Merge branch 'tip/perf/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace into perf/core

author: Ingo Molnar <mingo@elte.hu> 2012-01-08 06:31:24 -0500
committer: Ingo Molnar <mingo@elte.hu> 2012-01-08 06:31:24 -0500
commit: 636f0c70f2557e0819b50c74e31b4a027327015e (patch)
tree: 3a259ef26659dac92782651440091b9f5ab1a7f7
parent: 675eef66e3edcab8065533edfefbcbbacb9a30d3 (diff)
parent: 2e885057b7f75035f0b85e02f737891482815a81 (diff)
277 files changed, 3694 insertions, 1455 deletions
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 7945b0bd35e..e2a4b528736 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -1100,6 +1100,15 @@ emulate them efficiently. The fields in each entry are defined as follows:
   eax, ebx, ecx, edx: the values returned by the cpuid instruction for
         this function/index combination
+The TSC deadline timer feature (CPUID leaf 1, ecx[24]) is always returned
+as false, since the feature depends on KVM_CREATE_IRQCHIP for local APIC
+support.  Instead it is reported via
+  ioctl(KVM_CHECK_EXTENSION, KVM_CAP_TSC_DEADLINE_TIMER)
+if that returns true and you use KVM_CREATE_IRQCHIP, or if you emulate the
+feature in userspace, then you can enable the feature for KVM_SET_CPUID2.
 4.47 KVM_PPC_GET_PVINFO
 Capability: KVM_CAP_PPC_GET_PVINFO
@@ -1151,6 +1160,13 @@ following flags are specified:
 /* Depends on KVM_CAP_IOMMU */
 #define KVM_DEV_ASSIGN_ENABLE_IOMMU     (1 << 0)
+The KVM_DEV_ASSIGN_ENABLE_IOMMU flag is a mandatory option to ensure
+isolation of the device.  Usages not specifying this flag are deprecated.
+Only PCI header type 0 devices with PCI BAR resources are supported by
+device assignment.  The user requesting this ioctl must have read/write
+access to the PCI sysfs resource files associated with the device.
 4.49 KVM_DEASSIGN_PCI_DEVICE
 Capability: KVM_CAP_DEVICE_DEASSIGNMENT
diff --git a/MAINTAINERS b/MAINTAINERS
index b9db108f01c..62f1cd357dd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1698,11 +1698,9 @@ F:	arch/x86/include/asm/tce.h
 CAN NETWORK LAYER
 M:      Oliver Hartkopp <socketcan@hartkopp.net>
-M:      Oliver Hartkopp <oliver.hartkopp@volkswagen.de>
-M:      Urs Thuermann <urs.thuermann@volkswagen.de>
 L:      linux-can@vger.kernel.org
-L:      netdev@vger.kernel.org
+W:      http://gitorious.org/linux-can
-W:      http://developer.berlios.de/projects/socketcan/
+T:      git git://gitorious.org/linux-can/linux-can-next.git
 S:      Maintained
 F:      net/can/
 F:      include/linux/can.h
@@ -1713,9 +1711,10 @@ F:	include/linux/can/gw.h
 CAN NETWORK DRIVERS
 M:      Wolfgang Grandegger <wg@grandegger.com>
+M:      Marc Kleine-Budde <mkl@pengutronix.de>
 L:      linux-can@vger.kernel.org
-L:      netdev@vger.kernel.org
+W:      http://gitorious.org/linux-can
-W:      http://developer.berlios.de/projects/socketcan/
+T:      git git://gitorious.org/linux-can/linux-can-next.git
 S:      Maintained
 F:      drivers/net/can/
 F:      include/linux/can/dev.h
@@ -2700,7 +2699,7 @@ FIREWIRE SUBSYSTEM
 M:      Stefan Richter <stefanr@s5r6.in-berlin.de>
 L:      linux1394-devel@lists.sourceforge.net
 W:      http://ieee1394.wiki.kernel.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394.git
 S:      Maintained
 F:      drivers/firewire/
 F:      include/linux/firewire*.h
@@ -3101,6 +3100,7 @@ F:	include/linux/hid*
 HIGH-RESOLUTION TIMERS, CLOCKEVENTS, DYNTICKS
 M:      Thomas Gleixner <tglx@linutronix.de>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/core
 S:      Maintained
 F:      Documentation/timers/
 F:      kernel/hrtimer.c
@@ -3610,7 +3610,7 @@ F:	net/irda/
 IRQ SUBSYSTEM
 M:      Thomas Gleixner <tglx@linutronix.de>
 S:      Maintained
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip.git irq/core
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
 F:      kernel/irq/
 ISAPNP
@@ -4098,7 +4098,7 @@ F:	drivers/hwmon/lm90.c
 LOCKDEP AND LOCKSTAT
 M:      Peter Zijlstra <peterz@infradead.org>
 M:      Ingo Molnar <mingo@redhat.com>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/peterz/linux-2.6-lockdep.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git core/locking
 S:      Maintained
 F:      Documentation/lockdep*.txt
 F:      Documentation/lockstat.txt
@@ -4280,7 +4280,9 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 S:      Maintained
 F:      Documentation/dvb/
 F:      Documentation/video4linux/
+F:      Documentation/DocBook/media/
 F:      drivers/media/
+F:      drivers/staging/media/
 F:      include/media/
 F:      include/linux/dvb/
 F:      include/linux/videodev*.h
@@ -5086,6 +5088,7 @@ M:	Peter Zijlstra <a.p.zijlstra@chello.nl>
 M:      Paul Mackerras <paulus@samba.org>
 M:      Ingo Molnar <mingo@elte.hu>
 M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git perf/core
 S:      Supported
 F:      kernel/events/*
 F:      include/linux/perf_event.h
@@ -5165,6 +5168,7 @@ F:	drivers/scsi/pm8001/
 POSIX CLOCKS and TIMERS
 M:      Thomas Gleixner <tglx@linutronix.de>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/core
 S:      Supported
 F:      fs/timerfd.c
 F:      include/linux/timer*
@@ -5680,6 +5684,7 @@ F:	drivers/dma/dw_dmac.c
 TIMEKEEPING, NTP
 M:      John Stultz <johnstul@us.ibm.com>
 M:      Thomas Gleixner <tglx@linutronix.de>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/core
 S:      Supported
 F:      include/linux/clocksource.h
 F:      include/linux/time.h
@@ -5704,6 +5709,7 @@ F:	drivers/watchdog/sc1200wdt.c
 SCHEDULER
 M:      Ingo Molnar <mingo@elte.hu>
 M:      Peter Zijlstra <peterz@infradead.org>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git sched/core
 S:      Maintained
 F:      kernel/sched*
 F:      include/linux/sched.h
@@ -6631,7 +6637,7 @@ TRACING
 M:      Steven Rostedt <rostedt@goodmis.org>
 M:      Frederic Weisbecker <fweisbec@gmail.com>
 M:      Ingo Molnar <mingo@redhat.com>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip.git perf/core
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git perf/core
 S:      Maintained
 F:      Documentation/trace/ftrace.txt
 F:      arch/*/*/*/ftrace.h
@@ -7381,7 +7387,7 @@ M:	Thomas Gleixner <tglx@linutronix.de>
 M:      Ingo Molnar <mingo@redhat.com>
 M:      "H. Peter Anvin" <hpa@zytor.com>
 M:      x86@kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/core
 S:      Maintained
 F:      Documentation/x86/
 F:      arch/x86/
diff --git a/Makefile b/Makefile
index a43733df397..adddd11c3b3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 2
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION =
 NAME = Saber-toothed Squirrel
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 776d76b8cb6..b259c7c644e 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1246,7 +1246,7 @@ config PL310_ERRATA_588369
 config ARM_ERRATA_720789
        bool "ARM errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID"
-        depends on CPU_V7 && SMP
+        depends on CPU_V7
        help
          This option enables the workaround for the 720789 Cortex-A9 (prior to
          r2p0) erratum. A faulty ASID can be sent to the other CPUs for the
@@ -1282,7 +1282,7 @@ config ARM_ERRATA_743622
 config ARM_ERRATA_751472
        bool "ARM errata: Interrupted ICIALLUIS may prevent completion of broadcasted operation"
-        depends on CPU_V7 && SMP
+        depends on CPU_V7
        help
          This option enables the workaround for the 751472 Cortex-A9 (prior
          to r3p0) erratum. An interrupted ICIALLUIS operation may prevent the
diff --git a/arch/arm/common/pl330.c b/arch/arm/common/pl330.c
index f407a6b35d3..8d8df744f7a 100644
--- a/arch/arm/common/pl330.c
+++ b/arch/arm/common/pl330.c
@@ -221,17 +221,6 @@
 */
 #define MCODE_BUFF_PER_REQ      256
-/*
- * Mark a _pl330_req as free.
- * We do it by writing DMAEND as the first instruction
- * because no valid request is going to have DMAEND as
- * its first instruction to execute.
- */
-#define MARK_FREE(req)  do { \
-                                _emit_END(0, (req)->mc_cpu); \
-                                (req)->mc_len = 0; \
-                        } while (0)
 /* If the _pl330_req is available to the client */
 #define IS_FREE(req)    (*((u8 *)((req)->mc_cpu)) == CMD_DMAEND)
@@ -301,8 +290,10 @@ struct pl330_thread {
        struct pl330_dmac *dmac;
        /* Only two at a time */
        struct _pl330_req req[2];
-        /* Index of the last submitted request */
+        /* Index of the last enqueued request */
        unsigned lstenq;
+        /* Index of the last submitted request or -1 if the DMA is stopped */
+        int req_running;
 };
 enum pl330_dmac_state {
@@ -778,6 +769,22 @@ static inline void _execute_DBGINSN(struct pl330_thread *thrd,
        writel(0, regs + DBGCMD);
 }
+/*
+ * Mark a _pl330_req as free.
+ * We do it by writing DMAEND as the first instruction
+ * because no valid request is going to have DMAEND as
+ * its first instruction to execute.
+ */
+static void mark_free(struct pl330_thread *thrd, int idx)
+{
+        struct _pl330_req *req = &thrd->req[idx];
+        _emit_END(0, req->mc_cpu);
+        req->mc_len = 0;
+        thrd->req_running = -1;
+}
 static inline u32 _state(struct pl330_thread *thrd)
 {
        void __iomem *regs = thrd->dmac->pinfo->base;
@@ -836,31 +843,6 @@ static inline u32 _state(struct pl330_thread *thrd)
        }
 }
-/* If the request 'req' of thread 'thrd' is currently active */
-static inline bool _req_active(struct pl330_thread *thrd,
-                struct _pl330_req *req)
-{
-        void __iomem *regs = thrd->dmac->pinfo->base;
-        u32 buf = req->mc_bus, pc = readl(regs + CPC(thrd->id));
-        if (IS_FREE(req))
-                return false;
-        return (pc >= buf && pc <= buf + req->mc_len) ? true : false;
-}
-/* Returns 0 if the thread is inactive, ID of active req + 1 otherwise */
-static inline unsigned _thrd_active(struct pl330_thread *thrd)
-{
-        if (_req_active(thrd, &thrd->req[0]))
-                return 1; /* First req active */
-        if (_req_active(thrd, &thrd->req[1]))
-                return 2; /* Second req active */
-        return 0;
-}
 static void _stop(struct pl330_thread *thrd)
 {
        void __iomem *regs = thrd->dmac->pinfo->base;
@@ -892,17 +874,22 @@ static bool _trigger(struct pl330_thread *thrd)
        struct _arg_GO go;
        unsigned ns;
        u8 insn[6] = {0, 0, 0, 0, 0, 0};
+        int idx;
        /* Return if already ACTIVE */
        if (_state(thrd) != PL330_STATE_STOPPED)
                return true;
-        if (!IS_FREE(&thrd->req[1 - thrd->lstenq]))
+        idx = 1 - thrd->lstenq;
-                req = &thrd->req[1 - thrd->lstenq];
+        if (!IS_FREE(&thrd->req[idx]))
-        else if (!IS_FREE(&thrd->req[thrd->lstenq]))
+                req = &thrd->req[idx];
-                req = &thrd->req[thrd->lstenq];
+        else {
-        else
+                idx = thrd->lstenq;
-                req = NULL;
+                if (!IS_FREE(&thrd->req[idx]))
+                        req = &thrd->req[idx];
+                else
+                        req = NULL;
+        }
        /* Return if no request */
        if (!req || !req->r)
@@ -933,6 +920,8 @@ static bool _trigger(struct pl330_thread *thrd)
        /* Only manager can execute GO */
        _execute_DBGINSN(thrd, insn, true);
+        thrd->req_running = idx;
        return true;
 }
@@ -1382,8 +1371,8 @@ static void pl330_dotask(unsigned long data)
                        thrd->req[0].r = NULL;
                        thrd->req[1].r = NULL;
-                        MARK_FREE(&thrd->req[0]);
+                        mark_free(thrd, 0);
-                        MARK_FREE(&thrd->req[1]);
+                        mark_free(thrd, 1);
                        /* Clear the reset flag */
                        pl330->dmac_tbd.reset_chan &= ~(1 << i);
@@ -1461,14 +1450,12 @@ int pl330_update(const struct pl330_info *pi)
                        thrd = &pl330->channels[id];
-                        active = _thrd_active(thrd);
+                        active = thrd->req_running;
-                        if (!active) /* Aborted */
+                        if (active == -1) /* Aborted */
                                continue;
-                        active -= 1;
                        rqdone = &thrd->req[active];
-                        MARK_FREE(rqdone);
+                        mark_free(thrd, active);
                        /* Get going again ASAP */
                        _start(thrd);
@@ -1509,7 +1496,7 @@ int pl330_chan_ctrl(void *ch_id, enum pl330_chan_op op)
        struct pl330_thread *thrd = ch_id;
        struct pl330_dmac *pl330;
        unsigned long flags;
-        int ret = 0, active;
+        int ret = 0, active = thrd->req_running;
        if (!thrd || thrd->free || thrd->dmac->state == DYING)
                return -EINVAL;
@@ -1525,28 +1512,24 @@ int pl330_chan_ctrl(void *ch_id, enum pl330_chan_op op)
                thrd->req[0].r = NULL;
                thrd->req[1].r = NULL;
-                MARK_FREE(&thrd->req[0]);
+                mark_free(thrd, 0);
-                MARK_FREE(&thrd->req[1]);
+                mark_free(thrd, 1);
                break;
        case PL330_OP_ABORT:
-                active = _thrd_active(thrd);
                /* Make sure the channel is stopped */
                _stop(thrd);
                /* ABORT is only for the active req */
-                if (!active)
+                if (active == -1)
                        break;
-                active--;
                thrd->req[active].r = NULL;
-                MARK_FREE(&thrd->req[active]);
+                mark_free(thrd, active);
                /* Start the next */
        case PL330_OP_START:
-                if (!_thrd_active(thrd) && !_start(thrd))
+                if ((active == -1) && !_start(thrd))
                        ret = -EIO;
                break;
@@ -1587,14 +1570,13 @@ int pl330_chan_status(void *ch_id, struct pl330_chanstatus *pstatus)
        else
                pstatus->faulting = false;
-        active = _thrd_active(thrd);
+        active = thrd->req_running;
-        if (!active) {
+        if (active == -1) {
                /* Indicate that the thread is not running */
                pstatus->top_req = NULL;
                pstatus->wait_req = NULL;
        } else {
-                active--;
                pstatus->top_req = thrd->req[active].r;
                pstatus->wait_req = !IS_FREE(&thrd->req[1 - active])
                                        ? thrd->req[1 - active].r : NULL;
@@ -1659,9 +1641,9 @@ void *pl330_request_channel(const struct pl330_info *pi)
                                thrd->free = false;
                                thrd->lstenq = 1;
                                thrd->req[0].r = NULL;
-                                MARK_FREE(&thrd->req[0]);
+                                mark_free(thrd, 0);
                                thrd->req[1].r = NULL;
-                                MARK_FREE(&thrd->req[1]);
+                                mark_free(thrd, 1);
                                break;
                        }
                }
@@ -1767,14 +1749,14 @@ static inline void _reset_thread(struct pl330_thread *thrd)
        thrd->req[0].mc_bus = pl330->mcode_bus
                                + (thrd->id * pi->mcbufsz);
        thrd->req[0].r = NULL;
-        MARK_FREE(&thrd->req[0]);
+        mark_free(thrd, 0);
        thrd->req[1].mc_cpu = thrd->req[0].mc_cpu
                                + pi->mcbufsz / 2;
        thrd->req[1].mc_bus = thrd->req[0].mc_bus
                                + pi->mcbufsz / 2;
        thrd->req[1].r = NULL;
-        MARK_FREE(&thrd->req[1]);
+        mark_free(thrd, 1);
 }
 static int dmac_alloc_threads(struct pl330_dmac *pl330)
diff --git a/arch/arm/configs/imx_v4_v5_defconfig b/arch/arm/configs/imx_v4_v5_defconfig
index 11a4192197c..cf497ce41df 100644
--- a/arch/arm/configs/imx_v4_v5_defconfig
+++ b/arch/arm/configs/imx_v4_v5_defconfig
@@ -18,9 +18,10 @@ CONFIG_ARCH_MXC=y
 CONFIG_ARCH_IMX_V4_V5=y
 CONFIG_ARCH_MX1ADS=y
 CONFIG_MACH_SCB9328=y
+CONFIG_MACH_APF9328=y
 CONFIG_MACH_MX21ADS=y
 CONFIG_MACH_MX25_3DS=y
-CONFIG_MACH_EUKREA_CPUIMX25=y
+CONFIG_MACH_EUKREA_CPUIMX25SD=y
 CONFIG_MACH_MX27ADS=y
 CONFIG_MACH_PCM038=y
 CONFIG_MACH_CPUIMX27=y
@@ -72,17 +73,16 @@ CONFIG_MTD_CFI_GEOMETRY=y
 CONFIG_MTD_CFI_INTELEXT=y
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_NAND=y
+CONFIG_MTD_NAND_MXC=y
 CONFIG_MTD_UBI=y
 CONFIG_MISC_DEVICES=y
 CONFIG_EEPROM_AT24=y
 CONFIG_EEPROM_AT25=y
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-CONFIG_SMC91X=y
 CONFIG_DM9000=y
+CONFIG_SMC91X=y
 CONFIG_SMC911X=y
-# CONFIG_NETDEV_1000 is not set
+CONFIG_SMSC_PHY=y
-# CONFIG_NETDEV_10000 is not set
 # CONFIG_INPUT_MOUSEDEV is not set
 CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_KEYBOARD is not set
@@ -100,6 +100,7 @@ CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_IMX=y
 CONFIG_SPI=y
 CONFIG_SPI_IMX=y
+CONFIG_SPI_SPIDEV=y
 CONFIG_W1=y
 CONFIG_W1_MASTER_MXC=y
 CONFIG_W1_SLAVE_THERM=y
@@ -139,6 +140,7 @@ CONFIG_MMC=y
 CONFIG_MMC_MXC=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_MC13783=y
 CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_TIMER=y
diff --git a/arch/arm/mach-exynos/cpu.c b/arch/arm/mach-exynos/cpu.c
index 90ec247f3b3..cc8d4bd6d0f 100644
--- a/arch/arm/mach-exynos/cpu.c
+++ b/arch/arm/mach-exynos/cpu.c
@@ -111,11 +111,6 @@ static struct map_desc exynos4_iodesc[] __initdata = {
                .length         = SZ_4K,
                .type           = MT_DEVICE,
        }, {
-                .virtual        = (unsigned long)S5P_VA_SROMC,
-                .pfn            = __phys_to_pfn(EXYNOS4_PA_SROMC),
-                .length         = SZ_4K,
-                .type           = MT_DEVICE,
-        }, {
                .virtual        = (unsigned long)S3C_VA_USB_HSPHY,
                .pfn            = __phys_to_pfn(EXYNOS4_PA_HSPHY),
                .length         = SZ_4K,
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index c44aa974e79..0e6f1af260b 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -132,7 +132,7 @@ config MACH_MX25_3DS
        select IMX_HAVE_PLATFORM_MXC_NAND
        select IMX_HAVE_PLATFORM_SDHCI_ESDHC_IMX
-config MACH_EUKREA_CPUIMX25
+config MACH_EUKREA_CPUIMX25SD
        bool "Support Eukrea CPUIMX25 Platform"
        select SOC_IMX25
        select IMX_HAVE_PLATFORM_FLEXCAN
@@ -148,7 +148,7 @@ config MACH_EUKREA_CPUIMX25
 choice
        prompt "Baseboard"
-        depends on MACH_EUKREA_CPUIMX25
+        depends on MACH_EUKREA_CPUIMX25SD
        default MACH_EUKREA_MBIMXSD25_BASEBOARD
 config MACH_EUKREA_MBIMXSD25_BASEBOARD
@@ -542,7 +542,7 @@ config MACH_MX35_3DS
          Include support for MX35PDK platform. This includes specific
          configurations for the board and its peripherals.
-config MACH_EUKREA_CPUIMX35
+config MACH_EUKREA_CPUIMX35SD
        bool "Support Eukrea CPUIMX35 Platform"
        select SOC_IMX35
        select IMX_HAVE_PLATFORM_FLEXCAN
@@ -560,7 +560,7 @@ config MACH_EUKREA_CPUIMX35
 choice
        prompt "Baseboard"
-        depends on MACH_EUKREA_CPUIMX35
+        depends on MACH_EUKREA_CPUIMX35SD
        default MACH_EUKREA_MBIMXSD35_BASEBOARD
 config MACH_EUKREA_MBIMXSD35_BASEBOARD
diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
index aba73214c2a..d97f409ce98 100644
--- a/arch/arm/mach-imx/Makefile
+++ b/arch/arm/mach-imx/Makefile
@@ -24,7 +24,7 @@ obj-$(CONFIG_MACH_MX21ADS) += mach-mx21ads.o
 # i.MX25 based machines
 obj-$(CONFIG_MACH_MX25_3DS) += mach-mx25_3ds.o
-obj-$(CONFIG_MACH_EUKREA_CPUIMX25) += mach-eukrea_cpuimx25.o
+obj-$(CONFIG_MACH_EUKREA_CPUIMX25SD) += mach-eukrea_cpuimx25.o
 obj-$(CONFIG_MACH_EUKREA_MBIMXSD25_BASEBOARD) += eukrea_mbimxsd25-baseboard.o
 # i.MX27 based machines
@@ -57,7 +57,7 @@ obj-$(CONFIG_MACH_BUG) += mach-bug.o
 # i.MX35 based machines
 obj-$(CONFIG_MACH_PCM043) += mach-pcm043.o
 obj-$(CONFIG_MACH_MX35_3DS) += mach-mx35_3ds.o
-obj-$(CONFIG_MACH_EUKREA_CPUIMX35) += mach-cpuimx35.o
+obj-$(CONFIG_MACH_EUKREA_CPUIMX35SD) += mach-cpuimx35.o
 obj-$(CONFIG_MACH_EUKREA_MBIMXSD35_BASEBOARD) += eukrea_mbimxsd35-baseboard.o
 obj-$(CONFIG_MACH_VPR200) += mach-vpr200.o
diff --git a/arch/arm/mach-imx/clock-imx35.c b/arch/arm/mach-imx/clock-imx35.c
index 8116f119517..ac8238caecb 100644
--- a/arch/arm/mach-imx/clock-imx35.c
+++ b/arch/arm/mach-imx/clock-imx35.c
@@ -507,7 +507,7 @@ static struct clk_lookup lookups[] = {
 int __init mx35_clocks_init()
 {
-        unsigned int cgr2 = 3 << 26, cgr3 = 0;
+        unsigned int cgr2 = 3 << 26;
 #if defined(CONFIG_DEBUG_LL) && !defined(CONFIG_DEBUG_ICEDCC)
        cgr2 |= 3 << 16;
@@ -521,6 +521,12 @@ int __init mx35_clocks_init()
        __raw_writel((3 << 18), CCM_BASE + CCM_CGR0);
        __raw_writel((3 << 2) | (3 << 4) | (3 << 6) | (3 << 8) | (3 << 16),
                        CCM_BASE + CCM_CGR1);
+        __raw_writel(cgr2, CCM_BASE + CCM_CGR2);
+        __raw_writel(0, CCM_BASE + CCM_CGR3);
+        clk_enable(&iim_clk);
+        imx_print_silicon_rev("i.MX35", mx35_revision());
+        clk_disable(&iim_clk);
        /*
         * Check if we came up in internal boot mode. If yes, we need some
@@ -529,17 +535,11 @@ int __init mx35_clocks_init()
         */
        if (!(__raw_readl(CCM_BASE + CCM_RCSR) & (3 << 10))) {
                /* Additionally turn on UART1, SCC, and IIM clocks */
-                cgr2 |= 3 << 16 | 3 << 4;
+                clk_enable(&iim_clk);
-                cgr3 |= 3 << 2;
+                clk_enable(&uart1_clk);
+                clk_enable(&scc_clk);
        }
-        __raw_writel(cgr2, CCM_BASE + CCM_CGR2);
-        __raw_writel(cgr3, CCM_BASE + CCM_CGR3);
-        clk_enable(&iim_clk);
-        imx_print_silicon_rev("i.MX35", mx35_revision());
-        clk_disable(&iim_clk);
 #ifdef CONFIG_MXC_USE_EPIT
        epit_timer_init(&epit1_clk,
                        MX35_IO_ADDRESS(MX35_EPIT1_BASE_ADDR), MX35_INT_EPIT1);
diff --git a/arch/arm/mach-imx/mach-cpuimx35.c b/arch/arm/mach-imx/mach-cpuimx35.c
index 66af2e8f7e5..362aae78060 100644
--- a/arch/arm/mach-imx/mach-cpuimx35.c
+++ b/arch/arm/mach-imx/mach-cpuimx35.c
@@ -53,12 +53,18 @@ static const struct imxi2c_platform_data
        .bitrate =              100000,
 };
+#define TSC2007_IRQGPIO         IMX_GPIO_NR(3, 2)
+static int tsc2007_get_pendown_state(void)
+{
+        return !gpio_get_value(TSC2007_IRQGPIO);
+}
 static struct tsc2007_platform_data tsc2007_info = {
        .model                  = 2007,
        .x_plate_ohms           = 180,
+        .get_pendown_state = tsc2007_get_pendown_state,
 };
-#define TSC2007_IRQGPIO         IMX_GPIO_NR(3, 2)
 static struct i2c_board_info eukrea_cpuimx35_i2c_devices[] = {
        {
                I2C_BOARD_INFO("pcf8563", 0x51),
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index 7f8915ad509..eef43e2e163 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -3247,18 +3247,14 @@ static __initdata struct omap_hwmod *omap3xxx_hwmods[] = {
 /* 3430ES1-only hwmods */
 static __initdata struct omap_hwmod *omap3430es1_hwmods[] = {
-        &omap3xxx_iva_hwmod,
        &omap3430es1_dss_core_hwmod,
-        &omap3xxx_mailbox_hwmod,
        NULL
 };
 /* 3430ES2+-only hwmods */
 static __initdata struct omap_hwmod *omap3430es2plus_hwmods[] = {
-        &omap3xxx_iva_hwmod,
        &omap3xxx_dss_core_hwmod,
        &omap3xxx_usbhsotg_hwmod,
-        &omap3xxx_mailbox_hwmod,
        NULL
 };
diff --git a/arch/arm/mach-shmobile/board-ag5evm.c b/arch/arm/mach-shmobile/board-ag5evm.c
index b862e9f81e3..7119b87cbfa 100644
--- a/arch/arm/mach-shmobile/board-ag5evm.c
+++ b/arch/arm/mach-shmobile/board-ag5evm.c
@@ -607,6 +607,7 @@ struct sys_timer ag5evm_timer = {
 MACHINE_START(AG5EVM, "ag5evm")
        .map_io         = ag5evm_map_io,
+        .nr_irqs        = NR_IRQS_LEGACY,
        .init_irq       = sh73a0_init_irq,
        .handle_irq     = shmobile_handle_irq_gic,
        .init_machine   = ag5evm_init,
diff --git a/arch/arm/mach-shmobile/board-kota2.c b/arch/arm/mach-shmobile/board-kota2.c
index bd9a78424d6..f44150b5ae4 100644
--- a/arch/arm/mach-shmobile/board-kota2.c
+++ b/arch/arm/mach-shmobile/board-kota2.c
@@ -33,6 +33,7 @@
 #include <linux/input/sh_keysc.h>
 #include <linux/gpio_keys.h>
 #include <linux/leds.h>
+#include <linux/platform_data/leds-renesas-tpu.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/sh_mmcif.h>
 #include <linux/mfd/tmio.h>
@@ -56,7 +57,7 @@ static struct resource smsc9220_resources[] = {
                .flags          = IORESOURCE_MEM,
        },
        [1] = {
-                .start          = gic_spi(33), /* PINTA2 @ PORT144 */
+                .start          = SH73A0_PINT0_IRQ(2), /* PINTA2 */
                .flags          = IORESOURCE_IRQ,
        },
 };
@@ -157,10 +158,6 @@ static struct platform_device gpio_keys_device = {
 #define GPIO_LED(n, g) { .name = n, .gpio = g }
 static struct gpio_led gpio_leds[] = {
-        GPIO_LED("V2513", GPIO_PORT153), /* PORT153 [TPU1T02] -> V2513 */
-        GPIO_LED("V2514", GPIO_PORT199), /* PORT199 [TPU4TO1] -> V2514 */
-        GPIO_LED("V2515", GPIO_PORT197), /* PORT197 [TPU2TO1] -> V2515 */
-        GPIO_LED("KEYLED", GPIO_PORT163), /* PORT163 [TPU3TO0] -> KEYLED */
        GPIO_LED("G", GPIO_PORT20), /* PORT20 [GPO0] -> LED7 -> "G" */
        GPIO_LED("H", GPIO_PORT21), /* PORT21 [GPO1] -> LED8 -> "H" */
        GPIO_LED("J", GPIO_PORT22), /* PORT22 [GPO2] -> LED9 -> "J" */
@@ -179,6 +176,119 @@ static struct platform_device gpio_leds_device = {
        },
 };
+/* TPU LED */
+static struct led_renesas_tpu_config led_renesas_tpu12_pdata = {
+        .name           = "V2513",
+        .pin_gpio_fn    = GPIO_FN_TPU1TO2,
+        .pin_gpio       = GPIO_PORT153,
+        .channel_offset = 0x90,
+        .timer_bit = 2,
+        .max_brightness = 1000,
+};
+static struct resource tpu12_resources[] = {
+        [0] = {
+                .name   = "TPU12",
+                .start  = 0xe6610090,
+                .end    = 0xe66100b5,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+static struct platform_device leds_tpu12_device = {
+        .name = "leds-renesas-tpu",
+        .id = 12,
+        .dev = {
+                .platform_data  = &led_renesas_tpu12_pdata,
+        },
+        .num_resources  = ARRAY_SIZE(tpu12_resources),
+        .resource       = tpu12_resources,
+};
+static struct led_renesas_tpu_config led_renesas_tpu41_pdata = {
+        .name           = "V2514",
+        .pin_gpio_fn    = GPIO_FN_TPU4TO1,
+        .pin_gpio       = GPIO_PORT199,
+        .channel_offset = 0x50,
+        .timer_bit = 1,
+        .max_brightness = 1000,
+};
+static struct resource tpu41_resources[] = {
+        [0] = {
+                .name   = "TPU41",
+                .start  = 0xe6640050,
+                .end    = 0xe6640075,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+static struct platform_device leds_tpu41_device = {
+        .name = "leds-renesas-tpu",
+        .id = 41,
+        .dev = {
+                .platform_data  = &led_renesas_tpu41_pdata,
+        },
+        .num_resources  = ARRAY_SIZE(tpu41_resources),
+        .resource       = tpu41_resources,
+};
+static struct led_renesas_tpu_config led_renesas_tpu21_pdata = {
+        .name           = "V2515",
+        .pin_gpio_fn    = GPIO_FN_TPU2TO1,
+        .pin_gpio       = GPIO_PORT197,
+        .channel_offset = 0x50,
+        .timer_bit = 1,
+        .max_brightness = 1000,
+};
+static struct resource tpu21_resources[] = {
+        [0] = {
+                .name   = "TPU21",
+                .start  = 0xe6620050,
+                .end    = 0xe6620075,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+static struct platform_device leds_tpu21_device = {
+        .name = "leds-renesas-tpu",
+        .id = 21,
+        .dev = {
+                .platform_data  = &led_renesas_tpu21_pdata,
+        },
+        .num_resources  = ARRAY_SIZE(tpu21_resources),
+        .resource       = tpu21_resources,
+};
+static struct led_renesas_tpu_config led_renesas_tpu30_pdata = {
+        .name           = "KEYLED",
+        .pin_gpio_fn    = GPIO_FN_TPU3TO0,
+        .pin_gpio       = GPIO_PORT163,
+        .channel_offset = 0x10,
+        .timer_bit = 0,
+        .max_brightness = 1000,
+};
+static struct resource tpu30_resources[] = {
+        [0] = {
+                .name   = "TPU30",
+                .start  = 0xe6630010,
+                .end    = 0xe6630035,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+static struct platform_device leds_tpu30_device = {
+        .name = "leds-renesas-tpu",
+        .id = 30,
+        .dev = {
+                .platform_data  = &led_renesas_tpu30_pdata,
+        },
+        .num_resources  = ARRAY_SIZE(tpu30_resources),
+        .resource       = tpu30_resources,
+};
 /* MMCIF */
 static struct resource mmcif_resources[] = {
        [0] = {
@@ -291,6 +401,10 @@ static struct platform_device *kota2_devices[] __initdata = {
        &keysc_device,
        &gpio_keys_device,
        &gpio_leds_device,
+        &leds_tpu12_device,
+        &leds_tpu41_device,
+        &leds_tpu21_device,
+        &leds_tpu30_device,
        &mmcif_device,
        &sdhi0_device,
        &sdhi1_device,
@@ -317,18 +431,6 @@ static void __init kota2_map_io(void)
        shmobile_setup_console();
 }
-#define PINTER0A        0xe69000a0
-#define PINTCR0A        0xe69000b0
-void __init kota2_init_irq(void)
-{
-        sh73a0_init_irq();
-        /* setup PINT: enable PINTA2 as active low */
-        __raw_writel(1 << 29, PINTER0A);
-        __raw_writew(2 << 10, PINTCR0A);
-}
 static void __init kota2_init(void)
 {
        sh73a0_pinmux_init();
@@ -447,7 +549,8 @@ struct sys_timer kota2_timer = {
 MACHINE_START(KOTA2, "kota2")
        .map_io         = kota2_map_io,
-        .init_irq       = kota2_init_irq,
+        .nr_irqs        = NR_IRQS_LEGACY,
+        .init_irq       = sh73a0_init_irq,
        .handle_irq     = shmobile_handle_irq_gic,
        .init_machine   = kota2_init,
        .timer          = &kota2_timer,
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index 61a846bb30f..1370a89ca35 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -113,6 +113,12 @@ static struct clk main_clk = {
        .ops            = &main_clk_ops,
 };
+/* Divide Main clock by two */
+static struct clk main_div2_clk = {
+        .ops            = &div2_clk_ops,
+        .parent         = &main_clk,
+};
 /* PLL0, PLL1, PLL2, PLL3 */
 static unsigned long pll_recalc(struct clk *clk)
 {
@@ -181,6 +187,7 @@ static struct clk *main_clks[] = {
        &extal1_div2_clk,
        &extal2_div2_clk,
        &main_clk,
+        &main_div2_clk,
        &pll0_clk,
        &pll1_clk,
        &pll2_clk,
@@ -243,7 +250,7 @@ static struct clk div6_clks[DIV6_NR] = {
        [DIV6_VCK1] = SH_CLK_DIV6(&pll1_div2_clk, VCLKCR1, 0),
        [DIV6_VCK2] = SH_CLK_DIV6(&pll1_div2_clk, VCLKCR2, 0),
        [DIV6_VCK3] = SH_CLK_DIV6(&pll1_div2_clk, VCLKCR3, 0),
-        [DIV6_ZB1] = SH_CLK_DIV6(&pll1_div2_clk, ZBCKCR, 0),
+        [DIV6_ZB1] = SH_CLK_DIV6(&pll1_div2_clk, ZBCKCR, CLK_ENABLE_ON_INIT),
        [DIV6_FLCTL] = SH_CLK_DIV6(&pll1_div2_clk, FLCKCR, 0),
        [DIV6_SDHI0] = SH_CLK_DIV6(&pll1_div2_clk, SD0CKCR, 0),
        [DIV6_SDHI1] = SH_CLK_DIV6(&pll1_div2_clk, SD1CKCR, 0),
@@ -268,6 +275,7 @@ enum { MSTP001,
        MSTP207, MSTP206, MSTP204, MSTP203, MSTP202, MSTP201, MSTP200,
        MSTP331, MSTP329, MSTP325, MSTP323, MSTP318,
        MSTP314, MSTP313, MSTP312, MSTP311,
+        MSTP303, MSTP302, MSTP301, MSTP300,
        MSTP411, MSTP410, MSTP403,
        MSTP_NR };
@@ -301,6 +309,10 @@ static struct clk mstp_clks[MSTP_NR] = {
        [MSTP313] = MSTP(&div6_clks[DIV6_SDHI1], SMSTPCR3, 13, 0), /* SDHI1 */
        [MSTP312] = MSTP(&div4_clks[DIV4_HP], SMSTPCR3, 12, 0), /* MMCIF0 */
        [MSTP311] = MSTP(&div6_clks[DIV6_SDHI2], SMSTPCR3, 11, 0), /* SDHI2 */
+        [MSTP303] = MSTP(&main_div2_clk, SMSTPCR3, 3, 0), /* TPU1 */
+        [MSTP302] = MSTP(&main_div2_clk, SMSTPCR3, 2, 0), /* TPU2 */
+        [MSTP301] = MSTP(&main_div2_clk, SMSTPCR3, 1, 0), /* TPU3 */
+        [MSTP300] = MSTP(&main_div2_clk, SMSTPCR3, 0, 0), /* TPU4 */
        [MSTP411] = MSTP(&div4_clks[DIV4_HP], SMSTPCR4, 11, 0), /* IIC3 */
        [MSTP410] = MSTP(&div4_clks[DIV4_HP], SMSTPCR4, 10, 0), /* IIC4 */
        [MSTP403] = MSTP(&r_clk, SMSTPCR4, 3, 0), /* KEYSC */
@@ -350,6 +362,10 @@ static struct clk_lookup lookups[] = {
        CLKDEV_DEV_ID("sh_mobile_sdhi.1", &mstp_clks[MSTP313]), /* SDHI1 */
        CLKDEV_DEV_ID("sh_mmcif.0", &mstp_clks[MSTP312]), /* MMCIF0 */
        CLKDEV_DEV_ID("sh_mobile_sdhi.2", &mstp_clks[MSTP311]), /* SDHI2 */
+        CLKDEV_DEV_ID("leds-renesas-tpu.12", &mstp_clks[MSTP303]), /* TPU1 */
+        CLKDEV_DEV_ID("leds-renesas-tpu.21", &mstp_clks[MSTP302]), /* TPU2 */
+        CLKDEV_DEV_ID("leds-renesas-tpu.30", &mstp_clks[MSTP301]), /* TPU3 */
+        CLKDEV_DEV_ID("leds-renesas-tpu.41", &mstp_clks[MSTP300]), /* TPU4 */
        CLKDEV_DEV_ID("i2c-sh_mobile.3", &mstp_clks[MSTP411]), /* I2C3 */
        CLKDEV_DEV_ID("i2c-sh_mobile.4", &mstp_clks[MSTP410]), /* I2C4 */
        CLKDEV_DEV_ID("sh_keysc.0", &mstp_clks[MSTP403]), /* KEYSC */
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 2c559ac3814..e70a73731ea 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -363,11 +363,13 @@ __v7_setup:
        orreq   r10, r10, #1 << 6               @ set bit #6
        mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
 #endif
-#ifdef CONFIG_ARM_ERRATA_751472
+#if defined(CONFIG_ARM_ERRATA_751472) && defined(CONFIG_SMP)
-        cmp     r6, #0x30                       @ present prior to r3p0
+        ALT_SMP(cmp r6, #0x30)                  @ present prior to r3p0
+        ALT_UP_B(1f)
        mrclt   p15, 0, r10, c15, c0, 1         @ read diagnostic register
        orrlt   r10, r10, #1 << 11              @ set bit #11
        mcrlt   p15, 0, r10, c15, c0, 1         @ write diagnostic register
+1:
 #endif
 3:      mov     r10, #0
diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
index c074e66ad22..4e0a371630b 100644
--- a/arch/arm/oprofile/common.c
+++ b/arch/arm/oprofile/common.c
@@ -116,7 +116,7 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
        return oprofile_perf_init(ops);
 }
-void __exit oprofile_arch_exit(void)
+void oprofile_arch_exit(void)
 {
        oprofile_perf_exit();
 }
diff --git a/arch/arm/plat-mxc/cpufreq.c b/arch/arm/plat-mxc/cpufreq.c
index adbff706ef6..73db34bf588 100644
--- a/arch/arm/plat-mxc/cpufreq.c
+++ b/arch/arm/plat-mxc/cpufreq.c
@@ -98,7 +98,7 @@ static int mxc_set_target(struct cpufreq_policy *policy,
        return ret;
 }
-static int __init mxc_cpufreq_init(struct cpufreq_policy *policy)
+static int mxc_cpufreq_init(struct cpufreq_policy *policy)
 {
        int ret;
        int i;
diff --git a/arch/arm/plat-mxc/include/mach/uncompress.h b/arch/arm/plat-mxc/include/mach/uncompress.h
index 88fd4045256..477971b0093 100644
--- a/arch/arm/plat-mxc/include/mach/uncompress.h
+++ b/arch/arm/plat-mxc/include/mach/uncompress.h
@@ -98,6 +98,7 @@ static __inline__ void __arch_decomp_setup(unsigned long arch_id)
        case MACH_TYPE_PCM043:
        case MACH_TYPE_LILLY1131:
        case MACH_TYPE_VPR200:
+        case MACH_TYPE_EUKREA_CPUIMX35SD:
                uart_base = MX3X_UART1_BASE_ADDR;
                break;
        case MACH_TYPE_MAGX_ZN5:
diff --git a/arch/arm/plat-mxc/pwm.c b/arch/arm/plat-mxc/pwm.c
index 845de59f07e..e032717f7d0 100644
--- a/arch/arm/plat-mxc/pwm.c
+++ b/arch/arm/plat-mxc/pwm.c
@@ -77,6 +77,15 @@ int pwm_config(struct pwm_device *pwm, int duty_ns, int period_ns)
                do_div(c, period_ns);
                duty_cycles = c;
+                /*
+                 * according to imx pwm RM, the real period value should be
+                 * PERIOD value in PWMPR plus 2.
+                 */
+                if (period_cycles > 2)
+                        period_cycles -= 2;
+                else
+                        period_cycles = 0;
                writel(duty_cycles, pwm->mmio_base + MX3_PWMSAR);
                writel(period_cycles, pwm->mmio_base + MX3_PWMPR);
diff --git a/arch/arm/plat-orion/gpio.c b/arch/arm/plat-orion/gpio.c
index 41ab97ebe4c..10d16088813 100644
--- a/arch/arm/plat-orion/gpio.c
+++ b/arch/arm/plat-orion/gpio.c
@@ -384,12 +384,16 @@ void __init orion_gpio_init(int gpio_base, int ngpio,
        struct orion_gpio_chip *ochip;
        struct irq_chip_generic *gc;
        struct irq_chip_type *ct;
+        char gc_label[16];
        if (orion_gpio_chip_count == ARRAY_SIZE(orion_gpio_chips))
                return;
+        snprintf(gc_label, sizeof(gc_label), "orion_gpio%d",
+                orion_gpio_chip_count);
        ochip = orion_gpio_chips + orion_gpio_chip_count;
-        ochip->chip.label = "orion_gpio";
+        ochip->chip.label = kstrdup(gc_label, GFP_KERNEL);
        ochip->chip.request = orion_gpio_request;
        ochip->chip.direction_input = orion_gpio_direction_input;
        ochip->chip.get = orion_gpio_get;
diff --git a/arch/arm/plat-samsung/include/plat/cpu-freq-core.h b/arch/arm/plat-samsung/include/plat/cpu-freq-core.h
index dac4760c0f0..95509d8eb14 100644
--- a/arch/arm/plat-samsung/include/plat/cpu-freq-core.h
+++ b/arch/arm/plat-samsung/include/plat/cpu-freq-core.h
@@ -202,14 +202,6 @@ extern int s3c_plltab_register(struct cpufreq_frequency_table *plls,
 extern struct s3c_cpufreq_config *s3c_cpufreq_getconfig(void);
 extern struct s3c_iotimings *s3c_cpufreq_getiotimings(void);
-extern void s3c2410_iotiming_debugfs(struct seq_file *seq,
-                                     struct s3c_cpufreq_config *cfg,
-                                     union s3c_iobank *iob);
-extern void s3c2412_iotiming_debugfs(struct seq_file *seq,
-                                     struct s3c_cpufreq_config *cfg,
-                                     union s3c_iobank *iob);
 #ifdef CONFIG_CPU_FREQ_S3C24XX_DEBUGFS
 #define s3c_cpufreq_debugfs_call(x) x
 #else
@@ -226,6 +218,10 @@ extern void s3c2410_cpufreq_setrefresh(struct s3c_cpufreq_config *cfg);
 extern void s3c2410_set_fvco(struct s3c_cpufreq_config *cfg);
 #ifdef CONFIG_S3C2410_IOTIMING
+extern void s3c2410_iotiming_debugfs(struct seq_file *seq,
+                                     struct s3c_cpufreq_config *cfg,
+                                     union s3c_iobank *iob);
 extern int s3c2410_iotiming_calc(struct s3c_cpufreq_config *cfg,
                                 struct s3c_iotimings *iot);
@@ -235,6 +231,7 @@ extern int s3c2410_iotiming_get(struct s3c_cpufreq_config *cfg,
 extern void s3c2410_iotiming_set(struct s3c_cpufreq_config *cfg,
                                 struct s3c_iotimings *iot);
 #else
+#define s3c2410_iotiming_debugfs NULL
 #define s3c2410_iotiming_calc NULL
 #define s3c2410_iotiming_get NULL
 #define s3c2410_iotiming_set NULL
@@ -242,8 +239,10 @@ extern void s3c2410_iotiming_set(struct s3c_cpufreq_config *cfg,
 /* S3C2412 compatible routines */
-extern int s3c2412_iotiming_get(struct s3c_cpufreq_config *cfg,
+#ifdef CONFIG_S3C2412_IOTIMING
-                                struct s3c_iotimings *timings);
+extern void s3c2412_iotiming_debugfs(struct seq_file *seq,
+                                     struct s3c_cpufreq_config *cfg,
+                                     union s3c_iobank *iob);
 extern int s3c2412_iotiming_get(struct s3c_cpufreq_config *cfg,
                                struct s3c_iotimings *timings);
@@ -253,6 +252,12 @@ extern int s3c2412_iotiming_calc(struct s3c_cpufreq_config *cfg,
 extern void s3c2412_iotiming_set(struct s3c_cpufreq_config *cfg,
                                 struct s3c_iotimings *iot);
+#else
+#define s3c2412_iotiming_debugfs NULL
+#define s3c2412_iotiming_calc NULL
+#define s3c2412_iotiming_get NULL
+#define s3c2412_iotiming_set NULL
+#endif /* CONFIG_S3C2412_IOTIMING */
 #ifdef CONFIG_CPU_FREQ_S3C24XX_DEBUG
 #define s3c_freq_dbg(x...) printk(KERN_INFO x)
diff --git a/arch/ia64/include/asm/cputime.h b/arch/ia64/include/asm/cputime.h
index 6073b187528..5a274af31b2 100644
--- a/arch/ia64/include/asm/cputime.h
+++ b/arch/ia64/include/asm/cputime.h
@@ -60,6 +60,7 @@ typedef u64 cputime64_t;
 */
 #define cputime_to_usecs(__ct)          ((__ct) / NSEC_PER_USEC)
 #define usecs_to_cputime(__usecs)       ((__usecs) * NSEC_PER_USEC)
+#define usecs_to_cputime64(__usecs)     usecs_to_cputime(__usecs)
 /*
 * Convert cputime <-> seconds
diff --git a/arch/powerpc/include/asm/cputime.h b/arch/powerpc/include/asm/cputime.h
index 1cf20bdfbec..98b7c4b49c9 100644
--- a/arch/powerpc/include/asm/cputime.h
+++ b/arch/powerpc/include/asm/cputime.h
@@ -150,6 +150,8 @@ static inline cputime_t usecs_to_cputime(const unsigned long us)
        return ct;
 }
+#define usecs_to_cputime64(us)          usecs_to_cputime(us)
 /*
 * Convert cputime <-> seconds
 */
diff --git a/arch/powerpc/include/asm/kvm_book3s.h b/arch/powerpc/include/asm/kvm_book3s.h
index d4df013ad77..69c7377d207 100644
--- a/arch/powerpc/include/asm/kvm_book3s.h
+++ b/arch/powerpc/include/asm/kvm_book3s.h
@@ -381,39 +381,6 @@ static inline bool kvmppc_critical_section(struct kvm_vcpu *vcpu)
 }
 #endif
-static inline unsigned long compute_tlbie_rb(unsigned long v, unsigned long r,
-                                             unsigned long pte_index)
-{
-        unsigned long rb, va_low;
-        rb = (v & ~0x7fUL) << 16;               /* AVA field */
-        va_low = pte_index >> 3;
-        if (v & HPTE_V_SECONDARY)
-                va_low = ~va_low;
-        /* xor vsid from AVA */
-        if (!(v & HPTE_V_1TB_SEG))
-                va_low ^= v >> 12;
-        else
-                va_low ^= v >> 24;
-        va_low &= 0x7ff;
-        if (v & HPTE_V_LARGE) {
-                rb |= 1;                        /* L field */
-                if (cpu_has_feature(CPU_FTR_ARCH_206) &&
-                    (r & 0xff000)) {
-                        /* non-16MB large page, must be 64k */
-                        /* (masks depend on page size) */
-                        rb |= 0x1000;           /* page encoding in LP field */
-                        rb |= (va_low & 0x7f) << 16; /* 7b of VA in AVA/LP field */
-                        rb |= (va_low & 0xfe);  /* AVAL field (P7 doesn't seem to care) */
-                }
-        } else {
-                /* 4kB page */
-                rb |= (va_low & 0x7ff) << 12;   /* remaining 11b of VA */
-        }
-        rb |= (v >> 54) & 0x300;                /* B field */
-        return rb;
-}
 /* Magic register values loaded into r3 and r4 before the 'sc' assembly
 * instruction for the OSI hypercalls */
 #define OSI_SC_MAGIC_R3                 0x113724FA
diff --git a/arch/powerpc/include/asm/kvm_book3s_64.h b/arch/powerpc/include/asm/kvm_book3s_64.h
index e43fe42b987..d0ac94f98f9 100644
--- a/arch/powerpc/include/asm/kvm_book3s_64.h
+++ b/arch/powerpc/include/asm/kvm_book3s_64.h
@@ -29,4 +29,37 @@ static inline struct kvmppc_book3s_shadow_vcpu *to_svcpu(struct kvm_vcpu *vcpu)
 #define SPAPR_TCE_SHIFT         12
+static inline unsigned long compute_tlbie_rb(unsigned long v, unsigned long r,
+                                             unsigned long pte_index)
+{
+        unsigned long rb, va_low;
+        rb = (v & ~0x7fUL) << 16;               /* AVA field */
+        va_low = pte_index >> 3;
+        if (v & HPTE_V_SECONDARY)
+                va_low = ~va_low;
+        /* xor vsid from AVA */
+        if (!(v & HPTE_V_1TB_SEG))
+                va_low ^= v >> 12;
+        else
+                va_low ^= v >> 24;
+        va_low &= 0x7ff;
+        if (v & HPTE_V_LARGE) {
+                rb |= 1;                        /* L field */
+                if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                    (r & 0xff000)) {
+                        /* non-16MB large page, must be 64k */
+                        /* (masks depend on page size) */
+                        rb |= 0x1000;           /* page encoding in LP field */
+                        rb |= (va_low & 0x7f) << 16; /* 7b of VA in AVA/LP field */
+                        rb |= (va_low & 0xfe);  /* AVAL field (P7 doesn't seem to care) */
+                }
+        } else {
+                /* 4kB page */
+                rb |= (va_low & 0x7ff) << 12;   /* remaining 11b of VA */
+        }
+        rb |= (v >> 54) & 0x300;                /* B field */
+        return rb;
+}
 #endif /* __ASM_KVM_BOOK3S_64_H__ */
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 0cb137a9b03..336983da9e7 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -538,7 +538,7 @@ static void kvmppc_start_thread(struct kvm_vcpu *vcpu)
        tpaca->kvm_hstate.napping = 0;
        vcpu->cpu = vc->pcpu;
        smp_wmb();
-#ifdef CONFIG_PPC_ICP_NATIVE
+#if defined(CONFIG_PPC_ICP_NATIVE) && defined(CONFIG_SMP)
        if (vcpu->arch.ptid) {
                tpaca->cpu_start = 0x80;
                wmb();
diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
index 3c791e1eb67..e2cfb9e1e20 100644
--- a/arch/powerpc/kvm/book3s_pr.c
+++ b/arch/powerpc/kvm/book3s_pr.c
@@ -658,10 +658,12 @@ program_interrupt:
                        ulong cmd = kvmppc_get_gpr(vcpu, 3);
                        int i;
+#ifdef CONFIG_KVM_BOOK3S_64_PR
                        if (kvmppc_h_pr(vcpu, cmd) == EMULATE_DONE) {
                                r = RESUME_GUEST;
                                break;
                        }
+#endif
                        run->papr_hcall.nr = cmd;
                        for (i = 0; i < 9; ++i) {
diff --git a/arch/powerpc/kvm/e500.c b/arch/powerpc/kvm/e500.c
index 26d20903f2b..8c0d45a6faf 100644
--- a/arch/powerpc/kvm/e500.c
+++ b/arch/powerpc/kvm/e500.c
@@ -15,6 +15,7 @@
 #include <linux/kvm_host.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/export.h>
 #include <asm/reg.h>
 #include <asm/cputable.h>
diff --git a/arch/s390/include/asm/cputime.h b/arch/s390/include/asm/cputime.h
index 08143487829..b9acaaa175d 100644
--- a/arch/s390/include/asm/cputime.h
+++ b/arch/s390/include/asm/cputime.h
@@ -87,6 +87,8 @@ usecs_to_cputime(const unsigned int m)
        return (cputime_t) m * 4096;
 }
+#define usecs_to_cputime64(m)           usecs_to_cputime(m)
 /*
 * Convert cputime to milliseconds and back.
 */
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index 6cf2286d040..2297be406c6 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -123,7 +123,7 @@ static ssize_t hwsampler_write(struct file *file, char const __user *buf,
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        if (val != 0 && val != 1)
diff --git a/arch/sh/boards/board-sh7757lcr.c b/arch/sh/boards/board-sh7757lcr.c
index ec8c84c14b1..895e337c79b 100644
--- a/arch/sh/boards/board-sh7757lcr.c
+++ b/arch/sh/boards/board-sh7757lcr.c
@@ -50,9 +50,9 @@ static struct platform_device heartbeat_device = {
 #define GBECONT         0xffc10100
 #define GBECONT_RMII1   BIT(17)
 #define GBECONT_RMII0   BIT(16)
-static void sh7757_eth_set_mdio_gate(unsigned long addr)
+static void sh7757_eth_set_mdio_gate(void *addr)
 {
-        if ((addr & 0x00000fff) < 0x0800)
+        if (((unsigned long)addr & 0x00000fff) < 0x0800)
                writel(readl(GBECONT) | GBECONT_RMII0, GBECONT);
        else
                writel(readl(GBECONT) | GBECONT_RMII1, GBECONT);
@@ -116,9 +116,9 @@ static struct platform_device sh7757_eth1_device = {
        },
 };
-static void sh7757_eth_giga_set_mdio_gate(unsigned long addr)
+static void sh7757_eth_giga_set_mdio_gate(void *addr)
 {
-        if ((addr & 0x00000fff) < 0x0800) {
+        if (((unsigned long)addr & 0x00000fff) < 0x0800) {
                gpio_set_value(GPIO_PTT4, 1);
                writel(readl(GBECONT) & ~GBECONT_RMII0, GBECONT);
        } else {
@@ -210,8 +210,12 @@ static struct resource sh_mmcif_resources[] = {
 };
 static struct sh_mmcif_dma sh7757lcr_mmcif_dma = {
-        .chan_priv_tx   = SHDMA_SLAVE_MMCIF_TX,
+        .chan_priv_tx   = {
-        .chan_priv_rx   = SHDMA_SLAVE_MMCIF_RX,
+                .slave_id = SHDMA_SLAVE_MMCIF_TX,
+        },
+        .chan_priv_rx   = {
+                .slave_id = SHDMA_SLAVE_MMCIF_RX,
+        }
 };
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
diff --git a/arch/sh/oprofile/common.c b/arch/sh/oprofile/common.c
index b4c2d2b946d..e4dd5d5a111 100644
--- a/arch/sh/oprofile/common.c
+++ b/arch/sh/oprofile/common.c
@@ -49,7 +49,7 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
        return oprofile_perf_init(ops);
 }
-void __exit oprofile_arch_exit(void)
+void oprofile_arch_exit(void)
 {
        oprofile_perf_exit();
        kfree(sh_pmu_op_name);
@@ -60,5 +60,5 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
        ops->backtrace = sh_backtrace;
        return -ENODEV;
 }
-void __exit oprofile_arch_exit(void) {}
+void oprofile_arch_exit(void) {}
 #endif /* CONFIG_HW_PERF_EVENTS */
diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
index b272cda35a0..af5755d20fb 100644
--- a/arch/sparc/kernel/pci_sun4v.c
+++ b/arch/sparc/kernel/pci_sun4v.c
@@ -849,10 +849,10 @@ static int pci_sun4v_msiq_build_irq(struct pci_pbm_info *pbm,
        if (!irq)
                return -ENOMEM;
-        if (pci_sun4v_msiq_setstate(pbm->devhandle, msiqid, HV_MSIQSTATE_IDLE))
-                return -EINVAL;
        if (pci_sun4v_msiq_setvalid(pbm->devhandle, msiqid, HV_MSIQ_VALID))
                return -EINVAL;
+        if (pci_sun4v_msiq_setstate(pbm->devhandle, msiqid, HV_MSIQSTATE_IDLE))
+                return -EINVAL;
        return irq;
 }
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index cbfaaa2475e..3bd37bdf1b8 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1165,7 +1165,7 @@ again:
                 */
                c = &unconstrained;
        } else if (intel_try_alt_er(event, orig_idx)) {
-                raw_spin_unlock(&era->lock);
+                raw_spin_unlock_irqrestore(&era->lock, flags);
                goto again;
        }
        raw_spin_unlock_irqrestore(&era->lock, flags);
diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
index 3b97a80ce32..c99f9ed013d 100644
--- a/arch/x86/kernel/dumpstack_32.c
+++ b/arch/x86/kernel/dumpstack_32.c
@@ -116,16 +116,16 @@ void show_registers(struct pt_regs *regs)
                for (i = 0; i < code_len; i++, ip++) {
                        if (ip < (u8 *)PAGE_OFFSET ||
                                        probe_kernel_address(ip, c)) {
-                                printk(" Bad EIP value.");
+                                printk(KERN_CONT " Bad EIP value.");
                                break;
                        }
                        if (ip == (u8 *)regs->ip)
-                                printk("<%02x> ", c);
+                                printk(KERN_CONT "<%02x> ", c);
                        else
-                                printk("%02x ", c);
+                                printk(KERN_CONT "%02x ", c);
                }
        }
-        printk("\n");
+        printk(KERN_CONT "\n");
 }
 int is_valid_bugaddr(unsigned long ip)
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 19853ad8afc..6d728d9284b 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -284,16 +284,16 @@ void show_registers(struct pt_regs *regs)
                for (i = 0; i < code_len; i++, ip++) {
                        if (ip < (u8 *)PAGE_OFFSET ||
                                        probe_kernel_address(ip, c)) {
-                                printk(" Bad RIP value.");
+                                printk(KERN_CONT " Bad RIP value.");
                                break;
                        }
                        if (ip == (u8 *)regs->ip)
-                                printk("<%02x> ", c);
+                                printk(KERN_CONT "<%02x> ", c);
                        else
-                                printk("%02x ", c);
+                                printk(KERN_CONT "%02x ", c);
                }
        }
-        printk("\n");
+        printk(KERN_CONT "\n");
 }
 int is_valid_bugaddr(unsigned long ip)
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 76e3f1cd036..405f2620392 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -338,11 +338,15 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data)
                return HRTIMER_NORESTART;
 }
-static void create_pit_timer(struct kvm_kpit_state *ps, u32 val, int is_period)
+static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
 {
+        struct kvm_kpit_state *ps = &kvm->arch.vpit->pit_state;
        struct kvm_timer *pt = &ps->pit_timer;
        s64 interval;
+        if (!irqchip_in_kernel(kvm))
+                return;
        interval = muldiv64(val, NSEC_PER_SEC, KVM_PIT_FREQ);
        pr_debug("create pit timer, interval is %llu nsec\n", interval);
@@ -394,13 +398,13 @@ static void pit_load_count(struct kvm *kvm, int channel, u32 val)
        /* FIXME: enhance mode 4 precision */
        case 4:
                if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)) {
-                        create_pit_timer(ps, val, 0);
+                        create_pit_timer(kvm, val, 0);
                }
                break;
        case 2:
        case 3:
                if (!(ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)){
-                        create_pit_timer(ps, val, 1);
+                        create_pit_timer(kvm, val, 1);
                }
                break;
        default:
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index c38efd7b792..4c938da2ba0 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -602,7 +602,6 @@ static void update_cpuid(struct kvm_vcpu *vcpu)
 {
        struct kvm_cpuid_entry2 *best;
        struct kvm_lapic *apic = vcpu->arch.apic;
-        u32 timer_mode_mask;
        best = kvm_find_cpuid_entry(vcpu, 1, 0);
        if (!best)
@@ -615,15 +614,12 @@ static void update_cpuid(struct kvm_vcpu *vcpu)
                        best->ecx |= bit(X86_FEATURE_OSXSAVE);
        }
-        if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+        if (apic) {
-                best->function == 0x1) {
+                if (best->ecx & bit(X86_FEATURE_TSC_DEADLINE_TIMER))
-                best->ecx |= bit(X86_FEATURE_TSC_DEADLINE_TIMER);
+                        apic->lapic_timer.timer_mode_mask = 3 << 17;
-                timer_mode_mask = 3 << 17;
+                else
-        } else
+                        apic->lapic_timer.timer_mode_mask = 1 << 17;
-                timer_mode_mask = 1 << 17;
+        }
-        if (apic)
-                apic->lapic_timer.timer_mode_mask = timer_mode_mask;
 }
 int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
@@ -2135,6 +2131,9 @@ int kvm_dev_ioctl_check_extension(long ext)
        case KVM_CAP_TSC_CONTROL:
                r = kvm_has_tsc_control;
                break;
+        case KVM_CAP_TSC_DEADLINE_TIMER:
+                r = boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER);
+                break;
        default:
                r = 0;
                break;
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index bfab3fa10ed..7b65f752c5f 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -568,8 +568,8 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
                                        break;
                                }
                                if (filter[i].jt != 0) {
-                                        if (filter[i].jf)
+                                        if (filter[i].jf && f_offset)
-                                                t_offset += is_near(f_offset) ? 2 : 6;
+                                                t_offset += is_near(f_offset) ? 2 : 5;
                                        EMIT_COND_JMP(t_op, t_offset);
                                        if (filter[i].jf)
                                                EMIT_JMP(f_offset);
diff --git a/block/blk-map.c b/block/blk-map.c
index 164cd005970..623e1cd4cff 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -311,7 +311,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
        if (IS_ERR(bio))
                return PTR_ERR(bio);
-        if (rq_data_dir(rq) == WRITE)
+        if (!reading)
                bio->bi_rw |= REQ_WRITE;
        if (do_copy)
diff --git a/block/blk-tag.c b/block/blk-tag.c
index e74d6d13838..4af6f5cc116 100644
--- a/block/blk-tag.c
+++ b/block/blk-tag.c
@@ -282,18 +282,9 @@ EXPORT_SYMBOL(blk_queue_resize_tags);
 void blk_queue_end_tag(struct request_queue *q, struct request *rq)
 {
        struct blk_queue_tag *bqt = q->queue_tags;
-        int tag = rq->tag;
+        unsigned tag = rq->tag; /* negative tags invalid */
-        BUG_ON(tag == -1);
+        BUG_ON(tag >= bqt->real_max_depth);
-        if (unlikely(tag >= bqt->max_depth)) {
-                /*
-                 * This can happen after tag depth has been reduced.
-                 * But tag shouldn't be larger than real_max_depth.
-                 */
-                WARN_ON(tag >= bqt->real_max_depth);
-                return;
-        }
        list_del_init(&rq->queuelist);
        rq->cmd_flags &= ~REQ_QUEUED;
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 4c12869fcf7..3548705b04e 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1655,6 +1655,8 @@ cfq_merged_requests(struct request_queue *q, struct request *rq,
                    struct request *next)
 {
        struct cfq_queue *cfqq = RQ_CFQQ(rq);
+        struct cfq_data *cfqd = q->elevator->elevator_data;
        /*
         * reposition in fifo if next is older than rq
         */
@@ -1669,6 +1671,16 @@ cfq_merged_requests(struct request_queue *q, struct request *rq,
        cfq_remove_request(next);
        cfq_blkiocg_update_io_merged_stats(&(RQ_CFQG(rq))->blkg,
                                        rq_data_dir(next), rq_is_sync(next));
+        cfqq = RQ_CFQQ(next);
+        /*
+         * all requests of this queue are merged to other queues, delete it
+         * from the service tree. If it's the active_queue,
+         * cfq_dispatch_requests() will choose to expire it or do idle
+         */
+        if (cfq_cfqq_on_rr(cfqq) && RB_EMPTY_ROOT(&cfqq->sort_list) &&
+            cfqq != cfqd->active_queue)
+                cfq_del_cfqq_rr(cfqd, cfqq);
 }
 static int cfq_allow_merge(struct request_queue *q, struct request *rq,
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 6bdedd7cca2..cf047c406d9 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -820,7 +820,7 @@ config PATA_PLATFORM
 config PATA_OF_PLATFORM
        tristate "OpenFirmware platform device PATA support"
-        depends on PATA_PLATFORM && OF
+        depends on PATA_PLATFORM && OF && OF_IRQ
        help
          This option enables support for generic directly connected ATA
          devices commonly found on embedded systems with OpenFirmware
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index c2917ffad2c..34767a6d7f4 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -139,6 +139,8 @@
 #define IPMI_WDOG_SET_TIMER             0x24
 #define IPMI_WDOG_GET_TIMER             0x25
+#define IPMI_WDOG_TIMER_NOT_INIT_RESP   0x80
 /* These are here until the real ones get into the watchdog.h interface. */
 #ifndef WDIOC_GETTIMEOUT
 #define WDIOC_GETTIMEOUT        _IOW(WATCHDOG_IOCTL_BASE, 20, int)
@@ -596,6 +598,7 @@ static int ipmi_heartbeat(void)
        struct kernel_ipmi_msg            msg;
        int                               rv;
        struct ipmi_system_interface_addr addr;
+        int                               timeout_retries = 0;
        if (ipmi_ignore_heartbeat)
                return 0;
@@ -616,6 +619,7 @@ static int ipmi_heartbeat(void)
        mutex_lock(&heartbeat_lock);
+restart:
        atomic_set(&heartbeat_tofree, 2);
        /*
@@ -653,7 +657,33 @@ static int ipmi_heartbeat(void)
        /* Wait for the heartbeat to be sent. */
        wait_for_completion(&heartbeat_wait);
-        if (heartbeat_recv_msg.msg.data[0] != 0) {
+        if (heartbeat_recv_msg.msg.data[0] == IPMI_WDOG_TIMER_NOT_INIT_RESP)  {
+                timeout_retries++;
+                if (timeout_retries > 3) {
+                        printk(KERN_ERR PFX ": Unable to restore the IPMI"
+                               " watchdog's settings, giving up.\n");
+                        rv = -EIO;
+                        goto out_unlock;
+                }
+                /*
+                 * The timer was not initialized, that means the BMC was
+                 * probably reset and lost the watchdog information.  Attempt
+                 * to restore the timer's info.  Note that we still hold
+                 * the heartbeat lock, to keep a heartbeat from happening
+                 * in this process, so must say no heartbeat to avoid a
+                 * deadlock on this mutex.
+                 */
+                rv = ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
+                if (rv) {
+                        printk(KERN_ERR PFX ": Unable to send the command to"
+                               " set the watchdog's settings, giving up.\n");
+                        goto out_unlock;
+                }
+                /* We might need a new heartbeat, so do it now */
+                goto restart;
+        } else if (heartbeat_recv_msg.msg.data[0] != 0) {
                /*
                 * Got an error in the heartbeat response.  It was already
                 * reported in ipmi_wdog_msg_handler, but we should return
@@ -662,6 +692,7 @@ static int ipmi_heartbeat(void)
                rv = -EINVAL;
        }
+out_unlock:
        mutex_unlock(&heartbeat_lock);
        return rv;
@@ -922,11 +953,15 @@ static struct miscdevice ipmi_wdog_miscdev = {
 static void ipmi_wdog_msg_handler(struct ipmi_recv_msg *msg,
                                  void                 *handler_data)
 {
-        if (msg->msg.data[0] != 0) {
+        if (msg->msg.cmd == IPMI_WDOG_RESET_TIMER &&
+                        msg->msg.data[0] == IPMI_WDOG_TIMER_NOT_INIT_RESP)
+                printk(KERN_INFO PFX "response: The IPMI controller appears"
+                       " to have been reset, will attempt to reinitialize"
+                       " the watchdog timer\n");
+        else if (msg->msg.data[0] != 0)
                printk(KERN_ERR PFX "response: Error %x on cmd %x\n",
                       msg->msg.data[0],
                       msg->msg.cmd);
-        }
        ipmi_free_recv_msg(msg);
 }
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index ab8f469f5cf..5a99bb3f255 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -124,7 +124,7 @@ config MV_XOR
 config MX3_IPU
        bool "MX3x Image Processing Unit support"
-        depends on ARCH_MX3
+        depends on SOC_IMX31 || SOC_IMX35
        select DMA_ENGINE
        default y
        help
@@ -216,7 +216,7 @@ config PCH_DMA
 config IMX_SDMA
        tristate "i.MX SDMA support"
-        depends on ARCH_MX25 || ARCH_MX3 || ARCH_MX5
+        depends on ARCH_MX25 || SOC_IMX31 || SOC_IMX35 || ARCH_MX5
        select DMA_ENGINE
        help
          Support the i.MX SDMA engine. This engine is integrated into
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index c681dc149d2..b9da8900ae4 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -756,9 +756,9 @@ intel_enable_semaphores(struct drm_device *dev)
        if (i915_semaphores >= 0)
                return i915_semaphores;
-        /* Enable semaphores on SNB when IO remapping is off */
+        /* Disable semaphores on SNB */
        if (INTEL_INFO(dev)->gen == 6)
-                return !intel_iommu_enabled;
+                return 0;
        return 1;
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index d809b038ca8..daa5743ccbd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7922,13 +7922,11 @@ static bool intel_enable_rc6(struct drm_device *dev)
                return 0;
        /*
-         * Enable rc6 on Sandybridge if DMA remapping is disabled
+         * Disable rc6 on Sandybridge
         */
        if (INTEL_INFO(dev)->gen == 6) {
-                DRM_DEBUG_DRIVER("Sandybridge: intel_iommu_enabled %s -- RC6 %sabled\n",
+                DRM_DEBUG_DRIVER("Sandybridge: RC6 disabled\n");
-                                 intel_iommu_enabled ? "true" : "false",
+                return 0;
-                                 !intel_iommu_enabled ? "en" : "dis");
-                return !intel_iommu_enabled;
        }
        DRM_DEBUG_DRIVER("RC6 enabled\n");
        return 1;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 5e00d1670aa..92c9628c572 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3276,6 +3276,18 @@ int evergreen_init(struct radeon_device *rdev)
                        rdev->accel_working = false;
                }
        }
+        /* Don't start up if the MC ucode is missing on BTC parts.
+         * The default clocks and voltages before the MC ucode
+         * is loaded are not suffient for advanced operations.
+         */
+        if (ASIC_IS_DCE5(rdev)) {
+                if (!rdev->mc_fw && !(rdev->flags & RADEON_IS_IGP)) {
+                        DRM_ERROR("radeon: MC ucode required for NI+.\n");
+                        return -EINVAL;
+                }
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index d24baf30efc..5082d17d14d 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2560,7 +2560,11 @@ void radeon_atombios_get_power_modes(struct radeon_device *rdev)
        rdev->pm.current_power_state_index = rdev->pm.default_power_state_index;
        rdev->pm.current_clock_mode_index = 0;
-        rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
+        if (rdev->pm.default_power_state_index >= 0)
+                rdev->pm.current_vddc =
+                        rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
+        else
+                rdev->pm.current_vddc = 0;
 }
 void radeon_atom_set_clock_gating(struct radeon_device *rdev, int enable)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 8cca91a93bd..dc279706ca7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -390,6 +390,11 @@ extern int vmw_context_check(struct vmw_private *dev_priv,
                             struct ttm_object_file *tfile,
                             int id,
                             struct vmw_resource **p_res);
+extern int vmw_user_lookup_handle(struct vmw_private *dev_priv,
+                                  struct ttm_object_file *tfile,
+                                  uint32_t handle,
+                                  struct vmw_surface **out_surf,
+                                  struct vmw_dma_buffer **out_buf);
 extern void vmw_surface_res_free(struct vmw_resource *res);
 extern int vmw_surface_init(struct vmw_private *dev_priv,
                            struct vmw_surface *srf,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index 03bbc2a6f9a..a0c2f12b1e1 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -33,6 +33,7 @@ bool vmw_fifo_have_3d(struct vmw_private *dev_priv)
 {
        __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
        uint32_t fifo_min, hwversion;
+        const struct vmw_fifo_state *fifo = &dev_priv->fifo;
        if (!(dev_priv->capabilities & SVGA_CAP_EXTENDED_FIFO))
                return false;
@@ -41,7 +42,12 @@ bool vmw_fifo_have_3d(struct vmw_private *dev_priv)
        if (fifo_min <= SVGA_FIFO_3D_HWVERSION * sizeof(unsigned int))
                return false;
-        hwversion = ioread32(fifo_mem + SVGA_FIFO_3D_HWVERSION);
+        hwversion = ioread32(fifo_mem +
+                             ((fifo->capabilities &
+                               SVGA_FIFO_CAP_3D_HWVERSION_REVISED) ?
+                              SVGA_FIFO_3D_HWVERSION_REVISED :
+                              SVGA_FIFO_3D_HWVERSION));
        if (hwversion == 0)
                return false;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 5ff561d4e0b..66917c6c381 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -58,8 +58,14 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
        case DRM_VMW_PARAM_FIFO_HW_VERSION:
        {
                __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+                const struct vmw_fifo_state *fifo = &dev_priv->fifo;
-                param->value = ioread32(fifo_mem + SVGA_FIFO_3D_HWVERSION);
+                param->value =
+                        ioread32(fifo_mem +
+                                 ((fifo->capabilities &
+                                   SVGA_FIFO_CAP_3D_HWVERSION_REVISED) ?
+                                  SVGA_FIFO_3D_HWVERSION_REVISED :
+                                  SVGA_FIFO_3D_HWVERSION));
                break;
        }
        default:
@@ -166,13 +172,7 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
                ret = -EINVAL;
                goto out_no_fb;
        }
        vfb = vmw_framebuffer_to_vfb(obj_to_fb(obj));
-        if (!vfb->dmabuf) {
-                DRM_ERROR("Framebuffer not dmabuf backed.\n");
-                ret = -EINVAL;
-                goto out_no_fb;
-        }
        ret = ttm_read_lock(&vmaster->lock, true);
        if (unlikely(ret != 0))
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 37d40545ed7..f94b33ae221 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -31,6 +31,44 @@
 /* Might need a hrtimer here? */
 #define VMWGFX_PRESENT_RATE ((HZ / 60 > 0) ? HZ / 60 : 1)
+struct vmw_clip_rect {
+        int x1, x2, y1, y2;
+};
+/**
+ * Clip @num_rects number of @rects against @clip storing the
+ * results in @out_rects and the number of passed rects in @out_num.
+ */
+void vmw_clip_cliprects(struct drm_clip_rect *rects,
+                        int num_rects,
+                        struct vmw_clip_rect clip,
+                        SVGASignedRect *out_rects,
+                        int *out_num)
+{
+        int i, k;
+        for (i = 0, k = 0; i < num_rects; i++) {
+                int x1 = max_t(int, clip.x1, rects[i].x1);
+                int y1 = max_t(int, clip.y1, rects[i].y1);
+                int x2 = min_t(int, clip.x2, rects[i].x2);
+                int y2 = min_t(int, clip.y2, rects[i].y2);
+                if (x1 >= x2)
+                        continue;
+                if (y1 >= y2)
+                        continue;
+                out_rects[k].left   = x1;
+                out_rects[k].top    = y1;
+                out_rects[k].right  = x2;
+                out_rects[k].bottom = y2;
+                k++;
+        }
+        *out_num = k;
+}
 void vmw_display_unit_cleanup(struct vmw_display_unit *du)
 {
        if (du->cursor_surface)
@@ -82,6 +120,43 @@ int vmw_cursor_update_image(struct vmw_private *dev_priv,
        return 0;
 }
+int vmw_cursor_update_dmabuf(struct vmw_private *dev_priv,
+                             struct vmw_dma_buffer *dmabuf,
+                             u32 width, u32 height,
+                             u32 hotspotX, u32 hotspotY)
+{
+        struct ttm_bo_kmap_obj map;
+        unsigned long kmap_offset;
+        unsigned long kmap_num;
+        void *virtual;
+        bool dummy;
+        int ret;
+        kmap_offset = 0;
+        kmap_num = (width*height*4 + PAGE_SIZE - 1) >> PAGE_SHIFT;
+        ret = ttm_bo_reserve(&dmabuf->base, true, false, false, 0);
+        if (unlikely(ret != 0)) {
+                DRM_ERROR("reserve failed\n");
+                return -EINVAL;
+        }
+        ret = ttm_bo_kmap(&dmabuf->base, kmap_offset, kmap_num, &map);
+        if (unlikely(ret != 0))
+                goto err_unreserve;
+        virtual = ttm_kmap_obj_virtual(&map, &dummy);
+        ret = vmw_cursor_update_image(dev_priv, virtual, width, height,
+                                      hotspotX, hotspotY);
+        ttm_bo_kunmap(&map);
+err_unreserve:
+        ttm_bo_unreserve(&dmabuf->base);
+        return ret;
+}
 void vmw_cursor_update_position(struct vmw_private *dev_priv,
                                bool show, int x, int y)
 {
@@ -110,24 +185,21 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
                return -EINVAL;
        if (handle) {
-                ret = vmw_user_surface_lookup_handle(dev_priv, tfile,
+                ret = vmw_user_lookup_handle(dev_priv, tfile,
-                                                     handle, &surface);
+                                             handle, &surface, &dmabuf);
-                if (!ret) {
+                if (ret) {
-                        if (!surface->snooper.image) {
+                        DRM_ERROR("failed to find surface or dmabuf: %i\n", ret);
-                                DRM_ERROR("surface not suitable for cursor\n");
+                        return -EINVAL;
-                                vmw_surface_unreference(&surface);
-                                return -EINVAL;
-                        }
-                } else {
-                        ret = vmw_user_dmabuf_lookup(tfile,
-                                                     handle, &dmabuf);
-                        if (ret) {
-                                DRM_ERROR("failed to find surface or dmabuf: %i\n", ret);
-                                return -EINVAL;
-                        }
                }
        }
+        /* need to do this before taking down old image */
+        if (surface && !surface->snooper.image) {
+                DRM_ERROR("surface not suitable for cursor\n");
+                vmw_surface_unreference(&surface);
+                return -EINVAL;
+        }
        /* takedown old cursor */
        if (du->cursor_surface) {
                du->cursor_surface->snooper.crtc = NULL;
@@ -146,36 +218,11 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
                vmw_cursor_update_image(dev_priv, surface->snooper.image,
                                        64, 64, du->hotspot_x, du->hotspot_y);
        } else if (dmabuf) {
-                struct ttm_bo_kmap_obj map;
-                unsigned long kmap_offset;
-                unsigned long kmap_num;
-                void *virtual;
-                bool dummy;
                /* vmw_user_surface_lookup takes one reference */
                du->cursor_dmabuf = dmabuf;
-                kmap_offset = 0;
+                ret = vmw_cursor_update_dmabuf(dev_priv, dmabuf, width, height,
-                kmap_num = (64*64*4) >> PAGE_SHIFT;
+                                               du->hotspot_x, du->hotspot_y);
-                ret = ttm_bo_reserve(&dmabuf->base, true, false, false, 0);
-                if (unlikely(ret != 0)) {
-                        DRM_ERROR("reserve failed\n");
-                        return -EINVAL;
-                }
-                ret = ttm_bo_kmap(&dmabuf->base, kmap_offset, kmap_num, &map);
-                if (unlikely(ret != 0))
-                        goto err_unreserve;
-                virtual = ttm_kmap_obj_virtual(&map, &dummy);
-                vmw_cursor_update_image(dev_priv, virtual, 64, 64,
-                                        du->hotspot_x, du->hotspot_y);
-                ttm_bo_kunmap(&map);
-err_unreserve:
-                ttm_bo_unreserve(&dmabuf->base);
        } else {
                vmw_cursor_update_position(dev_priv, false, 0, 0);
                return 0;
@@ -377,8 +424,9 @@ static int do_surface_dirty_sou(struct vmw_private *dev_priv,
                                struct drm_clip_rect *clips,
                                unsigned num_clips, int inc)
 {
-        struct drm_clip_rect *clips_ptr;
        struct vmw_display_unit *units[VMWGFX_NUM_DISPLAY_UNITS];
+        struct drm_clip_rect *clips_ptr;
+        struct drm_clip_rect *tmp;
        struct drm_crtc *crtc;
        size_t fifo_size;
        int i, num_units;
@@ -391,7 +439,6 @@ static int do_surface_dirty_sou(struct vmw_private *dev_priv,
        } *cmd;
        SVGASignedRect *blits;
        num_units = 0;
        list_for_each_entry(crtc, &dev_priv->dev->mode_config.crtc_list,
                            head) {
@@ -402,13 +449,24 @@ static int do_surface_dirty_sou(struct vmw_private *dev_priv,
        BUG_ON(!clips || !num_clips);
+        tmp = kzalloc(sizeof(*tmp) * num_clips, GFP_KERNEL);
+        if (unlikely(tmp == NULL)) {
+                DRM_ERROR("Temporary cliprect memory alloc failed.\n");
+                return -ENOMEM;
+        }
        fifo_size = sizeof(*cmd) + sizeof(SVGASignedRect) * num_clips;
        cmd = kzalloc(fifo_size, GFP_KERNEL);
        if (unlikely(cmd == NULL)) {
                DRM_ERROR("Temporary fifo memory alloc failed.\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out_free_tmp;
        }
+        /* setup blits pointer */
+        blits = (SVGASignedRect *)&cmd[1];
+        /* initial clip region */
        left = clips->x1;
        right = clips->x2;
        top = clips->y1;
@@ -434,45 +492,60 @@ static int do_surface_dirty_sou(struct vmw_private *dev_priv,
        cmd->body.srcRect.bottom = bottom;
        clips_ptr = clips;
-        blits = (SVGASignedRect *)&cmd[1];
        for (i = 0; i < num_clips; i++, clips_ptr += inc) {
-                blits[i].left   = clips_ptr->x1 - left;
+                tmp[i].x1 = clips_ptr->x1 - left;
-                blits[i].right  = clips_ptr->x2 - left;
+                tmp[i].x2 = clips_ptr->x2 - left;
-                blits[i].top    = clips_ptr->y1 - top;
+                tmp[i].y1 = clips_ptr->y1 - top;
-                blits[i].bottom = clips_ptr->y2 - top;
+                tmp[i].y2 = clips_ptr->y2 - top;
        }
        /* do per unit writing, reuse fifo for each */
        for (i = 0; i < num_units; i++) {
                struct vmw_display_unit *unit = units[i];
-                int clip_x1 = left - unit->crtc.x;
+                struct vmw_clip_rect clip;
-                int clip_y1 = top - unit->crtc.y;
+                int num;
-                int clip_x2 = right - unit->crtc.x;
-                int clip_y2 = bottom - unit->crtc.y;
+                clip.x1 = left - unit->crtc.x;
+                clip.y1 = top - unit->crtc.y;
+                clip.x2 = right - unit->crtc.x;
+                clip.y2 = bottom - unit->crtc.y;
                /* skip any crtcs that misses the clip region */
-                if (clip_x1 >= unit->crtc.mode.hdisplay ||
+                if (clip.x1 >= unit->crtc.mode.hdisplay ||
-                    clip_y1 >= unit->crtc.mode.vdisplay ||
+                    clip.y1 >= unit->crtc.mode.vdisplay ||
-                    clip_x2 <= 0 || clip_y2 <= 0)
+                    clip.x2 <= 0 || clip.y2 <= 0)
                        continue;
+                /*
+                 * In order for the clip rects to be correctly scaled
+                 * the src and dest rects needs to be the same size.
+                 */
+                cmd->body.destRect.left = clip.x1;
+                cmd->body.destRect.right = clip.x2;
+                cmd->body.destRect.top = clip.y1;
+                cmd->body.destRect.bottom = clip.y2;
+                /* create a clip rect of the crtc in dest coords */
+                clip.x2 = unit->crtc.mode.hdisplay - clip.x1;
+                clip.y2 = unit->crtc.mode.vdisplay - clip.y1;
+                clip.x1 = 0 - clip.x1;
+                clip.y1 = 0 - clip.y1;
                /* need to reset sid as it is changed by execbuf */
                cmd->body.srcImage.sid = cpu_to_le32(framebuffer->user_handle);
                cmd->body.destScreenId = unit->unit;
-                /*
+                /* clip and write blits to cmd stream */
-                 * The blit command is a lot more resilient then the
+                vmw_clip_cliprects(tmp, num_clips, clip, blits, &num);
-                 * readback command when it comes to clip rects. So its
-                 * okay to go out of bounds.
-                 */
-                cmd->body.destRect.left = clip_x1;
+                /* if no cliprects hit skip this */
-                cmd->body.destRect.right = clip_x2;
+                if (num == 0)
-                cmd->body.destRect.top = clip_y1;
+                        continue;
-                cmd->body.destRect.bottom = clip_y2;
+                /* recalculate package length */
+                fifo_size = sizeof(*cmd) + sizeof(SVGASignedRect) * num;
+                cmd->header.size = cpu_to_le32(fifo_size - sizeof(cmd->header));
                ret = vmw_execbuf_process(file_priv, dev_priv, NULL, cmd,
                                          fifo_size, 0, NULL);
@@ -480,7 +553,10 @@ static int do_surface_dirty_sou(struct vmw_private *dev_priv,
                        break;
        }
        kfree(cmd);
+out_free_tmp:
+        kfree(tmp);
        return ret;
 }
@@ -556,6 +632,10 @@ static int vmw_kms_new_framebuffer_surface(struct vmw_private *dev_priv,
         * Sanity checks.
         */
+        /* Surface must be marked as a scanout. */
+        if (unlikely(!surface->scanout))
+                return -EINVAL;
        if (unlikely(surface->mip_levels[0] != 1 ||
                     surface->num_sizes != 1 ||
                     surface->sizes[0].width < mode_cmd->width ||
@@ -782,6 +862,7 @@ static int do_dmabuf_dirty_sou(struct drm_file *file_priv,
                        int clip_y1 = clips_ptr->y1 - unit->crtc.y;
                        int clip_x2 = clips_ptr->x2 - unit->crtc.x;
                        int clip_y2 = clips_ptr->y2 - unit->crtc.y;
+                        int move_x, move_y;
                        /* skip any crtcs that misses the clip region */
                        if (clip_x1 >= unit->crtc.mode.hdisplay ||
@@ -789,12 +870,21 @@ static int do_dmabuf_dirty_sou(struct drm_file *file_priv,
                            clip_x2 <= 0 || clip_y2 <= 0)
                                continue;
+                        /* clip size to crtc size */
+                        clip_x2 = min_t(int, clip_x2, unit->crtc.mode.hdisplay);
+                        clip_y2 = min_t(int, clip_y2, unit->crtc.mode.vdisplay);
+                        /* translate both src and dest to bring clip into screen */
+                        move_x = min_t(int, clip_x1, 0);
+                        move_y = min_t(int, clip_y1, 0);
+                        /* actual translate done here */
                        blits[hit_num].header = SVGA_CMD_BLIT_GMRFB_TO_SCREEN;
                        blits[hit_num].body.destScreenId = unit->unit;
-                        blits[hit_num].body.srcOrigin.x = clips_ptr->x1;
+                        blits[hit_num].body.srcOrigin.x = clips_ptr->x1 - move_x;
-                        blits[hit_num].body.srcOrigin.y = clips_ptr->y1;
+                        blits[hit_num].body.srcOrigin.y = clips_ptr->y1 - move_y;
-                        blits[hit_num].body.destRect.left = clip_x1;
+                        blits[hit_num].body.destRect.left = clip_x1 - move_x;
-                        blits[hit_num].body.destRect.top = clip_y1;
+                        blits[hit_num].body.destRect.top = clip_y1 - move_y;
                        blits[hit_num].body.destRect.right = clip_x2;
                        blits[hit_num].body.destRect.bottom = clip_y2;
                        hit_num++;
@@ -1003,7 +1093,6 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
        struct vmw_surface *surface = NULL;
        struct vmw_dma_buffer *bo = NULL;
        struct ttm_base_object *user_obj;
-        u64 required_size;
        int ret;
        /**
@@ -1012,8 +1101,9 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
         * requested framebuffer.
         */
-        required_size = mode_cmd->pitch * mode_cmd->height;
+        if (!vmw_kms_validate_mode_vram(dev_priv,
-        if (unlikely(required_size > (u64) dev_priv->vram_size)) {
+                                        mode_cmd->pitch,
+                                        mode_cmd->height)) {
                DRM_ERROR("VRAM size is too small for requested mode.\n");
                return ERR_PTR(-ENOMEM);
        }
@@ -1033,46 +1123,29 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
                return ERR_PTR(-ENOENT);
        }
-        /**
+        /* returns either a dmabuf or surface */
-         * End conditioned code.
+        ret = vmw_user_lookup_handle(dev_priv, tfile,
-         */
+                                     mode_cmd->handle,
+                                     &surface, &bo);
-        ret = vmw_user_surface_lookup_handle(dev_priv, tfile,
-                                             mode_cmd->handle, &surface);
        if (ret)
-                goto try_dmabuf;
+                goto err_out;
-        if (!surface->scanout)
+        /* Create the new framebuffer depending one what we got back */
-                goto err_not_scanout;
+        if (bo)
+                ret = vmw_kms_new_framebuffer_dmabuf(dev_priv, bo, &vfb,
-        ret = vmw_kms_new_framebuffer_surface(dev_priv, file_priv, surface,
+                                                     mode_cmd);
-                                              &vfb, mode_cmd);
+        else if (surface)
+                ret = vmw_kms_new_framebuffer_surface(dev_priv, file_priv,
-        /* vmw_user_surface_lookup takes one ref so does new_fb */
+                                                      surface, &vfb, mode_cmd);
-        vmw_surface_unreference(&surface);
+        else
+                BUG();
-        if (ret) {
-                DRM_ERROR("failed to create vmw_framebuffer: %i\n", ret);
-                ttm_base_object_unref(&user_obj);
-                return ERR_PTR(ret);
-        } else
-                vfb->user_obj = user_obj;
-        return &vfb->base;
-try_dmabuf:
-        DRM_INFO("%s: trying buffer\n", __func__);
-        ret = vmw_user_dmabuf_lookup(tfile, mode_cmd->handle, &bo);
-        if (ret) {
-                DRM_ERROR("failed to find buffer: %i\n", ret);
-                return ERR_PTR(-ENOENT);
-        }
-        ret = vmw_kms_new_framebuffer_dmabuf(dev_priv, bo, &vfb,
-                                             mode_cmd);
-        /* vmw_user_dmabuf_lookup takes one ref so does new_fb */
+err_out:
-        vmw_dmabuf_unreference(&bo);
+        /* vmw_user_lookup_handle takes one ref so does new_fb */
+        if (bo)
+                vmw_dmabuf_unreference(&bo);
+        if (surface)
+                vmw_surface_unreference(&surface);
        if (ret) {
                DRM_ERROR("failed to create vmw_framebuffer: %i\n", ret);
@@ -1082,14 +1155,6 @@ try_dmabuf:
                vfb->user_obj = user_obj;
        return &vfb->base;
-err_not_scanout:
-        DRM_ERROR("surface not marked as scanout\n");
-        /* vmw_user_surface_lookup takes one ref */
-        vmw_surface_unreference(&surface);
-        ttm_base_object_unref(&user_obj);
-        return ERR_PTR(-EINVAL);
 }
 static struct drm_mode_config_funcs vmw_kms_funcs = {
@@ -1106,10 +1171,12 @@ int vmw_kms_present(struct vmw_private *dev_priv,
                    uint32_t num_clips)
 {
        struct vmw_display_unit *units[VMWGFX_NUM_DISPLAY_UNITS];
+        struct drm_clip_rect *tmp;
        struct drm_crtc *crtc;
        size_t fifo_size;
        int i, k, num_units;
        int ret = 0; /* silence warning */
+        int left, right, top, bottom;
        struct {
                SVGA3dCmdHeader header;
@@ -1127,60 +1194,95 @@ int vmw_kms_present(struct vmw_private *dev_priv,
        BUG_ON(surface == NULL);
        BUG_ON(!clips || !num_clips);
+        tmp = kzalloc(sizeof(*tmp) * num_clips, GFP_KERNEL);
+        if (unlikely(tmp == NULL)) {
+                DRM_ERROR("Temporary cliprect memory alloc failed.\n");
+                return -ENOMEM;
+        }
        fifo_size = sizeof(*cmd) + sizeof(SVGASignedRect) * num_clips;
        cmd = kmalloc(fifo_size, GFP_KERNEL);
        if (unlikely(cmd == NULL)) {
                DRM_ERROR("Failed to allocate temporary fifo memory.\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out_free_tmp;
+        }
+        left = clips->x;
+        right = clips->x + clips->w;
+        top = clips->y;
+        bottom = clips->y + clips->h;
+        for (i = 1; i < num_clips; i++) {
+                left = min_t(int, left, (int)clips[i].x);
+                right = max_t(int, right, (int)clips[i].x + clips[i].w);
+                top = min_t(int, top, (int)clips[i].y);
+                bottom = max_t(int, bottom, (int)clips[i].y + clips[i].h);
        }
        /* only need to do this once */
        memset(cmd, 0, fifo_size);
        cmd->header.id = cpu_to_le32(SVGA_3D_CMD_BLIT_SURFACE_TO_SCREEN);
-        cmd->header.size = cpu_to_le32(fifo_size - sizeof(cmd->header));
-        cmd->body.srcRect.left = 0;
-        cmd->body.srcRect.right = surface->sizes[0].width;
-        cmd->body.srcRect.top = 0;
-        cmd->body.srcRect.bottom = surface->sizes[0].height;
        blits = (SVGASignedRect *)&cmd[1];
+        cmd->body.srcRect.left = left;
+        cmd->body.srcRect.right = right;
+        cmd->body.srcRect.top = top;
+        cmd->body.srcRect.bottom = bottom;
        for (i = 0; i < num_clips; i++) {
-                blits[i].left   = clips[i].x;
+                tmp[i].x1 = clips[i].x - left;
-                blits[i].right  = clips[i].x + clips[i].w;
+                tmp[i].x2 = clips[i].x + clips[i].w - left;
-                blits[i].top    = clips[i].y;
+                tmp[i].y1 = clips[i].y - top;
-                blits[i].bottom = clips[i].y + clips[i].h;
+                tmp[i].y2 = clips[i].y + clips[i].h - top;
        }
        for (k = 0; k < num_units; k++) {
                struct vmw_display_unit *unit = units[k];
-                int clip_x1 = destX - unit->crtc.x;
+                struct vmw_clip_rect clip;
-                int clip_y1 = destY - unit->crtc.y;
+                int num;
-                int clip_x2 = clip_x1 + surface->sizes[0].width;
-                int clip_y2 = clip_y1 + surface->sizes[0].height;
+                clip.x1 = left + destX - unit->crtc.x;
+                clip.y1 = top + destY - unit->crtc.y;
+                clip.x2 = right + destX - unit->crtc.x;
+                clip.y2 = bottom + destY - unit->crtc.y;
                /* skip any crtcs that misses the clip region */
-                if (clip_x1 >= unit->crtc.mode.hdisplay ||
+                if (clip.x1 >= unit->crtc.mode.hdisplay ||
-                    clip_y1 >= unit->crtc.mode.vdisplay ||
+                    clip.y1 >= unit->crtc.mode.vdisplay ||
-                    clip_x2 <= 0 || clip_y2 <= 0)
+                    clip.x2 <= 0 || clip.y2 <= 0)
                        continue;
+                /*
+                 * In order for the clip rects to be correctly scaled
+                 * the src and dest rects needs to be the same size.
+                 */
+                cmd->body.destRect.left = clip.x1;
+                cmd->body.destRect.right = clip.x2;
+                cmd->body.destRect.top = clip.y1;
+                cmd->body.destRect.bottom = clip.y2;
+                /* create a clip rect of the crtc in dest coords */
+                clip.x2 = unit->crtc.mode.hdisplay - clip.x1;
+                clip.y2 = unit->crtc.mode.vdisplay - clip.y1;
+                clip.x1 = 0 - clip.x1;
+                clip.y1 = 0 - clip.y1;
                /* need to reset sid as it is changed by execbuf */
                cmd->body.srcImage.sid = sid;
                cmd->body.destScreenId = unit->unit;
-                /*
+                /* clip and write blits to cmd stream */
-                 * The blit command is a lot more resilient then the
+                vmw_clip_cliprects(tmp, num_clips, clip, blits, &num);
-                 * readback command when it comes to clip rects. So its
-                 * okay to go out of bounds.
-                 */
-                cmd->body.destRect.left = clip_x1;
+                /* if no cliprects hit skip this */
-                cmd->body.destRect.right = clip_x2;
+                if (num == 0)
-                cmd->body.destRect.top = clip_y1;
+                        continue;
-                cmd->body.destRect.bottom = clip_y2;
+                /* recalculate package length */
+                fifo_size = sizeof(*cmd) + sizeof(SVGASignedRect) * num;
+                cmd->header.size = cpu_to_le32(fifo_size - sizeof(cmd->header));
                ret = vmw_execbuf_process(file_priv, dev_priv, NULL, cmd,
                                          fifo_size, 0, NULL);
@@ -1189,6 +1291,8 @@ int vmw_kms_present(struct vmw_private *dev_priv,
        }
        kfree(cmd);
+out_free_tmp:
+        kfree(tmp);
        return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index af8e6e5bd96..e1cb8556355 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -62,9 +62,14 @@ struct vmw_framebuffer {
 int vmw_cursor_update_image(struct vmw_private *dev_priv,
                            u32 *image, u32 width, u32 height,
                            u32 hotspotX, u32 hotspotY);
+int vmw_cursor_update_dmabuf(struct vmw_private *dev_priv,
+                             struct vmw_dma_buffer *dmabuf,
+                             u32 width, u32 height,
+                             u32 hotspotX, u32 hotspotY);
 void vmw_cursor_update_position(struct vmw_private *dev_priv,
                                bool show, int x, int y);
 /**
 * Base class display unit.
 *
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 90c5e392849..8f8dbd43c33 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -74,9 +74,10 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
 {
        struct vmw_legacy_display *lds = dev_priv->ldu_priv;
        struct vmw_legacy_display_unit *entry;
+        struct vmw_display_unit *du = NULL;
        struct drm_framebuffer *fb = NULL;
        struct drm_crtc *crtc = NULL;
-        int i = 0;
+        int i = 0, ret;
        /* If there is no display topology the host just assumes
         * that the guest will set the same layout as the host.
@@ -129,6 +130,25 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
        lds->last_num_active = lds->num_active;
+        /* Find the first du with a cursor. */
+        list_for_each_entry(entry, &lds->active, active) {
+                du = &entry->base;
+                if (!du->cursor_dmabuf)
+                        continue;
+                ret = vmw_cursor_update_dmabuf(dev_priv,
+                                               du->cursor_dmabuf,
+                                               64, 64,
+                                               du->hotspot_x,
+                                               du->hotspot_y);
+                if (ret == 0)
+                        break;
+                DRM_ERROR("Could not update cursor image\n");
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 86c5e4cceb3..1c7f09e2681 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -1190,6 +1190,29 @@ void vmw_resource_unreserve(struct list_head *list)
                write_unlock(lock);
 }
+/**
+ * Helper function that looks either a surface or dmabuf.
+ *
+ * The pointer this pointed at by out_surf and out_buf needs to be null.
+ */
+int vmw_user_lookup_handle(struct vmw_private *dev_priv,
+                           struct ttm_object_file *tfile,
+                           uint32_t handle,
+                           struct vmw_surface **out_surf,
+                           struct vmw_dma_buffer **out_buf)
+{
+        int ret;
+        BUG_ON(*out_surf || *out_buf);
+        ret = vmw_user_surface_lookup_handle(dev_priv, tfile, handle, out_surf);
+        if (!ret)
+                return 0;
+        ret = vmw_user_dmabuf_lookup(tfile, handle, out_buf);
+        return ret;
+}
 int vmw_user_surface_lookup_handle(struct vmw_private *dev_priv,
                                   struct ttm_object_file *tfile,
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 8cebef49aea..18936ac9d51 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -893,6 +893,13 @@ static int __devinit pch_i2c_probe(struct pci_dev *pdev,
        /* Set the number of I2C channel instance */
        adap_info->ch_num = id->driver_data;
+        ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
+                  KBUILD_MODNAME, adap_info);
+        if (ret) {
+                pch_pci_err(pdev, "request_irq FAILED\n");
+                goto err_request_irq;
+        }
        for (i = 0; i < adap_info->ch_num; i++) {
                pch_adap = &adap_info->pch_data[i].pch_adapter;
                adap_info->pch_i2c_suspended = false;
@@ -910,28 +917,23 @@ static int __devinit pch_i2c_probe(struct pci_dev *pdev,
                pch_adap->dev.parent = &pdev->dev;
+                pch_i2c_init(&adap_info->pch_data[i]);
                ret = i2c_add_adapter(pch_adap);
                if (ret) {
                        pch_pci_err(pdev, "i2c_add_adapter[ch:%d] FAILED\n", i);
-                        goto err_i2c_add_adapter;
+                        goto err_add_adapter;
                }
-                pch_i2c_init(&adap_info->pch_data[i]);
-        }
-        ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
-                  KBUILD_MODNAME, adap_info);
-        if (ret) {
-                pch_pci_err(pdev, "request_irq FAILED\n");
-                goto err_i2c_add_adapter;
        }
        pci_set_drvdata(pdev, adap_info);
        pch_pci_dbg(pdev, "returns %d.\n", ret);
        return 0;
-err_i2c_add_adapter:
+err_add_adapter:
        for (j = 0; j < i; j++)
                i2c_del_adapter(&adap_info->pch_data[j].pch_adapter);
+        free_irq(pdev->irq, adap_info);
+err_request_irq:
        pci_iounmap(pdev, base_addr);
 err_pci_iomap:
        pci_release_regions(pdev);
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index a43d0023446..fa23faa20f0 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1047,13 +1047,14 @@ omap_i2c_probe(struct platform_device *pdev)
                 * size. This is to ensure that we can handle the status on int
                 * call back latencies.
                 */
-                if (dev->rev >= OMAP_I2C_REV_ON_3530_4430) {
-                        dev->fifo_size = 0;
+                dev->fifo_size = (dev->fifo_size / 2);
+                if (dev->rev >= OMAP_I2C_REV_ON_3530_4430)
                        dev->b_hw = 0; /* Disable hardware fixes */
-                } else {
+                else
-                        dev->fifo_size = (dev->fifo_size / 2);
                        dev->b_hw = 1; /* Enable hardware fixes */
-                }
                /* calculate wakeup latency constraint for MPU */
                if (dev->set_mpu_wkup_lat != NULL)
                        dev->latency = (1000000 * dev->fifo_size) /
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 2754cef86a0..4c171808168 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -534,6 +534,7 @@ static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,
        /* first, try busy waiting briefly */
        do {
+                cpu_relax();
                iicstat = readl(i2c->regs + S3C2410_IICSTAT);
        } while ((iicstat & S3C2410_IICSTAT_START) && --spins);
@@ -786,7 +787,7 @@ static void s3c24xx_i2c_dt_gpio_free(struct s3c24xx_i2c *i2c)
 #else
 static int s3c24xx_i2c_parse_dt_gpio(struct s3c24xx_i2c *i2c)
 {
-        return -EINVAL;
+        return 0;
 }
 static void s3c24xx_i2c_dt_gpio_free(struct s3c24xx_i2c *i2c)
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 75ff821c0af..d0d4aa9f480 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2513,6 +2513,9 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
        req.private_data_len = sizeof(struct cma_hdr) +
                               conn_param->private_data_len;
+        if (req.private_data_len < conn_param->private_data_len)
+                return -EINVAL;
        req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
        if (!req.private_data)
                return -ENOMEM;
@@ -2562,6 +2565,9 @@ static int cma_connect_ib(struct rdma_id_private *id_priv,
        memset(&req, 0, sizeof req);
        offset = cma_user_data_offset(id_priv->id.ps);
        req.private_data_len = offset + conn_param->private_data_len;
+        if (req.private_data_len < conn_param->private_data_len)
+                return -EINVAL;
        private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
        if (!private_data)
                return -ENOMEM;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 77f3dbc0aaa..18836cdf1e1 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1244,7 +1244,8 @@ err_reg:
 err_counter:
        for (; i; --i)
-                mlx4_counter_free(ibdev->dev, ibdev->counters[i - 1]);
+                if (ibdev->counters[i - 1] != -1)
+                        mlx4_counter_free(ibdev->dev, ibdev->counters[i - 1]);
 err_map:
        iounmap(ibdev->uar_map);
@@ -1275,7 +1276,8 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr)
        }
        iounmap(ibdev->uar_map);
        for (p = 0; p < ibdev->num_ports; ++p)
-                mlx4_counter_free(ibdev->dev, ibdev->counters[p]);
+                if (ibdev->counters[p] != -1)
+                        mlx4_counter_free(ibdev->dev, ibdev->counters[p]);
        mlx4_foreach_port(p, dev, MLX4_PORT_TYPE_IB)
                mlx4_CLOSE_PORT(dev, p);
diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
index 574600ef5b4..a7403248d83 100644
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -1285,7 +1285,7 @@ static int setup_ctxt(struct qib_pportdata *ppd, int ctxt,
        strlcpy(rcd->comm, current->comm, sizeof(rcd->comm));
        ctxt_fp(fp) = rcd;
        qib_stats.sps_ctxts++;
-        dd->freectxts++;
+        dd->freectxts--;
        ret = 0;
        goto bail;
@@ -1794,7 +1794,7 @@ static int qib_close(struct inode *in, struct file *fp)
                if (dd->pageshadow)
                        unlock_expected_tids(rcd);
                qib_stats.sps_ctxts--;
-                dd->freectxts--;
+                dd->freectxts++;
        }
        mutex_unlock(&qib_mutex);
diff --git a/drivers/input/misc/cma3000_d0x.c b/drivers/input/misc/cma3000_d0x.c
index 80793f1608e..06517e60e50 100644
--- a/drivers/input/misc/cma3000_d0x.c
+++ b/drivers/input/misc/cma3000_d0x.c
@@ -115,8 +115,8 @@ static void decode_mg(struct cma3000_accl_data *data, int *datax,
 static irqreturn_t cma3000_thread_irq(int irq, void *dev_id)
 {
        struct cma3000_accl_data *data = dev_id;
-        int datax, datay, dataz;
+        int datax, datay, dataz, intr_status;
-        u8 ctrl, mode, range, intr_status;
+        u8 ctrl, mode, range;
        intr_status = CMA3000_READ(data, CMA3000_INTSTATUS, "interrupt status");
        if (intr_status < 0)
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index c5b12d2e955..86d6f39178b 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -2,7 +2,7 @@
 * Finger Sensing Pad PS/2 mouse driver.
 *
 * Copyright (C) 2005-2007 Asia Vital Components Co., Ltd.
- * Copyright (C) 2005-2010 Tai-hwa Liang, Sentelic Corporation.
+ * Copyright (C) 2005-2011 Tai-hwa Liang, Sentelic Corporation.
 *
 *   This program is free software; you can redistribute it and/or
 *   modify it under the terms of the GNU General Public License
@@ -162,7 +162,7 @@ static int fsp_reg_write(struct psmouse *psmouse, int reg_addr, int reg_val)
        ps2_sendbyte(ps2dev, v, FSP_CMD_TIMEOUT2);
        if (ps2_sendbyte(ps2dev, 0xf3, FSP_CMD_TIMEOUT) < 0)
-                return -1;
+                goto out;
        if ((v = fsp_test_invert_cmd(reg_val)) != reg_val) {
                /* inversion is required */
@@ -261,7 +261,7 @@ static int fsp_page_reg_write(struct psmouse *psmouse, int reg_val)
        ps2_sendbyte(ps2dev, 0x88, FSP_CMD_TIMEOUT2);
        if (ps2_sendbyte(ps2dev, 0xf3, FSP_CMD_TIMEOUT) < 0)
-                return -1;
+                goto out;
        if ((v = fsp_test_invert_cmd(reg_val)) != reg_val) {
                ps2_sendbyte(ps2dev, 0x47, FSP_CMD_TIMEOUT2);
@@ -309,7 +309,7 @@ static int fsp_get_buttons(struct psmouse *psmouse, int *btn)
        };
        int val;
-        if (fsp_reg_read(psmouse, FSP_REG_TMOD_STATUS1, &val) == -1)
+        if (fsp_reg_read(psmouse, FSP_REG_TMOD_STATUS, &val) == -1)
                return -EIO;
        *btn = buttons[(val & 0x30) >> 4];
diff --git a/drivers/input/mouse/sentelic.h b/drivers/input/mouse/sentelic.h
index ed1395ac7b8..2e4af24f8c1 100644
--- a/drivers/input/mouse/sentelic.h
+++ b/drivers/input/mouse/sentelic.h
@@ -2,7 +2,7 @@
 * Finger Sensing Pad PS/2 mouse driver.
 *
 * Copyright (C) 2005-2007 Asia Vital Components Co., Ltd.
- * Copyright (C) 2005-2009 Tai-hwa Liang, Sentelic Corporation.
+ * Copyright (C) 2005-2011 Tai-hwa Liang, Sentelic Corporation.
 *
 *   This program is free software; you can redistribute it and/or
 *   modify it under the terms of the GNU General Public License
@@ -33,6 +33,7 @@
 /* Finger-sensing Pad control registers */
 #define FSP_REG_SYSCTL1         0x10
 #define FSP_BIT_EN_REG_CLK      BIT(5)
+#define FSP_REG_TMOD_STATUS     0x20
 #define FSP_REG_OPC_QDOWN       0x31
 #define FSP_BIT_EN_OPC_TAG      BIT(7)
 #define FSP_REG_OPTZ_XLO        0x34
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index c080b828e5d..a6dcd18e9ad 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -24,6 +24,7 @@
 */
 #include <linux/module.h>
+#include <linux/delay.h>
 #include <linux/dmi.h>
 #include <linux/input/mt.h>
 #include <linux/serio.h>
@@ -1220,6 +1221,16 @@ static int synaptics_reconnect(struct psmouse *psmouse)
        do {
                psmouse_reset(psmouse);
+                if (retry) {
+                        /*
+                         * On some boxes, right after resuming, the touchpad
+                         * needs some time to finish initializing (I assume
+                         * it needs time to calibrate) and start responding
+                         * to Synaptics-specific queries, so let's wait a
+                         * bit.
+                         */
+                        ssleep(1);
+                }
                error = synaptics_detect(psmouse, 0);
        } while (error && ++retry < 3);
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index da0d8761e77..2ee47d01a3b 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1470,6 +1470,9 @@ static const struct wacom_features wacom_features_0xE3 =
 static const struct wacom_features wacom_features_0xE6 =
        { "Wacom ISDv4 E6",       WACOM_PKGLEN_TPC2FG,    27760, 15694,  255,
          0, TABLETPC2FG, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0xEC =
+        { "Wacom ISDv4 EC",       WACOM_PKGLEN_GRAPHIRE,  25710, 14500,  255,
+          0, TABLETPC,    WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0x47 =
        { "Wacom Intuos2 6x8",    WACOM_PKGLEN_INTUOS,    20320, 16240, 1023,
          31, INTUOS, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -1611,6 +1614,7 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0xE2) },
        { USB_DEVICE_WACOM(0xE3) },
        { USB_DEVICE_WACOM(0xE6) },
+        { USB_DEVICE_WACOM(0xEC) },
        { USB_DEVICE_WACOM(0x47) },
        { USB_DEVICE_LENOVO(0x6004) },
        { }
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 2fb2963df55..5b5fa5cdaa3 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -90,7 +90,7 @@ struct iommu_domain *iommu_domain_alloc(struct bus_type *bus)
        if (bus == NULL || bus->iommu_ops == NULL)
                return NULL;
-        domain = kmalloc(sizeof(*domain), GFP_KERNEL);
+        domain = kzalloc(sizeof(*domain), GFP_KERNEL);
        if (!domain)
                return NULL;
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index b6907118283..6d03774b176 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1393,9 +1393,6 @@ void bitmap_endwrite(struct bitmap *bitmap, sector_t offset, unsigned long secto
                         atomic_read(&bitmap->behind_writes),
                         bitmap->mddev->bitmap_info.max_write_behind);
        }
-        if (bitmap->mddev->degraded)
-                /* Never clear bits or update events_cleared when degraded */
-                success = 0;
        while (sectors) {
                sector_t blocks;
@@ -1409,7 +1406,7 @@ void bitmap_endwrite(struct bitmap *bitmap, sector_t offset, unsigned long secto
                        return;
                }
-                if (success &&
+                if (success && !bitmap->mddev->degraded &&
                    bitmap->events_cleared < bitmap->mddev->events) {
                        bitmap->events_cleared = bitmap->mddev->events;
                        bitmap->need_sync = 1;
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index c3273efd08c..627456542fb 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -230,6 +230,7 @@ static int linear_add(struct mddev *mddev, struct md_rdev *rdev)
                return -EINVAL;
        rdev->raid_disk = rdev->saved_raid_disk;
+        rdev->saved_raid_disk = -1;
        newconf = linear_conf(mddev,mddev->raid_disks+1);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index ee981737edf..f47f1f8ac44 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7360,8 +7360,7 @@ static int remove_and_add_spares(struct mddev *mddev)
                                        spares++;
                                        md_new_event(mddev);
                                        set_bit(MD_CHANGE_DEVS, &mddev->flags);
-                                } else
+                                }
-                                        break;
                        }
                }
        }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 31670f8d6b6..858fdbb7eb0 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3065,11 +3065,17 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
                        }
                } else if (test_bit(In_sync, &rdev->flags))
                        set_bit(R5_Insync, &dev->flags);
-                else {
+                else if (sh->sector + STRIPE_SECTORS <= rdev->recovery_offset)
                        /* in sync if before recovery_offset */
-                        if (sh->sector + STRIPE_SECTORS <= rdev->recovery_offset)
+                        set_bit(R5_Insync, &dev->flags);
-                                set_bit(R5_Insync, &dev->flags);
+                else if (test_bit(R5_UPTODATE, &dev->flags) &&
-                }
+                         test_bit(R5_Expanded, &dev->flags))
+                        /* If we've reshaped into here, we assume it is Insync.
+                         * We will shortly update recovery_offset to make
+                         * it official.
+                         */
+                        set_bit(R5_Insync, &dev->flags);
                if (rdev && test_bit(R5_WriteError, &dev->flags)) {
                        clear_bit(R5_Insync, &dev->flags);
                        if (!test_bit(Faulty, &rdev->flags)) {
diff --git a/drivers/media/common/tuners/mxl5007t.c b/drivers/media/common/tuners/mxl5007t.c
index 7eb1bf75cd0..5d02221e99d 100644
--- a/drivers/media/common/tuners/mxl5007t.c
+++ b/drivers/media/common/tuners/mxl5007t.c
@@ -488,9 +488,10 @@ static int mxl5007t_write_regs(struct mxl5007t_state *state,
 static int mxl5007t_read_reg(struct mxl5007t_state *state, u8 reg, u8 *val)
 {
+        u8 buf[2] = { 0xfb, reg };
        struct i2c_msg msg[] = {
                { .addr = state->i2c_props.addr, .flags = 0,
-                  .buf = &reg, .len = 1 },
+                  .buf = buf, .len = 2 },
                { .addr = state->i2c_props.addr, .flags = I2C_M_RD,
                  .buf = val, .len = 1 },
        };
diff --git a/drivers/media/common/tuners/tda18218.c b/drivers/media/common/tuners/tda18218.c
index aacfe2387e2..4fc29730a12 100644
--- a/drivers/media/common/tuners/tda18218.c
+++ b/drivers/media/common/tuners/tda18218.c
@@ -141,7 +141,7 @@ static int tda18218_set_params(struct dvb_frontend *fe,
        switch (params->u.ofdm.bandwidth) {
        case BANDWIDTH_6_MHZ:
                LP_Fc = 0;
-                LO_Frac = params->frequency + 4000000;
+                LO_Frac = params->frequency + 3000000;
                break;
        case BANDWIDTH_7_MHZ:
                LP_Fc = 1;
diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c
index 303f22ea04c..01bb8daf4b0 100644
--- a/drivers/media/rc/ati_remote.c
+++ b/drivers/media/rc/ati_remote.c
@@ -189,7 +189,7 @@ struct ati_remote {
        dma_addr_t inbuf_dma;
        dma_addr_t outbuf_dma;
-        unsigned char old_data[2];  /* Detect duplicate events */
+        unsigned char old_data;     /* Detect duplicate events */
        unsigned long old_jiffies;
        unsigned long acc_jiffies;  /* handle acceleration */
        unsigned long first_jiffies;
@@ -221,35 +221,35 @@ struct ati_remote {
 /* Translation table from hardware messages to input events. */
 static const struct {
        short kind;
-        unsigned char data1, data2;
+        unsigned char data;
        int type;
        unsigned int code;
        int value;
 }  ati_remote_tbl[] = {
        /* Directional control pad axes */
-        {KIND_ACCEL,   0x35, 0x70, EV_REL, REL_X, -1},   /* left */
+        {KIND_ACCEL,   0x70, EV_REL, REL_X, -1},   /* left */
-        {KIND_ACCEL,   0x36, 0x71, EV_REL, REL_X, 1},    /* right */
+        {KIND_ACCEL,   0x71, EV_REL, REL_X, 1},    /* right */
-        {KIND_ACCEL,   0x37, 0x72, EV_REL, REL_Y, -1},   /* up */
+        {KIND_ACCEL,   0x72, EV_REL, REL_Y, -1},   /* up */
-        {KIND_ACCEL,   0x38, 0x73, EV_REL, REL_Y, 1},    /* down */
+        {KIND_ACCEL,   0x73, EV_REL, REL_Y, 1},    /* down */
        /* Directional control pad diagonals */
-        {KIND_LU,      0x39, 0x74, EV_REL, 0, 0},        /* left up */
+        {KIND_LU,      0x74, EV_REL, 0, 0},        /* left up */
-        {KIND_RU,      0x3a, 0x75, EV_REL, 0, 0},        /* right up */
+        {KIND_RU,      0x75, EV_REL, 0, 0},        /* right up */
-        {KIND_LD,      0x3c, 0x77, EV_REL, 0, 0},        /* left down */
+        {KIND_LD,      0x77, EV_REL, 0, 0},        /* left down */
-        {KIND_RD,      0x3b, 0x76, EV_REL, 0, 0},        /* right down */
+        {KIND_RD,      0x76, EV_REL, 0, 0},        /* right down */
        /* "Mouse button" buttons */
-        {KIND_LITERAL, 0x3d, 0x78, EV_KEY, BTN_LEFT, 1}, /* left btn down */
+        {KIND_LITERAL, 0x78, EV_KEY, BTN_LEFT, 1}, /* left btn down */
-        {KIND_LITERAL, 0x3e, 0x79, EV_KEY, BTN_LEFT, 0}, /* left btn up */
+        {KIND_LITERAL, 0x79, EV_KEY, BTN_LEFT, 0}, /* left btn up */
-        {KIND_LITERAL, 0x41, 0x7c, EV_KEY, BTN_RIGHT, 1},/* right btn down */
+        {KIND_LITERAL, 0x7c, EV_KEY, BTN_RIGHT, 1},/* right btn down */
-        {KIND_LITERAL, 0x42, 0x7d, EV_KEY, BTN_RIGHT, 0},/* right btn up */
+        {KIND_LITERAL, 0x7d, EV_KEY, BTN_RIGHT, 0},/* right btn up */
        /* Artificial "doubleclick" events are generated by the hardware.
         * They are mapped to the "side" and "extra" mouse buttons here. */
-        {KIND_FILTERED, 0x3f, 0x7a, EV_KEY, BTN_SIDE, 1}, /* left dblclick */
+        {KIND_FILTERED, 0x7a, EV_KEY, BTN_SIDE, 1}, /* left dblclick */
-        {KIND_FILTERED, 0x43, 0x7e, EV_KEY, BTN_EXTRA, 1},/* right dblclick */
+        {KIND_FILTERED, 0x7e, EV_KEY, BTN_EXTRA, 1},/* right dblclick */
        /* Non-mouse events are handled by rc-core */
-        {KIND_END, 0x00, 0x00, EV_MAX + 1, 0, 0}
+        {KIND_END, 0x00, EV_MAX + 1, 0, 0}
 };
 /* Local function prototypes */
@@ -397,25 +397,6 @@ static int ati_remote_sendpacket(struct ati_remote *ati_remote, u16 cmd, unsigne
 }
 /*
- *      ati_remote_event_lookup
- */
-static int ati_remote_event_lookup(int rem, unsigned char d1, unsigned char d2)
-{
-        int i;
-        for (i = 0; ati_remote_tbl[i].kind != KIND_END; i++) {
-                /*
-                 * Decide if the table entry matches the remote input.
-                 */
-                if (ati_remote_tbl[i].data1 == d1 &&
-                    ati_remote_tbl[i].data2 == d2)
-                        return i;
-        }
-        return -1;
-}
-/*
 *      ati_remote_compute_accel
 *
 * Implements acceleration curve for directional control pad
@@ -463,7 +444,15 @@ static void ati_remote_input_report(struct urb *urb)
        int index = -1;
        int acc;
        int remote_num;
-        unsigned char scancode[2];
+        unsigned char scancode;
+        int i;
+        /*
+         * data[0] = 0x14
+         * data[1] = data[2] + data[3] + 0xd5 (a checksum byte)
+         * data[2] = the key code (with toggle bit in MSB with some models)
+         * data[3] = channel << 4 (the low 4 bits must be zero)
+         */
        /* Deal with strange looking inputs */
        if ( (urb->actual_length != 4) || (data[0] != 0x14) ||
@@ -472,6 +461,13 @@ static void ati_remote_input_report(struct urb *urb)
                return;
        }
+        if (data[1] != ((data[2] + data[3] + 0xd5) & 0xff)) {
+                dbginfo(&ati_remote->interface->dev,
+                        "wrong checksum in input: %02x %02x %02x %02x\n",
+                        data[0], data[1], data[2], data[3]);
+                return;
+        }
        /* Mask unwanted remote channels.  */
        /* note: remote_num is 0-based, channel 1 on remote == 0 here */
        remote_num = (data[3] >> 4) & 0x0f;
@@ -482,31 +478,30 @@ static void ati_remote_input_report(struct urb *urb)
                return;
        }
-        scancode[0] = (((data[1] - ((remote_num + 1) << 4)) & 0xf0) | (data[1] & 0x0f));
        /*
-         * Some devices (e.g. SnapStream Firefly) use 8080 as toggle code,
+         * MSB is a toggle code, though only used by some devices
-         * so we have to clear them. The first bit is a bit tricky as the
+         * (e.g. SnapStream Firefly)
-         * "non-toggled" state depends on remote_num, so we xor it with the
-         * second bit which is only used for toggle.
         */
-        scancode[0] ^= (data[2] & 0x80);
+        scancode = data[2] & 0x7f;
-        scancode[1] = data[2] & ~0x80;
-        /* Look up event code index in mouse translation table. */
+        /* Look up event code index in the mouse translation table. */
-        index = ati_remote_event_lookup(remote_num, scancode[0], scancode[1]);
+        for (i = 0; ati_remote_tbl[i].kind != KIND_END; i++) {
+                if (scancode == ati_remote_tbl[i].data) {
+                        index = i;
+                        break;
+                }
+        }
        if (index >= 0) {
                dbginfo(&ati_remote->interface->dev,
-                        "channel 0x%02x; mouse data %02x,%02x; index %d; keycode %d\n",
+                        "channel 0x%02x; mouse data %02x; index %d; keycode %d\n",
-                        remote_num, data[1], data[2], index, ati_remote_tbl[index].code);
+                        remote_num, data[2], index, ati_remote_tbl[index].code);
                if (!dev)
                        return; /* no mouse device */
        } else
                dbginfo(&ati_remote->interface->dev,
-                        "channel 0x%02x; key data %02x,%02x, scancode %02x,%02x\n",
+                        "channel 0x%02x; key data %02x, scancode %02x\n",
-                        remote_num, data[1], data[2], scancode[0], scancode[1]);
+                        remote_num, data[2], scancode);
        if (index >= 0 && ati_remote_tbl[index].kind == KIND_LITERAL) {
@@ -523,8 +518,7 @@ static void ati_remote_input_report(struct urb *urb)
                unsigned long now = jiffies;
                /* Filter duplicate events which happen "too close" together. */
-                if (ati_remote->old_data[0] == data[1] &&
+                if (ati_remote->old_data == data[2] &&
-                    ati_remote->old_data[1] == data[2] &&
                    time_before(now, ati_remote->old_jiffies +
                                     msecs_to_jiffies(repeat_filter))) {
                        ati_remote->repeat_count++;
@@ -533,8 +527,7 @@ static void ati_remote_input_report(struct urb *urb)
                        ati_remote->first_jiffies = now;
                }
-                ati_remote->old_data[0] = data[1];
+                ati_remote->old_data = data[2];
-                ati_remote->old_data[1] = data[2];
                ati_remote->old_jiffies = now;
                /* Ensure we skip at least the 4 first duplicate events (generated
@@ -549,14 +542,13 @@ static void ati_remote_input_report(struct urb *urb)
                if (index < 0) {
                        /* Not a mouse event, hand it to rc-core. */
-                        u32 rc_code = (scancode[0] << 8) | scancode[1];
                        /*
                         * We don't use the rc-core repeat handling yet as
                         * it would cause ghost repeats which would be a
                         * regression for this driver.
                         */
-                        rc_keydown_notimeout(ati_remote->rdev, rc_code,
+                        rc_keydown_notimeout(ati_remote->rdev, scancode,
                                             data[2]);
                        rc_keyup(ati_remote->rdev);
                        return;
@@ -607,8 +599,7 @@ static void ati_remote_input_report(struct urb *urb)
                input_sync(dev);
                ati_remote->old_jiffies = jiffies;
-                ati_remote->old_data[0] = data[1];
+                ati_remote->old_data = data[2];
-                ati_remote->old_data[1] = data[2];
        }
 }
diff --git a/drivers/media/rc/keymaps/rc-ati-x10.c b/drivers/media/rc/keymaps/rc-ati-x10.c
index e1b8b2605c4..81506440ede 100644
--- a/drivers/media/rc/keymaps/rc-ati-x10.c
+++ b/drivers/media/rc/keymaps/rc-ati-x10.c
@@ -27,55 +27,55 @@
 #include <media/rc-map.h>
 static struct rc_map_table ati_x10[] = {
-        { 0xd20d, KEY_1 },
+        { 0x0d, KEY_1 },
-        { 0xd30e, KEY_2 },
+        { 0x0e, KEY_2 },
-        { 0xd40f, KEY_3 },
+        { 0x0f, KEY_3 },
-        { 0xd510, KEY_4 },
+        { 0x10, KEY_4 },
-        { 0xd611, KEY_5 },
+        { 0x11, KEY_5 },
-        { 0xd712, KEY_6 },
+        { 0x12, KEY_6 },
-        { 0xd813, KEY_7 },
+        { 0x13, KEY_7 },
-        { 0xd914, KEY_8 },
+        { 0x14, KEY_8 },
-        { 0xda15, KEY_9 },
+        { 0x15, KEY_9 },
-        { 0xdc17, KEY_0 },
+        { 0x17, KEY_0 },
-        { 0xc500, KEY_A },
+        { 0x00, KEY_A },
-        { 0xc601, KEY_B },
+        { 0x01, KEY_B },
-        { 0xde19, KEY_C },
+        { 0x19, KEY_C },
-        { 0xe01b, KEY_D },
+        { 0x1b, KEY_D },
-        { 0xe621, KEY_E },
+        { 0x21, KEY_E },
-        { 0xe823, KEY_F },
+        { 0x23, KEY_F },
-        { 0xdd18, KEY_KPENTER },    /* "check" */
+        { 0x18, KEY_KPENTER },    /* "check" */
-        { 0xdb16, KEY_MENU },       /* "menu" */
+        { 0x16, KEY_MENU },       /* "menu" */
-        { 0xc702, KEY_POWER },      /* Power */
+        { 0x02, KEY_POWER },      /* Power */
-        { 0xc803, KEY_TV },         /* TV */
+        { 0x03, KEY_TV },         /* TV */
-        { 0xc904, KEY_DVD },        /* DVD */
+        { 0x04, KEY_DVD },        /* DVD */
-        { 0xca05, KEY_WWW },        /* WEB */
+        { 0x05, KEY_WWW },        /* WEB */
-        { 0xcb06, KEY_BOOKMARKS },  /* "book" */
+        { 0x06, KEY_BOOKMARKS },  /* "book" */
-        { 0xcc07, KEY_EDIT },       /* "hand" */
+        { 0x07, KEY_EDIT },       /* "hand" */
-        { 0xe11c, KEY_COFFEE },     /* "timer" */
+        { 0x1c, KEY_COFFEE },     /* "timer" */
-        { 0xe520, KEY_FRONT },      /* "max" */
+        { 0x20, KEY_FRONT },      /* "max" */
-        { 0xe21d, KEY_LEFT },       /* left */
+        { 0x1d, KEY_LEFT },       /* left */
-        { 0xe41f, KEY_RIGHT },      /* right */
+        { 0x1f, KEY_RIGHT },      /* right */
-        { 0xe722, KEY_DOWN },       /* down */
+        { 0x22, KEY_DOWN },       /* down */
-        { 0xdf1a, KEY_UP },         /* up */
+        { 0x1a, KEY_UP },         /* up */
-        { 0xe31e, KEY_OK },         /* "OK" */
+        { 0x1e, KEY_OK },         /* "OK" */
-        { 0xce09, KEY_VOLUMEDOWN }, /* VOL + */
+        { 0x09, KEY_VOLUMEDOWN }, /* VOL + */
-        { 0xcd08, KEY_VOLUMEUP },   /* VOL - */
+        { 0x08, KEY_VOLUMEUP },   /* VOL - */
-        { 0xcf0a, KEY_MUTE },       /* MUTE  */
+        { 0x0a, KEY_MUTE },       /* MUTE  */
-        { 0xd00b, KEY_CHANNELUP },  /* CH + */
+        { 0x0b, KEY_CHANNELUP },  /* CH + */
-        { 0xd10c, KEY_CHANNELDOWN },/* CH - */
+        { 0x0c, KEY_CHANNELDOWN },/* CH - */
-        { 0xec27, KEY_RECORD },     /* ( o) red */
+        { 0x27, KEY_RECORD },     /* ( o) red */
-        { 0xea25, KEY_PLAY },       /* ( >) */
+        { 0x25, KEY_PLAY },       /* ( >) */
-        { 0xe924, KEY_REWIND },     /* (<<) */
+        { 0x24, KEY_REWIND },     /* (<<) */
-        { 0xeb26, KEY_FORWARD },    /* (>>) */
+        { 0x26, KEY_FORWARD },    /* (>>) */
-        { 0xed28, KEY_STOP },       /* ([]) */
+        { 0x28, KEY_STOP },       /* ([]) */
-        { 0xee29, KEY_PAUSE },      /* ('') */
+        { 0x29, KEY_PAUSE },      /* ('') */
-        { 0xf02b, KEY_PREVIOUS },   /* (<-) */
+        { 0x2b, KEY_PREVIOUS },   /* (<-) */
-        { 0xef2a, KEY_NEXT },       /* (>+) */
+        { 0x2a, KEY_NEXT },       /* (>+) */
-        { 0xf22d, KEY_INFO },       /* PLAYING */
+        { 0x2d, KEY_INFO },       /* PLAYING */
-        { 0xf32e, KEY_HOME },       /* TOP */
+        { 0x2e, KEY_HOME },       /* TOP */
-        { 0xf42f, KEY_END },        /* END */
+        { 0x2f, KEY_END },        /* END */
-        { 0xf530, KEY_SELECT },     /* SELECT */
+        { 0x30, KEY_SELECT },     /* SELECT */
 };
 static struct rc_map_list ati_x10_map = {
diff --git a/drivers/media/rc/keymaps/rc-medion-x10.c b/drivers/media/rc/keymaps/rc-medion-x10.c
index 09e2cc01d11..479cdb89781 100644
--- a/drivers/media/rc/keymaps/rc-medion-x10.c
+++ b/drivers/media/rc/keymaps/rc-medion-x10.c
@@ -25,70 +25,70 @@
 #include <media/rc-map.h>
 static struct rc_map_table medion_x10[] = {
-        { 0xf12c, KEY_TV },    /* TV */
+        { 0x2c, KEY_TV },    /* TV */
-        { 0xf22d, KEY_VCR },   /* VCR */
+        { 0x2d, KEY_VCR },   /* VCR */
-        { 0xc904, KEY_DVD },   /* DVD */
+        { 0x04, KEY_DVD },   /* DVD */
-        { 0xcb06, KEY_AUDIO }, /* MUSIC */
+        { 0x06, KEY_AUDIO }, /* MUSIC */
-        { 0xf32e, KEY_RADIO },     /* RADIO */
+        { 0x2e, KEY_RADIO },     /* RADIO */
-        { 0xca05, KEY_DIRECTORY }, /* PHOTO */
+        { 0x05, KEY_DIRECTORY }, /* PHOTO */
-        { 0xf42f, KEY_INFO },      /* TV-PREVIEW */
+        { 0x2f, KEY_INFO },      /* TV-PREVIEW */
-        { 0xf530, KEY_LIST },      /* CHANNEL-LST */
+        { 0x30, KEY_LIST },      /* CHANNEL-LST */
-        { 0xe01b, KEY_SETUP }, /* SETUP */
+        { 0x1b, KEY_SETUP }, /* SETUP */
-        { 0xf631, KEY_VIDEO }, /* VIDEO DESKTOP */
+        { 0x31, KEY_VIDEO }, /* VIDEO DESKTOP */
-        { 0xcd08, KEY_VOLUMEDOWN },  /* VOL - */
+        { 0x08, KEY_VOLUMEDOWN },  /* VOL - */
-        { 0xce09, KEY_VOLUMEUP },    /* VOL + */
+        { 0x09, KEY_VOLUMEUP },    /* VOL + */
-        { 0xd00b, KEY_CHANNELUP },   /* CHAN + */
+        { 0x0b, KEY_CHANNELUP },   /* CHAN + */
-        { 0xd10c, KEY_CHANNELDOWN }, /* CHAN - */
+        { 0x0c, KEY_CHANNELDOWN }, /* CHAN - */
-        { 0xc500, KEY_MUTE },        /* MUTE */
+        { 0x00, KEY_MUTE },        /* MUTE */
-        { 0xf732, KEY_RED }, /* red */
+        { 0x32, KEY_RED }, /* red */
-        { 0xf833, KEY_GREEN }, /* green */
+        { 0x33, KEY_GREEN }, /* green */
-        { 0xf934, KEY_YELLOW }, /* yellow */
+        { 0x34, KEY_YELLOW }, /* yellow */
-        { 0xfa35, KEY_BLUE }, /* blue */
+        { 0x35, KEY_BLUE }, /* blue */
-        { 0xdb16, KEY_TEXT }, /* TXT */
+        { 0x16, KEY_TEXT }, /* TXT */
-        { 0xd20d, KEY_1 },
+        { 0x0d, KEY_1 },
-        { 0xd30e, KEY_2 },
+        { 0x0e, KEY_2 },
-        { 0xd40f, KEY_3 },
+        { 0x0f, KEY_3 },
-        { 0xd510, KEY_4 },
+        { 0x10, KEY_4 },
-        { 0xd611, KEY_5 },
+        { 0x11, KEY_5 },
-        { 0xd712, KEY_6 },
+        { 0x12, KEY_6 },
-        { 0xd813, KEY_7 },
+        { 0x13, KEY_7 },
-        { 0xd914, KEY_8 },
+        { 0x14, KEY_8 },
-        { 0xda15, KEY_9 },
+        { 0x15, KEY_9 },
-        { 0xdc17, KEY_0 },
+        { 0x17, KEY_0 },
-        { 0xe11c, KEY_SEARCH }, /* TV/RAD, CH SRC */
+        { 0x1c, KEY_SEARCH }, /* TV/RAD, CH SRC */
-        { 0xe520, KEY_DELETE }, /* DELETE */
+        { 0x20, KEY_DELETE }, /* DELETE */
-        { 0xfb36, KEY_KEYBOARD }, /* RENAME */
+        { 0x36, KEY_KEYBOARD }, /* RENAME */
-        { 0xdd18, KEY_SCREEN },   /* SNAPSHOT */
+        { 0x18, KEY_SCREEN },   /* SNAPSHOT */
-        { 0xdf1a, KEY_UP },    /* up */
+        { 0x1a, KEY_UP },    /* up */
-        { 0xe722, KEY_DOWN },  /* down */
+        { 0x22, KEY_DOWN },  /* down */
-        { 0xe21d, KEY_LEFT },  /* left */
+        { 0x1d, KEY_LEFT },  /* left */
-        { 0xe41f, KEY_RIGHT }, /* right */
+        { 0x1f, KEY_RIGHT }, /* right */
-        { 0xe31e, KEY_OK },    /* OK */
+        { 0x1e, KEY_OK },    /* OK */
-        { 0xfc37, KEY_SELECT }, /* ACQUIRE IMAGE */
+        { 0x37, KEY_SELECT }, /* ACQUIRE IMAGE */
-        { 0xfd38, KEY_EDIT },   /* EDIT IMAGE */
+        { 0x38, KEY_EDIT },   /* EDIT IMAGE */
-        { 0xe924, KEY_REWIND },   /* rewind  (<<) */
+        { 0x24, KEY_REWIND },   /* rewind  (<<) */
-        { 0xea25, KEY_PLAY },     /* play    ( >) */
+        { 0x25, KEY_PLAY },     /* play    ( >) */
-        { 0xeb26, KEY_FORWARD },  /* forward (>>) */
+        { 0x26, KEY_FORWARD },  /* forward (>>) */
-        { 0xec27, KEY_RECORD },   /* record  ( o) */
+        { 0x27, KEY_RECORD },   /* record  ( o) */
-        { 0xed28, KEY_STOP },     /* stop    ([]) */
+        { 0x28, KEY_STOP },     /* stop    ([]) */
-        { 0xee29, KEY_PAUSE },    /* pause   ('') */
+        { 0x29, KEY_PAUSE },    /* pause   ('') */
-        { 0xe621, KEY_PREVIOUS },        /* prev */
+        { 0x21, KEY_PREVIOUS },        /* prev */
-        { 0xfe39, KEY_SWITCHVIDEOMODE }, /* F SCR */
+        { 0x39, KEY_SWITCHVIDEOMODE }, /* F SCR */
-        { 0xe823, KEY_NEXT },            /* next */
+        { 0x23, KEY_NEXT },            /* next */
-        { 0xde19, KEY_MENU },            /* MENU */
+        { 0x19, KEY_MENU },            /* MENU */
-        { 0xff3a, KEY_LANGUAGE },        /* AUDIO */
+        { 0x3a, KEY_LANGUAGE },        /* AUDIO */
-        { 0xc702, KEY_POWER }, /* POWER */
+        { 0x02, KEY_POWER }, /* POWER */
 };
 static struct rc_map_list medion_x10_map = {
diff --git a/drivers/media/rc/keymaps/rc-snapstream-firefly.c b/drivers/media/rc/keymaps/rc-snapstream-firefly.c
index ef146520931..c7f33ec719b 100644
--- a/drivers/media/rc/keymaps/rc-snapstream-firefly.c
+++ b/drivers/media/rc/keymaps/rc-snapstream-firefly.c
@@ -22,63 +22,63 @@
 #include <media/rc-map.h>
 static struct rc_map_table snapstream_firefly[] = {
-        { 0xf12c, KEY_ZOOM },       /* Maximize */
+        { 0x2c, KEY_ZOOM },       /* Maximize */
-        { 0xc702, KEY_CLOSE },
+        { 0x02, KEY_CLOSE },
-        { 0xd20d, KEY_1 },
+        { 0x0d, KEY_1 },
-        { 0xd30e, KEY_2 },
+        { 0x0e, KEY_2 },
-        { 0xd40f, KEY_3 },
+        { 0x0f, KEY_3 },
-        { 0xd510, KEY_4 },
+        { 0x10, KEY_4 },
-        { 0xd611, KEY_5 },
+        { 0x11, KEY_5 },
-        { 0xd712, KEY_6 },
+        { 0x12, KEY_6 },
-        { 0xd813, KEY_7 },
+        { 0x13, KEY_7 },
-        { 0xd914, KEY_8 },
+        { 0x14, KEY_8 },
-        { 0xda15, KEY_9 },
+        { 0x15, KEY_9 },
-        { 0xdc17, KEY_0 },
+        { 0x17, KEY_0 },
-        { 0xdb16, KEY_BACK },
+        { 0x16, KEY_BACK },
-        { 0xdd18, KEY_KPENTER },    /* ent */
+        { 0x18, KEY_KPENTER },    /* ent */
-        { 0xce09, KEY_VOLUMEUP },
+        { 0x09, KEY_VOLUMEUP },
-        { 0xcd08, KEY_VOLUMEDOWN },
+        { 0x08, KEY_VOLUMEDOWN },
-        { 0xcf0a, KEY_MUTE },
+        { 0x0a, KEY_MUTE },
-        { 0xd00b, KEY_CHANNELUP },
+        { 0x0b, KEY_CHANNELUP },
-        { 0xd10c, KEY_CHANNELDOWN },
+        { 0x0c, KEY_CHANNELDOWN },
-        { 0xc500, KEY_VENDOR },     /* firefly */
+        { 0x00, KEY_VENDOR },     /* firefly */
-        { 0xf32e, KEY_INFO },
+        { 0x2e, KEY_INFO },
-        { 0xf42f, KEY_OPTION },
+        { 0x2f, KEY_OPTION },
-        { 0xe21d, KEY_LEFT },
+        { 0x1d, KEY_LEFT },
-        { 0xe41f, KEY_RIGHT },
+        { 0x1f, KEY_RIGHT },
-        { 0xe722, KEY_DOWN },
+        { 0x22, KEY_DOWN },
-        { 0xdf1a, KEY_UP },
+        { 0x1a, KEY_UP },
-        { 0xe31e, KEY_OK },
+        { 0x1e, KEY_OK },
-        { 0xe11c, KEY_MENU },
+        { 0x1c, KEY_MENU },
-        { 0xe520, KEY_EXIT },
+        { 0x20, KEY_EXIT },
-        { 0xec27, KEY_RECORD },
+        { 0x27, KEY_RECORD },
-        { 0xea25, KEY_PLAY },
+        { 0x25, KEY_PLAY },
-        { 0xed28, KEY_STOP },
+        { 0x28, KEY_STOP },
-        { 0xe924, KEY_REWIND },
+        { 0x24, KEY_REWIND },
-        { 0xeb26, KEY_FORWARD },
+        { 0x26, KEY_FORWARD },
-        { 0xee29, KEY_PAUSE },
+        { 0x29, KEY_PAUSE },
-        { 0xf02b, KEY_PREVIOUS },
+        { 0x2b, KEY_PREVIOUS },
-        { 0xef2a, KEY_NEXT },
+        { 0x2a, KEY_NEXT },
-        { 0xcb06, KEY_AUDIO },      /* Music */
+        { 0x06, KEY_AUDIO },      /* Music */
-        { 0xca05, KEY_IMAGES },     /* Photos */
+        { 0x05, KEY_IMAGES },     /* Photos */
-        { 0xc904, KEY_DVD },
+        { 0x04, KEY_DVD },
-        { 0xc803, KEY_TV },
+        { 0x03, KEY_TV },
-        { 0xcc07, KEY_VIDEO },
+        { 0x07, KEY_VIDEO },
-        { 0xc601, KEY_HELP },
+        { 0x01, KEY_HELP },
-        { 0xf22d, KEY_MODE },       /* Mouse */
+        { 0x2d, KEY_MODE },       /* Mouse */
-        { 0xde19, KEY_A },
+        { 0x19, KEY_A },
-        { 0xe01b, KEY_B },
+        { 0x1b, KEY_B },
-        { 0xe621, KEY_C },
+        { 0x21, KEY_C },
-        { 0xe823, KEY_D },
+        { 0x23, KEY_D },
 };
 static struct rc_map_list snapstream_firefly_map = {
diff --git a/drivers/media/video/au0828/au0828-cards.c b/drivers/media/video/au0828/au0828-cards.c
index 39fc923fc46..1c6015a04f9 100644
--- a/drivers/media/video/au0828/au0828-cards.c
+++ b/drivers/media/video/au0828/au0828-cards.c
@@ -162,11 +162,14 @@ static void hauppauge_eeprom(struct au0828_dev *dev, u8 *eeprom_data)
        switch (tv.model) {
        case 72000: /* WinTV-HVR950q (Retail, IR, ATSC/QAM */
        case 72001: /* WinTV-HVR950q (Retail, IR, ATSC/QAM and analog video */
+        case 72101: /* WinTV-HVR950q (Retail, IR, ATSC/QAM and analog video */
+        case 72201: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and analog video */
        case 72211: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and analog video */
        case 72221: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and analog video */
        case 72231: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and analog video */
        case 72241: /* WinTV-HVR950q (OEM, No IR, ATSC/QAM and analog video */
        case 72251: /* WinTV-HVR950q (Retail, IR, ATSC/QAM and analog video */
+        case 72261: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and analog video */
        case 72301: /* WinTV-HVR850 (Retail, IR, ATSC and analog video */
        case 72500: /* WinTV-HVR950q (OEM, No IR, ATSC/QAM */
                break;
@@ -324,6 +327,10 @@ struct usb_device_id au0828_usb_id_table[] = {
                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q_MXL },
        { USB_DEVICE(0x2040, 0x8200),
                .driver_info = AU0828_BOARD_HAUPPAUGE_WOODBURY },
+        { USB_DEVICE(0x2040, 0x7260),
+                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+        { USB_DEVICE(0x2040, 0x7213),
+                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
        { },
 };
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 881e04c7ffe..2ca10dfec91 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -838,13 +838,13 @@ static int gspca_init_transfer(struct gspca_dev *gspca_dev)
        gspca_dev->usb_err = 0;
        /* do the specific subdriver stuff before endpoint selection */
-        gspca_dev->alt = 0;
+        intf = usb_ifnum_to_if(gspca_dev->dev, gspca_dev->iface);
+        gspca_dev->alt = gspca_dev->cam.bulk ? intf->num_altsetting : 0;
        if (gspca_dev->sd_desc->isoc_init) {
                ret = gspca_dev->sd_desc->isoc_init(gspca_dev);
                if (ret < 0)
                        goto unlock;
        }
-        intf = usb_ifnum_to_if(gspca_dev->dev, gspca_dev->iface);
        xfer = gspca_dev->cam.bulk ? USB_ENDPOINT_XFER_BULK
                                   : USB_ENDPOINT_XFER_ISOC;
@@ -957,7 +957,7 @@ retry:
                                ret = -EIO;
                                goto out;
                        }
-                        alt = ep_tb[--alt_idx].alt;
+                        gspca_dev->alt = ep_tb[--alt_idx].alt;
                }
        }
 out:
diff --git a/drivers/media/video/m5mols/m5mols.h b/drivers/media/video/m5mols/m5mols.h
index 89d09a8914f..82c8817bd32 100644
--- a/drivers/media/video/m5mols/m5mols.h
+++ b/drivers/media/video/m5mols/m5mols.h
@@ -162,7 +162,6 @@ struct m5mols_version {
 * @pad: media pad
 * @ffmt: current fmt according to resolution type
 * @res_type: current resolution type
- * @code: current code
 * @irq_waitq: waitqueue for the capture
 * @work_irq: workqueue for the IRQ
 * @flags: state variable for the interrupt handler
@@ -192,7 +191,6 @@ struct m5mols_info {
        struct media_pad pad;
        struct v4l2_mbus_framefmt ffmt[M5MOLS_RESTYPE_MAX];
        int res_type;
-        enum v4l2_mbus_pixelcode code;
        wait_queue_head_t irq_waitq;
        struct work_struct work_irq;
        unsigned long flags;
diff --git a/drivers/media/video/m5mols/m5mols_core.c b/drivers/media/video/m5mols/m5mols_core.c
index 05ab3700647..e0f09e53180 100644
--- a/drivers/media/video/m5mols/m5mols_core.c
+++ b/drivers/media/video/m5mols/m5mols_core.c
@@ -334,7 +334,7 @@ int m5mols_mode(struct m5mols_info *info, u8 mode)
        int ret = -EINVAL;
        u8 reg;
-        if (mode < REG_PARAMETER && mode > REG_CAPTURE)
+        if (mode < REG_PARAMETER || mode > REG_CAPTURE)
                return ret;
        ret = m5mols_read_u8(sd, SYSTEM_SYSMODE, &reg);
@@ -511,9 +511,6 @@ static int m5mols_get_fmt(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh,
        struct m5mols_info *info = to_m5mols(sd);
        struct v4l2_mbus_framefmt *format;
-        if (fmt->pad != 0)
-                return -EINVAL;
        format = __find_format(info, fh, fmt->which, info->res_type);
        if (!format)
                return -EINVAL;
@@ -532,9 +529,6 @@ static int m5mols_set_fmt(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh,
        u32 resolution = 0;
        int ret;
-        if (fmt->pad != 0)
-                return -EINVAL;
        ret = __find_resolution(sd, format, &type, &resolution);
        if (ret < 0)
                return ret;
@@ -543,13 +537,14 @@ static int m5mols_set_fmt(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh,
        if (!sfmt)
                return 0;
-        *sfmt           = m5mols_default_ffmt[type];
-        sfmt->width     = format->width;
+        format->code = m5mols_default_ffmt[type].code;
-        sfmt->height    = format->height;
+        format->colorspace = V4L2_COLORSPACE_JPEG;
+        format->field = V4L2_FIELD_NONE;
        if (fmt->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+                *sfmt = *format;
                info->resolution = resolution;
-                info->code = format->code;
                info->res_type = type;
        }
@@ -626,13 +621,14 @@ static int m5mols_start_monitor(struct m5mols_info *info)
 static int m5mols_s_stream(struct v4l2_subdev *sd, int enable)
 {
        struct m5mols_info *info = to_m5mols(sd);
+        u32 code = info->ffmt[info->res_type].code;
        if (enable) {
                int ret = -EINVAL;
-                if (is_code(info->code, M5MOLS_RESTYPE_MONITOR))
+                if (is_code(code, M5MOLS_RESTYPE_MONITOR))
                        ret = m5mols_start_monitor(info);
-                if (is_code(info->code, M5MOLS_RESTYPE_CAPTURE))
+                if (is_code(code, M5MOLS_RESTYPE_CAPTURE))
                        ret = m5mols_start_capture(info);
                return ret;
diff --git a/drivers/media/video/mt9m111.c b/drivers/media/video/mt9m111.c
index cf2c0fb95f2..398f96ffd35 100644
--- a/drivers/media/video/mt9m111.c
+++ b/drivers/media/video/mt9m111.c
@@ -955,6 +955,7 @@ static int mt9m111_probe(struct i2c_client *client,
        mt9m111->rect.height    = MT9M111_MAX_HEIGHT;
        mt9m111->fmt            = &mt9m111_colour_fmts[0];
        mt9m111->lastpage       = -1;
+        mutex_init(&mt9m111->power_lock);
        ret = mt9m111_video_probe(client);
        if (ret) {
diff --git a/drivers/media/video/mt9t112.c b/drivers/media/video/mt9t112.c
index 32114a3c0ca..7b34b11daf2 100644
--- a/drivers/media/video/mt9t112.c
+++ b/drivers/media/video/mt9t112.c
@@ -1083,8 +1083,10 @@ static int mt9t112_probe(struct i2c_client *client,
        v4l2_i2c_subdev_init(&priv->subdev, client, &mt9t112_subdev_ops);
        ret = mt9t112_camera_probe(client);
-        if (ret)
+        if (ret) {
                kfree(priv);
+                return ret;
+        }
        /* Cannot fail: using the default supported pixel code */
        mt9t112_set_params(priv, &rect, V4L2_MBUS_FMT_UYVY8_2X8);
diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c
index 9c5c19f142d..ee0d0b39cd1 100644
--- a/drivers/media/video/omap/omap_vout.c
+++ b/drivers/media/video/omap/omap_vout.c
@@ -38,6 +38,7 @@
 #include <linux/irq.h>
 #include <linux/videodev2.h>
 #include <linux/dma-mapping.h>
+#include <linux/slab.h>
 #include <media/videobuf-dma-contig.h>
 #include <media/v4l2-device.h>
@@ -2169,6 +2170,14 @@ static int __init omap_vout_probe(struct platform_device *pdev)
        vid_dev->num_displays = 0;
        for_each_dss_dev(dssdev) {
                omap_dss_get_device(dssdev);
+                if (!dssdev->driver) {
+                        dev_warn(&pdev->dev, "no driver for display: %s\n",
+                                        dssdev->name);
+                        omap_dss_put_device(dssdev);
+                        continue;
+                }
                vid_dev->displays[vid_dev->num_displays++] = dssdev;
        }
diff --git a/drivers/media/video/omap1_camera.c b/drivers/media/video/omap1_camera.c
index e87ae2f634b..6a6cf388bae 100644
--- a/drivers/media/video/omap1_camera.c
+++ b/drivers/media/video/omap1_camera.c
@@ -24,6 +24,7 @@
 #include <linux/clk.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
diff --git a/drivers/media/video/omap24xxcam-dma.c b/drivers/media/video/omap24xxcam-dma.c
index 1d54b86c936..3ea38a8def8 100644
--- a/drivers/media/video/omap24xxcam-dma.c
+++ b/drivers/media/video/omap24xxcam-dma.c
@@ -506,7 +506,7 @@ int omap24xxcam_sgdma_queue(struct omap24xxcam_sgdma *sgdma,
        unsigned long flags;
        struct sgdma_state *sg_state;
-        if ((sglen < 0) || ((sglen > 0) & !sglist))
+        if ((sglen < 0) || ((sglen > 0) && !sglist))
                return -EINVAL;
        spin_lock_irqsave(&sgdma->lock, flags);
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index b0b0fa5a357..54a4a3f22e2 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -1408,7 +1408,7 @@ static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
 {
        struct isp_pipeline *pipe =
                to_isp_pipeline(&ccdc->video_out.video.entity);
-        struct video_device *vdev = &ccdc->subdev.devnode;
+        struct video_device *vdev = ccdc->subdev.devnode;
        struct v4l2_event event;
        memset(&event, 0, sizeof(event));
diff --git a/drivers/media/video/omap3isp/ispstat.c b/drivers/media/video/omap3isp/ispstat.c
index 68d539456c5..bc0b2c7349b 100644
--- a/drivers/media/video/omap3isp/ispstat.c
+++ b/drivers/media/video/omap3isp/ispstat.c
@@ -496,7 +496,7 @@ static int isp_stat_bufs_alloc(struct ispstat *stat, u32 size)
 static void isp_stat_queue_event(struct ispstat *stat, int err)
 {
-        struct video_device *vdev = &stat->subdev.devnode;
+        struct video_device *vdev = stat->subdev.devnode;
        struct v4l2_event event;
        struct omap3isp_stat_event_status *status = (void *)event.u.data;
diff --git a/drivers/media/video/omap3isp/ispvideo.c b/drivers/media/video/omap3isp/ispvideo.c
index d1000723c5a..f2290578448 100644
--- a/drivers/media/video/omap3isp/ispvideo.c
+++ b/drivers/media/video/omap3isp/ispvideo.c
@@ -26,6 +26,7 @@
 #include <asm/cacheflush.h>
 #include <linux/clk.h>
 #include <linux/mm.h>
+#include <linux/module.h>
 #include <linux/pagemap.h>
 #include <linux/scatterlist.h>
 #include <linux/sched.h>
diff --git a/drivers/media/video/ov6650.c b/drivers/media/video/ov6650.c
index 9f2d26b1d4c..6806345ec2f 100644
--- a/drivers/media/video/ov6650.c
+++ b/drivers/media/video/ov6650.c
@@ -540,7 +540,7 @@ static u8 to_clkrc(struct v4l2_fract *timeperframe,
 static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
 {
        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        struct soc_camera_device *icd = (struct soc_camera_device *)sd->grp_id;
+        struct soc_camera_device *icd = v4l2_get_subdev_hostdata(sd);
        struct soc_camera_sense *sense = icd->sense;
        struct ov6650 *priv = to_ov6650(client);
        bool half_scale = !is_unscaled_ok(mf->width, mf->height, &priv->rect);
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index c8d91b0cd9b..2cc3b916672 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -98,6 +98,10 @@ static int fimc_capture_state_cleanup(struct fimc_dev *fimc, bool suspend)
                        vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR);
        }
        set_bit(ST_CAPT_SUSPENDED, &fimc->state);
+        fimc_hw_reset(fimc);
+        cap->buf_index = 0;
        spin_unlock_irqrestore(&fimc->slock, flags);
        if (streaming)
@@ -137,7 +141,7 @@ int fimc_capture_config_update(struct fimc_ctx *ctx)
        struct fimc_dev *fimc = ctx->fimc_dev;
        int ret;
-        if (test_bit(ST_CAPT_APPLY_CFG, &fimc->state))
+        if (!test_bit(ST_CAPT_APPLY_CFG, &fimc->state))
                return 0;
        spin_lock(&ctx->slock);
@@ -150,7 +154,7 @@ int fimc_capture_config_update(struct fimc_ctx *ctx)
                fimc_hw_set_rotation(ctx);
                fimc_prepare_dma_offset(ctx, &ctx->d_frame);
                fimc_hw_set_out_dma(ctx);
-                set_bit(ST_CAPT_APPLY_CFG, &fimc->state);
+                clear_bit(ST_CAPT_APPLY_CFG, &fimc->state);
        }
        spin_unlock(&ctx->slock);
        return ret;
@@ -164,7 +168,6 @@ static int start_streaming(struct vb2_queue *q, unsigned int count)
        int min_bufs;
        int ret;
-        fimc_hw_reset(fimc);
        vid_cap->frame_count = 0;
        ret = fimc_init_capture(fimc);
@@ -523,7 +526,7 @@ static struct fimc_fmt *fimc_capture_try_format(struct fimc_ctx *ctx,
        max_w = rotation ? pl->out_rot_en_w : pl->out_rot_dis_w;
        min_w = ctx->state & FIMC_DST_CROP ? dst->width : var->min_out_pixsize;
        min_h = ctx->state & FIMC_DST_CROP ? dst->height : var->min_out_pixsize;
-        if (fimc->id == 1 && var->pix_hoff)
+        if (var->min_vsize_align == 1 && !rotation)
                align_h = fimc_fmt_is_rgb(ffmt->color) ? 0 : 1;
        depth = fimc_get_format_depth(ffmt);
@@ -1239,6 +1242,7 @@ static int fimc_subdev_set_fmt(struct v4l2_subdev *sd,
        mutex_lock(&fimc->lock);
        set_frame_bounds(ff, mf->width, mf->height);
+        fimc->vid_cap.mf = *mf;
        ff->fmt = ffmt;
        /* Reset the crop rectangle if required. */
@@ -1375,7 +1379,7 @@ static void fimc_destroy_capture_subdev(struct fimc_dev *fimc)
        media_entity_cleanup(&sd->entity);
        v4l2_device_unregister_subdev(sd);
        kfree(sd);
-        sd = NULL;
+        fimc->vid_cap.subdev = NULL;
 }
 /* Set default format at the sensor and host interface */
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index 19ca6db38b2..07c6254faee 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -37,7 +37,7 @@ static char *fimc_clocks[MAX_FIMC_CLOCKS] = {
 static struct fimc_fmt fimc_formats[] = {
        {
                .name           = "RGB565",
-                .fourcc         = V4L2_PIX_FMT_RGB565X,
+                .fourcc         = V4L2_PIX_FMT_RGB565,
                .depth          = { 16 },
                .color          = S5P_FIMC_RGB565,
                .memplanes      = 1,
@@ -1038,12 +1038,11 @@ static int fimc_try_fmt_mplane(struct fimc_ctx *ctx, struct v4l2_format *f)
                mod_x = 6; /* 64 x 32 pixels tile */
                mod_y = 5;
        } else {
-                if (fimc->id == 1 && variant->pix_hoff)
+                if (variant->min_vsize_align == 1)
                        mod_y = fimc_fmt_is_rgb(fmt->color) ? 0 : 1;
                else
-                        mod_y = mod_x;
+                        mod_y = ffs(variant->min_vsize_align) - 1;
        }
-        dbg("mod_x: %d, mod_y: %d, max_w: %d", mod_x, mod_y, max_w);
        v4l_bound_align_image(&pix->width, 16, max_w, mod_x,
                &pix->height, 8, variant->pix_limit->scaler_dis_w, mod_y, 0);
@@ -1226,10 +1225,10 @@ static int fimc_m2m_try_crop(struct fimc_ctx *ctx, struct v4l2_crop *cr)
                fimc->variant->min_inp_pixsize : fimc->variant->min_out_pixsize;
        /* Get pixel alignment constraints. */
-        if (fimc->id == 1 && fimc->variant->pix_hoff)
+        if (fimc->variant->min_vsize_align == 1)
                halign = fimc_fmt_is_rgb(f->fmt->color) ? 0 : 1;
        else
-                halign = ffs(min_size) - 1;
+                halign = ffs(fimc->variant->min_vsize_align) - 1;
        for (i = 0; i < f->fmt->colplanes; i++)
                depth += f->fmt->depth[i];
@@ -1615,7 +1614,6 @@ static int fimc_probe(struct platform_device *pdev)
        pdata = pdev->dev.platform_data;
        fimc->pdata = pdata;
-        set_bit(ST_LPM, &fimc->state);
        init_waitqueue_head(&fimc->irq_queue);
        spin_lock_init(&fimc->slock);
@@ -1707,8 +1705,6 @@ static int fimc_runtime_resume(struct device *dev)
        /* Enable clocks and perform basic initalization */
        clk_enable(fimc->clock[CLK_GATE]);
        fimc_hw_reset(fimc);
-        if (fimc->variant->out_buf_count > 4)
-                fimc_hw_set_dma_seq(fimc, 0xF);
        /* Resume the capture or mem-to-mem device */
        if (fimc_capture_busy(fimc))
@@ -1750,8 +1746,6 @@ static int fimc_resume(struct device *dev)
                return 0;
        }
        fimc_hw_reset(fimc);
-        if (fimc->variant->out_buf_count > 4)
-                fimc_hw_set_dma_seq(fimc, 0xF);
        spin_unlock_irqrestore(&fimc->slock, flags);
        if (fimc_capture_busy(fimc))
@@ -1780,7 +1774,6 @@ static int __devexit fimc_remove(struct platform_device *pdev)
        struct fimc_dev *fimc = platform_get_drvdata(pdev);
        pm_runtime_disable(&pdev->dev);
-        fimc_runtime_suspend(&pdev->dev);
        pm_runtime_set_suspended(&pdev->dev);
        vb2_dma_contig_cleanup_ctx(fimc->alloc_ctx);
@@ -1840,6 +1833,7 @@ static struct samsung_fimc_variant fimc0_variant_s5p = {
        .min_inp_pixsize = 16,
        .min_out_pixsize = 16,
        .hor_offs_align  = 8,
+        .min_vsize_align = 16,
        .out_buf_count   = 4,
        .pix_limit       = &s5p_pix_limit[0],
 };
@@ -1849,6 +1843,7 @@ static struct samsung_fimc_variant fimc2_variant_s5p = {
        .min_inp_pixsize = 16,
        .min_out_pixsize = 16,
        .hor_offs_align  = 8,
+        .min_vsize_align = 16,
        .out_buf_count   = 4,
        .pix_limit = &s5p_pix_limit[1],
 };
@@ -1861,6 +1856,7 @@ static struct samsung_fimc_variant fimc0_variant_s5pv210 = {
        .min_inp_pixsize = 16,
        .min_out_pixsize = 16,
        .hor_offs_align  = 8,
+        .min_vsize_align = 16,
        .out_buf_count   = 4,
        .pix_limit       = &s5p_pix_limit[1],
 };
@@ -1874,6 +1870,7 @@ static struct samsung_fimc_variant fimc1_variant_s5pv210 = {
        .min_inp_pixsize = 16,
        .min_out_pixsize = 16,
        .hor_offs_align  = 1,
+        .min_vsize_align = 1,
        .out_buf_count   = 4,
        .pix_limit       = &s5p_pix_limit[2],
 };
@@ -1884,6 +1881,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
        .min_inp_pixsize = 16,
        .min_out_pixsize = 16,
        .hor_offs_align  = 8,
+        .min_vsize_align = 16,
        .out_buf_count   = 4,
        .pix_limit       = &s5p_pix_limit[2],
 };
@@ -1898,6 +1896,7 @@ static struct samsung_fimc_variant fimc0_variant_exynos4 = {
        .min_inp_pixsize = 16,
        .min_out_pixsize = 16,
        .hor_offs_align  = 2,
+        .min_vsize_align = 1,
        .out_buf_count   = 32,
        .pix_limit       = &s5p_pix_limit[1],
 };
@@ -1910,6 +1909,7 @@ static struct samsung_fimc_variant fimc3_variant_exynos4 = {
        .min_inp_pixsize = 16,
        .min_out_pixsize = 16,
        .hor_offs_align  = 2,
+        .min_vsize_align = 1,
        .out_buf_count   = 32,
        .pix_limit       = &s5p_pix_limit[3],
 };
diff --git a/drivers/media/video/s5p-fimc/fimc-core.h b/drivers/media/video/s5p-fimc/fimc-core.h
index a6936dad5b1..c7f01c47b20 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.h
+++ b/drivers/media/video/s5p-fimc/fimc-core.h
@@ -377,6 +377,7 @@ struct fimc_pix_limit {
 * @min_inp_pixsize: minimum input pixel size
 * @min_out_pixsize: minimum output pixel size
 * @hor_offs_align: horizontal pixel offset aligment
+ * @min_vsize_align: minimum vertical pixel size alignment
 * @out_buf_count: the number of buffers in output DMA sequence
 */
 struct samsung_fimc_variant {
@@ -390,6 +391,7 @@ struct samsung_fimc_variant {
        u16             min_inp_pixsize;
        u16             min_out_pixsize;
        u16             hor_offs_align;
+        u16             min_vsize_align;
        u16             out_buf_count;
 };
diff --git a/drivers/media/video/s5p-fimc/fimc-mdevice.c b/drivers/media/video/s5p-fimc/fimc-mdevice.c
index cc337b1de91..615c862f036 100644
--- a/drivers/media/video/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/video/s5p-fimc/fimc-mdevice.c
@@ -220,6 +220,7 @@ static struct v4l2_subdev *fimc_md_register_sensor(struct fimc_md *fmd,
        sd = v4l2_i2c_new_subdev_board(&fmd->v4l2_dev, adapter,
                                       s_info->pdata->board_info, NULL);
        if (IS_ERR_OR_NULL(sd)) {
+                i2c_put_adapter(adapter);
                v4l2_err(&fmd->v4l2_dev, "Failed to acquire subdev\n");
                return NULL;
        }
@@ -234,12 +235,15 @@ static struct v4l2_subdev *fimc_md_register_sensor(struct fimc_md *fmd,
 static void fimc_md_unregister_sensor(struct v4l2_subdev *sd)
 {
        struct i2c_client *client = v4l2_get_subdevdata(sd);
+        struct i2c_adapter *adapter;
        if (!client)
                return;
        v4l2_device_unregister_subdev(sd);
+        adapter = client->adapter;
        i2c_unregister_device(client);
-        i2c_put_adapter(client->adapter);
+        if (adapter)
+                i2c_put_adapter(adapter);
 }
 static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
@@ -381,20 +385,28 @@ static void fimc_md_unregister_entities(struct fimc_md *fmd)
 static int fimc_md_register_video_nodes(struct fimc_md *fmd)
 {
+        struct video_device *vdev;
        int i, ret = 0;
        for (i = 0; i < FIMC_MAX_DEVS && !ret; i++) {
                if (!fmd->fimc[i])
                        continue;
-                if (fmd->fimc[i]->m2m.vfd)
+                vdev = fmd->fimc[i]->m2m.vfd;
-                        ret = video_register_device(fmd->fimc[i]->m2m.vfd,
+                if (vdev) {
-                                                    VFL_TYPE_GRABBER, -1);
+                        ret = video_register_device(vdev, VFL_TYPE_GRABBER, -1);
-                if (ret)
+                        if (ret)
-                        break;
+                                break;
-                if (fmd->fimc[i]->vid_cap.vfd)
+                        v4l2_info(&fmd->v4l2_dev, "Registered %s as /dev/%s\n",
-                        ret = video_register_device(fmd->fimc[i]->vid_cap.vfd,
+                                  vdev->name, video_device_node_name(vdev));
-                                                    VFL_TYPE_GRABBER, -1);
+                }
+                vdev = fmd->fimc[i]->vid_cap.vfd;
+                if (vdev == NULL)
+                        continue;
+                ret = video_register_device(vdev, VFL_TYPE_GRABBER, -1);
+                v4l2_info(&fmd->v4l2_dev, "Registered %s as /dev/%s\n",
+                          vdev->name, video_device_node_name(vdev));
        }
        return ret;
@@ -502,7 +514,7 @@ static int fimc_md_create_links(struct fimc_md *fmd)
                        if (WARN(csis == NULL,
                                 "MIPI-CSI interface specified "
                                 "but s5p-csis module is not loaded!\n"))
-                                continue;
+                                return -EINVAL;
                        ret = media_entity_create_link(&sensor->entity, 0,
                                              &csis->entity, CSIS_PAD_SINK,
@@ -742,9 +754,6 @@ static int __devinit fimc_md_probe(struct platform_device *pdev)
        struct fimc_md *fmd;
        int ret;
-        if (WARN(!pdev->dev.platform_data, "Platform data not specified!\n"))
-                return -EINVAL;
        fmd = kzalloc(sizeof(struct fimc_md), GFP_KERNEL);
        if (!fmd)
                return -ENOMEM;
@@ -782,9 +791,11 @@ static int __devinit fimc_md_probe(struct platform_device *pdev)
        if (ret)
                goto err3;
-        ret = fimc_md_register_sensor_entities(fmd);
+        if (pdev->dev.platform_data) {
-        if (ret)
+                ret = fimc_md_register_sensor_entities(fmd);
-                goto err3;
+                if (ret)
+                        goto err3;
+        }
        ret = fimc_md_create_links(fmd);
        if (ret)
                goto err3;
diff --git a/drivers/media/video/s5p-fimc/fimc-reg.c b/drivers/media/video/s5p-fimc/fimc-reg.c
index 20e664e3416..44f5c2d1920 100644
--- a/drivers/media/video/s5p-fimc/fimc-reg.c
+++ b/drivers/media/video/s5p-fimc/fimc-reg.c
@@ -35,6 +35,9 @@ void fimc_hw_reset(struct fimc_dev *dev)
        cfg = readl(dev->regs + S5P_CIGCTRL);
        cfg &= ~S5P_CIGCTRL_SWRST;
        writel(cfg, dev->regs + S5P_CIGCTRL);
+        if (dev->variant->out_buf_count > 4)
+                fimc_hw_set_dma_seq(dev, 0xF);
 }
 static u32 fimc_hw_get_in_flip(struct fimc_ctx *ctx)
@@ -251,7 +254,14 @@ static void fimc_hw_set_scaler(struct fimc_ctx *ctx)
        struct fimc_scaler *sc = &ctx->scaler;
        struct fimc_frame *src_frame = &ctx->s_frame;
        struct fimc_frame *dst_frame = &ctx->d_frame;
-        u32 cfg = 0;
+        u32 cfg = readl(dev->regs + S5P_CISCCTRL);
+        cfg &= ~(S5P_CISCCTRL_CSCR2Y_WIDE | S5P_CISCCTRL_CSCY2R_WIDE |
+                 S5P_CISCCTRL_SCALEUP_H | S5P_CISCCTRL_SCALEUP_V |
+                 S5P_CISCCTRL_SCALERBYPASS | S5P_CISCCTRL_ONE2ONE |
+                 S5P_CISCCTRL_INRGB_FMT_MASK | S5P_CISCCTRL_OUTRGB_FMT_MASK |
+                 S5P_CISCCTRL_INTERLACE | S5P_CISCCTRL_RGB_EXT);
        if (!(ctx->flags & FIMC_COLOR_RANGE_NARROW))
                cfg |= (S5P_CISCCTRL_CSCR2Y_WIDE | S5P_CISCCTRL_CSCY2R_WIDE);
@@ -308,9 +318,9 @@ void fimc_hw_set_mainscaler(struct fimc_ctx *ctx)
        fimc_hw_set_scaler(ctx);
        cfg = readl(dev->regs + S5P_CISCCTRL);
+        cfg &= ~(S5P_CISCCTRL_MHRATIO_MASK | S5P_CISCCTRL_MVRATIO_MASK);
        if (variant->has_mainscaler_ext) {
-                cfg &= ~(S5P_CISCCTRL_MHRATIO_MASK | S5P_CISCCTRL_MVRATIO_MASK);
                cfg |= S5P_CISCCTRL_MHRATIO_EXT(sc->main_hratio);
                cfg |= S5P_CISCCTRL_MVRATIO_EXT(sc->main_vratio);
                writel(cfg, dev->regs + S5P_CISCCTRL);
@@ -323,7 +333,6 @@ void fimc_hw_set_mainscaler(struct fimc_ctx *ctx)
                cfg |= S5P_CIEXTEN_MVRATIO_EXT(sc->main_vratio);
                writel(cfg, dev->regs + S5P_CIEXTEN);
        } else {
-                cfg &= ~(S5P_CISCCTRL_MHRATIO_MASK | S5P_CISCCTRL_MVRATIO_MASK);
                cfg |= S5P_CISCCTRL_MHRATIO(sc->main_hratio);
                cfg |= S5P_CISCCTRL_MVRATIO(sc->main_vratio);
                writel(cfg, dev->regs + S5P_CISCCTRL);
diff --git a/drivers/media/video/s5p-mfc/s5p_mfc_enc.c b/drivers/media/video/s5p-mfc/s5p_mfc_enc.c
index 1e8cdb77d4b..dff9dc79879 100644
--- a/drivers/media/video/s5p-mfc/s5p_mfc_enc.c
+++ b/drivers/media/video/s5p-mfc/s5p_mfc_enc.c
@@ -61,7 +61,7 @@ static struct s5p_mfc_fmt formats[] = {
                .num_planes = 1,
        },
        {
-                .name = "H264 Encoded Stream",
+                .name = "H263 Encoded Stream",
                .fourcc = V4L2_PIX_FMT_H263,
                .codec_mode = S5P_FIMV_CODEC_H263_ENC,
                .type = MFC_FMT_ENC,
diff --git a/drivers/media/video/s5p-tv/mixer_video.c b/drivers/media/video/s5p-tv/mixer_video.c
index e16d3a4bc1d..b47d0c06ecf 100644
--- a/drivers/media/video/s5p-tv/mixer_video.c
+++ b/drivers/media/video/s5p-tv/mixer_video.c
@@ -16,6 +16,7 @@
 #include <media/v4l2-ioctl.h>
 #include <linux/videodev2.h>
 #include <linux/mm.h>
+#include <linux/module.h>
 #include <linux/version.h>
 #include <linux/timer.h>
 #include <media/videobuf2-dma-contig.h>
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index f390682629c..c51decfcae1 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -566,8 +566,10 @@ static int sh_mobile_ceu_add_device(struct soc_camera_device *icd)
        ret = sh_mobile_ceu_soft_reset(pcdev);
        csi2_sd = find_csi2(pcdev);
-        if (csi2_sd)
+        if (csi2_sd) {
-                csi2_sd->grp_id = (long)icd;
+                csi2_sd->grp_id = soc_camera_grp_id(icd);
+                v4l2_set_subdev_hostdata(csi2_sd, icd);
+        }
        ret = v4l2_subdev_call(csi2_sd, core, s_power, 1);
        if (ret < 0 && ret != -ENOIOCTLCMD && ret != -ENODEV) {
@@ -768,7 +770,7 @@ static struct v4l2_subdev *find_bus_subdev(struct sh_mobile_ceu_dev *pcdev,
 {
        if (pcdev->csi2_pdev) {
                struct v4l2_subdev *csi2_sd = find_csi2(pcdev);
-                if (csi2_sd && csi2_sd->grp_id == (u32)icd)
+                if (csi2_sd && csi2_sd->grp_id == soc_camera_grp_id(icd))
                        return csi2_sd;
        }
@@ -1089,8 +1091,9 @@ static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, unsigned int
                        /* Try 2560x1920, 1280x960, 640x480, 320x240 */
                        mf.width        = 2560 >> shift;
                        mf.height       = 1920 >> shift;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev,
-                                                         s_mbus_fmt, &mf);
+                                        soc_camera_grp_id(icd), video,
+                                        s_mbus_fmt, &mf);
                        if (ret < 0)
                                return ret;
                        shift++;
@@ -1389,7 +1392,8 @@ static int client_s_fmt(struct soc_camera_device *icd,
        bool ceu_1to1;
        int ret;
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
+        ret = v4l2_device_call_until_err(sd->v4l2_dev,
+                                         soc_camera_grp_id(icd), video,
                                         s_mbus_fmt, mf);
        if (ret < 0)
                return ret;
@@ -1426,8 +1430,9 @@ static int client_s_fmt(struct soc_camera_device *icd,
                tmp_h = min(2 * tmp_h, max_height);
                mf->width = tmp_w;
                mf->height = tmp_h;
-                ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
+                ret = v4l2_device_call_until_err(sd->v4l2_dev,
-                                                 s_mbus_fmt, mf);
+                                        soc_camera_grp_id(icd), video,
+                                        s_mbus_fmt, mf);
                dev_geo(dev, "Camera scaled to %ux%u\n",
                        mf->width, mf->height);
                if (ret < 0) {
@@ -1580,8 +1585,9 @@ static int sh_mobile_ceu_set_crop(struct soc_camera_device *icd,
        }
        if (interm_width < icd->user_width || interm_height < icd->user_height) {
-                ret = v4l2_device_call_until_err(sd->v4l2_dev, (int)icd, video,
+                ret = v4l2_device_call_until_err(sd->v4l2_dev,
-                                                 s_mbus_fmt, &mf);
+                                        soc_camera_grp_id(icd), video,
+                                        s_mbus_fmt, &mf);
                if (ret < 0)
                        return ret;
@@ -1867,7 +1873,8 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
        mf.code         = xlate->code;
        mf.colorspace   = pix->colorspace;
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video, try_mbus_fmt, &mf);
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, soc_camera_grp_id(icd),
+                                         video, try_mbus_fmt, &mf);
        if (ret < 0)
                return ret;
@@ -1891,8 +1898,9 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
                         */
                        mf.width = 2560;
                        mf.height = 1920;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev,
-                                                         try_mbus_fmt, &mf);
+                                        soc_camera_grp_id(icd), video,
+                                        try_mbus_fmt, &mf);
                        if (ret < 0) {
                                /* Shouldn't actually happen... */
                                dev_err(icd->parent,
diff --git a/drivers/media/video/sh_mobile_csi2.c b/drivers/media/video/sh_mobile_csi2.c
index ea4f0473ed3..8a652b53ff7 100644
--- a/drivers/media/video/sh_mobile_csi2.c
+++ b/drivers/media/video/sh_mobile_csi2.c
@@ -143,7 +143,7 @@ static int sh_csi2_s_mbus_config(struct v4l2_subdev *sd,
                                 const struct v4l2_mbus_config *cfg)
 {
        struct sh_csi2 *priv = container_of(sd, struct sh_csi2, subdev);
-        struct soc_camera_device *icd = (struct soc_camera_device *)sd->grp_id;
+        struct soc_camera_device *icd = v4l2_get_subdev_hostdata(sd);
        struct v4l2_subdev *client_sd = soc_camera_to_subdev(icd);
        struct v4l2_mbus_config client_cfg = {.type = V4L2_MBUS_CSI2,
                                              .flags = priv->mipi_flags};
@@ -202,7 +202,7 @@ static void sh_csi2_hwinit(struct sh_csi2 *priv)
 static int sh_csi2_client_connect(struct sh_csi2 *priv)
 {
        struct sh_csi2_pdata *pdata = priv->pdev->dev.platform_data;
-        struct soc_camera_device *icd = (struct soc_camera_device *)priv->subdev.grp_id;
+        struct soc_camera_device *icd = v4l2_get_subdev_hostdata(&priv->subdev);
        struct v4l2_subdev *client_sd = soc_camera_to_subdev(icd);
        struct device *dev = v4l2_get_subdevdata(&priv->subdev);
        struct v4l2_mbus_config cfg;
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index b72580c3895..62e4312515c 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -1103,7 +1103,8 @@ static int soc_camera_probe(struct soc_camera_device *icd)
        }
        sd = soc_camera_to_subdev(icd);
-        sd->grp_id = (long)icd;
+        sd->grp_id = soc_camera_grp_id(icd);
+        v4l2_set_subdev_hostdata(sd, icd);
        if (v4l2_ctrl_add_handler(&icd->ctrl_handler, sd->ctrl_handler))
                goto ectrl;
diff --git a/drivers/mfd/ab5500-debugfs.c b/drivers/mfd/ab5500-debugfs.c
index 43c0ebb8195..b7b2d3483fd 100644
--- a/drivers/mfd/ab5500-debugfs.c
+++ b/drivers/mfd/ab5500-debugfs.c
@@ -4,7 +4,7 @@
 * Debugfs support for the AB5500 MFD driver
 */
-#include <linux/export.h>
+#include <linux/module.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
 #include <linux/mfd/ab5500/ab5500.h>
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 1e9173804ed..d3d572b2317 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -620,6 +620,7 @@ static struct resource __devinitdata ab8500_fg_resources[] = {
 static struct resource __devinitdata ab8500_chargalg_resources[] = {};
+#ifdef CONFIG_DEBUG_FS
 static struct resource __devinitdata ab8500_debug_resources[] = {
        {
                .name   = "IRQ_FIRST",
@@ -634,6 +635,7 @@ static struct resource __devinitdata ab8500_debug_resources[] = {
                .flags  = IORESOURCE_IRQ,
        },
 };
+#endif
 static struct resource __devinitdata ab8500_usb_resources[] = {
        {
diff --git a/drivers/mfd/adp5520.c b/drivers/mfd/adp5520.c
index f1d88483112..8d816cce832 100644
--- a/drivers/mfd/adp5520.c
+++ b/drivers/mfd/adp5520.c
@@ -109,7 +109,7 @@ int adp5520_set_bits(struct device *dev, int reg, uint8_t bit_mask)
        ret = __adp5520_read(chip->client, reg, &reg_val);
-        if (!ret && ((reg_val & bit_mask) == 0)) {
+        if (!ret && ((reg_val & bit_mask) != bit_mask)) {
                reg_val |= bit_mask;
                ret = __adp5520_write(chip->client, reg, reg_val);
        }
diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
index 1b79c37fd59..1924b857a0f 100644
--- a/drivers/mfd/da903x.c
+++ b/drivers/mfd/da903x.c
@@ -182,7 +182,7 @@ int da903x_set_bits(struct device *dev, int reg, uint8_t bit_mask)
        if (ret)
                goto out;
-        if ((reg_val & bit_mask) == 0) {
+        if ((reg_val & bit_mask) != bit_mask) {
                reg_val |= bit_mask;
                ret = __da903x_write(chip->client, reg, reg_val);
        }
@@ -549,6 +549,7 @@ static int __devexit da903x_remove(struct i2c_client *client)
        struct da903x_chip *chip = i2c_get_clientdata(client);
        da903x_remove_subdevs(chip);
+        free_irq(client->irq, chip);
        kfree(chip);
        return 0;
 }
diff --git a/drivers/mfd/jz4740-adc.c b/drivers/mfd/jz4740-adc.c
index 1e9ee533eac..ef39528088f 100644
--- a/drivers/mfd/jz4740-adc.c
+++ b/drivers/mfd/jz4740-adc.c
@@ -16,6 +16,7 @@
 */
 #include <linux/err.h>
+#include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index bba26d96c24..a5ddf31b60c 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -197,7 +197,7 @@ int tps6586x_set_bits(struct device *dev, int reg, uint8_t bit_mask)
        if (ret)
                goto out;
-        if ((reg_val & bit_mask) == 0) {
+        if ((reg_val & bit_mask) != bit_mask) {
                reg_val |= bit_mask;
                ret = __tps6586x_write(to_i2c_client(dev), reg, reg_val);
        }
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index 6f5b8cf2f65..c1da84bc157 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -120,7 +120,7 @@ int tps65910_clear_bits(struct tps65910 *tps65910, u8 reg, u8 mask)
                goto out;
        }
-        data &= mask;
+        data &= ~mask;
        err = tps65910_i2c_write(tps65910, reg, 1, &data);
        if (err)
                dev_err(tps65910->dev, "write to reg %x failed\n", reg);
diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index bfbd66021af..61e70cfaa77 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -363,13 +363,13 @@ int twl_i2c_write(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
                pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);
                return -EPERM;
        }
-        sid = twl_map[mod_no].sid;
-        twl = &twl_modules[sid];
        if (unlikely(!inuse)) {
-                pr_err("%s: client %d is not initialized\n", DRIVER_NAME, sid);
+                pr_err("%s: not initialized\n", DRIVER_NAME);
                return -EPERM;
        }
+        sid = twl_map[mod_no].sid;
+        twl = &twl_modules[sid];
        mutex_lock(&twl->xfer_lock);
        /*
         * [MSG1]: fill the register address data
@@ -420,13 +420,13 @@ int twl_i2c_read(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
                pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);
                return -EPERM;
        }
-        sid = twl_map[mod_no].sid;
-        twl = &twl_modules[sid];
        if (unlikely(!inuse)) {
-                pr_err("%s: client %d is not initialized\n", DRIVER_NAME, sid);
+                pr_err("%s: not initialized\n", DRIVER_NAME);
                return -EPERM;
        }
+        sid = twl_map[mod_no].sid;
+        twl = &twl_modules[sid];
        mutex_lock(&twl->xfer_lock);
        /* [MSG1] fill the register address data */
        msg = &twl->xfer_msg[0];
diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
index f062c8cc6c3..29f11e0765f 100644
--- a/drivers/mfd/twl4030-irq.c
+++ b/drivers/mfd/twl4030-irq.c
@@ -432,6 +432,7 @@ struct sih_agent {
        u32                     edge_change;
        struct mutex            irq_lock;
+        char                    *irq_name;
 };
 /*----------------------------------------------------------------------*/
@@ -589,7 +590,7 @@ static inline int sih_read_isr(const struct sih *sih)
 * Generic handler for SIH interrupts ... we "know" this is called
 * in task context, with IRQs enabled.
 */
-static void handle_twl4030_sih(unsigned irq, struct irq_desc *desc)
+static irqreturn_t handle_twl4030_sih(int irq, void *data)
 {
        struct sih_agent *agent = irq_get_handler_data(irq);
        const struct sih *sih = agent->sih;
@@ -602,7 +603,7 @@ static void handle_twl4030_sih(unsigned irq, struct irq_desc *desc)
                pr_err("twl4030: %s SIH, read ISR error %d\n",
                        sih->name, isr);
                /* REVISIT:  recover; eventually mask it all, etc */
-                return;
+                return IRQ_HANDLED;
        }
        while (isr) {
@@ -616,6 +617,7 @@ static void handle_twl4030_sih(unsigned irq, struct irq_desc *desc)
                        pr_err("twl4030: %s SIH, invalid ISR bit %d\n",
                                sih->name, irq);
        }
+        return IRQ_HANDLED;
 }
 static unsigned twl4030_irq_next;
@@ -668,18 +670,19 @@ int twl4030_sih_setup(int module)
                activate_irq(irq);
        }
-        status = irq_base;
        twl4030_irq_next += i;
        /* replace generic PIH handler (handle_simple_irq) */
        irq = sih_mod + twl4030_irq_base;
        irq_set_handler_data(irq, agent);
-        irq_set_chained_handler(irq, handle_twl4030_sih);
+        agent->irq_name = kasprintf(GFP_KERNEL, "twl4030_%s", sih->name);
+        status = request_threaded_irq(irq, NULL, handle_twl4030_sih, 0,
+                                      agent->irq_name ?: sih->name, NULL);
        pr_info("twl4030: %s (irq %d) chaining IRQs %d..%d\n", sih->name,
                        irq, irq_base, twl4030_irq_next - 1);
-        return status;
+        return status < 0 ? status : irq_base;
 }
 /* FIXME need a call to reverse twl4030_sih_setup() ... */
@@ -733,8 +736,9 @@ int twl4030_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
        }
        /* install an irq handler to demultiplex the TWL4030 interrupt */
-        status = request_threaded_irq(irq_num, NULL, handle_twl4030_pih, 0,
+        status = request_threaded_irq(irq_num, NULL, handle_twl4030_pih,
-                                        "TWL4030-PIH", NULL);
+                                      IRQF_ONESHOT,
+                                      "TWL4030-PIH", NULL);
        if (status < 0) {
                pr_err("twl4030: could not claim irq%d: %d\n", irq_num, status);
                goto fail_rqirq;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index 5d6ba132837..61894fced8e 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -239,6 +239,7 @@ static int wm8994_suspend(struct device *dev)
        switch (wm8994->type) {
        case WM8958:
+        case WM1811:
                ret = wm8994_reg_read(wm8994, WM8958_MIC_DETECT_1);
                if (ret < 0) {
                        dev_err(dev, "Failed to read power status: %d\n", ret);
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index e8a5eb38748..d31c78b72b0 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -302,17 +302,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
        host->max_blk_size = 512;
        host->max_blk_count = PAGE_CACHE_SIZE / 512;
-        /*
-         * Enable runtime power management by default. This flag was added due
-         * to runtime power management causing disruption for some users, but
-         * the power on/off code has been improved since then.
-         *
-         * We'll enable this flag by default as an experiment, and if no
-         * problems are reported, we will follow up later and remove the flag
-         * altogether.
-         */
-        host->caps = MMC_CAP_POWER_OFF_CARD;
        return host;
 free:
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 50b5f9926f6..0726e59fd41 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -675,7 +675,8 @@ mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
              unsigned int status)
 {
        /* First check for errors */
-        if (status & (MCI_DATACRCFAIL|MCI_DATATIMEOUT|MCI_TXUNDERRUN|MCI_RXOVERRUN)) {
+        if (status & (MCI_DATACRCFAIL|MCI_DATATIMEOUT|MCI_STARTBITERR|
+                      MCI_TXUNDERRUN|MCI_RXOVERRUN)) {
                u32 remain, success;
                /* Terminate the DMA transfer */
@@ -754,8 +755,12 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
        }
        if (!cmd->data || cmd->error) {
-                if (host->data)
+                if (host->data) {
+                        /* Terminate the DMA transfer */
+                        if (dma_inprogress(host))
+                                mmci_dma_data_error(host);
                        mmci_stop_data(host);
+                }
                mmci_request_end(host, cmd->mrq);
        } else if (!(cmd->data->flags & MMC_DATA_READ)) {
                mmci_start_data(host, cmd->data);
@@ -955,8 +960,9 @@ static irqreturn_t mmci_irq(int irq, void *dev_id)
                dev_dbg(mmc_dev(host->mmc), "irq0 (data+cmd) %08x\n", status);
                data = host->data;
-                if (status & (MCI_DATACRCFAIL|MCI_DATATIMEOUT|MCI_TXUNDERRUN|
+                if (status & (MCI_DATACRCFAIL|MCI_DATATIMEOUT|MCI_STARTBITERR|
-                              MCI_RXOVERRUN|MCI_DATAEND|MCI_DATABLOCKEND) && data)
+                              MCI_TXUNDERRUN|MCI_RXOVERRUN|MCI_DATAEND|
+                              MCI_DATABLOCKEND) && data)
                        mmci_data_irq(host, data, status);
                cmd = host->cmd;
diff --git a/drivers/mmc/host/sdhci-cns3xxx.c b/drivers/mmc/host/sdhci-cns3xxx.c
index 87b6f079b6e..b4257e70061 100644
--- a/drivers/mmc/host/sdhci-cns3xxx.c
+++ b/drivers/mmc/host/sdhci-cns3xxx.c
@@ -109,13 +109,10 @@ static struct platform_driver sdhci_cns3xxx_driver = {
        .driver         = {
                .name   = "sdhci-cns3xxx",
                .owner  = THIS_MODULE,
+                .pm     = SDHCI_PLTFM_PMOPS,
        },
        .probe          = sdhci_cns3xxx_probe,
        .remove         = __devexit_p(sdhci_cns3xxx_remove),
-#ifdef CONFIG_PM
-        .suspend        = sdhci_pltfm_suspend,
-        .resume         = sdhci_pltfm_resume,
-#endif
 };
 static int __init sdhci_cns3xxx_init(void)
diff --git a/drivers/mmc/host/sdhci-dove.c b/drivers/mmc/host/sdhci-dove.c
index f2d29dca442..a81312c91f7 100644
--- a/drivers/mmc/host/sdhci-dove.c
+++ b/drivers/mmc/host/sdhci-dove.c
@@ -82,13 +82,10 @@ static struct platform_driver sdhci_dove_driver = {
        .driver         = {
                .name   = "sdhci-dove",
                .owner  = THIS_MODULE,
+                .pm     = SDHCI_PLTFM_PMOPS,
        },
        .probe          = sdhci_dove_probe,
        .remove         = __devexit_p(sdhci_dove_remove),
-#ifdef CONFIG_PM
-        .suspend        = sdhci_pltfm_suspend,
-        .resume         = sdhci_pltfm_resume,
-#endif
 };
 static int __init sdhci_dove_init(void)
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 4b976f00ea8..38ebc4ea259 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -599,14 +599,11 @@ static struct platform_driver sdhci_esdhc_imx_driver = {
                .name   = "sdhci-esdhc-imx",
                .owner  = THIS_MODULE,
                .of_match_table = imx_esdhc_dt_ids,
+                .pm     = SDHCI_PLTFM_PMOPS,
        },
        .id_table       = imx_esdhc_devtype,
        .probe          = sdhci_esdhc_imx_probe,
        .remove         = __devexit_p(sdhci_esdhc_imx_remove),
-#ifdef CONFIG_PM
-        .suspend        = sdhci_pltfm_suspend,
-        .resume         = sdhci_pltfm_resume,
-#endif
 };
 static int __init sdhci_esdhc_imx_init(void)
diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
index 59e9d003e58..01e5f627e0f 100644
--- a/drivers/mmc/host/sdhci-of-esdhc.c
+++ b/drivers/mmc/host/sdhci-of-esdhc.c
@@ -125,13 +125,10 @@ static struct platform_driver sdhci_esdhc_driver = {
                .name = "sdhci-esdhc",
                .owner = THIS_MODULE,
                .of_match_table = sdhci_esdhc_of_match,
+                .pm = SDHCI_PLTFM_PMOPS,
        },
        .probe = sdhci_esdhc_probe,
        .remove = __devexit_p(sdhci_esdhc_remove),
-#ifdef CONFIG_PM
-        .suspend = sdhci_pltfm_suspend,
-        .resume = sdhci_pltfm_resume,
-#endif
 };
 static int __init sdhci_esdhc_init(void)
diff --git a/drivers/mmc/host/sdhci-of-hlwd.c b/drivers/mmc/host/sdhci-of-hlwd.c
index 9b0d794a4f6..3619adc7d9f 100644
--- a/drivers/mmc/host/sdhci-of-hlwd.c
+++ b/drivers/mmc/host/sdhci-of-hlwd.c
@@ -87,13 +87,10 @@ static struct platform_driver sdhci_hlwd_driver = {
                .name = "sdhci-hlwd",
                .owner = THIS_MODULE,
                .of_match_table = sdhci_hlwd_of_match,
+                .pm = SDHCI_PLTFM_PMOPS,
        },
        .probe = sdhci_hlwd_probe,
        .remove = __devexit_p(sdhci_hlwd_remove),
-#ifdef CONFIG_PM
-        .suspend = sdhci_pltfm_suspend,
-        .resume = sdhci_pltfm_resume,
-#endif
 };
 static int __init sdhci_hlwd_init(void)
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index d833d9c2f7e..6878a94626b 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -54,8 +54,7 @@ struct sdhci_pci_fixes {
        int                     (*probe_slot) (struct sdhci_pci_slot *);
        void                    (*remove_slot) (struct sdhci_pci_slot *, int);
-        int                     (*suspend) (struct sdhci_pci_chip *,
+        int                     (*suspend) (struct sdhci_pci_chip *);
-                                        pm_message_t);
        int                     (*resume) (struct sdhci_pci_chip *);
 };
@@ -549,7 +548,7 @@ static void jmicron_remove_slot(struct sdhci_pci_slot *slot, int dead)
                jmicron_enable_mmc(slot->host, 0);
 }
-static int jmicron_suspend(struct sdhci_pci_chip *chip, pm_message_t state)
+static int jmicron_suspend(struct sdhci_pci_chip *chip)
 {
        int i;
@@ -993,8 +992,9 @@ static struct sdhci_ops sdhci_pci_ops = {
 #ifdef CONFIG_PM
-static int sdhci_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+static int sdhci_pci_suspend(struct device *dev)
 {
+        struct pci_dev *pdev = to_pci_dev(dev);
        struct sdhci_pci_chip *chip;
        struct sdhci_pci_slot *slot;
        mmc_pm_flag_t slot_pm_flags;
@@ -1010,7 +1010,7 @@ static int sdhci_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                if (!slot)
                        continue;
-                ret = sdhci_suspend_host(slot->host, state);
+                ret = sdhci_suspend_host(slot->host);
                if (ret) {
                        for (i--; i >= 0; i--)
@@ -1026,7 +1026,7 @@ static int sdhci_pci_suspend(struct pci_dev *pdev, pm_message_t state)
        }
        if (chip->fixes && chip->fixes->suspend) {
-                ret = chip->fixes->suspend(chip, state);
+                ret = chip->fixes->suspend(chip);
                if (ret) {
                        for (i = chip->num_slots - 1; i >= 0; i--)
                                sdhci_resume_host(chip->slots[i]->host);
@@ -1042,16 +1042,17 @@ static int sdhci_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                }
                pci_set_power_state(pdev, PCI_D3hot);
        } else {
-                pci_enable_wake(pdev, pci_choose_state(pdev, state), 0);
+                pci_enable_wake(pdev, PCI_D3hot, 0);
                pci_disable_device(pdev);
-                pci_set_power_state(pdev, pci_choose_state(pdev, state));
+                pci_set_power_state(pdev, PCI_D3hot);
        }
        return 0;
 }
-static int sdhci_pci_resume(struct pci_dev *pdev)
+static int sdhci_pci_resume(struct device *dev)
 {
+        struct pci_dev *pdev = to_pci_dev(dev);
        struct sdhci_pci_chip *chip;
        struct sdhci_pci_slot *slot;
        int i, ret;
@@ -1099,7 +1100,6 @@ static int sdhci_pci_runtime_suspend(struct device *dev)
        struct pci_dev *pdev = container_of(dev, struct pci_dev, dev);
        struct sdhci_pci_chip *chip;
        struct sdhci_pci_slot *slot;
-        pm_message_t state = { .event = PM_EVENT_SUSPEND };
        int i, ret;
        chip = pci_get_drvdata(pdev);
@@ -1121,7 +1121,7 @@ static int sdhci_pci_runtime_suspend(struct device *dev)
        }
        if (chip->fixes && chip->fixes->suspend) {
-                ret = chip->fixes->suspend(chip, state);
+                ret = chip->fixes->suspend(chip);
                if (ret) {
                        for (i = chip->num_slots - 1; i >= 0; i--)
                                sdhci_runtime_resume_host(chip->slots[i]->host);
@@ -1176,6 +1176,8 @@ static int sdhci_pci_runtime_idle(struct device *dev)
 #endif
 static const struct dev_pm_ops sdhci_pci_pm_ops = {
+        .suspend = sdhci_pci_suspend,
+        .resume = sdhci_pci_resume,
        .runtime_suspend = sdhci_pci_runtime_suspend,
        .runtime_resume = sdhci_pci_runtime_resume,
        .runtime_idle = sdhci_pci_runtime_idle,
@@ -1428,8 +1430,6 @@ static struct pci_driver sdhci_driver = {
        .id_table =     pci_ids,
        .probe =        sdhci_pci_probe,
        .remove =       __devexit_p(sdhci_pci_remove),
-        .suspend =      sdhci_pci_suspend,
-        .resume =       sdhci_pci_resume,
        .driver =       {
                .pm =   &sdhci_pci_pm_ops
        },
diff --git a/drivers/mmc/host/sdhci-pltfm.c b/drivers/mmc/host/sdhci-pltfm.c
index a9e12ea0558..03970bcb349 100644
--- a/drivers/mmc/host/sdhci-pltfm.c
+++ b/drivers/mmc/host/sdhci-pltfm.c
@@ -194,21 +194,25 @@ int sdhci_pltfm_unregister(struct platform_device *pdev)
 EXPORT_SYMBOL_GPL(sdhci_pltfm_unregister);
 #ifdef CONFIG_PM
-int sdhci_pltfm_suspend(struct platform_device *dev, pm_message_t state)
+static int sdhci_pltfm_suspend(struct device *dev)
 {
-        struct sdhci_host *host = platform_get_drvdata(dev);
+        struct sdhci_host *host = dev_get_drvdata(dev);
-        return sdhci_suspend_host(host, state);
+        return sdhci_suspend_host(host);
 }
-EXPORT_SYMBOL_GPL(sdhci_pltfm_suspend);
-int sdhci_pltfm_resume(struct platform_device *dev)
+static int sdhci_pltfm_resume(struct device *dev)
 {
-        struct sdhci_host *host = platform_get_drvdata(dev);
+        struct sdhci_host *host = dev_get_drvdata(dev);
        return sdhci_resume_host(host);
 }
-EXPORT_SYMBOL_GPL(sdhci_pltfm_resume);
+const struct dev_pm_ops sdhci_pltfm_pmops = {
+        .suspend        = sdhci_pltfm_suspend,
+        .resume         = sdhci_pltfm_resume,
+};
+EXPORT_SYMBOL_GPL(sdhci_pltfm_pmops);
 #endif  /* CONFIG_PM */
 static int __init sdhci_pltfm_drv_init(void)
diff --git a/drivers/mmc/host/sdhci-pltfm.h b/drivers/mmc/host/sdhci-pltfm.h
index 3a9fc3f4084..37e0e184a0b 100644
--- a/drivers/mmc/host/sdhci-pltfm.h
+++ b/drivers/mmc/host/sdhci-pltfm.h
@@ -99,8 +99,10 @@ extern int sdhci_pltfm_register(struct platform_device *pdev,
 extern int sdhci_pltfm_unregister(struct platform_device *pdev);
 #ifdef CONFIG_PM
-extern int sdhci_pltfm_suspend(struct platform_device *dev, pm_message_t state);
+extern const struct dev_pm_ops sdhci_pltfm_pmops;
-extern int sdhci_pltfm_resume(struct platform_device *dev);
+#define SDHCI_PLTFM_PMOPS (&sdhci_pltfm_pmops)
+#else
+#define SDHCI_PLTFM_PMOPS NULL
 #endif
 #endif /* _DRIVERS_MMC_SDHCI_PLTFM_H */
diff --git a/drivers/mmc/host/sdhci-pxav2.c b/drivers/mmc/host/sdhci-pxav2.c
index d4bf6d30c7b..7a039c3cb1f 100644
--- a/drivers/mmc/host/sdhci-pxav2.c
+++ b/drivers/mmc/host/sdhci-pxav2.c
@@ -218,13 +218,10 @@ static struct platform_driver sdhci_pxav2_driver = {
        .driver         = {
                .name   = "sdhci-pxav2",
                .owner  = THIS_MODULE,
+                .pm     = SDHCI_PLTFM_PMOPS,
        },
        .probe          = sdhci_pxav2_probe,
        .remove         = __devexit_p(sdhci_pxav2_remove),
-#ifdef CONFIG_PM
-        .suspend        = sdhci_pltfm_suspend,
-        .resume         = sdhci_pltfm_resume,
-#endif
 };
 static int __init sdhci_pxav2_init(void)
 {
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index cff4ad3e7a5..15673a7ee6a 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -264,13 +264,10 @@ static struct platform_driver sdhci_pxav3_driver = {
        .driver         = {
                .name   = "sdhci-pxav3",
                .owner  = THIS_MODULE,
+                .pm     = SDHCI_PLTFM_PMOPS,
        },
        .probe          = sdhci_pxav3_probe,
        .remove         = __devexit_p(sdhci_pxav3_remove),
-#ifdef CONFIG_PM
-        .suspend        = sdhci_pltfm_suspend,
-        .resume         = sdhci_pltfm_resume,
-#endif
 };
 static int __init sdhci_pxav3_init(void)
 {
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index cb60c4197e0..0d33ff0d67f 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -622,23 +622,29 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM
-static int sdhci_s3c_suspend(struct platform_device *dev, pm_message_t pm)
+static int sdhci_s3c_suspend(struct device *dev)
 {
-        struct sdhci_host *host = platform_get_drvdata(dev);
+        struct sdhci_host *host = dev_get_drvdata(dev);
-        return sdhci_suspend_host(host, pm);
+        return sdhci_suspend_host(host);
 }
-static int sdhci_s3c_resume(struct platform_device *dev)
+static int sdhci_s3c_resume(struct device *dev)
 {
-        struct sdhci_host *host = platform_get_drvdata(dev);
+        struct sdhci_host *host = dev_get_drvdata(dev);
        return sdhci_resume_host(host);
 }
+static const struct dev_pm_ops sdhci_s3c_pmops = {
+        .suspend        = sdhci_s3c_suspend,
+        .resume         = sdhci_s3c_resume,
+};
+#define SDHCI_S3C_PMOPS (&sdhci_s3c_pmops)
 #else
-#define sdhci_s3c_suspend NULL
+#define SDHCI_S3C_PMOPS NULL
-#define sdhci_s3c_resume NULL
 #endif
 static struct platform_driver sdhci_s3c_driver = {
@@ -647,6 +653,7 @@ static struct platform_driver sdhci_s3c_driver = {
        .driver         = {
                .owner  = THIS_MODULE,
                .name   = "s3c-sdhci",
+                .pm     = SDHCI_S3C_PMOPS,
        },
 };
diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
index 89699e861fc..e2e18d3f949 100644
--- a/drivers/mmc/host/sdhci-tegra.c
+++ b/drivers/mmc/host/sdhci-tegra.c
@@ -318,13 +318,10 @@ static struct platform_driver sdhci_tegra_driver = {
                .name   = "sdhci-tegra",
                .owner  = THIS_MODULE,
                .of_match_table = sdhci_tegra_dt_match,
+                .pm     = SDHCI_PLTFM_PMOPS,
        },
        .probe          = sdhci_tegra_probe,
        .remove         = __devexit_p(sdhci_tegra_remove),
-#ifdef CONFIG_PM
-        .suspend        = sdhci_pltfm_suspend,
-        .resume         = sdhci_pltfm_resume,
-#endif
 };
 static int __init sdhci_tegra_init(void)
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 6d8eea32354..19ed580f2ca 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2327,7 +2327,7 @@ out:
 #ifdef CONFIG_PM
-int sdhci_suspend_host(struct sdhci_host *host, pm_message_t state)
+int sdhci_suspend_host(struct sdhci_host *host)
 {
        int ret;
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 0a5b65460d8..a04d4d0c6fd 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -374,7 +374,7 @@ extern int sdhci_add_host(struct sdhci_host *host);
 extern void sdhci_remove_host(struct sdhci_host *host, int dead);
 #ifdef CONFIG_PM
-extern int sdhci_suspend_host(struct sdhci_host *host, pm_message_t state);
+extern int sdhci_suspend_host(struct sdhci_host *host);
 extern int sdhci_resume_host(struct sdhci_host *host);
 extern void sdhci_enable_irq_wakeups(struct sdhci_host *host);
 #endif
diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index e8f6e65183d..2ec978bc32b 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -259,7 +259,7 @@ static int firmware_rom_wait_states = 0x04;
 static int firmware_rom_wait_states = 0x1C;
 #endif
-module_param(firmware_rom_wait_states, bool, 0644);
+module_param(firmware_rom_wait_states, int, 0644);
 MODULE_PARM_DESC(firmware_rom_wait_states,
                 "ROM wait states byte=RRRIIEEE (Reserved Internal External)");
diff --git a/drivers/mtd/maps/plat-ram.c b/drivers/mtd/maps/plat-ram.c
index 94f55348972..45876d0e5b8 100644
--- a/drivers/mtd/maps/plat-ram.c
+++ b/drivers/mtd/maps/plat-ram.c
@@ -227,10 +227,14 @@ static int platram_probe(struct platform_device *pdev)
        if (!err)
                dev_info(&pdev->dev, "registered mtd device\n");
-        /* add the whole device. */
+        if (pdata->nr_partitions) {
-        err = mtd_device_register(info->mtd, NULL, 0);
+                /* add the whole device. */
-        if (err)
+                err = mtd_device_register(info->mtd, NULL, 0);
-                dev_err(&pdev->dev, "failed to register the entire device\n");
+                if (err) {
+                        dev_err(&pdev->dev,
+                                "failed to register the entire device\n");
+                }
+        }
        return err;
diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
index 411a17df9fc..2a25b6789af 100644
--- a/drivers/mtd/maps/pxa2xx-flash.c
+++ b/drivers/mtd/maps/pxa2xx-flash.c
@@ -98,7 +98,7 @@ static int __devinit pxa2xx_flash_probe(struct platform_device *pdev)
        }
        info->mtd->owner = THIS_MODULE;
-        mtd_device_parse_register(info->mtd, probes, 0, NULL, 0);
+        mtd_device_parse_register(info->mtd, probes, 0, flash->parts, flash->nr_parts);
        platform_set_drvdata(pdev, info);
        return 0;
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 071b63420f0..493ec2fcf97 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -21,9 +21,9 @@
 #include <linux/clk.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
 #include <linux/mtd/gpmi-nand.h>
 #include <linux/mtd/partitions.h>
 #include "gpmi-nand.h"
 /* add our owner bbt descriptor */
diff --git a/drivers/mtd/nand/ndfc.c b/drivers/mtd/nand/ndfc.c
index ee1713907b9..f8aacf48ecd 100644
--- a/drivers/mtd/nand/ndfc.c
+++ b/drivers/mtd/nand/ndfc.c
@@ -188,7 +188,7 @@ static int ndfc_chip_init(struct ndfc_controller *ndfc,
        if (!flash_np)
                return -ENODEV;
-        ppdata->of_node = flash_np;
+        ppdata.of_node = flash_np;
        ndfc->mtd.name = kasprintf(GFP_KERNEL, "%s.%s",
                        dev_name(&ndfc->ofdev->dev), flash_np->name);
        if (!ndfc->mtd.name) {
diff --git a/drivers/net/ethernet/freescale/Kconfig b/drivers/net/ethernet/freescale/Kconfig
index 5272f9d4dda..9de37642f09 100644
--- a/drivers/net/ethernet/freescale/Kconfig
+++ b/drivers/net/ethernet/freescale/Kconfig
@@ -23,8 +23,8 @@ if NET_VENDOR_FREESCALE
 config FEC
        bool "FEC ethernet controller (of ColdFire and some i.MX CPUs)"
        depends on (M523x || M527x || M5272 || M528x || M520x || M532x || \
-                   ARCH_MXC || ARCH_MXS)
+                   ARCH_MXC || SOC_IMX28)
-        default ARCH_MXC || ARCH_MXS if ARM
+        default ARCH_MXC || SOC_IMX28 if ARM
        select PHYLIB
        ---help---
          Say Y here if you want to use the built-in 10/100 Fast ethernet
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index c7b60839ac9..dea0cb4400e 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -2606,6 +2606,9 @@ static int skge_up(struct net_device *dev)
        spin_unlock_irq(&hw->hw_lock);
        napi_enable(&skge->napi);
+        skge_set_multicast(dev);
        return 0;
 free_tx_ring:
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
index 227997d775e..5829e0b47e7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
@@ -147,6 +147,7 @@ void mlx4_en_destroy_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq)
        mlx4_free_hwq_res(mdev->dev, &cq->wqres, cq->buf_size);
        if (priv->mdev->dev->caps.comp_pool && cq->vector)
                mlx4_release_eq(priv->mdev->dev, cq->vector);
+        cq->vector = 0;
        cq->buf_size = 0;
        cq->buf = NULL;
 }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 67bf0781999..c8f47f17186 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -477,7 +477,6 @@ enum rtl_register_content {
        /* Config1 register p.24 */
        LEDS1           = (1 << 7),
        LEDS0           = (1 << 6),
-        MSIEnable       = (1 << 5),     /* Enable Message Signaled Interrupt */
        Speed_down      = (1 << 4),
        MEMMAP          = (1 << 3),
        IOMAP           = (1 << 2),
@@ -485,6 +484,7 @@ enum rtl_register_content {
        PMEnable        = (1 << 0),     /* Power Management Enable */
        /* Config2 register p. 25 */
+        MSIEnable       = (1 << 5),     /* 8169 only. Reserved in the 8168. */
        PCI_Clock_66MHz = 0x01,
        PCI_Clock_33MHz = 0x00,
@@ -3426,22 +3426,24 @@ static const struct rtl_cfg_info {
 };
 /* Cfg9346_Unlock assumed. */
-static unsigned rtl_try_msi(struct pci_dev *pdev, void __iomem *ioaddr,
+static unsigned rtl_try_msi(struct rtl8169_private *tp,
                            const struct rtl_cfg_info *cfg)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
        unsigned msi = 0;
        u8 cfg2;
        cfg2 = RTL_R8(Config2) & ~MSIEnable;
        if (cfg->features & RTL_FEATURE_MSI) {
-                if (pci_enable_msi(pdev)) {
+                if (pci_enable_msi(tp->pci_dev)) {
-                        dev_info(&pdev->dev, "no MSI. Back to INTx.\n");
+                        netif_info(tp, hw, tp->dev, "no MSI. Back to INTx.\n");
                } else {
                        cfg2 |= MSIEnable;
                        msi = RTL_FEATURE_MSI;
                }
        }
-        RTL_W8(Config2, cfg2);
+        if (tp->mac_version <= RTL_GIGA_MAC_VER_06)
+                RTL_W8(Config2, cfg2);
        return msi;
 }
@@ -4077,7 +4079,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                tp->features |= RTL_FEATURE_WOL;
        if ((RTL_R8(Config5) & (UWF | BWF | MWF)) != 0)
                tp->features |= RTL_FEATURE_WOL;
-        tp->features |= rtl_try_msi(pdev, ioaddr, cfg);
+        tp->features |= rtl_try_msi(tp, cfg);
        RTL_W8(Cfg9346, Cfg9346_Lock);
        if (rtl_tbi_enabled(tp)) {
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index dca9d3369cd..c97d2f59085 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -836,11 +836,13 @@ int cpdma_chan_stop(struct cpdma_chan *chan)
        chan_write(chan, cp, CPDMA_TEARDOWN_VALUE);
        /* handle completed packets */
+        spin_unlock_irqrestore(&chan->lock, flags);
        do {
                ret = __cpdma_chan_process(chan);
                if (ret < 0)
                        break;
        } while ((ret & CPDMA_DESC_TD_COMPLETE) == 0);
+        spin_lock_irqsave(&chan->lock, flags);
        /* remaining packets haven't been tx/rx'ed, clean them up */
        while (chan->head) {
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index e6fed4d4cb7..e95f0e60a9b 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1655,6 +1655,10 @@ static const struct usb_device_id	products [] = {
        // ASIX 88772a
        USB_DEVICE(0x0db0, 0xa877),
        .driver_info = (unsigned long) &ax88772_info,
+}, {
+        // Asus USB Ethernet Adapter
+        USB_DEVICE (0x0b95, 0x7e2b),
+        .driver_info = (unsigned long) &ax88772_info,
 },
        { },            // END
 };
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index d2348a5a780..a9c5ae75277 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1843,6 +1843,9 @@ static void ath9k_sta_notify(struct ieee80211_hw *hw,
        struct ath_softc *sc = hw->priv;
        struct ath_node *an = (struct ath_node *) sta->drv_priv;
+        if (!(sc->sc_flags & SC_OP_TXAGGR))
+                return;
        switch (cmd) {
        case STA_NOTIFY_SLEEP:
                an->sleeping = true;
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 888abc2be3a..528d5f3e868 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1271,7 +1271,9 @@ static void ath_rc_init(struct ath_softc *sc,
        ath_rc_priv->max_valid_rate = k;
        ath_rc_sort_validrates(rate_table, ath_rc_priv);
-        ath_rc_priv->rate_max_phy = ath_rc_priv->valid_rate_index[k-4];
+        ath_rc_priv->rate_max_phy = (k > 4) ?
+                                        ath_rc_priv->valid_rate_index[k-4] :
+                                        ath_rc_priv->valid_rate_index[k-1];
        ath_rc_priv->rate_table = rate_table;
        ath_dbg(common, ATH_DBG_CONFIG,
diff --git a/drivers/net/wireless/b43/pio.c b/drivers/net/wireless/b43/pio.c
index fcff923b3c1..279a53eae4c 100644
--- a/drivers/net/wireless/b43/pio.c
+++ b/drivers/net/wireless/b43/pio.c
@@ -617,9 +617,19 @@ static bool pio_rx_frame(struct b43_pio_rxqueue *q)
        const char *err_msg = NULL;
        struct b43_rxhdr_fw4 *rxhdr =
                (struct b43_rxhdr_fw4 *)wl->pio_scratchspace;
+        size_t rxhdr_size = sizeof(*rxhdr);
        BUILD_BUG_ON(sizeof(wl->pio_scratchspace) < sizeof(*rxhdr));
-        memset(rxhdr, 0, sizeof(*rxhdr));
+        switch (dev->fw.hdr_format) {
+        case B43_FW_HDR_410:
+        case B43_FW_HDR_351:
+                rxhdr_size -= sizeof(rxhdr->format_598) -
+                        sizeof(rxhdr->format_351);
+                break;
+        case B43_FW_HDR_598:
+                break;
+        }
+        memset(rxhdr, 0, rxhdr_size);
        /* Check if we have data and wait for it to get ready. */
        if (q->rev >= 8) {
@@ -657,11 +667,11 @@ data_ready:
        /* Get the preamble (RX header) */
        if (q->rev >= 8) {
-                b43_block_read(dev, rxhdr, sizeof(*rxhdr),
+                b43_block_read(dev, rxhdr, rxhdr_size,
                               q->mmio_base + B43_PIO8_RXDATA,
                               sizeof(u32));
        } else {
-                b43_block_read(dev, rxhdr, sizeof(*rxhdr),
+                b43_block_read(dev, rxhdr, rxhdr_size,
                               q->mmio_base + B43_PIO_RXDATA,
                               sizeof(u16));
        }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
index a7a6def40d0..5c7c17c7166 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -606,8 +606,8 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
                        if (ctx->ht.enabled) {
                                /* if HT40 is used, it should not change
                                 * after associated except channel switch */
-                                if (iwl_is_associated_ctx(ctx) &&
+                                if (!ctx->ht.is_40mhz ||
-                                     !ctx->ht.is_40mhz)
+                                                !iwl_is_associated_ctx(ctx))
                                        iwlagn_config_ht40(conf, ctx);
                        } else
                                ctx->ht.is_40mhz = false;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 35a6b71f358..df1540ca610 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -91,7 +91,10 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
                tx_cmd->tid_tspec = qc[0] & 0xf;
                tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
        } else {
-                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+                if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
+                        tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+                else
+                        tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
        }
        iwlagn_tx_cmd_protection(priv, info, fc, &tx_flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index bacc06c95e7..e0e9a3dfbc0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2850,6 +2850,9 @@ static int iwlagn_mac_tx_sync(struct ieee80211_hw *hw,
        int ret;
        u8 sta_id;
+        if (ctx->ctxid != IWL_RXON_CTX_PAN)
+                return 0;
        IWL_DEBUG_MAC80211(priv, "enter\n");
        mutex_lock(&priv->shrd->mutex);
@@ -2898,6 +2901,9 @@ static void iwlagn_mac_finish_tx_sync(struct ieee80211_hw *hw,
        struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
        struct iwl_rxon_context *ctx = vif_priv->ctx;
+        if (ctx->ctxid != IWL_RXON_CTX_PAN)
+                return;
        IWL_DEBUG_MAC80211(priv, "enter\n");
        mutex_lock(&priv->shrd->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
index ce918980e97..5f17ab8e76b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -1197,9 +1197,7 @@ static int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
        iwl_print_hex_dump(trans, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
        /* Set up entry for this TFD in Tx byte-count array */
-        if (is_agg)
+        iwl_trans_txq_update_byte_cnt_tbl(trans, txq, le16_to_cpu(tx_cmd->len));
-                iwl_trans_txq_update_byte_cnt_tbl(trans, txq,
-                                               le16_to_cpu(tx_cmd->len));
        dma_sync_single_for_device(bus(trans)->dev, txcmd_phys, firstlen,
                        DMA_BIDIRECTIONAL);
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index ac278156d39..6e0a3eaecf7 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -939,7 +939,6 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
 {
        struct cmd_ctrl_node *cmd_node = NULL, *tmp_node = NULL;
        unsigned long cmd_flags;
-        unsigned long cmd_pending_q_flags;
        unsigned long scan_pending_q_flags;
        uint16_t cancel_scan_cmd = false;
@@ -949,12 +948,9 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
                cmd_node = adapter->curr_cmd;
                cmd_node->wait_q_enabled = false;
                cmd_node->cmd_flag |= CMD_F_CANCELED;
-                spin_lock_irqsave(&adapter->cmd_pending_q_lock,
-                                  cmd_pending_q_flags);
-                list_del(&cmd_node->list);
-                spin_unlock_irqrestore(&adapter->cmd_pending_q_lock,
-                                       cmd_pending_q_flags);
                mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                mwifiex_complete_cmd(adapter, adapter->curr_cmd);
+                adapter->curr_cmd = NULL;
                spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
        }
@@ -981,7 +977,6 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
                spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
        }
        adapter->cmd_wait_q.status = -1;
-        mwifiex_complete_cmd(adapter, adapter->curr_cmd);
 }
 /*
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index ea4a29b7e33..1679c2593b7 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -55,9 +55,14 @@ int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
 {
        bool cancel_flag = false;
        int status = adapter->cmd_wait_q.status;
-        struct cmd_ctrl_node *cmd_queued = adapter->cmd_queued;
+        struct cmd_ctrl_node *cmd_queued;
+        if (!adapter->cmd_queued)
+                return 0;
+        cmd_queued = adapter->cmd_queued;
        adapter->cmd_queued = NULL;
        dev_dbg(adapter->dev, "cmd pending\n");
        atomic_inc(&adapter->cmd_pending);
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index cbd5d701c7e..63b3ec48c20 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -314,7 +314,7 @@ static const struct of_dev_auxdata *of_dev_lookup(const struct of_dev_auxdata *l
        if (!lookup)
                return NULL;
-        for(; lookup->name != NULL; lookup++) {
+        for(; lookup->compatible != NULL; lookup++) {
                if (!of_device_is_compatible(np, lookup->compatible))
                        continue;
                if (of_address_to_resource(np, 0, &res))
diff --git a/drivers/oprofile/oprofile_files.c b/drivers/oprofile/oprofile_files.c
index 89f63456646..84a208dbed9 100644
--- a/drivers/oprofile/oprofile_files.c
+++ b/drivers/oprofile/oprofile_files.c
@@ -45,7 +45,7 @@ static ssize_t timeout_write(struct file *file, char const __user *buf,
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        retval = oprofile_set_timeout(val);
@@ -84,7 +84,7 @@ static ssize_t depth_write(struct file *file, char const __user *buf, size_t cou
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        retval = oprofile_set_ulong(&oprofile_backtrace_depth, val);
@@ -141,9 +141,10 @@ static ssize_t enable_write(struct file *file, char const __user *buf, size_t co
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&val, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
+        retval = 0;
        if (val)
                retval = oprofile_start();
        else
diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
index d0de6cc2d7a..2f0aa0f700e 100644
--- a/drivers/oprofile/oprofilefs.c
+++ b/drivers/oprofile/oprofilefs.c
@@ -60,6 +60,13 @@ ssize_t oprofilefs_ulong_to_user(unsigned long val, char __user *buf, size_t cou
 }
+/*
+ * Note: If oprofilefs_ulong_from_user() returns 0, then *val remains
+ * unchanged and might be uninitialized. This follows write syscall
+ * implementation when count is zero: "If count is zero ... [and if]
+ * no errors are detected, 0 will be returned without causing any
+ * other effect." (man 2 write)
+ */
 int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_t count)
 {
        char tmpbuf[TMPBUFSIZE];
@@ -79,7 +86,7 @@ int oprofilefs_ulong_from_user(unsigned long *val, char const __user *buf, size_
        raw_spin_lock_irqsave(&oprofilefs_lock, flags);
        *val = simple_strtoul(tmpbuf, NULL, 0);
        raw_spin_unlock_irqrestore(&oprofilefs_lock, flags);
-        return 0;
+        return count;
 }
@@ -99,7 +106,7 @@ static ssize_t ulong_write_file(struct file *file, char const __user *buf, size_
                return -EINVAL;
        retval = oprofilefs_ulong_from_user(&value, buf, count);
-        if (retval)
+        if (retval <= 0)
                return retval;
        retval = oprofile_set_ulong(file->private_data, value);
diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c
index 7ec56fb0bd7..b0dd08e6a9d 100644
--- a/drivers/pci/ats.c
+++ b/drivers/pci/ats.c
@@ -13,6 +13,7 @@
 #include <linux/export.h>
 #include <linux/pci-ats.h>
 #include <linux/pci.h>
+#include <linux/slab.h>
 #include "pci.h"
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index fce1c54a0c8..9ddf69e3bbe 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -132,6 +132,18 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)
        if (!acpi_pci_check_ejectable(pbus, handle) && !is_dock_device(handle))
                return AE_OK;
+        pdev = pbus->self;
+        if (pdev && pci_is_pcie(pdev)) {
+                tmp = acpi_find_root_bridge_handle(pdev);
+                if (tmp) {
+                        struct acpi_pci_root *root = acpi_pci_find_root(tmp);
+                        if (root && (root->osc_control_set &
+                                        OSC_PCI_EXPRESS_NATIVE_HP_CONTROL))
+                                return AE_OK;
+                }
+        }
        acpi_evaluate_integer(handle, "_ADR", NULL, &adr);
        device = (adr >> 16) & 0xffff;
        function = adr & 0xffff;
@@ -213,7 +225,6 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)
        pdev = pci_get_slot(pbus, PCI_DEVFN(device, function));
        if (pdev) {
-                pdev->current_state = PCI_D0;
                slot->flags |= (SLOT_ENABLED | SLOT_POWEREDON);
                pci_dev_put(pdev);
        }
@@ -459,17 +470,8 @@ static int add_bridge(acpi_handle handle)
 {
        acpi_status status;
        unsigned long long tmp;
-        struct acpi_pci_root *root;
        acpi_handle dummy_handle;
-        /*
-         * We shouldn't use this bridge if PCIe native hotplug control has been
-         * granted by the BIOS for it.
-         */
-        root = acpi_pci_find_root(handle);
-        if (root && (root->osc_control_set & OSC_PCI_EXPRESS_NATIVE_HP_CONTROL))
-                return -ENODEV;
        /* if the bridge doesn't have _STA, we assume it is always there */
        status = acpi_get_handle(handle, "_STA", &dummy_handle);
        if (ACPI_SUCCESS(status)) {
@@ -1385,19 +1387,11 @@ static void handle_hotplug_event_func(acpi_handle handle, u32 type,
 static acpi_status
 find_root_bridges(acpi_handle handle, u32 lvl, void *context, void **rv)
 {
-        struct acpi_pci_root *root;
        int *count = (int *)context;
        if (!acpi_is_root_bridge(handle))
                return AE_OK;
-        root = acpi_pci_find_root(handle);
-        if (!root)
-                return AE_OK;
-        if (root->osc_control_set & OSC_PCI_EXPRESS_NATIVE_HP_CONTROL)
-                return AE_OK;
        (*count)++;
        acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
                                    handle_hotplug_event_bridge, NULL);
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index b82c155d7b3..1969a3ee305 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -283,6 +283,7 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn)
        struct resource *res;
        struct pci_dev *pdev;
        struct pci_sriov *iov = dev->sriov;
+        int bars = 0;
        if (!nr_virtfn)
                return 0;
@@ -307,6 +308,7 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn)
        nres = 0;
        for (i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
+                bars |= (1 << (i + PCI_IOV_RESOURCES));
                res = dev->resource + PCI_IOV_RESOURCES + i;
                if (res->parent)
                        nres++;
@@ -324,6 +326,11 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn)
                return -ENOMEM;
        }
+        if (pci_enable_resources(dev, bars)) {
+                dev_err(&dev->dev, "SR-IOV: IOV BARS not allocated\n");
+                return -ENOMEM;
+        }
        if (iov->link != dev->devfn) {
                pdev = pci_get_slot(dev->bus, iov->link);
                if (!pdev)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 6f45a73c6e9..6d4a5319148 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -664,6 +664,9 @@ static int pci_platform_power_transition(struct pci_dev *dev, pci_power_t state)
                error = platform_pci_set_power_state(dev, state);
                if (!error)
                        pci_update_current_state(dev, state);
+                /* Fall back to PCI_D0 if native PM is not supported */
+                if (!dev->pm_cap)
+                        dev->current_state = PCI_D0;
        } else {
                error = -ENODEV;
                /* Fall back to PCI_D0 if native PM is not supported */
@@ -1126,7 +1129,11 @@ static int __pci_enable_device_flags(struct pci_dev *dev,
        if (atomic_add_return(1, &dev->enable_cnt) > 1)
                return 0;               /* already enabled */
-        for (i = 0; i < DEVICE_COUNT_RESOURCE; i++)
+        /* only skip sriov related */
+        for (i = 0; i <= PCI_ROM_RESOURCE; i++)
+                if (dev->resource[i].flags & flags)
+                        bars |= (1 << i);
+        for (i = PCI_BRIDGE_RESOURCES; i < DEVICE_COUNT_RESOURCE; i++)
                if (dev->resource[i].flags & flags)
                        bars |= (1 << i);
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index fa4d9f32418..8e286259a00 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -319,20 +319,6 @@ int rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
 }
 EXPORT_SYMBOL_GPL(rtc_read_alarm);
-static int ___rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
-{
-        int err;
-        if (!rtc->ops)
-                err = -ENODEV;
-        else if (!rtc->ops->set_alarm)
-                err = -EINVAL;
-        else
-                err = rtc->ops->set_alarm(rtc->dev.parent, alarm);
-        return err;
-}
 static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
 {
        struct rtc_time tm;
@@ -356,7 +342,14 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
         * over right here, before we set the alarm.
         */
-        return ___rtc_set_alarm(rtc, alarm);
+        if (!rtc->ops)
+                err = -ENODEV;
+        else if (!rtc->ops->set_alarm)
+                err = -EINVAL;
+        else
+                err = rtc->ops->set_alarm(rtc->dev.parent, alarm);
+        return err;
 }
 int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
@@ -770,20 +763,6 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer)
        return 0;
 }
-static void rtc_alarm_disable(struct rtc_device *rtc)
-{
-        struct rtc_wkalrm alarm;
-        struct rtc_time tm;
-        __rtc_read_time(rtc, &tm);
-        alarm.time = rtc_ktime_to_tm(ktime_add(rtc_tm_to_ktime(tm),
-                                     ktime_set(300, 0)));
-        alarm.enabled = 0;
-        ___rtc_set_alarm(rtc, &alarm);
-}
 /**
 * rtc_timer_remove - Removes a rtc_timer from the rtc_device timerqueue
 * @rtc rtc device
@@ -805,10 +784,8 @@ static void rtc_timer_remove(struct rtc_device *rtc, struct rtc_timer *timer)
                struct rtc_wkalrm alarm;
                int err;
                next = timerqueue_getnext(&rtc->timerqueue);
-                if (!next) {
+                if (!next)
-                        rtc_alarm_disable(rtc);
                        return;
-                }
                alarm.time = rtc_ktime_to_tm(next->expires);
                alarm.enabled = 1;
                err = __rtc_set_alarm(rtc, &alarm);
@@ -870,8 +847,7 @@ again:
                err = __rtc_set_alarm(rtc, &alarm);
                if (err == -ETIME)
                        goto again;
-        } else
+        }
-                rtc_alarm_disable(rtc);
        mutex_unlock(&rtc->ops_lock);
 }
diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
index eda128fc1d3..64aedd8cc09 100644
--- a/drivers/rtc/rtc-m41t80.c
+++ b/drivers/rtc/rtc-m41t80.c
@@ -357,10 +357,19 @@ static int m41t80_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *t)
 static struct rtc_class_ops m41t80_rtc_ops = {
        .read_time = m41t80_rtc_read_time,
        .set_time = m41t80_rtc_set_time,
+        /*
+         * XXX - m41t80 alarm functionality is reported broken.
+         * until it is fixed, don't register alarm functions.
+         *
        .read_alarm = m41t80_rtc_read_alarm,
        .set_alarm = m41t80_rtc_set_alarm,
+        */
        .proc = m41t80_rtc_proc,
+        /*
+         * See above comment on broken alarm
+         *
        .alarm_irq_enable = m41t80_rtc_alarm_irq_enable,
+        */
 };
 #if defined(CONFIG_RTC_INTF_SYSFS) || defined(CONFIG_RTC_INTF_SYSFS_MODULE)
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 11f07f88822..b79576b64f4 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -55,6 +55,10 @@ static void zfcp_scsi_slave_destroy(struct scsi_device *sdev)
 {
        struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(sdev);
+        /* if previous slave_alloc returned early, there is nothing to do */
+        if (!zfcp_sdev->port)
+                return;
        zfcp_erp_lun_shutdown_wait(sdev, "scssd_1");
        put_device(&zfcp_sdev->port->dev);
 }
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index dba72a4e6a1..1ad0b822556 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -1906,18 +1906,19 @@ static int bnx2i_queue_scsi_cmd_resp(struct iscsi_session *session,
        spin_lock(&session->lock);
        task = iscsi_itt_to_task(bnx2i_conn->cls_conn->dd_data,
                                 cqe->itt & ISCSI_CMD_RESPONSE_INDEX);
-        if (!task) {
+        if (!task || !task->sc) {
                spin_unlock(&session->lock);
                return -EINVAL;
        }
        sc = task->sc;
-        spin_unlock(&session->lock);
        if (!blk_rq_cpu_valid(sc->request))
                cpu = smp_processor_id();
        else
                cpu = sc->request->cpu;
+        spin_unlock(&session->lock);
        p = &per_cpu(bnx2i_percpu, cpu);
        spin_lock(&p->p_work_lock);
        if (unlikely(!p->iothread)) {
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index cefbe44bb84..8d67467dd9c 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -31,6 +31,8 @@
 #include <linux/sysfs.h>
 #include <linux/ctype.h>
 #include <linux/workqueue.h>
+#include <net/dcbnl.h>
+#include <net/dcbevent.h>
 #include <scsi/scsi_tcq.h>
 #include <scsi/scsicam.h>
 #include <scsi/scsi_transport.h>
@@ -101,6 +103,8 @@ static int fcoe_ddp_done(struct fc_lport *, u16);
 static int fcoe_ddp_target(struct fc_lport *, u16, struct scatterlist *,
                           unsigned int);
 static int fcoe_cpu_callback(struct notifier_block *, unsigned long, void *);
+static int fcoe_dcb_app_notification(struct notifier_block *notifier,
+                                     ulong event, void *ptr);
 static bool fcoe_match(struct net_device *netdev);
 static int fcoe_create(struct net_device *netdev, enum fip_state fip_mode);
@@ -129,6 +133,11 @@ static struct notifier_block fcoe_cpu_notifier = {
        .notifier_call = fcoe_cpu_callback,
 };
+/* notification function for DCB events */
+static struct notifier_block dcb_notifier = {
+        .notifier_call = fcoe_dcb_app_notification,
+};
 static struct scsi_transport_template *fcoe_nport_scsi_transport;
 static struct scsi_transport_template *fcoe_vport_scsi_transport;
@@ -1522,6 +1531,8 @@ int fcoe_xmit(struct fc_lport *lport, struct fc_frame *fp)
        skb_reset_network_header(skb);
        skb->mac_len = elen;
        skb->protocol = htons(ETH_P_FCOE);
+        skb->priority = port->priority;
        if (fcoe->netdev->priv_flags & IFF_802_1Q_VLAN &&
            fcoe->realdev->features & NETIF_F_HW_VLAN_TX) {
                skb->vlan_tci = VLAN_TAG_PRESENT |
@@ -1624,6 +1635,7 @@ static inline int fcoe_filter_frames(struct fc_lport *lport,
        stats->InvalidCRCCount++;
        if (stats->InvalidCRCCount < 5)
                printk(KERN_WARNING "fcoe: dropping frame with CRC error\n");
+        put_cpu();
        return -EINVAL;
 }
@@ -1746,6 +1758,7 @@ int fcoe_percpu_receive_thread(void *arg)
 */
 static void fcoe_dev_setup(void)
 {
+        register_dcbevent_notifier(&dcb_notifier);
        register_netdevice_notifier(&fcoe_notifier);
 }
@@ -1754,9 +1767,69 @@ static void fcoe_dev_setup(void)
 */
 static void fcoe_dev_cleanup(void)
 {
+        unregister_dcbevent_notifier(&dcb_notifier);
        unregister_netdevice_notifier(&fcoe_notifier);
 }
+static struct fcoe_interface *
+fcoe_hostlist_lookup_realdev_port(struct net_device *netdev)
+{
+        struct fcoe_interface *fcoe;
+        struct net_device *real_dev;
+        list_for_each_entry(fcoe, &fcoe_hostlist, list) {
+                if (fcoe->netdev->priv_flags & IFF_802_1Q_VLAN)
+                        real_dev = vlan_dev_real_dev(fcoe->netdev);
+                else
+                        real_dev = fcoe->netdev;
+                if (netdev == real_dev)
+                        return fcoe;
+        }
+        return NULL;
+}
+static int fcoe_dcb_app_notification(struct notifier_block *notifier,
+                                     ulong event, void *ptr)
+{
+        struct dcb_app_type *entry = ptr;
+        struct fcoe_interface *fcoe;
+        struct net_device *netdev;
+        struct fcoe_port *port;
+        int prio;
+        if (entry->app.selector != DCB_APP_IDTYPE_ETHTYPE)
+                return NOTIFY_OK;
+        netdev = dev_get_by_index(&init_net, entry->ifindex);
+        if (!netdev)
+                return NOTIFY_OK;
+        fcoe = fcoe_hostlist_lookup_realdev_port(netdev);
+        dev_put(netdev);
+        if (!fcoe)
+                return NOTIFY_OK;
+        if (entry->dcbx & DCB_CAP_DCBX_VER_CEE)
+                prio = ffs(entry->app.priority) - 1;
+        else
+                prio = entry->app.priority;
+        if (prio < 0)
+                return NOTIFY_OK;
+        if (entry->app.protocol == ETH_P_FIP ||
+            entry->app.protocol == ETH_P_FCOE)
+                fcoe->ctlr.priority = prio;
+        if (entry->app.protocol == ETH_P_FCOE) {
+                port = lport_priv(fcoe->ctlr.lp);
+                port->priority = prio;
+        }
+        return NOTIFY_OK;
+}
 /**
 * fcoe_device_notification() - Handler for net device events
 * @notifier: The context of the notification
@@ -1965,6 +2038,46 @@ static bool fcoe_match(struct net_device *netdev)
 }
 /**
+ * fcoe_dcb_create() - Initialize DCB attributes and hooks
+ * @netdev: The net_device object of the L2 link that should be queried
+ * @port: The fcoe_port to bind FCoE APP priority with
+ * @
+ */
+static void fcoe_dcb_create(struct fcoe_interface *fcoe)
+{
+#ifdef CONFIG_DCB
+        int dcbx;
+        u8 fup, up;
+        struct net_device *netdev = fcoe->realdev;
+        struct fcoe_port *port = lport_priv(fcoe->ctlr.lp);
+        struct dcb_app app = {
+                                .priority = 0,
+                                .protocol = ETH_P_FCOE
+                             };
+        /* setup DCB priority attributes. */
+        if (netdev && netdev->dcbnl_ops && netdev->dcbnl_ops->getdcbx) {
+                dcbx = netdev->dcbnl_ops->getdcbx(netdev);
+                if (dcbx & DCB_CAP_DCBX_VER_IEEE) {
+                        app.selector = IEEE_8021QAZ_APP_SEL_ETHERTYPE;
+                        up = dcb_ieee_getapp_mask(netdev, &app);
+                        app.protocol = ETH_P_FIP;
+                        fup = dcb_ieee_getapp_mask(netdev, &app);
+                } else {
+                        app.selector = DCB_APP_IDTYPE_ETHTYPE;
+                        up = dcb_getapp(netdev, &app);
+                        app.protocol = ETH_P_FIP;
+                        fup = dcb_getapp(netdev, &app);
+                }
+                port->priority = ffs(up) ? ffs(up) - 1 : 0;
+                fcoe->ctlr.priority = ffs(fup) ? ffs(fup) - 1 : port->priority;
+        }
+#endif
+}
+/**
 * fcoe_create() - Create a fcoe interface
 * @netdev  : The net_device object the Ethernet interface to create on
 * @fip_mode: The FIP mode for this creation
@@ -2007,6 +2120,9 @@ static int fcoe_create(struct net_device *netdev, enum fip_state fip_mode)
        /* Make this the "master" N_Port */
        fcoe->ctlr.lp = lport;
+        /* setup DCB priority attributes. */
+        fcoe_dcb_create(fcoe);
        /* add to lports list */
        fcoe_hostlist_add(lport);
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index c74c4b8e71e..e7522dcc296 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -320,6 +320,7 @@ static void fcoe_ctlr_solicit(struct fcoe_ctlr *fip, struct fcoe_fcf *fcf)
        skb_put(skb, sizeof(*sol));
        skb->protocol = htons(ETH_P_FIP);
+        skb->priority = fip->priority;
        skb_reset_mac_header(skb);
        skb_reset_network_header(skb);
        fip->send(fip, skb);
@@ -474,6 +475,7 @@ static void fcoe_ctlr_send_keep_alive(struct fcoe_ctlr *fip,
        }
        skb_put(skb, len);
        skb->protocol = htons(ETH_P_FIP);
+        skb->priority = fip->priority;
        skb_reset_mac_header(skb);
        skb_reset_network_header(skb);
        fip->send(fip, skb);
@@ -566,6 +568,7 @@ static int fcoe_ctlr_encaps(struct fcoe_ctlr *fip, struct fc_lport *lport,
        cap->fip.fip_dl_len = htons(dlen / FIP_BPW);
        skb->protocol = htons(ETH_P_FIP);
+        skb->priority = fip->priority;
        skb_reset_mac_header(skb);
        skb_reset_network_header(skb);
        return 0;
@@ -1911,6 +1914,7 @@ static void fcoe_ctlr_vn_send(struct fcoe_ctlr *fip,
        skb_put(skb, len);
        skb->protocol = htons(ETH_P_FIP);
+        skb->priority = fip->priority;
        skb_reset_mac_header(skb);
        skb_reset_network_header(skb);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 4e041f6d808..d570573b796 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -4335,7 +4335,7 @@ _scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
        /* insert into event log */
        sz = offsetof(Mpi2EventNotificationReply_t, EventData) +
             sizeof(Mpi2EventDataSasDeviceStatusChange_t);
-        event_reply = kzalloc(sz, GFP_KERNEL);
+        event_reply = kzalloc(sz, GFP_ATOMIC);
        if (!event_reply) {
                printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
                    ioc->name, __FILE__, __LINE__, __func__);
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index ac326c41e93..6465dae5883 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1762,12 +1762,31 @@ qla2x00_get_host_port_state(struct Scsi_Host *shost)
        scsi_qla_host_t *vha = shost_priv(shost);
        struct scsi_qla_host *base_vha = pci_get_drvdata(vha->hw->pdev);
-        if (!base_vha->flags.online)
+        if (!base_vha->flags.online) {
                fc_host_port_state(shost) = FC_PORTSTATE_OFFLINE;
-        else if (atomic_read(&base_vha->loop_state) == LOOP_TIMEOUT)
+                return;
-                fc_host_port_state(shost) = FC_PORTSTATE_UNKNOWN;
+        }
-        else
+        switch (atomic_read(&base_vha->loop_state)) {
+        case LOOP_UPDATE:
+                fc_host_port_state(shost) = FC_PORTSTATE_DIAGNOSTICS;
+                break;
+        case LOOP_DOWN:
+                if (test_bit(LOOP_RESYNC_NEEDED, &base_vha->dpc_flags))
+                        fc_host_port_state(shost) = FC_PORTSTATE_DIAGNOSTICS;
+                else
+                        fc_host_port_state(shost) = FC_PORTSTATE_LINKDOWN;
+                break;
+        case LOOP_DEAD:
+                fc_host_port_state(shost) = FC_PORTSTATE_LINKDOWN;
+                break;
+        case LOOP_READY:
                fc_host_port_state(shost) = FC_PORTSTATE_ONLINE;
+                break;
+        default:
+                fc_host_port_state(shost) = FC_PORTSTATE_UNKNOWN;
+                break;
+        }
 }
 static int
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 9df4787715c..f3cddd5800c 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -12,17 +12,17 @@
 * |             Level            |   Last Value Used  |     Holes      |
 * ----------------------------------------------------------------------
 * | Module Init and Probe        |       0x0116       |                |
- * | Mailbox commands             |       0x1129       |                |
+ * | Mailbox commands             |       0x112b       |                |
 * | Device Discovery             |       0x2083       |                |
 * | Queue Command and IO tracing |       0x302e       |     0x3008     |
 * | DPC Thread                   |       0x401c       |                |
 * | Async Events                 |       0x5059       |                |
- * | Timer Routines               |       0x600d       |                |
+ * | Timer Routines               |       0x6010       | 0x600e,0x600f  |
 * | User Space Interactions      |       0x709d       |                |
- * | Task Management              |       0x8041       |                |
+ * | Task Management              |       0x8041       | 0x800b         |
 * | AER/EEH                      |       0x900f       |                |
 * | Virtual Port                 |       0xa007       |                |
- * | ISP82XX Specific             |       0xb051       |                |
+ * | ISP82XX Specific             |       0xb052       |                |
 * | MultiQ                       |       0xc00b       |                |
 * | Misc                         |       0xd00b       |                |
 * ----------------------------------------------------------------------
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index ce32d8135c9..c0c11afb685 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -578,6 +578,7 @@ extern int qla82xx_check_md_needed(scsi_qla_host_t *);
 extern void qla82xx_chip_reset_cleanup(scsi_qla_host_t *);
 extern int qla82xx_mbx_beacon_ctl(scsi_qla_host_t *, int);
 extern char *qdev_state(uint32_t);
+extern void qla82xx_clear_pending_mbx(scsi_qla_host_t *);
 /* BSG related functions */
 extern int qla24xx_bsg_request(struct fc_bsg_job *);
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index f03e915f187..54ea68cec4c 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1509,7 +1509,8 @@ enable_82xx_npiv:
                                    &ha->fw_xcb_count, NULL, NULL,
                                    &ha->max_npiv_vports, NULL);
-                                if (!fw_major_version && ql2xallocfwdump)
+                                if (!fw_major_version && ql2xallocfwdump
+                                    && !IS_QLA82XX(ha))
                                        qla2x00_alloc_fw_dump(vha);
                        }
                } else {
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index dbec89622a0..a4b267e60a3 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -120,11 +120,10 @@ qla2x00_prep_cont_type0_iocb(struct scsi_qla_host *vha)
 * Returns a pointer to the continuation type 1 IOCB packet.
 */
 static inline cont_a64_entry_t *
-qla2x00_prep_cont_type1_iocb(scsi_qla_host_t *vha)
+qla2x00_prep_cont_type1_iocb(scsi_qla_host_t *vha, struct req_que *req)
 {
        cont_a64_entry_t *cont_pkt;
-        struct req_que *req = vha->req;
        /* Adjust ring index. */
        req->ring_index++;
        if (req->ring_index == req->length) {
@@ -292,7 +291,7 @@ void qla2x00_build_scsi_iocbs_64(srb_t *sp, cmd_entry_t *cmd_pkt,
                         * Five DSDs are available in the Continuation
                         * Type 1 IOCB.
                         */
-                        cont_pkt = qla2x00_prep_cont_type1_iocb(vha);
+                        cont_pkt = qla2x00_prep_cont_type1_iocb(vha, vha->req);
                        cur_dsd = (uint32_t *)cont_pkt->dseg_0_address;
                        avail_dsds = 5;
                }
@@ -684,7 +683,7 @@ qla24xx_build_scsi_iocbs(srb_t *sp, struct cmd_type_7 *cmd_pkt,
                         * Five DSDs are available in the Continuation
                         * Type 1 IOCB.
                         */
-                        cont_pkt = qla2x00_prep_cont_type1_iocb(vha);
+                        cont_pkt = qla2x00_prep_cont_type1_iocb(vha, vha->req);
                        cur_dsd = (uint32_t *)cont_pkt->dseg_0_address;
                        avail_dsds = 5;
                }
@@ -2070,7 +2069,8 @@ qla2x00_ct_iocb(srb_t *sp, ms_iocb_entry_t *ct_iocb)
                        * Five DSDs are available in the Cont.
                        * Type 1 IOCB.
                               */
-                        cont_pkt = qla2x00_prep_cont_type1_iocb(vha);
+                        cont_pkt = qla2x00_prep_cont_type1_iocb(vha,
+                            vha->hw->req_q_map[0]);
                        cur_dsd = (uint32_t *) cont_pkt->dseg_0_address;
                        avail_dsds = 5;
                        cont_iocb_prsnt = 1;
@@ -2096,6 +2096,7 @@ qla24xx_ct_iocb(srb_t *sp, struct ct_entry_24xx *ct_iocb)
        int index;
        uint16_t tot_dsds;
        scsi_qla_host_t *vha = sp->fcport->vha;
+        struct qla_hw_data *ha = vha->hw;
        struct fc_bsg_job *bsg_job = ((struct srb_ctx *)sp->ctx)->u.bsg_job;
        int loop_iterartion = 0;
        int cont_iocb_prsnt = 0;
@@ -2141,7 +2142,8 @@ qla24xx_ct_iocb(srb_t *sp, struct ct_entry_24xx *ct_iocb)
                        * Five DSDs are available in the Cont.
                        * Type 1 IOCB.
                               */
-                        cont_pkt = qla2x00_prep_cont_type1_iocb(vha);
+                        cont_pkt = qla2x00_prep_cont_type1_iocb(vha,
+                            ha->req_q_map[0]);
                        cur_dsd = (uint32_t *) cont_pkt->dseg_0_address;
                        avail_dsds = 5;
                        cont_iocb_prsnt = 1;
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 2516adf1aee..7b91b290ffd 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1741,7 +1741,7 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
                                    resid, scsi_bufflen(cp));
                                cp->result = DID_ERROR << 16 | lscsi_status;
-                                break;
+                                goto check_scsi_status;
                        }
                        if (!lscsi_status &&
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 3b3cec9f6ac..82a33533ed2 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -79,8 +79,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                mcp->mb[0] = MBS_LINK_DOWN_ERROR;
                ql_log(ql_log_warn, base_vha, 0x1004,
                    "FW hung = %d.\n", ha->flags.isp82xx_fw_hung);
-                rval = QLA_FUNCTION_FAILED;
+                return QLA_FUNCTION_TIMEOUT;
-                goto premature_exit;
        }
        /*
@@ -163,6 +162,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                                HINT_MBX_INT_PENDING) {
                                spin_unlock_irqrestore(&ha->hardware_lock,
                                        flags);
+                                ha->flags.mbox_busy = 0;
                                ql_dbg(ql_dbg_mbx, base_vha, 0x1010,
                                    "Pending mailbox timeout, exiting.\n");
                                rval = QLA_FUNCTION_TIMEOUT;
@@ -188,6 +188,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                                HINT_MBX_INT_PENDING) {
                                spin_unlock_irqrestore(&ha->hardware_lock,
                                        flags);
+                                ha->flags.mbox_busy = 0;
                                ql_dbg(ql_dbg_mbx, base_vha, 0x1012,
                                    "Pending mailbox timeout, exiting.\n");
                                rval = QLA_FUNCTION_TIMEOUT;
@@ -302,7 +303,15 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                        if (!test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) &&
                            !test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) &&
                            !test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
+                                if (IS_QLA82XX(ha)) {
+                                        ql_dbg(ql_dbg_mbx, vha, 0x112a,
+                                            "disabling pause transmit on port "
+                                            "0 & 1.\n");
+                                        qla82xx_wr_32(ha,
+                                            QLA82XX_CRB_NIU + 0x98,
+                                            CRB_NIU_XG_PAUSE_CTL_P0|
+                                            CRB_NIU_XG_PAUSE_CTL_P1);
+                                }
                                ql_log(ql_log_info, base_vha, 0x101c,
                                    "Mailbox cmd timeout occured. "
                                    "Scheduling ISP abort eeh_busy=0x%x.\n",
@@ -318,7 +327,15 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                        if (!test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) &&
                            !test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) &&
                            !test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
+                                if (IS_QLA82XX(ha)) {
+                                        ql_dbg(ql_dbg_mbx, vha, 0x112b,
+                                            "disabling pause transmit on port "
+                                            "0 & 1.\n");
+                                        qla82xx_wr_32(ha,
+                                            QLA82XX_CRB_NIU + 0x98,
+                                            CRB_NIU_XG_PAUSE_CTL_P0|
+                                            CRB_NIU_XG_PAUSE_CTL_P1);
+                                }
                                ql_log(ql_log_info, base_vha, 0x101e,
                                    "Mailbox cmd timeout occured. "
                                    "Scheduling ISP abort.\n");
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 94bded5ddce..03554934b0a 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -3817,6 +3817,20 @@ exit:
        return rval;
 }
+void qla82xx_clear_pending_mbx(scsi_qla_host_t *vha)
+{
+        struct qla_hw_data *ha = vha->hw;
+        if (ha->flags.mbox_busy) {
+                ha->flags.mbox_int = 1;
+                ha->flags.mbox_busy = 0;
+                ql_log(ql_log_warn, vha, 0x6010,
+                    "Doing premature completion of mbx command.\n");
+                if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags))
+                        complete(&ha->mbx_intr_comp);
+        }
+}
 void qla82xx_watchdog(scsi_qla_host_t *vha)
 {
        uint32_t dev_state, halt_status;
@@ -3839,9 +3853,13 @@ void qla82xx_watchdog(scsi_qla_host_t *vha)
                        qla2xxx_wake_dpc(vha);
                } else {
                        if (qla82xx_check_fw_alive(vha)) {
+                                ql_dbg(ql_dbg_timer, vha, 0x6011,
+                                    "disabling pause transmit on port 0 & 1.\n");
+                                qla82xx_wr_32(ha, QLA82XX_CRB_NIU + 0x98,
+                                    CRB_NIU_XG_PAUSE_CTL_P0|CRB_NIU_XG_PAUSE_CTL_P1);
                                halt_status = qla82xx_rd_32(ha,
                                    QLA82XX_PEG_HALT_STATUS1);
-                                ql_dbg(ql_dbg_timer, vha, 0x6005,
+                                ql_log(ql_log_info, vha, 0x6005,
                                    "dumping hw/fw registers:.\n "
                                    " PEG_HALT_STATUS1: 0x%x, PEG_HALT_STATUS2: 0x%x,.\n "
                                    " PEG_NET_0_PC: 0x%x, PEG_NET_1_PC: 0x%x,.\n "
@@ -3858,6 +3876,11 @@ void qla82xx_watchdog(scsi_qla_host_t *vha)
                                            QLA82XX_CRB_PEG_NET_3 + 0x3c),
                                    qla82xx_rd_32(ha,
                                            QLA82XX_CRB_PEG_NET_4 + 0x3c));
+                                if (LSW(MSB(halt_status)) == 0x67)
+                                        ql_log(ql_log_warn, vha, 0xb052,
+                                            "Firmware aborted with "
+                                            "error code 0x00006700. Device is "
+                                            "being reset.\n");
                                if (halt_status & HALT_STATUS_UNRECOVERABLE) {
                                        set_bit(ISP_UNRECOVERABLE,
                                            &vha->dpc_flags);
@@ -3869,16 +3892,8 @@ void qla82xx_watchdog(scsi_qla_host_t *vha)
                                }
                                qla2xxx_wake_dpc(vha);
                                ha->flags.isp82xx_fw_hung = 1;
-                                if (ha->flags.mbox_busy) {
+                                ql_log(ql_log_warn, vha, 0x6007, "Firmware hung.\n");
-                                        ha->flags.mbox_int = 1;
+                                qla82xx_clear_pending_mbx(vha);
-                                        ql_log(ql_log_warn, vha, 0x6007,
-                                            "Due to FW hung, doing "
-                                            "premature completion of mbx "
-                                            "command.\n");
-                                        if (test_bit(MBX_INTR_WAIT,
-                                            &ha->mbx_cmd_flags))
-                                                complete(&ha->mbx_intr_comp);
-                                }
                        }
                }
        }
@@ -4073,10 +4088,7 @@ qla82xx_chip_reset_cleanup(scsi_qla_host_t *vha)
                        msleep(1000);
                        if (qla82xx_check_fw_alive(vha)) {
                                ha->flags.isp82xx_fw_hung = 1;
-                                if (ha->flags.mbox_busy) {
+                                qla82xx_clear_pending_mbx(vha);
-                                        ha->flags.mbox_int = 1;
-                                        complete(&ha->mbx_intr_comp);
-                                }
                                break;
                        }
                }
diff --git a/drivers/scsi/qla2xxx/qla_nx.h b/drivers/scsi/qla2xxx/qla_nx.h
index 57820c199bc..57a226be339 100644
--- a/drivers/scsi/qla2xxx/qla_nx.h
+++ b/drivers/scsi/qla2xxx/qla_nx.h
@@ -1173,4 +1173,8 @@ struct qla82xx_md_entry_queue {
 static const int MD_MIU_TEST_AGT_RDDATA[] = { 0x410000A8, 0x410000AC,
        0x410000B8, 0x410000BC };
+#define CRB_NIU_XG_PAUSE_CTL_P0        0x1
+#define CRB_NIU_XG_PAUSE_CTL_P1        0x8
 #endif
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index fd14c7bfc62..f9e5b85e84d 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -201,12 +201,12 @@ MODULE_PARM_DESC(ql2xmdcapmask,
                "Set the Minidump driver capture mask level. "
                "Default is 0x7F - Can be set to 0x3, 0x7, 0xF, 0x1F, 0x7F.");
-int ql2xmdenable;
+int ql2xmdenable = 1;
 module_param(ql2xmdenable, int, S_IRUGO);
 MODULE_PARM_DESC(ql2xmdenable,
                "Enable/disable MiniDump. "
-                "0 (Default) - MiniDump disabled. "
+                "0 - MiniDump disabled. "
-                "1 - MiniDump enabled.");
+                "1 (Default) - MiniDump enabled.");
 /*
 * SCSI host template entry points
@@ -423,6 +423,7 @@ fail2:
        qla25xx_delete_queues(vha);
        destroy_workqueue(ha->wq);
        ha->wq = NULL;
+        vha->req = ha->req_q_map[0];
 fail:
        ha->mqenable = 0;
        kfree(ha->req_q_map);
@@ -814,49 +815,6 @@ qla2x00_wait_for_chip_reset(scsi_qla_host_t *vha)
        return return_status;
 }
-/*
- * qla2x00_wait_for_loop_ready
- *    Wait for MAX_LOOP_TIMEOUT(5 min) value for loop
- *    to be in LOOP_READY state.
- * Input:
- *     ha - pointer to host adapter structure
- *
- * Note:
- *    Does context switching-Release SPIN_LOCK
- *    (if any) before calling this routine.
- *
- *
- * Return:
- *    Success (LOOP_READY) : 0
- *    Failed  (LOOP_NOT_READY) : 1
- */
-static inline int
-qla2x00_wait_for_loop_ready(scsi_qla_host_t *vha)
-{
-        int      return_status = QLA_SUCCESS;
-        unsigned long loop_timeout ;
-        struct qla_hw_data *ha = vha->hw;
-        scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
-        /* wait for 5 min at the max for loop to be ready */
-        loop_timeout = jiffies + (MAX_LOOP_TIMEOUT * HZ);
-        while ((!atomic_read(&base_vha->loop_down_timer) &&
-            atomic_read(&base_vha->loop_state) == LOOP_DOWN) ||
-            atomic_read(&base_vha->loop_state) != LOOP_READY) {
-                if (atomic_read(&base_vha->loop_state) == LOOP_DEAD) {
-                        return_status = QLA_FUNCTION_FAILED;
-                        break;
-                }
-                msleep(1000);
-                if (time_after_eq(jiffies, loop_timeout)) {
-                        return_status = QLA_FUNCTION_FAILED;
-                        break;
-                }
-        }
-        return (return_status);
-}
 static void
 sp_get(struct srb *sp)
 {
@@ -1035,12 +993,6 @@ __qla2xxx_eh_generic_reset(char *name, enum nexus_wait_type type,
                    "Wait for hba online failed for cmd=%p.\n", cmd);
                goto eh_reset_failed;
        }
-        err = 1;
-        if (qla2x00_wait_for_loop_ready(vha) != QLA_SUCCESS) {
-                ql_log(ql_log_warn, vha, 0x800b,
-                    "Wait for loop ready failed for cmd=%p.\n", cmd);
-                goto eh_reset_failed;
-        }
        err = 2;
        if (do_reset(fcport, cmd->device->lun, cmd->request->cpu + 1)
                != QLA_SUCCESS) {
@@ -1137,10 +1089,9 @@ qla2xxx_eh_bus_reset(struct scsi_cmnd *cmd)
                goto eh_bus_reset_done;
        }
-        if (qla2x00_wait_for_loop_ready(vha) == QLA_SUCCESS) {
+        if (qla2x00_loop_reset(vha) == QLA_SUCCESS)
-                if (qla2x00_loop_reset(vha) == QLA_SUCCESS)
+                ret = SUCCESS;
-                        ret = SUCCESS;
-        }
        if (ret == FAILED)
                goto eh_bus_reset_done;
@@ -1206,15 +1157,6 @@ qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
        if (qla2x00_wait_for_reset_ready(vha) != QLA_SUCCESS)
                goto eh_host_reset_lock;
-        /*
-         * Fixme-may be dpc thread is active and processing
-         * loop_resync,so wait a while for it to
-         * be completed and then issue big hammer.Otherwise
-         * it may cause I/O failure as big hammer marks the
-         * devices as lost kicking of the port_down_timer
-         * while dpc is stuck for the mailbox to complete.
-         */
-        qla2x00_wait_for_loop_ready(vha);
        if (vha != base_vha) {
                if (qla2x00_vp_abort_isp(vha))
                        goto eh_host_reset_lock;
@@ -1297,16 +1239,13 @@ qla2x00_loop_reset(scsi_qla_host_t *vha)
                atomic_set(&vha->loop_state, LOOP_DOWN);
                atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
                qla2x00_mark_all_devices_lost(vha, 0);
-                qla2x00_wait_for_loop_ready(vha);
        }
        if (ha->flags.enable_lip_reset) {
                ret = qla2x00_lip_reset(vha);
-                if (ret != QLA_SUCCESS) {
+                if (ret != QLA_SUCCESS)
                        ql_dbg(ql_dbg_taskm, vha, 0x802e,
                            "lip_reset failed (%d).\n", ret);
-                } else
-                        qla2x00_wait_for_loop_ready(vha);
        }
        /* Issue marker command only when we are going to start the I/O */
@@ -4070,13 +4009,8 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
                /* For ISP82XX complete any pending mailbox cmd */
                if (IS_QLA82XX(ha)) {
                        ha->flags.isp82xx_fw_hung = 1;
-                        if (ha->flags.mbox_busy) {
+                        ql_dbg(ql_dbg_aer, vha, 0x9001, "Pci channel io frozen\n");
-                                ha->flags.mbox_int = 1;
+                        qla82xx_clear_pending_mbx(vha);
-                                ql_dbg(ql_dbg_aer, vha, 0x9001,
-                                    "Due to pci channel io frozen, doing premature "
-                                    "completion of mbx command.\n");
-                                complete(&ha->mbx_intr_comp);
-                        }
                }
                qla2x00_free_irqs(vha);
                pci_disable_device(pdev);
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 13b6357c1fa..23f33a6d52d 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
 * Driver version
 */
-#define QLA2XXX_VERSION      "8.03.07.07-k"
+#define QLA2XXX_VERSION      "8.03.07.12-k"
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    3
diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index ace637bf254..fd5edc6e166 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -147,7 +147,7 @@
 #define ISCSI_ALIAS_SIZE                32      /* ISCSI Alias name size */
 #define ISCSI_NAME_SIZE                 0xE0    /* ISCSI Name size */
-#define QL4_SESS_RECOVERY_TMO           30      /* iSCSI session */
+#define QL4_SESS_RECOVERY_TMO           120     /* iSCSI session */
                                                /* recovery timeout */
 #define LSDW(x) ((u32)((u64)(x)))
@@ -173,6 +173,8 @@
 #define ISNS_DEREG_TOV                  5
 #define HBA_ONLINE_TOV                  30
 #define DISABLE_ACB_TOV                 30
+#define IP_CONFIG_TOV                   30
+#define LOGIN_TOV                       12
 #define MAX_RESET_HA_RETRIES            2
@@ -240,6 +242,45 @@ struct ddb_entry {
        uint16_t fw_ddb_index;  /* DDB firmware index */
        uint32_t fw_ddb_device_state; /* F/W Device State  -- see ql4_fw.h */
+        uint16_t ddb_type;
+#define FLASH_DDB 0x01
+        struct dev_db_entry fw_ddb_entry;
+        int (*unblock_sess)(struct iscsi_cls_session *cls_session);
+        int (*ddb_change)(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
+                          struct ddb_entry *ddb_entry, uint32_t state);
+        /* Driver Re-login  */
+        unsigned long flags;              /* DDB Flags */
+        uint16_t default_relogin_timeout; /*  Max time to wait for
+                                           *  relogin to complete */
+        atomic_t retry_relogin_timer;     /* Min Time between relogins
+                                           * (4000 only) */
+        atomic_t relogin_timer;           /* Max Time to wait for
+                                           * relogin to complete */
+        atomic_t relogin_retry_count;     /* Num of times relogin has been
+                                           * retried */
+        uint32_t default_time2wait;       /* Default Min time between
+                                           * relogins (+aens) */
+};
+struct qla_ddb_index {
+        struct list_head list;
+        uint16_t fw_ddb_idx;
+        struct dev_db_entry fw_ddb;
+};
+#define DDB_IPADDR_LEN 64
+struct ql4_tuple_ddb {
+        int port;
+        int tpgt;
+        char ip_addr[DDB_IPADDR_LEN];
+        char iscsi_name[ISCSI_NAME_SIZE];
+        uint16_t options;
+#define DDB_OPT_IPV6 0x0e0e
+#define DDB_OPT_IPV4 0x0f0f
 };
 /*
@@ -411,7 +452,7 @@ struct scsi_qla_host {
 #define AF_FW_RECOVERY                  19 /* 0x00080000 */
 #define AF_EEH_BUSY                     20 /* 0x00100000 */
 #define AF_PCI_CHANNEL_IO_PERM_FAILURE  21 /* 0x00200000 */
+#define AF_BUILD_DDB_LIST               22 /* 0x00400000 */
        unsigned long dpc_flags;
 #define DPC_RESET_HA                    1 /* 0x00000002 */
@@ -604,6 +645,7 @@ struct scsi_qla_host {
        uint16_t bootload_minor;
        uint16_t bootload_patch;
        uint16_t bootload_build;
+        uint16_t def_timeout; /* Default login timeout */
        uint32_t flash_state;
 #define QLFLASH_WAITING         0
@@ -623,6 +665,11 @@ struct scsi_qla_host {
        uint16_t iscsi_pci_func_cnt;
        uint8_t model_name[16];
        struct completion disable_acb_comp;
+        struct dma_pool *fw_ddb_dma_pool;
+#define DDB_DMA_BLOCK_SIZE 512
+        uint16_t pri_ddb_idx;
+        uint16_t sec_ddb_idx;
+        int is_reset;
 };
 struct ql4_task_data {
@@ -835,6 +882,10 @@ static inline int ql4xxx_reset_active(struct scsi_qla_host *ha)
 /*---------------------------------------------------------------------------*/
 /* Defines for qla4xxx_initialize_adapter() and qla4xxx_recover_adapter() */
+#define INIT_ADAPTER    0
+#define RESET_ADAPTER   1
 #define PRESERVE_DDB_LIST       0
 #define REBUILD_DDB_LIST        1
diff --git a/drivers/scsi/qla4xxx/ql4_fw.h b/drivers/scsi/qla4xxx/ql4_fw.h
index cbd5a20dbbd..4ac07f88252 100644
--- a/drivers/scsi/qla4xxx/ql4_fw.h
+++ b/drivers/scsi/qla4xxx/ql4_fw.h
@@ -12,6 +12,7 @@
 #define MAX_PRST_DEV_DB_ENTRIES         64
 #define MIN_DISC_DEV_DB_ENTRY           MAX_PRST_DEV_DB_ENTRIES
 #define MAX_DEV_DB_ENTRIES              512
+#define MAX_DEV_DB_ENTRIES_40XX         256
 /*************************************************************************
 *
@@ -604,6 +605,13 @@ struct addr_ctrl_blk {
        uint8_t res14[140];     /* 274-2FF */
 };
+#define IP_ADDR_COUNT   4 /* Total 4 IP address supported in one interface
+                           * One IPv4, one IPv6 link local and 2 IPv6
+                           */
+#define IP_STATE_MASK   0x0F000000
+#define IP_STATE_SHIFT  24
 struct init_fw_ctrl_blk {
        struct addr_ctrl_blk pri;
 /*      struct addr_ctrl_blk sec;*/
diff --git a/drivers/scsi/qla4xxx/ql4_glbl.h b/drivers/scsi/qla4xxx/ql4_glbl.h
index 160db9d5ea2..d0dd4b33020 100644
--- a/drivers/scsi/qla4xxx/ql4_glbl.h
+++ b/drivers/scsi/qla4xxx/ql4_glbl.h
@@ -13,7 +13,7 @@ struct iscsi_cls_conn;
 int qla4xxx_hw_reset(struct scsi_qla_host *ha);
 int ql4xxx_lock_drvr_wait(struct scsi_qla_host *a);
 int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb *srb);
-int qla4xxx_initialize_adapter(struct scsi_qla_host *ha);
+int qla4xxx_initialize_adapter(struct scsi_qla_host *ha, int is_reset);
 int qla4xxx_soft_reset(struct scsi_qla_host *ha);
 irqreturn_t qla4xxx_intr_handler(int irq, void *dev_id);
@@ -153,10 +153,13 @@ int qla4xxx_req_ddb_entry(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
                          uint32_t *mbx_sts);
 int qla4xxx_clear_ddb_entry(struct scsi_qla_host *ha, uint32_t fw_ddb_index);
 int qla4xxx_send_passthru0(struct iscsi_task *task);
+void qla4xxx_free_ddb_index(struct scsi_qla_host *ha);
 int qla4xxx_get_mgmt_data(struct scsi_qla_host *ha, uint16_t fw_ddb_index,
                          uint16_t stats_size, dma_addr_t stats_dma);
 void qla4xxx_update_session_conn_param(struct scsi_qla_host *ha,
                                       struct ddb_entry *ddb_entry);
+void qla4xxx_update_session_conn_fwddb_param(struct scsi_qla_host *ha,
+                                             struct ddb_entry *ddb_entry);
 int qla4xxx_bootdb_by_index(struct scsi_qla_host *ha,
                            struct dev_db_entry *fw_ddb_entry,
                            dma_addr_t fw_ddb_entry_dma, uint16_t ddb_index);
@@ -169,11 +172,22 @@ int qla4xxx_set_nvram(struct scsi_qla_host *ha, dma_addr_t nvram_dma,
 int qla4xxx_restore_factory_defaults(struct scsi_qla_host *ha,
                                     uint32_t region, uint32_t field0,
                                     uint32_t field1);
+int qla4xxx_get_ddb_index(struct scsi_qla_host *ha, uint16_t *ddb_index);
+void qla4xxx_login_flash_ddb(struct iscsi_cls_session *cls_session);
+int qla4xxx_unblock_ddb(struct iscsi_cls_session *cls_session);
+int qla4xxx_unblock_flash_ddb(struct iscsi_cls_session *cls_session);
+int qla4xxx_flash_ddb_change(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
+                             struct ddb_entry *ddb_entry, uint32_t state);
+int qla4xxx_ddb_change(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
+                       struct ddb_entry *ddb_entry, uint32_t state);
+void qla4xxx_build_ddb_list(struct scsi_qla_host *ha, int is_reset);
 /* BSG Functions */
 int qla4xxx_bsg_request(struct bsg_job *bsg_job);
 int qla4xxx_process_vendor_specific(struct bsg_job *bsg_job);
+void qla4xxx_arm_relogin_timer(struct ddb_entry *ddb_entry);
 extern int ql4xextended_error_logging;
 extern int ql4xdontresethba;
 extern int ql4xenablemsix;
diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
index 3075fbaef55..1bdfa8120ac 100644
--- a/drivers/scsi/qla4xxx/ql4_init.c
+++ b/drivers/scsi/qla4xxx/ql4_init.c
@@ -773,22 +773,24 @@ int qla4xxx_start_firmware(struct scsi_qla_host *ha)
 * be freed so that when login happens from user space there are free DDB
 * indices available.
 **/
-static void qla4xxx_free_ddb_index(struct scsi_qla_host *ha)
+void qla4xxx_free_ddb_index(struct scsi_qla_host *ha)
 {
        int max_ddbs;
        int ret;
        uint32_t idx = 0, next_idx = 0;
        uint32_t state = 0, conn_err = 0;
-        max_ddbs =  is_qla40XX(ha) ? MAX_PRST_DEV_DB_ENTRIES :
+        max_ddbs =  is_qla40XX(ha) ? MAX_DEV_DB_ENTRIES_40XX :
                                     MAX_DEV_DB_ENTRIES;
        for (idx = 0; idx < max_ddbs; idx = next_idx) {
                ret = qla4xxx_get_fwddb_entry(ha, idx, NULL, 0, NULL,
                                              &next_idx, &state, &conn_err,
                                                NULL, NULL);
-                if (ret == QLA_ERROR)
+                if (ret == QLA_ERROR) {
+                        next_idx++;
                        continue;
+                }
                if (state == DDB_DS_NO_CONNECTION_ACTIVE ||
                    state == DDB_DS_SESSION_FAILED) {
                        DEBUG2(ql4_printk(KERN_INFO, ha,
@@ -804,7 +806,6 @@ static void qla4xxx_free_ddb_index(struct scsi_qla_host *ha)
        }
 }
 /**
 * qla4xxx_initialize_adapter - initiailizes hba
 * @ha: Pointer to host adapter structure.
@@ -812,7 +813,7 @@ static void qla4xxx_free_ddb_index(struct scsi_qla_host *ha)
 * This routine parforms all of the steps necessary to initialize the adapter.
 *
 **/
-int qla4xxx_initialize_adapter(struct scsi_qla_host *ha)
+int qla4xxx_initialize_adapter(struct scsi_qla_host *ha, int is_reset)
 {
        int status = QLA_ERROR;
@@ -840,7 +841,8 @@ int qla4xxx_initialize_adapter(struct scsi_qla_host *ha)
        if (status == QLA_ERROR)
                goto exit_init_hba;
-        qla4xxx_free_ddb_index(ha);
+        if (is_reset == RESET_ADAPTER)
+                qla4xxx_build_ddb_list(ha, is_reset);
        set_bit(AF_ONLINE, &ha->flags);
 exit_init_hba:
@@ -855,38 +857,12 @@ exit_init_hba:
        return status;
 }
-/**
+int qla4xxx_ddb_change(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
- * qla4xxx_process_ddb_changed - process ddb state change
+                       struct ddb_entry *ddb_entry, uint32_t state)
- * @ha - Pointer to host adapter structure.
- * @fw_ddb_index - Firmware's device database index
- * @state - Device state
- *
- * This routine processes a Decive Database Changed AEN Event.
- **/
-int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
-                uint32_t state, uint32_t conn_err)
 {
-        struct ddb_entry * ddb_entry;
        uint32_t old_fw_ddb_device_state;
        int status = QLA_ERROR;
-        /* check for out of range index */
-        if (fw_ddb_index >= MAX_DDB_ENTRIES)
-                goto exit_ddb_event;
-        /* Get the corresponging ddb entry */
-        ddb_entry = qla4xxx_lookup_ddb_by_fw_index(ha, fw_ddb_index);
-        /* Device does not currently exist in our database. */
-        if (ddb_entry == NULL) {
-                ql4_printk(KERN_ERR, ha, "%s: No ddb_entry at FW index [%d]\n",
-                           __func__, fw_ddb_index);
-                if (state == DDB_DS_NO_CONNECTION_ACTIVE)
-                        clear_bit(fw_ddb_index, ha->ddb_idx_map);
-                goto exit_ddb_event;
-        }
        old_fw_ddb_device_state = ddb_entry->fw_ddb_device_state;
        DEBUG2(ql4_printk(KERN_INFO, ha,
                          "%s: DDB - old state = 0x%x, new state = 0x%x for "
@@ -900,9 +876,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
                switch (state) {
                case DDB_DS_SESSION_ACTIVE:
                case DDB_DS_DISCOVERY:
-                        iscsi_conn_start(ddb_entry->conn);
+                        ddb_entry->unblock_sess(ddb_entry->sess);
-                        iscsi_conn_login_event(ddb_entry->conn,
-                                               ISCSI_CONN_STATE_LOGGED_IN);
                        qla4xxx_update_session_conn_param(ha, ddb_entry);
                        status = QLA_SUCCESS;
                        break;
@@ -936,9 +910,7 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
                switch (state) {
                case DDB_DS_SESSION_ACTIVE:
                case DDB_DS_DISCOVERY:
-                        iscsi_conn_start(ddb_entry->conn);
+                        ddb_entry->unblock_sess(ddb_entry->sess);
-                        iscsi_conn_login_event(ddb_entry->conn,
-                                               ISCSI_CONN_STATE_LOGGED_IN);
                        qla4xxx_update_session_conn_param(ha, ddb_entry);
                        status = QLA_SUCCESS;
                        break;
@@ -954,7 +926,198 @@ int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
                                __func__));
                break;
        }
+        return status;
+}
+void qla4xxx_arm_relogin_timer(struct ddb_entry *ddb_entry)
+{
+        /*
+         * This triggers a relogin.  After the relogin_timer
+         * expires, the relogin gets scheduled.  We must wait a
+         * minimum amount of time since receiving an 0x8014 AEN
+         * with failed device_state or a logout response before
+         * we can issue another relogin.
+         *
+         * Firmware pads this timeout: (time2wait +1).
+         * Driver retry to login should be longer than F/W.
+         * Otherwise F/W will fail
+         * set_ddb() mbx cmd with 0x4005 since it still
+         * counting down its time2wait.
+         */
+        atomic_set(&ddb_entry->relogin_timer, 0);
+        atomic_set(&ddb_entry->retry_relogin_timer,
+                   ddb_entry->default_time2wait + 4);
+}
+int qla4xxx_flash_ddb_change(struct scsi_qla_host *ha, uint32_t fw_ddb_index,
+                             struct ddb_entry *ddb_entry, uint32_t state)
+{
+        uint32_t old_fw_ddb_device_state;
+        int status = QLA_ERROR;
+        old_fw_ddb_device_state = ddb_entry->fw_ddb_device_state;
+        DEBUG2(ql4_printk(KERN_INFO, ha,
+                          "%s: DDB - old state = 0x%x, new state = 0x%x for "
+                          "index [%d]\n", __func__,
+                          ddb_entry->fw_ddb_device_state, state, fw_ddb_index));
+        ddb_entry->fw_ddb_device_state = state;
+        switch (old_fw_ddb_device_state) {
+        case DDB_DS_LOGIN_IN_PROCESS:
+        case DDB_DS_NO_CONNECTION_ACTIVE:
+                switch (state) {
+                case DDB_DS_SESSION_ACTIVE:
+                        ddb_entry->unblock_sess(ddb_entry->sess);
+                        qla4xxx_update_session_conn_fwddb_param(ha, ddb_entry);
+                        status = QLA_SUCCESS;
+                        break;
+                case DDB_DS_SESSION_FAILED:
+                        iscsi_block_session(ddb_entry->sess);
+                        if (!test_bit(DF_RELOGIN, &ddb_entry->flags))
+                                qla4xxx_arm_relogin_timer(ddb_entry);
+                        status = QLA_SUCCESS;
+                        break;
+                }
+                break;
+        case DDB_DS_SESSION_ACTIVE:
+                switch (state) {
+                case DDB_DS_SESSION_FAILED:
+                        iscsi_block_session(ddb_entry->sess);
+                        if (!test_bit(DF_RELOGIN, &ddb_entry->flags))
+                                qla4xxx_arm_relogin_timer(ddb_entry);
+                        status = QLA_SUCCESS;
+                        break;
+                }
+                break;
+        case DDB_DS_SESSION_FAILED:
+                switch (state) {
+                case DDB_DS_SESSION_ACTIVE:
+                        ddb_entry->unblock_sess(ddb_entry->sess);
+                        qla4xxx_update_session_conn_fwddb_param(ha, ddb_entry);
+                        status = QLA_SUCCESS;
+                        break;
+                case DDB_DS_SESSION_FAILED:
+                        if (!test_bit(DF_RELOGIN, &ddb_entry->flags))
+                                qla4xxx_arm_relogin_timer(ddb_entry);
+                        status = QLA_SUCCESS;
+                        break;
+                }
+                break;
+        default:
+                DEBUG2(ql4_printk(KERN_INFO, ha, "%s: Unknown Event\n",
+                                  __func__));
+                break;
+        }
+        return status;
+}
+/**
+ * qla4xxx_process_ddb_changed - process ddb state change
+ * @ha - Pointer to host adapter structure.
+ * @fw_ddb_index - Firmware's device database index
+ * @state - Device state
+ *
+ * This routine processes a Decive Database Changed AEN Event.
+ **/
+int qla4xxx_process_ddb_changed(struct scsi_qla_host *ha,
+                                uint32_t fw_ddb_index,
+                                uint32_t state, uint32_t conn_err)
+{
+        struct ddb_entry *ddb_entry;
+        int status = QLA_ERROR;
+        /* check for out of range index */
+        if (fw_ddb_index >= MAX_DDB_ENTRIES)
+                goto exit_ddb_event;
+        /* Get the corresponging ddb entry */
+        ddb_entry = qla4xxx_lookup_ddb_by_fw_index(ha, fw_ddb_index);
+        /* Device does not currently exist in our database. */
+        if (ddb_entry == NULL) {
+                ql4_printk(KERN_ERR, ha, "%s: No ddb_entry at FW index [%d]\n",
+                           __func__, fw_ddb_index);
+                if (state == DDB_DS_NO_CONNECTION_ACTIVE)
+                        clear_bit(fw_ddb_index, ha->ddb_idx_map);
+                goto exit_ddb_event;
+        }
+        ddb_entry->ddb_change(ha, fw_ddb_index, ddb_entry, state);
 exit_ddb_event:
        return status;
 }
+/**
+ * qla4xxx_login_flash_ddb - Login to target (DDB)
+ * @cls_session: Pointer to the session to login
+ *
+ * This routine logins to the target.
+ * Issues setddb and conn open mbx
+ **/
+void qla4xxx_login_flash_ddb(struct iscsi_cls_session *cls_session)
+{
+        struct iscsi_session *sess;
+        struct ddb_entry *ddb_entry;
+        struct scsi_qla_host *ha;
+        struct dev_db_entry *fw_ddb_entry = NULL;
+        dma_addr_t fw_ddb_dma;
+        uint32_t mbx_sts = 0;
+        int ret;
+        sess = cls_session->dd_data;
+        ddb_entry = sess->dd_data;
+        ha =  ddb_entry->ha;
+        if (!test_bit(AF_LINK_UP, &ha->flags))
+                return;
+        if (ddb_entry->ddb_type != FLASH_DDB) {
+                DEBUG2(ql4_printk(KERN_INFO, ha,
+                                  "Skipping login to non FLASH DB"));
+                goto exit_login;
+        }
+        fw_ddb_entry = dma_pool_alloc(ha->fw_ddb_dma_pool, GFP_KERNEL,
+                                      &fw_ddb_dma);
+        if (fw_ddb_entry == NULL) {
+                DEBUG2(ql4_printk(KERN_ERR, ha, "Out of memory\n"));
+                goto exit_login;
+        }
+        if (ddb_entry->fw_ddb_index == INVALID_ENTRY) {
+                ret = qla4xxx_get_ddb_index(ha, &ddb_entry->fw_ddb_index);
+                if (ret == QLA_ERROR)
+                        goto exit_login;
+                ha->fw_ddb_index_map[ddb_entry->fw_ddb_index] = ddb_entry;
+                ha->tot_ddbs++;
+        }
+        memcpy(fw_ddb_entry, &ddb_entry->fw_ddb_entry,
+               sizeof(struct dev_db_entry));
+        ddb_entry->sess->target_id = ddb_entry->fw_ddb_index;
+        ret = qla4xxx_set_ddb_entry(ha, ddb_entry->fw_ddb_index,
+                                    fw_ddb_dma, &mbx_sts);
+        if (ret == QLA_ERROR) {
+                DEBUG2(ql4_printk(KERN_ERR, ha, "Set DDB failed\n"));
+                goto exit_login;
+        }
+        ddb_entry->fw_ddb_device_state = DDB_DS_LOGIN_IN_PROCESS;
+        ret = qla4xxx_conn_open(ha, ddb_entry->fw_ddb_index);
+        if (ret == QLA_ERROR) {
+                ql4_printk(KERN_ERR, ha, "%s: Login failed: %s\n", __func__,
+                           sess->targetname);
+                goto exit_login;
+        }
+exit_login:
+        if (fw_ddb_entry)
+                dma_pool_free(ha->fw_ddb_dma_pool, fw_ddb_entry, fw_ddb_dma);
+}
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index 4c2b8487039..c2593782fbb 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -41,6 +41,16 @@ int qla4xxx_mailbox_command(struct scsi_qla_host *ha, uint8_t inCount,
                return status;
        }
+        if (is_qla40XX(ha)) {
+                if (test_bit(AF_HA_REMOVAL, &ha->flags)) {
+                        DEBUG2(ql4_printk(KERN_WARNING, ha, "scsi%ld: %s: "
+                                          "prematurely completing mbx cmd as "
+                                          "adapter removal detected\n",
+                                          ha->host_no, __func__));
+                        return status;
+                }
+        }
        if (is_qla8022(ha)) {
                if (test_bit(AF_FW_RECOVERY, &ha->flags)) {
                        DEBUG2(ql4_printk(KERN_WARNING, ha, "scsi%ld: %s: "
@@ -413,6 +423,7 @@ qla4xxx_update_local_ifcb(struct scsi_qla_host *ha,
        memcpy(ha->name_string, init_fw_cb->iscsi_name,
                min(sizeof(ha->name_string),
                sizeof(init_fw_cb->iscsi_name)));
+        ha->def_timeout = le16_to_cpu(init_fw_cb->def_timeout);
        /*memcpy(ha->alias, init_fw_cb->Alias,
               min(sizeof(ha->alias), sizeof(init_fw_cb->Alias)));*/
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 30f31b127f3..4169c8baa11 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -8,6 +8,7 @@
 #include <linux/slab.h>
 #include <linux/blkdev.h>
 #include <linux/iscsi_boot_sysfs.h>
+#include <linux/inet.h>
 #include <scsi/scsi_tcq.h>
 #include <scsi/scsicam.h>
@@ -31,6 +32,13 @@ static struct kmem_cache *srb_cachep;
 /*
 * Module parameter information and variables
 */
+int ql4xdisablesysfsboot = 1;
+module_param(ql4xdisablesysfsboot, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(ql4xdisablesysfsboot,
+                "Set to disable exporting boot targets to sysfs\n"
+                " 0 - Export boot targets\n"
+                " 1 - Do not export boot targets (Default)");
 int ql4xdontresethba = 0;
 module_param(ql4xdontresethba, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(ql4xdontresethba,
@@ -63,7 +71,7 @@ static int ql4xsess_recovery_tmo = QL4_SESS_RECOVERY_TMO;
 module_param(ql4xsess_recovery_tmo, int, S_IRUGO);
 MODULE_PARM_DESC(ql4xsess_recovery_tmo,
                "Target Session Recovery Timeout.\n"
-                " Default: 30 sec.");
+                " Default: 120 sec.");
 static int qla4xxx_wait_for_hba_online(struct scsi_qla_host *ha);
 /*
@@ -415,7 +423,7 @@ static int qla4xxx_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
        qla_ep = ep->dd_data;
        ha = to_qla_host(qla_ep->host);
-        if (adapter_up(ha))
+        if (adapter_up(ha) && !test_bit(AF_BUILD_DDB_LIST, &ha->flags))
                ret = 1;
        return ret;
@@ -975,6 +983,150 @@ static int qla4xxx_conn_get_param(struct iscsi_cls_conn *cls_conn,
 }
+int qla4xxx_get_ddb_index(struct scsi_qla_host *ha, uint16_t *ddb_index)
+{
+        uint32_t mbx_sts = 0;
+        uint16_t tmp_ddb_index;
+        int ret;
+get_ddb_index:
+        tmp_ddb_index = find_first_zero_bit(ha->ddb_idx_map, MAX_DDB_ENTRIES);
+        if (tmp_ddb_index >= MAX_DDB_ENTRIES) {
+                DEBUG2(ql4_printk(KERN_INFO, ha,
+                                  "Free DDB index not available\n"));
+                ret = QLA_ERROR;
+                goto exit_get_ddb_index;
+        }
+        if (test_and_set_bit(tmp_ddb_index, ha->ddb_idx_map))
+                goto get_ddb_index;
+        DEBUG2(ql4_printk(KERN_INFO, ha,
+                          "Found a free DDB index at %d\n", tmp_ddb_index));
+        ret = qla4xxx_req_ddb_entry(ha, tmp_ddb_index, &mbx_sts);
+        if (ret == QLA_ERROR) {
+                if (mbx_sts == MBOX_STS_COMMAND_ERROR) {
+                        ql4_printk(KERN_INFO, ha,
+                                   "DDB index = %d not available trying next\n",
+                                   tmp_ddb_index);
+                        goto get_ddb_index;
+                }
+                DEBUG2(ql4_printk(KERN_INFO, ha,
+                                  "Free FW DDB not available\n"));
+        }
+        *ddb_index = tmp_ddb_index;
+exit_get_ddb_index:
+        return ret;
+}
+static int qla4xxx_match_ipaddress(struct scsi_qla_host *ha,
+                                   struct ddb_entry *ddb_entry,
+                                   char *existing_ipaddr,
+                                   char *user_ipaddr)
+{
+        uint8_t dst_ipaddr[IPv6_ADDR_LEN];
+        char formatted_ipaddr[DDB_IPADDR_LEN];
+        int status = QLA_SUCCESS, ret = 0;
+        if (ddb_entry->fw_ddb_entry.options & DDB_OPT_IPV6_DEVICE) {
+                ret = in6_pton(user_ipaddr, strlen(user_ipaddr), dst_ipaddr,
+                               '\0', NULL);
+                if (ret == 0) {
+                        status = QLA_ERROR;
+                        goto out_match;
+                }
+                ret = sprintf(formatted_ipaddr, "%pI6", dst_ipaddr);
+        } else {
+                ret = in4_pton(user_ipaddr, strlen(user_ipaddr), dst_ipaddr,
+                               '\0', NULL);
+                if (ret == 0) {
+                        status = QLA_ERROR;
+                        goto out_match;
+                }
+                ret = sprintf(formatted_ipaddr, "%pI4", dst_ipaddr);
+        }
+        if (strcmp(existing_ipaddr, formatted_ipaddr))
+                status = QLA_ERROR;
+out_match:
+        return status;
+}
+static int qla4xxx_match_fwdb_session(struct scsi_qla_host *ha,
+                                      struct iscsi_cls_conn *cls_conn)
+{
+        int idx = 0, max_ddbs, rval;
+        struct iscsi_cls_session *cls_sess = iscsi_conn_to_session(cls_conn);
+        struct iscsi_session *sess, *existing_sess;
+        struct iscsi_conn *conn, *existing_conn;
+        struct ddb_entry *ddb_entry;
+        sess = cls_sess->dd_data;
+        conn = cls_conn->dd_data;
+        if (sess->targetname == NULL ||
+            conn->persistent_address == NULL ||
+            conn->persistent_port == 0)
+                return QLA_ERROR;
+        max_ddbs =  is_qla40XX(ha) ? MAX_DEV_DB_ENTRIES_40XX :
+                                     MAX_DEV_DB_ENTRIES;
+        for (idx = 0; idx < max_ddbs; idx++) {
+                ddb_entry = qla4xxx_lookup_ddb_by_fw_index(ha, idx);
+                if (ddb_entry == NULL)
+                        continue;
+                if (ddb_entry->ddb_type != FLASH_DDB)
+                        continue;
+                existing_sess = ddb_entry->sess->dd_data;
+                existing_conn = ddb_entry->conn->dd_data;
+                if (existing_sess->targetname == NULL ||
+                    existing_conn->persistent_address == NULL ||
+                    existing_conn->persistent_port == 0)
+                        continue;
+                DEBUG2(ql4_printk(KERN_INFO, ha,
+                                  "IQN = %s User IQN = %s\n",
+                                  existing_sess->targetname,
+                                  sess->targetname));
+                DEBUG2(ql4_printk(KERN_INFO, ha,
+                                  "IP = %s User IP = %s\n",
+                                  existing_conn->persistent_address,
+                                  conn->persistent_address));
+                DEBUG2(ql4_printk(KERN_INFO, ha,
+                                  "Port = %d User Port = %d\n",
+                                  existing_conn->persistent_port,
+                                  conn->persistent_port));
+                if (strcmp(existing_sess->targetname, sess->targetname))
+                        continue;
+                rval = qla4xxx_match_ipaddress(ha, ddb_entry,
+                                        existing_conn->persistent_address,
+                                        conn->persistent_address);
+                if (rval == QLA_ERROR)
+                        continue;
+                if (existing_conn->persistent_port != conn->persistent_port)
+                        continue;
+                break;
+        }
+        if (idx == max_ddbs)
+                return QLA_ERROR;
+        DEBUG2(ql4_printk(KERN_INFO, ha,
+                          "Match found in fwdb sessions\n"));
+        return QLA_SUCCESS;
+}
 static struct iscsi_cls_session *
 qla4xxx_session_create(struct iscsi_endpoint *ep,
                        uint16_t cmds_max, uint16_t qdepth,
@@ -984,8 +1136,7 @@ qla4xxx_session_create(struct iscsi_endpoint *ep,
        struct scsi_qla_host *ha;
        struct qla_endpoint *qla_ep;
        struct ddb_entry *ddb_entry;
-        uint32_t ddb_index;
+        uint16_t ddb_index;
-        uint32_t mbx_sts = 0;
        struct iscsi_session *sess;
        struct sockaddr *dst_addr;
        int ret;
@@ -1000,32 +1151,9 @@ qla4xxx_session_create(struct iscsi_endpoint *ep,
        dst_addr = (struct sockaddr *)&qla_ep->dst_addr;
        ha = to_qla_host(qla_ep->host);
-get_ddb_index:
+        ret = qla4xxx_get_ddb_index(ha, &ddb_index);
-        ddb_index = find_first_zero_bit(ha->ddb_idx_map, MAX_DDB_ENTRIES);
+        if (ret == QLA_ERROR)
-        if (ddb_index >= MAX_DDB_ENTRIES) {
-                DEBUG2(ql4_printk(KERN_INFO, ha,
-                                  "Free DDB index not available\n"));
-                return NULL;
-        }
-        if (test_and_set_bit(ddb_index, ha->ddb_idx_map))
-                goto get_ddb_index;
-        DEBUG2(ql4_printk(KERN_INFO, ha,
-                          "Found a free DDB index at %d\n", ddb_index));
-        ret = qla4xxx_req_ddb_entry(ha, ddb_index, &mbx_sts);
-        if (ret == QLA_ERROR) {
-                if (mbx_sts == MBOX_STS_COMMAND_ERROR) {
-                        ql4_printk(KERN_INFO, ha,
-                                   "DDB index = %d not available trying next\n",
-                                   ddb_index);
-                        goto get_ddb_index;
-                }
-                DEBUG2(ql4_printk(KERN_INFO, ha,
-                                  "Free FW DDB not available\n"));
                return NULL;
-        }
        cls_sess = iscsi_session_setup(&qla4xxx_iscsi_transport, qla_ep->host,
                                       cmds_max, sizeof(struct ddb_entry),
@@ -1040,6 +1168,8 @@ get_ddb_index:
        ddb_entry->fw_ddb_device_state = DDB_DS_NO_CONNECTION_ACTIVE;
        ddb_entry->ha = ha;
        ddb_entry->sess = cls_sess;
+        ddb_entry->unblock_sess = qla4xxx_unblock_ddb;
+        ddb_entry->ddb_change = qla4xxx_ddb_change;
        cls_sess->recovery_tmo = ql4xsess_recovery_tmo;
        ha->fw_ddb_index_map[ddb_entry->fw_ddb_index] = ddb_entry;
        ha->tot_ddbs++;
@@ -1077,6 +1207,9 @@ qla4xxx_conn_create(struct iscsi_cls_session *cls_sess, uint32_t conn_idx)
        DEBUG2(printk(KERN_INFO "Func: %s\n", __func__));
        cls_conn = iscsi_conn_setup(cls_sess, sizeof(struct qla_conn),
                                    conn_idx);
+        if (!cls_conn)
+                return NULL;
        sess = cls_sess->dd_data;
        ddb_entry = sess->dd_data;
        ddb_entry->conn = cls_conn;
@@ -1109,7 +1242,7 @@ static int qla4xxx_conn_start(struct iscsi_cls_conn *cls_conn)
        struct iscsi_session *sess;
        struct ddb_entry *ddb_entry;
        struct scsi_qla_host *ha;
-        struct dev_db_entry *fw_ddb_entry;
+        struct dev_db_entry *fw_ddb_entry = NULL;
        dma_addr_t fw_ddb_entry_dma;
        uint32_t mbx_sts = 0;
        int ret = 0;
@@ -1120,12 +1253,25 @@ static int qla4xxx_conn_start(struct iscsi_cls_conn *cls_conn)
        ddb_entry = sess->dd_data;
        ha = ddb_entry->ha;
+        /* Check if we have  matching FW DDB, if yes then do not
+         * login to this target. This could cause target to logout previous
+         * connection
+         */
+        ret = qla4xxx_match_fwdb_session(ha, cls_conn);
+        if (ret == QLA_SUCCESS) {
+                ql4_printk(KERN_INFO, ha,
+                           "Session already exist in FW.\n");
+                ret = -EEXIST;
+                goto exit_conn_start;
+        }
        fw_ddb_entry = dma_alloc_coherent(&ha->pdev->dev, sizeof(*fw_ddb_entry),
                                          &fw_ddb_entry_dma, GFP_KERNEL);
        if (!fw_ddb_entry) {
                ql4_printk(KERN_ERR, ha,
                           "%s: Unable to allocate dma buffer\n", __func__);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto exit_conn_start;
        }
        ret = qla4xxx_set_param_ddbentry(ha, ddb_entry, cls_conn, &mbx_sts);
@@ -1138,9 +1284,7 @@ static int qla4xxx_conn_start(struct iscsi_cls_conn *cls_conn)
                if (mbx_sts)
                        if (ddb_entry->fw_ddb_device_state ==
                                                DDB_DS_SESSION_ACTIVE) {
-                                iscsi_conn_start(ddb_entry->conn);
+                                ddb_entry->unblock_sess(ddb_entry->sess);
-                                iscsi_conn_login_event(ddb_entry->conn,
-                                                ISCSI_CONN_STATE_LOGGED_IN);
                                goto exit_set_param;
                        }
@@ -1167,8 +1311,9 @@ exit_set_param:
        ret = 0;
 exit_conn_start:
-        dma_free_coherent(&ha->pdev->dev, sizeof(*fw_ddb_entry),
+        if (fw_ddb_entry)
-                          fw_ddb_entry, fw_ddb_entry_dma);
+                dma_free_coherent(&ha->pdev->dev, sizeof(*fw_ddb_entry),
+                                  fw_ddb_entry, fw_ddb_entry_dma);
        return ret;
 }
@@ -1344,6 +1489,101 @@ static int qla4xxx_task_xmit(struct iscsi_task *task)
        return -ENOSYS;
 }
+static void qla4xxx_copy_fwddb_param(struct scsi_qla_host *ha,
+                                     struct dev_db_entry *fw_ddb_entry,
+                                     struct iscsi_cls_session *cls_sess,
+                                     struct iscsi_cls_conn *cls_conn)
+{
+        int buflen = 0;
+        struct iscsi_session *sess;
+        struct iscsi_conn *conn;
+        char ip_addr[DDB_IPADDR_LEN];
+        uint16_t options = 0;
+        sess = cls_sess->dd_data;
+        conn = cls_conn->dd_data;
+        conn->max_recv_dlength = BYTE_UNITS *
+                          le16_to_cpu(fw_ddb_entry->iscsi_max_rcv_data_seg_len);
+        conn->max_xmit_dlength = BYTE_UNITS *
+                          le16_to_cpu(fw_ddb_entry->iscsi_max_snd_data_seg_len);
+        sess->initial_r2t_en =
+                            (BIT_10 & le16_to_cpu(fw_ddb_entry->iscsi_options));
+        sess->max_r2t = le16_to_cpu(fw_ddb_entry->iscsi_max_outsnd_r2t);
+        sess->imm_data_en = (BIT_11 & le16_to_cpu(fw_ddb_entry->iscsi_options));
+        sess->first_burst = BYTE_UNITS *
+                               le16_to_cpu(fw_ddb_entry->iscsi_first_burst_len);
+        sess->max_burst = BYTE_UNITS *
+                                 le16_to_cpu(fw_ddb_entry->iscsi_max_burst_len);
+        sess->time2wait = le16_to_cpu(fw_ddb_entry->iscsi_def_time2wait);
+        sess->time2retain = le16_to_cpu(fw_ddb_entry->iscsi_def_time2retain);
+        conn->persistent_port = le16_to_cpu(fw_ddb_entry->port);
+        sess->tpgt = le32_to_cpu(fw_ddb_entry->tgt_portal_grp);
+        options = le16_to_cpu(fw_ddb_entry->options);
+        if (options & DDB_OPT_IPV6_DEVICE)
+                sprintf(ip_addr, "%pI6", fw_ddb_entry->ip_addr);
+        else
+                sprintf(ip_addr, "%pI4", fw_ddb_entry->ip_addr);
+        iscsi_set_param(cls_conn, ISCSI_PARAM_TARGET_NAME,
+                        (char *)fw_ddb_entry->iscsi_name, buflen);
+        iscsi_set_param(cls_conn, ISCSI_PARAM_INITIATOR_NAME,
+                        (char *)ha->name_string, buflen);
+        iscsi_set_param(cls_conn, ISCSI_PARAM_PERSISTENT_ADDRESS,
+                        (char *)ip_addr, buflen);
+}
+void qla4xxx_update_session_conn_fwddb_param(struct scsi_qla_host *ha,
+                                             struct ddb_entry *ddb_entry)
+{
+        struct iscsi_cls_session *cls_sess;
+        struct iscsi_cls_conn *cls_conn;
+        uint32_t ddb_state;
+        dma_addr_t fw_ddb_entry_dma;
+        struct dev_db_entry *fw_ddb_entry;
+        fw_ddb_entry = dma_alloc_coherent(&ha->pdev->dev, sizeof(*fw_ddb_entry),
+                                          &fw_ddb_entry_dma, GFP_KERNEL);
+        if (!fw_ddb_entry) {
+                ql4_printk(KERN_ERR, ha,
+                           "%s: Unable to allocate dma buffer\n", __func__);
+                goto exit_session_conn_fwddb_param;
+        }
+        if (qla4xxx_get_fwddb_entry(ha, ddb_entry->fw_ddb_index, fw_ddb_entry,
+                                    fw_ddb_entry_dma, NULL, NULL, &ddb_state,
+                                    NULL, NULL, NULL) == QLA_ERROR) {
+                DEBUG2(ql4_printk(KERN_ERR, ha, "scsi%ld: %s: failed "
+                                  "get_ddb_entry for fw_ddb_index %d\n",
+                                  ha->host_no, __func__,
+                                  ddb_entry->fw_ddb_index));
+                goto exit_session_conn_fwddb_param;
+        }
+        cls_sess = ddb_entry->sess;
+        cls_conn = ddb_entry->conn;
+        /* Update params */
+        qla4xxx_copy_fwddb_param(ha, fw_ddb_entry, cls_sess, cls_conn);
+exit_session_conn_fwddb_param:
+        if (fw_ddb_entry)
+                dma_free_coherent(&ha->pdev->dev, sizeof(*fw_ddb_entry),
+                                  fw_ddb_entry, fw_ddb_entry_dma);
+}
 void qla4xxx_update_session_conn_param(struct scsi_qla_host *ha,
                                       struct ddb_entry *ddb_entry)
 {
@@ -1360,7 +1600,7 @@ void qla4xxx_update_session_conn_param(struct scsi_qla_host *ha,
        if (!fw_ddb_entry) {
                ql4_printk(KERN_ERR, ha,
                           "%s: Unable to allocate dma buffer\n", __func__);
-                return;
+                goto exit_session_conn_param;
        }
        if (qla4xxx_get_fwddb_entry(ha, ddb_entry->fw_ddb_index, fw_ddb_entry,
@@ -1370,7 +1610,7 @@ void qla4xxx_update_session_conn_param(struct scsi_qla_host *ha,
                                  "get_ddb_entry for fw_ddb_index %d\n",
                                  ha->host_no, __func__,
                                  ddb_entry->fw_ddb_index));
-                return;
+                goto exit_session_conn_param;
        }
        cls_sess = ddb_entry->sess;
@@ -1379,6 +1619,12 @@ void qla4xxx_update_session_conn_param(struct scsi_qla_host *ha,
        cls_conn = ddb_entry->conn;
        conn = cls_conn->dd_data;
+        /* Update timers after login */
+        ddb_entry->default_relogin_timeout =
+                                le16_to_cpu(fw_ddb_entry->def_timeout);
+        ddb_entry->default_time2wait =
+                                le16_to_cpu(fw_ddb_entry->iscsi_def_time2wait);
        /* Update params */
        conn->max_recv_dlength = BYTE_UNITS *
                          le16_to_cpu(fw_ddb_entry->iscsi_max_rcv_data_seg_len);
@@ -1407,6 +1653,11 @@ void qla4xxx_update_session_conn_param(struct scsi_qla_host *ha,
        memcpy(sess->initiatorname, ha->name_string,
               min(sizeof(ha->name_string), sizeof(sess->initiatorname)));
+exit_session_conn_param:
+        if (fw_ddb_entry)
+                dma_free_coherent(&ha->pdev->dev, sizeof(*fw_ddb_entry),
+                                  fw_ddb_entry, fw_ddb_entry_dma);
 }
 /*
@@ -1607,6 +1858,9 @@ static void qla4xxx_mem_free(struct scsi_qla_host *ha)
                vfree(ha->chap_list);
        ha->chap_list = NULL;
+        if (ha->fw_ddb_dma_pool)
+                dma_pool_destroy(ha->fw_ddb_dma_pool);
        /* release io space registers  */
        if (is_qla8022(ha)) {
                if (ha->nx_pcibase)
@@ -1689,6 +1943,16 @@ static int qla4xxx_mem_alloc(struct scsi_qla_host *ha)
                goto mem_alloc_error_exit;
        }
+        ha->fw_ddb_dma_pool = dma_pool_create("ql4_fw_ddb", &ha->pdev->dev,
+                                              DDB_DMA_BLOCK_SIZE, 8, 0);
+        if (ha->fw_ddb_dma_pool == NULL) {
+                ql4_printk(KERN_WARNING, ha,
+                           "%s: fw_ddb_dma_pool allocation failed..\n",
+                           __func__);
+                goto mem_alloc_error_exit;
+        }
        return QLA_SUCCESS;
 mem_alloc_error_exit:
@@ -1800,6 +2064,60 @@ void qla4_8xxx_watchdog(struct scsi_qla_host *ha)
        }
 }
+void qla4xxx_check_relogin_flash_ddb(struct iscsi_cls_session *cls_sess)
+{
+        struct iscsi_session *sess;
+        struct ddb_entry *ddb_entry;
+        struct scsi_qla_host *ha;
+        sess = cls_sess->dd_data;
+        ddb_entry = sess->dd_data;
+        ha = ddb_entry->ha;
+        if (!(ddb_entry->ddb_type == FLASH_DDB))
+                return;
+        if (adapter_up(ha) && !test_bit(DF_RELOGIN, &ddb_entry->flags) &&
+            !iscsi_is_session_online(cls_sess)) {
+                if (atomic_read(&ddb_entry->retry_relogin_timer) !=
+                    INVALID_ENTRY) {
+                        if (atomic_read(&ddb_entry->retry_relogin_timer) ==
+                                        0) {
+                                atomic_set(&ddb_entry->retry_relogin_timer,
+                                           INVALID_ENTRY);
+                                set_bit(DPC_RELOGIN_DEVICE, &ha->dpc_flags);
+                                set_bit(DF_RELOGIN, &ddb_entry->flags);
+                                DEBUG2(ql4_printk(KERN_INFO, ha,
+                                       "%s: index [%d] login device\n",
+                                        __func__, ddb_entry->fw_ddb_index));
+                        } else
+                                atomic_dec(&ddb_entry->retry_relogin_timer);
+                }
+        }
+        /* Wait for relogin to timeout */
+        if (atomic_read(&ddb_entry->relogin_timer) &&
+            (atomic_dec_and_test(&ddb_entry->relogin_timer) != 0)) {
+                /*
+                 * If the relogin times out and the device is
+                 * still NOT ONLINE then try and relogin again.
+                 */
+                if (!iscsi_is_session_online(cls_sess)) {
+                        /* Reset retry relogin timer */
+                        atomic_inc(&ddb_entry->relogin_retry_count);
+                        DEBUG2(ql4_printk(KERN_INFO, ha,
+                                "%s: index[%d] relogin timed out-retrying"
+                                " relogin (%d), retry (%d)\n", __func__,
+                                ddb_entry->fw_ddb_index,
+                                atomic_read(&ddb_entry->relogin_retry_count),
+                                ddb_entry->default_time2wait + 4));
+                        set_bit(DPC_RELOGIN_DEVICE, &ha->dpc_flags);
+                        atomic_set(&ddb_entry->retry_relogin_timer,
+                                   ddb_entry->default_time2wait + 4);
+                }
+        }
+}
 /**
 * qla4xxx_timer - checks every second for work to do.
 * @ha: Pointer to host adapter structure.
@@ -1809,6 +2127,8 @@ static void qla4xxx_timer(struct scsi_qla_host *ha)
        int start_dpc = 0;
        uint16_t w;
+        iscsi_host_for_each_session(ha->host, qla4xxx_check_relogin_flash_ddb);
        /* If we are in the middle of AER/EEH processing
         * skip any processing and reschedule the timer
         */
@@ -2078,7 +2398,12 @@ static void qla4xxx_fail_session(struct iscsi_cls_session *cls_session)
        sess = cls_session->dd_data;
        ddb_entry = sess->dd_data;
        ddb_entry->fw_ddb_device_state = DDB_DS_SESSION_FAILED;
-        iscsi_session_failure(cls_session->dd_data, ISCSI_ERR_CONN_FAILED);
+        if (ddb_entry->ddb_type == FLASH_DDB)
+                iscsi_block_session(ddb_entry->sess);
+        else
+                iscsi_session_failure(cls_session->dd_data,
+                                      ISCSI_ERR_CONN_FAILED);
 }
 /**
@@ -2163,7 +2488,7 @@ recover_ha_init_adapter:
                /* NOTE: AF_ONLINE flag set upon successful completion of
                 *       qla4xxx_initialize_adapter */
-                status = qla4xxx_initialize_adapter(ha);
+                status = qla4xxx_initialize_adapter(ha, RESET_ADAPTER);
        }
        /* Retry failed adapter initialization, if necessary
@@ -2245,17 +2570,108 @@ static void qla4xxx_relogin_devices(struct iscsi_cls_session *cls_session)
                        iscsi_unblock_session(ddb_entry->sess);
                } else {
                        /* Trigger relogin */
-                        iscsi_session_failure(cls_session->dd_data,
+                        if (ddb_entry->ddb_type == FLASH_DDB) {
-                                              ISCSI_ERR_CONN_FAILED);
+                                if (!test_bit(DF_RELOGIN, &ddb_entry->flags))
+                                        qla4xxx_arm_relogin_timer(ddb_entry);
+                        } else
+                                iscsi_session_failure(cls_session->dd_data,
+                                                      ISCSI_ERR_CONN_FAILED);
                }
        }
 }
+int qla4xxx_unblock_flash_ddb(struct iscsi_cls_session *cls_session)
+{
+        struct iscsi_session *sess;
+        struct ddb_entry *ddb_entry;
+        struct scsi_qla_host *ha;
+        sess = cls_session->dd_data;
+        ddb_entry = sess->dd_data;
+        ha = ddb_entry->ha;
+        ql4_printk(KERN_INFO, ha, "scsi%ld: %s: ddb[%d]"
+                   " unblock session\n", ha->host_no, __func__,
+                   ddb_entry->fw_ddb_index);
+        iscsi_unblock_session(ddb_entry->sess);
+        /* Start scan target */
+        if (test_bit(AF_ONLINE, &ha->flags)) {
+                ql4_printk(KERN_INFO, ha, "scsi%ld: %s: ddb[%d]"
+                           " start scan\n", ha->host_no, __func__,
+                           ddb_entry->fw_ddb_index);
+                scsi_queue_work(ha->host, &ddb_entry->sess->scan_work);
+        }
+        return QLA_SUCCESS;
+}
+int qla4xxx_unblock_ddb(struct iscsi_cls_session *cls_session)
+{
+        struct iscsi_session *sess;
+        struct ddb_entry *ddb_entry;
+        struct scsi_qla_host *ha;
+        sess = cls_session->dd_data;
+        ddb_entry = sess->dd_data;
+        ha = ddb_entry->ha;
+        ql4_printk(KERN_INFO, ha, "scsi%ld: %s: ddb[%d]"
+                   " unblock user space session\n", ha->host_no, __func__,
+                   ddb_entry->fw_ddb_index);
+        iscsi_conn_start(ddb_entry->conn);
+        iscsi_conn_login_event(ddb_entry->conn,
+                               ISCSI_CONN_STATE_LOGGED_IN);
+        return QLA_SUCCESS;
+}
 static void qla4xxx_relogin_all_devices(struct scsi_qla_host *ha)
 {
        iscsi_host_for_each_session(ha->host, qla4xxx_relogin_devices);
 }
+static void qla4xxx_relogin_flash_ddb(struct iscsi_cls_session *cls_sess)
+{
+        uint16_t relogin_timer;
+        struct iscsi_session *sess;
+        struct ddb_entry *ddb_entry;
+        struct scsi_qla_host *ha;
+        sess = cls_sess->dd_data;
+        ddb_entry = sess->dd_data;
+        ha = ddb_entry->ha;
+        relogin_timer = max(ddb_entry->default_relogin_timeout,
+                            (uint16_t)RELOGIN_TOV);
+        atomic_set(&ddb_entry->relogin_timer, relogin_timer);
+        DEBUG2(ql4_printk(KERN_INFO, ha,
+                          "scsi%ld: Relogin index [%d]. TOV=%d\n", ha->host_no,
+                          ddb_entry->fw_ddb_index, relogin_timer));
+        qla4xxx_login_flash_ddb(cls_sess);
+}
+static void qla4xxx_dpc_relogin(struct iscsi_cls_session *cls_sess)
+{
+        struct iscsi_session *sess;
+        struct ddb_entry *ddb_entry;
+        struct scsi_qla_host *ha;
+        sess = cls_sess->dd_data;
+        ddb_entry = sess->dd_data;
+        ha = ddb_entry->ha;
+        if (!(ddb_entry->ddb_type == FLASH_DDB))
+                return;
+        if (test_and_clear_bit(DF_RELOGIN, &ddb_entry->flags) &&
+            !iscsi_is_session_online(cls_sess)) {
+                DEBUG2(ql4_printk(KERN_INFO, ha,
+                                  "relogin issued\n"));
+                qla4xxx_relogin_flash_ddb(cls_sess);
+        }
+}
 void qla4xxx_wake_dpc(struct scsi_qla_host *ha)
 {
        if (ha->dpc_thread)
@@ -2356,6 +2772,12 @@ dpc_post_reset_ha:
        if (test_and_clear_bit(DPC_GET_DHCP_IP_ADDR, &ha->dpc_flags))
                qla4xxx_get_dhcp_ip_address(ha);
+        /* ---- relogin device? --- */
+        if (adapter_up(ha) &&
+            test_and_clear_bit(DPC_RELOGIN_DEVICE, &ha->dpc_flags)) {
+                iscsi_host_for_each_session(ha->host, qla4xxx_dpc_relogin);
+        }
        /* ---- link change? --- */
        if (test_and_clear_bit(DPC_LINK_CHANGED, &ha->dpc_flags)) {
                if (!test_bit(AF_LINK_UP, &ha->flags)) {
@@ -2368,8 +2790,12 @@ dpc_post_reset_ha:
                         * fatal error recovery.  Therefore, the driver must
                         * manually relogin to devices when recovering from
                         * connection failures, logouts, expired KATO, etc. */
+                        if (test_and_clear_bit(AF_BUILD_DDB_LIST, &ha->flags)) {
-                        qla4xxx_relogin_all_devices(ha);
+                                qla4xxx_build_ddb_list(ha, ha->is_reset);
+                                iscsi_host_for_each_session(ha->host,
+                                                qla4xxx_login_flash_ddb);
+                        } else
+                                qla4xxx_relogin_all_devices(ha);
                }
        }
 }
@@ -2867,6 +3293,9 @@ static int get_fw_boot_info(struct scsi_qla_host *ha, uint16_t ddb_index[])
                          " target ID %d\n", __func__, ddb_index[0],
                          ddb_index[1]));
+        ha->pri_ddb_idx = ddb_index[0];
+        ha->sec_ddb_idx = ddb_index[1];
 exit_boot_info_free:
        dma_free_coherent(&ha->pdev->dev, size, buf, buf_dma);
 exit_boot_info:
@@ -3034,6 +3463,9 @@ static int qla4xxx_get_boot_info(struct scsi_qla_host *ha)
                return ret;
        }
+        if (ql4xdisablesysfsboot)
+                return QLA_SUCCESS;
        if (ddb_index[0] == 0xffff)
                goto sec_target;
@@ -3066,7 +3498,15 @@ static int qla4xxx_setup_boot_info(struct scsi_qla_host *ha)
        struct iscsi_boot_kobj *boot_kobj;
        if (qla4xxx_get_boot_info(ha) != QLA_SUCCESS)
-                return 0;
+                return QLA_ERROR;
+        if (ql4xdisablesysfsboot) {
+                ql4_printk(KERN_INFO, ha,
+                           "%s: syfsboot disabled - driver will trigger login"
+                           "and publish session for discovery .\n", __func__);
+                return QLA_SUCCESS;
+        }
        ha->boot_kset = iscsi_boot_create_host_kset(ha->host->host_no);
        if (!ha->boot_kset)
@@ -3108,7 +3548,7 @@ static int qla4xxx_setup_boot_info(struct scsi_qla_host *ha)
        if (!boot_kobj)
                goto put_host;
-        return 0;
+        return QLA_SUCCESS;
 put_host:
        scsi_host_put(ha->host);
@@ -3174,9 +3614,507 @@ static void qla4xxx_create_chap_list(struct scsi_qla_host *ha)
 exit_chap_list:
        dma_free_coherent(&ha->pdev->dev, chap_size,
                        chap_flash_data, chap_dma);
-        return;
 }
+static void qla4xxx_get_param_ddb(struct ddb_entry *ddb_entry,
+                                  struct ql4_tuple_ddb *tddb)
+{
+        struct scsi_qla_host *ha;
+        struct iscsi_cls_session *cls_sess;
+        struct iscsi_cls_conn *cls_conn;
+        struct iscsi_session *sess;
+        struct iscsi_conn *conn;
+        DEBUG2(printk(KERN_INFO "Func: %s\n", __func__));
+        ha = ddb_entry->ha;
+        cls_sess = ddb_entry->sess;
+        sess = cls_sess->dd_data;
+        cls_conn = ddb_entry->conn;
+        conn = cls_conn->dd_data;
+        tddb->tpgt = sess->tpgt;
+        tddb->port = conn->persistent_port;
+        strncpy(tddb->iscsi_name, sess->targetname, ISCSI_NAME_SIZE);
+        strncpy(tddb->ip_addr, conn->persistent_address, DDB_IPADDR_LEN);
+}
+static void qla4xxx_convert_param_ddb(struct dev_db_entry *fw_ddb_entry,
+                                      struct ql4_tuple_ddb *tddb)
+{
+        uint16_t options = 0;
+        tddb->tpgt = le32_to_cpu(fw_ddb_entry->tgt_portal_grp);
+        memcpy(&tddb->iscsi_name[0], &fw_ddb_entry->iscsi_name[0],
+               min(sizeof(tddb->iscsi_name), sizeof(fw_ddb_entry->iscsi_name)));
+        options = le16_to_cpu(fw_ddb_entry->options);
+        if (options & DDB_OPT_IPV6_DEVICE)
+                sprintf(tddb->ip_addr, "%pI6", fw_ddb_entry->ip_addr);
+        else
+                sprintf(tddb->ip_addr, "%pI4", fw_ddb_entry->ip_addr);
+        tddb->port = le16_to_cpu(fw_ddb_entry->port);
+}
+static int qla4xxx_compare_tuple_ddb(struct scsi_qla_host *ha,
+                                     struct ql4_tuple_ddb *old_tddb,
+                                     struct ql4_tuple_ddb *new_tddb)
+{
+        if (strcmp(old_tddb->iscsi_name, new_tddb->iscsi_name))
+                return QLA_ERROR;
+        if (strcmp(old_tddb->ip_addr, new_tddb->ip_addr))
+                return QLA_ERROR;
+        if (old_tddb->port != new_tddb->port)
+                return QLA_ERROR;
+        DEBUG2(ql4_printk(KERN_INFO, ha,
+                          "Match Found, fw[%d,%d,%s,%s], [%d,%d,%s,%s]",
+                          old_tddb->port, old_tddb->tpgt, old_tddb->ip_addr,
+                          old_tddb->iscsi_name, new_tddb->port, new_tddb->tpgt,
+                          new_tddb->ip_addr, new_tddb->iscsi_name));
+        return QLA_SUCCESS;
+}
+static int qla4xxx_is_session_exists(struct scsi_qla_host *ha,
+                                     struct dev_db_entry *fw_ddb_entry)
+{
+        struct ddb_entry *ddb_entry;
+        struct ql4_tuple_ddb *fw_tddb = NULL;
+        struct ql4_tuple_ddb *tmp_tddb = NULL;
+        int idx;
+        int ret = QLA_ERROR;
+        fw_tddb = vzalloc(sizeof(*fw_tddb));
+        if (!fw_tddb) {
+                DEBUG2(ql4_printk(KERN_WARNING, ha,
+                                  "Memory Allocation failed.\n"));
+                ret = QLA_SUCCESS;
+                goto exit_check;
+        }
+        tmp_tddb = vzalloc(sizeof(*tmp_tddb));
+        if (!tmp_tddb) {
+                DEBUG2(ql4_printk(KERN_WARNING, ha,
+                                  "Memory Allocation failed.\n"));
+                ret = QLA_SUCCESS;
+                goto exit_check;
+        }
+        qla4xxx_convert_param_ddb(fw_ddb_entry, fw_tddb);
+        for (idx = 0; idx < MAX_DDB_ENTRIES; idx++) {
+                ddb_entry = qla4xxx_lookup_ddb_by_fw_index(ha, idx);
+                if (ddb_entry == NULL)
+                        continue;
+                qla4xxx_get_param_ddb(ddb_entry, tmp_tddb);
+                if (!qla4xxx_compare_tuple_ddb(ha, fw_tddb, tmp_tddb)) {
+                        ret = QLA_SUCCESS; /* found */
+                        goto exit_check;
+                }
+        }
+exit_check:
+        if (fw_tddb)
+                vfree(fw_tddb);
+        if (tmp_tddb)
+                vfree(tmp_tddb);
+        return ret;
+}
+static int qla4xxx_is_flash_ddb_exists(struct scsi_qla_host *ha,
+                                       struct list_head *list_nt,
+                                       struct dev_db_entry *fw_ddb_entry)
+{
+        struct qla_ddb_index  *nt_ddb_idx, *nt_ddb_idx_tmp;
+        struct ql4_tuple_ddb *fw_tddb = NULL;
+        struct ql4_tuple_ddb *tmp_tddb = NULL;
+        int ret = QLA_ERROR;
+        fw_tddb = vzalloc(sizeof(*fw_tddb));
+        if (!fw_tddb) {
+                DEBUG2(ql4_printk(KERN_WARNING, ha,
+                                  "Memory Allocation failed.\n"));
+                ret = QLA_SUCCESS;
+                goto exit_check;
+        }
+        tmp_tddb = vzalloc(sizeof(*tmp_tddb));
+        if (!tmp_tddb) {
+                DEBUG2(ql4_printk(KERN_WARNING, ha,
+                                  "Memory Allocation failed.\n"));
+                ret = QLA_SUCCESS;
+                goto exit_check;
+        }
+        qla4xxx_convert_param_ddb(fw_ddb_entry, fw_tddb);
+        list_for_each_entry_safe(nt_ddb_idx, nt_ddb_idx_tmp, list_nt, list) {
+                qla4xxx_convert_param_ddb(&nt_ddb_idx->fw_ddb, tmp_tddb);
+                if (!qla4xxx_compare_tuple_ddb(ha, fw_tddb, tmp_tddb)) {
+                        ret = QLA_SUCCESS; /* found */
+                        goto exit_check;
+                }
+        }
+exit_check:
+        if (fw_tddb)
+                vfree(fw_tddb);
+        if (tmp_tddb)
+                vfree(tmp_tddb);
+        return ret;
+}
+static void qla4xxx_free_nt_list(struct list_head *list_nt)
+{
+        struct qla_ddb_index  *nt_ddb_idx, *nt_ddb_idx_tmp;
+        /* Free up the normaltargets list */
+        list_for_each_entry_safe(nt_ddb_idx, nt_ddb_idx_tmp, list_nt, list) {
+                list_del_init(&nt_ddb_idx->list);
+                vfree(nt_ddb_idx);
+        }
+}
+static struct iscsi_endpoint *qla4xxx_get_ep_fwdb(struct scsi_qla_host *ha,
+                                        struct dev_db_entry *fw_ddb_entry)
+{
+        struct iscsi_endpoint *ep;
+        struct sockaddr_in *addr;
+        struct sockaddr_in6 *addr6;
+        struct sockaddr *dst_addr;
+        char *ip;
+        /* TODO: need to destroy on unload iscsi_endpoint*/
+        dst_addr = vmalloc(sizeof(*dst_addr));
+        if (!dst_addr)
+                return NULL;
+        if (fw_ddb_entry->options & DDB_OPT_IPV6_DEVICE) {
+                dst_addr->sa_family = AF_INET6;
+                addr6 = (struct sockaddr_in6 *)dst_addr;
+                ip = (char *)&addr6->sin6_addr;
+                memcpy(ip, fw_ddb_entry->ip_addr, IPv6_ADDR_LEN);
+                addr6->sin6_port = htons(le16_to_cpu(fw_ddb_entry->port));
+        } else {
+                dst_addr->sa_family = AF_INET;
+                addr = (struct sockaddr_in *)dst_addr;
+                ip = (char *)&addr->sin_addr;
+                memcpy(ip, fw_ddb_entry->ip_addr, IP_ADDR_LEN);
+                addr->sin_port = htons(le16_to_cpu(fw_ddb_entry->port));
+        }
+        ep = qla4xxx_ep_connect(ha->host, dst_addr, 0);
+        vfree(dst_addr);
+        return ep;
+}
+static int qla4xxx_verify_boot_idx(struct scsi_qla_host *ha, uint16_t idx)
+{
+        if (ql4xdisablesysfsboot)
+                return QLA_SUCCESS;
+        if (idx == ha->pri_ddb_idx || idx == ha->sec_ddb_idx)
+                return QLA_ERROR;
+        return QLA_SUCCESS;
+}
+static void qla4xxx_setup_flash_ddb_entry(struct scsi_qla_host *ha,
+                                          struct ddb_entry *ddb_entry)
+{
+        ddb_entry->ddb_type = FLASH_DDB;
+        ddb_entry->fw_ddb_index = INVALID_ENTRY;
+        ddb_entry->fw_ddb_device_state = DDB_DS_NO_CONNECTION_ACTIVE;
+        ddb_entry->ha = ha;
+        ddb_entry->unblock_sess = qla4xxx_unblock_flash_ddb;
+        ddb_entry->ddb_change = qla4xxx_flash_ddb_change;
+        atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
+        atomic_set(&ddb_entry->relogin_timer, 0);
+        atomic_set(&ddb_entry->relogin_retry_count, 0);
+        ddb_entry->default_relogin_timeout =
+                le16_to_cpu(ddb_entry->fw_ddb_entry.def_timeout);
+        ddb_entry->default_time2wait =
+                le16_to_cpu(ddb_entry->fw_ddb_entry.iscsi_def_time2wait);
+}
+static void qla4xxx_wait_for_ip_configuration(struct scsi_qla_host *ha)
+{
+        uint32_t idx = 0;
+        uint32_t ip_idx[IP_ADDR_COUNT] = {0, 1, 2, 3}; /* 4 IP interfaces */
+        uint32_t sts[MBOX_REG_COUNT];
+        uint32_t ip_state;
+        unsigned long wtime;
+        int ret;
+        wtime = jiffies + (HZ * IP_CONFIG_TOV);
+        do {
+                for (idx = 0; idx < IP_ADDR_COUNT; idx++) {
+                        if (ip_idx[idx] == -1)
+                                continue;
+                        ret = qla4xxx_get_ip_state(ha, 0, ip_idx[idx], sts);
+                        if (ret == QLA_ERROR) {
+                                ip_idx[idx] = -1;
+                                continue;
+                        }
+                        ip_state = (sts[1] & IP_STATE_MASK) >> IP_STATE_SHIFT;
+                        DEBUG2(ql4_printk(KERN_INFO, ha,
+                                          "Waiting for IP state for idx = %d, state = 0x%x\n",
+                                          ip_idx[idx], ip_state));
+                        if (ip_state == IP_ADDRSTATE_UNCONFIGURED ||
+                            ip_state == IP_ADDRSTATE_INVALID ||
+                            ip_state == IP_ADDRSTATE_PREFERRED ||
+                            ip_state == IP_ADDRSTATE_DEPRICATED ||
+                            ip_state == IP_ADDRSTATE_DISABLING)
+                                ip_idx[idx] = -1;
+                }
+                /* Break if all IP states checked */
+                if ((ip_idx[0] == -1) &&
+                    (ip_idx[1] == -1) &&
+                    (ip_idx[2] == -1) &&
+                    (ip_idx[3] == -1))
+                        break;
+                schedule_timeout_uninterruptible(HZ);
+        } while (time_after(wtime, jiffies));
+}
+void qla4xxx_build_ddb_list(struct scsi_qla_host *ha, int is_reset)
+{
+        int max_ddbs;
+        int ret;
+        uint32_t idx = 0, next_idx = 0;
+        uint32_t state = 0, conn_err = 0;
+        uint16_t conn_id;
+        struct dev_db_entry *fw_ddb_entry;
+        struct ddb_entry *ddb_entry = NULL;
+        dma_addr_t fw_ddb_dma;
+        struct iscsi_cls_session *cls_sess;
+        struct iscsi_session *sess;
+        struct iscsi_cls_conn *cls_conn;
+        struct iscsi_endpoint *ep;
+        uint16_t cmds_max = 32, tmo = 0;
+        uint32_t initial_cmdsn = 0;
+        struct list_head list_st, list_nt; /* List of sendtargets */
+        struct qla_ddb_index  *st_ddb_idx, *st_ddb_idx_tmp;
+        int fw_idx_size;
+        unsigned long wtime;
+        struct qla_ddb_index  *nt_ddb_idx;
+        if (!test_bit(AF_LINK_UP, &ha->flags)) {
+                set_bit(AF_BUILD_DDB_LIST, &ha->flags);
+                ha->is_reset = is_reset;
+                return;
+        }
+        max_ddbs =  is_qla40XX(ha) ? MAX_DEV_DB_ENTRIES_40XX :
+                                     MAX_DEV_DB_ENTRIES;
+        fw_ddb_entry = dma_pool_alloc(ha->fw_ddb_dma_pool, GFP_KERNEL,
+                                      &fw_ddb_dma);
+        if (fw_ddb_entry == NULL) {
+                DEBUG2(ql4_printk(KERN_ERR, ha, "Out of memory\n"));
+                goto exit_ddb_list;
+        }
+        INIT_LIST_HEAD(&list_st);
+        INIT_LIST_HEAD(&list_nt);
+        fw_idx_size = sizeof(struct qla_ddb_index);
+        for (idx = 0; idx < max_ddbs; idx = next_idx) {
+                ret = qla4xxx_get_fwddb_entry(ha, idx, fw_ddb_entry,
+                                              fw_ddb_dma, NULL,
+                                              &next_idx, &state, &conn_err,
+                                              NULL, &conn_id);
+                if (ret == QLA_ERROR)
+                        break;
+                if (qla4xxx_verify_boot_idx(ha, idx) != QLA_SUCCESS)
+                        goto continue_next_st;
+                /* Check if ST, add to the list_st */
+                if (strlen((char *) fw_ddb_entry->iscsi_name) != 0)
+                        goto continue_next_st;
+                st_ddb_idx = vzalloc(fw_idx_size);
+                if (!st_ddb_idx)
+                        break;
+                st_ddb_idx->fw_ddb_idx = idx;
+                list_add_tail(&st_ddb_idx->list, &list_st);
+continue_next_st:
+                if (next_idx == 0)
+                        break;
+        }
+        /* Before issuing conn open mbox, ensure all IPs states are configured
+         * Note, conn open fails if IPs are not configured
+         */
+        qla4xxx_wait_for_ip_configuration(ha);
+        /* Go thru the STs and fire the sendtargets by issuing conn open mbx */
+        list_for_each_entry_safe(st_ddb_idx, st_ddb_idx_tmp, &list_st, list) {
+                qla4xxx_conn_open(ha, st_ddb_idx->fw_ddb_idx);
+        }
+        /* Wait to ensure all sendtargets are done for min 12 sec wait */
+        tmo = ((ha->def_timeout < LOGIN_TOV) ? LOGIN_TOV : ha->def_timeout);
+        DEBUG2(ql4_printk(KERN_INFO, ha,
+                          "Default time to wait for build ddb %d\n", tmo));
+        wtime = jiffies + (HZ * tmo);
+        do {
+                list_for_each_entry_safe(st_ddb_idx, st_ddb_idx_tmp, &list_st,
+                                         list) {
+                        ret = qla4xxx_get_fwddb_entry(ha,
+                                                      st_ddb_idx->fw_ddb_idx,
+                                                      NULL, 0, NULL, &next_idx,
+                                                      &state, &conn_err, NULL,
+                                                      NULL);
+                        if (ret == QLA_ERROR)
+                                continue;
+                        if (state == DDB_DS_NO_CONNECTION_ACTIVE ||
+                            state == DDB_DS_SESSION_FAILED) {
+                                list_del_init(&st_ddb_idx->list);
+                                vfree(st_ddb_idx);
+                        }
+                }
+                schedule_timeout_uninterruptible(HZ / 10);
+        } while (time_after(wtime, jiffies));
+        /* Free up the sendtargets list */
+        list_for_each_entry_safe(st_ddb_idx, st_ddb_idx_tmp, &list_st, list) {
+                list_del_init(&st_ddb_idx->list);
+                vfree(st_ddb_idx);
+        }
+        for (idx = 0; idx < max_ddbs; idx = next_idx) {
+                ret = qla4xxx_get_fwddb_entry(ha, idx, fw_ddb_entry,
+                                              fw_ddb_dma, NULL,
+                                              &next_idx, &state, &conn_err,
+                                              NULL, &conn_id);
+                if (ret == QLA_ERROR)
+                        break;
+                if (qla4xxx_verify_boot_idx(ha, idx) != QLA_SUCCESS)
+                        goto continue_next_nt;
+                /* Check if NT, then add to list it */
+                if (strlen((char *) fw_ddb_entry->iscsi_name) == 0)
+                        goto continue_next_nt;
+                if (state == DDB_DS_NO_CONNECTION_ACTIVE ||
+                    state == DDB_DS_SESSION_FAILED) {
+                        DEBUG2(ql4_printk(KERN_INFO, ha,
+                                          "Adding  DDB to session = 0x%x\n",
+                                          idx));
+                        if (is_reset == INIT_ADAPTER) {
+                                nt_ddb_idx = vmalloc(fw_idx_size);
+                                if (!nt_ddb_idx)
+                                        break;
+                                nt_ddb_idx->fw_ddb_idx = idx;
+                                memcpy(&nt_ddb_idx->fw_ddb, fw_ddb_entry,
+                                       sizeof(struct dev_db_entry));
+                                if (qla4xxx_is_flash_ddb_exists(ha, &list_nt,
+                                                fw_ddb_entry) == QLA_SUCCESS) {
+                                        vfree(nt_ddb_idx);
+                                        goto continue_next_nt;
+                                }
+                                list_add_tail(&nt_ddb_idx->list, &list_nt);
+                        } else if (is_reset == RESET_ADAPTER) {
+                                if (qla4xxx_is_session_exists(ha,
+                                                   fw_ddb_entry) == QLA_SUCCESS)
+                                        goto continue_next_nt;
+                        }
+                        /* Create session object, with INVALID_ENTRY,
+                         * the targer_id would get set when we issue the login
+                         */
+                        cls_sess = iscsi_session_setup(&qla4xxx_iscsi_transport,
+                                                ha->host, cmds_max,
+                                                sizeof(struct ddb_entry),
+                                                sizeof(struct ql4_task_data),
+                                                initial_cmdsn, INVALID_ENTRY);
+                        if (!cls_sess)
+                                goto exit_ddb_list;
+                        /*
+                         * iscsi_session_setup increments the driver reference
+                         * count which wouldn't let the driver to be unloaded.
+                         * so calling module_put function to decrement the
+                         * reference count.
+                         **/
+                        module_put(qla4xxx_iscsi_transport.owner);
+                        sess = cls_sess->dd_data;
+                        ddb_entry = sess->dd_data;
+                        ddb_entry->sess = cls_sess;
+                        cls_sess->recovery_tmo = ql4xsess_recovery_tmo;
+                        memcpy(&ddb_entry->fw_ddb_entry, fw_ddb_entry,
+                               sizeof(struct dev_db_entry));
+                        qla4xxx_setup_flash_ddb_entry(ha, ddb_entry);
+                        cls_conn = iscsi_conn_setup(cls_sess,
+                                                    sizeof(struct qla_conn),
+                                                    conn_id);
+                        if (!cls_conn)
+                                goto exit_ddb_list;
+                        ddb_entry->conn = cls_conn;
+                        /* Setup ep, for displaying attributes in sysfs */
+                        ep = qla4xxx_get_ep_fwdb(ha, fw_ddb_entry);
+                        if (ep) {
+                                ep->conn = cls_conn;
+                                cls_conn->ep = ep;
+                        } else {
+                                DEBUG2(ql4_printk(KERN_ERR, ha,
+                                                  "Unable to get ep\n"));
+                        }
+                        /* Update sess/conn params */
+                        qla4xxx_copy_fwddb_param(ha, fw_ddb_entry, cls_sess,
+                                                 cls_conn);
+                        if (is_reset == RESET_ADAPTER) {
+                                iscsi_block_session(cls_sess);
+                                /* Use the relogin path to discover new devices
+                                 *  by short-circuting the logic of setting
+                                 *  timer to relogin - instead set the flags
+                                 *  to initiate login right away.
+                                 */
+                                set_bit(DPC_RELOGIN_DEVICE, &ha->dpc_flags);
+                                set_bit(DF_RELOGIN, &ddb_entry->flags);
+                        }
+                }
+continue_next_nt:
+                if (next_idx == 0)
+                        break;
+        }
+exit_ddb_list:
+        qla4xxx_free_nt_list(&list_nt);
+        if (fw_ddb_entry)
+                dma_pool_free(ha->fw_ddb_dma_pool, fw_ddb_entry, fw_ddb_dma);
+        qla4xxx_free_ddb_index(ha);
+}
 /**
 * qla4xxx_probe_adapter - callback function to probe HBA
 * @pdev: pointer to pci_dev structure
@@ -3298,7 +4236,7 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         * firmware
         * NOTE: interrupts enabled upon successful completion
         */
-        status = qla4xxx_initialize_adapter(ha);
+        status = qla4xxx_initialize_adapter(ha, INIT_ADAPTER);
        while ((!test_bit(AF_ONLINE, &ha->flags)) &&
            init_retry_count++ < MAX_INIT_RETRIES) {
@@ -3319,7 +4257,7 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
                if (ha->isp_ops->reset_chip(ha) == QLA_ERROR)
                        continue;
-                status = qla4xxx_initialize_adapter(ha);
+                status = qla4xxx_initialize_adapter(ha, INIT_ADAPTER);
        }
        if (!test_bit(AF_ONLINE, &ha->flags)) {
@@ -3386,12 +4324,16 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
               ha->host_no, ha->firmware_version[0], ha->firmware_version[1],
               ha->patch_number, ha->build_number);
-        qla4xxx_create_chap_list(ha);
        if (qla4xxx_setup_boot_info(ha))
                ql4_printk(KERN_ERR, ha, "%s:ISCSI boot info setup failed\n",
                           __func__);
+                /* Perform the build ddb list and login to each */
+        qla4xxx_build_ddb_list(ha, INIT_ADAPTER);
+        iscsi_host_for_each_session(ha->host, qla4xxx_login_flash_ddb);
+        qla4xxx_create_chap_list(ha);
        qla4xxx_create_ifaces(ha);
        return 0;
@@ -3449,6 +4391,38 @@ static void qla4xxx_prevent_other_port_reinit(struct scsi_qla_host *ha)
        }
 }
+static void qla4xxx_destroy_fw_ddb_session(struct scsi_qla_host *ha)
+{
+        struct ddb_entry *ddb_entry;
+        int options;
+        int idx;
+        for (idx = 0; idx < MAX_DDB_ENTRIES; idx++) {
+                ddb_entry = qla4xxx_lookup_ddb_by_fw_index(ha, idx);
+                if ((ddb_entry != NULL) &&
+                    (ddb_entry->ddb_type == FLASH_DDB)) {
+                        options = LOGOUT_OPTION_CLOSE_SESSION;
+                        if (qla4xxx_session_logout_ddb(ha, ddb_entry, options)
+                            == QLA_ERROR)
+                                ql4_printk(KERN_ERR, ha, "%s: Logout failed\n",
+                                           __func__);
+                        qla4xxx_clear_ddb_entry(ha, ddb_entry->fw_ddb_index);
+                        /*
+                         * we have decremented the reference count of the driver
+                         * when we setup the session to have the driver unload
+                         * to be seamless without actually destroying the
+                         * session
+                         **/
+                        try_module_get(qla4xxx_iscsi_transport.owner);
+                        iscsi_destroy_endpoint(ddb_entry->conn->ep);
+                        qla4xxx_free_ddb(ha, ddb_entry);
+                        iscsi_session_teardown(ddb_entry->sess);
+                }
+        }
+}
 /**
 * qla4xxx_remove_adapter - calback function to remove adapter.
 * @pci_dev: PCI device pointer
@@ -3465,9 +4439,11 @@ static void __devexit qla4xxx_remove_adapter(struct pci_dev *pdev)
        /* destroy iface from sysfs */
        qla4xxx_destroy_ifaces(ha);
-        if (ha->boot_kset)
+        if ((!ql4xdisablesysfsboot) && ha->boot_kset)
                iscsi_boot_destroy_kset(ha->boot_kset);
+        qla4xxx_destroy_fw_ddb_session(ha);
        scsi_remove_host(ha->host);
        qla4xxx_free_adapter(ha);
@@ -4115,7 +5091,7 @@ static uint32_t qla4_8xxx_error_recovery(struct scsi_qla_host *ha)
                qla4_8xxx_idc_unlock(ha);
                clear_bit(AF_FW_RECOVERY, &ha->flags);
-                rval = qla4xxx_initialize_adapter(ha);
+                rval = qla4xxx_initialize_adapter(ha, RESET_ADAPTER);
                qla4_8xxx_idc_lock(ha);
                if (rval != QLA_SUCCESS) {
@@ -4151,7 +5127,7 @@ static uint32_t qla4_8xxx_error_recovery(struct scsi_qla_host *ha)
                if ((qla4_8xxx_rd_32(ha, QLA82XX_CRB_DEV_STATE) ==
                    QLA82XX_DEV_READY)) {
                        clear_bit(AF_FW_RECOVERY, &ha->flags);
-                        rval = qla4xxx_initialize_adapter(ha);
+                        rval = qla4xxx_initialize_adapter(ha, RESET_ADAPTER);
                        if (rval == QLA_SUCCESS) {
                                ret = qla4xxx_request_irqs(ha);
                                if (ret) {
diff --git a/drivers/scsi/qla4xxx/ql4_version.h b/drivers/scsi/qla4xxx/ql4_version.h
index c15347d3f53..5254e57968f 100644
--- a/drivers/scsi/qla4xxx/ql4_version.h
+++ b/drivers/scsi/qla4xxx/ql4_version.h
@@ -5,4 +5,4 @@
 * See LICENSE.qla4xxx for copyright and licensing details.
 */
-#define QLA4XXX_DRIVER_VERSION  "5.02.00-k8"
+#define QLA4XXX_DRIVER_VERSION  "5.02.00-k9"
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 717ebc9ff94..600d8234851 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -264,7 +264,7 @@ static int __devinit dwc3_core_init(struct dwc3 *dwc)
                ret = -ENODEV;
                goto err0;
        }
-        dwc->revision = reg & DWC3_GSNPSREV_MASK;
+        dwc->revision = reg;
        dwc3_core_soft_reset(dwc);
diff --git a/drivers/usb/gadget/epautoconf.c b/drivers/usb/gadget/epautoconf.c
index 596a0b464e6..4dff83d2f26 100644
--- a/drivers/usb/gadget/epautoconf.c
+++ b/drivers/usb/gadget/epautoconf.c
@@ -130,9 +130,6 @@ ep_matches (
                        num_req_streams = ep_comp->bmAttributes & 0x1f;
                        if (num_req_streams > ep->max_streams)
                                return 0;
-                        /* Update the ep_comp descriptor if needed */
-                        if (num_req_streams != ep->max_streams)
-                                ep_comp->bmAttributes = ep->max_streams;
                }
        }
diff --git a/drivers/usb/host/isp1760-if.c b/drivers/usb/host/isp1760-if.c
index a7dc1e1d45f..2ac4ac2e4ef 100644
--- a/drivers/usb/host/isp1760-if.c
+++ b/drivers/usb/host/isp1760-if.c
@@ -18,7 +18,7 @@
 #include "isp1760-hcd.h"
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && defined(CONFIG_OF_IRQ)
 #include <linux/slab.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
@@ -31,7 +31,7 @@
 #include <linux/pci.h>
 #endif
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && defined(CONFIG_OF_IRQ)
 struct isp1760 {
        struct usb_hcd *hcd;
        int rst_gpio;
@@ -437,7 +437,7 @@ static int __init isp1760_init(void)
        ret = platform_driver_register(&isp1760_plat_driver);
        if (!ret)
                any_ret = 0;
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && defined(CONFIG_OF_IRQ)
        ret = platform_driver_register(&isp1760_of_driver);
        if (!ret)
                any_ret = 0;
@@ -457,7 +457,7 @@ module_init(isp1760_init);
 static void __exit isp1760_exit(void)
 {
        platform_driver_unregister(&isp1760_plat_driver);
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && defined(CONFIG_OF_IRQ)
        platform_driver_unregister(&isp1760_of_driver);
 #endif
 #ifdef CONFIG_PCI
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 60ddba8066e..79cb0af779f 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -774,6 +774,10 @@ static void musb_ep_program(struct musb *musb, u8 epnum,
                        if (musb->double_buffer_not_ok)
                                musb_writew(epio, MUSB_TXMAXP,
                                                hw_ep->max_packet_sz_tx);
+                        else if (can_bulk_split(musb, qh->type))
+                                musb_writew(epio, MUSB_TXMAXP, packet_sz
+                                        | ((hw_ep->max_packet_sz_tx /
+                                                packet_sz) - 1) << 11);
                        else
                                musb_writew(epio, MUSB_TXMAXP,
                                                qh->maxpacket |
diff --git a/drivers/watchdog/coh901327_wdt.c b/drivers/watchdog/coh901327_wdt.c
index 03f449a430d..5b89f7d6cd0 100644
--- a/drivers/watchdog/coh901327_wdt.c
+++ b/drivers/watchdog/coh901327_wdt.c
@@ -76,8 +76,6 @@ static int irq;
 static void __iomem *virtbase;
 static unsigned long coh901327_users;
 static unsigned long boot_status;
-static u16 wdogenablestore;
-static u16 irqmaskstore;
 static struct device *parent;
 /*
@@ -461,6 +459,10 @@ out:
 }
 #ifdef CONFIG_PM
+static u16 wdogenablestore;
+static u16 irqmaskstore;
 static int coh901327_suspend(struct platform_device *pdev, pm_message_t state)
 {
        irqmaskstore = readw(virtbase + U300_WDOG_IMR) & 0x0001U;
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 3774c9b8dac..8464ea1c36a 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -231,6 +231,7 @@ static int __devinit cru_detect(unsigned long map_entry,
        cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
+        set_memory_x((unsigned long)bios32_entrypoint, (2 * PAGE_SIZE));
        asminline_call(&cmn_regs, bios32_entrypoint);
        if (cmn_regs.u1.ral != 0) {
@@ -248,8 +249,10 @@ static int __devinit cru_detect(unsigned long map_entry,
                if ((physical_bios_base + physical_bios_offset)) {
                        cru_rom_addr =
                                ioremap(cru_physical_address, cru_length);
-                        if (cru_rom_addr)
+                        if (cru_rom_addr) {
+                                set_memory_x((unsigned long)cru_rom_addr, cru_length);
                                retval = 0;
+                        }
                }
                printk(KERN_DEBUG "hpwdt: CRU Base Address:   0x%lx\n",
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index ba6ad662635..99796c5d913 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -384,10 +384,10 @@ MODULE_PARM_DESC(nowayout,
        "Watchdog cannot be stopped once started (default="
                                __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
-static int turn_SMI_watchdog_clear_off = 0;
+static int turn_SMI_watchdog_clear_off = 1;
 module_param(turn_SMI_watchdog_clear_off, int, 0);
 MODULE_PARM_DESC(turn_SMI_watchdog_clear_off,
-        "Turn off SMI clearing watchdog (default=0)");
+        "Turn off SMI clearing watchdog (depends on TCO-version)(default=1)");
 /*
 * Some TCO specific functions
@@ -813,7 +813,7 @@ static int __devinit iTCO_wdt_init(struct pci_dev *pdev,
                ret = -EIO;
                goto out_unmap;
        }
-        if (turn_SMI_watchdog_clear_off) {
+        if (turn_SMI_watchdog_clear_off >= iTCO_wdt_private.iTCO_version) {
                /* Bit 13: TCO_EN -> 0 = Disables TCO logic generating an SMI# */
                val32 = inl(SMI_EN);
                val32 &= 0xffffdfff;    /* Turn off SMI clearing watchdog */
diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c
index cc2cfbe33b3..bfaf9bb1ee0 100644
--- a/drivers/watchdog/sp805_wdt.c
+++ b/drivers/watchdog/sp805_wdt.c
@@ -351,7 +351,7 @@ static int __devexit sp805_wdt_remove(struct amba_device *adev)
        return 0;
 }
-static struct amba_id sp805_wdt_ids[] __initdata = {
+static struct amba_id sp805_wdt_ids[] = {
        {
                .id     = 0x00141805,
                .mask   = 0x00ffffff,
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index b3b8f2f3ad1..ede860f921d 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -621,15 +621,6 @@ static struct xenbus_watch *find_watch(const char *token)
        return NULL;
 }
-static void xs_reset_watches(void)
-{
-        int err;
-        err = xs_error(xs_single(XBT_NIL, XS_RESET_WATCHES, "", NULL));
-        if (err && err != -EEXIST)
-                printk(KERN_WARNING "xs_reset_watches failed: %d\n", err);
-}
 /* Register callback to watch this node. */
 int register_xenbus_watch(struct xenbus_watch *watch)
 {
@@ -906,9 +897,5 @@ int xs_init(void)
        if (IS_ERR(task))
                return PTR_ERR(task);
-        /* shutdown watches for kexec boot */
-        if (xen_hvm_domain())
-                xs_reset_watches();
        return 0;
 }
diff --git a/firmware/README.AddingFirmware b/firmware/README.AddingFirmware
index e24cd8986d8..ea78c3a17ee 100644
--- a/firmware/README.AddingFirmware
+++ b/firmware/README.AddingFirmware
@@ -12,7 +12,7 @@ here.
 This directory is _NOT_ for adding arbitrary new firmware images. The
 place to add those is the separate linux-firmware repository:
-    git://git.kernel.org/pub/scm/linux/kernel/git/dwmw2/linux-firmware.git
+    git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
 That repository contains all these firmware images which have been
 extracted from older drivers, as well various new firmware images which
@@ -22,6 +22,7 @@ been permitted to redistribute under separate cover.
 To submit firmware to that repository, please send either a git binary
 diff or preferably a git pull request to:
      David Woodhouse <dwmw2@infradead.org>
+      Ben Hutchings <ben@decadent.org.uk>
 Your commit should include an update to the WHENCE file clearly
 identifying the licence under which the firmware is available, and
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index cb97174e236..0b394580d86 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -563,8 +563,8 @@ static struct btrfs_worker_thread *find_worker(struct btrfs_workers *workers)
        struct list_head *fallback;
        int ret;
-again:
        spin_lock_irqsave(&workers->lock, flags);
+again:
        worker = next_worker(workers);
        if (!worker) {
@@ -579,6 +579,7 @@ again:
                        spin_unlock_irqrestore(&workers->lock, flags);
                        /* we're below the limit, start another worker */
                        ret = __btrfs_start_workers(workers);
+                        spin_lock_irqsave(&workers->lock, flags);
                        if (ret)
                                goto fallback;
                        goto again;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 0a6b928813a..fd1a06df5bc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4590,10 +4590,6 @@ static int btrfs_add_nondir(struct btrfs_trans_handle *trans,
        int err = btrfs_add_link(trans, dir, inode,
                                 dentry->d_name.name, dentry->d_name.len,
                                 backref, index);
-        if (!err) {
-                d_instantiate(dentry, inode);
-                return 0;
-        }
        if (err > 0)
                err = -EEXIST;
        return err;
@@ -4655,6 +4651,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
        else {
                init_special_inode(inode, inode->i_mode, rdev);
                btrfs_update_inode(trans, root, inode);
+                d_instantiate(dentry, inode);
        }
 out_unlock:
        nr = trans->blocks_used;
@@ -4722,6 +4719,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
                inode->i_mapping->a_ops = &btrfs_aops;
                inode->i_mapping->backing_dev_info = &root->fs_info->bdi;
                BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;
+                d_instantiate(dentry, inode);
        }
 out_unlock:
        nr = trans->blocks_used;
@@ -4779,6 +4777,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                struct dentry *parent = dentry->d_parent;
                err = btrfs_update_inode(trans, root, inode);
                BUG_ON(err);
+                d_instantiate(dentry, inode);
                btrfs_log_new_name(trans, inode, NULL, parent);
        }
@@ -7245,6 +7244,8 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
                drop_inode = 1;
 out_unlock:
+        if (!err)
+                d_instantiate(dentry, inode);
        nr = trans->blocks_used;
        btrfs_end_transaction_throttle(trans, root);
        if (drop_inode) {
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 3eeb9766126..98954003a8d 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1094,42 +1094,19 @@ static int ceph_snapdir_d_revalidate(struct dentry *dentry,
 /*
 * Set/clear/test dir complete flag on the dir's dentry.
 */
-static struct dentry * __d_find_any_alias(struct inode *inode)
-{
-        struct dentry *alias;
-        if (list_empty(&inode->i_dentry))
-                return NULL;
-        alias = list_first_entry(&inode->i_dentry, struct dentry, d_alias);
-        return alias;
-}
 void ceph_dir_set_complete(struct inode *inode)
 {
-        struct dentry *dentry = __d_find_any_alias(inode);
+        /* not yet implemented */
-        
-        if (dentry && ceph_dentry(dentry)) {
-                dout(" marking %p (%p) complete\n", inode, dentry);
-                set_bit(CEPH_D_COMPLETE, &ceph_dentry(dentry)->flags);
-        }
 }
 void ceph_dir_clear_complete(struct inode *inode)
 {
-        struct dentry *dentry = __d_find_any_alias(inode);
+        /* not yet implemented */
-        if (dentry && ceph_dentry(dentry)) {
-                dout(" marking %p (%p) NOT complete\n", inode, dentry);
-                clear_bit(CEPH_D_COMPLETE, &ceph_dentry(dentry)->flags);
-        }
 }
 bool ceph_dir_test_complete(struct inode *inode)
 {
-        struct dentry *dentry = __d_find_any_alias(inode);
+        /* not yet implemented */
-        if (dentry && ceph_dentry(dentry))
-                return test_bit(CEPH_D_COMPLETE, &ceph_dentry(dentry)->flags);
        return false;
 }
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 8cd4b52d421..f3670cf7258 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -282,7 +282,7 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
        byte_count = be32_to_cpu(pTargetSMB->smb_buf_length);
        byte_count += total_in_buf2;
        /* don't allow buffer to overflow */
-        if (byte_count > CIFSMaxBufSize)
+        if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)
                return -ENOBUFS;
        pTargetSMB->smb_buf_length = cpu_to_be32(byte_count);
@@ -2122,7 +2122,7 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
                warned_on_ntlm = true;
                cERROR(1, "default security mechanism requested.  The default "
                        "security mechanism will be upgraded from ntlm to "
-                        "ntlmv2 in kernel release 3.2");
+                        "ntlmv2 in kernel release 3.3");
        }
        ses->overrideSecFlg = volume_info->secFlg;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index ac86f8b3e3c..517f211a3bd 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -47,17 +47,6 @@ struct wb_writeback_work {
        struct completion *done;        /* set if the caller waits */
 };
-const char *wb_reason_name[] = {
-        [WB_REASON_BACKGROUND]          = "background",
-        [WB_REASON_TRY_TO_FREE_PAGES]   = "try_to_free_pages",
-        [WB_REASON_SYNC]                = "sync",
-        [WB_REASON_PERIODIC]            = "periodic",
-        [WB_REASON_LAPTOP_TIMER]        = "laptop_timer",
-        [WB_REASON_FREE_MORE_MEM]       = "free_more_memory",
-        [WB_REASON_FS_FREE_SPACE]       = "fs_free_space",
-        [WB_REASON_FORKER_THREAD]       = "forker_thread"
-};
 /*
 * Include the creation of the trace points after defining the
 * wb_writeback_work structure so that the definition remains local to this
diff --git a/fs/locks.c b/fs/locks.c
index 3b0d05dcd7c..637694bf3a0 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1205,6 +1205,8 @@ int __break_lease(struct inode *inode, unsigned int mode)
        int want_write = (mode & O_ACCMODE) != O_RDONLY;
        new_fl = lease_alloc(NULL, want_write ? F_WRLCK : F_RDLCK);
+        if (IS_ERR(new_fl))
+                return PTR_ERR(new_fl);
        lock_flocks();
@@ -1221,12 +1223,6 @@ int __break_lease(struct inode *inode, unsigned int mode)
                if (fl->fl_owner == current->files)
                        i_have_this_lease = 1;
-        if (IS_ERR(new_fl) && !i_have_this_lease
-                        && ((mode & O_NONBLOCK) == 0)) {
-                error = PTR_ERR(new_fl);
-                goto out;
-        }
        break_time = 0;
        if (lease_break_time > 0) {
                break_time = jiffies + lease_break_time * HZ;
@@ -1284,8 +1280,7 @@ restart:
 out:
        unlock_flocks();
-        if (!IS_ERR(new_fl))
+        locks_free_lock(new_fl);
-                locks_free_lock(new_fl);
        return error;
 }
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 1d9e33966db..4d46a6a5907 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -263,23 +263,6 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
                goto out_no_root;
        }
-        ret = -ENOMEM;
-        s->s_root = d_alloc_root(root_inode);
-        if (!s->s_root)
-                goto out_iput;
-        if (!(s->s_flags & MS_RDONLY)) {
-                if (sbi->s_version != MINIX_V3) /* s_state is now out from V3 sb */
-                        ms->s_state &= ~MINIX_VALID_FS;
-                mark_buffer_dirty(bh);
-        }
-        if (!(sbi->s_mount_state & MINIX_VALID_FS))
-                printk("MINIX-fs: mounting unchecked file system, "
-                        "running fsck is recommended\n");
-        else if (sbi->s_mount_state & MINIX_ERROR_FS)
-                printk("MINIX-fs: mounting file system with errors, "
-                        "running fsck is recommended\n");
        /* Apparently minix can create filesystems that allocate more blocks for
         * the bitmaps than needed.  We simply ignore that, but verify it didn't
         * create one with not enough blocks and bail out if so.
@@ -300,6 +283,23 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
                goto out_iput;
        }
+        ret = -ENOMEM;
+        s->s_root = d_alloc_root(root_inode);
+        if (!s->s_root)
+                goto out_iput;
+        if (!(s->s_flags & MS_RDONLY)) {
+                if (sbi->s_version != MINIX_V3) /* s_state is now out from V3 sb */
+                        ms->s_state &= ~MINIX_VALID_FS;
+                mark_buffer_dirty(bh);
+        }
+        if (!(sbi->s_mount_state & MINIX_VALID_FS))
+                printk("MINIX-fs: mounting unchecked file system, "
+                        "running fsck is recommended\n");
+        else if (sbi->s_mount_state & MINIX_ERROR_FS)
+                printk("MINIX-fs: mounting file system with errors, "
+                        "running fsck is recommended\n");
        return 0;
 out_iput:
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index eca56d4b39c..606ef0f20ae 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -147,7 +147,7 @@ static loff_t nfs_file_llseek(struct file *filp, loff_t offset, int origin)
         * origin == SEEK_END || SEEK_DATA || SEEK_HOLE => we must revalidate
         * the cached file length
         */
-        if (origin != SEEK_SET || origin != SEEK_CUR) {
+        if (origin != SEEK_SET && origin != SEEK_CUR) {
                struct inode *inode = filp->f_mapping->host;
                int retval = nfs_revalidate_file_size(inode, filp);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index be2bbac1381..d9f4d78c341 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -39,6 +39,8 @@
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/string.h>
+#include <linux/ratelimit.h>
+#include <linux/printk.h>
 #include <linux/slab.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/gss_api.h>
@@ -894,6 +896,8 @@ out:
 static int can_open_delegated(struct nfs_delegation *delegation, fmode_t fmode)
 {
+        if (delegation == NULL)
+                return 0;
        if ((delegation->type & fmode) != fmode)
                return 0;
        if (test_bit(NFS_DELEGATION_NEED_RECLAIM, &delegation->flags))
@@ -1036,8 +1040,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
                }
                rcu_read_lock();
                delegation = rcu_dereference(nfsi->delegation);
-                if (delegation == NULL ||
+                if (!can_open_delegated(delegation, fmode)) {
-                    !can_open_delegated(delegation, fmode)) {
                        rcu_read_unlock();
                        break;
                }
@@ -1091,7 +1094,12 @@ static struct nfs4_state *nfs4_opendata_to_nfs4_state(struct nfs4_opendata *data
                if (delegation)
                        delegation_flags = delegation->flags;
                rcu_read_unlock();
-                if ((delegation_flags & 1UL<<NFS_DELEGATION_NEED_RECLAIM) == 0)
+                if (data->o_arg.claim == NFS4_OPEN_CLAIM_DELEGATE_CUR) {
+                        pr_err_ratelimited("NFS: Broken NFSv4 server %s is "
+                                        "returning a delegation for "
+                                        "OPEN(CLAIM_DELEGATE_CUR)\n",
+                                        NFS_CLIENT(inode)->cl_server);
+                } else if ((delegation_flags & 1UL<<NFS_DELEGATION_NEED_RECLAIM) == 0)
                        nfs_inode_set_delegation(state->inode,
                                        data->owner->so_cred,
                                        &data->o_res);
@@ -1423,11 +1431,9 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
                        goto out_no_action;
                rcu_read_lock();
                delegation = rcu_dereference(NFS_I(data->state->inode)->delegation);
-                if (delegation != NULL &&
+                if (data->o_arg.claim != NFS4_OPEN_CLAIM_DELEGATE_CUR &&
-                    test_bit(NFS_DELEGATION_NEED_RECLAIM, &delegation->flags) == 0) {
+                    can_open_delegated(delegation, data->o_arg.fmode))
-                        rcu_read_unlock();
+                        goto unlock_no_action;
-                        goto out_no_action;
-                }
                rcu_read_unlock();
        }
        /* Update sequence id. */
@@ -1444,6 +1450,8 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
                return;
        rpc_call_start(task);
        return;
+unlock_no_action:
+        rcu_read_unlock();
 out_no_action:
        task->tk_action = NULL;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 39914be40b0..6a7107ae6b7 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1156,11 +1156,13 @@ restart:
                if (status >= 0) {
                        status = nfs4_reclaim_locks(state, ops);
                        if (status >= 0) {
+                                spin_lock(&state->state_lock);
                                list_for_each_entry(lock, &state->lock_states, ls_locks) {
                                        if (!(lock->ls_flags & NFS_LOCK_INITIALIZED))
                                                printk("%s: Lock reclaim failed!\n",
                                                        __func__);
                                }
+                                spin_unlock(&state->state_lock);
                                nfs4_put_open_state(state);
                                goto restart;
                        }
@@ -1224,10 +1226,12 @@ static void nfs4_clear_open_state(struct nfs4_state *state)
        clear_bit(NFS_O_RDONLY_STATE, &state->flags);
        clear_bit(NFS_O_WRONLY_STATE, &state->flags);
        clear_bit(NFS_O_RDWR_STATE, &state->flags);
+        spin_lock(&state->state_lock);
        list_for_each_entry(lock, &state->lock_states, ls_locks) {
                lock->ls_seqid.flags = 0;
                lock->ls_flags &= ~NFS_LOCK_INITIALIZED;
        }
+        spin_unlock(&state->state_lock);
 }
 static void nfs4_reset_seqids(struct nfs_server *server,
@@ -1350,12 +1354,14 @@ static void nfs4_warn_keyexpired(const char *s)
 static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
 {
        switch (error) {
+                case 0:
+                        break;
                case -NFS4ERR_CB_PATH_DOWN:
                        nfs_handle_cb_pathdown(clp);
-                        return 0;
+                        break;
                case -NFS4ERR_NO_GRACE:
                        nfs4_state_end_reclaim_reboot(clp);
-                        return 0;
+                        break;
                case -NFS4ERR_STALE_CLIENTID:
                case -NFS4ERR_LEASE_MOVED:
                        set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
@@ -1375,13 +1381,15 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
                case -NFS4ERR_SEQ_MISORDERED:
                        set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
                        /* Zero session reset errors */
-                        return 0;
+                        break;
                case -EKEYEXPIRED:
                        /* Nothing we can do */
                        nfs4_warn_keyexpired(clp->cl_hostname);
-                        return 0;
+                        break;
+                default:
+                        return error;
        }
-        return error;
+        return 0;
 }
 static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recovery_ops *ops)
@@ -1428,7 +1436,7 @@ static int nfs4_check_lease(struct nfs_client *clp)
        struct rpc_cred *cred;
        const struct nfs4_state_maintenance_ops *ops =
                clp->cl_mvops->state_renewal_ops;
-        int status = -NFS4ERR_EXPIRED;
+        int status;
        /* Is the client already known to have an expired lease? */
        if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
@@ -1438,6 +1446,7 @@ static int nfs4_check_lease(struct nfs_client *clp)
        spin_unlock(&clp->cl_lock);
        if (cred == NULL) {
                cred = nfs4_get_setclientid_cred(clp);
+                status = -ENOKEY;
                if (cred == NULL)
                        goto out;
        }
@@ -1525,16 +1534,16 @@ void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags)
 {
        if (!flags)
                return;
-        else if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
+        if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
                nfs41_handle_server_reboot(clp);
-        else if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
+        if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
                            SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
                            SEQ4_STATUS_ADMIN_STATE_REVOKED |
                            SEQ4_STATUS_LEASE_MOVED))
                nfs41_handle_state_revoked(clp);
-        else if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
+        if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
                nfs41_handle_recallable_state_revoked(clp);
-        else if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
+        if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
                            SEQ4_STATUS_BACKCHANNEL_FAULT |
                            SEQ4_STATUS_CB_PATH_DOWN_SESSION))
                nfs41_handle_cb_path_down(clp);
@@ -1662,10 +1671,10 @@ static void nfs4_state_manager(struct nfs_client *clp)
                if (test_and_clear_bit(NFS4CLNT_CHECK_LEASE, &clp->cl_state)) {
                        status = nfs4_check_lease(clp);
+                        if (status < 0)
+                                goto out_error;
                        if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
                                continue;
-                        if (status < 0 && status != -NFS4ERR_CB_PATH_DOWN)
-                                goto out_error;
                }
                /* Initialize or reset the session */
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 41d6743d303..ac258beeda3 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -625,6 +625,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
                if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
                        goto out_free;
+                if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
+                        goto out_free;
                len = argv[n].v_size * argv[n].v_nmembs;
                base = (void __user *)(unsigned long)argv[n].v_base;
                if (len == 0) {
@@ -842,6 +845,19 @@ long nilfs_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        case FS_IOC32_GETVERSION:
                cmd = FS_IOC_GETVERSION;
                break;
+        case NILFS_IOCTL_CHANGE_CPMODE:
+        case NILFS_IOCTL_DELETE_CHECKPOINT:
+        case NILFS_IOCTL_GET_CPINFO:
+        case NILFS_IOCTL_GET_CPSTAT:
+        case NILFS_IOCTL_GET_SUINFO:
+        case NILFS_IOCTL_GET_SUSTAT:
+        case NILFS_IOCTL_GET_VINFO:
+        case NILFS_IOCTL_GET_BDESCS:
+        case NILFS_IOCTL_CLEAN_SEGMENTS:
+        case NILFS_IOCTL_SYNC:
+        case NILFS_IOCTL_RESIZE:
+        case NILFS_IOCTL_SET_ALLOC_RANGE:
+                break;
        default:
                return -ENOIOCTLCMD;
        }
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 2a30d67dd6b..0855e6f2039 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -32,7 +32,7 @@ static cputime64_t get_idle_time(int cpu)
                idle = kstat_cpu(cpu).cpustat.idle;
                idle = cputime64_add(idle, arch_idle_time(cpu));
        } else
-                idle = nsecs_to_jiffies64(1000 * idle_time);
+                idle = usecs_to_cputime64(idle_time);
        return idle;
 }
@@ -46,7 +46,7 @@ static cputime64_t get_iowait_time(int cpu)
                /* !NO_HZ so we can rely on cpustat.iowait */
                iowait = kstat_cpu(cpu).cpustat.iowait;
        else
-                iowait = nsecs_to_jiffies64(1000 * iowait_time);
+                iowait = usecs_to_cputime64(iowait_time);
        return iowait;
 }
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 3eca58f51ae..8a899496fd5 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -869,27 +869,6 @@ xfs_fs_dirty_inode(
 }
 STATIC int
-xfs_log_inode(
-        struct xfs_inode        *ip)
-{
-        struct xfs_mount        *mp = ip->i_mount;
-        struct xfs_trans        *tp;
-        int                     error;
-        tp = xfs_trans_alloc(mp, XFS_TRANS_FSYNC_TS);
-        error = xfs_trans_reserve(tp, 0, XFS_FSYNC_TS_LOG_RES(mp), 0, 0, 0);
-        if (error) {
-                xfs_trans_cancel(tp, 0);
-                return error;
-        }
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
-        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-        return xfs_trans_commit(tp, 0);
-}
-STATIC int
 xfs_fs_write_inode(
        struct inode            *inode,
        struct writeback_control *wbc)
@@ -902,10 +881,8 @@ xfs_fs_write_inode(
        if (XFS_FORCED_SHUTDOWN(mp))
                return -XFS_ERROR(EIO);
-        if (!ip->i_update_core)
-                return 0;
-        if (wbc->sync_mode == WB_SYNC_ALL) {
+        if (wbc->sync_mode == WB_SYNC_ALL || wbc->for_kupdate) {
                /*
                 * Make sure the inode has made it it into the log.  Instead
                 * of forcing it all the way to stable storage using a
@@ -913,11 +890,14 @@ xfs_fs_write_inode(
                 * ->sync_fs call do that for thus, which reduces the number
                 * of synchronous log forces dramatically.
                 */
-                error = xfs_log_inode(ip);
+                error = xfs_log_dirty_inode(ip, NULL, 0);
                if (error)
                        goto out;
                return 0;
        } else {
+                if (!ip->i_update_core)
+                        return 0;
                /*
                 * We make this non-blocking if the inode is contended, return
                 * EAGAIN to indicate to the caller that they did not succeed.
diff --git a/fs/xfs/xfs_sync.c b/fs/xfs/xfs_sync.c
index be5c51d8f75..f0994aedcd1 100644
--- a/fs/xfs/xfs_sync.c
+++ b/fs/xfs/xfs_sync.c
@@ -336,6 +336,32 @@ xfs_sync_fsdata(
        return error;
 }
+int
+xfs_log_dirty_inode(
+        struct xfs_inode        *ip,
+        struct xfs_perag        *pag,
+        int                     flags)
+{
+        struct xfs_mount        *mp = ip->i_mount;
+        struct xfs_trans        *tp;
+        int                     error;
+        if (!ip->i_update_core)
+                return 0;
+        tp = xfs_trans_alloc(mp, XFS_TRANS_FSYNC_TS);
+        error = xfs_trans_reserve(tp, 0, XFS_FSYNC_TS_LOG_RES(mp), 0, 0, 0);
+        if (error) {
+                xfs_trans_cancel(tp, 0);
+                return error;
+        }
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
+        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+        return xfs_trans_commit(tp, 0);
+}
 /*
 * When remounting a filesystem read-only or freezing the filesystem, we have
 * two phases to execute. This first phase is syncing the data before we
@@ -359,6 +385,16 @@ xfs_quiesce_data(
 {
        int                     error, error2 = 0;
+        /*
+         * Log all pending size and timestamp updates.  The vfs writeback
+         * code is supposed to do this, but due to its overagressive
+         * livelock detection it will skip inodes where appending writes
+         * were written out in the first non-blocking sync phase if their
+         * completion took long enough that it happened after taking the
+         * timestamp for the cut-off in the blocking phase.
+         */
+        xfs_inode_ag_iterator(mp, xfs_log_dirty_inode, 0);
        xfs_qm_sync(mp, SYNC_TRYLOCK);
        xfs_qm_sync(mp, SYNC_WAIT);
diff --git a/fs/xfs/xfs_sync.h b/fs/xfs/xfs_sync.h
index 941202e7ac6..fa965479d78 100644
--- a/fs/xfs/xfs_sync.h
+++ b/fs/xfs/xfs_sync.h
@@ -34,6 +34,8 @@ void xfs_quiesce_attr(struct xfs_mount *mp);
 void xfs_flush_inodes(struct xfs_inode *ip);
+int xfs_log_dirty_inode(struct xfs_inode *ip, struct xfs_perag *pag, int flags);
 int xfs_reclaim_inodes(struct xfs_mount *mp, int mode);
 int xfs_reclaim_inodes_count(struct xfs_mount *mp);
 void xfs_reclaim_inodes_nr(struct xfs_mount *mp, int nr_to_scan);
diff --git a/include/asm-generic/cputime.h b/include/asm-generic/cputime.h
index 62ce6823c0f..12a1764f612 100644
--- a/include/asm-generic/cputime.h
+++ b/include/asm-generic/cputime.h
@@ -40,6 +40,7 @@ typedef u64 cputime64_t;
 */
 #define cputime_to_usecs(__ct)          jiffies_to_usecs(__ct)
 #define usecs_to_cputime(__msecs)       usecs_to_jiffies(__msecs)
+#define usecs_to_cputime64(__msecs)     nsecs_to_jiffies64((__msecs) * 1000)
 /*
 * Convert cputime to seconds and back.
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index c86c940d1de..081147da056 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -71,7 +71,7 @@ struct timecounter {
 /**
 * cyclecounter_cyc2ns - converts cycle counter cycles to nanoseconds
- * @tc:         Pointer to cycle counter.
+ * @cc:         Pointer to cycle counter.
 * @cycles:     Cycles
 *
 * XXX - This could use some mult_lxl_ll() asm optimization. Same code
@@ -114,7 +114,7 @@ extern u64 timecounter_read(struct timecounter *tc);
 *                        time base as values returned by
 *                        timecounter_read()
 * @tc:         Pointer to time counter.
- * @cycle:      a value returned by tc->cc->read()
+ * @cycle_tstamp:       a value returned by tc->cc->read()
 *
 * Cycle counts that are converted correctly as long as they
 * fall into the interval [-1/2 max cycle count, +1/2 max cycle count],
@@ -156,11 +156,12 @@ extern u64 timecounter_cyc2time(struct timecounter *tc,
 * @mult:               cycle to nanosecond multiplier
 * @shift:              cycle to nanosecond divisor (power of two)
 * @max_idle_ns:        max idle time permitted by the clocksource (nsecs)
- * @maxadj              maximum adjustment value to mult (~11%)
+ * @maxadj:             maximum adjustment value to mult (~11%)
 * @flags:              flags describing special properties
 * @archdata:           arch-specific data
 * @suspend:            suspend function for the clocksource, if necessary
 * @resume:             resume function for the clocksource, if necessary
+ * @cycle_last:         most recent cycle counter value seen by ::read()
 */
 struct clocksource {
        /*
@@ -187,6 +188,7 @@ struct clocksource {
        void (*suspend)(struct clocksource *cs);
        void (*resume)(struct clocksource *cs);
+        /* private: */
 #ifdef CONFIG_CLOCKSOURCE_WATCHDOG
        /* Watchdog related data, used by the framework */
        struct list_head wd_list;
@@ -261,6 +263,9 @@ static inline u32 clocksource_hz2mult(u32 hz, u32 shift_constant)
 /**
 * clocksource_cyc2ns - converts clocksource cycles to nanoseconds
+ * @cycles:     cycles
+ * @mult:       cycle to nanosecond multiplier
+ * @shift:      cycle to nanosecond divisor (power of two)
 *
 * Converts cycles to nanoseconds, using the given mult and shift.
 *
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index c3892fc1d53..68e67e50d02 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -557,6 +557,7 @@ struct kvm_ppc_pvinfo {
 #define KVM_CAP_MAX_VCPUS 66       /* returns max vcpus per vm */
 #define KVM_CAP_PPC_PAPR 68
 #define KVM_CAP_S390_GMAP 71
+#define KVM_CAP_TSC_DEADLINE_TIMER 72
 #ifdef KVM_CAP_IRQ_ROUTING
diff --git a/include/linux/lglock.h b/include/linux/lglock.h
index f549056fb20..87f402ccec5 100644
--- a/include/linux/lglock.h
+++ b/include/linux/lglock.h
@@ -22,6 +22,7 @@
 #include <linux/spinlock.h>
 #include <linux/lockdep.h>
 #include <linux/percpu.h>
+#include <linux/cpu.h>
 /* can make br locks by using local lock for read side, global lock for write */
 #define br_lock_init(name)      name##_lock_init()
@@ -72,9 +73,31 @@
 #define DEFINE_LGLOCK(name)                                             \
                                                                        \
+ DEFINE_SPINLOCK(name##_cpu_lock);                                      \
+ cpumask_t name##_cpus __read_mostly;                                   \
 DEFINE_PER_CPU(arch_spinlock_t, name##_lock);                          \
 DEFINE_LGLOCK_LOCKDEP(name);                                           \
                                                                        \
+ static int                                                             \
+ name##_lg_cpu_callback(struct notifier_block *nb,                      \
+                                unsigned long action, void *hcpu)       \
+ {                                                                      \
+        switch (action & ~CPU_TASKS_FROZEN) {                           \
+        case CPU_UP_PREPARE:                                            \
+                spin_lock(&name##_cpu_lock);                            \
+                cpu_set((unsigned long)hcpu, name##_cpus);              \
+                spin_unlock(&name##_cpu_lock);                          \
+                break;                                                  \
+        case CPU_UP_CANCELED: case CPU_DEAD:                            \
+                spin_lock(&name##_cpu_lock);                            \
+                cpu_clear((unsigned long)hcpu, name##_cpus);            \
+                spin_unlock(&name##_cpu_lock);                          \
+        }                                                               \
+        return NOTIFY_OK;                                               \
+ }                                                                      \
+ static struct notifier_block name##_lg_cpu_notifier = {                \
+        .notifier_call = name##_lg_cpu_callback,                        \
+ };                                                                     \
 void name##_lock_init(void) {                                          \
        int i;                                                          \
        LOCKDEP_INIT_MAP(&name##_lock_dep_map, #name, &name##_lock_key, 0); \
@@ -83,6 +106,11 @@
                lock = &per_cpu(name##_lock, i);                        \
                *lock = (arch_spinlock_t)__ARCH_SPIN_LOCK_UNLOCKED;     \
        }                                                               \
+        register_hotcpu_notifier(&name##_lg_cpu_notifier);              \
+        get_online_cpus();                                              \
+        for_each_online_cpu(i)                                          \
+                cpu_set(i, name##_cpus);                                \
+        put_online_cpus();                                              \
 }                                                                      \
 EXPORT_SYMBOL(name##_lock_init);                                       \
                                                                        \
@@ -124,9 +152,9 @@
                                                                        \
 void name##_global_lock_online(void) {                                 \
        int i;                                                          \
-        preempt_disable();                                              \
+        spin_lock(&name##_cpu_lock);                                    \
        rwlock_acquire(&name##_lock_dep_map, 0, 0, _RET_IP_);           \
-        for_each_online_cpu(i) {                                        \
+        for_each_cpu(i, &name##_cpus) {                                 \
                arch_spinlock_t *lock;                                  \
                lock = &per_cpu(name##_lock, i);                        \
                arch_spin_lock(lock);                                   \
@@ -137,12 +165,12 @@
 void name##_global_unlock_online(void) {                               \
        int i;                                                          \
        rwlock_release(&name##_lock_dep_map, 1, _RET_IP_);              \
-        for_each_online_cpu(i) {                                        \
+        for_each_cpu(i, &name##_cpus) {                                 \
                arch_spinlock_t *lock;                                  \
                lock = &per_cpu(name##_lock, i);                        \
                arch_spin_unlock(lock);                                 \
        }                                                               \
-        preempt_enable();                                               \
+        spin_unlock(&name##_cpu_lock);                                  \
 }                                                                      \
 EXPORT_SYMBOL(name##_global_unlock_online);                            \
                                                                        \
diff --git a/include/linux/security.h b/include/linux/security.h
index 19d8e04e168..e8c619d3929 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -2056,7 +2056,7 @@ static inline int security_old_inode_init_security(struct inode *inode,
                                                   char **name, void **value,
                                                   size_t *len)
 {
-        return 0;
+        return -EOPNOTSUPP;
 }
 static inline int security_inode_create(struct inode *dir,
diff --git a/include/media/soc_camera.h b/include/media/soc_camera.h
index b1377b931eb..5fb2c3d10c0 100644
--- a/include/media/soc_camera.h
+++ b/include/media/soc_camera.h
@@ -254,7 +254,7 @@ unsigned long soc_camera_apply_board_flags(struct soc_camera_link *icl,
 static inline struct video_device *soc_camera_i2c_to_vdev(const struct i2c_client *client)
 {
        struct v4l2_subdev *sd = i2c_get_clientdata(client);
-        struct soc_camera_device *icd = (struct soc_camera_device *)sd->grp_id;
+        struct soc_camera_device *icd = v4l2_get_subdev_hostdata(sd);
        return icd ? icd->vdev : NULL;
 }
@@ -279,6 +279,11 @@ static inline struct soc_camera_device *soc_camera_from_vbq(const struct videobu
        return container_of(vq, struct soc_camera_device, vb_vidq);
 }
+static inline u32 soc_camera_grp_id(const struct soc_camera_device *icd)
+{
+        return (icd->iface << 8) | (icd->devnum + 1);
+}
 void soc_camera_lock(struct vb2_queue *vq);
 void soc_camera_unlock(struct vb2_queue *vq);
diff --git a/include/net/dst.h b/include/net/dst.h
index 6faec1a6021..75766b42660 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -53,6 +53,7 @@ struct dst_entry {
 #define DST_NOHASH              0x0008
 #define DST_NOCACHE             0x0010
 #define DST_NOCOUNT             0x0020
+#define DST_NOPEER              0x0040
        short                   error;
        short                   obsolete;
diff --git a/include/net/flow.h b/include/net/flow.h
index a09447749e2..57f15a7f1cd 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -207,6 +207,7 @@ extern struct flow_cache_object *flow_cache_lookup(
                u8 dir, flow_resolve_t resolver, void *ctx);
 extern void flow_cache_flush(void);
+extern void flow_cache_flush_deferred(void);
 extern atomic_t flow_cache_genid;
 #endif
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 873d5be7926..e5a7b9aaf55 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1207,7 +1207,7 @@ extern void ip_vs_control_cleanup(void);
 extern struct ip_vs_dest *
 ip_vs_find_dest(struct net *net, int af, const union nf_inet_addr *daddr,
                __be16 dport, const union nf_inet_addr *vaddr, __be16 vport,
-                __u16 protocol, __u32 fwmark);
+                __u16 protocol, __u32 fwmark, __u32 flags);
 extern struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp);
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index e90e7a9935d..a15432da27c 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -241,6 +241,9 @@ extern struct sctp_globals {
         * bits is an indicator of when to send and window update SACK.
         */
        int rwnd_update_shift;
+        /* Threshold for autoclose timeout, in seconds. */
+        unsigned long max_autoclose;
 } sctp_globals;
 #define sctp_rto_initial                (sctp_globals.rto_initial)
@@ -281,6 +284,7 @@ extern struct sctp_globals {
 #define sctp_auth_enable                (sctp_globals.auth_enable)
 #define sctp_checksum_disable           (sctp_globals.checksum_disable)
 #define sctp_rwnd_upd_shift             (sctp_globals.rwnd_update_shift)
+#define sctp_max_autoclose              (sctp_globals.max_autoclose)
 /* SCTP Socket type: UDP or TCP style. */
 typedef enum {
diff --git a/include/net/sock.h b/include/net/sock.h
index abb6e0f0c3c..32e39371fba 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -637,12 +637,14 @@ static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
 /*
 * Take into account size of receive queue and backlog queue
+ * Do not take into account this skb truesize,
+ * to allow even a single big packet to come.
 */
 static inline bool sk_rcvqueues_full(const struct sock *sk, const struct sk_buff *skb)
 {
        unsigned int qsize = sk->sk_backlog.len + atomic_read(&sk->sk_rmem_alloc);
-        return qsize + skb->truesize > sk->sk_rcvbuf;
+        return qsize > sk->sk_rcvbuf;
 }
 /* The per-socket spinlock must be held here. */
diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
index d1e95c6ac77..5a35a2a2d3c 100644
--- a/include/scsi/libfcoe.h
+++ b/include/scsi/libfcoe.h
@@ -147,6 +147,7 @@ struct fcoe_ctlr {
        u8 map_dest;
        u8 spma;
        u8 probe_tries;
+        u8 priority;
        u8 dest_addr[ETH_ALEN];
        u8 ctl_src_addr[ETH_ALEN];
@@ -301,6 +302,7 @@ struct fcoe_percpu_s {
 * @lport:                     The associated local port
 * @fcoe_pending_queue:        The pending Rx queue of skbs
 * @fcoe_pending_queue_active: Indicates if the pending queue is active
+ * @priority:                  Packet priority (DCB)
 * @max_queue_depth:           Max queue depth of pending queue
 * @min_queue_depth:           Min queue depth of pending queue
 * @timer:                     The queue timer
@@ -316,6 +318,7 @@ struct fcoe_port {
        struct fc_lport       *lport;
        struct sk_buff_head   fcoe_pending_queue;
        u8                    fcoe_pending_queue_active;
+        u8                    priority;
        u32                   max_queue_depth;
        u32                   min_queue_depth;
        struct timer_list     timer;
diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index b99caa8b780..99d1d0decf8 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -21,6 +21,16 @@
                {I_REFERENCED,          "I_REFERENCED"}         \
        )
+#define WB_WORK_REASON                                                  \
+                {WB_REASON_BACKGROUND,          "background"},          \
+                {WB_REASON_TRY_TO_FREE_PAGES,   "try_to_free_pages"},   \
+                {WB_REASON_SYNC,                "sync"},                \
+                {WB_REASON_PERIODIC,            "periodic"},            \
+                {WB_REASON_LAPTOP_TIMER,        "laptop_timer"},        \
+                {WB_REASON_FREE_MORE_MEM,       "free_more_memory"},    \
+                {WB_REASON_FS_FREE_SPACE,       "fs_free_space"},       \
+                {WB_REASON_FORKER_THREAD,       "forker_thread"}
 struct wb_writeback_work;
 DECLARE_EVENT_CLASS(writeback_work_class,
@@ -55,7 +65,7 @@ DECLARE_EVENT_CLASS(writeback_work_class,
                  __entry->for_kupdate,
                  __entry->range_cyclic,
                  __entry->for_background,
-                  wb_reason_name[__entry->reason]
+                  __print_symbolic(__entry->reason, WB_WORK_REASON)
        )
 );
 #define DEFINE_WRITEBACK_WORK_EVENT(name) \
@@ -184,7 +194,8 @@ TRACE_EVENT(writeback_queue_io,
                __entry->older, /* older_than_this in jiffies */
                __entry->age,   /* older_than_this in relative milliseconds */
                __entry->moved,
-                wb_reason_name[__entry->reason])
+                __print_symbolic(__entry->reason, WB_WORK_REASON)
+        )
 );
 TRACE_EVENT(global_dirty_state,
diff --git a/include/xen/interface/io/xs_wire.h b/include/xen/interface/io/xs_wire.h
index f0b6890370b..f6f07aa35af 100644
--- a/include/xen/interface/io/xs_wire.h
+++ b/include/xen/interface/io/xs_wire.h
@@ -29,8 +29,7 @@ enum xsd_sockmsg_type
    XS_IS_DOMAIN_INTRODUCED,
    XS_RESUME,
    XS_SET_TARGET,
-    XS_RESTRICT,
+    XS_RESTRICT
-    XS_RESET_WATCHES
 };
 #define XS_WRITE_NONE "NONE"
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index d9d5648f3cd..a184470cf9b 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2098,11 +2098,6 @@ int cgroup_attach_proc(struct cgroup *cgrp, struct task_struct *leader)
                        continue;
                /* get old css_set pointer */
                task_lock(tsk);
-                if (tsk->flags & PF_EXITING) {
-                        /* ignore this task if it's going away */
-                        task_unlock(tsk);
-                        continue;
-                }
                oldcg = tsk->cgroups;
                get_css_set(oldcg);
                task_unlock(tsk);
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 9fe58c46a42..0b1712dba58 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -123,6 +123,19 @@ static inline struct cpuset *task_cs(struct task_struct *task)
                            struct cpuset, css);
 }
+#ifdef CONFIG_NUMA
+static inline bool task_has_mempolicy(struct task_struct *task)
+{
+        return task->mempolicy;
+}
+#else
+static inline bool task_has_mempolicy(struct task_struct *task)
+{
+        return false;
+}
+#endif
 /* bits in struct cpuset flags field */
 typedef enum {
        CS_CPU_EXCLUSIVE,
@@ -949,7 +962,7 @@ static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
 static void cpuset_change_task_nodemask(struct task_struct *tsk,
                                        nodemask_t *newmems)
 {
-        bool masks_disjoint = !nodes_intersects(*newmems, tsk->mems_allowed);
+        bool need_loop;
 repeat:
        /*
@@ -962,6 +975,14 @@ repeat:
                return;
        task_lock(tsk);
+        /*
+         * Determine if a loop is necessary if another thread is doing
+         * get_mems_allowed().  If at least one node remains unchanged and
+         * tsk does not have a mempolicy, then an empty nodemask will not be
+         * possible when mems_allowed is larger than a word.
+         */
+        need_loop = task_has_mempolicy(tsk) ||
+                        !nodes_intersects(*newmems, tsk->mems_allowed);
        nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
        mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
@@ -981,11 +1002,9 @@ repeat:
        /*
         * Allocation of memory is very fast, we needn't sleep when waiting
-         * for the read-side.  No wait is necessary, however, if at least one
+         * for the read-side.
-         * node remains unchanged.
         */
-        while (masks_disjoint &&
+        while (need_loop && ACCESS_ONCE(tsk->mems_allowed_change_disable)) {
-                        ACCESS_ONCE(tsk->mems_allowed_change_disable)) {
                task_unlock(tsk);
                if (!task_curr(tsk))
                        yield();
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 2f8f3f103cb..24e3a4b1c89 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3360,9 +3360,13 @@ static void ring_buffer_wakeup(struct perf_event *event)
        rcu_read_lock();
        rb = rcu_dereference(event->rb);
-        list_for_each_entry_rcu(event, &rb->event_list, rb_entry) {
+        if (!rb)
+                goto unlock;
+        list_for_each_entry_rcu(event, &rb->event_list, rb_entry)
                wake_up_all(&event->waitq);
-        }
+unlock:
        rcu_read_unlock();
 }
diff --git a/kernel/exit.c b/kernel/exit.c
index d0b7d988f87..e6e01b959a0 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1540,8 +1540,15 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
        }
        /* dead body doesn't have much to contribute */
-        if (p->exit_state == EXIT_DEAD)
+        if (unlikely(p->exit_state == EXIT_DEAD)) {
+                /*
+                 * But do not ignore this task until the tracer does
+                 * wait_task_zombie()->do_notify_parent().
+                 */
+                if (likely(!ptrace) && unlikely(ptrace_reparented(p)))
+                        wo->notask_error = 0;
                return 0;
+        }
        /* slay zombie? */
        if (p->exit_state == EXIT_ZOMBIE) {
diff --git a/kernel/futex.c b/kernel/futex.c
index ea87f4d2f45..1614be20173 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -314,17 +314,29 @@ again:
 #endif
        lock_page(page_head);
+        /*
+         * If page_head->mapping is NULL, then it cannot be a PageAnon
+         * page; but it might be the ZERO_PAGE or in the gate area or
+         * in a special mapping (all cases which we are happy to fail);
+         * or it may have been a good file page when get_user_pages_fast
+         * found it, but truncated or holepunched or subjected to
+         * invalidate_complete_page2 before we got the page lock (also
+         * cases which we are happy to fail).  And we hold a reference,
+         * so refcount care in invalidate_complete_page's remove_mapping
+         * prevents drop_caches from setting mapping to NULL beneath us.
+         *
+         * The case we do have to guard against is when memory pressure made
+         * shmem_writepage move it from filecache to swapcache beneath us:
+         * an unlikely race, but we do need to retry for page_head->mapping.
+         */
        if (!page_head->mapping) {
+                int shmem_swizzled = PageSwapCache(page_head);
                unlock_page(page_head);
                put_page(page_head);
-                /*
+                if (shmem_swizzled)
-                * ZERO_PAGE pages don't have a mapping. Avoid a busy loop
+                        goto again;
-                * trying to find one. RW mapping would have COW'd (and thus
+                return -EFAULT;
-                * have a mapping) so this page is RO and won't ever change.
-                */
-                if ((page_head == ZERO_PAGE(address)))
-                        return -EFAULT;
-                goto again;
        }
        /*
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 8b1748d0172..2e48ec0c2e9 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -74,11 +74,17 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
        /*
         * Ensure the task is not frozen.
-         * Also, when a freshly created task is scheduled once, changes
+         * Also, skip vfork and any other user process that freezer should skip.
-         * its state to TASK_UNINTERRUPTIBLE without having ever been
-         * switched out once, it musn't be checked.
         */
-        if (unlikely(t->flags & PF_FROZEN || !switch_count))
+        if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP)))
+            return;
+        /*
+         * When a freshly created task is scheduled once, changes its state to
+         * TASK_UNINTERRUPTIBLE without having ever been switched out once, it
+         * musn't be checked.
+         */
+        if (unlikely(!switch_count))
                return;
        if (switch_count != t->last_switch_count) {
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 24d04477b25..78ab24a7b0e 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -96,9 +96,20 @@ void __ptrace_unlink(struct task_struct *child)
         */
        if (!(child->flags & PF_EXITING) &&
            (child->signal->flags & SIGNAL_STOP_STOPPED ||
-             child->signal->group_stop_count))
+             child->signal->group_stop_count)) {
                child->jobctl |= JOBCTL_STOP_PENDING;
+                /*
+                 * This is only possible if this thread was cloned by the
+                 * traced task running in the stopped group, set the signal
+                 * for the future reports.
+                 * FIXME: we should change ptrace_init_task() to handle this
+                 * case.
+                 */
+                if (!(child->jobctl & JOBCTL_STOP_SIGMASK))
+                        child->jobctl |= SIGSTOP;
+        }
        /*
         * If transition to TASK_STOPPED is pending or in TASK_TRACED, kick
         * @child in the butt.  Note that @resume should be used iff @child
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index a78ed2736ba..8a39fa3e3c6 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -2352,13 +2352,11 @@ again:
                if (!smt && (sd->flags & SD_SHARE_CPUPOWER))
                        continue;
-                if (!(sd->flags & SD_SHARE_PKG_RESOURCES)) {
+                if (smt && !(sd->flags & SD_SHARE_CPUPOWER))
-                        if (!smt) {
+                        break;
-                                smt = 1;
-                                goto again;
+                if (!(sd->flags & SD_SHARE_PKG_RESOURCES))
-                        }
                        break;
-                }
                sg = sd->groups;
                do {
@@ -2378,6 +2376,10 @@ next:
                        sg = sg->next;
                } while (sg != sd->groups);
        }
+        if (!smt) {
+                smt = 1;
+                goto again;
+        }
 done:
        rcu_read_unlock();
diff --git a/kernel/signal.c b/kernel/signal.c
index b3f78d09a10..206551563cc 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1994,8 +1994,6 @@ static bool do_signal_stop(int signr)
                 */
                if (!(sig->flags & SIGNAL_STOP_STOPPED))
                        sig->group_exit_code = signr;
-                else
-                        WARN_ON_ONCE(!current->ptrace);
                sig->group_stop_count = 0;
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 6318b511afa..a650694883a 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1354,7 +1354,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
        fput(file);
 out_putname:
-        putname(pathname);
+        __putname(pathname);
 out:
        return result;
 }
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index c4eb71c8b2e..1ecd6ba36d6 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -387,7 +387,6 @@ void clockevents_exchange_device(struct clock_event_device *old,
         * released list and do a notify add later.
         */
        if (old) {
-                old->event_handler = clockevents_handle_noop;
                clockevents_set_mode(old, CLOCK_EVT_MODE_UNUSED);
                list_del(&old->list);
                list_add(&old->list, &clockevents_released);
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index da2f760e780..d3ad022136e 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -647,7 +647,7 @@ static void clocksource_enqueue(struct clocksource *cs)
 /**
 * __clocksource_updatefreq_scale - Used update clocksource with new freq
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
 * @scale:      Scale factor multiplied against freq to get clocksource hz
 * @freq:       clocksource frequency (cycles per second) divided by scale
 *
@@ -699,7 +699,7 @@ EXPORT_SYMBOL_GPL(__clocksource_updatefreq_scale);
 /**
 * __clocksource_register_scale - Used to install new clocksources
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
 * @scale:      Scale factor multiplied against freq to get clocksource hz
 * @freq:       clocksource frequency (cycles per second) divided by scale
 *
@@ -727,7 +727,7 @@ EXPORT_SYMBOL_GPL(__clocksource_register_scale);
 /**
 * clocksource_register - Used to install new clocksources
- * @t:          clocksource to be registered
+ * @cs:         clocksource to be registered
 *
 * Returns -EBUSY if registration fails, zero otherwise.
 */
@@ -761,6 +761,8 @@ static void __clocksource_change_rating(struct clocksource *cs, int rating)
 /**
 * clocksource_change_rating - Change the rating of a registered clocksource
+ * @cs:         clocksource to be changed
+ * @rating:     new rating
 */
 void clocksource_change_rating(struct clocksource *cs, int rating)
 {
@@ -772,6 +774,7 @@ EXPORT_SYMBOL(clocksource_change_rating);
 /**
 * clocksource_unregister - remove a registered clocksource
+ * @cs: clocksource to be unregistered
 */
 void clocksource_unregister(struct clocksource *cs)
 {
@@ -787,6 +790,7 @@ EXPORT_SYMBOL(clocksource_unregister);
 /**
 * sysfs_show_current_clocksources - sysfs interface for current clocksource
 * @dev:        unused
+ * @attr:       unused
 * @buf:        char buffer to be filled with clocksource list
 *
 * Provides sysfs interface for listing current clocksource.
@@ -807,6 +811,7 @@ sysfs_show_current_clocksources(struct sys_device *dev,
 /**
 * sysfs_override_clocksource - interface for manually overriding clocksource
 * @dev:        unused
+ * @attr:       unused
 * @buf:        name of override clocksource
 * @count:      length of buffer
 *
@@ -842,6 +847,7 @@ static ssize_t sysfs_override_clocksource(struct sys_device *dev,
 /**
 * sysfs_show_available_clocksources - sysfs interface for listing clocksource
 * @dev:        unused
+ * @attr:       unused
 * @buf:        char buffer to be filled with clocksource list
 *
 * Provides sysfs interface for listing registered clocksources
diff --git a/mm/filemap.c b/mm/filemap.c
index c106d3b3cc6..5f0a3c91fda 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1828,7 +1828,7 @@ repeat:
                page = __page_cache_alloc(gfp | __GFP_COLD);
                if (!page)
                        return ERR_PTR(-ENOMEM);
-                err = add_to_page_cache_lru(page, mapping, index, GFP_KERNEL);
+                err = add_to_page_cache_lru(page, mapping, index, gfp);
                if (unlikely(err)) {
                        page_cache_release(page);
                        if (err == -EEXIST)
@@ -1925,10 +1925,7 @@ static struct page *wait_on_page_read(struct page *page)
 * @gfp:        the page allocator flags to use if allocating
 *
 * This is the same as "read_mapping_page(mapping, index, NULL)", but with
- * any new page allocations done using the specified allocation flags. Note
+ * any new page allocations done using the specified allocation flags.
- * that the Radix tree operations will still use GFP_KERNEL, so you can't
- * expect to do this atomically or anything like that - but you can pass in
- * other page requirements.
 *
 * If the page does not get brought uptodate, return -EIO.
 */
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 73f17c0293c..2316840b337 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -901,7 +901,6 @@ retry:
        h->resv_huge_pages += delta;
        ret = 0;
-        spin_unlock(&hugetlb_lock);
        /* Free the needed pages to the hugetlb pool */
        list_for_each_entry_safe(page, tmp, &surplus_list, lru) {
                if ((--needed) < 0)
@@ -915,6 +914,7 @@ retry:
                VM_BUG_ON(page_count(page));
                enqueue_huge_page(h, page);
        }
+        spin_unlock(&hugetlb_lock);
        /* Free unnecessary surplus pages to the buddy allocator */
 free:
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 6aff93c98ac..b63f5f7dfa0 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4907,9 +4907,9 @@ mem_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cont)
                int cpu;
                enable_swap_cgroup();
                parent = NULL;
-                root_mem_cgroup = memcg;
                if (mem_cgroup_soft_limit_tree_init())
                        goto free_out;
+                root_mem_cgroup = memcg;
                for_each_possible_cpu(cpu) {
                        struct memcg_stock_pcp *stock =
                                                &per_cpu(memcg_stock, cpu);
@@ -4948,7 +4948,6 @@ mem_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cont)
        return &memcg->css;
 free_out:
        __mem_cgroup_free(memcg);
-        root_mem_cgroup = NULL;
        return ERR_PTR(error);
 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index adc39548181..c3fdbcb1765 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -636,6 +636,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
        struct vm_area_struct *prev;
        struct vm_area_struct *vma;
        int err = 0;
+        pgoff_t pgoff;
        unsigned long vmstart;
        unsigned long vmend;
@@ -643,13 +644,21 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
        if (!vma || vma->vm_start > start)
                return -EFAULT;
+        if (start > vma->vm_start)
+                prev = vma;
        for (; vma && vma->vm_start < end; prev = vma, vma = next) {
                next = vma->vm_next;
                vmstart = max(start, vma->vm_start);
                vmend   = min(end, vma->vm_end);
+                if (mpol_equal(vma_policy(vma), new_pol))
+                        continue;
+                pgoff = vma->vm_pgoff +
+                        ((vmstart - vma->vm_start) >> PAGE_SHIFT);
                prev = vma_merge(mm, prev, vmstart, vmend, vma->vm_flags,
-                                  vma->anon_vma, vma->vm_file, vma->vm_pgoff,
+                                  vma->anon_vma, vma->vm_file, pgoff,
                                  new_pol);
                if (prev) {
                        vma = prev;
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 76f2c5ae908..069b64e521f 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -176,7 +176,7 @@ static bool oom_unkillable_task(struct task_struct *p,
 unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
                      const nodemask_t *nodemask, unsigned long totalpages)
 {
-        int points;
+        long points;
        if (oom_unkillable_task(p, mem, nodemask))
                return 0;
diff --git a/mm/percpu.c b/mm/percpu.c
index 3bb810a7200..716eb4acf2f 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1023,9 +1023,11 @@ phys_addr_t per_cpu_ptr_to_phys(void *addr)
                if (!is_vmalloc_addr(addr))
                        return __pa(addr);
                else
-                        return page_to_phys(vmalloc_to_page(addr));
+                        return page_to_phys(vmalloc_to_page(addr)) +
+                               offset_in_page(addr);
        } else
-                return page_to_phys(pcpu_addr_to_page(addr));
+                return page_to_phys(pcpu_addr_to_page(addr)) +
+                       offset_in_page(addr);
 }
 /**
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 1d8b32f0713..27be2f0d4cb 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1290,7 +1290,7 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
                unsigned long align, unsigned long flags, unsigned long start,
                unsigned long end, int node, gfp_t gfp_mask, void *caller)
 {
-        static struct vmap_area *va;
+        struct vmap_area *va;
        struct vm_struct *area;
        BUG_ON(in_interrupt());
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index e0af7237cd9..c1c597e3e19 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -673,7 +673,7 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
                goto encrypt;
 auth:
-        if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
                return 0;
        if (!hci_conn_auth(conn, sec_level, auth_type))
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index be84ae33ae3..b84458dcc22 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -613,7 +613,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
        if (!test_bit(HCI_RAW, &hdev->flags)) {
                set_bit(HCI_INIT, &hdev->flags);
                __hci_request(hdev, hci_reset_req, 0,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                        msecs_to_jiffies(250));
                clear_bit(HCI_INIT, &hdev->flags);
        }
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 5ea94a1eecf..17b5b1cd965 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2152,7 +2152,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
        void *ptr = req->data;
        int type, olen;
        unsigned long val;
-        struct l2cap_conf_rfc rfc;
+        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
        BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
@@ -2271,6 +2271,16 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
                }
        }
+        /* Use sane default values in case a misbehaving remote device
+         * did not send an RFC option.
+         */
+        rfc.mode = chan->mode;
+        rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
+        rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
+        rfc.max_pdu_size = cpu_to_le16(chan->imtu);
+        BT_ERR("Expected RFC option was not found, using defaults");
 done:
        switch (rfc.mode) {
        case L2CAP_MODE_ERTM:
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 4e32e18211f..2d28dfe9838 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1146,6 +1146,7 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                        if (list_empty(&s->dlcs)) {
                                s->state = BT_DISCONN;
                                rfcomm_send_disc(s, 0);
+                                rfcomm_session_clear_timer(s);
                        }
                        break;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index d6ec3720c77..fa8b8f76358 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -114,12 +114,18 @@ static struct neighbour *fake_neigh_lookup(const struct dst_entry *dst, const vo
        return NULL;
 }
+static unsigned int fake_mtu(const struct dst_entry *dst)
+{
+        return dst->dev->mtu;
+}
 static struct dst_ops fake_dst_ops = {
        .family =               AF_INET,
        .protocol =             cpu_to_be16(ETH_P_IP),
        .update_pmtu =          fake_update_pmtu,
        .cow_metrics =          fake_cow_metrics,
        .neigh_lookup =         fake_neigh_lookup,
+        .mtu =                  fake_mtu,
 };
 /*
@@ -141,7 +147,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
        rt->dst.dev = br->dev;
        rt->dst.path = &rt->dst;
        dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
-        rt->dst.flags   = DST_NOXFRM;
+        rt->dst.flags   = DST_NOXFRM | DST_NOPEER;
        rt->dst.ops = &fake_dst_ops;
 }
diff --git a/net/core/flow.c b/net/core/flow.c
index 8ae42de9c79..e318c7e9804 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -358,6 +358,18 @@ void flow_cache_flush(void)
        put_online_cpus();
 }
+static void flow_cache_flush_task(struct work_struct *work)
+{
+        flow_cache_flush();
+}
+static DECLARE_WORK(flow_cache_flush_work, flow_cache_flush_task);
+void flow_cache_flush_deferred(void)
+{
+        schedule_work(&flow_cache_flush_work);
+}
 static int __cpuinit flow_cache_cpu_prepare(struct flow_cache *fc, int cpu)
 {
        struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, cpu);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index c71c434a4c0..385aefe5364 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -665,11 +665,14 @@ static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
        if (count) {
                int i;
-                if (count > 1<<30) {
+                if (count > INT_MAX)
+                        return -EINVAL;
+                count = roundup_pow_of_two(count);
+                if (count > (ULONG_MAX - sizeof(struct rps_dev_flow_table))
+                                / sizeof(struct rps_dev_flow)) {
                        /* Enforce a limit to prevent overflow */
                        return -EINVAL;
                }
-                count = roundup_pow_of_two(count);
                table = vmalloc(RPS_DEV_FLOW_TABLE_SIZE(count));
                if (!table)
                        return -ENOMEM;
diff --git a/net/core/sock.c b/net/core/sock.c
index 4ed7b1d12f5..b23f174ab84 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -288,11 +288,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
        unsigned long flags;
        struct sk_buff_head *list = &sk->sk_receive_queue;
-        /* Cast sk->rcvbuf to unsigned... It's pointless, but reduces
+        if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) {
-           number of warnings when compiling with -W --ANK
-         */
-        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-            (unsigned)sk->sk_rcvbuf) {
                atomic_inc(&sk->sk_drops);
                trace_sock_rcvqueue_full(sk, skb);
                return -ENOMEM;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 0da2afc97f3..99ec116bef1 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -253,6 +253,10 @@ static int __init ic_open_devs(void)
                }
        }
+        /* no point in waiting if we could not bring up at least one device */
+        if (!ic_first_dev)
+                goto have_carrier;
        /* wait for a carrier on at least one device */
        start = jiffies;
        while (jiffies - start < msecs_to_jiffies(CONF_CARRIER_TIMEOUT)) {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 46af62363b8..94cdbc55ca7 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -91,6 +91,7 @@
 #include <linux/rcupdate.h>
 #include <linux/times.h>
 #include <linux/slab.h>
+#include <linux/prefetch.h>
 #include <net/dst.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
@@ -120,6 +121,7 @@
 static int ip_rt_max_size;
 static int ip_rt_gc_timeout __read_mostly       = RT_GC_TIMEOUT;
+static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
 static int ip_rt_gc_min_interval __read_mostly  = HZ / 2;
 static int ip_rt_redirect_number __read_mostly  = 9;
 static int ip_rt_redirect_load __read_mostly    = HZ / 50;
@@ -133,6 +135,9 @@ static int ip_rt_min_advmss __read_mostly	= 256;
 static int rt_chain_length_max __read_mostly    = 20;
 static int redirect_genid;
+static struct delayed_work expires_work;
+static unsigned long expires_ljiffies;
 /*
 *      Interface to generic destination cache.
 */
@@ -830,6 +835,97 @@ static int has_noalias(const struct rtable *head, const struct rtable *rth)
        return ONE;
 }
+static void rt_check_expire(void)
+{
+        static unsigned int rover;
+        unsigned int i = rover, goal;
+        struct rtable *rth;
+        struct rtable __rcu **rthp;
+        unsigned long samples = 0;
+        unsigned long sum = 0, sum2 = 0;
+        unsigned long delta;
+        u64 mult;
+        delta = jiffies - expires_ljiffies;
+        expires_ljiffies = jiffies;
+        mult = ((u64)delta) << rt_hash_log;
+        if (ip_rt_gc_timeout > 1)
+                do_div(mult, ip_rt_gc_timeout);
+        goal = (unsigned int)mult;
+        if (goal > rt_hash_mask)
+                goal = rt_hash_mask + 1;
+        for (; goal > 0; goal--) {
+                unsigned long tmo = ip_rt_gc_timeout;
+                unsigned long length;
+                i = (i + 1) & rt_hash_mask;
+                rthp = &rt_hash_table[i].chain;
+                if (need_resched())
+                        cond_resched();
+                samples++;
+                if (rcu_dereference_raw(*rthp) == NULL)
+                        continue;
+                length = 0;
+                spin_lock_bh(rt_hash_lock_addr(i));
+                while ((rth = rcu_dereference_protected(*rthp,
+                                        lockdep_is_held(rt_hash_lock_addr(i)))) != NULL) {
+                        prefetch(rth->dst.rt_next);
+                        if (rt_is_expired(rth)) {
+                                *rthp = rth->dst.rt_next;
+                                rt_free(rth);
+                                continue;
+                        }
+                        if (rth->dst.expires) {
+                                /* Entry is expired even if it is in use */
+                                if (time_before_eq(jiffies, rth->dst.expires)) {
+nofree:
+                                        tmo >>= 1;
+                                        rthp = &rth->dst.rt_next;
+                                        /*
+                                         * We only count entries on
+                                         * a chain with equal hash inputs once
+                                         * so that entries for different QOS
+                                         * levels, and other non-hash input
+                                         * attributes don't unfairly skew
+                                         * the length computation
+                                         */
+                                        length += has_noalias(rt_hash_table[i].chain, rth);
+                                        continue;
+                                }
+                        } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
+                                goto nofree;
+                        /* Cleanup aged off entries. */
+                        *rthp = rth->dst.rt_next;
+                        rt_free(rth);
+                }
+                spin_unlock_bh(rt_hash_lock_addr(i));
+                sum += length;
+                sum2 += length*length;
+        }
+        if (samples) {
+                unsigned long avg = sum / samples;
+                unsigned long sd = int_sqrt(sum2 / samples - avg*avg);
+                rt_chain_length_max = max_t(unsigned long,
+                                        ip_rt_gc_elasticity,
+                                        (avg + 4*sd) >> FRACT_BITS);
+        }
+        rover = i;
+}
+/*
+ * rt_worker_func() is run in process context.
+ * we call rt_check_expire() to scan part of the hash table
+ */
+static void rt_worker_func(struct work_struct *work)
+{
+        rt_check_expire();
+        schedule_delayed_work(&expires_work, ip_rt_gc_interval);
+}
 /*
 * Perturbation of rt_genid by a small quantity [1..256]
 * Using 8 bits of shuffling ensure we can call rt_cache_invalidate()
@@ -1271,7 +1367,7 @@ void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
 {
        struct rtable *rt = (struct rtable *) dst;
-        if (rt) {
+        if (rt && !(rt->dst.flags & DST_NOPEER)) {
                if (rt->peer == NULL)
                        rt_bind_peer(rt, rt->rt_dst, 1);
@@ -1282,7 +1378,7 @@ void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
                        iph->id = htons(inet_getid(rt->peer, more));
                        return;
                }
-        } else
+        } else if (!rt)
                printk(KERN_DEBUG "rt_bind_peer(0) @%p\n",
                       __builtin_return_address(0));
@@ -3179,6 +3275,13 @@ static ctl_table ipv4_route_table[] = {
                .proc_handler   = proc_dointvec_jiffies,
        },
        {
+                .procname       = "gc_interval",
+                .data           = &ip_rt_gc_interval,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_jiffies,
+        },
+        {
                .procname       = "redirect_load",
                .data           = &ip_rt_redirect_load,
                .maxlen         = sizeof(int),
@@ -3388,6 +3491,11 @@ int __init ip_rt_init(void)
        devinet_init();
        ip_fib_init();
+        INIT_DELAYED_WORK_DEFERRABLE(&expires_work, rt_worker_func);
+        expires_ljiffies = jiffies;
+        schedule_delayed_work(&expires_work,
+                net_random() % ip_rt_gc_interval + ip_rt_gc_interval);
        if (ip_rt_proc_init())
                printk(KERN_ERR "Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 84d0bd5cac9..ec562713db9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -603,7 +603,7 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
        static atomic_t ipv6_fragmentation_id;
        int old, new;
-        if (rt) {
+        if (rt && !(rt->dst.flags & DST_NOPEER)) {
                struct inet_peer *peer;
                if (!rt->rt6i_peer)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index dfd3a648a55..a18e6c3d36e 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -833,15 +833,15 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                copied += used;
                len -= used;
+                /* For non stream protcols we get one packet per recvmsg call */
+                if (sk->sk_type != SOCK_STREAM)
+                        goto copy_uaddr;
                if (!(flags & MSG_PEEK)) {
                        sk_eat_skb(sk, skb, 0);
                        *seq = 0;
                }
-                /* For non stream protcols we get one packet per recvmsg call */
-                if (sk->sk_type != SOCK_STREAM)
-                        goto copy_uaddr;
                /* Partial read */
                if (used + offset < skb->len)
                        continue;
@@ -857,6 +857,12 @@ copy_uaddr:
        }
        if (llc_sk(sk)->cmsg_flags)
                llc_cmsg_rcv(msg, skb);
+        if (!(flags & MSG_PEEK)) {
+                        sk_eat_skb(sk, skb, 0);
+                        *seq = 0;
+        }
        goto out;
 }
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 12571fb2881..29fa5badde7 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -616,7 +616,7 @@ struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp)
        if ((cp) && (!cp->dest)) {
                dest = ip_vs_find_dest(ip_vs_conn_net(cp), cp->af, &cp->daddr,
                                       cp->dport, &cp->vaddr, cp->vport,
-                                       cp->protocol, cp->fwmark);
+                                       cp->protocol, cp->fwmark, cp->flags);
                ip_vs_bind_dest(cp, dest);
                return dest;
        } else
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 008bf97cc91..e1a66cf37f9 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -619,15 +619,21 @@ struct ip_vs_dest *ip_vs_find_dest(struct net  *net, int af,
                                   const union nf_inet_addr *daddr,
                                   __be16 dport,
                                   const union nf_inet_addr *vaddr,
-                                   __be16 vport, __u16 protocol, __u32 fwmark)
+                                   __be16 vport, __u16 protocol, __u32 fwmark,
+                                   __u32 flags)
 {
        struct ip_vs_dest *dest;
        struct ip_vs_service *svc;
+        __be16 port = dport;
        svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
        if (!svc)
                return NULL;
-        dest = ip_vs_lookup_dest(svc, daddr, dport);
+        if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ)
+                port = 0;
+        dest = ip_vs_lookup_dest(svc, daddr, port);
+        if (!dest)
+                dest = ip_vs_lookup_dest(svc, daddr, port ^ dport);
        if (dest)
                atomic_inc(&dest->refcnt);
        ip_vs_service_put(svc);
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 3cdd479f9b5..2b6678c0ce1 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -740,7 +740,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
                 * but still handled.
                 */
                dest = ip_vs_find_dest(net, type, daddr, dport, param->vaddr,
-                                       param->vport, protocol, fwmark);
+                                       param->vport, protocol, fwmark, flags);
                /*  Set the approprite ativity flag */
                if (protocol == IPPROTO_TCP) {
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index ef21b221f03..257e77256c5 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -135,7 +135,7 @@ nla_put_failure:
 static inline int
 ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
 {
-        long timeout = (ct->timeout.expires - jiffies) / HZ;
+        long timeout = ((long)ct->timeout.expires - (long)jiffies) / HZ;
        if (timeout < 0)
                timeout = 0;
@@ -1358,12 +1358,15 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                                                    nf_ct_protonum(ct));
                if (helper == NULL) {
                        rcu_read_unlock();
+                        spin_unlock_bh(&nf_conntrack_lock);
 #ifdef CONFIG_MODULES
                        if (request_module("nfct-helper-%s", helpname) < 0) {
+                                spin_lock_bh(&nf_conntrack_lock);
                                err = -EOPNOTSUPP;
                                goto err1;
                        }
+                        spin_lock_bh(&nf_conntrack_lock);
                        rcu_read_lock();
                        helper = __nf_conntrack_helper_find(helpname,
                                                            nf_ct_l3num(ct),
@@ -1638,7 +1641,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
                          const struct nf_conntrack_expect *exp)
 {
        struct nf_conn *master = exp->master;
-        long timeout = (exp->timeout.expires - jiffies) / HZ;
+        long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
        struct nf_conn_help *help;
        if (timeout < 0)
@@ -1869,25 +1872,30 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
        err = -ENOMEM;
        skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (skb2 == NULL)
+        if (skb2 == NULL) {
+                nf_ct_expect_put(exp);
                goto out;
+        }
        rcu_read_lock();
        err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
                                      nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);
        rcu_read_unlock();
+        nf_ct_expect_put(exp);
        if (err <= 0)
                goto free;
-        nf_ct_expect_put(exp);
+        err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
+        if (err < 0)
+                goto out;
-        return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
+        return 0;
 free:
        kfree_skb(skb2);
 out:
-        nf_ct_expect_put(exp);
+        /* this avoids a loop in nfnetlink. */
-        return err;
+        return err == -EAGAIN ? -ENOBUFS : err;
 }
 static int
diff --git a/net/netfilter/xt_connbytes.c b/net/netfilter/xt_connbytes.c
index 5b138506690..9ddf1c3bfb3 100644
--- a/net/netfilter/xt_connbytes.c
+++ b/net/netfilter/xt_connbytes.c
@@ -87,10 +87,10 @@ connbytes_mt(const struct sk_buff *skb, struct xt_action_param *par)
                break;
        }
-        if (sinfo->count.to)
+        if (sinfo->count.to >= sinfo->count.from)
                return what <= sinfo->count.to && what >= sinfo->count.from;
-        else
+        else /* inverted */
-                return what >= sinfo->count.from;
+                return what < sinfo->count.to || what > sinfo->count.from;
 }
 static int connbytes_mt_check(const struct xt_mtchk_param *par)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 3925c657876..ea66034499c 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -69,7 +69,7 @@ static int __nci_request(struct nci_dev *ndev,
        __u32 timeout)
 {
        int rc = 0;
-        unsigned long completion_rc;
+        long completion_rc;
        ndev->req_status = NCI_REQ_PEND;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 82a6f34d39d..d9d4970b9b0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1630,8 +1630,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
        if (snaplen > res)
                snaplen = res;
-        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+        if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
-            (unsigned)sk->sk_rcvbuf)
                goto drop_n_acct;
        if (skb_shared(skb)) {
@@ -1762,8 +1761,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
        if (po->tp_version <= TPACKET_V2) {
                if (macoff + snaplen > po->rx_ring.frame_size) {
                        if (po->copy_thresh &&
-                                atomic_read(&sk->sk_rmem_alloc) + skb->truesize
+                            atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf) {
-                                < (unsigned)sk->sk_rcvbuf) {
                                if (skb_shared(skb)) {
                                        copy_skb = skb_clone(skb, GFP_ATOMIC);
                                } else {
@@ -2450,8 +2448,12 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
 {
        struct packet_sock *po = pkt_sk(sk);
-        if (po->fanout)
+        if (po->fanout) {
+                if (dev)
+                        dev_put(dev);
                return -EINVAL;
+        }
        lock_sock(sk);
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index f88256cbacb..28de4309233 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -107,7 +107,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
        if (!netif_is_multiqueue(dev))
                return -EOPNOTSUPP;
-        if (nla_len(opt) < sizeof(*qopt))
+        if (!opt || nla_len(opt) < sizeof(*qopt))
                return -EINVAL;
        qopt = nla_data(opt);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index eb3b9a86c6e..a4ab207cdc5 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -488,7 +488,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
                return -EINVAL;
        s = sizeof(struct disttable) + n * sizeof(s16);
-        d = kmalloc(s, GFP_KERNEL);
+        d = kmalloc(s, GFP_KERNEL | __GFP_NOWARN);
        if (!d)
                d = vmalloc(s);
        if (!d)
@@ -501,9 +501,10 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr)
        root_lock = qdisc_root_sleeping_lock(sch);
        spin_lock_bh(root_lock);
-        dist_free(q->delay_dist);
+        swap(q->delay_dist, d);
-        q->delay_dist = d;
        spin_unlock_bh(root_lock);
+        dist_free(d);
        return 0;
 }
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 10334340859..7b0325459e7 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -817,11 +817,11 @@ skip_unblock:
 static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
 {
        unsigned long mask;
-        uint32_t limit, roundedF;
+        u64 limit, roundedF;
        int slot_shift = cl->grp->slot_shift;
        roundedF = qfq_round_down(cl->F, slot_shift);
-        limit = qfq_round_down(q->V, slot_shift) + (1UL << slot_shift);
+        limit = qfq_round_down(q->V, slot_shift) + (1ULL << slot_shift);
        if (!qfq_gt(cl->F, q->V) || qfq_gt(roundedF, limit)) {
                /* timestamp was stale */
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 152b5b3c3ff..acd2edbc073 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -173,7 +173,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
        asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
        asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
-                (unsigned long)sp->autoclose * HZ;
+                min_t(unsigned long, sp->autoclose, sctp_max_autoclose) * HZ;
        /* Initializes the timers */
        for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 08b3cead650..817174eb5f4 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -697,13 +697,7 @@ static void sctp_packet_append_data(struct sctp_packet *packet,
        /* Keep track of how many bytes are in flight to the receiver. */
        asoc->outqueue.outstanding_bytes += datasize;
-        /* Update our view of the receiver's rwnd. Include sk_buff overhead
+        /* Update our view of the receiver's rwnd. */
-         * while updating peer.rwnd so that it reduces the chances of a
-         * receiver running out of receive buffer space even when receive
-         * window is still open. This can happen when a sender is sending
-         * sending small messages.
-         */
-        datasize += sizeof(struct sk_buff);
        if (datasize < rwnd)
                rwnd -= datasize;
        else
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 14c2b06028f..cfeb1d4a1ee 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -411,8 +411,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                                        chunk->transport->flight_size -=
                                                        sctp_data_size(chunk);
                                q->outstanding_bytes -= sctp_data_size(chunk);
-                                q->asoc->peer.rwnd += (sctp_data_size(chunk) +
+                                q->asoc->peer.rwnd += sctp_data_size(chunk);
-                                                        sizeof(struct sk_buff));
                        }
                        continue;
                }
@@ -432,8 +431,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                         * (Section 7.2.4)), add the data size of those
                         * chunks to the rwnd.
                         */
-                        q->asoc->peer.rwnd += (sctp_data_size(chunk) +
+                        q->asoc->peer.rwnd += sctp_data_size(chunk);
-                                                sizeof(struct sk_buff));
                        q->outstanding_bytes -= sctp_data_size(chunk);
                        if (chunk->transport)
                                transport->flight_size -= sctp_data_size(chunk);
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 61b9fca5a17..6f6ad868683 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1285,6 +1285,9 @@ SCTP_STATIC __init int sctp_init(void)
        sctp_max_instreams              = SCTP_DEFAULT_INSTREAMS;
        sctp_max_outstreams             = SCTP_DEFAULT_OUTSTREAMS;
+        /* Initialize maximum autoclose timeout. */
+        sctp_max_autoclose              = INT_MAX / HZ;
        /* Initialize handle used for association ids. */
        idr_init(&sctp_assocs_id);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 13bf5fcdbff..54a7cd2fdd7 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2200,8 +2200,6 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
                return -EINVAL;
        if (copy_from_user(&sp->autoclose, optval, optlen))
                return -EFAULT;
-        /* make sure it won't exceed MAX_SCHEDULE_TIMEOUT */
-        sp->autoclose = min_t(long, sp->autoclose, MAX_SCHEDULE_TIMEOUT / HZ);
        return 0;
 }
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 6b3952961b8..60ffbd067ff 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -53,6 +53,10 @@ static int sack_timer_min = 1;
 static int sack_timer_max = 500;
 static int addr_scope_max = 3; /* check sctp_scope_policy_t in include/net/sctp/constants.h for max entries */
 static int rwnd_scale_max = 16;
+static unsigned long max_autoclose_min = 0;
+static unsigned long max_autoclose_max =
+        (MAX_SCHEDULE_TIMEOUT / HZ > UINT_MAX)
+        ? UINT_MAX : MAX_SCHEDULE_TIMEOUT / HZ;
 extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
@@ -258,6 +262,15 @@ static ctl_table sctp_table[] = {
                .extra1         = &one,
                .extra2         = &rwnd_scale_max,
        },
+        {
+                .procname       = "max_autoclose",
+                .data           = &sctp_max_autoclose,
+                .maxlen         = sizeof(unsigned long),
+                .mode           = 0644,
+                .proc_handler   = &proc_doulongvec_minmax,
+                .extra1         = &max_autoclose_min,
+                .extra2         = &max_autoclose_max,
+        },
        { /* sentinel */ }
 };
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index d12ffa54581..00a1a2acd58 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -590,6 +590,27 @@ void rpc_prepare_task(struct rpc_task *task)
        task->tk_ops->rpc_call_prepare(task, task->tk_calldata);
 }
+static void
+rpc_init_task_statistics(struct rpc_task *task)
+{
+        /* Initialize retry counters */
+        task->tk_garb_retry = 2;
+        task->tk_cred_retry = 2;
+        task->tk_rebind_retry = 2;
+        /* starting timestamp */
+        task->tk_start = ktime_get();
+}
+static void
+rpc_reset_task_statistics(struct rpc_task *task)
+{
+        task->tk_timeouts = 0;
+        task->tk_flags &= ~(RPC_CALL_MAJORSEEN|RPC_TASK_KILLED|RPC_TASK_SENT);
+        rpc_init_task_statistics(task);
+}
 /*
 * Helper that calls task->tk_ops->rpc_call_done if it exists
 */
@@ -602,6 +623,7 @@ void rpc_exit_task(struct rpc_task *task)
                        WARN_ON(RPC_ASSASSINATED(task));
                        /* Always release the RPC slot and buffer memory */
                        xprt_release(task);
+                        rpc_reset_task_statistics(task);
                }
        }
 }
@@ -804,11 +826,6 @@ static void rpc_init_task(struct rpc_task *task, const struct rpc_task_setup *ta
        task->tk_calldata = task_setup_data->callback_data;
        INIT_LIST_HEAD(&task->tk_task);
-        /* Initialize retry counters */
-        task->tk_garb_retry = 2;
-        task->tk_cred_retry = 2;
-        task->tk_rebind_retry = 2;
        task->tk_priority = task_setup_data->priority - RPC_PRIORITY_LOW;
        task->tk_owner = current->tgid;
@@ -818,8 +835,7 @@ static void rpc_init_task(struct rpc_task *task, const struct rpc_task_setup *ta
        if (task->tk_ops->rpc_call_prepare != NULL)
                task->tk_action = rpc_prepare_task;
-        /* starting timestamp */
+        rpc_init_task_statistics(task);
-        task->tk_start = ktime_get();
        dprintk("RPC:       new task initialized, procpid %u\n",
                                task_pid_nr(current));
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index f4385e45a5f..c64c0ef519b 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -995,13 +995,11 @@ out_init_req:
 static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
 {
-        if (xprt_dynamic_free_slot(xprt, req))
-                return;
-        memset(req, 0, sizeof(*req));   /* mark unused */
        spin_lock(&xprt->reserve_lock);
-        list_add(&req->rq_list, &xprt->free);
+        if (!xprt_dynamic_free_slot(xprt, req)) {
+                memset(req, 0, sizeof(*req));   /* mark unused */
+                list_add(&req->rq_list, &xprt->free);
+        }
        rpc_wake_up_next(&xprt->backlog);
        spin_unlock(&xprt->reserve_lock);
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 2118d644663..9049a5caeb2 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2276,8 +2276,6 @@ static void __xfrm_garbage_collect(struct net *net)
 {
        struct dst_entry *head, *next;
-        flow_cache_flush();
        spin_lock_bh(&xfrm_policy_sk_bundle_lock);
        head = xfrm_policy_sk_bundles;
        xfrm_policy_sk_bundles = NULL;
@@ -2290,6 +2288,18 @@ static void __xfrm_garbage_collect(struct net *net)
        }
 }
+static void xfrm_garbage_collect(struct net *net)
+{
+        flow_cache_flush();
+        __xfrm_garbage_collect(net);
+}
+static void xfrm_garbage_collect_deferred(struct net *net)
+{
+        flow_cache_flush_deferred();
+        __xfrm_garbage_collect(net);
+}
 static void xfrm_init_pmtu(struct dst_entry *dst)
 {
        do {
@@ -2422,7 +2432,7 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                if (likely(dst_ops->neigh_lookup == NULL))
                        dst_ops->neigh_lookup = xfrm_neigh_lookup;
                if (likely(afinfo->garbage_collect == NULL))
-                        afinfo->garbage_collect = __xfrm_garbage_collect;
+                        afinfo->garbage_collect = xfrm_garbage_collect_deferred;
                xfrm_policy_afinfo[afinfo->family] = afinfo;
        }
        write_unlock_bh(&xfrm_policy_afinfo_lock);
@@ -2516,7 +2526,7 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void
        switch (event) {
        case NETDEV_DOWN:
-                __xfrm_garbage_collect(dev_net(dev));
+                xfrm_garbage_collect(dev_net(dev));
        }
        return NOTIFY_DONE;
 }
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index ba573fe7c74..914833d99b0 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -60,8 +60,8 @@ update-po-config: $(obj)/kxgettext $(obj)/gconf.glade.h
            --directory=$(srctree) --directory=$(objtree)           \
            --output $(obj)/config.pot
        $(Q)sed -i s/CHARSET/UTF-8/ $(obj)/config.pot
-        $(Q)ln -fs Kconfig.x86 arch/um/Kconfig
+        $(Q)(for i in `ls $(srctree)/arch/*/Kconfig      \
-        $(Q)(for i in `ls $(srctree)/arch/*/Kconfig`;    \
+            $(srctree)/arch/*/um/Kconfig`;               \
            do                                           \
                echo "  GEN $$i";                        \
                $(obj)/kxgettext $$i                     \
@@ -69,7 +69,6 @@ update-po-config: $(obj)/kxgettext $(obj)/gconf.glade.h
            done )
        $(Q)msguniq --sort-by-file --to-code=UTF-8 $(obj)/config.pot \
            --output $(obj)/linux.pot
-        $(Q)rm -f $(srctree)/arch/um/Kconfig
        $(Q)rm -f $(obj)/config.pot
 PHONY += allnoconfig allyesconfig allmodconfig alldefconfig randconfig
diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
index f40a6af6bf4..54e35c1e594 100644
--- a/scripts/recordmcount.h
+++ b/scripts/recordmcount.h
@@ -462,7 +462,7 @@ __has_rel_mcount(Elf_Shdr const *const relhdr,  /* is SHT_REL or SHT_RELA */
                succeed_file();
        }
        if (w(txthdr->sh_type) != SHT_PROGBITS ||
-            !(w(txthdr->sh_flags) & SHF_EXECINSTR))
+            !(_w(txthdr->sh_flags) & SHF_EXECINSTR))
                return NULL;
        return txtname;
 }
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 5dd5b140242..8738deff26f 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -27,20 +27,35 @@ static int evmkey_len = MAX_KEY_SIZE;
 struct crypto_shash *hmac_tfm;
+static DEFINE_MUTEX(mutex);
 static struct shash_desc *init_desc(void)
 {
        int rc;
        struct shash_desc *desc;
        if (hmac_tfm == NULL) {
+                mutex_lock(&mutex);
+                if (hmac_tfm)
+                        goto out;
                hmac_tfm = crypto_alloc_shash(evm_hmac, 0, CRYPTO_ALG_ASYNC);
                if (IS_ERR(hmac_tfm)) {
                        pr_err("Can not allocate %s (reason: %ld)\n",
                               evm_hmac, PTR_ERR(hmac_tfm));
                        rc = PTR_ERR(hmac_tfm);
                        hmac_tfm = NULL;
+                        mutex_unlock(&mutex);
+                        return ERR_PTR(rc);
+                }
+                rc = crypto_shash_setkey(hmac_tfm, evmkey, evmkey_len);
+                if (rc) {
+                        crypto_free_shash(hmac_tfm);
+                        hmac_tfm = NULL;
+                        mutex_unlock(&mutex);
                        return ERR_PTR(rc);
                }
+out:
+                mutex_unlock(&mutex);
        }
        desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(hmac_tfm),
@@ -51,11 +66,7 @@ static struct shash_desc *init_desc(void)
        desc->tfm = hmac_tfm;
        desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
-        rc = crypto_shash_setkey(hmac_tfm, evmkey, evmkey_len);
-        if (rc)
-                goto out;
        rc = crypto_shash_init(desc);
-out:
        if (rc) {
                kfree(desc);
                return ERR_PTR(rc);
diff --git a/security/security.c b/security/security.c
index 0c6cc69c8f8..e2f684aeb70 100644
--- a/security/security.c
+++ b/security/security.c
@@ -381,7 +381,7 @@ int security_old_inode_init_security(struct inode *inode, struct inode *dir,
                                     void **value, size_t *len)
 {
        if (unlikely(IS_PRIVATE(inode)))
-                return 0;
+                return -EOPNOTSUPP;
        return security_ops->inode_init_security(inode, dir, qstr, name, value,
                                                 len);
 }
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 0b62bd11246..7b9eb1faf68 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -123,7 +123,9 @@ static void sel_netport_insert(struct sel_netport *port)
        if (sel_netport_hash[idx].size == SEL_NETPORT_HASH_BKT_LIMIT) {
                struct sel_netport *tail;
                tail = list_entry(
-                        rcu_dereference(sel_netport_hash[idx].list.prev),
+                        rcu_dereference_protected(
+                                sel_netport_hash[idx].list.prev,
+                                lockdep_is_held(&sel_netport_lock)),
                        struct sel_netport, list);
                list_del_rcu(&tail->list);
                kfree_rcu(tail, rcu);
diff --git a/sound/atmel/ac97c.c b/sound/atmel/ac97c.c
index 6e5addeb236..73516f69ac7 100644
--- a/sound/atmel/ac97c.c
+++ b/sound/atmel/ac97c.c
@@ -899,6 +899,10 @@ static void atmel_ac97c_reset(struct atmel_ac97c *chip)
                /* AC97 v2.2 specifications says minimum 1 us. */
                udelay(2);
                gpio_set_value(chip->reset_pin, 1);
+        } else {
+                ac97c_writel(chip, MR, AC97C_MR_WRST | AC97C_MR_ENA);
+                udelay(2);
+                ac97c_writel(chip, MR, AC97C_MR_ENA);
        }
 }
diff --git a/sound/soc/codecs/wm8776.c b/sound/soc/codecs/wm8776.c
index bfdc52370ad..d3b0a20744f 100644
--- a/sound/soc/codecs/wm8776.c
+++ b/sound/soc/codecs/wm8776.c
@@ -235,6 +235,7 @@ static int wm8776_hw_params(struct snd_pcm_substream *substream,
        switch (snd_pcm_format_width(params_format(params))) {
        case 16:
                iface = 0;
+                break;
        case 20:
                iface = 0x10;
                break;
diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index 3ad0925d23a..758e3b36d4c 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -17,6 +17,8 @@
 #include <linux/pci.h>
 #include <linux/interrupt.h>
 #include <linux/slab.h>
+#include <linux/namei.h>
+#include <linux/fs.h>
 #include "irq.h"
 static struct kvm_assigned_dev_kernel *kvm_find_assigned_dev(struct list_head *head,
@@ -480,12 +482,76 @@ out:
        return r;
 }
+/*
+ * We want to test whether the caller has been granted permissions to
+ * use this device.  To be able to configure and control the device,
+ * the user needs access to PCI configuration space and BAR resources.
+ * These are accessed through PCI sysfs.  PCI config space is often
+ * passed to the process calling this ioctl via file descriptor, so we
+ * can't rely on access to that file.  We can check for permissions
+ * on each of the BAR resource files, which is a pretty clear
+ * indicator that the user has been granted access to the device.
+ */
+static int probe_sysfs_permissions(struct pci_dev *dev)
+{
+#ifdef CONFIG_SYSFS
+        int i;
+        bool bar_found = false;
+        for (i = PCI_STD_RESOURCES; i <= PCI_STD_RESOURCE_END; i++) {
+                char *kpath, *syspath;
+                struct path path;
+                struct inode *inode;
+                int r;
+                if (!pci_resource_len(dev, i))
+                        continue;
+                kpath = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
+                if (!kpath)
+                        return -ENOMEM;
+                /* Per sysfs-rules, sysfs is always at /sys */
+                syspath = kasprintf(GFP_KERNEL, "/sys%s/resource%d", kpath, i);
+                kfree(kpath);
+                if (!syspath)
+                        return -ENOMEM;
+                r = kern_path(syspath, LOOKUP_FOLLOW, &path);
+                kfree(syspath);
+                if (r)
+                        return r;
+                inode = path.dentry->d_inode;
+                r = inode_permission(inode, MAY_READ | MAY_WRITE | MAY_ACCESS);
+                path_put(&path);
+                if (r)
+                        return r;
+                bar_found = true;
+        }
+        /* If no resources, probably something special */
+        if (!bar_found)
+                return -EPERM;
+        return 0;
+#else
+        return -EINVAL; /* No way to control the device without sysfs */
+#endif
+}
 static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
                                      struct kvm_assigned_pci_dev *assigned_dev)
 {
        int r = 0, idx;
        struct kvm_assigned_dev_kernel *match;
        struct pci_dev *dev;
+        u8 header_type;
+        if (!(assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU))
+                return -EINVAL;
        mutex_lock(&kvm->lock);
        idx = srcu_read_lock(&kvm->srcu);
@@ -513,6 +579,18 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
                r = -EINVAL;
                goto out_free;
        }
+        /* Don't allow bridges to be assigned */
+        pci_read_config_byte(dev, PCI_HEADER_TYPE, &header_type);
+        if ((header_type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) {
+                r = -EPERM;
+                goto out_put;
+        }
+        r = probe_sysfs_permissions(dev);
+        if (r)
+                goto out_put;
        if (pci_enable_device(dev)) {
                printk(KERN_INFO "%s: Could not enable PCI device\n", __func__);
                r = -EBUSY;
@@ -544,16 +622,14 @@ static int kvm_vm_ioctl_assign_device(struct kvm *kvm,
        list_add(&match->list, &kvm->arch.assigned_dev_head);
-        if (assigned_dev->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU) {
+        if (!kvm->arch.iommu_domain) {
-                if (!kvm->arch.iommu_domain) {
+                r = kvm_iommu_map_guest(kvm);
-                        r = kvm_iommu_map_guest(kvm);
-                        if (r)
-                                goto out_list_del;
-                }
-                r = kvm_assign_device(kvm, match);
                if (r)
                        goto out_list_del;
        }
+        r = kvm_assign_device(kvm, match);
+        if (r)
+                goto out_list_del;
 out:
        srcu_read_unlock(&kvm->srcu, idx);
@@ -593,8 +669,7 @@ static int kvm_vm_ioctl_deassign_device(struct kvm *kvm,
                goto out;
        }
-        if (match->flags & KVM_DEV_ASSIGN_ENABLE_IOMMU)
+        kvm_deassign_device(kvm, match);
-                kvm_deassign_device(kvm, match);
        kvm_free_assigned_device(kvm, match);
author	Ingo Molnar <mingo@elte.hu>	2012-01-08 06:31:24 -0500
committer	Ingo Molnar <mingo@elte.hu>	2012-01-08 06:31:24 -0500
commit	636f0c70f2557e0819b50c74e31b4a027327015e (patch)
tree	3a259ef26659dac92782651440091b9f5ab1a7f7
parent	675eef66e3edcab8065533edfefbcbbacb9a30d3 (diff)
parent	2e885057b7f75035f0b85e02f737891482815a81 (diff)