Merge branch 'for-2.6.34-incoming' into for-2.6.35-incoming

424 files changed, 3779 insertions, 2240 deletions

diff --git a/Documentation/DocBook/libata.tmpl b/Documentation/DocBook/libata.tmpl
index ba997577150..ff3e5bec1c2 100644
--- a/Documentation/DocBook/libata.tmpl
+++ b/Documentation/DocBook/libata.tmpl
@@ -107,10 +107,6 @@ void (*dev_config) (struct ata_port *, struct ata_device *);
         issue of SET FEATURES - XFER MODE, and prior to operation.
         </para>
         <para>
-        Called by ata_device_add() after ata_dev_identify() determines
-        a device is present.
-        </para>
-        <para>
         This entry may be specified as NULL in ata_port_operations.
         </para>
 
@@ -154,8 +150,8 @@ unsigned int (*mode_filter) (struct ata_port *, struct ata_device *, unsigned in
 
         <sect2><title>Taskfile read/write</title>
         <programlisting>
-void (*tf_load) (struct ata_port *ap, struct ata_taskfile *tf);
-void (*tf_read) (struct ata_port *ap, struct ata_taskfile *tf);
+void (*sff_tf_load) (struct ata_port *ap, struct ata_taskfile *tf);
+void (*sff_tf_read) (struct ata_port *ap, struct ata_taskfile *tf);
         </programlisting>
 
         <para>
@@ -164,36 +160,35 @@ void (*tf_read) (struct ata_port *ap, struct ata_taskfile *tf);
         hardware registers / DMA buffers, to obtain the current set of
         taskfile register values.
         Most drivers for taskfile-based hardware (PIO or MMIO) use
-        ata_tf_load() and ata_tf_read() for these hooks.
+        ata_sff_tf_load() and ata_sff_tf_read() for these hooks.
         </para>
 
         </sect2>
 
         <sect2><title>PIO data read/write</title>
         <programlisting>
-void (*data_xfer) (struct ata_device *, unsigned char *, unsigned int, int);
+void (*sff_data_xfer) (struct ata_device *, unsigned char *, unsigned int, int);
         </programlisting>
 
         <para>
 All bmdma-style drivers must implement this hook.  This is the low-level
 operation that actually copies the data bytes during a PIO data
 transfer.
-Typically the driver
-will choose one of ata_pio_data_xfer_noirq(), ata_pio_data_xfer(), or
-ata_mmio_data_xfer().
+Typically the driver will choose one of ata_sff_data_xfer_noirq(),
+ata_sff_data_xfer(), or ata_sff_data_xfer32().
         </para>
 
         </sect2>
 
         <sect2><title>ATA command execute</title>
         <programlisting>
-void (*exec_command)(struct ata_port *ap, struct ata_taskfile *tf);
+void (*sff_exec_command)(struct ata_port *ap, struct ata_taskfile *tf);
         </programlisting>
 
         <para>
         causes an ATA command, previously loaded with
         ->tf_load(), to be initiated in hardware.
-        Most drivers for taskfile-based hardware use ata_exec_command()
+        Most drivers for taskfile-based hardware use ata_sff_exec_command()
         for this hook.
         </para>
 
@@ -218,8 +213,8 @@ command.
 
         <sect2><title>Read specific ATA shadow registers</title>
         <programlisting>
-u8   (*check_status)(struct ata_port *ap);
-u8   (*check_altstatus)(struct ata_port *ap);
+u8   (*sff_check_status)(struct ata_port *ap);
+u8   (*sff_check_altstatus)(struct ata_port *ap);
         </programlisting>
 
         <para>
@@ -227,20 +222,14 @@ u8   (*check_altstatus)(struct ata_port *ap);
         hardware.  On some hardware, reading the Status register has
         the side effect of clearing the interrupt condition.
         Most drivers for taskfile-based hardware use
-        ata_check_status() for this hook.
-        </para>
-        <para>
-        Note that because this is called from ata_device_add(), at
-        least a dummy function that clears device interrupts must be
-        provided for all drivers, even if the controller doesn't
-        actually have a taskfile status register.
+        ata_sff_check_status() for this hook.
         </para>
 
         </sect2>
 
         <sect2><title>Select ATA device on bus</title>
         <programlisting>
-void (*dev_select)(struct ata_port *ap, unsigned int device);
+void (*sff_dev_select)(struct ata_port *ap, unsigned int device);
         </programlisting>
 
         <para>
@@ -251,9 +240,7 @@ void (*dev_select)(struct ata_port *ap, unsigned int device);
         </para>
         <para>
         Most drivers for taskfile-based hardware use
-        ata_std_dev_select() for this hook.  Controllers which do not
-        support second drives on a port (such as SATA contollers) will
-        use ata_noop_dev_select().
+        ata_sff_dev_select() for this hook.
         </para>
 
         </sect2>
@@ -441,13 +428,13 @@ void (*irq_clear) (struct ata_port *);
         to struct ata_host_set.
         </para>
         <para>
-        Most legacy IDE drivers use ata_interrupt() for the
+        Most legacy IDE drivers use ata_sff_interrupt() for the
         irq_handler hook, which scans all ports in the host_set,
         determines which queued command was active (if any), and calls
-        ata_host_intr(ap,qc).
+        ata_sff_host_intr(ap,qc).
         </para>
         <para>
-        Most legacy IDE drivers use ata_bmdma_irq_clear() for the
+        Most legacy IDE drivers use ata_sff_irq_clear() for the
         irq_clear() hook, which simply clears the interrupt and error
         flags in the DMA status register.
         </para>
@@ -496,10 +483,6 @@ void (*host_stop) (struct ata_host_set *host_set);
         data from port at this time.
         </para>
         <para>
-        Many drivers use ata_port_stop() as this hook, which frees the
-        PRD table.
-        </para>
-        <para>
         ->host_stop() is called after all ->port_stop() calls
 have completed.  The hook must finalize hardware shutdown, release DMA
 and other resources, etc.
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index ed511af0f79..05df0b7514b 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -589,3 +589,26 @@ Why:	Useful in 2003, implementation is a hack.
         Generally invoked by accident today.
         Seen as doing more harm than good.
 Who:    Len Brown <len.brown@intel.com>
+
+----------------------------
+
+What:   video4linux /dev/vtx teletext API support
+When:   2.6.35
+Files:  drivers/media/video/saa5246a.c drivers/media/video/saa5249.c
+        include/linux/videotext.h
+Why:    The vtx device nodes have been superseded by vbi device nodes
+        for many years. No applications exist that use the vtx support.
+        Of the two i2c drivers that actually support this API the saa5249
+        has been impossible to use for a year now and no known hardware
+        that supports this device exists. The saa5246a is theoretically
+        supported by the old mxb boards, but it never actually worked.
+
+        In summary: there is no hardware that can use this API and there
+        are no applications actually implementing this API.
+
+        The vtx support still reserves minors 192-223 and we would really
+        like to reuse those for upcoming new functionality. In the unlikely
+        event that new hardware appears that wants to use the functionality
+        provided by the vtx API, then that functionality should be build
+        around the sliced VBI API instead.
+Who:    Hans Verkuil <hverkuil@xs4all.nl>
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index a4f30faa4f1..1e359b62c40 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -316,7 +316,7 @@ address           perms offset  dev   inode      pathname
 08049000-0804a000 rw-p 00001000 03:00 8312       /opt/test
 0804a000-0806b000 rw-p 00000000 00:00 0          [heap]
 a7cb1000-a7cb2000 ---p 00000000 00:00 0
-a7cb2000-a7eb2000 rw-p 00000000 00:00 0          [threadstack:001ff4b4]
+a7cb2000-a7eb2000 rw-p 00000000 00:00 0
 a7eb2000-a7eb3000 ---p 00000000 00:00 0
 a7eb3000-a7ed5000 rw-p 00000000 00:00 0
 a7ed5000-a8008000 r-xp 00000000 03:00 4222       /lib/libc.so.6
@@ -352,7 +352,6 @@ is not associated with a file:
  [stack]                  = the stack of the main process
  [vdso]                   = the "virtual dynamic shared object",
                             the kernel system call handler
- [threadstack:xxxxxxxx]   = the stack of the thread, xxxxxxxx is the stack size
 
  or if empty, the mapping is anonymous.
 
diff --git a/Documentation/i2c/writing-clients b/Documentation/i2c/writing-clients
index 3219ee0dbfe..5ebf5af1d71 100644
--- a/Documentation/i2c/writing-clients
+++ b/Documentation/i2c/writing-clients
@@ -74,6 +74,11 @@ structure at all.  You should use this to keep device-specific data.
         /* retrieve the value */
         void *i2c_get_clientdata(const struct i2c_client *client);
 
+Note that starting with kernel 2.6.34, you don't have to set the `data' field
+to NULL in remove() or if probe() failed anymore. The i2c-core does this
+automatically on these occasions. Those are also the only times the core will
+touch this field.
+
 
 Accessing the client
 ====================
diff --git a/Documentation/input/elantech.txt b/Documentation/input/elantech.txt
index a10c3b6ba7c..56941ae1f5d 100644
--- a/Documentation/input/elantech.txt
+++ b/Documentation/input/elantech.txt
@@ -333,14 +333,14 @@ byte 0:
 byte 1:
 
    bit   7   6   5   4   3   2   1   0
-        x15 x14 x13 x12 x11 x10 x9  x8
+         .   .   .   .   .  x10 x9  x8
 
 byte 2:
 
    bit   7   6   5   4   3   2   1   0
         x7  x6  x5  x4  x4  x2  x1  x0
 
-         x15..x0 = absolute x value (horizontal)
+         x10..x0 = absolute x value (horizontal)
 
 byte 3:
 
@@ -350,14 +350,14 @@ byte 3:
 byte 4:
 
    bit   7   6   5   4   3   2   1   0
-        y15 y14 y13 y12 y11 y10 y8  y8
+         .   .   .   .   .   .  y9  y8
 
 byte 5:
 
    bit   7   6   5   4   3   2   1   0
         y7  y6  y5  y4  y3  y2  y1  y0
 
-         y15..y0 = absolute y value (vertical)
+         y9..y0 = absolute y value (vertical)
 
 
 4.2.2 Two finger touch
diff --git a/Documentation/spi/spidev_test.c b/Documentation/spi/spidev_test.c
index 10abd3773e4..16feda90146 100644
--- a/Documentation/spi/spidev_test.c
+++ b/Documentation/spi/spidev_test.c
@@ -58,7 +58,7 @@ static void transfer(int fd)
         };
 
         ret = ioctl(fd, SPI_IOC_MESSAGE(1), &tr);
-        if (ret == 1)
+        if (ret < 1)
                 pabort("can't send spi message");
 
         for (ret = 0; ret < ARRAY_SIZE(tx); ret++) {
diff --git a/MAINTAINERS b/MAINTAINERS
index d5b0b1b6dc5..d329b053a71 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5492,7 +5492,7 @@ S:	Maintained
 F:      drivers/mmc/host/tmio_mmc.*
 
 TMPFS (SHMEM FILESYSTEM)
-M:      Hugh Dickins <hugh.dickins@tiscali.co.uk>
+M:      Hugh Dickins <hughd@google.com>
 L:      linux-mm@kvack.org
 S:      Maintained
 F:      include/linux/shmem_fs.h
diff --git a/Makefile b/Makefile
index 5f05f8cbeda..ebc8225f7a9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 34
-EXTRAVERSION = -rc6
+EXTRAVERSION =
 NAME = Sheep on Meth
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 6ab6b337a91..c5191b1532e 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -685,8 +685,8 @@ proc_types:
                 W(b)    __armv4_mmu_cache_off
                 W(b)    __armv4_mmu_cache_flush
 
-                .word   0x56056930
-                .word   0xff0ffff0              @ PXA935
+                .word   0x56056900
+                .word   0xffffff00              @ PXA9xx
                 W(b)    __armv4_mmu_cache_on
                 W(b)    __armv4_mmu_cache_off
                 W(b)    __armv4_mmu_cache_flush
@@ -697,12 +697,6 @@ proc_types:
                 W(b)    __armv4_mmu_cache_off
                 W(b)    __armv5tej_mmu_cache_flush
 
-                .word   0x56056930
-                .word   0xff0ffff0              @ PXA935
-                W(b)    __armv4_mmu_cache_on
-                W(b)    __armv4_mmu_cache_off
-                W(b)    __armv4_mmu_cache_flush
-
                 .word   0x56050000              @ Feroceon
                 .word   0xff0f0000
                 W(b)    __armv4_mmu_cache_on
diff --git a/arch/arm/configs/imote2_defconfig b/arch/arm/configs/imote2_defconfig
index 95d2becfc66..21f2bff8a36 100644
--- a/arch/arm/configs/imote2_defconfig
+++ b/arch/arm/configs/imote2_defconfig
@@ -1,13 +1,14 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.33-rc8
-# Sat Feb 13 21:48:53 2010
+# Linux kernel version: 2.6.34-rc2
+# Thu Apr  8 14:49:08 2010
 #
 CONFIG_ARM=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
 CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_HAVE_PROC_CPU=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_HAVE_LATENCYTOP_SUPPORT=y
@@ -19,6 +20,7 @@ CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_ARCH_HAS_CPUFREQ=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_ARCH_MTD_XIP=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_VECTORS_BASE=0xffff0000
@@ -60,11 +62,6 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_TREE_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_GROUP_SCHED=y
-CONFIG_FAIR_GROUP_SCHED=y
-# CONFIG_RT_GROUP_SCHED is not set
-CONFIG_USER_SCHED=y
-# CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
@@ -97,10 +94,14 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_AIO=y
+CONFIG_HAVE_PERF_EVENTS=y
+CONFIG_PERF_USE_VMALLOC=y
 
 #
 # Kernel Performance Events And Counters
 #
+# CONFIG_PERF_EVENTS is not set
+# CONFIG_PERF_COUNTERS is not set
 CONFIG_VM_EVENT_COUNTERS=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
@@ -184,6 +185,7 @@ CONFIG_MMU=y
 # CONFIG_ARCH_REALVIEW is not set
 # CONFIG_ARCH_VERSATILE is not set
 # CONFIG_ARCH_AT91 is not set
+# CONFIG_ARCH_BCMRING is not set
 # CONFIG_ARCH_CLPS711X is not set
 # CONFIG_ARCH_GEMINI is not set
 # CONFIG_ARCH_EBSA110 is not set
@@ -193,7 +195,6 @@ CONFIG_MMU=y
 # CONFIG_ARCH_STMP3XXX is not set
 # CONFIG_ARCH_NETX is not set
 # CONFIG_ARCH_H720X is not set
-# CONFIG_ARCH_NOMADIK is not set
 # CONFIG_ARCH_IOP13XX is not set
 # CONFIG_ARCH_IOP32X is not set
 # CONFIG_ARCH_IOP33X is not set
@@ -210,21 +211,26 @@ CONFIG_MMU=y
 # CONFIG_ARCH_KS8695 is not set
 # CONFIG_ARCH_NS9XXX is not set
 # CONFIG_ARCH_W90X900 is not set
+# CONFIG_ARCH_NUC93X is not set
 # CONFIG_ARCH_PNX4008 is not set
 CONFIG_ARCH_PXA=y
 # CONFIG_ARCH_MSM is not set
+# CONFIG_ARCH_SHMOBILE is not set
 # CONFIG_ARCH_RPC is not set
 # CONFIG_ARCH_SA1100 is not set
 # CONFIG_ARCH_S3C2410 is not set
 # CONFIG_ARCH_S3C64XX is not set
+# CONFIG_ARCH_S5P6440 is not set
+# CONFIG_ARCH_S5P6442 is not set
 # CONFIG_ARCH_S5PC1XX is not set
+# CONFIG_ARCH_S5PV210 is not set
 # CONFIG_ARCH_SHARK is not set
 # CONFIG_ARCH_LH7A40X is not set
 # CONFIG_ARCH_U300 is not set
+# CONFIG_ARCH_U8500 is not set
+# CONFIG_ARCH_NOMADIK is not set
 # CONFIG_ARCH_DAVINCI is not set
 # CONFIG_ARCH_OMAP is not set
-# CONFIG_ARCH_BCMRING is not set
-# CONFIG_ARCH_U8500 is not set
 
 #
 # Intel PXA2xx/PXA3xx Implementations
@@ -253,6 +259,7 @@ CONFIG_ARCH_PXA=y
 # CONFIG_MACH_EM_X270 is not set
 # CONFIG_MACH_EXEDA is not set
 # CONFIG_MACH_CM_X300 is not set
+# CONFIG_MACH_CAPC7117 is not set
 # CONFIG_ARCH_GUMSTIX is not set
 CONFIG_MACH_INTELMOTE2=y
 # CONFIG_MACH_STARGATE2 is not set
@@ -275,7 +282,11 @@ CONFIG_MACH_INTELMOTE2=y
 # CONFIG_PXA_EZX is not set
 # CONFIG_MACH_MP900C is not set
 # CONFIG_ARCH_PXA_PALM is not set
+# CONFIG_MACH_RAUMFELD_RC is not set
+# CONFIG_MACH_RAUMFELD_CONNECTOR is not set
+# CONFIG_MACH_RAUMFELD_SPEAKER is not set
 # CONFIG_PXA_SHARPSL is not set
+# CONFIG_MACH_ICONTROL is not set
 # CONFIG_ARCH_PXA_ESERIES is not set
 CONFIG_PXA27x=y
 CONFIG_PXA_SSP=y
@@ -302,6 +313,7 @@ CONFIG_ARM_THUMB=y
 CONFIG_ARM_L1_CACHE_SHIFT=5
 CONFIG_IWMMXT=y
 CONFIG_XSCALE_PMU=y
+CONFIG_CPU_HAS_PMU=y
 CONFIG_COMMON_CLKDEV=y
 
 #
@@ -352,7 +364,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=tty1 root=/dev/mmcblk0p2 rootfstype=ext2 rootdelay=3 ip=192.168.0.202:192.168.0.200:192.168.0.200:255.255.255.0 debug"
+CONFIG_CMDLINE="root=/dev/mtdblock2 rootfstype=jffs2 console=ttyS2,115200 mem=32M"
 # CONFIG_XIP_KERNEL is not set
 CONFIG_KEXEC=y
 CONFIG_ATAGS_PROC=y
@@ -360,24 +372,8 @@ CONFIG_ATAGS_PROC=y
 #
 # CPU Power Management
 #
-CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_TABLE=y
-CONFIG_CPU_FREQ_DEBUG=y
-CONFIG_CPU_FREQ_STAT=y
-# CONFIG_CPU_FREQ_STAT_DETAILS is not set
-CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
-# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
-# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
-# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
-# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
-CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
-CONFIG_CPU_FREQ_GOV_POWERSAVE=m
-CONFIG_CPU_FREQ_GOV_USERSPACE=m
-CONFIG_CPU_FREQ_GOV_ONDEMAND=m
-CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
-CONFIG_CPU_IDLE=y
-CONFIG_CPU_IDLE_GOV_LADDER=y
-CONFIG_CPU_IDLE_GOV_MENU=y
+# CONFIG_CPU_FREQ is not set
+# CONFIG_CPU_IDLE is not set
 
 #
 # Floating point emulation
@@ -409,6 +405,7 @@ CONFIG_SUSPEND=y
 CONFIG_SUSPEND_FREEZER=y
 CONFIG_APM_EMULATION=y
 CONFIG_PM_RUNTIME=y
+CONFIG_PM_OPS=y
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_NET=y
 
@@ -416,7 +413,6 @@ CONFIG_NET=y
 # Networking options
 #
 CONFIG_PACKET=y
-CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
@@ -506,6 +502,7 @@ CONFIG_NF_CT_NETLINK=m
 CONFIG_NETFILTER_XTABLES=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
 # CONFIG_NETFILTER_XT_TARGET_CONNMARK is not set
+# CONFIG_NETFILTER_XT_TARGET_CT is not set
 # CONFIG_NETFILTER_XT_TARGET_DSCP is not set
 CONFIG_NETFILTER_XT_TARGET_HL=m
 CONFIG_NETFILTER_XT_TARGET_LED=m
@@ -622,6 +619,7 @@ CONFIG_IP6_NF_RAW=m
 # CONFIG_ATM is not set
 CONFIG_STP=m
 CONFIG_BRIDGE=m
+# CONFIG_BRIDGE_IGMP_SNOOPING is not set
 # CONFIG_NET_DSA is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
@@ -646,32 +644,7 @@ CONFIG_NET_CLS_ROUTE=y
 # CONFIG_HAMRADIO is not set
 # CONFIG_CAN is not set
 # CONFIG_IRDA is not set
-CONFIG_BT=y
-CONFIG_BT_L2CAP=y
-CONFIG_BT_SCO=y
-CONFIG_BT_RFCOMM=y
-CONFIG_BT_RFCOMM_TTY=y
-CONFIG_BT_BNEP=y
-CONFIG_BT_BNEP_MC_FILTER=y
-CONFIG_BT_BNEP_PROTO_FILTER=y
-CONFIG_BT_HIDP=y
-
-#
-# Bluetooth device drivers
-#
-CONFIG_BT_HCIBTUSB=m
-CONFIG_BT_HCIBTSDIO=m
-CONFIG_BT_HCIUART=y
-CONFIG_BT_HCIUART_H4=y
-# CONFIG_BT_HCIUART_BCSP is not set
-# CONFIG_BT_HCIUART_LL is not set
-CONFIG_BT_HCIBCM203X=m
-CONFIG_BT_HCIBPA10X=m
-CONFIG_BT_HCIBFUSB=m
-CONFIG_BT_HCIVHCI=m
-CONFIG_BT_MRVL=m
-CONFIG_BT_MRVL_SDIO=m
-# CONFIG_BT_ATH3K is not set
+# CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
 CONFIG_FIB_RULES=y
 # CONFIG_WIRELESS is not set
@@ -687,7 +660,8 @@ CONFIG_FIB_RULES=y
 # Generic Driver Options
 #
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-# CONFIG_DEVTMPFS is not set
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=m
@@ -703,9 +677,9 @@ CONFIG_MTD=y
 # CONFIG_MTD_CONCAT is not set
 CONFIG_MTD_PARTITIONS=y
 # CONFIG_MTD_REDBOOT_PARTS is not set
-# CONFIG_MTD_CMDLINE_PARTS is not set
-# CONFIG_MTD_AFS_PARTS is not set
-# CONFIG_MTD_AR7_PARTS is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_AFS_PARTS=y
+CONFIG_MTD_AR7_PARTS=y
 
 #
 # User Modules And Translation Layers
@@ -812,6 +786,7 @@ CONFIG_HAVE_IDE=y
 #
 # SCSI device support
 #
+CONFIG_SCSI_MOD=y
 # CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
 # CONFIG_SCSI_DMA is not set
@@ -965,6 +940,7 @@ CONFIG_SERIAL_PXA=y
 CONFIG_SERIAL_PXA_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_TIMBERDALE is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
@@ -993,6 +969,7 @@ CONFIG_I2C_HELPER_AUTO=y
 CONFIG_I2C_PXA=y
 # CONFIG_I2C_PXA_SLAVE is not set
 # CONFIG_I2C_SIMTEC is not set
+# CONFIG_I2C_XILINX is not set
 
 #
 # External I2C/SMBus adapter drivers
@@ -1006,15 +983,9 @@ CONFIG_I2C_PXA=y
 #
 # CONFIG_I2C_PCA_PLATFORM is not set
 # CONFIG_I2C_STUB is not set
-
-#
-# Miscellaneous I2C Chip support
-#
-# CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
-# CONFIG_I2C_DEBUG_CHIP is not set
 CONFIG_SPI=y
 # CONFIG_SPI_DEBUG is not set
 CONFIG_SPI_MASTER=y
@@ -1046,10 +1017,12 @@ CONFIG_GPIO_SYSFS=y
 #
 # Memory mapped GPIO expanders:
 #
+# CONFIG_GPIO_IT8761E is not set
 
 #
 # I2C GPIO expanders:
 #
+# CONFIG_GPIO_MAX7300 is not set
 # CONFIG_GPIO_MAX732X is not set
 # CONFIG_GPIO_PCA953X is not set
 # CONFIG_GPIO_PCF857X is not set
@@ -1093,10 +1066,12 @@ CONFIG_SSB_POSSIBLE=y
 # Multifunction device drivers
 #
 # CONFIG_MFD_CORE is not set
+# CONFIG_MFD_88PM860X is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_MFD_ASIC3 is not set
 # CONFIG_HTC_EGPIO is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_HTC_I2CPLD is not set
 # CONFIG_TPS65010 is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
@@ -1105,22 +1080,25 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_TC6393XB is not set
 CONFIG_PMIC_DA903X=y
 # CONFIG_PMIC_ADP5520 is not set
+# CONFIG_MFD_MAX8925 is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM831X is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_WM8994 is not set
 # CONFIG_MFD_PCF50633 is not set
 # CONFIG_MFD_MC13783 is not set
 # CONFIG_AB3100_CORE is not set
 # CONFIG_EZX_PCAP is not set
-# CONFIG_MFD_88PM8607 is not set
 # CONFIG_AB4500_CORE is not set
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_DEBUG=y
+# CONFIG_REGULATOR_DUMMY is not set
 # CONFIG_REGULATOR_FIXED_VOLTAGE is not set
 CONFIG_REGULATOR_VIRTUAL_CONSUMER=y
 CONFIG_REGULATOR_USERSPACE_CONSUMER=y
 # CONFIG_REGULATOR_BQ24022 is not set
 # CONFIG_REGULATOR_MAX1586 is not set
+# CONFIG_REGULATOR_MAX8649 is not set
 # CONFIG_REGULATOR_MAX8660 is not set
 CONFIG_REGULATOR_DA903X=y
 # CONFIG_REGULATOR_LP3971 is not set
@@ -1218,6 +1196,7 @@ CONFIG_VIDEO_IR_I2C=y
 # CONFIG_VIDEO_SAA7191 is not set
 # CONFIG_VIDEO_TVP514X is not set
 # CONFIG_VIDEO_TVP5150 is not set
+# CONFIG_VIDEO_TVP7002 is not set
 # CONFIG_VIDEO_VPX3220 is not set
 
 #
@@ -1264,15 +1243,7 @@ CONFIG_SOC_CAMERA_MT9M111=y
 CONFIG_VIDEO_PXA27x=y
 # CONFIG_VIDEO_SH_MOBILE_CEU is not set
 # CONFIG_V4L_USB_DRIVERS is not set
-CONFIG_RADIO_ADAPTERS=y
-# CONFIG_I2C_SI4713 is not set
-# CONFIG_RADIO_SI4713 is not set
-# CONFIG_USB_DSBR is not set
-# CONFIG_RADIO_SI470X is not set
-# CONFIG_USB_MR800 is not set
-CONFIG_RADIO_TEA5764=y
-CONFIG_RADIO_TEA5764_XTAL=y
-# CONFIG_RADIO_TEF6862 is not set
+# CONFIG_RADIO_ADAPTERS is not set
 # CONFIG_DAB is not set
 
 #
@@ -1398,8 +1369,6 @@ CONFIG_HID=y
 #
 # Special HID drivers
 #
-CONFIG_HID_APPLE=m
-# CONFIG_HID_WACOM is not set
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
@@ -1477,7 +1446,6 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
-# CONFIG_USB_BERRY_CHARGE is not set
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
@@ -1489,7 +1457,6 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 # CONFIG_USB_ISIGHTFW is not set
-# CONFIG_USB_VST is not set
 CONFIG_USB_GADGET=y
 # CONFIG_USB_GADGET_DEBUG is not set
 # CONFIG_USB_GADGET_DEBUG_FILES is not set
@@ -1529,6 +1496,7 @@ CONFIG_USB_ETH=y
 # CONFIG_USB_MIDI_GADGET is not set
 # CONFIG_USB_G_PRINTER is not set
 # CONFIG_USB_CDC_COMPOSITE is not set
+# CONFIG_USB_G_NOKIA is not set
 # CONFIG_USB_G_MULTI is not set
 
 #
@@ -1555,8 +1523,6 @@ CONFIG_SDIO_UART=m
 #
 CONFIG_MMC_PXA=y
 # CONFIG_MMC_SDHCI is not set
-# CONFIG_MMC_AT91 is not set
-# CONFIG_MMC_ATMELMCI is not set
 CONFIG_MMC_SPI=y
 # CONFIG_MEMSTICK is not set
 CONFIG_NEW_LEDS=y
@@ -1574,11 +1540,11 @@ CONFIG_LEDS_LP3944=y
 # CONFIG_LEDS_REGULATOR is not set
 # CONFIG_LEDS_BD2802 is not set
 # CONFIG_LEDS_LT3593 is not set
+CONFIG_LEDS_TRIGGERS=y
 
 #
 # LED Triggers
 #
-CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_LEDS_TRIGGER_BACKLIGHT=y
@@ -1656,7 +1622,7 @@ CONFIG_RTC_INTF_DEV=y
 # on-CPU RTC drivers
 #
 # CONFIG_RTC_DRV_SA1100 is not set
-# CONFIG_RTC_DRV_PXA is not set
+CONFIG_RTC_DRV_PXA=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
@@ -1681,19 +1647,10 @@ CONFIG_EXT3_FS_XATTR=y
 CONFIG_JBD=m
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=m
-CONFIG_REISERFS_FS=m
-# CONFIG_REISERFS_CHECK is not set
-# CONFIG_REISERFS_PROC_INFO is not set
-CONFIG_REISERFS_FS_XATTR=y
-CONFIG_REISERFS_FS_POSIX_ACL=y
-CONFIG_REISERFS_FS_SECURITY=y
+# CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
-CONFIG_XFS_FS=m
-# CONFIG_XFS_QUOTA is not set
-# CONFIG_XFS_POSIX_ACL is not set
-# CONFIG_XFS_RT is not set
-# CONFIG_XFS_DEBUG is not set
+# CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
 # CONFIG_NILFS2_FS is not set
@@ -1716,9 +1673,7 @@ CONFIG_CUSE=m
 #
 # CD-ROM/DVD Filesystems
 #
-CONFIG_ISO9660_FS=m
-CONFIG_JOLIET=y
-CONFIG_ZISOFS=y
+# CONFIG_ISO9660_FS is not set
 # CONFIG_UDF_FS is not set
 
 #
@@ -1750,12 +1705,14 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
-CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
 CONFIG_JFFS2_FS_WRITEBUFFER=y
-# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
-# CONFIG_JFFS2_SUMMARY is not set
-# CONFIG_JFFS2_FS_XATTR is not set
+CONFIG_JFFS2_FS_WBUF_VERIFY=y
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_JFFS2_FS_XATTR=y
+CONFIG_JFFS2_FS_POSIX_ACL=y
+CONFIG_JFFS2_FS_SECURITY=y
 CONFIG_JFFS2_COMPRESSION_OPTIONS=y
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_LZO=y
@@ -1765,6 +1722,7 @@ CONFIG_JFFS2_RUBIN=y
 CONFIG_JFFS2_CMODE_PRIORITY=y
 # CONFIG_JFFS2_CMODE_SIZE is not set
 # CONFIG_JFFS2_CMODE_FAVOURLZO is not set
+# CONFIG_LOGFS is not set
 CONFIG_CRAMFS=m
 CONFIG_SQUASHFS=m
 # CONFIG_SQUASHFS_EMBEDDED is not set
@@ -1802,6 +1760,7 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
 # CONFIG_SMB_NLS_DEFAULT is not set
+# CONFIG_CEPH_FS is not set
 CONFIG_CIFS=m
 CONFIG_CIFS_STATS=y
 # CONFIG_CIFS_STATS2 is not set
@@ -1895,6 +1854,7 @@ CONFIG_DEBUG_SPINLOCK=y
 CONFIG_DEBUG_MUTEXES=y
 CONFIG_DEBUG_LOCK_ALLOC=y
 CONFIG_PROVE_LOCKING=y
+# CONFIG_PROVE_RCU is not set
 CONFIG_LOCKDEP=y
 # CONFIG_LOCK_STAT is not set
 # CONFIG_DEBUG_LOCKDEP is not set
@@ -1918,6 +1878,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_BACKTRACE_SELF_TEST is not set
 # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+# CONFIG_LKDTM is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 # CONFIG_SYSCTL_SYSCALL_CHECK is not set
@@ -2061,9 +2022,9 @@ CONFIG_CRC32=y
 CONFIG_CRC7=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
-CONFIG_ZLIB_DEFLATE=m
-CONFIG_LZO_COMPRESS=m
-CONFIG_LZO_DECOMPRESS=m
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
 CONFIG_DECOMPRESS_GZIP=y
 CONFIG_DECOMPRESS_BZIP2=y
 CONFIG_DECOMPRESS_LZMA=y
@@ -2075,3 +2036,4 @@ CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAS_DMA=y
 CONFIG_NLATTR=y
+CONFIG_GENERIC_ATOMIC64=y
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index 0d08d4170b6..4656a24058d 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -371,6 +371,10 @@ static inline void __flush_icache_all(void)
 #ifdef CONFIG_ARM_ERRATA_411920
         extern void v6_icache_inval_all(void);
         v6_icache_inval_all();
+#elif defined(CONFIG_SMP) && __LINUX_ARM_ARCH__ >= 7
+        asm("mcr        p15, 0, %0, c7, c1, 0   @ invalidate I-cache inner shareable\n"
+            :
+            : "r" (0));
 #else
         asm("mcr        p15, 0, %0, c7, c5, 0   @ invalidate I-cache\n"
             :
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index bff056489cc..51662feb9f1 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -9,6 +9,8 @@
 #include <asm/ptrace.h>
 #include <asm/user.h>
 
+struct task_struct;
+
 typedef unsigned long elf_greg_t;
 typedef unsigned long elf_freg_t[3];
 
diff --git a/arch/arm/include/asm/smp_twd.h b/arch/arm/include/asm/smp_twd.h
index 7be0978b262..634f357be6b 100644
--- a/arch/arm/include/asm/smp_twd.h
+++ b/arch/arm/include/asm/smp_twd.h
@@ -1,6 +1,23 @@
 #ifndef __ASMARM_SMP_TWD_H
 #define __ASMARM_SMP_TWD_H
 
+#define TWD_TIMER_LOAD                  0x00
+#define TWD_TIMER_COUNTER               0x04
+#define TWD_TIMER_CONTROL               0x08
+#define TWD_TIMER_INTSTAT               0x0C
+
+#define TWD_WDOG_LOAD                   0x20
+#define TWD_WDOG_COUNTER                0x24
+#define TWD_WDOG_CONTROL                0x28
+#define TWD_WDOG_INTSTAT                0x2C
+#define TWD_WDOG_RESETSTAT              0x30
+#define TWD_WDOG_DISABLE                0x34
+
+#define TWD_TIMER_CONTROL_ENABLE        (1 << 0)
+#define TWD_TIMER_CONTROL_ONESHOT       (0 << 1)
+#define TWD_TIMER_CONTROL_PERIODIC      (1 << 1)
+#define TWD_TIMER_CONTROL_IT_ENABLE     (1 << 2)
+
 struct clock_event_device;
 
 extern void __iomem *twd_base;
diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
index e085e2c545e..bd863d8608c 100644
--- a/arch/arm/include/asm/tlbflush.h
+++ b/arch/arm/include/asm/tlbflush.h
@@ -46,6 +46,9 @@
 #define TLB_V7_UIS_FULL (1 << 20)
 #define TLB_V7_UIS_ASID (1 << 21)
 
+/* Inner Shareable BTB operation (ARMv7 MP extensions) */
+#define TLB_V7_IS_BTB   (1 << 22)
+
 #define TLB_L2CLEAN_FR  (1 << 29)               /* Feroceon */
 #define TLB_DCLEAN      (1 << 30)
 #define TLB_WB          (1 << 31)
@@ -183,7 +186,7 @@
 #endif
 
 #ifdef CONFIG_SMP
-#define v7wbi_tlb_flags (TLB_WB | TLB_DCLEAN | TLB_BTB | \
+#define v7wbi_tlb_flags (TLB_WB | TLB_DCLEAN | TLB_V7_IS_BTB | \
                          TLB_V7_UIS_FULL | TLB_V7_UIS_PAGE | TLB_V7_UIS_ASID)
 #else
 #define v7wbi_tlb_flags (TLB_WB | TLB_DCLEAN | TLB_BTB | \
@@ -339,6 +342,12 @@ static inline void local_flush_tlb_all(void)
                 dsb();
                 isb();
         }
+        if (tlb_flag(TLB_V7_IS_BTB)) {
+                /* flush the branch target cache */
+                asm("mcr p15, 0, %0, c7, c1, 6" : : "r" (zero) : "cc");
+                dsb();
+                isb();
+        }
 }
 
 static inline void local_flush_tlb_mm(struct mm_struct *mm)
@@ -376,6 +385,12 @@ static inline void local_flush_tlb_mm(struct mm_struct *mm)
                 asm("mcr p15, 0, %0, c7, c5, 6" : : "r" (zero) : "cc");
                 dsb();
         }
+        if (tlb_flag(TLB_V7_IS_BTB)) {
+                /* flush the branch target cache */
+                asm("mcr p15, 0, %0, c7, c1, 6" : : "r" (zero) : "cc");
+                dsb();
+                isb();
+        }
 }
 
 static inline void
@@ -416,6 +431,12 @@ local_flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
                 asm("mcr p15, 0, %0, c7, c5, 6" : : "r" (zero) : "cc");
                 dsb();
         }
+        if (tlb_flag(TLB_V7_IS_BTB)) {
+                /* flush the branch target cache */
+                asm("mcr p15, 0, %0, c7, c1, 6" : : "r" (zero) : "cc");
+                dsb();
+                isb();
+        }
 }
 
 static inline void local_flush_tlb_kernel_page(unsigned long kaddr)
@@ -454,6 +475,12 @@ static inline void local_flush_tlb_kernel_page(unsigned long kaddr)
                 dsb();
                 isb();
         }
+        if (tlb_flag(TLB_V7_IS_BTB)) {
+                /* flush the branch target cache */
+                asm("mcr p15, 0, %0, c7, c1, 6" : : "r" (zero) : "cc");
+                dsb();
+                isb();
+        }
 }
 
 /*
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index e6a0fb0f392..7ee48e7f8f3 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -676,10 +676,10 @@ do_fpe:
  *  lr  = unrecognised FP instruction return address
  */
 
-        .data
+        .pushsection .data
 ENTRY(fp_enter)
         .word   no_fp
-        .text
+        .popsection
 
 ENTRY(no_fp)
         mov     pc, lr
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 577543f3857..a01194e583f 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -86,6 +86,12 @@ int __cpuinit __cpu_up(unsigned int cpu)
                         return PTR_ERR(idle);
                 }
                 ci->idle = idle;
+        } else {
+                /*
+                 * Since this idle thread is being re-used, call
+                 * init_idle() to reinitialize the thread structure.
+                 */
+                init_idle(idle, cpu);
         }
 
         /*
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index ea02a7b1c24..7c5f0c024db 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -21,23 +21,6 @@
 #include <asm/smp_twd.h>
 #include <asm/hardware/gic.h>
 
-#define TWD_TIMER_LOAD                  0x00
-#define TWD_TIMER_COUNTER               0x04
-#define TWD_TIMER_CONTROL               0x08
-#define TWD_TIMER_INTSTAT               0x0C
-
-#define TWD_WDOG_LOAD                   0x20
-#define TWD_WDOG_COUNTER                0x24
-#define TWD_WDOG_CONTROL                0x28
-#define TWD_WDOG_INTSTAT                0x2C
-#define TWD_WDOG_RESETSTAT              0x30
-#define TWD_WDOG_DISABLE                0x34
-
-#define TWD_TIMER_CONTROL_ENABLE        (1 << 0)
-#define TWD_TIMER_CONTROL_ONESHOT       (0 << 1)
-#define TWD_TIMER_CONTROL_PERIODIC      (1 << 1)
-#define TWD_TIMER_CONTROL_IT_ENABLE     (1 << 2)
-
 /* set up by the platform code */
 void __iomem *twd_base;
 
diff --git a/arch/arm/lib/clear_user.S b/arch/arm/lib/clear_user.S
index 5e3f99620c0..14a0d988c82 100644
--- a/arch/arm/lib/clear_user.S
+++ b/arch/arm/lib/clear_user.S
@@ -45,6 +45,7 @@ USER(		strnebt	r2, [r0])
                 mov     r0, #0
                 ldmfd   sp!, {r1, pc}
 ENDPROC(__clear_user)
+ENDPROC(__clear_user_std)
 
                 .pushsection .fixup,"ax"
                 .align  0
diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
index 027b69bdbad..d066df686e1 100644
--- a/arch/arm/lib/copy_to_user.S
+++ b/arch/arm/lib/copy_to_user.S
@@ -93,6 +93,7 @@ WEAK(__copy_to_user)
 #include "copy_template.S"
 
 ENDPROC(__copy_to_user)
+ENDPROC(__copy_to_user_std)
 
         .pushsection .fixup,"ax"
         .align 0
diff --git a/arch/arm/mach-davinci/da830.c b/arch/arm/mach-davinci/da830.c
index 122e61a9f50..e8cb982f5e8 100644
--- a/arch/arm/mach-davinci/da830.c
+++ b/arch/arm/mach-davinci/da830.c
@@ -410,7 +410,7 @@ static struct clk_lookup da830_clks[] = {
         CLK("davinci-mcasp.0",  NULL,           &mcasp0_clk),
         CLK("davinci-mcasp.1",  NULL,           &mcasp1_clk),
         CLK("davinci-mcasp.2",  NULL,           &mcasp2_clk),
-        CLK("musb_hdrc",        NULL,           &usb20_clk),
+        CLK(NULL,               "usb20",        &usb20_clk),
         CLK(NULL,               "aemif",        &aemif_clk),
         CLK(NULL,               "aintc",        &aintc_clk),
         CLK(NULL,               "secu_mgr",     &secu_mgr_clk),
diff --git a/arch/arm/mach-mx5/clock-mx51.c b/arch/arm/mach-mx5/clock-mx51.c
index 8f85f73b83a..1ee6ce4087b 100644
--- a/arch/arm/mach-mx5/clock-mx51.c
+++ b/arch/arm/mach-mx5/clock-mx51.c
@@ -16,6 +16,7 @@
 #include <linux/io.h>
 
 #include <asm/clkdev.h>
+#include <asm/div64.h>
 
 #include <mach/hardware.h>
 #include <mach/common.h>
diff --git a/arch/arm/mach-pxa/include/mach/colibri.h b/arch/arm/mach-pxa/include/mach/colibri.h
index 811743c5614..5f2ba8d9015 100644
--- a/arch/arm/mach-pxa/include/mach/colibri.h
+++ b/arch/arm/mach-pxa/include/mach/colibri.h
@@ -2,6 +2,7 @@
 #define _COLIBRI_H_
 
 #include <net/ax88796.h>
+#include <mach/mfp.h>
 
 /*
  * common settings for all modules
diff --git a/arch/arm/mach-pxa/include/mach/hardware.h b/arch/arm/mach-pxa/include/mach/hardware.h
index 7515757d691..3d8d8cb0968 100644
--- a/arch/arm/mach-pxa/include/mach/hardware.h
+++ b/arch/arm/mach-pxa/include/mach/hardware.h
@@ -202,7 +202,7 @@
 #define __cpu_is_pxa950(id)                             \
         ({                                              \
                 unsigned int _id = (id) >> 4 & 0xfff;   \
-                id == 0x697;                            \
+                _id == 0x697;                           \
          })
 #else
 #define __cpu_is_pxa950(id)     (0)
diff --git a/arch/arm/mach-pxa/include/mach/regs-u2d.h b/arch/arm/mach-pxa/include/mach/regs-u2d.h
index 44b0b20b69a..c15c0c57de0 100644
--- a/arch/arm/mach-pxa/include/mach/regs-u2d.h
+++ b/arch/arm/mach-pxa/include/mach/regs-u2d.h
@@ -166,7 +166,8 @@
 #define U2DMACSR_BUSERRTYPE     (7 << 10)       /* PX Bus Error Type */
 #define U2DMACSR_EORINTR        (1 << 9)        /* End Of Receive */
 #define U2DMACSR_REQPEND        (1 << 8)        /* Request Pending */
-#define U2DMACSR_RASINTR        (1 << 4)        /* Request After Channel Stopped (read / write 1 clear) */#define U2DMACSR_STOPINTR     (1 << 3)        /* Stop Interrupt (read only) */
+#define U2DMACSR_RASINTR        (1 << 4)        /* Request After Channel Stopped (read / write 1 clear) */
+#define U2DMACSR_STOPINTR       (1 << 3)        /* Stop Interrupt (read only) */
 #define U2DMACSR_ENDINTR        (1 << 2)        /* End Interrupt (read / write 1 clear) */
 #define U2DMACSR_STARTINTR      (1 << 1)        /* Start Interrupt (read / write 1 clear) */
 #define U2DMACSR_BUSERRINTR     (1 << 0)        /* Bus Error Interrupt (read / write 1 clear) */
diff --git a/arch/arm/mach-pxa/raumfeld.c b/arch/arm/mach-pxa/raumfeld.c
index 44bb675e47f..d12667bd9eb 100644
--- a/arch/arm/mach-pxa/raumfeld.c
+++ b/arch/arm/mach-pxa/raumfeld.c
@@ -983,7 +983,7 @@ static void __init raumfeld_common_init(void)
                 int i;
 
                 for (i = 0; i < ARRAY_SIZE(gpio_keys_button); i++)
-                        if (!strcmp(gpio_keys_button[i].desc, "on/off button"))
+                        if (!strcmp(gpio_keys_button[i].desc, "on_off button"))
                                 gpio_keys_button[i].active_low = 1;
         }
 
@@ -1009,8 +1009,7 @@ static void __init raumfeld_common_init(void)
                 gpio_direction_output(GPIO_W2W_PDN, 0);
 
         /* this can be used to switch off the device */
-        ret = gpio_request(GPIO_SHUTDOWN_SUPPLY,
-                                "supply shutdown");
+        ret = gpio_request(GPIO_SHUTDOWN_SUPPLY, "supply shutdown");
         if (ret < 0)
                 pr_warning("Unable to request GPIO_SHUTDOWN_SUPPLY\n");
         else
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index 19b5109d980..01bdd7500df 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -363,7 +363,7 @@ static struct gpio_keys_button spitz_gpio_keys[] = {
                 .type   = EV_PWR,
                 .code   = KEY_SUSPEND,
                 .gpio   = SPITZ_GPIO_ON_KEY,
-                .desc   = "On/Off",
+                .desc   = "On Off",
                 .wakeup = 1,
         },
         /* Two buttons detecting the lid state */
diff --git a/arch/arm/mach-pxa/viper.c b/arch/arm/mach-pxa/viper.c
index 9e0c5c3988a..e90114a7e24 100644
--- a/arch/arm/mach-pxa/viper.c
+++ b/arch/arm/mach-pxa/viper.c
@@ -34,6 +34,7 @@
 #include <linux/pm.h>
 #include <linux/sched.h>
 #include <linux/gpio.h>
+#include <linux/jiffies.h>
 #include <linux/i2c-gpio.h>
 #include <linux/serial_8250.h>
 #include <linux/smc91x.h>
@@ -454,7 +455,7 @@ static struct i2c_gpio_platform_data i2c_bus_data = {
         .sda_pin = VIPER_RTC_I2C_SDA_GPIO,
         .scl_pin = VIPER_RTC_I2C_SCL_GPIO,
         .udelay  = 10,
-        .timeout = 100,
+        .timeout = HZ,
 };
 
 static struct platform_device i2c_bus_device = {
@@ -779,7 +780,7 @@ static void __init viper_tpm_init(void)
                 .sda_pin = VIPER_TPM_I2C_SDA_GPIO,
                 .scl_pin = VIPER_TPM_I2C_SCL_GPIO,
                 .udelay  = 10,
-                .timeout = 100,
+                .timeout = HZ,
         };
         char *errstr;
 
diff --git a/arch/arm/mach-sa1100/Kconfig b/arch/arm/mach-sa1100/Kconfig
index b17d52f7cc4..fd4c52b7ccb 100644
--- a/arch/arm/mach-sa1100/Kconfig
+++ b/arch/arm/mach-sa1100/Kconfig
@@ -57,7 +57,7 @@ config SA1100_COLLIE
 config SA1100_H3100
         bool "Compaq iPAQ H3100"
         select HTC_EGPIO
-        select CPU_FREQ_SA1100
+        select CPU_FREQ_SA1110
         help
           Say Y here if you intend to run this kernel on the Compaq iPAQ
           H3100 handheld computer.  Information about this machine and the
@@ -68,7 +68,7 @@ config SA1100_H3100
 config SA1100_H3600
         bool "Compaq iPAQ H3600/H3700"
         select HTC_EGPIO
-        select CPU_FREQ_SA1100
+        select CPU_FREQ_SA1110
         help
           Say Y here if you intend to run this kernel on the Compaq iPAQ
           H3600 handheld computer.  Information about this machine and the
diff --git a/arch/arm/mach-sa1100/cpu-sa1110.c b/arch/arm/mach-sa1100/cpu-sa1110.c
index 63b32b68b29..7252874d328 100644
--- a/arch/arm/mach-sa1100/cpu-sa1110.c
+++ b/arch/arm/mach-sa1100/cpu-sa1110.c
@@ -363,6 +363,9 @@ static int __init sa1110_clk_init(void)
         struct sdram_params *sdram;
         const char *name = sdram_name;
 
+        if (!cpu_is_sa1110())
+                return -ENODEV;
+
         if (!name[0]) {
                 if (machine_is_assabet())
                         name = "TC59SM716-CL3";
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index 9d89c67a1cc..e46ecd84713 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -211,6 +211,9 @@ v6_dma_inv_range:
         mcrne   p15, 0, r1, c7, c15, 1          @ clean & invalidate unified line
 #endif
 1:
+#ifdef CONFIG_SMP
+        str     r0, [r0]                        @ write for ownership
+#endif
 #ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c6, 1           @ invalidate D line
 #else
@@ -231,6 +234,9 @@ v6_dma_inv_range:
 v6_dma_clean_range:
         bic     r0, r0, #D_CACHE_LINE_SIZE - 1
 1:
+#ifdef CONFIG_SMP
+        ldr     r2, [r0]                        @ read for ownership
+#endif
 #ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c10, 1          @ clean D line
 #else
@@ -251,6 +257,10 @@ v6_dma_clean_range:
 ENTRY(v6_dma_flush_range)
         bic     r0, r0, #D_CACHE_LINE_SIZE - 1
 1:
+#ifdef CONFIG_SMP
+        ldr     r2, [r0]                        @ read for ownership
+        str     r2, [r0]                        @ write for ownership
+#endif
 #ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c14, 1          @ clean & invalidate D line
 #else
@@ -273,7 +283,9 @@ ENTRY(v6_dma_map_area)
         add     r1, r1, r0
         teq     r2, #DMA_FROM_DEVICE
         beq     v6_dma_inv_range
-        b       v6_dma_clean_range
+        teq     r2, #DMA_TO_DEVICE
+        beq     v6_dma_clean_range
+        b       v6_dma_flush_range
 ENDPROC(v6_dma_map_area)
 
 /*
@@ -283,9 +295,6 @@ ENDPROC(v6_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(v6_dma_unmap_area)
-        add     r1, r1, r0
-        teq     r2, #DMA_TO_DEVICE
-        bne     v6_dma_inv_range
         mov     pc, lr
 ENDPROC(v6_dma_unmap_area)
 
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index bcd64f26587..06a90dcfc60 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -167,7 +167,11 @@ ENTRY(v7_coherent_user_range)
         cmp     r0, r1
         blo     1b
         mov     r0, #0
+#ifdef CONFIG_SMP
+        mcr     p15, 0, r0, c7, c1, 6           @ invalidate BTB Inner Shareable
+#else
         mcr     p15, 0, r0, c7, c5, 6           @ invalidate BTB
+#endif
         dsb
         isb
         mov     pc, lr
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 83db12a68d5..0ed29bfeba1 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -86,9 +86,6 @@ void show_mem(void)
         printk("Mem-info:\n");
         show_free_areas();
         for_each_online_node(node) {
-                pg_data_t *n = NODE_DATA(node);
-                struct page *map = pgdat_page_nr(n, 0) - n->node_start_pfn;
-
                 for_each_nodebank (i,mi,node) {
                         struct membank *bank = &mi->bank[i];
                         unsigned int pfn1, pfn2;
@@ -97,8 +94,8 @@ void show_mem(void)
                         pfn1 = bank_pfn_start(bank);
                         pfn2 = bank_pfn_end(bank);
 
-                        page = map + pfn1;
-                        end  = map + pfn2;
+                        page = pfn_to_page(pfn1);
+                        end  = pfn_to_page(pfn2 - 1) + 1;
 
                         do {
                                 total++;
@@ -603,9 +600,6 @@ void __init mem_init(void)
         reserved_pages = free_pages = 0;
 
         for_each_online_node(node) {
-                pg_data_t *n = NODE_DATA(node);
-                struct page *map = pgdat_page_nr(n, 0) - n->node_start_pfn;
-
                 for_each_nodebank(i, &meminfo, node) {
                         struct membank *bank = &meminfo.bank[i];
                         unsigned int pfn1, pfn2;
@@ -614,8 +608,8 @@ void __init mem_init(void)
                         pfn1 = bank_pfn_start(bank);
                         pfn2 = bank_pfn_end(bank);
 
-                        page = map + pfn1;
-                        end  = map + pfn2;
+                        page = pfn_to_page(pfn1);
+                        end  = pfn_to_page(pfn2 - 1) + 1;
 
                         do {
                                 if (PageReserved(page))
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index 9bfeb6b9509..33b327379f0 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -65,6 +65,15 @@ void flush_dcache_page(struct page *page)
 }
 EXPORT_SYMBOL(flush_dcache_page);
 
+void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
+                       unsigned long uaddr, void *dst, const void *src,
+                       unsigned long len)
+{
+        memcpy(dst, src, len);
+        if (vma->vm_flags & VM_EXEC)
+                __cpuc_coherent_user_range(uaddr, uaddr + len);
+}
+
 void __iomem *__arm_ioremap_pfn(unsigned long pfn, unsigned long offset,
                                 size_t size, unsigned int mtype)
 {
@@ -87,8 +96,8 @@ void __iomem *__arm_ioremap(unsigned long phys_addr, size_t size,
 }
 EXPORT_SYMBOL(__arm_ioremap);
 
-void __iomem *__arm_ioremap(unsigned long phys_addr, size_t size,
-                            unsigned int mtype, void *caller)
+void __iomem *__arm_ioremap_caller(unsigned long phys_addr, size_t size,
+                                   unsigned int mtype, void *caller)
 {
         return __arm_ioremap(phys_addr, size, mtype);
 }
diff --git a/arch/arm/mm/tlb-v7.S b/arch/arm/mm/tlb-v7.S
index 0cb1848bd87..f3f288a9546 100644
--- a/arch/arm/mm/tlb-v7.S
+++ b/arch/arm/mm/tlb-v7.S
@@ -50,7 +50,11 @@ ENTRY(v7wbi_flush_user_tlb_range)
         cmp     r0, r1
         blo     1b
         mov     ip, #0
+#ifdef CONFIG_SMP
+        mcr     p15, 0, ip, c7, c1, 6           @ flush BTAC/BTB Inner Shareable
+#else
         mcr     p15, 0, ip, c7, c5, 6           @ flush BTAC/BTB
+#endif
         dsb
         mov     pc, lr
 ENDPROC(v7wbi_flush_user_tlb_range)
@@ -79,7 +83,11 @@ ENTRY(v7wbi_flush_kern_tlb_range)
         cmp     r0, r1
         blo     1b
         mov     r2, #0
+#ifdef CONFIG_SMP
+        mcr     p15, 0, r2, c7, c1, 6           @ flush BTAC/BTB Inner Shareable
+#else
         mcr     p15, 0, r2, c7, c5, 6           @ flush BTAC/BTB
+#endif
         dsb
         isb
         mov     pc, lr
diff --git a/arch/arm/plat-mxc/include/mach/dma-mx1-mx2.h b/arch/arm/plat-mxc/include/mach/dma-mx1-mx2.h
index 07be8ad7ec3..7c4870bd5a2 100644
--- a/arch/arm/plat-mxc/include/mach/dma-mx1-mx2.h
+++ b/arch/arm/plat-mxc/include/mach/dma-mx1-mx2.h
@@ -31,7 +31,13 @@
 #define DMA_MODE_WRITE          1
 #define DMA_MODE_MASK           1
 
-#define DMA_BASE IO_ADDRESS(DMA_BASE_ADDR)
+#define MX1_DMA_REG(offset)     MX1_IO_ADDRESS(MX1_DMA_BASE_ADDR + (offset))
+
+/* DMA Interrupt Mask Register */
+#define MX1_DMA_DIMR            MX1_DMA_REG(0x08)
+
+/* Channel Control Register */
+#define MX1_DMA_CCR(x)          MX1_DMA_REG(0x8c + ((x) << 6))
 
 #define IMX_DMA_MEMSIZE_32      (0 << 4)
 #define IMX_DMA_MEMSIZE_8       (1 << 4)
diff --git a/arch/arm/plat-omap/include/plat/usb.h b/arch/arm/plat-omap/include/plat/usb.h
index 568578db93b..876ca8d5e92 100644
--- a/arch/arm/plat-omap/include/plat/usb.h
+++ b/arch/arm/plat-omap/include/plat/usb.h
@@ -46,7 +46,7 @@ struct ehci_hcd_omap_platform_data {
 struct omap_musb_board_data {
         u8      interface_type;
         u8      mode;
-        u8      power;
+        u16     power;
 };
 
 enum musb_interface    {MUSB_INTERFACE_ULPI, MUSB_INTERFACE_UTMI};
diff --git a/arch/arm/plat-pxa/dma.c b/arch/arm/plat-pxa/dma.c
index 742350e0f2a..2d3c19d7c7b 100644
--- a/arch/arm/plat-pxa/dma.c
+++ b/arch/arm/plat-pxa/dma.c
@@ -245,7 +245,7 @@ static void pxa_dma_init_debugfs(void)
 
         dbgfs_chan = kmalloc(sizeof(*dbgfs_state) * num_dma_channels,
                              GFP_KERNEL);
-        if (!dbgfs_state)
+        if (!dbgfs_chan)
                 goto err_alloc;
 
         chandir = debugfs_create_dir("channels", dbgfs_root);
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 1536f1784ca..8f10d24ae62 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Sat Mar 20 15:35:41 2010
+# Last update: Sat May 1 10:36:42 2010
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -2749,3 +2749,58 @@ stamp9g45		MACH_STAMP9G45		STAMP9G45		2761
 h6053                   MACH_H6053              H6053                   2762
 smint01                 MACH_SMINT01            SMINT01                 2763
 prtlvt2                 MACH_PRTLVT2            PRTLVT2                 2764
+ap420                   MACH_AP420              AP420                   2765
+htcshift                MACH_HTCSHIFT           HTCSHIFT                2766
+davinci_dm365_fc        MACH_DAVINCI_DM365_FC   DAVINCI_DM365_FC        2767
+msm8x55_surf            MACH_MSM8X55_SURF       MSM8X55_SURF            2768
+msm8x55_ffa             MACH_MSM8X55_FFA        MSM8X55_FFA             2769
+esl_vamana              MACH_ESL_VAMANA         ESL_VAMANA              2770
+sbc35                   MACH_SBC35              SBC35                   2771
+mpx6446                 MACH_MPX6446            MPX6446                 2772
+oreo_controller         MACH_OREO_CONTROLLER    OREO_CONTROLLER         2773
+kopin_models            MACH_KOPIN_MODELS       KOPIN_MODELS            2774
+ttc_vision2             MACH_TTC_VISION2        TTC_VISION2             2775
+cns3420vb               MACH_CNS3420VB          CNS3420VB               2776
+lpc2                    MACH_LPC2               LPC2                    2777
+olympus                 MACH_OLYMPUS            OLYMPUS                 2778
+vortex                  MACH_VORTEX             VORTEX                  2779
+s5pc200                 MACH_S5PC200            S5PC200                 2780
+ecucore_9263            MACH_ECUCORE_9263       ECUCORE_9263            2781
+smdkc200                MACH_SMDKC200           SMDKC200                2782
+emsiso_sx27             MACH_EMSISO_SX27        EMSISO_SX27             2783
+apx_som9g45_ek          MACH_APX_SOM9G45_EK     APX_SOM9G45_EK          2784
+songshan                MACH_SONGSHAN           SONGSHAN                2785
+tianshan                MACH_TIANSHAN           TIANSHAN                2786
+vpx500                  MACH_VPX500             VPX500                  2787
+am3517sam               MACH_AM3517SAM          AM3517SAM               2788
+skat91_sim508           MACH_SKAT91_SIM508      SKAT91_SIM508           2789
+skat91_s3e              MACH_SKAT91_S3E         SKAT91_S3E              2790
+omap4_panda             MACH_OMAP4_PANDA        OMAP4_PANDA             2791
+df7220                  MACH_DF7220             DF7220                  2792
+nemini                  MACH_NEMINI             NEMINI                  2793
+t8200                   MACH_T8200              T8200                   2794
+apf51                   MACH_APF51              APF51                   2795
+dr_rc_unit              MACH_DR_RC_UNIT         DR_RC_UNIT              2796
+bordeaux                MACH_BORDEAUX           BORDEAUX                2797
+catania_b               MACH_CATANIA_B          CATANIA_B               2798
+mx51_ocean              MACH_MX51_OCEAN         MX51_OCEAN              2799
+ti8168evm               MACH_TI8168EVM          TI8168EVM               2800
+neocoreomap             MACH_NEOCOREOMAP        NEOCOREOMAP             2801
+withings_wbp            MACH_WITHINGS_WBP       WITHINGS_WBP            2802
+dbps                    MACH_DBPS               DBPS                    2803
+sbc9261                 MACH_SBC9261            SBC9261                 2804
+pcbfp0001               MACH_PCBFP0001          PCBFP0001               2805
+speedy                  MACH_SPEEDY             SPEEDY                  2806
+chrysaor                MACH_CHRYSAOR           CHRYSAOR                2807
+tango                   MACH_TANGO              TANGO                   2808
+synology_dsx11          MACH_SYNOLOGY_DSX11     SYNOLOGY_DSX11          2809
+hanlin_v3ext            MACH_HANLIN_V3EXT       HANLIN_V3EXT            2810
+hanlin_v5               MACH_HANLIN_V5          HANLIN_V5               2811
+hanlin_v3plus           MACH_HANLIN_V3PLUS      HANLIN_V3PLUS           2812
+iriver_story            MACH_IRIVER_STORY       IRIVER_STORY            2813
+irex_iliad              MACH_IREX_ILIAD         IREX_ILIAD              2814
+irex_dr1000             MACH_IREX_DR1000        IREX_DR1000             2815
+teton_bga               MACH_TETON_BGA          TETON_BGA               2816
+snapper9g45             MACH_SNAPPER9G45        SNAPPER9G45             2817
+tam3517                 MACH_TAM3517            TAM3517                 2818
+pdc100                  MACH_PDC100             PDC100                  2819
diff --git a/arch/microblaze/configs/mmu_defconfig b/arch/microblaze/configs/mmu_defconfig
index 6fced1fe3bf..3c91cf6192c 100644
--- a/arch/microblaze/configs/mmu_defconfig
+++ b/arch/microblaze/configs/mmu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.33-rc6
-# Wed Feb  3 10:02:59 2010
+# Linux kernel version: 2.6.34-rc6
+# Thu May  6 11:22:14 2010
 #
 CONFIG_MICROBLAZE=y
 # CONFIG_SWAP is not set
@@ -22,8 +22,6 @@ CONFIG_GENERIC_CSUM=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_HAVE_LATENCYTOP_SUPPORT=y
-# CONFIG_PCI is not set
-CONFIG_NO_DMA=y
 CONFIG_DTC=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 CONFIG_CONSTRUCTORS=y
@@ -56,7 +54,6 @@ CONFIG_RCU_FANOUT=32
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=17
-# CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
@@ -106,6 +103,8 @@ CONFIG_SLAB=y
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
 CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_HAVE_DMA_API_DEBUG=y
 
 #
 # GCOV-based kernel profiling
@@ -245,13 +244,20 @@ CONFIG_BINFMT_ELF=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_HAVE_AOUT is not set
 # CONFIG_BINFMT_MISC is not set
+
+#
+# Bus Options
+#
+# CONFIG_PCI is not set
+# CONFIG_PCI_DOMAINS is not set
+# CONFIG_PCI_SYSCALL is not set
+# CONFIG_ARCH_SUPPORTS_MSI is not set
 CONFIG_NET=y
 
 #
 # Networking options
 #
 CONFIG_PACKET=y
-# CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
@@ -341,7 +347,9 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_CONNECTOR is not set
 # CONFIG_MTD is not set
+CONFIG_OF_FLATTREE=y
 CONFIG_OF_DEVICE=y
+CONFIG_OF_MDIO=y
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
@@ -370,6 +378,7 @@ CONFIG_MISC_DEVICES=y
 #
 # SCSI device support
 #
+CONFIG_SCSI_MOD=y
 # CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
 # CONFIG_SCSI_DMA is not set
@@ -383,9 +392,30 @@ CONFIG_NETDEVICES=y
 # CONFIG_EQUALIZER is not set
 # CONFIG_TUN is not set
 # CONFIG_VETH is not set
-# CONFIG_PHYLIB is not set
+CONFIG_PHYLIB=y
+
+#
+# MII PHY device drivers
+#
+# CONFIG_MARVELL_PHY is not set
+# CONFIG_DAVICOM_PHY is not set
+# CONFIG_QSEMI_PHY is not set
+# CONFIG_LXT_PHY is not set
+# CONFIG_CICADA_PHY is not set
+# CONFIG_VITESSE_PHY is not set
+# CONFIG_SMSC_PHY is not set
+# CONFIG_BROADCOM_PHY is not set
+# CONFIG_ICPLUS_PHY is not set
+# CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
+# CONFIG_MICREL_PHY is not set
+# CONFIG_FIXED_PHY is not set
+# CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
 # CONFIG_MII is not set
+# CONFIG_ETHOC is not set
 # CONFIG_DNET is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
@@ -394,6 +424,7 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
+# CONFIG_B44 is not set
 # CONFIG_KS8842 is not set
 # CONFIG_KS8851_MLL is not set
 CONFIG_XILINX_EMACLITE=y
@@ -444,6 +475,7 @@ CONFIG_SERIAL_UARTLITE=y
 CONFIG_SERIAL_UARTLITE_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_TIMBERDALE is not set
 # CONFIG_SERIAL_GRLIB_GAISLER_APBUART is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
@@ -471,6 +503,12 @@ CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
 # CONFIG_WATCHDOG is not set
+CONFIG_SSB_POSSIBLE=y
+
+#
+# Sonics Silicon Backplane
+#
+# CONFIG_SSB is not set
 
 #
 # Multifunction device drivers
@@ -502,6 +540,7 @@ CONFIG_USB_ARCH_HAS_EHCI=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
 
@@ -572,6 +611,7 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
+# CONFIG_LOGFS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
@@ -595,6 +635,7 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_KRB5 is not set
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
+# CONFIG_CEPH_FS is not set
 CONFIG_CIFS=y
 CONFIG_CIFS_STATS=y
 CONFIG_CIFS_STATS2=y
@@ -696,6 +737,7 @@ CONFIG_SCHED_DEBUG=y
 # CONFIG_DEBUG_OBJECTS is not set
 CONFIG_DEBUG_SLAB=y
 # CONFIG_DEBUG_SLAB_LEAK is not set
+# CONFIG_DEBUG_KMEMLEAK is not set
 CONFIG_DEBUG_SPINLOCK=y
 # CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_LOCK_ALLOC is not set
@@ -741,6 +783,7 @@ CONFIG_BRANCH_PROFILE_NONE=y
 # CONFIG_KMEMTRACE is not set
 # CONFIG_WORKQUEUE_TRACER is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_DMA_API_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_EARLY_PRINTK=y
 # CONFIG_HEART_BEAT is not set
@@ -862,5 +905,6 @@ CONFIG_ZLIB_INFLATE=y
 CONFIG_DECOMPRESS_GZIP=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
+CONFIG_HAS_DMA=y
 CONFIG_HAVE_LMB=y
 CONFIG_NLATTR=y
diff --git a/arch/microblaze/configs/nommu_defconfig b/arch/microblaze/configs/nommu_defconfig
index ce2da535246..dd3a494257f 100644
--- a/arch/microblaze/configs/nommu_defconfig
+++ b/arch/microblaze/configs/nommu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.33-rc6
-# Wed Feb  3 10:03:21 2010
+# Linux kernel version: 2.6.34-rc6
+# Thu May  6 11:25:12 2010
 #
 CONFIG_MICROBLAZE=y
 # CONFIG_SWAP is not set
@@ -22,8 +22,6 @@ CONFIG_GENERIC_CSUM=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_HAVE_LATENCYTOP_SUPPORT=y
-# CONFIG_PCI is not set
-CONFIG_NO_DMA=y
 CONFIG_DTC=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 CONFIG_CONSTRUCTORS=y
@@ -58,7 +56,6 @@ CONFIG_RCU_FANOUT=32
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=17
-# CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
@@ -96,6 +93,8 @@ CONFIG_SLAB=y
 # CONFIG_MMAP_ALLOW_UNINITIALIZED is not set
 # CONFIG_PROFILING is not set
 CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_HAVE_DMA_API_DEBUG=y
 
 #
 # GCOV-based kernel profiling
@@ -209,11 +208,14 @@ CONFIG_PROC_DEVICETREE=y
 #
 # Advanced setup
 #
+# CONFIG_ADVANCED_OPTIONS is not set
 
 #
 # Default settings for advanced configuration options are used
 #
+CONFIG_LOWMEM_SIZE=0x30000000
 CONFIG_KERNEL_START=0x90000000
+CONFIG_TASK_SIZE=0x80000000
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
 # CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -235,13 +237,20 @@ CONFIG_BINFMT_FLAT=y
 # CONFIG_BINFMT_SHARED_FLAT is not set
 # CONFIG_HAVE_AOUT is not set
 # CONFIG_BINFMT_MISC is not set
+
+#
+# Bus Options
+#
+# CONFIG_PCI is not set
+# CONFIG_PCI_DOMAINS is not set
+# CONFIG_PCI_SYSCALL is not set
+# CONFIG_ARCH_SUPPORTS_MSI is not set
 CONFIG_NET=y
 
 #
 # Networking options
 #
 CONFIG_PACKET=y
-# CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
@@ -413,6 +422,7 @@ CONFIG_MTD_UCLINUX=y
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
+CONFIG_OF_FLATTREE=y
 CONFIG_OF_DEVICE=y
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
@@ -442,6 +452,7 @@ CONFIG_MISC_DEVICES=y
 #
 # SCSI device support
 #
+CONFIG_SCSI_MOD=y
 # CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
 # CONFIG_SCSI_DMA is not set
@@ -458,6 +469,7 @@ CONFIG_NETDEVICES=y
 # CONFIG_PHYLIB is not set
 CONFIG_NET_ETHERNET=y
 # CONFIG_MII is not set
+# CONFIG_ETHOC is not set
 # CONFIG_DNET is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
@@ -466,6 +478,7 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
+# CONFIG_B44 is not set
 # CONFIG_KS8842 is not set
 # CONFIG_KS8851_MLL is not set
 # CONFIG_XILINX_EMACLITE is not set
@@ -516,6 +529,7 @@ CONFIG_SERIAL_UARTLITE=y
 CONFIG_SERIAL_UARTLITE_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_TIMBERDALE is not set
 # CONFIG_SERIAL_GRLIB_GAISLER_APBUART is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
@@ -544,6 +558,12 @@ CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
 # CONFIG_WATCHDOG is not set
+CONFIG_SSB_POSSIBLE=y
+
+#
+# Sonics Silicon Backplane
+#
+# CONFIG_SSB is not set
 
 #
 # Multifunction device drivers
@@ -593,6 +613,7 @@ CONFIG_USB_ARCH_HAS_EHCI=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
 
@@ -661,6 +682,7 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
 # CONFIG_JFFS2_FS is not set
+# CONFIG_LOGFS is not set
 CONFIG_CRAMFS=y
 # CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
@@ -689,6 +711,7 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_KRB5 is not set
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
+# CONFIG_CEPH_FS is not set
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
@@ -733,6 +756,7 @@ CONFIG_DEBUG_OBJECTS_TIMERS=y
 # CONFIG_DEBUG_OBJECTS_WORK is not set
 CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_KMEMLEAK is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
@@ -758,6 +782,7 @@ CONFIG_DEBUG_SG=y
 # CONFIG_BACKTRACE_SELF_TEST is not set
 # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+# CONFIG_LKDTM is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
@@ -782,6 +807,7 @@ CONFIG_BRANCH_PROFILE_NONE=y
 # CONFIG_WORKQUEUE_TRACER is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_DYNAMIC_DEBUG is not set
+# CONFIG_DMA_API_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_EARLY_PRINTK=y
 # CONFIG_HEART_BEAT is not set
@@ -901,5 +927,6 @@ CONFIG_GENERIC_FIND_LAST_BIT=y
 CONFIG_ZLIB_INFLATE=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
+CONFIG_HAS_DMA=y
 CONFIG_HAVE_LMB=y
 CONFIG_NLATTR=y
diff --git a/arch/microblaze/include/asm/cache.h b/arch/microblaze/include/asm/cache.h
index e52210891d7..4efe96a036f 100644
--- a/arch/microblaze/include/asm/cache.h
+++ b/arch/microblaze/include/asm/cache.h
@@ -15,7 +15,7 @@
 
 #include <asm/registers.h>
 
-#define L1_CACHE_SHIFT  2
+#define L1_CACHE_SHIFT 5
 /* word-granular cache in microblaze */
 #define L1_CACHE_BYTES  (1 << L1_CACHE_SHIFT)
 
diff --git a/arch/microblaze/include/asm/dma.h b/arch/microblaze/include/asm/dma.h
index 08c073badf1..0d73d0c6de3 100644
--- a/arch/microblaze/include/asm/dma.h
+++ b/arch/microblaze/include/asm/dma.h
@@ -18,4 +18,10 @@
 #define MAX_DMA_ADDRESS (CONFIG_KERNEL_START + memory_size - 1)
 #endif
 
+#ifdef CONFIG_PCI
+extern int isa_dma_bridge_buggy;
+#else
+#define isa_dma_bridge_buggy     (0)
+#endif
+
 #endif /* _ASM_MICROBLAZE_DMA_H */
diff --git a/arch/microblaze/include/asm/exceptions.h b/arch/microblaze/include/asm/exceptions.h
index 90731df9e57..4c7b5d037c8 100644
--- a/arch/microblaze/include/asm/exceptions.h
+++ b/arch/microblaze/include/asm/exceptions.h
@@ -64,12 +64,6 @@ asmlinkage void full_exception(struct pt_regs *regs, unsigned int type,
 void die(const char *str, struct pt_regs *fp, long err);
 void _exception(int signr, struct pt_regs *regs, int code, unsigned long addr);
 
-#ifdef CONFIG_MMU
-void __bug(const char *file, int line, void *data);
-int bad_trap(int trap_num, struct pt_regs *regs);
-int debug_trap(struct pt_regs *regs);
-#endif /* CONFIG_MMU */
-
 #if defined(CONFIG_KGDB)
 void (*debugger)(struct pt_regs *regs);
 int (*debugger_bpt)(struct pt_regs *regs);
diff --git a/arch/microblaze/include/asm/io.h b/arch/microblaze/include/asm/io.h
index e45a6eea92e..00b5398d08c 100644
--- a/arch/microblaze/include/asm/io.h
+++ b/arch/microblaze/include/asm/io.h
@@ -139,8 +139,6 @@ static inline void writel(unsigned int v, volatile void __iomem *addr)
 
 #ifdef CONFIG_MMU
 
-#define mm_ptov(addr)           ((void *)__phys_to_virt(addr))
-#define mm_vtop(addr)           ((unsigned long)__virt_to_phys(addr))
 #define phys_to_virt(addr)      ((void *)__phys_to_virt(addr))
 #define virt_to_phys(addr)      ((unsigned long)__virt_to_phys(addr))
 #define virt_to_bus(addr)       ((unsigned long)__virt_to_phys(addr))
diff --git a/arch/microblaze/include/asm/page.h b/arch/microblaze/include/asm/page.h
index 2dd1d04129e..de493f86d28 100644
--- a/arch/microblaze/include/asm/page.h
+++ b/arch/microblaze/include/asm/page.h
@@ -31,6 +31,9 @@
 
 #ifndef __ASSEMBLY__
 
+/* MS be sure that SLAB allocates aligned objects */
+#define ARCH_KMALLOC_MINALIGN   L1_CACHE_BYTES
+
 #define PAGE_UP(addr)   (((addr)+((PAGE_SIZE)-1))&(~((PAGE_SIZE)-1)))
 #define PAGE_DOWN(addr) ((addr)&(~((PAGE_SIZE)-1)))
 
@@ -70,14 +73,7 @@ typedef unsigned long pte_basic_t;
 
 #endif /* CONFIG_MMU */
 
-#  ifndef CONFIG_MMU
-#  define copy_page(to, from)                   memcpy((to), (from), PAGE_SIZE)
-#  define get_user_page(vaddr)                  __get_free_page(GFP_KERNEL)
-#  define free_user_page(page, addr)            free_page(addr)
-#  else /* CONFIG_MMU */
-extern void copy_page(void *to, void *from);
-#  endif /* CONFIG_MMU */
-
+# define copy_page(to, from)                    memcpy((to), (from), PAGE_SIZE)
 # define clear_page(pgaddr)                     memset((pgaddr), 0, PAGE_SIZE)
 
 # define clear_user_page(pgaddr, vaddr, page)   memset((pgaddr), 0, PAGE_SIZE)
diff --git a/arch/microblaze/include/asm/pci.h b/arch/microblaze/include/asm/pci.h
index bdd65aaee30..5a388eeeb28 100644
--- a/arch/microblaze/include/asm/pci.h
+++ b/arch/microblaze/include/asm/pci.h
@@ -94,14 +94,6 @@ extern int pci_mmap_legacy_page_range(struct pci_bus *bus,
 
 #define HAVE_PCI_LEGACY 1
 
-/* pci_unmap_{page,single} is a nop so... */
-#define DECLARE_PCI_UNMAP_ADDR(ADDR_NAME)
-#define DECLARE_PCI_UNMAP_LEN(LEN_NAME)
-#define pci_unmap_addr(PTR, ADDR_NAME)          (0)
-#define pci_unmap_addr_set(PTR, ADDR_NAME, VAL) do { } while (0)
-#define pci_unmap_len(PTR, LEN_NAME)            (0)
-#define pci_unmap_len_set(PTR, LEN_NAME, VAL)   do { } while (0)
-
 /* The PCI address space does equal the physical memory
  * address space (no IOMMU).  The IDE and SCSI device layers use
  * this boolean for bounce buffer decisions.
diff --git a/arch/microblaze/include/asm/pgalloc.h b/arch/microblaze/include/asm/pgalloc.h
index f44b0d696fe..c614a893f8a 100644
--- a/arch/microblaze/include/asm/pgalloc.h
+++ b/arch/microblaze/include/asm/pgalloc.h
@@ -108,21 +108,7 @@ extern inline void free_pgd_slow(pgd_t *pgd)
 #define pmd_alloc_one_fast(mm, address) ({ BUG(); ((pmd_t *)1); })
 #define pmd_alloc_one(mm, address)      ({ BUG(); ((pmd_t *)2); })
 
-static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
-                unsigned long address)
-{
-        pte_t *pte;
-        extern void *early_get_page(void);
-        if (mem_init_done) {
-                pte = (pte_t *)__get_free_page(GFP_KERNEL |
-                                        __GFP_REPEAT | __GFP_ZERO);
-        } else {
-                pte = (pte_t *)early_get_page();
-                if (pte)
-                        clear_page(pte);
-        }
-        return pte;
-}
+extern pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long addr);
 
 static inline struct page *pte_alloc_one(struct mm_struct *mm,
                 unsigned long address)
diff --git a/arch/microblaze/include/asm/pgtable.h b/arch/microblaze/include/asm/pgtable.h
index dd2bb60651c..ca2d9287154 100644
--- a/arch/microblaze/include/asm/pgtable.h
+++ b/arch/microblaze/include/asm/pgtable.h
@@ -512,15 +512,6 @@ static inline pmd_t *pmd_offset(pgd_t *dir, unsigned long address)
 extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 
 /*
- * When flushing the tlb entry for a page, we also need to flush the hash
- * table entry.  flush_hash_page is assembler (for speed) in hashtable.S.
- */
-extern int flush_hash_page(unsigned context, unsigned long va, pte_t *ptep);
-
-/* Add an HPTE to the hash table */
-extern void add_hash_page(unsigned context, unsigned long va, pte_t *ptep);
-
-/*
  * Encode and decode a swap entry.
  * Note that the bits we use in a PTE for representing a swap entry
  * must not include the _PAGE_PRESENT bit, or the _PAGE_HASHPTE bit
@@ -533,15 +524,7 @@ extern void add_hash_page(unsigned context, unsigned long va, pte_t *ptep);
 #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) >> 2 })
 #define __swp_entry_to_pte(x)   ((pte_t) { (x).val << 2 })
 
-
-/* CONFIG_APUS */
-/* For virtual address to physical address conversion */
-extern void cache_clear(__u32 addr, int length);
-extern void cache_push(__u32 addr, int length);
-extern int mm_end_of_chunk(unsigned long addr, int len);
 extern unsigned long iopa(unsigned long addr);
-/* extern unsigned long mm_ptov(unsigned long addr) \
-        __attribute__ ((const)); TBD */
 
 /* Values for nocacheflag and cmode */
 /* These are not used by the APUS kernel_map, but prevents
@@ -552,18 +535,6 @@ extern unsigned long iopa(unsigned long addr);
 #define IOMAP_NOCACHE_NONSER    2
 #define IOMAP_NO_COPYBACK       3
 
-/*
- * Map some physical address range into the kernel address space.
- */
-extern unsigned long kernel_map(unsigned long paddr, unsigned long size,
-                                int nocacheflag, unsigned long *memavailp);
-
-/*
- * Set cache mode of (kernel space) address range.
- */
-extern void kernel_set_cachemode(unsigned long address, unsigned long size,
-                                unsigned int cmode);
-
 /* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
 #define kern_addr_valid(addr)   (1)
 
@@ -577,10 +548,6 @@ extern void kernel_set_cachemode(unsigned long address, unsigned long size,
 void do_page_fault(struct pt_regs *regs, unsigned long address,
                    unsigned long error_code);
 
-void __init io_block_mapping(unsigned long virt, phys_addr_t phys,
-                             unsigned int size, int flags);
-
-void __init adjust_total_lowmem(void);
 void mapin_ram(void);
 int map_page(unsigned long va, phys_addr_t pa, int flags);
 
@@ -601,7 +568,7 @@ void __init *early_get_page(void);
 extern unsigned long ioremap_bot, ioremap_base;
 
 void *consistent_alloc(int gfp, size_t size, dma_addr_t *dma_handle);
-void consistent_free(void *vaddr);
+void consistent_free(size_t size, void *vaddr);
 void consistent_sync(void *vaddr, size_t size, int direction);
 void consistent_sync_page(struct page *page, unsigned long offset,
         size_t size, int direction);
diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
index 446bec29b14..26460d15b33 100644
--- a/arch/microblaze/include/asm/uaccess.h
+++ b/arch/microblaze/include/asm/uaccess.h
@@ -182,6 +182,39 @@ extern long __user_bad(void);
  * Returns zero on success, or -EFAULT on error.
  * On error, the variable @x is set to zero.
  */
+#define get_user(x, ptr)                                                \
+        __get_user_check((x), (ptr), sizeof(*(ptr)))
+
+#define __get_user_check(x, ptr, size)                                  \
+({                                                                      \
+        unsigned long __gu_val = 0;                                     \
+        const typeof(*(ptr)) __user *__gu_addr = (ptr);                 \
+        int __gu_err = 0;                                               \
+                                                                        \
+        if (access_ok(VERIFY_READ, __gu_addr, size)) {                  \
+                switch (size) {                                         \
+                case 1:                                                 \
+                        __get_user_asm("lbu", __gu_addr, __gu_val,      \
+                                       __gu_err);                       \
+                        break;                                          \
+                case 2:                                                 \
+                        __get_user_asm("lhu", __gu_addr, __gu_val,      \
+                                       __gu_err);                       \
+                        break;                                          \
+                case 4:                                                 \
+                        __get_user_asm("lw", __gu_addr, __gu_val,       \
+                                       __gu_err);                       \
+                        break;                                          \
+                default:                                                \
+                        __gu_err = __user_bad();                        \
+                        break;                                          \
+                }                                                       \
+        } else {                                                        \
+                __gu_err = -EFAULT;                                     \
+        }                                                               \
+        x = (typeof(*(ptr)))__gu_val;                                   \
+        __gu_err;                                                       \
+})
 
 #define __get_user(x, ptr)                                              \
 ({                                                                      \
@@ -206,12 +239,6 @@ extern long __user_bad(void);
 })
 
 
-#define get_user(x, ptr)                                                \
-({                                                                      \
-        access_ok(VERIFY_READ, (ptr), sizeof(*(ptr)))                   \
-                ? __get_user((x), (ptr)) : -EFAULT;                     \
-})
-
 #define __put_user_asm(insn, __gu_ptr, __gu_val, __gu_err)      \
 ({                                                              \
         __asm__ __volatile__ (                                  \
@@ -266,6 +293,42 @@ extern long __user_bad(void);
  *
  * Returns zero on success, or -EFAULT on error.
  */
+#define put_user(x, ptr)                                                \
+        __put_user_check((x), (ptr), sizeof(*(ptr)))
+
+#define __put_user_check(x, ptr, size)                                  \
+({                                                                      \
+        typeof(*(ptr)) __pu_val;                                        \
+        typeof(*(ptr)) __user *__pu_addr = (ptr);                       \
+        int __pu_err = 0;                                               \
+                                                                        \
+        __pu_val = (x);                                                 \
+        if (access_ok(VERIFY_WRITE, __pu_addr, size)) {                 \
+                switch (size) {                                         \
+                case 1:                                                 \
+                        __put_user_asm("sb", __pu_addr, __pu_val,       \
+                                       __pu_err);                       \
+                        break;                                          \
+                case 2:                                                 \
+                        __put_user_asm("sh", __pu_addr, __pu_val,       \
+                                       __pu_err);                       \
+                        break;                                          \
+                case 4:                                                 \
+                        __put_user_asm("sw", __pu_addr, __pu_val,       \
+                                       __pu_err);                       \
+                        break;                                          \
+                case 8:                                                 \
+                        __put_user_asm_8(__pu_addr, __pu_val, __pu_err);\
+                        break;                                          \
+                default:                                                \
+                        __pu_err = __user_bad();                        \
+                        break;                                          \
+                }                                                       \
+        } else {                                                        \
+                __pu_err = -EFAULT;                                     \
+        }                                                               \
+        __pu_err;                                                       \
+})
 
 #define __put_user(x, ptr)                                              \
 ({                                                                      \
@@ -290,18 +353,6 @@ extern long __user_bad(void);
         __gu_err;                                                       \
 })
 
-#ifndef CONFIG_MMU
-
-#define put_user(x, ptr)        __put_user((x), (ptr))
-
-#else /* CONFIG_MMU */
-
-#define put_user(x, ptr)                                                \
-({                                                                      \
-        access_ok(VERIFY_WRITE, (ptr), sizeof(*(ptr)))                  \
-                ? __put_user((x), (ptr)) : -EFAULT;                     \
-})
-#endif /* CONFIG_MMU */
 
 /* copy_to_from_user */
 #define __copy_from_user(to, from, n)   \
diff --git a/arch/microblaze/kernel/asm-offsets.c b/arch/microblaze/kernel/asm-offsets.c
index 0071260a672..c1b459c9757 100644
--- a/arch/microblaze/kernel/asm-offsets.c
+++ b/arch/microblaze/kernel/asm-offsets.c
@@ -16,6 +16,7 @@
 #include <linux/hardirq.h>
 #include <linux/thread_info.h>
 #include <linux/kbuild.h>
+#include <asm/cpuinfo.h>
 
 int main(int argc, char *argv[])
 {
diff --git a/arch/microblaze/kernel/cpu/cache.c b/arch/microblaze/kernel/cpu/cache.c
index f04d8a86dea..109876e8d64 100644
--- a/arch/microblaze/kernel/cpu/cache.c
+++ b/arch/microblaze/kernel/cpu/cache.c
@@ -96,13 +96,16 @@ static inline void __disable_dcache_nomsr(void)
 }
 
 
-/* Helper macro for computing the limits of cache range loops */
+/* Helper macro for computing the limits of cache range loops
+ *
+ * End address can be unaligned which is OK for C implementation.
+ * ASM implementation align it in ASM macros
+ */
 #define CACHE_LOOP_LIMITS(start, end, cache_line_length, cache_size)    \
 do {                                                                    \
         int align = ~(cache_line_length - 1);                           \
         end = min(start + cache_size, end);                             \
         start &= align;                                                 \
-        end = ((end & align) + cache_line_length);                      \
 } while (0);
 
 /*
@@ -111,9 +114,9 @@ do {									\
  */
 #define CACHE_ALL_LOOP(cache_size, line_length, op)                     \
 do {                                                                    \
-        unsigned int len = cache_size;                                  \
+        unsigned int len = cache_size - line_length;                    \
         int step = -line_length;                                        \
-        BUG_ON(step >= 0);                                              \
+        WARN_ON(step >= 0);                                             \
                                                                         \
         __asm__ __volatile__ (" 1:      " #op " %0, r0;                 \
                                         bgtid   %0, 1b;                 \
@@ -122,26 +125,22 @@ do {									\
                                         : "memory");                    \
 } while (0);
 
-
-#define CACHE_ALL_LOOP2(cache_size, line_length, op)                    \
-do {                                                                    \
-        unsigned int len = cache_size;                                  \
-        int step = -line_length;                                        \
-        BUG_ON(step >= 0);                                              \
-                                                                        \
-        __asm__ __volatile__ (" 1:      " #op " r0, %0;                 \
-                                        bgtid   %0, 1b;                 \
-                                        addk    %0, %0, %1;             \
-                                        " : : "r" (len), "r" (step)     \
-                                        : "memory");                    \
-} while (0);
-
-/* for wdc.flush/clear */
+/* Used for wdc.flush/clear which can use rB for offset which is not possible
+ * to use for simple wdc or wic.
+ *
+ * start address is cache aligned
+ * end address is not aligned, if end is aligned then I have to substract
+ * cacheline length because I can't flush/invalidate the next cacheline.
+ * If is not, I align it because I will flush/invalidate whole line.
+ */
 #define CACHE_RANGE_LOOP_2(start, end, line_length, op)                 \
 do {                                                                    \
         int step = -line_length;                                        \
-        int count = end - start;                                        \
-        BUG_ON(count <= 0);                                             \
+        int align = ~(line_length - 1);                                 \
+        int count;                                                      \
+        end = ((end & align) == end) ? end - line_length : end & align; \
+        count = end - start;                                            \
+        WARN_ON(count < 0);                                             \
                                                                         \
         __asm__ __volatile__ (" 1:      " #op " %0, %1;                 \
                                         bgtid   %1, 1b;                 \
@@ -154,7 +153,9 @@ do {									\
 #define CACHE_RANGE_LOOP_1(start, end, line_length, op)                 \
 do {                                                                    \
         int volatile temp;                                              \
-        BUG_ON(end - start <= 0);                                       \
+        int align = ~(line_length - 1);                                 \
+        end = ((end & align) == end) ? end - line_length : end & align; \
+        WARN_ON(end - start < 0);                                       \
                                                                         \
         __asm__ __volatile__ (" 1:      " #op " %1, r0;                 \
                                         cmpu    %0, %1, %2;             \
@@ -360,8 +361,12 @@ static void __invalidate_dcache_all_noirq_wt(void)
 #endif
 }
 
-/* FIXME this is weird - should be only wdc but not work
- * MS: I am getting bus errors and other weird things */
+/* FIXME It is blindly invalidation as is expected
+ * but can't be called on noMMU in microblaze_cache_init below
+ *
+ * MS: noMMU kernel won't boot if simple wdc is used
+ * The reason should be that there are discared data which kernel needs
+ */
 static void __invalidate_dcache_all_wb(void)
 {
 #ifndef ASM_LOOP
@@ -369,12 +374,12 @@ static void __invalidate_dcache_all_wb(void)
 #endif
         pr_debug("%s\n", __func__);
 #ifdef ASM_LOOP
-        CACHE_ALL_LOOP2(cpuinfo.dcache_size, cpuinfo.dcache_line_length,
-                                        wdc.clear)
+        CACHE_ALL_LOOP(cpuinfo.dcache_size, cpuinfo.dcache_line_length,
+                                        wdc)
 #else
         for (i = 0; i < cpuinfo.dcache_size;
                  i += cpuinfo.dcache_line_length)
-                        __asm__ __volatile__ ("wdc.clear        %0, r0;" \
+                        __asm__ __volatile__ ("wdc      %0, r0;" \
                                         : : "r" (i));
 #endif
 }
@@ -393,7 +398,7 @@ static void __invalidate_dcache_range_wb(unsigned long start,
 #ifdef ASM_LOOP
         CACHE_RANGE_LOOP_2(start, end, cpuinfo.dcache_line_length, wdc.clear);
 #else
-        for (i = start; i < end; i += cpuinfo.icache_line_length)
+        for (i = start; i < end; i += cpuinfo.dcache_line_length)
                 __asm__ __volatile__ ("wdc.clear        %0, r0;"        \
                                 : : "r" (i));
 #endif
@@ -413,7 +418,7 @@ static void __invalidate_dcache_range_nomsr_wt(unsigned long start,
 #ifdef ASM_LOOP
         CACHE_RANGE_LOOP_1(start, end, cpuinfo.dcache_line_length, wdc);
 #else
-        for (i = start; i < end; i += cpuinfo.icache_line_length)
+        for (i = start; i < end; i += cpuinfo.dcache_line_length)
                 __asm__ __volatile__ ("wdc      %0, r0;"        \
                                 : : "r" (i));
 #endif
@@ -437,7 +442,7 @@ static void __invalidate_dcache_range_msr_irq_wt(unsigned long start,
 #ifdef ASM_LOOP
         CACHE_RANGE_LOOP_1(start, end, cpuinfo.dcache_line_length, wdc);
 #else
-        for (i = start; i < end; i += cpuinfo.icache_line_length)
+        for (i = start; i < end; i += cpuinfo.dcache_line_length)
                 __asm__ __volatile__ ("wdc      %0, r0;"        \
                                 : : "r" (i));
 #endif
@@ -465,7 +470,7 @@ static void __invalidate_dcache_range_nomsr_irq(unsigned long start,
 #ifdef ASM_LOOP
         CACHE_RANGE_LOOP_1(start, end, cpuinfo.dcache_line_length, wdc);
 #else
-        for (i = start; i < end; i += cpuinfo.icache_line_length)
+        for (i = start; i < end; i += cpuinfo.dcache_line_length)
                 __asm__ __volatile__ ("wdc      %0, r0;"        \
                                 : : "r" (i));
 #endif
@@ -504,7 +509,7 @@ static void __flush_dcache_range_wb(unsigned long start, unsigned long end)
 #ifdef ASM_LOOP
         CACHE_RANGE_LOOP_2(start, end, cpuinfo.dcache_line_length, wdc.flush);
 #else
-        for (i = start; i < end; i += cpuinfo.icache_line_length)
+        for (i = start; i < end; i += cpuinfo.dcache_line_length)
                 __asm__ __volatile__ ("wdc.flush        %0, r0;"        \
                                 : : "r" (i));
 #endif
@@ -650,7 +655,11 @@ void microblaze_cache_init(void)
                         }
                 }
         }
-        invalidate_dcache();
+/* FIXME Invalidation is done in U-BOOT
+ * WT cache: Data is already written to main memory
+ * WB cache: Discard data on noMMU which caused that kernel doesn't boot
+ */
+        /* invalidate_dcache(); */
         enable_dcache();
 
         invalidate_icache();
diff --git a/arch/microblaze/kernel/cpu/mb.c b/arch/microblaze/kernel/cpu/mb.c
index 0c912b2a8e0..4216eb1eaa3 100644
--- a/arch/microblaze/kernel/cpu/mb.c
+++ b/arch/microblaze/kernel/cpu/mb.c
@@ -98,15 +98,17 @@ static int show_cpuinfo(struct seq_file *m, void *v)
 
         if (cpuinfo.use_icache)
                 count += seq_printf(m,
-                                "Icache:\t\t%ukB\n",
-                                cpuinfo.icache_size >> 10);
+                                "Icache:\t\t%ukB\tline length:\t%dB\n",
+                                cpuinfo.icache_size >> 10,
+                                cpuinfo.icache_line_length);
         else
                 count += seq_printf(m, "Icache:\t\tno\n");
 
         if (cpuinfo.use_dcache) {
                 count += seq_printf(m,
-                                "Dcache:\t\t%ukB\n",
-                                cpuinfo.dcache_size >> 10);
+                                "Dcache:\t\t%ukB\tline length:\t%dB\n",
+                                cpuinfo.dcache_size >> 10,
+                                cpuinfo.dcache_line_length);
                 if (cpuinfo.dcache_wb)
                         count += seq_printf(m, "\t\twrite-back\n");
                 else
diff --git a/arch/microblaze/kernel/dma.c b/arch/microblaze/kernel/dma.c
index ce72dd4967c..9dcd90b5df5 100644
--- a/arch/microblaze/kernel/dma.c
+++ b/arch/microblaze/kernel/dma.c
@@ -74,7 +74,7 @@ static void dma_direct_free_coherent(struct device *dev, size_t size,
                               void *vaddr, dma_addr_t dma_handle)
 {
 #ifdef NOT_COHERENT_CACHE
-        consistent_free(vaddr);
+        consistent_free(size, vaddr);
 #else
         free_pages((unsigned long)vaddr, get_order(size));
 #endif
diff --git a/arch/microblaze/kernel/entry-nommu.S b/arch/microblaze/kernel/entry-nommu.S
index 391d6197fc3..8cc18cd2cce 100644
--- a/arch/microblaze/kernel/entry-nommu.S
+++ b/arch/microblaze/kernel/entry-nommu.S
@@ -476,6 +476,8 @@ ENTRY(ret_from_fork)
         nop
 
 work_pending:
+        enable_irq
+
         andi    r11, r19, _TIF_NEED_RESCHED
         beqi    r11, 1f
         bralid  r15, schedule
diff --git a/arch/microblaze/kernel/exceptions.c b/arch/microblaze/kernel/exceptions.c
index d9f70f83097..02cbdfe5aa8 100644
--- a/arch/microblaze/kernel/exceptions.c
+++ b/arch/microblaze/kernel/exceptions.c
@@ -121,7 +121,7 @@ asmlinkage void full_exception(struct pt_regs *regs, unsigned int type,
                 }
                 printk(KERN_WARNING "Divide by zero exception " \
                                                         "in kernel mode.\n");
-                die("Divide by exception", regs, SIGBUS);
+                die("Divide by zero exception", regs, SIGBUS);
                 break;
         case MICROBLAZE_FPU_EXCEPTION:
                 pr_debug(KERN_WARNING "FPU exception\n");
diff --git a/arch/microblaze/kernel/head.S b/arch/microblaze/kernel/head.S
index da6a5f5dc76..1bf73988826 100644
--- a/arch/microblaze/kernel/head.S
+++ b/arch/microblaze/kernel/head.S
@@ -28,6 +28,7 @@
  * for more details.
  */
 
+#include <linux/init.h>
 #include <linux/linkage.h>
 #include <asm/thread_info.h>
 #include <asm/page.h>
@@ -49,7 +50,7 @@ swapper_pg_dir:
 
 #endif /* CONFIG_MMU */
 
-        .text
+        __HEAD
 ENTRY(_start)
 #if CONFIG_KERNEL_BASE_ADDR == 0
         brai    TOPHYS(real_start)
diff --git a/arch/microblaze/kernel/irq.c b/arch/microblaze/kernel/irq.c
index 6f39e2c001f..8f120aca123 100644
--- a/arch/microblaze/kernel/irq.c
+++ b/arch/microblaze/kernel/irq.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/ftrace.h>
 #include <linux/kernel.h>
 #include <linux/hardirq.h>
 #include <linux/interrupt.h>
@@ -32,7 +33,7 @@ EXPORT_SYMBOL_GPL(irq_of_parse_and_map);
 
 static u32 concurrent_irq;
 
-void do_IRQ(struct pt_regs *regs)
+void __irq_entry do_IRQ(struct pt_regs *regs)
 {
         unsigned int irq;
         struct pt_regs *old_regs = set_irq_regs(regs);
diff --git a/arch/microblaze/kernel/microblaze_ksyms.c b/arch/microblaze/kernel/microblaze_ksyms.c
index bc4dcb7d386..ff85f771803 100644
--- a/arch/microblaze/kernel/microblaze_ksyms.c
+++ b/arch/microblaze/kernel/microblaze_ksyms.c
@@ -52,3 +52,14 @@ EXPORT_SYMBOL_GPL(_ebss);
 extern void _mcount(void);
 EXPORT_SYMBOL(_mcount);
 #endif
+
+/*
+ * Assembly functions that may be used (directly or indirectly) by modules
+ */
+EXPORT_SYMBOL(__copy_tofrom_user);
+EXPORT_SYMBOL(__strncpy_user);
+
+#ifdef CONFIG_OPT_LIB_ASM
+EXPORT_SYMBOL(memcpy);
+EXPORT_SYMBOL(memmove);
+#endif
diff --git a/arch/microblaze/kernel/misc.S b/arch/microblaze/kernel/misc.S
index 7cf86498326..0fb5fc6c1fc 100644
--- a/arch/microblaze/kernel/misc.S
+++ b/arch/microblaze/kernel/misc.S
@@ -93,39 +93,3 @@ early_console_reg_tlb_alloc:
         nop
 
         .size  early_console_reg_tlb_alloc, . - early_console_reg_tlb_alloc
-
-/*
- * Copy a whole page (4096 bytes).
- */
-#define COPY_16_BYTES           \
-        lwi     r7, r6, 0;      \
-        lwi     r8, r6, 4;      \
-        lwi     r9, r6, 8;      \
-        lwi     r10, r6, 12;    \
-        swi     r7, r5, 0;      \
-        swi     r8, r5, 4;      \
-        swi     r9, r5, 8;      \
-        swi     r10, r5, 12
-
-
-/* FIXME DCACHE_LINE_BYTES (CONFIG_XILINX_MICROBLAZE0_DCACHE_LINE_LEN * 4)*/
-#define DCACHE_LINE_BYTES (4 * 4)
-
-.globl copy_page;
-.type  copy_page, @function
-.align 4;
-copy_page:
-        ori     r11, r0, (PAGE_SIZE/DCACHE_LINE_BYTES) - 1
-_copy_page_loop:
-        COPY_16_BYTES
-#if DCACHE_LINE_BYTES >= 32
-        COPY_16_BYTES
-#endif
-        addik   r6, r6, DCACHE_LINE_BYTES
-        addik   r5, r5, DCACHE_LINE_BYTES
-        bneid   r11, _copy_page_loop
-        addik   r11, r11, -1
-        rtsd    r15, 8
-        nop
-
-        .size  copy_page, . - copy_page
diff --git a/arch/microblaze/kernel/module.c b/arch/microblaze/kernel/module.c
index cbecf110dc3..0e73f660654 100644
--- a/arch/microblaze/kernel/module.c
+++ b/arch/microblaze/kernel/module.c
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 
 #include <asm/pgtable.h>
+#include <asm/cacheflush.h>
 
 void *module_alloc(unsigned long size)
 {
@@ -151,6 +152,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
 int module_finalize(const Elf32_Ehdr *hdr, const Elf_Shdr *sechdrs,
                 struct module *module)
 {
+        flush_dcache();
         return 0;
 }
 
diff --git a/arch/microblaze/kernel/traps.c b/arch/microblaze/kernel/traps.c
index 5e4570ef515..75e49202a5e 100644
--- a/arch/microblaze/kernel/traps.c
+++ b/arch/microblaze/kernel/traps.c
@@ -95,37 +95,3 @@ void dump_stack(void)
         show_stack(NULL, NULL);
 }
 EXPORT_SYMBOL(dump_stack);
-
-#ifdef CONFIG_MMU
-void __bug(const char *file, int line, void *data)
-{
-        if (data)
-                printk(KERN_CRIT "kernel BUG at %s:%d (data = %p)!\n",
-                        file, line, data);
-        else
-                printk(KERN_CRIT "kernel BUG at %s:%d!\n", file, line);
-
-        machine_halt();
-}
-
-int bad_trap(int trap_num, struct pt_regs *regs)
-{
-        printk(KERN_CRIT
-                "unimplemented trap %d called at 0x%08lx, pid %d!\n",
-                trap_num, regs->pc, current->pid);
-        return -ENOSYS;
-}
-
-int debug_trap(struct pt_regs *regs)
-{
-        int i;
-        printk(KERN_CRIT "debug trap\n");
-        for (i = 0; i < 32; i++) {
-                /* printk("r%i:%08X\t",i,regs->gpr[i]); */
-                if ((i % 4) == 3)
-                        printk(KERN_CRIT "\n");
-        }
-        printk(KERN_CRIT "pc:%08lX\tmsr:%08lX\n", regs->pc, regs->msr);
-        return -ENOSYS;
-}
-#endif
diff --git a/arch/microblaze/kernel/vmlinux.lds.S b/arch/microblaze/kernel/vmlinux.lds.S
index 5ef619aad63..db72d712460 100644
--- a/arch/microblaze/kernel/vmlinux.lds.S
+++ b/arch/microblaze/kernel/vmlinux.lds.S
@@ -24,7 +24,8 @@ SECTIONS {
         .text : AT(ADDR(.text) - LOAD_OFFSET) {
                 _text = . ;
                 _stext = . ;
-                *(.text .text.*)
+                HEAD_TEXT
+                TEXT_TEXT
                 *(.fixup)
                 EXIT_TEXT
                 EXIT_CALL
diff --git a/arch/microblaze/mm/consistent.c b/arch/microblaze/mm/consistent.c
index f956e24fe49..5a59dad62bd 100644
--- a/arch/microblaze/mm/consistent.c
+++ b/arch/microblaze/mm/consistent.c
@@ -42,11 +42,12 @@
 #include <linux/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/cpuinfo.h>
+#include <asm/tlbflush.h>
 
 #ifndef CONFIG_MMU
-
 /* I have to use dcache values because I can't relate on ram size */
-#define UNCACHED_SHADOW_MASK (cpuinfo.dcache_high - cpuinfo.dcache_base + 1)
+# define UNCACHED_SHADOW_MASK (cpuinfo.dcache_high - cpuinfo.dcache_base + 1)
+#endif
 
 /*
  * Consistent memory allocators. Used for DMA devices that want to
@@ -60,71 +61,16 @@
  */
 void *consistent_alloc(int gfp, size_t size, dma_addr_t *dma_handle)
 {
-        struct page *page, *end, *free;
-        unsigned long order;
-        void *ret, *virt;
-
-        if (in_interrupt())
-                BUG();
-
-        size = PAGE_ALIGN(size);
-        order = get_order(size);
-
-        page = alloc_pages(gfp, order);
-        if (!page)
-                goto no_page;
-
-        /* We could do with a page_to_phys and page_to_bus here. */
-        virt = page_address(page);
-        ret = ioremap(virt_to_phys(virt), size);
-        if (!ret)
-                goto no_remap;
-
-        /*
-         * Here's the magic!  Note if the uncached shadow is not implemented,
-         * it's up to the calling code to also test that condition and make
-         * other arranegments, such as manually flushing the cache and so on.
-         */
-#ifdef CONFIG_XILINX_UNCACHED_SHADOW
-        ret = (void *)((unsigned) ret | UNCACHED_SHADOW_MASK);
-#endif
-        /* dma_handle is same as physical (shadowed) address */
-        *dma_handle = (dma_addr_t)ret;
-
-        /*
-         * free wasted pages.  We skip the first page since we know
-         * that it will have count = 1 and won't require freeing.
-         * We also mark the pages in use as reserved so that
-         * remap_page_range works.
-         */
-        page = virt_to_page(virt);
-        free = page + (size >> PAGE_SHIFT);
-        end  = page + (1 << order);
-
-        for (; page < end; page++) {
-                init_page_count(page);
-                if (page >= free)
-                        __free_page(page);
-                else
-                        SetPageReserved(page);
-        }
-
-        return ret;
-no_remap:
-        __free_pages(page, order);
-no_page:
-        return NULL;
-}
-
-#else
+        unsigned long order, vaddr;
+        void *ret;
+        unsigned int i, err = 0;
+        struct page *page, *end;
 
-void *consistent_alloc(int gfp, size_t size, dma_addr_t *dma_handle)
-{
-        int order, err, i;
-        unsigned long page, va, flags;
+#ifdef CONFIG_MMU
         phys_addr_t pa;
         struct vm_struct *area;
-        void     *ret;
+        unsigned long va;
+#endif
 
         if (in_interrupt())
                 BUG();
@@ -133,71 +79,133 @@ void *consistent_alloc(int gfp, size_t size, dma_addr_t *dma_handle)
         size = PAGE_ALIGN(size);
         order = get_order(size);
 
-        page = __get_free_pages(gfp, order);
-        if (!page) {
-                BUG();
+        vaddr = __get_free_pages(gfp, order);
+        if (!vaddr)
                 return NULL;
-        }
 
         /*
          * we need to ensure that there are no cachelines in use,
          * or worse dirty in this area.
          */
-        flush_dcache_range(virt_to_phys(page), virt_to_phys(page) + size);
+        flush_dcache_range(virt_to_phys((void *)vaddr),
+                                        virt_to_phys((void *)vaddr) + size);
 
+#ifndef CONFIG_MMU
+        ret = (void *)vaddr;
+        /*
+         * Here's the magic!  Note if the uncached shadow is not implemented,
+         * it's up to the calling code to also test that condition and make
+         * other arranegments, such as manually flushing the cache and so on.
+         */
+# ifdef CONFIG_XILINX_UNCACHED_SHADOW
+        ret = (void *)((unsigned) ret | UNCACHED_SHADOW_MASK);
+# endif
+        if ((unsigned int)ret > cpuinfo.dcache_base &&
+                                (unsigned int)ret < cpuinfo.dcache_high)
+                printk(KERN_WARNING
+                        "ERROR: Your cache coherent area is CACHED!!!\n");
+
+        /* dma_handle is same as physical (shadowed) address */
+        *dma_handle = (dma_addr_t)ret;
+#else
         /* Allocate some common virtual space to map the new pages. */
         area = get_vm_area(size, VM_ALLOC);
-        if (area == NULL) {
-                free_pages(page, order);
+        if (!area) {
+                free_pages(vaddr, order);
                 return NULL;
         }
         va = (unsigned long) area->addr;
         ret = (void *)va;
 
         /* This gives us the real physical address of the first page. */
-        *dma_handle = pa = virt_to_bus((void *)page);
-
-        /* MS: This is the whole magic - use cache inhibit pages */
-        flags = _PAGE_KERNEL | _PAGE_NO_CACHE;
+        *dma_handle = pa = virt_to_bus((void *)vaddr);
+#endif
 
         /*
-         * Set refcount=1 on all pages in an order>0
-         * allocation so that vfree() will actually
-         * free all pages that were allocated.
+         * free wasted pages.  We skip the first page since we know
+         * that it will have count = 1 and won't require freeing.
+         * We also mark the pages in use as reserved so that
+         * remap_page_range works.
          */
-        if (order > 0) {
-                struct page *rpage = virt_to_page(page);
-                for (i = 1; i < (1 << order); i++)
-                        init_page_count(rpage+i);
+        page = virt_to_page(vaddr);
+        end = page + (1 << order);
+
+        split_page(page, order);
+
+        for (i = 0; i < size && err == 0; i += PAGE_SIZE) {
+#ifdef CONFIG_MMU
+                /* MS: This is the whole magic - use cache inhibit pages */
+                err = map_page(va + i, pa + i, _PAGE_KERNEL | _PAGE_NO_CACHE);
+#endif
+
+                SetPageReserved(page);
+                page++;
         }
 
-        err = 0;
-        for (i = 0; i < size && err == 0; i += PAGE_SIZE)
-                err = map_page(va+i, pa+i, flags);
+        /* Free the otherwise unused pages. */
+        while (page < end) {
+                __free_page(page);
+                page++;
+        }
 
         if (err) {
-                vfree((void *)va);
+                free_pages(vaddr, order);
                 return NULL;
         }
 
         return ret;
 }
-#endif /* CONFIG_MMU */
 EXPORT_SYMBOL(consistent_alloc);
 
 /*
  * free page(s) as defined by the above mapping.
  */
-void consistent_free(void *vaddr)
+void consistent_free(size_t size, void *vaddr)
 {
+        struct page *page;
+
         if (in_interrupt())
                 BUG();
 
+        size = PAGE_ALIGN(size);
+
+#ifndef CONFIG_MMU
         /* Clear SHADOW_MASK bit in address, and free as per usual */
-#ifdef CONFIG_XILINX_UNCACHED_SHADOW
+# ifdef CONFIG_XILINX_UNCACHED_SHADOW
         vaddr = (void *)((unsigned)vaddr & ~UNCACHED_SHADOW_MASK);
+# endif
+        page = virt_to_page(vaddr);
+
+        do {
+                ClearPageReserved(page);
+                __free_page(page);
+                page++;
+        } while (size -= PAGE_SIZE);
+#else
+        do {
+                pte_t *ptep;
+                unsigned long pfn;
+
+                ptep = pte_offset_kernel(pmd_offset(pgd_offset_k(
+                                                (unsigned int)vaddr),
+                                        (unsigned int)vaddr),
+                                (unsigned int)vaddr);
+                if (!pte_none(*ptep) && pte_present(*ptep)) {
+                        pfn = pte_pfn(*ptep);
+                        pte_clear(&init_mm, (unsigned int)vaddr, ptep);
+                        if (pfn_valid(pfn)) {
+                                page = pfn_to_page(pfn);
+
+                                ClearPageReserved(page);
+                                __free_page(page);
+                        }
+                }
+                vaddr += PAGE_SIZE;
+        } while (size -= PAGE_SIZE);
+
+        /* flush tlb */
+        flush_tlb_all();
 #endif
-        vfree(vaddr);
 }
 EXPORT_SYMBOL(consistent_free);
 
@@ -221,7 +229,7 @@ void consistent_sync(void *vaddr, size_t size, int direction)
         case PCI_DMA_NONE:
                 BUG();
         case PCI_DMA_FROMDEVICE:        /* invalidate only */
-                flush_dcache_range(start, end);
+                invalidate_dcache_range(start, end);
                 break;
         case PCI_DMA_TODEVICE:          /* writeback only */
                 flush_dcache_range(start, end);
diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
index 7af87f4b2c2..bab92299318 100644
--- a/arch/microblaze/mm/fault.c
+++ b/arch/microblaze/mm/fault.c
@@ -273,16 +273,11 @@ bad_area_nosemaphore:
  * us unable to handle the page fault gracefully.
  */
 out_of_memory:
-        if (current->pid == 1) {
-                yield();
-                down_read(&mm->mmap_sem);
-                goto survive;
-        }
         up_read(&mm->mmap_sem);
-        printk(KERN_WARNING "VM: killing process %s\n", current->comm);
-        if (user_mode(regs))
-                do_exit(SIGKILL);
-        bad_page_fault(regs, address, SIGKILL);
+        if (!user_mode(regs))
+                bad_page_fault(regs, address, SIGKILL);
+        else
+                pagefault_out_of_memory();
         return;
 
 do_sigbus:
diff --git a/arch/microblaze/mm/init.c b/arch/microblaze/mm/init.c
index f42c2dde8b1..cca3579d426 100644
--- a/arch/microblaze/mm/init.c
+++ b/arch/microblaze/mm/init.c
@@ -47,6 +47,7 @@ unsigned long memory_start;
 EXPORT_SYMBOL(memory_start);
 unsigned long memory_end; /* due to mm/nommu.c */
 unsigned long memory_size;
+EXPORT_SYMBOL(memory_size);
 
 /*
  * paging_init() sets up the page tables - in fact we've already done this.
diff --git a/arch/microblaze/mm/pgtable.c b/arch/microblaze/mm/pgtable.c
index d31312cde6e..59bf2335a4c 100644
--- a/arch/microblaze/mm/pgtable.c
+++ b/arch/microblaze/mm/pgtable.c
@@ -42,6 +42,7 @@
 
 unsigned long ioremap_base;
 unsigned long ioremap_bot;
+EXPORT_SYMBOL(ioremap_bot);
 
 /* The maximum lowmem defaults to 768Mb, but this can be configured to
  * another value.
@@ -161,24 +162,6 @@ int map_page(unsigned long va, phys_addr_t pa, int flags)
         return err;
 }
 
-void __init adjust_total_lowmem(void)
-{
-/* TBD */
-#if 0
-        unsigned long max_low_mem = MAX_LOW_MEM;
-
-        if (total_lowmem > max_low_mem) {
-                total_lowmem = max_low_mem;
-#ifndef CONFIG_HIGHMEM
-                printk(KERN_INFO "Warning, memory limited to %ld Mb, use "
-                                "CONFIG_HIGHMEM to reach %ld Mb\n",
-                                max_low_mem >> 20, total_memory >> 20);
-                total_memory = total_lowmem;
-#endif /* CONFIG_HIGHMEM */
-        }
-#endif
-}
-
 /*
  * Map in all of physical memory starting at CONFIG_KERNEL_START.
  */
@@ -206,24 +189,6 @@ void __init mapin_ram(void)
 /* is x a power of 2? */
 #define is_power_of_2(x)        ((x) != 0 && (((x) & ((x) - 1)) == 0))
 
-/*
- * Set up a mapping for a block of I/O.
- * virt, phys, size must all be page-aligned.
- * This should only be called before ioremap is called.
- */
-void __init io_block_mapping(unsigned long virt, phys_addr_t phys,
-                             unsigned int size, int flags)
-{
-        int i;
-
-        if (virt > CONFIG_KERNEL_START && virt < ioremap_bot)
-                ioremap_bot = ioremap_base = virt;
-
-        /* Put it in the page tables. */
-        for (i = 0; i < size; i += PAGE_SIZE)
-                map_page(virt + i, phys + i, flags);
-}
-
 /* Scan the real Linux page tables and return a PTE pointer for
  * a virtual address in a context.
  * Returns true (1) if PTE was found, zero otherwise.  The pointer to
@@ -274,3 +239,18 @@ unsigned long iopa(unsigned long addr)
 
         return pa;
 }
+
+__init_refok pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
+                unsigned long address)
+{
+        pte_t *pte;
+        if (mem_init_done) {
+                pte = (pte_t *)__get_free_page(GFP_KERNEL |
+                                        __GFP_REPEAT | __GFP_ZERO);
+        } else {
+                pte = (pte_t *)early_get_page();
+                if (pte)
+                        clear_page(pte);
+        }
+        return pte;
+}
diff --git a/arch/microblaze/pci/pci-common.c b/arch/microblaze/pci/pci-common.c
index 740bb32ec57..9cb782b8e03 100644
--- a/arch/microblaze/pci/pci-common.c
+++ b/arch/microblaze/pci/pci-common.c
@@ -1025,7 +1025,7 @@ static void __devinit pcibios_fixup_bridge(struct pci_bus *bus)
 
         struct pci_dev *dev = bus->self;
 
-        for (i = 0; i < PCI_BUS_NUM_RESOURCES; ++i) {
+        pci_bus_for_each_resource(bus, res, i) {
                 res = bus->resource[i];
                 if (!res)
                         continue;
@@ -1131,21 +1131,20 @@ static int skip_isa_ioresource_align(struct pci_dev *dev)
  * but we want to try to avoid allocating at 0x2900-0x2bff
  * which might have be mirrored at 0x0100-0x03ff..
  */
-void pcibios_align_resource(void *data, struct resource *res,
+resource_size_t pcibios_align_resource(void *data, const struct resource *res,
                                 resource_size_t size, resource_size_t align)
 {
         struct pci_dev *dev = data;
+        resource_size_t start = res->start;
 
         if (res->flags & IORESOURCE_IO) {
-                resource_size_t start = res->start;
-
                 if (skip_isa_ioresource_align(dev))
-                        return;
-                if (start & 0x300) {
+                        return start;
+                if (start & 0x300)
                         start = (start + 0x3ff) & ~0x3ff;
-                        res->start = start;
-                }
         }
+
+        return start;
 }
 EXPORT_SYMBOL(pcibios_align_resource);
 
@@ -1228,7 +1227,7 @@ void pcibios_allocate_bus_resources(struct pci_bus *bus)
         pr_debug("PCI: Allocating bus resources for %04x:%02x...\n",
                  pci_domain_nr(bus), bus->number);
 
-        for (i = 0; i < PCI_BUS_NUM_RESOURCES; ++i) {
+        pci_bus_for_each_resource(bus, res, i) {
                 res = bus->resource[i];
                 if (!res || !res->flags
                     || res->start > res->end || res->parent)
@@ -1508,7 +1507,7 @@ void pcibios_finish_adding_to_bus(struct pci_bus *bus)
         pci_bus_add_devices(bus);
 
         /* Fixup EEH */
-        eeh_add_device_tree_late(bus);
+        /* eeh_add_device_tree_late(bus); */
 }
 EXPORT_SYMBOL_GPL(pcibios_finish_adding_to_bus);
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 29e86923d1b..7e6fd1cbd3f 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -49,7 +49,7 @@ config AR7
           family: TNETD7100, 7200 and 7300.
 
 config BCM47XX
-        bool "BCM47XX based boards"
+        bool "Broadcom BCM47XX based boards"
         select CEVT_R4K
         select CSRC_R4K
         select DMA_NONCOHERENT
@@ -509,6 +509,7 @@ config SIBYTE_SWARM
         bool "Sibyte BCM91250A-SWARM"
         select BOOT_ELF32
         select DMA_COHERENT
+        select HAVE_PATA_PLATFORM
         select NR_CPUS_DEFAULT_2
         select SIBYTE_SB1250
         select SWAP_IO_SPACE
@@ -523,6 +524,7 @@ config SIBYTE_LITTLESUR
         depends on EXPERIMENTAL
         select BOOT_ELF32
         select DMA_COHERENT
+        select HAVE_PATA_PLATFORM
         select NR_CPUS_DEFAULT_2
         select SIBYTE_SB1250
         select SWAP_IO_SPACE
@@ -1305,6 +1307,33 @@ config CPU_CAVIUM_OCTEON
 
 endchoice
 
+if CPU_LOONGSON2F
+config CPU_NOP_WORKAROUNDS
+        bool
+
+config CPU_JUMP_WORKAROUNDS
+        bool
+
+config CPU_LOONGSON2F_WORKAROUNDS
+        bool "Loongson 2F Workarounds"
+        default y
+        select CPU_NOP_WORKAROUNDS
+        select CPU_JUMP_WORKAROUNDS
+        help
+          Loongson 2F01 / 2F02 processors have the NOP & JUMP issues which
+          require workarounds.  Without workarounds the system may hang
+          unexpectedly.  For more information please refer to the gas
+          -mfix-loongson2f-nop and -mfix-loongson2f-jump options.
+
+          Loongson 2F03 and later have fixed these issues and no workarounds
+          are needed.  The workarounds have no significant side effect on them
+          but may decrease the performance of the system so this option should
+          be disabled unless the kernel is intended to be run on 2F01 or 2F02
+          systems.
+
+          If unsure, please say Y.
+endif # CPU_LOONGSON2F
+
 config SYS_SUPPORTS_ZBOOT
         bool
         select HAVE_KERNEL_GZIP
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 2f2eac23332..0b9c01add0a 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -136,6 +136,19 @@ cflags-$(CONFIG_CPU_LOONGSON2E) += \
         $(call cc-option,-march=loongson2e,-march=r4600)
 cflags-$(CONFIG_CPU_LOONGSON2F) += \
         $(call cc-option,-march=loongson2f,-march=r4600)
+# enable the workarounds for loongson2f
+ifdef CONFIG_CPU_LOONGSON2F_WORKAROUNDS
+  ifeq ($(call as-option,-Wa$(comma)-mfix-loongson2f-nop,),)
+    $(error only binutils >= 2.20.2 have needed option -mfix-loongson2f-nop)
+  else
+    cflags-$(CONFIG_CPU_NOP_WORKAROUNDS) += -Wa$(comma)-mfix-loongson2f-nop
+  endif
+  ifeq ($(call as-option,-Wa$(comma)-mfix-loongson2f-jump,),)
+    $(error only binutils >= 2.20.2 have needed option -mfix-loongson2f-jump)
+  else
+    cflags-$(CONFIG_CPU_JUMP_WORKAROUNDS) += -Wa$(comma)-mfix-loongson2f-jump
+  endif
+endif
 
 cflags-$(CONFIG_CPU_MIPS32_R1)  += $(call cc-option,-march=mips32,-mips32 -U_MIPS_ISA -D_MIPS_ISA=_MIPS_ISA_MIPS32) \
                         -Wa,-mips32 -Wa,--trap
diff --git a/arch/mips/alchemy/devboards/db1200/setup.c b/arch/mips/alchemy/devboards/db1200/setup.c
index be7e92ea01f..88761954755 100644
--- a/arch/mips/alchemy/devboards/db1200/setup.c
+++ b/arch/mips/alchemy/devboards/db1200/setup.c
@@ -66,12 +66,16 @@ static int __init db1200_arch_init(void)
         set_irq_type(AU1200_GPIO7_INT, IRQF_TRIGGER_LOW);
         bcsr_init_irq(DB1200_INT_BEGIN, DB1200_INT_END, AU1200_GPIO7_INT);
 
-        /* do not autoenable these: CPLD has broken edge int handling,
-         * and the CD handler setup requires manual enabling to work
-         * around that.
+        /* insert/eject pairs: one of both is always screaming.  To avoid
+         * issues they must not be automatically enabled when initially
+         * requested.
          */
         irq_to_desc(DB1200_SD0_INSERT_INT)->status |= IRQ_NOAUTOEN;
         irq_to_desc(DB1200_SD0_EJECT_INT)->status |= IRQ_NOAUTOEN;
+        irq_to_desc(DB1200_PC0_INSERT_INT)->status |= IRQ_NOAUTOEN;
+        irq_to_desc(DB1200_PC0_EJECT_INT)->status |= IRQ_NOAUTOEN;
+        irq_to_desc(DB1200_PC1_INSERT_INT)->status |= IRQ_NOAUTOEN;
+        irq_to_desc(DB1200_PC1_EJECT_INT)->status |= IRQ_NOAUTOEN;
 
         return 0;
 }
diff --git a/arch/mips/configs/bcm63xx_defconfig b/arch/mips/configs/bcm63xx_defconfig
index 7fee0273c82..6389ca0fdc6 100644
--- a/arch/mips/configs/bcm63xx_defconfig
+++ b/arch/mips/configs/bcm63xx_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc6
-# Sun May 31 20:17:18 2009
+# Linux kernel version: 2.6.34-rc2
+# Tue Mar 23 10:36:32 2010
 #
 CONFIG_MIPS=y
 
@@ -9,13 +9,14 @@ CONFIG_MIPS=y
 # Machine selection
 #
 # CONFIG_MACH_ALCHEMY is not set
+# CONFIG_AR7 is not set
 # CONFIG_BCM47XX is not set
 CONFIG_BCM63XX=y
 # CONFIG_MIPS_COBALT is not set
 # CONFIG_MACH_DECSTATION is not set
 # CONFIG_MACH_JAZZ is not set
 # CONFIG_LASAT is not set
-# CONFIG_LEMOTE_FULONG is not set
+# CONFIG_MACH_LOONGSON is not set
 # CONFIG_MIPS_MALTA is not set
 # CONFIG_MIPS_SIM is not set
 # CONFIG_NEC_MARKEINS is not set
@@ -26,6 +27,7 @@ CONFIG_BCM63XX=y
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_PMC_MSP is not set
 # CONFIG_PMC_YOSEMITE is not set
+# CONFIG_POWERTV is not set
 # CONFIG_SGI_IP22 is not set
 # CONFIG_SGI_IP27 is not set
 # CONFIG_SGI_IP28 is not set
@@ -45,13 +47,17 @@ CONFIG_BCM63XX=y
 # CONFIG_WR_PPMC is not set
 # CONFIG_CAVIUM_OCTEON_SIMULATOR is not set
 # CONFIG_CAVIUM_OCTEON_REFERENCE_BOARD is not set
+# CONFIG_ALCHEMY_GPIO_INDIRECT is not set
 
 #
 # CPU support
 #
+CONFIG_BCM63XX_CPU_6338=y
+CONFIG_BCM63XX_CPU_6345=y
 CONFIG_BCM63XX_CPU_6348=y
 CONFIG_BCM63XX_CPU_6358=y
 CONFIG_BOARD_BCM963XX=y
+CONFIG_LOONGSON_UART_BASE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
@@ -69,10 +75,8 @@ CONFIG_CEVT_R4K=y
 CONFIG_CSRC_R4K_LIB=y
 CONFIG_CSRC_R4K=y
 CONFIG_DMA_NONCOHERENT=y
-CONFIG_DMA_NEED_PCI_MAP_STATE=y
-CONFIG_EARLY_PRINTK=y
+CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_SYS_HAS_EARLY_PRINTK=y
-# CONFIG_HOTPLUG_CPU is not set
 # CONFIG_NO_IOPORT is not set
 CONFIG_GENERIC_GPIO=y
 CONFIG_CPU_BIG_ENDIAN=y
@@ -85,7 +89,8 @@ CONFIG_MIPS_L1_CACHE_SHIFT=5
 #
 # CPU selection
 #
-# CONFIG_CPU_LOONGSON2 is not set
+# CONFIG_CPU_LOONGSON2E is not set
+# CONFIG_CPU_LOONGSON2F is not set
 CONFIG_CPU_MIPS32_R1=y
 # CONFIG_CPU_MIPS32_R2 is not set
 # CONFIG_CPU_MIPS64_R1 is not set
@@ -128,7 +133,7 @@ CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_MIPS_MT_DISABLED=y
 # CONFIG_MIPS_MT_SMP is not set
 # CONFIG_MIPS_MT_SMTC is not set
-CONFIG_CPU_HAS_LLSC=y
+# CONFIG_ARCH_PHYS_ADDR_T_64BIT is not set
 CONFIG_CPU_HAS_SYNC=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
@@ -146,9 +151,8 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_UNEVICTABLE_LRU=y
-CONFIG_HAVE_MLOCK=y
-CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+# CONFIG_KSM is not set
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_TICK_ONESHOT=y
 CONFIG_NO_HZ=y
 # CONFIG_HIGH_RES_TIMERS is not set
@@ -170,6 +174,7 @@ CONFIG_PREEMPT_NONE=y
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 
 #
 # General setup
@@ -189,15 +194,12 @@ CONFIG_LOCALVERSION=""
 #
 # RCU Subsystem
 #
-CONFIG_CLASSIC_RCU=y
 # CONFIG_TREE_RCU is not set
-# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_PREEMPT_RCU is not set
+CONFIG_TINY_RCU=y
 # CONFIG_TREE_RCU_TRACE is not set
-# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=17
-# CONFIG_GROUP_SCHED is not set
-# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -205,11 +207,11 @@ CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
+CONFIG_ANON_INODES=y
 CONFIG_EMBEDDED=y
 CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
-# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
@@ -223,6 +225,10 @@ CONFIG_BASE_FULL=y
 # CONFIG_EVENTFD is not set
 # CONFIG_SHMEM is not set
 # CONFIG_AIO is not set
+
+#
+# Kernel Performance Events And Counters
+#
 # CONFIG_VM_EVENT_COUNTERS is not set
 CONFIG_PCI_QUIRKS=y
 # CONFIG_SLUB_DEBUG is not set
@@ -231,14 +237,17 @@ CONFIG_COMPAT_BRK=y
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
+
+#
+# GCOV-based kernel profiling
+#
 # CONFIG_SLOW_WORK is not set
-# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
 CONFIG_BASE_SMALL=0
 # CONFIG_MODULES is not set
 CONFIG_BLOCK=y
-# CONFIG_LBD is not set
+CONFIG_LBDAF=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -246,14 +255,41 @@ CONFIG_BLOCK=y
 # IO Schedulers
 #
 CONFIG_IOSCHED_NOOP=y
-# CONFIG_IOSCHED_AS is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-# CONFIG_DEFAULT_AS is not set
 # CONFIG_DEFAULT_DEADLINE is not set
 # CONFIG_DEFAULT_CFQ is not set
 CONFIG_DEFAULT_NOOP=y
 CONFIG_DEFAULT_IOSCHED="noop"
+# CONFIG_INLINE_SPIN_TRYLOCK is not set
+# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK is not set
+# CONFIG_INLINE_SPIN_LOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
+CONFIG_INLINE_SPIN_UNLOCK=y
+# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
+CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_READ_TRYLOCK is not set
+# CONFIG_INLINE_READ_LOCK is not set
+# CONFIG_INLINE_READ_LOCK_BH is not set
+# CONFIG_INLINE_READ_LOCK_IRQ is not set
+# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
+CONFIG_INLINE_READ_UNLOCK=y
+# CONFIG_INLINE_READ_UNLOCK_BH is not set
+CONFIG_INLINE_READ_UNLOCK_IRQ=y
+# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_WRITE_TRYLOCK is not set
+# CONFIG_INLINE_WRITE_LOCK is not set
+# CONFIG_INLINE_WRITE_LOCK_BH is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
+CONFIG_INLINE_WRITE_UNLOCK=y
+# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
+CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
+# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
+# CONFIG_MUTEX_SPIN_ON_OWNER is not set
 # CONFIG_FREEZER is not set
 
 #
@@ -263,15 +299,12 @@ CONFIG_HW_HAS_PCI=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-# CONFIG_PCI_LEGACY is not set
 # CONFIG_PCI_STUB is not set
 # CONFIG_PCI_IOV is not set
 CONFIG_MMU=y
 CONFIG_PCCARD=y
-# CONFIG_PCMCIA_DEBUG is not set
 CONFIG_PCMCIA=y
 CONFIG_PCMCIA_LOAD_CIS=y
-CONFIG_PCMCIA_IOCTL=y
 CONFIG_CARDBUS=y
 
 #
@@ -295,6 +328,7 @@ CONFIG_TRAD_SIGNALS=y
 #
 # Power management options
 #
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 # CONFIG_PM is not set
 CONFIG_NET=y
@@ -333,6 +367,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_NETFILTER is not set
 # CONFIG_IP_DCCP is not set
 # CONFIG_IP_SCTP is not set
+# CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
@@ -347,6 +382,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
 
@@ -359,7 +395,27 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
-# CONFIG_WIRELESS is not set
+CONFIG_WIRELESS=y
+CONFIG_WEXT_CORE=y
+CONFIG_WEXT_PROC=y
+CONFIG_CFG80211=y
+CONFIG_NL80211_TESTMODE=y
+# CONFIG_CFG80211_DEVELOPER_WARNINGS is not set
+# CONFIG_CFG80211_REG_DEBUG is not set
+CONFIG_CFG80211_DEFAULT_PS=y
+# CONFIG_CFG80211_INTERNAL_REGDB is not set
+CONFIG_CFG80211_WEXT=y
+CONFIG_WIRELESS_EXT_SYSFS=y
+# CONFIG_LIB80211 is not set
+CONFIG_MAC80211=y
+# CONFIG_MAC80211_RC_PID is not set
+CONFIG_MAC80211_RC_MINSTREL=y
+# CONFIG_MAC80211_RC_DEFAULT_PID is not set
+CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
+CONFIG_MAC80211_RC_DEFAULT="minstrel"
+# CONFIG_MAC80211_MESH is not set
+CONFIG_MAC80211_LEDS=y
+# CONFIG_MAC80211_DEBUG_MENU is not set
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
@@ -471,6 +527,7 @@ CONFIG_HAVE_IDE=y
 #
 # SCSI device support
 #
+CONFIG_SCSI_MOD=y
 # CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
 # CONFIG_SCSI_DMA is not set
@@ -484,13 +541,16 @@ CONFIG_HAVE_IDE=y
 #
 
 #
-# Enable only one of the two stacks, unless you know what you are doing
+# You can enable one or both FireWire driver stacks.
+#
+
+#
+# The newer stack is recommended.
 #
 # CONFIG_FIREWIRE is not set
 # CONFIG_IEEE1394 is not set
 # CONFIG_I2O is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -529,6 +589,7 @@ CONFIG_MII=y
 # CONFIG_SMC91X is not set
 # CONFIG_DM9000 is not set
 # CONFIG_ETHOC is not set
+# CONFIG_SMSC911X is not set
 # CONFIG_DNET is not set
 # CONFIG_NET_TULIP is not set
 # CONFIG_HP100 is not set
@@ -541,17 +602,48 @@ CONFIG_MII=y
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_NET_PCI is not set
 # CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
+# CONFIG_KS8851_MLL is not set
 # CONFIG_ATL2 is not set
 CONFIG_BCM63XX_ENET=y
 # CONFIG_NETDEV_1000 is not set
 # CONFIG_NETDEV_10000 is not set
 # CONFIG_TR is not set
-
-#
-# Wireless LAN
-#
-# CONFIG_WLAN_PRE80211 is not set
-# CONFIG_WLAN_80211 is not set
+CONFIG_WLAN=y
+# CONFIG_PCMCIA_RAYCS is not set
+# CONFIG_LIBERTAS_THINFIRM is not set
+# CONFIG_ATMEL is not set
+# CONFIG_AT76C50X_USB is not set
+# CONFIG_AIRO_CS is not set
+# CONFIG_PCMCIA_WL3501 is not set
+# CONFIG_PRISM54 is not set
+# CONFIG_USB_ZD1201 is not set
+# CONFIG_USB_NET_RNDIS_WLAN is not set
+# CONFIG_RTL8180 is not set
+# CONFIG_RTL8187 is not set
+# CONFIG_ADM8211 is not set
+# CONFIG_MAC80211_HWSIM is not set
+# CONFIG_MWL8K is not set
+# CONFIG_ATH_COMMON is not set
+CONFIG_B43=y
+CONFIG_B43_PCI_AUTOSELECT=y
+CONFIG_B43_PCICORE_AUTOSELECT=y
+# CONFIG_B43_PCMCIA is not set
+CONFIG_B43_PIO=y
+# CONFIG_B43_PHY_LP is not set
+CONFIG_B43_LEDS=y
+# CONFIG_B43_DEBUG is not set
+# CONFIG_B43LEGACY is not set
+# CONFIG_HOSTAP is not set
+# CONFIG_IPW2100 is not set
+# CONFIG_IPW2200 is not set
+# CONFIG_IWLWIFI is not set
+# CONFIG_LIBERTAS is not set
+# CONFIG_HERMES is not set
+# CONFIG_P54_COMMON is not set
+# CONFIG_RT2X00 is not set
+# CONFIG_WL12XX is not set
+# CONFIG_ZD1211RW is not set
 
 #
 # Enable WiMAX (Networking options) to see the WiMAX drivers
@@ -574,6 +666,7 @@ CONFIG_BCM63XX_ENET=y
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_VMXNET3 is not set
 # CONFIG_ISDN is not set
 # CONFIG_PHONE is not set
 
@@ -607,6 +700,7 @@ CONFIG_BCM63XX_ENET=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
+# CONFIG_SERIAL_TIMBERDALE is not set
 CONFIG_SERIAL_BCM63XX=y
 CONFIG_SERIAL_BCM63XX_CONSOLE=y
 # CONFIG_UNIX98_PTYS is not set
@@ -629,6 +723,11 @@ CONFIG_LEGACY_PTY_COUNT=256
 CONFIG_DEVPORT=y
 # CONFIG_I2C is not set
 # CONFIG_SPI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
 CONFIG_ARCH_REQUIRE_GPIOLIB=y
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_SYSFS is not set
@@ -636,6 +735,8 @@ CONFIG_GPIOLIB=y
 #
 # Memory mapped GPIO expanders:
 #
+# CONFIG_GPIO_IT8761E is not set
+# CONFIG_GPIO_SCH is not set
 
 #
 # I2C GPIO expanders:
@@ -644,16 +745,21 @@ CONFIG_GPIOLIB=y
 #
 # PCI GPIO expanders:
 #
+# CONFIG_GPIO_CS5535 is not set
 # CONFIG_GPIO_BT8XX is not set
+# CONFIG_GPIO_LANGWELL is not set
 
 #
 # SPI GPIO expanders:
 #
+
+#
+# AC97 GPIO expanders:
+#
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
-# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 CONFIG_SSB_POSSIBLE=y
 
@@ -662,15 +768,16 @@ CONFIG_SSB_POSSIBLE=y
 #
 CONFIG_SSB=y
 CONFIG_SSB_SPROM=y
+CONFIG_SSB_BLOCKIO=y
 CONFIG_SSB_PCIHOST_POSSIBLE=y
 CONFIG_SSB_PCIHOST=y
-# CONFIG_SSB_B43_PCI_BRIDGE is not set
+CONFIG_SSB_B43_PCI_BRIDGE=y
 CONFIG_SSB_PCMCIAHOST_POSSIBLE=y
 # CONFIG_SSB_PCMCIAHOST is not set
 # CONFIG_SSB_SILENT is not set
 # CONFIG_SSB_DEBUG is not set
 CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
-# CONFIG_SSB_DRIVER_PCICORE is not set
+CONFIG_SSB_DRIVER_PCICORE=y
 # CONFIG_SSB_DRIVER_MIPS is not set
 
 #
@@ -680,27 +787,15 @@ CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
 # CONFIG_MFD_TMIO is not set
+# CONFIG_MFD_TIMBERDALE is not set
+# CONFIG_LPC_SCH is not set
 # CONFIG_REGULATOR is not set
-
-#
-# Multimedia devices
-#
-
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-
-#
-# Multimedia drivers
-#
-# CONFIG_DAB is not set
+# CONFIG_MEDIA_SUPPORT is not set
 
 #
 # Graphics support
 #
+# CONFIG_VGA_ARB is not set
 # CONFIG_DRM is not set
 # CONFIG_VGASTATE is not set
 # CONFIG_VIDEO_OUTPUT_CONTROL is not set
@@ -710,11 +805,7 @@ CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
 #
 # Display device support
 #
-CONFIG_DISPLAY_SUPPORT=y
-
-#
-# Display hardware drivers
-#
+# CONFIG_DISPLAY_SUPPORT is not set
 # CONFIG_SOUND is not set
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
@@ -741,13 +832,14 @@ CONFIG_USB=y
 # USB Host Controller Drivers
 #
 # CONFIG_USB_C67X00_HCD is not set
+# CONFIG_USB_XHCI_HCD is not set
 CONFIG_USB_EHCI_HCD=y
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
 # CONFIG_USB_EHCI_TT_NEWSCHED is not set
-CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
 # CONFIG_USB_OXU210HP_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
+# CONFIG_USB_ISP1362_HCD is not set
 CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OHCI_HCD_SSB is not set
 CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
@@ -796,7 +888,6 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
-# CONFIG_USB_BERRY_CHARGE is not set
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
@@ -807,8 +898,8 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_IOWARRIOR is not set
+# CONFIG_USB_TEST is not set
 # CONFIG_USB_ISIGHTFW is not set
-# CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
 
 #
@@ -819,7 +910,29 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
-# CONFIG_NEW_LEDS is not set
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+
+#
+# LED drivers
+#
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_GPIO_PLATFORM=y
+# CONFIG_LEDS_LT3593 is not set
+CONFIG_LEDS_TRIGGERS=y
+
+#
+# LED Triggers
+#
+CONFIG_LEDS_TRIGGER_TIMER=y
+# CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+
+#
+# iptables trigger is under Netfilter config (LED target)
+#
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_INFINIBAND is not set
 CONFIG_RTC_LIB=y
@@ -827,6 +940,10 @@ CONFIG_RTC_LIB=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
+
+#
+# TI VLYNQ
+#
 # CONFIG_STAGING is not set
 
 #
@@ -838,12 +955,16 @@ CONFIG_RTC_LIB=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
-# CONFIG_FILE_LOCKING is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+# CONFIG_NILFS2_FS is not set
+# CONFIG_FILE_LOCKING is not set
+CONFIG_FSNOTIFY=y
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
@@ -875,8 +996,6 @@ CONFIG_PROC_KCORE=y
 CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SYSFS=y
-CONFIG_TMPFS=y
-# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
 CONFIG_MISC_FILESYSTEMS=y
@@ -888,6 +1007,7 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
 # CONFIG_JFFS2_FS is not set
+# CONFIG_LOGFS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
@@ -898,7 +1018,6 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ROMFS_FS is not set
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
-# CONFIG_NILFS2_FS is not set
 # CONFIG_NETWORK_FILESYSTEMS is not set
 
 #
@@ -906,7 +1025,46 @@ CONFIG_MISC_FILESYSTEMS=y
 #
 # CONFIG_PARTITION_ADVANCED is not set
 CONFIG_MSDOS_PARTITION=y
-# CONFIG_NLS is not set
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
+# CONFIG_NLS_CODEPAGE_437 is not set
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_ASCII is not set
+# CONFIG_NLS_ISO8859_1 is not set
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_UTF8 is not set
 # CONFIG_DLM is not set
 
 #
@@ -918,29 +1076,23 @@ CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_FRAME_WARN=1024
 CONFIG_MAGIC_SYSRQ=y
+# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 # CONFIG_DEBUG_MEMORY_INIT is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 CONFIG_TRACING_SUPPORT=y
-
-#
-# Tracers
-#
-# CONFIG_IRQSOFF_TRACER is not set
-# CONFIG_SCHED_TRACER is not set
-# CONFIG_CONTEXT_SWITCH_TRACER is not set
-# CONFIG_EVENT_TRACER is not set
-# CONFIG_BOOT_TRACER is not set
-# CONFIG_TRACE_BRANCH_PROFILING is not set
-# CONFIG_KMEMTRACE is not set
-# CONFIG_WORKQUEUE_TRACER is not set
-# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_FTRACE is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_EARLY_PRINTK=y
 CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="console=ttyS0,115200"
 # CONFIG_CMDLINE_OVERRIDE is not set
@@ -951,8 +1103,108 @@ CONFIG_CMDLINE="console=ttyS0,115200"
 # CONFIG_KEYS is not set
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITYFS is not set
-# CONFIG_SECURITY_FILE_CAPABILITIES is not set
-# CONFIG_CRYPTO is not set
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SECURITY_SMACK is not set
+# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY=""
+CONFIG_CRYPTO=y
+
+#
+# Crypto core or helper
+#
+# CONFIG_CRYPTO_FIPS is not set
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_PCOMP=y
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_NULL is not set
+CONFIG_CRYPTO_WORKQUEUE=y
+# CONFIG_CRYPTO_CRYPTD is not set
+# CONFIG_CRYPTO_AUTHENC is not set
+
+#
+# Authenticated Encryption with Associated Data
+#
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_SEQIV is not set
+
+#
+# Block modes
+#
+# CONFIG_CRYPTO_CBC is not set
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
+CONFIG_CRYPTO_ECB=y
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+
+#
+# Hash modes
+#
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_VMAC is not set
+
+#
+# Digest
+#
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_GHASH is not set
+# CONFIG_CRYPTO_MD4 is not set
+# CONFIG_CRYPTO_MD5 is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_RMD128 is not set
+# CONFIG_CRYPTO_RMD160 is not set
+# CONFIG_CRYPTO_RMD256 is not set
+# CONFIG_CRYPTO_RMD320 is not set
+# CONFIG_CRYPTO_SHA1 is not set
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_WP512 is not set
+
+#
+# Ciphers
+#
+CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_ANUBIS is not set
+CONFIG_CRYPTO_ARC4=y
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_DES is not set
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_SALSA20 is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+
+#
+# Compression
+#
+# CONFIG_CRYPTO_DEFLATE is not set
+# CONFIG_CRYPTO_ZLIB is not set
+# CONFIG_CRYPTO_LZO is not set
+
+#
+# Random Number Generation
+#
+CONFIG_CRYPTO_ANSI_CPRNG=y
+# CONFIG_CRYPTO_HW is not set
 # CONFIG_BINARY_PRINTF is not set
 
 #
diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
index ed9aaaaf074..2d28017e95d 100644
--- a/arch/mips/include/asm/cmpxchg.h
+++ b/arch/mips/include/asm/cmpxchg.h
@@ -16,7 +16,7 @@
 ({                                                                      \
         __typeof(*(m)) __ret;                                           \
                                                                         \
-        if (kernel_uses_llsc && R10000_LLSC_WAR) {                              \
+        if (kernel_uses_llsc && R10000_LLSC_WAR) {                      \
                 __asm__ __volatile__(                                   \
                 "       .set    push                            \n"     \
                 "       .set    noat                            \n"     \
diff --git a/arch/mips/include/asm/mach-loongson/loongson.h b/arch/mips/include/asm/mach-loongson/loongson.h
index 1cf7b1401ee..fcdbe3a4ce1 100644
--- a/arch/mips/include/asm/mach-loongson/loongson.h
+++ b/arch/mips/include/asm/mach-loongson/loongson.h
@@ -307,7 +307,7 @@ extern unsigned long _loongson_addrwincfg_base;
  */
 #define LOONGSON_ADDRWIN_CFG(s, d, w, src, dst, size) do {\
         s##_WIN##w##_BASE = (src); \
-        s##_WIN##w##_MMAP = (src) | ADDRWIN_MAP_DST_##d; \
+        s##_WIN##w##_MMAP = (dst) | ADDRWIN_MAP_DST_##d; \
         s##_WIN##w##_MASK = ~(size-1); \
 } while (0)
 
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index 49382d5e891..c6e3c93ce7c 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -135,6 +135,12 @@
 #define FPU_CSR_COND7   0x80000000      /* $fcc7 */
 
 /*
+ * Bits 18 - 20 of the FPU Status Register will be read as 0,
+ * and should be written as zero.
+ */
+#define FPU_CSR_RSVD    0x001c0000
+
+/*
  * X the exception cause indicator
  * E the exception enable
  * S the sticky/flag bit
@@ -161,7 +167,8 @@
 #define FPU_CSR_UDF_S   0x00000008
 #define FPU_CSR_INE_S   0x00000004
 
-/* rounding mode */
+/* Bits 0 and 1 of FPU Status Register specify the rounding mode */
+#define FPU_CSR_RM      0x00000003
 #define FPU_CSR_RN      0x0     /* nearest */
 #define FPU_CSR_RZ      0x1     /* towards zero */
 #define FPU_CSR_RU      0x2     /* towards +Infinity */
diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h
index 26dc69d792a..1be4b0fa30d 100644
--- a/arch/mips/include/asm/pgtable-64.h
+++ b/arch/mips/include/asm/pgtable-64.h
@@ -120,9 +120,14 @@
 #endif
 #define FIRST_USER_ADDRESS      0UL
 
-#define VMALLOC_START           MAP_BASE
+/*
+ * TLB refill handlers also map the vmalloc area into xuseg.  Avoid
+ * the first couple of pages so NULL pointer dereferences will still
+ * reliably trap.
+ */
+#define VMALLOC_START           (MAP_BASE + (2 * PAGE_SIZE))
 #define VMALLOC_END     \
-        (VMALLOC_START + \
+        (MAP_BASE + \
          min(PTRS_PER_PGD * PTRS_PER_PMD * PTRS_PER_PTE * PAGE_SIZE, \
              (1UL << cpu_vmbits)) - (1UL << 32))
 
diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h
index ce47118e52b..cdc6a46efd9 100644
--- a/arch/mips/include/asm/ptrace.h
+++ b/arch/mips/include/asm/ptrace.h
@@ -142,9 +142,9 @@ extern int ptrace_set_watch_regs(struct task_struct *child,
 
 extern asmlinkage void do_syscall_trace(struct pt_regs *regs, int entryexit);
 
-extern NORET_TYPE void die(const char *, const struct pt_regs *) ATTRIB_NORET;
+extern NORET_TYPE void die(const char *, struct pt_regs *) ATTRIB_NORET;
 
-static inline void die_if_kernel(const char *str, const struct pt_regs *regs)
+static inline void die_if_kernel(const char *str, struct pt_regs *regs)
 {
         if (unlikely(!user_mode(regs)))
                 die(str, regs);
diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
index c8419129e77..58730c5ce4b 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -121,7 +121,7 @@
                 .endm
 #else
                 .macro  get_saved_sp    /* Uniprocessor variation */
-#ifdef CONFIG_CPU_LOONGSON2F
+#ifdef CONFIG_CPU_JUMP_WORKAROUNDS
                 /*
                  * Clear BTB (branch target buffer), forbid RAS (return address
                  * stack) to workaround the Out-of-order Issue in Loongson2F
diff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h
index 11a8b525254..697e40c0649 100644
--- a/arch/mips/include/asm/uasm.h
+++ b/arch/mips/include/asm/uasm.h
@@ -167,6 +167,24 @@ static inline void __cpuinit uasm_l##lb(struct uasm_label **lab, u32 *addr) \
 #define uasm_i_ssnop(buf) uasm_i_sll(buf, 0, 0, 1)
 #define uasm_i_ehb(buf) uasm_i_sll(buf, 0, 0, 3)
 
+static inline void uasm_i_dsrl_safe(u32 **p, unsigned int a1,
+                                    unsigned int a2, unsigned int a3)
+{
+        if (a3 < 32)
+                uasm_i_dsrl(p, a1, a2, a3);
+        else
+                uasm_i_dsrl32(p, a1, a2, a3 - 32);
+}
+
+static inline void uasm_i_dsll_safe(u32 **p, unsigned int a1,
+                                    unsigned int a2, unsigned int a3)
+{
+        if (a3 < 32)
+                uasm_i_dsll(p, a1, a2, a3);
+        else
+                uasm_i_dsll32(p, a1, a2, a3 - 32);
+}
+
 /* Handle relocations. */
 struct uasm_reloc {
         u32 *addr;
diff --git a/arch/mips/jazz/setup.c b/arch/mips/jazz/setup.c
index 7043f6b9ff3..0d0f054a02f 100644
--- a/arch/mips/jazz/setup.c
+++ b/arch/mips/jazz/setup.c
@@ -76,15 +76,9 @@ void __init plat_mem_setup(void)
 
 #ifdef CONFIG_VT
         screen_info = (struct screen_info) {
-                0, 0,           /* orig-x, orig-y */
-                0,              /* unused */
-                0,              /* orig_video_page */
-                0,              /* orig_video_mode */
-                160,            /* orig_video_cols */
-                0, 0, 0,        /* unused, ega_bx, unused */
-                64,             /* orig_video_lines */
-                0,              /* orig_video_isVGA */
-                16              /* orig_video_points */
+                .orig_video_cols        = 160,
+                .orig_video_lines       = 64,
+                .orig_video_points      = 16,
         };
 #endif
 
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 44337ba0371..a5297e2a353 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -385,7 +385,7 @@ EXPORT(sysn32_call_table)
         PTR     sys_fchmodat
         PTR     sys_faccessat
         PTR     compat_sys_pselect6
-        PTR     sys_ppoll                       /* 6265 */
+        PTR     compat_sys_ppoll                /* 6265 */
         PTR     sys_unshare
         PTR     sys_splice
         PTR     sys_sync_file_range
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 1a4dd657ccb..d612c6dcb74 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -352,9 +352,10 @@ void show_registers(const struct pt_regs *regs)
 
 static DEFINE_SPINLOCK(die_lock);
 
-void __noreturn die(const char * str, const struct pt_regs * regs)
+void __noreturn die(const char * str, struct pt_regs * regs)
 {
         static int die_counter;
+        int sig = SIGSEGV;
 #ifdef CONFIG_MIPS_MT_SMTC
         unsigned long dvpret = dvpe();
 #endif /* CONFIG_MIPS_MT_SMTC */
@@ -365,6 +366,10 @@ void __noreturn die(const char * str, const struct pt_regs * regs)
 #ifdef CONFIG_MIPS_MT_SMTC
         mips_mt_regdump(dvpret);
 #endif /* CONFIG_MIPS_MT_SMTC */
+
+        if (notify_die(DIE_OOPS, str, regs, 0, current->thread.trap_no, SIGSEGV) == NOTIFY_STOP)
+                sig = 0;
+
         printk("%s[#%d]:\n", str, ++die_counter);
         show_registers(regs);
         add_taint(TAINT_DIE);
@@ -379,7 +384,7 @@ void __noreturn die(const char * str, const struct pt_regs * regs)
                 panic("Fatal exception");
         }
 
-        do_exit(SIGSEGV);
+        do_exit(sig);
 }
 
 extern struct exception_table_entry __start___dbe_table[];
@@ -1557,12 +1562,7 @@ static char panic_null_cerr[] __cpuinitdata =
 void __cpuinit set_uncached_handler(unsigned long offset, void *addr,
         unsigned long size)
 {
-#ifdef CONFIG_32BIT
-        unsigned long uncached_ebase = KSEG1ADDR(ebase);
-#endif
-#ifdef CONFIG_64BIT
-        unsigned long uncached_ebase = TO_UNCAC(ebase);
-#endif
+        unsigned long uncached_ebase = CKSEG1ADDR(ebase);
 
         if (!addr)
                 panic(panic_null_cerr);
diff --git a/arch/mips/loongson/common/machtype.c b/arch/mips/loongson/common/machtype.c
index 853f184b793..81fbe6b73f9 100644
--- a/arch/mips/loongson/common/machtype.c
+++ b/arch/mips/loongson/common/machtype.c
@@ -24,7 +24,7 @@ static const char *system_types[] = {
         [MACH_LEMOTE_FL2F]              "lemote-fuloong-2f-box",
         [MACH_LEMOTE_ML2F7]             "lemote-mengloong-2f-7inches",
         [MACH_LEMOTE_YL2F89]            "lemote-yeeloong-2f-8.9inches",
-        [MACH_DEXXON_GDIUM2F10]         "dexxon-gidum-2f-10inches",
+        [MACH_DEXXON_GDIUM2F10]         "dexxon-gdium-2f",
         [MACH_LEMOTE_NAS]               "lemote-nas-2f",
         [MACH_LEMOTE_LL2F]              "lemote-lynloong-2f",
         [MACH_LOONGSON_END]             NULL,
diff --git a/arch/mips/loongson/common/mem.c b/arch/mips/loongson/common/mem.c
index ec2f7964a0b..30eba600120 100644
--- a/arch/mips/loongson/common/mem.c
+++ b/arch/mips/loongson/common/mem.c
@@ -75,7 +75,7 @@ pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
         unsigned long end = offset + size;
 
         if (__uncached_access(file, offset)) {
-                if (((uca_start && offset) >= uca_start) &&
+                if (uca_start && (offset >= uca_start) &&
                     (end <= uca_end))
                         return __pgprot((pgprot_val(vma_prot) &
                                          ~_CACHE_MASK) |
@@ -96,7 +96,7 @@ static int __init find_vga_mem_init(void)
                 return 0;
 
         for_each_pci_dev(dev) {
-                if ((dev->class >> 8) == PCI_CLASS_DISPLAY_VGA) {
+                if ((dev->class >> 16) == PCI_BASE_CLASS_DISPLAY) {
                         for (idx = 0; idx < PCI_NUM_RESOURCES; idx++) {
                                 r = &dev->resource[idx];
                                 if (!r->start && r->end)
diff --git a/arch/mips/loongson/common/reset.c b/arch/mips/loongson/common/reset.c
index 4bd9c18b07a..9e10d6225d9 100644
--- a/arch/mips/loongson/common/reset.c
+++ b/arch/mips/loongson/common/reset.c
@@ -16,13 +16,31 @@
 
 #include <loongson.h>
 
+static inline void loongson_reboot(void)
+{
+#ifndef CONFIG_CPU_JUMP_WORKAROUNDS
+        ((void (*)(void))ioremap_nocache(LOONGSON_BOOT_BASE, 4)) ();
+#else
+        void (*func)(void);
+
+        func = (void *)ioremap_nocache(LOONGSON_BOOT_BASE, 4);
+
+        __asm__ __volatile__(
+        "       .set    noat                                            \n"
+        "       jr      %[func]                                         \n"
+        "       .set    at                                              \n"
+        : /* No outputs */
+        : [func] "r" (func));
+#endif
+}
+
 static void loongson_restart(char *command)
 {
         /* do preparation for reboot */
         mach_prepare_reboot();
 
         /* reboot via jumping to boot base address */
-        ((void (*)(void))ioremap_nocache(LOONGSON_BOOT_BASE, 4)) ();
+        loongson_reboot();
 }
 
 static void loongson_poweroff(void)
diff --git a/arch/mips/loongson/common/setup.c b/arch/mips/loongson/common/setup.c
index 4cd2aa9a342..27d826bc710 100644
--- a/arch/mips/loongson/common/setup.c
+++ b/arch/mips/loongson/common/setup.c
@@ -41,15 +41,12 @@ void __init plat_mem_setup(void)
         conswitchp = &vga_con;
 
         screen_info = (struct screen_info) {
-                0, 25,          /* orig-x, orig-y */
-                    0,          /* unused */
-                    0,          /* orig-video-page */
-                    0,          /* orig-video-mode */
-                    80,         /* orig-video-cols */
-                    0, 0, 0,    /* ega_ax, ega_bx, ega_cx */
-                    25,         /* orig-video-lines */
-                    VIDEO_TYPE_VGAC,    /* orig-video-isVGA */
-                    16          /* orig-video-points */
+                .orig_x                 = 0,
+                .orig_y                 = 25,
+                .orig_video_cols        = 80,
+                .orig_video_lines       = 25,
+                .orig_video_isVGA       = VIDEO_TYPE_VGAC,
+                .orig_video_points      = 16,
         };
 #elif defined(CONFIG_DUMMY_CONSOLE)
         conswitchp = &dummy_con;
diff --git a/arch/mips/loongson/lemote-2f/irq.c b/arch/mips/loongson/lemote-2f/irq.c
index 882dfcd42c0..1d8b4d28a05 100644
--- a/arch/mips/loongson/lemote-2f/irq.c
+++ b/arch/mips/loongson/lemote-2f/irq.c
@@ -79,7 +79,7 @@ void mach_irq_dispatch(unsigned int pending)
         if (pending & CAUSEF_IP7)
                 do_IRQ(LOONGSON_TIMER_IRQ);
         else if (pending & CAUSEF_IP6) {        /* North Bridge, Perf counter */
-#ifdef CONFIG_OPROFILE
+#if defined(CONFIG_OPROFILE) || defined(CONFIG_OPROFILE_MODULE)
                 do_IRQ(LOONGSON2_PERFCNT_IRQ);
 #endif
                 bonito_irqdispatch();
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 8f2f8e9d8b2..f2338d1c0b4 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -78,6 +78,9 @@ DEFINE_PER_CPU(struct mips_fpu_emulator_stats, fpuemustats);
 #define FPCREG_RID      0       /* $0  = revision id */
 #define FPCREG_CSR      31      /* $31 = csr */
 
+/* Determine rounding mode from the RM bits of the FCSR */
+#define modeindex(v) ((v) & FPU_CSR_RM)
+
 /* Convert Mips rounding mode (0..3) to IEEE library modes. */
 static const unsigned char ieee_rm[4] = {
         [FPU_CSR_RN] = IEEE754_RN,
@@ -384,10 +387,14 @@ static int cop1Emulate(struct pt_regs *xcp, struct mips_fpu_struct *ctx)
                                         (void *) (xcp->cp0_epc),
                                         MIPSInst_RT(ir), value);
 #endif
-                                value &= (FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03);
-                                ctx->fcr31 &= ~(FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03);
-                                /* convert to ieee library modes */
-                                ctx->fcr31 |= (value & ~0x3) | ieee_rm[value & 0x3];
+
+                                /*
+                                 * Don't write reserved bits,
+                                 * and convert to ieee library modes
+                                 */
+                                ctx->fcr31 = (value &
+                                                ~(FPU_CSR_RSVD | FPU_CSR_RM)) |
+                                                ieee_rm[modeindex(value)];
                         }
                         if ((ctx->fcr31 >> 5) & ctx->fcr31 & FPU_CSR_ALL_E) {
                                 return SIGFPE;
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index d1f68aadbc4..86f004dc835 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -31,6 +31,16 @@
 #include <asm/war.h>
 #include <asm/uasm.h>
 
+/*
+ * TLB load/store/modify handlers.
+ *
+ * Only the fastpath gets synthesized at runtime, the slowpath for
+ * do_page_fault remains normal asm.
+ */
+extern void tlb_do_page_fault_0(void);
+extern void tlb_do_page_fault_1(void);
+
+
 static inline int r45k_bvahwbug(void)
 {
         /* XXX: We should probe for the presence of this bug, but we don't. */
@@ -83,6 +93,7 @@ enum label_id {
         label_nopage_tlbm,
         label_smp_pgtable_change,
         label_r3000_write_probe_fail,
+        label_large_segbits_fault,
 #ifdef CONFIG_HUGETLB_PAGE
         label_tlb_huge_update,
 #endif
@@ -101,6 +112,7 @@ UASM_L_LA(_nopage_tlbs)
 UASM_L_LA(_nopage_tlbm)
 UASM_L_LA(_smp_pgtable_change)
 UASM_L_LA(_r3000_write_probe_fail)
+UASM_L_LA(_large_segbits_fault)
 #ifdef CONFIG_HUGETLB_PAGE
 UASM_L_LA(_tlb_huge_update)
 #endif
@@ -157,6 +169,10 @@ static u32 tlb_handler[128] __cpuinitdata;
 static struct uasm_label labels[128] __cpuinitdata;
 static struct uasm_reloc relocs[128] __cpuinitdata;
 
+#ifdef CONFIG_64BIT
+static int check_for_high_segbits __cpuinitdata;
+#endif
+
 #ifndef CONFIG_MIPS_PGD_C0_CONTEXT
 /*
  * CONFIG_MIPS_PGD_C0_CONTEXT implies 64 bit and lack of pgd_current,
@@ -408,7 +424,7 @@ static __cpuinit __maybe_unused void build_convert_pte_to_entrylo(u32 **p,
                 UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL) - ilog2(_PAGE_NO_EXEC));
         } else {
 #ifdef CONFIG_64BIT_PHYS_ADDR
-                uasm_i_dsrl(p, reg, reg, ilog2(_PAGE_GLOBAL));
+                uasm_i_dsrl_safe(p, reg, reg, ilog2(_PAGE_GLOBAL));
 #else
                 UASM_i_SRL(p, reg, reg, ilog2(_PAGE_GLOBAL));
 #endif
@@ -532,7 +548,24 @@ build_get_pmde64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
          * The vmalloc handling is not in the hotpath.
          */
         uasm_i_dmfc0(p, tmp, C0_BADVADDR);
-        uasm_il_bltz(p, r, tmp, label_vmalloc);
+
+        if (check_for_high_segbits) {
+                /*
+                 * The kernel currently implicitely assumes that the
+                 * MIPS SEGBITS parameter for the processor is
+                 * (PGDIR_SHIFT+PGDIR_BITS) or less, and will never
+                 * allocate virtual addresses outside the maximum
+                 * range for SEGBITS = (PGDIR_SHIFT+PGDIR_BITS). But
+                 * that doesn't prevent user code from accessing the
+                 * higher xuseg addresses.  Here, we make sure that
+                 * everything but the lower xuseg addresses goes down
+                 * the module_alloc/vmalloc path.
+                 */
+                uasm_i_dsrl_safe(p, ptr, tmp, PGDIR_SHIFT + PGD_ORDER + PAGE_SHIFT - 3);
+                uasm_il_bnez(p, r, ptr, label_vmalloc);
+        } else {
+                uasm_il_bltz(p, r, tmp, label_vmalloc);
+        }
         /* No uasm_i_nop needed here, since the next insn doesn't touch TMP. */
 
 #ifdef CONFIG_MIPS_PGD_C0_CONTEXT
@@ -549,14 +582,14 @@ build_get_pmde64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
          * SMTC uses TCBind value as "CPU" index
          */
         uasm_i_mfc0(p, ptr, C0_TCBIND);
-        uasm_i_dsrl(p, ptr, ptr, 19);
+        uasm_i_dsrl_safe(p, ptr, ptr, 19);
 # else
         /*
          * 64 bit SMP running in XKPHYS has smp_processor_id() << 3
          * stored in CONTEXT.
          */
         uasm_i_dmfc0(p, ptr, C0_CONTEXT);
-        uasm_i_dsrl(p, ptr, ptr, 23);
+        uasm_i_dsrl_safe(p, ptr, ptr, 23);
 # endif
         UASM_i_LA_mostly(p, tmp, pgdc);
         uasm_i_daddu(p, ptr, ptr, tmp);
@@ -569,44 +602,78 @@ build_get_pmde64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
 
         uasm_l_vmalloc_done(l, *p);
 
-        if (PGDIR_SHIFT - 3 < 32)               /* get pgd offset in bytes */
-                uasm_i_dsrl(p, tmp, tmp, PGDIR_SHIFT-3);
-        else
-                uasm_i_dsrl32(p, tmp, tmp, PGDIR_SHIFT - 3 - 32);
+        /* get pgd offset in bytes */
+        uasm_i_dsrl_safe(p, tmp, tmp, PGDIR_SHIFT - 3);
 
         uasm_i_andi(p, tmp, tmp, (PTRS_PER_PGD - 1)<<3);
         uasm_i_daddu(p, ptr, ptr, tmp); /* add in pgd offset */
 #ifndef __PAGETABLE_PMD_FOLDED
         uasm_i_dmfc0(p, tmp, C0_BADVADDR); /* get faulting address */
         uasm_i_ld(p, ptr, 0, ptr); /* get pmd pointer */
-        uasm_i_dsrl(p, tmp, tmp, PMD_SHIFT-3); /* get pmd offset in bytes */
+        uasm_i_dsrl_safe(p, tmp, tmp, PMD_SHIFT-3); /* get pmd offset in bytes */
         uasm_i_andi(p, tmp, tmp, (PTRS_PER_PMD - 1)<<3);
         uasm_i_daddu(p, ptr, ptr, tmp); /* add in pmd offset */
 #endif
 }
 
+enum vmalloc64_mode {not_refill, refill};
 /*
  * BVADDR is the faulting address, PTR is scratch.
  * PTR will hold the pgd for vmalloc.
  */
 static void __cpuinit
 build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
-                        unsigned int bvaddr, unsigned int ptr)
+                        unsigned int bvaddr, unsigned int ptr,
+                        enum vmalloc64_mode mode)
 {
         long swpd = (long)swapper_pg_dir;
+        int single_insn_swpd;
+        int did_vmalloc_branch = 0;
+
+        single_insn_swpd = uasm_in_compat_space_p(swpd) && !uasm_rel_lo(swpd);
 
         uasm_l_vmalloc(l, *p);
 
-        if (uasm_in_compat_space_p(swpd) && !uasm_rel_lo(swpd)) {
-                uasm_il_b(p, r, label_vmalloc_done);
-                uasm_i_lui(p, ptr, uasm_rel_hi(swpd));
-        } else {
-                UASM_i_LA_mostly(p, ptr, swpd);
-                uasm_il_b(p, r, label_vmalloc_done);
-                if (uasm_in_compat_space_p(swpd))
-                        uasm_i_addiu(p, ptr, ptr, uasm_rel_lo(swpd));
-                else
-                        uasm_i_daddiu(p, ptr, ptr, uasm_rel_lo(swpd));
+        if (mode == refill && check_for_high_segbits) {
+                if (single_insn_swpd) {
+                        uasm_il_bltz(p, r, bvaddr, label_vmalloc_done);
+                        uasm_i_lui(p, ptr, uasm_rel_hi(swpd));
+                        did_vmalloc_branch = 1;
+                        /* fall through */
+                } else {
+                        uasm_il_bgez(p, r, bvaddr, label_large_segbits_fault);
+                }
+        }
+        if (!did_vmalloc_branch) {
+                if (uasm_in_compat_space_p(swpd) && !uasm_rel_lo(swpd)) {
+                        uasm_il_b(p, r, label_vmalloc_done);
+                        uasm_i_lui(p, ptr, uasm_rel_hi(swpd));
+                } else {
+                        UASM_i_LA_mostly(p, ptr, swpd);
+                        uasm_il_b(p, r, label_vmalloc_done);
+                        if (uasm_in_compat_space_p(swpd))
+                                uasm_i_addiu(p, ptr, ptr, uasm_rel_lo(swpd));
+                        else
+                                uasm_i_daddiu(p, ptr, ptr, uasm_rel_lo(swpd));
+                }
+        }
+        if (mode == refill && check_for_high_segbits) {
+                uasm_l_large_segbits_fault(l, *p);
+                /*
+                 * We get here if we are an xsseg address, or if we are
+                 * an xuseg address above (PGDIR_SHIFT+PGDIR_BITS) boundary.
+                 *
+                 * Ignoring xsseg (assume disabled so would generate
+                 * (address errors?), the only remaining possibility
+                 * is the upper xuseg addresses.  On processors with
+                 * TLB_SEGBITS <= PGDIR_SHIFT+PGDIR_BITS, these
+                 * addresses would have taken an address error. We try
+                 * to mimic that here by taking a load/istream page
+                 * fault.
+                 */
+                UASM_i_LA(p, ptr, (unsigned long)tlb_do_page_fault_0);
+                uasm_i_jr(p, ptr);
+                uasm_i_nop(p);
         }
 }
 
@@ -720,9 +787,9 @@ static void __cpuinit build_update_entries(u32 **p, unsigned int tmp,
                         UASM_i_MTC0(p, tmp, C0_ENTRYLO0); /* load it */
                         UASM_i_ROTR(p, ptep, ptep, ilog2(_PAGE_GLOBAL) - ilog2(_PAGE_NO_EXEC));
                 } else {
-                        uasm_i_dsrl(p, tmp, tmp, ilog2(_PAGE_GLOBAL)); /* convert to entrylo0 */
+                        uasm_i_dsrl_safe(p, tmp, tmp, ilog2(_PAGE_GLOBAL)); /* convert to entrylo0 */
                         UASM_i_MTC0(p, tmp, C0_ENTRYLO0); /* load it */
-                        uasm_i_dsrl(p, ptep, ptep, ilog2(_PAGE_GLOBAL)); /* convert to entrylo1 */
+                        uasm_i_dsrl_safe(p, ptep, ptep, ilog2(_PAGE_GLOBAL)); /* convert to entrylo1 */
                 }
                 UASM_i_MTC0(p, ptep, C0_ENTRYLO1); /* load it */
         } else {
@@ -793,9 +860,9 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
                 uasm_i_dmfc0(&p, K0, C0_BADVADDR);
                 uasm_i_dmfc0(&p, K1, C0_ENTRYHI);
                 uasm_i_xor(&p, K0, K0, K1);
-                uasm_i_dsrl32(&p, K1, K0, 62 - 32);
-                uasm_i_dsrl(&p, K0, K0, 12 + 1);
-                uasm_i_dsll32(&p, K0, K0, 64 + 12 + 1 - segbits - 32);
+                uasm_i_dsrl_safe(&p, K1, K0, 62);
+                uasm_i_dsrl_safe(&p, K0, K0, 12 + 1);
+                uasm_i_dsll_safe(&p, K0, K0, 64 + 12 + 1 - segbits);
                 uasm_i_or(&p, K0, K0, K1);
                 uasm_il_bnez(&p, &r, K0, label_leave);
                 /* No need for uasm_i_nop */
@@ -825,7 +892,7 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
 #endif
 
 #ifdef CONFIG_64BIT
-        build_get_pgd_vmalloc64(&p, &l, &r, K0, K1);
+        build_get_pgd_vmalloc64(&p, &l, &r, K0, K1, refill);
 #endif
 
         /*
@@ -935,15 +1002,6 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
 }
 
 /*
- * TLB load/store/modify handlers.
- *
- * Only the fastpath gets synthesized at runtime, the slowpath for
- * do_page_fault remains normal asm.
- */
-extern void tlb_do_page_fault_0(void);
-extern void tlb_do_page_fault_1(void);
-
-/*
  * 128 instructions for the fastpath handler is generous and should
  * never be exceeded.
  */
@@ -1302,7 +1360,7 @@ build_r4000_tlbchange_handler_tail(u32 **p, struct uasm_label **l,
         uasm_i_eret(p); /* return from trap */
 
 #ifdef CONFIG_64BIT
-        build_get_pgd_vmalloc64(p, l, r, tmp, ptr);
+        build_get_pgd_vmalloc64(p, l, r, tmp, ptr, not_refill);
 #endif
 }
 
@@ -1322,9 +1380,9 @@ static void __cpuinit build_r4000_tlb_load_handler(void)
                 uasm_i_dmfc0(&p, K0, C0_BADVADDR);
                 uasm_i_dmfc0(&p, K1, C0_ENTRYHI);
                 uasm_i_xor(&p, K0, K0, K1);
-                uasm_i_dsrl32(&p, K1, K0, 62 - 32);
-                uasm_i_dsrl(&p, K0, K0, 12 + 1);
-                uasm_i_dsll32(&p, K0, K0, 64 + 12 + 1 - segbits - 32);
+                uasm_i_dsrl_safe(&p, K1, K0, 62);
+                uasm_i_dsrl_safe(&p, K0, K0, 12 + 1);
+                uasm_i_dsll_safe(&p, K0, K0, 64 + 12 + 1 - segbits);
                 uasm_i_or(&p, K0, K0, K1);
                 uasm_il_bnez(&p, &r, K0, label_leave);
                 /* No need for uasm_i_nop */
@@ -1526,6 +1584,10 @@ void __cpuinit build_tlb_refill_handler(void)
          */
         static int run_once = 0;
 
+#ifdef CONFIG_64BIT
+        check_for_high_segbits = current_cpu_data.vmbits > (PGDIR_SHIFT + PGD_ORDER + PAGE_SHIFT - 3);
+#endif
+
         switch (current_cpu_type()) {
         case CPU_R2000:
         case CPU_R3000:
diff --git a/arch/mips/nxp/pnx8550/common/reset.c b/arch/mips/nxp/pnx8550/common/reset.c
index 76bc3ec634e..fadd8744a6b 100644
--- a/arch/mips/nxp/pnx8550/common/reset.c
+++ b/arch/mips/nxp/pnx8550/common/reset.c
@@ -20,6 +20,8 @@
  * Reset the PNX8550 board.
  *
  */
+#include <linux/kernel.h>
+
 #include <asm/reboot.h>
 #include <glb.h>
 
diff --git a/arch/mips/oprofile/op_model_loongson2.c b/arch/mips/oprofile/op_model_loongson2.c
index 29e2326b625..fa3bf661ae2 100644
--- a/arch/mips/oprofile/op_model_loongson2.c
+++ b/arch/mips/oprofile/op_model_loongson2.c
@@ -122,7 +122,7 @@ static irqreturn_t loongson2_perfcount_handler(int irq, void *dev_id)
          */
 
         /* Check whether the irq belongs to me */
-        enabled = read_c0_perfcnt() & LOONGSON2_PERFCNT_INT_EN;
+        enabled = read_c0_perfctrl() & LOONGSON2_PERFCNT_INT_EN;
         if (!enabled)
                 return IRQ_NONE;
         enabled = reg.cnt1_enabled | reg.cnt2_enabled;
diff --git a/arch/mips/pci/pci-sb1250.c b/arch/mips/pci/pci-sb1250.c
index ada24e6f951..1711e8e101b 100644
--- a/arch/mips/pci/pci-sb1250.c
+++ b/arch/mips/pci/pci-sb1250.c
@@ -37,6 +37,7 @@
 #include <linux/mm.h>
 #include <linux/console.h>
 #include <linux/tty.h>
+#include <linux/vt.h>
 
 #include <asm/io.h>
 
@@ -254,7 +255,7 @@ static int __init sb1250_pcibios_init(void)
          * XXX ehs: Should this happen in PCI Device mode?
          */
         io_map_base = ioremap(A_PHYS_LDTPCI_IO_MATCH_BYTES, 1024 * 1024);
-        sb1250_controller.io_map_base = io_map_base;
+        sb1250_controller.io_map_base = (unsigned long)io_map_base;
         set_io_port_base((unsigned long)io_map_base);
 
 #ifdef CONFIG_SIBYTE_HAS_LDT
diff --git a/arch/mips/sgi-ip22/ip22-berr.c b/arch/mips/sgi-ip22/ip22-berr.c
index de6a0cc32fe..911d3999c0c 100644
--- a/arch/mips/sgi-ip22/ip22-berr.c
+++ b/arch/mips/sgi-ip22/ip22-berr.c
@@ -89,7 +89,7 @@ static void print_buserr(void)
 void ip22_be_interrupt(int irq)
 {
         const int field = 2 * sizeof(unsigned long);
-        const struct pt_regs *regs = get_irq_regs();
+        struct pt_regs *regs = get_irq_regs();
 
         save_and_clear_buserr();
         print_buserr();
diff --git a/arch/mips/sgi-ip22/ip28-berr.c b/arch/mips/sgi-ip22/ip28-berr.c
index 30e12e2ec4b..88c684e05a3 100644
--- a/arch/mips/sgi-ip22/ip28-berr.c
+++ b/arch/mips/sgi-ip22/ip28-berr.c
@@ -453,7 +453,7 @@ mips_be_fatal:
 
 void ip22_be_interrupt(int irq)
 {
-        const struct pt_regs *regs = get_irq_regs();
+        struct pt_regs *regs = get_irq_regs();
 
         count_be_interrupt++;
 
diff --git a/arch/mips/sibyte/swarm/setup.c b/arch/mips/sibyte/swarm/setup.c
index 5277aac96b0..c308989fc46 100644
--- a/arch/mips/sibyte/swarm/setup.c
+++ b/arch/mips/sibyte/swarm/setup.c
@@ -145,15 +145,14 @@ void __init plat_mem_setup(void)
 
 #ifdef CONFIG_VT
         screen_info = (struct screen_info) {
-                0, 0,           /* orig-x, orig-y */
-                0,              /* unused */
-                52,             /* orig_video_page */
-                3,              /* orig_video_mode */
-                80,             /* orig_video_cols */
-                4626, 3, 9,     /* unused, ega_bx, unused */
-                25,             /* orig_video_lines */
-                0x22,           /* orig_video_isVGA */
-                16              /* orig_video_points */
+                .orig_video_page        = 52,
+                .orig_video_mode        = 3,
+                .orig_video_cols        = 80,
+                .flags                  = 12,
+                .orig_video_ega_bx      = 3,
+                .orig_video_lines       = 25,
+                .orig_video_isVGA       = 0x22,
+                .orig_video_points      = 16,
        };
        /* XXXKW for CFE, get lines/cols from environment */
 #endif
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index 9f4c9d4f580..bd100fcf40d 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -130,43 +130,5 @@ static inline int irqs_disabled_flags(unsigned long flags)
  */
 struct irq_chip;
 
-#ifdef CONFIG_PERF_EVENTS
-
-#ifdef CONFIG_PPC64
-static inline unsigned long test_perf_event_pending(void)
-{
-        unsigned long x;
-
-        asm volatile("lbz %0,%1(13)"
-                : "=r" (x)
-                : "i" (offsetof(struct paca_struct, perf_event_pending)));
-        return x;
-}
-
-static inline void set_perf_event_pending(void)
-{
-        asm volatile("stb %0,%1(13)" : :
-                "r" (1),
-                "i" (offsetof(struct paca_struct, perf_event_pending)));
-}
-
-static inline void clear_perf_event_pending(void)
-{
-        asm volatile("stb %0,%1(13)" : :
-                "r" (0),
-                "i" (offsetof(struct paca_struct, perf_event_pending)));
-}
-#endif /* CONFIG_PPC64 */
-
-#else  /* CONFIG_PERF_EVENTS */
-
-static inline unsigned long test_perf_event_pending(void)
-{
-        return 0;
-}
-
-static inline void clear_perf_event_pending(void) {}
-#endif /* CONFIG_PERF_EVENTS */
-
 #endif  /* __KERNEL__ */
 #endif  /* _ASM_POWERPC_HW_IRQ_H */
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 957ceb7059c..c09138d150d 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -133,7 +133,6 @@ int main(void)
         DEFINE(PACAKMSR, offsetof(struct paca_struct, kernel_msr));
         DEFINE(PACASOFTIRQEN, offsetof(struct paca_struct, soft_enabled));
         DEFINE(PACAHARDIRQEN, offsetof(struct paca_struct, hard_enabled));
-        DEFINE(PACAPERFPEND, offsetof(struct paca_struct, perf_event_pending));
         DEFINE(PACACONTEXTID, offsetof(struct paca_struct, context.id));
 #ifdef CONFIG_PPC_MM_SLICES
         DEFINE(PACALOWSLICESPSIZE, offsetof(struct paca_struct,
diff --git a/arch/powerpc/kernel/dma-swiotlb.c b/arch/powerpc/kernel/dma-swiotlb.c
index 59c928564a0..4ff4da2c238 100644
--- a/arch/powerpc/kernel/dma-swiotlb.c
+++ b/arch/powerpc/kernel/dma-swiotlb.c
@@ -1,7 +1,8 @@
 /*
  * Contains routines needed to support swiotlb for ppc.
  *
- * Copyright (C) 2009 Becky Bruce, Freescale Semiconductor
+ * Copyright (C) 2009-2010 Freescale Semiconductor, Inc.
+ * Author: Becky Bruce
  *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
@@ -70,7 +71,7 @@ static int ppc_swiotlb_bus_notify(struct notifier_block *nb,
         sd->max_direct_dma_addr = 0;
 
         /* May need to bounce if the device can't address all of DRAM */
-        if (dma_get_mask(dev) < lmb_end_of_DRAM())
+        if ((dma_get_mask(dev) + 1) < lmb_end_of_DRAM())
                 set_dma_ops(dev, &swiotlb_dma_ops);
 
         return NOTIFY_DONE;
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 07109d84378..42e9d908914 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -556,15 +556,6 @@ ALT_FW_FTR_SECTION_END_IFCLR(FW_FEATURE_ISERIES)
 2:
         TRACE_AND_RESTORE_IRQ(r5);
 
-#ifdef CONFIG_PERF_EVENTS
-        /* check paca->perf_event_pending if we're enabling ints */
-        lbz     r3,PACAPERFPEND(r13)
-        and.    r3,r3,r5
-        beq     27f
-        bl      .perf_event_do_pending
-27:
-#endif /* CONFIG_PERF_EVENTS */
-
         /* extract EE bit and use it to restore paca->hard_enabled */
         ld      r3,_MSR(r1)
         rldicl  r4,r3,49,63             /* r0 = (r3 >> 15) & 1 */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 64f6f2031c2..066bd31551d 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -53,7 +53,6 @@
 #include <linux/bootmem.h>
 #include <linux/pci.h>
 #include <linux/debugfs.h>
-#include <linux/perf_event.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -145,11 +144,6 @@ notrace void raw_local_irq_restore(unsigned long en)
         }
 #endif /* CONFIG_PPC_STD_MMU_64 */
 
-        if (test_perf_event_pending()) {
-                clear_perf_event_pending();
-                perf_event_do_pending();
-        }
-
         /*
          * if (get_paca()->hard_enabled) return;
          * But again we need to take care that gcc gets hard_enabled directly
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 1b16b9a3e49..0441bbdadbd 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -532,25 +532,60 @@ void __init iSeries_time_init_early(void)
 }
 #endif /* CONFIG_PPC_ISERIES */
 
-#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_PPC32)
-DEFINE_PER_CPU(u8, perf_event_pending);
+#ifdef CONFIG_PERF_EVENTS
 
-void set_perf_event_pending(void)
+/*
+ * 64-bit uses a byte in the PACA, 32-bit uses a per-cpu variable...
+ */
+#ifdef CONFIG_PPC64
+static inline unsigned long test_perf_event_pending(void)
 {
-        get_cpu_var(perf_event_pending) = 1;
-        set_dec(1);
-        put_cpu_var(perf_event_pending);
+        unsigned long x;
+
+        asm volatile("lbz %0,%1(13)"
+                : "=r" (x)
+                : "i" (offsetof(struct paca_struct, perf_event_pending)));
+        return x;
 }
 
+static inline void set_perf_event_pending_flag(void)
+{
+        asm volatile("stb %0,%1(13)" : :
+                "r" (1),
+                "i" (offsetof(struct paca_struct, perf_event_pending)));
+}
+
+static inline void clear_perf_event_pending(void)
+{
+        asm volatile("stb %0,%1(13)" : :
+                "r" (0),
+                "i" (offsetof(struct paca_struct, perf_event_pending)));
+}
+
+#else /* 32-bit */
+
+DEFINE_PER_CPU(u8, perf_event_pending);
+
+#define set_perf_event_pending_flag()   __get_cpu_var(perf_event_pending) = 1
 #define test_perf_event_pending()       __get_cpu_var(perf_event_pending)
 #define clear_perf_event_pending()      __get_cpu_var(perf_event_pending) = 0
 
-#else  /* CONFIG_PERF_EVENTS && CONFIG_PPC32 */
+#endif /* 32 vs 64 bit */
+
+void set_perf_event_pending(void)
+{
+        preempt_disable();
+        set_perf_event_pending_flag();
+        set_dec(1);
+        preempt_enable();
+}
+
+#else  /* CONFIG_PERF_EVENTS */
 
 #define test_perf_event_pending()       0
 #define clear_perf_event_pending()
 
-#endif /* CONFIG_PERF_EVENTS && CONFIG_PPC32 */
+#endif /* CONFIG_PERF_EVENTS */
 
 /*
  * For iSeries shared processors, we have to let the hypervisor
@@ -582,10 +617,6 @@ void timer_interrupt(struct pt_regs * regs)
         set_dec(DECREMENTER_MAX);
 
 #ifdef CONFIG_PPC32
-        if (test_perf_event_pending()) {
-                clear_perf_event_pending();
-                perf_event_do_pending();
-        }
         if (atomic_read(&ppc_n_lost_interrupts) != 0)
                 do_IRQ(regs);
 #endif
@@ -604,6 +635,11 @@ void timer_interrupt(struct pt_regs * regs)
 
         calculate_steal_time();
 
+        if (test_perf_event_pending()) {
+                clear_perf_event_pending();
+                perf_event_do_pending();
+        }
+
 #ifdef CONFIG_PPC_ISERIES
         if (firmware_has_feature(FW_FEATURE_ISERIES))
                 get_lppaca()->int_dword.fields.decr_int = 0;
diff --git a/arch/powerpc/kvm/44x_tlb.c b/arch/powerpc/kvm/44x_tlb.c
index 2570fcc7665..812312542e5 100644
--- a/arch/powerpc/kvm/44x_tlb.c
+++ b/arch/powerpc/kvm/44x_tlb.c
@@ -440,7 +440,7 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
         unsigned int gtlb_index;
 
         gtlb_index = kvmppc_get_gpr(vcpu, ra);
-        if (gtlb_index > KVM44x_GUEST_TLB_SIZE) {
+        if (gtlb_index >= KVM44x_GUEST_TLB_SIZE) {
                 printk("%s: index %d\n", __func__, gtlb_index);
                 kvmppc_dump_vcpu(vcpu);
                 return EMULATE_FAIL;
diff --git a/arch/s390/kernel/head31.S b/arch/s390/kernel/head31.S
index 1bbcc499d45..b8f8dc12610 100644
--- a/arch/s390/kernel/head31.S
+++ b/arch/s390/kernel/head31.S
@@ -82,7 +82,7 @@ startup_continue:
 _ehead:
 
 #ifdef CONFIG_SHARED_KERNEL
-        .org    0x100000
+        .org    0x100000 - 0x11000      # head.o ends at 0x11000
 #endif
 
 #
diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
index 1f70970de0a..cdef6871741 100644
--- a/arch/s390/kernel/head64.S
+++ b/arch/s390/kernel/head64.S
@@ -80,7 +80,7 @@ startup_continue:
 _ehead:
 
 #ifdef CONFIG_SHARED_KERNEL
-        .org    0x100000
+        .org    0x100000 - 0x11000      # head.o ends at 0x11000
 #endif
 
 #
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 33fdc5a7976..9f654da4cec 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -640,7 +640,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
 
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 {
-        long ret;
+        long ret = 0;
 
         /* Do the secure computing check first. */
         secure_computing(regs->gprs[2]);
@@ -649,7 +649,6 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
          * The sysc_tracesys code in entry.S stored the system
          * call number to gprs[2].
          */
-        ret = regs->gprs[2];
         if (test_thread_flag(TIF_SYSCALL_TRACE) &&
             (tracehook_report_syscall_entry(regs) ||
              regs->gprs[2] >= NR_syscalls)) {
@@ -671,7 +670,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
                                     regs->gprs[2], regs->orig_gpr2,
                                     regs->gprs[3], regs->gprs[4],
                                     regs->gprs[5]);
-        return ret;
+        return ret ?: regs->gprs[2];
 }
 
 asmlinkage void do_syscall_trace_exit(struct pt_regs *regs)
diff --git a/arch/sh/configs/rts7751r2d1_defconfig b/arch/sh/configs/rts7751r2d1_defconfig
index fba1f62d56e..dba024d72a8 100644
--- a/arch/sh/configs/rts7751r2d1_defconfig
+++ b/arch/sh/configs/rts7751r2d1_defconfig
@@ -877,7 +877,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 # CONFIG_SERIAL_MAX3100 is not set
 CONFIG_SERIAL_SH_SCI=y
-CONFIG_SERIAL_SH_SCI_NR_UARTS=1
+CONFIG_SERIAL_SH_SCI_NR_UARTS=2
 CONFIG_SERIAL_SH_SCI_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
diff --git a/arch/sh/configs/rts7751r2dplus_defconfig b/arch/sh/configs/rts7751r2dplus_defconfig
index a8d538f06e6..6d511d06cbf 100644
--- a/arch/sh/configs/rts7751r2dplus_defconfig
+++ b/arch/sh/configs/rts7751r2dplus_defconfig
@@ -963,7 +963,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 # CONFIG_SERIAL_MAX3100 is not set
 CONFIG_SERIAL_SH_SCI=y
-CONFIG_SERIAL_SH_SCI_NR_UARTS=1
+CONFIG_SERIAL_SH_SCI_NR_UARTS=2
 CONFIG_SERIAL_SH_SCI_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
diff --git a/arch/sh/drivers/pci/pci-sh7751.c b/arch/sh/drivers/pci/pci-sh7751.c
index 17811e5d287..f98141b3b7d 100644
--- a/arch/sh/drivers/pci/pci-sh7751.c
+++ b/arch/sh/drivers/pci/pci-sh7751.c
@@ -17,6 +17,7 @@
 #include <linux/io.h>
 #include "pci-sh4.h"
 #include <asm/addrspace.h>
+#include <asm/sizes.h>
 
 static int __init __area_sdram_check(struct pci_channel *chan,
                                      unsigned int area)
@@ -47,8 +48,8 @@ static int __init __area_sdram_check(struct pci_channel *chan,
 static struct resource sh7751_pci_resources[] = {
         {
                 .name   = "SH7751_IO",
-                .start  = SH7751_PCI_IO_BASE,
-                .end    = SH7751_PCI_IO_BASE + SH7751_PCI_IO_SIZE - 1,
+                .start  = 0x1000,
+                .end    = SZ_4M - 1,
                 .flags  = IORESOURCE_IO
         }, {
                 .name   = "SH7751_mem",
diff --git a/arch/sh/include/cpu-sh4/cpu/dma-register.h b/arch/sh/include/cpu-sh4/cpu/dma-register.h
index 55f9fec082d..de235953399 100644
--- a/arch/sh/include/cpu-sh4/cpu/dma-register.h
+++ b/arch/sh/include/cpu-sh4/cpu/dma-register.h
@@ -76,7 +76,7 @@ enum {
 }
 
 #define TS_INDEX2VAL(i) ((((i) & 3) << CHCR_TS_LOW_SHIFT) | \
-                         ((((i) >> 2) & 3) << CHCR_TS_HIGH_SHIFT))
+                         (((i) & 0xc) << CHCR_TS_HIGH_SHIFT))
 
 #else /* CONFIG_CPU_SH4A */
 
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index a1dcfa3ab17..30a3e977612 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -347,6 +347,7 @@ extern void __iomem *early_ioremap(resource_size_t phys_addr,
 extern void __iomem *early_memremap(resource_size_t phys_addr,
                                     unsigned long size);
 extern void early_iounmap(void __iomem *addr, unsigned long size);
+extern void fixup_early_ioremap(void);
 
 #define IO_SPACE_LIMIT 0xffff
 
diff --git a/arch/x86/include/asm/k8.h b/arch/x86/include/asm/k8.h
index f70e60071fe..af00bd1d208 100644
--- a/arch/x86/include/asm/k8.h
+++ b/arch/x86/include/asm/k8.h
@@ -16,11 +16,16 @@ extern int k8_numa_init(unsigned long start_pfn, unsigned long end_pfn);
 extern int k8_scan_nodes(void);
 
 #ifdef CONFIG_K8_NB
+extern int num_k8_northbridges;
+
 static inline struct pci_dev *node_to_k8_nb_misc(int node)
 {
         return (node < num_k8_northbridges) ? k8_northbridges[node] : NULL;
 }
+
 #else
+#define num_k8_northbridges 0
+
 static inline struct pci_dev *node_to_k8_nb_misc(int node)
 {
         return NULL;
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 127b8718abf..eb2789c3f72 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2545,6 +2545,9 @@ void irq_force_complete_move(int irq)
         struct irq_desc *desc = irq_to_desc(irq);
         struct irq_cfg *cfg = desc->chip_data;
 
+        if (!cfg)
+                return;
+
         __irq_complete_move(&desc, cfg->vector);
 }
 #else
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index d360b56e982..b6215b9798e 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -929,7 +929,8 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data,
                 powernow_table[i].index = index;
 
                 /* Frequency may be rounded for these */
-                if (boot_cpu_data.x86 == 0x10 || boot_cpu_data.x86 == 0x11) {
+                if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
+                                 || boot_cpu_data.x86 == 0x11) {
                         powernow_table[i].frequency =
                                 freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7);
                 } else
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index b3eeb66c0a5..95962a93f99 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -340,6 +340,10 @@ amd_check_l3_disable(int index, struct _cpuid4_info_regs *this_leaf)
              (boot_cpu_data.x86_mask  < 0x1)))
                 return;
 
+        /* not in virtualized environments */
+        if (num_k8_northbridges == 0)
+                return;
+
         this_leaf->can_disable = true;
         this_leaf->l3_indices  = amd_calc_l3_indices();
 }
diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
index b43bbaebe2c..1658efdfb4e 100644
--- a/arch/x86/kernel/kprobes.c
+++ b/arch/x86/kernel/kprobes.c
@@ -534,20 +534,6 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
         struct kprobe_ctlblk *kcb;
 
         addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
-        if (*addr != BREAKPOINT_INSTRUCTION) {
-                /*
-                 * The breakpoint instruction was removed right
-                 * after we hit it.  Another cpu has removed
-                 * either a probepoint or a debugger breakpoint
-                 * at this address.  In either case, no further
-                 * handling of this interrupt is appropriate.
-                 * Back up over the (now missing) int3 and run
-                 * the original instruction.
-                 */
-                regs->ip = (unsigned long)addr;
-                return 1;
-        }
-
         /*
          * We don't want to be preempted for the entire
          * duration of kprobe processing. We conditionally
@@ -579,6 +565,19 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                                 setup_singlestep(p, regs, kcb, 0);
                         return 1;
                 }
+        } else if (*addr != BREAKPOINT_INSTRUCTION) {
+                /*
+                 * The breakpoint instruction was removed right
+                 * after we hit it.  Another cpu has removed
+                 * either a probepoint or a debugger breakpoint
+                 * at this address.  In either case, no further
+                 * handling of this interrupt is appropriate.
+                 * Back up over the (now missing) int3 and run
+                 * the original instruction.
+                 */
+                regs->ip = (unsigned long)addr;
+                preempt_enable_no_resched();
+                return 1;
         } else if (kprobe_running()) {
                 p = __get_cpu_var(current_kprobe);
                 if (p->break_handler && p->break_handler(p, regs)) {
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 28ad9f4d8b9..0415c3ef91b 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -546,11 +546,13 @@ static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
                  * check OSVW bit for CPUs that are not affected
                  * by erratum #400
                  */
-                rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
-                if (val >= 2) {
-                        rdmsrl(MSR_AMD64_OSVW_STATUS, val);
-                        if (!(val & BIT(1)))
-                                goto no_c1e_idle;
+                if (cpu_has(c, X86_FEATURE_OSVW)) {
+                        rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
+                        if (val >= 2) {
+                                rdmsrl(MSR_AMD64_OSVW_STATUS, val);
+                                if (!(val & BIT(1)))
+                                        goto no_c1e_idle;
+                        }
                 }
                 return 1;
         }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 2ba58206812..737361fcd50 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -2067,7 +2067,7 @@ static int cpuid_interception(struct vcpu_svm *svm)
 static int iret_interception(struct vcpu_svm *svm)
 {
         ++svm->vcpu.stat.nmi_window_exits;
-        svm->vmcb->control.intercept &= ~(1UL << INTERCEPT_IRET);
+        svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_IRET);
         svm->vcpu.arch.hflags |= HF_IRET_MASK;
         return 1;
 }
@@ -2479,7 +2479,7 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
 
         svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
         vcpu->arch.hflags |= HF_NMI_MASK;
-        svm->vmcb->control.intercept |= (1UL << INTERCEPT_IRET);
+        svm->vmcb->control.intercept |= (1ULL << INTERCEPT_IRET);
         ++vcpu->stat.nmi_injections;
 }
 
@@ -2539,10 +2539,10 @@ static void svm_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
 
         if (masked) {
                 svm->vcpu.arch.hflags |= HF_NMI_MASK;
-                svm->vmcb->control.intercept |= (1UL << INTERCEPT_IRET);
+                svm->vmcb->control.intercept |= (1ULL << INTERCEPT_IRET);
         } else {
                 svm->vcpu.arch.hflags &= ~HF_NMI_MASK;
-                svm->vmcb->control.intercept &= ~(1UL << INTERCEPT_IRET);
+                svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_IRET);
         }
 }
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index bc933cfb4e6..2f8db0ec8ae 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2703,8 +2703,7 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
                 return 0;
 
         return  !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
-                        (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS |
-                                GUEST_INTR_STATE_NMI));
+                        (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_NMI));
 }
 
 static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3c4ca98ad27..c4f35b545c1 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1712,6 +1712,7 @@ static int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
         if (copy_from_user(cpuid_entries, entries,
                            cpuid->nent * sizeof(struct kvm_cpuid_entry)))
                 goto out_free;
+        vcpu_load(vcpu);
         for (i = 0; i < cpuid->nent; i++) {
                 vcpu->arch.cpuid_entries[i].function = cpuid_entries[i].function;
                 vcpu->arch.cpuid_entries[i].eax = cpuid_entries[i].eax;
@@ -1729,6 +1730,7 @@ static int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
         r = 0;
         kvm_apic_set_version(vcpu);
         kvm_x86_ops->cpuid_update(vcpu);
+        vcpu_put(vcpu);
 
 out_free:
         vfree(cpuid_entries);
@@ -1749,9 +1751,11 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
         if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
                            cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
                 goto out;
+        vcpu_load(vcpu);
         vcpu->arch.cpuid_nent = cpuid->nent;
         kvm_apic_set_version(vcpu);
         kvm_x86_ops->cpuid_update(vcpu);
+        vcpu_put(vcpu);
         return 0;
 
 out:
diff --git a/arch/x86/lib/rwsem_64.S b/arch/x86/lib/rwsem_64.S
index 15acecf0d7a..41fcf00e49d 100644
--- a/arch/x86/lib/rwsem_64.S
+++ b/arch/x86/lib/rwsem_64.S
@@ -60,7 +60,7 @@ ENTRY(call_rwsem_down_write_failed)
         ENDPROC(call_rwsem_down_write_failed)
 
 ENTRY(call_rwsem_wake)
-        decw %dx    /* do nothing if still outstanding active readers */
+        decl %edx       /* do nothing if still outstanding active readers */
         jnz 1f
         save_common_regs
         movq %rax,%rdi
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 5eb1ba74a3a..12e4d2d3c11 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -448,6 +448,20 @@ static inline void __init early_clear_fixmap(enum fixed_addresses idx)
 static void __iomem *prev_map[FIX_BTMAPS_SLOTS] __initdata;
 static unsigned long prev_size[FIX_BTMAPS_SLOTS] __initdata;
 
+void __init fixup_early_ioremap(void)
+{
+        int i;
+
+        for (i = 0; i < FIX_BTMAPS_SLOTS; i++) {
+                if (prev_map[i]) {
+                        WARN_ON(1);
+                        break;
+                }
+        }
+
+        early_ioremap_init();
+}
+
 static int __init check_early_ioremap_leak(void)
 {
         int count = 0;
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index 1a8faf09afe..792854003ed 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -18,6 +18,7 @@
 #include <asm/e820.h>
 #include <asm/tlb.h>
 #include <asm/tlbflush.h>
+#include <asm/io.h>
 
 unsigned int __VMALLOC_RESERVE = 128 << 20;
 
@@ -128,6 +129,7 @@ static int __init parse_reservetop(char *arg)
 
         address = memparse(arg, &arg);
         reserve_top_address(address);
+        fixup_early_ioremap();
         return 0;
 }
 early_param("reservetop", parse_reservetop);
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index 28c68762648..38512d0c474 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -461,7 +461,8 @@ void __init acpi_fake_nodes(const struct bootnode *fake_nodes, int num_nodes)
                  * node, it must now point to the fake node ID.
                  */
                 for (j = 0; j < MAX_LOCAL_APIC; j++)
-                        if (apicid_to_node[j] == nid)
+                        if (apicid_to_node[j] == nid &&
+                            fake_apicid_to_node[j] == NUMA_NO_NODE)
                                 fake_apicid_to_node[j] = i;
         }
         for (i = 0; i < num_nodes; i++)
diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
index 8bf2fcb88d0..1cdc02cf8fa 100644
--- a/arch/x86/pci/mrst.c
+++ b/arch/x86/pci/mrst.c
@@ -247,6 +247,10 @@ static void __devinit pci_fixed_bar_fixup(struct pci_dev *dev)
         u32 size;
         int i;
 
+        /* Must have extended configuration space */
+        if (dev->cfg_size < PCIE_CAP_OFFSET + 4)
+                return;
+
         /* Fixup the BAR sizes for fixed BAR devices and make them unmoveable */
         offset = fixed_bar_cap(dev->bus, dev->devfn);
         if (!offset || PCI_DEVFN(2, 0) == dev->devfn ||
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 5fe03def34b..2cc682b860e 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -286,16 +286,16 @@ done:
 static struct cgroup_subsys_state *
 blkiocg_create(struct cgroup_subsys *subsys, struct cgroup *cgroup)
 {
-        struct blkio_cgroup *blkcg, *parent_blkcg;
+        struct blkio_cgroup *blkcg;
+        struct cgroup *parent = cgroup->parent;
 
-        if (!cgroup->parent) {
+        if (!parent) {
                 blkcg = &blkio_root_cgroup;
                 goto done;
         }
 
         /* Currently we do not support hierarchy deeper than two level (0,1) */
-        parent_blkcg = cgroup_to_blkio_cgroup(cgroup->parent);
-        if (css_depth(&parent_blkcg->css) > 0)
+        if (parent != cgroup->top_cgroup)
                 return ERR_PTR(-EINVAL);
 
         blkcg = kzalloc(sizeof(*blkcg), GFP_KERNEL);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 838834be115..5f127cfb2e9 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -3694,8 +3694,10 @@ static void *cfq_init_queue(struct request_queue *q)
          * to make sure that cfq_put_cfqg() does not try to kfree root group
          */
         atomic_set(&cfqg->ref, 1);
+        rcu_read_lock();
         blkiocg_add_blkio_group(&blkio_root_cgroup, &cfqg->blkg, (void *)cfqd,
                                         0);
+        rcu_read_unlock();
 #endif
         /*
          * Not strictly needed (since RB_ROOT just clears the node and we
diff --git a/crypto/async_tx/async_raid6_recov.c b/crypto/async_tx/async_raid6_recov.c
index 943f2abac9b..ce038d861eb 100644
--- a/crypto/async_tx/async_raid6_recov.c
+++ b/crypto/async_tx/async_raid6_recov.c
@@ -324,6 +324,7 @@ struct dma_async_tx_descriptor *
 async_raid6_2data_recov(int disks, size_t bytes, int faila, int failb,
                         struct page **blocks, struct async_submit_ctl *submit)
 {
+        void *scribble = submit->scribble;
         int non_zero_srcs, i;
 
         BUG_ON(faila == failb);
@@ -332,11 +333,13 @@ async_raid6_2data_recov(int disks, size_t bytes, int faila, int failb,
 
         pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes);
 
-        /* we need to preserve the contents of 'blocks' for the async
-         * case, so punt to synchronous if a scribble buffer is not available
+        /* if a dma resource is not available or a scribble buffer is not
+         * available punt to the synchronous path.  In the 'dma not
+         * available' case be sure to use the scribble buffer to
+         * preserve the content of 'blocks' as the caller intended.
          */
-        if (!submit->scribble) {
-                void **ptrs = (void **) blocks;
+        if (!async_dma_find_channel(DMA_PQ) || !scribble) {
+                void **ptrs = scribble ? scribble : (void **) blocks;
 
                 async_tx_quiesce(&submit->depend_tx);
                 for (i = 0; i < disks; i++)
@@ -406,11 +409,13 @@ async_raid6_datap_recov(int disks, size_t bytes, int faila,
 
         pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes);
 
-        /* we need to preserve the contents of 'blocks' for the async
-         * case, so punt to synchronous if a scribble buffer is not available
+        /* if a dma resource is not available or a scribble buffer is not
+         * available punt to the synchronous path.  In the 'dma not
+         * available' case be sure to use the scribble buffer to
+         * preserve the content of 'blocks' as the caller intended.
          */
-        if (!scribble) {
-                void **ptrs = (void **) blocks;
+        if (!async_dma_find_channel(DMA_PQ) || !scribble) {
+                void **ptrs = scribble ? scribble : (void **) blocks;
 
                 async_tx_quiesce(&submit->depend_tx);
                 for (i = 0; i < disks; i++)
diff --git a/drivers/Makefile b/drivers/Makefile
index 34f1e1064db..f42a03029b7 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -17,6 +17,7 @@ obj-$(CONFIG_SFI)		+= sfi/
 obj-$(CONFIG_PNP)               += pnp/
 obj-$(CONFIG_ARM_AMBA)          += amba/
 
+obj-$(CONFIG_VIRTIO)            += virtio/
 obj-$(CONFIG_XEN)               += xen/
 
 # regulators early, since some subsystems rely on them to initialize
@@ -108,7 +109,6 @@ obj-$(CONFIG_PPC_PS3)		+= ps3/
 obj-$(CONFIG_OF)                += of/
 obj-$(CONFIG_SSB)               += ssb/
 obj-$(CONFIG_VHOST_NET)         += vhost/
-obj-$(CONFIG_VIRTIO)            += virtio/
 obj-$(CONFIG_VLYNQ)             += vlynq/
 obj-$(CONFIG_STAGING)           += staging/
 obj-y                           += platform/
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index 19dacfd4316..62122134693 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -31,7 +31,7 @@
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
-#define ACPI_PROCESSOR_AGGREGATOR_CLASS "processor_aggregator"
+#define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
 static DEFINE_MUTEX(isolated_cpus_lock);
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 37132dc2da0..743576bf1bd 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -527,7 +527,7 @@ int acpi_bus_generate_proc_event4(const char *device_class, const char *bus_id,
         if (!event_is_open)
                 return 0;
 
-        event = kmalloc(sizeof(struct acpi_bus_event), GFP_ATOMIC);
+        event = kzalloc(sizeof(struct acpi_bus_event), GFP_ATOMIC);
         if (!event)
                 return -ENOMEM;
 
diff --git a/drivers/acpi/hest.c b/drivers/acpi/hest.c
index 4bb18c980ac..1c527a19287 100644
--- a/drivers/acpi/hest.c
+++ b/drivers/acpi/hest.c
@@ -123,6 +123,10 @@ int acpi_hest_firmware_first_pci(struct pci_dev *pci)
 {
         acpi_status status = AE_NOT_FOUND;
         struct acpi_table_header *hest = NULL;
+
+        if (acpi_disabled)
+                return 0;
+
         status = acpi_get_table(ACPI_SIG_HEST, 1, &hest);
 
         if (ACPI_SUCCESS(status)) {
diff --git a/drivers/acpi/power_meter.c b/drivers/acpi/power_meter.c
index e8c32a49f14..66f67293341 100644
--- a/drivers/acpi/power_meter.c
+++ b/drivers/acpi/power_meter.c
@@ -35,7 +35,7 @@
 #define ACPI_POWER_METER_NAME           "power_meter"
 ACPI_MODULE_NAME(ACPI_POWER_METER_NAME);
 #define ACPI_POWER_METER_DEVICE_NAME    "Power Meter"
-#define ACPI_POWER_METER_CLASS          "power_meter_resource"
+#define ACPI_POWER_METER_CLASS          "pwr_meter_resource"
 
 #define NUM_SENSORS                     17
 
diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
index 36704b887cc..f8be23b6c12 100644
--- a/drivers/acpi/sbshc.c
+++ b/drivers/acpi/sbshc.c
@@ -18,7 +18,7 @@
 
 #define PREFIX "ACPI: "
 
-#define ACPI_SMB_HC_CLASS       "smbus_host_controller"
+#define ACPI_SMB_HC_CLASS       "smbus_host_ctl"
 #define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
 
 struct acpi_smb_hc {
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index f74834a544f..baa76bbf244 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -450,6 +450,38 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
                 },
         },
         {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Lenovo ThinkPad T410",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Lenovo ThinkPad T510",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Lenovo ThinkPad W510",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Lenovo ThinkPad X201[s]",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+                },
+        },
+        {
         .callback = init_old_suspend_ordering,
         .ident = "Panasonic CF51-2L",
         .matches = {
@@ -458,6 +490,30 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
                 DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
                 },
         },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Dell Studio 1558",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1558"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Dell Studio 1557",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1557"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Dell Studio 1555",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1555"),
+                },
+        },
         {},
 };
 #endif /* CONFIG_SUSPEND */
diff --git a/drivers/ata/pata_pcmcia.c b/drivers/ata/pata_pcmcia.c
index 4164dd244dd..d94b8f0bd74 100644
--- a/drivers/ata/pata_pcmcia.c
+++ b/drivers/ata/pata_pcmcia.c
@@ -424,7 +424,7 @@ static struct pcmcia_device_id pcmcia_devices[] = {
         PCMCIA_DEVICE_PROD_ID12("Hyperstone", "Model1", 0x3d5b9ef5, 0xca6ab420),
         PCMCIA_DEVICE_PROD_ID12("IBM", "microdrive", 0xb569a6e5, 0xa6d76178),
         PCMCIA_DEVICE_PROD_ID12("IBM", "IBM17JSSFP20", 0xb569a6e5, 0xf2508753),
-        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 1GB", 0x2e6d1829, 0x3e520e17),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 1GB", 0x2e6d1829, 0x55d5bffb),
         PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 4GB", 0x2e6d1829, 0x531e7d10),
         PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF8GB", 0x2e6d1829, 0xacbe682e),
         PCMCIA_DEVICE_PROD_ID12("IO DATA", "CBIDE2      ", 0x547e66dc, 0x8671043b),
@@ -446,7 +446,7 @@ static struct pcmcia_device_id pcmcia_devices[] = {
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS1GCF80", 0x709b1bf1, 0x2a54d4b1),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS2GCF120", 0x709b1bf1, 0x969aa4f2),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF120", 0x709b1bf1, 0xf54a91c8),
-        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF133", 0x709b1bf1, 0x9351e59d),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF133", 0x709b1bf1, 0x7558f133),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS8GCF133", 0x709b1bf1, 0xb2f89b47),
         PCMCIA_DEVICE_PROD_ID12("WIT", "IDE16", 0x244e5994, 0x3e232852),
         PCMCIA_DEVICE_PROD_ID12("WEIDA", "TWTTI", 0xcc7cf69c, 0x212bb918),
diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c
index 44bf6d11197..d48a1dfd7b2 100644
--- a/drivers/block/drbd/drbd_worker.c
+++ b/drivers/block/drbd/drbd_worker.c
@@ -235,7 +235,7 @@ void drbd_endio_pri(struct bio *bio, int error)
         if (unlikely(error)) {
                 what = (bio_data_dir(bio) == WRITE)
                         ? write_completed_with_error
-                        : (bio_rw(bio) == READA)
+                        : (bio_rw(bio) == READ)
                           ? read_completed_with_error
                           : read_ahead_completed_with_error;
         } else
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 0fa2e4a0835..c1ab303455c 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -879,8 +879,8 @@ static int isicom_open(struct tty_struct *tty, struct file *filp)
         if (tport == NULL)
                 return -ENODEV;
         port = container_of(tport, struct isi_port, port);
-        card = &isi_card[BOARD(tty->index)];
 
+        tty->driver_data = port;
         return tty_port_open(tport, tty, filp);
 }
 
@@ -936,7 +936,12 @@ static void isicom_shutdown(struct tty_port *port)
 static void isicom_close(struct tty_struct *tty, struct file *filp)
 {
         struct isi_port *ip = tty->driver_data;
-        struct tty_port *port = &ip->port;
+        struct tty_port *port;
+
+        if (ip == NULL)
+                return;
+
+        port = &ip->port;
         if (isicom_paranoia_check(ip, tty->name, "isicom_close"))
                 return;
         tty_port_close(port, tty, filp);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 4cd6c527ee4..4e395c956a0 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -827,6 +827,8 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
                 return -ENODEV;
         if (portp->devnr < 1)
                 return -ENODEV;
+
+        tty->driver_data = portp;
         return tty_port_open(&portp->port, tty, filp);
 }
 
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 47023053ee8..d2692d443f7 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1011,6 +1011,7 @@ static int mxser_open(struct tty_struct *tty, struct file *filp)
         if (!info->ioaddr)
                 return -ENODEV;
 
+        tty->driver_data = info;
         return tty_port_open(&info->port, tty, filp);
 }
 
@@ -1074,7 +1075,7 @@ static void mxser_close(struct tty_struct *tty, struct file *filp)
         struct mxser_port *info = tty->driver_data;
         struct tty_port *port = &info->port;
 
-        if (tty->index == MXSER_PORTS)
+        if (tty->index == MXSER_PORTS || info == NULL)
                 return;
         if (tty_port_close_start(port, tty, filp) == 0)
                 return;
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 0a8d1e56c99..b02332a5412 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -909,6 +909,7 @@ static int rc_open(struct tty_struct *tty, struct file *filp)
         if (error)
                 return error;
 
+        tty->driver_data = port;
         return tty_port_open(&port->port, tty, filp);
 }
 
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 0e511d61f54..6049fd73192 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -724,7 +724,6 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
 {
         struct stlport  *portp;
         struct stlbrd   *brdp;
-        struct tty_port *port;
         unsigned int    minordev, brdnr, panelnr;
         int             portnr;
 
@@ -754,7 +753,8 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
         portp = brdp->panels[panelnr]->ports[portnr];
         if (portp == NULL)
                 return -ENODEV;
-        port = &portp->port;
+
+        tty->driver_data = portp;
         return tty_port_open(&portp->port, tty, filp);
 
 }
@@ -841,7 +841,8 @@ static void stl_close(struct tty_struct *tty, struct file *filp)
         pr_debug("stl_close(tty=%p,filp=%p)\n", tty, filp);
 
         portp = tty->driver_data;
-        BUG_ON(portp == NULL);
+        if(portp == NULL)
+                return;
         tty_port_close(&portp->port, tty, filp);
 }
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 6da962c9b21..d71f0fc34b4 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1875,6 +1875,7 @@ got_driver:
                  */
                 if (filp->f_op == &hung_up_tty_fops)
                         filp->f_op = &tty_fops;
+                unlock_kernel();
                 goto retry_open;
         }
         unlock_kernel();
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 1aea7157d8f..f8e57c6303f 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -100,7 +100,6 @@ struct menu_device {
         int             needs_update;
 
         unsigned int    expected_us;
-        unsigned int    measured_us;
         u64             predicted_us;
         unsigned int    exit_us;
         unsigned int    bucket;
@@ -187,14 +186,14 @@ static int menu_select(struct cpuidle_device *dev)
         int i;
         int multiplier;
 
-        data->last_state_idx = 0;
-        data->exit_us = 0;
-
         if (data->needs_update) {
                 menu_update(dev);
                 data->needs_update = 0;
         }
 
+        data->last_state_idx = 0;
+        data->exit_us = 0;
+
         /* Special case when user has set very strict latency requirement */
         if (unlikely(latency_req == 0))
                 return 0;
@@ -294,7 +293,7 @@ static void menu_update(struct cpuidle_device *dev)
         new_factor = data->correction_factor[data->bucket]
                         * (DECAY - 1) / DECAY;
 
-        if (data->expected_us > 0 && data->measured_us < MAX_INTERESTING)
+        if (data->expected_us > 0 && measured_us < MAX_INTERESTING)
                 new_factor += RESOLUTION * measured_us / data->expected_us;
         else
                 /*
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index 7cc31b3f40d..6f25a20de99 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -290,6 +290,7 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
         struct sh_dmae_chan *sh_chan = to_sh_chan(chan);
         struct sh_desc *desc;
         struct sh_dmae_slave *param = chan->private;
+        int ret;
 
         pm_runtime_get_sync(sh_chan->dev);
 
@@ -301,11 +302,15 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
                 struct sh_dmae_slave_config *cfg;
 
                 cfg = sh_dmae_find_slave(sh_chan, param->slave_id);
-                if (!cfg)
-                        return -EINVAL;
+                if (!cfg) {
+                        ret = -EINVAL;
+                        goto efindslave;
+                }
 
-                if (test_and_set_bit(param->slave_id, sh_dmae_slave_used))
-                        return -EBUSY;
+                if (test_and_set_bit(param->slave_id, sh_dmae_slave_used)) {
+                        ret = -EBUSY;
+                        goto etestused;
+                }
 
                 param->config = cfg;
 
@@ -334,10 +339,20 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
         }
         spin_unlock_bh(&sh_chan->desc_lock);
 
-        if (!sh_chan->descs_allocated)
-                pm_runtime_put(sh_chan->dev);
+        if (!sh_chan->descs_allocated) {
+                ret = -ENOMEM;
+                goto edescalloc;
+        }
 
         return sh_chan->descs_allocated;
+
+edescalloc:
+        if (param)
+                clear_bit(param->slave_id, sh_dmae_slave_used);
+etestused:
+efindslave:
+        pm_runtime_put(sh_chan->dev);
+        return ret;
 }
 
 /*
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index 3ebc61067e5..75fcf1ac8bb 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -1359,3 +1359,5 @@ module_exit(txx9dmac_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("TXx9 DMA Controller driver");
 MODULE_AUTHOR("Atsushi Nemoto <anemo@mba.ocn.ne.jp>");
+MODULE_ALIAS("platform:txx9dmac");
+MODULE_ALIAS("platform:txx9dmac-chan");
diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
index f5b6d9fe4de..97e64bcdbc0 100644
--- a/drivers/edac/edac_mce_amd.c
+++ b/drivers/edac/edac_mce_amd.c
@@ -294,7 +294,6 @@ wrong_ls_mce:
 void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
 {
         u32 ec  = ERROR_CODE(regs->nbsl);
-        u32 xec = EXT_ERROR_CODE(regs->nbsl);
 
         if (!handle_errors)
                 return;
@@ -324,7 +323,7 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
                 pr_cont("\n");
         }
 
-        pr_emerg("%s.\n", EXT_ERR_MSG(xec));
+        pr_emerg("%s.\n", EXT_ERR_MSG(regs->nbsl));
 
         if (BUS_ERROR(ec) && nb_bus_decoder)
                 nb_bus_decoder(node_id, regs);
@@ -374,7 +373,7 @@ static int amd_decode_mce(struct notifier_block *nb, unsigned long val,
                  ((m->status & MCI_STATUS_PCC) ? "yes" : "no"));
 
         /* do the two bits[14:13] together */
-        ecc = m->status & (3ULL << 45);
+        ecc = (m->status >> 45) & 0x3;
         if (ecc)
                 pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U"));
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 76be229c814..eb0c3fe44b2 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -416,7 +416,8 @@ static int gpio_setup_irq(struct gpio_desc *desc, struct device *dev,
         return 0;
 
 free_sd:
-        sysfs_put(pdesc->value_sd);
+        if (pdesc)
+                sysfs_put(pdesc->value_sd);
 free_id:
         idr_remove(&pdesc_idr, id);
         desc->flags &= GPIO_FLAGS_MASK;
diff --git a/drivers/gpio/it8761e_gpio.c b/drivers/gpio/it8761e_gpio.c
index 753219cf993..41a9388f2fd 100644
--- a/drivers/gpio/it8761e_gpio.c
+++ b/drivers/gpio/it8761e_gpio.c
@@ -80,8 +80,8 @@ static int it8761e_gpio_get(struct gpio_chip *gc, unsigned gpio_num)
         u16 reg;
         u8 bit;
 
-        bit = gpio_num % 7;
-        reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+        bit = gpio_num % 8;
+        reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
 
         return !!(inb(reg) & (1 << bit));
 }
@@ -91,8 +91,8 @@ static int it8761e_gpio_direction_in(struct gpio_chip *gc, unsigned gpio_num)
         u8 curr_dirs;
         u8 io_reg, bit;
 
-        bit = gpio_num % 7;
-        io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+        bit = gpio_num % 8;
+        io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
 
         spin_lock(&sio_lock);
 
@@ -116,8 +116,8 @@ static void it8761e_gpio_set(struct gpio_chip *gc,
         u8 curr_vals, bit;
         u16 reg;
 
-        bit = gpio_num % 7;
-        reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+        bit = gpio_num % 8;
+        reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
 
         spin_lock(&sio_lock);
 
@@ -135,8 +135,8 @@ static int it8761e_gpio_direction_out(struct gpio_chip *gc,
 {
         u8 curr_dirs, io_reg, bit;
 
-        bit = gpio_num % 7;
-        io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+        bit = gpio_num % 8;
+        io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
 
         it8761e_gpio_set(gc, gpio_num, val);
 
@@ -200,7 +200,7 @@ static int __init it8761e_gpio_init(void)
                 return -EBUSY;
 
         it8761e_gpio_chip.base = -1;
-        it8761e_gpio_chip.ngpio = 14;
+        it8761e_gpio_chip.ngpio = 16;
 
         err = gpiochip_add(&it8761e_gpio_chip);
         if (err < 0)
diff --git a/drivers/gpu/drm/drm_memory.c b/drivers/gpu/drm/drm_memory.c
index e4865f99989..7732268eced 100644
--- a/drivers/gpu/drm/drm_memory.c
+++ b/drivers/gpu/drm/drm_memory.c
@@ -77,7 +77,7 @@ static void *agp_remap(unsigned long offset, unsigned long size,
                     && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
                     (offset + size))
                         break;
-        if (!agpmem)
+        if (&agpmem->head == &dev->agp->memory)
                 return NULL;
 
         /*
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 1a1825b29f5..25bbd30ed7a 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -354,7 +354,10 @@ static struct bin_attribute edid_attr = {
 int drm_sysfs_connector_add(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        int ret = 0, i, j;
+        int attr_cnt = 0;
+        int opt_cnt = 0;
+        int i;
+        int ret = 0;
 
         /* We shouldn't get called more than once for the same connector */
         BUG_ON(device_is_registered(&connector->kdev));
@@ -377,8 +380,8 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
 
         /* Standard attributes */
 
-        for (i = 0; i < ARRAY_SIZE(connector_attrs); i++) {
-                ret = device_create_file(&connector->kdev, &connector_attrs[i]);
+        for (attr_cnt = 0; attr_cnt < ARRAY_SIZE(connector_attrs); attr_cnt++) {
+                ret = device_create_file(&connector->kdev, &connector_attrs[attr_cnt]);
                 if (ret)
                         goto err_out_files;
         }
@@ -394,8 +397,8 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
                 case DRM_MODE_CONNECTOR_SVIDEO:
                 case DRM_MODE_CONNECTOR_Component:
                 case DRM_MODE_CONNECTOR_TV:
-                        for (i = 0; i < ARRAY_SIZE(connector_attrs_opt1); i++) {
-                                ret = device_create_file(&connector->kdev, &connector_attrs_opt1[i]);
+                        for (opt_cnt = 0; opt_cnt < ARRAY_SIZE(connector_attrs_opt1); opt_cnt++) {
+                                ret = device_create_file(&connector->kdev, &connector_attrs_opt1[opt_cnt]);
                                 if (ret)
                                         goto err_out_files;
                         }
@@ -414,10 +417,10 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
         return 0;
 
 err_out_files:
-        if (i > 0)
-                for (j = 0; j < i; j++)
-                        device_remove_file(&connector->kdev,
-                                           &connector_attrs[i]);
+        for (i = 0; i < opt_cnt; i++)
+                device_remove_file(&connector->kdev, &connector_attrs_opt1[i]);
+        for (i = 0; i < attr_cnt; i++)
+                device_remove_file(&connector->kdev, &connector_attrs[i]);
         device_unregister(&connector->kdev);
 
 out:
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2b8b969d0c1..df6a9cd82c4 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -456,11 +456,15 @@ i915_error_object_create(struct drm_device *dev,
 
         for (page = 0; page < page_count; page++) {
                 void *s, *d = kmalloc(PAGE_SIZE, GFP_ATOMIC);
+                unsigned long flags;
+
                 if (d == NULL)
                         goto unwind;
-                s = kmap_atomic(src_priv->pages[page], KM_USER0);
+                local_irq_save(flags);
+                s = kmap_atomic(src_priv->pages[page], KM_IRQ0);
                 memcpy(d, s, PAGE_SIZE);
-                kunmap_atomic(s, KM_USER0);
+                kunmap_atomic(s, KM_IRQ0);
+                local_irq_restore(flags);
                 dst->pages[page] = d;
         }
         dst->page_count = page_count;
diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
index 6732b5dd8ff..27e2c715be1 100644
--- a/drivers/gpu/drm/radeon/atombios.h
+++ b/drivers/gpu/drm/radeon/atombios.h
@@ -2912,7 +2912,7 @@ typedef struct _ATOM_ANALOG_TV_INFO_V1_2
   UCHAR                    ucTV_BootUpDefaultStandard; 
   UCHAR                    ucExt_TV_ASIC_ID;
   UCHAR                    ucExt_TV_ASIC_SlaveAddr;
-  ATOM_DTD_FORMAT          aModeTimings[MAX_SUPPORTED_TV_TIMING];
+  ATOM_DTD_FORMAT          aModeTimings[MAX_SUPPORTED_TV_TIMING_V1_2];
 }ATOM_ANALOG_TV_INFO_V1_2;
 
 typedef struct _ATOM_DPCD_INFO
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index d7388fdb6d0..cf60c0b3ef1 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2975,7 +2975,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
 
         for (i = 0; i < track->num_cb; i++) {
                 if (track->cb[i].robj == NULL) {
-                        if (!(track->fastfill || track->color_channel_mask ||
+                        if (!(track->zb_cb_clear || track->color_channel_mask ||
                               track->blend_read_enable)) {
                                 continue;
                         }
diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h
index fadfe68de9c..f47cdca1c00 100644
--- a/drivers/gpu/drm/radeon/r100_track.h
+++ b/drivers/gpu/drm/radeon/r100_track.h
@@ -75,7 +75,7 @@ struct r100_cs_track {
         struct r100_cs_track_texture    textures[R300_TRACK_MAX_TEXTURE];
         bool                            z_enabled;
         bool                            separate_cube;
-        bool                            fastfill;
+        bool                            zb_cb_clear;
         bool                            blend_read_enable;
 };
 
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index eaf1f6bc44f..a5ff8076b42 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -1044,7 +1044,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 break;
         case 0x4d1c:
                 /* ZB_BW_CNTL */
-                track->fastfill = !!(idx_value & (1 << 2));
+                track->zb_cb_clear = !!(idx_value & (1 << 5));
                 break;
         case 0x4e04:
                 /* RB3D_BLENDCNTL */
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index c4457791dff..28e473f1f56 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -134,12 +134,10 @@ int radeon_agp_init(struct radeon_device *rdev)
         int ret;
 
         /* Acquire AGP. */
-        if (!rdev->ddev->agp->acquired) {
-                ret = drm_agp_acquire(rdev->ddev);
-                if (ret) {
-                        DRM_ERROR("Unable to acquire AGP: %d\n", ret);
-                        return ret;
-                }
+        ret = drm_agp_acquire(rdev->ddev);
+        if (ret) {
+                DRM_ERROR("Unable to acquire AGP: %d\n", ret);
+                return ret;
         }
 
         ret = drm_agp_info(rdev->ddev, &info);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 5673665ff21..9916d825401 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1264,7 +1264,7 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index,
         switch (crev) {
         case 1:
                 tv_info = (ATOM_ANALOG_TV_INFO *)(mode_info->atom_context->bios + data_offset);
-                if (index > MAX_SUPPORTED_TV_TIMING)
+                if (index >= MAX_SUPPORTED_TV_TIMING)
                         return false;
 
                 mode->crtc_htotal = le16_to_cpu(tv_info->aModeTimings[index].usCRTC_H_Total);
@@ -1302,7 +1302,7 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index,
                 break;
         case 2:
                 tv_info_v1_2 = (ATOM_ANALOG_TV_INFO_V1_2 *)(mode_info->atom_context->bios + data_offset);
-                if (index > MAX_SUPPORTED_TV_TIMING_V1_2)
+                if (index >= MAX_SUPPORTED_TV_TIMING_V1_2)
                         return false;
 
                 dtd_timings = &tv_info_v1_2->aModeTimings[index];
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 1331351c517..4559a53d5e5 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1316,6 +1316,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                         radeon_connector->ddc_bus = radeon_i2c_create(dev, i2c_bus, "DVI");
                         if (!radeon_connector->ddc_bus)
                                 goto failed;
+                }
+                if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                         radeon_connector->dac_load_detect = true;
                         drm_connector_attach_property(&radeon_connector->base,
                                                       rdev->mode_info.load_detect_property,
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 4b05563d99e..b3749d47be7 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -216,6 +216,7 @@ static struct drm_driver driver_old = {
                  .mmap = drm_mmap,
                  .poll = drm_poll,
                  .fasync = drm_fasync,
+                 .read = drm_read,
 #ifdef CONFIG_COMPAT
                  .compat_ioctl = radeon_compat_ioctl,
 #endif
@@ -304,6 +305,7 @@ static struct drm_driver kms_driver = {
                  .mmap = radeon_mmap,
                  .poll = drm_poll,
                  .fasync = drm_fasync,
+                 .read = drm_read,
 #ifdef CONFIG_COMPAT
                  .compat_ioctl = radeon_kms_compat_ioctl,
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index fed7b808477..c5ddaf58563 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -254,6 +254,53 @@ radeon_get_atom_connector_priv_from_encoder(struct drm_encoder *encoder)
         return dig_connector;
 }
 
+void radeon_panel_mode_fixup(struct drm_encoder *encoder,
+                             struct drm_display_mode *adjusted_mode)
+{
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_device *dev = encoder->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+        unsigned hblank = native_mode->htotal - native_mode->hdisplay;
+        unsigned vblank = native_mode->vtotal - native_mode->vdisplay;
+        unsigned hover = native_mode->hsync_start - native_mode->hdisplay;
+        unsigned vover = native_mode->vsync_start - native_mode->vdisplay;
+        unsigned hsync_width = native_mode->hsync_end - native_mode->hsync_start;
+        unsigned vsync_width = native_mode->vsync_end - native_mode->vsync_start;
+
+        adjusted_mode->clock = native_mode->clock;
+        adjusted_mode->flags = native_mode->flags;
+
+        if (ASIC_IS_AVIVO(rdev)) {
+                adjusted_mode->hdisplay = native_mode->hdisplay;
+                adjusted_mode->vdisplay = native_mode->vdisplay;
+        }
+
+        adjusted_mode->htotal = native_mode->hdisplay + hblank;
+        adjusted_mode->hsync_start = native_mode->hdisplay + hover;
+        adjusted_mode->hsync_end = adjusted_mode->hsync_start + hsync_width;
+
+        adjusted_mode->vtotal = native_mode->vdisplay + vblank;
+        adjusted_mode->vsync_start = native_mode->vdisplay + vover;
+        adjusted_mode->vsync_end = adjusted_mode->vsync_start + vsync_width;
+
+        drm_mode_set_crtcinfo(adjusted_mode, CRTC_INTERLACE_HALVE_V);
+
+        if (ASIC_IS_AVIVO(rdev)) {
+                adjusted_mode->crtc_hdisplay = native_mode->hdisplay;
+                adjusted_mode->crtc_vdisplay = native_mode->vdisplay;
+        }
+
+        adjusted_mode->crtc_htotal = adjusted_mode->crtc_hdisplay + hblank;
+        adjusted_mode->crtc_hsync_start = adjusted_mode->crtc_hdisplay + hover;
+        adjusted_mode->crtc_hsync_end = adjusted_mode->crtc_hsync_start + hsync_width;
+
+        adjusted_mode->crtc_vtotal = adjusted_mode->crtc_vdisplay + vblank;
+        adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + vover;
+        adjusted_mode->crtc_vsync_end = adjusted_mode->crtc_vsync_start + vsync_width;
+
+}
+
 static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
                                    struct drm_display_mode *mode,
                                    struct drm_display_mode *adjusted_mode)
@@ -275,18 +322,8 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
                 adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2;
 
         /* get the native mode for LVDS */
-        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
-                struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
-                int mode_id = adjusted_mode->base.id;
-                *adjusted_mode = *native_mode;
-                if (!ASIC_IS_AVIVO(rdev)) {
-                        adjusted_mode->hdisplay = mode->hdisplay;
-                        adjusted_mode->vdisplay = mode->vdisplay;
-                        adjusted_mode->crtc_hdisplay = mode->hdisplay;
-                        adjusted_mode->crtc_vdisplay = mode->vdisplay;
-                }
-                adjusted_mode->base.id = mode_id;
-        }
+        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT))
+                radeon_panel_mode_fixup(encoder, adjusted_mode);
 
         /* get the native mode for TV */
         if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT)) {
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 2441cca7d77..0274abe17ad 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -228,16 +228,8 @@ static bool radeon_legacy_mode_fixup(struct drm_encoder *encoder,
         drm_mode_set_crtcinfo(adjusted_mode, 0);
 
         /* get the native mode for LVDS */
-        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
-                struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
-                int mode_id = adjusted_mode->base.id;
-                *adjusted_mode = *native_mode;
-                adjusted_mode->hdisplay = mode->hdisplay;
-                adjusted_mode->vdisplay = mode->vdisplay;
-                adjusted_mode->crtc_hdisplay = mode->hdisplay;
-                adjusted_mode->crtc_vdisplay = mode->vdisplay;
-                adjusted_mode->base.id = mode_id;
-        }
+        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT))
+                radeon_panel_mode_fixup(encoder, adjusted_mode);
 
         return true;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 0b8e32776b1..5413fcd6308 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -558,6 +558,8 @@ extern int radeon_static_clocks_init(struct drm_device *dev);
 bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
                                         struct drm_display_mode *mode,
                                         struct drm_display_mode *adjusted_mode);
+void radeon_panel_mode_fixup(struct drm_encoder *encoder,
+                             struct drm_display_mode *adjusted_mode);
 void atom_rv515_force_tv_scaler(struct radeon_device *rdev, struct radeon_crtc *radeon_crtc);
 
 /* legacy tv */
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 40ab6d9c373..cc5316dcf58 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -424,7 +424,7 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                 if ((*cmd & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
                     (*cmd & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
                         u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
-                        offset = *cmd << 10;
+                        offset = *cmd3 << 10;
                         if (radeon_check_and_fixup_offset
                             (dev_priv, file_priv, &offset)) {
                                 DRM_ERROR("Invalid second packet offset\n");
@@ -2895,9 +2895,12 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                         return rv;
                 rv = drm_buffer_copy_from_user(cmdbuf->buffer, buffer,
                                                 cmdbuf->bufsz);
-                if (rv)
+                if (rv) {
+                        drm_buffer_free(cmdbuf->buffer);
                         return rv;
-        }
+                }
+        } else
+                goto done;
 
         orig_nbox = cmdbuf->nbox;
 
@@ -2905,8 +2908,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                 int temp;
                 temp = r300_do_cp_cmdbuf(dev, file_priv, cmdbuf);
 
-                if (cmdbuf->bufsz != 0)
-                        drm_buffer_free(cmdbuf->buffer);
+                drm_buffer_free(cmdbuf->buffer);
 
                 return temp;
         }
@@ -3012,16 +3014,15 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                 }
         }
 
-        if (cmdbuf->bufsz != 0)
-                drm_buffer_free(cmdbuf->buffer);
+        drm_buffer_free(cmdbuf->buffer);
 
+      done:
         DRM_DEBUG("DONE\n");
         COMMIT_RING();
         return 0;
 
       err:
-        if (cmdbuf->bufsz != 0)
-                drm_buffer_free(cmdbuf->buffer);
+        drm_buffer_free(cmdbuf->buffer);
         return -EINVAL;
 }
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index dd47b2a9a79..0e3754a3a30 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1716,40 +1716,12 @@ int ttm_bo_wait(struct ttm_buffer_object *bo,
 }
 EXPORT_SYMBOL(ttm_bo_wait);
 
-void ttm_bo_unblock_reservation(struct ttm_buffer_object *bo)
-{
-        atomic_set(&bo->reserved, 0);
-        wake_up_all(&bo->event_queue);
-}
-
-int ttm_bo_block_reservation(struct ttm_buffer_object *bo, bool interruptible,
-                             bool no_wait)
-{
-        int ret;
-
-        while (unlikely(atomic_cmpxchg(&bo->reserved, 0, 1) != 0)) {
-                if (no_wait)
-                        return -EBUSY;
-                else if (interruptible) {
-                        ret = wait_event_interruptible
-                            (bo->event_queue, atomic_read(&bo->reserved) == 0);
-                        if (unlikely(ret != 0))
-                                return ret;
-                } else {
-                        wait_event(bo->event_queue,
-                                   atomic_read(&bo->reserved) == 0);
-                }
-        }
-        return 0;
-}
-
 int ttm_bo_synccpu_write_grab(struct ttm_buffer_object *bo, bool no_wait)
 {
         int ret = 0;
 
         /*
-         * Using ttm_bo_reserve instead of ttm_bo_block_reservation
-         * makes sure the lru lists are updated.
+         * Using ttm_bo_reserve makes sure the lru lists are updated.
          */
 
         ret = ttm_bo_reserve(bo, true, no_wait, false, 0);
diff --git a/drivers/gpu/drm/ttm/ttm_lock.c b/drivers/gpu/drm/ttm/ttm_lock.c
index 3d172ef04ee..de41e55a944 100644
--- a/drivers/gpu/drm/ttm/ttm_lock.c
+++ b/drivers/gpu/drm/ttm/ttm_lock.c
@@ -204,7 +204,6 @@ static int __ttm_vt_unlock(struct ttm_lock *lock)
         lock->flags &= ~TTM_VT_LOCK;
         wake_up_all(&lock->queue);
         spin_unlock(&lock->lock);
-        printk(KERN_INFO TTM_PFX "vt unlock.\n");
 
         return ret;
 }
@@ -265,10 +264,8 @@ int ttm_vt_lock(struct ttm_lock *lock,
                                    ttm_lock_type, &ttm_vt_lock_remove, NULL);
         if (ret)
                 (void)__ttm_vt_unlock(lock);
-        else {
+        else
                 lock->vt_holder = tfile;
-                printk(KERN_INFO TTM_PFX "vt lock.\n");
-        }
 
         return ret;
 }
diff --git a/drivers/gpu/drm/via/via_video.c b/drivers/gpu/drm/via/via_video.c
index 6ec04ac1245..6efac8117c9 100644
--- a/drivers/gpu/drm/via/via_video.c
+++ b/drivers/gpu/drm/via/via_video.c
@@ -75,7 +75,7 @@ int via_decoder_futex(struct drm_device *dev, void *data, struct drm_file *file_
 
         DRM_DEBUG("\n");
 
-        if (fx->lock > VIA_NR_XVMC_LOCKS)
+        if (fx->lock >= VIA_NR_XVMC_LOCKS)
                 return -EFAULT;
 
         lock = (volatile int *)XVMCLOCKPTR(sAPriv, fx->lock);
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index d6d1149d525..c8768f38511 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -276,8 +276,10 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf,
 
         mutex_lock(&vgasr_mutex);
 
-        if (!vgasr_priv.active)
-                return -EINVAL;
+        if (!vgasr_priv.active) {
+                cnt = -EINVAL;
+                goto out;
+        }
 
         /* pwr off the device not in use */
         if (strncmp(usercmd, "OFF", 3) == 0) {
diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
index 7e597d7f770..24663a8717b 100644
--- a/drivers/hid/hid-cherry.c
+++ b/drivers/hid/hid-cherry.c
@@ -59,6 +59,7 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 
 static const struct hid_device_id ch_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, ch_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 2e2aa759d23..143e788b729 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1043,13 +1043,8 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
 
         if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
                 hid->hiddev_report_event(hid, report);
-        if (hid->claimed & HID_CLAIMED_HIDRAW) {
-                /* numbered reports need to be passed with the report num */
-                if (report_enum->numbered)
-                        hidraw_report_event(hid, data - 1, size + 1);
-                else
-                        hidraw_report_event(hid, data, size);
-        }
+        if (hid->claimed & HID_CLAIMED_HIDRAW)
+                hidraw_report_event(hid, data, size);
 
         for (a = 0; a < report->maxfield; a++)
                 hid_input_field(hid, report->field[a], cdata, interrupt);
@@ -1296,6 +1291,7 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 797e0647035..09d27649a0f 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -131,6 +131,7 @@
 
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
+#define USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR     0x0027
 
 #define USB_VENDOR_ID_CHIC              0x05fe
 #define USB_DEVICE_ID_CHIC_GAMEPAD      0x0014
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index 9b24fc51071..4777bbfa1cc 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -1,8 +1,8 @@
 /*
  *  HID driver for N-Trig touchscreens
  *
- *  Copyright (c) 2008 Rafi Rubin
- *  Copyright (c) 2009 Stephane Chatty
+ *  Copyright (c) 2008-2010 Rafi Rubin
+ *  Copyright (c) 2009-2010 Stephane Chatty
  *
  */
 
@@ -15,6 +15,8 @@
 
 #include <linux/device.h>
 #include <linux/hid.h>
+#include <linux/usb.h>
+#include "usbhid/usbhid.h"
 #include <linux/module.h>
 #include <linux/slab.h>
 
@@ -22,17 +24,16 @@
 
 #define NTRIG_DUPLICATE_USAGES  0x001
 
-#define nt_map_key_clear(c)     hid_map_usage_clear(hi, usage, bit, max, \
-                                        EV_KEY, (c))
-
 struct ntrig_data {
         /* Incoming raw values for a single contact */
         __u16 x, y, w, h;
         __u16 id;
-        __u8 confidence;
+
+        bool tipswitch;
+        bool confidence;
+        bool first_contact_touch;
 
         bool reading_mt;
-        __u8 first_contact_confidence;
 
         __u8 mt_footer[4];
         __u8 mt_foot_count;
@@ -139,9 +140,10 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                 case 0xff000001:
                         /* Tag indicating the start of a multitouch group */
                         nd->reading_mt = 1;
-                        nd->first_contact_confidence = 0;
+                        nd->first_contact_touch = 0;
                         break;
                 case HID_DG_TIPSWITCH:
+                        nd->tipswitch = value;
                         /* Prevent emission of touch until validated */
                         return 1;
                 case HID_DG_CONFIDENCE:
@@ -169,8 +171,14 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                          * to emit a normal (X, Y) position
                          */
                         if (!nd->reading_mt) {
+                                /*
+                                 * TipSwitch indicates the presence of a
+                                 * finger in single touch mode.
+                                 */
+                                input_report_key(input, BTN_TOUCH,
+                                                 nd->tipswitch);
                                 input_report_key(input, BTN_TOOL_DOUBLETAP,
-                                                 (nd->confidence != 0));
+                                                 nd->tipswitch);
                                 input_event(input, EV_ABS, ABS_X, nd->x);
                                 input_event(input, EV_ABS, ABS_Y, nd->y);
                         }
@@ -209,7 +217,13 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
 
                         /* emit a normal (X, Y) for the first point only */
                         if (nd->id == 0) {
-                                nd->first_contact_confidence = nd->confidence;
+                                /*
+                                 * TipSwitch is superfluous in multitouch
+                                 * mode.  The footer events tell us
+                                 * if there is a finger on the screen or
+                                 * not.
+                                 */
+                                nd->first_contact_touch = nd->confidence;
                                 input_event(input, EV_ABS, ABS_X, nd->x);
                                 input_event(input, EV_ABS, ABS_Y, nd->y);
                         }
@@ -239,30 +253,11 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
 
                         nd->reading_mt = 0;
 
-                        if (nd->first_contact_confidence) {
-                                switch (value) {
-                                case 0: /* for single touch devices */
-                                case 1:
-                                        input_report_key(input,
-                                                        BTN_TOOL_DOUBLETAP, 1);
-                                        break;
-                                case 2:
-                                        input_report_key(input,
-                                                        BTN_TOOL_TRIPLETAP, 1);
-                                        break;
-                                case 3:
-                                default:
-                                        input_report_key(input,
-                                                        BTN_TOOL_QUADTAP, 1);
-                                }
+                        if (nd->first_contact_touch) {
+                                input_report_key(input, BTN_TOOL_DOUBLETAP, 1);
                                 input_report_key(input, BTN_TOUCH, 1);
                         } else {
-                                input_report_key(input,
-                                                BTN_TOOL_DOUBLETAP, 0);
-                                input_report_key(input,
-                                                BTN_TOOL_TRIPLETAP, 0);
-                                input_report_key(input,
-                                                BTN_TOOL_QUADTAP, 0);
+                                input_report_key(input, BTN_TOOL_DOUBLETAP, 0);
                                 input_report_key(input, BTN_TOUCH, 0);
                         }
                         break;
@@ -286,6 +281,7 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
         struct ntrig_data *nd;
         struct hid_input *hidinput;
         struct input_dev *input;
+        struct hid_report *report;
 
         if (id->driver_data)
                 hdev->quirks |= HID_QUIRK_MULTI_INPUT;
@@ -327,13 +323,7 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
                         __clear_bit(BTN_TOOL_PEN, input->keybit);
                         __clear_bit(BTN_TOOL_FINGER, input->keybit);
                         __clear_bit(BTN_0, input->keybit);
-                        /*
-                         * A little something special to enable
-                         * two and three finger taps.
-                         */
                         __set_bit(BTN_TOOL_DOUBLETAP, input->keybit);
-                        __set_bit(BTN_TOOL_TRIPLETAP, input->keybit);
-                        __set_bit(BTN_TOOL_QUADTAP, input->keybit);
                         /*
                          * The physical touchscreen (single touch)
                          * input has a value for physical, whereas
@@ -349,6 +339,12 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 }
         }
 
+        /* This is needed for devices with more recent firmware versions */
+        report = hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0x0a];
+        if (report)
+                usbhid_submit_report(hdev, report, USB_DIR_OUT);
+
+
         return 0;
 err_free:
         kfree(nd);
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 7502a4b2fa8..402d5574b57 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -76,7 +76,7 @@ static int sony_set_operational_usb(struct hid_device *hdev)
 
 static int sony_set_operational_bt(struct hid_device *hdev)
 {
-        unsigned char buf[] = { 0x53, 0xf4,  0x42, 0x03, 0x00, 0x00 };
+        unsigned char buf[] = { 0xf4,  0x42, 0x03, 0x00, 0x00 };
         return hdev->hid_output_raw_report(hdev, buf, sizeof(buf), HID_FEATURE_REPORT);
 }
 
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index f7700cf4972..f947d8337e2 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -277,7 +277,6 @@ static int __init wacom_init(void)
         ret = hid_register_driver(&wacom_driver);
         if (ret)
                 printk(KERN_ERR "can't register wacom driver\n");
-        printk(KERN_ERR "wacom driver registered\n");
         return ret;
 }
 
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 56d06cd8075..7b85b696fda 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -999,13 +999,6 @@ static int usbhid_start(struct hid_device *hid)
                 }
         }
 
-        init_waitqueue_head(&usbhid->wait);
-        INIT_WORK(&usbhid->reset_work, hid_reset);
-        INIT_WORK(&usbhid->restart_work, __usbhid_restart_queues);
-        setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
-
-        spin_lock_init(&usbhid->lock);
-
         usbhid->urbctrl = usb_alloc_urb(0, GFP_KERNEL);
         if (!usbhid->urbctrl) {
                 ret = -ENOMEM;
@@ -1179,6 +1172,12 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
         usbhid->intf = intf;
         usbhid->ifnum = interface->desc.bInterfaceNumber;
 
+        init_waitqueue_head(&usbhid->wait);
+        INIT_WORK(&usbhid->reset_work, hid_reset);
+        INIT_WORK(&usbhid->restart_work, __usbhid_restart_queues);
+        setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
+        spin_lock_init(&usbhid->lock);
+
         ret = hid_add_device(hid);
         if (ret) {
                 if (ret != -ENODEV)
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 0f28d91f29d..f085c18d290 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -195,6 +195,9 @@ static unsigned int applesmc_accelerometer;
 /* Indicates whether this computer has light sensors and keyboard backlight. */
 static unsigned int applesmc_light;
 
+/* The number of fans handled by the driver */
+static unsigned int fans_handled;
+
 /* Indicates which temperature sensors set to use. */
 static unsigned int applesmc_temperature_set;
 
@@ -1492,39 +1495,24 @@ static int __init applesmc_init(void)
 
         /* create fan files */
         count = applesmc_get_fan_count();
-        if (count < 0) {
+        if (count < 0)
                 printk(KERN_ERR "applesmc: Cannot get the number of fans.\n");
-        } else {
+        else
                 printk(KERN_INFO "applesmc: %d fans found.\n", count);
 
-                switch (count) {
-                default:
-                        printk(KERN_WARNING "applesmc: More than 4 fans found,"
-                                        " but at most 4 fans are supported"
-                                                " by the driver.\n");
-                case 4:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[3]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 3:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[2]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 2:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[1]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 1:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[0]);
-                        if (ret)
-                                goto out_fan_1;
-                case 0:
-                        ;
-                }
+        if (count > 4) {
+                count = 4;
+                printk(KERN_WARNING "applesmc: More than 4 fans found,"
+                       " but at most 4 fans are supported"
+                       " by the driver.\n");
+        }
+
+        while (fans_handled < count) {
+                ret = sysfs_create_group(&pdev->dev.kobj,
+                                         &fan_attribute_groups[fans_handled]);
+                if (ret)
+                        goto out_fans;
+                fans_handled++;
         }
 
         for (i = 0;
@@ -1593,10 +1581,10 @@ out_accelerometer:
                 applesmc_release_accelerometer();
 out_temperature:
         sysfs_remove_group(&pdev->dev.kobj, &temperature_attributes_group);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[0]);
-out_fan_1:
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[1]);
-out_key_enumeration:
+out_fans:
+        while (fans_handled)
+                sysfs_remove_group(&pdev->dev.kobj,
+                                   &fan_attribute_groups[--fans_handled]);
         sysfs_remove_group(&pdev->dev.kobj, &key_enumeration_group);
 out_name:
         sysfs_remove_file(&pdev->dev.kobj, &dev_attr_name.attr);
@@ -1622,8 +1610,9 @@ static void __exit applesmc_exit(void)
         if (applesmc_accelerometer)
                 applesmc_release_accelerometer();
         sysfs_remove_group(&pdev->dev.kobj, &temperature_attributes_group);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[0]);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[1]);
+        while (fans_handled)
+                sysfs_remove_group(&pdev->dev.kobj,
+                                   &fan_attribute_groups[--fans_handled]);
         sysfs_remove_group(&pdev->dev.kobj, &key_enumeration_group);
         sysfs_remove_file(&pdev->dev.kobj, &dev_attr_name.attr);
         platform_device_unregister(pdev);
diff --git a/drivers/hwmon/asc7621.c b/drivers/hwmon/asc7621.c
index 7f948105d8a..0f388adc618 100644
--- a/drivers/hwmon/asc7621.c
+++ b/drivers/hwmon/asc7621.c
@@ -268,8 +268,11 @@ static ssize_t store_fan16(struct device *dev,
         if (strict_strtol(buf, 10, &reqval))
                 return -EINVAL;
 
+        /* If a minimum RPM of zero is requested, then we set the register to
+           0xffff. This value allows the fan to be stopped completely without
+           generating an alarm. */
         reqval =
-            (SENSORS_LIMIT((reqval) <= 0 ? 0 : 5400000 / (reqval), 0, 65534));
+            (reqval <= 0 ? 0xffff : SENSORS_LIMIT(5400000 / reqval, 0, 0xfffe));
 
         mutex_lock(&data->update_lock);
         data->reg[param->msb[0]] = (reqval >> 8) & 0xff;
@@ -285,8 +288,9 @@ static ssize_t store_fan16(struct device *dev,
  * Voltages are scaled in the device so that the nominal voltage
  * is 3/4ths of the 0-255 range (i.e. 192).
  * If all voltages are 'normal' then all voltage registers will
- * read 0xC0.  This doesn't help us if we don't have a point of refernce.
- * The data sheet however provides us with the full scale value for each
+ * read 0xC0.
+ *
+ * The data sheet provides us with the 3/4 scale value for each voltage
  * which is stored in in_scaling.  The sda->index parameter value provides
  * the index into in_scaling.
  *
@@ -295,7 +299,7 @@ static ssize_t store_fan16(struct device *dev,
  */
 
 static int asc7621_in_scaling[] = {
-        3320, 3000, 4380, 6640, 16000
+        2500, 2250, 3300, 5000, 12000
 };
 
 static ssize_t show_in10(struct device *dev, struct device_attribute *attr,
@@ -306,19 +310,12 @@ static ssize_t show_in10(struct device *dev, struct device_attribute *attr,
         u8 nr = sda->index;
 
         mutex_lock(&data->update_lock);
-        regval = (data->reg[param->msb[0]] * asc7621_in_scaling[nr]) / 256;
-
-        /* The LSB value is a 2-bit scaling of the MSB's LSbit value.
-         * I.E.  If the maximim voltage for this input is 6640 millivolts then
-         * a MSB register value of 0 = 0mv and 255 = 6640mv.
-         * A 1 step change therefore represents 25.9mv (6640 / 256).
-         * The extra 2-bits therefore represent increments of 6.48mv.
-         */
-        regval += ((asc7621_in_scaling[nr] / 256) / 4) *
-            (data->reg[param->lsb[0]] >> 6);
-
+        regval = (data->reg[param->msb[0]] << 8) | (data->reg[param->lsb[0]]);
         mutex_unlock(&data->update_lock);
 
+        /* The LSB value is a 2-bit scaling of the MSB's LSbit value. */
+        regval = (regval >> 6) * asc7621_in_scaling[nr] / (0xc0 << 2);
+
         return sprintf(buf, "%u\n", regval);
 }
 
@@ -331,7 +328,7 @@ static ssize_t show_in8(struct device *dev, struct device_attribute *attr,
 
         return sprintf(buf, "%u\n",
                        ((data->reg[param->msb[0]] *
-                         asc7621_in_scaling[nr]) / 256));
+                         asc7621_in_scaling[nr]) / 0xc0));
 }
 
 static ssize_t store_in8(struct device *dev, struct device_attribute *attr,
@@ -344,9 +341,11 @@ static ssize_t store_in8(struct device *dev, struct device_attribute *attr,
         if (strict_strtol(buf, 10, &reqval))
                 return -EINVAL;
 
-        reqval = SENSORS_LIMIT(reqval, 0, asc7621_in_scaling[nr]);
+        reqval = SENSORS_LIMIT(reqval, 0, 0xffff);
+
+        reqval = reqval * 0xc0 / asc7621_in_scaling[nr];
 
-        reqval = (reqval * 255 + 128) / asc7621_in_scaling[nr];
+        reqval = SENSORS_LIMIT(reqval, 0, 0xff);
 
         mutex_lock(&data->update_lock);
         data->reg[param->msb[0]] = reqval;
@@ -846,11 +845,11 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(in3_max, 3, PRI_LOW, 0x4b, 0, 0, 0, in8),
         PWRITE(in4_max, 4, PRI_LOW, 0x4d, 0, 0, 0, in8),
 
-        PREAD(in0_alarm, 0, PRI_LOW, 0x41, 0, 0x01, 0, bitmask),
-        PREAD(in1_alarm, 1, PRI_LOW, 0x41, 0, 0x01, 1, bitmask),
-        PREAD(in2_alarm, 2, PRI_LOW, 0x41, 0, 0x01, 2, bitmask),
-        PREAD(in3_alarm, 3, PRI_LOW, 0x41, 0, 0x01, 3, bitmask),
-        PREAD(in4_alarm, 4, PRI_LOW, 0x42, 0, 0x01, 0, bitmask),
+        PREAD(in0_alarm, 0, PRI_HIGH, 0x41, 0, 0x01, 0, bitmask),
+        PREAD(in1_alarm, 1, PRI_HIGH, 0x41, 0, 0x01, 1, bitmask),
+        PREAD(in2_alarm, 2, PRI_HIGH, 0x41, 0, 0x01, 2, bitmask),
+        PREAD(in3_alarm, 3, PRI_HIGH, 0x41, 0, 0x01, 3, bitmask),
+        PREAD(in4_alarm, 4, PRI_HIGH, 0x42, 0, 0x01, 0, bitmask),
 
         PREAD(fan1_input, 0, PRI_HIGH, 0x29, 0x28, 0, 0, fan16),
         PREAD(fan2_input, 1, PRI_HIGH, 0x2b, 0x2a, 0, 0, fan16),
@@ -862,10 +861,10 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(fan3_min, 2, PRI_LOW, 0x59, 0x58, 0, 0, fan16),
         PWRITE(fan4_min, 3, PRI_LOW, 0x5b, 0x5a, 0, 0, fan16),
 
-        PREAD(fan1_alarm, 0, PRI_LOW, 0x42, 0, 0x01, 0, bitmask),
-        PREAD(fan2_alarm, 1, PRI_LOW, 0x42, 0, 0x01, 1, bitmask),
-        PREAD(fan3_alarm, 2, PRI_LOW, 0x42, 0, 0x01, 2, bitmask),
-        PREAD(fan4_alarm, 3, PRI_LOW, 0x42, 0, 0x01, 3, bitmask),
+        PREAD(fan1_alarm, 0, PRI_HIGH, 0x42, 0, 0x01, 2, bitmask),
+        PREAD(fan2_alarm, 1, PRI_HIGH, 0x42, 0, 0x01, 3, bitmask),
+        PREAD(fan3_alarm, 2, PRI_HIGH, 0x42, 0, 0x01, 4, bitmask),
+        PREAD(fan4_alarm, 3, PRI_HIGH, 0x42, 0, 0x01, 5, bitmask),
 
         PREAD(temp1_input, 0, PRI_HIGH, 0x25, 0x10, 0, 0, temp10),
         PREAD(temp2_input, 1, PRI_HIGH, 0x26, 0x15, 0, 0, temp10),
@@ -886,10 +885,10 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(temp3_max, 2, PRI_LOW, 0x53, 0, 0, 0, temp8),
         PWRITE(temp4_max, 3, PRI_LOW, 0x35, 0, 0, 0, temp8),
 
-        PREAD(temp1_alarm, 0, PRI_LOW, 0x41, 0, 0x01, 4, bitmask),
-        PREAD(temp2_alarm, 1, PRI_LOW, 0x41, 0, 0x01, 5, bitmask),
-        PREAD(temp3_alarm, 2, PRI_LOW, 0x41, 0, 0x01, 6, bitmask),
-        PREAD(temp4_alarm, 3, PRI_LOW, 0x43, 0, 0x01, 0, bitmask),
+        PREAD(temp1_alarm, 0, PRI_HIGH, 0x41, 0, 0x01, 4, bitmask),
+        PREAD(temp2_alarm, 1, PRI_HIGH, 0x41, 0, 0x01, 5, bitmask),
+        PREAD(temp3_alarm, 2, PRI_HIGH, 0x41, 0, 0x01, 6, bitmask),
+        PREAD(temp4_alarm, 3, PRI_HIGH, 0x43, 0, 0x01, 0, bitmask),
 
         PWRITE(temp1_source, 0, PRI_LOW, 0x02, 0, 0x07, 4, bitmask),
         PWRITE(temp2_source, 1, PRI_LOW, 0x02, 0, 0x07, 0, bitmask),
@@ -898,7 +897,7 @@ static struct asc7621_param asc7621_params[] = {
 
         PWRITE(temp1_smoothing_enable, 0, PRI_LOW, 0x62, 0, 0x01, 3, bitmask),
         PWRITE(temp2_smoothing_enable, 1, PRI_LOW, 0x63, 0, 0x01, 7, bitmask),
-        PWRITE(temp3_smoothing_enable, 2, PRI_LOW, 0x64, 0, 0x01, 3, bitmask),
+        PWRITE(temp3_smoothing_enable, 2, PRI_LOW, 0x63, 0, 0x01, 3, bitmask),
         PWRITE(temp4_smoothing_enable, 3, PRI_LOW, 0x3c, 0, 0x01, 3, bitmask),
 
         PWRITE(temp1_smoothing_time, 0, PRI_LOW, 0x62, 0, 0x07, 0, temp_st),
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index c8ab5051667..7580f55e67e 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -328,8 +328,8 @@ static int lis3lv02d_remove(struct acpi_device *device, int type)
         lis3lv02d_joystick_disable();
         lis3lv02d_poweroff(&lis3_dev);
 
-        flush_work(&hpled_led.work);
         led_classdev_unregister(&hpled_led.led_classdev);
+        flush_work(&hpled_led.work);
 
         return lis3lv02d_remove_fs(&lis3_dev);
 }
diff --git a/drivers/i2c/busses/i2c-octeon.c b/drivers/i2c/busses/i2c-octeon.c
index a2481f40ea1..0e9f85d0a83 100644
--- a/drivers/i2c/busses/i2c-octeon.c
+++ b/drivers/i2c/busses/i2c-octeon.c
@@ -447,7 +447,7 @@ static struct i2c_adapter octeon_i2c_ops = {
 /**
  * octeon_i2c_setclock - Calculate and set clock divisors.
  */
-static int __init octeon_i2c_setclock(struct octeon_i2c *i2c)
+static int __devinit octeon_i2c_setclock(struct octeon_i2c *i2c)
 {
         int tclk, thp_base, inc, thp_idx, mdiv_idx, ndiv_idx, foscl, diff;
         int thp = 0x18, mdiv = 2, ndiv = 0, delta_hz = 1000000;
@@ -490,7 +490,7 @@ static int __init octeon_i2c_setclock(struct octeon_i2c *i2c)
         return 0;
 }
 
-static int __init octeon_i2c_initlowlevel(struct octeon_i2c *i2c)
+static int __devinit octeon_i2c_initlowlevel(struct octeon_i2c *i2c)
 {
         u8 status;
         int tries;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 3202a86f420..c2258a51fe0 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -40,12 +40,11 @@
 #include "i2c-core.h"
 
 
-/* core_lock protects i2c_adapter_idr, userspace_devices, and guarantees
+/* core_lock protects i2c_adapter_idr, and guarantees
    that device detection, deletion of detected devices, and attach_adapter
    and detach_adapter calls are serialized */
 static DEFINE_MUTEX(core_lock);
 static DEFINE_IDR(i2c_adapter_idr);
-static LIST_HEAD(userspace_devices);
 
 static struct device_type i2c_client_type;
 static int i2c_check_addr(struct i2c_adapter *adapter, int addr);
@@ -117,8 +116,10 @@ static int i2c_device_probe(struct device *dev)
         dev_dbg(dev, "probe\n");
 
         status = driver->probe(client, i2c_match_id(driver->id_table, client));
-        if (status)
+        if (status) {
                 client->driver = NULL;
+                i2c_set_clientdata(client, NULL);
+        }
         return status;
 }
 
@@ -139,8 +140,10 @@ static int i2c_device_remove(struct device *dev)
                 dev->driver = NULL;
                 status = 0;
         }
-        if (status == 0)
+        if (status == 0) {
                 client->driver = NULL;
+                i2c_set_clientdata(client, NULL);
+        }
         return status;
 }
 
@@ -538,9 +541,9 @@ i2c_sysfs_new_device(struct device *dev, struct device_attribute *attr,
                 return -EEXIST;
 
         /* Keep track of the added device */
-        mutex_lock(&core_lock);
-        list_add_tail(&client->detected, &userspace_devices);
-        mutex_unlock(&core_lock);
+        i2c_lock_adapter(adap);
+        list_add_tail(&client->detected, &adap->userspace_clients);
+        i2c_unlock_adapter(adap);
         dev_info(dev, "%s: Instantiated device %s at 0x%02hx\n", "new_device",
                  info.type, info.addr);
 
@@ -579,9 +582,10 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
 
         /* Make sure the device was added through sysfs */
         res = -ENOENT;
-        mutex_lock(&core_lock);
-        list_for_each_entry_safe(client, next, &userspace_devices, detected) {
-                if (client->addr == addr && client->adapter == adap) {
+        i2c_lock_adapter(adap);
+        list_for_each_entry_safe(client, next, &adap->userspace_clients,
+                                 detected) {
+                if (client->addr == addr) {
                         dev_info(dev, "%s: Deleting device %s at 0x%02hx\n",
                                  "delete_device", client->name, client->addr);
 
@@ -591,7 +595,7 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
                         break;
                 }
         }
-        mutex_unlock(&core_lock);
+        i2c_unlock_adapter(adap);
 
         if (res < 0)
                 dev_err(dev, "%s: Can't find device in list\n",
@@ -673,6 +677,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
         }
 
         rt_mutex_init(&adap->bus_lock);
+        INIT_LIST_HEAD(&adap->userspace_clients);
 
         /* Set default timeout to 1 second if not already set */
         if (adap->timeout == 0)
@@ -875,14 +880,15 @@ int i2c_del_adapter(struct i2c_adapter *adap)
                 return res;
 
         /* Remove devices instantiated from sysfs */
-        list_for_each_entry_safe(client, next, &userspace_devices, detected) {
-                if (client->adapter == adap) {
-                        dev_dbg(&adap->dev, "Removing %s at 0x%x\n",
-                                client->name, client->addr);
-                        list_del(&client->detected);
-                        i2c_unregister_device(client);
-                }
+        i2c_lock_adapter(adap);
+        list_for_each_entry_safe(client, next, &adap->userspace_clients,
+                                 detected) {
+                dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
+                        client->addr);
+                list_del(&client->detected);
+                i2c_unregister_device(client);
         }
+        i2c_unlock_adapter(adap);
 
         /* Detach any active clients. This can't fail, thus we do not
            checking the returned value. */
@@ -1260,12 +1266,23 @@ static int i2c_detect_address(struct i2c_client *temp_client,
                 return 0;
 
         /* Make sure there is something at this address */
-        if (i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL) < 0)
-                return 0;
+        if (addr == 0x73 && (adapter->class & I2C_CLASS_HWMON)) {
+                /* Special probe for FSC hwmon chips */
+                union i2c_smbus_data dummy;
 
-        /* Prevent 24RF08 corruption */
-        if ((addr & ~0x0f) == 0x50)
-                i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL);
+                if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_READ, 0,
+                                   I2C_SMBUS_BYTE_DATA, &dummy) < 0)
+                        return 0;
+        } else {
+                if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
+                                   I2C_SMBUS_QUICK, NULL) < 0)
+                        return 0;
+
+                /* Prevent 24RF08 corruption */
+                if ((addr & ~0x0f) == 0x50)
+                        i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
+                                       I2C_SMBUS_QUICK, NULL);
+        }
 
         /* Finally call the custom detection function */
         memset(&info, 0, sizeof(struct i2c_board_info));
diff --git a/drivers/ide/ide-cs.c b/drivers/ide/ide-cs.c
index defce2877ee..b85450865ff 100644
--- a/drivers/ide/ide-cs.c
+++ b/drivers/ide/ide-cs.c
@@ -409,7 +409,7 @@ static struct pcmcia_device_id ide_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("Hyperstone", "Model1", 0x3d5b9ef5, 0xca6ab420),
         PCMCIA_DEVICE_PROD_ID12("IBM", "microdrive", 0xb569a6e5, 0xa6d76178),
         PCMCIA_DEVICE_PROD_ID12("IBM", "IBM17JSSFP20", 0xb569a6e5, 0xf2508753),
-        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 1GB", 0x2e6d1829, 0x3e520e17),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 1GB", 0x2e6d1829, 0x55d5bffb),
         PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 4GB", 0x2e6d1829, 0x531e7d10),
         PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF8GB", 0x2e6d1829, 0xacbe682e),
         PCMCIA_DEVICE_PROD_ID12("IO DATA", "CBIDE2      ", 0x547e66dc, 0x8671043b),
@@ -431,7 +431,7 @@ static struct pcmcia_device_id ide_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS1GCF80", 0x709b1bf1, 0x2a54d4b1),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS2GCF120", 0x709b1bf1, 0x969aa4f2),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF120", 0x709b1bf1, 0xf54a91c8),
-        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF133", 0x709b1bf1, 0x9351e59d),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF133", 0x709b1bf1, 0x7558f133),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS8GCF133", 0x709b1bf1, 0xb2f89b47),
         PCMCIA_DEVICE_PROD_ID12("WIT", "IDE16", 0x244e5994, 0x3e232852),
         PCMCIA_DEVICE_PROD_ID12("WEIDA", "TWTTI", 0xcc7cf69c, 0x212bb918),
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index c52bec4d053..423e0e6031a 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -929,6 +929,24 @@ static const struct input_device_id joydev_ids[] = {
                 .evbit = { BIT_MASK(EV_ABS) },
                 .absbit = { BIT_MASK(ABS_THROTTLE) },
         },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = {[BIT_WORD(BTN_JOYSTICK)] = BIT_MASK(BTN_JOYSTICK) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_GAMEPAD)] = BIT_MASK(BTN_GAMEPAD) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_TRIGGER_HAPPY)] = BIT_MASK(BTN_TRIGGER_HAPPY) },
+        },
         { }     /* Terminating entry */
 };
 
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index b1edd778639..405febd94f2 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -54,6 +54,9 @@ static signed short btn_avb_wheel[] =
 static signed short abs_joystick[] =
 { ABS_X, ABS_Y, ABS_THROTTLE, ABS_HAT0X, ABS_HAT0Y, -1 };
 
+static signed short abs_joystick_rudder[] =
+{ ABS_X, ABS_Y, ABS_THROTTLE, ABS_RUDDER, ABS_HAT0X, ABS_HAT0Y, -1 };
+
 static signed short abs_avb_pegasus[] =
 { ABS_X, ABS_Y, ABS_THROTTLE, ABS_RUDDER, ABS_HAT0X, ABS_HAT0Y,
   ABS_HAT1X, ABS_HAT1Y, -1 };
@@ -76,8 +79,9 @@ static struct iforce_device iforce_device[] = {
         { 0x061c, 0xc0a4, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x061c, 0xc084, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce },
         { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
+        { 0x06f8, 0x0001, "Guillemot Jet Leader Force Feedback",        btn_joystick, abs_joystick_rudder, ff_iforce },
         { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
-        { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
+        { 0x06f8, 0xa302, "Guillemot Jet Leader 3D",                    btn_joystick, abs_joystick, ff_iforce }, //?
         { 0x06d6, 0x29bc, "Trust Force Feedback Race Master",           btn_wheel, abs_wheel, ff_iforce },
         { 0x0000, 0x0000, "Unknown I-Force Device [%04x:%04x]",         btn_joystick, abs_joystick, ff_iforce }
 };
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index b41303d3ec5..6c96631ae5d 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -212,6 +212,7 @@ static struct usb_device_id iforce_usb_ids [] = {
         { USB_DEVICE(0x061c, 0xc0a4) },         /* ACT LABS Force RS */
         { USB_DEVICE(0x061c, 0xc084) },         /* ACT LABS Force RS */
         { USB_DEVICE(0x06f8, 0x0001) },         /* Guillemot Race Leader Force Feedback */
+        { USB_DEVICE(0x06f8, 0x0003) },         /* Guillemot Jet Leader Force Feedback */
         { USB_DEVICE(0x06f8, 0x0004) },         /* Guillemot Force Feedback Racing Wheel */
         { USB_DEVICE(0x06f8, 0xa302) },         /* Guillemot Jet Leader 3D */
         { }                                     /* Terminating entry */
diff --git a/drivers/input/misc/ati_remote.c b/drivers/input/misc/ati_remote.c
index 614b65d78fe..e8bbc619f6d 100644
--- a/drivers/input/misc/ati_remote.c
+++ b/drivers/input/misc/ati_remote.c
@@ -98,10 +98,12 @@
  * Module and Version Information, Module Parameters
  */
 
-#define ATI_REMOTE_VENDOR_ID    0x0bc7
-#define ATI_REMOTE_PRODUCT_ID   0x004
-#define LOLA_REMOTE_PRODUCT_ID  0x002
-#define MEDION_REMOTE_PRODUCT_ID 0x006
+#define ATI_REMOTE_VENDOR_ID            0x0bc7
+#define LOLA_REMOTE_PRODUCT_ID          0x0002
+#define LOLA2_REMOTE_PRODUCT_ID         0x0003
+#define ATI_REMOTE_PRODUCT_ID           0x0004
+#define NVIDIA_REMOTE_PRODUCT_ID        0x0005
+#define MEDION_REMOTE_PRODUCT_ID        0x0006
 
 #define DRIVER_VERSION          "2.2.1"
 #define DRIVER_AUTHOR           "Torrey Hoffman <thoffman@arnor.net>"
@@ -142,8 +144,10 @@ MODULE_PARM_DESC(repeat_delay, "Delay before sending repeats, default = 500 msec
 #define err(format, arg...) printk(KERN_ERR format , ## arg)
 
 static struct usb_device_id ati_remote_table[] = {
-        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, ATI_REMOTE_PRODUCT_ID) },
         { USB_DEVICE(ATI_REMOTE_VENDOR_ID, LOLA_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, LOLA2_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, ATI_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, NVIDIA_REMOTE_PRODUCT_ID) },
         { USB_DEVICE(ATI_REMOTE_VENDOR_ID, MEDION_REMOTE_PRODUCT_ID) },
         {}      /* Terminating entry */
 };
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 0d22cb9ce42..99d58764ef0 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -64,7 +64,6 @@ static const struct alps_model_info alps_model_data[] = {
         { { 0x62, 0x02, 0x14 }, 0xcf, 0xcf,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
         { { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },          /* Dell Vostro 1400 */
-        { { 0x73, 0x02, 0x64 }, 0xf8, 0xf8, 0 },                          /* HP Pavilion dm3 */
         { { 0x52, 0x01, 0x14 }, 0xff, 0xff,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },      /* Toshiba Tecra A11-11L */
 };
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index a138b5da79f..112b4ee52ff 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -25,6 +25,10 @@
                         printk(KERN_DEBUG format, ##arg);       \
         } while (0)
 
+static bool force_elantech;
+module_param_named(force_elantech, force_elantech, bool, 0644);
+MODULE_PARM_DESC(force_elantech, "Force the Elantech PS/2 protocol extension to be used, 1 = enabled, 0 = disabled (default).");
+
 /*
  * Send a Synaptics style sliced query command
  */
@@ -181,14 +185,18 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         int fingers;
         static int old_fingers;
 
-        if (etd->fw_version_maj == 0x01) {
-                /* byte 0:  D   U  p1  p2   1  p3   R   L
-                   byte 1:  f   0  th  tw  x9  x8  y9  y8 */
+        if (etd->fw_version < 0x020000) {
+                /*
+                 * byte 0:  D   U  p1  p2   1  p3   R   L
+                 * byte 1:  f   0  th  tw  x9  x8  y9  y8
+                 */
                 fingers = ((packet[1] & 0x80) >> 7) +
                                 ((packet[1] & 0x30) >> 4);
         } else {
-                /* byte 0: n1  n0  p2  p1   1  p3   R   L
-                   byte 1:  0   0   0   0  x9  x8  y9  y8 */
+                /*
+                 * byte 0: n1  n0  p2  p1   1  p3   R   L
+                 * byte 1:  0   0   0   0  x9  x8  y9  y8
+                 */
                 fingers = (packet[0] & 0xc0) >> 6;
         }
 
@@ -202,13 +210,15 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
 
         input_report_key(dev, BTN_TOUCH, fingers != 0);
 
-        /* byte 2: x7  x6  x5  x4  x3  x2  x1  x0
-           byte 3: y7  y6  y5  y4  y3  y2  y1  y0 */
+        /*
+         * byte 2: x7  x6  x5  x4  x3  x2  x1  x0
+         * byte 3: y7  y6  y5  y4  y3  y2  y1  y0
+         */
         if (fingers) {
                 input_report_abs(dev, ABS_X,
                         ((packet[1] & 0x0c) << 6) | packet[2]);
-                input_report_abs(dev, ABS_Y, ETP_YMAX_V1 -
-                        (((packet[1] & 0x03) << 8) | packet[3]));
+                input_report_abs(dev, ABS_Y,
+                        ETP_YMAX_V1 - (((packet[1] & 0x03) << 8) | packet[3]));
         }
 
         input_report_key(dev, BTN_TOOL_FINGER, fingers == 1);
@@ -217,7 +227,7 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
         input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
 
-        if ((etd->fw_version_maj == 0x01) &&
+        if (etd->fw_version < 0x020000 &&
             (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                 /* rocker up */
                 input_report_key(dev, BTN_FORWARD, packet[0] & 0x40);
@@ -247,34 +257,47 @@ static void elantech_report_absolute_v2(struct psmouse *psmouse)
 
         switch (fingers) {
         case 1:
-                /* byte 1: x15 x14 x13 x12 x11 x10 x9  x8
-                   byte 2: x7  x6  x5  x4  x4  x2  x1  x0 */
-                input_report_abs(dev, ABS_X, (packet[1] << 8) | packet[2]);
-                /* byte 4: y15 y14 y13 y12 y11 y10 y8  y8
-                   byte 5: y7  y6  y5  y4  y3  y2  y1  y0 */
-                input_report_abs(dev, ABS_Y, ETP_YMAX_V2 -
-                        ((packet[4] << 8) | packet[5]));
+                /*
+                 * byte 1:  .   .   .   .   .  x10 x9  x8
+                 * byte 2: x7  x6  x5  x4  x4  x2  x1  x0
+                 */
+                input_report_abs(dev, ABS_X,
+                        ((packet[1] & 0x07) << 8) | packet[2]);
+                /*
+                 * byte 4:  .   .   .   .   .   .  y9  y8
+                 * byte 5: y7  y6  y5  y4  y3  y2  y1  y0
+                 */
+                input_report_abs(dev, ABS_Y,
+                        ETP_YMAX_V2 - (((packet[4] & 0x03) << 8) | packet[5]));
                 break;
 
         case 2:
-                /* The coordinate of each finger is reported separately with
-                   a lower resolution for two finger touches */
-                /* byte 0:  .   .  ay8 ax8  .   .   .   .
-                   byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0 */
+                /*
+                 * The coordinate of each finger is reported separately
+                 * with a lower resolution for two finger touches:
+                 * byte 0:  .   .  ay8 ax8  .   .   .   .
+                 * byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0
+                 */
                 x1 = ((packet[0] & 0x10) << 4) | packet[1];
                 /* byte 2: ay7 ay6 ay5 ay4 ay3 ay2 ay1 ay0 */
                 y1 = ETP_2FT_YMAX - (((packet[0] & 0x20) << 3) | packet[2]);
-                /* byte 3:  .   .  by8 bx8  .   .   .   .
-                   byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0 */
+                /*
+                 * byte 3:  .   .  by8 bx8  .   .   .   .
+                 * byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0
+                 */
                 x2 = ((packet[3] & 0x10) << 4) | packet[4];
                 /* byte 5: by7 by8 by5 by4 by3 by2 by1 by0 */
                 y2 = ETP_2FT_YMAX - (((packet[3] & 0x20) << 3) | packet[5]);
-                /* For compatibility with the X Synaptics driver scale up one
-                   coordinate and report as ordinary mouse movent */
+                /*
+                 * For compatibility with the X Synaptics driver scale up
+                 * one coordinate and report as ordinary mouse movent
+                 */
                 input_report_abs(dev, ABS_X, x1 << 2);
                 input_report_abs(dev, ABS_Y, y1 << 2);
-                /* For compatibility with the proprietary X Elantech driver
-                   report both coordinates as hat coordinates */
+                /*
+                 * For compatibility with the proprietary X Elantech driver
+                 * report both coordinates as hat coordinates
+                 */
                 input_report_abs(dev, ABS_HAT0X, x1);
                 input_report_abs(dev, ABS_HAT0Y, y1);
                 input_report_abs(dev, ABS_HAT1X, x2);
@@ -298,7 +321,7 @@ static int elantech_check_parity_v1(struct psmouse *psmouse)
         unsigned char p1, p2, p3;
 
         /* Parity bits are placed differently */
-        if (etd->fw_version_maj == 0x01) {
+        if (etd->fw_version < 0x020000) {
                 /* byte 0:  D   U  p1  p2   1  p3   R   L */
                 p1 = (packet[0] & 0x20) >> 5;
                 p2 = (packet[0] & 0x10) >> 4;
@@ -434,7 +457,7 @@ static void elantech_set_input_params(struct psmouse *psmouse)
         switch (etd->hw_version) {
         case 1:
                 /* Rocker button */
-                if ((etd->fw_version_maj == 0x01) &&
+                if (etd->fw_version < 0x020000 &&
                     (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                         __set_bit(BTN_FORWARD, dev->keybit);
                         __set_bit(BTN_BACK, dev->keybit);
@@ -596,8 +619,12 @@ int elantech_detect(struct psmouse *psmouse, bool set_properties)
                  param[0], param[1], param[2]);
 
         if (param[0] == 0 || param[1] != 0) {
-                pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
-                return -1;
+                if (!force_elantech) {
+                        pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
+                        return -1;
+                }
+
+                pr_debug("elantech.c: Probably not a real Elantech touchpad. Enabling anyway due to force_elantech.\n");
         }
 
         if (set_properties) {
@@ -659,14 +686,14 @@ int elantech_init(struct psmouse *psmouse)
                 pr_err("elantech.c: failed to query firmware version.\n");
                 goto init_fail;
         }
-        etd->fw_version_maj = param[0];
-        etd->fw_version_min = param[2];
+
+        etd->fw_version = (param[0] << 16) | (param[1] << 8) | param[2];
 
         /*
          * Assume every version greater than this is new EeePC style
          * hardware with 6 byte packets
          */
-        if (etd->fw_version_maj >= 0x02 && etd->fw_version_min >= 0x30) {
+        if (etd->fw_version >= 0x020030) {
                 etd->hw_version = 2;
                 /* For now show extra debug information */
                 etd->debug = 1;
@@ -676,8 +703,9 @@ int elantech_init(struct psmouse *psmouse)
                 etd->hw_version = 1;
                 etd->paritycheck = 1;
         }
-        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d\n",
-                etd->hw_version, etd->fw_version_maj, etd->fw_version_min);
+
+        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d.%d\n",
+                etd->hw_version, param[0], param[1], param[2]);
 
         if (synaptics_send_cmd(psmouse, ETP_CAPABILITIES_QUERY, param)) {
                 pr_err("elantech.c: failed to query capabilities.\n");
@@ -692,8 +720,8 @@ int elantech_init(struct psmouse *psmouse)
          * a touch action starts causing the mouse cursor or scrolled page
          * to jump. Enable a workaround.
          */
-        if (etd->fw_version_maj == 0x02 && etd->fw_version_min == 0x22) {
-                pr_info("elantech.c: firmware version 2.34 detected, "
+        if (etd->fw_version == 0x020022) {
+                pr_info("elantech.c: firmware version 2.0.34 detected, "
                         "enabling jumpy cursor workaround\n");
                 etd->jumpy_cursor = 1;
         }
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index feac5f7af96..ac57bde1bb9 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -100,11 +100,10 @@ struct elantech_data {
         unsigned char reg_26;
         unsigned char debug;
         unsigned char capabilities;
-        unsigned char fw_version_maj;
-        unsigned char fw_version_min;
-        unsigned char hw_version;
         unsigned char paritycheck;
         unsigned char jumpy_cursor;
+        unsigned char hw_version;
+        unsigned int  fw_version;
         unsigned char parity[256];
 };
 
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index d8c0c8d6992..a3c97315a47 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -110,6 +110,7 @@ static struct workqueue_struct *kpsmoused_wq;
 struct psmouse_protocol {
         enum psmouse_type type;
         bool maxproto;
+        bool ignore_parity; /* Protocol should ignore parity errors from KBC */
         const char *name;
         const char *alias;
         int (*detect)(struct psmouse *, bool);
@@ -288,7 +289,9 @@ static irqreturn_t psmouse_interrupt(struct serio *serio,
         if (psmouse->state == PSMOUSE_IGNORE)
                 goto out;
 
-        if (flags & (SERIO_PARITY|SERIO_TIMEOUT)) {
+        if (unlikely((flags & SERIO_TIMEOUT) ||
+                     ((flags & SERIO_PARITY) && !psmouse->ignore_parity))) {
+
                 if (psmouse->state == PSMOUSE_ACTIVATED)
                         printk(KERN_WARNING "psmouse.c: bad data from KBC -%s%s\n",
                                 flags & SERIO_TIMEOUT ? " timeout" : "",
@@ -759,6 +762,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                 .name           = "PS/2",
                 .alias          = "bare",
                 .maxproto       = true,
+                .ignore_parity  = true,
                 .detect         = ps2bare_detect,
         },
 #ifdef CONFIG_MOUSE_PS2_LOGIPS2PP
@@ -786,6 +790,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                 .name           = "ImPS/2",
                 .alias          = "imps",
                 .maxproto       = true,
+                .ignore_parity  = true,
                 .detect         = intellimouse_detect,
         },
         {
@@ -793,6 +798,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                 .name           = "ImExPS/2",
                 .alias          = "exps",
                 .maxproto       = true,
+                .ignore_parity  = true,
                 .detect         = im_explorer_detect,
         },
 #ifdef CONFIG_MOUSE_PS2_SYNAPTICS
@@ -1222,6 +1228,7 @@ static void psmouse_disconnect(struct serio *serio)
 static int psmouse_switch_protocol(struct psmouse *psmouse,
                                    const struct psmouse_protocol *proto)
 {
+        const struct psmouse_protocol *selected_proto;
         struct input_dev *input_dev = psmouse->dev;
 
         input_dev->dev.parent = &psmouse->ps2dev.serio->dev;
@@ -1245,9 +1252,14 @@ static int psmouse_switch_protocol(struct psmouse *psmouse,
                         return -1;
 
                 psmouse->type = proto->type;
-        } else
+                selected_proto = proto;
+        } else {
                 psmouse->type = psmouse_extensions(psmouse,
                                                    psmouse_max_proto, true);
+                selected_proto = psmouse_protocol_by_type(psmouse->type);
+        }
+
+        psmouse->ignore_parity = selected_proto->ignore_parity;
 
         /*
          * If mouse's packet size is 3 there is no point in polling the
@@ -1267,7 +1279,7 @@ static int psmouse_switch_protocol(struct psmouse *psmouse,
                 psmouse->resync_time = 0;
 
         snprintf(psmouse->devname, sizeof(psmouse->devname), "%s %s %s",
-                 psmouse_protocol_by_type(psmouse->type)->name, psmouse->vendor, psmouse->name);
+                 selected_proto->name, psmouse->vendor, psmouse->name);
 
         input_dev->name = psmouse->devname;
         input_dev->phys = psmouse->phys;
@@ -1382,6 +1394,7 @@ static int psmouse_reconnect(struct serio *serio)
         struct psmouse *psmouse = serio_get_drvdata(serio);
         struct psmouse *parent = NULL;
         struct serio_driver *drv = serio->drv;
+        unsigned char type;
         int rc = -1;
 
         if (!drv || !psmouse) {
@@ -1401,10 +1414,15 @@ static int psmouse_reconnect(struct serio *serio)
         if (psmouse->reconnect) {
                 if (psmouse->reconnect(psmouse))
                         goto out;
-        } else if (psmouse_probe(psmouse) < 0 ||
-                   psmouse->type != psmouse_extensions(psmouse,
-                                                psmouse_max_proto, false)) {
-                goto out;
+        } else {
+                psmouse_reset(psmouse);
+
+                if (psmouse_probe(psmouse) < 0)
+                        goto out;
+
+                type = psmouse_extensions(psmouse, psmouse_max_proto, false);
+                if (psmouse->type != type)
+                        goto out;
         }
 
         /* ok, the device type (and capabilities) match the old one,
diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
index e053bdd137f..593e910bfc7 100644
--- a/drivers/input/mouse/psmouse.h
+++ b/drivers/input/mouse/psmouse.h
@@ -47,6 +47,7 @@ struct psmouse {
         unsigned char pktcnt;
         unsigned char pktsize;
         unsigned char type;
+        bool ignore_parity;
         bool acks_disable_command;
         unsigned int model;
         unsigned long last;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 026df601016..ebd7a99efea 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -137,7 +137,8 @@ static int synaptics_capability(struct psmouse *psmouse)
         if (synaptics_send_cmd(psmouse, SYN_QUE_CAPABILITIES, cap))
                 return -1;
         priv->capabilities = (cap[0] << 16) | (cap[1] << 8) | cap[2];
-        priv->ext_cap = 0;
+        priv->ext_cap = priv->ext_cap_0c = 0;
+
         if (!SYN_CAP_VALID(priv->capabilities))
                 return -1;
 
@@ -150,7 +151,7 @@ static int synaptics_capability(struct psmouse *psmouse)
         if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 1) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB, cap)) {
                         printk(KERN_ERR "Synaptics claims to have extended capabilities,"
-                               " but I'm not able to read them.");
+                               " but I'm not able to read them.\n");
                 } else {
                         priv->ext_cap = (cap[0] << 16) | (cap[1] << 8) | cap[2];
 
@@ -162,6 +163,16 @@ static int synaptics_capability(struct psmouse *psmouse)
                                 priv->ext_cap &= 0xff0fff;
                 }
         }
+
+        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 4) {
+                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB_0C, cap)) {
+                        printk(KERN_ERR "Synaptics claims to have extended capability 0x0c,"
+                               " but I'm not able to read it.\n");
+                } else {
+                        priv->ext_cap_0c = (cap[0] << 16) | (cap[1] << 8) | cap[2];
+                }
+        }
+
         return 0;
 }
 
@@ -348,7 +359,15 @@ static void synaptics_parse_hw_state(unsigned char buf[], struct synaptics_data
                 hw->left  = (buf[0] & 0x01) ? 1 : 0;
                 hw->right = (buf[0] & 0x02) ? 1 : 0;
 
-                if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
+                if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+                        /*
+                         * Clickpad's button is transmitted as middle button,
+                         * however, since it is primary button, we will report
+                         * it as BTN_LEFT.
+                         */
+                        hw->left = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
+
+                } else if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
                         hw->middle = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
                         if (hw->w == 2)
                                 hw->scroll = (signed char)(buf[1]);
@@ -593,6 +612,12 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
 
         dev->absres[ABS_X] = priv->x_res;
         dev->absres[ABS_Y] = priv->y_res;
+
+        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+                /* Clickpads report only left button */
+                __clear_bit(BTN_RIGHT, dev->keybit);
+                __clear_bit(BTN_MIDDLE, dev->keybit);
+        }
 }
 
 static void synaptics_disconnect(struct psmouse *psmouse)
@@ -697,10 +722,10 @@ int synaptics_init(struct psmouse *psmouse)
 
         priv->pkt_type = SYN_MODEL_NEWABS(priv->model_id) ? SYN_NEWABS : SYN_OLDABS;
 
-        printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx\n",
+        printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx\n",
                 SYN_ID_MODEL(priv->identity),
                 SYN_ID_MAJOR(priv->identity), SYN_ID_MINOR(priv->identity),
-                priv->model_id, priv->capabilities, priv->ext_cap);
+                priv->model_id, priv->capabilities, priv->ext_cap, priv->ext_cap_0c);
 
         set_input_params(psmouse->dev, priv);
 
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index f0f40a331dc..ae37c5d162a 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -18,6 +18,7 @@
 #define SYN_QUE_SERIAL_NUMBER_SUFFIX    0x07
 #define SYN_QUE_RESOLUTION              0x08
 #define SYN_QUE_EXT_CAPAB               0x09
+#define SYN_QUE_EXT_CAPAB_0C            0x0c
 
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -48,6 +49,8 @@
 #define SYN_CAP_VALID(c)                ((((c) & 0x00ff00) >> 8) == 0x47)
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
+#define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100100)
 
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
@@ -96,6 +99,7 @@ struct synaptics_data {
         unsigned long int model_id;             /* Model-ID */
         unsigned long int capabilities;         /* Capabilities */
         unsigned long int ext_cap;              /* Extended Capabilities */
+        unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
         unsigned long int identity;             /* Identification */
         int x_res;                              /* X resolution in units/mm */
         int y_res;                              /* Y resolution in units/mm */
diff --git a/drivers/input/touchscreen/ad7877.c b/drivers/input/touchscreen/ad7877.c
index e019d53d1ab..0d2d7e54b46 100644
--- a/drivers/input/touchscreen/ad7877.c
+++ b/drivers/input/touchscreen/ad7877.c
@@ -156,9 +156,14 @@ struct ser_req {
         u16                     reset;
         u16                     ref_on;
         u16                     command;
-        u16                     sample;
         struct spi_message      msg;
         struct spi_transfer     xfer[6];
+
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u16 sample ____cacheline_aligned;
 };
 
 struct ad7877 {
@@ -182,8 +187,6 @@ struct ad7877 {
         u8                      averaging;
         u8                      pen_down_acc_interval;
 
-        u16                     conversion_data[AD7877_NR_SENSE];
-
         struct spi_transfer     xfer[AD7877_NR_SENSE + 2];
         struct spi_message      msg;
 
@@ -195,6 +198,12 @@ struct ad7877 {
         spinlock_t              lock;
         struct timer_list       timer;          /* P: lock */
         unsigned                pending:1;      /* P: lock */
+
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u16 conversion_data[AD7877_NR_SENSE] ____cacheline_aligned;
 };
 
 static int gpio3;
diff --git a/drivers/input/touchscreen/eeti_ts.c b/drivers/input/touchscreen/eeti_ts.c
index 204b8a1a601..75f8b73010f 100644
--- a/drivers/input/touchscreen/eeti_ts.c
+++ b/drivers/input/touchscreen/eeti_ts.c
@@ -124,14 +124,25 @@ static irqreturn_t eeti_ts_isr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static int eeti_ts_open(struct input_dev *dev)
+static void eeti_ts_start(struct eeti_ts_priv *priv)
 {
-        struct eeti_ts_priv *priv = input_get_drvdata(dev);
-
         enable_irq(priv->irq);
 
         /* Read the events once to arm the IRQ */
         eeti_ts_read(&priv->work);
+}
+
+static void eeti_ts_stop(struct eeti_ts_priv *priv)
+{
+        disable_irq(priv->irq);
+        cancel_work_sync(&priv->work);
+}
+
+static int eeti_ts_open(struct input_dev *dev)
+{
+        struct eeti_ts_priv *priv = input_get_drvdata(dev);
+
+        eeti_ts_start(priv);
 
         return 0;
 }
@@ -140,8 +151,7 @@ static void eeti_ts_close(struct input_dev *dev)
 {
         struct eeti_ts_priv *priv = input_get_drvdata(dev);
 
-        disable_irq(priv->irq);
-        cancel_work_sync(&priv->work);
+        eeti_ts_stop(priv);
 }
 
 static int __devinit eeti_ts_probe(struct i2c_client *client,
@@ -153,10 +163,12 @@ static int __devinit eeti_ts_probe(struct i2c_client *client,
         unsigned int irq_flags;
         int err = -ENOMEM;
 
-        /* In contrast to what's described in the datasheet, there seems
+        /*
+         * In contrast to what's described in the datasheet, there seems
          * to be no way of probing the presence of that device using I2C
          * commands. So we need to blindly believe it is there, and wait
-         * for interrupts to occur. */
+         * for interrupts to occur.
+         */
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv) {
@@ -212,9 +224,11 @@ static int __devinit eeti_ts_probe(struct i2c_client *client,
                 goto err2;
         }
 
-        /* Disable the irq for now. It will be enabled once the input device
-         * is opened. */
-        disable_irq(priv->irq);
+        /*
+         * Disable the device for now. It will be enabled once the
+         * input device is opened.
+         */
+        eeti_ts_stop(priv);
 
         device_init_wakeup(&client->dev, 0);
         return 0;
@@ -235,6 +249,12 @@ static int __devexit eeti_ts_remove(struct i2c_client *client)
         struct eeti_ts_priv *priv = i2c_get_clientdata(client);
 
         free_irq(priv->irq, priv);
+        /*
+         * eeti_ts_stop() leaves IRQ disabled. We need to re-enable it
+         * so that device still works if we reload the driver.
+         */
+        enable_irq(priv->irq);
+
         input_unregister_device(priv->input);
         i2c_set_clientdata(client, NULL);
         kfree(priv);
@@ -246,6 +266,14 @@ static int __devexit eeti_ts_remove(struct i2c_client *client)
 static int eeti_ts_suspend(struct i2c_client *client, pm_message_t mesg)
 {
         struct eeti_ts_priv *priv = i2c_get_clientdata(client);
+        struct input_dev *input_dev = priv->input;
+
+        mutex_lock(&input_dev->mutex);
+
+        if (input_dev->users)
+                eeti_ts_stop(priv);
+
+        mutex_unlock(&input_dev->mutex);
 
         if (device_may_wakeup(&client->dev))
                 enable_irq_wake(priv->irq);
@@ -256,10 +284,18 @@ static int eeti_ts_suspend(struct i2c_client *client, pm_message_t mesg)
 static int eeti_ts_resume(struct i2c_client *client)
 {
         struct eeti_ts_priv *priv = i2c_get_clientdata(client);
+        struct input_dev *input_dev = priv->input;
 
         if (device_may_wakeup(&client->dev))
                 disable_irq_wake(priv->irq);
 
+        mutex_lock(&input_dev->mutex);
+
+        if (input_dev->users)
+                eeti_ts_start(priv);
+
+        mutex_unlock(&input_dev->mutex);
+
         return 0;
 }
 #else
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 9712b2e97be..cefd63daff3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2109,12 +2109,18 @@ repeat:
                 if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
                         /* .. if the array isn't clean, an 'even' event must also go
                          * to spares. */
-                        if ((mddev->events&1)==0)
+                        if ((mddev->events&1)==0) {
                                 nospares = 0;
+                                sync_req = 2; /* force a second update to get the
+                                               * even/odd in sync */
+                        }
                 } else {
                         /* otherwise an 'odd' event must go to spares */
-                        if ((mddev->events&1))
+                        if ((mddev->events&1)) {
                                 nospares = 0;
+                                sync_req = 2; /* force a second update to get the
+                                               * even/odd in sync */
+                        }
                 }
         }
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 58ea0ecae7c..15348c393b5 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1527,7 +1527,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
 
                 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
                 atomic_inc(&rdev->read_errors);
-                if (conf->mddev->degraded)
+                if (conf->mddev->degraded >= conf->max_degraded)
                         printk_rl(KERN_WARNING
                                   "raid5:%s: read error not correctable "
                                   "(sector %llu on %s).\n",
diff --git a/drivers/media/common/saa7146_fops.c b/drivers/media/common/saa7146_fops.c
index fd8e1f45be3..7364b9642d0 100644
--- a/drivers/media/common/saa7146_fops.c
+++ b/drivers/media/common/saa7146_fops.c
@@ -423,15 +423,14 @@ static void vv_callback(struct saa7146_dev *dev, unsigned long status)
         }
 }
 
-int saa7146_vv_devinit(struct saa7146_dev *dev)
-{
-        return v4l2_device_register(&dev->pci->dev, &dev->v4l2_dev);
-}
-EXPORT_SYMBOL_GPL(saa7146_vv_devinit);
-
 int saa7146_vv_init(struct saa7146_dev* dev, struct saa7146_ext_vv *ext_vv)
 {
         struct saa7146_vv *vv;
+        int err;
+
+        err = v4l2_device_register(&dev->pci->dev, &dev->v4l2_dev);
+        if (err)
+                return err;
 
         vv = kzalloc(sizeof(struct saa7146_vv), GFP_KERNEL);
         if (vv == NULL) {
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index 5ed75263340..b8b2c551a1e 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -558,9 +558,11 @@ static int vidioc_s_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *f
         /* ok, accept it */
         vv->ov_fb = *fb;
         vv->ov_fmt = fmt;
-        if (0 == vv->ov_fb.fmt.bytesperline)
-                vv->ov_fb.fmt.bytesperline =
-                        vv->ov_fb.fmt.width * fmt->depth / 8;
+
+        if (vv->ov_fb.fmt.bytesperline < vv->ov_fb.fmt.width) {
+                vv->ov_fb.fmt.bytesperline = vv->ov_fb.fmt.width * fmt->depth / 8;
+                DEB_D(("setting bytesperline to %d\n", vv->ov_fb.fmt.bytesperline));
+        }
 
         mutex_unlock(&dev->lock);
         return 0;
diff --git a/drivers/media/dvb/frontends/stv090x.c b/drivers/media/dvb/frontends/stv090x.c
index a3c07fe0e6c..96972804f4a 100644
--- a/drivers/media/dvb/frontends/stv090x.c
+++ b/drivers/media/dvb/frontends/stv090x.c
@@ -4470,6 +4470,10 @@ static int stv090x_setup(struct dvb_frontend *fe)
         if (stv090x_write_reg(state, STV090x_TSTRES0, 0x00) < 0)
                 goto err;
 
+        /* workaround for stuck DiSEqC output */
+        if (config->diseqc_envelope_mode)
+                stv090x_send_diseqc_burst(fe, SEC_MINI_A);
+
         return 0;
 err:
         dprintk(FE_ERROR, 1, "I/O error");
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index 9fdf26cc699..1500210c06c 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -643,9 +643,6 @@ static void frontend_init(struct budget *budget)
                                         &budget->i2c_adap,
                                         &tt1600_isl6423_config);
 
-                        } else {
-                                dvb_frontend_detach(budget->dvb_frontend);
-                                budget->dvb_frontend = NULL;
                         }
                 }
                 break;
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index f8fc8654693..9644cf760aa 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -361,7 +361,7 @@ config VIDEO_SAA717X
 
 config VIDEO_SAA7191
         tristate "Philips SAA7191 video decoder"
-        depends on VIDEO_V4L1 && I2C
+        depends on VIDEO_V4L2 && I2C
         ---help---
           Support for the Philips SAA7191 video decoder.
 
@@ -756,7 +756,7 @@ source "drivers/media/video/saa7134/Kconfig"
 
 config VIDEO_MXB
         tristate "Siemens-Nixdorf 'Multimedia eXtension Board'"
-        depends on PCI && VIDEO_V4L1 && I2C
+        depends on PCI && VIDEO_V4L2 && I2C
         select VIDEO_SAA7146_VV
         select VIDEO_TUNER
         select VIDEO_SAA711X if VIDEO_HELPER_CHIPS_AUTO
diff --git a/drivers/media/video/Makefile b/drivers/media/video/Makefile
index b88b6174a33..c51c386559f 100644
--- a/drivers/media/video/Makefile
+++ b/drivers/media/video/Makefile
@@ -160,8 +160,6 @@ obj-$(CONFIG_VIDEO_MX3)			+= mx3_camera.o
 obj-$(CONFIG_VIDEO_PXA27x)              += pxa_camera.o
 obj-$(CONFIG_VIDEO_SH_MOBILE_CEU)       += sh_mobile_ceu_camera.o
 
-obj-$(CONFIG_ARCH_DAVINCI)              += davinci/
-
 obj-$(CONFIG_VIDEO_AU0828) += au0828/
 
 obj-$(CONFIG_USB_VIDEO_CLASS)   += uvc/
diff --git a/drivers/media/video/davinci/vpfe_capture.c b/drivers/media/video/davinci/vpfe_capture.c
index 7cf042f9b37..398dbe71cb8 100644
--- a/drivers/media/video/davinci/vpfe_capture.c
+++ b/drivers/media/video/davinci/vpfe_capture.c
@@ -223,7 +223,6 @@ int vpfe_register_ccdc_device(struct ccdc_hw_device *dev)
         BUG_ON(!dev->hw_ops.get_frame_format);
         BUG_ON(!dev->hw_ops.get_pixel_format);
         BUG_ON(!dev->hw_ops.set_pixel_format);
-        BUG_ON(!dev->hw_ops.set_params);
         BUG_ON(!dev->hw_ops.set_image_window);
         BUG_ON(!dev->hw_ops.get_image_window);
         BUG_ON(!dev->hw_ops.get_line_length);
@@ -1689,11 +1688,12 @@ static long vpfe_param_handler(struct file *file, void *priv,
         struct vpfe_device *vpfe_dev = video_drvdata(file);
         int ret = 0;
 
-        v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, "vpfe_param_handler\n");
+        v4l2_dbg(2, debug, &vpfe_dev->v4l2_dev, "vpfe_param_handler\n");
 
         if (vpfe_dev->started) {
                 /* only allowed if streaming is not started */
-                v4l2_err(&vpfe_dev->v4l2_dev, "device already started\n");
+                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+                        "device already started\n");
                 return -EBUSY;
         }
 
@@ -1705,16 +1705,23 @@ static long vpfe_param_handler(struct file *file, void *priv,
         case VPFE_CMD_S_CCDC_RAW_PARAMS:
                 v4l2_warn(&vpfe_dev->v4l2_dev,
                           "VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n");
-                ret = ccdc_dev->hw_ops.set_params(param);
-                if (ret) {
-                        v4l2_err(&vpfe_dev->v4l2_dev,
-                                "Error in setting parameters in CCDC\n");
-                        goto unlock_out;
-                }
-                if (vpfe_get_ccdc_image_format(vpfe_dev, &vpfe_dev->fmt) < 0) {
-                        v4l2_err(&vpfe_dev->v4l2_dev,
-                                "Invalid image format at CCDC\n");
-                        goto unlock_out;
+                if (ccdc_dev->hw_ops.set_params) {
+                        ret = ccdc_dev->hw_ops.set_params(param);
+                        if (ret) {
+                                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+                                        "Error setting parameters in CCDC\n");
+                                goto unlock_out;
+                        }
+                        if (vpfe_get_ccdc_image_format(vpfe_dev,
+                                                       &vpfe_dev->fmt) < 0) {
+                                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+                                        "Invalid image format at CCDC\n");
+                                goto unlock_out;
+                        }
+                } else {
+                        ret = -EINVAL;
+                        v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+                                "VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
                 }
                 break;
         default:
@@ -1830,7 +1837,7 @@ static __init int vpfe_probe(struct platform_device *pdev)
         if (NULL == ccdc_cfg) {
                 v4l2_err(pdev->dev.driver,
                          "Memory allocation failed for ccdc_cfg\n");
-                goto probe_free_dev_mem;
+                goto probe_free_lock;
         }
 
         strncpy(ccdc_cfg->name, vpfe_cfg->ccdc, 32);
@@ -1982,8 +1989,9 @@ probe_out_video_release:
 probe_out_release_irq:
         free_irq(vpfe_dev->ccdc_irq0, vpfe_dev);
 probe_free_ccdc_cfg_mem:
-        mutex_unlock(&ccdc_lock);
         kfree(ccdc_cfg);
+probe_free_lock:
+        mutex_unlock(&ccdc_lock);
 probe_free_dev_mem:
         kfree(vpfe_dev);
         return ret;
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 38a6e15e096..3dee3e5844b 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -1427,7 +1427,7 @@ static int input_kthread(void *data)
         struct gspca_dev *gspca_dev = (struct gspca_dev *)data;
         struct sd *sd = (struct sd *) gspca_dev;
 
-        DECLARE_WAIT_QUEUE_HEAD(wait);
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wait);
         set_freezable();
         for (;;) {
                 if (kthread_should_stop())
diff --git a/drivers/media/video/gspca/spca508.c b/drivers/media/video/gspca/spca508.c
index 15b2eef8a3f..edf0fe15750 100644
--- a/drivers/media/video/gspca/spca508.c
+++ b/drivers/media/video/gspca/spca508.c
@@ -1513,7 +1513,6 @@ static const struct sd_desc sd_desc = {
 static const __devinitdata struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0130, 0x0130), .driver_info = HamaUSBSightcam},
         {USB_DEVICE(0x041e, 0x4018), .driver_info = CreativeVista},
-        {USB_DEVICE(0x0461, 0x0815), .driver_info = MicroInnovationIC200},
         {USB_DEVICE(0x0733, 0x0110), .driver_info = ViewQuestVQ110},
         {USB_DEVICE(0x0af9, 0x0010), .driver_info = HamaUSBSightcam},
         {USB_DEVICE(0x0af9, 0x0011), .driver_info = HamaUSBSightcam2},
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index dc7f2b0fbc7..b9c80e2103b 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -1053,6 +1053,7 @@ static const __devinitdata struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x401a), .driver_info = Rev072A},
         {USB_DEVICE(0x041e, 0x403b), .driver_info = Rev012A},
         {USB_DEVICE(0x0458, 0x7004), .driver_info = Rev072A},
+        {USB_DEVICE(0x0461, 0x0815), .driver_info = Rev072A},
         {USB_DEVICE(0x046d, 0x0928), .driver_info = Rev012A},
         {USB_DEVICE(0x046d, 0x0929), .driver_info = Rev012A},
         {USB_DEVICE(0x046d, 0x092a), .driver_info = Rev012A},
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx.c b/drivers/media/video/gspca/stv06xx/stv06xx.c
index af73da34c83..14f179a1948 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx.c
+++ b/drivers/media/video/gspca/stv06xx/stv06xx.c
@@ -524,8 +524,6 @@ static const __devinitdata struct usb_device_id device_table[] = {
         {USB_DEVICE(0x046D, 0x08F5), .driver_info = BRIDGE_ST6422 },
         /* QuickCam Messenger (new) */
         {USB_DEVICE(0x046D, 0x08F6), .driver_info = BRIDGE_ST6422 },
-        /* QuickCam Messenger (new) */
-        {USB_DEVICE(0x046D, 0x08DA), .driver_info = BRIDGE_ST6422 },
         {}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
diff --git a/drivers/media/video/hexium_gemini.c b/drivers/media/video/hexium_gemini.c
index e620a3a92f2..ad2c232baa6 100644
--- a/drivers/media/video/hexium_gemini.c
+++ b/drivers/media/video/hexium_gemini.c
@@ -356,9 +356,6 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
 
         DEB_EE((".\n"));
 
-        ret = saa7146_vv_devinit(dev);
-        if (ret)
-                return ret;
         hexium = kzalloc(sizeof(struct hexium), GFP_KERNEL);
         if (NULL == hexium) {
                 printk("hexium_gemini: not enough kernel memory in hexium_attach().\n");
diff --git a/drivers/media/video/hexium_orion.c b/drivers/media/video/hexium_orion.c
index fe596a1c12a..938a1f8f880 100644
--- a/drivers/media/video/hexium_orion.c
+++ b/drivers/media/video/hexium_orion.c
@@ -216,10 +216,6 @@ static int hexium_probe(struct saa7146_dev *dev)
                 return -EFAULT;
         }
 
-        err = saa7146_vv_devinit(dev);
-        if (err)
-                return err;
-
         hexium = kzalloc(sizeof(struct hexium), GFP_KERNEL);
         if (NULL == hexium) {
                 printk("hexium_orion: hexium_probe: not enough kernel memory.\n");
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 3c8ebfcb742..34a66019190 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -49,8 +49,6 @@
 /*
  * CSI registers
  */
-#define DMA_CCR(x)      (0x8c + ((x) << 6))     /* Control Registers */
-#define DMA_DIMR        0x08                    /* Interrupt mask Register */
 #define CSICR1          0x00                    /* CSI Control Register 1 */
 #define CSISR           0x08                    /* CSI Status Register */
 #define CSIRXR          0x10                    /* CSI RxFIFO Register */
@@ -784,7 +782,7 @@ static int __init mx1_camera_probe(struct platform_device *pdev)
                                pcdev);
 
         imx_dma_config_channel(pcdev->dma_chan, IMX_DMA_TYPE_FIFO,
-                               IMX_DMA_MEMSIZE_32, DMA_REQ_CSI_R, 0);
+                               IMX_DMA_MEMSIZE_32, MX1_DMA_REQ_CSI_R, 0);
         /* burst length : 16 words = 64 bytes */
         imx_dma_config_burstlen(pcdev->dma_chan, 0);
 
@@ -798,8 +796,8 @@ static int __init mx1_camera_probe(struct platform_device *pdev)
         set_fiq_handler(&mx1_camera_sof_fiq_start, &mx1_camera_sof_fiq_end -
                                                    &mx1_camera_sof_fiq_start);
 
-        regs.ARM_r8 = DMA_BASE + DMA_DIMR;
-        regs.ARM_r9 = DMA_BASE + DMA_CCR(pcdev->dma_chan);
+        regs.ARM_r8 = (long)MX1_DMA_DIMR;
+        regs.ARM_r9 = (long)MX1_DMA_CCR(pcdev->dma_chan);
         regs.ARM_r10 = (long)pcdev->base + CSICR1;
         regs.ARM_fp = (long)pcdev->base + CSISR;
         regs.ARM_sp = 1 << pcdev->dma_chan;
diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c
index 9f01f14e4aa..ef0c8178f25 100644
--- a/drivers/media/video/mxb.c
+++ b/drivers/media/video/mxb.c
@@ -169,11 +169,7 @@ static struct saa7146_extension extension;
 static int mxb_probe(struct saa7146_dev *dev)
 {
         struct mxb *mxb = NULL;
-        int err;
 
-        err = saa7146_vv_devinit(dev);
-        if (err)
-                return err;
         mxb = kzalloc(sizeof(struct mxb), GFP_KERNEL);
         if (mxb == NULL) {
                 DEB_D(("not enough kernel memory.\n"));
@@ -699,14 +695,17 @@ static struct saa7146_ext_vv vv_data;
 /* this function only gets called when the probing was successful */
 static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info)
 {
-        struct mxb *mxb = (struct mxb *)dev->ext_priv;
+        struct mxb *mxb;
 
         DEB_EE(("dev:%p\n", dev));
 
-        /* checking for i2c-devices can be omitted here, because we
-           already did this in "mxb_vl42_probe" */
-
         saa7146_vv_init(dev, &vv_data);
+        if (mxb_probe(dev)) {
+                saa7146_vv_release(dev);
+                return -1;
+        }
+        mxb = (struct mxb *)dev->ext_priv;
+
         vv_data.ops.vidioc_queryctrl = vidioc_queryctrl;
         vv_data.ops.vidioc_g_ctrl = vidioc_g_ctrl;
         vv_data.ops.vidioc_s_ctrl = vidioc_s_ctrl;
@@ -726,6 +725,7 @@ static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data
         vv_data.ops.vidioc_default = vidioc_default;
         if (saa7146_register_device(&mxb->video_dev, dev, "mxb", VFL_TYPE_GRABBER)) {
                 ERR(("cannot register capture v4l2 device. skipping.\n"));
+                saa7146_vv_release(dev);
                 return -1;
         }
 
@@ -846,7 +846,6 @@ static struct saa7146_extension extension = {
         .pci_tbl        = &pci_tbl[0],
         .module         = THIS_MODULE,
 
-        .probe          = mxb_probe,
         .attach         = mxb_attach,
         .detach         = mxb_detach,
 
diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
index b189fe63394..ce76d952e16 100644
--- a/drivers/media/video/omap24xxcam.c
+++ b/drivers/media/video/omap24xxcam.c
@@ -1405,7 +1405,7 @@ static int omap24xxcam_mmap_buffers(struct file *file,
         }
 
         size = 0;
-        for (i = first; i <= last; i++) {
+        for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) {
                 struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]);
 
                 for (j = 0; j < dma->sglen; j++) {
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 5ecc30daef2..04bf5c11308 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -609,12 +609,9 @@ static void pxa_dma_add_tail_buf(struct pxa_camera_dev *pcdev,
  */
 static void pxa_camera_start_capture(struct pxa_camera_dev *pcdev)
 {
-        unsigned long cicr0, cifr;
+        unsigned long cicr0;
 
         dev_dbg(pcdev->soc_host.v4l2_dev.dev, "%s\n", __func__);
-        /* Reset the FIFOs */
-        cifr = __raw_readl(pcdev->base + CIFR) | CIFR_RESET_F;
-        __raw_writel(cifr, pcdev->base + CIFR);
         /* Enable End-Of-Frame Interrupt */
         cicr0 = __raw_readl(pcdev->base + CICR0) | CICR0_ENB;
         cicr0 &= ~CICR0_EOFM;
@@ -935,7 +932,7 @@ static void pxa_camera_deactivate(struct pxa_camera_dev *pcdev)
 static irqreturn_t pxa_camera_irq(int irq, void *data)
 {
         struct pxa_camera_dev *pcdev = data;
-        unsigned long status, cicr0;
+        unsigned long status, cifr, cicr0;
         struct pxa_buffer *buf;
         struct videobuf_buffer *vb;
 
@@ -949,6 +946,10 @@ static irqreturn_t pxa_camera_irq(int irq, void *data)
         __raw_writel(status, pcdev->base + CISR);
 
         if (status & CISR_EOF) {
+                /* Reset the FIFOs */
+                cifr = __raw_readl(pcdev->base + CIFR) | CIFR_RESET_F;
+                __raw_writel(cifr, pcdev->base + CIFR);
+
                 pcdev->active = list_first_entry(&pcdev->capture,
                                            struct pxa_buffer, vb.queue);
                 vb = &pcdev->active->vb;
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 6e16b397932..1ad980f8e77 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -1633,7 +1633,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
         height = pix->height;
 
         pix->bytesperline = soc_mbus_bytes_per_line(width, xlate->host_fmt);
-        if (pix->bytesperline < 0)
+        if ((int)pix->bytesperline < 0)
                 return pix->bytesperline;
         pix->sizeimage = height * pix->bytesperline;
 
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index a3d5728b644..f2ab025ad97 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -349,6 +349,9 @@ int wm831x_auxadc_read(struct wm831x *wm831x, enum wm831x_auxadc input)
                 goto disable;
         }
 
+        /* If an interrupt arrived late clean up after it */
+        try_wait_for_completion(&wm831x->auxadc_done);
+
         /* Ignore the result to allow us to soldier on without IRQ hookup */
         wait_for_completion_timeout(&wm831x->auxadc_done, msecs_to_jiffies(5));
 
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index e400a3bed06..b5807484b4c 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -363,6 +363,10 @@ int wm8350_read_auxadc(struct wm8350 *wm8350, int channel, int scale, int vref)
         reg |= 1 << channel | WM8350_AUXADC_POLL;
         wm8350_reg_write(wm8350, WM8350_DIGITISER_CONTROL_1, reg);
 
+        /* If a late IRQ left the completion signalled then consume
+         * the completion. */
+        try_wait_for_completion(&wm8350->auxadc_done);
+
         /* We ignore the result of the completion and just check for a
          * conversion result, allowing us to soldier on if the IRQ
          * infrastructure is not set up for the chip. */
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index a6dd7da3735..336d9f553f3 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -314,8 +314,8 @@ static void at91_mci_post_dma_read(struct at91mci_host *host)
                         dmabuf = (unsigned *)tmpv;
                 }
 
+                flush_kernel_dcache_page(sg_page(sg));
                 kunmap_atomic(sgbuffer, KM_BIO_SRC_IRQ);
-                dmac_flush_range((void *)sgbuffer, ((void *)sgbuffer) + amount);
                 data->bytes_xfered += amount;
                 if (size == 0)
                         break;
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 88be37d9e9a..fb279f4ed8b 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -266,7 +266,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                 "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                 cmd->opcode, cmd->arg, cmd->flags,
                                 cmd->resp[0], cmd->resp[1], cmd->resp[2],
-                                cmd->resp[2], cmd->error);
+                                cmd->resp[3], cmd->error);
                 if (data)
                         seq_printf(s, "DATA %u / %u * %u flg %x err %d\n",
                                 data->bytes_xfered, data->blocks,
@@ -276,7 +276,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                 "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                 stop->opcode, stop->arg, stop->flags,
                                 stop->resp[0], stop->resp[1], stop->resp[2],
-                                stop->resp[2], stop->error);
+                                stop->resp[3], stop->error);
         }
 
         spin_unlock_bh(&slot->host->lock);
@@ -569,9 +569,10 @@ static void atmci_dma_cleanup(struct atmel_mci *host)
 {
         struct mmc_data                 *data = host->data;
 
-        dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
-                     ((data->flags & MMC_DATA_WRITE)
-                      ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
+        if (data)
+                dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
+                             ((data->flags & MMC_DATA_WRITE)
+                              ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
 }
 
 static void atmci_stop_dma(struct atmel_mci *host)
@@ -1099,8 +1100,8 @@ static void atmci_command_complete(struct atmel_mci *host,
                         "command error: status=0x%08x\n", status);
 
                 if (cmd->data) {
-                        host->data = NULL;
                         atmci_stop_dma(host);
+                        host->data = NULL;
                         mci_writel(host, IDR, MCI_NOTBUSY
                                         | MCI_TXRDY | MCI_RXRDY
                                         | ATMCI_DATA_ERROR_FLAGS);
@@ -1293,6 +1294,7 @@ static void atmci_tasklet_func(unsigned long priv)
                         } else {
                                 data->bytes_xfered = data->blocks * data->blksz;
                                 data->error = 0;
+                                mci_writel(host, IDR, ATMCI_DATA_ERROR_FLAGS);
                         }
 
                         if (!data->stop) {
@@ -1751,13 +1753,13 @@ static int __init atmci_probe(struct platform_device *pdev)
         ret = -ENODEV;
         if (pdata->slot[0].bus_width) {
                 ret = atmci_init_slot(host, &pdata->slot[0],
-                                MCI_SDCSEL_SLOT_A, 0);
+                                0, MCI_SDCSEL_SLOT_A);
                 if (!ret)
                         nr_slots++;
         }
         if (pdata->slot[1].bus_width) {
                 ret = atmci_init_slot(host, &pdata->slot[1],
-                                MCI_SDCSEL_SLOT_B, 1);
+                                1, MCI_SDCSEL_SLOT_B);
                 if (!ret)
                         nr_slots++;
         }
diff --git a/drivers/mtd/internal.h b/drivers/mtd/internal.h
deleted file mode 100644
index e69de29bb2d..00000000000
--- a/drivers/mtd/internal.h
+++ /dev/null
diff --git a/drivers/mtd/mtdbdi.c b/drivers/mtd/mtdbdi.c
deleted file mode 100644
index e69de29bb2d..00000000000
--- a/drivers/mtd/mtdbdi.c
+++ /dev/null
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 6995169d285..cd17d09f385 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -311,11 +311,6 @@ err:
                 processed++;
         }
 
-        if (processed) {
-                wrw(ep, REG_RXDENQ, processed);
-                wrw(ep, REG_RXSTSENQ, processed);
-        }
-
         return processed;
 }
 
@@ -350,6 +345,11 @@ poll_some_more:
                         goto poll_some_more;
         }
 
+        if (rx) {
+                wrw(ep, REG_RXDENQ, rx);
+                wrw(ep, REG_RXSTSENQ, rx);
+        }
+
         return rx;
 }
 
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index fb8fc7d1b50..dbf81788bb4 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4633,6 +4633,9 @@ static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
         reg16 &= ~state;
         pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
 
+        if (!pdev->bus->self)
+                return;
+
         pos = pci_pcie_cap(pdev->bus->self);
         pci_read_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, &reg16);
         reg16 &= ~state;
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 9f98c1c4a34..9b4e8f797a7 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1653,7 +1653,7 @@ fec_set_mac_address(struct net_device *dev, void *p)
                 (dev->dev_addr[1] << 16) | (dev->dev_addr[0] << 24),
                 fep->hwp + FEC_ADDR_LOW);
         writel((dev->dev_addr[5] << 16) | (dev->dev_addr[4] << 24),
-                fep + FEC_ADDR_HIGH);
+                fep->hwp + FEC_ADDR_HIGH);
         return 0;
 }
 
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 4e97ca18299..5d3763fb347 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1649,6 +1649,7 @@ static void free_skb_resources(struct gfar_private *priv)
                         sizeof(struct rxbd8) * priv->total_rx_ring_size,
                         priv->tx_queue[0]->tx_bd_base,
                         priv->tx_queue[0]->tx_bd_dma_base);
+        skb_queue_purge(&priv->rx_recycle);
 }
 
 void gfar_start(struct net_device *dev)
@@ -2088,7 +2089,6 @@ static int gfar_close(struct net_device *dev)
 
         disable_napi(priv);
 
-        skb_queue_purge(&priv->rx_recycle);
         cancel_work_sync(&priv->reset_task);
         stop_gfar(dev);
 
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index fc5938ba3d7..a527e37728c 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -88,6 +88,11 @@ config LSI_ET1011C_PHY
         ---help---
           Supports the LSI ET1011C PHY.
 
+config MICREL_PHY
+        tristate "Driver for Micrel PHYs"
+        ---help---
+          Supports the KSZ9021, VSC8201, KS8001 PHYs.
+
 config FIXED_PHY
         bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
         depends on PHYLIB=y
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 1342585af38..13bebab65d0 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -20,4 +20,5 @@ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
 obj-$(CONFIG_MDIO_GPIO)         += mdio-gpio.o
 obj-$(CONFIG_NATIONAL_PHY)      += national.o
 obj-$(CONFIG_STE10XP)           += ste10Xp.o
+obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c
index a872aea4ed7..f443d43edd8 100644
--- a/drivers/net/phy/mdio-octeon.c
+++ b/drivers/net/phy/mdio-octeon.c
@@ -88,6 +88,7 @@ static int octeon_mdiobus_write(struct mii_bus *bus, int phy_id,
 static int __init octeon_mdiobus_probe(struct platform_device *pdev)
 {
         struct octeon_mdiobus *bus;
+        union cvmx_smix_en smi_en;
         int i;
         int err = -ENOENT;
 
@@ -103,6 +104,10 @@ static int __init octeon_mdiobus_probe(struct platform_device *pdev)
         if (!bus->mii_bus)
                 goto err;
 
+        smi_en.u64 = 0;
+        smi_en.s.en = 1;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
+
         /*
          * Standard Octeon evaluation boards don't support phy
          * interrupts, we need to poll.
@@ -133,17 +138,22 @@ err_register:
 
 err:
         devm_kfree(&pdev->dev, bus);
+        smi_en.u64 = 0;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
         return err;
 }
 
 static int __exit octeon_mdiobus_remove(struct platform_device *pdev)
 {
         struct octeon_mdiobus *bus;
+        union cvmx_smix_en smi_en;
 
         bus = dev_get_drvdata(&pdev->dev);
 
         mdiobus_unregister(bus->mii_bus);
         mdiobus_free(bus->mii_bus);
+        smi_en.u64 = 0;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
         return 0;
 }
 
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
new file mode 100644
index 00000000000..e67691dca4a
--- /dev/null
+++ b/drivers/net/phy/micrel.c
@@ -0,0 +1,105 @@
+/*
+ * drivers/net/phy/micrel.c
+ *
+ * Driver for Micrel PHYs
+ *
+ * Author: David J. Choi
+ *
+ * Copyright (c) 2010 Micrel, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ * Support : ksz9021 , vsc8201, ks8001
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/phy.h>
+
+#define PHY_ID_KSZ9021                  0x00221611
+#define PHY_ID_VSC8201                  0x000FC413
+#define PHY_ID_KS8001                   0x0022161A
+
+
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        return 0;
+}
+
+
+static struct phy_driver ks8001_driver = {
+        .phy_id         = PHY_ID_KS8001,
+        .name           = "Micrel KS8001",
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver vsc8201_driver = {
+        .phy_id         = PHY_ID_VSC8201,
+        .name           = "Micrel VSC8201",
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver ksz9021_driver = {
+        .phy_id         = PHY_ID_KSZ9021,
+        .phy_id_mask    = 0x000fff10,
+        .name           = "Micrel KSZ9021 Gigabit PHY",
+        .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE, },
+};
+
+static int __init ksphy_init(void)
+{
+        int ret;
+
+        ret = phy_driver_register(&ks8001_driver);
+        if (ret)
+                goto err1;
+        ret = phy_driver_register(&vsc8201_driver);
+        if (ret)
+                goto err2;
+
+        ret = phy_driver_register(&ksz9021_driver);
+        if (ret)
+                goto err3;
+        return 0;
+
+err3:
+        phy_driver_unregister(&vsc8201_driver);
+err2:
+        phy_driver_unregister(&ks8001_driver);
+err1:
+        return ret;
+}
+
+static void __exit ksphy_exit(void)
+{
+        phy_driver_unregister(&ks8001_driver);
+        phy_driver_unregister(&vsc8201_driver);
+        phy_driver_unregister(&ksz9021_driver);
+}
+
+module_init(ksphy_init);
+module_exit(ksphy_exit);
+
+MODULE_DESCRIPTION("Micrel PHY driver");
+MODULE_AUTHOR("David J. Choi");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6e281bc825e..8518a2e58e5 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -405,6 +405,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
         DECLARE_WAITQUEUE(wait, current);
         ssize_t ret;
         struct sk_buff *skb = NULL;
+        struct iovec iov;
 
         ret = count;
 
@@ -448,7 +449,9 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
         if (skb->len > count)
                 goto outf;
         ret = -EFAULT;
-        if (copy_to_user(buf, skb->data, skb->len))
+        iov.iov_base = buf;
+        iov.iov_len = count;
+        if (skb_copy_datagram_iovec(skb, 0, &iov, skb->len))
                 goto outf;
         ret = skb->len;
 
@@ -1567,13 +1570,22 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
         struct channel *pch = chan->ppp;
         int proto;
 
-        if (!pch || skb->len == 0) {
+        if (!pch) {
                 kfree_skb(skb);
                 return;
         }
 
-        proto = PPP_PROTO(skb);
         read_lock_bh(&pch->upl);
+        if (!pskb_may_pull(skb, 2)) {
+                kfree_skb(skb);
+                if (pch->ppp) {
+                        ++pch->ppp->dev->stats.rx_length_errors;
+                        ppp_receive_error(pch->ppp);
+                }
+                goto done;
+        }
+
+        proto = PPP_PROTO(skb);
         if (!pch->ppp || proto >= 0xc000 || proto == PPP_CCPFRAG) {
                 /* put it on the channel queue */
                 skb_queue_tail(&pch->file.rq, skb);
@@ -1585,6 +1597,8 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
         } else {
                 ppp_do_recv(pch->ppp, skb, pch);
         }
+
+done:
         read_unlock_bh(&pch->upl);
 }
 
@@ -1617,7 +1631,8 @@ ppp_input_error(struct ppp_channel *chan, int code)
 static void
 ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
-        if (pskb_may_pull(skb, 2)) {
+        /* note: a 0-length skb is used as an error indication */
+        if (skb->len > 0) {
 #ifdef CONFIG_PPP_MULTILINK
                 /* XXX do channel-level decompression here */
                 if (PPP_PROTO(skb) == PPP_MP)
@@ -1625,15 +1640,10 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
                 else
 #endif /* CONFIG_PPP_MULTILINK */
                         ppp_receive_nonmp_frame(ppp, skb);
-                return;
+        } else {
+                kfree_skb(skb);
+                ppp_receive_error(ppp);
         }
-
-        if (skb->len > 0)
-                /* note: a 0-length skb is used as an error indication */
-                ++ppp->dev->stats.rx_length_errors;
-
-        kfree_skb(skb);
-        ppp_receive_error(ppp);
 }
 
 static void
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 4748c21eb72..dd8106ff35a 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1042,14 +1042,14 @@ static void rtl8169_vlan_rx_register(struct net_device *dev,
 }
 
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
         u32 opts2 = le32_to_cpu(desc->opts2);
         struct vlan_group *vlgrp = tp->vlgrp;
         int ret;
 
         if (vlgrp && (opts2 & RxVlanTag)) {
-                vlan_hwaccel_receive_skb(skb, vlgrp, swab16(opts2 & 0xffff));
+                __vlan_hwaccel_rx(skb, vlgrp, swab16(opts2 & 0xffff), polling);
                 ret = 0;
         } else
                 ret = -1;
@@ -1066,7 +1066,7 @@ static inline u32 rtl8169_tx_vlan_tag(struct rtl8169_private *tp,
 }
 
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
         return -1;
 }
@@ -4445,12 +4445,20 @@ out:
         return done;
 }
 
+/*
+ * Warning : rtl8169_rx_interrupt() might be called :
+ * 1) from NAPI (softirq) context
+ *      (polling = 1 : we should call netif_receive_skb())
+ * 2) from process context (rtl8169_reset_task())
+ *      (polling = 0 : we must call netif_rx() instead)
+ */
 static int rtl8169_rx_interrupt(struct net_device *dev,
                                 struct rtl8169_private *tp,
                                 void __iomem *ioaddr, u32 budget)
 {
         unsigned int cur_rx, rx_left;
         unsigned int delta, count;
+        int polling = (budget != ~(u32)0) ? 1 : 0;
 
         cur_rx = tp->cur_rx;
         rx_left = NUM_RX_DESC + tp->dirty_rx - cur_rx;
@@ -4512,8 +4520,12 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                         skb_put(skb, pkt_size);
                         skb->protocol = eth_type_trans(skb, dev);
 
-                        if (rtl8169_rx_vlan_skb(tp, desc, skb) < 0)
-                                netif_receive_skb(skb);
+                        if (rtl8169_rx_vlan_skb(tp, desc, skb, polling) < 0) {
+                                if (likely(polling))
+                                        netif_receive_skb(skb);
+                                else
+                                        netif_rx(skb);
+                        }
 
                         dev->stats.rx_bytes += pkt_size;
                         dev->stats.rx_packets++;
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 9944e5d662c..04efc0c1bda 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2353,17 +2353,36 @@ static int sbmac_init(struct platform_device *pldev, long long base)
 
         sc->mii_bus = mdiobus_alloc();
         if (sc->mii_bus == NULL) {
-                sbmac_uninitctx(sc);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto uninit_ctx;
         }
 
+        sc->mii_bus->name = sbmac_mdio_string;
+        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
+        sc->mii_bus->priv = sc;
+        sc->mii_bus->read = sbmac_mii_read;
+        sc->mii_bus->write = sbmac_mii_write;
+        sc->mii_bus->irq = sc->phy_irq;
+        for (i = 0; i < PHY_MAX_ADDR; ++i)
+                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
+
+        sc->mii_bus->parent = &pldev->dev;
+        /*
+         * Probe PHY address
+         */
+        err = mdiobus_register(sc->mii_bus);
+        if (err) {
+                printk(KERN_ERR "%s: unable to register MDIO bus\n",
+                       dev->name);
+                goto free_mdio;
+        }
+        dev_set_drvdata(&pldev->dev, sc->mii_bus);
+
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR "%s.%d: unable to register netdev\n",
                        sbmac_string, idx);
-                mdiobus_free(sc->mii_bus);
-                sbmac_uninitctx(sc);
-                return err;
+                goto unreg_mdio;
         }
 
         pr_info("%s.%d: registered as %s\n", sbmac_string, idx, dev->name);
@@ -2379,19 +2398,15 @@ static int sbmac_init(struct platform_device *pldev, long long base)
         pr_info("%s: SiByte Ethernet at 0x%08Lx, address: %pM\n",
                dev->name, base, eaddr);
 
-        sc->mii_bus->name = sbmac_mdio_string;
-        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
-        sc->mii_bus->priv = sc;
-        sc->mii_bus->read = sbmac_mii_read;
-        sc->mii_bus->write = sbmac_mii_write;
-        sc->mii_bus->irq = sc->phy_irq;
-        for (i = 0; i < PHY_MAX_ADDR; ++i)
-                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
-
-        sc->mii_bus->parent = &pldev->dev;
-        dev_set_drvdata(&pldev->dev, sc->mii_bus);
-
         return 0;
+unreg_mdio:
+        mdiobus_unregister(sc->mii_bus);
+        dev_set_drvdata(&pldev->dev, NULL);
+free_mdio:
+        mdiobus_free(sc->mii_bus);
+uninit_ctx:
+        sbmac_uninitctx(sc);
+        return err;
 }
 
 
@@ -2417,16 +2432,6 @@ static int sbmac_open(struct net_device *dev)
                 goto out_err;
         }
 
-        /*
-         * Probe PHY address
-         */
-        err = mdiobus_register(sc->mii_bus);
-        if (err) {
-                printk(KERN_ERR "%s: unable to register MDIO bus\n",
-                       dev->name);
-                goto out_unirq;
-        }
-
         sc->sbm_speed = sbmac_speed_none;
         sc->sbm_duplex = sbmac_duplex_none;
         sc->sbm_fc = sbmac_fc_none;
@@ -2457,11 +2462,7 @@ static int sbmac_open(struct net_device *dev)
         return 0;
 
 out_unregister:
-        mdiobus_unregister(sc->mii_bus);
-
-out_unirq:
         free_irq(dev->irq, dev);
-
 out_err:
         return err;
 }
@@ -2650,9 +2651,6 @@ static int sbmac_close(struct net_device *dev)
 
         phy_disconnect(sc->phy_dev);
         sc->phy_dev = NULL;
-
-        mdiobus_unregister(sc->mii_bus);
-
         free_irq(dev->irq, dev);
 
         sbdma_emptyring(&(sc->sbm_txdma));
@@ -2760,6 +2758,7 @@ static int __exit sbmac_remove(struct platform_device *pldev)
 
         unregister_netdev(dev);
         sbmac_uninitctx(sc);
+        mdiobus_unregister(sc->mii_bus);
         mdiobus_free(sc->mii_bus);
         iounmap(sc->sbm_base);
         free_netdev(dev);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 5d58abc224f..d7b7018a1de 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -400,7 +400,6 @@ config USB_IPHETH
 config USB_SIERRA_NET
         tristate "USB-to-WWAN Driver for Sierra Wireless modems"
         depends on USB_USBNET
-        default y
         help
           Choose this option if you have a Sierra Wireless USB-to-WWAN device.
 
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 04b281002a7..5dfed9297b2 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -240,7 +240,7 @@ static int dm_write_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 valu
                 goto out;
 
         dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
-        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
+        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
 
         for (i = 0; i < DM_TIMEOUT; i++) {
                 u8 tmp;
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index a44f9e0ea09..f1942d69a0d 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -789,6 +789,9 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
         /* prepare sync message from template */
         memcpy(priv->sync_msg, sync_tmplate, sizeof(priv->sync_msg));
 
+        /* initiate the sync sequence */
+        sierra_net_dosync(dev);
+
         return 0;
 }
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index f9f0730b53d..5ec542dd5b5 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -187,7 +187,6 @@ tx_drop:
         return NETDEV_TX_OK;
 
 rx_drop:
-        kfree_skb(skb);
         rcv_stats->rx_dropped++;
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 99a6da464bd..e1c2fcaa8be 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -727,12 +727,16 @@ static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
         struct device *parent = aru->udev->dev.parent;
 
+        complete(&aru->firmware_loading_complete);
+
         /* unbind anything failed */
         if (parent)
                 down(&parent->sem);
         device_release_driver(&aru->udev->dev);
         if (parent)
                 up(&parent->sem);
+
+        usb_put_dev(aru->udev);
 }
 
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
@@ -761,6 +765,8 @@ static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
         if (err)
                 goto err_unrx;
 
+        complete(&aru->firmware_loading_complete);
+        usb_put_dev(aru->udev);
         return;
 
  err_unrx:
@@ -858,6 +864,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         init_usb_anchor(&aru->tx_pending);
         init_usb_anchor(&aru->tx_submitted);
         init_completion(&aru->cmd_wait);
+        init_completion(&aru->firmware_loading_complete);
         spin_lock_init(&aru->tx_urb_lock);
 
         aru->tx_pending_urbs = 0;
@@ -877,6 +884,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         if (err)
                 goto err_freehw;
 
+        usb_get_dev(aru->udev);
         return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
                                        &aru->udev->dev, GFP_KERNEL, aru,
                                        ar9170_usb_firmware_step2);
@@ -896,6 +904,9 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
                 return;
 
         aru->common.state = AR9170_IDLE;
+
+        wait_for_completion(&aru->firmware_loading_complete);
+
         ar9170_unregister(&aru->common);
         ar9170_usb_cancel_urbs(aru);
 
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index a2ce3b169ce..919b06046eb 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -71,6 +71,7 @@ struct ar9170_usb {
         unsigned int tx_pending_urbs;
 
         struct completion cmd_wait;
+        struct completion firmware_loading_complete;
         int readlen;
         u8 *readbuf;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 6383d9f8c9b..f4e59ae07f8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -2621,7 +2621,9 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945           4
 #define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED        0
+#define IWL_GOOD_CRC_TH_DEFAULT         cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER           cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
 #define IWL_MAX_CMD_SIZE 4096
 #define IWL_MAX_PROBE_REQUEST           200
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 12e455a4b90..741e65ec830 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -813,16 +813,29 @@ static void iwl_bg_request_scan(struct work_struct *data)
                         rate = IWL_RATE_1M_PLCP;
                         rate_flags = RATE_MCS_CCK_MSK;
                 }
-                scan->good_CRC_th = 0;
+                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
         } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 band = IEEE80211_BAND_5GHZ;
                 rate = IWL_RATE_6M_PLCP;
                 /*
-                 * If active scaning is requested but a certain channel
-                 * is marked passive, we can do active scanning if we
-                 * detect transmissions.
+                 * If active scanning is requested but a certain channel is
+                 * marked passive, we can do active scanning if we detect
+                 * transmissions.
+                 *
+                 * There is an issue with some firmware versions that triggers
+                 * a sysassert on a "good CRC threshold" of zero (== disabled),
+                 * on a radar channel even though this means that we should NOT
+                 * send probes.
+                 *
+                 * The "good CRC threshold" is the number of frames that we
+                 * need to receive during our dwell time on a channel before
+                 * sending out probes -- setting this to a huge value will
+                 * mean we never reach it, but at the same time work around
+                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_NEVER;
 
                 /* Force use of chains B and C (0x6) for scan Rx for 4965
                  * Avoid A (0x1) because of its off-channel reception on A-band.
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index b55e4f39a9e..b74a56c48d2 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2967,7 +2967,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                  * is marked passive, we can do active scanning if we
                  * detect transmissions.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_DISABLED;
                 band = IEEE80211_BAND_5GHZ;
         } else {
                 IWL_WARN(priv, "Invalid scan band count\n");
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 269fda36283..c24067f1a0c 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
         u32 idx, i;
 
         i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
         idx %= ring_limit;
 
         while (i != idx) {
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 18ecae4a437..b4748337223 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -69,7 +69,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
                 }
 
                 phy = get_phy_device(mdio, be32_to_cpup(addr));
-                if (!phy) {
+                if (!phy || IS_ERR(phy)) {
                         dev_err(&mdio->dev, "error probing PHY at address %i\n",
                                 *addr);
                         continue;
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 4fe36d2e104..19b111383f6 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -838,65 +838,11 @@ static void pci_bus_dump_resources(struct pci_bus *bus)
         }
 }
 
-static int __init pci_bus_get_depth(struct pci_bus *bus)
-{
-        int depth = 0;
-        struct pci_dev *dev;
-
-        list_for_each_entry(dev, &bus->devices, bus_list) {
-                int ret;
-                struct pci_bus *b = dev->subordinate;
-                if (!b)
-                        continue;
-
-                ret = pci_bus_get_depth(b);
-                if (ret + 1 > depth)
-                        depth = ret + 1;
-        }
-
-        return depth;
-}
-static int __init pci_get_max_depth(void)
-{
-        int depth = 0;
-        struct pci_bus *bus;
-
-        list_for_each_entry(bus, &pci_root_buses, node) {
-                int ret;
-
-                ret = pci_bus_get_depth(bus);
-                if (ret > depth)
-                        depth = ret;
-        }
-
-        return depth;
-}
-
-/*
- * first try will not touch pci bridge res
- * second  and later try will clear small leaf bridge res
- * will stop till to the max  deepth if can not find good one
- */
 void __init
 pci_assign_unassigned_resources(void)
 {
         struct pci_bus *bus;
-        int tried_times = 0;
-        enum release_type rel_type = leaf_only;
-        struct resource_list_x head, *list;
-        unsigned long type_mask = IORESOURCE_IO | IORESOURCE_MEM |
-                                  IORESOURCE_PREFETCH;
-        unsigned long failed_type;
-        int max_depth = pci_get_max_depth();
-        int pci_try_num;
 
-        head.next = NULL;
-
-        pci_try_num = max_depth + 1;
-        printk(KERN_DEBUG "PCI: max bus depth: %d pci_try_num: %d\n",
-                 max_depth, pci_try_num);
-
-again:
         /* Depth first, calculate sizes and alignments of all
            subordinate buses. */
         list_for_each_entry(bus, &pci_root_buses, node) {
@@ -904,65 +850,9 @@ again:
         }
         /* Depth last, allocate resources and update the hardware. */
         list_for_each_entry(bus, &pci_root_buses, node) {
-                __pci_bus_assign_resources(bus, &head);
-        }
-        tried_times++;
-
-        /* any device complain? */
-        if (!head.next)
-                goto enable_and_dump;
-        failed_type = 0;
-        for (list = head.next; list;) {
-                failed_type |= list->flags;
-                list = list->next;
-        }
-        /*
-         * io port are tight, don't try extra
-         * or if reach the limit, don't want to try more
-         */
-        failed_type &= type_mask;
-        if ((failed_type == IORESOURCE_IO) || (tried_times >= pci_try_num)) {
-                free_failed_list(&head);
-                goto enable_and_dump;
-        }
-
-        printk(KERN_DEBUG "PCI: No. %d try to assign unassigned res\n",
-                         tried_times + 1);
-
-        /* third times and later will not check if it is leaf */
-        if ((tried_times + 1) > 2)
-                rel_type = whole_subtree;
-
-        /*
-         * Try to release leaf bridge's resources that doesn't fit resource of
-         * child device under that bridge
-         */
-        for (list = head.next; list;) {
-                bus = list->dev->bus;
-                pci_bus_release_bridge_resources(bus, list->flags & type_mask,
-                                                  rel_type);
-                list = list->next;
-        }
-        /* restore size and flags */
-        for (list = head.next; list;) {
-                struct resource *res = list->res;
-
-                res->start = list->start;
-                res->end = list->end;
-                res->flags = list->flags;
-                if (list->dev->subordinate)
-                        res->flags = 0;
-
-                list = list->next;
-        }
-        free_failed_list(&head);
-
-        goto again;
-
-enable_and_dump:
-        /* Depth last, update the hardware. */
-        list_for_each_entry(bus, &pci_root_buses, node)
+                pci_bus_assign_resources(bus);
                 pci_enable_bridges(bus);
+        }
 
         /* dump the resource on buses */
         list_for_each_entry(bus, &pci_root_buses, node) {
diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index 75ed866e695..c3383750e33 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -671,20 +671,22 @@ static int pccardd(void *__skt)
                                 socket_remove(skt);
                         if (sysfs_events & PCMCIA_UEVENT_INSERT)
                                 socket_insert(skt);
-                        if ((sysfs_events & PCMCIA_UEVENT_RESUME) &&
-                                !(skt->state & SOCKET_CARDBUS)) {
-                                ret = socket_resume(skt);
-                                if (!ret && skt->callback)
-                                        skt->callback->resume(skt);
-                        }
                         if ((sysfs_events & PCMCIA_UEVENT_SUSPEND) &&
                                 !(skt->state & SOCKET_CARDBUS)) {
                                 if (skt->callback)
                                         ret = skt->callback->suspend(skt);
                                 else
                                         ret = 0;
-                                if (!ret)
+                                if (!ret) {
                                         socket_suspend(skt);
+                                        msleep(100);
+                                }
+                        }
+                        if ((sysfs_events & PCMCIA_UEVENT_RESUME) &&
+                                !(skt->state & SOCKET_CARDBUS)) {
+                                ret = socket_resume(skt);
+                                if (!ret && skt->callback)
+                                        skt->callback->resume(skt);
                         }
                         if ((sysfs_events & PCMCIA_UEVENT_REQUERY) &&
                                 !(skt->state & SOCKET_CARDBUS)) {
diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c
index 2d48196a48c..0f4cc3f0002 100644
--- a/drivers/pcmcia/db1xxx_ss.c
+++ b/drivers/pcmcia/db1xxx_ss.c
@@ -146,7 +146,6 @@ static irqreturn_t db1200_pcmcia_cdirq(int irq, void *data)
 static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
 {
         int ret;
-        unsigned long flags;
 
         if (sock->stschg_irq != -1) {
                 ret = request_irq(sock->stschg_irq, db1000_pcmcia_stschgirq,
@@ -162,30 +161,23 @@ static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
          * active one disabled.
          */
         if (sock->board_type == BOARD_TYPE_DB1200) {
-                local_irq_save(flags);
-
                 ret = request_irq(sock->insert_irq, db1200_pcmcia_cdirq,
                                   IRQF_DISABLED, "pcmcia_insert", sock);
-                if (ret) {
-                        local_irq_restore(flags);
+                if (ret)
                         goto out1;
-                }
 
                 ret = request_irq(sock->eject_irq, db1200_pcmcia_cdirq,
                                   IRQF_DISABLED, "pcmcia_eject", sock);
                 if (ret) {
                         free_irq(sock->insert_irq, sock);
-                        local_irq_restore(flags);
                         goto out1;
                 }
 
-                /* disable the currently active one */
+                /* enable the currently silent one */
                 if (db1200_card_inserted(sock))
-                        disable_irq_nosync(sock->insert_irq);
+                        enable_irq(sock->eject_irq);
                 else
-                        disable_irq_nosync(sock->eject_irq);
-
-                local_irq_restore(flags);
+                        enable_irq(sock->insert_irq);
         } else {
                 /* all other (older) Db1x00 boards use a GPIO to show
                  * card detection status:  use both-edge triggers.
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 508f94a2a78..041eee43fd8 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -1283,6 +1283,7 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
                         destroy_cis_cache(skt);
                         kfree(skt->fake_cis);
                         skt->fake_cis = NULL;
+                        s->functions = 0;
                         mutex_unlock(&s->ops_mutex);
                         /* now, add the new card */
                         ds_event(skt, CS_EVENT_CARD_INSERTION,
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index 104e73d5d86..7631faa0cad 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -711,7 +711,7 @@ static int ds_open(struct inode *inode, struct file *file)
             warning_printed = 1;
     }
 
-    if (s->pcmcia_state.present)
+    if (atomic_read(&s->present))
         queue_event(user, CS_EVENT_CARD_INSERTION);
 out:
     unlock_kernel();
@@ -770,9 +770,6 @@ static ssize_t ds_read(struct file *file, char __user *buf,
         return -EIO;
 
     s = user->socket;
-    if (s->pcmcia_state.dead)
-        return -EIO;
-
     ret = wait_event_interruptible(s->queue, !queue_empty(user));
     if (ret == 0)
         ret = put_user(get_queued_event(user), (int __user *)buf) ? -EFAULT : 4;
@@ -838,8 +835,6 @@ static int ds_ioctl(struct inode *inode, struct file *file,
         return -EIO;
 
     s = user->socket;
-    if (s->pcmcia_state.dead)
-        return -EIO;
 
     size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
     if (size > sizeof(ds_ioctl_arg_t))
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 35bb44af49b..100e4d9372f 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -274,26 +274,6 @@ static void pnpacpi_parse_allocated_busresource(struct pnp_dev *dev,
         pnp_add_bus_resource(dev, start, end);
 }
 
-static u64 addr_space_length(struct pnp_dev *dev, u64 min, u64 max, u64 len)
-{
-        u64 max_len;
-
-        max_len = max - min + 1;
-        if (len <= max_len)
-                return len;
-
-        /*
-         * Per 6.4.3.5, _LEN cannot exceed _MAX - _MIN + 1, but some BIOSes
-         * don't do this correctly, e.g.,
-         * https://bugzilla.kernel.org/show_bug.cgi?id=15480
-         */
-        dev_info(&dev->dev,
-                 "resource length %#llx doesn't fit in %#llx-%#llx, trimming\n",
-                 (unsigned long long) len, (unsigned long long) min,
-                 (unsigned long long) max);
-        return max_len;
-}
-
 static void pnpacpi_parse_allocated_address_space(struct pnp_dev *dev,
                                                   struct acpi_resource *res)
 {
@@ -309,7 +289,8 @@ static void pnpacpi_parse_allocated_address_space(struct pnp_dev *dev,
                 return;
         }
 
-        len = addr_space_length(dev, p->minimum, p->maximum, p->address_length);
+        /* Windows apparently computes length rather than using _LEN */
+        len = p->maximum - p->minimum + 1;
         window = (p->producer_consumer == ACPI_PRODUCER) ? 1 : 0;
 
         if (p->resource_type == ACPI_MEMORY_RANGE)
@@ -330,7 +311,8 @@ static void pnpacpi_parse_allocated_ext_address_space(struct pnp_dev *dev,
         int window;
         u64 len;
 
-        len = addr_space_length(dev, p->minimum, p->maximum, p->address_length);
+        /* Windows apparently computes length rather than using _LEN */
+        len = p->maximum - p->minimum + 1;
         window = (p->producer_consumer == ACPI_PRODUCER) ? 1 : 0;
 
         if (p->resource_type == ACPI_MEMORY_RANGE)
diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
index 2e54e6a23c7..e3446ab8b56 100644
--- a/drivers/pnp/resource.c
+++ b/drivers/pnp/resource.c
@@ -211,6 +211,8 @@ int pnp_check_port(struct pnp_dev *dev, struct resource *res)
                         if (tres->flags & IORESOURCE_IO) {
                                 if (cannot_compare(tres->flags))
                                         continue;
+                                if (tres->flags & IORESOURCE_WINDOW)
+                                        continue;
                                 tport = &tres->start;
                                 tend = &tres->end;
                                 if (ranged_conflict(port, end, tport, tend))
@@ -271,6 +273,8 @@ int pnp_check_mem(struct pnp_dev *dev, struct resource *res)
                         if (tres->flags & IORESOURCE_MEM) {
                                 if (cannot_compare(tres->flags))
                                         continue;
+                                if (tres->flags & IORESOURCE_WINDOW)
+                                        continue;
                                 taddr = &tres->start;
                                 tend = &tres->end;
                                 if (ranged_conflict(addr, end, taddr, tend))
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index acf222f91f5..fa2339cb168 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -37,6 +37,9 @@
  */
 #define DASD_CHANQ_MAX_SIZE 4
 
+#define DASD_SLEEPON_START_TAG  (void *) 1
+#define DASD_SLEEPON_END_TAG    (void *) 2
+
 /*
  * SECTION: exported variables of dasd.c
  */
@@ -1472,7 +1475,10 @@ void dasd_add_request_tail(struct dasd_ccw_req *cqr)
  */
 static void dasd_wakeup_cb(struct dasd_ccw_req *cqr, void *data)
 {
-        wake_up((wait_queue_head_t *) data);
+        spin_lock_irq(get_ccwdev_lock(cqr->startdev->cdev));
+        cqr->callback_data = DASD_SLEEPON_END_TAG;
+        spin_unlock_irq(get_ccwdev_lock(cqr->startdev->cdev));
+        wake_up(&generic_waitq);
 }
 
 static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
@@ -1482,10 +1488,7 @@ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
 
         device = cqr->startdev;
         spin_lock_irq(get_ccwdev_lock(device->cdev));
-        rc = ((cqr->status == DASD_CQR_DONE ||
-               cqr->status == DASD_CQR_NEED_ERP ||
-               cqr->status == DASD_CQR_TERMINATED) &&
-              list_empty(&cqr->devlist));
+        rc = (cqr->callback_data == DASD_SLEEPON_END_TAG);
         spin_unlock_irq(get_ccwdev_lock(device->cdev));
         return rc;
 }
@@ -1573,7 +1576,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
                         wait_event(generic_waitq, !(device->stopped));
 
                 cqr->callback = dasd_wakeup_cb;
-                cqr->callback_data = (void *) &generic_waitq;
+                cqr->callback_data = DASD_SLEEPON_START_TAG;
                 dasd_add_request_tail(cqr);
                 if (interruptible) {
                         rc = wait_event_interruptible(
@@ -1652,7 +1655,7 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
         }
 
         cqr->callback = dasd_wakeup_cb;
-        cqr->callback_data = (void *) &generic_waitq;
+        cqr->callback_data = DASD_SLEEPON_START_TAG;
         cqr->status = DASD_CQR_QUEUED;
         list_add(&cqr->devlist, &device->ccw_queue);
 
diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 9201afe6560..7f87979da22 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -4724,6 +4724,10 @@ static ushort AscInitMicroCodeVar(ASC_DVC_VAR *asc_dvc)
         BUG_ON((unsigned long)asc_dvc->overrun_buf & 7);
         asc_dvc->overrun_dma = dma_map_single(board->dev, asc_dvc->overrun_buf,
                                         ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
+        if (dma_mapping_error(board->dev, asc_dvc->overrun_dma)) {
+                warn_code = -ENOMEM;
+                goto err_dma_map;
+        }
         phy_addr = cpu_to_le32(asc_dvc->overrun_dma);
         AscMemDWordCopyPtrToLram(iop_base, ASCV_OVERRUN_PADDR_D,
                                  (uchar *)&phy_addr, 1);
@@ -4739,14 +4743,23 @@ static ushort AscInitMicroCodeVar(ASC_DVC_VAR *asc_dvc)
         AscSetPCAddr(iop_base, ASC_MCODE_START_ADDR);
         if (AscGetPCAddr(iop_base) != ASC_MCODE_START_ADDR) {
                 asc_dvc->err_code |= ASC_IERR_SET_PC_ADDR;
-                return warn_code;
+                warn_code = UW_ERR;
+                goto err_mcode_start;
         }
         if (AscStartChip(iop_base) != 1) {
                 asc_dvc->err_code |= ASC_IERR_START_STOP_CHIP;
-                return warn_code;
+                warn_code = UW_ERR;
+                goto err_mcode_start;
         }
 
         return warn_code;
+
+err_mcode_start:
+        dma_unmap_single(board->dev, asc_dvc->overrun_dma,
+                         ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
+err_dma_map:
+        asc_dvc->overrun_dma = 0;
+        return warn_code;
 }
 
 static ushort AscInitAsc1000Driver(ASC_DVC_VAR *asc_dvc)
@@ -4802,6 +4815,8 @@ static ushort AscInitAsc1000Driver(ASC_DVC_VAR *asc_dvc)
         }
         release_firmware(fw);
         warn_code |= AscInitMicroCodeVar(asc_dvc);
+        if (!asc_dvc->overrun_dma)
+                return warn_code;
         asc_dvc->init_state |= ASC_INIT_STATE_END_LOAD_MC;
         AscEnableInterrupt(iop_base);
         return warn_code;
@@ -7978,9 +7993,10 @@ static int advansys_reset(struct scsi_cmnd *scp)
                 status = AscInitAsc1000Driver(asc_dvc);
 
                 /* Refer to ASC_IERR_* definitions for meaning of 'err_code'. */
-                if (asc_dvc->err_code) {
+                if (asc_dvc->err_code || !asc_dvc->overrun_dma) {
                         scmd_printk(KERN_INFO, scp, "SCSI bus reset error: "
-                                    "0x%x\n", asc_dvc->err_code);
+                                    "0x%x, status: 0x%x\n", asc_dvc->err_code,
+                                    status);
                         ret = FAILED;
                 } else if (status) {
                         scmd_printk(KERN_INFO, scp, "SCSI bus reset warning: "
@@ -12311,7 +12327,7 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
                 asc_dvc_varp->overrun_buf = kzalloc(ASC_OVERRUN_BSIZE, GFP_KERNEL);
                 if (!asc_dvc_varp->overrun_buf) {
                         ret = -ENOMEM;
-                        goto err_free_wide_mem;
+                        goto err_free_irq;
                 }
                 warn_code = AscInitAsc1000Driver(asc_dvc_varp);
 
@@ -12320,30 +12336,36 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
                                         "warn 0x%x, error 0x%x\n",
                                         asc_dvc_varp->init_state, warn_code,
                                         asc_dvc_varp->err_code);
-                        if (asc_dvc_varp->err_code) {
+                        if (!asc_dvc_varp->overrun_dma) {
                                 ret = -ENODEV;
-                                kfree(asc_dvc_varp->overrun_buf);
+                                goto err_free_mem;
                         }
                 }
         } else {
-                if (advansys_wide_init_chip(shost))
+                if (advansys_wide_init_chip(shost)) {
                         ret = -ENODEV;
+                        goto err_free_mem;
+                }
         }
 
-        if (ret)
-                goto err_free_wide_mem;
-
         ASC_DBG_PRT_SCSI_HOST(2, shost);
 
         ret = scsi_add_host(shost, boardp->dev);
         if (ret)
-                goto err_free_wide_mem;
+                goto err_free_mem;
 
         scsi_scan_host(shost);
         return 0;
 
- err_free_wide_mem:
-        advansys_wide_free_mem(boardp);
+ err_free_mem:
+        if (ASC_NARROW_BOARD(boardp)) {
+                if (asc_dvc_varp->overrun_dma)
+                        dma_unmap_single(boardp->dev, asc_dvc_varp->overrun_dma,
+                                         ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
+                kfree(asc_dvc_varp->overrun_buf);
+        } else
+                advansys_wide_free_mem(boardp);
+ err_free_irq:
         free_irq(boardp->irq, shost);
  err_free_dma:
 #ifdef CONFIG_ISA
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 6d5ae4474bb..633e0903635 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -471,12 +471,12 @@ static int iscsi_prep_scsi_cmd_pdu(struct iscsi_task *task)
 
         WARN_ON(hdrlength >= 256);
         hdr->hlength = hdrlength & 0xFF;
+        hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
 
         if (session->tt->init_task && session->tt->init_task(task))
                 return -EIO;
 
         task->state = ISCSI_TASK_RUNNING;
-        hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
         session->cmdsn++;
 
         conn->scsicmd_pdus_cnt++;
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index b00efd19aad..88f74467257 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -395,11 +395,15 @@ int sas_ata_init_host_and_port(struct domain_device *found_dev,
 void sas_ata_task_abort(struct sas_task *task)
 {
         struct ata_queued_cmd *qc = task->uldd_task;
+        struct request_queue *q = qc->scsicmd->device->request_queue;
         struct completion *waiting;
+        unsigned long flags;
 
         /* Bounce SCSI-initiated commands to the SCSI EH */
         if (qc->scsicmd) {
+                spin_lock_irqsave(q->queue_lock, flags);
                 blk_abort_request(qc->scsicmd->request);
+                spin_unlock_irqrestore(q->queue_lock, flags);
                 scsi_schedule_eh(qc->scsicmd->device->host);
                 return;
         }
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 2660e1b4569..822835055ce 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -1030,6 +1030,8 @@ int __sas_task_abort(struct sas_task *task)
 void sas_task_abort(struct sas_task *task)
 {
         struct scsi_cmnd *sc = task->uldd_task;
+        struct request_queue *q = sc->device->request_queue;
+        unsigned long flags;
 
         /* Escape for libsas internal commands */
         if (!sc) {
@@ -1044,7 +1046,9 @@ void sas_task_abort(struct sas_task *task)
                 return;
         }
 
+        spin_lock_irqsave(q->queue_lock, flags);
         blk_abort_request(sc->request);
+        spin_unlock_irqrestore(q->queue_lock, flags);
         scsi_schedule_eh(sc->device->host);
 }
 
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 3e10c306de9..3a5bfd10b2c 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -957,7 +957,8 @@ static int resp_start_stop(struct scsi_cmnd * scp,
 static sector_t get_sdebug_capacity(void)
 {
         if (scsi_debug_virtual_gb > 0)
-                return 2048 * 1024 * (sector_t)scsi_debug_virtual_gb;
+                return (sector_t)scsi_debug_virtual_gb *
+                        (1073741824 / scsi_debug_sector_size);
         else
                 return sdebug_store_sectors;
 }
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index d45c69ca573..7ad53fa4276 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -302,7 +302,20 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
                 if (scmd->device->allow_restart &&
                     (sshdr.asc == 0x04) && (sshdr.ascq == 0x02))
                         return FAILED;
-                return SUCCESS;
+
+                if (blk_barrier_rq(scmd->request))
+                        /*
+                         * barrier requests should always retry on UA
+                         * otherwise block will get a spurious error
+                         */
+                        return NEEDS_RETRY;
+                else
+                        /*
+                         * for normal (non barrier) commands, pass the
+                         * UA upwards for a determination in the
+                         * completion functions
+                         */
+                        return SUCCESS;
 
                 /* these three are not supported */
         case COPY_ABORTED:
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 8b827f37b03..de6c60320f6 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1040,6 +1040,7 @@ static void sd_prepare_flush(struct request_queue *q, struct request *rq)
 {
         rq->cmd_type = REQ_TYPE_BLOCK_PC;
         rq->timeout = SD_TIMEOUT;
+        rq->retries = SD_MAX_RETRIES;
         rq->cmd[0] = SYNCHRONIZE_CACHE;
         rq->cmd_len = 10;
 }
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index 24485cc62ff..4822cb50cd0 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -348,6 +348,8 @@ static const struct pnp_device_id pnp_dev_table[] = {
         {       "FUJ02E6",              0       },
         /* Fujitsu Wacom 2FGT Tablet PC device */
         {       "FUJ02E7",              0       },
+        /* Fujitsu Wacom 1FGT Tablet PC device */
+        {       "FUJ02E9",              0       },
         /*
          * LG C1 EXPRESS DUAL (C1-PB11A3) touch screen (actually a FUJ02E6 in
          * disguise)
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 4315b23590b..eacb588a934 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -120,7 +120,8 @@
 #define  MX2_UCR3_RXDMUXSEL      (1<<2)  /* RXD Muxed Input Select, on mx2/mx3 */
 #define  UCR3_INVT       (1<<1)  /* Inverted Infrared transmission */
 #define  UCR3_BPEN       (1<<0)  /* Preset registers enable */
-#define  UCR4_CTSTL_32   (32<<10) /* CTS trigger level (32 chars) */
+#define  UCR4_CTSTL_SHF  10      /* CTS trigger level shift */
+#define  UCR4_CTSTL_MASK 0x3F    /* CTS trigger is 6 bits wide */
 #define  UCR4_INVR       (1<<9)  /* Inverted infrared reception */
 #define  UCR4_ENIRI      (1<<8)  /* Serial infrared interrupt enable */
 #define  UCR4_WKEN       (1<<7)  /* Wake interrupt enable */
@@ -591,6 +592,9 @@ static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
         return 0;
 }
 
+/* half the RX buffer size */
+#define CTSTL 16
+
 static int imx_startup(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
@@ -607,6 +611,10 @@ static int imx_startup(struct uart_port *port)
         if (USE_IRDA(sport))
                 temp |= UCR4_IRSC;
 
+        /* set the trigger level for CTS */
+        temp &= ~(UCR4_CTSTL_MASK<<  UCR4_CTSTL_SHF);
+        temp |= CTSTL<<  UCR4_CTSTL_SHF;
+
         writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
 
         if (USE_IRDA(sport)) {
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 3119fddaedb..02469c31bf0 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -29,39 +29,6 @@
  * kind, whether express or implied.
  */
 
-/* Platform device Usage :
- *
- * Since PSCs can have multiple function, the correct driver for each one
- * is selected by calling mpc52xx_match_psc_function(...). The function
- * handled by this driver is "uart".
- *
- * The driver init all necessary registers to place the PSC in uart mode without
- * DCD. However, the pin multiplexing aren't changed and should be set either
- * by the bootloader or in the platform init code.
- *
- * The idx field must be equal to the PSC index (e.g. 0 for PSC1, 1 for PSC2,
- * and so on). So the PSC1 is mapped to /dev/ttyPSC0, PSC2 to /dev/ttyPSC1 and
- * so on. But be warned, it's an ABSOLUTE REQUIREMENT ! This is needed mainly
- * fpr the console code : without this 1:1 mapping, at early boot time, when we
- * are parsing the kernel args console=ttyPSC?, we wouldn't know which PSC it
- * will be mapped to.
- */
-
-/* OF Platform device Usage :
- *
- * This driver is only used for PSCs configured in uart mode.  The device
- * tree will have a node for each PSC with "mpc52xx-psc-uart" in the compatible
- * list.
- *
- * By default, PSC devices are enumerated in the order they are found.  However
- * a particular PSC number can be forces by adding 'device_no = <port#>'
- * to the device node.
- *
- * The driver init all necessary registers to place the PSC in uart mode without
- * DCD. However, the pin multiplexing aren't changed and should be set either
- * by the bootloader or in the platform init code.
- */
-
 #undef DEBUG
 
 #include <linux/device.h>
@@ -1500,7 +1467,7 @@ mpc52xx_uart_init(void)
         /*
          * Map the PSC FIFO Controller and init if on MPC512x.
          */
-        if (psc_ops->fifoc_init) {
+        if (psc_ops && psc_ops->fifoc_init) {
                 ret = psc_ops->fifoc_init();
                 if (ret)
                         return ret;
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index 4eaa043ca2a..700e10833bf 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -752,8 +752,10 @@ static void pmz_break_ctl(struct uart_port *port, int break_state)
                 uap->curregs[R5] = new_reg;
 
                 /* NOTE: Not subject to 'transmitter active' rule. */
-                if (ZS_IS_ASLEEP(uap))
+                if (ZS_IS_ASLEEP(uap)) {
+                        spin_unlock_irqrestore(&port->lock, flags);
                         return;
+                }
                 write_zsreg(uap, R5, uap->curregs[R5]);
         }
 
diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
index d8356af118a..e0de0d0eede 100644
--- a/drivers/spi/omap2_mcspi.c
+++ b/drivers/spi/omap2_mcspi.c
@@ -204,6 +204,7 @@ static inline void mcspi_write_chconf0(const struct spi_device *spi, u32 val)
 
         cs->chconf0 = val;
         mcspi_write_cs_reg(spi, OMAP2_MCSPI_CHCONF0, val);
+        mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHCONF0);
 }
 
 static void omap2_mcspi_set_dma_req(const struct spi_device *spi,
@@ -532,7 +533,7 @@ omap2_mcspi_txrx_pio(struct spi_device *spi, struct spi_transfer *xfer)
                                         goto out;
                                 }
 #ifdef VERBOSE
-                                dev_dbg(&spi->dev, "write-%d %04x\n",
+                                dev_dbg(&spi->dev, "write-%d %08x\n",
                                                 word_len, *tx);
 #endif
                                 __raw_writel(*tx++, tx_reg);
@@ -550,7 +551,7 @@ omap2_mcspi_txrx_pio(struct spi_device *spi, struct spi_transfer *xfer)
                                         mcspi_write_chconf0(spi, l);
                                 *rx++ = __raw_readl(rx_reg);
 #ifdef VERBOSE
-                                dev_dbg(&spi->dev, "read-%d %04x\n",
+                                dev_dbg(&spi->dev, "read-%d %08x\n",
                                                 word_len, *(rx - 1));
 #endif
                         }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 9ffb0fdbd6f..b3a1f9259b6 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -41,7 +41,7 @@ static void spidev_release(struct device *dev)
                 spi->master->cleanup(spi);
 
         spi_master_put(spi->master);
-        kfree(dev);
+        kfree(spi);
 }
 
 static ssize_t
@@ -257,6 +257,7 @@ int spi_add_device(struct spi_device *spi)
 {
         static DEFINE_MUTEX(spi_add_lock);
         struct device *dev = spi->master->dev.parent;
+        struct device *d;
         int status;
 
         /* Chipselects are numbered 0..max; validate. */
@@ -278,10 +279,11 @@ int spi_add_device(struct spi_device *spi)
          */
         mutex_lock(&spi_add_lock);
 
-        if (bus_find_device_by_name(&spi_bus_type, NULL, dev_name(&spi->dev))
-                        != NULL) {
+        d = bus_find_device_by_name(&spi_bus_type, NULL, dev_name(&spi->dev));
+        if (d != NULL) {
                 dev_err(dev, "chipselect %d already in use\n",
                                 spi->chip_select);
+                put_device(d);
                 status = -EBUSY;
                 goto done;
         }
diff --git a/drivers/staging/dt3155/dt3155_drv.c b/drivers/staging/dt3155/dt3155_drv.c
index e2c44ec6fc4..7ac2c6d8e9a 100644
--- a/drivers/staging/dt3155/dt3155_drv.c
+++ b/drivers/staging/dt3155/dt3155_drv.c
@@ -464,9 +464,9 @@ static void dt3155_init_isr(int minor)
   /* 50/60 Hz should be set before this point but let's make sure it is */
   /* right anyway */
 
-  ReadI2C(dt3155_lbase[ minor ], CONFIG, &i2c_csr2.reg);
+  ReadI2C(dt3155_lbase[ minor ], CSR2, &i2c_csr2.reg);
   i2c_csr2.fld.HZ50 = FORMAT50HZ;
-  WriteI2C(dt3155_lbase[ minor ], CONFIG, i2c_config.reg);
+  WriteI2C(dt3155_lbase[ minor ], CSR2, i2c_csr2.reg);
 
   /* enable busmaster chip, clear flags */
 
diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
index 5d53889fb4a..3a1112d29ae 100644
--- a/drivers/staging/hv/Hv.c
+++ b/drivers/staging/hv/Hv.c
@@ -306,9 +306,9 @@ void HvCleanup(void)
         DPRINT_ENTER(VMBUS);
 
         if (gHvContext.SignalEventBuffer) {
+                kfree(gHvContext.SignalEventBuffer);
                 gHvContext.SignalEventBuffer = NULL;
                 gHvContext.SignalEventParam = NULL;
-                kfree(gHvContext.SignalEventBuffer);
         }
 
         if (gHvContext.HypercallPage) {
diff --git a/drivers/staging/hv/RndisFilter.c b/drivers/staging/hv/RndisFilter.c
index cd2930de217..6704f64c93f 100644
--- a/drivers/staging/hv/RndisFilter.c
+++ b/drivers/staging/hv/RndisFilter.c
@@ -751,6 +751,7 @@ static int RndisFilterOpenDevice(struct rndis_device *Device)
 
         ret = RndisFilterSetPacketFilter(Device,
                                          NDIS_PACKET_TYPE_BROADCAST |
+                                         NDIS_PACKET_TYPE_ALL_MULTICAST |
                                          NDIS_PACKET_TYPE_DIRECTED);
         if (ret == 0)
                 Device->State = RNDIS_DEV_DATAINITIALIZED;
diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
index 2ccb6b93fe4..ab27d9a4446 100644
--- a/drivers/staging/hv/netvsc_drv.c
+++ b/drivers/staging/hv/netvsc_drv.c
@@ -403,8 +403,7 @@ static int netvsc_probe(struct device *device)
         if (!net_drv_obj->Base.OnDeviceAdd)
                 return -1;
 
-        net = alloc_netdev(sizeof(struct net_device_context), "seth%d",
-                           ether_setup);
+        net = alloc_etherdev(sizeof(struct net_device_context));
         if (!net)
                 return -1;
 
diff --git a/drivers/staging/iio/accel/lis3l02dq_core.c b/drivers/staging/iio/accel/lis3l02dq_core.c
index ea76902797b..82e43588e8a 100644
--- a/drivers/staging/iio/accel/lis3l02dq_core.c
+++ b/drivers/staging/iio/accel/lis3l02dq_core.c
@@ -618,7 +618,7 @@ static int lis3l02dq_thresh_handler_th(struct iio_dev *dev_info,
 static void lis3l02dq_thresh_handler_bh_no_check(struct work_struct *work_s)
 {
         struct iio_work_cont *wc
-                = container_of(work_s, struct iio_work_cont, ws_nocheck);
+                = container_of(work_s, struct iio_work_cont, ws);
         struct lis3l02dq_state *st = wc->st;
         u8 t;
 
diff --git a/drivers/staging/iio/accel/lis3l02dq_ring.c b/drivers/staging/iio/accel/lis3l02dq_ring.c
index 93712430e57..a4d97ea0df3 100644
--- a/drivers/staging/iio/accel/lis3l02dq_ring.c
+++ b/drivers/staging/iio/accel/lis3l02dq_ring.c
@@ -493,6 +493,9 @@ int lis3l02dq_probe_trigger(struct iio_dev *indio_dev)
         struct lis3l02dq_state *state = indio_dev->dev_data;
 
         state->trig = iio_allocate_trigger();
+        if (!state->trig)
+                return -ENOMEM;
+
         state->trig->name = kmalloc(IIO_TRIGGER_NAME_LENGTH, GFP_KERNEL);
         if (!state->trig->name) {
                 ret = -ENOMEM;
diff --git a/drivers/staging/iio/adc/max1363_core.c b/drivers/staging/iio/adc/max1363_core.c
index 790d1cc9cdc..773f1d1d9c6 100644
--- a/drivers/staging/iio/adc/max1363_core.c
+++ b/drivers/staging/iio/adc/max1363_core.c
@@ -557,6 +557,7 @@ error_put_reg:
         if (!IS_ERR(st->reg))
                 regulator_put(st->reg);
 error_free_st:
+        i2c_set_clientdata(client, NULL);
         kfree(st);
 
 error_ret:
@@ -574,6 +575,7 @@ static int max1363_remove(struct i2c_client *client)
                 regulator_disable(st->reg);
                 regulator_put(st->reg);
         }
+        i2c_set_clientdata(client, NULL);
         kfree(st);
 
         return 0;
diff --git a/drivers/staging/iio/industrialio-core.c b/drivers/staging/iio/industrialio-core.c
index 37f58f66e49..1d77082c853 100644
--- a/drivers/staging/iio/industrialio-core.c
+++ b/drivers/staging/iio/industrialio-core.c
@@ -537,6 +537,7 @@ static void iio_device_unregister_sysfs(struct iio_dev *dev_info)
         sysfs_remove_group(&dev_info->dev.kobj, dev_info->attrs);
 }
 
+/* Return a negative errno on failure */
 int iio_get_new_idr_val(struct idr *this_idr)
 {
         int ret;
@@ -660,7 +661,7 @@ static int iio_device_register_eventset(struct iio_dev *dev_info)
         for (i = 0; i < dev_info->num_interrupt_lines; i++) {
                 dev_info->event_interfaces[i].owner = dev_info->driver_module;
                 ret = iio_get_new_idr_val(&iio_event_idr);
-                if (ret)
+                if (ret < 0)
                         goto error_free_setup_ev_ints;
                 else
                         dev_info->event_interfaces[i].id = ret;
diff --git a/drivers/staging/iio/light/tsl2563.c b/drivers/staging/iio/light/tsl2563.c
index 1ba4aa392f6..8770a00e365 100644
--- a/drivers/staging/iio/light/tsl2563.c
+++ b/drivers/staging/iio/light/tsl2563.c
@@ -682,6 +682,7 @@ static int __devinit tsl2563_probe(struct i2c_client *client,
 fail2:
         iio_device_unregister(chip->indio_dev);
 fail1:
+        i2c_set_clientdata(client, NULL);
         kfree(chip);
         return err;
 }
@@ -692,6 +693,7 @@ static int tsl2563_remove(struct i2c_client *client)
 
         iio_device_unregister(chip->indio_dev);
 
+        i2c_set_clientdata(client, NULL);
         kfree(chip);
         return 0;
 }
diff --git a/drivers/staging/iio/ring_sw.c b/drivers/staging/iio/ring_sw.c
index b104c3d9c35..cf22c091668 100644
--- a/drivers/staging/iio/ring_sw.c
+++ b/drivers/staging/iio/ring_sw.c
@@ -293,7 +293,7 @@ again:
                 return -EAGAIN;
         memcpy(data, last_written_p_copy, ring->buf.bpd);
 
-        if (unlikely(ring->last_written_p >= last_written_p_copy))
+        if (unlikely(ring->last_written_p != last_written_p_copy))
                 goto again;
 
         iio_unmark_sw_rb_in_use(&ring->buf);
diff --git a/drivers/staging/octeon/cvmx-helper-board.c b/drivers/staging/octeon/cvmx-helper-board.c
index 3085e38a6f9..00a555b8335 100644
--- a/drivers/staging/octeon/cvmx-helper-board.c
+++ b/drivers/staging/octeon/cvmx-helper-board.c
@@ -153,6 +153,14 @@ int cvmx_helper_board_get_mii_address(int ipd_port)
                  * through switch.
                  */
                 return -1;
+
+        case CVMX_BOARD_TYPE_CUST_WSX16:
+                if (ipd_port >= 0 && ipd_port <= 3)
+                        return ipd_port;
+                else if (ipd_port >= 16 && ipd_port <= 19)
+                        return ipd_port - 16 + 4;
+                else
+                        return -1;
         }
 
         /* Some unknown board. Somebody forgot to update this function... */
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index 1873a79bb03..740db0c1ac0 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -63,6 +63,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x07D1, 0x3C11)},   /* D-Link */
         {USB_DEVICE(0x14B2, 0x3C07)},   /* AL */
         {USB_DEVICE(0x050D, 0x8053)},   /* Belkin */
+        {USB_DEVICE(0x050D, 0x825B)},   /* Belkin */
         {USB_DEVICE(0x14B2, 0x3C23)},   /* Airlink */
         {USB_DEVICE(0x14B2, 0x3C27)},   /* Airlink */
         {USB_DEVICE(0x07AA, 0x002F)},   /* Corega */
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index e16256fe595..04d9b85f3d4 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -113,14 +113,17 @@ u32 rt_global_debug_component = \
 
 static const struct usb_device_id rtl8192_usb_id_tbl[] = {
         /* Realtek */
+        {USB_DEVICE(0x0bda, 0x8171)},
         {USB_DEVICE(0x0bda, 0x8192)},
         {USB_DEVICE(0x0bda, 0x8709)},
         /* Corega */
         {USB_DEVICE(0x07aa, 0x0043)},
         /* Belkin */
         {USB_DEVICE(0x050d, 0x805E)},
+        {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x0031)},
+        {USB_DEVICE(0x0df6, 0x004b)},   /* WL-349 */
         /* EnGenius */
         {USB_DEVICE(0x1740, 0x9201)},
         /* Dlink */
diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/staging/usbip/usbip_event.c
index 6da1021e8a6..a2566f1075d 100644
--- a/drivers/staging/usbip/usbip_event.c
+++ b/drivers/staging/usbip/usbip_event.c
@@ -117,6 +117,9 @@ void usbip_stop_eh(struct usbip_device *ud)
 {
         struct usbip_task *eh = &ud->eh;
 
+        if (eh->thread == current)
+                return; /* do not wait for myself */
+
         wait_for_completion(&eh->thread_done);
         usbip_dbg_eh("usbip_eh has finished\n");
 }
diff --git a/drivers/staging/vme/bridges/vme_tsi148.c b/drivers/staging/vme/bridges/vme_tsi148.c
index 68f24425977..783051f59f1 100644
--- a/drivers/staging/vme/bridges/vme_tsi148.c
+++ b/drivers/staging/vme/bridges/vme_tsi148.c
@@ -2455,9 +2455,10 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         dev_info(&pdev->dev, "VME Write and flush and error check is %s\n",
                 err_chk ? "enabled" : "disabled");
 
-        if (tsi148_crcsr_init(tsi148_bridge, pdev))
+        if (tsi148_crcsr_init(tsi148_bridge, pdev)) {
                 dev_err(&pdev->dev, "CR/CSR configuration failed.\n");
                 goto err_crcsr;
+        }
 
         retval = vme_register_bridge(tsi148_bridge);
         if (retval != 0) {
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index be6331e2c27..5e1a253b08a 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1542,6 +1542,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x1bbb, 0x0003), /* Alcatel OT-I650 */
         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
         },
+        { USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
+        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+        },
 
         /* Nokia S60 phones expose two ACM channels. The first is
          * a modem and is picked up by the standard AT-command
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 97a819c23ef..7e594449600 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -109,7 +109,7 @@ config USB_SUSPEND
 config USB_OTG
         bool
         depends on USB && EXPERIMENTAL
-        select USB_SUSPEND
+        depends on USB_SUSPEND
         default n
 
 
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index bdf87a8414a..2c95153c0f2 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -120,7 +120,7 @@ int usb_choose_configuration(struct usb_device *udev)
                  * than a vendor-specific driver. */
                 else if (udev->descriptor.bDeviceClass !=
                                                 USB_CLASS_VENDOR_SPEC &&
-                                (!desc || desc->bInterfaceClass !=
+                                (desc && desc->bInterfaceClass !=
                                                 USB_CLASS_VENDOR_SPEC)) {
                         best = c;
                         break;
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 97b40ce133f..111a01a747f 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -380,6 +380,7 @@ static int usbfs_rmdir(struct inode *dir, struct dentry *dentry)
         mutex_lock(&inode->i_mutex);
         dentry_unhash(dentry);
         if (usbfs_empty(dentry)) {
+                dont_mount(dentry);
                 drop_nlink(dentry->d_inode);
                 drop_nlink(dentry->d_inode);
                 dput(dentry);
@@ -515,13 +516,13 @@ static int fs_create_by_name (const char *name, mode_t mode,
         *dentry = NULL;
         mutex_lock(&parent->d_inode->i_mutex);
         *dentry = lookup_one_len(name, parent, strlen(name));
-        if (!IS_ERR(dentry)) {
+        if (!IS_ERR(*dentry)) {
                 if ((mode & S_IFMT) == S_IFDIR)
                         error = usbfs_mkdir (parent->d_inode, *dentry, mode);
                 else 
                         error = usbfs_create (parent->d_inode, *dentry, mode);
         } else
-                error = PTR_ERR(dentry);
+                error = PTR_ERR(*dentry);
         mutex_unlock(&parent->d_inode->i_mutex);
 
         return error;
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 1297e9b16a5..0561430f2ed 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -718,7 +718,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
 EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);
 
 /**
- * usb_buffer_alloc - allocate dma-consistent buffer for URB_NO_xxx_DMA_MAP
+ * usb_alloc_coherent - allocate dma-consistent buffer for URB_NO_xxx_DMA_MAP
  * @dev: device the buffer will be used with
  * @size: requested buffer size
  * @mem_flags: affect whether allocation may block
@@ -737,30 +737,30 @@ EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);
  * architectures where CPU caches are not DMA-coherent.  On systems without
  * bus-snooping caches, these buffers are uncached.
  *
- * When the buffer is no longer used, free it with usb_buffer_free().
+ * When the buffer is no longer used, free it with usb_free_coherent().
  */
-void *usb_buffer_alloc(struct usb_device *dev, size_t size, gfp_t mem_flags,
-                       dma_addr_t *dma)
+void *usb_alloc_coherent(struct usb_device *dev, size_t size, gfp_t mem_flags,
+                         dma_addr_t *dma)
 {
         if (!dev || !dev->bus)
                 return NULL;
         return hcd_buffer_alloc(dev->bus, size, mem_flags, dma);
 }
-EXPORT_SYMBOL_GPL(usb_buffer_alloc);
+EXPORT_SYMBOL_GPL(usb_alloc_coherent);
 
 /**
- * usb_buffer_free - free memory allocated with usb_buffer_alloc()
+ * usb_free_coherent - free memory allocated with usb_alloc_coherent()
  * @dev: device the buffer was used with
  * @size: requested buffer size
  * @addr: CPU address of buffer
  * @dma: DMA address of buffer
  *
  * This reclaims an I/O buffer, letting it be reused.  The memory must have
- * been allocated using usb_buffer_alloc(), and the parameters must match
+ * been allocated using usb_alloc_coherent(), and the parameters must match
  * those provided in that allocation request.
  */
-void usb_buffer_free(struct usb_device *dev, size_t size, void *addr,
-                     dma_addr_t dma)
+void usb_free_coherent(struct usb_device *dev, size_t size, void *addr,
+                       dma_addr_t dma)
 {
         if (!dev || !dev->bus)
                 return;
@@ -768,7 +768,7 @@ void usb_buffer_free(struct usb_device *dev, size_t size, void *addr,
                 return;
         hcd_buffer_free(dev->bus, size, addr, dma);
 }
-EXPORT_SYMBOL_GPL(usb_buffer_free);
+EXPORT_SYMBOL_GPL(usb_free_coherent);
 
 /**
  * usb_buffer_map - create DMA mapping(s) for an urb
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 124a8ccfdcd..1f73b485732 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -2145,6 +2145,7 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         u32 epctrl;
         u32 mps;
         int dir_in;
+        int ret = 0;
 
         dev_dbg(hsotg->dev,
                 "%s: ep %s: a 0x%02x, attr 0x%02x, mps 0x%04x, intr %d\n",
@@ -2196,7 +2197,8 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
         case USB_ENDPOINT_XFER_ISOC:
                 dev_err(hsotg->dev, "no current ISOC support\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
 
         case USB_ENDPOINT_XFER_BULK:
                 epctrl |= S3C_DxEPCTL_EPType_Bulk;
@@ -2235,8 +2237,9 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         /* enable the endpoint interrupt */
         s3c_hsotg_ctrl_epint(hsotg, index, dir_in, 1);
 
+out:
         spin_unlock_irqrestore(&hs_ep->lock, flags);
-        return 0;
+        return ret;
 }
 
 static int s3c_hsotg_ep_disable(struct usb_ep *ep)
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 68b83ab7071..944291e10f9 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -331,6 +331,8 @@ ohci_hcd_at91_drv_suspend(struct platform_device *pdev, pm_message_t mesg)
          */
         if (at91_suspend_entering_slow_clock()) {
                 ohci_usb_reset (ohci);
+                /* flush the writes */
+                (void) ohci_readl (ohci, &ohci->regs->control);
                 at91_stop_clock();
         }
 
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 32bbce9718f..65cac8cc892 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -697,7 +697,7 @@ static int ohci_hub_control (
         u16             wLength
 ) {
         struct ohci_hcd *ohci = hcd_to_ohci (hcd);
-        int             ports = hcd_to_bus (hcd)->root_hub->maxchild;
+        int             ports = ohci->num_ports;
         u32             temp;
         int             retval = 0;
 
diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index 50f57f46883..e62b30b3e42 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -660,13 +660,13 @@ static struct ehci_qh *oxu_qh_alloc(struct oxu_hcd *oxu)
                 if (qh->dummy == NULL) {
                         oxu_dbg(oxu, "no dummy td\n");
                         oxu->qh_used[i] = 0;
-
-                        return NULL;
+                        qh = NULL;
+                        goto unlock;
                 }
 
                 oxu->qh_used[i] = 1;
         }
-
+unlock:
         spin_unlock(&oxu->mem_lock);
 
         return qh;
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index e11cc3aa4b8..3b867a8af7b 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -720,10 +720,10 @@ retry:
                 /* port status seems weird until after reset, so
                  * force the reset and make khubd clean up later.
                  */
-                if (sl811->stat_insrmv & 1)
-                        sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
-                else
+                if (irqstat & SL11H_INTMASK_RD)
                         sl811->port1 &= ~(1 << USB_PORT_FEAT_CONNECTION);
+                else
+                        sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
 
                 sl811->port1 |= 1 << USB_PORT_FEAT_C_CONNECTION;
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index c09539bad1e..d64f5724bfc 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -582,6 +582,19 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
         return EP_INTERVAL(interval);
 }
 
+/* The "Mult" field in the endpoint context is only set for SuperSpeed devices.
+ * High speed endpoint descriptors can define "the number of additional
+ * transaction opportunities per microframe", but that goes in the Max Burst
+ * endpoint context field.
+ */
+static inline u32 xhci_get_endpoint_mult(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        if (udev->speed != USB_SPEED_SUPER || !ep->ss_ep_comp)
+                return 0;
+        return ep->ss_ep_comp->desc.bmAttributes;
+}
+
 static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
@@ -612,6 +625,36 @@ static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
         return type;
 }
 
+/* Return the maximum endpoint service interval time (ESIT) payload.
+ * Basically, this is the maxpacket size, multiplied by the burst size
+ * and mult size.
+ */
+static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
+                struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        int max_burst;
+        int max_packet;
+
+        /* Only applies for interrupt or isochronous endpoints */
+        if (usb_endpoint_xfer_control(&ep->desc) ||
+                        usb_endpoint_xfer_bulk(&ep->desc))
+                return 0;
+
+        if (udev->speed == USB_SPEED_SUPER) {
+                if (ep->ss_ep_comp)
+                        return ep->ss_ep_comp->desc.wBytesPerInterval;
+                xhci_warn(xhci, "WARN no SS endpoint companion descriptor.\n");
+                /* Assume no bursts, no multiple opportunities to send. */
+                return ep->desc.wMaxPacketSize;
+        }
+
+        max_packet = ep->desc.wMaxPacketSize & 0x3ff;
+        max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11;
+        /* A 0 in max burst means 1 transfer per ESIT */
+        return max_packet * (max_burst + 1);
+}
+
 int xhci_endpoint_init(struct xhci_hcd *xhci,
                 struct xhci_virt_device *virt_dev,
                 struct usb_device *udev,
@@ -623,6 +666,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         struct xhci_ring *ep_ring;
         unsigned int max_packet;
         unsigned int max_burst;
+        u32 max_esit_payload;
 
         ep_index = xhci_get_endpoint_index(&ep->desc);
         ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
@@ -644,6 +688,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
 
         ep_ctx->ep_info = xhci_get_endpoint_interval(udev, ep);
+        ep_ctx->ep_info |= EP_MULT(xhci_get_endpoint_mult(udev, ep));
 
         /* FIXME dig Mult and streams info out of ep companion desc */
 
@@ -689,6 +734,26 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         default:
                 BUG();
         }
+        max_esit_payload = xhci_get_max_esit_payload(xhci, udev, ep);
+        ep_ctx->tx_info = MAX_ESIT_PAYLOAD_FOR_EP(max_esit_payload);
+
+        /*
+         * XXX no idea how to calculate the average TRB buffer length for bulk
+         * endpoints, as the driver gives us no clue how big each scatter gather
+         * list entry (or buffer) is going to be.
+         *
+         * For isochronous and interrupt endpoints, we set it to the max
+         * available, until we have new API in the USB core to allow drivers to
+         * declare how much bandwidth they actually need.
+         *
+         * Normally, it would be calculated by taking the total of the buffer
+         * lengths in the TD and then dividing by the number of TRBs in a TD,
+         * including link TRBs, No-op TRBs, and Event data TRBs.  Since we don't
+         * use Event Data TRBs, and we don't chain in a link TRB on short
+         * transfers, we're basically dividing by 1.
+         */
+        ep_ctx->tx_info |= AVG_TRB_LENGTH_FOR_EP(max_esit_payload);
+
         /* FIXME Debug endpoint context */
         return 0;
 }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index e5eb09b2f38..ea389e9a493 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -609,6 +609,10 @@ struct xhci_ep_ctx {
 #define MAX_PACKET_MASK         (0xffff << 16)
 #define MAX_PACKET_DECODED(p)   (((p) >> 16) & 0xffff)
 
+/* tx_info bitmasks */
+#define AVG_TRB_LENGTH_FOR_EP(p)        ((p) & 0xffff)
+#define MAX_ESIT_PAYLOAD_FOR_EP(p)      (((p) & 0xffff) << 16)
+
 
 /**
  * struct xhci_input_control_context
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index b4c783c284b..07fe490b44d 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -42,7 +42,7 @@ config USB_MUSB_SOC
         default y if (BF52x && !BF522 && !BF523)
 
 comment "DaVinci 35x and 644x USB support"
-        depends on USB_MUSB_HDRC && ARCH_DAVINCI
+        depends on USB_MUSB_HDRC && ARCH_DAVINCI_DMx
 
 comment "OMAP 243x high speed USB support"
         depends on USB_MUSB_HDRC && ARCH_OMAP2430
diff --git a/drivers/usb/musb/Makefile b/drivers/usb/musb/Makefile
index 85710ccc188..3a485dabebb 100644
--- a/drivers/usb/musb/Makefile
+++ b/drivers/usb/musb/Makefile
@@ -6,7 +6,7 @@ musb_hdrc-objs := musb_core.o
 
 obj-$(CONFIG_USB_MUSB_HDRC)     += musb_hdrc.o
 
-ifeq ($(CONFIG_ARCH_DAVINCI),y)
+ifeq ($(CONFIG_ARCH_DAVINCI_DMx),y)
         musb_hdrc-objs  += davinci.o
 endif
 
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index 719a22d664e..ec8d324237f 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -172,13 +172,7 @@ static irqreturn_t blackfin_interrupt(int irq, void *__hci)
 
         spin_unlock_irqrestore(&musb->lock, flags);
 
-        /* REVISIT we sometimes get spurious IRQs on g_ep0
-         * not clear why... fall in BF54x too.
-         */
-        if (retval != IRQ_HANDLED)
-                DBG(5, "spurious?\n");
-
-        return IRQ_HANDLED;
+        return retval;
 }
 
 static void musb_conn_timer_handler(unsigned long _musb)
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 29bce5c0fd1..ce2e16fee0d 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -444,6 +444,8 @@ int __init musb_platform_init(struct musb *musb)
         return 0;
 
 fail:
+        clk_disable(musb->clock);
+
         usb_nop_xceiv_unregister();
         return -ENODEV;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 0e8b8ab1d16..705cc4ad873 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -965,10 +965,8 @@ static void musb_shutdown(struct platform_device *pdev)
         spin_lock_irqsave(&musb->lock, flags);
         musb_platform_disable(musb);
         musb_generic_disable(musb);
-        if (musb->clock) {
+        if (musb->clock)
                 clk_put(musb->clock);
-                musb->clock = NULL;
-        }
         spin_unlock_irqrestore(&musb->lock, flags);
 
         /* FIXME power down */
@@ -1853,15 +1851,6 @@ static void musb_free(struct musb *musb)
         put_device(musb->xceiv->dev);
 #endif
 
-        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
-        musb_platform_exit(musb);
-        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
-
-        if (musb->clock) {
-                clk_disable(musb->clock);
-                clk_put(musb->clock);
-        }
-
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
         usb_put_hcd(musb_to_hcd(musb));
 #else
@@ -1889,8 +1878,10 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
          */
         if (!plat) {
                 dev_dbg(dev, "no platform_data?\n");
-                return -ENODEV;
+                status = -ENODEV;
+                goto fail0;
         }
+
         switch (plat->mode) {
         case MUSB_HOST:
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
@@ -1912,13 +1903,16 @@ bad_config:
 #endif
         default:
                 dev_err(dev, "incompatible Kconfig role setting\n");
-                return -EINVAL;
+                status = -EINVAL;
+                goto fail0;
         }
 
         /* allocate */
         musb = allocate_instance(dev, plat->config, ctrl);
-        if (!musb)
-                return -ENOMEM;
+        if (!musb) {
+                status = -ENOMEM;
+                goto fail0;
+        }
 
         spin_lock_init(&musb->lock);
         musb->board_mode = plat->mode;
@@ -1936,7 +1930,7 @@ bad_config:
                 if (IS_ERR(musb->clock)) {
                         status = PTR_ERR(musb->clock);
                         musb->clock = NULL;
-                        goto fail;
+                        goto fail1;
                 }
         }
 
@@ -1955,12 +1949,12 @@ bad_config:
          */
         musb->isr = generic_interrupt;
         status = musb_platform_init(musb);
-
         if (status < 0)
-                goto fail;
+                goto fail2;
+
         if (!musb->isr) {
                 status = -ENODEV;
-                goto fail2;
+                goto fail3;
         }
 
 #ifndef CONFIG_MUSB_PIO_ONLY
@@ -1986,7 +1980,7 @@ bad_config:
                         ? MUSB_CONTROLLER_MHDRC
                         : MUSB_CONTROLLER_HDRC, musb);
         if (status < 0)
-                goto fail2;
+                goto fail3;
 
 #ifdef CONFIG_USB_MUSB_OTG
         setup_timer(&musb->otg_timer, musb_otg_timer_func, (unsigned long) musb);
@@ -1999,7 +1993,7 @@ bad_config:
         if (request_irq(nIrq, musb->isr, 0, dev_name(dev), musb)) {
                 dev_err(dev, "request_irq %d failed!\n", nIrq);
                 status = -ENODEV;
-                goto fail2;
+                goto fail3;
         }
         musb->nIrq = nIrq;
 /* FIXME this handles wakeup irqs wrong */
@@ -2039,8 +2033,6 @@ bad_config:
                 musb->xceiv->state = OTG_STATE_A_IDLE;
 
                 status = usb_add_hcd(musb_to_hcd(musb), -1, 0);
-                if (status)
-                        goto fail;
 
                 DBG(1, "%s mode, status %d, devctl %02x %c\n",
                         "HOST", status,
@@ -2055,8 +2047,6 @@ bad_config:
                 musb->xceiv->state = OTG_STATE_B_IDLE;
 
                 status = musb_gadget_setup(musb);
-                if (status)
-                        goto fail;
 
                 DBG(1, "%s mode, status %d, dev%02x\n",
                         is_otg_enabled(musb) ? "OTG" : "PERIPHERAL",
@@ -2064,12 +2054,14 @@ bad_config:
                         musb_readb(musb->mregs, MUSB_DEVCTL));
 
         }
+        if (status < 0)
+                goto fail3;
 
 #ifdef CONFIG_SYSFS
         status = sysfs_create_group(&musb->controller->kobj, &musb_attr_group);
-#endif
         if (status)
-                goto fail2;
+                goto fail4;
+#endif
 
         dev_info(dev, "USB %s mode controller at %p using %s, IRQ %d\n",
                         ({char *s;
@@ -2085,17 +2077,29 @@ bad_config:
 
         return 0;
 
-fail2:
+fail4:
+        if (!is_otg_enabled(musb) && is_host_enabled(musb))
+                usb_remove_hcd(musb_to_hcd(musb));
+        else
+                musb_gadget_cleanup(musb);
+
+fail3:
+        if (musb->irq_wake)
+                device_init_wakeup(dev, 0);
         musb_platform_exit(musb);
-fail:
-        dev_err(musb->controller,
-                "musb_init_controller failed with status %d\n", status);
 
+fail2:
         if (musb->clock)
                 clk_put(musb->clock);
-        device_init_wakeup(dev, 0);
+
+fail1:
+        dev_err(musb->controller,
+                "musb_init_controller failed with status %d\n", status);
+
         musb_free(musb);
 
+fail0:
+
         return status;
 
 }
@@ -2132,7 +2136,6 @@ static int __init musb_probe(struct platform_device *pdev)
         /* clobbered by use_dma=n */
         orig_dma_mask = dev->dma_mask;
 #endif
-
         status = musb_init_controller(dev, irq, base);
         if (status < 0)
                 iounmap(base);
@@ -2155,6 +2158,10 @@ static int __exit musb_remove(struct platform_device *pdev)
         if (musb->board_mode == MUSB_HOST)
                 usb_remove_hcd(musb_to_hcd(musb));
 #endif
+        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+        musb_platform_exit(musb);
+        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+
         musb_free(musb);
         iounmap(ctrl_base);
         device_init_wakeup(&pdev->dev, 0);
@@ -2176,6 +2183,7 @@ void musb_save_context(struct musb *musb)
         if (is_host_enabled(musb)) {
                 musb_context.frame = musb_readw(musb_base, MUSB_FRAME);
                 musb_context.testmode = musb_readb(musb_base, MUSB_TESTMODE);
+                musb_context.busctl = musb_read_ulpi_buscontrol(musb->mregs);
         }
         musb_context.power = musb_readb(musb_base, MUSB_POWER);
         musb_context.intrtxe = musb_readw(musb_base, MUSB_INTRTXE);
@@ -2247,6 +2255,7 @@ void musb_restore_context(struct musb *musb)
         if (is_host_enabled(musb)) {
                 musb_writew(musb_base, MUSB_FRAME, musb_context.frame);
                 musb_writeb(musb_base, MUSB_TESTMODE, musb_context.testmode);
+                musb_write_ulpi_buscontrol(musb->mregs, musb_context.busctl);
         }
         musb_writeb(musb_base, MUSB_POWER, musb_context.power);
         musb_writew(musb_base, MUSB_INTRTXE, musb_context.intrtxe);
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index cd9f4a9a06c..ac17b004909 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -478,7 +478,7 @@ struct musb_context_registers {
         u16 frame;
         u8 index, testmode;
 
-        u8 devctl, misc;
+        u8 devctl, busctl, misc;
 
         struct musb_csr_regs index_regs[MUSB_C_NUM_EPS];
 };
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index dec896e888d..877d20b1dff 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2042,6 +2042,7 @@ static int musb_urb_enqueue(
                  * odd, rare, error prone, but legal.
                  */
                 kfree(qh);
+                qh = NULL;
                 ret = 0;
         } else
                 ret = musb_schedule(musb, qh,
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 490cdf15ccb..82592633502 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -331,8 +331,5 @@ int musb_platform_exit(struct musb *musb)
 
         musb_platform_suspend(musb);
 
-        clk_put(musb->clock);
-        musb->clock = NULL;
-
         return 0;
 }
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index ab776a8d98c..60d3938cafc 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -29,6 +29,19 @@ static void tusb_source_power(struct musb *musb, int is_on);
 #define TUSB_REV_MAJOR(reg_val)         ((reg_val >> 4) & 0xf)
 #define TUSB_REV_MINOR(reg_val)         (reg_val & 0xf)
 
+#ifdef CONFIG_PM
+/* REVISIT: These should be only needed if somebody implements off idle */
+void musb_platform_save_context(struct musb *musb,
+                        struct musb_context_registers *musb_context)
+{
+}
+
+void musb_platform_restore_context(struct musb *musb,
+                        struct musb_context_registers *musb_context)
+{
+}
+#endif
+
 /*
  * Checks the revision. We need to use the DMA register as 3.0 does not
  * have correct versions for TUSB_PRCM_REV or TUSB_INT_CTRL_REV.
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 5afa070d7dc..c061a88f2b0 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -39,7 +39,7 @@ struct tusb_omap_dma_ch {
 
         struct tusb_omap_dma    *tusb_dma;
 
-        void __iomem            *dma_addr;
+        dma_addr_t              dma_addr;
 
         u32                     len;
         u16                     packet_sz;
@@ -126,6 +126,7 @@ static void tusb_omap_dma_cb(int lch, u16 ch_status, void *data)
         struct tusb_omap_dma_ch *chdat = to_chdat(channel);
         struct tusb_omap_dma    *tusb_dma = chdat->tusb_dma;
         struct musb             *musb = chdat->musb;
+        struct device           *dev = musb->controller;
         struct musb_hw_ep       *hw_ep = chdat->hw_ep;
         void __iomem            *ep_conf = hw_ep->conf;
         void __iomem            *mbase = musb->mregs;
@@ -173,13 +174,15 @@ static void tusb_omap_dma_cb(int lch, u16 ch_status, void *data)
                 DBG(3, "Using PIO for remaining %lu bytes\n", pio);
                 buf = phys_to_virt((u32)chdat->dma_addr) + chdat->transfer_len;
                 if (chdat->tx) {
-                        dma_cache_maint(phys_to_virt((u32)chdat->dma_addr),
-                                        chdat->transfer_len, DMA_TO_DEVICE);
+                        dma_unmap_single(dev, chdat->dma_addr,
+                                                chdat->transfer_len,
+                                                DMA_TO_DEVICE);
                         musb_write_fifo(hw_ep, pio, buf);
                 } else {
+                        dma_unmap_single(dev, chdat->dma_addr,
+                                                chdat->transfer_len,
+                                                DMA_FROM_DEVICE);
                         musb_read_fifo(hw_ep, pio, buf);
-                        dma_cache_maint(phys_to_virt((u32)chdat->dma_addr),
-                                        chdat->transfer_len, DMA_FROM_DEVICE);
                 }
                 channel->actual_len += pio;
         }
@@ -224,6 +227,7 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
         struct tusb_omap_dma_ch         *chdat = to_chdat(channel);
         struct tusb_omap_dma            *tusb_dma = chdat->tusb_dma;
         struct musb                     *musb = chdat->musb;
+        struct device                   *dev = musb->controller;
         struct musb_hw_ep               *hw_ep = chdat->hw_ep;
         void __iomem                    *mbase = musb->mregs;
         void __iomem                    *ep_conf = hw_ep->conf;
@@ -299,14 +303,16 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
         chdat->packet_sz = packet_sz;
         chdat->len = len;
         channel->actual_len = 0;
-        chdat->dma_addr = (void __iomem *)dma_addr;
+        chdat->dma_addr = dma_addr;
         channel->status = MUSB_DMA_STATUS_BUSY;
 
         /* Since we're recycling dma areas, we need to clean or invalidate */
         if (chdat->tx)
-                dma_cache_maint(phys_to_virt(dma_addr), len, DMA_TO_DEVICE);
+                dma_map_single(dev, phys_to_virt(dma_addr), len,
+                                DMA_TO_DEVICE);
         else
-                dma_cache_maint(phys_to_virt(dma_addr), len, DMA_FROM_DEVICE);
+                dma_map_single(dev, phys_to_virt(dma_addr), len,
+                                DMA_FROM_DEVICE);
 
         /* Use 16-bit transfer if dma_addr is not 32-bit aligned */
         if ((dma_addr & 0x3) == 0) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index ca9d866672a..84d0edad8e4 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -305,6 +305,11 @@ static int  option_resume(struct usb_serial *serial);
 #define ZTE_PRODUCT_CDMA_TECH                   0xfffe
 #define ZTE_PRODUCT_AC8710                      0xfff1
 #define ZTE_PRODUCT_AC2726                      0xfff5
+#define ZTE_PRODUCT_AC8710T                     0xffff
+
+/* ZTE PRODUCTS -- alternate vendor ID */
+#define ZTE_VENDOR_ID2                          0x1d6b
+#define ZTE_PRODUCT_MF_330                      0x0002
 
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -373,6 +378,8 @@ static int  option_resume(struct usb_serial *serial);
 #define HAIER_VENDOR_ID                         0x201e
 #define HAIER_PRODUCT_CE100                     0x2009
 
+#define CINTERION_VENDOR_ID                     0x0681
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -679,6 +686,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
+        { USB_DEVICE(ZTE_VENDOR_ID2, ZTE_PRODUCT_MF_330) },
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
         { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
@@ -716,6 +725,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
 
+        { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index c97a0bb5b6d..c28b1607eac 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -59,6 +59,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ALDIGA) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index a352d5f3a59..23c09b38b9e 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -20,6 +20,7 @@
 #define PL2303_PRODUCT_ID_ALDIGA        0x0611
 #define PL2303_PRODUCT_ID_MMX           0x0612
 #define PL2303_PRODUCT_ID_GPRS          0x0609
+#define PL2303_PRODUCT_ID_HCR331        0x331a
 
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 880e990abb0..e1bfda33f5b 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1735,7 +1735,7 @@ static int ti_download_firmware(struct ti_device *tdev)
                 return -ENOENT;
         }
         if (fw_p->size > TI_FIRMWARE_BUF_SIZE) {
-                dev_err(&dev->dev, "%s - firmware too large %d \n", __func__, fw_p->size);
+                dev_err(&dev->dev, "%s - firmware too large %zu\n", __func__, fw_p->size);
                 return -ENOENT;
         }
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index e69d238c5af..49fa953aaf6 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1035,7 +1035,12 @@ int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
 /* This actually signals the guest, using eventfd. */
 void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
-        __u16 flags = 0;
+        __u16 flags;
+        /* Flush out used index updates. This is paired
+         * with the barrier that the Guest executes when enabling
+         * interrupts. */
+        smp_mb();
+
         if (get_user(flags, &vq->avail->flags)) {
                 vq_err(vq, "Failed to get flags");
                 return;
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
index 44e49c28b2a..c2ec3dcd4e9 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -488,9 +488,9 @@ static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
         fbinfo->fbops = &bfin_t350mcqb_fb_ops;
         fbinfo->flags = FBINFO_FLAG_DEFAULT;
 
-        info->fb_buffer =
-            dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
-                               GFP_KERNEL);
+        info->fb_buffer = dma_alloc_coherent(NULL, fbinfo->fix.smem_len +
+                                ACTIVE_VIDEO_MEM_OFFSET,
+                                &info->dma_handle, GFP_KERNEL);
 
         if (NULL == info->fb_buffer) {
                 printk(KERN_ERR DRIVER_NAME
@@ -568,8 +568,8 @@ out7:
 out6:
         fb_dealloc_cmap(&fbinfo->cmap);
 out4:
-        dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
-                          info->dma_handle);
+        dma_free_coherent(NULL, fbinfo->fix.smem_len + ACTIVE_VIDEO_MEM_OFFSET,
+                         info->fb_buffer, info->dma_handle);
 out3:
         framebuffer_release(fbinfo);
 out2:
@@ -592,8 +592,9 @@ static int __devexit bfin_t350mcqb_remove(struct platform_device *pdev)
         free_irq(info->irq, info);
 
         if (info->fb_buffer != NULL)
-                dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
-                                  info->dma_handle);
+                dma_free_coherent(NULL, fbinfo->fix.smem_len +
+                        ACTIVE_VIDEO_MEM_OFFSET, info->fb_buffer,
+                        info->dma_handle);
 
         fb_dealloc_cmap(&fbinfo->cmap);
 
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index e14bd074912..e8c76994481 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -695,6 +695,7 @@ static int sh_mobile_lcdc_setup_clocks(struct platform_device *pdev,
          * 1) Enable Runtime PM
          * 2) Force Runtime PM Resume since hardware is accessed from probe()
          */
+        priv->dev = &pdev->dev;
         pm_runtime_enable(priv->dev);
         pm_runtime_resume(priv->dev);
         return 0;
@@ -957,25 +958,24 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
 
         if (!pdev->dev.platform_data) {
                 dev_err(&pdev->dev, "no platform data defined\n");
-                error = -EINVAL;
-                goto err0;
+                return -EINVAL;
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         i = platform_get_irq(pdev, 0);
         if (!res || i < 0) {
                 dev_err(&pdev->dev, "cannot get platform resources\n");
-                error = -ENOENT;
-                goto err0;
+                return -ENOENT;
         }
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv) {
                 dev_err(&pdev->dev, "cannot allocate device data\n");
-                error = -ENOMEM;
-                goto err0;
+                return -ENOMEM;
         }
 
+        platform_set_drvdata(pdev, priv);
+
         error = request_irq(i, sh_mobile_lcdc_irq, IRQF_DISABLED,
                             dev_name(&pdev->dev), priv);
         if (error) {
@@ -984,8 +984,6 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
         }
 
         priv->irq = i;
-        priv->dev = &pdev->dev;
-        platform_set_drvdata(pdev, priv);
         pdata = pdev->dev.platform_data;
 
         j = 0;
@@ -1099,9 +1097,9 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
                 info = ch->info;
 
                 if (info->fbdefio) {
-                        priv->ch->sglist = vmalloc(sizeof(struct scatterlist) *
+                        ch->sglist = vmalloc(sizeof(struct scatterlist) *
                                         info->fix.smem_len >> PAGE_SHIFT);
-                        if (!priv->ch->sglist) {
+                        if (!ch->sglist) {
                                 dev_err(&pdev->dev, "cannot allocate sglist\n");
                                 goto err1;
                         }
@@ -1126,9 +1124,9 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
         }
 
         return 0;
- err1:
+err1:
         sh_mobile_lcdc_remove(pdev);
- err0:
+
         return error;
 }
 
@@ -1139,7 +1137,7 @@ static int sh_mobile_lcdc_remove(struct platform_device *pdev)
         int i;
 
         for (i = 0; i < ARRAY_SIZE(priv->ch); i++)
-                if (priv->ch[i].info->dev)
+                if (priv->ch[i].info && priv->ch[i].info->dev)
                         unregister_framebuffer(priv->ch[i].info);
 
         sh_mobile_lcdc_stop(priv);
@@ -1162,7 +1160,8 @@ static int sh_mobile_lcdc_remove(struct platform_device *pdev)
         if (priv->dot_clk)
                 clk_put(priv->dot_clk);
 
-        pm_runtime_disable(priv->dev);
+        if (priv->dev)
+                pm_runtime_disable(priv->dev);
 
         if (priv->base)
                 iounmap(priv->base);
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 0bf5020d0d3..b87ba23442d 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -175,7 +175,7 @@ config SA1100_WATCHDOG
 
 config MPCORE_WATCHDOG
         tristate "MPcore watchdog"
-        depends on ARM_MPCORE_PLATFORM && LOCAL_TIMERS
+        depends on HAVE_ARM_TWD
         help
           Watchdog timer embedded into the MPcore system.
 
diff --git a/drivers/watchdog/ep93xx_wdt.c b/drivers/watchdog/ep93xx_wdt.c
index 88ed54e50f7..59359c9a5e0 100644
--- a/drivers/watchdog/ep93xx_wdt.c
+++ b/drivers/watchdog/ep93xx_wdt.c
@@ -244,7 +244,7 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started");
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout,
         "Watchdog timeout in seconds. (1<=timeout<=3600, default="
-                                __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
+                                __MODULE_STRING(WDT_TIMEOUT) ")");
 
 MODULE_AUTHOR("Ray Lehtiniemi <rayl@mail.com>,"
                 "Alessandro Zummo <a.zummo@towertech.it>");
diff --git a/drivers/watchdog/mpcore_wdt.c b/drivers/watchdog/mpcore_wdt.c
index 016c6a791ca..b8ec7aca3c8 100644
--- a/drivers/watchdog/mpcore_wdt.c
+++ b/drivers/watchdog/mpcore_wdt.c
@@ -31,8 +31,9 @@
 #include <linux/platform_device.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <linux/io.h>
 
-#include <asm/hardware/arm_twd.h>
+#include <asm/smp_twd.h>
 
 struct mpcore_wdt {
         unsigned long   timer_alive;
@@ -44,7 +45,7 @@ struct mpcore_wdt {
 };
 
 static struct platform_device *mpcore_wdt_dev;
-extern unsigned int mpcore_timer_rate;
+static DEFINE_SPINLOCK(wdt_lock);
 
 #define TIMER_MARGIN    60
 static int mpcore_margin = TIMER_MARGIN;
@@ -94,13 +95,15 @@ static irqreturn_t mpcore_wdt_fire(int irq, void *arg)
  */
 static void mpcore_wdt_keepalive(struct mpcore_wdt *wdt)
 {
-        unsigned int count;
+        unsigned long count;
 
+        spin_lock(&wdt_lock);
         /* Assume prescale is set to 256 */
-        count = (mpcore_timer_rate / 256) * mpcore_margin;
+        count =  __raw_readl(wdt->base + TWD_WDOG_COUNTER);
+        count = (0xFFFFFFFFU - count) * (HZ / 5);
+        count = (count / 256) * mpcore_margin;
 
         /* Reload the counter */
-        spin_lock(&wdt_lock);
         writel(count + wdt->perturb, wdt->base + TWD_WDOG_LOAD);
         wdt->perturb = wdt->perturb ? 0 : 1;
         spin_unlock(&wdt_lock);
@@ -119,7 +122,6 @@ static void mpcore_wdt_start(struct mpcore_wdt *wdt)
 {
         dev_printk(KERN_INFO, wdt->dev, "enabling watchdog.\n");
 
-        spin_lock(&wdt_lock);
         /* This loads the count register but does NOT start the count yet */
         mpcore_wdt_keepalive(wdt);
 
@@ -130,7 +132,6 @@ static void mpcore_wdt_start(struct mpcore_wdt *wdt)
                 /* Enable watchdog - prescale=256, watchdog mode=1, enable=1 */
                 writel(0x0000FF09, wdt->base + TWD_WDOG_CONTROL);
         }
-        spin_unlock(&wdt_lock);
 }
 
 static int mpcore_wdt_set_heartbeat(int t)
@@ -360,7 +361,7 @@ static int __devinit mpcore_wdt_probe(struct platform_device *dev)
         mpcore_wdt_miscdev.parent = &dev->dev;
         ret = misc_register(&mpcore_wdt_miscdev);
         if (ret) {
-                dev_printk(KERN_ERR, _dev,
+                dev_printk(KERN_ERR, wdt->dev,
                         "cannot register miscdev on minor=%d (err=%d)\n",
                                                         WATCHDOG_MINOR, ret);
                 goto err_misc;
@@ -369,13 +370,13 @@ static int __devinit mpcore_wdt_probe(struct platform_device *dev)
         ret = request_irq(wdt->irq, mpcore_wdt_fire, IRQF_DISABLED,
                                                         "mpcore_wdt", wdt);
         if (ret) {
-                dev_printk(KERN_ERR, _dev,
+                dev_printk(KERN_ERR, wdt->dev,
                         "cannot register IRQ%d for watchdog\n", wdt->irq);
                 goto err_irq;
         }
 
         mpcore_wdt_stop(wdt);
-        platform_set_drvdata(&dev->dev, wdt);
+        platform_set_drvdata(dev, wdt);
         mpcore_wdt_dev = dev;
 
         return 0;
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 109a6c606d9..e8e5e63ac95 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -177,8 +177,7 @@ static int try_to_fill_dentry(struct dentry *dentry, int flags)
                 }
         /* Trigger mount for path component or follow link */
         } else if (ino->flags & AUTOFS_INF_PENDING ||
-                        autofs4_need_mount(flags) ||
-                        current->link_count) {
+                        autofs4_need_mount(flags)) {
                 DPRINTK("waiting for mount name=%.*s",
                         dentry->d_name.len, dentry->d_name.name);
 
@@ -262,7 +261,7 @@ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
                 spin_unlock(&dcache_lock);
                 spin_unlock(&sbi->fs_lock);
 
-                status = try_to_fill_dentry(dentry, 0);
+                status = try_to_fill_dentry(dentry, nd->flags);
                 if (status)
                         goto out_error;
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index e84ef60ffe3..97a97839a86 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1481,12 +1481,17 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                 ret = -EBADF;
                 goto out_drop_write;
         }
+
         src = src_file->f_dentry->d_inode;
 
         ret = -EINVAL;
         if (src == inode)
                 goto out_fput;
 
+        /* the src must be open for reading */
+        if (!(src_file->f_mode & FMODE_READ))
+                goto out_fput;
+
         ret = -EISDIR;
         if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode))
                 goto out_fput;
diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
index f7c255f9c62..a8cd821226d 100644
--- a/fs/cachefiles/internal.h
+++ b/fs/cachefiles/internal.h
@@ -34,6 +34,7 @@ struct cachefiles_object {
         loff_t                          i_size;         /* object size */
         unsigned long                   flags;
 #define CACHEFILES_OBJECT_ACTIVE        0               /* T if marked active */
+#define CACHEFILES_OBJECT_BURIED        1               /* T if preemptively buried */
         atomic_t                        usage;          /* object usage count */
         uint8_t                         type;           /* object type */
         uint8_t                         new;            /* T if object new */
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index d5db84a1ee0..f4a7840bf42 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -93,6 +93,59 @@ static noinline void cachefiles_printk_object(struct cachefiles_object *object,
 }
 
 /*
+ * mark the owner of a dentry, if there is one, to indicate that that dentry
+ * has been preemptively deleted
+ * - the caller must hold the i_mutex on the dentry's parent as required to
+ *   call vfs_unlink(), vfs_rmdir() or vfs_rename()
+ */
+static void cachefiles_mark_object_buried(struct cachefiles_cache *cache,
+                                          struct dentry *dentry)
+{
+        struct cachefiles_object *object;
+        struct rb_node *p;
+
+        _enter(",'%*.*s'",
+               dentry->d_name.len, dentry->d_name.len, dentry->d_name.name);
+
+        write_lock(&cache->active_lock);
+
+        p = cache->active_nodes.rb_node;
+        while (p) {
+                object = rb_entry(p, struct cachefiles_object, active_node);
+                if (object->dentry > dentry)
+                        p = p->rb_left;
+                else if (object->dentry < dentry)
+                        p = p->rb_right;
+                else
+                        goto found_dentry;
+        }
+
+        write_unlock(&cache->active_lock);
+        _leave(" [no owner]");
+        return;
+
+        /* found the dentry for  */
+found_dentry:
+        kdebug("preemptive burial: OBJ%x [%s] %p",
+               object->fscache.debug_id,
+               fscache_object_states[object->fscache.state],
+               dentry);
+
+        if (object->fscache.state < FSCACHE_OBJECT_DYING) {
+                printk(KERN_ERR "\n");
+                printk(KERN_ERR "CacheFiles: Error:"
+                       " Can't preemptively bury live object\n");
+                cachefiles_printk_object(object, NULL);
+        } else if (test_and_set_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
+                printk(KERN_ERR "CacheFiles: Error:"
+                       " Object already preemptively buried\n");
+        }
+
+        write_unlock(&cache->active_lock);
+        _leave(" [owner marked]");
+}
+
+/*
  * record the fact that an object is now active
  */
 static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
@@ -219,7 +272,8 @@ requeue:
  */
 static int cachefiles_bury_object(struct cachefiles_cache *cache,
                                   struct dentry *dir,
-                                  struct dentry *rep)
+                                  struct dentry *rep,
+                                  bool preemptive)
 {
         struct dentry *grave, *trap;
         char nbuffer[8 + 8 + 1];
@@ -229,11 +283,16 @@ static int cachefiles_bury_object(struct cachefiles_cache *cache,
                dir->d_name.len, dir->d_name.len, dir->d_name.name,
                rep->d_name.len, rep->d_name.len, rep->d_name.name);
 
+        _debug("remove %p from %p", rep, dir);
+
         /* non-directories can just be unlinked */
         if (!S_ISDIR(rep->d_inode->i_mode)) {
                 _debug("unlink stale object");
                 ret = vfs_unlink(dir->d_inode, rep);
 
+                if (preemptive)
+                        cachefiles_mark_object_buried(cache, rep);
+
                 mutex_unlock(&dir->d_inode->i_mutex);
 
                 if (ret == -EIO)
@@ -325,6 +384,9 @@ try_again:
         if (ret != 0 && ret != -ENOMEM)
                 cachefiles_io_error(cache, "Rename failed with error %d", ret);
 
+        if (preemptive)
+                cachefiles_mark_object_buried(cache, rep);
+
         unlock_rename(cache->graveyard, dir);
         dput(grave);
         _leave(" = 0");
@@ -340,7 +402,7 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
         struct dentry *dir;
         int ret;
 
-        _enter(",{%p}", object->dentry);
+        _enter(",OBJ%x{%p}", object->fscache.debug_id, object->dentry);
 
         ASSERT(object->dentry);
         ASSERT(object->dentry->d_inode);
@@ -350,15 +412,25 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
 
         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
 
-        /* we need to check that our parent is _still_ our parent - it may have
-         * been renamed */
-        if (dir == object->dentry->d_parent) {
-                ret = cachefiles_bury_object(cache, dir, object->dentry);
-        } else {
-                /* it got moved, presumably by cachefilesd culling it, so it's
-                 * no longer in the key path and we can ignore it */
+        if (test_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
+                /* object allocation for the same key preemptively deleted this
+                 * object's file so that it could create its own file */
+                _debug("object preemptively buried");
                 mutex_unlock(&dir->d_inode->i_mutex);
                 ret = 0;
+        } else {
+                /* we need to check that our parent is _still_ our parent - it
+                 * may have been renamed */
+                if (dir == object->dentry->d_parent) {
+                        ret = cachefiles_bury_object(cache, dir,
+                                                     object->dentry, false);
+                } else {
+                        /* it got moved, presumably by cachefilesd culling it,
+                         * so it's no longer in the key path and we can ignore
+                         * it */
+                        mutex_unlock(&dir->d_inode->i_mutex);
+                        ret = 0;
+                }
         }
 
         dput(dir);
@@ -381,7 +453,9 @@ int cachefiles_walk_to_object(struct cachefiles_object *parent,
         const char *name;
         int ret, nlen;
 
-        _enter("{%p},,%s,", parent->dentry, key);
+        _enter("OBJ%x{%p},OBJ%x,%s,",
+               parent->fscache.debug_id, parent->dentry,
+               object->fscache.debug_id, key);
 
         cache = container_of(parent->fscache.cache,
                              struct cachefiles_cache, cache);
@@ -509,7 +583,7 @@ lookup_again:
                          * mutex) */
                         object->dentry = NULL;
 
-                        ret = cachefiles_bury_object(cache, dir, next);
+                        ret = cachefiles_bury_object(cache, dir, next, true);
                         dput(next);
                         next = NULL;
 
@@ -828,7 +902,7 @@ int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
         /*  actually remove the victim (drops the dir mutex) */
         _debug("bury");
 
-        ret = cachefiles_bury_object(cache, dir, victim);
+        ret = cachefiles_bury_object(cache, dir, victim, false);
         if (ret < 0)
                 goto error;
 
diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c
index b5808cdb223..039b5011d83 100644
--- a/fs/cachefiles/security.c
+++ b/fs/cachefiles/security.c
@@ -77,6 +77,8 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,
 /*
  * check the security details of the on-disk cache
  * - must be called with security override in force
+ * - must return with a security override in force - even in the case of an
+ *   error
  */
 int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
                                         struct dentry *root,
@@ -99,6 +101,8 @@ int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
          * which create files */
         ret = set_create_files_as(new, root->d_inode);
         if (ret < 0) {
+                abort_creds(new);
+                cachefiles_begin_secure(cache, _saved_cred);
                 _leave(" = %d [cfa]", ret);
                 return ret;
         }
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 412593703d1..a9005d862ed 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -504,12 +504,11 @@ static void writepages_finish(struct ceph_osd_request *req,
         int i;
         struct ceph_snap_context *snapc = req->r_snapc;
         struct address_space *mapping = inode->i_mapping;
-        struct writeback_control *wbc = req->r_wbc;
         __s32 rc = -EIO;
         u64 bytes = 0;
         struct ceph_client *client = ceph_inode_to_client(inode);
         long writeback_stat;
-        unsigned issued = __ceph_caps_issued(ci, NULL);
+        unsigned issued = ceph_caps_issued(ci);
 
         /* parse reply */
         replyhead = msg->front.iov_base;
@@ -546,10 +545,6 @@ static void writepages_finish(struct ceph_osd_request *req,
                         clear_bdi_congested(&client->backing_dev_info,
                                             BLK_RW_ASYNC);
 
-                if (i >= wrote) {
-                        dout("inode %p skipping page %p\n", inode, page);
-                        wbc->pages_skipped++;
-                }
                 ceph_put_snap_context((void *)page->private);
                 page->private = 0;
                 ClearPagePrivate(page);
@@ -799,7 +794,6 @@ get_more_pages:
                                 alloc_page_vec(client, req);
                                 req->r_callback = writepages_finish;
                                 req->r_inode = inode;
-                                req->r_wbc = wbc;
                         }
 
                         /* note position of first page in pvec */
diff --git a/fs/ceph/auth.c b/fs/ceph/auth.c
index f6394b94b86..818afe72e6c 100644
--- a/fs/ceph/auth.c
+++ b/fs/ceph/auth.c
@@ -3,6 +3,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 
 #include "types.h"
 #include "auth_none.h"
diff --git a/fs/ceph/auth_none.h b/fs/ceph/auth_none.h
index 56c05533a31..8164df1a08b 100644
--- a/fs/ceph/auth_none.h
+++ b/fs/ceph/auth_none.h
@@ -1,6 +1,8 @@
 #ifndef _FS_CEPH_AUTH_NONE_H
 #define _FS_CEPH_AUTH_NONE_H
 
+#include <linux/slab.h>
+
 #include "auth.h"
 
 /*
diff --git a/fs/ceph/auth_x.c b/fs/ceph/auth_x.c
index d9001a4dc8c..fee5a08da88 100644
--- a/fs/ceph/auth_x.c
+++ b/fs/ceph/auth_x.c
@@ -12,8 +12,6 @@
 #include "auth.h"
 #include "decode.h"
 
-struct kmem_cache *ceph_x_ticketbuf_cachep;
-
 #define TEMP_TICKET_BUF_LEN     256
 
 static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
@@ -131,13 +129,12 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
         char *ticket_buf;
         u8 struct_v;
 
-        dbuf = kmem_cache_alloc(ceph_x_ticketbuf_cachep, GFP_NOFS | GFP_ATOMIC);
+        dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
         if (!dbuf)
                 return -ENOMEM;
 
         ret = -ENOMEM;
-        ticket_buf = kmem_cache_alloc(ceph_x_ticketbuf_cachep,
-                                      GFP_NOFS | GFP_ATOMIC);
+        ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
         if (!ticket_buf)
                 goto out_dbuf;
 
@@ -251,9 +248,9 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
 
         ret = 0;
 out:
-        kmem_cache_free(ceph_x_ticketbuf_cachep, ticket_buf);
+        kfree(ticket_buf);
 out_dbuf:
-        kmem_cache_free(ceph_x_ticketbuf_cachep, dbuf);
+        kfree(dbuf);
         return ret;
 
 bad:
@@ -605,8 +602,6 @@ static void ceph_x_destroy(struct ceph_auth_client *ac)
                 remove_ticket_handler(ac, th);
         }
 
-        kmem_cache_destroy(ceph_x_ticketbuf_cachep);
-
         kfree(ac->private);
         ac->private = NULL;
 }
@@ -641,26 +636,20 @@ int ceph_x_init(struct ceph_auth_client *ac)
         int ret;
 
         dout("ceph_x_init %p\n", ac);
+        ret = -ENOMEM;
         xi = kzalloc(sizeof(*xi), GFP_NOFS);
         if (!xi)
-                return -ENOMEM;
+                goto out;
 
-        ret = -ENOMEM;
-        ceph_x_ticketbuf_cachep = kmem_cache_create("ceph_x_ticketbuf",
-                                      TEMP_TICKET_BUF_LEN, 8,
-                                      (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD),
-                                      NULL);
-        if (!ceph_x_ticketbuf_cachep)
-                goto done_nomem;
         ret = -EINVAL;
         if (!ac->secret) {
                 pr_err("no secret set (for auth_x protocol)\n");
-                goto done_nomem;
+                goto out_nomem;
         }
 
         ret = ceph_crypto_key_unarmor(&xi->secret, ac->secret);
         if (ret)
-                goto done_nomem;
+                goto out_nomem;
 
         xi->starting = true;
         xi->ticket_handlers = RB_ROOT;
@@ -670,10 +659,9 @@ int ceph_x_init(struct ceph_auth_client *ac)
         ac->ops = &ceph_x_ops;
         return 0;
 
-done_nomem:
+out_nomem:
         kfree(xi);
-        if (ceph_x_ticketbuf_cachep)
-                kmem_cache_destroy(ceph_x_ticketbuf_cachep);
+out:
         return ret;
 }
 
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index aa2239fa9a3..d9400534b27 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -858,6 +858,8 @@ static int __ceph_is_any_caps(struct ceph_inode_info *ci)
 }
 
 /*
+ * Remove a cap.  Take steps to deal with a racing iterate_session_caps.
+ *
  * caller should hold i_lock.
  * caller will not hold session s_mutex if called from destroy_inode.
  */
@@ -866,15 +868,10 @@ void __ceph_remove_cap(struct ceph_cap *cap)
         struct ceph_mds_session *session = cap->session;
         struct ceph_inode_info *ci = cap->ci;
         struct ceph_mds_client *mdsc = &ceph_client(ci->vfs_inode.i_sb)->mdsc;
+        int removed = 0;
 
         dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
 
-        /* remove from inode list */
-        rb_erase(&cap->ci_node, &ci->i_caps);
-        cap->ci = NULL;
-        if (ci->i_auth_cap == cap)
-                ci->i_auth_cap = NULL;
-
         /* remove from session list */
         spin_lock(&session->s_cap_lock);
         if (session->s_cap_iterator == cap) {
@@ -885,10 +882,18 @@ void __ceph_remove_cap(struct ceph_cap *cap)
                 list_del_init(&cap->session_caps);
                 session->s_nr_caps--;
                 cap->session = NULL;
+                removed = 1;
         }
+        /* protect backpointer with s_cap_lock: see iterate_session_caps */
+        cap->ci = NULL;
         spin_unlock(&session->s_cap_lock);
 
-        if (cap->session == NULL)
+        /* remove from inode list */
+        rb_erase(&cap->ci_node, &ci->i_caps);
+        if (ci->i_auth_cap == cap)
+                ci->i_auth_cap = NULL;
+
+        if (removed)
                 ceph_put_cap(cap);
 
         if (!__ceph_is_any_caps(ci) && ci->i_snap_realm) {
@@ -1861,8 +1866,8 @@ static void kick_flushing_capsnaps(struct ceph_mds_client *mdsc,
                 } else {
                         pr_err("%p auth cap %p not mds%d ???\n", inode,
                                cap, session->s_mds);
-                        spin_unlock(&inode->i_lock);
                 }
+                spin_unlock(&inode->i_lock);
         }
 }
 
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index ea8ee2e526a..650d2db5ed2 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -880,7 +880,16 @@ static int ceph_rename(struct inode *old_dir, struct dentry *old_dentry,
                  * do_request, above).  If there is no trace, we need
                  * to do it here.
                  */
+
+                /* d_move screws up d_subdirs order */
+                ceph_i_clear(new_dir, CEPH_I_COMPLETE);
+
                 d_move(old_dentry, new_dentry);
+
+                /* ensure target dentry is invalidated, despite
+                   rehashing bug in vfs_rename_dir */
+                new_dentry->d_time = jiffies;
+                ceph_dentry(new_dentry)->lease_shared_gen = 0;
         }
         ceph_mdsc_put_request(req);
         return err;
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 4add3d5da2c..ed6f19721d6 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -665,7 +665,8 @@ more:
                  * throw out any page cache pages in this range. this
                  * may block.
                  */
-                truncate_inode_pages_range(inode->i_mapping, pos, pos+len);
+                truncate_inode_pages_range(inode->i_mapping, pos, 
+                                           (pos+len) | (PAGE_CACHE_SIZE-1));
         } else {
                 pages = alloc_page_vector(num_pages);
                 if (IS_ERR(pages)) {
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 26f883c275e..85b4d2ffdeb 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -733,6 +733,10 @@ no_change:
                                 __ceph_get_fmode(ci, cap_fmode);
                         spin_unlock(&inode->i_lock);
                 }
+        } else if (cap_fmode >= 0) {
+                pr_warning("mds issued no caps on %llx.%llx\n",
+                           ceph_vinop(inode));
+                __ceph_get_fmode(ci, cap_fmode);
         }
 
         /* update delegation info? */
@@ -997,6 +1001,10 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                              dn, dn->d_name.len, dn->d_name.name);
                         dout("fill_trace doing d_move %p -> %p\n",
                              req->r_old_dentry, dn);
+
+                        /* d_move screws up d_subdirs order */
+                        ceph_i_clear(dir, CEPH_I_COMPLETE);
+
                         d_move(req->r_old_dentry, dn);
                         dout(" src %p '%.*s' dst %p '%.*s'\n",
                              req->r_old_dentry,
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 60a9a4ae47b..24561a557e0 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -736,9 +736,10 @@ static void cleanup_cap_releases(struct ceph_mds_session *session)
 }
 
 /*
- * Helper to safely iterate over all caps associated with a session.
+ * Helper to safely iterate over all caps associated with a session, with
+ * special care taken to handle a racing __ceph_remove_cap().
  *
- * caller must hold session s_mutex
+ * Caller must hold session s_mutex.
  */
 static int iterate_session_caps(struct ceph_mds_session *session,
                                  int (*cb)(struct inode *, struct ceph_cap *,
@@ -2136,7 +2137,7 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc, int mds)
         struct ceph_mds_session *session = NULL;
         struct ceph_msg *reply;
         struct rb_node *p;
-        int err;
+        int err = -ENOMEM;
         struct ceph_pagelist *pagelist;
 
         pr_info("reconnect to recovering mds%d\n", mds);
@@ -2185,7 +2186,7 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc, int mds)
                 goto fail;
         err = iterate_session_caps(session, encode_caps_cb, pagelist);
         if (err < 0)
-                goto out;
+                goto fail;
 
         /*
          * snaprealms.  we provide mds with the ino, seq (version), and
@@ -2213,28 +2214,31 @@ send:
         reply->nr_pages = calc_pages_for(0, pagelist->length);
         ceph_con_send(&session->s_con, reply);
 
-        if (session) {
-                session->s_state = CEPH_MDS_SESSION_OPEN;
-                __wake_requests(mdsc, &session->s_waiting);
-        }
+        session->s_state = CEPH_MDS_SESSION_OPEN;
+        mutex_unlock(&session->s_mutex);
+
+        mutex_lock(&mdsc->mutex);
+        __wake_requests(mdsc, &session->s_waiting);
+        mutex_unlock(&mdsc->mutex);
+
+        ceph_put_mds_session(session);
 
-out:
         up_read(&mdsc->snap_rwsem);
-        if (session) {
-                mutex_unlock(&session->s_mutex);
-                ceph_put_mds_session(session);
-        }
         mutex_lock(&mdsc->mutex);
         return;
 
 fail:
         ceph_msg_put(reply);
+        up_read(&mdsc->snap_rwsem);
+        mutex_unlock(&session->s_mutex);
+        ceph_put_mds_session(session);
 fail_nomsg:
         ceph_pagelist_release(pagelist);
         kfree(pagelist);
 fail_nopagelist:
-        pr_err("ENOMEM preparing reconnect for mds%d\n", mds);
-        goto out;
+        pr_err("error %d preparing reconnect for mds%d\n", err, mds);
+        mutex_lock(&mdsc->mutex);
+        return;
 }
 
 
diff --git a/fs/ceph/messenger.c b/fs/ceph/messenger.c
index cdaaa131add..cd4fadb6491 100644
--- a/fs/ceph/messenger.c
+++ b/fs/ceph/messenger.c
@@ -492,7 +492,14 @@ static void prepare_write_message(struct ceph_connection *con)
                 list_move_tail(&m->list_head, &con->out_sent);
         }
 
-        m->hdr.seq = cpu_to_le64(++con->out_seq);
+        /*
+         * only assign outgoing seq # if we haven't sent this message
+         * yet.  if it is requeued, resend with it's original seq.
+         */
+        if (m->needs_out_seq) {
+                m->hdr.seq = cpu_to_le64(++con->out_seq);
+                m->needs_out_seq = false;
+        }
 
         dout("prepare_write_message %p seq %lld type %d len %d+%d+%d %d pgs\n",
              m, con->out_seq, le16_to_cpu(m->hdr.type),
@@ -1334,6 +1341,7 @@ static int read_partial_message(struct ceph_connection *con)
         unsigned front_len, middle_len, data_len, data_off;
         int datacrc = con->msgr->nocrc;
         int skip;
+        u64 seq;
 
         dout("read_partial_message con %p msg %p\n", con, m);
 
@@ -1368,6 +1376,25 @@ static int read_partial_message(struct ceph_connection *con)
                 return -EIO;
         data_off = le16_to_cpu(con->in_hdr.data_off);
 
+        /* verify seq# */
+        seq = le64_to_cpu(con->in_hdr.seq);
+        if ((s64)seq - (s64)con->in_seq < 1) {
+                pr_info("skipping %s%lld %s seq %lld, expected %lld\n",
+                        ENTITY_NAME(con->peer_name),
+                        pr_addr(&con->peer_addr.in_addr),
+                        seq, con->in_seq + 1);
+                con->in_base_pos = -front_len - middle_len - data_len -
+                        sizeof(m->footer);
+                con->in_tag = CEPH_MSGR_TAG_READY;
+                con->in_seq++;
+                return 0;
+        } else if ((s64)seq - (s64)con->in_seq > 1) {
+                pr_err("read_partial_message bad seq %lld expected %lld\n",
+                       seq, con->in_seq + 1);
+                con->error_msg = "bad message sequence # for incoming message";
+                return -EBADMSG;
+        }
+
         /* allocate message? */
         if (!con->in_msg) {
                 dout("got hdr type %d front %d data %d\n", con->in_hdr.type,
@@ -1379,6 +1406,7 @@ static int read_partial_message(struct ceph_connection *con)
                         con->in_base_pos = -front_len - middle_len - data_len -
                                 sizeof(m->footer);
                         con->in_tag = CEPH_MSGR_TAG_READY;
+                        con->in_seq++;
                         return 0;
                 }
                 if (IS_ERR(con->in_msg)) {
@@ -1965,6 +1993,8 @@ void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg)
 
         BUG_ON(msg->front.iov_len != le32_to_cpu(msg->hdr.front_len));
 
+        msg->needs_out_seq = true;
+
         /* queue */
         mutex_lock(&con->mutex);
         BUG_ON(!list_empty(&msg->list_head));
@@ -2030,6 +2060,7 @@ void ceph_con_revoke_message(struct ceph_connection *con, struct ceph_msg *msg)
                 ceph_msg_put(con->in_msg);
                 con->in_msg = NULL;
                 con->in_tag = CEPH_MSGR_TAG_READY;
+                con->in_seq++;
         } else {
                 dout("con_revoke_pages %p msg %p pages %p no-op\n",
                      con, con->in_msg, msg);
@@ -2063,15 +2094,19 @@ struct ceph_msg *ceph_msg_new(int type, int front_len,
         kref_init(&m->kref);
         INIT_LIST_HEAD(&m->list_head);
 
+        m->hdr.tid = 0;
         m->hdr.type = cpu_to_le16(type);
+        m->hdr.priority = cpu_to_le16(CEPH_MSG_PRIO_DEFAULT);
+        m->hdr.version = 0;
         m->hdr.front_len = cpu_to_le32(front_len);
         m->hdr.middle_len = 0;
         m->hdr.data_len = cpu_to_le32(page_len);
         m->hdr.data_off = cpu_to_le16(page_off);
-        m->hdr.priority = cpu_to_le16(CEPH_MSG_PRIO_DEFAULT);
+        m->hdr.reserved = 0;
         m->footer.front_crc = 0;
         m->footer.middle_crc = 0;
         m->footer.data_crc = 0;
+        m->footer.flags = 0;
         m->front_max = front_len;
         m->front_is_vmalloc = false;
         m->more_to_follow = false;
diff --git a/fs/ceph/messenger.h b/fs/ceph/messenger.h
index a343dae73cd..a5caf91cc97 100644
--- a/fs/ceph/messenger.h
+++ b/fs/ceph/messenger.h
@@ -86,6 +86,7 @@ struct ceph_msg {
         struct kref kref;
         bool front_is_vmalloc;
         bool more_to_follow;
+        bool needs_out_seq;
         int front_max;
 
         struct ceph_msgpool *pool;
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index c7b4dedaace..3514f71ff85 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -565,7 +565,8 @@ static int __map_osds(struct ceph_osd_client *osdc,
 {
         struct ceph_osd_request_head *reqhead = req->r_request->front.iov_base;
         struct ceph_pg pgid;
-        int o = -1;
+        int acting[CEPH_PG_MAX_SIZE];
+        int o = -1, num = 0;
         int err;
 
         dout("map_osds %p tid %lld\n", req, req->r_tid);
@@ -576,10 +577,16 @@ static int __map_osds(struct ceph_osd_client *osdc,
         pgid = reqhead->layout.ol_pgid;
         req->r_pgid = pgid;
 
-        o = ceph_calc_pg_primary(osdc->osdmap, pgid);
+        err = ceph_calc_pg_acting(osdc->osdmap, pgid, acting);
+        if (err > 0) {
+                o = acting[0];
+                num = err;
+        }
 
         if ((req->r_osd && req->r_osd->o_osd == o &&
-             req->r_sent >= req->r_osd->o_incarnation) ||
+             req->r_sent >= req->r_osd->o_incarnation &&
+             req->r_num_pg_osds == num &&
+             memcmp(req->r_pg_osds, acting, sizeof(acting[0])*num) == 0) ||
             (req->r_osd == NULL && o == -1))
                 return 0;  /* no change */
 
@@ -587,6 +594,10 @@ static int __map_osds(struct ceph_osd_client *osdc,
              req->r_tid, le32_to_cpu(pgid.pool), le16_to_cpu(pgid.ps), o,
              req->r_osd ? req->r_osd->o_osd : -1);
 
+        /* record full pg acting set */
+        memcpy(req->r_pg_osds, acting, sizeof(acting[0]) * num);
+        req->r_num_pg_osds = num;
+
         if (req->r_osd) {
                 __cancel_request(req);
                 list_del_init(&req->r_osd_item);
@@ -612,7 +623,7 @@ static int __map_osds(struct ceph_osd_client *osdc,
                 __remove_osd_from_lru(req->r_osd);
                 list_add(&req->r_osd_item, &req->r_osd->o_requests);
         }
-        err = 1;   /* osd changed */
+        err = 1;   /* osd or pg changed */
 
 out:
         return err;
@@ -779,16 +790,18 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
         struct ceph_osd_request *req;
         u64 tid;
         int numops, object_len, flags;
+        s32 result;
 
         tid = le64_to_cpu(msg->hdr.tid);
         if (msg->front.iov_len < sizeof(*rhead))
                 goto bad;
         numops = le32_to_cpu(rhead->num_ops);
         object_len = le32_to_cpu(rhead->object_len);
+        result = le32_to_cpu(rhead->result);
         if (msg->front.iov_len != sizeof(*rhead) + object_len +
             numops * sizeof(struct ceph_osd_op))
                 goto bad;
-        dout("handle_reply %p tid %llu\n", msg, tid);
+        dout("handle_reply %p tid %llu result %d\n", msg, tid, (int)result);
 
         /* lookup */
         mutex_lock(&osdc->request_mutex);
@@ -834,7 +847,8 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
         dout("handle_reply tid %llu flags %d\n", tid, flags);
 
         /* either this is a read, or we got the safe response */
-        if ((flags & CEPH_OSD_FLAG_ONDISK) ||
+        if (result < 0 ||
+            (flags & CEPH_OSD_FLAG_ONDISK) ||
             ((flags & CEPH_OSD_FLAG_WRITE) == 0))
                 __unregister_request(osdc, req);
 
diff --git a/fs/ceph/osd_client.h b/fs/ceph/osd_client.h
index b0759911e7c..ce776989ef6 100644
--- a/fs/ceph/osd_client.h
+++ b/fs/ceph/osd_client.h
@@ -48,6 +48,8 @@ struct ceph_osd_request {
         struct list_head r_osd_item;
         struct ceph_osd *r_osd;
         struct ceph_pg   r_pgid;
+        int              r_pg_osds[CEPH_PG_MAX_SIZE];
+        int              r_num_pg_osds;
 
         struct ceph_connection *r_con_filling_msg;
 
@@ -66,7 +68,6 @@ struct ceph_osd_request {
         struct list_head  r_unsafe_item;
 
         struct inode *r_inode;                /* for use by callbacks */
-        struct writeback_control *r_wbc;      /* ditto */
 
         char              r_oid[40];          /* object name */
         int               r_oid_len;
diff --git a/fs/ceph/osdmap.c b/fs/ceph/osdmap.c
index 2e2c15eed82..cfdd8f4388b 100644
--- a/fs/ceph/osdmap.c
+++ b/fs/ceph/osdmap.c
@@ -1041,12 +1041,33 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
 }
 
 /*
+ * Return acting set for given pgid.
+ */
+int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+                        int *acting)
+{
+        int rawosds[CEPH_PG_MAX_SIZE], *osds;
+        int i, o, num = CEPH_PG_MAX_SIZE;
+
+        osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
+        if (!osds)
+                return -1;
+
+        /* primary is first up osd */
+        o = 0;
+        for (i = 0; i < num; i++)
+                if (ceph_osd_is_up(osdmap, osds[i]))
+                        acting[o++] = osds[i];
+        return o;
+}
+
+/*
  * Return primary osd for given pgid, or -1 if none.
  */
 int ceph_calc_pg_primary(struct ceph_osdmap *osdmap, struct ceph_pg pgid)
 {
-        int rawosds[10], *osds;
-        int i, num = ARRAY_SIZE(rawosds);
+        int rawosds[CEPH_PG_MAX_SIZE], *osds;
+        int i, num = CEPH_PG_MAX_SIZE;
 
         osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
         if (!osds)
@@ -1054,9 +1075,7 @@ int ceph_calc_pg_primary(struct ceph_osdmap *osdmap, struct ceph_pg pgid)
 
         /* primary is first up osd */
         for (i = 0; i < num; i++)
-                if (ceph_osd_is_up(osdmap, osds[i])) {
+                if (ceph_osd_is_up(osdmap, osds[i]))
                         return osds[i];
-                        break;
-                }
         return -1;
 }
diff --git a/fs/ceph/osdmap.h b/fs/ceph/osdmap.h
index 8bc9f1e4f56..970b547e510 100644
--- a/fs/ceph/osdmap.h
+++ b/fs/ceph/osdmap.h
@@ -120,6 +120,8 @@ extern int ceph_calc_object_layout(struct ceph_object_layout *ol,
                                    const char *oid,
                                    struct ceph_file_layout *fl,
                                    struct ceph_osdmap *osdmap);
+extern int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+                               int *acting);
 extern int ceph_calc_pg_primary(struct ceph_osdmap *osdmap,
                                 struct ceph_pg pgid);
 
diff --git a/fs/ceph/rados.h b/fs/ceph/rados.h
index a1fc1d017b5..fd56451a871 100644
--- a/fs/ceph/rados.h
+++ b/fs/ceph/rados.h
@@ -58,6 +58,7 @@ struct ceph_timespec {
 #define CEPH_PG_LAYOUT_LINEAR 2
 #define CEPH_PG_LAYOUT_HYBRID 3
 
+#define CEPH_PG_MAX_SIZE      16  /* max # osds in a single pg */
 
 /*
  * placement group.
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 2b881262ef6..d5114db7045 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -869,16 +869,20 @@ skip_inode:
                                 continue;
                         ci = ceph_inode(inode);
                         spin_lock(&inode->i_lock);
-                        if (!ci->i_snap_realm)
-                                goto split_skip_inode;
-                        ceph_put_snap_realm(mdsc, ci->i_snap_realm);
-                        spin_lock(&realm->inodes_with_caps_lock);
-                        list_add(&ci->i_snap_realm_item,
-                                 &realm->inodes_with_caps);
-                        ci->i_snap_realm = realm;
-                        spin_unlock(&realm->inodes_with_caps_lock);
-                        ceph_get_snap_realm(mdsc, realm);
-split_skip_inode:
+                        if (list_empty(&ci->i_snap_realm_item)) {
+                                struct ceph_snap_realm *oldrealm =
+                                        ci->i_snap_realm;
+
+                                dout(" moving %p to split realm %llx %p\n",
+                                     inode, realm->ino, realm);
+                                spin_lock(&realm->inodes_with_caps_lock);
+                                list_add(&ci->i_snap_realm_item,
+                                         &realm->inodes_with_caps);
+                                ci->i_snap_realm = realm;
+                                spin_unlock(&realm->inodes_with_caps_lock);
+                                ceph_get_snap_realm(mdsc, realm);
+                                ceph_put_snap_realm(mdsc, oldrealm);
+                        }
                         spin_unlock(&inode->i_lock);
                         iput(inode);
                 }
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 75d02eaa127..110857ba926 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -47,10 +47,20 @@ const char *ceph_file_part(const char *s, int len)
  */
 static void ceph_put_super(struct super_block *s)
 {
-        struct ceph_client *cl = ceph_client(s);
+        struct ceph_client *client = ceph_sb_to_client(s);
 
         dout("put_super\n");
-        ceph_mdsc_close_sessions(&cl->mdsc);
+        ceph_mdsc_close_sessions(&client->mdsc);
+
+        /*
+         * ensure we release the bdi before put_anon_super releases
+         * the device name.
+         */
+        if (s->s_bdi == &client->backing_dev_info) {
+                bdi_unregister(&client->backing_dev_info);
+                s->s_bdi = NULL;
+        }
+
         return;
 }
 
@@ -636,6 +646,8 @@ static void ceph_destroy_client(struct ceph_client *client)
         destroy_workqueue(client->pg_inv_wq);
         destroy_workqueue(client->trunc_wq);
 
+        bdi_destroy(&client->backing_dev_info);
+
         if (client->msgr)
                 ceph_messenger_destroy(client->msgr);
         mempool_destroy(client->wb_pagevec_pool);
@@ -876,14 +888,14 @@ static int ceph_register_bdi(struct super_block *sb, struct ceph_client *client)
 {
         int err;
 
-        sb->s_bdi = &client->backing_dev_info;
-
         /* set ra_pages based on rsize mount option? */
         if (client->mount_args->rsize >= PAGE_CACHE_SIZE)
                 client->backing_dev_info.ra_pages =
                         (client->mount_args->rsize + PAGE_CACHE_SIZE - 1)
                         >> PAGE_SHIFT;
         err = bdi_register_dev(&client->backing_dev_info, sb->s_dev);
+        if (!err)
+                sb->s_bdi = &client->backing_dev_info;
         return err;
 }
 
@@ -957,9 +969,6 @@ static void ceph_kill_sb(struct super_block *s)
         dout("kill_sb %p\n", s);
         ceph_mdsc_pre_umount(&client->mdsc);
         kill_anon_super(s);    /* will call put_super after sb is r/o */
-        if (s->s_bdi == &client->backing_dev_info)
-                bdi_unregister(&client->backing_dev_info);
-        bdi_destroy(&client->backing_dev_info);
         ceph_destroy_client(client);
 }
 
@@ -996,9 +1005,10 @@ static int __init init_ceph(void)
         if (ret)
                 goto out_icache;
 
-        pr_info("loaded %d.%d.%d (mon/mds/osd proto %d/%d/%d)\n",
-                CEPH_VERSION_MAJOR, CEPH_VERSION_MINOR, CEPH_VERSION_PATCH,
-                CEPH_MONC_PROTOCOL, CEPH_MDSC_PROTOCOL, CEPH_OSDC_PROTOCOL);
+        pr_info("loaded (mon/mds/osd proto %d/%d/%d, osdmap %d/%d %d/%d)\n",
+                CEPH_MONC_PROTOCOL, CEPH_MDSC_PROTOCOL, CEPH_OSDC_PROTOCOL,
+                CEPH_OSDMAP_VERSION, CEPH_OSDMAP_VERSION_EXT,
+                CEPH_OSDMAP_INC_VERSION, CEPH_OSDMAP_INC_VERSION_EXT);
         return 0;
 
 out_icache:
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index e30dfbb056c..13513b80d87 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/mempool.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/wait.h>
 #include <linux/writeback.h>
 #include <linux/slab.h>
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index ecf0ffbe2b6..0c2fd17439c 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -502,6 +502,7 @@ struct dfs_info3_param {
 #define CIFS_FATTR_DFS_REFERRAL         0x1
 #define CIFS_FATTR_DELETE_PENDING       0x2
 #define CIFS_FATTR_NEED_REVAL           0x4
+#define CIFS_FATTR_INO_COLLISION        0x8
 
 struct cifs_fattr {
         u32             cf_flags;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 35ec1171621..29b9ea244c8 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -715,6 +715,16 @@ cifs_find_inode(struct inode *inode, void *opaque)
         if (CIFS_I(inode)->uniqueid != fattr->cf_uniqueid)
                 return 0;
 
+        /*
+         * uh oh -- it's a directory. We can't use it since hardlinked dirs are
+         * verboten. Disable serverino and return it as if it were found, the
+         * caller can discard it, generate a uniqueid and retry the find
+         */
+        if (S_ISDIR(inode->i_mode) && !list_empty(&inode->i_dentry)) {
+                fattr->cf_flags |= CIFS_FATTR_INO_COLLISION;
+                cifs_autodisable_serverino(CIFS_SB(inode->i_sb));
+        }
+
         return 1;
 }
 
@@ -734,15 +744,22 @@ cifs_iget(struct super_block *sb, struct cifs_fattr *fattr)
         unsigned long hash;
         struct inode *inode;
 
+retry_iget5_locked:
         cFYI(1, ("looking for uniqueid=%llu", fattr->cf_uniqueid));
 
         /* hash down to 32-bits on 32-bit arch */
         hash = cifs_uniqueid_to_ino_t(fattr->cf_uniqueid);
 
         inode = iget5_locked(sb, hash, cifs_find_inode, cifs_init_inode, fattr);
-
-        /* we have fattrs in hand, update the inode */
         if (inode) {
+                /* was there a problematic inode number collision? */
+                if (fattr->cf_flags & CIFS_FATTR_INO_COLLISION) {
+                        iput(inode);
+                        fattr->cf_uniqueid = iunique(sb, ROOT_I);
+                        fattr->cf_flags &= ~CIFS_FATTR_INO_COLLISION;
+                        goto retry_iget5_locked;
+                }
+
                 cifs_fattr_to_inode(inode, fattr);
                 if (sb->s_flags & MS_NOATIME)
                         inode->i_flags |= S_NOATIME | S_NOCMTIME;
diff --git a/fs/compat.c b/fs/compat.c
index 4b6ed03cc47..05448730f84 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1531,8 +1531,6 @@ int compat_do_execve(char * filename,
         if (retval < 0)
                 goto out;
 
-        current->stack_start = current->mm->start_stack;
-
         /* execve succeeded */
         current->fs->in_exec = 0;
         current->in_execve = 0;
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 8e48b52205a..0b502f80c69 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -645,6 +645,7 @@ static void detach_groups(struct config_group *group)
 
                 configfs_detach_group(sd->s_element);
                 child->d_inode->i_flags |= S_DEAD;
+                dont_mount(child);
 
                 mutex_unlock(&child->d_inode->i_mutex);
 
@@ -840,6 +841,7 @@ static int configfs_attach_item(struct config_item *parent_item,
                         mutex_lock(&dentry->d_inode->i_mutex);
                         configfs_remove_dir(item);
                         dentry->d_inode->i_flags |= S_DEAD;
+                        dont_mount(dentry);
                         mutex_unlock(&dentry->d_inode->i_mutex);
                         d_delete(dentry);
                 }
@@ -882,6 +884,7 @@ static int configfs_attach_group(struct config_item *parent_item,
                 if (ret) {
                         configfs_detach_item(item);
                         dentry->d_inode->i_flags |= S_DEAD;
+                        dont_mount(dentry);
                 }
                 configfs_adjust_dir_dirent_depth_after_populate(sd);
                 mutex_unlock(&dentry->d_inode->i_mutex);
@@ -1725,6 +1728,7 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys)
         mutex_unlock(&configfs_symlink_mutex);
         configfs_detach_group(&group->cg_item);
         dentry->d_inode->i_flags |= S_DEAD;
+        dont_mount(dentry);
         mutex_unlock(&dentry->d_inode->i_mutex);
 
         d_delete(dentry);
diff --git a/fs/exec.c b/fs/exec.c
index 49cdaa19e5b..e6e94c626c2 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1387,8 +1387,6 @@ int do_execve(char * filename,
         if (retval < 0)
                 goto out;
 
-        current->stack_start = current->mm->start_stack;
-
         /* execve succeeded */
         current->fs->in_exec = 0;
         current->in_execve = 0;
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 157382fa625..b66832ac33a 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -446,10 +446,8 @@ static int jfs_fill_super(struct super_block *sb, void *data, int silent)
         /* initialize the mount flag and determine the default error handler */
         flag = JFS_ERR_REMOUNT_RO;
 
-        if (!parse_options((char *) data, sb, &newLVSize, &flag)) {
-                kfree(sbi);
-                return -EINVAL;
-        }
+        if (!parse_options((char *) data, sb, &newLVSize, &flag))
+                goto out_kfree;
         sbi->flag = flag;
 
 #ifdef CONFIG_JFS_POSIX_ACL
@@ -458,7 +456,7 @@ static int jfs_fill_super(struct super_block *sb, void *data, int silent)
 
         if (newLVSize) {
                 printk(KERN_ERR "resize option for remount only\n");
-                return -EINVAL;
+                goto out_kfree;
         }
 
         /*
@@ -478,7 +476,7 @@ static int jfs_fill_super(struct super_block *sb, void *data, int silent)
         inode = new_inode(sb);
         if (inode == NULL) {
                 ret = -ENOMEM;
-                goto out_kfree;
+                goto out_unload;
         }
         inode->i_ino = 0;
         inode->i_nlink = 1;
@@ -550,9 +548,10 @@ out_mount_failed:
         make_bad_inode(sbi->direct_inode);
         iput(sbi->direct_inode);
         sbi->direct_inode = NULL;
-out_kfree:
+out_unload:
         if (sbi->nls_tab)
                 unload_nls(sbi->nls_tab);
+out_kfree:
         kfree(sbi);
         return ret;
 }
diff --git a/fs/logfs/super.c b/fs/logfs/super.c
index 5866ee6e132..d7c23ed8349 100644
--- a/fs/logfs/super.c
+++ b/fs/logfs/super.c
@@ -333,27 +333,27 @@ static int logfs_get_sb_final(struct super_block *sb, struct vfsmount *mnt)
                 goto fail;
 
         sb->s_root = d_alloc_root(rootdir);
-        if (!sb->s_root)
-                goto fail2;
+        if (!sb->s_root) {
+                iput(rootdir);
+                goto fail;
+        }
 
         super->s_erase_page = alloc_pages(GFP_KERNEL, 0);
         if (!super->s_erase_page)
-                goto fail2;
+                goto fail;
         memset(page_address(super->s_erase_page), 0xFF, PAGE_SIZE);
 
         /* FIXME: check for read-only mounts */
         err = logfs_make_writeable(sb);
         if (err)
-                goto fail3;
+                goto fail1;
 
         log_super("LogFS: Finished mounting\n");
         simple_set_mnt(mnt, sb);
         return 0;
 
-fail3:
+fail1:
         __free_page(super->s_erase_page);
-fail2:
-        iput(rootdir);
 fail:
         iput(logfs_super(sb)->s_master_inode);
         return -EIO;
diff --git a/fs/namei.c b/fs/namei.c
index a7dce91a7e4..b86b96fe1dc 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1641,7 +1641,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
         if (nd->last.name[nd->last.len]) {
                 if (open_flag & O_CREAT)
                         goto exit;
-                nd->flags |= LOOKUP_DIRECTORY;
+                nd->flags |= LOOKUP_DIRECTORY | LOOKUP_FOLLOW;
         }
 
         /* just plain open? */
@@ -1830,6 +1830,8 @@ reval:
         }
         if (open_flag & O_DIRECTORY)
                 nd.flags |= LOOKUP_DIRECTORY;
+        if (!(open_flag & O_NOFOLLOW))
+                nd.flags |= LOOKUP_FOLLOW;
         filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname);
         while (unlikely(!filp)) { /* trailing symlink */
                 struct path holder;
@@ -1837,7 +1839,7 @@ reval:
                 void *cookie;
                 error = -ELOOP;
                 /* S_ISDIR part is a temporary automount kludge */
-                if ((open_flag & O_NOFOLLOW) && !S_ISDIR(inode->i_mode))
+                if (!(nd.flags & LOOKUP_FOLLOW) && !S_ISDIR(inode->i_mode))
                         goto exit_dput;
                 if (count++ == 32)
                         goto exit_dput;
@@ -2174,8 +2176,10 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
                 error = security_inode_rmdir(dir, dentry);
                 if (!error) {
                         error = dir->i_op->rmdir(dir, dentry);
-                        if (!error)
+                        if (!error) {
                                 dentry->d_inode->i_flags |= S_DEAD;
+                                dont_mount(dentry);
+                        }
                 }
         }
         mutex_unlock(&dentry->d_inode->i_mutex);
@@ -2259,7 +2263,7 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
                 if (!error) {
                         error = dir->i_op->unlink(dir, dentry);
                         if (!error)
-                                dentry->d_inode->i_flags |= S_DEAD;
+                                dont_mount(dentry);
                 }
         }
         mutex_unlock(&dentry->d_inode->i_mutex);
@@ -2570,17 +2574,20 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
                 return error;
 
         target = new_dentry->d_inode;
-        if (target) {
+        if (target)
                 mutex_lock(&target->i_mutex);
-                dentry_unhash(new_dentry);
-        }
         if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
                 error = -EBUSY;
-        else 
+        else {
+                if (target)
+                        dentry_unhash(new_dentry);
                 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
+        }
         if (target) {
-                if (!error)
+                if (!error) {
                         target->i_flags |= S_DEAD;
+                        dont_mount(new_dentry);
+                }
                 mutex_unlock(&target->i_mutex);
                 if (d_unhashed(new_dentry))
                         d_rehash(new_dentry);
@@ -2612,7 +2619,7 @@ static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
                 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
         if (!error) {
                 if (target)
-                        target->i_flags |= S_DEAD;
+                        dont_mount(new_dentry);
                 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
                         d_move(old_dentry, new_dentry);
         }
diff --git a/fs/namespace.c b/fs/namespace.c
index 8174c8ab5c7..f20cb57d106 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1432,7 +1432,7 @@ static int graft_tree(struct vfsmount *mnt, struct path *path)
 
         err = -ENOENT;
         mutex_lock(&path->dentry->d_inode->i_mutex);
-        if (IS_DEADDIR(path->dentry->d_inode))
+        if (cant_mount(path->dentry))
                 goto out_unlock;
 
         err = security_sb_check_sb(mnt, path);
@@ -1623,7 +1623,7 @@ static int do_move_mount(struct path *path, char *old_name)
 
         err = -ENOENT;
         mutex_lock(&path->dentry->d_inode->i_mutex);
-        if (IS_DEADDIR(path->dentry->d_inode))
+        if (cant_mount(path->dentry))
                 goto out1;
 
         if (d_unlinked(path->dentry))
@@ -2234,7 +2234,7 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
         if (!check_mnt(root.mnt))
                 goto out2;
         error = -ENOENT;
-        if (IS_DEADDIR(new.dentry->d_inode))
+        if (cant_mount(old.dentry))
                 goto out2;
         if (d_unlinked(new.dentry))
                 goto out2;
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 15671245c6e..ea61d26e787 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -24,6 +24,8 @@
 
 static void nfs_do_free_delegation(struct nfs_delegation *delegation)
 {
+        if (delegation->cred)
+                put_rpccred(delegation->cred);
         kfree(delegation);
 }
 
@@ -36,13 +38,7 @@ static void nfs_free_delegation_callback(struct rcu_head *head)
 
 static void nfs_free_delegation(struct nfs_delegation *delegation)
 {
-        struct rpc_cred *cred;
-
-        cred = rcu_dereference(delegation->cred);
-        rcu_assign_pointer(delegation->cred, NULL);
         call_rcu(&delegation->rcu, nfs_free_delegation_callback);
-        if (cred)
-                put_rpccred(cred);
 }
 
 void nfs_mark_delegation_referenced(struct nfs_delegation *delegation)
@@ -129,21 +125,35 @@ again:
  */
 void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res)
 {
-        struct nfs_delegation *delegation = NFS_I(inode)->delegation;
-        struct rpc_cred *oldcred;
+        struct nfs_delegation *delegation;
+        struct rpc_cred *oldcred = NULL;
 
-        if (delegation == NULL)
-                return;
-        memcpy(delegation->stateid.data, res->delegation.data,
-                        sizeof(delegation->stateid.data));
-        delegation->type = res->delegation_type;
-        delegation->maxsize = res->maxsize;
-        oldcred = delegation->cred;
-        delegation->cred = get_rpccred(cred);
-        clear_bit(NFS_DELEGATION_NEED_RECLAIM, &delegation->flags);
-        NFS_I(inode)->delegation_state = delegation->type;
-        smp_wmb();
-        put_rpccred(oldcred);
+        rcu_read_lock();
+        delegation = rcu_dereference(NFS_I(inode)->delegation);
+        if (delegation != NULL) {
+                spin_lock(&delegation->lock);
+                if (delegation->inode != NULL) {
+                        memcpy(delegation->stateid.data, res->delegation.data,
+                               sizeof(delegation->stateid.data));
+                        delegation->type = res->delegation_type;
+                        delegation->maxsize = res->maxsize;
+                        oldcred = delegation->cred;
+                        delegation->cred = get_rpccred(cred);
+                        clear_bit(NFS_DELEGATION_NEED_RECLAIM,
+                                  &delegation->flags);
+                        NFS_I(inode)->delegation_state = delegation->type;
+                        spin_unlock(&delegation->lock);
+                        put_rpccred(oldcred);
+                        rcu_read_unlock();
+                } else {
+                        /* We appear to have raced with a delegation return. */
+                        spin_unlock(&delegation->lock);
+                        rcu_read_unlock();
+                        nfs_inode_set_delegation(inode, cred, res);
+                }
+        } else {
+                rcu_read_unlock();
+        }
 }
 
 static int nfs_do_return_delegation(struct inode *inode, struct nfs_delegation *delegation, int issync)
@@ -166,9 +176,13 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
         return inode;
 }
 
-static struct nfs_delegation *nfs_detach_delegation_locked(struct nfs_inode *nfsi, const nfs4_stateid *stateid)
+static struct nfs_delegation *nfs_detach_delegation_locked(struct nfs_inode *nfsi,
+                                                           const nfs4_stateid *stateid,
+                                                           struct nfs_client *clp)
 {
-        struct nfs_delegation *delegation = rcu_dereference(nfsi->delegation);
+        struct nfs_delegation *delegation =
+                rcu_dereference_protected(nfsi->delegation,
+                                          lockdep_is_held(&clp->cl_lock));
 
         if (delegation == NULL)
                 goto nomatch;
@@ -195,7 +209,7 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
 {
         struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
         struct nfs_inode *nfsi = NFS_I(inode);
-        struct nfs_delegation *delegation;
+        struct nfs_delegation *delegation, *old_delegation;
         struct nfs_delegation *freeme = NULL;
         int status = 0;
 
@@ -213,10 +227,12 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
         spin_lock_init(&delegation->lock);
 
         spin_lock(&clp->cl_lock);
-        if (rcu_dereference(nfsi->delegation) != NULL) {
-                if (memcmp(&delegation->stateid, &nfsi->delegation->stateid,
-                                        sizeof(delegation->stateid)) == 0 &&
-                                delegation->type == nfsi->delegation->type) {
+        old_delegation = rcu_dereference_protected(nfsi->delegation,
+                                                   lockdep_is_held(&clp->cl_lock));
+        if (old_delegation != NULL) {
+                if (memcmp(&delegation->stateid, &old_delegation->stateid,
+                                        sizeof(old_delegation->stateid)) == 0 &&
+                                delegation->type == old_delegation->type) {
                         goto out;
                 }
                 /*
@@ -226,12 +242,12 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
                 dfprintk(FILE, "%s: server %s handed out "
                                 "a duplicate delegation!\n",
                                 __func__, clp->cl_hostname);
-                if (delegation->type <= nfsi->delegation->type) {
+                if (delegation->type <= old_delegation->type) {
                         freeme = delegation;
                         delegation = NULL;
                         goto out;
                 }
-                freeme = nfs_detach_delegation_locked(nfsi, NULL);
+                freeme = nfs_detach_delegation_locked(nfsi, NULL, clp);
         }
         list_add_rcu(&delegation->super_list, &clp->cl_delegations);
         nfsi->delegation_state = delegation->type;
@@ -301,7 +317,7 @@ restart:
                 if (inode == NULL)
                         continue;
                 spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL);
+                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL, clp);
                 spin_unlock(&clp->cl_lock);
                 rcu_read_unlock();
                 if (delegation != NULL) {
@@ -330,9 +346,9 @@ void nfs_inode_return_delegation_noreclaim(struct inode *inode)
         struct nfs_inode *nfsi = NFS_I(inode);
         struct nfs_delegation *delegation;
 
-        if (rcu_dereference(nfsi->delegation) != NULL) {
+        if (rcu_access_pointer(nfsi->delegation) != NULL) {
                 spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(nfsi, NULL);
+                delegation = nfs_detach_delegation_locked(nfsi, NULL, clp);
                 spin_unlock(&clp->cl_lock);
                 if (delegation != NULL)
                         nfs_do_return_delegation(inode, delegation, 0);
@@ -346,9 +362,9 @@ int nfs_inode_return_delegation(struct inode *inode)
         struct nfs_delegation *delegation;
         int err = 0;
 
-        if (rcu_dereference(nfsi->delegation) != NULL) {
+        if (rcu_access_pointer(nfsi->delegation) != NULL) {
                 spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(nfsi, NULL);
+                delegation = nfs_detach_delegation_locked(nfsi, NULL, clp);
                 spin_unlock(&clp->cl_lock);
                 if (delegation != NULL) {
                         nfs_msync_inode(inode);
@@ -526,7 +542,7 @@ restart:
                 if (inode == NULL)
                         continue;
                 spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL);
+                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL, clp);
                 spin_unlock(&clp->cl_lock);
                 rcu_read_unlock();
                 if (delegation != NULL)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 23c06f77f4c..4eb9baa3308 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -443,8 +443,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
         if (size_change)
                 put_write_access(inode);
         if (!err)
-                if (EX_ISSYNC(fhp->fh_export))
-                        write_inode_now(inode, 1);
+                commit_metadata(fhp);
 out:
         return err;
 
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 0cdbc5e7655..48145f505a6 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -749,6 +749,7 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent,
         sb->s_export_op = &nilfs_export_ops;
         sb->s_root = NULL;
         sb->s_time_gran = 1;
+        sb->s_bdi = nilfs->ns_bdi;
 
         err = load_nilfs(nilfs, sbi);
         if (err)
diff --git a/fs/notify/inotify/Kconfig b/fs/notify/inotify/Kconfig
index 3e56dbffe72..b3a159b21cf 100644
--- a/fs/notify/inotify/Kconfig
+++ b/fs/notify/inotify/Kconfig
@@ -15,6 +15,7 @@ config INOTIFY
 
 config INOTIFY_USER
         bool "Inotify support for userspace"
+        select ANON_INODES
         select FSNOTIFY
         default y
         ---help---
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 1afb0a10229..e27960cd76a 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -28,6 +28,7 @@
 #include <linux/path.h> /* struct path */
 #include <linux/slab.h> /* kmem_* */
 #include <linux/types.h>
+#include <linux/sched.h>
 
 #include "inotify.h"
 
@@ -146,6 +147,7 @@ static void inotify_free_group_priv(struct fsnotify_group *group)
         idr_for_each(&group->inotify_data.idr, idr_callback, group);
         idr_remove_all(&group->inotify_data.idr);
         idr_destroy(&group->inotify_data.idr);
+        free_uid(group->inotify_data.user);
 }
 
 void inotify_free_event_priv(struct fsnotify_event_private_data *fsn_event_priv)
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 472cdf29ef8..e46ca685b9b 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -546,21 +546,24 @@ retry:
         if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL)))
                 goto out_err;
 
+        /* we are putting the mark on the idr, take a reference */
+        fsnotify_get_mark(&tmp_ientry->fsn_entry);
+
         spin_lock(&group->inotify_data.idr_lock);
         ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
                                 group->inotify_data.last_wd+1,
                                 &tmp_ientry->wd);
         spin_unlock(&group->inotify_data.idr_lock);
         if (ret) {
+                /* we didn't get on the idr, drop the idr reference */
+                fsnotify_put_mark(&tmp_ientry->fsn_entry);
+
                 /* idr was out of memory allocate and try again */
                 if (ret == -EAGAIN)
                         goto retry;
                 goto out_err;
         }
 
-        /* we put the mark on the idr, take a reference */
-        fsnotify_get_mark(&tmp_ientry->fsn_entry);
-
         /* we are on the idr, now get on the inode */
         ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode);
         if (ret) {
@@ -578,16 +581,13 @@ retry:
         /* return the watch descriptor for this new entry */
         ret = tmp_ientry->wd;
 
-        /* match the ref from fsnotify_init_markentry() */
-        fsnotify_put_mark(&tmp_ientry->fsn_entry);
-
         /* if this mark added a new event update the group mask */
         if (mask & ~group->mask)
                 fsnotify_recalc_group_mask(group);
 
 out_err:
-        if (ret < 0)
-                kmem_cache_free(inotify_inode_mark_cachep, tmp_ientry);
+        /* match the ref from fsnotify_init_markentry() */
+        fsnotify_put_mark(&tmp_ientry->fsn_entry);
 
         return ret;
 }
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index ecebb227679..f9d5d3ffc75 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -406,6 +406,7 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb,
                                 struct buffer_head *bh)
 {
         int ret = 0;
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)bh->b_data;
 
         mlog_entry_void();
 
@@ -425,6 +426,7 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb,
 
         get_bh(bh); /* for end_buffer_write_sync() */
         bh->b_end_io = end_buffer_write_sync;
+        ocfs2_compute_meta_ecc(osb->sb, bh->b_data, &di->i_check);
         submit_bh(WRITE, bh);
 
         wait_on_buffer(bh);
diff --git a/fs/ocfs2/dlm/dlmast.c b/fs/ocfs2/dlm/dlmast.c
index a795eb91f4e..12d5eb78a11 100644
--- a/fs/ocfs2/dlm/dlmast.c
+++ b/fs/ocfs2/dlm/dlmast.c
@@ -184,9 +184,8 @@ static void dlm_update_lvb(struct dlm_ctxt *dlm, struct dlm_lock_resource *res,
         BUG_ON(!lksb);
 
         /* only updates if this node masters the lockres */
+        spin_lock(&res->spinlock);
         if (res->owner == dlm->node_num) {
-
-                spin_lock(&res->spinlock);
                 /* check the lksb flags for the direction */
                 if (lksb->flags & DLM_LKSB_GET_LVB) {
                         mlog(0, "getting lvb from lockres for %s node\n",
@@ -201,8 +200,8 @@ static void dlm_update_lvb(struct dlm_ctxt *dlm, struct dlm_lock_resource *res,
                  * here. In the future we might want to clear it at the time
                  * the put is actually done.
                  */
-                spin_unlock(&res->spinlock);
         }
+        spin_unlock(&res->spinlock);
 
         /* reset any lvb flags on the lksb */
         lksb->flags &= ~(DLM_LKSB_PUT_LVB|DLM_LKSB_GET_LVB);
diff --git a/fs/ocfs2/dlmfs/dlmfs.c b/fs/ocfs2/dlmfs/dlmfs.c
index 1b0de157a08..b83d6107a1f 100644
--- a/fs/ocfs2/dlmfs/dlmfs.c
+++ b/fs/ocfs2/dlmfs/dlmfs.c
@@ -112,20 +112,20 @@ MODULE_PARM_DESC(capabilities, DLMFS_CAPABILITIES);
  * O_RDONLY -> PRMODE level
  * O_WRONLY -> EXMODE level
  *
- * O_NONBLOCK -> LKM_NOQUEUE
+ * O_NONBLOCK -> NOQUEUE
  */
 static int dlmfs_decode_open_flags(int open_flags,
                                    int *level,
                                    int *flags)
 {
         if (open_flags & (O_WRONLY|O_RDWR))
-                *level = LKM_EXMODE;
+                *level = DLM_LOCK_EX;
         else
-                *level = LKM_PRMODE;
+                *level = DLM_LOCK_PR;
 
         *flags = 0;
         if (open_flags & O_NONBLOCK)
-                *flags |= LKM_NOQUEUE;
+                *flags |= DLM_LKF_NOQUEUE;
 
         return 0;
 }
@@ -166,7 +166,7 @@ static int dlmfs_file_open(struct inode *inode,
                  * to be able userspace to be able to distinguish a
                  * valid lock request from one that simply couldn't be
                  * granted. */
-                if (flags & LKM_NOQUEUE && status == -EAGAIN)
+                if (flags & DLM_LKF_NOQUEUE && status == -EAGAIN)
                         status = -ETXTBSY;
                 kfree(fp);
                 goto bail;
@@ -193,7 +193,7 @@ static int dlmfs_file_release(struct inode *inode,
         status = 0;
         if (fp) {
                 level = fp->fp_lock_level;
-                if (level != LKM_IVMODE)
+                if (level != DLM_LOCK_IV)
                         user_dlm_cluster_unlock(&ip->ip_lockres, level);
 
                 kfree(fp);
@@ -262,7 +262,7 @@ static ssize_t dlmfs_file_read(struct file *filp,
         if ((count + *ppos) > i_size_read(inode))
                 readlen = i_size_read(inode) - *ppos;
         else
-                readlen = count - *ppos;
+                readlen = count;
 
         lvb_buf = kmalloc(readlen, GFP_NOFS);
         if (!lvb_buf)
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 17947dc8341..a5fbd9cea96 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -684,6 +684,7 @@ restarted_transaction:
                 if (why == RESTART_META) {
                         mlog(0, "restarting function.\n");
                         restart_func = 1;
+                        status = 0;
                 } else {
                         BUG_ON(why != RESTART_TRANS);
 
@@ -1981,18 +1982,18 @@ relock:
         /* communicate with ocfs2_dio_end_io */
         ocfs2_iocb_set_rw_locked(iocb, rw_level);
 
-        if (direct_io) {
-                ret = generic_segment_checks(iov, &nr_segs, &ocount,
-                                             VERIFY_READ);
-                if (ret)
-                        goto out_dio;
+        ret = generic_segment_checks(iov, &nr_segs, &ocount,
+                                     VERIFY_READ);
+        if (ret)
+                goto out_dio;
 
-                count = ocount;
-                ret = generic_write_checks(file, ppos, &count,
-                                           S_ISBLK(inode->i_mode));
-                if (ret)
-                        goto out_dio;
+        count = ocount;
+        ret = generic_write_checks(file, ppos, &count,
+                                   S_ISBLK(inode->i_mode));
+        if (ret)
+                goto out_dio;
 
+        if (direct_io) {
                 written = generic_file_direct_write(iocb, iov, &nr_segs, *ppos,
                                                     ppos, count, ocount);
                 if (written < 0) {
@@ -2007,7 +2008,10 @@ relock:
                         goto out_dio;
                 }
         } else {
-                written = __generic_file_aio_write(iocb, iov, nr_segs, ppos);
+                current->backing_dev_info = file->f_mapping->backing_dev_info;
+                written = generic_file_buffered_write(iocb, iov, nr_segs, *ppos,
+                                                      ppos, count, 0);
+                current->backing_dev_info = NULL;
         }
 
 out_dio:
@@ -2021,9 +2025,9 @@ out_dio:
                 if (ret < 0)
                         written = ret;
 
-                if (!ret && (old_size != i_size_read(inode) ||
-                    old_clusters != OCFS2_I(inode)->ip_clusters ||
-                    has_refcount)) {
+                if (!ret && ((old_size != i_size_read(inode)) ||
+                             (old_clusters != OCFS2_I(inode)->ip_clusters) ||
+                             has_refcount)) {
                         ret = jbd2_journal_force_commit(osb->journal->j_journal);
                         if (ret < 0)
                                 written = ret;
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 07cc8bb68b6..af189887201 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -558,6 +558,7 @@ static int ocfs2_truncate_for_delete(struct ocfs2_super *osb,
                 handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
                 if (IS_ERR(handle)) {
                         status = PTR_ERR(handle);
+                        handle = NULL;
                         mlog_errno(status);
                         goto out;
                 }
@@ -639,11 +640,13 @@ static int ocfs2_remove_inode(struct inode *inode,
                 goto bail_unlock;
         }
 
-        status = ocfs2_orphan_del(osb, handle, orphan_dir_inode, inode,
-                                  orphan_dir_bh);
-        if (status < 0) {
-                mlog_errno(status);
-                goto bail_commit;
+        if (!(OCFS2_I(inode)->ip_flags & OCFS2_INODE_SKIP_ORPHAN_DIR)) {
+                status = ocfs2_orphan_del(osb, handle, orphan_dir_inode, inode,
+                                          orphan_dir_bh);
+                if (status < 0) {
+                        mlog_errno(status);
+                        goto bail_commit;
+                }
         }
 
         /* set the inodes dtime */
@@ -722,38 +725,39 @@ static void ocfs2_signal_wipe_completion(struct ocfs2_super *osb,
 static int ocfs2_wipe_inode(struct inode *inode,
                             struct buffer_head *di_bh)
 {
-        int status, orphaned_slot;
+        int status, orphaned_slot = -1;
         struct inode *orphan_dir_inode = NULL;
         struct buffer_head *orphan_dir_bh = NULL;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
-        struct ocfs2_dinode *di;
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *) di_bh->b_data;
 
-        di = (struct ocfs2_dinode *) di_bh->b_data;
-        orphaned_slot = le16_to_cpu(di->i_orphaned_slot);
+        if (!(OCFS2_I(inode)->ip_flags & OCFS2_INODE_SKIP_ORPHAN_DIR)) {
+                orphaned_slot = le16_to_cpu(di->i_orphaned_slot);
 
-        status = ocfs2_check_orphan_recovery_state(osb, orphaned_slot);
-        if (status)
-                return status;
+                status = ocfs2_check_orphan_recovery_state(osb, orphaned_slot);
+                if (status)
+                        return status;
 
-        orphan_dir_inode = ocfs2_get_system_file_inode(osb,
-                                                       ORPHAN_DIR_SYSTEM_INODE,
-                                                       orphaned_slot);
-        if (!orphan_dir_inode) {
-                status = -EEXIST;
-                mlog_errno(status);
-                goto bail;
-        }
+                orphan_dir_inode = ocfs2_get_system_file_inode(osb,
+                                                               ORPHAN_DIR_SYSTEM_INODE,
+                                                               orphaned_slot);
+                if (!orphan_dir_inode) {
+                        status = -EEXIST;
+                        mlog_errno(status);
+                        goto bail;
+                }
 
-        /* Lock the orphan dir. The lock will be held for the entire
-         * delete_inode operation. We do this now to avoid races with
-         * recovery completion on other nodes. */
-        mutex_lock(&orphan_dir_inode->i_mutex);
-        status = ocfs2_inode_lock(orphan_dir_inode, &orphan_dir_bh, 1);
-        if (status < 0) {
-                mutex_unlock(&orphan_dir_inode->i_mutex);
+                /* Lock the orphan dir. The lock will be held for the entire
+                 * delete_inode operation. We do this now to avoid races with
+                 * recovery completion on other nodes. */
+                mutex_lock(&orphan_dir_inode->i_mutex);
+                status = ocfs2_inode_lock(orphan_dir_inode, &orphan_dir_bh, 1);
+                if (status < 0) {
+                        mutex_unlock(&orphan_dir_inode->i_mutex);
 
-                mlog_errno(status);
-                goto bail;
+                        mlog_errno(status);
+                        goto bail;
+                }
         }
 
         /* we do this while holding the orphan dir lock because we
@@ -794,6 +798,9 @@ static int ocfs2_wipe_inode(struct inode *inode,
                 mlog_errno(status);
 
 bail_unlock_dir:
+        if (OCFS2_I(inode)->ip_flags & OCFS2_INODE_SKIP_ORPHAN_DIR)
+                return status;
+
         ocfs2_inode_unlock(orphan_dir_inode, 1);
         mutex_unlock(&orphan_dir_inode->i_mutex);
         brelse(orphan_dir_bh);
@@ -889,7 +896,8 @@ static int ocfs2_query_inode_wipe(struct inode *inode,
 
         /* Do some basic inode verification... */
         di = (struct ocfs2_dinode *) di_bh->b_data;
-        if (!(di->i_flags & cpu_to_le32(OCFS2_ORPHANED_FL))) {
+        if (!(di->i_flags & cpu_to_le32(OCFS2_ORPHANED_FL)) &&
+            !(oi->ip_flags & OCFS2_INODE_SKIP_ORPHAN_DIR)) {
                 /*
                  * Inodes in the orphan dir must have ORPHANED_FL.  The only
                  * inodes that come back out of the orphan dir are reflink
diff --git a/fs/ocfs2/inode.h b/fs/ocfs2/inode.h
index ba4fe07b293..0b28e1921a3 100644
--- a/fs/ocfs2/inode.h
+++ b/fs/ocfs2/inode.h
@@ -100,6 +100,8 @@ struct ocfs2_inode_info
 #define OCFS2_INODE_MAYBE_ORPHANED      0x00000020
 /* Does someone have the file open O_DIRECT */
 #define OCFS2_INODE_OPEN_DIRECT         0x00000040
+/* Tell the inode wipe code it's not in orphan dir */
+#define OCFS2_INODE_SKIP_ORPHAN_DIR     0x00000080
 
 static inline struct ocfs2_inode_info *OCFS2_I(struct inode *inode)
 {
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index b1eb50ae409..4cbb18f26c5 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -408,23 +408,28 @@ static int ocfs2_mknod(struct inode *dir,
                 }
         }
 
-        status = ocfs2_add_entry(handle, dentry, inode,
-                                 OCFS2_I(inode)->ip_blkno, parent_fe_bh,
-                                 &lookup);
-        if (status < 0) {
+        /*
+         * Do this before adding the entry to the directory. We add
+         * also set d_op after success so that ->d_iput() will cleanup
+         * the dentry lock even if ocfs2_add_entry() fails below.
+         */
+        status = ocfs2_dentry_attach_lock(dentry, inode,
+                                          OCFS2_I(dir)->ip_blkno);
+        if (status) {
                 mlog_errno(status);
                 goto leave;
         }
+        dentry->d_op = &ocfs2_dentry_ops;
 
-        status = ocfs2_dentry_attach_lock(dentry, inode,
-                                          OCFS2_I(dir)->ip_blkno);
-        if (status) {
+        status = ocfs2_add_entry(handle, dentry, inode,
+                                 OCFS2_I(inode)->ip_blkno, parent_fe_bh,
+                                 &lookup);
+        if (status < 0) {
                 mlog_errno(status);
                 goto leave;
         }
 
         insert_inode_hash(inode);
-        dentry->d_op = &ocfs2_dentry_ops;
         d_instantiate(dentry, inode);
         status = 0;
 leave:
@@ -445,11 +450,6 @@ leave:
 
         ocfs2_free_dir_lookup_result(&lookup);
 
-        if ((status < 0) && inode) {
-                clear_nlink(inode);
-                iput(inode);
-        }
-
         if (inode_ac)
                 ocfs2_free_alloc_context(inode_ac);
 
@@ -459,6 +459,17 @@ leave:
         if (meta_ac)
                 ocfs2_free_alloc_context(meta_ac);
 
+        /*
+         * We should call iput after the i_mutex of the bitmap been
+         * unlocked in ocfs2_free_alloc_context, or the
+         * ocfs2_delete_inode will mutex_lock again.
+         */
+        if ((status < 0) && inode) {
+                OCFS2_I(inode)->ip_flags |= OCFS2_INODE_SKIP_ORPHAN_DIR;
+                clear_nlink(inode);
+                iput(inode);
+        }
+
         mlog_exit(status);
 
         return status;
@@ -1771,22 +1782,27 @@ static int ocfs2_symlink(struct inode *dir,
                 }
         }
 
-        status = ocfs2_add_entry(handle, dentry, inode,
-                                 le64_to_cpu(fe->i_blkno), parent_fe_bh,
-                                 &lookup);
-        if (status < 0) {
+        /*
+         * Do this before adding the entry to the directory. We add
+         * also set d_op after success so that ->d_iput() will cleanup
+         * the dentry lock even if ocfs2_add_entry() fails below.
+         */
+        status = ocfs2_dentry_attach_lock(dentry, inode, OCFS2_I(dir)->ip_blkno);
+        if (status) {
                 mlog_errno(status);
                 goto bail;
         }
+        dentry->d_op = &ocfs2_dentry_ops;
 
-        status = ocfs2_dentry_attach_lock(dentry, inode, OCFS2_I(dir)->ip_blkno);
-        if (status) {
+        status = ocfs2_add_entry(handle, dentry, inode,
+                                 le64_to_cpu(fe->i_blkno), parent_fe_bh,
+                                 &lookup);
+        if (status < 0) {
                 mlog_errno(status);
                 goto bail;
         }
 
         insert_inode_hash(inode);
-        dentry->d_op = &ocfs2_dentry_ops;
         d_instantiate(dentry, inode);
 bail:
         if (status < 0 && did_quota)
@@ -1811,6 +1827,7 @@ bail:
         if (xattr_ac)
                 ocfs2_free_alloc_context(xattr_ac);
         if ((status < 0) && inode) {
+                OCFS2_I(inode)->ip_flags |= OCFS2_INODE_SKIP_ORPHAN_DIR;
                 clear_nlink(inode);
                 iput(inode);
         }
@@ -1976,6 +1993,7 @@ static int ocfs2_orphan_add(struct ocfs2_super *osb,
         }
 
         le32_add_cpu(&fe->i_flags, OCFS2_ORPHANED_FL);
+        OCFS2_I(inode)->ip_flags &= ~OCFS2_INODE_SKIP_ORPHAN_DIR;
 
         /* Record which orphan dir our inode now resides
          * in. delete_inode will use this to determine which orphan
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index bd96f6c7877..5cbcd0f008f 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -4083,6 +4083,9 @@ static int ocfs2_complete_reflink(struct inode *s_inode,
         di->i_attr = s_di->i_attr;
 
         if (preserve) {
+                t_inode->i_uid = s_inode->i_uid;
+                t_inode->i_gid = s_inode->i_gid;
+                t_inode->i_mode = s_inode->i_mode;
                 di->i_uid = s_di->i_uid;
                 di->i_gid = s_di->i_gid;
                 di->i_mode = s_di->i_mode;
diff --git a/fs/proc/array.c b/fs/proc/array.c
index e51f2ec2c5e..885ab5513ac 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -81,7 +81,6 @@
 #include <linux/pid_namespace.h>
 #include <linux/ptrace.h>
 #include <linux/tracehook.h>
-#include <linux/swapops.h>
 
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -495,7 +494,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 rsslim,
                 mm ? mm->start_code : 0,
                 mm ? mm->end_code : 0,
-                (permitted && mm) ? task->stack_start : 0,
+                (permitted && mm) ? mm->start_stack : 0,
                 esp,
                 eip,
                 /* The signal information here is obsolete.
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 070553427dd..47f5b145f56 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -247,25 +247,6 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
                                 } else if (vma->vm_start <= mm->start_stack &&
                                            vma->vm_end >= mm->start_stack) {
                                         name = "[stack]";
-                                } else {
-                                        unsigned long stack_start;
-                                        struct proc_maps_private *pmp;
-
-                                        pmp = m->private;
-                                        stack_start = pmp->task->stack_start;
-
-                                        if (vma->vm_start <= stack_start &&
-                                            vma->vm_end >= stack_start) {
-                                                pad_len_spaces(m, len);
-                                                seq_printf(m,
-                                                 "[threadstack:%08lx]",
-#ifdef CONFIG_STACK_GROWSUP
-                                                 vma->vm_end - stack_start
-#else
-                                                 stack_start - vma->vm_start
-#endif
-                                                );
-                                        }
                                 }
                         } else {
                                 name = "[vdso]";
diff --git a/fs/sysv/dir.c b/fs/sysv/dir.c
index 4e50286a4cc..1dabed286b4 100644
--- a/fs/sysv/dir.c
+++ b/fs/sysv/dir.c
@@ -164,8 +164,8 @@ struct sysv_dir_entry *sysv_find_entry(struct dentry *dentry, struct page **res_
                                                         name, de->name))
                                         goto found;
                         }
+                        dir_put_page(page);
                 }
-                dir_put_page(page);
 
                 if (++n >= npages)
                         n = 0;
diff --git a/include/asm-generic/dma-mapping-common.h b/include/asm-generic/dma-mapping-common.h
index e694263445f..69206957b72 100644
--- a/include/asm-generic/dma-mapping-common.h
+++ b/include/asm-generic/dma-mapping-common.h
@@ -131,7 +131,7 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
                 debug_dma_sync_single_range_for_cpu(dev, addr, offset, size, dir);
 
         } else
-                dma_sync_single_for_cpu(dev, addr, size, dir);
+                dma_sync_single_for_cpu(dev, addr + offset, size, dir);
 }
 
 static inline void dma_sync_single_range_for_device(struct device *dev,
@@ -148,7 +148,7 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
                 debug_dma_sync_single_range_for_device(dev, addr, offset, size, dir);
 
         } else
-                dma_sync_single_for_device(dev, addr, size, dir);
+                dma_sync_single_for_device(dev, addr + offset, size, dir);
 }
 
 static inline void
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index e929c27ede2..6b9db917e71 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -789,34 +789,6 @@ extern void ttm_bo_unreserve(struct ttm_buffer_object *bo);
 extern int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo,
                                   bool interruptible);
 
-/**
- * ttm_bo_block_reservation
- *
- * @bo: A pointer to a struct ttm_buffer_object.
- * @interruptible: Use interruptible sleep when waiting.
- * @no_wait: Don't sleep, but rather return -EBUSY.
- *
- * Block reservation for validation by simply reserving the buffer.
- * This is intended for single buffer use only without eviction,
- * and thus needs no deadlock protection.
- *
- * Returns:
- * -EBUSY: If no_wait == 1 and the buffer is already reserved.
- * -ERESTARTSYS: If interruptible == 1 and the process received a signal
- * while sleeping.
- */
-extern int ttm_bo_block_reservation(struct ttm_buffer_object *bo,
-                                    bool interruptible, bool no_wait);
-
-/**
- * ttm_bo_unblock_reservation
- *
- * @bo: A pointer to a struct ttm_buffer_object.
- *
- * Unblocks reservation leaving lru lists untouched.
- */
-extern void ttm_bo_unblock_reservation(struct ttm_buffer_object *bo);
-
 /*
  * ttm_bo_util.c
  */
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index b8ad1ea9958..8f78073d7ca 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -530,6 +530,7 @@ static inline struct cgroup_subsys_state *task_subsys_state(
 {
         return rcu_dereference_check(task->cgroups->subsys[subsys_id],
                                      rcu_read_lock_held() ||
+                                     lockdep_is_held(&task->alloc_lock) ||
                                      cgroup_lock_is_held());
 }
 
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 30b93b2a01a..eebb617c17d 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -186,6 +186,8 @@ d_iput:		no		no		no       yes
 
 #define DCACHE_FSNOTIFY_PARENT_WATCHED  0x0080 /* Parent inode is watched by some fsnotify listener */
 
+#define DCACHE_CANT_MOUNT       0x0100
+
 extern spinlock_t dcache_lock;
 extern seqlock_t rename_lock;
 
@@ -358,6 +360,18 @@ static inline int d_unlinked(struct dentry *dentry)
         return d_unhashed(dentry) && !IS_ROOT(dentry);
 }
 
+static inline int cant_mount(struct dentry *dentry)
+{
+        return (dentry->d_flags & DCACHE_CANT_MOUNT);
+}
+
+static inline void dont_mount(struct dentry *dentry)
+{
+        spin_lock(&dentry->d_lock);
+        dentry->d_flags |= DCACHE_CANT_MOUNT;
+        spin_unlock(&dentry->d_lock);
+}
+
 static inline struct dentry *dget_parent(struct dentry *dentry)
 {
         struct dentry *ret;
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index 0a5da639b32..6ed1d59bfb1 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -355,6 +355,8 @@ struct i2c_adapter {
         int nr;
         char name[48];
         struct completion dev_released;
+
+        struct list_head userspace_clients;
 };
 #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev)
 
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index c9bf92cd765..d94963b379d 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -79,10 +79,7 @@ enum {
         IFLA_NET_NS_PID,
         IFLA_IFALIAS,
         IFLA_NUM_VF,            /* Number of VFs if device is SR-IOV PF */
-        IFLA_VF_MAC,            /* Hardware queue specific attributes */
-        IFLA_VF_VLAN,
-        IFLA_VF_TX_RATE,        /* TX Bandwidth Allocation */
-        IFLA_VFINFO,
+        IFLA_VFINFO_LIST,
         __IFLA_MAX
 };
 
@@ -203,6 +200,24 @@ enum macvlan_mode {
 
 /* SR-IOV virtual function managment section */
 
+enum {
+        IFLA_VF_INFO_UNSPEC,
+        IFLA_VF_INFO,
+        __IFLA_VF_INFO_MAX,
+};
+
+#define IFLA_VF_INFO_MAX (__IFLA_VF_INFO_MAX - 1)
+
+enum {
+        IFLA_VF_UNSPEC,
+        IFLA_VF_MAC,            /* Hardware queue specific attributes */
+        IFLA_VF_VLAN,
+        IFLA_VF_TX_RATE,        /* TX Bandwidth Allocation */
+        __IFLA_VF_MAX,
+};
+
+#define IFLA_VF_MAX (__IFLA_VF_MAX - 1)
+
 struct ifla_vf_mac {
         __u32 vf;
         __u8 mac[32]; /* MAX_ADDR_LEN */
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 07db2feb857..db266bbed23 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -190,6 +190,8 @@ static inline int rcu_read_lock_sched_held(void)
 
 #ifdef CONFIG_PROVE_RCU
 
+extern int rcu_my_thread_group_empty(void);
+
 /**
  * rcu_dereference_check - rcu_dereference with debug checking
  * @p: The pointer to read, prior to dereferencing
diff --git a/include/linux/sched.h b/include/linux/sched.h
index dad7f668ebf..2b7b81df78b 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1497,7 +1497,6 @@ struct task_struct {
         /* bitmask of trace recursion */
         unsigned long trace_recursion;
 #endif /* CONFIG_TRACING */
-        unsigned long stack_start;
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR /* memcg uses this to do batch job */
         struct memcg_batch_info {
                 int do_batch;   /* incremented when batch uncharge started */
diff --git a/include/linux/usb.h b/include/linux/usb.h
index ce1323c4e47..739f1fd1cc1 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1085,7 +1085,7 @@ typedef void (*usb_complete_t)(struct urb *);
  * Alternatively, drivers may pass the URB_NO_xxx_DMA_MAP transfer flags,
  * which tell the host controller driver that no such mapping is needed since
  * the device driver is DMA-aware.  For example, a device driver might
- * allocate a DMA buffer with usb_buffer_alloc() or call usb_buffer_map().
+ * allocate a DMA buffer with usb_alloc_coherent() or call usb_buffer_map().
  * When these transfer flags are provided, host controller drivers will
  * attempt to use the dma addresses found in the transfer_dma and/or
  * setup_dma fields rather than determining a dma address themselves.
@@ -1366,11 +1366,23 @@ static inline int usb_urb_dir_out(struct urb *urb)
         return (urb->transfer_flags & URB_DIR_MASK) == URB_DIR_OUT;
 }
 
-void *usb_buffer_alloc(struct usb_device *dev, size_t size,
+void *usb_alloc_coherent(struct usb_device *dev, size_t size,
         gfp_t mem_flags, dma_addr_t *dma);
-void usb_buffer_free(struct usb_device *dev, size_t size,
+void usb_free_coherent(struct usb_device *dev, size_t size,
         void *addr, dma_addr_t dma);
 
+/* Compatible macros while we switch over */
+static inline void *usb_buffer_alloc(struct usb_device *dev, size_t size,
+                                     gfp_t mem_flags, dma_addr_t *dma)
+{
+        return usb_alloc_coherent(dev, size, mem_flags, dma);
+}
+static inline void usb_buffer_free(struct usb_device *dev, size_t size,
+                                   void *addr, dma_addr_t dma)
+{
+        return usb_free_coherent(dev, size, addr, dma);
+}
+
 #if 0
 struct urb *usb_buffer_map(struct urb *urb);
 void usb_buffer_dmasync(struct urb *urb);
diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
index b9da1f5591e..4aeff96ff7d 100644
--- a/include/media/saa7146_vv.h
+++ b/include/media/saa7146_vv.h
@@ -188,7 +188,6 @@ void saa7146_buffer_timeout(unsigned long data);
 void saa7146_dma_free(struct saa7146_dev* dev,struct videobuf_queue *q,
                                                 struct saa7146_buf *buf);
 
-int saa7146_vv_devinit(struct saa7146_dev *dev);
 int saa7146_vv_init(struct saa7146_dev* dev, struct saa7146_ext_vv *ext_vv);
 int saa7146_vv_release(struct saa7146_dev* dev);
 
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 851c813adb3..61d73e37d54 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -279,6 +279,7 @@ int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
 /* 2nd level prototypes */
 void sctp_generate_t3_rtx_event(unsigned long peer);
 void sctp_generate_heartbeat_event(unsigned long peer);
+void sctp_generate_proto_unreach_event(unsigned long peer);
 
 void sctp_ootb_pkt_free(struct sctp_packet *);
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index ff301774471..219043a67bf 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -778,6 +778,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
                           struct iovec *data);
 void sctp_chunk_free(struct sctp_chunk *);
 void  *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data);
+void  *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data);
 struct sctp_chunk *sctp_chunkify(struct sk_buff *,
                                  const struct sctp_association *,
                                  struct sock *);
@@ -1009,6 +1010,9 @@ struct sctp_transport {
         /* Heartbeat timer is per destination. */
         struct timer_list hb_timer;
 
+        /* Timer to handle ICMP proto unreachable envets */
+        struct timer_list proto_unreach_timer;
+
         /* Since we're using per-destination retransmission timers
          * (see above), we're also using per-destination "transmitted"
          * queues.  This probably ought to be a private struct
diff --git a/include/net/sock.h b/include/net/sock.h
index b4603cd54fc..1ad6435f252 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -74,7 +74,7 @@
                                         printk(KERN_DEBUG msg); } while (0)
 #else
 /* Validate arguments and do nothing */
-static void inline int __attribute__ ((format (printf, 2, 3)))
+static inline void __attribute__ ((format (printf, 2, 3)))
 SOCK_DEBUG(struct sock *sk, const char *msg, ...)
 {
 }
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 75be5a28815..aa04b9a5093 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1197,30 +1197,15 @@ extern int			tcp_v4_md5_do_del(struct sock *sk,
 extern struct tcp_md5sig_pool * __percpu *tcp_alloc_md5sig_pool(struct sock *);
 extern void                     tcp_free_md5sig_pool(void);
 
-extern struct tcp_md5sig_pool   *__tcp_get_md5sig_pool(int cpu);
-extern void                     __tcp_put_md5sig_pool(void);
+extern struct tcp_md5sig_pool   *tcp_get_md5sig_pool(void);
+extern void                     tcp_put_md5sig_pool(void);
+
 extern int tcp_md5_hash_header(struct tcp_md5sig_pool *, struct tcphdr *);
 extern int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *, struct sk_buff *,
                                  unsigned header_len);
 extern int tcp_md5_hash_key(struct tcp_md5sig_pool *hp,
                             struct tcp_md5sig_key *key);
 
-static inline
-struct tcp_md5sig_pool          *tcp_get_md5sig_pool(void)
-{
-        int cpu = get_cpu();
-        struct tcp_md5sig_pool *ret = __tcp_get_md5sig_pool(cpu);
-        if (!ret)
-                put_cpu();
-        return ret;
-}
-
-static inline void              tcp_put_md5sig_pool(void)
-{
-        __tcp_put_md5sig_pool();
-        put_cpu();
-}
-
 /* write queue abstraction */
 static inline void tcp_write_queue_purge(struct sock *sk)
 {
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 722b0130aa9..59a009dc54a 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -158,7 +158,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
                             u->mq_bytes + mq_bytes >
                             task_rlimit(p, RLIMIT_MSGQUEUE)) {
                                 spin_unlock(&mq_lock);
-                                kfree(info->messages);
+                                /* mqueue_delete_inode() releases info->messages */
                                 goto out_inode;
                         }
                         u->mq_bytes += mq_bytes;
diff --git a/kernel/acct.c b/kernel/acct.c
index 24f8c81fc48..e4c0e1fee9b 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -353,17 +353,18 @@ restart:
 
 void acct_exit_ns(struct pid_namespace *ns)
 {
-        struct bsd_acct_struct *acct;
+        struct bsd_acct_struct *acct = ns->bacct;
 
-        spin_lock(&acct_lock);
-        acct = ns->bacct;
-        if (acct != NULL) {
-                if (acct->file != NULL)
-                        acct_file_reopen(acct, NULL, NULL);
+        if (acct == NULL)
+                return;
 
-                kfree(acct);
-        }
+        del_timer_sync(&acct->timer);
+        spin_lock(&acct_lock);
+        if (acct->file != NULL)
+                acct_file_reopen(acct, NULL, NULL);
         spin_unlock(&acct_lock);
+
+        kfree(acct);
 }
 
 /*
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index e2769e13980..6d870f2d122 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1646,7 +1646,9 @@ static inline struct cftype *__d_cft(struct dentry *dentry)
 int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
 {
         char *start;
-        struct dentry *dentry = rcu_dereference(cgrp->dentry);
+        struct dentry *dentry = rcu_dereference_check(cgrp->dentry,
+                                                      rcu_read_lock_held() ||
+                                                      cgroup_lock_is_held());
 
         if (!dentry || cgrp == dummytop) {
                 /*
@@ -1662,13 +1664,17 @@ int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen)
         *--start = '\0';
         for (;;) {
                 int len = dentry->d_name.len;
+
                 if ((start -= len) < buf)
                         return -ENAMETOOLONG;
-                memcpy(start, cgrp->dentry->d_name.name, len);
+                memcpy(start, dentry->d_name.name, len);
                 cgrp = cgrp->parent;
                 if (!cgrp)
                         break;
-                dentry = rcu_dereference(cgrp->dentry);
+
+                dentry = rcu_dereference_check(cgrp->dentry,
+                                               rcu_read_lock_held() ||
+                                               cgroup_lock_is_held());
                 if (!cgrp->parent)
                         continue;
                 if (--start < buf)
@@ -4429,7 +4435,15 @@ __setup("cgroup_disable=", cgroup_disable);
  */
 unsigned short css_id(struct cgroup_subsys_state *css)
 {
-        struct css_id *cssid = rcu_dereference(css->id);
+        struct css_id *cssid;
+
+        /*
+         * This css_id() can return correct value when somone has refcnt
+         * on this or this is under rcu_read_lock(). Once css->id is allocated,
+         * it's unchanged until freed.
+         */
+        cssid = rcu_dereference_check(css->id,
+                        rcu_read_lock_held() || atomic_read(&css->refcnt));
 
         if (cssid)
                 return cssid->id;
@@ -4439,7 +4453,10 @@ EXPORT_SYMBOL_GPL(css_id);
 
 unsigned short css_depth(struct cgroup_subsys_state *css)
 {
-        struct css_id *cssid = rcu_dereference(css->id);
+        struct css_id *cssid;
+
+        cssid = rcu_dereference_check(css->id,
+                        rcu_read_lock_held() || atomic_read(&css->refcnt));
 
         if (cssid)
                 return cssid->depth;
@@ -4447,15 +4464,36 @@ unsigned short css_depth(struct cgroup_subsys_state *css)
 }
 EXPORT_SYMBOL_GPL(css_depth);
 
+/**
+ *  css_is_ancestor - test "root" css is an ancestor of "child"
+ * @child: the css to be tested.
+ * @root: the css supporsed to be an ancestor of the child.
+ *
+ * Returns true if "root" is an ancestor of "child" in its hierarchy. Because
+ * this function reads css->id, this use rcu_dereference() and rcu_read_lock().
+ * But, considering usual usage, the csses should be valid objects after test.
+ * Assuming that the caller will do some action to the child if this returns
+ * returns true, the caller must take "child";s reference count.
+ * If "child" is valid object and this returns true, "root" is valid, too.
+ */
+
 bool css_is_ancestor(struct cgroup_subsys_state *child,
                     const struct cgroup_subsys_state *root)
 {
-        struct css_id *child_id = rcu_dereference(child->id);
-        struct css_id *root_id = rcu_dereference(root->id);
+        struct css_id *child_id;
+        struct css_id *root_id;
+        bool ret = true;
 
-        if (!child_id || !root_id || (child_id->depth < root_id->depth))
-                return false;
-        return child_id->stack[root_id->depth] == root_id->id;
+        rcu_read_lock();
+        child_id  = rcu_dereference(child->id);
+        root_id = rcu_dereference(root->id);
+        if (!child_id
+            || !root_id
+            || (child_id->depth < root_id->depth)
+            || (child_id->stack[root_id->depth] != root_id->id))
+                ret = false;
+        rcu_read_unlock();
+        return ret;
 }
 
 static void __free_css_id_cb(struct rcu_head *head)
@@ -4555,13 +4593,13 @@ static int alloc_css_id(struct cgroup_subsys *ss, struct cgroup *parent,
 {
         int subsys_id, i, depth = 0;
         struct cgroup_subsys_state *parent_css, *child_css;
-        struct css_id *child_id, *parent_id = NULL;
+        struct css_id *child_id, *parent_id;
 
         subsys_id = ss->subsys_id;
         parent_css = parent->subsys[subsys_id];
         child_css = child->subsys[subsys_id];
-        depth = css_depth(parent_css) + 1;
         parent_id = parent_css->id;
+        depth = parent_id->depth;
 
         child_id = get_new_cssid(ss, depth);
         if (IS_ERR(child_id))
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index da5e1397553..e5c0244962b 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -205,9 +205,12 @@ static void freezer_fork(struct cgroup_subsys *ss, struct task_struct *task)
          * No lock is needed, since the task isn't on tasklist yet,
          * so it can't be moved to another cgroup, which means the
          * freezer won't be removed and will be valid during this
-         * function call.
+         * function call.  Nevertheless, apply RCU read-side critical
+         * section to suppress RCU lockdep false positives.
          */
+        rcu_read_lock();
         freezer = task_freezer(task);
+        rcu_read_unlock();
 
         /*
          * The root cgroup is non-freezable, so we can skip the
diff --git a/kernel/fork.c b/kernel/fork.c
index 44b0791b0a2..4c14942a0ee 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1114,8 +1114,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
         p->bts = NULL;
 
-        p->stack_start = stack_start;
-
         /* Perform scheduler related setup. Assign this task to a CPU. */
         sched_fork(p, clone_flags);
 
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 87ebe8adc47..474a84715ea 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1134,11 +1134,9 @@ int crash_shrink_memory(unsigned long new_size)
 
         free_reserved_phys_range(end, crashk_res.end);
 
-        if (start == end) {
-                crashk_res.end = end;
+        if (start == end)
                 release_resource(&crashk_res);
-        } else
-                crashk_res.end = end - 1;
+        crashk_res.end = end - 1;
 
 unlock:
         mutex_unlock(&kexec_mutex);
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 2f3fbf84215..3d1552d3c12 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -4897,7 +4897,7 @@ err_fput_free_put_context:
 
 err_free_put_context:
         if (err < 0)
-                kfree(event);
+                free_event(event);
 
 err_put_context:
         if (err < 0)
diff --git a/kernel/profile.c b/kernel/profile.c
index a55d3a367ae..dfadc5b729f 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -127,8 +127,10 @@ int __ref profile_init(void)
                 return 0;
 
         prof_buffer = vmalloc(buffer_bytes);
-        if (prof_buffer)
+        if (prof_buffer) {
+                memset(prof_buffer, 0, buffer_bytes);
                 return 0;
+        }
 
         free_cpumask_var(prof_cpu_mask);
         return -ENOMEM;
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 03a7ea1579f..49d808e833b 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -122,3 +122,14 @@ void wakeme_after_rcu(struct rcu_head  *head)
         rcu = container_of(head, struct rcu_synchronize, head);
         complete(&rcu->completion);
 }
+
+#ifdef CONFIG_PROVE_RCU
+/*
+ * wrapper function to avoid #include problems.
+ */
+int rcu_my_thread_group_empty(void)
+{
+        return thread_group_empty(current);
+}
+EXPORT_SYMBOL_GPL(rcu_my_thread_group_empty);
+#endif /* #ifdef CONFIG_PROVE_RCU */
diff --git a/kernel/sched.c b/kernel/sched.c
index 6af210a7de7..3c2a54f70ff 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -323,6 +323,15 @@ static inline struct task_group *task_group(struct task_struct *p)
 /* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */
 static inline void set_task_rq(struct task_struct *p, unsigned int cpu)
 {
+        /*
+         * Strictly speaking this rcu_read_lock() is not needed since the
+         * task_group is tied to the cgroup, which in turn can never go away
+         * as long as there are tasks attached to it.
+         *
+         * However since task_group() uses task_subsys_state() which is an
+         * rcu_dereference() user, this quiets CONFIG_PROVE_RCU.
+         */
+        rcu_read_lock();
 #ifdef CONFIG_FAIR_GROUP_SCHED
         p->se.cfs_rq = task_group(p)->cfs_rq[cpu];
         p->se.parent = task_group(p)->se[cpu];
@@ -332,6 +341,7 @@ static inline void set_task_rq(struct task_struct *p, unsigned int cpu)
         p->rt.rt_rq  = task_group(p)->rt_rq[cpu];
         p->rt.parent = task_group(p)->rt_se[cpu];
 #endif
+        rcu_read_unlock();
 }
 
 #else
@@ -3780,7 +3790,7 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
          * the mutex owner just released it and exited.
          */
         if (probe_kernel_address(&owner->cpu, cpu))
-                goto out;
+                return 0;
 #else
         cpu = owner->cpu;
 #endif
@@ -3790,14 +3800,14 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
          * the cpu field may no longer be valid.
          */
         if (cpu >= nr_cpumask_bits)
-                goto out;
+                return 0;
 
         /*
          * We need to validate that we can do a
          * get_cpu() and that we have the percpu area.
          */
         if (!cpu_online(cpu))
-                goto out;
+                return 0;
 
         rq = cpu_rq(cpu);
 
@@ -3816,7 +3826,7 @@ int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
 
                 cpu_relax();
         }
-out:
+
         return 1;
 }
 #endif
diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
index 9b49db14403..19be00ba612 100644
--- a/kernel/sched_debug.c
+++ b/kernel/sched_debug.c
@@ -114,7 +114,9 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
         {
                 char path[64];
 
+                rcu_read_lock();
                 cgroup_path(task_group(p)->css.cgroup, path, sizeof(path));
+                rcu_read_unlock();
                 SEQ_printf(m, " %s", path);
         }
 #endif
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index dee48658805..5bfb213984b 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -774,7 +774,7 @@ void flush_delayed_work(struct delayed_work *dwork)
 {
         if (del_timer_sync(&dwork->timer)) {
                 struct cpu_workqueue_struct *cwq;
-                cwq = wq_per_cpu(keventd_wq, get_cpu());
+                cwq = wq_per_cpu(get_wq_data(&dwork->work)->wq, get_cpu());
                 __queue_work(cwq, &dwork->work);
                 put_cpu();
         }
diff --git a/lib/btree.c b/lib/btree.c
index 41859a82021..c9c6f035152 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -95,7 +95,8 @@ static unsigned long *btree_node_alloc(struct btree_head *head, gfp_t gfp)
         unsigned long *node;
 
         node = mempool_alloc(head->mempool, gfp);
-        memset(node, 0, NODESIZE);
+        if (likely(node))
+                memset(node, 0, NODESIZE);
         return node;
 }
 
diff --git a/lib/rwsem.c b/lib/rwsem.c
index 3e3365e5665..ceba8e28807 100644
--- a/lib/rwsem.c
+++ b/lib/rwsem.c
@@ -136,9 +136,10 @@ __rwsem_do_wake(struct rw_semaphore *sem, int downgrading)
  out:
         return sem;
 
-        /* undo the change to count, but check for a transition 1->0 */
+        /* undo the change to the active count, but check for a transition
+         * 1->0 */
  undo:
-        if (rwsem_atomic_update(-RWSEM_ACTIVE_BIAS, sem) != 0)
+        if (rwsem_atomic_update(-RWSEM_ACTIVE_BIAS, sem) & RWSEM_ACTIVE_MASK)
                 goto out;
         goto try_again;
 }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ffbdfc86aed..4c9e6bbf377 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1039,7 +1039,7 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
                 page = alloc_buddy_huge_page(h, vma, addr);
                 if (!page) {
                         hugetlb_put_quota(inode->i_mapping, chg);
-                        return ERR_PTR(-VM_FAULT_OOM);
+                        return ERR_PTR(-VM_FAULT_SIGBUS);
                 }
         }
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 6c755de385f..8a79a6f0f02 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1601,7 +1601,6 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                          * There is a small race that "from" or "to" can be
                          * freed by rmdir, so we use css_tryget().
                          */
-                        rcu_read_lock();
                         from = mc.from;
                         to = mc.to;
                         if (from && css_tryget(&from->css)) {
@@ -1622,7 +1621,6 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                                         do_continue = (to == mem_over_limit);
                                 css_put(&to->css);
                         }
-                        rcu_read_unlock();
                         if (do_continue) {
                                 DEFINE_WAIT(wait);
                                 prepare_to_wait(&mc.waitq, &wait,
diff --git a/mm/rmap.c b/mm/rmap.c
index 07fc9475879..0feeef860a8 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -336,14 +336,13 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 
 /*
  * At what user virtual address is page expected in vma?
- * checking that the page matches the vma.
+ * Caller should check the page is actually part of the vma.
  */
 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 {
-        if (PageAnon(page)) {
-                if (vma->anon_vma != page_anon_vma(page))
-                        return -EFAULT;
-        } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
+        if (PageAnon(page))
+                ;
+        else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
                 if (!vma->vm_file ||
                     vma->vm_file->f_mapping != page->mapping)
                         return -EFAULT;
diff --git a/mm/slub.c b/mm/slub.c
index 7d6c8b1ccf6..d2a54fe71ea 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2153,7 +2153,7 @@ static int init_kmem_cache_nodes(struct kmem_cache *s, gfp_t gfpflags)
         int local_node;
 
         if (slab_state >= UP && (s < kmalloc_caches ||
-                        s > kmalloc_caches + KMALLOC_CACHES))
+                        s >= kmalloc_caches + KMALLOC_CACHES))
                 local_node = page_to_nid(virt_to_page(s));
         else
                 local_node = 0;
diff --git a/net/core/dev.c b/net/core/dev.c
index f769098774b..264137fce3a 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1451,7 +1451,7 @@ static inline void net_timestamp(struct sk_buff *skb)
  *
  * return values:
  *      NET_RX_SUCCESS  (no congestion)
- *      NET_RX_DROP     (packet was dropped)
+ *      NET_RX_DROP     (packet was dropped, but freed)
  *
  * dev_forward_skb can be used for injecting an skb from the
  * start_xmit function of one device into the receive queue
@@ -1465,12 +1465,11 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 {
         skb_orphan(skb);
 
-        if (!(dev->flags & IFF_UP))
-                return NET_RX_DROP;
-
-        if (skb->len > (dev->mtu + dev->hard_header_len))
+        if (!(dev->flags & IFF_UP) ||
+            (skb->len > (dev->mtu + dev->hard_header_len))) {
+                kfree_skb(skb);
                 return NET_RX_DROP;
-
+        }
         skb_set_dev(skb, dev);
         skb->tstamp.tv64 = 0;
         skb->pkt_type = PACKET_HOST;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index fe776c9ddec..31e85d327aa 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -602,12 +602,19 @@ static void copy_rtnl_link_stats(struct rtnl_link_stats *a,
         a->tx_compressed = b->tx_compressed;
 };
 
+/* All VF info */
 static inline int rtnl_vfinfo_size(const struct net_device *dev)
 {
-        if (dev->dev.parent && dev_is_pci(dev->dev.parent))
-                return dev_num_vf(dev->dev.parent) *
-                        sizeof(struct ifla_vf_info);
-        else
+        if (dev->dev.parent && dev_is_pci(dev->dev.parent)) {
+
+                int num_vfs = dev_num_vf(dev->dev.parent);
+                size_t size = nlmsg_total_size(sizeof(struct nlattr));
+                size += nlmsg_total_size(num_vfs * sizeof(struct nlattr));
+                size += num_vfs * (sizeof(struct ifla_vf_mac) +
+                                  sizeof(struct ifla_vf_vlan) +
+                                  sizeof(struct ifla_vf_tx_rate));
+                return size;
+        } else
                 return 0;
 }
 
@@ -629,7 +636,7 @@ static inline size_t if_nlmsg_size(const struct net_device *dev)
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
                + nla_total_size(4) /* IFLA_NUM_VF */
-               + nla_total_size(rtnl_vfinfo_size(dev)) /* IFLA_VFINFO */
+               + rtnl_vfinfo_size(dev) /* IFLA_VFINFO_LIST */
                + rtnl_link_get_size(dev); /* IFLA_LINKINFO */
 }
 
@@ -700,14 +707,37 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
 
         if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent) {
                 int i;
-                struct ifla_vf_info ivi;
 
-                NLA_PUT_U32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent));
-                for (i = 0; i < dev_num_vf(dev->dev.parent); i++) {
+                struct nlattr *vfinfo, *vf;
+                int num_vfs = dev_num_vf(dev->dev.parent);
+
+                NLA_PUT_U32(skb, IFLA_NUM_VF, num_vfs);
+                vfinfo = nla_nest_start(skb, IFLA_VFINFO_LIST);
+                if (!vfinfo)
+                        goto nla_put_failure;
+                for (i = 0; i < num_vfs; i++) {
+                        struct ifla_vf_info ivi;
+                        struct ifla_vf_mac vf_mac;
+                        struct ifla_vf_vlan vf_vlan;
+                        struct ifla_vf_tx_rate vf_tx_rate;
                         if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
                                 break;
-                        NLA_PUT(skb, IFLA_VFINFO, sizeof(ivi), &ivi);
+                        vf_mac.vf = vf_vlan.vf = vf_tx_rate.vf = ivi.vf;
+                        memcpy(vf_mac.mac, ivi.mac, sizeof(ivi.mac));
+                        vf_vlan.vlan = ivi.vlan;
+                        vf_vlan.qos = ivi.qos;
+                        vf_tx_rate.rate = ivi.tx_rate;
+                        vf = nla_nest_start(skb, IFLA_VF_INFO);
+                        if (!vf) {
+                                nla_nest_cancel(skb, vfinfo);
+                                goto nla_put_failure;
+                        }
+                        NLA_PUT(skb, IFLA_VF_MAC, sizeof(vf_mac), &vf_mac);
+                        NLA_PUT(skb, IFLA_VF_VLAN, sizeof(vf_vlan), &vf_vlan);
+                        NLA_PUT(skb, IFLA_VF_TX_RATE, sizeof(vf_tx_rate), &vf_tx_rate);
+                        nla_nest_end(skb, vf);
                 }
+                nla_nest_end(skb, vfinfo);
         }
         if (dev->rtnl_link_ops) {
                 if (rtnl_link_fill(skb, dev) < 0)
@@ -769,12 +799,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_LINKINFO]         = { .type = NLA_NESTED },
         [IFLA_NET_NS_PID]       = { .type = NLA_U32 },
         [IFLA_IFALIAS]          = { .type = NLA_STRING, .len = IFALIASZ-1 },
-        [IFLA_VF_MAC]           = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_mac) },
-        [IFLA_VF_VLAN]          = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_vlan) },
-        [IFLA_VF_TX_RATE]       = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_tx_rate) },
+        [IFLA_VFINFO_LIST]      = {. type = NLA_NESTED },
 };
 EXPORT_SYMBOL(ifla_policy);
 
@@ -783,6 +808,19 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
         [IFLA_INFO_DATA]        = { .type = NLA_NESTED },
 };
 
+static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
+        [IFLA_VF_INFO]          = { .type = NLA_NESTED },
+};
+
+static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
+        [IFLA_VF_MAC]           = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_mac) },
+        [IFLA_VF_VLAN]          = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_vlan) },
+        [IFLA_VF_TX_RATE]       = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_tx_rate) },
+};
+
 struct net *rtnl_link_get_net(struct net *src_net, struct nlattr *tb[])
 {
         struct net *net;
@@ -812,6 +850,52 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
         return 0;
 }
 
+static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
+{
+        int rem, err = -EINVAL;
+        struct nlattr *vf;
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        nla_for_each_nested(vf, attr, rem) {
+                switch (nla_type(vf)) {
+                case IFLA_VF_MAC: {
+                        struct ifla_vf_mac *ivm;
+                        ivm = nla_data(vf);
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_set_vf_mac)
+                                err = ops->ndo_set_vf_mac(dev, ivm->vf,
+                                                          ivm->mac);
+                        break;
+                }
+                case IFLA_VF_VLAN: {
+                        struct ifla_vf_vlan *ivv;
+                        ivv = nla_data(vf);
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_set_vf_vlan)
+                                err = ops->ndo_set_vf_vlan(dev, ivv->vf,
+                                                           ivv->vlan,
+                                                           ivv->qos);
+                        break;
+                }
+                case IFLA_VF_TX_RATE: {
+                        struct ifla_vf_tx_rate *ivt;
+                        ivt = nla_data(vf);
+                        err = -EOPNOTSUPP;
+                        if (ops->ndo_set_vf_tx_rate)
+                                err = ops->ndo_set_vf_tx_rate(dev, ivt->vf,
+                                                              ivt->rate);
+                        break;
+                }
+                default:
+                        err = -EINVAL;
+                        break;
+                }
+                if (err)
+                        break;
+        }
+        return err;
+}
+
 static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                       struct nlattr **tb, char *ifname, int modified)
 {
@@ -942,40 +1026,17 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                 write_unlock_bh(&dev_base_lock);
         }
 
-        if (tb[IFLA_VF_MAC]) {
-                struct ifla_vf_mac *ivm;
-                ivm = nla_data(tb[IFLA_VF_MAC]);
-                err = -EOPNOTSUPP;
-                if (ops->ndo_set_vf_mac)
-                        err = ops->ndo_set_vf_mac(dev, ivm->vf, ivm->mac);
-                if (err < 0)
-                        goto errout;
-                modified = 1;
-        }
-
-        if (tb[IFLA_VF_VLAN]) {
-                struct ifla_vf_vlan *ivv;
-                ivv = nla_data(tb[IFLA_VF_VLAN]);
-                err = -EOPNOTSUPP;
-                if (ops->ndo_set_vf_vlan)
-                        err = ops->ndo_set_vf_vlan(dev, ivv->vf,
-                                                   ivv->vlan,
-                                                   ivv->qos);
-                if (err < 0)
-                        goto errout;
-                modified = 1;
-        }
-        err = 0;
-
-        if (tb[IFLA_VF_TX_RATE]) {
-                struct ifla_vf_tx_rate *ivt;
-                ivt = nla_data(tb[IFLA_VF_TX_RATE]);
-                err = -EOPNOTSUPP;
-                if (ops->ndo_set_vf_tx_rate)
-                        err = ops->ndo_set_vf_tx_rate(dev, ivt->vf, ivt->rate);
-                if (err < 0)
-                        goto errout;
-                modified = 1;
+        if (tb[IFLA_VFINFO_LIST]) {
+                struct nlattr *attr;
+                int rem;
+                nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
+                        if (nla_type(attr) != IFLA_VF_INFO)
+                                goto errout;
+                        err = do_setvfinfo(dev, attr);
+                        if (err < 0)
+                                goto errout;
+                        modified = 1;
+                }
         }
         err = 0;
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 6e747065c20..80769f1f9fa 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -661,13 +661,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 #endif
 #endif
 
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 arp->ar_hrd = htons(ARPHRD_ETHER);
                 arp->ar_pro = htons(ETH_P_IP);
                 break;
 #endif
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
         case ARPHRD_IEEE802_TR:
                 arp->ar_hrd = htons(ARPHRD_IEEE802);
                 arp->ar_pro = htons(ETH_P_IP);
@@ -1051,7 +1051,7 @@ static int arp_req_set(struct net *net, struct arpreq *r,
                         return -EINVAL;
         }
         switch (dev->type) {
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 /*
                  * According to RFC 1390, FDDI devices should accept ARP
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9d4f6d1340a..ec19a890c9a 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -754,7 +754,8 @@ ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
                 c->next = mfc_unres_queue;
                 mfc_unres_queue = c;
 
-                mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
+                if (atomic_read(&net->ipv4.cache_resolve_queue_len) == 1)
+                        mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
         }
 
         /*
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0f8caf64caa..296150b2a62 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2839,7 +2839,6 @@ static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool * __percpu *pool)
                         if (p->md5_desc.tfm)
                                 crypto_free_hash(p->md5_desc.tfm);
                         kfree(p);
-                        p = NULL;
                 }
         }
         free_percpu(pool);
@@ -2937,25 +2936,40 @@ retry:
 
 EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
 
-struct tcp_md5sig_pool *__tcp_get_md5sig_pool(int cpu)
+
+/**
+ *      tcp_get_md5sig_pool - get md5sig_pool for this user
+ *
+ *      We use percpu structure, so if we succeed, we exit with preemption
+ *      and BH disabled, to make sure another thread or softirq handling
+ *      wont try to get same context.
+ */
+struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
 {
         struct tcp_md5sig_pool * __percpu *p;
-        spin_lock_bh(&tcp_md5sig_pool_lock);
+
+        local_bh_disable();
+
+        spin_lock(&tcp_md5sig_pool_lock);
         p = tcp_md5sig_pool;
         if (p)
                 tcp_md5sig_users++;
-        spin_unlock_bh(&tcp_md5sig_pool_lock);
-        return (p ? *per_cpu_ptr(p, cpu) : NULL);
-}
+        spin_unlock(&tcp_md5sig_pool_lock);
+
+        if (p)
+                return *per_cpu_ptr(p, smp_processor_id());
 
-EXPORT_SYMBOL(__tcp_get_md5sig_pool);
+        local_bh_enable();
+        return NULL;
+}
+EXPORT_SYMBOL(tcp_get_md5sig_pool);
 
-void __tcp_put_md5sig_pool(void)
+void tcp_put_md5sig_pool(void)
 {
+        local_bh_enable();
         tcp_free_md5sig_pool();
 }
-
-EXPORT_SYMBOL(__tcp_put_md5sig_pool);
+EXPORT_SYMBOL(tcp_put_md5sig_pool);
 
 int tcp_md5_hash_header(struct tcp_md5sig_pool *hp,
                         struct tcphdr *th)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 8fef859db35..c36522a0f11 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1527,6 +1527,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
         uh   = udp_hdr(skb);
         ulen = ntohs(uh->len);
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
+
         if (ulen > skb->len)
                 goto short_packet;
 
@@ -1540,9 +1543,6 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp4_csum_init(skb, uh, proto))
                 goto csum_error;
 
-        saddr = ip_hdr(skb)->saddr;
-        daddr = ip_hdr(skb)->daddr;
-
         if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                 return __udp4_lib_mcast_deliver(net, skb, uh,
                                 saddr, daddr, udptable);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3192aa02ba5..3f9e86b15e0 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -200,7 +200,7 @@ lookup_protocol:
 
         inet_sk(sk)->pinet6 = np = inet6_sk_generic(sk);
         np->hop_limit   = -1;
-        np->mcast_hops  = -1;
+        np->mcast_hops  = IPV6_DEFAULT_MCASTHOPS;
         np->mc_loop     = 1;
         np->pmtudisc    = IPV6_PMTUDISC_WANT;
         np->ipv6only    = net->ipv6.sysctl.bindv6only;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 622dc7939a1..61573885e45 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -222,6 +222,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
         if (!skb)
                 return;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         serr = SKB_EXT_ERR(skb);
         serr->ee.ee_errno = err;
         serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
@@ -255,6 +257,8 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
         if (!skb)
                 return;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         skb_put(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         iph = ipv6_hdr(skb);
@@ -319,7 +323,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_flowinfo = 0;
                 sin->sin6_port = serr->port;
                 sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                         ipv6_addr_copy(&sin->sin6_addr,
                                   (struct in6_addr *)(nh + serr->addr_offset));
                         if (np->sndflow)
@@ -341,7 +345,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
                 sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                         ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr);
                         if (np->rxopt.all)
                                 datagram_recv_ctl(sk, msg, skb);
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index a432f0ec051..94e7fca75b8 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -31,7 +31,7 @@ static int llc_mac_header_len(unsigned short devtype)
         case ARPHRD_ETHER:
         case ARPHRD_LOOPBACK:
                 return sizeof(struct ethhdr);
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
         case ARPHRD_IEEE802_TR:
                 return sizeof(struct trh_hdr);
 #endif
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 4aefa6dc309..875c8dec940 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2030,7 +2030,8 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                 continue;
 
                         if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
-                            wk->type != IEEE80211_WORK_AUTH)
+                            wk->type != IEEE80211_WORK_AUTH &&
+                            wk->type != IEEE80211_WORK_ASSOC)
                                 continue;
 
                         if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 2a570184e5a..ea2192444ce 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -440,11 +440,25 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 {
         SCTP_DEBUG_PRINTK("%s\n",  __func__);
 
-        sctp_do_sm(SCTP_EVENT_T_OTHER,
-                   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
-                   asoc->state, asoc->ep, asoc, t,
-                   GFP_ATOMIC);
+        if (sock_owned_by_user(sk)) {
+                if (timer_pending(&t->proto_unreach_timer))
+                        return;
+                else {
+                        if (!mod_timer(&t->proto_unreach_timer,
+                                                jiffies + (HZ/20)))
+                                sctp_association_hold(asoc);
+                }
+                        
+        } else {
+                if (timer_pending(&t->proto_unreach_timer) &&
+                    del_timer(&t->proto_unreach_timer))
+                        sctp_association_put(asoc);
 
+                sctp_do_sm(SCTP_EVENT_T_OTHER,
+                           SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                           asoc->state, asoc->ep, asoc, t,
+                           GFP_ATOMIC);
+        }
 }
 
 /* Common lookup code for icmp/icmpv6 error handler. */
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 0fd5b4c8835..30c1767186b 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -108,7 +108,7 @@ static const struct sctp_paramhdr prsctp_param = {
         cpu_to_be16(sizeof(struct sctp_paramhdr)),
 };
 
-/* A helper to initialize to initialize an op error inside a
+/* A helper to initialize an op error inside a
  * provided chunk, as most cause codes will be embedded inside an
  * abort chunk.
  */
@@ -125,6 +125,29 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
         chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
 }
 
+/* A helper to initialize an op error inside a
+ * provided chunk, as most cause codes will be embedded inside an
+ * abort chunk.  Differs from sctp_init_cause in that it won't oops
+ * if there isn't enough space in the op error chunk
+ */
+int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+                      size_t paylen)
+{
+        sctp_errhdr_t err;
+        __u16 len;
+
+        /* Cause code constants are now defined in network order.  */
+        err.cause = cause_code;
+        len = sizeof(sctp_errhdr_t) + paylen;
+        err.length  = htons(len);
+
+        if (skb_tailroom(chunk->skb) >  len)
+                return -ENOSPC;
+        chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+                                                     sizeof(sctp_errhdr_t),
+                                                     &err);
+        return 0;
+}
 /* 3.3.2 Initiation (INIT) (1)
  *
  * This chunk is used to initiate a SCTP association between two
@@ -1132,6 +1155,24 @@ nodata:
         return retval;
 }
 
+/* Create an Operation Error chunk of a fixed size,
+ * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT)
+ * This is a helper function to allocate an error chunk for
+ * for those invalid parameter codes in which we may not want
+ * to report all the errors, if the incomming chunk is large
+ */
+static inline struct sctp_chunk *sctp_make_op_error_fixed(
+        const struct sctp_association *asoc,
+        const struct sctp_chunk *chunk)
+{
+        size_t size = asoc ? asoc->pathmtu : 0;
+
+        if (!size)
+                size = SCTP_DEFAULT_MAXSEGMENT;
+
+        return sctp_make_op_error_space(asoc, chunk, size);
+}
+
 /* Create an Operation Error chunk.  */
 struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc,
                                  const struct sctp_chunk *chunk,
@@ -1374,6 +1415,18 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
         return target;
 }
 
+/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient
+ * space in the chunk
+ */
+void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+                             int len, const void *data)
+{
+        if (skb_tailroom(chunk->skb) > len)
+                return sctp_addto_chunk(chunk, len, data);
+        else
+                return NULL;
+}
+
 /* Append bytes from user space to the end of a chunk.  Will panic if
  * chunk is not big enough.
  * Returns a kernel err value.
@@ -1977,13 +2030,12 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
                  * returning multiple unknown parameters.
                  */
                 if (NULL == *errp)
-                        *errp = sctp_make_op_error_space(asoc, chunk,
-                                        ntohs(chunk->chunk_hdr->length));
+                        *errp = sctp_make_op_error_fixed(asoc, chunk);
 
                 if (*errp) {
-                        sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+                        sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
                                         WORD_ROUND(ntohs(param.p->length)));
-                        sctp_addto_chunk(*errp,
+                        sctp_addto_chunk_fixed(*errp,
                                         WORD_ROUND(ntohs(param.p->length)),
                                         param.v);
                 } else {
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index d5ae450b6f0..eb1f42f45fd 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -397,6 +397,41 @@ out_unlock:
         sctp_transport_put(transport);
 }
 
+/* Handle the timeout of the ICMP protocol unreachable timer.  Trigger
+ * the correct state machine transition that will close the association.
+ */
+void sctp_generate_proto_unreach_event(unsigned long data)
+{
+        struct sctp_transport *transport = (struct sctp_transport *) data;
+        struct sctp_association *asoc = transport->asoc;
+        
+        sctp_bh_lock_sock(asoc->base.sk);
+        if (sock_owned_by_user(asoc->base.sk)) {
+                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+
+                /* Try again later.  */
+                if (!mod_timer(&transport->proto_unreach_timer,
+                                jiffies + (HZ/20)))
+                        sctp_association_hold(asoc);
+                goto out_unlock;
+        }
+
+        /* Is this structure just waiting around for us to actually
+         * get destroyed?
+         */
+        if (asoc->base.dead)
+                goto out_unlock;
+
+        sctp_do_sm(SCTP_EVENT_T_OTHER,
+                   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                   asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
+
+out_unlock:
+        sctp_bh_unlock_sock(asoc->base.sk);
+        sctp_association_put(asoc);
+}
+
+
 /* Inject a SACK Timeout event into the state machine.  */
 static void sctp_generate_sack_event(unsigned long data)
 {
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index be4d63d5a5c..165d54e07fc 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -108,6 +108,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
                         (unsigned long)peer);
         setup_timer(&peer->hb_timer, sctp_generate_heartbeat_event,
                         (unsigned long)peer);
+        setup_timer(&peer->proto_unreach_timer,
+                    sctp_generate_proto_unreach_event, (unsigned long)peer);
 
         /* Initialize the 64-bit random nonce sent with heartbeat. */
         get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
@@ -171,6 +173,10 @@ void sctp_transport_free(struct sctp_transport *transport)
             del_timer(&transport->T3_rtx_timer))
                 sctp_transport_put(transport);
 
+        /* Delete the ICMP proto unreachable timer if it's active. */
+        if (timer_pending(&transport->proto_unreach_timer) &&
+            del_timer(&transport->proto_unreach_timer))
+                sctp_association_put(transport->asoc);
 
         sctp_transport_put(transport);
 }
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 19902319d09..a46e825cbf0 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -77,10 +77,10 @@ static bool key_gc_keyring(struct key *keyring, time_t limit)
                 goto dont_gc;
 
         /* scan the keyring looking for dead keys */
-        klist = rcu_dereference_check(keyring->payload.subscriptions,
-                                      lockdep_is_held(&key_serial_lock));
+        rcu_read_lock();
+        klist = rcu_dereference(keyring->payload.subscriptions);
         if (!klist)
-                goto dont_gc;
+                goto unlock_dont_gc;
 
         for (loop = klist->nkeys - 1; loop >= 0; loop--) {
                 key = klist->keys[loop];
@@ -89,11 +89,14 @@ static bool key_gc_keyring(struct key *keyring, time_t limit)
                         goto do_gc;
         }
 
+unlock_dont_gc:
+        rcu_read_unlock();
 dont_gc:
         kleave(" = false");
         return false;
 
 do_gc:
+        rcu_read_unlock();
         key_gc_cursor = keyring->serial;
         key_get(keyring);
         spin_unlock(&key_serial_lock);
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index dd7cd0f8e13..1e4b0037935 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -20,6 +20,11 @@
 #include <asm/uaccess.h>
 #include "internal.h"
 
+#define rcu_dereference_locked_keyring(keyring)                         \
+        (rcu_dereference_protected(                                     \
+                (keyring)->payload.subscriptions,                       \
+                rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
+
 /*
  * when plumbing the depths of the key tree, this sets a hard limit set on how
  * deep we're willing to go
@@ -201,8 +206,7 @@ static long keyring_read(const struct key *keyring,
         int loop, ret;
 
         ret = 0;
-        klist = keyring->payload.subscriptions;
-
+        klist = rcu_dereference_locked_keyring(keyring);
         if (klist) {
                 /* calculate how much data we could return */
                 qty = klist->nkeys * sizeof(key_serial_t);
@@ -526,9 +530,8 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
         struct key *keyring;
         int bucket;
 
-        keyring = ERR_PTR(-EINVAL);
         if (!name)
-                goto error;
+                return ERR_PTR(-EINVAL);
 
         bucket = keyring_hash(name);
 
@@ -555,17 +558,18 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
                                            KEY_SEARCH) < 0)
                                 continue;
 
-                        /* we've got a match */
-                        atomic_inc(&keyring->usage);
-                        read_unlock(&keyring_name_lock);
-                        goto error;
+                        /* we've got a match but we might end up racing with
+                         * key_cleanup() if the keyring is currently 'dead'
+                         * (ie. it has a zero usage count) */
+                        if (!atomic_inc_not_zero(&keyring->usage))
+                                continue;
+                        goto out;
                 }
         }
 
-        read_unlock(&keyring_name_lock);
         keyring = ERR_PTR(-ENOKEY);
-
- error:
+out:
+        read_unlock(&keyring_name_lock);
         return keyring;
 
 } /* end find_keyring_by_name() */
@@ -720,8 +724,7 @@ int __key_link(struct key *keyring, struct key *key)
         }
 
         /* see if there's a matching key we can displace */
-        klist = keyring->payload.subscriptions;
-
+        klist = rcu_dereference_locked_keyring(keyring);
         if (klist && klist->nkeys > 0) {
                 struct key_type *type = key->type;
 
@@ -765,8 +768,6 @@ int __key_link(struct key *keyring, struct key *key)
         if (ret < 0)
                 goto error2;
 
-        klist = keyring->payload.subscriptions;
-
         if (klist && klist->nkeys < klist->maxkeys) {
                 /* there's sufficient slack space to add directly */
                 atomic_inc(&key->usage);
@@ -868,7 +869,7 @@ int key_unlink(struct key *keyring, struct key *key)
 
         down_write(&keyring->sem);
 
-        klist = keyring->payload.subscriptions;
+        klist = rcu_dereference_locked_keyring(keyring);
         if (klist) {
                 /* search the keyring for the key */
                 for (loop = 0; loop < klist->nkeys; loop++)
@@ -959,7 +960,7 @@ int keyring_clear(struct key *keyring)
                 /* detach the pointer block with the locks held */
                 down_write(&keyring->sem);
 
-                klist = keyring->payload.subscriptions;
+                klist = rcu_dereference_locked_keyring(keyring);
                 if (klist) {
                         /* adjust the quota */
                         key_payload_reserve(keyring,
@@ -991,7 +992,9 @@ EXPORT_SYMBOL(keyring_clear);
  */
 static void keyring_revoke(struct key *keyring)
 {
-        struct keyring_list *klist = keyring->payload.subscriptions;
+        struct keyring_list *klist;
+
+        klist = rcu_dereference_locked_keyring(keyring);
 
         /* adjust the quota */
         key_payload_reserve(keyring, 0);
@@ -1025,7 +1028,7 @@ void keyring_gc(struct key *keyring, time_t limit)
 
         down_write(&keyring->sem);
 
-        klist = keyring->payload.subscriptions;
+        klist = rcu_dereference_locked_keyring(keyring);
         if (!klist)
                 goto no_klist;
 
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index d737cea5347..d8c1a6a0fb0 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -94,7 +94,7 @@ static int call_sbin_request_key(struct key_construction *cons,
         }
 
         /* attach the auth key to the session keyring */
-        ret = __key_link(keyring, authkey);
+        ret = key_link(keyring, authkey);
         if (ret < 0)
                 goto error_link;
 
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 7c687d56822..e9aa0792965 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -199,7 +199,8 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
         struct user_key_payload *upayload;
         long ret;
 
-        upayload = rcu_dereference(key->payload.data);
+        upayload = rcu_dereference_protected(
+                key->payload.data, rwsem_is_locked(&((struct key *)key)->sem));
         ret = upayload->datalen;
 
         /* we can return the data as is */
diff --git a/security/min_addr.c b/security/min_addr.c
index e86f297522b..f728728f193 100644
--- a/security/min_addr.c
+++ b/security/min_addr.c
@@ -33,7 +33,7 @@ int mmap_min_addr_handler(struct ctl_table *table, int write,
 {
         int ret;
 
-        if (!capable(CAP_SYS_RAWIO))
+        if (write && !capable(CAP_SYS_RAWIO))
                 return -EPERM;
 
         ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 87288762403..20b5982c996 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -36,6 +36,9 @@
 #include <sound/timer.h>
 #include <sound/minors.h>
 #include <asm/io.h>
+#if defined(CONFIG_MIPS) && defined(CONFIG_DMA_NONCOHERENT)
+#include <dma-coherence.h>
+#endif
 
 /*
  *  Compatibility
@@ -3184,6 +3187,10 @@ static int snd_pcm_default_mmap(struct snd_pcm_substream *substream,
                                          substream->runtime->dma_area,
                                          substream->runtime->dma_addr,
                                          area->vm_end - area->vm_start);
+#elif defined(CONFIG_MIPS) && defined(CONFIG_DMA_NONCOHERENT)
+        if (substream->dma_buffer.dev.type == SNDRV_DMA_TYPE_DEV &&
+            !plat_device_is_coherent(substream->dma_buffer.dev.dev))
+                area->vm_page_prot = pgprot_noncached(area->vm_page_prot);
 #endif /* ARCH_HAS_DMA_MMAP_COHERENT */
         /* mmap with fault handler */
         area->vm_ops = &snd_pcm_vm_ops_data_fault;
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 73943651cae..5040c7b862f 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1160,6 +1160,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,
 {
         struct snd_timer_user *tu = timeri->callback_data;
         struct snd_timer_tread r1;
+        unsigned long flags;
 
         if (event >= SNDRV_TIMER_EVENT_START &&
             event <= SNDRV_TIMER_EVENT_PAUSE)
@@ -1169,9 +1170,9 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,
         r1.event = event;
         r1.tstamp = *tstamp;
         r1.val = resolution;
-        spin_lock(&tu->qlock);
+        spin_lock_irqsave(&tu->qlock, flags);
         snd_timer_user_append_to_tqueue(tu, &r1);
-        spin_unlock(&tu->qlock);
+        spin_unlock_irqrestore(&tu->qlock, flags);
         kill_fasync(&tu->fasync, SIGIO, POLL_IN);
         wake_up(&tu->qchange_sleep);
 }
diff --git a/sound/isa/sb/es968.c b/sound/isa/sb/es968.c
index cafc3a7316a..ff18286fef9 100644
--- a/sound/isa/sb/es968.c
+++ b/sound/isa/sb/es968.c
@@ -93,7 +93,7 @@ static int __devinit snd_card_es968_pnp(int dev, struct snd_card_es968 *acard,
                 return err;
         }
         port[dev] = pnp_port_start(pdev, 0);
-        dma8[dev] = pnp_dma(pdev, 1);
+        dma8[dev] = pnp_dma(pdev, 0);
         irq[dev] = pnp_irq(pdev, 0);
 
         return 0;
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 7de782a5b8f..350ee8ac415 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -766,7 +766,7 @@ static int build_input(struct hda_codec *codec)
                 for (n = 0; n < AUTO_PIN_LAST; n++) {
                         if (!spec->adc_nid[n])
                                 continue;
-                        err = snd_hda_add_nid(codec, kctl, 0, spec->adc_nid[i]);
+                        err = snd_hda_add_nid(codec, kctl, 0, spec->adc_nid[n]);
                         if (err < 0)
                                 return err;
                 }
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 61682e1d09d..feabb44c7ca 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -1195,10 +1195,12 @@ static int patch_cxt5045(struct hda_codec *codec)
 
         switch (codec->subsystem_id >> 16) {
         case 0x103c:
+        case 0x1631:
         case 0x1734:
-                /* HP & Fujitsu-Siemens laptops have really bad sound over 0dB
-                 * on NID 0x17. Fix max PCM level to 0 dB
-                 * (originally it has 0x2b steps with 0dB offset 0x14)
+        case 0x17aa:
+                /* HP, Packard Bell, Fujitsu-Siemens & Lenovo laptops have
+                 * really bad sound over 0dB on NID 0x17. Fix max PCM level to
+                 * 0 dB (originally it has 0x2b steps with 0dB offset 0x14)
                  */
                 snd_hda_override_amp_caps(codec, 0x17, HDA_INPUT,
                                           (0x14 << AC_AMPCAP_OFFSET_SHIFT) |
@@ -2842,6 +2844,10 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
                       CXT5066_DELL_LAPTOP),
         SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTO),
+        SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
+        SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
+        SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
+        SND_PCI_QUIRK(0x17aa, 0x21b2, "Thinkpad X100e", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "ideapad", CXT5066_IDEAPAD),
         {}
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7404dba16f8..886d8e46bb3 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -17871,7 +17871,6 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
                                         ALC662_3ST_6ch_DIG),
         SND_PCI_QUIRK_MASK(0x1854, 0xf000, 0x2000, "ASUS H13-200x",
                            ALC663_ASUS_H13),
-        SND_PCI_QUIRK(0x8086, 0xd604, "Intel mobo", ALC662_3ST_2ch_DIG),
         {}
 };
 
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 7fb7d017a34..a0e06d82da1 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -104,6 +104,7 @@ enum {
         STAC_DELL_M4_2,
         STAC_DELL_M4_3,
         STAC_HP_M4,
+        STAC_HP_DV4,
         STAC_HP_DV5,
         STAC_HP_HDX,
         STAC_HP_DV4_1222NR,
@@ -1544,11 +1545,9 @@ static unsigned int alienware_m17x_pin_configs[13] = {
         0x904601b0,
 };
 
-static unsigned int intel_dg45id_pin_configs[14] = {
+static unsigned int intel_dg45id_pin_configs[13] = {
         0x02214230, 0x02A19240, 0x01013214, 0x01014210,
-        0x01A19250, 0x01011212, 0x01016211, 0x40f000f0,
-        0x40f000f0, 0x40f000f0, 0x40f000f0, 0x014510A0,
-        0x074510B0, 0x40f000f0
+        0x01A19250, 0x01011212, 0x01016211
 };
 
 static unsigned int *stac92hd73xx_brd_tbl[STAC_92HD73XX_MODELS] = {
@@ -1693,6 +1692,7 @@ static unsigned int *stac92hd71bxx_brd_tbl[STAC_92HD71BXX_MODELS] = {
         [STAC_DELL_M4_2]        = dell_m4_2_pin_configs,
         [STAC_DELL_M4_3]        = dell_m4_3_pin_configs,
         [STAC_HP_M4]            = NULL,
+        [STAC_HP_DV4]           = NULL,
         [STAC_HP_DV5]           = NULL,
         [STAC_HP_HDX]           = NULL,
         [STAC_HP_DV4_1222NR]    = NULL,
@@ -1705,6 +1705,7 @@ static const char *stac92hd71bxx_models[STAC_92HD71BXX_MODELS] = {
         [STAC_DELL_M4_2] = "dell-m4-2",
         [STAC_DELL_M4_3] = "dell-m4-3",
         [STAC_HP_M4] = "hp-m4",
+        [STAC_HP_DV4] = "hp-dv4",
         [STAC_HP_DV5] = "hp-dv5",
         [STAC_HP_HDX] = "hp-hdx",
         [STAC_HP_DV4_1222NR] = "hp-dv4-1222nr",
@@ -1723,7 +1724,7 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
         SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x3080,
                       "HP", STAC_HP_DV5),
         SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x30f0,
-                      "HP dv4-7", STAC_HP_DV5),
+                      "HP dv4-7", STAC_HP_DV4),
         SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x3600,
                       "HP dv4-7", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3610,
@@ -4768,6 +4769,9 @@ static void set_hp_led_gpio(struct hda_codec *codec)
         struct sigmatel_spec *spec = codec->spec;
         unsigned int gpio;
 
+        if (spec->gpio_led)
+                return;
+
         gpio = snd_hda_param_read(codec, codec->afg, AC_PAR_GPIO_CAP);
         gpio &= AC_GPIO_IO_COUNT;
         if (gpio > 3)
@@ -5677,6 +5681,9 @@ again:
                 spec->num_smuxes = 1;
                 spec->num_dmuxes = 1;
                 /* fallthrough */
+        case STAC_HP_DV4:
+                spec->gpio_led = 0x01;
+                /* fallthrough */
         case STAC_HP_DV5:
                 snd_hda_codec_set_pincfg(codec, 0x0d, 0x90170010);
                 stac92xx_auto_set_pinctl(codec, 0x0d, AC_PINCTL_OUT_EN);
@@ -5690,6 +5697,7 @@ again:
                 spec->num_dmics = 1;
                 spec->num_dmuxes = 1;
                 spec->num_smuxes = 1;
+                spec->gpio_led = 0x08;
                 break;
         }
 
@@ -5746,7 +5754,8 @@ again:
         }
 
         /* enable bass on HP dv7 */
-        if (spec->board_config == STAC_HP_DV5) {
+        if (spec->board_config == STAC_HP_DV4 ||
+            spec->board_config == STAC_HP_DV5) {
                 unsigned int cap;
                 cap = snd_hda_param_read(codec, 0x1, AC_PAR_GPIO_CAP);
                 cap &= AC_GPIO_IO_COUNT;
diff --git a/sound/pci/ice1712/maya44.c b/sound/pci/ice1712/maya44.c
index 3e1c20ae2f1..726fd4b92e1 100644
--- a/sound/pci/ice1712/maya44.c
+++ b/sound/pci/ice1712/maya44.c
@@ -347,7 +347,7 @@ static int maya_gpio_sw_put(struct snd_kcontrol *kcontrol,
 
 /* known working input slots (0-4) */
 #define MAYA_LINE_IN    1       /* in-2 */
-#define MAYA_MIC_IN     4       /* in-5 */
+#define MAYA_MIC_IN     3       /* in-4 */
 
 static void wm8776_select_input(struct snd_maya44 *chip, int idx, int line)
 {
@@ -393,8 +393,8 @@ static int maya_rec_src_put(struct snd_kcontrol *kcontrol,
         int changed;
 
         mutex_lock(&chip->mutex);
-        changed = maya_set_gpio_bits(chip->ice, GPIO_MIC_RELAY,
-                                     sel ? GPIO_MIC_RELAY : 0);
+        changed = maya_set_gpio_bits(chip->ice, 1 << GPIO_MIC_RELAY,
+                                     sel ? (1 << GPIO_MIC_RELAY) : 0);
         wm8776_select_input(chip, 0, sel ? MAYA_MIC_IN : MAYA_LINE_IN);
         mutex_unlock(&chip->mutex);
         return changed;
diff --git a/sound/pci/oxygen/xonar_cs43xx.c b/sound/pci/oxygen/xonar_cs43xx.c
index 16c226bfcd2..7c4986b27f2 100644
--- a/sound/pci/oxygen/xonar_cs43xx.c
+++ b/sound/pci/oxygen/xonar_cs43xx.c
@@ -56,6 +56,7 @@
 #include <sound/pcm_params.h>
 #include <sound/tlv.h>
 #include "xonar.h"
+#include "cm9780.h"
 #include "cs4398.h"
 #include "cs4362a.h"
 
@@ -172,6 +173,8 @@ static void xonar_d1_init(struct oxygen *chip)
         oxygen_clear_bits16(chip, OXYGEN_GPIO_DATA,
                             GPIO_D1_FRONT_PANEL | GPIO_D1_INPUT_ROUTE);
 
+        oxygen_ac97_set_bits(chip, 0, CM9780_JACK, CM9780_FMIC2MIC);
+
         xonar_init_cs53x1(chip);
         xonar_enable_output(chip);
 
diff --git a/sound/soc/txx9/txx9aclc-ac97.c b/sound/soc/txx9/txx9aclc-ac97.c
index 612e18b4bf4..0ec20b68e8c 100644
--- a/sound/soc/txx9/txx9aclc-ac97.c
+++ b/sound/soc/txx9/txx9aclc-ac97.c
@@ -254,3 +254,4 @@ module_exit(txx9aclc_ac97_exit);
 MODULE_AUTHOR("Atsushi Nemoto <anemo@mba.ocn.ne.jp>");
 MODULE_DESCRIPTION("TXx9 ACLC AC97 driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:txx9aclc-ac97");
diff --git a/sound/soc/txx9/txx9aclc-generic.c b/sound/soc/txx9/txx9aclc-generic.c
index 3175de9a92c..95b17f731ae 100644
--- a/sound/soc/txx9/txx9aclc-generic.c
+++ b/sound/soc/txx9/txx9aclc-generic.c
@@ -96,3 +96,4 @@ module_exit(txx9aclc_generic_exit);
 MODULE_AUTHOR("Atsushi Nemoto <anemo@mba.ocn.ne.jp>");
 MODULE_DESCRIPTION("Generic TXx9 ACLC ALSA SoC audio driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:txx9aclc-generic");
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 3b8b6387c47..f1411e9cdf4 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -563,6 +563,9 @@ static int __cmd_record(int argc, const char **argv)
 
         err = event__synthesize_kernel_mmap(process_synthesized_event,
                                             session, "_text");
+        if (err < 0)
+                err = event__synthesize_kernel_mmap(process_synthesized_event,
+                                                    session, "_stext");
         if (err < 0) {
                 pr_err("Couldn't record kernel reference relocation symbol.\n");
                 return err;
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 9b3c20f42f9..613c9cc9057 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -1925,7 +1925,7 @@ void *raw_field_ptr(struct event *event, const char *name, void *data)
         if (!field)
                 return NULL;
 
-        if (field->flags & FIELD_IS_STRING) {
+        if (field->flags & FIELD_IS_DYNAMIC) {
                 int offset;
 
                 offset = *(int *)(data + field->offset);
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 03a5eb22da2..7c79c1d76d0 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -197,7 +197,7 @@ int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
         union kvm_ioapic_redirect_entry entry;
         int ret = 1;
 
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         if (irq >= 0 && irq < IOAPIC_NUM_PINS) {
                 entry = ioapic->redirtbl[irq];
                 level ^= entry.fields.polarity;
@@ -214,7 +214,7 @@ int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
                 }
                 trace_kvm_ioapic_set_irq(entry.bits, irq, ret == 0);
         }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
 
         return ret;
 }
@@ -238,9 +238,9 @@ static void __kvm_ioapic_update_eoi(struct kvm_ioapic *ioapic, int vector,
                  * is dropped it will be put into irr and will be delivered
                  * after ack notifier returns.
                  */
-                mutex_unlock(&ioapic->lock);
+                spin_unlock(&ioapic->lock);
                 kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
-                mutex_lock(&ioapic->lock);
+                spin_lock(&ioapic->lock);
 
                 if (trigger_mode != IOAPIC_LEVEL_TRIG)
                         continue;
@@ -259,9 +259,9 @@ void kvm_ioapic_update_eoi(struct kvm *kvm, int vector, int trigger_mode)
         smp_rmb();
         if (!test_bit(vector, ioapic->handled_vectors))
                 return;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         __kvm_ioapic_update_eoi(ioapic, vector, trigger_mode);
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
 }
 
 static inline struct kvm_ioapic *to_ioapic(struct kvm_io_device *dev)
@@ -287,7 +287,7 @@ static int ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
         ASSERT(!(addr & 0xf));  /* check alignment */
 
         addr &= 0xff;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         switch (addr) {
         case IOAPIC_REG_SELECT:
                 result = ioapic->ioregsel;
@@ -301,7 +301,7 @@ static int ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
                 result = 0;
                 break;
         }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
 
         switch (len) {
         case 8:
@@ -338,7 +338,7 @@ static int ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
         }
 
         addr &= 0xff;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         switch (addr) {
         case IOAPIC_REG_SELECT:
                 ioapic->ioregsel = data;
@@ -356,7 +356,7 @@ static int ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
         default:
                 break;
         }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
         return 0;
 }
 
@@ -386,7 +386,7 @@ int kvm_ioapic_init(struct kvm *kvm)
         ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
         if (!ioapic)
                 return -ENOMEM;
-        mutex_init(&ioapic->lock);
+        spin_lock_init(&ioapic->lock);
         kvm->arch.vioapic = ioapic;
         kvm_ioapic_reset(ioapic);
         kvm_iodevice_init(&ioapic->dev, &ioapic_mmio_ops);
@@ -419,9 +419,9 @@ int kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
         if (!ioapic)
                 return -EINVAL;
 
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         memcpy(state, ioapic, sizeof(struct kvm_ioapic_state));
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
         return 0;
 }
 
@@ -431,9 +431,9 @@ int kvm_set_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
         if (!ioapic)
                 return -EINVAL;
 
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
         memcpy(ioapic, state, sizeof(struct kvm_ioapic_state));
         update_handled_vectors(ioapic);
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
         return 0;
 }
diff --git a/virt/kvm/ioapic.h b/virt/kvm/ioapic.h
index 8a751b78a43..0b190c34ccc 100644
--- a/virt/kvm/ioapic.h
+++ b/virt/kvm/ioapic.h
@@ -45,7 +45,7 @@ struct kvm_ioapic {
         struct kvm_io_device dev;
         struct kvm *kvm;
         void (*ack_notifier)(void *opaque, int irq);
-        struct mutex lock;
+        spinlock_t lock;
         DECLARE_BITMAP(handled_vectors, 256);
 };