)
                        index = EXT_CSD_PWR_CL_200_195;
                break;
+        case MMC_VDD_27_28:
+        case MMC_VDD_28_29:
+        case MMC_VDD_29_30:
+        case MMC_VDD_30_31:
+        case MMC_VDD_31_32:
        case MMC_VDD_32_33:
        case MMC_VDD_33_34:
        case MMC_VDD_34_35:
@@ -1111,11 +1116,10 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                ext_csd_bits = (bus_width == MMC_BUS_WIDTH_8) ?
                                EXT_CSD_BUS_WIDTH_8 : EXT_CSD_BUS_WIDTH_4;
                err = mmc_select_powerclass(card, ext_csd_bits, ext_csd);
-                if (err) {
+                if (err)
-                        pr_err("%s: power class selection to bus width %d failed\n",
+                        pr_warning("%s: power class selection to bus width %d"
-                                mmc_hostname(card->host), 1 << bus_width);
+                                   " failed\n", mmc_hostname(card->host),
-                        goto err;
+                                   1 << bus_width);
-                }
        }
        /*
@@ -1147,10 +1151,10 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                        err = mmc_select_powerclass(card, ext_csd_bits[idx][0],
                                                    ext_csd);
                        if (err)
-                                pr_err("%s: power class selection to "
+                                pr_warning("%s: power class selection to "
-                                       "bus width %d failed\n",
+                                           "bus width %d failed\n",
-                                       mmc_hostname(card->host),
+                                           mmc_hostname(card->host),
-                                       1 << bus_width);
+                                           1 << bus_width);
                        err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                                         EXT_CSD_BUS_WIDTH,
@@ -1178,10 +1182,10 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                        err = mmc_select_powerclass(card, ext_csd_bits[idx][1],
                                                    ext_csd);
                        if (err)
-                                pr_err("%s: power class selection to "
+                                pr_warning("%s: power class selection to "
-                                       "bus width %d ddr %d failed\n",
+                                           "bus width %d ddr %d failed\n",
-                                       mmc_hostname(card->host),
+                                           mmc_hostname(card->host),
-                                       1 << bus_width, ddr);
+                                           1 << bus_width, ddr);
                        err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                                         EXT_CSD_BUS_WIDTH,
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index 40989e6bb53a..236842ec955a 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -192,9 +192,15 @@ static int sdio_bus_remove(struct device *dev)
        return ret;
 }
-#ifdef CONFIG_PM_RUNTIME
+#ifdef CONFIG_PM
+static int pm_no_operation(struct device *dev)
+{
+        return 0;
+}
 static const struct dev_pm_ops sdio_bus_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(pm_no_operation, pm_no_operation)
        SET_RUNTIME_PM_OPS(
                pm_generic_runtime_suspend,
                pm_generic_runtime_resume,
@@ -204,11 +210,11 @@ static const struct dev_pm_ops sdio_bus_pm_ops = {
 #define SDIO_PM_OPS_PTR (&sdio_bus_pm_ops)
-#else /* !CONFIG_PM_RUNTIME */
+#else /* !CONFIG_PM */
 #define SDIO_PM_OPS_PTR NULL
-#endif /* !CONFIG_PM_RUNTIME */
+#endif /* !CONFIG_PM */
 static struct bus_type sdio_bus_type = {
        .name           = "sdio",
diff --git a/drivers/mmc/host/atmel-mci-regs.h b/drivers/mmc/host/atmel-mci-regs.h
index 000b3ad0f5ca..787aba1682bb 100644
--- a/drivers/mmc/host/atmel-mci-regs.h
+++ b/drivers/mmc/host/atmel-mci-regs.h
@@ -31,6 +31,7 @@
 # define ATMCI_MR_PDCFBYTE              (  1 << 13)     /* Force Byte Transfer */
 # define ATMCI_MR_PDCPADV               (  1 << 14)     /* Padding Value */
 # define ATMCI_MR_PDCMODE               (  1 << 15)     /* PDC-oriented Mode */
+# define ATMCI_MR_CLKODD(x)             ((x) << 16)     /* LSB of Clock Divider */
 #define ATMCI_DTOR                      0x0008  /* Data Timeout */
 # define ATMCI_DTOCYC(x)                ((x) <<  0)     /* Data Timeout Cycles */
 # define ATMCI_DTOMUL(x)                ((x) <<  4)     /* Data Timeout Multiplier */
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 9819dc09ce08..e94476beca18 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -77,6 +77,7 @@ struct atmel_mci_caps {
        bool    has_cstor_reg;
        bool    has_highspeed;
        bool    has_rwproof;
+        bool    has_odd_clk_div;
 };
 struct atmel_mci_dma {
@@ -482,7 +483,14 @@ err:
 static inline unsigned int atmci_ns_to_clocks(struct atmel_mci *host,
                                        unsigned int ns)
 {
-        return (ns * (host->bus_hz / 1000000) + 999) / 1000;
+        /*
+         * It is easier here to use us instead of ns for the timeout,
+         * it prevents from overflows during calculation.
+         */
+        unsigned int us = DIV_ROUND_UP(ns, 1000);
+        /* Maximum clock frequency is host->bus_hz/2 */
+        return us * (DIV_ROUND_UP(host->bus_hz, 2000000));
 }
 static void atmci_set_timeout(struct atmel_mci *host,
@@ -1127,16 +1135,27 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                }
                /* Calculate clock divider */
-                clkdiv = DIV_ROUND_UP(host->bus_hz, 2 * clock_min) - 1;
+                if (host->caps.has_odd_clk_div) {
-                if (clkdiv > 255) {
+                        clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2;
-                        dev_warn(&mmc->class_dev,
+                        if (clkdiv > 511) {
-                                "clock %u too slow; using %lu\n",
+                                dev_warn(&mmc->class_dev,
-                                clock_min, host->bus_hz / (2 * 256));
+                                         "clock %u too slow; using %lu\n",
-                        clkdiv = 255;
+                                         clock_min, host->bus_hz / (511 + 2));
+                                clkdiv = 511;
+                        }
+                        host->mode_reg = ATMCI_MR_CLKDIV(clkdiv >> 1)
+                                         | ATMCI_MR_CLKODD(clkdiv & 1);
+                } else {
+                        clkdiv = DIV_ROUND_UP(host->bus_hz, 2 * clock_min) - 1;
+                        if (clkdiv > 255) {
+                                dev_warn(&mmc->class_dev,
+                                         "clock %u too slow; using %lu\n",
+                                         clock_min, host->bus_hz / (2 * 256));
+                                clkdiv = 255;
+                        }
+                        host->mode_reg = ATMCI_MR_CLKDIV(clkdiv);
                }
-                host->mode_reg = ATMCI_MR_CLKDIV(clkdiv);
                /*
                 * WRPROOF and RDPROOF prevent overruns/underruns by
                 * stopping the clock when the FIFO is full/empty.
@@ -2007,35 +2026,35 @@ static void __init atmci_get_cap(struct atmel_mci *host)
                        "version: 0x%x\n", version);
        host->caps.has_dma = 0;
-        host->caps.has_pdc = 0;
+        host->caps.has_pdc = 1;
        host->caps.has_cfg_reg = 0;
        host->caps.has_cstor_reg = 0;
        host->caps.has_highspeed = 0;
        host->caps.has_rwproof = 0;
+        host->caps.has_odd_clk_div = 0;
        /* keep only major version number */
        switch (version & 0xf00) {
-        case 0x100:
-        case 0x200:
-                host->caps.has_pdc = 1;
-                host->caps.has_rwproof = 1;
-                break;
-        case 0x300:
-        case 0x400:
        case 0x500:
+                host->caps.has_odd_clk_div = 1;
+        case 0x400:
+        case 0x300:
 #ifdef CONFIG_AT_HDMAC
                host->caps.has_dma = 1;
 #else
-                host->caps.has_dma = 0;
                dev_info(&host->pdev->dev,
                        "has dma capability but dma engine is not selected, then use pio\n");
 #endif
+                host->caps.has_pdc = 0;
                host->caps.has_cfg_reg = 1;
                host->caps.has_cstor_reg = 1;
                host->caps.has_highspeed = 1;
+        case 0x200:
                host->caps.has_rwproof = 1;
+        case 0x100:
                break;
        default:
+                host->caps.has_pdc = 0;
                dev_warn(&host->pdev->dev,
                                "Unmanaged mci version, set minimum capabilities\n");
                break;
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 47adb161d3ad..5c2b1c10af9c 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1785,7 +1785,7 @@ static inline struct omap_mmc_platform_data
 }
 #endif
-static int __init omap_hsmmc_probe(struct platform_device *pdev)
+static int __devinit omap_hsmmc_probe(struct platform_device *pdev)
 {
        struct omap_mmc_platform_data *pdata = pdev->dev.platform_data;
        struct mmc_host *mmc;
@@ -1818,8 +1818,6 @@ static int __init omap_hsmmc_probe(struct platform_device *pdev)
        if (res == NULL || irq < 0)
                return -ENXIO;
-        res->start += pdata->reg_offset;
-        res->end += pdata->reg_offset;
        res = request_mem_region(res->start, resource_size(res), pdev->name);
        if (res == NULL)
                return -EBUSY;
@@ -1843,7 +1841,7 @@ static int __init omap_hsmmc_probe(struct platform_device *pdev)
        host->dma_ch    = -1;
        host->irq       = irq;
        host->slot_id   = 0;
-        host->mapbase   = res->start;
+        host->mapbase   = res->start + pdata->reg_offset;
        host->base      = ioremap(host->mapbase, SZ_4K);
        host->power_mode = MMC_POWER_OFF;
        host->next_data.cookie = 1;
@@ -1875,8 +1873,6 @@ static int __init omap_hsmmc_probe(struct platform_device *pdev)
                goto err1;
        }
-        omap_hsmmc_context_save(host);
        if (host->pdata->controller_flags & OMAP_HSMMC_BROKEN_MULTIBLOCK_READ) {
                dev_info(&pdev->dev, "multiblock reads disabled due to 35xx erratum 2.1.1.128; MMC read performance may suffer\n");
                mmc->caps2 |= MMC_CAP2_NO_MULTI_READ;
@@ -1887,6 +1883,8 @@ static int __init omap_hsmmc_probe(struct platform_device *pdev)
        pm_runtime_set_autosuspend_delay(host->dev, MMC_AUTOSUSPEND_DELAY);
        pm_runtime_use_autosuspend(host->dev);
+        omap_hsmmc_context_save(host);
        if (cpu_is_omap2430()) {
                host->dbclk = clk_get(&pdev->dev, "mmchsdb_fck");
                /*
@@ -2018,8 +2016,7 @@ err_reg:
 err_irq_cd_init:
        free_irq(host->irq, host);
 err_irq:
-        pm_runtime_mark_last_busy(host->dev);
+        pm_runtime_put_sync(host->dev);
-        pm_runtime_put_autosuspend(host->dev);
        pm_runtime_disable(host->dev);
        clk_put(host->fclk);
        if (host->got_dbclk) {
@@ -2037,35 +2034,33 @@ err:
        return ret;
 }
-static int omap_hsmmc_remove(struct platform_device *pdev)
+static int __devexit omap_hsmmc_remove(struct platform_device *pdev)
 {
        struct omap_hsmmc_host *host = platform_get_drvdata(pdev);
        struct resource *res;
-        if (host) {
+        pm_runtime_get_sync(host->dev);
-                pm_runtime_get_sync(host->dev);
+        mmc_remove_host(host->mmc);
-                mmc_remove_host(host->mmc);
+        if (host->use_reg)
-                if (host->use_reg)
+                omap_hsmmc_reg_put(host);
-                        omap_hsmmc_reg_put(host);
+        if (host->pdata->cleanup)
-                if (host->pdata->cleanup)
+                host->pdata->cleanup(&pdev->dev);
-                        host->pdata->cleanup(&pdev->dev);
+        free_irq(host->irq, host);
-                free_irq(host->irq, host);
+        if (mmc_slot(host).card_detect_irq)
-                if (mmc_slot(host).card_detect_irq)
+                free_irq(mmc_slot(host).card_detect_irq, host);
-                        free_irq(mmc_slot(host).card_detect_irq, host);
-                pm_runtime_put_sync(host->dev);
-                pm_runtime_disable(host->dev);
-                clk_put(host->fclk);
-                if (host->got_dbclk) {
-                        clk_disable(host->dbclk);
-                        clk_put(host->dbclk);
-                }
-                mmc_free_host(host->mmc);
+        pm_runtime_put_sync(host->dev);
-                iounmap(host->base);
+        pm_runtime_disable(host->dev);
-                omap_hsmmc_gpio_free(pdev->dev.platform_data);
+        clk_put(host->fclk);
+        if (host->got_dbclk) {
+                clk_disable(host->dbclk);
+                clk_put(host->dbclk);
        }
+        mmc_free_host(host->mmc);
+        iounmap(host->base);
+        omap_hsmmc_gpio_free(pdev->dev.platform_data);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (res)
                release_mem_region(res->start, resource_size(res));
@@ -2078,49 +2073,45 @@ static int omap_hsmmc_remove(struct platform_device *pdev)
 static int omap_hsmmc_suspend(struct device *dev)
 {
        int ret = 0;
-        struct platform_device *pdev = to_platform_device(dev);
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
-        struct omap_hsmmc_host *host = platform_get_drvdata(pdev);
-        if (host && host->suspended)
+        if (!host)
                return 0;
-        if (host) {
+        if (host && host->suspended)
-                pm_runtime_get_sync(host->dev);
+                return 0;
-                host->suspended = 1;
-                if (host->pdata->suspend) {
-                        ret = host->pdata->suspend(&pdev->dev,
-                                                        host->slot_id);
-                        if (ret) {
-                                dev_dbg(mmc_dev(host->mmc),
-                                        "Unable to handle MMC board"
-                                        " level suspend\n");
-                                host->suspended = 0;
-                                return ret;
-                        }
-                }
-                ret = mmc_suspend_host(host->mmc);
+        pm_runtime_get_sync(host->dev);
+        host->suspended = 1;
+        if (host->pdata->suspend) {
+                ret = host->pdata->suspend(dev, host->slot_id);
                if (ret) {
+                        dev_dbg(dev, "Unable to handle MMC board"
+                                        " level suspend\n");
                        host->suspended = 0;
-                        if (host->pdata->resume) {
+                        return ret;
-                                ret = host->pdata->resume(&pdev->dev,
-                                                          host->slot_id);
-                                if (ret)
-                                        dev_dbg(mmc_dev(host->mmc),
-                                                "Unmask interrupt failed\n");
-                        }
-                        goto err;
                }
+        }
+        ret = mmc_suspend_host(host->mmc);
-                if (!(host->mmc->pm_flags & MMC_PM_KEEP_POWER)) {
+        if (ret) {
-                        omap_hsmmc_disable_irq(host);
+                host->suspended = 0;
-                        OMAP_HSMMC_WRITE(host->base, HCTL,
+                if (host->pdata->resume) {
-                                OMAP_HSMMC_READ(host->base, HCTL) & ~SDBP);
+                        ret = host->pdata->resume(dev, host->slot_id);
+                        if (ret)
+                                dev_dbg(dev, "Unmask interrupt failed\n");
                }
-                if (host->got_dbclk)
+                goto err;
-                        clk_disable(host->dbclk);
+        }
+        if (!(host->mmc->pm_flags & MMC_PM_KEEP_POWER)) {
+                omap_hsmmc_disable_irq(host);
+                OMAP_HSMMC_WRITE(host->base, HCTL,
+                                OMAP_HSMMC_READ(host->base, HCTL) & ~SDBP);
        }
+        if (host->got_dbclk)
+                clk_disable(host->dbclk);
 err:
        pm_runtime_put_sync(host->dev);
        return ret;
@@ -2130,38 +2121,37 @@ err:
 static int omap_hsmmc_resume(struct device *dev)
 {
        int ret = 0;
-        struct platform_device *pdev = to_platform_device(dev);
+        struct omap_hsmmc_host *host = dev_get_drvdata(dev);
-        struct omap_hsmmc_host *host = platform_get_drvdata(pdev);
+        if (!host)
+                return 0;
        if (host && !host->suspended)
                return 0;
-        if (host) {
+        pm_runtime_get_sync(host->dev);
-                pm_runtime_get_sync(host->dev);
-                if (host->got_dbclk)
+        if (host->got_dbclk)
-                        clk_enable(host->dbclk);
+                clk_enable(host->dbclk);
-                if (!(host->mmc->pm_flags & MMC_PM_KEEP_POWER))
+        if (!(host->mmc->pm_flags & MMC_PM_KEEP_POWER))
-                        omap_hsmmc_conf_bus_power(host);
+                omap_hsmmc_conf_bus_power(host);
-                if (host->pdata->resume) {
+        if (host->pdata->resume) {
-                        ret = host->pdata->resume(&pdev->dev, host->slot_id);
+                ret = host->pdata->resume(dev, host->slot_id);
-                        if (ret)
+                if (ret)
-                                dev_dbg(mmc_dev(host->mmc),
+                        dev_dbg(dev, "Unmask interrupt failed\n");
-                                        "Unmask interrupt failed\n");
+        }
-                }
-                omap_hsmmc_protect_card(host);
+        omap_hsmmc_protect_card(host);
-                /* Notify the core to resume the host */
+        /* Notify the core to resume the host */
-                ret = mmc_resume_host(host->mmc);
+        ret = mmc_resume_host(host->mmc);
-                if (ret == 0)
+        if (ret == 0)
-                        host->suspended = 0;
+                host->suspended = 0;
-                pm_runtime_mark_last_busy(host->dev);
+        pm_runtime_mark_last_busy(host->dev);
-                pm_runtime_put_autosuspend(host->dev);
+        pm_runtime_put_autosuspend(host->dev);
-        }
        return ret;
@@ -2178,7 +2168,7 @@ static int omap_hsmmc_runtime_suspend(struct device *dev)
        host = platform_get_drvdata(to_platform_device(dev));
        omap_hsmmc_context_save(host);
-        dev_dbg(mmc_dev(host->mmc), "disabled\n");
+        dev_dbg(dev, "disabled\n");
        return 0;
 }
@@ -2189,7 +2179,7 @@ static int omap_hsmmc_runtime_resume(struct device *dev)
        host = platform_get_drvdata(to_platform_device(dev));
        omap_hsmmc_context_restore(host);
-        dev_dbg(mmc_dev(host->mmc), "enabled\n");
+        dev_dbg(dev, "enabled\n");
        return 0;
 }
@@ -2202,7 +2192,8 @@ static struct dev_pm_ops omap_hsmmc_dev_pm_ops = {
 };
 static struct platform_driver omap_hsmmc_driver = {
-        .remove         = omap_hsmmc_remove,
+        .probe          = omap_hsmmc_probe,
+        .remove         = __devexit_p(omap_hsmmc_remove),
        .driver         = {
                .name = DRIVER_NAME,
                .owner = THIS_MODULE,
@@ -2211,21 +2202,7 @@ static struct platform_driver omap_hsmmc_driver = {
        },
 };
-static int __init omap_hsmmc_init(void)
+module_platform_driver(omap_hsmmc_driver);
-{
-        /* Register the MMC driver */
-        return platform_driver_probe(&omap_hsmmc_driver, omap_hsmmc_probe);
-}
-static void __exit omap_hsmmc_cleanup(void)
-{
-        /* Unregister MMC driver */
-        platform_driver_unregister(&omap_hsmmc_driver);
-}
-module_init(omap_hsmmc_init);
-module_exit(omap_hsmmc_cleanup);
 MODULE_DESCRIPTION("OMAP High Speed Multimedia Card driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" DRIVER_NAME);
diff --git a/drivers/mmc/host/sdhci-dove.c b/drivers/mmc/host/sdhci-dove.c
index 46fd1fd1b605..177f697b5835 100644
--- a/drivers/mmc/host/sdhci-dove.c
+++ b/drivers/mmc/host/sdhci-dove.c
@@ -20,6 +20,7 @@
 */
 #include <linux/io.h>
+#include <linux/module.h>
 #include <linux/mmc/host.h>
 #include "sdhci-pltfm.h"
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index fbbebe251e01..69ef0beae104 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -1418,8 +1418,6 @@ static int __devinit sdhci_pci_probe(struct pci_dev *pdev,
        slots = chip->num_slots;        /* Quirk may have changed this */
-        pci_enable_msi(pdev);
        for (i = 0; i < slots; i++) {
                slot = sdhci_pci_probe_slot(pdev, chip, first_bar, i);
                if (IS_ERR(slot)) {
@@ -1438,8 +1436,6 @@ static int __devinit sdhci_pci_probe(struct pci_dev *pdev,
        return 0;
 free:
-        pci_disable_msi(pdev);
        pci_set_drvdata(pdev, NULL);
        kfree(chip);
@@ -1462,8 +1458,6 @@ static void __devexit sdhci_pci_remove(struct pci_dev *pdev)
                for (i = 0; i < chip->num_slots; i++)
                        sdhci_pci_remove_slot(chip->slots[i]);
-                pci_disable_msi(pdev);
                pci_set_drvdata(pdev, NULL);
                kfree(chip);
        }
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index b19e7d435f8d..55a164fcaa15 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -20,6 +20,10 @@
 #include <linux/io.h>
 #include <linux/gpio.h>
 #include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/pm.h>
+#include <linux/pm_runtime.h>
 #include <linux/mmc/host.h>
@@ -53,6 +57,18 @@ struct sdhci_s3c {
        struct clk              *clk_bus[MAX_BUS_CLK];
 };
+/**
+ * struct sdhci_s3c_driver_data - S3C SDHCI platform specific driver data
+ * @sdhci_quirks: sdhci host specific quirks.
+ *
+ * Specifies platform specific configuration of sdhci controller.
+ * Note: A structure for driver specific platform data is used for future
+ * expansion of its usage.
+ */
+struct sdhci_s3c_drv_data {
+        unsigned int    sdhci_quirks;
+};
 static inline struct sdhci_s3c *to_s3c(struct sdhci_host *host)
 {
        return sdhci_priv(host);
@@ -132,10 +148,10 @@ static unsigned int sdhci_s3c_consider_clock(struct sdhci_s3c *ourhost,
                return UINT_MAX;
        /*
-         * Clock divider's step is different as 1 from that of host controller
+         * If controller uses a non-standard clock division, find the best clock
-         * when 'clk_type' is S3C_SDHCI_CLK_DIV_EXTERNAL.
+         * speed possible with selected clock source and skip the division.
         */
-        if (ourhost->pdata->clk_type) {
+        if (ourhost->host->quirks & SDHCI_QUIRK_NONSTANDARD_CLOCK) {
                rate = clk_round_rate(clksrc, wanted);
                return wanted - rate;
        }
@@ -272,6 +288,8 @@ static unsigned int sdhci_cmu_get_min_clock(struct sdhci_host *host)
 static void sdhci_cmu_set_clock(struct sdhci_host *host, unsigned int clock)
 {
        struct sdhci_s3c *ourhost = to_s3c(host);
+        unsigned long timeout;
+        u16 clk = 0;
        /* don't bother if the clock is going off */
        if (clock == 0)
@@ -282,6 +300,25 @@ static void sdhci_cmu_set_clock(struct sdhci_host *host, unsigned int clock)
        clk_set_rate(ourhost->clk_bus[ourhost->cur_clk], clock);
        host->clock = clock;
+        clk = SDHCI_CLOCK_INT_EN;
+        sdhci_writew(host, clk, SDHCI_CLOCK_CONTROL);
+        /* Wait max 20 ms */
+        timeout = 20;
+        while (!((clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL))
+                & SDHCI_CLOCK_INT_STABLE)) {
+                if (timeout == 0) {
+                        printk(KERN_ERR "%s: Internal clock never "
+                                "stabilised.\n", mmc_hostname(host->mmc));
+                        return;
+                }
+                timeout--;
+                mdelay(1);
+        }
+        clk |= SDHCI_CLOCK_CARD_EN;
+        sdhci_writew(host, clk, SDHCI_CLOCK_CONTROL);
 }
 /**
@@ -382,16 +419,24 @@ static void sdhci_s3c_setup_card_detect_gpio(struct sdhci_s3c *sc)
        }
 }
+static inline struct sdhci_s3c_drv_data *sdhci_s3c_get_driver_data(
+                        struct platform_device *pdev)
+{
+        return (struct sdhci_s3c_drv_data *)
+                        platform_get_device_id(pdev)->driver_data;
+}
 static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
 {
-        struct s3c_sdhci_platdata *pdata = pdev->dev.platform_data;
+        struct s3c_sdhci_platdata *pdata;
+        struct sdhci_s3c_drv_data *drv_data;
        struct device *dev = &pdev->dev;
        struct sdhci_host *host;
        struct sdhci_s3c *sc;
        struct resource *res;
        int ret, irq, ptr, clks;
-        if (!pdata) {
+        if (!pdev->dev.platform_data) {
                dev_err(dev, "no device data specified\n");
                return -ENOENT;
        }
@@ -402,18 +447,20 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
                return irq;
        }
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(dev, "no memory specified\n");
-                return -ENOENT;
-        }
        host = sdhci_alloc_host(dev, sizeof(struct sdhci_s3c));
        if (IS_ERR(host)) {
                dev_err(dev, "sdhci_alloc_host() failed\n");
                return PTR_ERR(host);
        }
+        pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+        if (!pdata) {
+                ret = -ENOMEM;
+                goto err_io_clk;
+        }
+        memcpy(pdata, pdev->dev.platform_data, sizeof(*pdata));
+        drv_data = sdhci_s3c_get_driver_data(pdev);
        sc = sdhci_priv(host);
        sc->host = host;
@@ -464,15 +511,8 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
                goto err_no_busclks;
        }
-        sc->ioarea = request_mem_region(res->start, resource_size(res),
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-                                        mmc_hostname(host->mmc));
+        host->ioaddr = devm_request_and_ioremap(&pdev->dev, res);
-        if (!sc->ioarea) {
-                dev_err(dev, "failed to reserve register area\n");
-                ret = -ENXIO;
-                goto err_req_regs;
-        }
-        host->ioaddr = ioremap_nocache(res->start, resource_size(res));
        if (!host->ioaddr) {
                dev_err(dev, "failed to map registers\n");
                ret = -ENXIO;
@@ -491,6 +531,8 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        /* Setup quirks for the controller */
        host->quirks |= SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC;
        host->quirks |= SDHCI_QUIRK_NO_HISPD_BIT;
+        if (drv_data)
+                host->quirks |= drv_data->sdhci_quirks;
 #ifndef CONFIG_MMC_SDHCI_S3C_DMA
@@ -518,6 +560,14 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        if (pdata->cd_type == S3C_SDHCI_CD_PERMANENT)
                host->mmc->caps = MMC_CAP_NONREMOVABLE;
+        switch (pdata->max_width) {
+        case 8:
+                host->mmc->caps |= MMC_CAP_8_BIT_DATA;
+        case 4:
+                host->mmc->caps |= MMC_CAP_4_BIT_DATA;
+                break;
+        }
        if (pdata->pm_caps)
                host->mmc->pm_caps |= pdata->pm_caps;
@@ -531,7 +581,7 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
         * If controller does not have internal clock divider,
         * we can use overriding functions instead of default.
         */
-        if (pdata->clk_type) {
+        if (host->quirks & SDHCI_QUIRK_NONSTANDARD_CLOCK) {
                sdhci_s3c_ops.set_clock = sdhci_cmu_set_clock;
                sdhci_s3c_ops.get_min_clock = sdhci_cmu_get_min_clock;
                sdhci_s3c_ops.get_max_clock = sdhci_cmu_get_max_clock;
@@ -544,10 +594,17 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        if (pdata->host_caps2)
                host->mmc->caps2 |= pdata->host_caps2;
+        pm_runtime_enable(&pdev->dev);
+        pm_runtime_set_autosuspend_delay(&pdev->dev, 50);
+        pm_runtime_use_autosuspend(&pdev->dev);
+        pm_suspend_ignore_children(&pdev->dev, 1);
        ret = sdhci_add_host(host);
        if (ret) {
                dev_err(dev, "sdhci_add_host() failed\n");
-                goto err_add_host;
+                pm_runtime_forbid(&pdev->dev);
+                pm_runtime_get_noresume(&pdev->dev);
+                goto err_req_regs;
        }
        /* The following two methods of card detection might call
@@ -561,10 +618,6 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
        return 0;
- err_add_host:
-        release_resource(sc->ioarea);
-        kfree(sc->ioarea);
 err_req_regs:
        for (ptr = 0; ptr < MAX_BUS_CLK; ptr++) {
                if (sc->clk_bus[ptr]) {
@@ -601,6 +654,8 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
        sdhci_remove_host(host, 1);
+        pm_runtime_disable(&pdev->dev);
        for (ptr = 0; ptr < 3; ptr++) {
                if (sc->clk_bus[ptr]) {
                        clk_disable(sc->clk_bus[ptr]);
@@ -610,18 +665,13 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
        clk_disable(sc->clk_io);
        clk_put(sc->clk_io);
-        iounmap(host->ioaddr);
-        release_resource(sc->ioarea);
-        kfree(sc->ioarea);
        sdhci_free_host(host);
        platform_set_drvdata(pdev, NULL);
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int sdhci_s3c_suspend(struct device *dev)
 {
        struct sdhci_host *host = dev_get_drvdata(dev);
@@ -635,10 +685,29 @@ static int sdhci_s3c_resume(struct device *dev)
        return sdhci_resume_host(host);
 }
+#endif
+#ifdef CONFIG_PM_RUNTIME
+static int sdhci_s3c_runtime_suspend(struct device *dev)
+{
+        struct sdhci_host *host = dev_get_drvdata(dev);
+        return sdhci_runtime_suspend_host(host);
+}
+static int sdhci_s3c_runtime_resume(struct device *dev)
+{
+        struct sdhci_host *host = dev_get_drvdata(dev);
+        return sdhci_runtime_resume_host(host);
+}
+#endif
+#ifdef CONFIG_PM
 static const struct dev_pm_ops sdhci_s3c_pmops = {
-        .suspend        = sdhci_s3c_suspend,
+        SET_SYSTEM_SLEEP_PM_OPS(sdhci_s3c_suspend, sdhci_s3c_resume)
-        .resume         = sdhci_s3c_resume,
+        SET_RUNTIME_PM_OPS(sdhci_s3c_runtime_suspend, sdhci_s3c_runtime_resume,
+                           NULL)
 };
 #define SDHCI_S3C_PMOPS (&sdhci_s3c_pmops)
@@ -647,9 +716,31 @@ static const struct dev_pm_ops sdhci_s3c_pmops = {
 #define SDHCI_S3C_PMOPS NULL
 #endif
+#if defined(CONFIG_CPU_EXYNOS4210) || defined(CONFIG_SOC_EXYNOS4212)
+static struct sdhci_s3c_drv_data exynos4_sdhci_drv_data = {
+        .sdhci_quirks = SDHCI_QUIRK_NONSTANDARD_CLOCK,
+};
+#define EXYNOS4_SDHCI_DRV_DATA ((kernel_ulong_t)&exynos4_sdhci_drv_data)
+#else
+#define EXYNOS4_SDHCI_DRV_DATA ((kernel_ulong_t)NULL)
+#endif
+static struct platform_device_id sdhci_s3c_driver_ids[] = {
+        {
+                .name           = "s3c-sdhci",
+                .driver_data    = (kernel_ulong_t)NULL,
+        }, {
+                .name           = "exynos4-sdhci",
+                .driver_data    = EXYNOS4_SDHCI_DRV_DATA,
+        },
+        { }
+};
+MODULE_DEVICE_TABLE(platform, sdhci_s3c_driver_ids);
 static struct platform_driver sdhci_s3c_driver = {
        .probe          = sdhci_s3c_probe,
        .remove         = __devexit_p(sdhci_s3c_remove),
+        .id_table       = sdhci_s3c_driver_ids,
        .driver         = {
                .owner  = THIS_MODULE,
                .name   = "s3c-sdhci",
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 8262cadfdab7..9aa77f3f04a8 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2782,8 +2782,9 @@ int sdhci_add_host(struct sdhci_host *host)
            mmc_card_is_removable(mmc))
                mmc->caps |= MMC_CAP_NEEDS_POLL;
-        /* UHS-I mode(s) supported by the host controller. */
+        /* Any UHS-I mode in caps implies SDR12 and SDR25 support. */
-        if (host->version >= SDHCI_SPEC_300)
+        if (caps[1] & (SDHCI_SUPPORT_SDR104 | SDHCI_SUPPORT_SDR50 |
+                       SDHCI_SUPPORT_DDR50))
                mmc->caps |= MMC_CAP_UHS_SDR12 | MMC_CAP_UHS_SDR25;
        /* SDR104 supports also implies SDR50 support */
diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
index aafaf0b6eb1c..724b35e85a26 100644
--- a/drivers/mmc/host/sh_mmcif.c
+++ b/drivers/mmc/host/sh_mmcif.c
@@ -454,7 +454,8 @@ static void sh_mmcif_clock_control(struct sh_mmcif_host *host, unsigned int clk)
                sh_mmcif_bitset(host, MMCIF_CE_CLK_CTRL, CLK_SUP_PCLK);
        else
                sh_mmcif_bitset(host, MMCIF_CE_CLK_CTRL, CLK_CLEAR &
-                                ((fls(host->clk / clk) - 1) << 16));
+                                ((fls(DIV_ROUND_UP(host->clk,
+                                                   clk) - 1) - 1) << 16));
        sh_mmcif_bitset(host, MMCIF_CE_CLK_CTRL, CLK_ENABLE);
 }
@@ -1297,14 +1298,8 @@ static int __devinit sh_mmcif_probe(struct platform_device *pdev)
        spin_lock_init(&host->lock);
        mmc->ops = &sh_mmcif_ops;
-        mmc->f_max = host->clk;
+        mmc->f_max = host->clk / 2;
-        /* close to 400KHz */
+        mmc->f_min = host->clk / 512;
-        if (mmc->f_max < 51200000)
-                mmc->f_min = mmc->f_max / 128;
-        else if (mmc->f_max < 102400000)
-                mmc->f_min = mmc->f_max / 256;
-        else
-                mmc->f_min = mmc->f_max / 512;
        if (pd->ocr)
                mmc->ocr_avail = pd->ocr;
        mmc->caps = MMC_CAP_MMC_HIGHSPEED;
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 94eb05b1afdf..58fc65f5c817 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -106,16 +106,14 @@ static int mtdchar_open(struct inode *inode, struct file *file)
        }
        if (mtd->type == MTD_ABSENT) {
-                put_mtd_device(mtd);
                ret = -ENODEV;
-                goto out;
+                goto out1;
        }
        mtd_ino = iget_locked(mnt->mnt_sb, devnum);
        if (!mtd_ino) {
-                put_mtd_device(mtd);
                ret = -ENOMEM;
-                goto out;
+                goto out1;
        }
        if (mtd_ino->i_state & I_NEW) {
                mtd_ino->i_private = mtd;
@@ -127,23 +125,25 @@ static int mtdchar_open(struct inode *inode, struct file *file)
        /* You can't open it RW if it's not a writeable device */
        if ((file->f_mode & FMODE_WRITE) && !(mtd->flags & MTD_WRITEABLE)) {
-                iput(mtd_ino);
-                put_mtd_device(mtd);
                ret = -EACCES;
-                goto out;
+                goto out2;
        }
        mfi = kzalloc(sizeof(*mfi), GFP_KERNEL);
        if (!mfi) {
-                iput(mtd_ino);
-                put_mtd_device(mtd);
                ret = -ENOMEM;
-                goto out;
+                goto out2;
        }
        mfi->ino = mtd_ino;
        mfi->mtd = mtd;
        file->private_data = mfi;
+        mutex_unlock(&mtd_mutex);
+        return 0;
+out2:
+        iput(mtd_ino);
+out1:
+        put_mtd_device(mtd);
 out:
        mutex_unlock(&mtd_mutex);
        simple_release_fs(&mnt, &count);
diff --git a/drivers/net/ethernet/tile/tilepro.c b/drivers/net/ethernet/tile/tilepro.c
index 261356c2dc99..3d501ec7fad7 100644
--- a/drivers/net/ethernet/tile/tilepro.c
+++ b/drivers/net/ethernet/tile/tilepro.c
@@ -342,6 +342,21 @@ inline int __netio_fastio1(u32 fastio_index, u32 arg0)
 }
+static void tile_net_return_credit(struct tile_net_cpu *info)
+{
+        struct tile_netio_queue *queue = &info->queue;
+        netio_queue_user_impl_t *qup = &queue->__user_part;
+        /* Return four credits after every fourth packet. */
+        if (--qup->__receive_credit_remaining == 0) {
+                u32 interval = qup->__receive_credit_interval;
+                qup->__receive_credit_remaining = interval;
+                __netio_fastio_return_credits(qup->__fastio_index, interval);
+        }
+}
 /*
 * Provide a linux buffer to LIPP.
 */
@@ -433,7 +448,7 @@ static bool tile_net_provide_needed_buffer(struct tile_net_cpu *info,
        struct sk_buff **skb_ptr;
        /* Request 96 extra bytes for alignment purposes. */
-        skb = netdev_alloc_skb(info->napi->dev, len + padding);
+        skb = netdev_alloc_skb(info->napi.dev, len + padding);
        if (skb == NULL)
                return false;
@@ -864,19 +879,11 @@ static bool tile_net_poll_aux(struct tile_net_cpu *info, int index)
                stats->rx_packets++;
                stats->rx_bytes += len;
-                if (small)
-                        info->num_needed_small_buffers++;
-                else
-                        info->num_needed_large_buffers++;
        }
-        /* Return four credits after every fourth packet. */
+        /* ISSUE: It would be nice to defer this until the packet has */
-        if (--qup->__receive_credit_remaining == 0) {
+        /* actually been processed. */
-                u32 interval = qup->__receive_credit_interval;
+        tile_net_return_credit(info);
-                qup->__receive_credit_remaining = interval;
-                __netio_fastio_return_credits(qup->__fastio_index, interval);
-        }
        /* Consume this packet. */
        qup->__packet_receive_read = index2;
@@ -1543,7 +1550,7 @@ static int tile_net_drain_lipp_buffers(struct tile_net_priv *priv)
        /* Drain all the LIPP buffers. */
        while (true) {
-                int buffer;
+                unsigned int buffer;
                /* NOTE: This should never fail. */
                if (hv_dev_pread(priv->hv_devhdl, 0, (HV_VirtAddr)&buffer,
@@ -1707,7 +1714,7 @@ static unsigned int tile_net_tx_frags(lepp_frag_t *frags,
                if (!hash_default) {
                        void *va = pfn_to_kaddr(pfn) + f->page_offset;
                        BUG_ON(PageHighMem(skb_frag_page(f)));
-                        finv_buffer_remote(va, f->size, 0);
+                        finv_buffer_remote(va, skb_frag_size(f), 0);
                }
                cpa = ((phys_addr_t)pfn << PAGE_SHIFT) + f->page_offset;
@@ -1735,8 +1742,8 @@ static unsigned int tile_net_tx_frags(lepp_frag_t *frags,
 * Sometimes, if "sendfile()" requires copying, we will be called with
 * "data" containing the header and payload, with "frags" being empty.
 *
- * In theory, "sh->nr_frags" could be 3, but in practice, it seems
+ * Sometimes, for example when using NFS over TCP, a single segment can
- * that this will never actually happen.
+ * span 3 fragments, which must be handled carefully in LEPP.
 *
 * See "emulate_large_send_offload()" for some reference code, which
 * does not handle checksumming.
@@ -1844,10 +1851,8 @@ static int tile_net_tx_tso(struct sk_buff *skb, struct net_device *dev)
        spin_lock_irqsave(&priv->eq_lock, irqflags);
-        /*
+        /* Handle completions if needed to make room. */
-         * Handle completions if needed to make room.
+        /* NOTE: Return NETDEV_TX_BUSY if there is still no room. */
-         * HACK: Spin until there is sufficient room.
-         */
        if (lepp_num_free_comp_slots(eq) == 0) {
                nolds = tile_net_lepp_grab_comps(eq, olds, wanted, 0);
                if (nolds == 0) {
@@ -1861,6 +1866,7 @@ busy:
        cmd_tail = eq->cmd_tail;
        /* Prepare to advance, detecting full queue. */
+        /* NOTE: Return NETDEV_TX_BUSY if the queue is full. */
        cmd_next = cmd_tail + cmd_size;
        if (cmd_tail < cmd_head && cmd_next >= cmd_head)
                goto busy;
@@ -2023,10 +2029,8 @@ static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
        spin_lock_irqsave(&priv->eq_lock, irqflags);
-        /*
+        /* Handle completions if needed to make room. */
-         * Handle completions if needed to make room.
+        /* NOTE: Return NETDEV_TX_BUSY if there is still no room. */
-         * HACK: Spin until there is sufficient room.
-         */
        if (lepp_num_free_comp_slots(eq) == 0) {
                nolds = tile_net_lepp_grab_comps(eq, olds, wanted, 0);
                if (nolds == 0) {
@@ -2040,6 +2044,7 @@ busy:
        cmd_tail = eq->cmd_tail;
        /* Copy the commands, or fail. */
+        /* NOTE: Return NETDEV_TX_BUSY if the queue is full. */
        for (i = 0; i < num_frags; i++) {
                /* Prepare to advance, detecting full queue. */
@@ -2261,6 +2266,23 @@ static int tile_net_get_mac(struct net_device *dev)
        return 0;
 }
+#ifdef CONFIG_NET_POLL_CONTROLLER
+/*
+ * Polling 'interrupt' - used by things like netconsole to send skbs
+ * without having to re-enable interrupts. It's not called while
+ * the interrupt routine is executing.
+ */
+static void tile_net_netpoll(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        disable_percpu_irq(priv->intr_id);
+        tile_net_handle_ingress_interrupt(priv->intr_id, dev);
+        enable_percpu_irq(priv->intr_id, 0);
+}
+#endif
 static const struct net_device_ops tile_net_ops = {
        .ndo_open = tile_net_open,
        .ndo_stop = tile_net_stop,
@@ -2269,7 +2291,10 @@ static const struct net_device_ops tile_net_ops = {
        .ndo_get_stats = tile_net_get_stats,
        .ndo_change_mtu = tile_net_change_mtu,
        .ndo_tx_timeout = tile_net_tx_timeout,
-        .ndo_set_mac_address = tile_net_set_mac_address
+        .ndo_set_mac_address = tile_net_set_mac_address,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller = tile_net_netpoll,
+#endif
 };
@@ -2409,7 +2434,7 @@ static void tile_net_cleanup(void)
 */
 static int tile_net_init_module(void)
 {
-        pr_info("Tilera IPP Net Driver\n");
+        pr_info("Tilera Network Driver\n");
        tile_net_devs[0] = tile_net_dev_init("xgbe0");
        tile_net_devs[1] = tile_net_dev_init("xgbe1");
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 215eb2536b1e..2504ab005589 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -118,15 +118,13 @@ void ath9k_ps_restore(struct ath_softc *sc)
        if (--sc->ps_usecount != 0)
                goto unlock;
-        if (sc->ps_flags & PS_WAIT_FOR_TX_ACK)
+        if (sc->ps_idle && (sc->ps_flags & PS_WAIT_FOR_TX_ACK))
-                goto unlock;
-        if (sc->ps_idle)
                mode = ATH9K_PM_FULL_SLEEP;
        else if (sc->ps_enabled &&
                 !(sc->ps_flags & (PS_WAIT_FOR_BEACON |
                              PS_WAIT_FOR_CAB |
-                              PS_WAIT_FOR_PSPOLL_DATA)))
+                              PS_WAIT_FOR_PSPOLL_DATA |
+                              PS_WAIT_FOR_TX_ACK)))
                mode = ATH9K_PM_NETWORK_SLEEP;
        else
                goto unlock;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index fc9901e027c1..90cc5e772650 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1062,11 +1062,6 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
        set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
-        /*
-         * Register the extra components.
-         */
-        rt2x00rfkill_register(rt2x00dev);
        return 0;
 }
@@ -1210,6 +1205,7 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
        rt2x00link_register(rt2x00dev);
        rt2x00leds_register(rt2x00dev);
        rt2x00debug_register(rt2x00dev);
+        rt2x00rfkill_register(rt2x00dev);
        return 0;
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 510023554e5f..e54488db0e10 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -838,7 +838,10 @@ void rtl_get_tcb_desc(struct ieee80211_hw *hw,
        __le16 fc = hdr->frame_control;
        txrate = ieee80211_get_tx_rate(hw, info);
-        tcb_desc->hw_rate = txrate->hw_value;
+        if (txrate)
+                tcb_desc->hw_rate = txrate->hw_value;
+        else
+                tcb_desc->hw_rate = 0;
        if (ieee80211_is_data(fc)) {
                /*
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 07dd38efe62a..288b035a3579 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -912,8 +912,13 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
        memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
        ring = &rtlpci->tx_ring[BEACON_QUEUE];
        pskb = __skb_dequeue(&ring->queue);
-        if (pskb)
+        if (pskb) {
+                struct rtl_tx_desc *entry = &ring->desc[ring->idx];
+                pci_unmap_single(rtlpci->pdev, rtlpriv->cfg->ops->get_desc(
+                                 (u8 *) entry, true, HW_DESC_TXBUFF_ADDR),
+                                 pskb->len, PCI_DMA_TODEVICE);
                kfree_skb(pskb);
+        }
        /*NB: the beacon data buffer must be 32-bit aligned. */
        pskb = ieee80211_beacon_get(hw, mac->vif);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index 4898c502974d..480862c07f92 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -91,7 +91,6 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
        u8 tid;
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-        static int header_print;
        rtlpriv->dm.dm_initialgain_enable = true;
        rtlpriv->dm.dm_flag = 0;
@@ -171,10 +170,6 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
        for (tid = 0; tid < 8; tid++)
                skb_queue_head_init(&rtlpriv->mac80211.skb_waitq[tid]);
-        /* Only load firmware for first MAC */
-        if (header_print)
-                return 0;
        /* for firmware buf */
        rtlpriv->rtlhal.pfirmware = vzalloc(0x8000);
        if (!rtlpriv->rtlhal.pfirmware) {
@@ -186,7 +181,6 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
        rtlpriv->max_fw_size = 0x8000;
        pr_info("Driver for Realtek RTL8192DE WLAN interface\n");
        pr_info("Loading firmware file %s\n", rtlpriv->cfg->fw_name);
-        header_print++;
        /* request fw */
        err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 2e1e352864bb..d04dbda13f5a 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -124,46 +124,38 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
        return status;
 }
-static u32 _usb_read_sync(struct usb_device *udev, u32 addr, u16 len)
+static u32 _usb_read_sync(struct rtl_priv *rtlpriv, u32 addr, u16 len)
 {
+        struct device *dev = rtlpriv->io.dev;
+        struct usb_device *udev = to_usb_device(dev);
        u8 request;
        u16 wvalue;
        u16 index;
-        u32 *data;
+        __le32 *data = &rtlpriv->usb_data[rtlpriv->usb_data_index];
-        u32 ret;
-        data = kmalloc(sizeof(u32), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
        request = REALTEK_USB_VENQT_CMD_REQ;
        index = REALTEK_USB_VENQT_CMD_IDX; /* n/a */
        wvalue = (u16)addr;
        _usbctrl_vendorreq_sync_read(udev, request, wvalue, index, data, len);
-        ret = le32_to_cpu(*data);
+        if (++rtlpriv->usb_data_index >= RTL_USB_MAX_RX_COUNT)
-        kfree(data);
+                rtlpriv->usb_data_index = 0;
-        return ret;
+        return le32_to_cpu(*data);
 }
 static u8 _usb_read8_sync(struct rtl_priv *rtlpriv, u32 addr)
 {
-        struct device *dev = rtlpriv->io.dev;
+        return (u8)_usb_read_sync(rtlpriv, addr, 1);
-        return (u8)_usb_read_sync(to_usb_device(dev), addr, 1);
 }
 static u16 _usb_read16_sync(struct rtl_priv *rtlpriv, u32 addr)
 {
-        struct device *dev = rtlpriv->io.dev;
+        return (u16)_usb_read_sync(rtlpriv, addr, 2);
-        return (u16)_usb_read_sync(to_usb_device(dev), addr, 2);
 }
 static u32 _usb_read32_sync(struct rtl_priv *rtlpriv, u32 addr)
 {
-        struct device *dev = rtlpriv->io.dev;
+        return _usb_read_sync(rtlpriv, addr, 4);
-        return _usb_read_sync(to_usb_device(dev), addr, 4);
 }
 static void _usb_write_async(struct usb_device *udev, u32 addr, u32 val,
@@ -955,6 +947,11 @@ int __devinit rtl_usb_probe(struct usb_interface *intf,
                return -ENOMEM;
        }
        rtlpriv = hw->priv;
+        rtlpriv->usb_data = kzalloc(RTL_USB_MAX_RX_COUNT * sizeof(u32),
+                                    GFP_KERNEL);
+        if (!rtlpriv->usb_data)
+                return -ENOMEM;
+        rtlpriv->usb_data_index = 0;
        init_completion(&rtlpriv->firmware_loading_complete);
        SET_IEEE80211_DEV(hw, &intf->dev);
        udev = interface_to_usbdev(intf);
@@ -1025,6 +1022,7 @@ void rtl_usb_disconnect(struct usb_interface *intf)
        /* rtl_deinit_rfkill(hw); */
        rtl_usb_deinit(hw);
        rtl_deinit_core(hw);
+        kfree(rtlpriv->usb_data);
        rtlpriv->cfg->ops->deinit_sw_leds(hw);
        rtlpriv->cfg->ops->deinit_sw_vars(hw);
        _rtl_usb_io_handler_release(hw);
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index b591614c3b9b..28ebc69218a3 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -67,7 +67,7 @@
 #define QOS_QUEUE_NUM                           4
 #define RTL_MAC80211_NUM_QUEUE                  5
 #define REALTEK_USB_VENQT_MAX_BUF_SIZE          254
+#define RTL_USB_MAX_RX_COUNT                    100
 #define QBSS_LOAD_SIZE                          5
 #define MAX_WMMELE_LENGTH                       64
@@ -1629,6 +1629,10 @@ struct rtl_priv {
           interface or hardware */
        unsigned long status;
+        /* data buffer pointer for USB reads */
+        __le32 *usb_data;
+        int usb_data_index;
        /*This must be the last item so
           that it points to the data allocated
           beyond  this structure like:
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 663b32c2e931..0ebbb1906c30 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1965,7 +1965,7 @@ static int __init netif_init(void)
        if (xen_initial_domain())
                return 0;
-        if (!xen_platform_pci_unplug)
+        if (xen_hvm_domain() && !xen_platform_pci_unplug)
                return -ENODEV;
        printk(KERN_INFO "Initialising Xen virtual ethernet driver.\n");
diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
index fd00ff02ab4d..d6cc62cb4cf7 100644
--- a/drivers/pci/xen-pcifront.c
+++ b/drivers/pci/xen-pcifront.c
@@ -290,6 +290,7 @@ static int pci_frontend_enable_msix(struct pci_dev *dev,
                } else {
                        printk(KERN_DEBUG "enable msix get value %x\n",
                                op.value);
+                        err = op.value;
                }
        } else {
                dev_err(&dev->dev, "enable msix get err %x\n", err);
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index 53969af17558..81fd606e47bc 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -214,7 +214,7 @@ static struct of_device_id __devinitdata of_anatop_regulator_match_tbl[] = {
        { /* end */ }
 };
-static struct platform_driver anatop_regulator = {
+static struct platform_driver anatop_regulator_driver = {
        .driver = {
                .name   = "anatop_regulator",
                .owner  = THIS_MODULE,
@@ -226,13 +226,13 @@ static struct platform_driver anatop_regulator = {
 static int __init anatop_regulator_init(void)
 {
-        return platform_driver_register(&anatop_regulator);
+        return platform_driver_register(&anatop_regulator_driver);
 }
 postcore_initcall(anatop_regulator_init);
 static void __exit anatop_regulator_exit(void)
 {
-        platform_driver_unregister(&anatop_regulator);
+        platform_driver_unregister(&anatop_regulator_driver);
 }
 module_exit(anatop_regulator_exit);
diff --git a/drivers/rtc/rtc-efi.c b/drivers/rtc/rtc-efi.c
index 550292304b0f..c9f890b088da 100644
--- a/drivers/rtc/rtc-efi.c
+++ b/drivers/rtc/rtc-efi.c
@@ -213,7 +213,6 @@ static struct platform_driver efi_rtc_driver = {
                .name = "rtc-efi",
                .owner = THIS_MODULE,
        },
-        .probe = efi_rtc_probe,
        .remove = __exit_p(efi_rtc_remove),
 };
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index 692de7360e94..684ef4bbfce4 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -339,8 +339,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
        dev_dbg(&adev->dev, "revision = 0x%01x\n", ldata->hw_revision);
        /* Enable the clockwatch on ST Variants */
-        if ((ldata->hw_designer == AMBA_VENDOR_ST) &&
+        if (ldata->hw_designer == AMBA_VENDOR_ST)
-            (ldata->hw_revision > 1))
                writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
                       ldata->base + RTC_CR);
diff --git a/drivers/rtc/rtc-r9701.c b/drivers/rtc/rtc-r9701.c
index 7f8e6c247935..33b6ba0afa0d 100644
--- a/drivers/rtc/rtc-r9701.c
+++ b/drivers/rtc/rtc-r9701.c
@@ -122,6 +122,7 @@ static const struct rtc_class_ops r9701_rtc_ops = {
 static int __devinit r9701_probe(struct spi_device *spi)
 {
        struct rtc_device *rtc;
+        struct rtc_time dt;
        unsigned char tmp;
        int res;
@@ -132,6 +133,27 @@ static int __devinit r9701_probe(struct spi_device *spi)
                return -ENODEV;
        }
+        /*
+         * The device seems to be present. Now check if the registers
+         * contain invalid values. If so, try to write a default date:
+         * 2000/1/1 00:00:00
+         */
+        r9701_get_datetime(&spi->dev, &dt);
+        if (rtc_valid_tm(&dt)) {
+                dev_info(&spi->dev, "trying to repair invalid date/time\n");
+                dt.tm_sec  = 0;
+                dt.tm_min  = 0;
+                dt.tm_hour = 0;
+                dt.tm_mday = 1;
+                dt.tm_mon  = 0;
+                dt.tm_year = 100;
+                if (r9701_set_datetime(&spi->dev, &dt)) {
+                        dev_err(&spi->dev, "cannot repair RTC register\n");
+                        return -ENODEV;
+                }
+        }
        rtc = rtc_device_register("r9701",
                                &spi->dev, &r9701_rtc_ops, THIS_MODULE);
        if (IS_ERR(rtc))
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 9ccea134a996..3f3a29752369 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -40,6 +40,10 @@ enum s3c_cpu_type {
        TYPE_S3C64XX,
 };
+struct s3c_rtc_drv_data {
+        int cpu_type;
+};
 /* I have yet to find an S3C implementation with more than one
 * of these rtc blocks in */
@@ -446,10 +450,12 @@ static const struct of_device_id s3c_rtc_dt_match[];
 static inline int s3c_rtc_get_driver_data(struct platform_device *pdev)
 {
 #ifdef CONFIG_OF
+        struct s3c_rtc_drv_data *data;
        if (pdev->dev.of_node) {
                const struct of_device_id *match;
                match = of_match_node(s3c_rtc_dt_match, pdev->dev.of_node);
-                return match->data;
+                data = (struct s3c_rtc_drv_data *) match->data;
+                return data->cpu_type;
        }
 #endif
        return platform_get_device_id(pdev)->driver_data;
@@ -664,20 +670,27 @@ static int s3c_rtc_resume(struct platform_device *pdev)
 #define s3c_rtc_resume  NULL
 #endif
+static struct s3c_rtc_drv_data s3c_rtc_drv_data_array[] = {
+        [TYPE_S3C2410] = { TYPE_S3C2410 },
+        [TYPE_S3C2416] = { TYPE_S3C2416 },
+        [TYPE_S3C2443] = { TYPE_S3C2443 },
+        [TYPE_S3C64XX] = { TYPE_S3C64XX },
+};
 #ifdef CONFIG_OF
 static const struct of_device_id s3c_rtc_dt_match[] = {
        {
-                .compatible = "samsung,s3c2410-rtc"
+                .compatible = "samsung,s3c2410-rtc",
-                .data = TYPE_S3C2410,
+                .data = &s3c_rtc_drv_data_array[TYPE_S3C2410],
        }, {
-                .compatible = "samsung,s3c2416-rtc"
+                .compatible = "samsung,s3c2416-rtc",
-                .data = TYPE_S3C2416,
+                .data = &s3c_rtc_drv_data_array[TYPE_S3C2416],
        }, {
-                .compatible = "samsung,s3c2443-rtc"
+                .compatible = "samsung,s3c2443-rtc",
-                .data = TYPE_S3C2443,
+                .data = &s3c_rtc_drv_data_array[TYPE_S3C2443],
        }, {
-                .compatible = "samsung,s3c6410-rtc"
+                .compatible = "samsung,s3c6410-rtc",
-                .data = TYPE_S3C64XX,
+                .data = &s3c_rtc_drv_data_array[TYPE_S3C64XX],
        },
        {},
 };
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 4c2c6df2a9ef..258abeabf624 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -112,6 +112,7 @@ static const u8 twl6030_rtc_reg_map[] = {
 #define BIT_RTC_CTRL_REG_TEST_MODE_M             0x10
 #define BIT_RTC_CTRL_REG_SET_32_COUNTER_M        0x20
 #define BIT_RTC_CTRL_REG_GET_TIME_M              0x40
+#define BIT_RTC_CTRL_REG_RTC_V_OPT               0x80
 /* RTC_STATUS_REG bitfields */
 #define BIT_RTC_STATUS_REG_RUN_M                 0x02
@@ -235,25 +236,57 @@ static int twl_rtc_read_time(struct device *dev, struct rtc_time *tm)
        unsigned char rtc_data[ALL_TIME_REGS + 1];
        int ret;
        u8 save_control;
+        u8 rtc_control;
        ret = twl_rtc_read_u8(&save_control, REG_RTC_CTRL_REG);
-        if (ret < 0)
+        if (ret < 0) {
+                dev_err(dev, "%s: reading CTRL_REG, error %d\n", __func__, ret);
                return ret;
+        }
+        /* for twl6030/32 make sure BIT_RTC_CTRL_REG_GET_TIME_M is clear */
+        if (twl_class_is_6030()) {
+                if (save_control & BIT_RTC_CTRL_REG_GET_TIME_M) {
+                        save_control &= ~BIT_RTC_CTRL_REG_GET_TIME_M;
+                        ret = twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
+                        if (ret < 0) {
+                                dev_err(dev, "%s clr GET_TIME, error %d\n",
+                                        __func__, ret);
+                                return ret;
+                        }
+                }
+        }
-        save_control |= BIT_RTC_CTRL_REG_GET_TIME_M;
+        /* Copy RTC counting registers to static registers or latches */
+        rtc_control = save_control | BIT_RTC_CTRL_REG_GET_TIME_M;
-        ret = twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
+        /* for twl6030/32 enable read access to static shadowed registers */
-        if (ret < 0)
+        if (twl_class_is_6030())
+                rtc_control |= BIT_RTC_CTRL_REG_RTC_V_OPT;
+        ret = twl_rtc_write_u8(rtc_control, REG_RTC_CTRL_REG);
+        if (ret < 0) {
+                dev_err(dev, "%s: writing CTRL_REG, error %d\n", __func__, ret);
                return ret;
+        }
        ret = twl_i2c_read(TWL_MODULE_RTC, rtc_data,
                        (rtc_reg_map[REG_SECONDS_REG]), ALL_TIME_REGS);
        if (ret < 0) {
-                dev_err(dev, "rtc_read_time error %d\n", ret);
+                dev_err(dev, "%s: reading data, error %d\n", __func__, ret);
                return ret;
        }
+        /* for twl6030 restore original state of rtc control register */
+        if (twl_class_is_6030()) {
+                ret = twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
+                if (ret < 0) {
+                        dev_err(dev, "%s: restore CTRL_REG, error %d\n",
+                                __func__, ret);
+                        return ret;
+                }
+        }
        tm->tm_sec = bcd2bin(rtc_data[0]);
        tm->tm_min = bcd2bin(rtc_data[1]);
        tm->tm_hour = bcd2bin(rtc_data[2]);
diff --git a/drivers/staging/android/lowmemorykiller.c b/drivers/staging/android/lowmemorykiller.c
index 052b43e4e505..b91e4bc332a7 100644
--- a/drivers/staging/android/lowmemorykiller.c
+++ b/drivers/staging/android/lowmemorykiller.c
@@ -55,7 +55,6 @@ static int lowmem_minfree[6] = {
 };
 static int lowmem_minfree_size = 4;
-static struct task_struct *lowmem_deathpending;
 static unsigned long lowmem_deathpending_timeout;
 #define lowmem_print(level, x...)                       \
@@ -64,24 +63,6 @@ static unsigned long lowmem_deathpending_timeout;
                        printk(x);                      \
        } while (0)
-static int
-task_notify_func(struct notifier_block *self, unsigned long val, void *data);
-static struct notifier_block task_nb = {
-        .notifier_call  = task_notify_func,
-};
-static int
-task_notify_func(struct notifier_block *self, unsigned long val, void *data)
-{
-        struct task_struct *task = data;
-        if (task == lowmem_deathpending)
-                lowmem_deathpending = NULL;
-        return NOTIFY_OK;
-}
 static int lowmem_shrink(struct shrinker *s, struct shrink_control *sc)
 {
        struct task_struct *tsk;
@@ -97,19 +78,6 @@ static int lowmem_shrink(struct shrinker *s, struct shrink_control *sc)
        int other_file = global_page_state(NR_FILE_PAGES) -
                                                global_page_state(NR_SHMEM);
-        /*
-         * If we already have a death outstanding, then
-         * bail out right away; indicating to vmscan
-         * that we have nothing further to offer on
-         * this pass.
-         *
-         * Note: Currently you need CONFIG_PROFILING
-         * for this to work correctly.
-         */
-        if (lowmem_deathpending &&
-            time_before_eq(jiffies, lowmem_deathpending_timeout))
-                return 0;
        if (lowmem_adj_size < array_size)
                array_size = lowmem_adj_size;
        if (lowmem_minfree_size < array_size)
@@ -148,6 +116,12 @@ static int lowmem_shrink(struct shrinker *s, struct shrink_control *sc)
                if (!p)
                        continue;
+                if (test_tsk_thread_flag(p, TIF_MEMDIE) &&
+                    time_before_eq(jiffies, lowmem_deathpending_timeout)) {
+                        task_unlock(p);
+                        rcu_read_unlock();
+                        return 0;
+                }
                oom_score_adj = p->signal->oom_score_adj;
                if (oom_score_adj < min_score_adj) {
                        task_unlock(p);
@@ -174,15 +148,9 @@ static int lowmem_shrink(struct shrinker *s, struct shrink_control *sc)
                lowmem_print(1, "send sigkill to %d (%s), adj %d, size %d\n",
                             selected->pid, selected->comm,
                             selected_oom_score_adj, selected_tasksize);
-                /*
-                 * If CONFIG_PROFILING is off, then we don't want to stall
-                 * the killer by setting lowmem_deathpending.
-                 */
-#ifdef CONFIG_PROFILING
-                lowmem_deathpending = selected;
                lowmem_deathpending_timeout = jiffies + HZ;
-#endif
                send_sig(SIGKILL, selected, 0);
+                set_tsk_thread_flag(selected, TIF_MEMDIE);
                rem -= selected_tasksize;
        }
        lowmem_print(4, "lowmem_shrink %lu, %x, return %d\n",
@@ -198,7 +166,6 @@ static struct shrinker lowmem_shrinker = {
 static int __init lowmem_init(void)
 {
-        task_handoff_register(&task_nb);
        register_shrinker(&lowmem_shrinker);
        return 0;
 }
@@ -206,7 +173,6 @@ static int __init lowmem_init(void)
 static void __exit lowmem_exit(void)
 {
        unregister_shrinker(&lowmem_shrinker);
-        task_handoff_unregister(&task_nb);
 }
 module_param_named(cost, lowmem_shrinker.seeks, int, S_IRUGO | S_IWUSR);
diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index 830657908db8..c5eb3c33c3db 100644
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -122,6 +122,7 @@ struct ft_cmd {
        /* Local sense buffer */
        unsigned char ft_sense_buffer[TRANSPORT_SENSE_BUFFER];
        u32 was_ddp_setup:1;            /* Set only if ddp is setup */
+        u32 aborted:1;                  /* Set if aborted by reset or timeout */
        struct scatterlist *sg;         /* Set only if DDP is setup */
        u32 sg_cnt;                     /* No. of item in scatterlist */
 };
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 62dec9715ce5..a375f257aabc 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -121,6 +121,8 @@ int ft_queue_status(struct se_cmd *se_cmd)
        struct fc_exch *ep;
        size_t len;
+        if (cmd->aborted)
+                return 0;
        ft_dump_cmd(cmd, __func__);
        ep = fc_seq_exch(cmd->seq);
        lport = ep->lp;
@@ -187,6 +189,8 @@ int ft_write_pending(struct se_cmd *se_cmd)
        ft_dump_cmd(cmd, __func__);
+        if (cmd->aborted)
+                return 0;
        ep = fc_seq_exch(cmd->seq);
        lport = ep->lp;
        fp = fc_frame_alloc(lport, sizeof(*txrdy));
@@ -252,10 +256,10 @@ static void ft_recv_seq(struct fc_seq *sp, struct fc_frame *fp, void *arg)
        struct ft_cmd *cmd = arg;
        struct fc_frame_header *fh;
-        if (IS_ERR(fp)) {
+        if (unlikely(IS_ERR(fp))) {
                /* XXX need to find cmd if queued */
                cmd->seq = NULL;
-                transport_generic_free_cmd(&cmd->se_cmd, 0);
+                cmd->aborted = true;
                return;
        }
@@ -399,6 +403,8 @@ int ft_queue_tm_resp(struct se_cmd *se_cmd)
        struct se_tmr_req *tmr = se_cmd->se_tmr_req;
        enum fcp_resp_rsp_codes code;
+        if (cmd->aborted)
+                return 0;
        switch (tmr->response) {
        case TMR_FUNCTION_COMPLETE:
                code = FCP_TMF_CMPL;
diff --git a/drivers/target/tcm_fc/tfc_conf.c b/drivers/target/tcm_fc/tfc_conf.c
index f357039349ba..2948dc944619 100644
--- a/drivers/target/tcm_fc/tfc_conf.c
+++ b/drivers/target/tcm_fc/tfc_conf.c
@@ -300,6 +300,7 @@ static struct se_portal_group *ft_add_tpg(
 {
        struct ft_lport_acl *lacl;
        struct ft_tpg *tpg;
+        struct workqueue_struct *wq;
        unsigned long index;
        int ret;
@@ -321,18 +322,20 @@ static struct se_portal_group *ft_add_tpg(
        tpg->lport_acl = lacl;
        INIT_LIST_HEAD(&tpg->lun_list);
-        ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg,
+        wq = alloc_workqueue("tcm_fc", 0, 1);
-                                tpg, TRANSPORT_TPG_TYPE_NORMAL);
+        if (!wq) {
-        if (ret < 0) {
                kfree(tpg);
                return NULL;
        }
-        tpg->workqueue = alloc_workqueue("tcm_fc", 0, 1);
+        ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg,
-        if (!tpg->workqueue) {
+                                tpg, TRANSPORT_TPG_TYPE_NORMAL);
+        if (ret < 0) {
+                destroy_workqueue(wq);
                kfree(tpg);
                return NULL;
        }
+        tpg->workqueue = wq;
        mutex_lock(&ft_lport_lock);
        list_add_tail(&tpg->list, &lacl->tpg_list);
diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
index 2b693eefac55..dc7c0db26e20 100644
--- a/drivers/target/tcm_fc/tfc_io.c
+++ b/drivers/target/tcm_fc/tfc_io.c
@@ -81,6 +81,8 @@ int ft_queue_data_in(struct se_cmd *se_cmd)
        void *from;
        void *to = NULL;
+        if (cmd->aborted)
+                return 0;
        ep = fc_seq_exch(cmd->seq);
        lport = ep->lp;
        cmd->seq = lport->tt.seq_start_next(cmd->seq);
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index bf461cf99616..3158e17b665c 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -355,9 +355,6 @@ static void sci_serial_out(struct uart_port *p, int offset, int value)
                WARN(1, "Invalid register access\n");
 }
-#define sci_in(up, offset)              (up->serial_in(up, offset))
-#define sci_out(up, offset, value)      (up->serial_out(up, offset, value))
 static int sci_probe_regmap(struct plat_sci_port *cfg)
 {
        switch (cfg->type) {
@@ -422,9 +419,9 @@ static int sci_poll_get_char(struct uart_port *port)
        int c;
        do {
-                status = sci_in(port, SCxSR);
+                status = serial_port_in(port, SCxSR);
                if (status & SCxSR_ERRORS(port)) {
-                        sci_out(port, SCxSR, SCxSR_ERROR_CLEAR(port));
+                        serial_port_out(port, SCxSR, SCxSR_ERROR_CLEAR(port));
                        continue;
                }
                break;
@@ -433,11 +430,11 @@ static int sci_poll_get_char(struct uart_port *port)
        if (!(status & SCxSR_RDxF(port)))
                return NO_POLL_CHAR;
-        c = sci_in(port, SCxRDR);
+        c = serial_port_in(port, SCxRDR);
        /* Dummy read */
-        sci_in(port, SCxSR);
+        serial_port_in(port, SCxSR);
-        sci_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
+        serial_port_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
        return c;
 }
@@ -448,11 +445,11 @@ static void sci_poll_put_char(struct uart_port *port, unsigned char c)
        unsigned short status;
        do {
-                status = sci_in(port, SCxSR);
+                status = serial_port_in(port, SCxSR);
        } while (!(status & SCxSR_TDxE(port)));
-        sci_out(port, SCxTDR, c);
+        serial_port_out(port, SCxTDR, c);
-        sci_out(port, SCxSR, SCxSR_TDxE_CLEAR(port) & ~SCxSR_TEND(port));
+        serial_port_out(port, SCxSR, SCxSR_TDxE_CLEAR(port) & ~SCxSR_TEND(port));
 }
 #endif /* CONFIG_CONSOLE_POLL || CONFIG_SERIAL_SH_SCI_CONSOLE */
@@ -480,10 +477,10 @@ static void sci_init_pins(struct uart_port *port, unsigned int cflag)
            ((!(cflag & CRTSCTS)))) {
                unsigned short status;
-                status = sci_in(port, SCSPTR);
+                status = serial_port_in(port, SCSPTR);
                status &= ~SCSPTR_CTSIO;
                status |= SCSPTR_RTSIO;
-                sci_out(port, SCSPTR, status); /* Set RTS = 1 */
+                serial_port_out(port, SCSPTR, status); /* Set RTS = 1 */
        }
 }
@@ -493,13 +490,13 @@ static int sci_txfill(struct uart_port *port)
        reg = sci_getreg(port, SCTFDR);
        if (reg->size)
-                return sci_in(port, SCTFDR) & 0xff;
+                return serial_port_in(port, SCTFDR) & 0xff;
        reg = sci_getreg(port, SCFDR);
        if (reg->size)
-                return sci_in(port, SCFDR) >> 8;
+                return serial_port_in(port, SCFDR) >> 8;
-        return !(sci_in(port, SCxSR) & SCI_TDRE);
+        return !(serial_port_in(port, SCxSR) & SCI_TDRE);
 }
 static int sci_txroom(struct uart_port *port)
@@ -513,13 +510,13 @@ static int sci_rxfill(struct uart_port *port)
        reg = sci_getreg(port, SCRFDR);
        if (reg->size)
-                return sci_in(port, SCRFDR) & 0xff;
+                return serial_port_in(port, SCRFDR) & 0xff;
        reg = sci_getreg(port, SCFDR);
        if (reg->size)
-                return sci_in(port, SCFDR) & ((port->fifosize << 1) - 1);
+                return serial_port_in(port, SCFDR) & ((port->fifosize << 1) - 1);
-        return (sci_in(port, SCxSR) & SCxSR_RDxF(port)) != 0;
+        return (serial_port_in(port, SCxSR) & SCxSR_RDxF(port)) != 0;
 }
 /*
@@ -547,14 +544,14 @@ static void sci_transmit_chars(struct uart_port *port)
        unsigned short ctrl;
        int count;
-        status = sci_in(port, SCxSR);
+        status = serial_port_in(port, SCxSR);
        if (!(status & SCxSR_TDxE(port))) {
-                ctrl = sci_in(port, SCSCR);
+                ctrl = serial_port_in(port, SCSCR);
                if (uart_circ_empty(xmit))
                        ctrl &= ~SCSCR_TIE;
                else
                        ctrl |= SCSCR_TIE;
-                sci_out(port, SCSCR, ctrl);
+                serial_port_out(port, SCSCR, ctrl);
                return;
        }
@@ -573,27 +570,27 @@ static void sci_transmit_chars(struct uart_port *port)
                        break;
                }
-                sci_out(port, SCxTDR, c);
+                serial_port_out(port, SCxTDR, c);
                port->icount.tx++;
        } while (--count > 0);
-        sci_out(port, SCxSR, SCxSR_TDxE_CLEAR(port));
+        serial_port_out(port, SCxSR, SCxSR_TDxE_CLEAR(port));
        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                uart_write_wakeup(port);
        if (uart_circ_empty(xmit)) {
                sci_stop_tx(port);
        } else {
-                ctrl = sci_in(port, SCSCR);
+                ctrl = serial_port_in(port, SCSCR);
                if (port->type != PORT_SCI) {
-                        sci_in(port, SCxSR); /* Dummy read */
+                        serial_port_in(port, SCxSR); /* Dummy read */
-                        sci_out(port, SCxSR, SCxSR_TDxE_CLEAR(port));
+                        serial_port_out(port, SCxSR, SCxSR_TDxE_CLEAR(port));
                }
                ctrl |= SCSCR_TIE;
-                sci_out(port, SCSCR, ctrl);
+                serial_port_out(port, SCSCR, ctrl);
        }
 }
@@ -608,7 +605,7 @@ static void sci_receive_chars(struct uart_port *port)
        unsigned short status;
        unsigned char flag;
-        status = sci_in(port, SCxSR);
+        status = serial_port_in(port, SCxSR);
        if (!(status & SCxSR_RDxF(port)))
                return;
@@ -621,7 +618,7 @@ static void sci_receive_chars(struct uart_port *port)
                        break;
                if (port->type == PORT_SCI) {
-                        char c = sci_in(port, SCxRDR);
+                        char c = serial_port_in(port, SCxRDR);
                        if (uart_handle_sysrq_char(port, c) ||
                            sci_port->break_flag)
                                count = 0;
@@ -629,9 +626,9 @@ static void sci_receive_chars(struct uart_port *port)
                                tty_insert_flip_char(tty, c, TTY_NORMAL);
                } else {
                        for (i = 0; i < count; i++) {
-                                char c = sci_in(port, SCxRDR);
+                                char c = serial_port_in(port, SCxRDR);
-                                status = sci_in(port, SCxSR);
+                                status = serial_port_in(port, SCxSR);
 #if defined(CONFIG_CPU_SH3)
                                /* Skip "chars" during break */
                                if (sci_port->break_flag) {
@@ -672,8 +669,8 @@ static void sci_receive_chars(struct uart_port *port)
                        }
                }
-                sci_in(port, SCxSR); /* dummy read */
+                serial_port_in(port, SCxSR); /* dummy read */
-                sci_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
+                serial_port_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
                copied += count;
                port->icount.rx += count;
@@ -683,8 +680,8 @@ static void sci_receive_chars(struct uart_port *port)
                /* Tell the rest of the system the news. New characters! */
                tty_flip_buffer_push(tty);
        } else {
-                sci_in(port, SCxSR); /* dummy read */
+                serial_port_in(port, SCxSR); /* dummy read */
-                sci_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
+                serial_port_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
        }
 }
@@ -726,7 +723,7 @@ static void sci_break_timer(unsigned long data)
 static int sci_handle_errors(struct uart_port *port)
 {
        int copied = 0;
-        unsigned short status = sci_in(port, SCxSR);
+        unsigned short status = serial_port_in(port, SCxSR);
        struct tty_struct *tty = port->state->port.tty;
        struct sci_port *s = to_sci_port(port);
@@ -804,8 +801,8 @@ static int sci_handle_fifo_overrun(struct uart_port *port)
        if (!reg->size)
                return 0;
-        if ((sci_in(port, SCLSR) & (1 << s->cfg->overrun_bit))) {
+        if ((serial_port_in(port, SCLSR) & (1 << s->cfg->overrun_bit))) {
-                sci_out(port, SCLSR, 0);
+                serial_port_out(port, SCLSR, 0);
                port->icount.overrun++;
@@ -822,7 +819,7 @@ static int sci_handle_fifo_overrun(struct uart_port *port)
 static int sci_handle_breaks(struct uart_port *port)
 {
        int copied = 0;
-        unsigned short status = sci_in(port, SCxSR);
+        unsigned short status = serial_port_in(port, SCxSR);
        struct tty_struct *tty = port->state->port.tty;
        struct sci_port *s = to_sci_port(port);
@@ -859,8 +856,8 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
        struct sci_port *s = to_sci_port(port);
        if (s->chan_rx) {
-                u16 scr = sci_in(port, SCSCR);
+                u16 scr = serial_port_in(port, SCSCR);
-                u16 ssr = sci_in(port, SCxSR);
+                u16 ssr = serial_port_in(port, SCxSR);
                /* Disable future Rx interrupts */
                if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) {
@@ -869,9 +866,9 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
                } else {
                        scr &= ~SCSCR_RIE;
                }
-                sci_out(port, SCSCR, scr);
+                serial_port_out(port, SCSCR, scr);
                /* Clear current interrupt */
-                sci_out(port, SCxSR, ssr & ~(1 | SCxSR_RDxF(port)));
+                serial_port_out(port, SCxSR, ssr & ~(1 | SCxSR_RDxF(port)));
                dev_dbg(port->dev, "Rx IRQ %lu: setup t-out in %u jiffies\n",
                        jiffies, s->rx_timeout);
                mod_timer(&s->rx_timer, jiffies + s->rx_timeout);
@@ -909,15 +906,15 @@ static irqreturn_t sci_er_interrupt(int irq, void *ptr)
        if (port->type == PORT_SCI) {
                if (sci_handle_errors(port)) {
                        /* discard character in rx buffer */
-                        sci_in(port, SCxSR);
+                        serial_port_in(port, SCxSR);
-                        sci_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
+                        serial_port_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
                }
        } else {
                sci_handle_fifo_overrun(port);
                sci_rx_interrupt(irq, ptr);
        }
-        sci_out(port, SCxSR, SCxSR_ERROR_CLEAR(port));
+        serial_port_out(port, SCxSR, SCxSR_ERROR_CLEAR(port));
        /* Kick the transmission */
        sci_tx_interrupt(irq, ptr);
@@ -931,7 +928,7 @@ static irqreturn_t sci_br_interrupt(int irq, void *ptr)
        /* Handle BREAKs */
        sci_handle_breaks(port);
-        sci_out(port, SCxSR, SCxSR_BREAK_CLEAR(port));
+        serial_port_out(port, SCxSR, SCxSR_BREAK_CLEAR(port));
        return IRQ_HANDLED;
 }
@@ -955,8 +952,8 @@ static irqreturn_t sci_mpxed_interrupt(int irq, void *ptr)
        struct sci_port *s = to_sci_port(port);
        irqreturn_t ret = IRQ_NONE;
-        ssr_status = sci_in(port, SCxSR);
+        ssr_status = serial_port_in(port, SCxSR);
-        scr_status = sci_in(port, SCSCR);
+        scr_status = serial_port_in(port, SCSCR);
        err_enabled = scr_status & port_rx_irq_mask(port);
        /* Tx Interrupt */
@@ -1170,7 +1167,7 @@ static void sci_free_gpios(struct sci_port *port)
 static unsigned int sci_tx_empty(struct uart_port *port)
 {
-        unsigned short status = sci_in(port, SCxSR);
+        unsigned short status = serial_port_in(port, SCxSR);
        unsigned short in_tx_fifo = sci_txfill(port);
        return (status & SCxSR_TEND(port)) && !in_tx_fifo ? TIOCSER_TEMT : 0;
@@ -1198,7 +1195,7 @@ static void sci_set_mctrl(struct uart_port *port, unsigned int mctrl)
                 */
                reg = sci_getreg(port, SCFCR);
                if (reg->size)
-                        sci_out(port, SCFCR, sci_in(port, SCFCR) | 1);
+                        serial_port_out(port, SCFCR, serial_port_in(port, SCFCR) | 1);
        }
 }
@@ -1240,8 +1237,8 @@ static void sci_dma_tx_complete(void *arg)
        } else {
                s->cookie_tx = -EINVAL;
                if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) {
-                        u16 ctrl = sci_in(port, SCSCR);
+                        u16 ctrl = serial_port_in(port, SCSCR);
-                        sci_out(port, SCSCR, ctrl & ~SCSCR_TIE);
+                        serial_port_out(port, SCSCR, ctrl & ~SCSCR_TIE);
                }
        }
@@ -1494,13 +1491,13 @@ static void sci_start_tx(struct uart_port *port)
 #ifdef CONFIG_SERIAL_SH_SCI_DMA
        if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) {
-                u16 new, scr = sci_in(port, SCSCR);
+                u16 new, scr = serial_port_in(port, SCSCR);
                if (s->chan_tx)
                        new = scr | 0x8000;
                else
                        new = scr & ~0x8000;
                if (new != scr)
-                        sci_out(port, SCSCR, new);
+                        serial_port_out(port, SCSCR, new);
        }
        if (s->chan_tx && !uart_circ_empty(&s->port.state->xmit) &&
@@ -1512,8 +1509,8 @@ static void sci_start_tx(struct uart_port *port)
        if (!s->chan_tx || port->type == PORT_SCIFA || port->type == PORT_SCIFB) {
                /* Set TIE (Transmit Interrupt Enable) bit in SCSCR */
-                ctrl = sci_in(port, SCSCR);
+                ctrl = serial_port_in(port, SCSCR);
-                sci_out(port, SCSCR, ctrl | SCSCR_TIE);
+                serial_port_out(port, SCSCR, ctrl | SCSCR_TIE);
        }
 }
@@ -1522,40 +1519,40 @@ static void sci_stop_tx(struct uart_port *port)
        unsigned short ctrl;
        /* Clear TIE (Transmit Interrupt Enable) bit in SCSCR */
-        ctrl = sci_in(port, SCSCR);
+        ctrl = serial_port_in(port, SCSCR);
        if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
                ctrl &= ~0x8000;
        ctrl &= ~SCSCR_TIE;
-        sci_out(port, SCSCR, ctrl);
+        serial_port_out(port, SCSCR, ctrl);
 }
 static void sci_start_rx(struct uart_port *port)
 {
        unsigned short ctrl;
-        ctrl = sci_in(port, SCSCR) | port_rx_irq_mask(port);
+        ctrl = serial_port_in(port, SCSCR) | port_rx_irq_mask(port);
        if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
                ctrl &= ~0x4000;
-        sci_out(port, SCSCR, ctrl);
+        serial_port_out(port, SCSCR, ctrl);
 }
 static void sci_stop_rx(struct uart_port *port)
 {
        unsigned short ctrl;
-        ctrl = sci_in(port, SCSCR);
+        ctrl = serial_port_in(port, SCSCR);
        if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
                ctrl &= ~0x4000;
        ctrl &= ~port_rx_irq_mask(port);
-        sci_out(port, SCSCR, ctrl);
+        serial_port_out(port, SCSCR, ctrl);
 }
 static void sci_enable_ms(struct uart_port *port)
@@ -1589,13 +1586,13 @@ static void rx_timer_fn(unsigned long arg)
 {
        struct sci_port *s = (struct sci_port *)arg;
        struct uart_port *port = &s->port;
-        u16 scr = sci_in(port, SCSCR);
+        u16 scr = serial_port_in(port, SCSCR);
        if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) {
                scr &= ~0x4000;
                enable_irq(s->cfg->irqs[1]);
        }
-        sci_out(port, SCSCR, scr | SCSCR_RIE);
+        serial_port_out(port, SCSCR, scr | SCSCR_RIE);
        dev_dbg(port->dev, "DMA Rx timed out\n");
        schedule_work(&s->work_rx);
 }
@@ -1776,14 +1773,14 @@ static void sci_reset(struct uart_port *port)
        unsigned int status;
        do {
-                status = sci_in(port, SCxSR);
+                status = serial_port_in(port, SCxSR);
        } while (!(status & SCxSR_TEND(port)));
-        sci_out(port, SCSCR, 0x00);     /* TE=0, RE=0, CKE1=0 */
+        serial_port_out(port, SCSCR, 0x00);     /* TE=0, RE=0, CKE1=0 */
        reg = sci_getreg(port, SCFCR);
        if (reg->size)
-                sci_out(port, SCFCR, SCFCR_RFRST | SCFCR_TFRST);
+                serial_port_out(port, SCFCR, SCFCR_RFRST | SCFCR_TFRST);
 }
 static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
@@ -1812,7 +1809,7 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
        sci_reset(port);
-        smr_val = sci_in(port, SCSMR) & 3;
+        smr_val = serial_port_in(port, SCSMR) & 3;
        if ((termios->c_cflag & CSIZE) == CS7)
                smr_val |= 0x40;
@@ -1825,19 +1822,19 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
        uart_update_timeout(port, termios->c_cflag, baud);
-        sci_out(port, SCSMR, smr_val);
+        serial_port_out(port, SCSMR, smr_val);
        dev_dbg(port->dev, "%s: SMR %x, t %x, SCSCR %x\n", __func__, smr_val, t,
                s->cfg->scscr);
        if (t > 0) {
                if (t >= 256) {
-                        sci_out(port, SCSMR, (sci_in(port, SCSMR) & ~3) | 1);
+                        serial_port_out(port, SCSMR, (serial_port_in(port, SCSMR) & ~3) | 1);
                        t >>= 2;
                } else
-                        sci_out(port, SCSMR, sci_in(port, SCSMR) & ~3);
+                        serial_port_out(port, SCSMR, serial_port_in(port, SCSMR) & ~3);
-                sci_out(port, SCBRR, t);
+                serial_port_out(port, SCBRR, t);
                udelay((1000000+(baud-1)) / baud); /* Wait one bit interval */
        }
@@ -1845,7 +1842,7 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
        reg = sci_getreg(port, SCFCR);
        if (reg->size) {
-                unsigned short ctrl = sci_in(port, SCFCR);
+                unsigned short ctrl = serial_port_in(port, SCFCR);
                if (s->cfg->capabilities & SCIx_HAVE_RTSCTS) {
                        if (termios->c_cflag & CRTSCTS)
@@ -1861,10 +1858,10 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
                 */
                ctrl &= ~(SCFCR_RFRST | SCFCR_TFRST);
-                sci_out(port, SCFCR, ctrl);
+                serial_port_out(port, SCFCR, ctrl);
        }
-        sci_out(port, SCSCR, s->cfg->scscr);
+        serial_port_out(port, SCSCR, s->cfg->scscr);
 #ifdef CONFIG_SERIAL_SH_SCI_DMA
        /*
@@ -2166,7 +2163,7 @@ static void serial_console_write(struct console *co, const char *s,
        /* wait until fifo is empty and last bit has been transmitted */
        bits = SCxSR_TDxE(port) | SCxSR_TEND(port);
-        while ((sci_in(port, SCxSR) & bits) != bits)
+        while ((serial_port_in(port, SCxSR) & bits) != bits)
                cpu_relax();
        sci_port_disable(sci_port);
@@ -2260,12 +2257,12 @@ static int sci_runtime_suspend(struct device *dev)
        if (uart_console(port)) {
                struct plat_sci_reg *reg;
-                sci_port->saved_smr = sci_in(port, SCSMR);
+                sci_port->saved_smr = serial_port_in(port, SCSMR);
-                sci_port->saved_brr = sci_in(port, SCBRR);
+                sci_port->saved_brr = serial_port_in(port, SCBRR);
                reg = sci_getreg(port, SCFCR);
                if (reg->size)
-                        sci_port->saved_fcr = sci_in(port, SCFCR);
+                        sci_port->saved_fcr = serial_port_in(port, SCFCR);
                else
                        sci_port->saved_fcr = 0;
        }
@@ -2279,13 +2276,13 @@ static int sci_runtime_resume(struct device *dev)
        if (uart_console(port)) {
                sci_reset(port);
-                sci_out(port, SCSMR, sci_port->saved_smr);
+                serial_port_out(port, SCSMR, sci_port->saved_smr);
-                sci_out(port, SCBRR, sci_port->saved_brr);
+                serial_port_out(port, SCBRR, sci_port->saved_brr);
                if (sci_port->saved_fcr)
-                        sci_out(port, SCFCR, sci_port->saved_fcr);
+                        serial_port_out(port, SCFCR, sci_port->saved_fcr);
-                sci_out(port, SCSCR, sci_port->cfg->scscr);
+                serial_port_out(port, SCSCR, sci_port->cfg->scscr);
        }
        return 0;
 }
diff --git a/drivers/tty/serial/sh-sci.h b/drivers/tty/serial/sh-sci.h
index a1a2d364f92b..4c22a1529aac 100644
--- a/drivers/tty/serial/sh-sci.h
+++ b/drivers/tty/serial/sh-sci.h
@@ -20,10 +20,10 @@
    defined(CONFIG_ARCH_SH7372) || \
    defined(CONFIG_ARCH_R8A7740)
-# define SCxSR_RDxF_CLEAR(port)  (sci_in(port, SCxSR) & 0xfffc)
+# define SCxSR_RDxF_CLEAR(port)  (serial_port_in(port, SCxSR) & 0xfffc)
-# define SCxSR_ERROR_CLEAR(port) (sci_in(port, SCxSR) & 0xfd73)
+# define SCxSR_ERROR_CLEAR(port) (serial_port_in(port, SCxSR) & 0xfd73)
-# define SCxSR_TDxE_CLEAR(port)  (sci_in(port, SCxSR) & 0xffdf)
+# define SCxSR_TDxE_CLEAR(port)  (serial_port_in(port, SCxSR) & 0xffdf)
-# define SCxSR_BREAK_CLEAR(port) (sci_in(port, SCxSR) & 0xffe3)
+# define SCxSR_BREAK_CLEAR(port) (serial_port_in(port, SCxSR) & 0xffe3)
 #else
 # define SCxSR_RDxF_CLEAR(port)  (((port)->type == PORT_SCI) ? 0xbc : 0x00fc)
 # define SCxSR_ERROR_CLEAR(port) (((port)->type == PORT_SCI) ? 0xc4 : 0x0073)
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 63616d7453e6..97f5d264c31e 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -234,7 +234,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
        if (dev_data)
                dev_data->ack_intr = 0;
-        return result;
+        return result > 0 ? 0 : result;
 }
 static
diff --git a/fs/gfs2/Kconfig b/fs/gfs2/Kconfig
index c465ae066c62..eb08c9e43c2a 100644
--- a/fs/gfs2/Kconfig
+++ b/fs/gfs2/Kconfig
@@ -1,10 +1,6 @@
 config GFS2_FS
        tristate "GFS2 file system support"
        depends on (64BIT || LBDAF)
-        select DLM if GFS2_FS_LOCKING_DLM
-        select CONFIGFS_FS if GFS2_FS_LOCKING_DLM
-        select SYSFS if GFS2_FS_LOCKING_DLM
-        select IP_SCTP if DLM_SCTP
        select FS_POSIX_ACL
        select CRC32
        select QUOTACTL
@@ -29,7 +25,8 @@ config GFS2_FS
 config GFS2_FS_LOCKING_DLM
        bool "GFS2 DLM locking"
-        depends on (GFS2_FS!=n) && NET && INET && (IPV6 || IPV6=n) && HOTPLUG
+        depends on (GFS2_FS!=n) && NET && INET && (IPV6 || IPV6=n) && \
+                HOTPLUG && DLM && CONFIGFS_FS && SYSFS
        help
          Multiple node locking module for GFS2
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 38b7a74a0f91..9b2ff0e851b1 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -807,7 +807,7 @@ static int gfs2_stuffed_write_end(struct inode *inode, struct buffer_head *dibh,
        if (inode == sdp->sd_rindex) {
                adjust_fs_space(inode);
-                ip->i_gh.gh_flags |= GL_NOCACHE;
+                sdp->sd_rindex_uptodate = 0;
        }
        brelse(dibh);
@@ -873,7 +873,7 @@ static int gfs2_write_end(struct file *file, struct address_space *mapping,
        if (inode == sdp->sd_rindex) {
                adjust_fs_space(inode);
-                ip->i_gh.gh_flags |= GL_NOCACHE;
+                sdp->sd_rindex_uptodate = 0;
        }
        brelse(dibh);
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 197c5c47e577..03c04febe26f 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -724,7 +724,11 @@ static int do_strip(struct gfs2_inode *ip, struct buffer_head *dibh,
        int metadata;
        unsigned int revokes = 0;
        int x;
-        int error = 0;
+        int error;
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
        if (!*top)
                sm->sm_first = 0;
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index c35573abd371..a836056343f0 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -1844,6 +1844,10 @@ static int leaf_dealloc(struct gfs2_inode *dip, u32 index, u32 len,
        unsigned int x, size = len * sizeof(u64);
        int error;
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
        memset(&rlist, 0, sizeof(struct gfs2_rgrp_list));
        ht = kzalloc(size, GFP_NOFS);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index c98a60ee6dfd..a9ba2444e077 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1031,7 +1031,13 @@ static int gfs2_unlink(struct inode *dir, struct dentry *dentry)
        struct buffer_head *bh;
        struct gfs2_holder ghs[3];
        struct gfs2_rgrpd *rgd;
-        int error = -EROFS;
+        int error;
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
+        error = -EROFS;
        gfs2_holder_init(dip->i_gl, LM_ST_EXCLUSIVE, 0, ghs);
        gfs2_holder_init(ip->i_gl,  LM_ST_EXCLUSIVE, 0, ghs + 1);
@@ -1224,6 +1230,10 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
                        return 0;
        }
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
        if (odip != ndip) {
                error = gfs2_glock_nq_init(sdp->sd_rename_gl, LM_ST_EXCLUSIVE,
                                           0, &r_gh);
@@ -1345,7 +1355,6 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
        error = alloc_required;
        if (error < 0)
                goto out_gunlock;
-        error = 0;
        if (alloc_required) {
                struct gfs2_qadata *qa = gfs2_qadata_get(ndip);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 19bde40b4864..3df65c9ab73b 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -332,9 +332,6 @@ struct gfs2_rgrpd *gfs2_blk2rgrpd(struct gfs2_sbd *sdp, u64 blk, bool exact)
        struct rb_node *n, *next;
        struct gfs2_rgrpd *cur;
-        if (gfs2_rindex_update(sdp))
-                return NULL;
        spin_lock(&sdp->sd_rindex_spin);
        n = sdp->sd_rindex_tree.rb_node;
        while (n) {
@@ -640,6 +637,7 @@ static int read_rindex_entry(struct gfs2_inode *ip,
                return 0;
        error = 0; /* someone else read in the rgrp; free it and ignore it */
+        gfs2_glock_put(rgd->rd_gl);
 fail:
        kfree(rgd->rd_bits);
@@ -927,6 +925,10 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
        } else if (copy_from_user(&r, argp, sizeof(r)))
                return -EFAULT;
+        ret = gfs2_rindex_update(sdp);
+        if (ret)
+                return ret;
        rgd = gfs2_blk2rgrpd(sdp, r.start, 0);
        rgd_end = gfs2_blk2rgrpd(sdp, r.start + r.len, 0);
diff --git a/fs/gfs2/xattr.c b/fs/gfs2/xattr.c
index 2e5ba425cae7..927f4df874ae 100644
--- a/fs/gfs2/xattr.c
+++ b/fs/gfs2/xattr.c
@@ -238,6 +238,10 @@ static int ea_dealloc_unstuffed(struct gfs2_inode *ip, struct buffer_head *bh,
        unsigned int x;
        int error;
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
        if (GFS2_EA_IS_STUFFED(ea))
                return 0;
@@ -1330,6 +1334,10 @@ static int ea_dealloc_indirect(struct gfs2_inode *ip)
        unsigned int x;
        int error;
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
        memset(&rlist, 0, sizeof(struct gfs2_rgrp_list));
        error = gfs2_meta_read(ip->i_gl, ip->i_eattr, DIO_WAIT, &indbh);
@@ -1439,6 +1447,10 @@ static int ea_dealloc_block(struct gfs2_inode *ip)
        struct gfs2_holder gh;
        int error;
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                return error;
        rgd = gfs2_blk2rgrpd(sdp, ip->i_eattr, 1);
        if (!rgd) {
                gfs2_consist_inode(ip);
diff --git a/fs/libfs.c b/fs/libfs.c
index 358094f0433d..18d08f5db53a 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -529,6 +529,7 @@ int simple_fill_super(struct super_block *s, unsigned long magic,
        return 0;
 out:
        d_genocide(root);
+        shrink_dcache_parent(root);
        dput(root);
        return -ENOMEM;
 }
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index 3963116083ae..e478de4e5d56 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -85,7 +85,7 @@ struct drm_exynos_gem_mmap {
 struct drm_exynos_vidi_connection {
        unsigned int connection;
        unsigned int extensions;
-        uint64_t *edid;
+        uint64_t edid;
 };
 struct drm_exynos_plane_set_zpos {
@@ -96,7 +96,8 @@ struct drm_exynos_plane_set_zpos {
 /* memory type definitions. */
 enum e_drm_exynos_gem_mem_type {
        /* Physically Non-Continuous memory. */
-        EXYNOS_BO_NONCONTIG     = 1 << 0
+        EXYNOS_BO_NONCONTIG     = 1 << 0,
+        EXYNOS_BO_MASK          = EXYNOS_BO_NONCONTIG
 };
 #define DRM_EXYNOS_GEM_CREATE           0x00
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 676f967390ae..f9a2e5e67a54 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -974,6 +974,7 @@ int dma_async_device_register(struct dma_device *device);
 void dma_async_device_unregister(struct dma_device *device);
 void dma_run_dependencies(struct dma_async_tx_descriptor *tx);
 struct dma_chan *dma_find_channel(enum dma_transaction_type tx_type);
+struct dma_chan *net_dma_find_channel(void);
 #define dma_request_channel(mask, x, y) __dma_request_channel(&(mask), x, y)
 /* --- Helper iov-locking functions --- */
diff --git a/include/linux/irq.h b/include/linux/irq.h
index bff29c58da23..7810406f3d80 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -263,6 +263,11 @@ static inline void irqd_clr_chained_irq_inprogress(struct irq_data *d)
        d->state_use_accessors &= ~IRQD_IRQ_INPROGRESS;
 }
+static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
+{
+        return d->hwirq;
+}
 /**
 * struct irq_chip - hardware interrupt chip descriptor
 *
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index ead4a4215797..c65740d76e66 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -42,12 +42,6 @@ struct of_device_id;
 /* Number of irqs reserved for a legacy isa controller */
 #define NUM_ISA_INTERRUPTS      16
-/* This type is the placeholder for a hardware interrupt number. It has to
- * be big enough to enclose whatever representation is used by a given
- * platform.
- */
-typedef unsigned long irq_hw_number_t;
 /**
 * struct irq_domain_ops - Methods for irq_domain objects
 * @match: Match an interrupt controller device node to a host, returns
@@ -104,6 +98,9 @@ struct irq_domain {
                        unsigned int size;
                        unsigned int *revmap;
                } linear;
+                struct {
+                        unsigned int max_irq;
+                } nomap;
                struct radix_tree_root tree;
        } revmap_data;
        const struct irq_domain_ops *ops;
@@ -126,6 +123,7 @@ struct irq_domain *irq_domain_add_linear(struct device_node *of_node,
                                         const struct irq_domain_ops *ops,
                                         void *host_data);
 struct irq_domain *irq_domain_add_nomap(struct device_node *of_node,
+                                         unsigned int max_irq,
                                         const struct irq_domain_ops *ops,
                                         void *host_data);
 struct irq_domain *irq_domain_add_tree(struct device_node *of_node,
@@ -134,7 +132,6 @@ struct irq_domain *irq_domain_add_tree(struct device_node *of_node,
 extern struct irq_domain *irq_find_host(struct device_node *node);
 extern void irq_set_default_host(struct irq_domain *host);
-extern void irq_set_virq_count(unsigned int count);
 static inline struct irq_domain *irq_domain_add_legacy_isa(
                                struct device_node *of_node,
@@ -146,7 +143,6 @@ static inline struct irq_domain *irq_domain_add_legacy_isa(
 }
 extern struct irq_domain *irq_find_host(struct device_node *node);
 extern void irq_set_default_host(struct irq_domain *host);
-extern void irq_set_virq_count(unsigned int count);
 extern unsigned int irq_create_mapping(struct irq_domain *host,
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index f549adccc94c..1bc898b14a80 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -287,7 +287,17 @@ extern unsigned int ip6t_do_table(struct sk_buff *skb,
                                  struct xt_table *table);
 /* Check for an extension */
-extern int ip6t_ext_hdr(u8 nexthdr);
+static inline int
+ip6t_ext_hdr(u8 nexthdr)
+{       return (nexthdr == IPPROTO_HOPOPTS) ||
+               (nexthdr == IPPROTO_ROUTING) ||
+               (nexthdr == IPPROTO_FRAGMENT) ||
+               (nexthdr == IPPROTO_ESP) ||
+               (nexthdr == IPPROTO_AH) ||
+               (nexthdr == IPPROTO_NONE) ||
+               (nexthdr == IPPROTO_DSTOPTS);
+}
 /* find specified header and get offset to it */
 extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                         int target, unsigned short *fragoff);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 33370271b8b2..70a3f8d49118 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -481,6 +481,7 @@ struct sk_buff {
        union {
                __u32           mark;
                __u32           dropcount;
+                __u32           avail_size;
        };
        sk_buff_data_t          transport_header;
@@ -1366,6 +1367,18 @@ static inline int skb_tailroom(const struct sk_buff *skb)
 }
 /**
+ *      skb_availroom - bytes at buffer end
+ *      @skb: buffer to check
+ *
+ *      Return the number of bytes of free space at the tail of an sk_buff
+ *      allocated by sk_stream_alloc()
+ */
+static inline int skb_availroom(const struct sk_buff *skb)
+{
+        return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
+}
+/**
 *      skb_reserve - adjust headroom
 *      @skb: buffer to alter
 *      @len: bytes to move
diff --git a/include/linux/types.h b/include/linux/types.h
index e5fa50345516..7f480db60231 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -210,6 +210,12 @@ typedef u32 phys_addr_t;
 typedef phys_addr_t resource_size_t;
+/*
+ * This type is the placeholder for a hardware interrupt number. It has to be
+ * big enough to enclose whatever representation is used by a given platform.
+ */
+typedef unsigned long irq_hw_number_t;
 typedef struct {
        int counter;
 } atomic_t;
diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h
index 9c3120dca294..b572f80bdfd5 100644
--- a/include/linux/vgaarb.h
+++ b/include/linux/vgaarb.h
@@ -47,6 +47,8 @@
 */
 #define VGA_DEFAULT_DEVICE     (NULL)
+struct pci_dev;
 /* For use by clients */
 /**
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 344b0f972828..d47e523c9d83 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -92,6 +92,7 @@ enum {
        HCI_SERVICE_CACHE,
        HCI_LINK_KEYS,
        HCI_DEBUG_KEYS,
+        HCI_UNREGISTER,
        HCI_LE_SCAN,
        HCI_SSP_ENABLED,
@@ -1327,8 +1328,8 @@ struct sockaddr_hci {
 #define HCI_DEV_NONE    0xffff
 #define HCI_CHANNEL_RAW         0
-#define HCI_CHANNEL_CONTROL     1
 #define HCI_CHANNEL_MONITOR     2
+#define HCI_CHANNEL_CONTROL     3
 struct hci_filter {
        unsigned long type_mask;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index daefaac51131..6822d2595aff 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -427,7 +427,7 @@ enum {
 static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
 {
        struct hci_dev *hdev = conn->hdev;
-        return (test_bit(HCI_SSP_ENABLED, &hdev->flags) &&
+        return (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
                                test_bit(HCI_CONN_SSP_ENABLED, &conn->flags));
 }
@@ -907,11 +907,13 @@ static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
 static inline bool eir_has_data_type(u8 *data, size_t data_len, u8 type)
 {
-        u8 field_len;
+        size_t parsed = 0;
-        size_t parsed;
-        for (parsed = 0; parsed < data_len - 1; parsed += field_len) {
+        if (data_len < 2)
-                field_len = data[0];
+                return false;
+        while (parsed < data_len - 1) {
+                u8 field_len = data[0];
                if (field_len == 0)
                        break;
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index ffc1377e092e..ebfd91fc20f8 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -117,7 +117,7 @@ struct mgmt_mode {
 #define MGMT_OP_SET_DISCOVERABLE        0x0006
 struct mgmt_cp_set_discoverable {
        __u8    val;
-        __u16   timeout;
+        __le16  timeout;
 } __packed;
 #define MGMT_SET_DISCOVERABLE_SIZE      3
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 87d203ff7a8a..9210bdc7bd8d 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1327,7 +1327,7 @@ static inline struct ieee80211_rate *
 ieee80211_get_tx_rate(const struct ieee80211_hw *hw,
                      const struct ieee80211_tx_info *c)
 {
-        if (WARN_ON(c->control.rates[0].idx < 0))
+        if (WARN_ON_ONCE(c->control.rates[0].idx < 0))
                return NULL;
        return &hw->wiphy->bands[c->band]->bitrates[c->control.rates[0].idx];
 }
diff --git a/include/sound/core.h b/include/sound/core.h
index b6e0f57d451d..bc056687f647 100644
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -325,6 +325,13 @@ void release_and_free_resource(struct resource *res);
 /* --- */
+/* sound printk debug levels */
+enum {
+        SND_PR_ALWAYS,
+        SND_PR_DEBUG,
+        SND_PR_VERBOSE,
+};
 #if defined(CONFIG_SND_DEBUG) || defined(CONFIG_SND_VERBOSE_PRINTK)
 __printf(4, 5)
 void __snd_printk(unsigned int level, const char *file, int line,
@@ -354,6 +361,8 @@ void __snd_printk(unsigned int level, const char *file, int line,
 */
 #define snd_printd(fmt, args...) \
        __snd_printk(1, __FILE__, __LINE__, fmt, ##args)
+#define _snd_printd(level, fmt, args...) \
+        __snd_printk(level, __FILE__, __LINE__, fmt, ##args)
 /**
 * snd_BUG - give a BUG warning message and stack trace
@@ -383,6 +392,7 @@ void __snd_printk(unsigned int level, const char *file, int line,
 #else /* !CONFIG_SND_DEBUG */
 #define snd_printd(fmt, args...)        do { } while (0)
+#define _snd_printd(level, fmt, args...) do { } while (0)
 #define snd_BUG()                       do { } while (0)
 static inline int __snd_bug_on(int cond)
 {
diff --git a/kernel/cred.c b/kernel/cred.c
index 97b36eeca4c9..e70683d9ec32 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -386,6 +386,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
        struct cred *new;
        int ret;
+        p->replacement_session_keyring = NULL;
        if (
 #ifdef CONFIG_KEYS
                !p->cred->thread_keyring &&
diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
index cf1a4a68ce44..d1a758bc972a 100644
--- a/kernel/irq/Kconfig
+++ b/kernel/irq/Kconfig
@@ -62,7 +62,7 @@ config IRQ_DOMAIN_DEBUG
        help
          This option will show the mapping relationship between hardware irq
          numbers and Linux irq numbers. The mapping is exposed via debugfs
-          in the file "virq_mapping".
+          in the file "irq_domain_mapping".
          If you don't know what this means you don't need it.
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 3601f3fbf67c..d34413e78628 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -23,7 +23,6 @@ static LIST_HEAD(irq_domain_list);
 static DEFINE_MUTEX(irq_domain_mutex);
 static DEFINE_MUTEX(revmap_trees_mutex);
-static unsigned int irq_virq_count = NR_IRQS;
 static struct irq_domain *irq_default_domain;
 /**
@@ -184,13 +183,16 @@ struct irq_domain *irq_domain_add_linear(struct device_node *of_node,
 }
 struct irq_domain *irq_domain_add_nomap(struct device_node *of_node,
+                                         unsigned int max_irq,
                                         const struct irq_domain_ops *ops,
                                         void *host_data)
 {
        struct irq_domain *domain = irq_domain_alloc(of_node,
                                        IRQ_DOMAIN_MAP_NOMAP, ops, host_data);
-        if (domain)
+        if (domain) {
+                domain->revmap_data.nomap.max_irq = max_irq ? max_irq : ~0;
                irq_domain_add(domain);
+        }
        return domain;
 }
@@ -262,22 +264,6 @@ void irq_set_default_host(struct irq_domain *domain)
        irq_default_domain = domain;
 }
-/**
- * irq_set_virq_count() - Set the maximum number of linux irqs
- * @count: number of linux irqs, capped with NR_IRQS
- *
- * This is mainly for use by platforms like iSeries who want to program
- * the virtual irq number in the controller to avoid the reverse mapping
- */
-void irq_set_virq_count(unsigned int count)
-{
-        pr_debug("irq: Trying to set virq count to %d\n", count);
-        BUG_ON(count < NUM_ISA_INTERRUPTS);
-        if (count < NR_IRQS)
-                irq_virq_count = count;
-}
 static int irq_setup_virq(struct irq_domain *domain, unsigned int virq,
                            irq_hw_number_t hwirq)
 {
@@ -320,13 +306,12 @@ unsigned int irq_create_direct_mapping(struct irq_domain *domain)
                pr_debug("irq: create_direct virq allocation failed\n");
                return 0;
        }
-        if (virq >= irq_virq_count) {
+        if (virq >= domain->revmap_data.nomap.max_irq) {
                pr_err("ERROR: no free irqs available below %i maximum\n",
-                        irq_virq_count);
+                        domain->revmap_data.nomap.max_irq);
                irq_free_desc(virq);
                return 0;
        }
        pr_debug("irq: create_direct obtained virq %d\n", virq);
        if (irq_setup_virq(domain, virq, virq)) {
@@ -350,7 +335,8 @@ unsigned int irq_create_direct_mapping(struct irq_domain *domain)
 unsigned int irq_create_mapping(struct irq_domain *domain,
                                irq_hw_number_t hwirq)
 {
-        unsigned int virq, hint;
+        unsigned int hint;
+        int virq;
        pr_debug("irq: irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq);
@@ -377,13 +363,13 @@ unsigned int irq_create_mapping(struct irq_domain *domain,
                return irq_domain_legacy_revmap(domain, hwirq);
        /* Allocate a virtual interrupt number */
-        hint = hwirq % irq_virq_count;
+        hint = hwirq % nr_irqs;
        if (hint == 0)
                hint++;
        virq = irq_alloc_desc_from(hint, 0);
-        if (!virq)
+        if (virq <= 0)
                virq = irq_alloc_desc_from(1, 0);
-        if (!virq) {
+        if (virq <= 0) {
                pr_debug("irq: -> virq allocation failed\n");
                return 0;
        }
@@ -515,7 +501,7 @@ unsigned int irq_find_mapping(struct irq_domain *domain,
                              irq_hw_number_t hwirq)
 {
        unsigned int i;
-        unsigned int hint = hwirq % irq_virq_count;
+        unsigned int hint = hwirq % nr_irqs;
        /* Look for default domain if nececssary */
        if (domain == NULL)
@@ -536,7 +522,7 @@ unsigned int irq_find_mapping(struct irq_domain *domain,
                if (data && (data->domain == domain) && (data->hwirq == hwirq))
                        return i;
                i++;
-                if (i >= irq_virq_count)
+                if (i >= nr_irqs)
                        i = 1;
        } while(i != hint);
        return 0;
@@ -642,8 +628,8 @@ static int virq_debug_show(struct seq_file *m, void *private)
        void *data;
        int i;
-        seq_printf(m, "%-5s  %-7s  %-15s  %-18s  %s\n", "virq", "hwirq",
+        seq_printf(m, "%-5s  %-7s  %-15s  %-*s  %s\n", "irq", "hwirq",
-                      "chip name", "chip data", "domain name");
+                      "chip name", 2 * sizeof(void *) + 2, "chip data", "domain name");
        for (i = 1; i < nr_irqs; i++) {
                desc = irq_to_desc(i);
@@ -666,7 +652,7 @@ static int virq_debug_show(struct seq_file *m, void *private)
                        seq_printf(m, "%-15s  ", p);
                        data = irq_desc_get_chip_data(desc);
-                        seq_printf(m, "0x%16p  ", data);
+                        seq_printf(m, data ? "0x%p  " : "  %p  ", data);
                        if (desc->irq_data.domain && desc->irq_data.domain->of_node)
                                p = desc->irq_data.domain->of_node->full_name;
diff --git a/kernel/panic.c b/kernel/panic.c
index 80aed44e345a..8ed89a175d79 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -97,7 +97,7 @@ void panic(const char *fmt, ...)
        /*
         * Avoid nested stack-dumping if a panic occurs during oops processing
         */
-        if (!oops_in_progress)
+        if (!test_taint(TAINT_DIE) && oops_in_progress <= 1)
                dump_stack();
 #endif
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 52b3a06a02f8..4ab11879aeb4 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -170,7 +170,7 @@ static int proc_taint(struct ctl_table *table, int write,
 #endif
 #ifdef CONFIG_PRINTK
-static int proc_dmesg_restrict(struct ctl_table *table, int write,
+static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
                                void __user *buffer, size_t *lenp, loff_t *ppos);
 #endif
@@ -703,7 +703,7 @@ static struct ctl_table kern_table[] = {
                .data           = &dmesg_restrict,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
+                .proc_handler   = proc_dointvec_minmax_sysadmin,
                .extra1         = &zero,
                .extra2         = &one,
        },
@@ -712,7 +712,7 @@ static struct ctl_table kern_table[] = {
                .data           = &kptr_restrict,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-                .proc_handler   = proc_dmesg_restrict,
+                .proc_handler   = proc_dointvec_minmax_sysadmin,
                .extra1         = &zero,
                .extra2         = &two,
        },
@@ -1943,7 +1943,7 @@ static int proc_taint(struct ctl_table *table, int write,
 }
 #ifdef CONFIG_PRINTK
-static int proc_dmesg_restrict(struct ctl_table *table, int write,
+static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
                                void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        if (write && !capable(CAP_SYS_ADMIN))
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b8ce6f450956..cd65cb19c941 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2791,6 +2791,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         * so no worry about deadlock.
         */
        page = pte_page(entry);
+        get_page(page);
        if (page != pagecache_page)
                lock_page(page);
@@ -2822,6 +2823,7 @@ out_page_table_lock:
        }
        if (page != pagecache_page)
                unlock_page(page);
+        put_page(page);
 out_mutex:
        mutex_unlock(&hugetlb_instantiation_mutex);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7d698df4a067..a7165a60d0a7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2165,7 +2165,7 @@ static int __cpuinit memcg_cpu_hotplug_callback(struct notifier_block *nb,
        if (action == CPU_ONLINE)
                return NOTIFY_OK;
-        if ((action != CPU_DEAD) || action != CPU_DEAD_FROZEN)
+        if (action != CPU_DEAD && action != CPU_DEAD_FROZEN)
                return NOTIFY_OK;
        for_each_mem_cgroup(iter)
@@ -3763,7 +3763,7 @@ move_account:
                        goto try_to_free;
                cond_resched();
        /* "ret" should also be checked to ensure all lists are empty. */
-        } while (memcg->res.usage > 0 || ret);
+        } while (res_counter_read_u64(&memcg->res, RES_USAGE) > 0 || ret);
 out:
        css_put(&memcg->css);
        return ret;
@@ -3778,7 +3778,7 @@ try_to_free:
        lru_add_drain_all();
        /* try to free all pages in this cgroup */
        shrink = 1;
-        while (nr_retries && memcg->res.usage > 0) {
+        while (nr_retries && res_counter_read_u64(&memcg->res, RES_USAGE) > 0) {
                int progress;
                if (signal_pending(current)) {
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 33c332bbab73..1a518684a32f 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2107,12 +2107,7 @@ restart:
                 * with multiple processes reclaiming pages, the total
                 * freeing target can get unreasonably large.
                 */
-                if (nr_reclaimed >= nr_to_reclaim)
+                if (nr_reclaimed >= nr_to_reclaim && priority < DEF_PRIORITY)
-                        nr_to_reclaim = 0;
-                else
-                        nr_to_reclaim -= nr_reclaimed;
-                if (!nr_to_reclaim && priority < DEF_PRIORITY)
                        break;
        }
        blk_finish_plug(&plug);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e33af63a884a..92a857e3786d 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -665,6 +665,11 @@ int hci_dev_open(__u16 dev)
        hci_req_lock(hdev);
+        if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
+                ret = -ENODEV;
+                goto done;
+        }
        if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
                ret = -ERFKILL;
                goto done;
@@ -1849,6 +1854,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
        BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
+        set_bit(HCI_UNREGISTER, &hdev->dev_flags);
        write_lock(&hci_dev_list_lock);
        list_del(&hdev->list);
        write_unlock(&hci_dev_list_lock);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b8e17e4dac8b..94552b33d528 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1308,6 +1308,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
        if (chan->retry_count >= chan->remote_max_tx) {
                l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
                l2cap_chan_unlock(chan);
+                l2cap_chan_put(chan);
                return;
        }
@@ -1316,6 +1317,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
        l2cap_chan_unlock(chan);
+        l2cap_chan_put(chan);
 }
 static void l2cap_retrans_timeout(struct work_struct *work)
@@ -1335,6 +1337,7 @@ static void l2cap_retrans_timeout(struct work_struct *work)
        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
        l2cap_chan_unlock(chan);
+        l2cap_chan_put(chan);
 }
 static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index c4fe583b0af6..29122ed28ea9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -82,7 +82,7 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
        }
        if (la.l2_cid)
-                err = l2cap_add_scid(chan, la.l2_cid);
+                err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
        else
                err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
@@ -123,7 +123,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
        if (la.l2_cid && la.l2_psm)
                return -EINVAL;
-        err = l2cap_chan_connect(chan, la.l2_psm, la.l2_cid, &la.l2_bdaddr);
+        err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
+                                &la.l2_bdaddr);
        if (err)
                return err;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 7fcff8887131..4ef275c69675 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2523,13 +2523,18 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
        if (cp->val) {
                type = PAGE_SCAN_TYPE_INTERLACED;
-                acp.interval = 0x0024;  /* 22.5 msec page scan interval */
+                /* 22.5 msec page scan interval */
+                acp.interval = __constant_cpu_to_le16(0x0024);
        } else {
                type = PAGE_SCAN_TYPE_STANDARD; /* default */
-                acp.interval = 0x0800;  /* default 1.28 sec page scan */
+                /* default 1.28 sec page scan */
+                acp.interval = __constant_cpu_to_le16(0x0800);
        }
-        acp.window = 0x0012;    /* default 11.25 msec page scan window */
+        /* default 11.25 msec page scan window */
+        acp.window = __constant_cpu_to_le16(0x0012);
        err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
                           &acp);
@@ -2936,7 +2941,7 @@ int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                                          name, name_len);
        if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
-                eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
+                eir_len = eir_append_data(ev->eir, eir_len,
                                          EIR_CLASS_OF_DEV, dev_class, 3);
        put_unaligned_le16(eir_len, &ev->eir_len);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 702a1ae9220b..27ca25ed7021 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data)
        hlist_del_rcu(&mp->hlist[mdb->ver]);
        mdb->size--;
-        del_timer(&mp->query_timer);
        call_rcu_bh(&mp->rcu, br_multicast_free_group);
 out:
@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
                rcu_assign_pointer(*pp, p->next);
                hlist_del_init(&p->mglist);
                del_timer(&p->timer);
-                del_timer(&p->query_timer);
                call_rcu_bh(&p->rcu, br_multicast_free_pg);
                if (!mp->ports && !mp->mglist &&
@@ -507,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
        return NULL;
 }
-static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
-{
-        struct net_bridge *br = mp->br;
-        struct sk_buff *skb;
-        skb = br_multicast_alloc_query(br, &mp->addr);
-        if (!skb)
-                goto timer;
-        netif_rx(skb);
-timer:
-        if (++mp->queries_sent < br->multicast_last_member_count)
-                mod_timer(&mp->query_timer,
-                          jiffies + br->multicast_last_member_interval);
-}
-static void br_multicast_group_query_expired(unsigned long data)
-{
-        struct net_bridge_mdb_entry *mp = (void *)data;
-        struct net_bridge *br = mp->br;
-        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || !mp->mglist ||
-            mp->queries_sent >= br->multicast_last_member_count)
-                goto out;
-        br_multicast_send_group_query(mp);
-out:
-        spin_unlock(&br->multicast_lock);
-}
-static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
-{
-        struct net_bridge_port *port = pg->port;
-        struct net_bridge *br = port->br;
-        struct sk_buff *skb;
-        skb = br_multicast_alloc_query(br, &pg->addr);
-        if (!skb)
-                goto timer;
-        br_deliver(port, skb);
-timer:
-        if (++pg->queries_sent < br->multicast_last_member_count)
-                mod_timer(&pg->query_timer,
-                          jiffies + br->multicast_last_member_interval);
-}
-static void br_multicast_port_group_query_expired(unsigned long data)
-{
-        struct net_bridge_port_group *pg = (void *)data;
-        struct net_bridge_port *port = pg->port;
-        struct net_bridge *br = port->br;
-        spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
-            pg->queries_sent >= br->multicast_last_member_count)
-                goto out;
-        br_multicast_send_port_group_query(pg);
-out:
-        spin_unlock(&br->multicast_lock);
-}
 static struct net_bridge_mdb_entry *br_multicast_get_group(
        struct net_bridge *br, struct net_bridge_port *port,
        struct br_ip *group, int hash)
@@ -690,8 +620,6 @@ rehash:
        mp->addr = *group;
        setup_timer(&mp->timer, br_multicast_group_expired,
                    (unsigned long)mp);
-        setup_timer(&mp->query_timer, br_multicast_group_query_expired,
-                    (unsigned long)mp);
        hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
        mdb->size++;
@@ -746,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
        hlist_add_head(&p->mglist, &port->mglist);
        setup_timer(&p->timer, br_multicast_port_group_expired,
                    (unsigned long)p);
-        setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
-                    (unsigned long)p);
        rcu_assign_pointer(*pp, p);
@@ -1291,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                     time_after(mp->timer.expires, time) :
                     try_to_del_timer_sync(&mp->timer) >= 0)) {
                        mod_timer(&mp->timer, time);
-                        mp->queries_sent = 0;
-                        mod_timer(&mp->query_timer, now);
                }
                goto out;
@@ -1310,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
                     time_after(p->timer.expires, time) :
                     try_to_del_timer_sync(&p->timer) >= 0)) {
                        mod_timer(&p->timer, time);
-                        p->queries_sent = 0;
-                        mod_timer(&p->query_timer, now);
                }
                break;
@@ -1681,7 +1601,6 @@ void br_multicast_stop(struct net_bridge *br)
                hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
                                          hlist[ver]) {
                        del_timer(&mp->timer);
-                        del_timer(&mp->query_timer);
                        call_rcu_bh(&mp->rcu, br_multicast_free_group);
                }
        }
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 0b67a63ad7a8..e1d882257877 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -82,9 +82,7 @@ struct net_bridge_port_group {
        struct hlist_node               mglist;
        struct rcu_head                 rcu;
        struct timer_list               timer;
-        struct timer_list               query_timer;
        struct br_ip                    addr;
-        u32                             queries_sent;
 };
 struct net_bridge_mdb_entry
@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry
        struct net_bridge_port_group __rcu *ports;
        struct rcu_head                 rcu;
        struct timer_list               timer;
-        struct timer_list               query_timer;
        struct br_ip                    addr;
        bool                            mglist;
-        u32                             queries_sent;
 };
 struct net_bridge_mdb_htable
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a396a6926238..35b3a685e342 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -951,9 +951,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                goto adjust_others;
        }
-        data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
+        data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
+                       gfp_mask);
        if (!data)
                goto nodata;
+        size = SKB_WITH_OVERHEAD(ksize(data));
        /* Copy only real data... and, alas, header. This should be
         * optimized for the cases when header is void.
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 5c45e30cf788..345c7dc08482 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -74,16 +74,24 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
        iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
        if (iph == NULL)
-                return -NF_DROP;
+                return -NF_ACCEPT;
        /* Conntrack defragments packets, we might still see fragments
         * inside ICMP packets though. */
        if (iph->frag_off & htons(IP_OFFSET))
-                return -NF_DROP;
+                return -NF_ACCEPT;
        *dataoff = nhoff + (iph->ihl << 2);
        *protonum = iph->protocol;
+        /* Check bogus IP headers */
+        if (*dataoff > skb->len) {
+                pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
+                         "nhoff %u, ihl %u, skblen %u\n",
+                         nhoff, iph->ihl << 2, skb->len);
+                return -NF_ACCEPT;
+        }
        return NF_ACCEPT;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5d54ed30e821..8bb6adeb62c0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
        skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
        if (skb) {
                if (sk_wmem_schedule(sk, skb->truesize)) {
+                        skb_reserve(skb, sk->sk_prot->max_header);
                        /*
                         * Make sure that we have exactly size bytes
                         * available to the caller, no more, no less.
                         */
-                        skb_reserve(skb, skb_tailroom(skb) - size);
+                        skb->avail_size = size;
                        return skb;
                }
                __kfree_skb(skb);
@@ -995,10 +996,9 @@ new_segment:
                                copy = seglen;
                        /* Where to copy to? */
-                        if (skb_tailroom(skb) > 0) {
+                        if (skb_availroom(skb) > 0) {
                                /* We have some space in skb head. Superb! */
-                                if (copy > skb_tailroom(skb))
+                                copy = min_t(int, copy, skb_availroom(skb));
-                                        copy = skb_tailroom(skb);
                                err = skb_add_data_nocache(sk, skb, from, copy);
                                if (err)
                                        goto do_fault;
@@ -1452,7 +1452,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                if ((available < target) &&
                    (len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) &&
                    !sysctl_tcp_low_latency &&
-                    dma_find_channel(DMA_MEMCPY)) {
+                    net_dma_find_channel()) {
                        preempt_enable_no_resched();
                        tp->ucopy.pinned_list =
                                        dma_pin_iovec_pages(msg->msg_iov, len);
@@ -1667,7 +1667,7 @@ do_prequeue:
                if (!(flags & MSG_TRUNC)) {
 #ifdef CONFIG_NET_DMA
                        if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                                tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                                tp->ucopy.dma_chan = net_dma_find_channel();
                        if (tp->ucopy.dma_chan) {
                                tp->ucopy.dma_cookie = dma_skb_copy_datagram_iovec(
@@ -3302,8 +3302,7 @@ void __init tcp_init(void)
        tcp_init_mem(&init_net);
        /* Set per-socket limits to no more than 1/128 the pressure threshold */
-        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 10);
+        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 7);
-        limit = max(limit, 128UL);
        max_share = min(4UL*1024*1024, limit);
        sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e886e2f7fa8d..9944c1d9a218 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -474,8 +474,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
                if (!win_dep) {
                        m -= (new_sample >> 3);
                        new_sample += m;
-                } else if (m < new_sample)
+                } else {
-                        new_sample = m << 3;
+                        m <<= 3;
+                        if (m < new_sample)
+                                new_sample = m;
+                }
        } else {
                /* No previous measure. */
                new_sample = m << 3;
@@ -5225,7 +5228,7 @@ static int tcp_dma_try_early_copy(struct sock *sk, struct sk_buff *skb,
                return 0;
        if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                tp->ucopy.dma_chan = net_dma_find_channel();
        if (tp->ucopy.dma_chan && skb_csum_unnecessary(skb)) {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3a25cf743f8b..0cb86ceb652f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1730,7 +1730,7 @@ process:
 #ifdef CONFIG_NET_DMA
                struct tcp_sock *tp = tcp_sk(sk);
                if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                        tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                        tp->ucopy.dma_chan = net_dma_find_channel();
                if (tp->ucopy.dma_chan)
                        ret = tcp_v4_do_rcv(sk, skb);
                else
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 364784a91939..376b2cfbb685 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2060,7 +2060,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
                /* Punt if not enough space exists in the first SKB for
                 * the data in the second
                 */
-                if (skb->len > skb_tailroom(to))
+                if (skb->len > skb_availroom(to))
                        break;
                if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 94874b0bdcdc..9d4e15559319 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -78,19 +78,6 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
   Hence the start of any table is given by get_table() below.  */
-/* Check for an extension */
-int
-ip6t_ext_hdr(u8 nexthdr)
-{
-        return  (nexthdr == IPPROTO_HOPOPTS)   ||
-                (nexthdr == IPPROTO_ROUTING)   ||
-                (nexthdr == IPPROTO_FRAGMENT)  ||
-                (nexthdr == IPPROTO_ESP)       ||
-                (nexthdr == IPPROTO_AH)        ||
-                (nexthdr == IPPROTO_NONE)      ||
-                (nexthdr == IPPROTO_DSTOPTS);
-}
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
@@ -2366,7 +2353,6 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 EXPORT_SYMBOL(ip6t_register_table);
 EXPORT_SYMBOL(ip6t_unregister_table);
 EXPORT_SYMBOL(ip6t_do_table);
-EXPORT_SYMBOL(ip6t_ext_hdr);
 EXPORT_SYMBOL(ipv6_find_hdr);
 module_init(ip6_tables_init);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 12c6ece67f39..86cfe6005f40 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1645,7 +1645,7 @@ process:
 #ifdef CONFIG_NET_DMA
                struct tcp_sock *tp = tcp_sk(sk);
                if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                        tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
+                        tp->ucopy.dma_chan = net_dma_find_channel();
                if (tp->ucopy.dma_chan)
                        ret = tcp_v6_do_rcv(sk, skb);
                else
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 576fb25456dd..f76da5b3f5c5 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3387,8 +3387,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                 */
                printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
                       sdata->name, ifmgd->bssid);
-                assoc_data->timeout = jiffies +
+                assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
-                                TU_TO_EXP_TIME(req->bss->beacon_interval);
        } else {
                assoc_data->have_beacon = true;
                assoc_data->sent_assoc = false;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 6cd8e32e281c..cf0747c5741f 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1593,7 +1593,7 @@ static int nf_conntrack_init_net(struct net *net)
        return 0;
 err_timeout:
-        nf_conntrack_timeout_fini(net);
+        nf_conntrack_ecache_fini(net);
 err_ecache:
        nf_conntrack_tstamp_fini(net);
 err_tstamp:
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index cc558162493b..4dfbfa840f8a 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -584,8 +584,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         * Let's try to use the data from the packet.
                         */
                        sender->td_end = end;
-                        win <<= sender->td_scale;
+                        swin = win << sender->td_scale;
-                        sender->td_maxwin = (win == 0 ? 1 : win);
+                        sender->td_maxwin = (swin == 0 ? 1 : swin);
                        sender->td_maxend = end + sender->td_maxwin;
                        /*
                         * We haven't seen traffic in the other direction yet
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index 7b76eb7192f3..ef10ffcb4b6f 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -474,7 +474,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
        while (remaining_len > 0) {
-                frag_len = min_t(u16, local->remote_miu, remaining_len);
+                frag_len = min_t(size_t, local->remote_miu, remaining_len);
                pr_debug("Fragment %zd bytes remaining %zd",
                         frag_len, remaining_len);
@@ -497,7 +497,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
                release_sock(sk);
                remaining_len -= frag_len;
-                msg_ptr += len;
+                msg_ptr += frag_len;
        }
        kfree(msg_data);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a4aab1d36285..65622e9c7c54 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1332,6 +1332,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                        goto bad_res;
                }
+                if (!netif_running(netdev)) {
+                        result = -ENETDOWN;
+                        goto bad_res;
+                }
                nla_for_each_nested(nl_txq_params,
                                    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
                                    rem_txq_params) {
@@ -6467,7 +6472,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_get_key,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6499,7 +6504,7 @@ static struct genl_ops nl80211_ops[] = {
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
                .doit = nl80211_set_beacon,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6507,7 +6512,7 @@ static struct genl_ops nl80211_ops[] = {
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
                .doit = nl80211_start_ap,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6515,7 +6520,7 @@ static struct genl_ops nl80211_ops[] = {
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
                .doit = nl80211_stop_ap,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6531,7 +6536,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_set_station,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6547,7 +6552,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_del_station,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6580,7 +6585,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_del_mpath,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6588,7 +6593,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_set_bss,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6614,7 +6619,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_get_mesh_config,
                .policy = nl80211_policy,
                /* can be retrieved by unprivileged users */
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6747,7 +6752,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_setdel_pmksa,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6755,7 +6760,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_setdel_pmksa,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6763,7 +6768,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_flush_pmksa,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
@@ -6923,7 +6928,7 @@ static struct genl_ops nl80211_ops[] = {
                .doit = nl80211_probe_client,
                .policy = nl80211_policy,
                .flags = GENL_ADMIN_PERM,
-                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                  NL80211_FLAG_NEED_RTNL,
        },
        {
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 9f544c95171c..22adfebaad27 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -781,8 +781,10 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                if (cmd == SIOCSIWENCODEEXT) {
                        struct iw_encode_ext *ee = (void *) extra;
-                        if (iwp->length < sizeof(*ee) + ee->key_len)
+                        if (iwp->length < sizeof(*ee) + ee->key_len) {
-                                return -EFAULT;
+                                err = -EFAULT;
+                                goto out;
+                        }
                }
        }
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 3f01fd908730..c4e7d1510f9d 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -132,8 +132,10 @@ static struct module *new_module(char *modname)
        /* strip trailing .o */
        s = strrchr(p, '.');
        if (s != NULL)
-                if (strcmp(s, ".o") == 0)
+                if (strcmp(s, ".o") == 0) {
                        *s = '\0';
+                        mod->is_dot_o = 1;
+                }
        /* add to list */
        mod->name = p;
@@ -587,7 +589,8 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
        unsigned int crc;
        enum export export;
-        if (!is_vmlinux(mod->name) && strncmp(symname, "__ksymtab", 9) == 0)
+        if ((!is_vmlinux(mod->name) || mod->is_dot_o) &&
+            strncmp(symname, "__ksymtab", 9) == 0)
                export = export_from_secname(info, get_secindex(info, sym));
        else
                export = export_from_sec(info, get_secindex(info, sym));
diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
index 2031119080dc..51207e4d5f8b 100644
--- a/scripts/mod/modpost.h
+++ b/scripts/mod/modpost.h
@@ -113,6 +113,7 @@ struct module {
        int has_cleanup;
        struct buffer dev_table_buf;
        char         srcversion[25];
+        int is_dot_o;
 };
 struct elf_info {
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 81c03a597112..10056f2f6df3 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1939,18 +1939,19 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
        char *hostsp;
        struct socket_smack *ssp = sk->sk_security;
        struct smk_audit_info ad;
-        struct lsm_network_audit net;
        rcu_read_lock();
        hostsp = smack_host_label(sap);
        if (hostsp != NULL) {
-                sk_lbl = SMACK_UNLABELED_SOCKET;
 #ifdef CONFIG_AUDIT
+                struct lsm_network_audit net;
                smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
                ad.a.u.net->family = sap->sin_family;
                ad.a.u.net->dport = sap->sin_port;
                ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr;
 #endif
+                sk_lbl = SMACK_UNLABELED_SOCKET;
                rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE, &ad);
        } else {
                sk_lbl = SMACK_CIPSO_SOCKET;
@@ -2809,11 +2810,14 @@ static int smack_unix_stream_connect(struct sock *sock,
        struct socket_smack *osp = other->sk_security;
        struct socket_smack *nsp = newsk->sk_security;
        struct smk_audit_info ad;
-        struct lsm_network_audit net;
        int rc = 0;
+#ifdef CONFIG_AUDIT
+        struct lsm_network_audit net;
        smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
        smk_ad_setfield_u_net_sk(&ad, other);
+#endif
        if (!capable(CAP_MAC_OVERRIDE))
                rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
@@ -2842,11 +2846,14 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
        struct socket_smack *ssp = sock->sk->sk_security;
        struct socket_smack *osp = other->sk->sk_security;
        struct smk_audit_info ad;
-        struct lsm_network_audit net;
        int rc = 0;
+#ifdef CONFIG_AUDIT
+        struct lsm_network_audit net;
        smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
        smk_ad_setfield_u_net_sk(&ad, other->sk);
+#endif
        if (!capable(CAP_MAC_OVERRIDE))
                rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
@@ -2993,7 +3000,9 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
        char *csp;
        int rc;
        struct smk_audit_info ad;
+#ifdef CONFIG_AUDIT
        struct lsm_network_audit net;
+#endif
        if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
                return 0;
@@ -3156,7 +3165,9 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
        char *sp;
        int rc;
        struct smk_audit_info ad;
+#ifdef CONFIG_AUDIT
        struct lsm_network_audit net;
+#endif
        /* handle mapped IPv4 packets arriving via IPv6 sockets */
        if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
diff --git a/sound/isa/sscape.c b/sound/isa/sscape.c
index b4a6aa960f4b..8490f59709bb 100644
--- a/sound/isa/sscape.c
+++ b/sound/isa/sscape.c
@@ -1019,13 +1019,15 @@ static int __devinit create_sscape(int dev, struct snd_card *card)
        irq_cfg = get_irq_config(sscape->type, irq[dev]);
        if (irq_cfg == INVALID_IRQ) {
                snd_printk(KERN_ERR "sscape: Invalid IRQ %d\n", irq[dev]);
-                return -ENXIO;
+                err = -ENXIO;
+                goto _release_dma;
        }
        mpu_irq_cfg = get_irq_config(sscape->type, mpu_irq[dev]);
        if (mpu_irq_cfg == INVALID_IRQ) {
                snd_printk(KERN_ERR "sscape: Invalid IRQ %d\n", mpu_irq[dev]);
-                return -ENXIO;
+                err = -ENXIO;
+                goto _release_dma;
        }
        /*
diff --git a/sound/oss/msnd_pinnacle.c b/sound/oss/msnd_pinnacle.c
index 2c79d60a725f..536c4c0514d3 100644
--- a/sound/oss/msnd_pinnacle.c
+++ b/sound/oss/msnd_pinnacle.c
@@ -1294,6 +1294,8 @@ static int __init calibrate_adc(WORD srate)
 static int upload_dsp_code(void)
 {
+        int ret = 0;
        msnd_outb(HPBLKSEL_0, dev.io + HP_BLKS);
 #ifndef HAVE_DSPCODEH
        INITCODESIZE = mod_firmware_load(INITCODEFILE, &INITCODE);
@@ -1312,7 +1314,8 @@ static int upload_dsp_code(void)
        memcpy_toio(dev.base, PERMCODE, PERMCODESIZE);
        if (msnd_upload_host(&dev, INITCODE, INITCODESIZE) < 0) {
                printk(KERN_WARNING LOGNAME ": Error uploading to DSP\n");
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out;
        }
 #ifdef HAVE_DSPCODEH
        printk(KERN_INFO LOGNAME ": DSP firmware uploaded (resident)\n");
@@ -1320,12 +1323,13 @@ static int upload_dsp_code(void)
        printk(KERN_INFO LOGNAME ": DSP firmware uploaded\n");
 #endif
+out:
 #ifndef HAVE_DSPCODEH
        vfree(INITCODE);
        vfree(PERMCODE);
 #endif
-        return 0;
+        return ret;
 }
 #ifdef MSND_CLASSIC
diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
index 88168044375f..5ca0939e4223 100644
--- a/sound/pci/Kconfig
+++ b/sound/pci/Kconfig
@@ -2,8 +2,8 @@
 config SND_TEA575X
        tristate
-        depends on SND_FM801_TEA575X_BOOL || SND_ES1968_RADIO || RADIO_SF16FMR2
+        depends on SND_FM801_TEA575X_BOOL || SND_ES1968_RADIO || RADIO_SF16FMR2 || RADIO_MAXIRADIO
-        default SND_FM801 || SND_ES1968 || RADIO_SF16FMR2
+        default SND_FM801 || SND_ES1968 || RADIO_SF16FMR2 || RADIO_MAXIRADIO
 menuconfig SND_PCI
        bool "PCI sound devices"
diff --git a/sound/pci/asihpi/hpi_internal.h b/sound/pci/asihpi/hpi_internal.h
index 8c63200cf339..bc86cb726d79 100644
--- a/sound/pci/asihpi/hpi_internal.h
+++ b/sound/pci/asihpi/hpi_internal.h
@@ -1,7 +1,7 @@
 /******************************************************************************
    AudioScience HPI driver
-    Copyright (C) 1997-2011  AudioScience Inc. <support@audioscience.com>
+    Copyright (C) 1997-2012  AudioScience Inc. <support@audioscience.com>
    This program is free software; you can redistribute it and/or modify
    it under the terms of version 2 of the GNU General Public License as
@@ -42,7 +42,7 @@ On error *pLockedMemHandle marked invalid, non-zero returned.
 If this function succeeds, then HpiOs_LockedMem_GetVirtAddr() and
 HpiOs_LockedMem_GetPyhsAddr() will always succed on the returned handle.
 */
-int hpios_locked_mem_alloc(struct consistent_dma_area *p_locked_mem_handle,
+u16 hpios_locked_mem_alloc(struct consistent_dma_area *p_locked_mem_handle,
                                                           /**< memory handle */
        u32 size, /**< Size in bytes to allocate */
        struct pci_dev *p_os_reference
diff --git a/sound/pci/asihpi/hpios.c b/sound/pci/asihpi/hpios.c
index 87f4385fe8c7..5ef4fe964366 100644
--- a/sound/pci/asihpi/hpios.c
+++ b/sound/pci/asihpi/hpios.c
@@ -1,7 +1,7 @@
 /******************************************************************************
    AudioScience HPI driver
-    Copyright (C) 1997-2011  AudioScience Inc. <support@audioscience.com>
+    Copyright (C) 1997-2012  AudioScience Inc. <support@audioscience.com>
    This program is free software; you can redistribute it and/or modify
    it under the terms of version 2 of the GNU General Public License as
@@ -39,11 +39,11 @@ void hpios_delay_micro_seconds(u32 num_micro_sec)
 }
-/** Allocated an area of locked memory for bus master DMA operations.
+/** Allocate an area of locked memory for bus master DMA operations.
-On error, return -ENOMEM, and *pMemArea.size = 0
+If allocation fails, return 1, and *pMemArea.size = 0
 */
-int hpios_locked_mem_alloc(struct consistent_dma_area *p_mem_area, u32 size,
+u16 hpios_locked_mem_alloc(struct consistent_dma_area *p_mem_area, u32 size,
        struct pci_dev *pdev)
 {
        /*?? any benefit in using managed dmam_alloc_coherent? */
@@ -62,7 +62,7 @@ int hpios_locked_mem_alloc(struct consistent_dma_area *p_mem_area, u32 size,
                HPI_DEBUG_LOG(WARNING,
                        "failed to allocate %d bytes locked memory\n", size);
                p_mem_area->size = 0;
-                return -ENOMEM;
+                return 1;
        }
 }
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 9a9f372e1be4..56b4f74c0b13 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -851,6 +851,9 @@ struct hda_codec {
        unsigned int pin_amp_workaround:1; /* pin out-amp takes index
                                            * (e.g. Conexant codecs)
                                            */
+        unsigned int single_adc_amp:1; /* adc in-amp takes no index
+                                        * (e.g. CX20549 codec)
+                                        */
        unsigned int no_sticky_stream:1; /* no sticky-PCM stream assignment */
        unsigned int pins_shutup:1;     /* pins are shut up */
        unsigned int no_trigger_sense:1; /* don't trigger at pin-sensing */
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index b58b4b1687fa..4c054f4486b9 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -418,7 +418,7 @@ static void hdmi_show_short_audio_desc(struct cea_sad *a)
        else
                buf2[0] = '\0';
-        printk(KERN_INFO "HDMI: supports coding type %s:"
+        _snd_printd(SND_PR_VERBOSE, "HDMI: supports coding type %s:"
                        " channels = %d, rates =%s%s\n",
                        cea_audio_coding_type_names[a->format],
                        a->channels,
@@ -442,14 +442,14 @@ void snd_hdmi_show_eld(struct hdmi_eld *e)
 {
        int i;
-        printk(KERN_INFO "HDMI: detected monitor %s at connection type %s\n",
+        _snd_printd(SND_PR_VERBOSE, "HDMI: detected monitor %s at connection type %s\n",
                        e->monitor_name,
                        eld_connection_type_names[e->conn_type]);
        if (e->spk_alloc) {
                char buf[SND_PRINT_CHANNEL_ALLOCATION_ADVISED_BUFSIZE];
                snd_print_channel_allocation(e->spk_alloc, buf, sizeof(buf));
-                printk(KERN_INFO "HDMI: available speakers:%s\n", buf);
+                _snd_printd(SND_PR_VERBOSE, "HDMI: available speakers:%s\n", buf);
        }
        for (i = 0; i < e->sad_count; i++)
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index 254ab5204603..e59e2f059b6e 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -651,9 +651,16 @@ static void print_codec_info(struct snd_info_entry *entry,
                        snd_iprintf(buffer, "  Amp-In caps: ");
                        print_amp_caps(buffer, codec, nid, HDA_INPUT);
                        snd_iprintf(buffer, "  Amp-In vals: ");
-                        print_amp_vals(buffer, codec, nid, HDA_INPUT,
+                        if (wid_type == AC_WID_PIN ||
-                                       wid_caps & AC_WCAP_STEREO,
+                            (codec->single_adc_amp &&
-                                       wid_type == AC_WID_PIN ? 1 : conn_len);
+                             wid_type == AC_WID_AUD_IN))
+                                print_amp_vals(buffer, codec, nid, HDA_INPUT,
+                                               wid_caps & AC_WCAP_STEREO,
+                                               1);
+                        else
+                                print_amp_vals(buffer, codec, nid, HDA_INPUT,
+                                               wid_caps & AC_WCAP_STEREO,
+                                               conn_len);
                }
                if (wid_caps & AC_WCAP_OUT_AMP) {
                        snd_iprintf(buffer, "  Amp-Out caps: ");
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 8c6523bbc797..a36488d94aaa 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -141,7 +141,6 @@ struct conexant_spec {
        unsigned int hp_laptop:1;
        unsigned int asus:1;
        unsigned int pin_eapd_ctrls:1;
-        unsigned int single_adc_amp:1;
        unsigned int adc_switching:1;
@@ -687,27 +686,26 @@ static const struct hda_channel_mode cxt5045_modes[1] = {
 static const struct hda_input_mux cxt5045_capture_source = {
        .num_items = 2,
        .items = {
-                { "IntMic", 0x1 },
+                { "Internal Mic", 0x1 },
-                { "ExtMic", 0x2 },
+                { "Mic",          0x2 },
        }
 };
 static const struct hda_input_mux cxt5045_capture_source_benq = {
-        .num_items = 5,
+        .num_items = 4,
        .items = {
-                { "IntMic", 0x1 },
+                { "Internal Mic", 0x1 },
-                { "ExtMic", 0x2 },
+                { "Mic",          0x2 },
-                { "LineIn", 0x3 },
+                { "Line",         0x3 },
-                { "CD",     0x4 },
+                { "Mixer",        0x0 },
-                { "Mixer",  0x0 },
        }
 };
 static const struct hda_input_mux cxt5045_capture_source_hp530 = {
        .num_items = 2,
        .items = {
-                { "ExtMic", 0x1 },
+                { "Mic",          0x1 },
-                { "IntMic", 0x2 },
+                { "Internal Mic", 0x2 },
        }
 };
@@ -798,10 +796,8 @@ static void cxt5045_hp_unsol_event(struct hda_codec *codec,
 }
 static const struct snd_kcontrol_new cxt5045_mixers[] = {
-        HDA_CODEC_VOLUME("Internal Mic Capture Volume", 0x1a, 0x01, HDA_INPUT),
+        HDA_CODEC_VOLUME("Capture Volume", 0x1a, 0x00, HDA_INPUT),
-        HDA_CODEC_MUTE("Internal Mic Capture Switch", 0x1a, 0x01, HDA_INPUT),
+        HDA_CODEC_MUTE("Capture Switch", 0x1a, 0x0, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mic Capture Volume", 0x1a, 0x02, HDA_INPUT),
-        HDA_CODEC_MUTE("Mic Capture Switch", 0x1a, 0x02, HDA_INPUT),
        HDA_CODEC_VOLUME("PCM Playback Volume", 0x17, 0x0, HDA_INPUT),
        HDA_CODEC_MUTE("PCM Playback Switch", 0x17, 0x0, HDA_INPUT),
        HDA_CODEC_VOLUME("Internal Mic Playback Volume", 0x17, 0x1, HDA_INPUT),
@@ -822,27 +818,15 @@ static const struct snd_kcontrol_new cxt5045_mixers[] = {
 };
 static const struct snd_kcontrol_new cxt5045_benq_mixers[] = {
-        HDA_CODEC_VOLUME("CD Capture Volume", 0x1a, 0x04, HDA_INPUT),
+        HDA_CODEC_VOLUME("Line Playback Volume", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_MUTE("CD Capture Switch", 0x1a, 0x04, HDA_INPUT),
+        HDA_CODEC_MUTE("Line Playback Switch", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_VOLUME("CD Playback Volume", 0x17, 0x4, HDA_INPUT),
-        HDA_CODEC_MUTE("CD Playback Switch", 0x17, 0x4, HDA_INPUT),
-        HDA_CODEC_VOLUME("Line In Capture Volume", 0x1a, 0x03, HDA_INPUT),
-        HDA_CODEC_MUTE("Line In Capture Switch", 0x1a, 0x03, HDA_INPUT),
-        HDA_CODEC_VOLUME("Line In Playback Volume", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_MUTE("Line In Playback Switch", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer Capture Volume", 0x1a, 0x0, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer Capture Switch", 0x1a, 0x0, HDA_INPUT),
        {}
 };
 static const struct snd_kcontrol_new cxt5045_mixers_hp530[] = {
-        HDA_CODEC_VOLUME("Internal Mic Capture Volume", 0x1a, 0x02, HDA_INPUT),
+        HDA_CODEC_VOLUME("Capture Volume", 0x1a, 0x00, HDA_INPUT),
-        HDA_CODEC_MUTE("Internal Mic Capture Switch", 0x1a, 0x02, HDA_INPUT),
+        HDA_CODEC_MUTE("Capture Switch", 0x1a, 0x0, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mic Capture Volume", 0x1a, 0x01, HDA_INPUT),
-        HDA_CODEC_MUTE("Mic Capture Switch", 0x1a, 0x01, HDA_INPUT),
        HDA_CODEC_VOLUME("PCM Playback Volume", 0x17, 0x0, HDA_INPUT),
        HDA_CODEC_MUTE("PCM Playback Switch", 0x17, 0x0, HDA_INPUT),
        HDA_CODEC_VOLUME("Internal Mic Playback Volume", 0x17, 0x2, HDA_INPUT),
@@ -946,10 +930,10 @@ static const struct snd_kcontrol_new cxt5045_test_mixer[] = {
        /* Output controls */
        HDA_CODEC_VOLUME("Speaker Playback Volume", 0x10, 0x0, HDA_OUTPUT),
        HDA_CODEC_MUTE("Speaker Playback Switch", 0x10, 0x0, HDA_OUTPUT),
-        HDA_CODEC_VOLUME("Node 11 Playback Volume", 0x11, 0x0, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("HP-OUT Playback Volume", 0x11, 0x0, HDA_OUTPUT),
-        HDA_CODEC_MUTE("Node 11 Playback Switch", 0x11, 0x0, HDA_OUTPUT),
+        HDA_CODEC_MUTE("HP-OUT Playback Switch", 0x11, 0x0, HDA_OUTPUT),
-        HDA_CODEC_VOLUME("Node 12 Playback Volume", 0x12, 0x0, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("LINE1 Playback Volume", 0x12, 0x0, HDA_OUTPUT),
-        HDA_CODEC_MUTE("Node 12 Playback Switch", 0x12, 0x0, HDA_OUTPUT),
+        HDA_CODEC_MUTE("LINE1 Playback Switch", 0x12, 0x0, HDA_OUTPUT),
        
        /* Modes for retasking pin widgets */
        CXT_PIN_MODE("HP-OUT pin mode", 0x11, CXT_PIN_DIR_INOUT),
@@ -960,16 +944,16 @@ static const struct snd_kcontrol_new cxt5045_test_mixer[] = {
        /* Loopback mixer controls */
-        HDA_CODEC_VOLUME("Mixer-1 Volume", 0x17, 0x0, HDA_INPUT),
+        HDA_CODEC_VOLUME("PCM Volume", 0x17, 0x0, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-1 Switch", 0x17, 0x0, HDA_INPUT),
+        HDA_CODEC_MUTE("PCM Switch", 0x17, 0x0, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer-2 Volume", 0x17, 0x1, HDA_INPUT),
+        HDA_CODEC_VOLUME("MIC1 pin Volume", 0x17, 0x1, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-2 Switch", 0x17, 0x1, HDA_INPUT),
+        HDA_CODEC_MUTE("MIC1 pin Switch", 0x17, 0x1, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer-3 Volume", 0x17, 0x2, HDA_INPUT),
+        HDA_CODEC_VOLUME("LINE1 pin Volume", 0x17, 0x2, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-3 Switch", 0x17, 0x2, HDA_INPUT),
+        HDA_CODEC_MUTE("LINE1 pin Switch", 0x17, 0x2, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer-4 Volume", 0x17, 0x3, HDA_INPUT),
+        HDA_CODEC_VOLUME("HP-OUT pin Volume", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-4 Switch", 0x17, 0x3, HDA_INPUT),
+        HDA_CODEC_MUTE("HP-OUT pin Switch", 0x17, 0x3, HDA_INPUT),
-        HDA_CODEC_VOLUME("Mixer-5 Volume", 0x17, 0x4, HDA_INPUT),
+        HDA_CODEC_VOLUME("CD pin Volume", 0x17, 0x4, HDA_INPUT),
-        HDA_CODEC_MUTE("Mixer-5 Switch", 0x17, 0x4, HDA_INPUT),
+        HDA_CODEC_MUTE("CD pin Switch", 0x17, 0x4, HDA_INPUT),
        {
                .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
                .name = "Input Source",
@@ -978,16 +962,8 @@ static const struct snd_kcontrol_new cxt5045_test_mixer[] = {
                .put = conexant_mux_enum_put,
        },
        /* Audio input controls */
-        HDA_CODEC_VOLUME("Input-1 Volume", 0x1a, 0x0, HDA_INPUT),
+        HDA_CODEC_VOLUME("Capture Volume", 0x1a, 0x0, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-1 Switch", 0x1a, 0x0, HDA_INPUT),
+        HDA_CODEC_MUTE("Capture Switch", 0x1a, 0x0, HDA_INPUT),
-        HDA_CODEC_VOLUME("Input-2 Volume", 0x1a, 0x1, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-2 Switch", 0x1a, 0x1, HDA_INPUT),
-        HDA_CODEC_VOLUME("Input-3 Volume", 0x1a, 0x2, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-3 Switch", 0x1a, 0x2, HDA_INPUT),
-        HDA_CODEC_VOLUME("Input-4 Volume", 0x1a, 0x3, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-4 Switch", 0x1a, 0x3, HDA_INPUT),
-        HDA_CODEC_VOLUME("Input-5 Volume", 0x1a, 0x4, HDA_INPUT),
-        HDA_CODEC_MUTE("Input-5 Switch", 0x1a, 0x4, HDA_INPUT),
        { } /* end */
 };
@@ -1009,10 +985,6 @@ static const struct hda_verb cxt5045_test_init_verbs[] = {
        {0x13, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
        {0x18, AC_VERB_SET_DIGI_CONVERT_1, 0},
-        /* Start with output sum widgets muted and their output gains at min */
-        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
-        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)},
        /* Unmute retasking pin widget output buffers since the default
         * state appears to be output.  As the pin mode is changed by the
         * user the pin mode control will take care of enabling the pin's
@@ -1027,11 +999,11 @@ static const struct hda_verb cxt5045_test_init_verbs[] = {
        /* Set ADC connection select to match default mixer setting (mic1
         * pin)
         */
-        {0x1a, AC_VERB_SET_CONNECT_SEL, 0x00},
+        {0x1a, AC_VERB_SET_CONNECT_SEL, 0x01},
-        {0x17, AC_VERB_SET_CONNECT_SEL, 0x00},
+        {0x17, AC_VERB_SET_CONNECT_SEL, 0x01},
        /* Mute all inputs to mixer widget (even unconnected ones) */
-        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)}, /* Mixer pin */
+        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)}, /* Mixer */
        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)}, /* Mic1 pin */
        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(2)}, /* Line pin */
        {0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(3)}, /* HP pin */
@@ -1110,7 +1082,7 @@ static int patch_cxt5045(struct hda_codec *codec)
        if (!spec)
                return -ENOMEM;
        codec->spec = spec;
-        codec->pin_amp_workaround = 1;
+        codec->single_adc_amp = 1;
        spec->multiout.max_channels = 2;
        spec->multiout.num_dacs = ARRAY_SIZE(cxt5045_dac_nids);
@@ -4220,7 +4192,7 @@ static int cx_auto_add_capture_volume(struct hda_codec *codec, hda_nid_t nid,
                int idx = get_input_connection(codec, adc_nid, nid);
                if (idx < 0)
                        continue;
-                if (spec->single_adc_amp)
+                if (codec->single_adc_amp)
                        idx = 0;
                return cx_auto_add_volume_idx(codec, label, pfx,
                                              cidx, adc_nid, HDA_INPUT, idx);
@@ -4275,7 +4247,7 @@ static int cx_auto_build_input_controls(struct hda_codec *codec)
                if (cidx < 0)
                        continue;
                input_conn[i] = spec->imux_info[i].adc;
-                if (!spec->single_adc_amp)
+                if (!codec->single_adc_amp)
                        input_conn[i] |= cidx << 8;
                if (i > 0 && input_conn[i] != input_conn[0])
                        multi_connection = 1;
@@ -4466,15 +4438,17 @@ static int patch_conexant_auto(struct hda_codec *codec)
        if (!spec)
                return -ENOMEM;
        codec->spec = spec;
-        codec->pin_amp_workaround = 1;
        switch (codec->vendor_id) {
        case 0x14f15045:
-                spec->single_adc_amp = 1;
+                codec->single_adc_amp = 1;
                break;
        case 0x14f15051:
                add_cx5051_fake_mutes(codec);
+                codec->pin_amp_workaround = 1;
                break;
+        default:
+                codec->pin_amp_workaround = 1;
        }
        apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 540cd13f7f15..83f345f3c961 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -757,8 +757,6 @@ static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
        struct hdmi_spec *spec = codec->spec;
        int tag = res >> AC_UNSOL_RES_TAG_SHIFT;
        int pin_nid;
-        int pd = !!(res & AC_UNSOL_RES_PD);
-        int eldv = !!(res & AC_UNSOL_RES_ELDV);
        int pin_idx;
        struct hda_jack_tbl *jack;
@@ -768,9 +766,10 @@ static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
        pin_nid = jack->nid;
        jack->jack_dirty = 1;
-        printk(KERN_INFO
+        _snd_printd(SND_PR_VERBOSE,
                "HDMI hot plug event: Codec=%d Pin=%d Presence_Detect=%d ELD_Valid=%d\n",
-                codec->addr, pin_nid, pd, eldv);
+                codec->addr, pin_nid,
+                !!(res & AC_UNSOL_RES_PD), !!(res & AC_UNSOL_RES_ELDV));
        pin_idx = pin_nid_to_pin_index(spec, pin_nid);
        if (pin_idx < 0)
@@ -992,7 +991,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
        if (eld->monitor_present)
                eld_valid       = !!(present & AC_PINSENSE_ELDV);
-        printk(KERN_INFO
+        _snd_printd(SND_PR_VERBOSE,
                "HDMI status: Codec=%d Pin=%d Presence_Detect=%d ELD_Valid=%d\n",
                codec->addr, pin_nid, eld->monitor_present, eld_valid);
diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
index f8e10ced244a..b3e24f289421 100644
--- a/sound/soc/codecs/ak4642.c
+++ b/sound/soc/codecs/ak4642.c
@@ -140,7 +140,7 @@
 * min : 0xFE : -115.0 dB
 * mute: 0xFF
 */
-static const DECLARE_TLV_DB_SCALE(out_tlv, -11500, 50, 1);
+static const DECLARE_TLV_DB_SCALE(out_tlv, -11550, 50, 1);
 static const struct snd_kcontrol_new ak4642_snd_controls[] = {
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index d1926266fe00..8e92fb88ed09 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -143,11 +143,11 @@ static int mic_bias_event(struct snd_soc_dapm_widget *w,
 }
 /*
- * using codec assist to small pop, hp_powerup or lineout_powerup
+ * As manual described, ADC/DAC only works when VAG powerup,
- * should stay setting until vag_powerup is fully ramped down,
+ * So enabled VAG before ADC/DAC up.
- * vag fully ramped down require 400ms.
+ * In power down case, we need wait 400ms when vag fully ramped down.
 */
-static int small_pop_event(struct snd_soc_dapm_widget *w,
+static int power_vag_event(struct snd_soc_dapm_widget *w,
        struct snd_kcontrol *kcontrol, int event)
 {
        switch (event) {
@@ -156,7 +156,7 @@ static int small_pop_event(struct snd_soc_dapm_widget *w,
                        SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP);
                break;
-        case SND_SOC_DAPM_PRE_PMD:
+        case SND_SOC_DAPM_POST_PMD:
                snd_soc_update_bits(w->codec, SGTL5000_CHIP_ANA_POWER,
                        SGTL5000_VAG_POWERUP, 0);
                msleep(400);
@@ -201,12 +201,8 @@ static const struct snd_soc_dapm_widget sgtl5000_dapm_widgets[] = {
                                mic_bias_event,
                                SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
-        SND_SOC_DAPM_PGA_E("HP", SGTL5000_CHIP_ANA_POWER, 4, 0, NULL, 0,
+        SND_SOC_DAPM_PGA("HP", SGTL5000_CHIP_ANA_POWER, 4, 0, NULL, 0),
-                        small_pop_event,
+        SND_SOC_DAPM_PGA("LO", SGTL5000_CHIP_ANA_POWER, 0, 0, NULL, 0),
-                        SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
-        SND_SOC_DAPM_PGA_E("LO", SGTL5000_CHIP_ANA_POWER, 0, 0, NULL, 0,
-                        small_pop_event,
-                        SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
        SND_SOC_DAPM_MUX("Capture Mux", SND_SOC_NOPM, 0, 0, &adc_mux),
        SND_SOC_DAPM_MUX("Headphone Mux", SND_SOC_NOPM, 0, 0, &dac_mux),
@@ -221,8 +217,11 @@ static const struct snd_soc_dapm_widget sgtl5000_dapm_widgets[] = {
                                0, SGTL5000_CHIP_DIG_POWER,
                                1, 0),
-        SND_SOC_DAPM_ADC("ADC", "Capture", SGTL5000_CHIP_ANA_POWER, 1, 0),
+        SND_SOC_DAPM_SUPPLY("VAG_POWER", SGTL5000_CHIP_ANA_POWER, 7, 0,
+                            power_vag_event,
+                            SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+        SND_SOC_DAPM_ADC("ADC", "Capture", SGTL5000_CHIP_ANA_POWER, 1, 0),
        SND_SOC_DAPM_DAC("DAC", "Playback", SGTL5000_CHIP_ANA_POWER, 3, 0),
 };
@@ -231,9 +230,11 @@ static const struct snd_soc_dapm_route sgtl5000_dapm_routes[] = {
        {"Capture Mux", "LINE_IN", "LINE_IN"},  /* line_in --> adc_mux */
        {"Capture Mux", "MIC_IN", "MIC_IN"},    /* mic_in --> adc_mux */
+        {"ADC", NULL, "VAG_POWER"},
        {"ADC", NULL, "Capture Mux"},           /* adc_mux --> adc */
        {"AIFOUT", NULL, "ADC"},                /* adc --> i2s_out */
+        {"DAC", NULL, "VAG_POWER"},
        {"DAC", NULL, "AIFIN"},                 /* i2s-->dac,skip audio mux */
        {"Headphone Mux", "DAC", "DAC"},        /* dac --> hp_mux */
        {"LO", NULL, "DAC"},                    /* dac --> line_out */
diff --git a/sound/soc/imx/imx-audmux.c b/sound/soc/imx/imx-audmux.c
index 1765a197acb0..f23700359c67 100644
--- a/sound/soc/imx/imx-audmux.c
+++ b/sound/soc/imx/imx-audmux.c
@@ -73,6 +73,9 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,
        if (!buf)
                return -ENOMEM;
+        if (!audmux_base)
+                return -ENOSYS;
        if (audmux_clk)
                clk_prepare_enable(audmux_clk);
@@ -152,7 +155,7 @@ static void __init audmux_debugfs_init(void)
                return;
        }
-        for (i = 1; i < 8; i++) {
+        for (i = 0; i < MX31_AUDMUX_PORT6_SSI_PINS_6 + 1; i++) {
                snprintf(buf, sizeof(buf), "ssi%d", i);
                if (!debugfs_create_file(buf, 0444, audmux_debugfs_root,
                                         (void *)i, &audmux_debugfs_fops))
diff --git a/sound/soc/pxa/pxa2xx-i2s.c b/sound/soc/pxa/pxa2xx-i2s.c
index 609abd51e55f..d08583790d23 100644
--- a/sound/soc/pxa/pxa2xx-i2s.c
+++ b/sound/soc/pxa/pxa2xx-i2s.c
@@ -17,6 +17,7 @@
 #include <linux/delay.h>
 #include <linux/clk.h>
 #include <linux/platform_device.h>
+#include <linux/io.h>
 #include <sound/core.h>
 #include <sound/pcm.h>
 #include <sound/initval.h>
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index e19c24ade414..accdcb7d4d9d 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1081,6 +1081,8 @@ static int soc_probe_platform(struct snd_soc_card *card,
                snd_soc_dapm_new_controls(&platform->dapm,
                        driver->dapm_widgets, driver->num_dapm_widgets);
+        platform->dapm.idle_bias_off = 1;
        if (driver->probe) {
                ret = driver->probe(platform);
                if (ret < 0) {
diff --git a/sound/soc/tegra/tegra_i2s.c b/sound/soc/tegra/tegra_i2s.c
index 33509de52540..e53349912b2e 100644
--- a/sound/soc/tegra/tegra_i2s.c
+++ b/sound/soc/tegra/tegra_i2s.c
@@ -79,11 +79,15 @@ static int tegra_i2s_show(struct seq_file *s, void *unused)
        struct tegra_i2s *i2s = s->private;
        int i;
+        clk_enable(i2s->clk_i2s);
        for (i = 0; i < ARRAY_SIZE(regs); i++) {
                u32 val = tegra_i2s_read(i2s, regs[i].offset);
                seq_printf(s, "%s = %08x\n", regs[i].name, val);
        }
+        clk_disable(i2s->clk_i2s);
        return 0;
 }
@@ -112,7 +116,7 @@ static void tegra_i2s_debug_remove(struct tegra_i2s *i2s)
                debugfs_remove(i2s->debug);
 }
 #else
-static inline void tegra_i2s_debug_add(struct tegra_i2s *i2s, int id)
+static inline void tegra_i2s_debug_add(struct tegra_i2s *i2s)
 {
 }
diff --git a/sound/soc/tegra/tegra_spdif.c b/sound/soc/tegra/tegra_spdif.c
index 475428cf270e..9ff2c601445f 100644
--- a/sound/soc/tegra/tegra_spdif.c
+++ b/sound/soc/tegra/tegra_spdif.c
@@ -79,11 +79,15 @@ static int tegra_spdif_show(struct seq_file *s, void *unused)
        struct tegra_spdif *spdif = s->private;
        int i;
+        clk_enable(spdif->clk_spdif_out);
        for (i = 0; i < ARRAY_SIZE(regs); i++) {
                u32 val = tegra_spdif_read(spdif, regs[i].offset);
                seq_printf(s, "%s = %08x\n", regs[i].name, val);
        }
+        clk_disable(spdif->clk_spdif_out);
        return 0;
 }