1682 files changed, 20619 insertions, 11663 deletions

diff --git a/.mailmap b/.mailmap
index 581fd39193a..1eba28acab6 100644
--- a/.mailmap
+++ b/.mailmap
@@ -23,6 +23,7 @@ Andy Adamson <andros@citi.umich.edu>
 Arnaud Patard <arnaud.patard@rtp-net.org>
 Arnd Bergmann <arnd@arndb.de>
 Axel Dyks <xl@xlsigned.net>
+Axel Lin <axel.lin@gmail.com>
 Ben Gardner <bgardner@wabtec.com>
 Ben M Cahill <ben.m.cahill@intel.com>
 Björn Steinbrink <B.Steinbrink@gmx.de>
diff --git a/Documentation/ABI/testing/sysfs-platform-at91 b/Documentation/ABI/testing/sysfs-platform-at91
new file mode 100644
index 00000000000..4cc6a865ae6
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-platform-at91
@@ -0,0 +1,25 @@
+What:           /sys/devices/platform/at91_can/net/<iface>/mb0_id
+Date:           January 2011
+KernelVersion:  2.6.38
+Contact:        Marc Kleine-Budde <kernel@pengutronix.de>
+Description:
+                Value representing the can_id of mailbox 0.
+
+                Default: 0x7ff (standard frame)
+
+                Due to a chip bug (errata 50.2.6.3 & 50.3.5.3 in
+                "AT91SAM9263 Preliminary 6249H-ATARM-27-Jul-09") the
+                contents of mailbox 0 may be send under certain
+                conditions (even if disabled or in rx mode).
+
+                The workaround in the errata suggests not to use the
+                mailbox and load it with an unused identifier.
+
+                In order to use an extended can_id add the
+                CAN_EFF_FLAG (0x80000000U) to the can_id. Example:
+
+                - standard id 0x7ff:
+                echo 0x7ff      > /sys/class/net/can0/mb0_id
+
+                - extended id 0x1fffffff:
+                echo 0x9fffffff > /sys/class/net/can0/mb0_id
diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index 35447e08173..36f63d4a0a0 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -217,8 +217,8 @@ X!Isound/sound_firmware.c
   <chapter id="uart16x50">
      <title>16x50 UART Driver</title>
 !Iinclude/linux/serial_core.h
-!Edrivers/serial/serial_core.c
-!Edrivers/serial/8250.c
+!Edrivers/tty/serial/serial_core.c
+!Edrivers/tty/serial/8250.c
   </chapter>
 
   <chapter id="fbdev">
diff --git a/Documentation/DocBook/dvb/dvbapi.xml b/Documentation/DocBook/dvb/dvbapi.xml
index e3a97fdd62a..ad8678d4891 100644
--- a/Documentation/DocBook/dvb/dvbapi.xml
+++ b/Documentation/DocBook/dvb/dvbapi.xml
@@ -28,7 +28,7 @@
         <holder>Convergence GmbH</holder>
 </copyright>
 <copyright>
-        <year>2009-2010</year>
+        <year>2009-2011</year>
         <holder>Mauro Carvalho Chehab</holder>
 </copyright>
 
diff --git a/Documentation/DocBook/media.tmpl b/Documentation/DocBook/media.tmpl
index f11048d4053..a99088aae1a 100644
--- a/Documentation/DocBook/media.tmpl
+++ b/Documentation/DocBook/media.tmpl
@@ -28,7 +28,7 @@
 <title>LINUX MEDIA INFRASTRUCTURE API</title>
 
 <copyright>
-        <year>2009-2010</year>
+        <year>2009-2011</year>
         <holder>LinuxTV Developers</holder>
 </copyright>
 
@@ -86,7 +86,7 @@ Foundation. A copy of the license is included in the chapter entitled
 </author>
 </authorgroup>
 <copyright>
-        <year>2009-2010</year>
+        <year>2009-2011</year>
         <holder>Mauro Carvalho Chehab</holder>
 </copyright>
 
diff --git a/Documentation/DocBook/v4l/dev-rds.xml b/Documentation/DocBook/v4l/dev-rds.xml
index 360d2737e64..2427f54397e 100644
--- a/Documentation/DocBook/v4l/dev-rds.xml
+++ b/Documentation/DocBook/v4l/dev-rds.xml
@@ -75,6 +75,7 @@ as follows:</para>
   </section>
 
   <section>
+    <title>RDS datastructures</title>
     <table frame="none" pgwide="1" id="v4l2-rds-data">
       <title>struct
 <structname>v4l2_rds_data</structname></title>
@@ -129,10 +130,11 @@ as follows:</para>
 
     <table frame="none" pgwide="1" id="v4l2-rds-block-codes">
       <title>Block defines</title>
-      <tgroup cols="3">
+      <tgroup cols="4">
         <colspec colname="c1" colwidth="1*" />
         <colspec colname="c2" colwidth="1*" />
-        <colspec colname="c3" colwidth="5*" />
+        <colspec colname="c3" colwidth="1*" />
+        <colspec colname="c4" colwidth="5*" />
         <tbody valign="top">
           <row>
             <entry>V4L2_RDS_BLOCK_MSK</entry>
diff --git a/Documentation/DocBook/v4l/v4l2.xml b/Documentation/DocBook/v4l/v4l2.xml
index 839e93e875a..9288af96de3 100644
--- a/Documentation/DocBook/v4l/v4l2.xml
+++ b/Documentation/DocBook/v4l/v4l2.xml
@@ -100,6 +100,7 @@ Remote Controller chapter.</contrib>
       <year>2008</year>
       <year>2009</year>
       <year>2010</year>
+      <year>2011</year>
       <holder>Bill Dirks, Michael H. Schimek, Hans Verkuil, Martin
 Rubli, Andy Walls, Muralidharan Karicheri, Mauro Carvalho Chehab</holder>
     </copyright>
@@ -381,7 +382,7 @@ and discussions on the V4L mailing list.</revremark>
 </partinfo>
 
 <title>Video for Linux Two API Specification</title>
- <subtitle>Revision 2.6.33</subtitle>
+ <subtitle>Revision 2.6.38</subtitle>
 
   <chapter id="common">
     &sub-common;
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 8c594c45b6a..b3f35e5f9c9 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -357,14 +357,6 @@ Who:	Dave Jones <davej@redhat.com>, Matthew Garrett <mjg@redhat.com>
 
 -----------------------------
 
-What:   __do_IRQ all in one fits nothing interrupt handler
-When:   2.6.32
-Why:    __do_IRQ was kept for easy migration to the type flow handlers.
-        More than two years of migration time is enough.
-Who:    Thomas Gleixner <tglx@linutronix.de>
-
------------------------------
-
 What:   fakephp and associated sysfs files in /sys/bus/pci/slots/
 When:   2011
 Why:    In 2.6.27, the semantics of /sys/bus/pci/slots was redefined to
@@ -611,3 +603,19 @@ Why:	The adm9240, w83792d and w83793 hardware monitoring drivers have
 Who:    Jean Delvare <khali@linux-fr.org>
 
 ----------------------------
+
+What:   noswapaccount kernel command line parameter
+When:   2.6.40
+Why:    The original implementation of memsw feature enabled by
+        CONFIG_CGROUP_MEM_RES_CTLR_SWAP could be disabled by the noswapaccount
+        kernel parameter (introduced in 2.6.29-rc1). Later on, this decision
+        turned out to be not ideal because we cannot have the feature compiled
+        in and disabled by default and let only interested to enable it
+        (e.g. general distribution kernels might need it). Therefore we have
+        added swapaccount[=0|1] parameter (introduced in 2.6.37) which provides
+        the both possibilities. If we remove noswapaccount we will have
+        less command line parameters with the same functionality and we
+        can also cleanup the parameter handling a bit ().
+Who:    Michal Hocko <mhocko@suse.cz>
+
+----------------------------
diff --git a/Documentation/filesystems/ntfs.txt b/Documentation/filesystems/ntfs.txt
index 6ef8cf3bc9a..933bc66ccff 100644
--- a/Documentation/filesystems/ntfs.txt
+++ b/Documentation/filesystems/ntfs.txt
@@ -460,6 +460,8 @@ Note, a technical ChangeLog aimed at kernel hackers is in fs/ntfs/ChangeLog.
 2.1.30:
         - Fix writev() (it kept writing the first segment over and over again
           instead of moving onto subsequent segments).
+        - Fix crash in ntfs_mft_record_alloc() when mapping the new extent mft
+          record failed.
 2.1.29:
         - Fix a deadlock when mounting read-write.
 2.1.28:
diff --git a/Documentation/hwmon/lm93 b/Documentation/hwmon/lm93
index 7a10616d0b4..f3b2ad2ceb0 100644
--- a/Documentation/hwmon/lm93
+++ b/Documentation/hwmon/lm93
@@ -6,6 +6,10 @@ Supported chips:
     Prefix 'lm93'
     Addresses scanned: I2C 0x2c-0x2e
     Datasheet: http://www.national.com/ds.cgi/LM/LM93.pdf
+  * National Semiconductor LM94
+    Prefix 'lm94'
+    Addresses scanned: I2C 0x2c-0x2e
+    Datasheet: http://www.national.com/ds.cgi/LM/LM94.pdf
 
 Authors:
         Mark M. Hoffman <mhoffman@lightlink.com>
@@ -56,6 +60,9 @@ previous motherboard management ASICs and uses some of the LM85's features
 for dynamic Vccp monitoring and PROCHOT. It is designed to monitor a dual
 processor Xeon class motherboard with a minimum of external components.
 
+LM94 is also supported in LM93 compatible mode. Extra sensors and features of
+LM94 are not supported.
+
 
 User Interface
 --------------
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index b72e071a3e5..89835a4766a 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -43,11 +43,11 @@ parameter is applicable:
         AVR32   AVR32 architecture is enabled.
         AX25    Appropriate AX.25 support is enabled.
         BLACKFIN Blackfin architecture is enabled.
+        DRM     Direct Rendering Management support is enabled.
+        DYNAMIC_DEBUG Build in debug messages and enable them at runtime
         EDD     BIOS Enhanced Disk Drive Services (EDD) is enabled
         EFI     EFI Partitioning (GPT) is enabled
         EIDE    EIDE/ATAPI support is enabled.
-        DRM     Direct Rendering Management support is enabled.
-        DYNAMIC_DEBUG Build in debug messages and enable them at runtime
         FB      The frame buffer device is enabled.
         GCOV    GCOV profiling is enabled.
         HW      Appropriate hardware is enabled.
diff --git a/Documentation/lguest/lguest.c b/Documentation/lguest/lguest.c
index dc73bc54cc4..d9da7e14853 100644
--- a/Documentation/lguest/lguest.c
+++ b/Documentation/lguest/lguest.c
@@ -39,6 +39,9 @@
 #include <limits.h>
 #include <stddef.h>
 #include <signal.h>
+#include <pwd.h>
+#include <grp.h>
+
 #include <linux/virtio_config.h>
 #include <linux/virtio_net.h>
 #include <linux/virtio_blk.h>
@@ -298,20 +301,27 @@ static void *map_zeroed_pages(unsigned int num)
 
         /*
          * We use a private mapping (ie. if we write to the page, it will be
-         * copied).
+         * copied). We allocate an extra two pages PROT_NONE to act as guard
+         * pages against read/write attempts that exceed allocated space.
          */
-        addr = mmap(NULL, getpagesize() * num,
-                    PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, fd, 0);
+        addr = mmap(NULL, getpagesize() * (num+2),
+                    PROT_NONE, MAP_PRIVATE, fd, 0);
+
         if (addr == MAP_FAILED)
                 err(1, "Mmapping %u pages of /dev/zero", num);
 
+        if (mprotect(addr + getpagesize(), getpagesize() * num,
+                     PROT_READ|PROT_WRITE) == -1)
+                err(1, "mprotect rw %u pages failed", num);
+
         /*
          * One neat mmap feature is that you can close the fd, and it
          * stays mapped.
          */
         close(fd);
 
-        return addr;
+        /* Return address after PROT_NONE page */
+        return addr + getpagesize();
 }
 
 /* Get some more pages for a device. */
@@ -343,7 +353,7 @@ static void map_at(int fd, void *addr, unsigned long offset, unsigned long len)
          * done to it.  This allows us to share untouched memory between
          * Guests.
          */
-        if (mmap(addr, len, PROT_READ|PROT_WRITE|PROT_EXEC,
+        if (mmap(addr, len, PROT_READ|PROT_WRITE,
                  MAP_FIXED|MAP_PRIVATE, fd, offset) != MAP_FAILED)
                 return;
 
@@ -573,10 +583,10 @@ static void *_check_pointer(unsigned long addr, unsigned int size,
                             unsigned int line)
 {
         /*
-         * We have to separately check addr and addr+size, because size could
-         * be huge and addr + size might wrap around.
+         * Check if the requested address and size exceeds the allocated memory,
+         * or addr + size wraps around.
          */
-        if (addr >= guest_limit || addr + size >= guest_limit)
+        if ((addr + size) > guest_limit || (addr + size) < addr)
                 errx(1, "%s:%i: Invalid address %#lx", __FILE__, line, addr);
         /*
          * We return a pointer for the caller's convenience, now we know it's
@@ -1872,6 +1882,8 @@ static struct option opts[] = {
         { "block", 1, NULL, 'b' },
         { "rng", 0, NULL, 'r' },
         { "initrd", 1, NULL, 'i' },
+        { "username", 1, NULL, 'u' },
+        { "chroot", 1, NULL, 'c' },
         { NULL },
 };
 static void usage(void)
@@ -1894,6 +1906,12 @@ int main(int argc, char *argv[])
         /* If they specify an initrd file to load. */
         const char *initrd_name = NULL;
 
+        /* Password structure for initgroups/setres[gu]id */
+        struct passwd *user_details = NULL;
+
+        /* Directory to chroot to */
+        char *chroot_path = NULL;
+
         /* Save the args: we "reboot" by execing ourselves again. */
         main_args = argv;
 
@@ -1950,6 +1968,14 @@ int main(int argc, char *argv[])
                 case 'i':
                         initrd_name = optarg;
                         break;
+                case 'u':
+                        user_details = getpwnam(optarg);
+                        if (!user_details)
+                                err(1, "getpwnam failed, incorrect username?");
+                        break;
+                case 'c':
+                        chroot_path = optarg;
+                        break;
                 default:
                         warnx("Unknown argument %s", argv[optind]);
                         usage();
@@ -2021,6 +2047,37 @@ int main(int argc, char *argv[])
         /* If we exit via err(), this kills all the threads, restores tty. */
         atexit(cleanup_devices);
 
+        /* If requested, chroot to a directory */
+        if (chroot_path) {
+                if (chroot(chroot_path) != 0)
+                        err(1, "chroot(\"%s\") failed", chroot_path);
+
+                if (chdir("/") != 0)
+                        err(1, "chdir(\"/\") failed");
+
+                verbose("chroot done\n");
+        }
+
+        /* If requested, drop privileges */
+        if (user_details) {
+                uid_t u;
+                gid_t g;
+
+                u = user_details->pw_uid;
+                g = user_details->pw_gid;
+
+                if (initgroups(user_details->pw_name, g) != 0)
+                        err(1, "initgroups failed");
+
+                if (setresgid(g, g, g) != 0)
+                        err(1, "setresgid failed");
+
+                if (setresuid(u, u, u) != 0)
+                        err(1, "setresuid failed");
+
+                verbose("Dropping privileges completed\n");
+        }
+
         /* Finally, run the Guest.  This doesn't return. */
         run_guest();
 }
diff --git a/Documentation/lguest/lguest.txt b/Documentation/lguest/lguest.txt
index 6ccaf8e1a00..dad99978a6a 100644
--- a/Documentation/lguest/lguest.txt
+++ b/Documentation/lguest/lguest.txt
@@ -117,6 +117,11 @@ Running Lguest:
     
   for general information on how to get bridging to work.
 
+- Random number generation. Using the --rng option will provide a
+  /dev/hwrng in the guest that will read from the host's /dev/random.
+  Use this option in conjunction with rng-tools (see ../hw_random.txt)
+  to provide entropy to the guest kernel's /dev/random.
+
 There is a helpful mailing list at http://ozlabs.org/mailman/listinfo/lguest
 
 Good luck!
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 5dc638791d9..25d2f4141d2 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -49,7 +49,8 @@ Table of Contents
 3.3     Configuring Bonding Manually with Ifenslave
 3.3.1           Configuring Multiple Bonds Manually
 3.4     Configuring Bonding Manually via Sysfs
-3.5     Overriding Configuration for Special Cases
+3.5     Configuration with Interfaces Support
+3.6     Overriding Configuration for Special Cases
 
 4. Querying Bonding Configuration
 4.1     Bonding Configuration
@@ -161,8 +162,8 @@ onwards) do not have /usr/include/linux symbolically linked to the
 default kernel source include directory.
 
 SECOND IMPORTANT NOTE:
-        If you plan to configure bonding using sysfs, you do not need
-to use ifenslave.
+        If you plan to configure bonding using sysfs or using the
+/etc/network/interfaces file, you do not need to use ifenslave.
 
 2. Bonding Driver Options
 =========================
@@ -779,22 +780,26 @@ resend_igmp
 
         You can configure bonding using either your distro's network
 initialization scripts, or manually using either ifenslave or the
-sysfs interface.  Distros generally use one of two packages for the
-network initialization scripts: initscripts or sysconfig.  Recent
-versions of these packages have support for bonding, while older
+sysfs interface.  Distros generally use one of three packages for the
+network initialization scripts: initscripts, sysconfig or interfaces.
+Recent versions of these packages have support for bonding, while older
 versions do not.
 
         We will first describe the options for configuring bonding for
-distros using versions of initscripts and sysconfig with full or
-partial support for bonding, then provide information on enabling
+distros using versions of initscripts, sysconfig and interfaces with full
+or partial support for bonding, then provide information on enabling
 bonding without support from the network initialization scripts (i.e.,
 older versions of initscripts or sysconfig).
 
-        If you're unsure whether your distro uses sysconfig or
-initscripts, or don't know if it's new enough, have no fear.
+        If you're unsure whether your distro uses sysconfig,
+initscripts or interfaces, or don't know if it's new enough, have no fear.
 Determining this is fairly straightforward.
 
-        First, issue the command:
+        First, look for a file called interfaces in /etc/network directory.
+If this file is present in your system, then your system use interfaces. See
+Configuration with Interfaces Support.
+
+        Else, issue the command:
 
 $ rpm -qf /sbin/ifup
 
@@ -1327,8 +1332,62 @@ echo 2000 > /sys/class/net/bond1/bonding/arp_interval
 echo +eth2 > /sys/class/net/bond1/bonding/slaves
 echo +eth3 > /sys/class/net/bond1/bonding/slaves
 
-3.5 Overriding Configuration for Special Cases
+3.5 Configuration with Interfaces Support
+-----------------------------------------
+
+        This section applies to distros which use /etc/network/interfaces file
+to describe network interface configuration, most notably Debian and it's
+derivatives.
+
+        The ifup and ifdown commands on Debian don't support bonding out of
+the box. The ifenslave-2.6 package should be installed to provide bonding
+support.  Once installed, this package will provide bond-* options to be used
+into /etc/network/interfaces.
+
+        Note that ifenslave-2.6 package will load the bonding module and use
+the ifenslave command when appropriate.
+
+Example Configurations
+----------------------
+
+In /etc/network/interfaces, the following stanza will configure bond0, in
+active-backup mode, with eth0 and eth1 as slaves.
+
+auto bond0
+iface bond0 inet dhcp
+        bond-slaves eth0 eth1
+        bond-mode active-backup
+        bond-miimon 100
+        bond-primary eth0 eth1
+
+If the above configuration doesn't work, you might have a system using
+upstart for system startup. This is most notably true for recent
+Ubuntu versions. The following stanza in /etc/network/interfaces will
+produce the same result on those systems.
+
+auto bond0
+iface bond0 inet dhcp
+        bond-slaves none
+        bond-mode active-backup
+        bond-miimon 100
+
+auto eth0
+iface eth0 inet manual
+        bond-master bond0
+        bond-primary eth0 eth1
+
+auto eth1
+iface eth1 inet manual
+        bond-master bond0
+        bond-primary eth0 eth1
+
+For a full list of bond-* supported options in /etc/network/interfaces and some
+more advanced examples tailored to you particular distros, see the files in
+/usr/share/doc/ifenslave-2.6.
+
+3.6 Overriding Configuration for Special Cases
 ----------------------------------------------
+
 When using the bonding driver, the physical port which transmits a frame is
 typically selected by the bonding driver, and is not relevant to the user or
 system administrator.  The output port is simply selected using the policies of
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index d99940dcfc4..ac3b4a726a1 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -187,7 +187,7 @@ tcp_cookie_size - INTEGER
 tcp_dsack - BOOLEAN
         Allows TCP to send "duplicate" SACKs.
 
-tcp_ecn - BOOLEAN
+tcp_ecn - INTEGER
         Enable Explicit Congestion Notification (ECN) in TCP. ECN is only
         used when both ends of the TCP flow support it. It is useful to
         avoid losses due to congestion (when the bottleneck router supports
diff --git a/Documentation/scheduler/sched-stats.txt b/Documentation/scheduler/sched-stats.txt
index 01e69404ee5..1cd5d51bc76 100644
--- a/Documentation/scheduler/sched-stats.txt
+++ b/Documentation/scheduler/sched-stats.txt
@@ -1,3 +1,7 @@
+Version 15 of schedstats dropped counters for some sched_yield:
+yld_exp_empty, yld_act_empty and yld_both_empty. Otherwise, it is
+identical to version 14.
+
 Version 14 of schedstats includes support for sched_domains, which hit the
 mainline kernel in 2.6.20 although it is identical to the stats from version
 12 which was in the kernel from 2.6.13-2.6.19 (version 13 never saw a kernel
@@ -28,32 +32,25 @@ to write their own scripts, the fields are described here.
 
 CPU statistics
 --------------
-cpu<N> 1 2 3 4 5 6 7 8 9 10 11 12
-
-NOTE: In the sched_yield() statistics, the active queue is considered empty
-    if it has only one process in it, since obviously the process calling
-    sched_yield() is that process.
+cpu<N> 1 2 3 4 5 6 7 8 9
 
-First four fields are sched_yield() statistics:
-     1) # of times both the active and the expired queue were empty
-     2) # of times just the active queue was empty
-     3) # of times just the expired queue was empty
-     4) # of times sched_yield() was called
+First field is a sched_yield() statistic:
+     1) # of times sched_yield() was called
 
 Next three are schedule() statistics:
-     5) # of times we switched to the expired queue and reused it
-     6) # of times schedule() was called
-     7) # of times schedule() left the processor idle
+     2) # of times we switched to the expired queue and reused it
+     3) # of times schedule() was called
+     4) # of times schedule() left the processor idle
 
 Next two are try_to_wake_up() statistics:
-     8) # of times try_to_wake_up() was called
-     9) # of times try_to_wake_up() was called to wake up the local cpu
+     5) # of times try_to_wake_up() was called
+     6) # of times try_to_wake_up() was called to wake up the local cpu
 
 Next three are statistics describing scheduling latency:
-    10) sum of all time spent running by tasks on this processor (in jiffies)
-    11) sum of all time spent waiting to run by tasks on this processor (in
+     7) sum of all time spent running by tasks on this processor (in jiffies)
+     8) sum of all time spent waiting to run by tasks on this processor (in
         jiffies)
-    12) # of timeslices run on this cpu
+     9) # of timeslices run on this cpu
 
 
 Domain statistics
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index 16ae4300c74..0caf77e59be 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -296,6 +296,7 @@ Conexant 5066
 =============
   laptop        Basic Laptop config (default)
   hp-laptop     HP laptops, e g G60
+  asus          Asus K52JU, Lenovo G560
   dell-laptop   Dell laptops
   dell-vostro   Dell Vostro
   olpc-xo-1_5   OLPC XO 1.5
diff --git a/Documentation/sound/alsa/soc/codec.txt b/Documentation/sound/alsa/soc/codec.txt
index 37ba3a72cb7..bce23a4a787 100644
--- a/Documentation/sound/alsa/soc/codec.txt
+++ b/Documentation/sound/alsa/soc/codec.txt
@@ -27,42 +27,38 @@ ASoC Codec driver breakdown
 
 1 - Codec DAI and PCM configuration
 -----------------------------------
-Each codec driver must have a struct snd_soc_codec_dai to define its DAI and
+Each codec driver must have a struct snd_soc_dai_driver to define its DAI and
 PCM capabilities and operations. This struct is exported so that it can be
 registered with the core by your machine driver.
 
 e.g.
 
-struct snd_soc_codec_dai wm8731_dai = {
-        .name = "WM8731",
-        /* playback capabilities */
+static struct snd_soc_dai_ops wm8731_dai_ops = {
+        .prepare        = wm8731_pcm_prepare,
+        .hw_params      = wm8731_hw_params,
+        .shutdown       = wm8731_shutdown,
+        .digital_mute   = wm8731_mute,
+        .set_sysclk     = wm8731_set_dai_sysclk,
+        .set_fmt        = wm8731_set_dai_fmt,
+};
+
+struct snd_soc_dai_driver wm8731_dai = {
+        .name = "wm8731-hifi",
         .playback = {
                 .stream_name = "Playback",
                 .channels_min = 1,
                 .channels_max = 2,
                 .rates = WM8731_RATES,
                 .formats = WM8731_FORMATS,},
-        /* capture capabilities */
         .capture = {
                 .stream_name = "Capture",
                 .channels_min = 1,
                 .channels_max = 2,
                 .rates = WM8731_RATES,
                 .formats = WM8731_FORMATS,},
-        /* pcm operations - see section 4 below */
-        .ops = {
-                .prepare = wm8731_pcm_prepare,
-                .hw_params = wm8731_hw_params,
-                .shutdown = wm8731_shutdown,
-        },
-        /* DAI operations - see DAI.txt */
-        .dai_ops = {
-                .digital_mute = wm8731_mute,
-                .set_sysclk = wm8731_set_dai_sysclk,
-                .set_fmt = wm8731_set_dai_fmt,
-        }
+        .ops = &wm8731_dai_ops,
+        .symmetric_rates = 1,
 };
-EXPORT_SYMBOL_GPL(wm8731_dai);
 
 
 2 - Codec control IO
@@ -186,13 +182,14 @@ when the mute is applied or freed.
 
 i.e.
 
-static int wm8974_mute(struct snd_soc_codec *codec,
-        struct snd_soc_codec_dai *dai, int mute)
+static int wm8974_mute(struct snd_soc_dai *dai, int mute)
 {
-        u16 mute_reg = wm8974_read_reg_cache(codec, WM8974_DAC) & 0xffbf;
-        if(mute)
-                wm8974_write(codec, WM8974_DAC, mute_reg | 0x40);
+        struct snd_soc_codec *codec = dai->codec;
+        u16 mute_reg = snd_soc_read(codec, WM8974_DAC) & 0xffbf;
+
+        if (mute)
+                snd_soc_write(codec, WM8974_DAC, mute_reg | 0x40);
         else
-                wm8974_write(codec, WM8974_DAC, mute_reg);
+                snd_soc_write(codec, WM8974_DAC, mute_reg);
         return 0;
 }
diff --git a/Documentation/sound/alsa/soc/machine.txt b/Documentation/sound/alsa/soc/machine.txt
index 2524c75557d..3e2ec9cbf39 100644
--- a/Documentation/sound/alsa/soc/machine.txt
+++ b/Documentation/sound/alsa/soc/machine.txt
@@ -12,6 +12,8 @@ the following struct:-
 struct snd_soc_card {
         char *name;
 
+        ...
+
         int (*probe)(struct platform_device *pdev);
         int (*remove)(struct platform_device *pdev);
 
@@ -22,12 +24,13 @@ struct snd_soc_card {
         int (*resume_pre)(struct platform_device *pdev);
         int (*resume_post)(struct platform_device *pdev);
 
-        /* machine stream operations */
-        struct snd_soc_ops *ops;
+        ...
 
         /* CPU <--> Codec DAI links  */
         struct snd_soc_dai_link *dai_link;
         int num_links;
+
+        ...
 };
 
 probe()/remove()
@@ -42,11 +45,6 @@ of any machine audio tasks that have to be done before or after the codec, DAIs
 and DMA is suspended and resumed. Optional.
 
 
-Machine operations
-------------------
-The machine specific audio operations can be set here. Again this is optional.
-
-
 Machine DAI Configuration
 -------------------------
 The machine DAI configuration glues all the codec and CPU DAIs together. It can
@@ -61,8 +59,10 @@ struct snd_soc_dai_link is used to set up each DAI in your machine. e.g.
 static struct snd_soc_dai_link corgi_dai = {
         .name = "WM8731",
         .stream_name = "WM8731",
-        .cpu_dai = &pxa_i2s_dai,
-        .codec_dai = &wm8731_dai,
+        .cpu_dai_name = "pxa-is2-dai",
+        .codec_dai_name = "wm8731-hifi",
+        .platform_name = "pxa-pcm-audio",
+        .codec_name = "wm8713-codec.0-001a",
         .init = corgi_wm8731_init,
         .ops = &corgi_ops,
 };
@@ -77,26 +77,6 @@ static struct snd_soc_card snd_soc_corgi = {
 };
 
 
-Machine Audio Subsystem
------------------------
-
-The machine soc device glues the platform, machine and codec driver together.
-Private data can also be set here. e.g.
-
-/* corgi audio private data */
-static struct wm8731_setup_data corgi_wm8731_setup = {
-        .i2c_address = 0x1b,
-};
-
-/* corgi audio subsystem */
-static struct snd_soc_device corgi_snd_devdata = {
-        .machine = &snd_soc_corgi,
-        .platform = &pxa2xx_soc_platform,
-        .codec_dev = &soc_codec_dev_wm8731,
-        .codec_data = &corgi_wm8731_setup,
-};
-
-
 Machine Power Map
 -----------------
 
diff --git a/Documentation/sound/alsa/soc/platform.txt b/Documentation/sound/alsa/soc/platform.txt
index 06d835987c6..d57efad37e0 100644
--- a/Documentation/sound/alsa/soc/platform.txt
+++ b/Documentation/sound/alsa/soc/platform.txt
@@ -20,9 +20,10 @@ struct snd_soc_ops {
         int (*trigger)(struct snd_pcm_substream *, int);
 };
 
-The platform driver exports its DMA functionality via struct snd_soc_platform:-
+The platform driver exports its DMA functionality via struct
+snd_soc_platform_driver:-
 
-struct snd_soc_platform {
+struct snd_soc_platform_driver {
         char *name;
 
         int (*probe)(struct platform_device *pdev);
@@ -34,6 +35,13 @@ struct snd_soc_platform {
         int (*pcm_new)(struct snd_card *, struct snd_soc_codec_dai *, struct snd_pcm *);
         void (*pcm_free)(struct snd_pcm *);
 
+        /*
+         * For platform caused delay reporting.
+         * Optional.
+         */
+        snd_pcm_sframes_t (*delay)(struct snd_pcm_substream *,
+                struct snd_soc_dai *);
+
         /* platform stream ops */
         struct snd_pcm_ops *pcm_ops;
 };
diff --git a/Documentation/video4linux/v4l2-controls.txt b/Documentation/video4linux/v4l2-controls.txt
index 8773778d23f..881e7f44491 100644
--- a/Documentation/video4linux/v4l2-controls.txt
+++ b/Documentation/video4linux/v4l2-controls.txt
@@ -285,6 +285,9 @@ implement g_volatile_ctrl like this:
 The 'new value' union is not used in g_volatile_ctrl. In general controls
 that need to implement g_volatile_ctrl are read-only controls.
 
+Note that if one or more controls in a control cluster are marked as volatile,
+then all the controls in the cluster are seen as volatile.
+
 To mark a control as volatile you have to set the is_volatile flag:
 
         ctrl = v4l2_ctrl_new_std(&sd->ctrl_handler, ...);
@@ -462,6 +465,15 @@ pointer to the v4l2_ctrl_ops struct that is used for that cluster.
 Obviously, all controls in the cluster array must be initialized to either
 a valid control or to NULL.
 
+In rare cases you might want to know which controls of a cluster actually
+were set explicitly by the user. For this you can check the 'is_new' flag of
+each control. For example, in the case of a volume/mute cluster the 'is_new'
+flag of the mute control would be set if the user called VIDIOC_S_CTRL for
+mute only. If the user would call VIDIOC_S_EXT_CTRLS for both mute and volume
+controls, then the 'is_new' flag would be 1 for both controls.
+
+The 'is_new' flag is always 1 when called from v4l2_ctrl_handler_setup().
+
 
 VIDIOC_LOG_STATUS Support
 =========================
diff --git a/MAINTAINERS b/MAINTAINERS
index 1af022e6366..531c5cf150b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -162,7 +162,7 @@ L:	linux-serial@vger.kernel.org
 W:      http://serial.sourceforge.net
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6.git
-F:      drivers/serial/8250*
+F:      drivers/tty/serial/8250*
 F:      include/linux/serial_8250.h
 
 8390 NETWORK DRIVERS [WD80x3/SMC-ELITE, SMC-ULTRA, NE2000, 3C503, etc.]
@@ -624,11 +624,15 @@ M:	Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 
-ARM/ATMEL AT91RM9200 ARM ARCHITECTURE
+ARM/ATMEL AT91RM9200 AND AT91SAM ARM ARCHITECTURES
 M:      Andrew Victor <linux@maxim.org.za>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://maxim.org.za/at91_26.html
-S:      Maintained
+W:      http://www.linux4sam.org
+S:      Supported
+F:      arch/arm/mach-at91/
 
 ARM/BCMRING ARM ARCHITECTURE
 M:      Jiandong Zheng <jdzheng@broadcom.com>
@@ -888,8 +892,8 @@ F:	arch/arm/mach-msm/
 F:      drivers/video/msm/
 F:      drivers/mmc/host/msm_sdcc.c
 F:      drivers/mmc/host/msm_sdcc.h
-F:      drivers/serial/msm_serial.h
-F:      drivers/serial/msm_serial.c
+F:      drivers/tty/serial/msm_serial.h
+F:      drivers/tty/serial/msm_serial.c
 T:      git git://codeaurora.org/quic/kernel/davidb/linux-msm.git
 S:      Maintained
 
@@ -974,6 +978,8 @@ S:	Maintained
 F:      arch/arm/plat-samsung/
 F:      arch/arm/plat-s3c24xx/
 F:      arch/arm/plat-s5p/
+F:      drivers/*/*s3c2410*
+F:      drivers/*/*/*s3c2410*
 
 ARM/S3C2410 ARM ARCHITECTURE
 M:      Ben Dooks <ben-linux@fluff.org>
@@ -1256,7 +1262,7 @@ F:	drivers/mmc/host/atmel-mci-regs.h
 ATMEL AT91 / AT32 SERIAL DRIVER
 M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
-F:      drivers/serial/atmel_serial.c
+F:      drivers/tty/serial/atmel_serial.c
 
 ATMEL LCDFB DRIVER
 M:      Nicolas Ferre <nicolas.ferre@atmel.com>
@@ -1412,7 +1418,7 @@ M:	Sonic Zhang <sonic.zhang@analog.com>
 L:      uclinux-dist-devel@blackfin.uclinux.org
 W:      http://blackfin.uclinux.org
 S:      Supported
-F:      drivers/serial/bfin_5xx.c
+F:      drivers/tty/serial/bfin_5xx.c
 
 BLACKFIN WATCHDOG DRIVER
 M:      Mike Frysinger <vapier.adi@gmail.com>
@@ -1877,7 +1883,7 @@ L:	linux-cris-kernel@axis.com
 W:      http://developer.axis.com
 S:      Maintained
 F:      arch/cris/
-F:      drivers/serial/crisv10.*
+F:      drivers/tty/serial/crisv10.*
 
 CRYPTO API
 M:      Herbert Xu <herbert@gondor.apana.org.au>
@@ -2216,7 +2222,7 @@ F:	drivers/net/wan/dscc4.c
 DZ DECSTATION DZ11 SERIAL DRIVER
 M:      "Maciej W. Rozycki" <macro@linux-mips.org>
 S:      Maintained
-F:      drivers/serial/dz.*
+F:      drivers/tty/serial/dz.*
 
 EATA-DMA SCSI DRIVER
 M:      Michael Neuffer <mike@i-Connect.Net>
@@ -2643,7 +2649,7 @@ FREESCALE QUICC ENGINE UCC UART DRIVER
 M:      Timur Tabi <timur@freescale.com>
 L:      linuxppc-dev@lists.ozlabs.org
 S:      Supported
-F:      drivers/serial/ucc_uart.c
+F:      drivers/tty/serial/ucc_uart.c
 
 FREESCALE SOC SOUND DRIVERS
 M:      Timur Tabi <timur@freescale.com>
@@ -3135,6 +3141,12 @@ S:	Maintained
 F:      net/ieee802154/
 F:      drivers/ieee802154/
 
+IKANOS/ADI EAGLE ADSL USB DRIVER
+M:      Matthieu Castet <castet.matthieu@free.fr>
+M:      Stanislaw Gruszka <stf_xl@wp.pl>
+S:      Maintained
+F:      drivers/usb/atm/ueagle-atm.c
+
 INTEGRITY MEASUREMENT ARCHITECTURE (IMA)
 M:      Mimi Zohar <zohar@us.ibm.com>
 S:      Supported
@@ -3146,7 +3158,7 @@ S:	Orphan
 F:      drivers/video/imsttfb.c
 
 INFINIBAND SUBSYSTEM
-M:      Roland Dreier <rolandd@cisco.com>
+M:      Roland Dreier <roland@kernel.org>
 M:      Sean Hefty <sean.hefty@intel.com>
 M:      Hal Rosenstock <hal.rosenstock@gmail.com>
 L:      linux-rdma@vger.kernel.org
@@ -3323,7 +3335,6 @@ F:	drivers/net/wimax/i2400m/
 F:      include/linux/wimax/i2400m.h
 
 INTEL WIRELESS WIFI LINK (iwlwifi)
-M:      Reinette Chatre <reinette.chatre@intel.com>
 M:      Wey-Yi Guy <wey-yi.w.guy@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
@@ -3350,7 +3361,7 @@ IOC3 SERIAL DRIVER
 M:      Pat Gefre <pfg@sgi.com>
 L:      linux-serial@vger.kernel.org
 S:      Maintained
-F:      drivers/serial/ioc3_serial.c
+F:      drivers/tty/serial/ioc3_serial.c
 
 IP MASQUERADING
 M:      Juanjo Ciarlante <jjciarla@raiz.uncu.edu.ar>
@@ -3527,7 +3538,7 @@ JSM Neo PCI based serial card
 M:      Breno Leitao <leitao@linux.vnet.ibm.com>
 L:      linux-serial@vger.kernel.org
 S:      Maintained
-F:      drivers/serial/jsm/
+F:      drivers/tty/serial/jsm/
 
 K10TEMP HARDWARE MONITORING DRIVER
 M:      Clemens Ladisch <clemens@ladisch.de>
@@ -3670,6 +3681,28 @@ F:	include/linux/key-type.h
 F:      include/keys/
 F:      security/keys/
 
+KEYS-TRUSTED
+M:      David Safford <safford@watson.ibm.com>
+M:      Mimi Zohar <zohar@us.ibm.com>
+L:      linux-security-module@vger.kernel.org
+L:      keyrings@linux-nfs.org
+S:      Supported
+F:      Documentation/keys-trusted-encrypted.txt
+F:      include/keys/trusted-type.h
+F:      security/keys/trusted.c
+F:      security/keys/trusted.h
+
+KEYS-ENCRYPTED
+M:      Mimi Zohar <zohar@us.ibm.com>
+M:      David Safford <safford@watson.ibm.com>
+L:      linux-security-module@vger.kernel.org
+L:      keyrings@linux-nfs.org
+S:      Supported
+F:      Documentation/keys-trusted-encrypted.txt
+F:      include/keys/encrypted-type.h
+F:      security/keys/encrypted.c
+F:      security/keys/encrypted.h
+
 KGDB / KDB /debug_core
 M:      Jason Wessel <jason.wessel@windriver.com>
 W:      http://kgdb.wiki.kernel.org/
@@ -3677,7 +3710,7 @@ L:	kgdb-bugreport@lists.sourceforge.net
 S:      Maintained
 F:      Documentation/DocBook/kgdb.tmpl
 F:      drivers/misc/kgdbts.c
-F:      drivers/serial/kgdboc.c
+F:      drivers/tty/serial/kgdboc.c
 F:      include/linux/kdb.h
 F:      include/linux/kgdb.h
 F:      kernel/debug/
@@ -5518,12 +5551,11 @@ S:	Supported
 F:      drivers/scsi/be2iscsi/
 
 SERVER ENGINES 10Gbps NIC - BladeEngine 2 DRIVER
-M:      Sathya Perla <sathyap@serverengines.com>
-M:      Subbu Seetharaman <subbus@serverengines.com>
-M:      Sarveshwar Bandi <sarveshwarb@serverengines.com>
-M:      Ajit Khaparde <ajitk@serverengines.com>
+M:      Sathya Perla <sathya.perla@emulex.com>
+M:      Subbu Seetharaman <subbu.seetharaman@emulex.com>
+M:      Ajit Khaparde <ajit.khaparde@emulex.com>
 L:      netdev@vger.kernel.org
-W:      http://www.serverengines.com
+W:      http://www.emulex.com
 S:      Supported
 F:      drivers/net/benet/
 
@@ -5545,7 +5577,7 @@ M:	Pat Gefre <pfg@sgi.com>
 L:      linux-ia64@vger.kernel.org
 S:      Supported
 F:      Documentation/ia64/serial.txt
-F:      drivers/serial/ioc?_serial.c
+F:      drivers/tty/serial/ioc?_serial.c
 F:      include/linux/ioc?.h
 
 SGI VISUAL WORKSTATION 320 AND 540
@@ -5567,7 +5599,7 @@ L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      Documentation/arm/Sharp-LH/ADC-LH7-Touchscreen
 F:      arch/arm/mach-lh7a40x/
-F:      drivers/serial/serial_lh7a40x.c
+F:      drivers/tty/serial/serial_lh7a40x.c
 F:      drivers/usb/gadget/lh7a40*
 F:      drivers/usb/host/ohci-lh7a40*
 
@@ -5583,18 +5615,20 @@ F:	include/linux/sfi*.h
 
 SIMTEC EB110ATX (Chalice CATS)
 P:      Ben Dooks
-M:      Vincent Sanders <support@simtec.co.uk>
+P:      Vincent Sanders <vince@simtec.co.uk>
+M:      Simtec Linux Team <linux@simtec.co.uk>
 W:      http://www.simtec.co.uk/products/EB110ATX/
 S:      Supported
 
 SIMTEC EB2410ITX (BAST)
 P:      Ben Dooks
-M:      Vincent Sanders <support@simtec.co.uk>
+P:      Vincent Sanders <vince@simtec.co.uk>
+M:      Simtec Linux Team <linux@simtec.co.uk>
 W:      http://www.simtec.co.uk/products/EB2410ITX/
 S:      Supported
-F:      arch/arm/mach-s3c2410/
-F:      drivers/*/*s3c2410*
-F:      drivers/*/*/*s3c2410*
+F:      arch/arm/mach-s3c2410/mach-bast.c
+F:      arch/arm/mach-s3c2410/bast-ide.c
+F:      arch/arm/mach-s3c2410/bast-irq.c
 
 TI DAVINCI MACHINE SUPPORT
 M:      Kevin Hilman <khilman@deeprootsystems.com>
@@ -5787,14 +5821,14 @@ L:	sparclinux@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next-2.6.git
 S:      Maintained
-F:      drivers/serial/suncore.c
-F:      drivers/serial/suncore.h
-F:      drivers/serial/sunhv.c
-F:      drivers/serial/sunsab.c
-F:      drivers/serial/sunsab.h
-F:      drivers/serial/sunsu.c
-F:      drivers/serial/sunzilog.c
-F:      drivers/serial/sunzilog.h
+F:      drivers/tty/serial/suncore.c
+F:      drivers/tty/serial/suncore.h
+F:      drivers/tty/serial/sunhv.c
+F:      drivers/tty/serial/sunsab.c
+F:      drivers/tty/serial/sunsab.h
+F:      drivers/tty/serial/sunsu.c
+F:      drivers/tty/serial/sunzilog.c
+F:      drivers/tty/serial/sunzilog.h
 
 SPEAR PLATFORM SUPPORT
 M:      Viresh Kumar <viresh.kumar@st.com>
@@ -6124,8 +6158,8 @@ TTY LAYER
 M:      Greg Kroah-Hartman <gregkh@suse.de>
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6.git
-F:      drivers/char/tty_*
-F:      drivers/serial/serial_core.c
+F:      drivers/tty/*
+F:      drivers/tty/serial/serial_core.c
 F:      include/linux/serial_core.h
 F:      include/linux/serial.h
 F:      include/linux/tty.h
@@ -6569,6 +6603,16 @@ S:	Maintained
 F:      drivers/char/virtio_console.c
 F:      include/linux/virtio_console.h
 
+VIRTIO CORE, NET AND BLOCK DRIVERS
+M:      Rusty Russell <rusty@rustcorp.com.au>
+M:      "Michael S. Tsirkin" <mst@redhat.com>
+L:      virtualization@lists.linux-foundation.org
+S:      Maintained
+F:      drivers/virtio/
+F:      drivers/net/virtio_net.c
+F:      drivers/block/virtio_blk.c
+F:      include/linux/virtio_*.h
+
 VIRTIO HOST (VHOST)
 M:      "Michael S. Tsirkin" <mst@redhat.com>
 L:      kvm@vger.kernel.org
@@ -6742,12 +6786,12 @@ S:	Maintained
 F:      drivers/net/wireless/wl1251/*
 
 WL1271 WIRELESS DRIVER
-M:      Luciano Coelho <luciano.coelho@nokia.com>
+M:      Luciano Coelho <coelho@ti.com>
 L:      linux-wireless@vger.kernel.org
-W:      http://wireless.kernel.org
+W:      http://wireless.kernel.org/en/users/Drivers/wl12xx
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/luca/wl12xx.git
 S:      Maintained
-F:      drivers/net/wireless/wl12xx/wl1271*
+F:      drivers/net/wireless/wl12xx/
 F:      include/linux/wl12xx.h
 
 WL3501 WIRELESS PCMCIA CARD DRIVER
@@ -6870,7 +6914,7 @@ XILINX UARTLITE SERIAL DRIVER
 M:      Peter Korsgaard <jacmet@sunsite.dk>
 L:      linux-serial@vger.kernel.org
 S:      Maintained
-F:      drivers/serial/uartlite.c
+F:      drivers/tty/serial/uartlite.c
 
 YAM DRIVER FOR AX.25
 M:      Jean-Paul Roubelat <jpr@f6fbb.org>
@@ -6916,7 +6960,7 @@ F:	drivers/media/video/zoran/
 ZS DECSTATION Z85C30 SERIAL DRIVER
 M:      "Maciej W. Rozycki" <macro@linux-mips.org>
 S:      Maintained
-F:      drivers/serial/zs.*
+F:      drivers/tty/serial/zs.*
 
 GRE DEMULTIPLEXER DRIVER
 M:      Dmitry Kozlov <xeb@mail.ru>
diff --git a/Makefile b/Makefile
index 6a457690d10..c9c8c8fd259 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
-SUBLEVEL = 37
-EXTRAVERSION =
+SUBLEVEL = 38
+EXTRAVERSION = -rc4
 NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index fc95ee1bcf6..47f63d48014 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -8,6 +8,9 @@ config ALPHA
         select HAVE_IRQ_WORK
         select HAVE_PERF_EVENTS
         select HAVE_DMA_ATTRS
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_IRQ_PROBE
+        select AUTO_IRQ_AFFINITY if SMP
         help
           The Alpha is a 64-bit general-purpose processor designed and
           marketed by the Digital Equipment Corporation of blessed memory,
@@ -68,22 +71,6 @@ config GENERIC_IOMAP
         bool
         default n
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
-config GENERIC_HARDIRQS
-        bool
-        default y
-
-config GENERIC_IRQ_PROBE
-        bool
-        default y
-
-config AUTO_IRQ_AFFINITY
-        bool
-        depends on SMP
-        default y
-
 source "init/Kconfig"
 source "kernel/Kconfig.freezer"
 
diff --git a/arch/arm/configs/ag5evm_defconfig b/arch/arm/configs/ag5evm_defconfig
index 2b9cf56db36..212ead354a6 100644
--- a/arch/arm/configs/ag5evm_defconfig
+++ b/arch/arm/configs/ag5evm_defconfig
@@ -10,7 +10,7 @@ CONFIG_NAMESPACES=y
 # CONFIG_PID_NS is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
diff --git a/arch/arm/configs/am200epdkit_defconfig b/arch/arm/configs/am200epdkit_defconfig
index 5536c488dd0..f0dea52e49c 100644
--- a/arch/arm/configs/am200epdkit_defconfig
+++ b/arch/arm/configs/am200epdkit_defconfig
@@ -3,7 +3,7 @@ CONFIG_LOCALVERSION="gum"
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SHMEM is not set
diff --git a/arch/arm/configs/at572d940hfek_defconfig b/arch/arm/configs/at572d940hfek_defconfig
index 695e32d4fb5..1b1158ae8f8 100644
--- a/arch/arm/configs/at572d940hfek_defconfig
+++ b/arch/arm/configs/at572d940hfek_defconfig
@@ -17,7 +17,7 @@ CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=m
diff --git a/arch/arm/configs/badge4_defconfig b/arch/arm/configs/badge4_defconfig
index 3a1ad15a779..5b54abbeb0b 100644
--- a/arch/arm/configs/badge4_defconfig
+++ b/arch/arm/configs/badge4_defconfig
@@ -1,6 +1,6 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODVERSIONS=y
 CONFIG_ARCH_SA1100=y
diff --git a/arch/arm/configs/bcmring_defconfig b/arch/arm/configs/bcmring_defconfig
index 75984cd1e23..795374d48f8 100644
--- a/arch/arm/configs/bcmring_defconfig
+++ b/arch/arm/configs/bcmring_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 # CONFIG_LOCALVERSION_AUTO is not set
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 # CONFIG_HOTPLUG is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/arm/configs/cm_x2xx_defconfig b/arch/arm/configs/cm_x2xx_defconfig
index dcfbcf3b6c3..a93ff8da5ba 100644
--- a/arch/arm/configs/cm_x2xx_defconfig
+++ b/arch/arm/configs/cm_x2xx_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_VM_EVENT_COUNTERS is not set
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
diff --git a/arch/arm/configs/colibri_pxa270_defconfig b/arch/arm/configs/colibri_pxa270_defconfig
index f52c64e36d8..2ef2c5e8aae 100644
--- a/arch/arm/configs/colibri_pxa270_defconfig
+++ b/arch/arm/configs/colibri_pxa270_defconfig
@@ -8,7 +8,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/collie_defconfig b/arch/arm/configs/collie_defconfig
index 310f9a6270b..6c56ad086c7 100644
--- a/arch/arm/configs/collie_defconfig
+++ b/arch/arm/configs/collie_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_BASE_FULL is not set
 # CONFIG_EPOLL is not set
 CONFIG_SLOB=y
diff --git a/arch/arm/configs/corgi_defconfig b/arch/arm/configs/corgi_defconfig
index 4a1fa81ed37..e53c4756384 100644
--- a/arch/arm/configs/corgi_defconfig
+++ b/arch/arm/configs/corgi_defconfig
@@ -4,7 +4,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=m
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/da8xx_omapl_defconfig b/arch/arm/configs/da8xx_omapl_defconfig
index cdc40c4b8c4..88ccde058ba 100644
--- a/arch/arm/configs/da8xx_omapl_defconfig
+++ b/arch/arm/configs/da8xx_omapl_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
diff --git a/arch/arm/configs/davinci_all_defconfig b/arch/arm/configs/davinci_all_defconfig
index 2519cc5a5f8..889922ad229 100644
--- a/arch/arm/configs/davinci_all_defconfig
+++ b/arch/arm/configs/davinci_all_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
diff --git a/arch/arm/configs/dove_defconfig b/arch/arm/configs/dove_defconfig
index 9359e1bf32c..54bf5eec801 100644
--- a/arch/arm/configs/dove_defconfig
+++ b/arch/arm/configs/dove_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/ebsa110_defconfig b/arch/arm/configs/ebsa110_defconfig
index c3194186920..14559dbb4c2 100644
--- a/arch/arm/configs/ebsa110_defconfig
+++ b/arch/arm/configs/ebsa110_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_ARCH_EBSA110=y
 CONFIG_PCCARD=m
diff --git a/arch/arm/configs/edb7211_defconfig b/arch/arm/configs/edb7211_defconfig
index 7b62be1561e..d52ded350a1 100644
--- a/arch/arm/configs/edb7211_defconfig
+++ b/arch/arm/configs/edb7211_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 CONFIG_ARCH_CLPS711X=y
 CONFIG_ARCH_EDB7211=y
diff --git a/arch/arm/configs/em_x270_defconfig b/arch/arm/configs/em_x270_defconfig
index d7db34f7970..60a21e01eb7 100644
--- a/arch/arm/configs/em_x270_defconfig
+++ b/arch/arm/configs/em_x270_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_VM_EVENT_COUNTERS is not set
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
diff --git a/arch/arm/configs/ep93xx_defconfig b/arch/arm/configs/ep93xx_defconfig
index 6d6689cdf39..8e97b2f7cee 100644
--- a/arch/arm/configs/ep93xx_defconfig
+++ b/arch/arm/configs/ep93xx_defconfig
@@ -4,7 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/eseries_pxa_defconfig b/arch/arm/configs/eseries_pxa_defconfig
index 1691dea582f..d68ac67c201 100644
--- a/arch/arm/configs/eseries_pxa_defconfig
+++ b/arch/arm/configs/eseries_pxa_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
diff --git a/arch/arm/configs/ezx_defconfig b/arch/arm/configs/ezx_defconfig
index c4eeb6d1cbf..227a477346e 100644
--- a/arch/arm/configs/ezx_defconfig
+++ b/arch/arm/configs/ezx_defconfig
@@ -7,7 +7,7 @@ CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/footbridge_defconfig b/arch/arm/configs/footbridge_defconfig
index 4f925ead261..038518ab39a 100644
--- a/arch/arm/configs/footbridge_defconfig
+++ b/arch/arm/configs/footbridge_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 CONFIG_MODULES=y
 CONFIG_ARCH_FOOTBRIDGE=y
diff --git a/arch/arm/configs/fortunet_defconfig b/arch/arm/configs/fortunet_defconfig
index e11c7eab8ed..840fced7529 100644
--- a/arch/arm/configs/fortunet_defconfig
+++ b/arch/arm/configs/fortunet_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 CONFIG_ARCH_CLPS711X=y
 CONFIG_ARCH_FORTUNET=y
diff --git a/arch/arm/configs/h5000_defconfig b/arch/arm/configs/h5000_defconfig
index ac336f10000..37903e3f0ef 100644
--- a/arch/arm/configs/h5000_defconfig
+++ b/arch/arm/configs/h5000_defconfig
@@ -4,7 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/imote2_defconfig b/arch/arm/configs/imote2_defconfig
index ade55c8c408..176ec22af03 100644
--- a/arch/arm/configs/imote2_defconfig
+++ b/arch/arm/configs/imote2_defconfig
@@ -6,7 +6,7 @@ CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/ixp2000_defconfig b/arch/arm/configs/ixp2000_defconfig
index 90832468454..8405aded97a 100644
--- a/arch/arm/configs/ixp2000_defconfig
+++ b/arch/arm/configs/ixp2000_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/ixp23xx_defconfig b/arch/arm/configs/ixp23xx_defconfig
index 7fc056a8569..688717612e9 100644
--- a/arch/arm/configs/ixp23xx_defconfig
+++ b/arch/arm/configs/ixp23xx_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/ixp4xx_defconfig b/arch/arm/configs/ixp4xx_defconfig
index 5c502393400..063e2ab2c8f 100644
--- a/arch/arm/configs/ixp4xx_defconfig
+++ b/arch/arm/configs/ixp4xx_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODVERSIONS=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/arm/configs/loki_defconfig b/arch/arm/configs/loki_defconfig
index e1eaff7f553..1ba752b2dc6 100644
--- a/arch/arm/configs/loki_defconfig
+++ b/arch/arm/configs/loki_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/lpd7a400_defconfig b/arch/arm/configs/lpd7a400_defconfig
index 20caaaba4a0..5a48f171204 100644
--- a/arch/arm/configs/lpd7a400_defconfig
+++ b/arch/arm/configs/lpd7a400_defconfig
@@ -3,7 +3,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_IKCONFIG=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 # CONFIG_EPOLL is not set
 # CONFIG_IOSCHED_DEADLINE is not set
diff --git a/arch/arm/configs/lpd7a404_defconfig b/arch/arm/configs/lpd7a404_defconfig
index 1efcce97b4a..22d0631de00 100644
--- a/arch/arm/configs/lpd7a404_defconfig
+++ b/arch/arm/configs/lpd7a404_defconfig
@@ -3,7 +3,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_IKCONFIG=y
 CONFIG_LOG_BUF_SHIFT=16
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 # CONFIG_EPOLL is not set
 CONFIG_SLAB=y
diff --git a/arch/arm/configs/magician_defconfig b/arch/arm/configs/magician_defconfig
index af805e8fd03..a88e64d4e9a 100644
--- a/arch/arm/configs/magician_defconfig
+++ b/arch/arm/configs/magician_defconfig
@@ -4,7 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/mv78xx0_defconfig b/arch/arm/configs/mv78xx0_defconfig
index b0d082422d4..7305ebddb51 100644
--- a/arch/arm/configs/mv78xx0_defconfig
+++ b/arch/arm/configs/mv78xx0_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_SLUB_DEBUG is not set
 CONFIG_PROFILING=y
diff --git a/arch/arm/configs/mx1_defconfig b/arch/arm/configs/mx1_defconfig
index 2f38d971543..b39b5ced8a1 100644
--- a/arch/arm/configs/mx1_defconfig
+++ b/arch/arm/configs/mx1_defconfig
@@ -4,7 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/mx21_defconfig b/arch/arm/configs/mx21_defconfig
index 6454e18e2ab..411f88dd440 100644
--- a/arch/arm/configs/mx21_defconfig
+++ b/arch/arm/configs/mx21_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/mx27_defconfig b/arch/arm/configs/mx27_defconfig
index 813cfb366c1..9ad4c656c9b 100644
--- a/arch/arm/configs/mx27_defconfig
+++ b/arch/arm/configs/mx27_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
diff --git a/arch/arm/configs/mx3_defconfig b/arch/arm/configs/mx3_defconfig
index e648ea3429b..7c4b30b3495 100644
--- a/arch/arm/configs/mx3_defconfig
+++ b/arch/arm/configs/mx3_defconfig
@@ -4,7 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/mx51_defconfig b/arch/arm/configs/mx51_defconfig
index 5c7a87260fa..9cba68cfa51 100644
--- a/arch/arm/configs/mx51_defconfig
+++ b/arch/arm/configs/mx51_defconfig
@@ -3,7 +3,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=18
 CONFIG_RELAY=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/nhk8815_defconfig b/arch/arm/configs/nhk8815_defconfig
index 0e2dc26ebe6..37207d1bf44 100644
--- a/arch/arm/configs/nhk8815_defconfig
+++ b/arch/arm/configs/nhk8815_defconfig
@@ -7,7 +7,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/omap1_defconfig b/arch/arm/configs/omap1_defconfig
index a350cc6bfe6..7b63462b349 100644
--- a/arch/arm/configs/omap1_defconfig
+++ b/arch/arm/configs/omap1_defconfig
@@ -6,7 +6,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_IKCONFIG=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_BASE_FULL is not set
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index ccedde1371c..ae890caa17a 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_SLAB=y
diff --git a/arch/arm/configs/orion5x_defconfig b/arch/arm/configs/orion5x_defconfig
index 439323b3b0e..a288d703395 100644
--- a/arch/arm/configs/orion5x_defconfig
+++ b/arch/arm/configs/orion5x_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SLUB_DEBUG is not set
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=y
diff --git a/arch/arm/configs/pcm027_defconfig b/arch/arm/configs/pcm027_defconfig
index 583a0610bd0..2f136c30a98 100644
--- a/arch/arm/configs/pcm027_defconfig
+++ b/arch/arm/configs/pcm027_defconfig
@@ -7,7 +7,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/pcontrol_g20_defconfig b/arch/arm/configs/pcontrol_g20_defconfig
index b42ee62c4d7..c75c9fcede5 100644
--- a/arch/arm/configs/pcontrol_g20_defconfig
+++ b/arch/arm/configs/pcontrol_g20_defconfig
@@ -10,7 +10,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/arm/configs/pleb_defconfig b/arch/arm/configs/pleb_defconfig
index d1efbdc1e6d..cb08cc561da 100644
--- a/arch/arm/configs/pleb_defconfig
+++ b/arch/arm/configs/pleb_defconfig
@@ -3,7 +3,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 # CONFIG_SHMEM is not set
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/pnx4008_defconfig b/arch/arm/configs/pnx4008_defconfig
index bd481f04276..35a31ccacc3 100644
--- a/arch/arm/configs/pnx4008_defconfig
+++ b/arch/arm/configs/pnx4008_defconfig
@@ -5,7 +5,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_AUDIT=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/simpad_defconfig b/arch/arm/configs/simpad_defconfig
index af3b12e3b46..d3358155bf8 100644
--- a/arch/arm/configs/simpad_defconfig
+++ b/arch/arm/configs/simpad_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_LOCALVERSION="oe1"
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/spitz_defconfig b/arch/arm/configs/spitz_defconfig
index aebd4bb0ad0..70158273c6d 100644
--- a/arch/arm/configs/spitz_defconfig
+++ b/arch/arm/configs/spitz_defconfig
@@ -4,7 +4,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=m
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/stmp378x_defconfig b/arch/arm/configs/stmp378x_defconfig
index 94a2d904bf9..1079c2b6eb3 100644
--- a/arch/arm/configs/stmp378x_defconfig
+++ b/arch/arm/configs/stmp378x_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/stmp37xx_defconfig b/arch/arm/configs/stmp37xx_defconfig
index d8ee58cfa87..564a5cc4408 100644
--- a/arch/arm/configs/stmp37xx_defconfig
+++ b/arch/arm/configs/stmp37xx_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/arm/configs/tct_hammer_defconfig b/arch/arm/configs/tct_hammer_defconfig
index e89ca19489c..95c0f0d63db 100644
--- a/arch/arm/configs/tct_hammer_defconfig
+++ b/arch/arm/configs/tct_hammer_defconfig
@@ -5,7 +5,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_BUG is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/arm/configs/trizeps4_defconfig b/arch/arm/configs/trizeps4_defconfig
index 37f48342827..3162173fa75 100644
--- a/arch/arm/configs/trizeps4_defconfig
+++ b/arch/arm/configs/trizeps4_defconfig
@@ -7,7 +7,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/u300_defconfig b/arch/arm/configs/u300_defconfig
index c1c252cdca6..4a5a12681be 100644
--- a/arch/arm/configs/u300_defconfig
+++ b/arch/arm/configs/u300_defconfig
@@ -3,7 +3,7 @@ CONFIG_EXPERIMENTAL=y
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_AIO is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
 CONFIG_MODULES=y
diff --git a/arch/arm/configs/viper_defconfig b/arch/arm/configs/viper_defconfig
index 9d7bf5e0d0f..8b0c717378f 100644
--- a/arch/arm/configs/viper_defconfig
+++ b/arch/arm/configs/viper_defconfig
@@ -3,7 +3,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=13
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_ELF_CORE is not set
 # CONFIG_SHMEM is not set
 CONFIG_SLAB=y
diff --git a/arch/arm/configs/xcep_defconfig b/arch/arm/configs/xcep_defconfig
index 70d47dbae6d..5b550414364 100644
--- a/arch/arm/configs/xcep_defconfig
+++ b/arch/arm/configs/xcep_defconfig
@@ -8,7 +8,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 # CONFIG_SHMEM is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/arm/include/asm/hardware/sp810.h b/arch/arm/include/asm/hardware/sp810.h
index a101f10bb5b..721847dc68a 100644
--- a/arch/arm/include/asm/hardware/sp810.h
+++ b/arch/arm/include/asm/hardware/sp810.h
@@ -50,6 +50,12 @@
 #define SCPCELLID2              0xFF8
 #define SCPCELLID3              0xFFC
 
+#define SCCTRL_TIMEREN0SEL_REFCLK       (0 << 15)
+#define SCCTRL_TIMEREN0SEL_TIMCLK       (1 << 15)
+
+#define SCCTRL_TIMEREN1SEL_REFCLK       (0 << 17)
+#define SCCTRL_TIMEREN1SEL_TIMCLK       (1 << 17)
+
 static inline void sysctl_soft_reset(void __iomem *base)
 {
         /* writing any value to SCSYSSTAT reg will reset system */
diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h
index 20e0f7c9e03..d66605dea55 100644
--- a/arch/arm/include/asm/io.h
+++ b/arch/arm/include/asm/io.h
@@ -95,6 +95,15 @@ static inline void __iomem *__typesafe_io(unsigned long addr)
         return (void __iomem *)addr;
 }
 
+/* IO barriers */
+#ifdef CONFIG_ARM_DMA_MEM_BUFFERABLE
+#define __iormb()               rmb()
+#define __iowmb()               wmb()
+#else
+#define __iormb()               do { } while (0)
+#define __iowmb()               do { } while (0)
+#endif
+
 /*
  * Now, pick up the machine-defined IO definitions
  */
@@ -125,17 +134,17 @@ static inline void __iomem *__typesafe_io(unsigned long addr)
  * The {in,out}[bwl] macros are for emulating x86-style PCI/ISA IO space.
  */
 #ifdef __io
-#define outb(v,p)               __raw_writeb(v,__io(p))
-#define outw(v,p)               __raw_writew((__force __u16) \
-                                        cpu_to_le16(v),__io(p))
-#define outl(v,p)               __raw_writel((__force __u32) \
-                                        cpu_to_le32(v),__io(p))
+#define outb(v,p)       ({ __iowmb(); __raw_writeb(v,__io(p)); })
+#define outw(v,p)       ({ __iowmb(); __raw_writew((__force __u16) \
+                                        cpu_to_le16(v),__io(p)); })
+#define outl(v,p)       ({ __iowmb(); __raw_writel((__force __u32) \
+                                        cpu_to_le32(v),__io(p)); })
 
-#define inb(p)  ({ __u8 __v = __raw_readb(__io(p)); __v; })
+#define inb(p)  ({ __u8 __v = __raw_readb(__io(p)); __iormb(); __v; })
 #define inw(p)  ({ __u16 __v = le16_to_cpu((__force __le16) \
-                        __raw_readw(__io(p))); __v; })
+                        __raw_readw(__io(p))); __iormb(); __v; })
 #define inl(p)  ({ __u32 __v = le32_to_cpu((__force __le32) \
-                        __raw_readl(__io(p))); __v; })
+                        __raw_readl(__io(p))); __iormb(); __v; })
 
 #define outsb(p,d,l)            __raw_writesb(__io(p),d,l)
 #define outsw(p,d,l)            __raw_writesw(__io(p),d,l)
@@ -192,14 +201,6 @@ extern void _memset_io(volatile void __iomem *, int, size_t);
 #define writel_relaxed(v,c)     ((void)__raw_writel((__force u32) \
                                         cpu_to_le32(v),__mem_pci(c)))
 
-#ifdef CONFIG_ARM_DMA_MEM_BUFFERABLE
-#define __iormb()               rmb()
-#define __iowmb()               wmb()
-#else
-#define __iormb()               do { } while (0)
-#define __iowmb()               do { } while (0)
-#endif
-
 #define readb(c)                ({ u8  __v = readb_relaxed(c); __iormb(); __v; })
 #define readw(c)                ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
 #define readl(c)                ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 23c2e8e5c0f..d0ee74b7cf8 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -188,7 +188,7 @@
  * translation for translating DMA addresses.  Use the driver
  * DMA support - see dma-mapping.h.
  */
-static inline unsigned long virt_to_phys(void *x)
+static inline unsigned long virt_to_phys(const volatile void *x)
 {
         return __virt_to_phys((unsigned long)(x));
 }
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f17d9a09e8f..c0225da3fb2 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -392,24 +392,22 @@ ENDPROC(__turn_mmu_on)
 
 #ifdef CONFIG_SMP_ON_UP
 __fixup_smp:
-        mov     r4, #0x00070000
-        orr     r3, r4, #0xff000000     @ mask 0xff070000
-        orr     r4, r4, #0x41000000     @ val 0x41070000
-        and     r0, r9, r3
-        teq     r0, r4                  @ ARM CPU and ARMv6/v7?
+        and     r3, r9, #0x000f0000     @ architecture version
+        teq     r3, #0x000f0000         @ CPU ID supported?
         bne     __fixup_smp_on_up       @ no, assume UP
 
-        orr     r3, r3, #0x0000ff00
-        orr     r3, r3, #0x000000f0     @ mask 0xff07fff0
+        bic     r3, r9, #0x00ff0000
+        bic     r3, r3, #0x0000000f     @ mask 0xff00fff0
+        mov     r4, #0x41000000
         orr     r4, r4, #0x0000b000
-        orr     r4, r4, #0x00000020     @ val 0x4107b020
-        and     r0, r9, r3
-        teq     r0, r4                  @ ARM 11MPCore?
+        orr     r4, r4, #0x00000020     @ val 0x4100b020
+        teq     r3, r4                  @ ARM 11MPCore?
         moveq   pc, lr                  @ yes, assume SMP
 
         mrc     p15, 0, r0, c0, c0, 5   @ read MPIDR
-        tst     r0, #1 << 31
-        movne   pc, lr                  @ bit 31 => SMP
+        and     r0, r0, #0xc0000000     @ multiprocessing extensions and
+        teq     r0, #0x80000000         @ not part of a uniprocessor system?
+        moveq   pc, lr                  @ yes, assume SMP
 
 __fixup_smp_on_up:
         adr     r0, 1f
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index fd9156698ab..60636f499cb 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -36,6 +36,7 @@ static void twd_set_mode(enum clock_event_mode mode,
                 /* timer load already set up */
                 ctrl = TWD_TIMER_CONTROL_ENABLE | TWD_TIMER_CONTROL_IT_ENABLE
                         | TWD_TIMER_CONTROL_PERIODIC;
+                __raw_writel(twd_timer_rate / HZ, twd_base + TWD_TIMER_LOAD);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
                 /* period set, and timer enabled in 'next_event' hook */
@@ -81,7 +82,7 @@ int twd_timer_ack(void)
 
 static void __cpuinit twd_calibrate_rate(void)
 {
-        unsigned long load, count;
+        unsigned long count;
         u64 waitjiffies;
 
         /*
@@ -116,10 +117,6 @@ static void __cpuinit twd_calibrate_rate(void)
                 printk("%lu.%02luMHz.\n", twd_timer_rate / 1000000,
                         (twd_timer_rate / 1000000) % 100);
         }
-
-        load = twd_timer_rate / HZ;
-
-        __raw_writel(load, twd_base + TWD_TIMER_LOAD);
 }
 
 /*
diff --git a/arch/arm/mach-ep93xx/core.c b/arch/arm/mach-ep93xx/core.c
index ffdf87be295..82079545adc 100644
--- a/arch/arm/mach-ep93xx/core.c
+++ b/arch/arm/mach-ep93xx/core.c
@@ -838,7 +838,7 @@ EXPORT_SYMBOL(ep93xx_i2s_release);
 static struct resource ep93xx_ac97_resources[] = {
         {
                 .start  = EP93XX_AAC_PHYS_BASE,
-                .end    = EP93XX_AAC_PHYS_BASE + 0xb0 - 1,
+                .end    = EP93XX_AAC_PHYS_BASE + 0xac - 1,
                 .flags  = IORESOURCE_MEM,
         },
         {
diff --git a/arch/arm/mach-ep93xx/gpio.c b/arch/arm/mach-ep93xx/gpio.c
index f3dc76fdcea..bec34b83495 100644
--- a/arch/arm/mach-ep93xx/gpio.c
+++ b/arch/arm/mach-ep93xx/gpio.c
@@ -427,6 +427,13 @@ void __init ep93xx_gpio_init(void)
 {
         int i;
 
+        /* Set Ports C, D, E, G, and H for GPIO use */
+        ep93xx_devcfg_set_bits(EP93XX_SYSCON_DEVCFG_KEYS |
+                                 EP93XX_SYSCON_DEVCFG_GONK |
+                                 EP93XX_SYSCON_DEVCFG_EONIDE |
+                                 EP93XX_SYSCON_DEVCFG_GONIDE |
+                                 EP93XX_SYSCON_DEVCFG_HONIDE);
+
         for (i = 0; i < ARRAY_SIZE(ep93xx_gpio_banks); i++)
                 gpiochip_add(&ep93xx_gpio_banks[i].chip);
 }
diff --git a/arch/arm/mach-footbridge/include/mach/debug-macro.S b/arch/arm/mach-footbridge/include/mach/debug-macro.S
index 3c9e0c40c67..30b971d6581 100644
--- a/arch/arm/mach-footbridge/include/mach/debug-macro.S
+++ b/arch/arm/mach-footbridge/include/mach/debug-macro.S
@@ -17,8 +17,8 @@
         /* For NetWinder debugging */
                 .macro  addruart, rp, rv
                 mov     \rp, #0x000003f8
-                orr     \rv, \rp, #0x7c000000   @ physical
-                orr     \rp, \rp, #0xff000000   @ virtual
+                orr     \rv, \rp, #0xff000000   @ virtual
+                orr     \rp, \rp, #0x7c000000   @ physical
                 .endm
 
 #define UART_SHIFT      0
diff --git a/arch/arm/mach-imx/mach-mx25_3ds.c b/arch/arm/mach-imx/mach-mx25_3ds.c
index 0c92a80eac4..cd18a0c91b8 100644
--- a/arch/arm/mach-imx/mach-mx25_3ds.c
+++ b/arch/arm/mach-imx/mach-mx25_3ds.c
@@ -180,7 +180,7 @@ static const uint32_t mx25pdk_keymap[] = {
         KEY(3, 3, KEY_POWER),
 };
 
-static const struct matrix_keymap_data mx25pdk_keymap_data __initdata = {
+static const struct matrix_keymap_data mx25pdk_keymap_data __initconst = {
         .keymap         = mx25pdk_keymap,
         .keymap_size    = ARRAY_SIZE(mx25pdk_keymap),
 };
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index 4dc68d6bb6b..9fd894271d5 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -432,7 +432,7 @@ static struct clocksource clocksource_ixp4xx = {
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-unsigned long ixp4xx_timer_freq = FREQ;
+unsigned long ixp4xx_timer_freq = IXP4XX_TIMER_FREQ;
 EXPORT_SYMBOL(ixp4xx_timer_freq);
 static void __init ixp4xx_clocksource_init(void)
 {
@@ -496,7 +496,7 @@ static struct clock_event_device clockevent_ixp4xx = {
 
 static void __init ixp4xx_clockevent_init(void)
 {
-        clockevent_ixp4xx.mult = div_sc(FREQ, NSEC_PER_SEC,
+        clockevent_ixp4xx.mult = div_sc(IXP4XX_TIMER_FREQ, NSEC_PER_SEC,
                                         clockevent_ixp4xx.shift);
         clockevent_ixp4xx.max_delta_ns =
                 clockevent_delta2ns(0xfffffffe, &clockevent_ixp4xx);
diff --git a/arch/arm/mach-ixp4xx/include/mach/timex.h b/arch/arm/mach-ixp4xx/include/mach/timex.h
index 2c3f93c3eb7..c9e930f2933 100644
--- a/arch/arm/mach-ixp4xx/include/mach/timex.h
+++ b/arch/arm/mach-ixp4xx/include/mach/timex.h
@@ -10,6 +10,7 @@
  * 66.66... MHz. We do a convulted calculation of CLOCK_TICK_RATE b/c the
  * timer register ignores the bottom 2 bits of the LATCH value.
  */
-#define FREQ 66666000
-#define CLOCK_TICK_RATE (((FREQ / HZ & ~IXP4XX_OST_RELOAD_MASK) + 1) * HZ)
+#define IXP4XX_TIMER_FREQ 66666000
+#define CLOCK_TICK_RATE \
+        (((IXP4XX_TIMER_FREQ / HZ & ~IXP4XX_OST_RELOAD_MASK) + 1) * HZ)
 
diff --git a/arch/arm/mach-ixp4xx/ixp4xx_qmgr.c b/arch/arm/mach-ixp4xx/ixp4xx_qmgr.c
index bfdbe4b5a3c..852f7c9f87d 100644
--- a/arch/arm/mach-ixp4xx/ixp4xx_qmgr.c
+++ b/arch/arm/mach-ixp4xx/ixp4xx_qmgr.c
@@ -265,6 +265,11 @@ void qmgr_release_queue(unsigned int queue)
                qmgr_queue_descs[queue], queue);
         qmgr_queue_descs[queue][0] = '\x0';
 #endif
+
+        while ((addr = qmgr_get_entry(queue)))
+                printk(KERN_ERR "qmgr: released queue %i not empty: 0x%08X\n",
+                       queue, addr);
+
         __raw_writel(0, &qmgr_regs->sram[queue]);
 
         used_sram_bitmap[0] &= ~mask[0];
@@ -275,10 +280,6 @@ void qmgr_release_queue(unsigned int queue)
         spin_unlock_irq(&qmgr_lock);
 
         module_put(THIS_MODULE);
-
-        while ((addr = qmgr_get_entry(queue)))
-                printk(KERN_ERR "qmgr: released queue %i not empty: 0x%08X\n",
-                       queue, addr);
 }
 
 static int qmgr_init(void)
diff --git a/arch/arm/mach-msm/board-qsd8x50.c b/arch/arm/mach-msm/board-qsd8x50.c
index 2e8391307f5..6dde8185205 100644
--- a/arch/arm/mach-msm/board-qsd8x50.c
+++ b/arch/arm/mach-msm/board-qsd8x50.c
@@ -43,7 +43,7 @@ static const unsigned        qsd8x50_surf_smc91x_gpio __initdata = 156;
  * at run-time: they vary from board to board, and the true
  * configuration won't be known until boot.
  */
-static struct resource smc91x_resources[] __initdata = {
+static struct resource smc91x_resources[] = {
         [0] = {
                 .flags = IORESOURCE_MEM,
         },
@@ -52,7 +52,7 @@ static struct resource smc91x_resources[] __initdata = {
         },
 };
 
-static struct platform_device smc91x_device __initdata = {
+static struct platform_device smc91x_device = {
         .name           = "smc91x",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(smc91x_resources),
diff --git a/arch/arm/mach-mxs/clock-mx23.c b/arch/arm/mach-mxs/clock-mx23.c
index b1a362ebfde..ca72a05ed9c 100644
--- a/arch/arm/mach-mxs/clock-mx23.c
+++ b/arch/arm/mach-mxs/clock-mx23.c
@@ -304,7 +304,7 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
         reg = __raw_readl(CLKCTRL_BASE_ADDR + HW_CLKCTRL_##dr);         \
         reg &= ~BM_CLKCTRL_##dr##_DIV;                                  \
         reg |= div << BP_CLKCTRL_##dr##_DIV;                            \
-        if (reg | (1 << clk->enable_shift)) {                           \
+        if (reg & (1 << clk->enable_shift)) {                           \
                 pr_err("%s: clock is gated\n", __func__);               \
                 return -EINVAL;                                         \
         }                                                               \
@@ -347,7 +347,7 @@ static int name##_set_parent(struct clk *clk, struct clk *parent)	\
 {                                                                       \
         if (parent != clk->parent) {                                    \
                 __raw_writel(BM_CLKCTRL_CLKSEQ_BYPASS_##bit,            \
-                         HW_CLKCTRL_CLKSEQ_TOG);                        \
+                         CLKCTRL_BASE_ADDR + HW_CLKCTRL_CLKSEQ_TOG);    \
                 clk->parent = parent;                                   \
         }                                                               \
                                                                         \
diff --git a/arch/arm/mach-mxs/clock-mx28.c b/arch/arm/mach-mxs/clock-mx28.c
index c9d7951e8bf..febd787f054 100644
--- a/arch/arm/mach-mxs/clock-mx28.c
+++ b/arch/arm/mach-mxs/clock-mx28.c
@@ -355,12 +355,12 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
         } else {                                                        \
                 reg &= ~BM_CLKCTRL_##dr##_DIV;                          \
                 reg |= div << BP_CLKCTRL_##dr##_DIV;                    \
-                if (reg | (1 << clk->enable_shift)) {                   \
+                if (reg & (1 << clk->enable_shift)) {                   \
                         pr_err("%s: clock is gated\n", __func__);       \
                         return -EINVAL;                                 \
                 }                                                       \
         }                                                               \
-        __raw_writel(reg, CLKCTRL_BASE_ADDR + HW_CLKCTRL_CPU);          \
+        __raw_writel(reg, CLKCTRL_BASE_ADDR + HW_CLKCTRL_##dr);         \
                                                                         \
         for (i = 10000; i; i--)                                         \
                 if (!(__raw_readl(CLKCTRL_BASE_ADDR +                   \
@@ -483,7 +483,7 @@ static int name##_set_parent(struct clk *clk, struct clk *parent)	\
 {                                                                       \
         if (parent != clk->parent) {                                    \
                 __raw_writel(BM_CLKCTRL_CLKSEQ_BYPASS_##bit,            \
-                         HW_CLKCTRL_CLKSEQ_TOG);                        \
+                         CLKCTRL_BASE_ADDR + HW_CLKCTRL_CLKSEQ_TOG);    \
                 clk->parent = parent;                                   \
         }                                                               \
                                                                         \
@@ -614,7 +614,6 @@ static struct clk_lookup lookups[] = {
         _REGISTER_CLOCK("mxs-auart.2", NULL, uart_clk)
         _REGISTER_CLOCK("mxs-auart.3", NULL, uart_clk)
         _REGISTER_CLOCK("mxs-auart.4", NULL, uart_clk)
-        _REGISTER_CLOCK("fec.0", NULL, fec_clk)
         _REGISTER_CLOCK("rtc", NULL, rtc_clk)
         _REGISTER_CLOCK("pll2", NULL, pll2_clk)
         _REGISTER_CLOCK(NULL, "hclk", hbus_clk)
diff --git a/arch/arm/mach-mxs/clock.c b/arch/arm/mach-mxs/clock.c
index e7d2269cf70..a7093c88e6a 100644
--- a/arch/arm/mach-mxs/clock.c
+++ b/arch/arm/mach-mxs/clock.c
@@ -57,7 +57,6 @@ static void __clk_disable(struct clk *clk)
                 if (clk->disable)
                         clk->disable(clk);
                 __clk_disable(clk->parent);
-                __clk_disable(clk->secondary);
         }
 }
 
@@ -68,7 +67,6 @@ static int __clk_enable(struct clk *clk)
 
         if (clk->usecount++ == 0) {
                 __clk_enable(clk->parent);
-                __clk_enable(clk->secondary);
 
                 if (clk->enable)
                         clk->enable(clk);
diff --git a/arch/arm/mach-mxs/gpio.c b/arch/arm/mach-mxs/gpio.c
index 8bcb3404225..64848fa3af3 100644
--- a/arch/arm/mach-mxs/gpio.c
+++ b/arch/arm/mach-mxs/gpio.c
@@ -139,6 +139,8 @@ static void mxs_gpio_irq_handler(u32 irq, struct irq_desc *desc)
         struct mxs_gpio_port *port = (struct mxs_gpio_port *)get_irq_data(irq);
         u32 gpio_irq_no_base = port->virtual_irq_start;
 
+        desc->irq_data.chip->irq_ack(&desc->irq_data);
+
         irq_stat = __raw_readl(port->base + PINCTRL_IRQSTAT(port->id)) &
                         __raw_readl(port->base + PINCTRL_IRQEN(port->id));
 
diff --git a/arch/arm/mach-mxs/include/mach/clock.h b/arch/arm/mach-mxs/include/mach/clock.h
index 041e276d8a3..592c9ab5d76 100644
--- a/arch/arm/mach-mxs/include/mach/clock.h
+++ b/arch/arm/mach-mxs/include/mach/clock.h
@@ -29,8 +29,6 @@ struct clk {
         int id;
         /* Source clock this clk depends on */
         struct clk *parent;
-        /* Secondary clock to enable/disable with this clock */
-        struct clk *secondary;
         /* Reference count of clock enable/disable */
         __s8 usecount;
         /* Register bit position for clock's enable/disable control. */
diff --git a/arch/arm/mach-omap1/Kconfig b/arch/arm/mach-omap1/Kconfig
index 8d2f2daba0c..e0a028161dd 100644
--- a/arch/arm/mach-omap1/Kconfig
+++ b/arch/arm/mach-omap1/Kconfig
@@ -9,6 +9,7 @@ config ARCH_OMAP730
         depends on ARCH_OMAP1
         bool "OMAP730 Based System"
         select CPU_ARM926T
+        select OMAP_MPU_TIMER
         select ARCH_OMAP_OTG
 
 config ARCH_OMAP850
@@ -22,6 +23,7 @@ config ARCH_OMAP15XX
         default y
         bool "OMAP15xx Based System"
         select CPU_ARM925T
+        select OMAP_MPU_TIMER
 
 config ARCH_OMAP16XX
         depends on ARCH_OMAP1
diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile
index 6ee19504845..ba6009f2767 100644
--- a/arch/arm/mach-omap1/Makefile
+++ b/arch/arm/mach-omap1/Makefile
@@ -3,12 +3,11 @@
 #
 
 # Common support
-obj-y := io.o id.o sram.o irq.o mux.o flash.o serial.o devices.o dma.o
+obj-y := io.o id.o sram.o time.o irq.o mux.o flash.o serial.o devices.o dma.o
 obj-y += clock.o clock_data.o opp_data.o
 
 obj-$(CONFIG_OMAP_MCBSP) += mcbsp.o
 
-obj-$(CONFIG_OMAP_MPU_TIMER)    += time.o
 obj-$(CONFIG_OMAP_32K_TIMER)    += timer32k.o
 
 # Power Management
diff --git a/arch/arm/mach-omap1/include/mach/entry-macro.S b/arch/arm/mach-omap1/include/mach/entry-macro.S
index c9be6d4d83e..bfb4fb1d738 100644
--- a/arch/arm/mach-omap1/include/mach/entry-macro.S
+++ b/arch/arm/mach-omap1/include/mach/entry-macro.S
@@ -14,19 +14,6 @@
 #include <mach/irqs.h>
 #include <asm/hardware/gic.h>
 
-/*
- * We use __glue to avoid errors with multiple definitions of
- * .globl omap_irq_flags as it's included from entry-armv.S but not
- * from entry-common.S.
- */
-#ifdef __glue
-                .pushsection .data
-                .globl  omap_irq_flags
-omap_irq_flags:
-                .word   0
-                .popsection
-#endif
-
                 .macro  disable_fiq
                 .endm
 
diff --git a/arch/arm/mach-omap1/irq.c b/arch/arm/mach-omap1/irq.c
index 47701584df3..731dd33bff5 100644
--- a/arch/arm/mach-omap1/irq.c
+++ b/arch/arm/mach-omap1/irq.c
@@ -57,6 +57,7 @@ struct omap_irq_bank {
         unsigned long wake_enable;
 };
 
+u32 omap_irq_flags;
 static unsigned int irq_bank_count;
 static struct omap_irq_bank *irq_banks;
 
@@ -176,7 +177,6 @@ static struct irq_chip omap_irq_chip = {
 
 void __init omap_init_irq(void)
 {
-        extern unsigned int omap_irq_flags;
         int i, j;
 
 #if defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP850)
diff --git a/arch/arm/mach-omap1/lcd_dma.c b/arch/arm/mach-omap1/lcd_dma.c
index c9088d85da0..453809359ba 100644
--- a/arch/arm/mach-omap1/lcd_dma.c
+++ b/arch/arm/mach-omap1/lcd_dma.c
@@ -37,7 +37,7 @@ int omap_lcd_dma_running(void)
          * On OMAP1510, internal LCD controller will start the transfer
          * when it gets enabled, so assume DMA running if LCD enabled.
          */
-        if (cpu_is_omap1510())
+        if (cpu_is_omap15xx())
                 if (omap_readw(OMAP_LCDC_CONTROL) & OMAP_LCDC_CTRL_LCD_EN)
                         return 1;
 
@@ -95,7 +95,7 @@ EXPORT_SYMBOL(omap_set_lcd_dma_single_transfer);
 
 void omap_set_lcd_dma_b1_rotation(int rotate)
 {
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_ERR "DMA rotation is not supported in 1510 mode\n");
                 BUG();
                 return;
@@ -106,7 +106,7 @@ EXPORT_SYMBOL(omap_set_lcd_dma_b1_rotation);
 
 void omap_set_lcd_dma_b1_mirror(int mirror)
 {
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_ERR "DMA mirror is not supported in 1510 mode\n");
                 BUG();
         }
@@ -116,7 +116,7 @@ EXPORT_SYMBOL(omap_set_lcd_dma_b1_mirror);
 
 void omap_set_lcd_dma_b1_vxres(unsigned long vxres)
 {
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_ERR "DMA virtual resulotion is not supported "
                                 "in 1510 mode\n");
                 BUG();
@@ -127,7 +127,7 @@ EXPORT_SYMBOL(omap_set_lcd_dma_b1_vxres);
 
 void omap_set_lcd_dma_b1_scale(unsigned int xscale, unsigned int yscale)
 {
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_ERR "DMA scale is not supported in 1510 mode\n");
                 BUG();
         }
@@ -177,7 +177,7 @@ static void set_b1_regs(void)
                         bottom = PIXADDR(lcd_dma.xres - 1, lcd_dma.yres - 1);
                         /* 1510 DMA requires the bottom address to be 2 more
                          * than the actual last memory access location. */
-                        if (cpu_is_omap1510() &&
+                        if (cpu_is_omap15xx() &&
                                 lcd_dma.data_type == OMAP_DMA_DATA_TYPE_S32)
                                         bottom += 2;
                         ei = PIXSTEP(0, 0, 1, 0);
@@ -241,7 +241,7 @@ static void set_b1_regs(void)
                 return; /* Suppress warning about uninitialized vars */
         }
 
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 omap_writew(top >> 16, OMAP1510_DMA_LCD_TOP_F1_U);
                 omap_writew(top, OMAP1510_DMA_LCD_TOP_F1_L);
                 omap_writew(bottom >> 16, OMAP1510_DMA_LCD_BOT_F1_U);
@@ -343,7 +343,7 @@ void omap_free_lcd_dma(void)
                 BUG();
                 return;
         }
-        if (!cpu_is_omap1510())
+        if (!cpu_is_omap15xx())
                 omap_writew(omap_readw(OMAP1610_DMA_LCD_CCR) & ~1,
                             OMAP1610_DMA_LCD_CCR);
         lcd_dma.reserved = 0;
@@ -360,7 +360,7 @@ void omap_enable_lcd_dma(void)
          * connected. Otherwise the OMAP internal controller will
          * start the transfer when it gets enabled.
          */
-        if (cpu_is_omap1510() || !lcd_dma.ext_ctrl)
+        if (cpu_is_omap15xx() || !lcd_dma.ext_ctrl)
                 return;
 
         w = omap_readw(OMAP1610_DMA_LCD_CTRL);
@@ -378,14 +378,14 @@ EXPORT_SYMBOL(omap_enable_lcd_dma);
 void omap_setup_lcd_dma(void)
 {
         BUG_ON(lcd_dma.active);
-        if (!cpu_is_omap1510()) {
+        if (!cpu_is_omap15xx()) {
                 /* Set some reasonable defaults */
                 omap_writew(0x5440, OMAP1610_DMA_LCD_CCR);
                 omap_writew(0x9102, OMAP1610_DMA_LCD_CSDP);
                 omap_writew(0x0004, OMAP1610_DMA_LCD_LCH_CTRL);
         }
         set_b1_regs();
-        if (!cpu_is_omap1510()) {
+        if (!cpu_is_omap15xx()) {
                 u16 w;
 
                 w = omap_readw(OMAP1610_DMA_LCD_CCR);
@@ -407,7 +407,7 @@ void omap_stop_lcd_dma(void)
         u16 w;
 
         lcd_dma.active = 0;
-        if (cpu_is_omap1510() || !lcd_dma.ext_ctrl)
+        if (cpu_is_omap15xx() || !lcd_dma.ext_ctrl)
                 return;
 
         w = omap_readw(OMAP1610_DMA_LCD_CCR);
diff --git a/arch/arm/mach-omap1/time.c b/arch/arm/mach-omap1/time.c
index ed7a61ff916..6885d2fac18 100644
--- a/arch/arm/mach-omap1/time.c
+++ b/arch/arm/mach-omap1/time.c
@@ -49,11 +49,15 @@
 #include <mach/hardware.h>
 #include <asm/leds.h>
 #include <asm/irq.h>
+#include <asm/sched_clock.h>
+
 #include <asm/mach/irq.h>
 #include <asm/mach/time.h>
 
 #include <plat/common.h>
 
+#ifdef CONFIG_OMAP_MPU_TIMER
+
 #define OMAP_MPU_TIMER_BASE             OMAP_MPU_TIMER1_BASE
 #define OMAP_MPU_TIMER_OFFSET           0x100
 
@@ -67,7 +71,7 @@ typedef struct {
 ((volatile omap_mpu_timer_regs_t*)OMAP1_IO_ADDRESS(OMAP_MPU_TIMER_BASE +        \
                                  (n)*OMAP_MPU_TIMER_OFFSET))
 
-static inline unsigned long omap_mpu_timer_read(int nr)
+static inline unsigned long notrace omap_mpu_timer_read(int nr)
 {
         volatile omap_mpu_timer_regs_t* timer = omap_mpu_timer_base(nr);
         return timer->read_tim;
@@ -212,6 +216,32 @@ static struct clocksource clocksource_mpu = {
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
+static DEFINE_CLOCK_DATA(cd);
+
+static inline unsigned long long notrace _omap_mpu_sched_clock(void)
+{
+        u32 cyc = mpu_read(&clocksource_mpu);
+        return cyc_to_sched_clock(&cd, cyc, (u32)~0);
+}
+
+#ifndef CONFIG_OMAP_32K_TIMER
+unsigned long long notrace sched_clock(void)
+{
+        return _omap_mpu_sched_clock();
+}
+#else
+static unsigned long long notrace omap_mpu_sched_clock(void)
+{
+        return _omap_mpu_sched_clock();
+}
+#endif
+
+static void notrace mpu_update_sched_clock(void)
+{
+        u32 cyc = mpu_read(&clocksource_mpu);
+        update_sched_clock(&cd, cyc, (u32)~0);
+}
+
 static void __init omap_init_clocksource(unsigned long rate)
 {
         static char err[] __initdata = KERN_ERR
@@ -219,17 +249,13 @@ static void __init omap_init_clocksource(unsigned long rate)
 
         setup_irq(INT_TIMER2, &omap_mpu_timer2_irq);
         omap_mpu_timer_start(1, ~0, 1);
+        init_sched_clock(&cd, mpu_update_sched_clock, 32, rate);
 
         if (clocksource_register_hz(&clocksource_mpu, rate))
                 printk(err, clocksource_mpu.name);
 }
 
-/*
- * ---------------------------------------------------------------------------
- * Timer initialization
- * ---------------------------------------------------------------------------
- */
-static void __init omap_timer_init(void)
+static void __init omap_mpu_timer_init(void)
 {
         struct clk      *ck_ref = clk_get(NULL, "ck_ref");
         unsigned long   rate;
@@ -246,6 +272,66 @@ static void __init omap_timer_init(void)
         omap_init_clocksource(rate);
 }
 
+#else
+static inline void omap_mpu_timer_init(void)
+{
+        pr_err("Bogus timer, should not happen\n");
+}
+#endif  /* CONFIG_OMAP_MPU_TIMER */
+
+#if defined(CONFIG_OMAP_MPU_TIMER) && defined(CONFIG_OMAP_32K_TIMER)
+static unsigned long long (*preferred_sched_clock)(void);
+
+unsigned long long notrace sched_clock(void)
+{
+        if (!preferred_sched_clock)
+                return 0;
+
+        return preferred_sched_clock();
+}
+
+static inline void preferred_sched_clock_init(bool use_32k_sched_clock)
+{
+        if (use_32k_sched_clock)
+                preferred_sched_clock = omap_32k_sched_clock;
+        else
+                preferred_sched_clock = omap_mpu_sched_clock;
+}
+#else
+static inline void preferred_sched_clock_init(bool use_32k_sched_clcok)
+{
+}
+#endif
+
+static inline int omap_32k_timer_usable(void)
+{
+        int res = false;
+
+        if (cpu_is_omap730() || cpu_is_omap15xx())
+                return res;
+
+#ifdef CONFIG_OMAP_32K_TIMER
+        res = omap_32k_timer_init();
+#endif
+
+        return res;
+}
+
+/*
+ * ---------------------------------------------------------------------------
+ * Timer initialization
+ * ---------------------------------------------------------------------------
+ */
+static void __init omap_timer_init(void)
+{
+        if (omap_32k_timer_usable()) {
+                preferred_sched_clock_init(1);
+        } else {
+                omap_mpu_timer_init();
+                preferred_sched_clock_init(0);
+        }
+}
+
 struct sys_timer omap_timer = {
         .init           = omap_timer_init,
 };
diff --git a/arch/arm/mach-omap1/timer32k.c b/arch/arm/mach-omap1/timer32k.c
index 20cfbcc6c60..13d7b8f145b 100644
--- a/arch/arm/mach-omap1/timer32k.c
+++ b/arch/arm/mach-omap1/timer32k.c
@@ -52,10 +52,9 @@
 #include <asm/irq.h>
 #include <asm/mach/irq.h>
 #include <asm/mach/time.h>
+#include <plat/common.h>
 #include <plat/dmtimer.h>
 
-struct sys_timer omap_timer;
-
 /*
  * ---------------------------------------------------------------------------
  * 32KHz OS timer
@@ -181,14 +180,14 @@ static __init void omap_init_32k_timer(void)
  * Timer initialization
  * ---------------------------------------------------------------------------
  */
-static void __init omap_timer_init(void)
+bool __init omap_32k_timer_init(void)
 {
+        omap_init_clocksource_32k();
+
 #ifdef CONFIG_OMAP_DM_TIMER
         omap_dm_timer_init();
 #endif
         omap_init_32k_timer();
-}
 
-struct sys_timer omap_timer = {
-        .init           = omap_timer_init,
-};
+        return true;
+}
diff --git a/arch/arm/mach-omap2/board-cm-t3517.c b/arch/arm/mach-omap2/board-cm-t3517.c
index 5b0c77732df..8f9a64d650e 100644
--- a/arch/arm/mach-omap2/board-cm-t3517.c
+++ b/arch/arm/mach-omap2/board-cm-t3517.c
@@ -124,8 +124,9 @@ static inline void cm_t3517_init_hecc(void) {}
 #if defined(CONFIG_RTC_DRV_V3020) || defined(CONFIG_RTC_DRV_V3020_MODULE)
 #define RTC_IO_GPIO             (153)
 #define RTC_WR_GPIO             (154)
-#define RTC_RD_GPIO             (160)
+#define RTC_RD_GPIO             (53)
 #define RTC_CS_GPIO             (163)
+#define RTC_CS_EN_GPIO          (160)
 
 struct v3020_platform_data cm_t3517_v3020_pdata = {
         .use_gpio       = 1,
@@ -145,6 +146,16 @@ static struct platform_device cm_t3517_rtc_device = {
 
 static void __init cm_t3517_init_rtc(void)
 {
+        int err;
+
+        err = gpio_request(RTC_CS_EN_GPIO, "rtc cs en");
+        if (err) {
+                pr_err("CM-T3517: rtc cs en gpio request failed: %d\n", err);
+                return;
+        }
+
+        gpio_direction_output(RTC_CS_EN_GPIO, 1);
+
         platform_device_register(&cm_t3517_rtc_device);
 }
 #else
@@ -214,12 +225,12 @@ static struct mtd_partition cm_t3517_nand_partitions[] = {
         },
         {
                 .name           = "linux",
-                .offset         = MTDPART_OFS_APPEND,   /* Offset = 0x280000 */
+                .offset         = MTDPART_OFS_APPEND,   /* Offset = 0x2A0000 */
                 .size           = 32 * NAND_BLOCK_SIZE,
         },
         {
                 .name           = "rootfs",
-                .offset         = MTDPART_OFS_APPEND,   /* Offset = 0x680000 */
+                .offset         = MTDPART_OFS_APPEND,   /* Offset = 0x6A0000 */
                 .size           = MTDPART_SIZ_FULL,
         },
 };
@@ -256,11 +267,19 @@ static void __init cm_t3517_init_irq(void)
 static struct omap_board_mux board_mux[] __initdata = {
         /* GPIO186 - Green LED */
         OMAP3_MUX(SYS_CLKOUT2, OMAP_MUX_MODE4 | OMAP_PIN_OUTPUT),
-        /* RTC GPIOs: IO, WR#, RD#, CS# */
+
+        /* RTC GPIOs: */
+        /* IO - GPIO153 */
         OMAP3_MUX(MCBSP4_DR, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
+        /* WR# - GPIO154 */
         OMAP3_MUX(MCBSP4_DX, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
-        OMAP3_MUX(MCBSP_CLKS, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
+        /* RD# - GPIO53 */
+        OMAP3_MUX(GPMC_NCS2, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
+        /* CS# - GPIO163 */
         OMAP3_MUX(UART3_CTS_RCTX, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
+        /* CS EN - GPIO160 */
+        OMAP3_MUX(MCBSP_CLKS, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
+
         /* HSUSB1 RESET */
         OMAP3_MUX(UART2_TX, OMAP_MUX_MODE4 | OMAP_PIN_OUTPUT),
         /* HSUSB2 RESET */
diff --git a/arch/arm/mach-omap2/board-devkit8000.c b/arch/arm/mach-omap2/board-devkit8000.c
index 00bb1fc5e01..9a2a31e011c 100644
--- a/arch/arm/mach-omap2/board-devkit8000.c
+++ b/arch/arm/mach-omap2/board-devkit8000.c
@@ -115,9 +115,6 @@ static struct omap2_hsmmc_info mmc[] = {
 
 static int devkit8000_panel_enable_lcd(struct omap_dss_device *dssdev)
 {
-        twl_i2c_write_u8(TWL4030_MODULE_GPIO, 0x80, REG_GPIODATADIR1);
-        twl_i2c_write_u8(TWL4030_MODULE_LED, 0x0, 0x0);
-
         if (gpio_is_valid(dssdev->reset_gpio))
                 gpio_set_value_cansleep(dssdev->reset_gpio, 1);
         return 0;
@@ -247,6 +244,8 @@ static struct gpio_led gpio_leds[];
 static int devkit8000_twl_gpio_setup(struct device *dev,
                 unsigned gpio, unsigned ngpio)
 {
+        int ret;
+
         omap_mux_init_gpio(29, OMAP_PIN_INPUT);
         /* gpio + 0 is "mmc0_cd" (input/IRQ) */
         mmc[0].gpio_cd = gpio + 0;
@@ -255,17 +254,23 @@ static int devkit8000_twl_gpio_setup(struct device *dev,
         /* TWL4030_GPIO_MAX + 1 == ledB, PMU_STAT (out, active low LED) */
         gpio_leds[2].gpio = gpio + TWL4030_GPIO_MAX + 1;
 
-        /* gpio + 1 is "LCD_PWREN" (out, active high) */
-        devkit8000_lcd_device.reset_gpio = gpio + 1;
-        gpio_request(devkit8000_lcd_device.reset_gpio, "LCD_PWREN");
-        /* Disable until needed */
-        gpio_direction_output(devkit8000_lcd_device.reset_gpio, 0);
+        /* TWL4030_GPIO_MAX + 0 is "LCD_PWREN" (out, active high) */
+        devkit8000_lcd_device.reset_gpio = gpio + TWL4030_GPIO_MAX + 0;
+        ret = gpio_request_one(devkit8000_lcd_device.reset_gpio,
+                        GPIOF_DIR_OUT | GPIOF_INIT_LOW, "LCD_PWREN");
+        if (ret < 0) {
+                devkit8000_lcd_device.reset_gpio = -EINVAL;
+                printk(KERN_ERR "Failed to request GPIO for LCD_PWRN\n");
+        }
 
         /* gpio + 7 is "DVI_PD" (out, active low) */
         devkit8000_dvi_device.reset_gpio = gpio + 7;
-        gpio_request(devkit8000_dvi_device.reset_gpio, "DVI PowerDown");
-        /* Disable until needed */
-        gpio_direction_output(devkit8000_dvi_device.reset_gpio, 0);
+        ret = gpio_request_one(devkit8000_dvi_device.reset_gpio,
+                        GPIOF_DIR_OUT | GPIOF_INIT_LOW, "DVI PowerDown");
+        if (ret < 0) {
+                devkit8000_dvi_device.reset_gpio = -EINVAL;
+                printk(KERN_ERR "Failed to request GPIO for DVI PowerDown\n");
+        }
 
         return 0;
 }
@@ -275,8 +280,7 @@ static struct twl4030_gpio_platform_data devkit8000_gpio_data = {
         .irq_base       = TWL4030_GPIO_IRQ_BASE,
         .irq_end        = TWL4030_GPIO_IRQ_END,
         .use_leds       = true,
-        .pullups        = BIT(1),
-        .pulldowns      = BIT(2) | BIT(6) | BIT(7) | BIT(8) | BIT(13)
+        .pulldowns      = BIT(1) | BIT(2) | BIT(6) | BIT(8) | BIT(13)
                                 | BIT(15) | BIT(16) | BIT(17),
         .setup          = devkit8000_twl_gpio_setup,
 };
diff --git a/arch/arm/mach-omap2/board-omap4panda.c b/arch/arm/mach-omap2/board-omap4panda.c
index e001a048dc0..e944025d5ef 100644
--- a/arch/arm/mach-omap2/board-omap4panda.c
+++ b/arch/arm/mach-omap2/board-omap4panda.c
@@ -409,8 +409,6 @@ static void __init omap4_panda_init(void)
         platform_add_devices(panda_devices, ARRAY_SIZE(panda_devices));
         omap_serial_init();
         omap4_twl6030_hsmmc_init(mmc);
-        /* OMAP4 Panda uses internal transceiver so register nop transceiver */
-        usb_nop_xceiv_register();
         omap4_ehci_init();
         usb_musb_init(&musb_board_data);
 }
diff --git a/arch/arm/mach-omap2/board-rm680.c b/arch/arm/mach-omap2/board-rm680.c
index cb77be7ac44..39a71bb8a30 100644
--- a/arch/arm/mach-omap2/board-rm680.c
+++ b/arch/arm/mach-omap2/board-rm680.c
@@ -40,9 +40,6 @@ static struct regulator_consumer_supply rm680_vemmc_consumers[] = {
 static struct regulator_init_data rm680_vemmc = {
         .constraints =  {
                 .name                   = "rm680_vemmc",
-                .min_uV                 = 2900000,
-                .max_uV                 = 2900000,
-                .apply_uV               = 1,
                 .valid_modes_mask       = REGULATOR_MODE_NORMAL
                                         | REGULATOR_MODE_STANDBY,
                 .valid_ops_mask         = REGULATOR_CHANGE_STATUS
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index e8cb32fd7f1..de9ec8ddd2a 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -34,7 +34,6 @@
 #include "cm2_44xx.h"
 #include "cm-regbits-44xx.h"
 #include "prm44xx.h"
-#include "prm44xx.h"
 #include "prm-regbits-44xx.h"
 #include "control.h"
 #include "scrm44xx.h"
diff --git a/arch/arm/mach-omap2/clockdomain.c b/arch/arm/mach-omap2/clockdomain.c
index e20b98636ab..58e42f76603 100644
--- a/arch/arm/mach-omap2/clockdomain.c
+++ b/arch/arm/mach-omap2/clockdomain.c
@@ -423,6 +423,12 @@ int clkdm_add_wkdep(struct clockdomain *clkdm1, struct clockdomain *clkdm2)
 {
         struct clkdm_dep *cd;
 
+        if (!cpu_is_omap24xx() && !cpu_is_omap34xx()) {
+                pr_err("clockdomain: %s/%s: %s: not yet implemented\n",
+                       clkdm1->name, clkdm2->name, __func__);
+                return -EINVAL;
+        }
+
         if (!clkdm1 || !clkdm2)
                 return -EINVAL;
 
@@ -458,6 +464,12 @@ int clkdm_del_wkdep(struct clockdomain *clkdm1, struct clockdomain *clkdm2)
 {
         struct clkdm_dep *cd;
 
+        if (!cpu_is_omap24xx() && !cpu_is_omap34xx()) {
+                pr_err("clockdomain: %s/%s: %s: not yet implemented\n",
+                       clkdm1->name, clkdm2->name, __func__);
+                return -EINVAL;
+        }
+
         if (!clkdm1 || !clkdm2)
                 return -EINVAL;
 
@@ -500,6 +512,12 @@ int clkdm_read_wkdep(struct clockdomain *clkdm1, struct clockdomain *clkdm2)
         if (!clkdm1 || !clkdm2)
                 return -EINVAL;
 
+        if (!cpu_is_omap24xx() && !cpu_is_omap34xx()) {
+                pr_err("clockdomain: %s/%s: %s: not yet implemented\n",
+                       clkdm1->name, clkdm2->name, __func__);
+                return -EINVAL;
+        }
+
         cd = _clkdm_deps_lookup(clkdm2, clkdm1->wkdep_srcs);
         if (IS_ERR(cd)) {
                 pr_debug("clockdomain: hardware cannot set/clear wake up of "
@@ -527,6 +545,12 @@ int clkdm_clear_all_wkdeps(struct clockdomain *clkdm)
         struct clkdm_dep *cd;
         u32 mask = 0;
 
+        if (!cpu_is_omap24xx() && !cpu_is_omap34xx()) {
+                pr_err("clockdomain: %s: %s: not yet implemented\n",
+                       clkdm->name, __func__);
+                return -EINVAL;
+        }
+
         if (!clkdm)
                 return -EINVAL;
 
@@ -830,8 +854,7 @@ void omap2_clkdm_allow_idle(struct clockdomain *clkdm)
          * dependency code and data for OMAP4.
          */
         if (cpu_is_omap44xx()) {
-                WARN_ONCE(1, "clockdomain: OMAP4 wakeup/sleep dependency "
-                          "support is not yet implemented\n");
+                pr_err("clockdomain: %s: OMAP4 wakeup/sleep dependency support: not yet implemented\n", clkdm->name);
         } else {
                 if (atomic_read(&clkdm->usecount) > 0)
                         _clkdm_add_autodeps(clkdm);
@@ -872,8 +895,7 @@ void omap2_clkdm_deny_idle(struct clockdomain *clkdm)
          * dependency code and data for OMAP4.
          */
         if (cpu_is_omap44xx()) {
-                WARN_ONCE(1, "clockdomain: OMAP4 wakeup/sleep dependency "
-                          "support is not yet implemented\n");
+                pr_err("clockdomain: %s: OMAP4 wakeup/sleep dependency support: not yet implemented\n", clkdm->name);
         } else {
                 if (atomic_read(&clkdm->usecount) > 0)
                         _clkdm_del_autodeps(clkdm);
diff --git a/arch/arm/mach-omap2/clockdomains44xx_data.c b/arch/arm/mach-omap2/clockdomains44xx_data.c
index 51920fc7fc5..10622c914ab 100644
--- a/arch/arm/mach-omap2/clockdomains44xx_data.c
+++ b/arch/arm/mach-omap2/clockdomains44xx_data.c
@@ -30,8 +30,6 @@
 #include "cm1_44xx.h"
 #include "cm2_44xx.h"
 
-#include "cm1_44xx.h"
-#include "cm2_44xx.h"
 #include "cm-regbits-44xx.h"
 #include "prm44xx.h"
 #include "prcm44xx.h"
diff --git a/arch/arm/mach-omap2/dma.c b/arch/arm/mach-omap2/dma.c
index d2f15f5cfd3..34922b2d2e3 100644
--- a/arch/arm/mach-omap2/dma.c
+++ b/arch/arm/mach-omap2/dma.c
@@ -264,7 +264,7 @@ static int __init omap2_system_dma_init_dev(struct omap_hwmod *oh, void *unused)
         if (IS_ERR(od)) {
                 pr_err("%s: Cant build omap_device for %s:%s.\n",
                         __func__, name, oh->name);
-                return IS_ERR(od);
+                return PTR_ERR(od);
         }
 
         mem = platform_get_resource(&od->pdev, IORESOURCE_MEM, 0);
diff --git a/arch/arm/mach-omap2/include/mach/entry-macro.S b/arch/arm/mach-omap2/include/mach/entry-macro.S
index befa321c4c1..81985a665cb 100644
--- a/arch/arm/mach-omap2/include/mach/entry-macro.S
+++ b/arch/arm/mach-omap2/include/mach/entry-macro.S
@@ -38,20 +38,6 @@
  */
 
 #ifdef MULTI_OMAP2
-
-/*
- * We use __glue to avoid errors with multiple definitions of
- * .globl omap_irq_base as it's included from entry-armv.S but not
- * from entry-common.S.
- */
-#ifdef __glue
-                .pushsection .data
-                .globl  omap_irq_base
-omap_irq_base:
-                .word   0
-                .popsection
-#endif
-
                 /*
                  * Configure the interrupt base on the first interrupt.
                  * See also omap_irq_base_init for setting omap_irq_base.
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index e66687b0b9d..c2032041d26 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -314,14 +314,13 @@ static int _set_hwmod_postsetup_state(struct omap_hwmod *oh, void *data)
         return omap_hwmod_set_postsetup_state(oh, *(u8 *)data);
 }
 
+void __iomem *omap_irq_base;
+
 /*
  * Initialize asm_irq_base for entry-macro.S
  */
 static inline void omap_irq_base_init(void)
 {
-        extern void __iomem *omap_irq_base;
-
-#ifdef MULTI_OMAP2
         if (cpu_is_omap24xx())
                 omap_irq_base = OMAP2_L4_IO_ADDRESS(OMAP24XX_IC_BASE);
         else if (cpu_is_omap34xx())
@@ -330,7 +329,6 @@ static inline void omap_irq_base_init(void)
                 omap_irq_base = OMAP2_L4_IO_ADDRESS(OMAP44XX_GIC_CPU_BASE);
         else
                 pr_err("Could not initialize omap_irq_base\n");
-#endif
 }
 
 void __init omap2_init_common_infrastructure(void)
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index df8d2f2872c..98148b6c36e 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -160,7 +160,7 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition,
         struct omap_mux *mux = NULL;
         struct omap_mux_entry *e;
         const char *mode_name;
-        int found = 0, found_mode, mode0_len = 0;
+        int found = 0, found_mode = 0, mode0_len = 0;
         struct list_head *muxmodes = &partition->muxmodes;
 
         mode_name = strchr(muxname, '.');
@@ -1000,6 +1000,7 @@ int __init omap_mux_init(const char *name, u32 flags,
         if (!partition->base) {
                 pr_err("%s: Could not ioremap mux partition at 0x%08x\n",
                         __func__, partition->phys);
+                kfree(partition);
                 return -ENODEV;
         }
 
diff --git a/arch/arm/mach-omap2/pm24xx.c b/arch/arm/mach-omap2/pm24xx.c
index 9e5dc8ed51e..97feb3ab6a6 100644
--- a/arch/arm/mach-omap2/pm24xx.c
+++ b/arch/arm/mach-omap2/pm24xx.c
@@ -134,7 +134,7 @@ static void omap2_enter_full_retention(void)
 
         /* Block console output in case it is on one of the OMAP UARTs */
         if (!is_suspending())
-                if (try_acquire_console_sem())
+                if (!console_trylock())
                         goto no_sleep;
 
         omap_uart_prepare_idle(0);
@@ -151,7 +151,7 @@ static void omap2_enter_full_retention(void)
         omap_uart_resume_idle(0);
 
         if (!is_suspending())
-                release_console_sem();
+                console_unlock();
 
 no_sleep:
         if (omap2_pm_debug) {
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 8cbbeade4b8..2f864e4b085 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -168,9 +168,10 @@ static void omap3_core_restore_context(void)
  * once during boot sequence, but this works as we are not using secure
  * services.
  */
-static void omap3_save_secure_ram_context(u32 target_mpu_state)
+static void omap3_save_secure_ram_context(void)
 {
         u32 ret;
+        int mpu_next_state = pwrdm_read_next_pwrst(mpu_pwrdm);
 
         if (omap_type() != OMAP2_DEVICE_TYPE_GP) {
                 /*
@@ -181,7 +182,7 @@ static void omap3_save_secure_ram_context(u32 target_mpu_state)
                 pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON);
                 ret = _omap_save_secure_sram((u32 *)
                                 __pa(omap3_secure_ram_storage));
-                pwrdm_set_next_pwrst(mpu_pwrdm, target_mpu_state);
+                pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state);
                 /* Following is for error tracking, it should not happen */
                 if (ret) {
                         printk(KERN_ERR "save_secure_sram() returns %08x\n",
@@ -398,7 +399,7 @@ void omap_sram_idle(void)
         if (!is_suspending())
                 if (per_next_state < PWRDM_POWER_ON ||
                     core_next_state < PWRDM_POWER_ON)
-                        if (try_acquire_console_sem())
+                        if (!console_trylock())
                                 goto console_still_active;
 
         /* PER */
@@ -481,7 +482,7 @@ void omap_sram_idle(void)
         }
 
         if (!is_suspending())
-                release_console_sem();
+                console_unlock();
 
 console_still_active:
         /* Disable IO-PAD and IO-CHAIN wakeup */
@@ -1094,7 +1095,7 @@ static int __init omap3_pm_init(void)
                 local_fiq_disable();
 
                 omap_dma_global_context_save();
-                omap3_save_secure_ram_context(PWRDM_POWER_ON);
+                omap3_save_secure_ram_context();
                 omap_dma_global_context_restore();
 
                 local_irq_enable();
diff --git a/arch/arm/mach-omap2/powerdomain2xxx_3xxx.c b/arch/arm/mach-omap2/powerdomain2xxx_3xxx.c
index d5233890370..cf600e22bf8 100644
--- a/arch/arm/mach-omap2/powerdomain2xxx_3xxx.c
+++ b/arch/arm/mach-omap2/powerdomain2xxx_3xxx.c
@@ -19,7 +19,6 @@
 #include <plat/prcm.h>
 
 #include "powerdomain.h"
-#include "prm-regbits-34xx.h"
 #include "prm.h"
 #include "prm-regbits-24xx.h"
 #include "prm-regbits-34xx.h"
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index 302da7403a1..32e91a9c8b6 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -812,7 +812,7 @@ void __init omap_serial_init_port(struct omap_board_data *bdata)
 
         oh->dev_attr = uart;
 
-        acquire_console_sem(); /* in case the earlycon is on the UART */
+        console_lock(); /* in case the earlycon is on the UART */
 
         /*
          * Because of early UART probing, UART did not get idled
@@ -838,7 +838,7 @@ void __init omap_serial_init_port(struct omap_board_data *bdata)
         omap_uart_block_sleep(uart);
         uart->timeout = DEFAULT_TIMEOUT;
 
-        release_console_sem();
+        console_unlock();
 
         if ((cpu_is_omap34xx() && uart->padconf) ||
             (uart->wk_en && uart->wk_mask)) {
diff --git a/arch/arm/mach-omap2/smartreflex.c b/arch/arm/mach-omap2/smartreflex.c
index 77ecebf3fae..c37e823266d 100644
--- a/arch/arm/mach-omap2/smartreflex.c
+++ b/arch/arm/mach-omap2/smartreflex.c
@@ -780,8 +780,7 @@ static int omap_sr_autocomp_show(void *data, u64 *val)
         struct omap_sr *sr_info = (struct omap_sr *) data;
 
         if (!sr_info) {
-                pr_warning("%s: omap_sr struct for sr_%s not found\n",
-                        __func__, sr_info->voltdm->name);
+                pr_warning("%s: omap_sr struct not found\n", __func__);
                 return -EINVAL;
         }
 
@@ -795,8 +794,7 @@ static int omap_sr_autocomp_store(void *data, u64 val)
         struct omap_sr *sr_info = (struct omap_sr *) data;
 
         if (!sr_info) {
-                pr_warning("%s: omap_sr struct for sr_%s not found\n",
-                        __func__, sr_info->voltdm->name);
+                pr_warning("%s: omap_sr struct not found\n", __func__);
                 return -EINVAL;
         }
 
@@ -834,7 +832,8 @@ static int __init omap_sr_probe(struct platform_device *pdev)
 
         if (!pdata) {
                 dev_err(&pdev->dev, "%s: platform data missing\n", __func__);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_free_devinfo;
         }
 
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -966,7 +965,7 @@ static int __devexit omap_sr_remove(struct platform_device *pdev)
         }
 
         sr_info = _sr_lookup(pdata->voltdm);
-        if (!sr_info) {
+        if (IS_ERR(sr_info)) {
                 dev_warn(&pdev->dev, "%s: omap_sr struct not found\n",
                         __func__);
                 return -EINVAL;
diff --git a/arch/arm/mach-omap2/timer-gp.c b/arch/arm/mach-omap2/timer-gp.c
index 4e48e786bec..7b7c2683ae7 100644
--- a/arch/arm/mach-omap2/timer-gp.c
+++ b/arch/arm/mach-omap2/timer-gp.c
@@ -42,6 +42,8 @@
 
 #include "timer-gp.h"
 
+#include <plat/common.h>
+
 /* MAX_GPTIMER_ID: number of GPTIMERs on the chip */
 #define MAX_GPTIMER_ID          12
 
@@ -176,10 +178,14 @@ static void __init omap2_gp_clockevent_init(void)
 /* 
  * When 32k-timer is enabled, don't use GPTimer for clocksource
  * instead, just leave default clocksource which uses the 32k
- * sync counter.  See clocksource setup in see plat-omap/common.c. 
+ * sync counter.  See clocksource setup in plat-omap/counter_32k.c
  */
 
-static inline void __init omap2_gp_clocksource_init(void) {}
+static void __init omap2_gp_clocksource_init(void)
+{
+        omap_init_clocksource_32k();
+}
+
 #else
 /*
  * clocksource
diff --git a/arch/arm/mach-omap2/voltage.c b/arch/arm/mach-omap2/voltage.c
index ed6079c94c5..12be525b8df 100644
--- a/arch/arm/mach-omap2/voltage.c
+++ b/arch/arm/mach-omap2/voltage.c
@@ -471,6 +471,7 @@ static void __init vdd_debugfs_init(struct omap_vdd_info *vdd)
         strcat(name, vdd->voltdm.name);
 
         vdd->debug_dir = debugfs_create_dir(name, voltage_dir);
+        kfree(name);
         if (IS_ERR(vdd->debug_dir)) {
                 pr_warning("%s: Unable to create debugfs directory for"
                         " vdd_%s\n", __func__, vdd->voltdm.name);
diff --git a/arch/arm/mach-realview/Kconfig b/arch/arm/mach-realview/Kconfig
index b4575ae9648..7ca138a943a 100644
--- a/arch/arm/mach-realview/Kconfig
+++ b/arch/arm/mach-realview/Kconfig
@@ -2,52 +2,56 @@ menu "RealView platform type"
         depends on ARCH_REALVIEW
 
 config MACH_REALVIEW_EB
-        bool "Support RealView/EB platform"
+        bool "Support RealView(R) Emulation Baseboard"
         select ARM_GIC
         help
-          Include support for the ARM(R) RealView Emulation Baseboard platform.
+          Include support for the ARM(R) RealView(R) Emulation Baseboard
+          platform.
 
 config REALVIEW_EB_A9MP
-        bool "Support Multicore Cortex-A9"
+        bool "Support Multicore Cortex-A9 Tile"
         depends on MACH_REALVIEW_EB
         select CPU_V7
         help
-          Enable support for the Cortex-A9MPCore tile on the Realview platform.
+          Enable support for the Cortex-A9MPCore tile fitted to the
+          Realview(R) Emulation Baseboard platform.
 
 config REALVIEW_EB_ARM11MP
-        bool "Support ARM11MPCore tile"
+        bool "Support ARM11MPCore Tile"
         depends on MACH_REALVIEW_EB
         select CPU_V6
         select ARCH_HAS_BARRIERS if SMP
         help
-          Enable support for the ARM11MPCore tile on the Realview platform.
+          Enable support for the ARM11MPCore tile fitted to the Realview(R)
+          Emulation Baseboard platform.
 
 config REALVIEW_EB_ARM11MP_REVB
-        bool "Support ARM11MPCore RevB tile"
+        bool "Support ARM11MPCore RevB Tile"
         depends on REALVIEW_EB_ARM11MP
         help
-          Enable support for the ARM11MPCore RevB tile on the Realview
-          platform. Since there are device address differences, a
-          kernel built with this option enabled is not compatible with
-          other revisions of the ARM11MPCore tile.
+          Enable support for the ARM11MPCore Revision B tile on the
+          Realview(R) Emulation Baseboard platform. Since there are device
+          address differences, a kernel built with this option enabled is
+          not compatible with other revisions of the ARM11MPCore tile.
 
 config MACH_REALVIEW_PB11MP
-        bool "Support RealView/PB11MPCore platform"
+        bool "Support RealView(R) Platform Baseboard for ARM11MPCore"
         select CPU_V6
         select ARM_GIC
         select HAVE_PATA_PLATFORM
         select ARCH_HAS_BARRIERS if SMP
         help
-          Include support for the ARM(R) RealView MPCore Platform Baseboard.
-          PB11MPCore is a platform with an on-board ARM11MPCore and has
+          Include support for the ARM(R) RealView(R) Platform Baseboard for
+          the ARM11MPCore.  This platform has an on-board ARM11MPCore and has
           support for PCI-E and Compact Flash.
 
 config MACH_REALVIEW_PB1176
-        bool "Support RealView/PB1176 platform"
+        bool "Support RealView(R) Platform Baseboard for ARM1176JZF-S"
         select CPU_V6
         select ARM_GIC
         help
-          Include support for the ARM(R) RealView ARM1176 Platform Baseboard.
+          Include support for the ARM(R) RealView(R) Platform Baseboard for
+          ARM1176JZF-S.
 
 config REALVIEW_PB1176_SECURE_FLASH
         bool "Allow access to the secure flash memory block"
@@ -59,23 +63,24 @@ config REALVIEW_PB1176_SECURE_FLASH
           block (64MB @ 0x3c000000) is required.
 
 config MACH_REALVIEW_PBA8
-        bool "Support RealView/PB-A8 platform"
+        bool "Support RealView(R) Platform Baseboard for Cortex(tm)-A8 platform"
         select CPU_V7
         select ARM_GIC
         select HAVE_PATA_PLATFORM
         help
-          Include support for the ARM(R) RealView Cortex-A8 Platform Baseboard.
-          PB-A8 is a platform with an on-board Cortex-A8 and has support for
-          PCI-E and Compact Flash.
+          Include support for the ARM(R) RealView Platform Baseboard for
+          Cortex(tm)-A8.  This platform has an on-board Cortex-A8 and has
+          support for PCI-E and Compact Flash.
 
 config MACH_REALVIEW_PBX
-        bool "Support RealView/PBX platform"
+        bool "Support RealView(R) Platform Baseboard Explore"
         select ARM_GIC
         select HAVE_PATA_PLATFORM
         select ARCH_SPARSEMEM_ENABLE if CPU_V7 && !REALVIEW_HIGH_PHYS_OFFSET
         select ZONE_DMA if SPARSEMEM
         help
-          Include support for the ARM(R) RealView PBX platform.
+          Include support for the ARM(R) RealView(R) Platform Baseboard
+          Explore.
 
 config REALVIEW_HIGH_PHYS_OFFSET
         bool "High physical base address for the RealView platform"
diff --git a/arch/arm/mach-realview/platsmp.c b/arch/arm/mach-realview/platsmp.c
index a22bf67f2f7..6959d13d908 100644
--- a/arch/arm/mach-realview/platsmp.c
+++ b/arch/arm/mach-realview/platsmp.c
@@ -41,7 +41,7 @@ volatile int __cpuinitdata pen_release = -1;
  * observers, irrespective of whether they're taking part in coherency
  * or not.  This is necessary for the hotplug code to work reliably.
  */
-static void write_pen_release(int val)
+static void __cpuinit write_pen_release(int val)
 {
         pen_release = val;
         smp_wmb();
diff --git a/arch/arm/mach-shmobile/Kconfig b/arch/arm/mach-shmobile/Kconfig
index 4d1b4c5c938..0c8f6cf3e94 100644
--- a/arch/arm/mach-shmobile/Kconfig
+++ b/arch/arm/mach-shmobile/Kconfig
@@ -60,6 +60,8 @@ endchoice
 
 config MACH_AG5EVM
         bool "AG5EVM board"
+        select ARCH_REQUIRE_GPIOLIB
+        select SH_LCD_MIPI_DSI
         depends on ARCH_SH73A0
 
 config MACH_MACKEREL
diff --git a/arch/arm/mach-shmobile/board-ag5evm.c b/arch/arm/mach-shmobile/board-ag5evm.c
index c18a740a415..2123b96b563 100644
--- a/arch/arm/mach-shmobile/board-ag5evm.c
+++ b/arch/arm/mach-shmobile/board-ag5evm.c
@@ -34,9 +34,10 @@
 #include <linux/input/sh_keysc.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/sh_mmcif.h>
-
+#include <linux/sh_clk.h>
+#include <video/sh_mobile_lcdc.h>
+#include <video/sh_mipi_dsi.h>
 #include <sound/sh_fsi.h>
-
 #include <mach/hardware.h>
 #include <mach/sh73a0.h>
 #include <mach/common.h>
@@ -183,11 +184,165 @@ static struct platform_device mmc_device = {
         .resource       = sh_mmcif_resources,
 };
 
+/* IrDA */
+static struct resource irda_resources[] = {
+        [0] = {
+                .start  = 0xE6D00000,
+                .end    = 0xE6D01FD4 - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = gic_spi(95),
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device irda_device = {
+        .name           = "sh_irda",
+        .id             = 0,
+        .resource       = irda_resources,
+        .num_resources  = ARRAY_SIZE(irda_resources),
+};
+
+static unsigned char lcd_backlight_seq[3][2] = {
+        { 0x04, 0x07 },
+        { 0x23, 0x80 },
+        { 0x03, 0x01 },
+};
+
+static void lcd_backlight_on(void)
+{
+        struct i2c_adapter *a;
+        struct i2c_msg msg;
+        int k;
+
+        a = i2c_get_adapter(1);
+        for (k = 0; a && k < 3; k++) {
+                msg.addr = 0x6d;
+                msg.buf = &lcd_backlight_seq[k][0];
+                msg.len = 2;
+                msg.flags = 0;
+                if (i2c_transfer(a, &msg, 1) != 1)
+                        break;
+        }
+}
+
+static void lcd_backlight_reset(void)
+{
+        gpio_set_value(GPIO_PORT235, 0);
+        mdelay(24);
+        gpio_set_value(GPIO_PORT235, 1);
+}
+
+static void lcd_on(void *board_data, struct fb_info *info)
+{
+        lcd_backlight_on();
+}
+
+static void lcd_off(void *board_data)
+{
+        lcd_backlight_reset();
+}
+
+/* LCDC0 */
+static const struct fb_videomode lcdc0_modes[] = {
+        {
+                .name           = "R63302(QHD)",
+                .xres           = 544,
+                .yres           = 961,
+                .left_margin    = 72,
+                .right_margin   = 600,
+                .hsync_len      = 16,
+                .upper_margin   = 8,
+                .lower_margin   = 8,
+                .vsync_len      = 2,
+                .sync           = FB_SYNC_VERT_HIGH_ACT | FB_SYNC_HOR_HIGH_ACT,
+        },
+};
+
+static struct sh_mobile_lcdc_info lcdc0_info = {
+        .clock_source = LCDC_CLK_PERIPHERAL,
+        .ch[0] = {
+                .chan = LCDC_CHAN_MAINLCD,
+                .interface_type = RGB24,
+                .clock_divider = 1,
+                .flags = LCDC_FLAGS_DWPOL,
+                .lcd_size_cfg.width = 44,
+                .lcd_size_cfg.height = 79,
+                .bpp = 16,
+                .lcd_cfg = lcdc0_modes,
+                .num_cfg = ARRAY_SIZE(lcdc0_modes),
+                .board_cfg = {
+                        .display_on = lcd_on,
+                        .display_off = lcd_off,
+                },
+        }
+};
+
+static struct resource lcdc0_resources[] = {
+        [0] = {
+                .name   = "LCDC0",
+                .start  = 0xfe940000, /* P4-only space */
+                .end    = 0xfe943fff,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = intcs_evt2irq(0x580),
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device lcdc0_device = {
+        .name           = "sh_mobile_lcdc_fb",
+        .num_resources  = ARRAY_SIZE(lcdc0_resources),
+        .resource       = lcdc0_resources,
+        .id             = 0,
+        .dev    = {
+                .platform_data  = &lcdc0_info,
+                .coherent_dma_mask = ~0,
+        },
+};
+
+/* MIPI-DSI */
+static struct resource mipidsi0_resources[] = {
+        [0] = {
+                .start  = 0xfeab0000,
+                .end    = 0xfeab3fff,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = 0xfeab4000,
+                .end    = 0xfeab7fff,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+
+static struct sh_mipi_dsi_info mipidsi0_info = {
+        .data_format    = MIPI_RGB888,
+        .lcd_chan       = &lcdc0_info.ch[0],
+        .vsynw_offset   = 20,
+        .clksrc         = 1,
+        .flags          = SH_MIPI_DSI_HSABM,
+};
+
+static struct platform_device mipidsi0_device = {
+        .name           = "sh-mipi-dsi",
+        .num_resources  = ARRAY_SIZE(mipidsi0_resources),
+        .resource       = mipidsi0_resources,
+        .id             = 0,
+        .dev    = {
+                .platform_data  = &mipidsi0_info,
+        },
+};
+
 static struct platform_device *ag5evm_devices[] __initdata = {
         &eth_device,
         &keysc_device,
         &fsi_device,
         &mmc_device,
+        &irda_device,
+        &lcdc0_device,
+        &mipidsi0_device,
 };
 
 static struct map_desc ag5evm_io_desc[] __initdata = {
@@ -224,6 +379,8 @@ void __init ag5evm_init_irq(void)
         __raw_writew(__raw_readw(PINTCR0A) | (2<<10), PINTCR0A);
 }
 
+#define DSI0PHYCR       0xe615006c
+
 static void __init ag5evm_init(void)
 {
         sh73a0_pinmux_init();
@@ -287,6 +444,25 @@ static void __init ag5evm_init(void)
         gpio_request(GPIO_FN_FSIAISLD, NULL);
         gpio_request(GPIO_FN_FSIAOSLD, NULL);
 
+        /* IrDA */
+        gpio_request(GPIO_FN_PORT241_IRDA_OUT, NULL);
+        gpio_request(GPIO_FN_PORT242_IRDA_IN,  NULL);
+        gpio_request(GPIO_FN_PORT243_IRDA_FIRSEL, NULL);
+
+        /* LCD panel */
+        gpio_request(GPIO_PORT217, NULL); /* RESET */
+        gpio_direction_output(GPIO_PORT217, 0);
+        mdelay(1);
+        gpio_set_value(GPIO_PORT217, 1);
+
+        /* LCD backlight controller */
+        gpio_request(GPIO_PORT235, NULL); /* RESET */
+        gpio_direction_output(GPIO_PORT235, 0);
+        lcd_backlight_reset();
+
+        /* MIPI-DSI clock setup */
+        __raw_writel(0x2a809010, DSI0PHYCR);
+
 #ifdef CONFIG_CACHE_L2X0
         /* Shared attribute override enable, 64K*8way */
         l2x0_init(__io(0xf0100000), 0x00460000, 0xc2000fff);
diff --git a/arch/arm/mach-shmobile/board-g3evm.c b/arch/arm/mach-shmobile/board-g3evm.c
index 686b304a770..ef4613b993a 100644
--- a/arch/arm/mach-shmobile/board-g3evm.c
+++ b/arch/arm/mach-shmobile/board-g3evm.c
@@ -347,7 +347,6 @@ static void __init g3evm_init(void)
         gpio_request(GPIO_FN_IRDA_OUT, NULL);
         gpio_request(GPIO_FN_IRDA_IN, NULL);
         gpio_request(GPIO_FN_IRDA_FIRSEL, NULL);
-        set_irq_type(evt2irq(0x480), IRQ_TYPE_LEVEL_LOW);
 
         sh7367_add_standard_devices();
 
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 7b15d21f0f6..fb4213a4e15 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -169,9 +169,8 @@
  *      SW1     |       SW33
  *              | bit1 | bit2 | bit3 | bit4
  * -------------+------+------+------+-------
- * MMC0   OFF   |  OFF |  ON  |  ON  |  X
- * MMC1   ON    |  OFF |  ON  |  X   | ON
- * SDHI1  OFF   |  ON  |   X  |  OFF | ON
+ * MMC0   OFF   |  OFF |   X  |  ON  |  X       (Use MMCIF)
+ * SDHI1  OFF   |  ON  |   X  |  OFF |  X       (Use MFD_SH_MOBILE_SDHI)
  *
  */
 
diff --git a/arch/arm/mach-shmobile/clock-sh7372.c b/arch/arm/mach-shmobile/clock-sh7372.c
index 9aa8d68d1a9..e9731b5a73e 100644
--- a/arch/arm/mach-shmobile/clock-sh7372.c
+++ b/arch/arm/mach-shmobile/clock-sh7372.c
@@ -234,7 +234,9 @@ static int pllc2_set_rate(struct clk *clk, unsigned long rate)
 
         value = __raw_readl(PLLC2CR) & ~(0x3f << 24);
 
-        __raw_writel((value & ~0x80000000) | ((idx + 19) << 24), PLLC2CR);
+        __raw_writel(value | ((idx + 19) << 24), PLLC2CR);
+
+        clk->rate = clk->freq_table[idx].frequency;
 
         return 0;
 }
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index 720a71433be..ddd4a1b775f 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -118,8 +118,16 @@ static unsigned long pll_recalc(struct clk *clk)
 {
         unsigned long mult = 1;
 
-        if (__raw_readl(PLLECR) & (1 << clk->enable_bit))
+        if (__raw_readl(PLLECR) & (1 << clk->enable_bit)) {
                 mult = (((__raw_readl(clk->enable_reg) >> 24) & 0x3f) + 1);
+                /* handle CFG bit for PLL1 and PLL2 */
+                switch (clk->enable_bit) {
+                case 1:
+                case 2:
+                        if (__raw_readl(clk->enable_reg) & (1 << 20))
+                                mult *= 2;
+                }
+        }
 
         return clk->parent->rate * mult;
 }
@@ -212,7 +220,7 @@ enum { DIV4_I, DIV4_ZG, DIV4_M3, DIV4_B, DIV4_M1, DIV4_M2,
 static struct clk div4_clks[DIV4_NR] = {
         [DIV4_I] = DIV4(FRQCRA, 20, 0xfff, CLK_ENABLE_ON_INIT),
         [DIV4_ZG] = DIV4(FRQCRA, 16, 0xbff, CLK_ENABLE_ON_INIT),
-        [DIV4_M3] = DIV4(FRQCRA, 8, 0xfff, CLK_ENABLE_ON_INIT),
+        [DIV4_M3] = DIV4(FRQCRA, 12, 0xfff, CLK_ENABLE_ON_INIT),
         [DIV4_B] = DIV4(FRQCRA, 8, 0xfff, CLK_ENABLE_ON_INIT),
         [DIV4_M1] = DIV4(FRQCRA, 4, 0xfff, 0),
         [DIV4_M2] = DIV4(FRQCRA, 0, 0xfff, 0),
@@ -255,10 +263,10 @@ static struct clk div6_clks[DIV6_NR] = {
 };
 
 enum { MSTP001,
-        MSTP125, MSTP116,
+        MSTP125, MSTP118, MSTP116, MSTP100,
         MSTP219,
         MSTP207, MSTP206, MSTP204, MSTP203, MSTP202, MSTP201, MSTP200,
-        MSTP331, MSTP329, MSTP323, MSTP312,
+        MSTP331, MSTP329, MSTP325, MSTP323, MSTP312,
         MSTP411, MSTP410, MSTP403,
         MSTP_NR };
 
@@ -268,7 +276,9 @@ enum { MSTP001,
 static struct clk mstp_clks[MSTP_NR] = {
         [MSTP001] = MSTP(&div4_clks[DIV4_HP], SMSTPCR0, 1, 0), /* IIC2 */
         [MSTP125] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR1, 25, 0), /* TMU0 */
+        [MSTP118] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 18, 0), /* DSITX0 */
         [MSTP116] = MSTP(&div4_clks[DIV4_HP], SMSTPCR1, 16, 0), /* IIC0 */
+        [MSTP100] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 0, 0), /* LCDC0 */
         [MSTP219] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 19, 0), /* SCIFA7 */
         [MSTP207] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 7, 0), /* SCIFA5 */
         [MSTP206] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 6, 0), /* SCIFB */
@@ -279,6 +289,7 @@ static struct clk mstp_clks[MSTP_NR] = {
         [MSTP200] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 0, 0), /* SCIFA4 */
         [MSTP331] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR3, 31, 0), /* SCIFA6 */
         [MSTP329] = MSTP(&r_clk, SMSTPCR3, 29, 0), /* CMT10 */
+        [MSTP325] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR3, 25, 0), /* IrDA */
         [MSTP323] = MSTP(&div4_clks[DIV4_HP], SMSTPCR3, 23, 0), /* IIC1 */
         [MSTP312] = MSTP(&div4_clks[DIV4_HP], SMSTPCR3, 12, 0), /* MMCIF0 */
         [MSTP411] = MSTP(&div4_clks[DIV4_HP], SMSTPCR4, 11, 0), /* IIC3 */
@@ -288,16 +299,25 @@ static struct clk mstp_clks[MSTP_NR] = {
 
 #define CLKDEV_CON_ID(_id, _clk) { .con_id = _id, .clk = _clk }
 #define CLKDEV_DEV_ID(_id, _clk) { .dev_id = _id, .clk = _clk }
+#define CLKDEV_ICK_ID(_cid, _did, _clk) { .con_id = _cid, .dev_id = _did, .clk = _clk }
 
 static struct clk_lookup lookups[] = {
         /* main clocks */
         CLKDEV_CON_ID("r_clk", &r_clk),
 
+        /* DIV6 clocks */
+        CLKDEV_ICK_ID("dsit_clk", "sh-mipi-dsi.0", &div6_clks[DIV6_DSIT]),
+        CLKDEV_ICK_ID("dsit_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSIT]),
+        CLKDEV_ICK_ID("dsi0p_clk", "sh-mipi-dsi.0", &div6_clks[DIV6_DSI0P]),
+        CLKDEV_ICK_ID("dsi1p_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSI1P]),
+
         /* MSTP32 clocks */
         CLKDEV_DEV_ID("i2c-sh_mobile.2", &mstp_clks[MSTP001]), /* I2C2 */
+        CLKDEV_DEV_ID("sh_mobile_lcdc_fb.0", &mstp_clks[MSTP100]), /* LCDC0 */
         CLKDEV_DEV_ID("sh_tmu.0", &mstp_clks[MSTP125]), /* TMU00 */
         CLKDEV_DEV_ID("sh_tmu.1", &mstp_clks[MSTP125]), /* TMU01 */
         CLKDEV_DEV_ID("i2c-sh_mobile.0", &mstp_clks[MSTP116]), /* I2C0 */
+        CLKDEV_DEV_ID("sh-mipi-dsi.0", &mstp_clks[MSTP118]), /* DSITX */
         CLKDEV_DEV_ID("sh-sci.7", &mstp_clks[MSTP219]), /* SCIFA7 */
         CLKDEV_DEV_ID("sh-sci.5", &mstp_clks[MSTP207]), /* SCIFA5 */
         CLKDEV_DEV_ID("sh-sci.8", &mstp_clks[MSTP206]), /* SCIFB */
@@ -308,6 +328,7 @@ static struct clk_lookup lookups[] = {
         CLKDEV_DEV_ID("sh-sci.4", &mstp_clks[MSTP200]), /* SCIFA4 */
         CLKDEV_DEV_ID("sh-sci.6", &mstp_clks[MSTP331]), /* SCIFA6 */
         CLKDEV_DEV_ID("sh_cmt.10", &mstp_clks[MSTP329]), /* CMT10 */
+        CLKDEV_DEV_ID("sh_irda.0", &mstp_clks[MSTP325]), /* IrDA */
         CLKDEV_DEV_ID("i2c-sh_mobile.1", &mstp_clks[MSTP323]), /* I2C1 */
         CLKDEV_DEV_ID("sh_mmcif.0", &mstp_clks[MSTP312]), /* MMCIF0 */
         CLKDEV_DEV_ID("i2c-sh_mobile.3", &mstp_clks[MSTP411]), /* I2C3 */
diff --git a/arch/arm/mach-shmobile/intc-sh7372.c b/arch/arm/mach-shmobile/intc-sh7372.c
index f78a1ead71a..ca5f9d17b39 100644
--- a/arch/arm/mach-shmobile/intc-sh7372.c
+++ b/arch/arm/mach-shmobile/intc-sh7372.c
@@ -365,6 +365,7 @@ static struct intc_desc intca_desc __initdata = {
 
 enum {
         UNUSED_INTCS = 0,
+        ENABLED_INTCS,
 
         INTCS,
 
@@ -413,7 +414,7 @@ enum {
         CMT4,
         DSITX1_DSITX1_0,
         DSITX1_DSITX1_1,
-        /* MFIS2 */
+        MFIS2_INTCS, /* Priority always enabled using ENABLED_INTCS */
         CPORTS2R,
         /* CEC */
         JPU6E,
@@ -477,7 +478,7 @@ static struct intc_vect intcs_vectors[] = {
         INTCS_VECT(CMT4, 0x1980),
         INTCS_VECT(DSITX1_DSITX1_0, 0x19a0),
         INTCS_VECT(DSITX1_DSITX1_1, 0x19c0),
-        /* MFIS2 */
+        INTCS_VECT(MFIS2_INTCS, 0x1a00),
         INTCS_VECT(CPORTS2R, 0x1a20),
         /* CEC */
         INTCS_VECT(JPU6E, 0x1a80),
@@ -543,7 +544,7 @@ static struct intc_mask_reg intcs_mask_registers[] = {
           { 0, TMU1_TUNI2, TMU1_TUNI1, TMU1_TUNI0,
             CMT4, DSITX1_DSITX1_0, DSITX1_DSITX1_1, 0 } },
         { 0xffd5019c, 0xffd501dc, 8, /* IMR7SA3 / IMCR7SA3 */
-          { 0, CPORTS2R, 0, 0,
+          { MFIS2_INTCS, CPORTS2R, 0, 0,
             JPU6E, 0, 0, 0 } },
         { 0xffd20104, 0, 16, /* INTAMASK */
           { 0, 0, 0, 0, 0, 0, 0, 0,
@@ -571,7 +572,8 @@ static struct intc_prio_reg intcs_prio_registers[] = {
         { 0xffd50030, 0, 16, 4, /* IPRMS3 */ { TMU1, 0, 0, 0 } },
         { 0xffd50034, 0, 16, 4, /* IPRNS3 */ { CMT4, DSITX1_DSITX1_0,
                                                DSITX1_DSITX1_1, 0 } },
-        { 0xffd50038, 0, 16, 4, /* IPROS3 */ { 0, CPORTS2R, 0, 0 } },
+        { 0xffd50038, 0, 16, 4, /* IPROS3 */ { ENABLED_INTCS, CPORTS2R,
+                                               0, 0 } },
         { 0xffd5003c, 0, 16, 4, /* IPRPS3 */ { JPU6E, 0, 0, 0 } },
 };
 
@@ -590,6 +592,7 @@ static struct resource intcs_resources[] __initdata = {
 
 static struct intc_desc intcs_desc __initdata = {
         .name = "sh7372-intcs",
+        .force_enable = ENABLED_INTCS,
         .resource = intcs_resources,
         .num_resources = ARRAY_SIZE(intcs_resources),
         .hw = INTC_HW_DESC(intcs_vectors, intcs_groups, intcs_mask_registers,
diff --git a/arch/arm/mach-shmobile/intc-sh73a0.c b/arch/arm/mach-shmobile/intc-sh73a0.c
index 322d8d57cbc..5d0e1503ece 100644
--- a/arch/arm/mach-shmobile/intc-sh73a0.c
+++ b/arch/arm/mach-shmobile/intc-sh73a0.c
@@ -252,10 +252,11 @@ static irqreturn_t sh73a0_intcs_demux(int irq, void *dev_id)
 
 void __init sh73a0_init_irq(void)
 {
-        void __iomem *gic_base = __io(0xf0001000);
+        void __iomem *gic_dist_base = __io(0xf0001000);
+        void __iomem *gic_cpu_base = __io(0xf0000100);
         void __iomem *intevtsa = ioremap_nocache(0xffd20100, PAGE_SIZE);
 
-        gic_init(0, 29, gic_base, gic_base);
+        gic_init(0, 29, gic_dist_base, gic_cpu_base);
 
         register_intc_controller(&intcs_desc);
 
diff --git a/arch/arm/mach-tegra/gpio.c b/arch/arm/mach-tegra/gpio.c
index bd066206e11..ad804880151 100644
--- a/arch/arm/mach-tegra/gpio.c
+++ b/arch/arm/mach-tegra/gpio.c
@@ -207,9 +207,9 @@ static int tegra_gpio_irq_set_type(struct irq_data *d, unsigned int type)
         spin_unlock_irqrestore(&bank->lvl_lock[port], flags);
 
         if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
-                __set_irq_handler_unlocked(irq, handle_level_irq);
+                __set_irq_handler_unlocked(d->irq, handle_level_irq);
         else if (type & (IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
-                __set_irq_handler_unlocked(irq, handle_edge_irq);
+                __set_irq_handler_unlocked(d->irq, handle_edge_irq);
 
         return 0;
 }
diff --git a/arch/arm/mach-tegra/include/mach/clk.h b/arch/arm/mach-tegra/include/mach/clk.h
index d7723955dac..a217f68ba57 100644
--- a/arch/arm/mach-tegra/include/mach/clk.h
+++ b/arch/arm/mach-tegra/include/mach/clk.h
@@ -20,6 +20,8 @@
 #ifndef __MACH_CLK_H
 #define __MACH_CLK_H
 
+struct clk;
+
 void tegra_periph_reset_deassert(struct clk *c);
 void tegra_periph_reset_assert(struct clk *c);
 
diff --git a/arch/arm/mach-tegra/include/mach/clkdev.h b/arch/arm/mach-tegra/include/mach/clkdev.h
index 412f5c63e65..66cd3f4fc89 100644
--- a/arch/arm/mach-tegra/include/mach/clkdev.h
+++ b/arch/arm/mach-tegra/include/mach/clkdev.h
@@ -20,6 +20,8 @@
 #ifndef __MACH_CLKDEV_H
 #define __MACH_CLKDEV_H
 
+struct clk;
+
 static inline int __clk_get(struct clk *clk)
 {
         return 1;
diff --git a/arch/arm/mach-tegra/include/mach/kbc.h b/arch/arm/mach-tegra/include/mach/kbc.h
new file mode 100644
index 00000000000..66ad2760c62
--- /dev/null
+++ b/arch/arm/mach-tegra/include/mach/kbc.h
@@ -0,0 +1,61 @@
+/*
+ * Platform definitions for tegra-kbc keyboard input driver
+ *
+ * Copyright (c) 2010-2011, NVIDIA Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef ASMARM_ARCH_TEGRA_KBC_H
+#define ASMARM_ARCH_TEGRA_KBC_H
+
+#include <linux/types.h>
+#include <linux/input/matrix_keypad.h>
+
+#ifdef CONFIG_ARCH_TEGRA_2x_SOC
+#define KBC_MAX_GPIO    24
+#define KBC_MAX_KPENT   8
+#else
+#define KBC_MAX_GPIO    20
+#define KBC_MAX_KPENT   7
+#endif
+
+#define KBC_MAX_ROW     16
+#define KBC_MAX_COL     8
+#define KBC_MAX_KEY     (KBC_MAX_ROW * KBC_MAX_COL)
+
+struct tegra_kbc_pin_cfg {
+        bool is_row;
+        unsigned char num;
+};
+
+struct tegra_kbc_wake_key {
+        u8 row:4;
+        u8 col:4;
+};
+
+struct tegra_kbc_platform_data {
+        unsigned int debounce_cnt;
+        unsigned int repeat_cnt;
+
+        unsigned int wake_cnt; /* 0:wake on any key >1:wake on wake_cfg */
+        const struct tegra_kbc_wake_key *wake_cfg;
+
+        struct tegra_kbc_pin_cfg pin_cfg[KBC_MAX_GPIO];
+        const struct matrix_keymap_data *keymap_data;
+
+        bool wakeup;
+};
+#endif
diff --git a/arch/arm/mach-tegra/irq.c b/arch/arm/mach-tegra/irq.c
index de7dfad6f76..17c74d21077 100644
--- a/arch/arm/mach-tegra/irq.c
+++ b/arch/arm/mach-tegra/irq.c
@@ -46,24 +46,24 @@
 #define ICTLR_COP_IER_CLR       0x38
 #define ICTLR_COP_IEP_CLASS     0x3c
 
-static void (*gic_mask_irq)(struct irq_data *d);
-static void (*gic_unmask_irq)(struct irq_data *d);
+static void (*tegra_gic_mask_irq)(struct irq_data *d);
+static void (*tegra_gic_unmask_irq)(struct irq_data *d);
 
-#define irq_to_ictlr(irq) (((irq)-32) >> 5)
+#define irq_to_ictlr(irq) (((irq) - 32) >> 5)
 static void __iomem *tegra_ictlr_base = IO_ADDRESS(TEGRA_PRIMARY_ICTLR_BASE);
-#define ictlr_to_virt(ictlr) (tegra_ictlr_base + (ictlr)*0x100)
+#define ictlr_to_virt(ictlr) (tegra_ictlr_base + (ictlr) * 0x100)
 
 static void tegra_mask(struct irq_data *d)
 {
         void __iomem *addr = ictlr_to_virt(irq_to_ictlr(d->irq));
-        gic_mask_irq(d);
-        writel(1<<(d->irq&31), addr+ICTLR_CPU_IER_CLR);
+        tegra_gic_mask_irq(d);
+        writel(1 << (d->irq & 31), addr+ICTLR_CPU_IER_CLR);
 }
 
 static void tegra_unmask(struct irq_data *d)
 {
         void __iomem *addr = ictlr_to_virt(irq_to_ictlr(d->irq));
-        gic_unmask_irq(d);
+        tegra_gic_unmask_irq(d);
         writel(1<<(d->irq&31), addr+ICTLR_CPU_IER_SET);
 }
 
@@ -98,8 +98,8 @@ void __init tegra_init_irq(void)
                  IO_ADDRESS(TEGRA_ARM_PERIF_BASE + 0x100));
 
         gic = get_irq_chip(29);
-        gic_unmask_irq = gic->irq_unmask;
-        gic_mask_irq = gic->irq_mask;
+        tegra_gic_unmask_irq = gic->irq_unmask;
+        tegra_gic_mask_irq = gic->irq_mask;
         tegra_irq.irq_ack = gic->irq_ack;
 #ifdef CONFIG_SMP
         tegra_irq.irq_set_affinity = gic->irq_set_affinity;
diff --git a/arch/arm/mach-versatile/Kconfig b/arch/arm/mach-versatile/Kconfig
index 3f7b5e9d83c..9cdec5aa04a 100644
--- a/arch/arm/mach-versatile/Kconfig
+++ b/arch/arm/mach-versatile/Kconfig
@@ -2,17 +2,19 @@ menu "Versatile platform type"
         depends on ARCH_VERSATILE
 
 config ARCH_VERSATILE_PB
-        bool "Support Versatile/PB platform"
+        bool "Support Versatile Platform Baseboard for ARM926EJ-S"
         select CPU_ARM926T
         select MIGHT_HAVE_PCI
         default y
         help
-          Include support for the ARM(R) Versatile/PB platform.
+          Include support for the ARM(R) Versatile Platform Baseboard
+          for the ARM926EJ-S.
 
 config MACH_VERSATILE_AB
-        bool "Support Versatile/AB platform"
+        bool "Support Versatile Application Baseboard for ARM926EJ-S"
         select CPU_ARM926T
         help
-          Include support for the ARM(R) Versatile/AP platform.
+          Include support for the ARM(R) Versatile Application Baseboard
+          for the ARM926EJ-S.
 
 endmenu
diff --git a/arch/arm/mach-vexpress/platsmp.c b/arch/arm/mach-vexpress/platsmp.c
index b1687b6abe6..634bf1d3a31 100644
--- a/arch/arm/mach-vexpress/platsmp.c
+++ b/arch/arm/mach-vexpress/platsmp.c
@@ -39,7 +39,7 @@ volatile int __cpuinitdata pen_release = -1;
  * observers, irrespective of whether they're taking part in coherency
  * or not.  This is necessary for the hotplug code to work reliably.
  */
-static void write_pen_release(int val)
+static void __cpuinit write_pen_release(int val)
 {
         pen_release = val;
         smp_wmb();
diff --git a/arch/arm/mach-vexpress/v2m.c b/arch/arm/mach-vexpress/v2m.c
index a9ed3428a2f..1edae65a0e7 100644
--- a/arch/arm/mach-vexpress/v2m.c
+++ b/arch/arm/mach-vexpress/v2m.c
@@ -19,6 +19,7 @@
 #include <asm/mach/time.h>
 #include <asm/hardware/arm_timer.h>
 #include <asm/hardware/timer-sp.h>
+#include <asm/hardware/sp810.h>
 
 #include <mach/motherboard.h>
 
@@ -50,8 +51,16 @@ void __init v2m_map_io(struct map_desc *tile, size_t num)
 
 static void __init v2m_timer_init(void)
 {
+        u32 scctrl;
+
         versatile_sched_clock_init(MMIO_P2V(V2M_SYS_24MHZ), 24000000);
 
+        /* Select 1MHz TIMCLK as the reference clock for SP804 timers */
+        scctrl = readl(MMIO_P2V(V2M_SYSCTL + SCCTRL));
+        scctrl |= SCCTRL_TIMEREN0SEL_TIMCLK;
+        scctrl |= SCCTRL_TIMEREN1SEL_TIMCLK;
+        writel(scctrl, MMIO_P2V(V2M_SYSCTL + SCCTRL));
+
         writel(0, MMIO_P2V(V2M_TIMER0) + TIMER_CTRL);
         writel(0, MMIO_P2V(V2M_TIMER1) + TIMER_CTRL);
 
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 5164069ced4..cddd684364d 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -297,6 +297,12 @@ void __init arm_memblock_init(struct meminfo *mi, struct machine_desc *mdesc)
         memblock_reserve(__pa(_stext), _end - _stext);
 #endif
 #ifdef CONFIG_BLK_DEV_INITRD
+        if (phys_initrd_size &&
+            memblock_is_region_reserved(phys_initrd_start, phys_initrd_size)) {
+                pr_err("INITRD: 0x%08lx+0x%08lx overlaps in-use memory region - disabling initrd\n",
+                       phys_initrd_start, phys_initrd_size);
+                phys_initrd_start = phys_initrd_size = 0;
+        }
         if (phys_initrd_size) {
                 memblock_reserve(phys_initrd_start, phys_initrd_size);
 
diff --git a/arch/arm/plat-mxc/include/mach/uncompress.h b/arch/arm/plat-mxc/include/mach/uncompress.h
index 2315541ac29..e634d6c2e7b 100644
--- a/arch/arm/plat-mxc/include/mach/uncompress.h
+++ b/arch/arm/plat-mxc/include/mach/uncompress.h
@@ -96,6 +96,7 @@ static __inline__ void __arch_decomp_setup(unsigned long arch_id)
         case MACH_TYPE_MX35_3DS:
         case MACH_TYPE_PCM043:
         case MACH_TYPE_LILLY1131:
+        case MACH_TYPE_VPR200:
                 uart_base = MX3X_UART1_BASE_ADDR;
                 break;
         case MACH_TYPE_MAGX_ZN5:
@@ -103,6 +104,7 @@ static __inline__ void __arch_decomp_setup(unsigned long arch_id)
                 break;
         case MACH_TYPE_MX51_BABBAGE:
         case MACH_TYPE_EUKREA_CPUIMX51SD:
+        case MACH_TYPE_MX51_3DS:
                 uart_base = MX51_UART1_BASE_ADDR;
                 break;
         case MACH_TYPE_MX50_RDP:
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index 18fe3cb195d..b6333ae3f92 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -144,12 +144,9 @@ config OMAP_IOMMU_DEBUG
 config OMAP_IOMMU_IVA2
         bool
 
-choice
-        prompt "System timer"
-        default OMAP_32K_TIMER if !ARCH_OMAP15XX
-
 config OMAP_MPU_TIMER
         bool "Use mpu timer"
+        depends on ARCH_OMAP1
         help
           Select this option if you want to use the OMAP mpu timer. This
           timer provides more intra-tick resolution than the 32KHz timer,
@@ -158,6 +155,7 @@ config OMAP_MPU_TIMER
 config OMAP_32K_TIMER
         bool "Use 32KHz timer"
         depends on ARCH_OMAP16XX || ARCH_OMAP2PLUS
+        default y if (ARCH_OMAP16XX || ARCH_OMAP2PLUS)
         help
           Select this option if you want to enable the OMAP 32KHz timer.
           This timer saves power compared to the OMAP_MPU_TIMER, and has
@@ -165,8 +163,6 @@ config OMAP_32K_TIMER
           intra-tick resolution than OMAP_MPU_TIMER. The 32KHz timer is
           currently only available for OMAP16XX, 24XX, 34XX and OMAP4.
 
-endchoice
-
 config OMAP3_L2_AUX_SECURE_SAVE_RESTORE
         bool "OMAP3 HS/EMU save and restore for L2 AUX control register"
         depends on ARCH_OMAP3 && PM
diff --git a/arch/arm/plat-omap/counter_32k.c b/arch/arm/plat-omap/counter_32k.c
index ea4644021fb..862dda95d61 100644
--- a/arch/arm/plat-omap/counter_32k.c
+++ b/arch/arm/plat-omap/counter_32k.c
@@ -36,8 +36,6 @@
 
 #define OMAP16XX_TIMER_32K_SYNCHRONIZED         0xfffbc410
 
-#if !(defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP15XX))
-
 #include <linux/clocksource.h>
 
 /*
@@ -122,12 +120,24 @@ static DEFINE_CLOCK_DATA(cd);
 #define SC_MULT         4000000000u
 #define SC_SHIFT        17
 
-unsigned long long notrace sched_clock(void)
+static inline unsigned long long notrace _omap_32k_sched_clock(void)
 {
         u32 cyc = clocksource_32k.read(&clocksource_32k);
         return cyc_to_fixed_sched_clock(&cd, cyc, (u32)~0, SC_MULT, SC_SHIFT);
 }
 
+#ifndef CONFIG_OMAP_MPU_TIMER
+unsigned long long notrace sched_clock(void)
+{
+        return _omap_32k_sched_clock();
+}
+#else
+unsigned long long notrace omap_32k_sched_clock(void)
+{
+        return _omap_32k_sched_clock();
+}
+#endif
+
 static void notrace omap_update_sched_clock(void)
 {
         u32 cyc = clocksource_32k.read(&clocksource_32k);
@@ -160,7 +170,7 @@ void read_persistent_clock(struct timespec *ts)
         *ts = *tsp;
 }
 
-static int __init omap_init_clocksource_32k(void)
+int __init omap_init_clocksource_32k(void)
 {
         static char err[] __initdata = KERN_ERR
                         "%s: can't register clocksource!\n";
@@ -195,7 +205,3 @@ static int __init omap_init_clocksource_32k(void)
         }
         return 0;
 }
-arch_initcall(omap_init_clocksource_32k);
-
-#endif  /* !(defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP15XX)) */
-
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index c4b2b478b1a..85363084cc1 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -53,7 +53,7 @@ enum { DMA_CHAIN_STARTED, DMA_CHAIN_NOTSTARTED };
 #endif
 
 #define OMAP_DMA_ACTIVE                 0x01
-#define OMAP2_DMA_CSR_CLEAR_MASK        0xffe
+#define OMAP2_DMA_CSR_CLEAR_MASK        0xffffffff
 
 #define OMAP_FUNC_MUX_ARM_BASE          (0xfffe1000 + 0xec)
 
@@ -1873,7 +1873,7 @@ static int omap2_dma_handle_ch(int ch)
                 printk(KERN_INFO "DMA misaligned error with device %d\n",
                        dma_chan[ch].dev_id);
 
-        p->dma_write(OMAP2_DMA_CSR_CLEAR_MASK, CSR, ch);
+        p->dma_write(status, CSR, ch);
         p->dma_write(1 << ch, IRQSTATUS_L0, ch);
         /* read back the register to flush the write */
         p->dma_read(IRQSTATUS_L0, ch);
@@ -1893,10 +1893,9 @@ static int omap2_dma_handle_ch(int ch)
                         OMAP_DMA_CHAIN_INCQHEAD(chain_id);
 
                 status = p->dma_read(CSR, ch);
+                p->dma_write(status, CSR, ch);
         }
 
-        p->dma_write(status, CSR, ch);
-
         if (likely(dma_chan[ch].callback != NULL))
                 dma_chan[ch].callback(ch, status, dma_chan[ch].data);
 
diff --git a/arch/arm/plat-omap/include/plat/common.h b/arch/arm/plat-omap/include/plat/common.h
index 6b8088ec74a..29b2afb4288 100644
--- a/arch/arm/plat-omap/include/plat/common.h
+++ b/arch/arm/plat-omap/include/plat/common.h
@@ -35,6 +35,9 @@ struct sys_timer;
 
 extern void omap_map_common_io(void);
 extern struct sys_timer omap_timer;
+extern bool omap_32k_timer_init(void);
+extern int __init omap_init_clocksource_32k(void);
+extern unsigned long long notrace omap_32k_sched_clock(void);
 
 extern void omap_reserve(void);
 
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 2fea897ebeb..9d6feaabbe7 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Sun Dec 12 23:24:27 2010
+# Last update: Mon Feb 7 08:59:27 2011
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -2240,7 +2240,7 @@ arm_ultimator2		MACH_ARM_ULTIMATOR2	ARM_ULTIMATOR2		2250
 vs_v210                 MACH_VS_V210            VS_V210                 2252
 vs_v212                 MACH_VS_V212            VS_V212                 2253
 hmt                     MACH_HMT                HMT                     2254
-suen3                   MACH_SUEN3              SUEN3                   2255
+km_kirkwood             MACH_KM_KIRKWOOD        KM_KIRKWOOD             2255
 vesper                  MACH_VESPER             VESPER                  2256
 str9                    MACH_STR9               STR9                    2257
 omap3_wl_ff             MACH_OMAP3_WL_FF        OMAP3_WL_FF             2258
@@ -2987,7 +2987,7 @@ pxwnas_500_1000		MACH_PXWNAS_500_1000	PXWNAS_500_1000		3001
 ea20                    MACH_EA20               EA20                    3002
 awm2                    MACH_AWM2               AWM2                    3003
 ti8148evm               MACH_TI8148EVM          TI8148EVM               3004
-tegra_seaboard          MACH_TEGRA_SEABOARD     TEGRA_SEABOARD          3005
+seaboard                MACH_SEABOARD           SEABOARD                3005
 linkstation_chlv2       MACH_LINKSTATION_CHLV2  LINKSTATION_CHLV2       3006
 tera_pro2_rack          MACH_TERA_PRO2_RACK     TERA_PRO2_RACK          3007
 rubys                   MACH_RUBYS              RUBYS                   3008
@@ -3190,7 +3190,7 @@ synergy			MACH_SYNERGY		SYNERGY			3205
 ics_if_voip             MACH_ICS_IF_VOIP        ICS_IF_VOIP             3206
 wlf_cragg_6410          MACH_WLF_CRAGG_6410     WLF_CRAGG_6410          3207
 punica                  MACH_PUNICA             PUNICA                  3208
-sbc_nt250               MACH_SBC_NT250          SBC_NT250               3209
+trimslice               MACH_TRIMSLICE          TRIMSLICE               3209
 mx27_wmultra            MACH_MX27_WMULTRA       MX27_WMULTRA            3210
 mackerel                MACH_MACKEREL           MACKEREL                3211
 fa9x27                  MACH_FA9X27             FA9X27                  3213
@@ -3219,3 +3219,100 @@ pivicc			MACH_PIVICC		PIVICC			3235
 pcm048                  MACH_PCM048             PCM048                  3236
 dds                     MACH_DDS                DDS                     3237
 chalten_xa1             MACH_CHALTEN_XA1        CHALTEN_XA1             3238
+ts48xx                  MACH_TS48XX             TS48XX                  3239
+tonga2_tfttimer         MACH_TONGA2_TFTTIMER    TONGA2_TFTTIMER         3240
+whistler                MACH_WHISTLER           WHISTLER                3241
+asl_phoenix             MACH_ASL_PHOENIX        ASL_PHOENIX             3242
+at91sam9263otlite       MACH_AT91SAM9263OTLITE  AT91SAM9263OTLITE       3243
+ddplug                  MACH_DDPLUG             DDPLUG                  3244
+d2plug                  MACH_D2PLUG             D2PLUG                  3245
+kzm9d                   MACH_KZM9D              KZM9D                   3246
+verdi_lte               MACH_VERDI_LTE          VERDI_LTE               3247
+nanozoom                MACH_NANOZOOM           NANOZOOM                3248
+dm3730_som_lv           MACH_DM3730_SOM_LV      DM3730_SOM_LV           3249
+dm3730_torpedo          MACH_DM3730_TORPEDO     DM3730_TORPEDO          3250
+anchovy                 MACH_ANCHOVY            ANCHOVY                 3251
+re2rev20                MACH_RE2REV20           RE2REV20                3253
+re2rev21                MACH_RE2REV21           RE2REV21                3254
+cns21xx                 MACH_CNS21XX            CNS21XX                 3255
+rider                   MACH_RIDER              RIDER                   3257
+nsk330                  MACH_NSK330             NSK330                  3258
+cns2133evb              MACH_CNS2133EVB         CNS2133EVB              3259
+z3_816x_mod             MACH_Z3_816X_MOD        Z3_816X_MOD             3260
+z3_814x_mod             MACH_Z3_814X_MOD        Z3_814X_MOD             3261
+beect                   MACH_BEECT              BEECT                   3262
+dma_thunderbug          MACH_DMA_THUNDERBUG     DMA_THUNDERBUG          3263
+omn_at91sam9g20         MACH_OMN_AT91SAM9G20    OMN_AT91SAM9G20         3264
+mx25_e2s_uc             MACH_MX25_E2S_UC        MX25_E2S_UC             3265
+mione                   MACH_MIONE              MIONE                   3266
+top9000_tcu             MACH_TOP9000_TCU        TOP9000_TCU             3267
+top9000_bsl             MACH_TOP9000_BSL        TOP9000_BSL             3268
+kingdom                 MACH_KINGDOM            KINGDOM                 3269
+armadillo460            MACH_ARMADILLO460       ARMADILLO460            3270
+lq2                     MACH_LQ2                LQ2                     3271
+sweda_tms2              MACH_SWEDA_TMS2         SWEDA_TMS2              3272
+mx53_loco               MACH_MX53_LOCO          MX53_LOCO               3273
+acer_a8                 MACH_ACER_A8            ACER_A8                 3275
+acer_gauguin            MACH_ACER_GAUGUIN       ACER_GAUGUIN            3276
+guppy                   MACH_GUPPY              GUPPY                   3277
+mx61_ard                MACH_MX61_ARD           MX61_ARD                3278
+tx53                    MACH_TX53               TX53                    3279
+omapl138_case_a3        MACH_OMAPL138_CASE_A3   OMAPL138_CASE_A3        3280
+uemd                    MACH_UEMD               UEMD                    3281
+ccwmx51mut              MACH_CCWMX51MUT         CCWMX51MUT              3282
+rockhopper              MACH_ROCKHOPPER         ROCKHOPPER              3283
+nookcolor               MACH_NOOKCOLOR          NOOKCOLOR               3284
+hkdkc100                MACH_HKDKC100           HKDKC100                3285
+ts42xx                  MACH_TS42XX             TS42XX                  3286
+aebl                    MACH_AEBL               AEBL                    3287
+wario                   MACH_WARIO              WARIO                   3288
+gfs_spm                 MACH_GFS_SPM            GFS_SPM                 3289
+cm_t3730                MACH_CM_T3730           CM_T3730                3290
+isc3                    MACH_ISC3               ISC3                    3291
+rascal                  MACH_RASCAL             RASCAL                  3292
+hrefv60                 MACH_HREFV60            HREFV60                 3293
+tpt_2_0                 MACH_TPT_2_0            TPT_2_0                 3294
+pyramid_td              MACH_PYRAMID_TD         PYRAMID_TD              3295
+splendor                MACH_SPLENDOR           SPLENDOR                3296
+guf_planet              MACH_GUF_PLANET         GUF_PLANET              3297
+msm8x60_qt              MACH_MSM8X60_QT         MSM8X60_QT              3298
+htc_hd_mini             MACH_HTC_HD_MINI        HTC_HD_MINI             3299
+athene                  MACH_ATHENE             ATHENE                  3300
+deep_r_ek_1             MACH_DEEP_R_EK_1        DEEP_R_EK_1             3301
+vivow_ct                MACH_VIVOW_CT           VIVOW_CT                3302
+nery_1000               MACH_NERY_1000          NERY_1000               3303
+rfl109145_ssrv          MACH_RFL109145_SSRV     RFL109145_SSRV          3304
+nmh                     MACH_NMH                NMH                     3305
+wn802t                  MACH_WN802T             WN802T                  3306
+dragonet                MACH_DRAGONET           DRAGONET                3307
+geneva_b                MACH_GENEVA_B           GENEVA_B                3308
+at91sam9263desk16l      MACH_AT91SAM9263DESK16L AT91SAM9263DESK16L      3309
+bcmhana_sv              MACH_BCMHANA_SV         BCMHANA_SV              3310
+bcmhana_tablet          MACH_BCMHANA_TABLET     BCMHANA_TABLET          3311
+koi                     MACH_KOI                KOI                     3312
+ts4800                  MACH_TS4800             TS4800                  3313
+tqma9263                MACH_TQMA9263           TQMA9263                3314
+holiday                 MACH_HOLIDAY            HOLIDAY                 3315
+dma_6410                MACH_DMA6410            DMA6410                 3316
+pcats_overlay           MACH_PCATS_OVERLAY      PCATS_OVERLAY           3317
+hwgw6410                MACH_HWGW6410           HWGW6410                3318
+shenzhou                MACH_SHENZHOU           SHENZHOU                3319
+cwme9210                MACH_CWME9210           CWME9210                3320
+cwme9210js              MACH_CWME9210JS         CWME9210JS              3321
+pgs_v1                  MACH_PGS_SITARA         PGS_SITARA              3322
+colibri_tegra2          MACH_COLIBRI_TEGRA2     COLIBRI_TEGRA2          3323
+w21                     MACH_W21                W21                     3324
+polysat1                MACH_POLYSAT1           POLYSAT1                3325
+dataway                 MACH_DATAWAY            DATAWAY                 3326
+cobral138               MACH_COBRAL138          COBRAL138               3327
+roverpcs8               MACH_ROVERPCS8          ROVERPCS8               3328
+marvelc                 MACH_MARVELC            MARVELC                 3329
+navefihid               MACH_NAVEFIHID          NAVEFIHID               3330
+dm365_cv100             MACH_DM365_CV100        DM365_CV100             3331
+able                    MACH_ABLE               ABLE                    3332
+legacy                  MACH_LEGACY             LEGACY                  3333
+icong                   MACH_ICONG              ICONG                   3334
+rover_g8                MACH_ROVER_G8           ROVER_G8                3335
+t5388p                  MACH_T5388P             T5388P                  3336
+dingo                   MACH_DINGO              DINGO                   3337
+goflexhome              MACH_GOFLEXHOME         GOFLEXHOME              3338
diff --git a/arch/avr32/Kconfig b/arch/avr32/Kconfig
index 313b13073c5..cd2062fe0f6 100644
--- a/arch/avr32/Kconfig
+++ b/arch/avr32/Kconfig
@@ -1,8 +1,8 @@
 config AVR32
         def_bool y
-        # With EMBEDDED=n, we get lots of stuff automatically selected
+        # With EXPERT=n, we get lots of stuff automatically selected
         # that we usually don't need on AVR32.
-        select EMBEDDED
+        select EXPERT
         select HAVE_CLK
         select HAVE_OPROFILE
         select HAVE_KPROBES
diff --git a/arch/avr32/include/asm/pgalloc.h b/arch/avr32/include/asm/pgalloc.h
index 92ecd8446ef..bc7e8ae479e 100644
--- a/arch/avr32/include/asm/pgalloc.h
+++ b/arch/avr32/include/asm/pgalloc.h
@@ -8,6 +8,7 @@
 #ifndef __ASM_AVR32_PGALLOC_H
 #define __ASM_AVR32_PGALLOC_H
 
+#include <linux/mm.h>
 #include <linux/quicklist.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index 0a221d48152..c09577ddc3c 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -30,6 +30,9 @@ config BLACKFIN
         select HAVE_KERNEL_LZO if RAMKERNEL
         select HAVE_OPROFILE
         select ARCH_WANT_OPTIONAL_GPIOLIB
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_IRQ_PROBE
+        select IRQ_PER_CPU if SMP
 
 config GENERIC_CSUM
         def_bool y
@@ -44,15 +47,6 @@ config ZONE_DMA
 config GENERIC_FIND_NEXT_BIT
         def_bool y
 
-config GENERIC_HARDIRQS
-        def_bool y
-
-config GENERIC_IRQ_PROBE
-        def_bool y
-
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
 config GENERIC_GPIO
         def_bool y
 
@@ -254,11 +248,6 @@ config HOTPLUG_CPU
         depends on SMP && HOTPLUG
         default y
 
-config IRQ_PER_CPU
-        bool
-        depends on SMP
-        default y
-
 config HAVE_LEGACY_PER_CPU_AREA
         def_bool y
         depends on SMP
diff --git a/arch/blackfin/configs/BF518F-EZBRD_defconfig b/arch/blackfin/configs/BF518F-EZBRD_defconfig
index c0b988ee30d..db8d38a12a9 100644
--- a/arch/blackfin/configs/BF518F-EZBRD_defconfig
+++ b/arch/blackfin/configs/BF518F-EZBRD_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF526-EZBRD_defconfig b/arch/blackfin/configs/BF526-EZBRD_defconfig
index 864af5b6887..3e50d7857c2 100644
--- a/arch/blackfin/configs/BF526-EZBRD_defconfig
+++ b/arch/blackfin/configs/BF526-EZBRD_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF527-AD7160-EVAL_defconfig b/arch/blackfin/configs/BF527-AD7160-EVAL_defconfig
index 7b6a3370dbe..362f59dd522 100644
--- a/arch/blackfin/configs/BF527-AD7160-EVAL_defconfig
+++ b/arch/blackfin/configs/BF527-AD7160-EVAL_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_ELF_CORE is not set
 # CONFIG_AIO is not set
 CONFIG_SLAB=y
diff --git a/arch/blackfin/configs/BF527-EZKIT-V2_defconfig b/arch/blackfin/configs/BF527-EZKIT-V2_defconfig
index 4faa6b46a35..023ff0df269 100644
--- a/arch/blackfin/configs/BF527-EZKIT-V2_defconfig
+++ b/arch/blackfin/configs/BF527-EZKIT-V2_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF527-EZKIT_defconfig b/arch/blackfin/configs/BF527-EZKIT_defconfig
index 9d893eb6824..4e5a121b3c5 100644
--- a/arch/blackfin/configs/BF527-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF527-EZKIT_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF527-TLL6527M_defconfig b/arch/blackfin/configs/BF527-TLL6527M_defconfig
index 97a2767c80f..cd0636bb24a 100644
--- a/arch/blackfin/configs/BF527-TLL6527M_defconfig
+++ b/arch/blackfin/configs/BF527-TLL6527M_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF533-EZKIT_defconfig b/arch/blackfin/configs/BF533-EZKIT_defconfig
index f84774360c5..9f8fc84e4ac 100644
--- a/arch/blackfin/configs/BF533-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF533-EZKIT_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF533-STAMP_defconfig b/arch/blackfin/configs/BF533-STAMP_defconfig
index 0e7262c04cc..ccc432b722a 100644
--- a/arch/blackfin/configs/BF533-STAMP_defconfig
+++ b/arch/blackfin/configs/BF533-STAMP_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF537-STAMP_defconfig b/arch/blackfin/configs/BF537-STAMP_defconfig
index 4d14a002e7b..566695472a8 100644
--- a/arch/blackfin/configs/BF537-STAMP_defconfig
+++ b/arch/blackfin/configs/BF537-STAMP_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF538-EZKIT_defconfig b/arch/blackfin/configs/BF538-EZKIT_defconfig
index fbee9d776f5..ac22124ccb6 100644
--- a/arch/blackfin/configs/BF538-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF538-EZKIT_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF548-EZKIT_defconfig b/arch/blackfin/configs/BF548-EZKIT_defconfig
index 05dd11db2f7..944404b6ff0 100644
--- a/arch/blackfin/configs/BF548-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF548-EZKIT_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF561-ACVILON_defconfig b/arch/blackfin/configs/BF561-ACVILON_defconfig
index bcb14d1c566..b7c8451f26a 100644
--- a/arch/blackfin/configs/BF561-ACVILON_defconfig
+++ b/arch/blackfin/configs/BF561-ACVILON_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF561-EZKIT-SMP_defconfig b/arch/blackfin/configs/BF561-EZKIT-SMP_defconfig
index 4cf451024fd..7e67ba31e99 100644
--- a/arch/blackfin/configs/BF561-EZKIT-SMP_defconfig
+++ b/arch/blackfin/configs/BF561-EZKIT-SMP_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BF561-EZKIT_defconfig b/arch/blackfin/configs/BF561-EZKIT_defconfig
index 843aaa54a9e..141e5933e1a 100644
--- a/arch/blackfin/configs/BF561-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF561-EZKIT_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/BlackStamp_defconfig b/arch/blackfin/configs/BlackStamp_defconfig
index dae7adf3b2a..97ebe09a737 100644
--- a/arch/blackfin/configs/BlackStamp_defconfig
+++ b/arch/blackfin/configs/BlackStamp_defconfig
@@ -6,7 +6,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/CM-BF527_defconfig b/arch/blackfin/configs/CM-BF527_defconfig
index f3414244bfe..c2457543e58 100644
--- a/arch/blackfin/configs/CM-BF527_defconfig
+++ b/arch/blackfin/configs/CM-BF527_defconfig
@@ -8,7 +8,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 CONFIG_RD_LZMA=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/CM-BF533_defconfig b/arch/blackfin/configs/CM-BF533_defconfig
index 8c7e08f173d..baf1c1573e5 100644
--- a/arch/blackfin/configs/CM-BF533_defconfig
+++ b/arch/blackfin/configs/CM-BF533_defconfig
@@ -7,7 +7,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 CONFIG_RD_LZMA=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/blackfin/configs/CM-BF537E_defconfig b/arch/blackfin/configs/CM-BF537E_defconfig
index bd3cb766d07..707cbf8a259 100644
--- a/arch/blackfin/configs/CM-BF537E_defconfig
+++ b/arch/blackfin/configs/CM-BF537E_defconfig
@@ -8,7 +8,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 CONFIG_RD_LZMA=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/blackfin/configs/CM-BF537U_defconfig b/arch/blackfin/configs/CM-BF537U_defconfig
index 82224f37c04..4596935eada 100644
--- a/arch/blackfin/configs/CM-BF537U_defconfig
+++ b/arch/blackfin/configs/CM-BF537U_defconfig
@@ -8,7 +8,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 CONFIG_RD_LZMA=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/blackfin/configs/CM-BF548_defconfig b/arch/blackfin/configs/CM-BF548_defconfig
index 433598c6e77..df267588efe 100644
--- a/arch/blackfin/configs/CM-BF548_defconfig
+++ b/arch/blackfin/configs/CM-BF548_defconfig
@@ -8,7 +8,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 CONFIG_RD_LZMA=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/blackfin/configs/CM-BF561_defconfig b/arch/blackfin/configs/CM-BF561_defconfig
index ded7d845cb3..6c7b21585a4 100644
--- a/arch/blackfin/configs/CM-BF561_defconfig
+++ b/arch/blackfin/configs/CM-BF561_defconfig
@@ -8,7 +8,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 CONFIG_RD_LZMA=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/blackfin/configs/DNP5370_defconfig b/arch/blackfin/configs/DNP5370_defconfig
index 0ebc7d9aa42..f50313657f3 100644
--- a/arch/blackfin/configs/DNP5370_defconfig
+++ b/arch/blackfin/configs/DNP5370_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLOB=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_CFQ is not set
diff --git a/arch/blackfin/configs/H8606_defconfig b/arch/blackfin/configs/H8606_defconfig
index 700fb701c12..7450127b645 100644
--- a/arch/blackfin/configs/H8606_defconfig
+++ b/arch/blackfin/configs/H8606_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/IP0X_defconfig b/arch/blackfin/configs/IP0X_defconfig
index b40156d217e..5e797cf7204 100644
--- a/arch/blackfin/configs/IP0X_defconfig
+++ b/arch/blackfin/configs/IP0X_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/blackfin/configs/PNAV-10_defconfig b/arch/blackfin/configs/PNAV-10_defconfig
index be866d95ed7..a566a2fe6b9 100644
--- a/arch/blackfin/configs/PNAV-10_defconfig
+++ b/arch/blackfin/configs/PNAV-10_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/SRV1_defconfig b/arch/blackfin/configs/SRV1_defconfig
index b64bdf759b8..853809510ee 100644
--- a/arch/blackfin/configs/SRV1_defconfig
+++ b/arch/blackfin/configs/SRV1_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_ELF_CORE is not set
diff --git a/arch/blackfin/configs/TCM-BF518_defconfig b/arch/blackfin/configs/TCM-BF518_defconfig
index 1bccd9a5098..d496ae9a39b 100644
--- a/arch/blackfin/configs/TCM-BF518_defconfig
+++ b/arch/blackfin/configs/TCM-BF518_defconfig
@@ -7,7 +7,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 CONFIG_RD_LZMA=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/blackfin/configs/TCM-BF537_defconfig b/arch/blackfin/configs/TCM-BF537_defconfig
index 00ce899e9e5..65f642167a5 100644
--- a/arch/blackfin/configs/TCM-BF537_defconfig
+++ b/arch/blackfin/configs/TCM-BF537_defconfig
@@ -8,7 +8,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 CONFIG_RD_LZMA=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig
index 613e62831c5..0a7a4c11d8b 100644
--- a/arch/cris/Kconfig
+++ b/arch/cris/Kconfig
@@ -54,6 +54,8 @@ config CRIS
         bool
         default y
         select HAVE_IDE
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_HARDIRQS_NO_DEPRECATED
 
 config HZ
         int
@@ -67,10 +69,6 @@ menu "General setup"
 
 source "fs/Kconfig.binfmt"
 
-config GENERIC_HARDIRQS
-        bool
-        default y
-
 config ETRAX_CMDLINE
         string "Kernel command line"
         default "root=/dev/mtdblock3"
diff --git a/arch/cris/arch-v10/kernel/irq.c b/arch/cris/arch-v10/kernel/irq.c
index a0c0df8be9c..7328a7cf744 100644
--- a/arch/cris/arch-v10/kernel/irq.c
+++ b/arch/cris/arch-v10/kernel/irq.c
@@ -104,43 +104,21 @@ static void (*interrupt[NR_IRQS])(void) = {
         IRQ31_interrupt
 };
 
-static void enable_crisv10_irq(unsigned int irq);
-
-static unsigned int startup_crisv10_irq(unsigned int irq)
-{
-        enable_crisv10_irq(irq);
-        return 0;
-}
-
-#define shutdown_crisv10_irq    disable_crisv10_irq
-
-static void enable_crisv10_irq(unsigned int irq)
-{
-        crisv10_unmask_irq(irq);
-}
-
-static void disable_crisv10_irq(unsigned int irq)
-{
-        crisv10_mask_irq(irq);
-}
-
-static void ack_crisv10_irq(unsigned int irq)
+static void enable_crisv10_irq(struct irq_data *data)
 {
+        crisv10_unmask_irq(data->irq);
 }
 
-static void end_crisv10_irq(unsigned int irq)
+static void disable_crisv10_irq(struct irq_data *data)
 {
+        crisv10_mask_irq(data->irq);
 }
 
 static struct irq_chip crisv10_irq_type = {
-        .name =        "CRISv10",
-        .startup =     startup_crisv10_irq,
-        .shutdown =    shutdown_crisv10_irq,
-        .enable =      enable_crisv10_irq,
-        .disable =     disable_crisv10_irq,
-        .ack =         ack_crisv10_irq,
-        .end =         end_crisv10_irq,
-        .set_affinity = NULL
+        .name           = "CRISv10",
+        .irq_shutdown   = disable_crisv10_irq,
+        .irq_enable     = enable_crisv10_irq,
+        .irq_disable    = disable_crisv10_irq,
 };
 
 void weird_irq(void);
@@ -221,7 +199,8 @@ init_IRQ(void)
 
         /* Initialize IRQ handler descriptors. */
         for(i = 2; i < NR_IRQS; i++) {
-                irq_desc[i].chip = &crisv10_irq_type;
+                set_irq_desc_and_handler(i, &crisv10_irq_type,
+                                         handle_simple_irq);
                 set_int_vector(i, interrupt[i]);
         }
 
diff --git a/arch/cris/arch-v32/kernel/irq.c b/arch/cris/arch-v32/kernel/irq.c
index 2ed48ae3d31..0ad9db5126c 100644
--- a/arch/cris/arch-v32/kernel/irq.c
+++ b/arch/cris/arch-v32/kernel/irq.c
@@ -291,54 +291,33 @@ void crisv32_unmask_irq(int irq)
 }
 
 
-static unsigned int startup_crisv32_irq(unsigned int irq)
+static void enable_crisv32_irq(struct irq_data *data)
 {
-        crisv32_unmask_irq(irq);
-        return 0;
-}
-
-static void shutdown_crisv32_irq(unsigned int irq)
-{
-        crisv32_mask_irq(irq);
+        crisv32_unmask_irq(data->irq);
 }
 
-static void enable_crisv32_irq(unsigned int irq)
+static void disable_crisv32_irq(struct irq_data *data)
 {
-        crisv32_unmask_irq(irq);
+        crisv32_mask_irq(data->irq);
 }
 
-static void disable_crisv32_irq(unsigned int irq)
-{
-        crisv32_mask_irq(irq);
-}
-
-static void ack_crisv32_irq(unsigned int irq)
-{
-}
-
-static void end_crisv32_irq(unsigned int irq)
-{
-}
-
-int set_affinity_crisv32_irq(unsigned int irq, const struct cpumask *dest)
+static int set_affinity_crisv32_irq(struct irq_data *data,
+                                    const struct cpumask *dest, bool force)
 {
         unsigned long flags;
+
         spin_lock_irqsave(&irq_lock, flags);
-        irq_allocations[irq - FIRST_IRQ].mask = *dest;
+        irq_allocations[data->irq - FIRST_IRQ].mask = *dest;
         spin_unlock_irqrestore(&irq_lock, flags);
-
         return 0;
 }
 
 static struct irq_chip crisv32_irq_type = {
-        .name =        "CRISv32",
-        .startup =     startup_crisv32_irq,
-        .shutdown =    shutdown_crisv32_irq,
-        .enable =      enable_crisv32_irq,
-        .disable =     disable_crisv32_irq,
-        .ack =         ack_crisv32_irq,
-        .end =         end_crisv32_irq,
-        .set_affinity = set_affinity_crisv32_irq
+        .name                   = "CRISv32",
+        .irq_shutdown           = disable_crisv32_irq,
+        .irq_enable             = enable_crisv32_irq,
+        .irq_disable            = disable_crisv32_irq,
+        .irq_set_affinity       = set_affinity_crisv32_irq,
 };
 
 void
@@ -472,7 +451,8 @@ init_IRQ(void)
 
         /* Point all IRQ's to bad handlers. */
         for (i = FIRST_IRQ, j = 0; j < NR_IRQS; i++, j++) {
-                irq_desc[j].chip = &crisv32_irq_type;
+                set_irq_chip_and_handler(j, &crisv32_irq_type,
+                                         handle_simple_irq);
                 set_exception_vector(i, interrupt[j]);
         }
 
diff --git a/arch/cris/configs/artpec_3_defconfig b/arch/cris/configs/artpec_3_defconfig
index 590f72c9455..71854d41c5a 100644
--- a/arch/cris/configs/artpec_3_defconfig
+++ b/arch/cris/configs/artpec_3_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 # CONFIG_SWAP is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/cris/configs/etrax-100lx_v2_defconfig b/arch/cris/configs/etrax-100lx_v2_defconfig
index 1b2853e3980..a85aabf92be 100644
--- a/arch/cris/configs/etrax-100lx_v2_defconfig
+++ b/arch/cris/configs/etrax-100lx_v2_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 # CONFIG_SWAP is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/cris/configs/etraxfs_defconfig b/arch/cris/configs/etraxfs_defconfig
index f73d38cc9c6..87c7227fecb 100644
--- a/arch/cris/configs/etraxfs_defconfig
+++ b/arch/cris/configs/etraxfs_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 # CONFIG_SWAP is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/cris/kernel/irq.c b/arch/cris/kernel/irq.c
index 469f7f9d62e..c346952f06d 100644
--- a/arch/cris/kernel/irq.c
+++ b/arch/cris/kernel/irq.c
@@ -62,7 +62,7 @@ int show_interrupts(struct seq_file *p, void *v)
                 for_each_online_cpu(j)
                         seq_printf(p, "%10u ", kstat_irqs_cpu(i, j));
 #endif
-                seq_printf(p, " %14s", irq_desc[i].chip->name);
+                seq_printf(p, " %14s", irq_desc[i].irq_data.chip->name);
                 seq_printf(p, "  %s", action->name);
 
                 for (action=action->next; action; action = action->next)
@@ -93,8 +93,8 @@ asmlinkage void do_IRQ(int irq, struct pt_regs * regs)
                 printk("do_IRQ: stack overflow: %lX\n", sp);
                 show_stack(NULL, (unsigned long *)sp);
         }
-        __do_IRQ(irq);
-        irq_exit();
+        generic_handle_irq(irq);
+        irq_exit();
         set_irq_regs(old_regs);
 }
 
diff --git a/arch/frv/Kconfig b/arch/frv/Kconfig
index f6bcb039cd6..747499a1b31 100644
--- a/arch/frv/Kconfig
+++ b/arch/frv/Kconfig
@@ -5,6 +5,7 @@ config FRV
         select HAVE_ARCH_TRACEHOOK
         select HAVE_IRQ_WORK
         select HAVE_PERF_EVENTS
+        select HAVE_GENERIC_HARDIRQS
 
 config ZONE_DMA
         bool
@@ -29,14 +30,6 @@ config GENERIC_CALIBRATE_DELAY
         bool
         default n
 
-config GENERIC_HARDIRQS
-        bool
-        default y
-
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        bool
-        default y
-
 config TIME_LOW_RES
         bool
         default y
diff --git a/arch/frv/defconfig b/arch/frv/defconfig
index b8ebe9e8a49..b1b792610fd 100644
--- a/arch/frv/defconfig
+++ b/arch/frv/defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 CONFIG_MMU=y
 CONFIG_FRV_OUTOFLINE_ATOMIC_OPS=y
diff --git a/arch/h8300/Kconfig b/arch/h8300/Kconfig
index 65f897d8c1e..6df692d1475 100644
--- a/arch/h8300/Kconfig
+++ b/arch/h8300/Kconfig
@@ -2,6 +2,8 @@ config H8300
         bool
         default y
         select HAVE_IDE
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_HARDIRQS_NO_DEPRECATED
 
 config SYMBOL_PREFIX
         string
@@ -47,10 +49,6 @@ config GENERIC_HWEIGHT
         bool
         default y
 
-config GENERIC_HARDIRQS
-        bool
-        default y
-
 config GENERIC_CALIBRATE_DELAY
         bool
         default y
diff --git a/arch/h8300/defconfig b/arch/h8300/defconfig
index 342f77765f0..042425a0264 100644
--- a/arch/h8300/defconfig
+++ b/arch/h8300/defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_UID16 is not set
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
diff --git a/arch/h8300/kernel/irq.c b/arch/h8300/kernel/irq.c
index c25dc2c2b1d..7643d39925d 100644
--- a/arch/h8300/kernel/irq.c
+++ b/arch/h8300/kernel/irq.c
@@ -38,34 +38,30 @@ static inline int is_ext_irq(unsigned int irq)
         return (irq >= EXT_IRQ0 && irq <= (EXT_IRQ0 + EXT_IRQS));
 }
 
-static void h8300_enable_irq(unsigned int irq)
+static void h8300_enable_irq(struct irq_data *data)
 {
-        if (is_ext_irq(irq))
-                IER_REGS |= 1 << (irq - EXT_IRQ0);
+        if (is_ext_irq(data->irq))
+                IER_REGS |= 1 << (data->irq - EXT_IRQ0);
 }
 
-static void h8300_disable_irq(unsigned int irq)
+static void h8300_disable_irq(struct irq_data *data)
 {
-        if (is_ext_irq(irq))
-                IER_REGS &= ~(1 << (irq - EXT_IRQ0));
+        if (is_ext_irq(data->irq))
+                IER_REGS &= ~(1 << (data->irq - EXT_IRQ0));
 }
 
-static void h8300_end_irq(unsigned int irq)
+static unsigned int h8300_startup_irq(struct irq_data *data)
 {
-}
-
-static unsigned int h8300_startup_irq(unsigned int irq)
-{
-        if (is_ext_irq(irq))
-                return h8300_enable_irq_pin(irq);
+        if (is_ext_irq(data->irq))
+                return h8300_enable_irq_pin(data->irq);
         else
                 return 0;
 }
 
-static void h8300_shutdown_irq(unsigned int irq)
+static void h8300_shutdown_irq(struct irq_data *data)
 {
-        if (is_ext_irq(irq))
-                h8300_disable_irq_pin(irq);
+        if (is_ext_irq(data->irq))
+                h8300_disable_irq_pin(data->irq);
 }
 
 /*
@@ -73,12 +69,10 @@ static void h8300_shutdown_irq(unsigned int irq)
  */
 struct irq_chip h8300irq_chip = {
         .name           = "H8300-INTC",
-        .startup        = h8300_startup_irq,
-        .shutdown       = h8300_shutdown_irq,
-        .enable         = h8300_enable_irq,
-        .disable        = h8300_disable_irq,
-        .ack            = NULL,
-        .end            = h8300_end_irq,
+        .irq_startup    = h8300_startup_irq,
+        .irq_shutdown   = h8300_shutdown_irq,
+        .irq_enable     = h8300_enable_irq,
+        .irq_disable    = h8300_disable_irq,
 };
 
 #if defined(CONFIG_RAMKERNEL)
@@ -160,18 +154,14 @@ void __init init_IRQ(void)
 
         setup_vector();
 
-        for (c = 0; c < NR_IRQS; c++) {
-                irq_desc[c].status = IRQ_DISABLED;
-                irq_desc[c].action = NULL;
-                irq_desc[c].depth = 1;
-                irq_desc[c].chip = &h8300irq_chip;
-        }
+        for (c = 0; c < NR_IRQS; c++)
+                set_irq_chip_and_handler(c, &h8300irq_chip, handle_simple_irq);
 }
 
 asmlinkage void do_IRQ(int irq)
 {
         irq_enter();
-        __do_IRQ(irq);
+        generic_handle_irq(irq);
         irq_exit();
 }
 
@@ -192,7 +182,7 @@ int show_interrupts(struct seq_file *p, void *v)
                         goto unlock;
                 seq_printf(p, "%3d: ",i);
                 seq_printf(p, "%10u ", kstat_irqs(i));
-                seq_printf(p, " %14s", irq_desc[i].chip->name);
+                seq_printf(p, " %14s", irq_desc[i].irq_data.chip->name);
                 seq_printf(p, "-%-8s", irq_desc[i].name);
                 seq_printf(p, "  %s", action->name);
 
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index e0f5b6d7f84..fcf3b437a2d 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -22,6 +22,10 @@ config IA64
         select HAVE_KVM
         select HAVE_ARCH_TRACEHOOK
         select HAVE_DMA_API_DEBUG
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_IRQ_PROBE
+        select GENERIC_PENDING_IRQ if SMP
+        select IRQ_PER_CPU
         default y
         help
           The Itanium Processor Family is Intel's 64-bit successor to
@@ -678,28 +682,6 @@ source "arch/ia64/kvm/Kconfig"
 
 source "lib/Kconfig"
 
-#
-# Use the generic interrupt handling code in kernel/irq/:
-#
-config GENERIC_HARDIRQS
-        def_bool y
-
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
-config GENERIC_IRQ_PROBE
-        bool
-        default y
-
-config GENERIC_PENDING_IRQ
-        bool
-        depends on GENERIC_HARDIRQS && SMP
-        default y
-
-config IRQ_PER_CPU
-        bool
-        default y
-
 config IOMMU_HELPER
         def_bool (IA64_HP_ZX1 || IA64_HP_ZX1_SWIOTLB || IA64_GENERIC || SWIOTLB)
 
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index 5c291d65196..ef4c1e442be 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -7,6 +7,9 @@ config M32R
         select HAVE_KERNEL_GZIP
         select HAVE_KERNEL_BZIP2
         select HAVE_KERNEL_LZMA
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_HARDIRQS_NO_DEPRECATED
+        select GENERIC_IRQ_PROBE
 
 config SBUS
         bool
@@ -19,14 +22,6 @@ config ZONE_DMA
         bool
         default y
 
-config GENERIC_HARDIRQS
-        bool
-        default y
-
-config GENERIC_IRQ_PROBE
-        bool
-        default y
-
 config NO_IOPORT
         def_bool y
 
diff --git a/arch/m32r/configs/m32700ut.smp_defconfig b/arch/m32r/configs/m32700ut.smp_defconfig
index 816c3ecaa2a..a3d727ed6a1 100644
--- a/arch/m32r/configs/m32700ut.smp_defconfig
+++ b/arch/m32r/configs/m32700ut.smp_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=15
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/m32700ut.up_defconfig b/arch/m32r/configs/m32700ut.up_defconfig
index 84785686640..b8334163099 100644
--- a/arch/m32r/configs/m32700ut.up_defconfig
+++ b/arch/m32r/configs/m32700ut.up_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/mappi.nommu_defconfig b/arch/m32r/configs/mappi.nommu_defconfig
index 354a964d084..7c90ce2fc42 100644
--- a/arch/m32r/configs/mappi.nommu_defconfig
+++ b/arch/m32r/configs/mappi.nommu_defconfig
@@ -3,7 +3,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_IKCONFIG=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/mappi.smp_defconfig b/arch/m32r/configs/mappi.smp_defconfig
index 9022307bd07..367d07cebcd 100644
--- a/arch/m32r/configs/mappi.smp_defconfig
+++ b/arch/m32r/configs/mappi.smp_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=15
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/mappi.up_defconfig b/arch/m32r/configs/mappi.up_defconfig
index 3726068721a..cb11384386c 100644
--- a/arch/m32r/configs/mappi.up_defconfig
+++ b/arch/m32r/configs/mappi.up_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/mappi2.opsp_defconfig b/arch/m32r/configs/mappi2.opsp_defconfig
index 6136fad048e..3bff779259b 100644
--- a/arch/m32r/configs/mappi2.opsp_defconfig
+++ b/arch/m32r/configs/mappi2.opsp_defconfig
@@ -4,7 +4,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_IKCONFIG=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/mappi2.vdec2_defconfig b/arch/m32r/configs/mappi2.vdec2_defconfig
index dce1fc7d67e..75246c9c1af 100644
--- a/arch/m32r/configs/mappi2.vdec2_defconfig
+++ b/arch/m32r/configs/mappi2.vdec2_defconfig
@@ -4,7 +4,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_IKCONFIG=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/mappi3.smp_defconfig b/arch/m32r/configs/mappi3.smp_defconfig
index b204e2ecd0f..27cefd41ac1 100644
--- a/arch/m32r/configs/mappi3.smp_defconfig
+++ b/arch/m32r/configs/mappi3.smp_defconfig
@@ -5,7 +5,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=15
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/oaks32r_defconfig b/arch/m32r/configs/oaks32r_defconfig
index 5aa4ea9ebb1..5087a510ca4 100644
--- a/arch/m32r/configs/oaks32r_defconfig
+++ b/arch/m32r/configs/oaks32r_defconfig
@@ -2,7 +2,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/opsput_defconfig b/arch/m32r/configs/opsput_defconfig
index 8494c6a276e..50c6f525db2 100644
--- a/arch/m32r/configs/opsput_defconfig
+++ b/arch/m32r/configs/opsput_defconfig
@@ -4,7 +4,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_IKCONFIG=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/m32r/configs/usrv_defconfig b/arch/m32r/configs/usrv_defconfig
index 1df293bc2ab..a3cfaaedab6 100644
--- a/arch/m32r/configs/usrv_defconfig
+++ b/arch/m32r/configs/usrv_defconfig
@@ -5,7 +5,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=15
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/m32r/kernel/irq.c b/arch/m32r/kernel/irq.c
index 7db26f1f082..76eaf3883fb 100644
--- a/arch/m32r/kernel/irq.c
+++ b/arch/m32r/kernel/irq.c
@@ -40,8 +40,10 @@ int show_interrupts(struct seq_file *p, void *v)
         }
 
         if (i < NR_IRQS) {
-                raw_spin_lock_irqsave(&irq_desc[i].lock, flags);
-                action = irq_desc[i].action;
+                struct irq_desc *desc = irq_to_desc(i);
+
+                raw_spin_lock_irqsave(&desc->lock, flags);
+                action = desc->action;
                 if (!action)
                         goto skip;
                 seq_printf(p, "%3d: ",i);
@@ -51,7 +53,7 @@ int show_interrupts(struct seq_file *p, void *v)
                 for_each_online_cpu(j)
                         seq_printf(p, "%10u ", kstat_irqs_cpu(i, j));
 #endif
-                seq_printf(p, " %14s", irq_desc[i].chip->name);
+                seq_printf(p, " %14s", desc->irq_data.chip->name);
                 seq_printf(p, "  %s", action->name);
 
                 for (action=action->next; action; action = action->next)
@@ -59,7 +61,7 @@ int show_interrupts(struct seq_file *p, void *v)
 
                 seq_putc(p, '\n');
 skip:
-                raw_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+                raw_spin_unlock_irqrestore(&desc->lock, flags);
         }
         return 0;
 }
@@ -78,7 +80,7 @@ asmlinkage unsigned int do_IRQ(int irq, struct pt_regs *regs)
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
         /* FIXME M32R */
 #endif
-        __do_IRQ(irq);
+        generic_handle_irq(irq);
         irq_exit();
         set_irq_regs(old_regs);
 
diff --git a/arch/m32r/platforms/m32104ut/setup.c b/arch/m32r/platforms/m32104ut/setup.c
index 402a59d7219..4a693d02c1e 100644
--- a/arch/m32r/platforms/m32104ut/setup.c
+++ b/arch/m32r/platforms/m32104ut/setup.c
@@ -39,39 +39,30 @@ static void enable_m32104ut_irq(unsigned int irq)
         outl(data, port);
 }
 
-static void mask_and_ack_m32104ut(unsigned int irq)
+static void mask_m32104ut_irq(struct irq_data *data)
 {
-        disable_m32104ut_irq(irq);
+        disable_m32104ut_irq(data->irq);
 }
 
-static void end_m32104ut_irq(unsigned int irq)
+static void unmask_m32104ut_irq(struct irq_data *data)
 {
-        enable_m32104ut_irq(irq);
+        enable_m32104ut_irq(data->irq);
 }
 
-static unsigned int startup_m32104ut_irq(unsigned int irq)
+static void shutdown_m32104ut_irq(struct irq_data *data)
 {
-        enable_m32104ut_irq(irq);
-        return (0);
-}
-
-static void shutdown_m32104ut_irq(unsigned int irq)
-{
-        unsigned long port;
+        unsigned int irq = data->irq;
+        unsigned long port = irq2port(irq);
 
-        port = irq2port(irq);
         outl(M32R_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip m32104ut_irq_type =
 {
-        .name = "M32104UT-IRQ",
-        .startup = startup_m32104ut_irq,
-        .shutdown = shutdown_m32104ut_irq,
-        .enable = enable_m32104ut_irq,
-        .disable = disable_m32104ut_irq,
-        .ack = mask_and_ack_m32104ut,
-        .end = end_m32104ut_irq
+        .name           = "M32104UT-IRQ",
+        .irq_shutdown   = shutdown_m32104ut_irq,
+        .irq_unmask     = unmask_m32104ut_irq,
+        .irq_mask       = mask_m32104ut_irq,
 };
 
 void __init init_IRQ(void)
@@ -85,36 +76,29 @@ void __init init_IRQ(void)
 
 #if defined(CONFIG_SMC91X)
         /* INT#0: LAN controller on M32104UT-LAN (SMC91C111)*/
-        irq_desc[M32R_IRQ_INT0].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT0].chip = &m32104ut_irq_type;
-        irq_desc[M32R_IRQ_INT0].action = 0;
-        irq_desc[M32R_IRQ_INT0].depth = 1;
-        icu_data[M32R_IRQ_INT0].icucr = M32R_ICUCR_IEN | M32R_ICUCR_ISMOD11; /* "H" level sense */
+        set_irq_chip_and_handler(M32R_IRQ_INT0, &m32104ut_irq_type,
+                                 handle_level_irq);
+        /* "H" level sense */
+        cu_data[M32R_IRQ_INT0].icucr = M32R_ICUCR_IEN | M32R_ICUCR_ISMOD11;
         disable_m32104ut_irq(M32R_IRQ_INT0);
 #endif  /* CONFIG_SMC91X */
 
         /* MFT2 : system timer */
-        irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_MFT2].chip = &m32104ut_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = 0;
-        irq_desc[M32R_IRQ_MFT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_MFT2, &m32104ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_m32104ut_irq(M32R_IRQ_MFT2);
 
 #ifdef CONFIG_SERIAL_M32R_SIO
         /* SIO0_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_R].chip = &m32104ut_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = 0;
-        irq_desc[M32R_IRQ_SIO0_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_R, &m32104ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_R].icucr = M32R_ICUCR_IEN;
         disable_m32104ut_irq(M32R_IRQ_SIO0_R);
 
         /* SIO0_S : uart send data */
-        irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_S].chip = &m32104ut_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = 0;
-        irq_desc[M32R_IRQ_SIO0_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_S, &m32104ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_S].icucr = M32R_ICUCR_IEN;
         disable_m32104ut_irq(M32R_IRQ_SIO0_S);
 #endif /* CONFIG_SERIAL_M32R_SIO */
diff --git a/arch/m32r/platforms/m32700ut/setup.c b/arch/m32r/platforms/m32700ut/setup.c
index 80b1a026795..2074bcc841e 100644
--- a/arch/m32r/platforms/m32700ut/setup.c
+++ b/arch/m32r/platforms/m32700ut/setup.c
@@ -45,39 +45,30 @@ static void enable_m32700ut_irq(unsigned int irq)
         outl(data, port);
 }
 
-static void mask_and_ack_m32700ut(unsigned int irq)
+static void mask_m32700ut(struct irq_data *data)
 {
-        disable_m32700ut_irq(irq);
+        disable_m32700ut_irq(data->irq);
 }
 
-static void end_m32700ut_irq(unsigned int irq)
+static void unmask_m32700ut(struct irq_data *data)
 {
-        enable_m32700ut_irq(irq);
+        enable_m32700ut_irq(data->irq);
 }
 
-static unsigned int startup_m32700ut_irq(unsigned int irq)
-{
-        enable_m32700ut_irq(irq);
-        return (0);
-}
-
-static void shutdown_m32700ut_irq(unsigned int irq)
+static void shutdown_m32700ut(struct irq_data *data)
 {
         unsigned long port;
 
-        port = irq2port(irq);
+        port = irq2port(data->irq);
         outl(M32R_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip m32700ut_irq_type =
 {
-        .name = "M32700UT-IRQ",
-        .startup = startup_m32700ut_irq,
-        .shutdown = shutdown_m32700ut_irq,
-        .enable = enable_m32700ut_irq,
-        .disable = disable_m32700ut_irq,
-        .ack = mask_and_ack_m32700ut,
-        .end = end_m32700ut_irq
+        .name           = "M32700UT-IRQ",
+        .irq_shutdown   = shutdown_m32700ut,
+        .irq_mask       = mask_m32700ut,
+        .irq_unmask     = unmask_m32700ut
 };
 
 /*
@@ -99,7 +90,6 @@ static void disable_m32700ut_pld_irq(unsigned int irq)
         unsigned int pldirq;
 
         pldirq = irq2pldirq(irq);
-//      disable_m32700ut_irq(M32R_IRQ_INT1);
         port = pldirq2port(pldirq);
         data = pld_icu_data[pldirq].icucr|PLD_ICUCR_ILEVEL7;
         outw(data, port);
@@ -111,50 +101,38 @@ static void enable_m32700ut_pld_irq(unsigned int irq)
         unsigned int pldirq;
 
         pldirq = irq2pldirq(irq);
-//      enable_m32700ut_irq(M32R_IRQ_INT1);
         port = pldirq2port(pldirq);
         data = pld_icu_data[pldirq].icucr|PLD_ICUCR_IEN|PLD_ICUCR_ILEVEL6;
         outw(data, port);
 }
 
-static void mask_and_ack_m32700ut_pld(unsigned int irq)
-{
-        disable_m32700ut_pld_irq(irq);
-//      mask_and_ack_m32700ut(M32R_IRQ_INT1);
-}
-
-static void end_m32700ut_pld_irq(unsigned int irq)
+static void mask_m32700ut_pld(struct irq_data *data)
 {
-        enable_m32700ut_pld_irq(irq);
-        end_m32700ut_irq(M32R_IRQ_INT1);
+        disable_m32700ut_pld_irq(data->irq);
 }
 
-static unsigned int startup_m32700ut_pld_irq(unsigned int irq)
+static void unmask_m32700ut_pld(struct irq_data *data)
 {
-        enable_m32700ut_pld_irq(irq);
-        return (0);
+        enable_m32700ut_pld_irq(data->irq);
+        enable_m32700ut_irq(M32R_IRQ_INT1);
 }
 
-static void shutdown_m32700ut_pld_irq(unsigned int irq)
+static void shutdown_m32700ut_pld_irq(struct irq_data *data)
 {
         unsigned long port;
         unsigned int pldirq;
 
-        pldirq = irq2pldirq(irq);
-//      shutdown_m32700ut_irq(M32R_IRQ_INT1);
+        pldirq = irq2pldirq(data->irq);
         port = pldirq2port(pldirq);
         outw(PLD_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip m32700ut_pld_irq_type =
 {
-        .name = "M32700UT-PLD-IRQ",
-        .startup = startup_m32700ut_pld_irq,
-        .shutdown = shutdown_m32700ut_pld_irq,
-        .enable = enable_m32700ut_pld_irq,
-        .disable = disable_m32700ut_pld_irq,
-        .ack = mask_and_ack_m32700ut_pld,
-        .end = end_m32700ut_pld_irq
+        .name           = "M32700UT-PLD-IRQ",
+        .irq_shutdown   = shutdown_m32700ut_pld_irq,
+        .irq_mask       = mask_m32700ut_pld,
+        .irq_unmask     = unmask_m32700ut_pld,
 };
 
 /*
@@ -188,42 +166,33 @@ static void enable_m32700ut_lanpld_irq(unsigned int irq)
         outw(data, port);
 }
 
-static void mask_and_ack_m32700ut_lanpld(unsigned int irq)
+static void mask_m32700ut_lanpld(struct irq_data *data)
 {
-        disable_m32700ut_lanpld_irq(irq);
+        disable_m32700ut_lanpld_irq(data->irq);
 }
 
-static void end_m32700ut_lanpld_irq(unsigned int irq)
+static void unmask_m32700ut_lanpld(struct irq_data *data)
 {
-        enable_m32700ut_lanpld_irq(irq);
-        end_m32700ut_irq(M32R_IRQ_INT0);
-}
-
-static unsigned int startup_m32700ut_lanpld_irq(unsigned int irq)
-{
-        enable_m32700ut_lanpld_irq(irq);
-        return (0);
+        enable_m32700ut_lanpld_irq(data->irq);
+        enable_m32700ut_irq(M32R_IRQ_INT0);
 }
 
-static void shutdown_m32700ut_lanpld_irq(unsigned int irq)
+static void shutdown_m32700ut_lanpld(struct irq_data *data)
 {
         unsigned long port;
         unsigned int pldirq;
 
-        pldirq = irq2lanpldirq(irq);
+        pldirq = irq2lanpldirq(data->irq);
         port = lanpldirq2port(pldirq);
         outw(PLD_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip m32700ut_lanpld_irq_type =
 {
-        .name = "M32700UT-PLD-LAN-IRQ",
-        .startup = startup_m32700ut_lanpld_irq,
-        .shutdown = shutdown_m32700ut_lanpld_irq,
-        .enable = enable_m32700ut_lanpld_irq,
-        .disable = disable_m32700ut_lanpld_irq,
-        .ack = mask_and_ack_m32700ut_lanpld,
-        .end = end_m32700ut_lanpld_irq
+        .name           = "M32700UT-PLD-LAN-IRQ",
+        .irq_shutdown   = shutdown_m32700ut_lanpld,
+        .irq_mask       = mask_m32700ut_lanpld,
+        .irq_unmask     = unmask_m32700ut_lanpld,
 };
 
 /*
@@ -257,143 +226,110 @@ static void enable_m32700ut_lcdpld_irq(unsigned int irq)
         outw(data, port);
 }
 
-static void mask_and_ack_m32700ut_lcdpld(unsigned int irq)
+static void mask_m32700ut_lcdpld(struct irq_data *data)
 {
-        disable_m32700ut_lcdpld_irq(irq);
+        disable_m32700ut_lcdpld_irq(data->irq);
 }
 
-static void end_m32700ut_lcdpld_irq(unsigned int irq)
+static void unmask_m32700ut_lcdpld(struct irq_data *data)
 {
-        enable_m32700ut_lcdpld_irq(irq);
-        end_m32700ut_irq(M32R_IRQ_INT2);
-}
-
-static unsigned int startup_m32700ut_lcdpld_irq(unsigned int irq)
-{
-        enable_m32700ut_lcdpld_irq(irq);
-        return (0);
+        enable_m32700ut_lcdpld_irq(data->irq);
+        enable_m32700ut_irq(M32R_IRQ_INT2);
 }
 
-static void shutdown_m32700ut_lcdpld_irq(unsigned int irq)
+static void shutdown_m32700ut_lcdpld(struct irq_data *data)
 {
         unsigned long port;
         unsigned int pldirq;
 
-        pldirq = irq2lcdpldirq(irq);
+        pldirq = irq2lcdpldirq(data->irq);
         port = lcdpldirq2port(pldirq);
         outw(PLD_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip m32700ut_lcdpld_irq_type =
 {
-        .name = "M32700UT-PLD-LCD-IRQ",
-        .startup = startup_m32700ut_lcdpld_irq,
-        .shutdown = shutdown_m32700ut_lcdpld_irq,
-        .enable = enable_m32700ut_lcdpld_irq,
-        .disable = disable_m32700ut_lcdpld_irq,
-        .ack = mask_and_ack_m32700ut_lcdpld,
-        .end = end_m32700ut_lcdpld_irq
+        .name           = "M32700UT-PLD-LCD-IRQ",
+        .irq_shutdown   = shutdown_m32700ut_lcdpld,
+        .irq_mask       = mask_m32700ut_lcdpld,
+        .irq_unmask     = unmask_m32700ut_lcdpld,
 };
 
 void __init init_IRQ(void)
 {
 #if defined(CONFIG_SMC91X)
         /* INT#0: LAN controller on M32700UT-LAN (SMC91C111)*/
-        irq_desc[M32700UT_LAN_IRQ_LAN].status = IRQ_DISABLED;
-        irq_desc[M32700UT_LAN_IRQ_LAN].chip = &m32700ut_lanpld_irq_type;
-        irq_desc[M32700UT_LAN_IRQ_LAN].action = 0;
-        irq_desc[M32700UT_LAN_IRQ_LAN].depth = 1;       /* disable nested irq */
+        set_irq_chip_and_handler(M32700UT_LAN_IRQ_LAN,
+                                 &m32700ut_lanpld_irq_type, handle_level_irq);
         lanpld_icu_data[irq2lanpldirq(M32700UT_LAN_IRQ_LAN)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD02;   /* "H" edge sense */
         disable_m32700ut_lanpld_irq(M32700UT_LAN_IRQ_LAN);
 #endif  /* CONFIG_SMC91X */
 
         /* MFT2 : system timer */
-        irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_MFT2].chip = &m32700ut_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = 0;
-        irq_desc[M32R_IRQ_MFT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_MFT2, &m32700ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_m32700ut_irq(M32R_IRQ_MFT2);
 
         /* SIO0 : receive */
-        irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_R].chip = &m32700ut_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = 0;
-        irq_desc[M32R_IRQ_SIO0_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_R, &m32700ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_R].icucr = 0;
         disable_m32700ut_irq(M32R_IRQ_SIO0_R);
 
         /* SIO0 : send */
-        irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_S].chip = &m32700ut_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = 0;
-        irq_desc[M32R_IRQ_SIO0_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_S, &m32700ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_S].icucr = 0;
         disable_m32700ut_irq(M32R_IRQ_SIO0_S);
 
         /* SIO1 : receive */
-        irq_desc[M32R_IRQ_SIO1_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_R].chip = &m32700ut_irq_type;
-        irq_desc[M32R_IRQ_SIO1_R].action = 0;
-        irq_desc[M32R_IRQ_SIO1_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_R, &m32700ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_R].icucr = 0;
         disable_m32700ut_irq(M32R_IRQ_SIO1_R);
 
         /* SIO1 : send */
-        irq_desc[M32R_IRQ_SIO1_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_S].chip = &m32700ut_irq_type;
-        irq_desc[M32R_IRQ_SIO1_S].action = 0;
-        irq_desc[M32R_IRQ_SIO1_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_S, &m32700ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_S].icucr = 0;
         disable_m32700ut_irq(M32R_IRQ_SIO1_S);
 
         /* DMA1 : */
-        irq_desc[M32R_IRQ_DMA1].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_DMA1].chip = &m32700ut_irq_type;
-        irq_desc[M32R_IRQ_DMA1].action = 0;
-        irq_desc[M32R_IRQ_DMA1].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_DMA1, &m32700ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_DMA1].icucr = 0;
         disable_m32700ut_irq(M32R_IRQ_DMA1);
 
 #ifdef CONFIG_SERIAL_M32R_PLDSIO
         /* INT#1: SIO0 Receive on PLD */
-        irq_desc[PLD_IRQ_SIO0_RCV].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_SIO0_RCV].chip = &m32700ut_pld_irq_type;
-        irq_desc[PLD_IRQ_SIO0_RCV].action = 0;
-        irq_desc[PLD_IRQ_SIO0_RCV].depth = 1;   /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_SIO0_RCV, &m32700ut_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_SIO0_RCV)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD03;
         disable_m32700ut_pld_irq(PLD_IRQ_SIO0_RCV);
 
         /* INT#1: SIO0 Send on PLD */
-        irq_desc[PLD_IRQ_SIO0_SND].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_SIO0_SND].chip = &m32700ut_pld_irq_type;
-        irq_desc[PLD_IRQ_SIO0_SND].action = 0;
-        irq_desc[PLD_IRQ_SIO0_SND].depth = 1;   /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_SIO0_SND, &m32700ut_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_SIO0_SND)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD03;
         disable_m32700ut_pld_irq(PLD_IRQ_SIO0_SND);
 #endif  /* CONFIG_SERIAL_M32R_PLDSIO */
 
         /* INT#1: CFC IREQ on PLD */
-        irq_desc[PLD_IRQ_CFIREQ].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFIREQ].chip = &m32700ut_pld_irq_type;
-        irq_desc[PLD_IRQ_CFIREQ].action = 0;
-        irq_desc[PLD_IRQ_CFIREQ].depth = 1;     /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFIREQ, &m32700ut_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_CFIREQ)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD01;       /* 'L' level sense */
         disable_m32700ut_pld_irq(PLD_IRQ_CFIREQ);
 
         /* INT#1: CFC Insert on PLD */
-        irq_desc[PLD_IRQ_CFC_INSERT].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFC_INSERT].chip = &m32700ut_pld_irq_type;
-        irq_desc[PLD_IRQ_CFC_INSERT].action = 0;
-        irq_desc[PLD_IRQ_CFC_INSERT].depth = 1; /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFC_INSERT, &m32700ut_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_CFC_INSERT)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD00;   /* 'L' edge sense */
         disable_m32700ut_pld_irq(PLD_IRQ_CFC_INSERT);
 
         /* INT#1: CFC Eject on PLD */
-        irq_desc[PLD_IRQ_CFC_EJECT].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFC_EJECT].chip = &m32700ut_pld_irq_type;
-        irq_desc[PLD_IRQ_CFC_EJECT].action = 0;
-        irq_desc[PLD_IRQ_CFC_EJECT].depth = 1;  /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFC_EJECT, &m32700ut_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_CFC_EJECT)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD02;    /* 'H' edge sense */
         disable_m32700ut_pld_irq(PLD_IRQ_CFC_EJECT);
 
@@ -413,13 +349,11 @@ void __init init_IRQ(void)
 
 #if defined(CONFIG_USB)
         outw(USBCR_OTGS, USBCR);        /* USBCR: non-OTG */
+        set_irq_chip_and_handler(M32700UT_LCD_IRQ_USB_INT1,
+                                 &m32700ut_lcdpld_irq_type, handle_level_irq);
 
-    irq_desc[M32700UT_LCD_IRQ_USB_INT1].status = IRQ_DISABLED;
-    irq_desc[M32700UT_LCD_IRQ_USB_INT1].chip = &m32700ut_lcdpld_irq_type;
-    irq_desc[M32700UT_LCD_IRQ_USB_INT1].action = 0;
-    irq_desc[M32700UT_LCD_IRQ_USB_INT1].depth = 1;
-    lcdpld_icu_data[irq2lcdpldirq(M32700UT_LCD_IRQ_USB_INT1)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD01;  /* "L" level sense */
-    disable_m32700ut_lcdpld_irq(M32700UT_LCD_IRQ_USB_INT1);
+        lcdpld_icu_data[irq2lcdpldirq(M32700UT_LCD_IRQ_USB_INT1)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD01;      /* "L" level sense */
+        disable_m32700ut_lcdpld_irq(M32700UT_LCD_IRQ_USB_INT1);
 #endif
         /*
          * INT2# is used for BAT, USB, AUDIO
@@ -432,10 +366,8 @@ void __init init_IRQ(void)
         /*
          * INT3# is used for AR
          */
-        irq_desc[M32R_IRQ_INT3].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT3].chip = &m32700ut_irq_type;
-        irq_desc[M32R_IRQ_INT3].action = 0;
-        irq_desc[M32R_IRQ_INT3].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT3, &m32700ut_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT3].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD10;
         disable_m32700ut_irq(M32R_IRQ_INT3);
 #endif  /* CONFIG_VIDEO_M32R_AR */
diff --git a/arch/m32r/platforms/mappi/setup.c b/arch/m32r/platforms/mappi/setup.c
index ea00c84d6b1..cdd8c457402 100644
--- a/arch/m32r/platforms/mappi/setup.c
+++ b/arch/m32r/platforms/mappi/setup.c
@@ -38,40 +38,30 @@ static void enable_mappi_irq(unsigned int irq)
         outl(data, port);
 }
 
-static void mask_and_ack_mappi(unsigned int irq)
+static void mask_mappi(struct irq_data *data)
 {
-        disable_mappi_irq(irq);
+        disable_mappi_irq(data->irq);
 }
 
-static void end_mappi_irq(unsigned int irq)
+static void unmask_mappi(struct irq_data *data)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED | IRQ_INPROGRESS)))
-                enable_mappi_irq(irq);
+        enable_mappi_irq(data->irq);
 }
 
-static unsigned int startup_mappi_irq(unsigned int irq)
-{
-        enable_mappi_irq(irq);
-        return (0);
-}
-
-static void shutdown_mappi_irq(unsigned int irq)
+static void shutdown_mappi(struct irq_data *data)
 {
         unsigned long port;
 
-        port = irq2port(irq);
+        port = irq2port(data->irq);
         outl(M32R_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip mappi_irq_type =
 {
-        .name = "MAPPI-IRQ",
-        .startup = startup_mappi_irq,
-        .shutdown = shutdown_mappi_irq,
-        .enable = enable_mappi_irq,
-        .disable = disable_mappi_irq,
-        .ack = mask_and_ack_mappi,
-        .end = end_mappi_irq
+        .name           = "MAPPI-IRQ",
+        .irq_shutdown   = shutdown_mappi,
+        .irq_mask       = mask_mappi,
+        .irq_unmask     = unmask_mappi,
 };
 
 void __init init_IRQ(void)
@@ -85,70 +75,54 @@ void __init init_IRQ(void)
 
 #ifdef CONFIG_NE2000
         /* INT0 : LAN controller (RTL8019AS) */
-        irq_desc[M32R_IRQ_INT0].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT0].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_INT0].action = NULL;
-        irq_desc[M32R_IRQ_INT0].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT0, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT0].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD11;
         disable_mappi_irq(M32R_IRQ_INT0);
 #endif /* CONFIG_M32R_NE2000 */
 
         /* MFT2 : system timer */
-        irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_MFT2].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = NULL;
-        irq_desc[M32R_IRQ_MFT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_MFT2, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_mappi_irq(M32R_IRQ_MFT2);
 
 #ifdef CONFIG_SERIAL_M32R_SIO
         /* SIO0_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_R].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = NULL;
-        irq_desc[M32R_IRQ_SIO0_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_R, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_R].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO0_R);
 
         /* SIO0_S : uart send data */
-        irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_S].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = NULL;
-        irq_desc[M32R_IRQ_SIO0_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_S, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_S].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO0_S);
 
         /* SIO1_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO1_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_R].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO1_R].action = NULL;
-        irq_desc[M32R_IRQ_SIO1_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_R, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_R].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO1_R);
 
         /* SIO1_S : uart send data */
-        irq_desc[M32R_IRQ_SIO1_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_S].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO1_S].action = NULL;
-        irq_desc[M32R_IRQ_SIO1_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_S, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_S].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO1_S);
 #endif /* CONFIG_SERIAL_M32R_SIO */
 
 #if defined(CONFIG_M32R_PCC)
         /* INT1 : pccard0 interrupt */
-        irq_desc[M32R_IRQ_INT1].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT1].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_INT1].action = NULL;
-        irq_desc[M32R_IRQ_INT1].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT1, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT1].icucr = M32R_ICUCR_IEN | M32R_ICUCR_ISMOD00;
         disable_mappi_irq(M32R_IRQ_INT1);
 
         /* INT2 : pccard1 interrupt */
-        irq_desc[M32R_IRQ_INT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT2].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_INT2].action = NULL;
-        irq_desc[M32R_IRQ_INT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT2, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT2].icucr = M32R_ICUCR_IEN | M32R_ICUCR_ISMOD00;
         disable_mappi_irq(M32R_IRQ_INT2);
 #endif /* CONFIG_M32RPCC */
diff --git a/arch/m32r/platforms/mappi2/setup.c b/arch/m32r/platforms/mappi2/setup.c
index c049376d027..9117c30ea36 100644
--- a/arch/m32r/platforms/mappi2/setup.c
+++ b/arch/m32r/platforms/mappi2/setup.c
@@ -46,126 +46,97 @@ static void enable_mappi2_irq(unsigned int irq)
         outl(data, port);
 }
 
-static void mask_and_ack_mappi2(unsigned int irq)
+static void mask_mappi2(struct irq_data *data)
 {
-        disable_mappi2_irq(irq);
+        disable_mappi2_irq(data->irq);
 }
 
-static void end_mappi2_irq(unsigned int irq)
+static void unmask_mappi2(struct irq_data *data)
 {
-        enable_mappi2_irq(irq);
+        enable_mappi2_irq(data->irq);
 }
 
-static unsigned int startup_mappi2_irq(unsigned int irq)
-{
-        enable_mappi2_irq(irq);
-        return (0);
-}
-
-static void shutdown_mappi2_irq(unsigned int irq)
+static void shutdown_mappi2(struct irq_data *data)
 {
         unsigned long port;
 
-        port = irq2port(irq);
+        port = irq2port(data->irq);
         outl(M32R_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip mappi2_irq_type =
 {
-        .name = "MAPPI2-IRQ",
-        .startup = startup_mappi2_irq,
-        .shutdown = shutdown_mappi2_irq,
-        .enable = enable_mappi2_irq,
-        .disable = disable_mappi2_irq,
-        .ack = mask_and_ack_mappi2,
-        .end = end_mappi2_irq
+        .name           = "MAPPI2-IRQ",
+        .irq_shutdown   = shutdown_mappi2,
+        .irq_mask       = mask_mappi2,
+        .irq_unmask     = unmask_mappi2,
 };
 
 void __init init_IRQ(void)
 {
 #if defined(CONFIG_SMC91X)
         /* INT0 : LAN controller (SMC91111) */
-        irq_desc[M32R_IRQ_INT0].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT0].chip = &mappi2_irq_type;
-        irq_desc[M32R_IRQ_INT0].action = 0;
-        irq_desc[M32R_IRQ_INT0].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT0, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT0].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD10;
         disable_mappi2_irq(M32R_IRQ_INT0);
 #endif  /* CONFIG_SMC91X */
 
         /* MFT2 : system timer */
-        irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_MFT2].chip = &mappi2_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = 0;
-        irq_desc[M32R_IRQ_MFT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_MFT2, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_mappi2_irq(M32R_IRQ_MFT2);
 
 #ifdef CONFIG_SERIAL_M32R_SIO
         /* SIO0_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_R].chip = &mappi2_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = 0;
-        irq_desc[M32R_IRQ_SIO0_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_R, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_R].icucr = 0;
         disable_mappi2_irq(M32R_IRQ_SIO0_R);
 
         /* SIO0_S : uart send data */
-        irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_S].chip = &mappi2_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = 0;
-        irq_desc[M32R_IRQ_SIO0_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_S, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_S].icucr = 0;
         disable_mappi2_irq(M32R_IRQ_SIO0_S);
         /* SIO1_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO1_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_R].chip = &mappi2_irq_type;
-        irq_desc[M32R_IRQ_SIO1_R].action = 0;
-        irq_desc[M32R_IRQ_SIO1_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_R, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_R].icucr = 0;
         disable_mappi2_irq(M32R_IRQ_SIO1_R);
 
         /* SIO1_S : uart send data */
-        irq_desc[M32R_IRQ_SIO1_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_S].chip = &mappi2_irq_type;
-        irq_desc[M32R_IRQ_SIO1_S].action = 0;
-        irq_desc[M32R_IRQ_SIO1_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_S, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_S].icucr = 0;
         disable_mappi2_irq(M32R_IRQ_SIO1_S);
 #endif  /* CONFIG_M32R_USE_DBG_CONSOLE */
 
 #if defined(CONFIG_USB)
         /* INT1 : USB Host controller interrupt */
-        irq_desc[M32R_IRQ_INT1].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT1].chip = &mappi2_irq_type;
-        irq_desc[M32R_IRQ_INT1].action = 0;
-        irq_desc[M32R_IRQ_INT1].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT1, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT1].icucr = M32R_ICUCR_ISMOD01;
         disable_mappi2_irq(M32R_IRQ_INT1);
 #endif /* CONFIG_USB */
 
         /* ICUCR40: CFC IREQ */
-        irq_desc[PLD_IRQ_CFIREQ].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFIREQ].chip = &mappi2_irq_type;
-        irq_desc[PLD_IRQ_CFIREQ].action = 0;
-        irq_desc[PLD_IRQ_CFIREQ].depth = 1;     /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFIREQ, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[PLD_IRQ_CFIREQ].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD01;
         disable_mappi2_irq(PLD_IRQ_CFIREQ);
 
 #if defined(CONFIG_M32R_CFC)
         /* ICUCR41: CFC Insert */
-        irq_desc[PLD_IRQ_CFC_INSERT].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFC_INSERT].chip = &mappi2_irq_type;
-        irq_desc[PLD_IRQ_CFC_INSERT].action = 0;
-        irq_desc[PLD_IRQ_CFC_INSERT].depth = 1; /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFC_INSERT, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[PLD_IRQ_CFC_INSERT].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD00;
         disable_mappi2_irq(PLD_IRQ_CFC_INSERT);
 
         /* ICUCR42: CFC Eject */
-        irq_desc[PLD_IRQ_CFC_EJECT].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFC_EJECT].chip = &mappi2_irq_type;
-        irq_desc[PLD_IRQ_CFC_EJECT].action = 0;
-        irq_desc[PLD_IRQ_CFC_EJECT].depth = 1;  /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFC_EJECT, &mappi2_irq_type,
+                                 handle_level_irq);
         icu_data[PLD_IRQ_CFC_EJECT].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD10;
         disable_mappi2_irq(PLD_IRQ_CFC_EJECT);
 #endif /* CONFIG_MAPPI2_CFC */
diff --git a/arch/m32r/platforms/mappi3/setup.c b/arch/m32r/platforms/mappi3/setup.c
index 882de25c6e8..b44f5ded2bb 100644
--- a/arch/m32r/platforms/mappi3/setup.c
+++ b/arch/m32r/platforms/mappi3/setup.c
@@ -46,128 +46,98 @@ static void enable_mappi3_irq(unsigned int irq)
         outl(data, port);
 }
 
-static void mask_and_ack_mappi3(unsigned int irq)
+static void mask_mappi3(struct irq_data *data)
 {
-        disable_mappi3_irq(irq);
+        disable_mappi3_irq(data->irq);
 }
 
-static void end_mappi3_irq(unsigned int irq)
+static void unmask_mappi3(struct irq_data *data)
 {
-        enable_mappi3_irq(irq);
+        enable_mappi3_irq(data->irq);
 }
 
-static unsigned int startup_mappi3_irq(unsigned int irq)
-{
-        enable_mappi3_irq(irq);
-        return (0);
-}
-
-static void shutdown_mappi3_irq(unsigned int irq)
+static void shutdown_mappi3(struct irq_data *data)
 {
         unsigned long port;
 
-        port = irq2port(irq);
+        port = irq2port(data->irq);
         outl(M32R_ICUCR_ILEVEL7, port);
 }
 
-static struct irq_chip mappi3_irq_type =
-{
-        .name = "MAPPI3-IRQ",
-        .startup = startup_mappi3_irq,
-        .shutdown = shutdown_mappi3_irq,
-        .enable = enable_mappi3_irq,
-        .disable = disable_mappi3_irq,
-        .ack = mask_and_ack_mappi3,
-        .end = end_mappi3_irq
+static struct irq_chip mappi3_irq_type = {
+        .name           = "MAPPI3-IRQ",
+        .irq_shutdown   = shutdown_mappi3,
+        .irq_mask       = mask_mappi3,
+        .irq_unmask     = unmask_mappi3,
 };
 
 void __init init_IRQ(void)
 {
 #if defined(CONFIG_SMC91X)
         /* INT0 : LAN controller (SMC91111) */
-        irq_desc[M32R_IRQ_INT0].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT0].chip = &mappi3_irq_type;
-        irq_desc[M32R_IRQ_INT0].action = 0;
-        irq_desc[M32R_IRQ_INT0].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT0, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT0].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD10;
         disable_mappi3_irq(M32R_IRQ_INT0);
 #endif  /* CONFIG_SMC91X */
 
         /* MFT2 : system timer */
-        irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_MFT2].chip = &mappi3_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = 0;
-        irq_desc[M32R_IRQ_MFT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_MFT2, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_mappi3_irq(M32R_IRQ_MFT2);
 
 #ifdef CONFIG_SERIAL_M32R_SIO
         /* SIO0_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_R].chip = &mappi3_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = 0;
-        irq_desc[M32R_IRQ_SIO0_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_R, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_R].icucr = 0;
         disable_mappi3_irq(M32R_IRQ_SIO0_R);
 
         /* SIO0_S : uart send data */
-        irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_S].chip = &mappi3_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = 0;
-        irq_desc[M32R_IRQ_SIO0_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_S, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_S].icucr = 0;
         disable_mappi3_irq(M32R_IRQ_SIO0_S);
         /* SIO1_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO1_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_R].chip = &mappi3_irq_type;
-        irq_desc[M32R_IRQ_SIO1_R].action = 0;
-        irq_desc[M32R_IRQ_SIO1_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_R, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_R].icucr = 0;
         disable_mappi3_irq(M32R_IRQ_SIO1_R);
 
         /* SIO1_S : uart send data */
-        irq_desc[M32R_IRQ_SIO1_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_S].chip = &mappi3_irq_type;
-        irq_desc[M32R_IRQ_SIO1_S].action = 0;
-        irq_desc[M32R_IRQ_SIO1_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_S, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_S].icucr = 0;
         disable_mappi3_irq(M32R_IRQ_SIO1_S);
 #endif  /* CONFIG_M32R_USE_DBG_CONSOLE */
 
 #if defined(CONFIG_USB)
         /* INT1 : USB Host controller interrupt */
-        irq_desc[M32R_IRQ_INT1].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT1].chip = &mappi3_irq_type;
-        irq_desc[M32R_IRQ_INT1].action = 0;
-        irq_desc[M32R_IRQ_INT1].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT1, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT1].icucr = M32R_ICUCR_ISMOD01;
         disable_mappi3_irq(M32R_IRQ_INT1);
 #endif /* CONFIG_USB */
 
         /* CFC IREQ */
-        irq_desc[PLD_IRQ_CFIREQ].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFIREQ].chip = &mappi3_irq_type;
-        irq_desc[PLD_IRQ_CFIREQ].action = 0;
-        irq_desc[PLD_IRQ_CFIREQ].depth = 1;     /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFIREQ, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[PLD_IRQ_CFIREQ].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD01;
         disable_mappi3_irq(PLD_IRQ_CFIREQ);
 
 #if defined(CONFIG_M32R_CFC)
         /* ICUCR41: CFC Insert & eject */
-        irq_desc[PLD_IRQ_CFC_INSERT].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFC_INSERT].chip = &mappi3_irq_type;
-        irq_desc[PLD_IRQ_CFC_INSERT].action = 0;
-        irq_desc[PLD_IRQ_CFC_INSERT].depth = 1; /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFC_INSERT, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[PLD_IRQ_CFC_INSERT].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD00;
         disable_mappi3_irq(PLD_IRQ_CFC_INSERT);
 
 #endif /* CONFIG_M32R_CFC */
 
         /* IDE IREQ */
-        irq_desc[PLD_IRQ_IDEIREQ].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_IDEIREQ].chip = &mappi3_irq_type;
-        irq_desc[PLD_IRQ_IDEIREQ].action = 0;
-        irq_desc[PLD_IRQ_IDEIREQ].depth = 1;    /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_IDEIREQ, &mappi3_irq_type,
+                                 handle_level_irq);
         icu_data[PLD_IRQ_IDEIREQ].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD10;
         disable_mappi3_irq(PLD_IRQ_IDEIREQ);
 
diff --git a/arch/m32r/platforms/oaks32r/setup.c b/arch/m32r/platforms/oaks32r/setup.c
index d11d93bf74f..19a02db7b81 100644
--- a/arch/m32r/platforms/oaks32r/setup.c
+++ b/arch/m32r/platforms/oaks32r/setup.c
@@ -37,39 +37,30 @@ static void enable_oaks32r_irq(unsigned int irq)
         outl(data, port);
 }
 
-static void mask_and_ack_mappi(unsigned int irq)
+static void mask_oaks32r(struct irq_data *data)
 {
-        disable_oaks32r_irq(irq);
+        disable_oaks32r_irq(data->irq);
 }
 
-static void end_oaks32r_irq(unsigned int irq)
+static void unmask_oaks32r(struct irq_data *data)
 {
-        enable_oaks32r_irq(irq);
+        enable_oaks32r_irq(data->irq);
 }
 
-static unsigned int startup_oaks32r_irq(unsigned int irq)
-{
-        enable_oaks32r_irq(irq);
-        return (0);
-}
-
-static void shutdown_oaks32r_irq(unsigned int irq)
+static void shutdown_oaks32r(struct irq_data *data)
 {
         unsigned long port;
 
-        port = irq2port(irq);
+        port = irq2port(data->irq);
         outl(M32R_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip oaks32r_irq_type =
 {
-        .name = "OAKS32R-IRQ",
-        .startup = startup_oaks32r_irq,
-        .shutdown = shutdown_oaks32r_irq,
-        .enable = enable_oaks32r_irq,
-        .disable = disable_oaks32r_irq,
-        .ack = mask_and_ack_mappi,
-        .end = end_oaks32r_irq
+        .name           = "OAKS32R-IRQ",
+        .irq_shutdown   = shutdown_oaks32r,
+        .irq_mask       = mask_oaks32r,
+        .irq_unmask     = unmask_oaks32r,
 };
 
 void __init init_IRQ(void)
@@ -83,52 +74,40 @@ void __init init_IRQ(void)
 
 #ifdef CONFIG_NE2000
         /* INT3 : LAN controller (RTL8019AS) */
-        irq_desc[M32R_IRQ_INT3].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT3].chip = &oaks32r_irq_type;
-        irq_desc[M32R_IRQ_INT3].action = 0;
-        irq_desc[M32R_IRQ_INT3].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT3, &oaks32r_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT3].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD10;
         disable_oaks32r_irq(M32R_IRQ_INT3);
 #endif /* CONFIG_M32R_NE2000 */
 
         /* MFT2 : system timer */
-        irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_MFT2].chip = &oaks32r_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = 0;
-        irq_desc[M32R_IRQ_MFT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_MFT2, &oaks32r_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_oaks32r_irq(M32R_IRQ_MFT2);
 
 #ifdef CONFIG_SERIAL_M32R_SIO
         /* SIO0_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_R].chip = &oaks32r_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = 0;
-        irq_desc[M32R_IRQ_SIO0_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_R, &oaks32r_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_R].icucr = 0;
         disable_oaks32r_irq(M32R_IRQ_SIO0_R);
 
         /* SIO0_S : uart send data */
-        irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_S].chip = &oaks32r_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = 0;
-        irq_desc[M32R_IRQ_SIO0_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_S, &oaks32r_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_S].icucr = 0;
         disable_oaks32r_irq(M32R_IRQ_SIO0_S);
 
         /* SIO1_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO1_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_R].chip = &oaks32r_irq_type;
-        irq_desc[M32R_IRQ_SIO1_R].action = 0;
-        irq_desc[M32R_IRQ_SIO1_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_R, &oaks32r_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_R].icucr = 0;
         disable_oaks32r_irq(M32R_IRQ_SIO1_R);
 
         /* SIO1_S : uart send data */
-        irq_desc[M32R_IRQ_SIO1_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_S].chip = &oaks32r_irq_type;
-        irq_desc[M32R_IRQ_SIO1_S].action = 0;
-        irq_desc[M32R_IRQ_SIO1_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_S, &oaks32r_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_S].icucr = 0;
         disable_oaks32r_irq(M32R_IRQ_SIO1_S);
 #endif /* CONFIG_SERIAL_M32R_SIO */
diff --git a/arch/m32r/platforms/opsput/setup.c b/arch/m32r/platforms/opsput/setup.c
index 5f3402a2fba..12731547e8b 100644
--- a/arch/m32r/platforms/opsput/setup.c
+++ b/arch/m32r/platforms/opsput/setup.c
@@ -46,39 +46,30 @@ static void enable_opsput_irq(unsigned int irq)
         outl(data, port);
 }
 
-static void mask_and_ack_opsput(unsigned int irq)
+static void mask_opsput(struct irq_data *data)
 {
-        disable_opsput_irq(irq);
+        disable_opsput_irq(data->irq);
 }
 
-static void end_opsput_irq(unsigned int irq)
+static void unmask_opsput(struct irq_data *data)
 {
-        enable_opsput_irq(irq);
+        enable_opsput_irq(data->irq);
 }
 
-static unsigned int startup_opsput_irq(unsigned int irq)
-{
-        enable_opsput_irq(irq);
-        return (0);
-}
-
-static void shutdown_opsput_irq(unsigned int irq)
+static void shutdown_opsput(struct irq_data *data)
 {
         unsigned long port;
 
-        port = irq2port(irq);
+        port = irq2port(data->irq);
         outl(M32R_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip opsput_irq_type =
 {
-        .name = "OPSPUT-IRQ",
-        .startup = startup_opsput_irq,
-        .shutdown = shutdown_opsput_irq,
-        .enable = enable_opsput_irq,
-        .disable = disable_opsput_irq,
-        .ack = mask_and_ack_opsput,
-        .end = end_opsput_irq
+        .name           = "OPSPUT-IRQ",
+        .irq_shutdown   = shutdown_opsput,
+        .irq_mask       = mask_opsput,
+        .irq_unmask     = unmask_opsput,
 };
 
 /*
@@ -100,7 +91,6 @@ static void disable_opsput_pld_irq(unsigned int irq)
         unsigned int pldirq;
 
         pldirq = irq2pldirq(irq);
-//      disable_opsput_irq(M32R_IRQ_INT1);
         port = pldirq2port(pldirq);
         data = pld_icu_data[pldirq].icucr|PLD_ICUCR_ILEVEL7;
         outw(data, port);
@@ -112,50 +102,38 @@ static void enable_opsput_pld_irq(unsigned int irq)
         unsigned int pldirq;
 
         pldirq = irq2pldirq(irq);
-//      enable_opsput_irq(M32R_IRQ_INT1);
         port = pldirq2port(pldirq);
         data = pld_icu_data[pldirq].icucr|PLD_ICUCR_IEN|PLD_ICUCR_ILEVEL6;
         outw(data, port);
 }
 
-static void mask_and_ack_opsput_pld(unsigned int irq)
-{
-        disable_opsput_pld_irq(irq);
-//      mask_and_ack_opsput(M32R_IRQ_INT1);
-}
-
-static void end_opsput_pld_irq(unsigned int irq)
+static void mask_opsput_pld(struct irq_data *data)
 {
-        enable_opsput_pld_irq(irq);
-        end_opsput_irq(M32R_IRQ_INT1);
+        disable_opsput_pld_irq(data->irq);
 }
 
-static unsigned int startup_opsput_pld_irq(unsigned int irq)
+static void unmask_opsput_pld(struct irq_data *data)
 {
-        enable_opsput_pld_irq(irq);
-        return (0);
+        enable_opsput_pld_irq(data->irq);
+        enable_opsput_irq(M32R_IRQ_INT1);
 }
 
-static void shutdown_opsput_pld_irq(unsigned int irq)
+static void shutdown_opsput_pld(struct irq_data *data)
 {
         unsigned long port;
         unsigned int pldirq;
 
-        pldirq = irq2pldirq(irq);
-//      shutdown_opsput_irq(M32R_IRQ_INT1);
+        pldirq = irq2pldirq(data->irq);
         port = pldirq2port(pldirq);
         outw(PLD_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip opsput_pld_irq_type =
 {
-        .name = "OPSPUT-PLD-IRQ",
-        .startup = startup_opsput_pld_irq,
-        .shutdown = shutdown_opsput_pld_irq,
-        .enable = enable_opsput_pld_irq,
-        .disable = disable_opsput_pld_irq,
-        .ack = mask_and_ack_opsput_pld,
-        .end = end_opsput_pld_irq
+        .name           = "OPSPUT-PLD-IRQ",
+        .irq_shutdown   = shutdown_opsput_pld,
+        .irq_mask       = mask_opsput_pld,
+        .irq_unmask     = unmask_opsput_pld,
 };
 
 /*
@@ -189,42 +167,33 @@ static void enable_opsput_lanpld_irq(unsigned int irq)
         outw(data, port);
 }
 
-static void mask_and_ack_opsput_lanpld(unsigned int irq)
-{
-        disable_opsput_lanpld_irq(irq);
-}
-
-static void end_opsput_lanpld_irq(unsigned int irq)
+static void mask_opsput_lanpld(struct irq_data *data)
 {
-        enable_opsput_lanpld_irq(irq);
-        end_opsput_irq(M32R_IRQ_INT0);
+        disable_opsput_lanpld_irq(data->irq);
 }
 
-static unsigned int startup_opsput_lanpld_irq(unsigned int irq)
+static void unmask_opsput_lanpld(struct irq_data *data)
 {
-        enable_opsput_lanpld_irq(irq);
-        return (0);
+        enable_opsput_lanpld_irq(data->irq);
+        enable_opsput_irq(M32R_IRQ_INT0);
 }
 
-static void shutdown_opsput_lanpld_irq(unsigned int irq)
+static void shutdown_opsput_lanpld(struct irq_data *data)
 {
         unsigned long port;
         unsigned int pldirq;
 
-        pldirq = irq2lanpldirq(irq);
+        pldirq = irq2lanpldirq(data->irq);
         port = lanpldirq2port(pldirq);
         outw(PLD_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip opsput_lanpld_irq_type =
 {
-        .name = "OPSPUT-PLD-LAN-IRQ",
-        .startup = startup_opsput_lanpld_irq,
-        .shutdown = shutdown_opsput_lanpld_irq,
-        .enable = enable_opsput_lanpld_irq,
-        .disable = disable_opsput_lanpld_irq,
-        .ack = mask_and_ack_opsput_lanpld,
-        .end = end_opsput_lanpld_irq
+        .name           = "OPSPUT-PLD-LAN-IRQ",
+        .irq_shutdown   = shutdown_opsput_lanpld,
+        .irq_mask       = mask_opsput_lanpld,
+        .irq_unmask     = unmask_opsput_lanpld,
 };
 
 /*
@@ -258,143 +227,109 @@ static void enable_opsput_lcdpld_irq(unsigned int irq)
         outw(data, port);
 }
 
-static void mask_and_ack_opsput_lcdpld(unsigned int irq)
-{
-        disable_opsput_lcdpld_irq(irq);
-}
-
-static void end_opsput_lcdpld_irq(unsigned int irq)
+static void mask_opsput_lcdpld(struct irq_data *data)
 {
-        enable_opsput_lcdpld_irq(irq);
-        end_opsput_irq(M32R_IRQ_INT2);
+        disable_opsput_lcdpld_irq(data->irq);
 }
 
-static unsigned int startup_opsput_lcdpld_irq(unsigned int irq)
+static void unmask_opsput_lcdpld(struct irq_data *data)
 {
-        enable_opsput_lcdpld_irq(irq);
-        return (0);
+        enable_opsput_lcdpld_irq(data->irq);
+        enable_opsput_irq(M32R_IRQ_INT2);
 }
 
-static void shutdown_opsput_lcdpld_irq(unsigned int irq)
+static void shutdown_opsput_lcdpld(struct irq_data *data)
 {
         unsigned long port;
         unsigned int pldirq;
 
-        pldirq = irq2lcdpldirq(irq);
+        pldirq = irq2lcdpldirq(data->irq);
         port = lcdpldirq2port(pldirq);
         outw(PLD_ICUCR_ILEVEL7, port);
 }
 
-static struct irq_chip opsput_lcdpld_irq_type =
-{
-        "OPSPUT-PLD-LCD-IRQ",
-        startup_opsput_lcdpld_irq,
-        shutdown_opsput_lcdpld_irq,
-        enable_opsput_lcdpld_irq,
-        disable_opsput_lcdpld_irq,
-        mask_and_ack_opsput_lcdpld,
-        end_opsput_lcdpld_irq
+static struct irq_chip opsput_lcdpld_irq_type = {
+        .name           = "OPSPUT-PLD-LCD-IRQ",
+        .irq_shutdown   = shutdown_opsput_lcdpld,
+        .irq_mask       = mask_opsput_lcdpld,
+        .irq_unmask     = unmask_opsput_lcdpld,
 };
 
 void __init init_IRQ(void)
 {
 #if defined(CONFIG_SMC91X)
         /* INT#0: LAN controller on OPSPUT-LAN (SMC91C111)*/
-        irq_desc[OPSPUT_LAN_IRQ_LAN].status = IRQ_DISABLED;
-        irq_desc[OPSPUT_LAN_IRQ_LAN].chip = &opsput_lanpld_irq_type;
-        irq_desc[OPSPUT_LAN_IRQ_LAN].action = 0;
-        irq_desc[OPSPUT_LAN_IRQ_LAN].depth = 1; /* disable nested irq */
+        set_irq_chip_and_handler(OPSPUT_LAN_IRQ_LAN, &opsput_lanpld_irq_type,
+                                 handle_level_irq);
         lanpld_icu_data[irq2lanpldirq(OPSPUT_LAN_IRQ_LAN)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD02;     /* "H" edge sense */
         disable_opsput_lanpld_irq(OPSPUT_LAN_IRQ_LAN);
 #endif  /* CONFIG_SMC91X */
 
         /* MFT2 : system timer */
-        irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_MFT2].chip = &opsput_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = 0;
-        irq_desc[M32R_IRQ_MFT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_MFT2, &opsput_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_opsput_irq(M32R_IRQ_MFT2);
 
         /* SIO0 : receive */
-        irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_R].chip = &opsput_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = 0;
-        irq_desc[M32R_IRQ_SIO0_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_R, &opsput_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_R].icucr = 0;
         disable_opsput_irq(M32R_IRQ_SIO0_R);
 
         /* SIO0 : send */
-        irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_S].chip = &opsput_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = 0;
-        irq_desc[M32R_IRQ_SIO0_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_S, &opsput_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_S].icucr = 0;
         disable_opsput_irq(M32R_IRQ_SIO0_S);
 
         /* SIO1 : receive */
-        irq_desc[M32R_IRQ_SIO1_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_R].chip = &opsput_irq_type;
-        irq_desc[M32R_IRQ_SIO1_R].action = 0;
-        irq_desc[M32R_IRQ_SIO1_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_R, &opsput_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_R].icucr = 0;
         disable_opsput_irq(M32R_IRQ_SIO1_R);
 
         /* SIO1 : send */
-        irq_desc[M32R_IRQ_SIO1_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_S].chip = &opsput_irq_type;
-        irq_desc[M32R_IRQ_SIO1_S].action = 0;
-        irq_desc[M32R_IRQ_SIO1_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_S, &opsput_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_S].icucr = 0;
         disable_opsput_irq(M32R_IRQ_SIO1_S);
 
         /* DMA1 : */
-        irq_desc[M32R_IRQ_DMA1].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_DMA1].chip = &opsput_irq_type;
-        irq_desc[M32R_IRQ_DMA1].action = 0;
-        irq_desc[M32R_IRQ_DMA1].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_DMA1, &opsput_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_DMA1].icucr = 0;
         disable_opsput_irq(M32R_IRQ_DMA1);
 
 #ifdef CONFIG_SERIAL_M32R_PLDSIO
         /* INT#1: SIO0 Receive on PLD */
-        irq_desc[PLD_IRQ_SIO0_RCV].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_SIO0_RCV].chip = &opsput_pld_irq_type;
-        irq_desc[PLD_IRQ_SIO0_RCV].action = 0;
-        irq_desc[PLD_IRQ_SIO0_RCV].depth = 1;   /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_SIO0_RCV, &opsput_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_SIO0_RCV)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD03;
         disable_opsput_pld_irq(PLD_IRQ_SIO0_RCV);
 
         /* INT#1: SIO0 Send on PLD */
-        irq_desc[PLD_IRQ_SIO0_SND].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_SIO0_SND].chip = &opsput_pld_irq_type;
-        irq_desc[PLD_IRQ_SIO0_SND].action = 0;
-        irq_desc[PLD_IRQ_SIO0_SND].depth = 1;   /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_SIO0_SND, &opsput_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_SIO0_SND)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD03;
         disable_opsput_pld_irq(PLD_IRQ_SIO0_SND);
 #endif  /* CONFIG_SERIAL_M32R_PLDSIO */
 
         /* INT#1: CFC IREQ on PLD */
-        irq_desc[PLD_IRQ_CFIREQ].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFIREQ].chip = &opsput_pld_irq_type;
-        irq_desc[PLD_IRQ_CFIREQ].action = 0;
-        irq_desc[PLD_IRQ_CFIREQ].depth = 1;     /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFIREQ, &opsput_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_CFIREQ)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD01;       /* 'L' level sense */
         disable_opsput_pld_irq(PLD_IRQ_CFIREQ);
 
         /* INT#1: CFC Insert on PLD */
-        irq_desc[PLD_IRQ_CFC_INSERT].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFC_INSERT].chip = &opsput_pld_irq_type;
-        irq_desc[PLD_IRQ_CFC_INSERT].action = 0;
-        irq_desc[PLD_IRQ_CFC_INSERT].depth = 1; /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFC_INSERT, &opsput_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_CFC_INSERT)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD00;   /* 'L' edge sense */
         disable_opsput_pld_irq(PLD_IRQ_CFC_INSERT);
 
         /* INT#1: CFC Eject on PLD */
-        irq_desc[PLD_IRQ_CFC_EJECT].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_CFC_EJECT].chip = &opsput_pld_irq_type;
-        irq_desc[PLD_IRQ_CFC_EJECT].action = 0;
-        irq_desc[PLD_IRQ_CFC_EJECT].depth = 1;  /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_CFC_EJECT, &opsput_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_CFC_EJECT)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD02;    /* 'H' edge sense */
         disable_opsput_pld_irq(PLD_IRQ_CFC_EJECT);
 
@@ -413,14 +348,11 @@ void __init init_IRQ(void)
         enable_opsput_irq(M32R_IRQ_INT1);
 
 #if defined(CONFIG_USB)
-        outw(USBCR_OTGS, USBCR);        /* USBCR: non-OTG */
-
-    irq_desc[OPSPUT_LCD_IRQ_USB_INT1].status = IRQ_DISABLED;
-    irq_desc[OPSPUT_LCD_IRQ_USB_INT1].chip = &opsput_lcdpld_irq_type;
-    irq_desc[OPSPUT_LCD_IRQ_USB_INT1].action = 0;
-    irq_desc[OPSPUT_LCD_IRQ_USB_INT1].depth = 1;
-    lcdpld_icu_data[irq2lcdpldirq(OPSPUT_LCD_IRQ_USB_INT1)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD01;    /* "L" level sense */
-    disable_opsput_lcdpld_irq(OPSPUT_LCD_IRQ_USB_INT1);
+        outw(USBCR_OTGS, USBCR);        /* USBCR: non-OTG */
+        set_irq_chip_and_handler(OPSPUT_LCD_IRQ_USB_INT1,
+                                 &opsput_lcdpld_irq_type, handle_level_irq);
+        lcdpld_icu_data[irq2lcdpldirq(OPSPUT_LCD_IRQ_USB_INT1)].icucr = PLD_ICUCR_IEN|PLD_ICUCR_ISMOD01;        /* "L" level sense */
+        disable_opsput_lcdpld_irq(OPSPUT_LCD_IRQ_USB_INT1);
 #endif
         /*
          * INT2# is used for BAT, USB, AUDIO
@@ -433,10 +365,8 @@ void __init init_IRQ(void)
         /*
          * INT3# is used for AR
          */
-        irq_desc[M32R_IRQ_INT3].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_INT3].chip = &opsput_irq_type;
-        irq_desc[M32R_IRQ_INT3].action = 0;
-        irq_desc[M32R_IRQ_INT3].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_INT3, &opsput_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_INT3].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD10;
         disable_opsput_irq(M32R_IRQ_INT3);
 #endif /* CONFIG_VIDEO_M32R_AR */
diff --git a/arch/m32r/platforms/usrv/setup.c b/arch/m32r/platforms/usrv/setup.c
index 1beac7a51ed..f3cff26d6e7 100644
--- a/arch/m32r/platforms/usrv/setup.c
+++ b/arch/m32r/platforms/usrv/setup.c
@@ -37,39 +37,30 @@ static void enable_mappi_irq(unsigned int irq)
         outl(data, port);
 }
 
-static void mask_and_ack_mappi(unsigned int irq)
+static void mask_mappi(struct irq_data *data)
 {
-        disable_mappi_irq(irq);
+        disable_mappi_irq(data->irq);
 }
 
-static void end_mappi_irq(unsigned int irq)
+static void unmask_mappi(struct irq_data *data)
 {
-        enable_mappi_irq(irq);
+        enable_mappi_irq(data->irq);
 }
 
-static unsigned int startup_mappi_irq(unsigned int irq)
-{
-        enable_mappi_irq(irq);
-        return 0;
-}
-
-static void shutdown_mappi_irq(unsigned int irq)
+static void shutdown_mappi(struct irq_data *data)
 {
         unsigned long port;
 
-        port = irq2port(irq);
+        port = irq2port(data->irq);
         outl(M32R_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip mappi_irq_type =
 {
-        .name = "M32700-IRQ",
-        .startup = startup_mappi_irq,
-        .shutdown = shutdown_mappi_irq,
-        .enable = enable_mappi_irq,
-        .disable = disable_mappi_irq,
-        .ack = mask_and_ack_mappi,
-        .end = end_mappi_irq
+        .name           = "M32700-IRQ",
+        .irq_shutdown   = shutdown_mappi,
+        .irq_mask       = mask_mappi,
+        .irq_unmask     = unmask_mappi,
 };
 
 /*
@@ -107,42 +98,33 @@ static void enable_m32700ut_pld_irq(unsigned int irq)
         outw(data, port);
 }
 
-static void mask_and_ack_m32700ut_pld(unsigned int irq)
+static void mask_m32700ut_pld(struct irq_data *data)
 {
-        disable_m32700ut_pld_irq(irq);
+        disable_m32700ut_pld_irq(data->irq);
 }
 
-static void end_m32700ut_pld_irq(unsigned int irq)
+static void unmask_m32700ut_pld(struct irq_data *data)
 {
-        enable_m32700ut_pld_irq(irq);
-        end_mappi_irq(M32R_IRQ_INT1);
-}
-
-static unsigned int startup_m32700ut_pld_irq(unsigned int irq)
-{
-        enable_m32700ut_pld_irq(irq);
-        return 0;
+        enable_m32700ut_pld_irq(data->irq);
+        enable_mappi_irq(M32R_IRQ_INT1);
 }
 
-static void shutdown_m32700ut_pld_irq(unsigned int irq)
+static void shutdown_m32700ut_pld(struct irq_data *data)
 {
         unsigned long port;
         unsigned int pldirq;
 
-        pldirq = irq2pldirq(irq);
+        pldirq = irq2pldirq(data->irq);
         port = pldirq2port(pldirq);
         outw(PLD_ICUCR_ILEVEL7, port);
 }
 
 static struct irq_chip m32700ut_pld_irq_type =
 {
-        .name = "USRV-PLD-IRQ",
-        .startup = startup_m32700ut_pld_irq,
-        .shutdown = shutdown_m32700ut_pld_irq,
-        .enable = enable_m32700ut_pld_irq,
-        .disable = disable_m32700ut_pld_irq,
-        .ack = mask_and_ack_m32700ut_pld,
-        .end = end_m32700ut_pld_irq
+        .name           = "USRV-PLD-IRQ",
+        .irq_shutdown   = shutdown_m32700ut_pld,
+        .irq_mask       = mask_m32700ut_pld,
+        .irq_unmask     = unmask_m32700ut_pld,
 };
 
 void __init init_IRQ(void)
@@ -156,53 +138,42 @@ void __init init_IRQ(void)
                 once++;
 
         /* MFT2 : system timer */
-        irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_MFT2].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = 0;
-        irq_desc[M32R_IRQ_MFT2].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_MFT2, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_mappi_irq(M32R_IRQ_MFT2);
 
 #if defined(CONFIG_SERIAL_M32R_SIO)
         /* SIO0_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_R].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = 0;
-        irq_desc[M32R_IRQ_SIO0_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_R, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_R].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO0_R);
 
         /* SIO0_S : uart send data */
-        irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO0_S].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = 0;
-        irq_desc[M32R_IRQ_SIO0_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO0_S, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO0_S].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO0_S);
 
         /* SIO1_R : uart receive data */
-        irq_desc[M32R_IRQ_SIO1_R].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_R].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO1_R].action = 0;
-        irq_desc[M32R_IRQ_SIO1_R].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_R, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_R].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO1_R);
 
         /* SIO1_S : uart send data */
-        irq_desc[M32R_IRQ_SIO1_S].status = IRQ_DISABLED;
-        irq_desc[M32R_IRQ_SIO1_S].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO1_S].action = 0;
-        irq_desc[M32R_IRQ_SIO1_S].depth = 1;
+        set_irq_chip_and_handler(M32R_IRQ_SIO1_S, &mappi_irq_type,
+                                 handle_level_irq);
         icu_data[M32R_IRQ_SIO1_S].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO1_S);
 #endif  /* CONFIG_SERIAL_M32R_SIO */
 
         /* INT#67-#71: CFC#0 IREQ on PLD */
         for (i = 0 ; i < CONFIG_M32R_CFC_NUM ; i++ ) {
-                irq_desc[PLD_IRQ_CF0 + i].status = IRQ_DISABLED;
-                irq_desc[PLD_IRQ_CF0 + i].chip = &m32700ut_pld_irq_type;
-                irq_desc[PLD_IRQ_CF0 + i].action = 0;
-                irq_desc[PLD_IRQ_CF0 + i].depth = 1;    /* disable nested irq */
+                set_irq_chip_and_handler(PLD_IRQ_CF0 + i,
+                                         &m32700ut_pld_irq_type,
+                                         handle_level_irq);
                 pld_icu_data[irq2pldirq(PLD_IRQ_CF0 + i)].icucr
                         = PLD_ICUCR_ISMOD01;    /* 'L' level sense */
                 disable_m32700ut_pld_irq(PLD_IRQ_CF0 + i);
@@ -210,19 +181,15 @@ void __init init_IRQ(void)
 
 #if defined(CONFIG_SERIAL_8250) || defined(CONFIG_SERIAL_8250_MODULE)
         /* INT#76: 16552D#0 IREQ on PLD */
-        irq_desc[PLD_IRQ_UART0].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_UART0].chip = &m32700ut_pld_irq_type;
-        irq_desc[PLD_IRQ_UART0].action = 0;
-        irq_desc[PLD_IRQ_UART0].depth = 1;      /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_UART0, &m32700ut_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_UART0)].icucr
                 = PLD_ICUCR_ISMOD03;    /* 'H' level sense */
         disable_m32700ut_pld_irq(PLD_IRQ_UART0);
 
         /* INT#77: 16552D#1 IREQ on PLD */
-        irq_desc[PLD_IRQ_UART1].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_UART1].chip = &m32700ut_pld_irq_type;
-        irq_desc[PLD_IRQ_UART1].action = 0;
-        irq_desc[PLD_IRQ_UART1].depth = 1;      /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_UART1, &m32700ut_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_UART1)].icucr
                 = PLD_ICUCR_ISMOD03;    /* 'H' level sense */
         disable_m32700ut_pld_irq(PLD_IRQ_UART1);
@@ -230,10 +197,8 @@ void __init init_IRQ(void)
 
 #if defined(CONFIG_IDC_AK4524) || defined(CONFIG_IDC_AK4524_MODULE)
         /* INT#80: AK4524 IREQ on PLD */
-        irq_desc[PLD_IRQ_SNDINT].status = IRQ_DISABLED;
-        irq_desc[PLD_IRQ_SNDINT].chip = &m32700ut_pld_irq_type;
-        irq_desc[PLD_IRQ_SNDINT].action = 0;
-        irq_desc[PLD_IRQ_SNDINT].depth = 1;     /* disable nested irq */
+        set_irq_chip_and_handler(PLD_IRQ_SNDINT, &m32700ut_pld_irq_type,
+                                 handle_level_irq);
         pld_icu_data[irq2pldirq(PLD_IRQ_SNDINT)].icucr
                 = PLD_ICUCR_ISMOD01;    /* 'L' level sense */
         disable_m32700ut_pld_irq(PLD_IRQ_SNDINT);
diff --git a/arch/m68k/amiga/config.c b/arch/m68k/amiga/config.c
index b1577f741fa..82a4bb51d5d 100644
--- a/arch/m68k/amiga/config.c
+++ b/arch/m68k/amiga/config.c
@@ -610,17 +610,17 @@ static void amiga_mem_console_write(struct console *co, const char *s,
 
 static int __init amiga_savekmsg_setup(char *arg)
 {
-        static struct resource debug_res = { .name = "Debug" };
-
         if (!MACH_IS_AMIGA || strcmp(arg, "mem"))
-                goto done;
+                return 0;
 
-        if (!AMIGAHW_PRESENT(CHIP_RAM)) {
-                printk("Warning: no chipram present for debugging\n");
-                goto done;
+        if (amiga_chip_size < SAVEKMSG_MAXMEM) {
+                pr_err("Not enough chipram for debugging\n");
+                return -ENOMEM;
         }
 
-        savekmsg = amiga_chip_alloc_res(SAVEKMSG_MAXMEM, &debug_res);
+        /* Just steal the block, the chipram allocator isn't functional yet */
+        amiga_chip_size -= SAVEKMSG_MAXMEM;
+        savekmsg = (void *)ZTWO_VADDR(CHIP_PHYSADDR + amiga_chip_size);
         savekmsg->magic1 = SAVEKMSG_MAGIC1;
         savekmsg->magic2 = SAVEKMSG_MAGIC2;
         savekmsg->magicptr = ZTWO_PADDR(savekmsg);
@@ -628,8 +628,6 @@ static int __init amiga_savekmsg_setup(char *arg)
 
         amiga_console_driver.write = amiga_mem_console_write;
         register_console(&amiga_console_driver);
-
-done:
         return 0;
 }
 
diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
index 39478dd08e6..26a804e67bc 100644
--- a/arch/m68k/atari/ataints.c
+++ b/arch/m68k/atari/ataints.c
@@ -388,9 +388,9 @@ void __init atari_init_IRQ(void)
         }
 
         if (ATARIHW_PRESENT(SCC) && !atari_SCC_reset_done) {
-                scc.cha_a_ctrl = 9;
+                atari_scc.cha_a_ctrl = 9;
                 MFPDELAY();
-                scc.cha_a_ctrl = (char) 0xc0; /* hardware reset */
+                atari_scc.cha_a_ctrl = (char) 0xc0; /* hardware reset */
         }
 
         if (ATARIHW_PRESENT(SCU)) {
diff --git a/arch/m68k/atari/config.c b/arch/m68k/atari/config.c
index ae2d96e5d61..4203d101363 100644
--- a/arch/m68k/atari/config.c
+++ b/arch/m68k/atari/config.c
@@ -315,7 +315,7 @@ void __init config_atari(void)
                 ATARIHW_SET(SCC_DMA);
                 printk("SCC_DMA ");
         }
-        if (scc_test(&scc.cha_a_ctrl)) {
+        if (scc_test(&atari_scc.cha_a_ctrl)) {
                 ATARIHW_SET(SCC);
                 printk("SCC ");
         }
diff --git a/arch/m68k/atari/debug.c b/arch/m68k/atari/debug.c
index 28efdc33c1a..5a484247e49 100644
--- a/arch/m68k/atari/debug.c
+++ b/arch/m68k/atari/debug.c
@@ -53,9 +53,9 @@ static inline void ata_scc_out(char c)
 {
         do {
                 MFPDELAY();
-        } while (!(scc.cha_b_ctrl & 0x04)); /* wait for tx buf empty */
+        } while (!(atari_scc.cha_b_ctrl & 0x04)); /* wait for tx buf empty */
         MFPDELAY();
-        scc.cha_b_data = c;
+        atari_scc.cha_b_data = c;
 }
 
 static void atari_scc_console_write(struct console *co, const char *str,
@@ -140,9 +140,9 @@ int atari_scc_console_wait_key(struct console *co)
 {
         do {
                 MFPDELAY();
-        } while (!(scc.cha_b_ctrl & 0x01)); /* wait for rx buf filled */
+        } while (!(atari_scc.cha_b_ctrl & 0x01)); /* wait for rx buf filled */
         MFPDELAY();
-        return scc.cha_b_data;
+        return atari_scc.cha_b_data;
 }
 
 int atari_midi_console_wait_key(struct console *co)
@@ -185,9 +185,9 @@ static void __init atari_init_mfp_port(int cflag)
 
 #define SCC_WRITE(reg, val)                             \
         do {                                            \
-                scc.cha_b_ctrl = (reg);                 \
+                atari_scc.cha_b_ctrl = (reg);           \
                 MFPDELAY();                             \
-                scc.cha_b_ctrl = (val);                 \
+                atari_scc.cha_b_ctrl = (val);           \
                 MFPDELAY();                             \
         } while (0)
 
@@ -240,7 +240,7 @@ static void __init atari_init_scc_port(int cflag)
         reg3 = (cflag & CSIZE) == CS8 ? 0xc0 : 0x40;
         reg5 = (cflag & CSIZE) == CS8 ? 0x60 : 0x20 | 0x82 /* assert DTR/RTS */;
 
-        (void)scc.cha_b_ctrl;           /* reset reg pointer */
+        (void)atari_scc.cha_b_ctrl;     /* reset reg pointer */
         SCC_WRITE(9, 0xc0);             /* reset */
         LONG_DELAY();                   /* extra delay after WR9 access */
         SCC_WRITE(4, (cflag & PARENB) ? ((cflag & PARODD) ? 0x01 : 0x03)
diff --git a/arch/m68k/include/asm/atarihw.h b/arch/m68k/include/asm/atarihw.h
index a714e1aa072..f51f709bbf3 100644
--- a/arch/m68k/include/asm/atarihw.h
+++ b/arch/m68k/include/asm/atarihw.h
@@ -449,7 +449,7 @@ struct SCC
   u_char char_dummy3;
   u_char cha_b_data;
  };
-# define scc ((*(volatile struct SCC*)SCC_BAS))
+# define atari_scc ((*(volatile struct SCC*)SCC_BAS))
 
 /* The ESCC (Z85230) in an Atari ST. The channels are reversed! */
 # define st_escc ((*(volatile struct SCC*)0xfffffa31))
diff --git a/arch/m68k/include/asm/string.h b/arch/m68k/include/asm/string.h
index 2936dda938d..65b13128283 100644
--- a/arch/m68k/include/asm/string.h
+++ b/arch/m68k/include/asm/string.h
@@ -81,18 +81,6 @@ static inline char *strncpy(char *dest, const char *src, size_t n)
         strcpy(__d + strlen(__d), (s));         \
 })
 
-#define __HAVE_ARCH_STRCHR
-static inline char *strchr(const char *s, int c)
-{
-        char sc, ch = c;
-
-        for (; (sc = *s++) != ch; ) {
-                if (!sc)
-                        return NULL;
-        }
-        return (char *)s - 1;
-}
-
 #ifndef CONFIG_COLDFIRE
 #define __HAVE_ARCH_STRCMP
 static inline int strcmp(const char *cs, const char *ct)
diff --git a/arch/m68knommu/Kconfig b/arch/m68knommu/Kconfig
index 704e7b92334..8b9dacaa0f6 100644
--- a/arch/m68knommu/Kconfig
+++ b/arch/m68knommu/Kconfig
@@ -2,6 +2,7 @@ config M68K
         bool
         default y
         select HAVE_IDE
+        select HAVE_GENERIC_HARDIRQS
 
 config MMU
         bool
@@ -48,14 +49,6 @@ config GENERIC_HWEIGHT
         bool
         default y
 
-config GENERIC_HARDIRQS
-        bool
-        default y
-
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        bool
-        default y
-
 config GENERIC_CALIBRATE_DELAY
         bool
         default y
diff --git a/arch/m68knommu/configs/m5208evb_defconfig b/arch/m68knommu/configs/m5208evb_defconfig
index 6ac2981a2cd..2f5655c577a 100644
--- a/arch/m68knommu/configs/m5208evb_defconfig
+++ b/arch/m68knommu/configs/m5208evb_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/m68knommu/configs/m5249evb_defconfig b/arch/m68knommu/configs/m5249evb_defconfig
index 14934ff8d5c..16df72bfbd4 100644
--- a/arch/m68knommu/configs/m5249evb_defconfig
+++ b/arch/m68knommu/configs/m5249evb_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/m68knommu/configs/m5272c3_defconfig b/arch/m68knommu/configs/m5272c3_defconfig
index 5985a3b593d..4e6ea50c7f3 100644
--- a/arch/m68knommu/configs/m5272c3_defconfig
+++ b/arch/m68knommu/configs/m5272c3_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/m68knommu/configs/m5275evb_defconfig b/arch/m68knommu/configs/m5275evb_defconfig
index 5a7857efb45..f3dd74115a3 100644
--- a/arch/m68knommu/configs/m5275evb_defconfig
+++ b/arch/m68knommu/configs/m5275evb_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/m68knommu/configs/m5307c3_defconfig b/arch/m68knommu/configs/m5307c3_defconfig
index e8102018c8d..bce0a20c373 100644
--- a/arch/m68knommu/configs/m5307c3_defconfig
+++ b/arch/m68knommu/configs/m5307c3_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/m68knommu/configs/m5407c3_defconfig b/arch/m68knommu/configs/m5407c3_defconfig
index 5c124a7ba2a..618cc32691f 100644
--- a/arch/m68knommu/configs/m5407c3_defconfig
+++ b/arch/m68knommu/configs/m5407c3_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/m68knommu/defconfig b/arch/m68knommu/defconfig
index 6ac2981a2cd..2f5655c577a 100644
--- a/arch/m68knommu/defconfig
+++ b/arch/m68knommu/defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 5f5018a71a3..31680032053 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -15,6 +15,8 @@ config MICROBLAZE
         select TRACING_SUPPORT
         select OF
         select OF_EARLY_FLATTREE
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_IRQ_PROBE
 
 config SWAP
         def_bool n
@@ -37,12 +39,6 @@ config GENERIC_FIND_NEXT_BIT
 config GENERIC_HWEIGHT
         def_bool y
 
-config GENERIC_HARDIRQS
-        def_bool y
-
-config GENERIC_IRQ_PROBE
-        def_bool y
-
 config GENERIC_CALIBRATE_DELAY
         def_bool y
 
@@ -52,9 +48,6 @@ config GENERIC_TIME_VSYSCALL
 config GENERIC_CLOCKEVENTS
         def_bool y
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
 config GENERIC_GPIO
         def_bool y
 
diff --git a/arch/microblaze/configs/mmu_defconfig b/arch/microblaze/configs/mmu_defconfig
index ab8fbe7ad90..b3f5eecff2a 100644
--- a/arch/microblaze/configs/mmu_defconfig
+++ b/arch/microblaze/configs/mmu_defconfig
@@ -7,7 +7,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE="rootfs.cpio"
 CONFIG_INITRAMFS_COMPRESSION_GZIP=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 # CONFIG_HOTPLUG is not set
diff --git a/arch/microblaze/configs/nommu_defconfig b/arch/microblaze/configs/nommu_defconfig
index ebc143c5368..0249e4b7e1d 100644
--- a/arch/microblaze/configs/nommu_defconfig
+++ b/arch/microblaze/configs/nommu_defconfig
@@ -6,7 +6,7 @@ CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 # CONFIG_HOTPLUG is not set
diff --git a/arch/microblaze/kernel/head.S b/arch/microblaze/kernel/head.S
index 42434008209..0db20b5abb5 100644
--- a/arch/microblaze/kernel/head.S
+++ b/arch/microblaze/kernel/head.S
@@ -77,8 +77,18 @@ real_start:
    We ensure r7 points to a valid FDT, just in case the bootloader
    is broken or non-existent */
         beqi    r7, no_fdt_arg                  /* NULL pointer?  don't copy */
-        lw      r11, r0, r7                     /* Does r7 point to a */
-        rsubi   r11, r11, OF_DT_HEADER          /* valid FDT? */
+/* Does r7 point to a valid FDT? Load HEADER magic number */
+        /* Run time Big/Little endian platform */
+        /* Save 1 as word and load byte - 0 - BIG, 1 - LITTLE */
+        addik   r11, r0, 0x1 /* BIG/LITTLE checking value */
+        /* __bss_start will be zeroed later - it is just temp location */
+        swi     r11, r0, TOPHYS(__bss_start)
+        lbui    r11, r0, TOPHYS(__bss_start)
+        beqid   r11, big_endian /* DO NOT break delay stop dependency */
+        lw      r11, r0, r7 /* Big endian load in delay slot */
+        lwr     r11, r0, r7 /* Little endian load */
+big_endian:
+        rsubi   r11, r11, OF_DT_HEADER  /* Check FDT header */
         beqi    r11, _prepare_copy_fdt
         or      r7, r0, r0              /* clear R7 when not valid DTB */
         bnei    r11, no_fdt_arg                 /* No - get out of here */
diff --git a/arch/microblaze/kernel/hw_exception_handler.S b/arch/microblaze/kernel/hw_exception_handler.S
index 25f6e07d8de..782680de312 100644
--- a/arch/microblaze/kernel/hw_exception_handler.S
+++ b/arch/microblaze/kernel/hw_exception_handler.S
@@ -147,10 +147,6 @@
         #if CONFIG_XILINX_MICROBLAZE0_USE_BARREL > 0
         #define BSRLI(rD, rA, imm)      \
                 bsrli rD, rA, imm
-        #elif CONFIG_XILINX_MICROBLAZE0_USE_DIV > 0
-        #define BSRLI(rD, rA, imm)      \
-                ori rD, r0, (1 << imm); \
-                idivu rD, rD, rA
         #else
         #define BSRLI(rD, rA, imm) BSRLI ## imm (rD, rA)
         /* Only the used shift constants defined here - add more if needed */
diff --git a/arch/microblaze/lib/fastcopy.S b/arch/microblaze/lib/fastcopy.S
index fdc48bb065d..62021d7e249 100644
--- a/arch/microblaze/lib/fastcopy.S
+++ b/arch/microblaze/lib/fastcopy.S
@@ -29,6 +29,10 @@
  *      between mem locations with size of xfer spec'd in bytes
  */
 
+#ifdef __MICROBLAZEEL__
+#error Microblaze LE not support ASM optimized lib func. Disable OPT_LIB_ASM.
+#endif
+
 #include <linux/linkage.h>
         .text
         .globl  memcpy
diff --git a/arch/mips/Kbuild.platforms b/arch/mips/Kbuild.platforms
index 78439b8a83c..7ff9b549204 100644
--- a/arch/mips/Kbuild.platforms
+++ b/arch/mips/Kbuild.platforms
@@ -2,6 +2,7 @@
 
 platforms += alchemy
 platforms += ar7
+platforms += ath79
 platforms += bcm47xx
 platforms += bcm63xx
 platforms += cavium-octeon
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index f489ec30e07..f5ecc0566bc 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -21,6 +21,7 @@ config MIPS
         select HAVE_DMA_API_DEBUG
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_IRQ_PROBE
+        select HAVE_ARCH_JUMP_LABEL
 
 menu "Machine selection"
 
@@ -65,6 +66,22 @@ config AR7
           Support for the Texas Instruments AR7 System-on-a-Chip
           family: TNETD7100, 7200 and 7300.
 
+config ATH79
+        bool "Atheros AR71XX/AR724X/AR913X based boards"
+        select ARCH_REQUIRE_GPIOLIB
+        select BOOT_RAW
+        select CEVT_R4K
+        select CSRC_R4K
+        select DMA_NONCOHERENT
+        select IRQ_CPU
+        select MIPS_MACHINE
+        select SYS_HAS_CPU_MIPS32_R2
+        select SYS_HAS_EARLY_PRINTK
+        select SYS_SUPPORTS_32BIT_KERNEL
+        select SYS_SUPPORTS_BIG_ENDIAN
+        help
+          Support for the Atheros AR71XX/AR724X/AR913X SoCs.
+
 config BCM47XX
         bool "Broadcom BCM47XX based boards"
         select CEVT_R4K
@@ -717,6 +734,7 @@ config CAVIUM_OCTEON_REFERENCE_BOARD
 endchoice
 
 source "arch/mips/alchemy/Kconfig"
+source "arch/mips/ath79/Kconfig"
 source "arch/mips/bcm63xx/Kconfig"
 source "arch/mips/jazz/Kconfig"
 source "arch/mips/jz4740/Kconfig"
@@ -775,9 +793,6 @@ config SCHED_OMIT_FRAME_POINTER
         bool
         default y
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
 #
 # Select some configuration options automatically based on user selections.
 #
@@ -883,6 +898,9 @@ config MIPS_DISABLE_OBSOLETE_IDE
 config SYNC_R4K
         bool
 
+config MIPS_MACHINE
+        def_bool n
+
 config NO_IOPORT
         def_bool n
 
@@ -2400,4 +2418,20 @@ source "security/Kconfig"
 
 source "crypto/Kconfig"
 
+menuconfig VIRTUALIZATION
+        bool "Virtualization"
+        default n
+        ---help---
+          Say Y here to get to see options for using your Linux host to run other
+          operating systems inside virtual machines (guests).
+          This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
+
+if VIRTUALIZATION
+
+source drivers/virtio/Kconfig
+
+endif # VIRTUALIZATION
+
 source "lib/Kconfig"
diff --git a/arch/mips/Kconfig.debug b/arch/mips/Kconfig.debug
index f437cd1fafb..5358f90b4dd 100644
--- a/arch/mips/Kconfig.debug
+++ b/arch/mips/Kconfig.debug
@@ -7,7 +7,7 @@ config TRACE_IRQFLAGS_SUPPORT
 source "lib/Kconfig.debug"
 
 config EARLY_PRINTK
-        bool "Early printk" if EMBEDDED
+        bool "Early printk" if EXPERT
         depends on SYS_HAS_EARLY_PRINTK
         default y
         help
diff --git a/arch/mips/ath79/Kconfig b/arch/mips/ath79/Kconfig
new file mode 100644
index 00000000000..b05828260f7
--- /dev/null
+++ b/arch/mips/ath79/Kconfig
@@ -0,0 +1,50 @@
+if ATH79
+
+menu "Atheros AR71XX/AR724X/AR913X machine selection"
+
+config ATH79_MACH_AP81
+        bool "Atheros AP81 reference board"
+        select SOC_AR913X
+        select ATH79_DEV_AR913X_WMAC
+        select ATH79_DEV_GPIO_BUTTONS
+        select ATH79_DEV_LEDS_GPIO
+        select ATH79_DEV_SPI
+        help
+          Say 'Y' here if you want your kernel to support the
+          Atheros AP81 reference board.
+
+config ATH79_MACH_PB44
+        bool "Atheros PB44 reference board"
+        select SOC_AR71XX
+        select ATH79_DEV_GPIO_BUTTONS
+        select ATH79_DEV_LEDS_GPIO
+        select ATH79_DEV_SPI
+        help
+          Say 'Y' here if you want your kernel to support the
+          Atheros PB44 reference board.
+
+endmenu
+
+config SOC_AR71XX
+        def_bool n
+
+config SOC_AR724X
+        def_bool n
+
+config SOC_AR913X
+        def_bool n
+
+config ATH79_DEV_AR913X_WMAC
+        depends on SOC_AR913X
+        def_bool n
+
+config ATH79_DEV_GPIO_BUTTONS
+        def_bool n
+
+config ATH79_DEV_LEDS_GPIO
+        def_bool n
+
+config ATH79_DEV_SPI
+        def_bool n
+
+endif
diff --git a/arch/mips/ath79/Makefile b/arch/mips/ath79/Makefile
new file mode 100644
index 00000000000..c33d4653007
--- /dev/null
+++ b/arch/mips/ath79/Makefile
@@ -0,0 +1,28 @@
+#
+# Makefile for the Atheros AR71XX/AR724X/AR913X specific parts of the kernel
+#
+# Copyright (C) 2008-2011 Gabor Juhos <juhosg@openwrt.org>
+# Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 as published
+# by the Free Software Foundation.
+
+obj-y   := prom.o setup.o irq.o common.o clock.o gpio.o
+
+obj-$(CONFIG_EARLY_PRINTK)              += early_printk.o
+
+#
+# Devices
+#
+obj-y                                   += dev-common.o
+obj-$(CONFIG_ATH79_DEV_AR913X_WMAC)     += dev-ar913x-wmac.o
+obj-$(CONFIG_ATH79_DEV_GPIO_BUTTONS)    += dev-gpio-buttons.o
+obj-$(CONFIG_ATH79_DEV_LEDS_GPIO)       += dev-leds-gpio.o
+obj-$(CONFIG_ATH79_DEV_SPI)             += dev-spi.o
+
+#
+# Machines
+#
+obj-$(CONFIG_ATH79_MACH_AP81)           += mach-ap81.o
+obj-$(CONFIG_ATH79_MACH_PB44)           += mach-pb44.o
diff --git a/arch/mips/ath79/Platform b/arch/mips/ath79/Platform
new file mode 100644
index 00000000000..2bd663647d2
--- /dev/null
+++ b/arch/mips/ath79/Platform
@@ -0,0 +1,7 @@
+#
+# Atheros AR71xx/AR724x/AR913x
+#
+
+platform-$(CONFIG_ATH79)        += ath79/
+cflags-$(CONFIG_ATH79)          += -I$(srctree)/arch/mips/include/asm/mach-ath79
+load-$(CONFIG_ATH79)            = 0xffffffff80060000
diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
new file mode 100644
index 00000000000..680bde99a26
--- /dev/null
+++ b/arch/mips/ath79/clock.c
@@ -0,0 +1,183 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X common routines
+ *
+ *  Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/clk.h>
+
+#include <asm/mach-ath79/ath79.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include "common.h"
+
+#define AR71XX_BASE_FREQ        40000000
+#define AR724X_BASE_FREQ        5000000
+#define AR913X_BASE_FREQ        5000000
+
+struct clk {
+        unsigned long rate;
+};
+
+static struct clk ath79_ref_clk;
+static struct clk ath79_cpu_clk;
+static struct clk ath79_ddr_clk;
+static struct clk ath79_ahb_clk;
+static struct clk ath79_wdt_clk;
+static struct clk ath79_uart_clk;
+
+static void __init ar71xx_clocks_init(void)
+{
+        u32 pll;
+        u32 freq;
+        u32 div;
+
+        ath79_ref_clk.rate = AR71XX_BASE_FREQ;
+
+        pll = ath79_pll_rr(AR71XX_PLL_REG_CPU_CONFIG);
+
+        div = ((pll >> AR71XX_PLL_DIV_SHIFT) & AR71XX_PLL_DIV_MASK) + 1;
+        freq = div * ath79_ref_clk.rate;
+
+        div = ((pll >> AR71XX_CPU_DIV_SHIFT) & AR71XX_CPU_DIV_MASK) + 1;
+        ath79_cpu_clk.rate = freq / div;
+
+        div = ((pll >> AR71XX_DDR_DIV_SHIFT) & AR71XX_DDR_DIV_MASK) + 1;
+        ath79_ddr_clk.rate = freq / div;
+
+        div = (((pll >> AR71XX_AHB_DIV_SHIFT) & AR71XX_AHB_DIV_MASK) + 1) * 2;
+        ath79_ahb_clk.rate = ath79_cpu_clk.rate / div;
+
+        ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+        ath79_uart_clk.rate = ath79_ahb_clk.rate;
+}
+
+static void __init ar724x_clocks_init(void)
+{
+        u32 pll;
+        u32 freq;
+        u32 div;
+
+        ath79_ref_clk.rate = AR724X_BASE_FREQ;
+        pll = ath79_pll_rr(AR724X_PLL_REG_CPU_CONFIG);
+
+        div = ((pll >> AR724X_PLL_DIV_SHIFT) & AR724X_PLL_DIV_MASK);
+        freq = div * ath79_ref_clk.rate;
+
+        div = ((pll >> AR724X_PLL_REF_DIV_SHIFT) & AR724X_PLL_REF_DIV_MASK);
+        freq *= div;
+
+        ath79_cpu_clk.rate = freq;
+
+        div = ((pll >> AR724X_DDR_DIV_SHIFT) & AR724X_DDR_DIV_MASK) + 1;
+        ath79_ddr_clk.rate = freq / div;
+
+        div = (((pll >> AR724X_AHB_DIV_SHIFT) & AR724X_AHB_DIV_MASK) + 1) * 2;
+        ath79_ahb_clk.rate = ath79_cpu_clk.rate / div;
+
+        ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+        ath79_uart_clk.rate = ath79_ahb_clk.rate;
+}
+
+static void __init ar913x_clocks_init(void)
+{
+        u32 pll;
+        u32 freq;
+        u32 div;
+
+        ath79_ref_clk.rate = AR913X_BASE_FREQ;
+        pll = ath79_pll_rr(AR913X_PLL_REG_CPU_CONFIG);
+
+        div = ((pll >> AR913X_PLL_DIV_SHIFT) & AR913X_PLL_DIV_MASK);
+        freq = div * ath79_ref_clk.rate;
+
+        ath79_cpu_clk.rate = freq;
+
+        div = ((pll >> AR913X_DDR_DIV_SHIFT) & AR913X_DDR_DIV_MASK) + 1;
+        ath79_ddr_clk.rate = freq / div;
+
+        div = (((pll >> AR913X_AHB_DIV_SHIFT) & AR913X_AHB_DIV_MASK) + 1) * 2;
+        ath79_ahb_clk.rate = ath79_cpu_clk.rate / div;
+
+        ath79_wdt_clk.rate = ath79_ahb_clk.rate;
+        ath79_uart_clk.rate = ath79_ahb_clk.rate;
+}
+
+void __init ath79_clocks_init(void)
+{
+        if (soc_is_ar71xx())
+                ar71xx_clocks_init();
+        else if (soc_is_ar724x())
+                ar724x_clocks_init();
+        else if (soc_is_ar913x())
+                ar913x_clocks_init();
+        else
+                BUG();
+
+        pr_info("Clocks: CPU:%lu.%03luMHz, DDR:%lu.%03luMHz, AHB:%lu.%03luMHz, "
+                "Ref:%lu.%03luMHz",
+                ath79_cpu_clk.rate / 1000000,
+                (ath79_cpu_clk.rate / 1000) % 1000,
+                ath79_ddr_clk.rate / 1000000,
+                (ath79_ddr_clk.rate / 1000) % 1000,
+                ath79_ahb_clk.rate / 1000000,
+                (ath79_ahb_clk.rate / 1000) % 1000,
+                ath79_ref_clk.rate / 1000000,
+                (ath79_ref_clk.rate / 1000) % 1000);
+}
+
+/*
+ * Linux clock API
+ */
+struct clk *clk_get(struct device *dev, const char *id)
+{
+        if (!strcmp(id, "ref"))
+                return &ath79_ref_clk;
+
+        if (!strcmp(id, "cpu"))
+                return &ath79_cpu_clk;
+
+        if (!strcmp(id, "ddr"))
+                return &ath79_ddr_clk;
+
+        if (!strcmp(id, "ahb"))
+                return &ath79_ahb_clk;
+
+        if (!strcmp(id, "wdt"))
+                return &ath79_wdt_clk;
+
+        if (!strcmp(id, "uart"))
+                return &ath79_uart_clk;
+
+        return ERR_PTR(-ENOENT);
+}
+EXPORT_SYMBOL(clk_get);
+
+int clk_enable(struct clk *clk)
+{
+        return 0;
+}
+EXPORT_SYMBOL(clk_enable);
+
+void clk_disable(struct clk *clk)
+{
+}
+EXPORT_SYMBOL(clk_disable);
+
+unsigned long clk_get_rate(struct clk *clk)
+{
+        return clk->rate;
+}
+EXPORT_SYMBOL(clk_get_rate);
+
+void clk_put(struct clk *clk)
+{
+}
+EXPORT_SYMBOL(clk_put);
diff --git a/arch/mips/ath79/common.c b/arch/mips/ath79/common.c
new file mode 100644
index 00000000000..58f60e722a0
--- /dev/null
+++ b/arch/mips/ath79/common.c
@@ -0,0 +1,97 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X common routines
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+
+#include <asm/mach-ath79/ath79.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include "common.h"
+
+static DEFINE_SPINLOCK(ath79_device_reset_lock);
+
+u32 ath79_cpu_freq;
+EXPORT_SYMBOL_GPL(ath79_cpu_freq);
+
+u32 ath79_ahb_freq;
+EXPORT_SYMBOL_GPL(ath79_ahb_freq);
+
+u32 ath79_ddr_freq;
+EXPORT_SYMBOL_GPL(ath79_ddr_freq);
+
+enum ath79_soc_type ath79_soc;
+
+void __iomem *ath79_pll_base;
+void __iomem *ath79_reset_base;
+EXPORT_SYMBOL_GPL(ath79_reset_base);
+void __iomem *ath79_ddr_base;
+
+void ath79_ddr_wb_flush(u32 reg)
+{
+        void __iomem *flush_reg = ath79_ddr_base + reg;
+
+        /* Flush the DDR write buffer. */
+        __raw_writel(0x1, flush_reg);
+        while (__raw_readl(flush_reg) & 0x1)
+                ;
+
+        /* It must be run twice. */
+        __raw_writel(0x1, flush_reg);
+        while (__raw_readl(flush_reg) & 0x1)
+                ;
+}
+EXPORT_SYMBOL_GPL(ath79_ddr_wb_flush);
+
+void ath79_device_reset_set(u32 mask)
+{
+        unsigned long flags;
+        u32 reg;
+        u32 t;
+
+        if (soc_is_ar71xx())
+                reg = AR71XX_RESET_REG_RESET_MODULE;
+        else if (soc_is_ar724x())
+                reg = AR724X_RESET_REG_RESET_MODULE;
+        else if (soc_is_ar913x())
+                reg = AR913X_RESET_REG_RESET_MODULE;
+        else
+                BUG();
+
+        spin_lock_irqsave(&ath79_device_reset_lock, flags);
+        t = ath79_reset_rr(reg);
+        ath79_reset_wr(reg, t | mask);
+        spin_unlock_irqrestore(&ath79_device_reset_lock, flags);
+}
+EXPORT_SYMBOL_GPL(ath79_device_reset_set);
+
+void ath79_device_reset_clear(u32 mask)
+{
+        unsigned long flags;
+        u32 reg;
+        u32 t;
+
+        if (soc_is_ar71xx())
+                reg = AR71XX_RESET_REG_RESET_MODULE;
+        else if (soc_is_ar724x())
+                reg = AR724X_RESET_REG_RESET_MODULE;
+        else if (soc_is_ar913x())
+                reg = AR913X_RESET_REG_RESET_MODULE;
+        else
+                BUG();
+
+        spin_lock_irqsave(&ath79_device_reset_lock, flags);
+        t = ath79_reset_rr(reg);
+        ath79_reset_wr(reg, t & ~mask);
+        spin_unlock_irqrestore(&ath79_device_reset_lock, flags);
+}
+EXPORT_SYMBOL_GPL(ath79_device_reset_clear);
diff --git a/arch/mips/ath79/common.h b/arch/mips/ath79/common.h
new file mode 100644
index 00000000000..561906c2345
--- /dev/null
+++ b/arch/mips/ath79/common.h
@@ -0,0 +1,31 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X common definitions
+ *
+ *  Copyright (C) 2008-2011 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  Parts of this file are based on Atheros' 2.6.15 BSP
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef __ATH79_COMMON_H
+#define __ATH79_COMMON_H
+
+#include <linux/types.h>
+#include <linux/init.h>
+
+#define ATH79_MEM_SIZE_MIN      (2 * 1024 * 1024)
+#define ATH79_MEM_SIZE_MAX      (128 * 1024 * 1024)
+
+void ath79_clocks_init(void);
+void ath79_ddr_wb_flush(unsigned int reg);
+
+void ath79_gpio_function_enable(u32 mask);
+void ath79_gpio_function_disable(u32 mask);
+void ath79_gpio_function_setup(u32 set, u32 clear);
+void ath79_gpio_init(void);
+
+#endif /* __ATH79_COMMON_H */
diff --git a/arch/mips/ath79/dev-ar913x-wmac.c b/arch/mips/ath79/dev-ar913x-wmac.c
new file mode 100644
index 00000000000..48f425a5ba2
--- /dev/null
+++ b/arch/mips/ath79/dev-ar913x-wmac.c
@@ -0,0 +1,60 @@
+/*
+ *  Atheros AR913X SoC built-in WMAC device support
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/irq.h>
+#include <linux/platform_device.h>
+#include <linux/ath9k_platform.h>
+
+#include <asm/mach-ath79/ath79.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include "dev-ar913x-wmac.h"
+
+static struct ath9k_platform_data ar913x_wmac_data;
+
+static struct resource ar913x_wmac_resources[] = {
+        {
+                .start  = AR913X_WMAC_BASE,
+                .end    = AR913X_WMAC_BASE + AR913X_WMAC_SIZE - 1,
+                .flags  = IORESOURCE_MEM,
+        }, {
+                .start  = ATH79_CPU_IRQ_IP2,
+                .end    = ATH79_CPU_IRQ_IP2,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device ar913x_wmac_device = {
+        .name           = "ath9k",
+        .id             = -1,
+        .resource       = ar913x_wmac_resources,
+        .num_resources  = ARRAY_SIZE(ar913x_wmac_resources),
+        .dev = {
+                .platform_data = &ar913x_wmac_data,
+        },
+};
+
+void __init ath79_register_ar913x_wmac(u8 *cal_data)
+{
+        if (cal_data)
+                memcpy(ar913x_wmac_data.eeprom_data, cal_data,
+                       sizeof(ar913x_wmac_data.eeprom_data));
+
+        /* reset the WMAC */
+        ath79_device_reset_set(AR913X_RESET_AMBA2WMAC);
+        mdelay(10);
+
+        ath79_device_reset_clear(AR913X_RESET_AMBA2WMAC);
+        mdelay(10);
+
+        platform_device_register(&ar913x_wmac_device);
+}
diff --git a/arch/mips/ath79/dev-ar913x-wmac.h b/arch/mips/ath79/dev-ar913x-wmac.h
new file mode 100644
index 00000000000..579d562bbda
--- /dev/null
+++ b/arch/mips/ath79/dev-ar913x-wmac.h
@@ -0,0 +1,17 @@
+/*
+ *  Atheros AR913X SoC built-in WMAC device support
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef _ATH79_DEV_AR913X_WMAC_H
+#define _ATH79_DEV_AR913X_WMAC_H
+
+void ath79_register_ar913x_wmac(u8 *cal_data);
+
+#endif /* _ATH79_DEV_AR913X_WMAC_H */
diff --git a/arch/mips/ath79/dev-common.c b/arch/mips/ath79/dev-common.c
new file mode 100644
index 00000000000..3b82e325beb
--- /dev/null
+++ b/arch/mips/ath79/dev-common.c
@@ -0,0 +1,77 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X common devices
+ *
+ *  Copyright (C) 2008-2011 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  Parts of this file are based on Atheros' 2.6.15 BSP
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/serial_8250.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+
+#include <asm/mach-ath79/ath79.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include "common.h"
+#include "dev-common.h"
+
+static struct resource ath79_uart_resources[] = {
+        {
+                .start  = AR71XX_UART_BASE,
+                .end    = AR71XX_UART_BASE + AR71XX_UART_SIZE - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+
+#define AR71XX_UART_FLAGS (UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_IOREMAP)
+static struct plat_serial8250_port ath79_uart_data[] = {
+        {
+                .mapbase        = AR71XX_UART_BASE,
+                .irq            = ATH79_MISC_IRQ_UART,
+                .flags          = AR71XX_UART_FLAGS,
+                .iotype         = UPIO_MEM32,
+                .regshift       = 2,
+        }, {
+                /* terminating entry */
+        }
+};
+
+static struct platform_device ath79_uart_device = {
+        .name           = "serial8250",
+        .id             = PLAT8250_DEV_PLATFORM,
+        .resource       = ath79_uart_resources,
+        .num_resources  = ARRAY_SIZE(ath79_uart_resources),
+        .dev = {
+                .platform_data  = ath79_uart_data
+        },
+};
+
+void __init ath79_register_uart(void)
+{
+        struct clk *clk;
+
+        clk = clk_get(NULL, "uart");
+        if (IS_ERR(clk))
+                panic("unable to get UART clock, err=%ld", PTR_ERR(clk));
+
+        ath79_uart_data[0].uartclk = clk_get_rate(clk);
+        platform_device_register(&ath79_uart_device);
+}
+
+static struct platform_device ath79_wdt_device = {
+        .name           = "ath79-wdt",
+        .id             = -1,
+};
+
+void __init ath79_register_wdt(void)
+{
+        platform_device_register(&ath79_wdt_device);
+}
diff --git a/arch/mips/ath79/dev-common.h b/arch/mips/ath79/dev-common.h
new file mode 100644
index 00000000000..0f514e1affc
--- /dev/null
+++ b/arch/mips/ath79/dev-common.h
@@ -0,0 +1,18 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X common devices
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef _ATH79_DEV_COMMON_H
+#define _ATH79_DEV_COMMON_H
+
+void ath79_register_uart(void);
+void ath79_register_wdt(void);
+
+#endif /* _ATH79_DEV_COMMON_H */
diff --git a/arch/mips/ath79/dev-gpio-buttons.c b/arch/mips/ath79/dev-gpio-buttons.c
new file mode 100644
index 00000000000..4b0168a11c0
--- /dev/null
+++ b/arch/mips/ath79/dev-gpio-buttons.c
@@ -0,0 +1,58 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X GPIO button support
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include "linux/init.h"
+#include "linux/slab.h"
+#include <linux/platform_device.h>
+
+#include "dev-gpio-buttons.h"
+
+void __init ath79_register_gpio_keys_polled(int id,
+                                            unsigned poll_interval,
+                                            unsigned nbuttons,
+                                            struct gpio_keys_button *buttons)
+{
+        struct platform_device *pdev;
+        struct gpio_keys_platform_data pdata;
+        struct gpio_keys_button *p;
+        int err;
+
+        p = kmalloc(nbuttons * sizeof(*p), GFP_KERNEL);
+        if (!p)
+                return;
+
+        memcpy(p, buttons, nbuttons * sizeof(*p));
+
+        pdev = platform_device_alloc("gpio-keys-polled", id);
+        if (!pdev)
+                goto err_free_buttons;
+
+        memset(&pdata, 0, sizeof(pdata));
+        pdata.poll_interval = poll_interval;
+        pdata.nbuttons = nbuttons;
+        pdata.buttons = p;
+
+        err = platform_device_add_data(pdev, &pdata, sizeof(pdata));
+        if (err)
+                goto err_put_pdev;
+
+        err = platform_device_add(pdev);
+        if (err)
+                goto err_put_pdev;
+
+        return;
+
+err_put_pdev:
+        platform_device_put(pdev);
+
+err_free_buttons:
+        kfree(p);
+}
diff --git a/arch/mips/ath79/dev-gpio-buttons.h b/arch/mips/ath79/dev-gpio-buttons.h
new file mode 100644
index 00000000000..481847ac1cb
--- /dev/null
+++ b/arch/mips/ath79/dev-gpio-buttons.h
@@ -0,0 +1,23 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X GPIO button support
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef _ATH79_DEV_GPIO_BUTTONS_H
+#define _ATH79_DEV_GPIO_BUTTONS_H
+
+#include <linux/input.h>
+#include <linux/gpio_keys.h>
+
+void ath79_register_gpio_keys_polled(int id,
+                                     unsigned poll_interval,
+                                     unsigned nbuttons,
+                                     struct gpio_keys_button *buttons);
+
+#endif /* _ATH79_DEV_GPIO_BUTTONS_H */
diff --git a/arch/mips/ath79/dev-leds-gpio.c b/arch/mips/ath79/dev-leds-gpio.c
new file mode 100644
index 00000000000..cdade68dcd1
--- /dev/null
+++ b/arch/mips/ath79/dev-leds-gpio.c
@@ -0,0 +1,56 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X common GPIO LEDs support
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+
+#include "dev-leds-gpio.h"
+
+void __init ath79_register_leds_gpio(int id,
+                                     unsigned num_leds,
+                                     struct gpio_led *leds)
+{
+        struct platform_device *pdev;
+        struct gpio_led_platform_data pdata;
+        struct gpio_led *p;
+        int err;
+
+        p = kmalloc(num_leds * sizeof(*p), GFP_KERNEL);
+        if (!p)
+                return;
+
+        memcpy(p, leds, num_leds * sizeof(*p));
+
+        pdev = platform_device_alloc("leds-gpio", id);
+        if (!pdev)
+                goto err_free_leds;
+
+        memset(&pdata, 0, sizeof(pdata));
+        pdata.num_leds = num_leds;
+        pdata.leds = p;
+
+        err = platform_device_add_data(pdev, &pdata, sizeof(pdata));
+        if (err)
+                goto err_put_pdev;
+
+        err = platform_device_add(pdev);
+        if (err)
+                goto err_put_pdev;
+
+        return;
+
+err_put_pdev:
+        platform_device_put(pdev);
+
+err_free_leds:
+        kfree(p);
+}
diff --git a/arch/mips/ath79/dev-leds-gpio.h b/arch/mips/ath79/dev-leds-gpio.h
new file mode 100644
index 00000000000..6e5d8851ebc
--- /dev/null
+++ b/arch/mips/ath79/dev-leds-gpio.h
@@ -0,0 +1,21 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X common GPIO LEDs support
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef _ATH79_DEV_LEDS_GPIO_H
+#define _ATH79_DEV_LEDS_GPIO_H
+
+#include <linux/leds.h>
+
+void ath79_register_leds_gpio(int id,
+                              unsigned num_leds,
+                              struct gpio_led *leds);
+
+#endif /* _ATH79_DEV_LEDS_GPIO_H */
diff --git a/arch/mips/ath79/dev-spi.c b/arch/mips/ath79/dev-spi.c
new file mode 100644
index 00000000000..aa30163efbf
--- /dev/null
+++ b/arch/mips/ath79/dev-spi.c
@@ -0,0 +1,38 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X SPI controller device
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/platform_device.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include "dev-spi.h"
+
+static struct resource ath79_spi_resources[] = {
+        {
+                .start  = AR71XX_SPI_BASE,
+                .end    = AR71XX_SPI_BASE + AR71XX_SPI_SIZE - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+
+static struct platform_device ath79_spi_device = {
+        .name           = "ath79-spi",
+        .id             = -1,
+        .resource       = ath79_spi_resources,
+        .num_resources  = ARRAY_SIZE(ath79_spi_resources),
+};
+
+void __init ath79_register_spi(struct ath79_spi_platform_data *pdata,
+                               struct spi_board_info const *info,
+                               unsigned n)
+{
+        spi_register_board_info(info, n);
+        ath79_spi_device.dev.platform_data = pdata;
+        platform_device_register(&ath79_spi_device);
+}
diff --git a/arch/mips/ath79/dev-spi.h b/arch/mips/ath79/dev-spi.h
new file mode 100644
index 00000000000..d732565ca73
--- /dev/null
+++ b/arch/mips/ath79/dev-spi.h
@@ -0,0 +1,22 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X SPI controller device
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef _ATH79_DEV_SPI_H
+#define _ATH79_DEV_SPI_H
+
+#include <linux/spi/spi.h>
+#include <asm/mach-ath79/ath79_spi_platform.h>
+
+void ath79_register_spi(struct ath79_spi_platform_data *pdata,
+                         struct spi_board_info const *info,
+                         unsigned n);
+
+#endif /* _ATH79_DEV_SPI_H */
diff --git a/arch/mips/ath79/early_printk.c b/arch/mips/ath79/early_printk.c
new file mode 100644
index 00000000000..7499b0e9df2
--- /dev/null
+++ b/arch/mips/ath79/early_printk.c
@@ -0,0 +1,36 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X SoC early printk support
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/io.h>
+#include <linux/serial_reg.h>
+#include <asm/addrspace.h>
+
+#include <asm/mach-ath79/ar71xx_regs.h>
+
+static inline void prom_wait_thre(void __iomem *base)
+{
+        u32 lsr;
+
+        do {
+                lsr = __raw_readl(base + UART_LSR * 4);
+                if (lsr & UART_LSR_THRE)
+                        break;
+        } while (1);
+}
+
+void prom_putchar(unsigned char ch)
+{
+        void __iomem *base = (void __iomem *)(KSEG1ADDR(AR71XX_UART_BASE));
+
+        prom_wait_thre(base);
+        __raw_writel(ch, base + UART_TX * 4);
+        prom_wait_thre(base);
+}
diff --git a/arch/mips/ath79/gpio.c b/arch/mips/ath79/gpio.c
new file mode 100644
index 00000000000..a0c426b8212
--- /dev/null
+++ b/arch/mips/ath79/gpio.c
@@ -0,0 +1,197 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X GPIO API support
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/gpio.h>
+
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include <asm/mach-ath79/ath79.h>
+#include "common.h"
+
+static void __iomem *ath79_gpio_base;
+static unsigned long ath79_gpio_count;
+static DEFINE_SPINLOCK(ath79_gpio_lock);
+
+static void __ath79_gpio_set_value(unsigned gpio, int value)
+{
+        void __iomem *base = ath79_gpio_base;
+
+        if (value)
+                __raw_writel(1 << gpio, base + AR71XX_GPIO_REG_SET);
+        else
+                __raw_writel(1 << gpio, base + AR71XX_GPIO_REG_CLEAR);
+}
+
+static int __ath79_gpio_get_value(unsigned gpio)
+{
+        return (__raw_readl(ath79_gpio_base + AR71XX_GPIO_REG_IN) >> gpio) & 1;
+}
+
+static int ath79_gpio_get_value(struct gpio_chip *chip, unsigned offset)
+{
+        return __ath79_gpio_get_value(offset);
+}
+
+static void ath79_gpio_set_value(struct gpio_chip *chip,
+                                  unsigned offset, int value)
+{
+        __ath79_gpio_set_value(offset, value);
+}
+
+static int ath79_gpio_direction_input(struct gpio_chip *chip,
+                                       unsigned offset)
+{
+        void __iomem *base = ath79_gpio_base;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ath79_gpio_lock, flags);
+
+        __raw_writel(__raw_readl(base + AR71XX_GPIO_REG_OE) & ~(1 << offset),
+                     base + AR71XX_GPIO_REG_OE);
+
+        spin_unlock_irqrestore(&ath79_gpio_lock, flags);
+
+        return 0;
+}
+
+static int ath79_gpio_direction_output(struct gpio_chip *chip,
+                                        unsigned offset, int value)
+{
+        void __iomem *base = ath79_gpio_base;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ath79_gpio_lock, flags);
+
+        if (value)
+                __raw_writel(1 << offset, base + AR71XX_GPIO_REG_SET);
+        else
+                __raw_writel(1 << offset, base + AR71XX_GPIO_REG_CLEAR);
+
+        __raw_writel(__raw_readl(base + AR71XX_GPIO_REG_OE) | (1 << offset),
+                     base + AR71XX_GPIO_REG_OE);
+
+        spin_unlock_irqrestore(&ath79_gpio_lock, flags);
+
+        return 0;
+}
+
+static struct gpio_chip ath79_gpio_chip = {
+        .label                  = "ath79",
+        .get                    = ath79_gpio_get_value,
+        .set                    = ath79_gpio_set_value,
+        .direction_input        = ath79_gpio_direction_input,
+        .direction_output       = ath79_gpio_direction_output,
+        .base                   = 0,
+};
+
+void ath79_gpio_function_enable(u32 mask)
+{
+        void __iomem *base = ath79_gpio_base;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ath79_gpio_lock, flags);
+
+        __raw_writel(__raw_readl(base + AR71XX_GPIO_REG_FUNC) | mask,
+                     base + AR71XX_GPIO_REG_FUNC);
+        /* flush write */
+        __raw_readl(base + AR71XX_GPIO_REG_FUNC);
+
+        spin_unlock_irqrestore(&ath79_gpio_lock, flags);
+}
+
+void ath79_gpio_function_disable(u32 mask)
+{
+        void __iomem *base = ath79_gpio_base;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ath79_gpio_lock, flags);
+
+        __raw_writel(__raw_readl(base + AR71XX_GPIO_REG_FUNC) & ~mask,
+                     base + AR71XX_GPIO_REG_FUNC);
+        /* flush write */
+        __raw_readl(base + AR71XX_GPIO_REG_FUNC);
+
+        spin_unlock_irqrestore(&ath79_gpio_lock, flags);
+}
+
+void ath79_gpio_function_setup(u32 set, u32 clear)
+{
+        void __iomem *base = ath79_gpio_base;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ath79_gpio_lock, flags);
+
+        __raw_writel((__raw_readl(base + AR71XX_GPIO_REG_FUNC) & ~clear) | set,
+                     base + AR71XX_GPIO_REG_FUNC);
+        /* flush write */
+        __raw_readl(base + AR71XX_GPIO_REG_FUNC);
+
+        spin_unlock_irqrestore(&ath79_gpio_lock, flags);
+}
+
+void __init ath79_gpio_init(void)
+{
+        int err;
+
+        if (soc_is_ar71xx())
+                ath79_gpio_count = AR71XX_GPIO_COUNT;
+        else if (soc_is_ar724x())
+                ath79_gpio_count = AR724X_GPIO_COUNT;
+        else if (soc_is_ar913x())
+                ath79_gpio_count = AR913X_GPIO_COUNT;
+        else
+                BUG();
+
+        ath79_gpio_base = ioremap_nocache(AR71XX_GPIO_BASE, AR71XX_GPIO_SIZE);
+        ath79_gpio_chip.ngpio = ath79_gpio_count;
+
+        err = gpiochip_add(&ath79_gpio_chip);
+        if (err)
+                panic("cannot add AR71xx GPIO chip, error=%d", err);
+}
+
+int gpio_get_value(unsigned gpio)
+{
+        if (gpio < ath79_gpio_count)
+                return __ath79_gpio_get_value(gpio);
+
+        return __gpio_get_value(gpio);
+}
+EXPORT_SYMBOL(gpio_get_value);
+
+void gpio_set_value(unsigned gpio, int value)
+{
+        if (gpio < ath79_gpio_count)
+                __ath79_gpio_set_value(gpio, value);
+        else
+                __gpio_set_value(gpio, value);
+}
+EXPORT_SYMBOL(gpio_set_value);
+
+int gpio_to_irq(unsigned gpio)
+{
+        /* FIXME */
+        return -EINVAL;
+}
+EXPORT_SYMBOL(gpio_to_irq);
+
+int irq_to_gpio(unsigned irq)
+{
+        /* FIXME */
+        return -EINVAL;
+}
+EXPORT_SYMBOL(irq_to_gpio);
diff --git a/arch/mips/ath79/irq.c b/arch/mips/ath79/irq.c
new file mode 100644
index 00000000000..1bf7f719ba5
--- /dev/null
+++ b/arch/mips/ath79/irq.c
@@ -0,0 +1,187 @@
+/*
+ *  Atheros AR71xx/AR724x/AR913x specific interrupt handling
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  Parts of this file are based on Atheros' 2.6.15 BSP
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+
+#include <asm/irq_cpu.h>
+#include <asm/mipsregs.h>
+
+#include <asm/mach-ath79/ath79.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include "common.h"
+
+static unsigned int ath79_ip2_flush_reg;
+static unsigned int ath79_ip3_flush_reg;
+
+static void ath79_misc_irq_handler(unsigned int irq, struct irq_desc *desc)
+{
+        void __iomem *base = ath79_reset_base;
+        u32 pending;
+
+        pending = __raw_readl(base + AR71XX_RESET_REG_MISC_INT_STATUS) &
+                  __raw_readl(base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+
+        if (pending & MISC_INT_UART)
+                generic_handle_irq(ATH79_MISC_IRQ_UART);
+
+        else if (pending & MISC_INT_DMA)
+                generic_handle_irq(ATH79_MISC_IRQ_DMA);
+
+        else if (pending & MISC_INT_PERFC)
+                generic_handle_irq(ATH79_MISC_IRQ_PERFC);
+
+        else if (pending & MISC_INT_TIMER)
+                generic_handle_irq(ATH79_MISC_IRQ_TIMER);
+
+        else if (pending & MISC_INT_OHCI)
+                generic_handle_irq(ATH79_MISC_IRQ_OHCI);
+
+        else if (pending & MISC_INT_ERROR)
+                generic_handle_irq(ATH79_MISC_IRQ_ERROR);
+
+        else if (pending & MISC_INT_GPIO)
+                generic_handle_irq(ATH79_MISC_IRQ_GPIO);
+
+        else if (pending & MISC_INT_WDOG)
+                generic_handle_irq(ATH79_MISC_IRQ_WDOG);
+
+        else
+                spurious_interrupt();
+}
+
+static void ar71xx_misc_irq_unmask(unsigned int irq)
+{
+        void __iomem *base = ath79_reset_base;
+        u32 t;
+
+        irq -= ATH79_MISC_IRQ_BASE;
+
+        t = __raw_readl(base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+        __raw_writel(t | (1 << irq), base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+
+        /* flush write */
+        __raw_readl(base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+}
+
+static void ar71xx_misc_irq_mask(unsigned int irq)
+{
+        void __iomem *base = ath79_reset_base;
+        u32 t;
+
+        irq -= ATH79_MISC_IRQ_BASE;
+
+        t = __raw_readl(base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+        __raw_writel(t & ~(1 << irq), base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+
+        /* flush write */
+        __raw_readl(base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+}
+
+static void ar724x_misc_irq_ack(unsigned int irq)
+{
+        void __iomem *base = ath79_reset_base;
+        u32 t;
+
+        irq -= ATH79_MISC_IRQ_BASE;
+
+        t = __raw_readl(base + AR71XX_RESET_REG_MISC_INT_STATUS);
+        __raw_writel(t & ~(1 << irq), base + AR71XX_RESET_REG_MISC_INT_STATUS);
+
+        /* flush write */
+        __raw_readl(base + AR71XX_RESET_REG_MISC_INT_STATUS);
+}
+
+static struct irq_chip ath79_misc_irq_chip = {
+        .name           = "MISC",
+        .unmask         = ar71xx_misc_irq_unmask,
+        .mask           = ar71xx_misc_irq_mask,
+};
+
+static void __init ath79_misc_irq_init(void)
+{
+        void __iomem *base = ath79_reset_base;
+        int i;
+
+        __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+        __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_STATUS);
+
+        if (soc_is_ar71xx() || soc_is_ar913x())
+                ath79_misc_irq_chip.mask_ack = ar71xx_misc_irq_mask;
+        else if (soc_is_ar724x())
+                ath79_misc_irq_chip.ack = ar724x_misc_irq_ack;
+        else
+                BUG();
+
+        for (i = ATH79_MISC_IRQ_BASE;
+             i < ATH79_MISC_IRQ_BASE + ATH79_MISC_IRQ_COUNT; i++) {
+                irq_desc[i].status = IRQ_DISABLED;
+                set_irq_chip_and_handler(i, &ath79_misc_irq_chip,
+                                         handle_level_irq);
+        }
+
+        set_irq_chained_handler(ATH79_CPU_IRQ_MISC, ath79_misc_irq_handler);
+}
+
+asmlinkage void plat_irq_dispatch(void)
+{
+        unsigned long pending;
+
+        pending = read_c0_status() & read_c0_cause() & ST0_IM;
+
+        if (pending & STATUSF_IP7)
+                do_IRQ(ATH79_CPU_IRQ_TIMER);
+
+        else if (pending & STATUSF_IP2) {
+                ath79_ddr_wb_flush(ath79_ip2_flush_reg);
+                do_IRQ(ATH79_CPU_IRQ_IP2);
+        }
+
+        else if (pending & STATUSF_IP4)
+                do_IRQ(ATH79_CPU_IRQ_GE0);
+
+        else if (pending & STATUSF_IP5)
+                do_IRQ(ATH79_CPU_IRQ_GE1);
+
+        else if (pending & STATUSF_IP3) {
+                ath79_ddr_wb_flush(ath79_ip3_flush_reg);
+                do_IRQ(ATH79_CPU_IRQ_USB);
+        }
+
+        else if (pending & STATUSF_IP6)
+                do_IRQ(ATH79_CPU_IRQ_MISC);
+
+        else
+                spurious_interrupt();
+}
+
+void __init arch_init_irq(void)
+{
+        if (soc_is_ar71xx()) {
+                ath79_ip2_flush_reg = AR71XX_DDR_REG_FLUSH_PCI;
+                ath79_ip3_flush_reg = AR71XX_DDR_REG_FLUSH_USB;
+        } else if (soc_is_ar724x()) {
+                ath79_ip2_flush_reg = AR724X_DDR_REG_FLUSH_PCIE;
+                ath79_ip3_flush_reg = AR724X_DDR_REG_FLUSH_USB;
+        } else if (soc_is_ar913x()) {
+                ath79_ip2_flush_reg = AR913X_DDR_REG_FLUSH_WMAC;
+                ath79_ip3_flush_reg = AR913X_DDR_REG_FLUSH_USB;
+        } else
+                BUG();
+
+        cp0_perfcount_irq = ATH79_MISC_IRQ_PERFC;
+        mips_cpu_irq_init();
+        ath79_misc_irq_init();
+}
diff --git a/arch/mips/ath79/mach-ap81.c b/arch/mips/ath79/mach-ap81.c
new file mode 100644
index 00000000000..eee4c121deb
--- /dev/null
+++ b/arch/mips/ath79/mach-ap81.c
@@ -0,0 +1,98 @@
+/*
+ *  Atheros AP81 board support
+ *
+ *  Copyright (C) 2009-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2009 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include "machtypes.h"
+#include "dev-ar913x-wmac.h"
+#include "dev-gpio-buttons.h"
+#include "dev-leds-gpio.h"
+#include "dev-spi.h"
+
+#define AP81_GPIO_LED_STATUS    1
+#define AP81_GPIO_LED_AOSS      3
+#define AP81_GPIO_LED_WLAN      6
+#define AP81_GPIO_LED_POWER     14
+
+#define AP81_GPIO_BTN_SW4       12
+#define AP81_GPIO_BTN_SW1       21
+
+#define AP81_KEYS_POLL_INTERVAL         20      /* msecs */
+#define AP81_KEYS_DEBOUNCE_INTERVAL     (3 * AP81_KEYS_POLL_INTERVAL)
+
+#define AP81_CAL_DATA_ADDR      0x1fff1000
+
+static struct gpio_led ap81_leds_gpio[] __initdata = {
+        {
+                .name           = "ap81:green:status",
+                .gpio           = AP81_GPIO_LED_STATUS,
+                .active_low     = 1,
+        }, {
+                .name           = "ap81:amber:aoss",
+                .gpio           = AP81_GPIO_LED_AOSS,
+                .active_low     = 1,
+        }, {
+                .name           = "ap81:green:wlan",
+                .gpio           = AP81_GPIO_LED_WLAN,
+                .active_low     = 1,
+        }, {
+                .name           = "ap81:green:power",
+                .gpio           = AP81_GPIO_LED_POWER,
+                .active_low     = 1,
+        }
+};
+
+static struct gpio_keys_button ap81_gpio_keys[] __initdata = {
+        {
+                .desc           = "sw1",
+                .type           = EV_KEY,
+                .code           = BTN_0,
+                .debounce_interval = AP81_KEYS_DEBOUNCE_INTERVAL,
+                .gpio           = AP81_GPIO_BTN_SW1,
+                .active_low     = 1,
+        } , {
+                .desc           = "sw4",
+                .type           = EV_KEY,
+                .code           = BTN_1,
+                .debounce_interval = AP81_KEYS_DEBOUNCE_INTERVAL,
+                .gpio           = AP81_GPIO_BTN_SW4,
+                .active_low     = 1,
+        }
+};
+
+static struct spi_board_info ap81_spi_info[] = {
+        {
+                .bus_num        = 0,
+                .chip_select    = 0,
+                .max_speed_hz   = 25000000,
+                .modalias       = "m25p64",
+        }
+};
+
+static struct ath79_spi_platform_data ap81_spi_data = {
+        .bus_num        = 0,
+        .num_chipselect = 1,
+};
+
+static void __init ap81_setup(void)
+{
+        u8 *cal_data = (u8 *) KSEG1ADDR(AP81_CAL_DATA_ADDR);
+
+        ath79_register_leds_gpio(-1, ARRAY_SIZE(ap81_leds_gpio),
+                                 ap81_leds_gpio);
+        ath79_register_gpio_keys_polled(-1, AP81_KEYS_POLL_INTERVAL,
+                                        ARRAY_SIZE(ap81_gpio_keys),
+                                        ap81_gpio_keys);
+        ath79_register_spi(&ap81_spi_data, ap81_spi_info,
+                           ARRAY_SIZE(ap81_spi_info));
+        ath79_register_ar913x_wmac(cal_data);
+}
+
+MIPS_MACHINE(ATH79_MACH_AP81, "AP81", "Atheros AP81 reference board",
+             ap81_setup);
diff --git a/arch/mips/ath79/mach-pb44.c b/arch/mips/ath79/mach-pb44.c
new file mode 100644
index 00000000000..ec7b7a135d5
--- /dev/null
+++ b/arch/mips/ath79/mach-pb44.c
@@ -0,0 +1,118 @@
+/*
+ *  Atheros PB44 reference board support
+ *
+ *  Copyright (C) 2009-2010 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/i2c-gpio.h>
+#include <linux/i2c/pcf857x.h>
+
+#include "machtypes.h"
+#include "dev-gpio-buttons.h"
+#include "dev-leds-gpio.h"
+#include "dev-spi.h"
+
+#define PB44_GPIO_I2C_SCL       0
+#define PB44_GPIO_I2C_SDA       1
+
+#define PB44_GPIO_EXP_BASE      16
+#define PB44_GPIO_SW_RESET      (PB44_GPIO_EXP_BASE + 6)
+#define PB44_GPIO_SW_JUMP       (PB44_GPIO_EXP_BASE + 8)
+#define PB44_GPIO_LED_JUMP1     (PB44_GPIO_EXP_BASE + 9)
+#define PB44_GPIO_LED_JUMP2     (PB44_GPIO_EXP_BASE + 10)
+
+#define PB44_KEYS_POLL_INTERVAL         20      /* msecs */
+#define PB44_KEYS_DEBOUNCE_INTERVAL     (3 * PB44_KEYS_POLL_INTERVAL)
+
+static struct i2c_gpio_platform_data pb44_i2c_gpio_data = {
+        .sda_pin        = PB44_GPIO_I2C_SDA,
+        .scl_pin        = PB44_GPIO_I2C_SCL,
+};
+
+static struct platform_device pb44_i2c_gpio_device = {
+        .name           = "i2c-gpio",
+        .id             = 0,
+        .dev = {
+                .platform_data  = &pb44_i2c_gpio_data,
+        }
+};
+
+static struct pcf857x_platform_data pb44_pcf857x_data = {
+        .gpio_base      = PB44_GPIO_EXP_BASE,
+};
+
+static struct i2c_board_info pb44_i2c_board_info[] __initdata = {
+        {
+                I2C_BOARD_INFO("pcf8575", 0x20),
+                .platform_data  = &pb44_pcf857x_data,
+        },
+};
+
+static struct gpio_led pb44_leds_gpio[] __initdata = {
+        {
+                .name           = "pb44:amber:jump1",
+                .gpio           = PB44_GPIO_LED_JUMP1,
+                .active_low     = 1,
+        }, {
+                .name           = "pb44:green:jump2",
+                .gpio           = PB44_GPIO_LED_JUMP2,
+                .active_low     = 1,
+        },
+};
+
+static struct gpio_keys_button pb44_gpio_keys[] __initdata = {
+        {
+                .desc           = "soft_reset",
+                .type           = EV_KEY,
+                .code           = KEY_RESTART,
+                .debounce_interval = PB44_KEYS_DEBOUNCE_INTERVAL,
+                .gpio           = PB44_GPIO_SW_RESET,
+                .active_low     = 1,
+        } , {
+                .desc           = "jumpstart",
+                .type           = EV_KEY,
+                .code           = KEY_WPS_BUTTON,
+                .debounce_interval = PB44_KEYS_DEBOUNCE_INTERVAL,
+                .gpio           = PB44_GPIO_SW_JUMP,
+                .active_low     = 1,
+        }
+};
+
+static struct spi_board_info pb44_spi_info[] = {
+        {
+                .bus_num        = 0,
+                .chip_select    = 0,
+                .max_speed_hz   = 25000000,
+                .modalias       = "m25p64",
+        },
+};
+
+static struct ath79_spi_platform_data pb44_spi_data = {
+        .bus_num                = 0,
+        .num_chipselect         = 1,
+};
+
+static void __init pb44_init(void)
+{
+        i2c_register_board_info(0, pb44_i2c_board_info,
+                                ARRAY_SIZE(pb44_i2c_board_info));
+        platform_device_register(&pb44_i2c_gpio_device);
+
+        ath79_register_leds_gpio(-1, ARRAY_SIZE(pb44_leds_gpio),
+                                 pb44_leds_gpio);
+        ath79_register_gpio_keys_polled(-1, PB44_KEYS_POLL_INTERVAL,
+                                        ARRAY_SIZE(pb44_gpio_keys),
+                                        pb44_gpio_keys);
+        ath79_register_spi(&pb44_spi_data, pb44_spi_info,
+                           ARRAY_SIZE(pb44_spi_info));
+}
+
+MIPS_MACHINE(ATH79_MACH_PB44, "PB44", "Atheros PB44 reference board",
+             pb44_init);
diff --git a/arch/mips/ath79/machtypes.h b/arch/mips/ath79/machtypes.h
new file mode 100644
index 00000000000..3940fe470b2
--- /dev/null
+++ b/arch/mips/ath79/machtypes.h
@@ -0,0 +1,23 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X machine type definitions
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef _ATH79_MACHTYPE_H
+#define _ATH79_MACHTYPE_H
+
+#include <asm/mips_machine.h>
+
+enum ath79_mach_type {
+        ATH79_MACH_GENERIC = 0,
+        ATH79_MACH_AP81,                /* Atheros AP81 reference board */
+        ATH79_MACH_PB44,                /* Atheros PB44 reference board */
+};
+
+#endif /* _ATH79_MACHTYPE_H */
diff --git a/arch/mips/ath79/prom.c b/arch/mips/ath79/prom.c
new file mode 100644
index 00000000000..e9cbd7c2918
--- /dev/null
+++ b/arch/mips/ath79/prom.c
@@ -0,0 +1,57 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X specific prom routines
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/string.h>
+
+#include <asm/bootinfo.h>
+#include <asm/addrspace.h>
+
+#include "common.h"
+
+static inline int is_valid_ram_addr(void *addr)
+{
+        if (((u32) addr > KSEG0) &&
+            ((u32) addr < (KSEG0 + ATH79_MEM_SIZE_MAX)))
+                return 1;
+
+        if (((u32) addr > KSEG1) &&
+            ((u32) addr < (KSEG1 + ATH79_MEM_SIZE_MAX)))
+                return 1;
+
+        return 0;
+}
+
+static __init void ath79_prom_init_cmdline(int argc, char **argv)
+{
+        int i;
+
+        if (!is_valid_ram_addr(argv))
+                return;
+
+        for (i = 0; i < argc; i++)
+                if (is_valid_ram_addr(argv[i])) {
+                        strlcat(arcs_cmdline, " ", sizeof(arcs_cmdline));
+                        strlcat(arcs_cmdline, argv[i], sizeof(arcs_cmdline));
+                }
+}
+
+void __init prom_init(void)
+{
+        ath79_prom_init_cmdline(fw_arg0, (char **)fw_arg1);
+}
+
+void __init prom_free_prom_memory(void)
+{
+        /* We do not have to prom memory to free */
+}
diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
new file mode 100644
index 00000000000..159b42f106b
--- /dev/null
+++ b/arch/mips/ath79/setup.c
@@ -0,0 +1,206 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X specific setup
+ *
+ *  Copyright (C) 2008-2011 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  Parts of this file are based on Atheros' 2.6.15 BSP
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/bootmem.h>
+#include <linux/err.h>
+#include <linux/clk.h>
+
+#include <asm/bootinfo.h>
+#include <asm/time.h>           /* for mips_hpt_frequency */
+#include <asm/reboot.h>         /* for _machine_{restart,halt} */
+#include <asm/mips_machine.h>
+
+#include <asm/mach-ath79/ath79.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include "common.h"
+#include "dev-common.h"
+#include "machtypes.h"
+
+#define ATH79_SYS_TYPE_LEN      64
+
+#define AR71XX_BASE_FREQ        40000000
+#define AR724X_BASE_FREQ        5000000
+#define AR913X_BASE_FREQ        5000000
+
+static char ath79_sys_type[ATH79_SYS_TYPE_LEN];
+
+static void ath79_restart(char *command)
+{
+        ath79_device_reset_set(AR71XX_RESET_FULL_CHIP);
+        for (;;)
+                if (cpu_wait)
+                        cpu_wait();
+}
+
+static void ath79_halt(void)
+{
+        while (1)
+                cpu_wait();
+}
+
+static void __init ath79_detect_mem_size(void)
+{
+        unsigned long size;
+
+        for (size = ATH79_MEM_SIZE_MIN; size < ATH79_MEM_SIZE_MAX;
+             size <<= 1) {
+                if (!memcmp(ath79_detect_mem_size,
+                            ath79_detect_mem_size + size, 1024))
+                        break;
+        }
+
+        add_memory_region(0, size, BOOT_MEM_RAM);
+}
+
+static void __init ath79_detect_sys_type(void)
+{
+        char *chip = "????";
+        u32 id;
+        u32 major;
+        u32 minor;
+        u32 rev = 0;
+
+        id = ath79_reset_rr(AR71XX_RESET_REG_REV_ID);
+        major = id & REV_ID_MAJOR_MASK;
+
+        switch (major) {
+        case REV_ID_MAJOR_AR71XX:
+                minor = id & AR71XX_REV_ID_MINOR_MASK;
+                rev = id >> AR71XX_REV_ID_REVISION_SHIFT;
+                rev &= AR71XX_REV_ID_REVISION_MASK;
+                switch (minor) {
+                case AR71XX_REV_ID_MINOR_AR7130:
+                        ath79_soc = ATH79_SOC_AR7130;
+                        chip = "7130";
+                        break;
+
+                case AR71XX_REV_ID_MINOR_AR7141:
+                        ath79_soc = ATH79_SOC_AR7141;
+                        chip = "7141";
+                        break;
+
+                case AR71XX_REV_ID_MINOR_AR7161:
+                        ath79_soc = ATH79_SOC_AR7161;
+                        chip = "7161";
+                        break;
+                }
+                break;
+
+        case REV_ID_MAJOR_AR7240:
+                ath79_soc = ATH79_SOC_AR7240;
+                chip = "7240";
+                rev = (id & AR724X_REV_ID_REVISION_MASK);
+                break;
+
+        case REV_ID_MAJOR_AR7241:
+                ath79_soc = ATH79_SOC_AR7241;
+                chip = "7241";
+                rev = (id & AR724X_REV_ID_REVISION_MASK);
+                break;
+
+        case REV_ID_MAJOR_AR7242:
+                ath79_soc = ATH79_SOC_AR7242;
+                chip = "7242";
+                rev = (id & AR724X_REV_ID_REVISION_MASK);
+                break;
+
+        case REV_ID_MAJOR_AR913X:
+                minor = id & AR913X_REV_ID_MINOR_MASK;
+                rev = id >> AR913X_REV_ID_REVISION_SHIFT;
+                rev &= AR913X_REV_ID_REVISION_MASK;
+                switch (minor) {
+                case AR913X_REV_ID_MINOR_AR9130:
+                        ath79_soc = ATH79_SOC_AR9130;
+                        chip = "9130";
+                        break;
+
+                case AR913X_REV_ID_MINOR_AR9132:
+                        ath79_soc = ATH79_SOC_AR9132;
+                        chip = "9132";
+                        break;
+                }
+                break;
+
+        default:
+                panic("ath79: unknown SoC, id:0x%08x\n", id);
+        }
+
+        sprintf(ath79_sys_type, "Atheros AR%s rev %u", chip, rev);
+        pr_info("SoC: %s\n", ath79_sys_type);
+}
+
+const char *get_system_type(void)
+{
+        return ath79_sys_type;
+}
+
+unsigned int __cpuinit get_c0_compare_int(void)
+{
+        return CP0_LEGACY_COMPARE_IRQ;
+}
+
+void __init plat_mem_setup(void)
+{
+        set_io_port_base(KSEG1);
+
+        ath79_reset_base = ioremap_nocache(AR71XX_RESET_BASE,
+                                           AR71XX_RESET_SIZE);
+        ath79_pll_base = ioremap_nocache(AR71XX_PLL_BASE,
+                                         AR71XX_PLL_SIZE);
+        ath79_ddr_base = ioremap_nocache(AR71XX_DDR_CTRL_BASE,
+                                         AR71XX_DDR_CTRL_SIZE);
+
+        ath79_detect_sys_type();
+        ath79_detect_mem_size();
+        ath79_clocks_init();
+
+        _machine_restart = ath79_restart;
+        _machine_halt = ath79_halt;
+        pm_power_off = ath79_halt;
+}
+
+void __init plat_time_init(void)
+{
+        struct clk *clk;
+
+        clk = clk_get(NULL, "cpu");
+        if (IS_ERR(clk))
+                panic("unable to get CPU clock, err=%ld", PTR_ERR(clk));
+
+        mips_hpt_frequency = clk_get_rate(clk) / 2;
+}
+
+static int __init ath79_setup(void)
+{
+        ath79_gpio_init();
+        ath79_register_uart();
+        ath79_register_wdt();
+
+        mips_machine_setup();
+
+        return 0;
+}
+
+arch_initcall(ath79_setup);
+
+static void __init ath79_generic_init(void)
+{
+        /* Nothing to do */
+}
+
+MIPS_MACHINE(ATH79_MACH_GENERIC,
+             "Generic",
+             "Generic AR71XX/AR724X/AR913X based board",
+             ath79_generic_init);
diff --git a/arch/mips/configs/ar7_defconfig b/arch/mips/configs/ar7_defconfig
index c78c7e7e41d..6cd5a519ce5 100644
--- a/arch/mips/configs/ar7_defconfig
+++ b/arch/mips/configs/ar7_defconfig
@@ -14,7 +14,7 @@ CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_RD_LZMA=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/bcm47xx_defconfig b/arch/mips/configs/bcm47xx_defconfig
index 927d58b2cd0..22fdf2f0cc2 100644
--- a/arch/mips/configs/bcm47xx_defconfig
+++ b/arch/mips/configs/bcm47xx_defconfig
@@ -21,7 +21,7 @@ CONFIG_CGROUP_CPUACCT=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_RD_LZMA=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/configs/bcm63xx_defconfig b/arch/mips/configs/bcm63xx_defconfig
index b806a4e3289..919005139f5 100644
--- a/arch/mips/configs/bcm63xx_defconfig
+++ b/arch/mips/configs/bcm63xx_defconfig
@@ -10,7 +10,7 @@ CONFIG_EXPERIMENTAL=y
 # CONFIG_SWAP is not set
 CONFIG_TINY_RCU=y
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_PCSPKR_PLATFORM is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/mips/configs/bigsur_defconfig b/arch/mips/configs/bigsur_defconfig
index 9749bc8758d..1cdff6b6327 100644
--- a/arch/mips/configs/bigsur_defconfig
+++ b/arch/mips/configs/bigsur_defconfig
@@ -26,7 +26,7 @@ CONFIG_PID_NS=y
 CONFIG_NET_NS=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_PCSPKR_PLATFORM is not set
 CONFIG_SLAB=y
diff --git a/arch/mips/configs/capcella_defconfig b/arch/mips/configs/capcella_defconfig
index 502a8e9c084..5135dc0b950 100644
--- a/arch/mips/configs/capcella_defconfig
+++ b/arch/mips/configs/capcella_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/configs/cavium-octeon_defconfig b/arch/mips/configs/cavium-octeon_defconfig
index 3567b6f07b3..75165dfa60c 100644
--- a/arch/mips/configs/cavium-octeon_defconfig
+++ b/arch/mips/configs/cavium-octeon_defconfig
@@ -15,7 +15,7 @@ CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_PCSPKR_PLATFORM is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/cobalt_defconfig b/arch/mips/configs/cobalt_defconfig
index 6c4f7e9d338..5419adb219a 100644
--- a/arch/mips/configs/cobalt_defconfig
+++ b/arch/mips/configs/cobalt_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/mips/configs/db1000_defconfig b/arch/mips/configs/db1000_defconfig
index dda158b2c8d..4044c9e0fb7 100644
--- a/arch/mips/configs/db1000_defconfig
+++ b/arch/mips/configs/db1000_defconfig
@@ -11,7 +11,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/mips/configs/db1100_defconfig b/arch/mips/configs/db1100_defconfig
index 7e4fc76df53..c6b49938ee8 100644
--- a/arch/mips/configs/db1100_defconfig
+++ b/arch/mips/configs/db1100_defconfig
@@ -11,7 +11,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/db1200_defconfig b/arch/mips/configs/db1200_defconfig
index 6fe205fa7b6..1f69249b839 100644
--- a/arch/mips/configs/db1200_defconfig
+++ b/arch/mips/configs/db1200_defconfig
@@ -12,7 +12,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/db1500_defconfig b/arch/mips/configs/db1500_defconfig
index a741c55448d..b6e21c7cb6b 100644
--- a/arch/mips/configs/db1500_defconfig
+++ b/arch/mips/configs/db1500_defconfig
@@ -10,7 +10,7 @@ CONFIG_LOCALVERSION="-db1500"
 CONFIG_KERNEL_LZMA=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/mips/configs/db1550_defconfig b/arch/mips/configs/db1550_defconfig
index cd32dd8c800..798a553c9e8 100644
--- a/arch/mips/configs/db1550_defconfig
+++ b/arch/mips/configs/db1550_defconfig
@@ -11,7 +11,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/decstation_defconfig b/arch/mips/configs/decstation_defconfig
index b15bfd1e69c..87d0340837a 100644
--- a/arch/mips/configs/decstation_defconfig
+++ b/arch/mips/configs/decstation_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_HOTPLUG is not set
 CONFIG_SLAB=y
diff --git a/arch/mips/configs/e55_defconfig b/arch/mips/configs/e55_defconfig
index 0b60c06a943..0126e66d60c 100644
--- a/arch/mips/configs/e55_defconfig
+++ b/arch/mips/configs/e55_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/fuloong2e_defconfig b/arch/mips/configs/fuloong2e_defconfig
index 63944a14b81..e5b73de08fc 100644
--- a/arch/mips/configs/fuloong2e_defconfig
+++ b/arch/mips/configs/fuloong2e_defconfig
@@ -17,7 +17,7 @@ CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_PID_NS=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_PCSPKR_PLATFORM is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
diff --git a/arch/mips/configs/gpr_defconfig b/arch/mips/configs/gpr_defconfig
index 53edc134f27..48a40aefaf5 100644
--- a/arch/mips/configs/gpr_defconfig
+++ b/arch/mips/configs/gpr_defconfig
@@ -11,7 +11,7 @@ CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_PROFILING=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/ip22_defconfig b/arch/mips/configs/ip22_defconfig
index 36de199f4c2..d1606569b00 100644
--- a/arch/mips/configs/ip22_defconfig
+++ b/arch/mips/configs/ip22_defconfig
@@ -17,7 +17,7 @@ CONFIG_IPC_NS=y
 CONFIG_USER_NS=y
 CONFIG_PID_NS=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 # CONFIG_PCSPKR_PLATFORM is not set
 # CONFIG_COMPAT_BRK is not set
diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
index 4b16c48b0c3..0e36abcd39c 100644
--- a/arch/mips/configs/ip27_defconfig
+++ b/arch/mips/configs/ip27_defconfig
@@ -15,7 +15,7 @@ CONFIG_CGROUPS=y
 CONFIG_CPUSETS=y
 CONFIG_RELAY=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_PCSPKR_PLATFORM is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/ip28_defconfig b/arch/mips/configs/ip28_defconfig
index 98f2c7736e8..4dbf6269b3f 100644
--- a/arch/mips/configs/ip28_defconfig
+++ b/arch/mips/configs/ip28_defconfig
@@ -8,7 +8,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/ip32_defconfig b/arch/mips/configs/ip32_defconfig
index 5bea99b26fa..7bbd52194fc 100644
--- a/arch/mips/configs/ip32_defconfig
+++ b/arch/mips/configs/ip32_defconfig
@@ -10,7 +10,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_RELAY=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=m
diff --git a/arch/mips/configs/jazz_defconfig b/arch/mips/configs/jazz_defconfig
index 6ae46bcdb20..92a60aecad5 100644
--- a/arch/mips/configs/jazz_defconfig
+++ b/arch/mips/configs/jazz_defconfig
@@ -10,7 +10,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/jmr3927_defconfig b/arch/mips/configs/jmr3927_defconfig
index bf24e9309b9..db5705e18b3 100644
--- a/arch/mips/configs/jmr3927_defconfig
+++ b/arch/mips/configs/jmr3927_defconfig
@@ -4,7 +4,7 @@ CONFIG_TOSHIBA_JMR3927=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 # CONFIG_PCSPKR_PLATFORM is not set
 CONFIG_SLAB=y
diff --git a/arch/mips/configs/lasat_defconfig b/arch/mips/configs/lasat_defconfig
index 6447261c61d..d9f3db29ab9 100644
--- a/arch/mips/configs/lasat_defconfig
+++ b/arch/mips/configs/lasat_defconfig
@@ -8,7 +8,7 @@ CONFIG_HZ_1000=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
diff --git a/arch/mips/configs/lemote2f_defconfig b/arch/mips/configs/lemote2f_defconfig
index f7033f3a582..167c1d07b80 100644
--- a/arch/mips/configs/lemote2f_defconfig
+++ b/arch/mips/configs/lemote2f_defconfig
@@ -21,7 +21,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=m
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/malta_defconfig b/arch/mips/configs/malta_defconfig
index b455d0f3648..7270f3183bd 100644
--- a/arch/mips/configs/malta_defconfig
+++ b/arch/mips/configs/malta_defconfig
@@ -15,7 +15,7 @@ CONFIG_UTS_NS=y
 CONFIG_IPC_NS=y
 CONFIG_PID_NS=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
@@ -369,7 +369,10 @@ CONFIG_VT_HW_CONSOLE_BINDING=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 # CONFIG_HWMON is not set
+CONFIG_FB=y
+CONFIG_FB_CIRRUS=y
 # CONFIG_VGA_CONSOLE is not set
+CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_HID=m
 CONFIG_LEDS_CLASS=m
 CONFIG_LEDS_TRIGGER_TIMER=m
diff --git a/arch/mips/configs/markeins_defconfig b/arch/mips/configs/markeins_defconfig
index 86bf001babe..9c9a123016c 100644
--- a/arch/mips/configs/markeins_defconfig
+++ b/arch/mips/configs/markeins_defconfig
@@ -9,7 +9,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/configs/mipssim_defconfig b/arch/mips/configs/mipssim_defconfig
index 4925f507dc2..b5ad7387bbb 100644
--- a/arch/mips/configs/mipssim_defconfig
+++ b/arch/mips/configs/mipssim_defconfig
@@ -7,7 +7,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/configs/mpc30x_defconfig b/arch/mips/configs/mpc30x_defconfig
index efb779f8f6f..c16de981292 100644
--- a/arch/mips/configs/mpc30x_defconfig
+++ b/arch/mips/configs/mpc30x_defconfig
@@ -5,7 +5,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/configs/msp71xx_defconfig b/arch/mips/configs/msp71xx_defconfig
index ab051458452..d1142e9cd9a 100644
--- a/arch/mips/configs/msp71xx_defconfig
+++ b/arch/mips/configs/msp71xx_defconfig
@@ -8,7 +8,7 @@ CONFIG_LOCALVERSION="-pmc"
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SHMEM is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/mtx1_defconfig b/arch/mips/configs/mtx1_defconfig
index 814699754e0..a97a42c6b2c 100644
--- a/arch/mips/configs/mtx1_defconfig
+++ b/arch/mips/configs/mtx1_defconfig
@@ -11,7 +11,7 @@ CONFIG_AUDIT=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=m
diff --git a/arch/mips/configs/pb1100_defconfig b/arch/mips/configs/pb1100_defconfig
index 1597aa1842f..75eb1b1f316 100644
--- a/arch/mips/configs/pb1100_defconfig
+++ b/arch/mips/configs/pb1100_defconfig
@@ -11,7 +11,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/pb1200_defconfig b/arch/mips/configs/pb1200_defconfig
index 96f0d43cf08..dcbe2704e5e 100644
--- a/arch/mips/configs/pb1200_defconfig
+++ b/arch/mips/configs/pb1200_defconfig
@@ -12,7 +12,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/pb1500_defconfig b/arch/mips/configs/pb1500_defconfig
index b4bfd482345..fa00487146f 100644
--- a/arch/mips/configs/pb1500_defconfig
+++ b/arch/mips/configs/pb1500_defconfig
@@ -11,7 +11,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/pb1550_defconfig b/arch/mips/configs/pb1550_defconfig
index 5a660024d22..e83d6497e8b 100644
--- a/arch/mips/configs/pb1550_defconfig
+++ b/arch/mips/configs/pb1550_defconfig
@@ -11,7 +11,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/pnx8335-stb225_defconfig b/arch/mips/configs/pnx8335-stb225_defconfig
index 39926a1a96b..f2925769dfa 100644
--- a/arch/mips/configs/pnx8335-stb225_defconfig
+++ b/arch/mips/configs/pnx8335-stb225_defconfig
@@ -11,7 +11,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/configs/pnx8550-jbs_defconfig b/arch/mips/configs/pnx8550-jbs_defconfig
index 3376bc8616c..1d1f2067f3e 100644
--- a/arch/mips/configs/pnx8550-jbs_defconfig
+++ b/arch/mips/configs/pnx8550-jbs_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/pnx8550-stb810_defconfig b/arch/mips/configs/pnx8550-stb810_defconfig
index 6514f1bf0af..15c66a571f9 100644
--- a/arch/mips/configs/pnx8550-stb810_defconfig
+++ b/arch/mips/configs/pnx8550-stb810_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_HOTPLUG is not set
 CONFIG_SLAB=y
diff --git a/arch/mips/configs/powertv_defconfig b/arch/mips/configs/powertv_defconfig
index f1f58e91dd8..3b0b6e8c853 100644
--- a/arch/mips/configs/powertv_defconfig
+++ b/arch/mips/configs/powertv_defconfig
@@ -14,7 +14,7 @@ CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_RD_GZIP is not set
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_PCSPKR_PLATFORM is not set
diff --git a/arch/mips/configs/rb532_defconfig b/arch/mips/configs/rb532_defconfig
index d6457bc38c7..55902d9cd0f 100644
--- a/arch/mips/configs/rb532_defconfig
+++ b/arch/mips/configs/rb532_defconfig
@@ -13,7 +13,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/mips/configs/rbtx49xx_defconfig b/arch/mips/configs/rbtx49xx_defconfig
index 29acfab3151..9cba856277f 100644
--- a/arch/mips/configs/rbtx49xx_defconfig
+++ b/arch/mips/configs/rbtx49xx_defconfig
@@ -12,7 +12,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 # CONFIG_PCSPKR_PLATFORM is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/mips/configs/rm200_defconfig b/arch/mips/configs/rm200_defconfig
index 2b3e47653f6..2c0230e76d2 100644
--- a/arch/mips/configs/rm200_defconfig
+++ b/arch/mips/configs/rm200_defconfig
@@ -12,7 +12,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/configs/sb1250-swarm_defconfig b/arch/mips/configs/sb1250-swarm_defconfig
index 64840d71775..5b0463ef938 100644
--- a/arch/mips/configs/sb1250-swarm_defconfig
+++ b/arch/mips/configs/sb1250-swarm_defconfig
@@ -15,7 +15,7 @@ CONFIG_RELAY=y
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/tb0219_defconfig b/arch/mips/configs/tb0219_defconfig
index d9be37fc9cb..30036b4cbeb 100644
--- a/arch/mips/configs/tb0219_defconfig
+++ b/arch/mips/configs/tb0219_defconfig
@@ -5,7 +5,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_PCSPKR_PLATFORM is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/tb0226_defconfig b/arch/mips/configs/tb0226_defconfig
index 3d25dd08907..81bfa1d4d8e 100644
--- a/arch/mips/configs/tb0226_defconfig
+++ b/arch/mips/configs/tb0226_defconfig
@@ -5,7 +5,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_PCSPKR_PLATFORM is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/mips/configs/tb0287_defconfig b/arch/mips/configs/tb0287_defconfig
index be697c9b23c..c415c4f0e5c 100644
--- a/arch/mips/configs/tb0287_defconfig
+++ b/arch/mips/configs/tb0287_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_PCSPKR_PLATFORM is not set
 CONFIG_SLAB=y
diff --git a/arch/mips/configs/workpad_defconfig b/arch/mips/configs/workpad_defconfig
index 7ec9287254d..ee4b2be43c4 100644
--- a/arch/mips/configs/workpad_defconfig
+++ b/arch/mips/configs/workpad_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/configs/wrppmc_defconfig b/arch/mips/configs/wrppmc_defconfig
index a231b73b1a4..44a451be359 100644
--- a/arch/mips/configs/wrppmc_defconfig
+++ b/arch/mips/configs/wrppmc_defconfig
@@ -7,7 +7,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 # CONFIG_EPOLL is not set
 CONFIG_SLAB=y
diff --git a/arch/mips/configs/yosemite_defconfig b/arch/mips/configs/yosemite_defconfig
index ab3a3dcec04..f72d305a3f0 100644
--- a/arch/mips/configs/yosemite_defconfig
+++ b/arch/mips/configs/yosemite_defconfig
@@ -8,7 +8,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
index 37f175c42bb..650ac9ba734 100644
--- a/arch/mips/include/asm/cache.h
+++ b/arch/mips/include/asm/cache.h
@@ -17,4 +17,6 @@
 #define SMP_CACHE_SHIFT         L1_CACHE_SHIFT
 #define SMP_CACHE_BYTES         L1_CACHE_BYTES
 
+#define __read_mostly __attribute__((__section__(".data.read_mostly")))
+
 #endif /* _ASM_CACHE_H */
diff --git a/arch/mips/include/asm/cpu-info.h b/arch/mips/include/asm/cpu-info.h
index b39def3f6e0..c454550eb0c 100644
--- a/arch/mips/include/asm/cpu-info.h
+++ b/arch/mips/include/asm/cpu-info.h
@@ -78,6 +78,7 @@ struct cpuinfo_mips {
         unsigned int            watch_reg_use_cnt; /* Usable by ptrace */
 #define NUM_WATCH_REGS 4
         u16                     watch_reg_masks[NUM_WATCH_REGS];
+        unsigned int            kscratch_mask; /* Usable KScratch mask. */
 } __attribute__((aligned(SMP_CACHE_BYTES)));
 
 extern struct cpuinfo_mips cpu_data[];
diff --git a/arch/mips/include/asm/inst.h b/arch/mips/include/asm/inst.h
index 444ff71aa0e..7ebfc392e58 100644
--- a/arch/mips/include/asm/inst.h
+++ b/arch/mips/include/asm/inst.h
@@ -72,6 +72,7 @@ enum spec2_op {
 enum spec3_op {
         ext_op, dextm_op, dextu_op, dext_op,
         ins_op, dinsm_op, dinsu_op, dins_op,
+        lx_op = 0x0a,
         bshfl_op = 0x20,
         dbshfl_op = 0x24,
         rdhwr_op = 0x3b
@@ -179,6 +180,19 @@ enum mad_func {
 };
 
 /*
+ * func field for special3 lx opcodes (Cavium Octeon).
+ */
+enum lx_func {
+        lwx_op  = 0x00,
+        lhx_op  = 0x04,
+        lbux_op = 0x06,
+        ldx_op  = 0x08,
+        lwux_op = 0x10,
+        lhux_op = 0x14,
+        lbx_op  = 0x16,
+};
+
+/*
  * Damn ...  bitfields depend from byteorder :-(
  */
 #ifdef __MIPSEB__
diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h
new file mode 100644
index 00000000000..7622ccf7507
--- /dev/null
+++ b/arch/mips/include/asm/jump_label.h
@@ -0,0 +1,48 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (c) 2010 Cavium Networks, Inc.
+ */
+#ifndef _ASM_MIPS_JUMP_LABEL_H
+#define _ASM_MIPS_JUMP_LABEL_H
+
+#include <linux/types.h>
+
+#ifdef __KERNEL__
+
+#define JUMP_LABEL_NOP_SIZE 4
+
+#ifdef CONFIG_64BIT
+#define WORD_INSN ".dword"
+#else
+#define WORD_INSN ".word"
+#endif
+
+#define JUMP_LABEL(key, label)                                          \
+        do {                                                            \
+                asm goto("1:\tnop\n\t"                                  \
+                        "nop\n\t"                                       \
+                        ".pushsection __jump_table,  \"a\"\n\t"         \
+                        WORD_INSN " 1b, %l[" #label "], %0\n\t"         \
+                        ".popsection\n\t"                               \
+                        : :  "i" (key) :  : label);                     \
+        } while (0)
+
+
+#endif /* __KERNEL__ */
+
+#ifdef CONFIG_64BIT
+typedef u64 jump_label_t;
+#else
+typedef u32 jump_label_t;
+#endif
+
+struct jump_entry {
+        jump_label_t code;
+        jump_label_t target;
+        jump_label_t key;
+};
+
+#endif /* _ASM_MIPS_JUMP_LABEL_H */
diff --git a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
new file mode 100644
index 00000000000..cda1c8070b2
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
@@ -0,0 +1,233 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X SoC register definitions
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  Parts of this file are based on Atheros' 2.6.15 BSP
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef __ASM_MACH_AR71XX_REGS_H
+#define __ASM_MACH_AR71XX_REGS_H
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/bitops.h>
+
+#define AR71XX_APB_BASE         0x18000000
+#define AR71XX_SPI_BASE         0x1f000000
+#define AR71XX_SPI_SIZE         0x01000000
+
+#define AR71XX_DDR_CTRL_BASE    (AR71XX_APB_BASE + 0x00000000)
+#define AR71XX_DDR_CTRL_SIZE    0x100
+#define AR71XX_UART_BASE        (AR71XX_APB_BASE + 0x00020000)
+#define AR71XX_UART_SIZE        0x100
+#define AR71XX_GPIO_BASE        (AR71XX_APB_BASE + 0x00040000)
+#define AR71XX_GPIO_SIZE        0x100
+#define AR71XX_PLL_BASE         (AR71XX_APB_BASE + 0x00050000)
+#define AR71XX_PLL_SIZE         0x100
+#define AR71XX_RESET_BASE       (AR71XX_APB_BASE + 0x00060000)
+#define AR71XX_RESET_SIZE       0x100
+
+#define AR913X_WMAC_BASE        (AR71XX_APB_BASE + 0x000C0000)
+#define AR913X_WMAC_SIZE        0x30000
+
+/*
+ * DDR_CTRL block
+ */
+#define AR71XX_DDR_REG_PCI_WIN0         0x7c
+#define AR71XX_DDR_REG_PCI_WIN1         0x80
+#define AR71XX_DDR_REG_PCI_WIN2         0x84
+#define AR71XX_DDR_REG_PCI_WIN3         0x88
+#define AR71XX_DDR_REG_PCI_WIN4         0x8c
+#define AR71XX_DDR_REG_PCI_WIN5         0x90
+#define AR71XX_DDR_REG_PCI_WIN6         0x94
+#define AR71XX_DDR_REG_PCI_WIN7         0x98
+#define AR71XX_DDR_REG_FLUSH_GE0        0x9c
+#define AR71XX_DDR_REG_FLUSH_GE1        0xa0
+#define AR71XX_DDR_REG_FLUSH_USB        0xa4
+#define AR71XX_DDR_REG_FLUSH_PCI        0xa8
+
+#define AR724X_DDR_REG_FLUSH_GE0        0x7c
+#define AR724X_DDR_REG_FLUSH_GE1        0x80
+#define AR724X_DDR_REG_FLUSH_USB        0x84
+#define AR724X_DDR_REG_FLUSH_PCIE       0x88
+
+#define AR913X_DDR_REG_FLUSH_GE0        0x7c
+#define AR913X_DDR_REG_FLUSH_GE1        0x80
+#define AR913X_DDR_REG_FLUSH_USB        0x84
+#define AR913X_DDR_REG_FLUSH_WMAC       0x88
+
+/*
+ * PLL block
+ */
+#define AR71XX_PLL_REG_CPU_CONFIG       0x00
+#define AR71XX_PLL_REG_SEC_CONFIG       0x04
+#define AR71XX_PLL_REG_ETH0_INT_CLOCK   0x10
+#define AR71XX_PLL_REG_ETH1_INT_CLOCK   0x14
+
+#define AR71XX_PLL_DIV_SHIFT            3
+#define AR71XX_PLL_DIV_MASK             0x1f
+#define AR71XX_CPU_DIV_SHIFT            16
+#define AR71XX_CPU_DIV_MASK             0x3
+#define AR71XX_DDR_DIV_SHIFT            18
+#define AR71XX_DDR_DIV_MASK             0x3
+#define AR71XX_AHB_DIV_SHIFT            20
+#define AR71XX_AHB_DIV_MASK             0x7
+
+#define AR724X_PLL_REG_CPU_CONFIG       0x00
+#define AR724X_PLL_REG_PCIE_CONFIG      0x18
+
+#define AR724X_PLL_DIV_SHIFT            0
+#define AR724X_PLL_DIV_MASK             0x3ff
+#define AR724X_PLL_REF_DIV_SHIFT        10
+#define AR724X_PLL_REF_DIV_MASK         0xf
+#define AR724X_AHB_DIV_SHIFT            19
+#define AR724X_AHB_DIV_MASK             0x1
+#define AR724X_DDR_DIV_SHIFT            22
+#define AR724X_DDR_DIV_MASK             0x3
+
+#define AR913X_PLL_REG_CPU_CONFIG       0x00
+#define AR913X_PLL_REG_ETH_CONFIG       0x04
+#define AR913X_PLL_REG_ETH0_INT_CLOCK   0x14
+#define AR913X_PLL_REG_ETH1_INT_CLOCK   0x18
+
+#define AR913X_PLL_DIV_SHIFT            0
+#define AR913X_PLL_DIV_MASK             0x3ff
+#define AR913X_DDR_DIV_SHIFT            22
+#define AR913X_DDR_DIV_MASK             0x3
+#define AR913X_AHB_DIV_SHIFT            19
+#define AR913X_AHB_DIV_MASK             0x1
+
+/*
+ * RESET block
+ */
+#define AR71XX_RESET_REG_TIMER                  0x00
+#define AR71XX_RESET_REG_TIMER_RELOAD           0x04
+#define AR71XX_RESET_REG_WDOG_CTRL              0x08
+#define AR71XX_RESET_REG_WDOG                   0x0c
+#define AR71XX_RESET_REG_MISC_INT_STATUS        0x10
+#define AR71XX_RESET_REG_MISC_INT_ENABLE        0x14
+#define AR71XX_RESET_REG_PCI_INT_STATUS         0x18
+#define AR71XX_RESET_REG_PCI_INT_ENABLE         0x1c
+#define AR71XX_RESET_REG_GLOBAL_INT_STATUS      0x20
+#define AR71XX_RESET_REG_RESET_MODULE           0x24
+#define AR71XX_RESET_REG_PERFC_CTRL             0x2c
+#define AR71XX_RESET_REG_PERFC0                 0x30
+#define AR71XX_RESET_REG_PERFC1                 0x34
+#define AR71XX_RESET_REG_REV_ID                 0x90
+
+#define AR913X_RESET_REG_GLOBAL_INT_STATUS      0x18
+#define AR913X_RESET_REG_RESET_MODULE           0x1c
+#define AR913X_RESET_REG_PERF_CTRL              0x20
+#define AR913X_RESET_REG_PERFC0                 0x24
+#define AR913X_RESET_REG_PERFC1                 0x28
+
+#define AR724X_RESET_REG_RESET_MODULE           0x1c
+
+#define MISC_INT_DMA                    BIT(7)
+#define MISC_INT_OHCI                   BIT(6)
+#define MISC_INT_PERFC                  BIT(5)
+#define MISC_INT_WDOG                   BIT(4)
+#define MISC_INT_UART                   BIT(3)
+#define MISC_INT_GPIO                   BIT(2)
+#define MISC_INT_ERROR                  BIT(1)
+#define MISC_INT_TIMER                  BIT(0)
+
+#define AR71XX_RESET_EXTERNAL           BIT(28)
+#define AR71XX_RESET_FULL_CHIP          BIT(24)
+#define AR71XX_RESET_CPU_NMI            BIT(21)
+#define AR71XX_RESET_CPU_COLD           BIT(20)
+#define AR71XX_RESET_DMA                BIT(19)
+#define AR71XX_RESET_SLIC               BIT(18)
+#define AR71XX_RESET_STEREO             BIT(17)
+#define AR71XX_RESET_DDR                BIT(16)
+#define AR71XX_RESET_GE1_MAC            BIT(13)
+#define AR71XX_RESET_GE1_PHY            BIT(12)
+#define AR71XX_RESET_USBSUS_OVERRIDE    BIT(10)
+#define AR71XX_RESET_GE0_MAC            BIT(9)
+#define AR71XX_RESET_GE0_PHY            BIT(8)
+#define AR71XX_RESET_USB_OHCI_DLL       BIT(6)
+#define AR71XX_RESET_USB_HOST           BIT(5)
+#define AR71XX_RESET_USB_PHY            BIT(4)
+#define AR71XX_RESET_PCI_BUS            BIT(1)
+#define AR71XX_RESET_PCI_CORE           BIT(0)
+
+#define AR724X_RESET_GE1_MDIO           BIT(23)
+#define AR724X_RESET_GE0_MDIO           BIT(22)
+#define AR724X_RESET_PCIE_PHY_SERIAL    BIT(10)
+#define AR724X_RESET_PCIE_PHY           BIT(7)
+#define AR724X_RESET_PCIE               BIT(6)
+#define AR724X_RESET_OHCI_DLL           BIT(3)
+
+#define AR913X_RESET_AMBA2WMAC          BIT(22)
+
+#define REV_ID_MAJOR_MASK               0xfff0
+#define REV_ID_MAJOR_AR71XX             0x00a0
+#define REV_ID_MAJOR_AR913X             0x00b0
+#define REV_ID_MAJOR_AR7240             0x00c0
+#define REV_ID_MAJOR_AR7241             0x0100
+#define REV_ID_MAJOR_AR7242             0x1100
+
+#define AR71XX_REV_ID_MINOR_MASK        0x3
+#define AR71XX_REV_ID_MINOR_AR7130      0x0
+#define AR71XX_REV_ID_MINOR_AR7141      0x1
+#define AR71XX_REV_ID_MINOR_AR7161      0x2
+#define AR71XX_REV_ID_REVISION_MASK     0x3
+#define AR71XX_REV_ID_REVISION_SHIFT    2
+
+#define AR913X_REV_ID_MINOR_MASK        0x3
+#define AR913X_REV_ID_MINOR_AR9130      0x0
+#define AR913X_REV_ID_MINOR_AR9132      0x1
+#define AR913X_REV_ID_REVISION_MASK     0x3
+#define AR913X_REV_ID_REVISION_SHIFT    2
+
+#define AR724X_REV_ID_REVISION_MASK     0x3
+
+/*
+ * SPI block
+ */
+#define AR71XX_SPI_REG_FS       0x00    /* Function Select */
+#define AR71XX_SPI_REG_CTRL     0x04    /* SPI Control */
+#define AR71XX_SPI_REG_IOC      0x08    /* SPI I/O Control */
+#define AR71XX_SPI_REG_RDS      0x0c    /* Read Data Shift */
+
+#define AR71XX_SPI_FS_GPIO      BIT(0)  /* Enable GPIO mode */
+
+#define AR71XX_SPI_CTRL_RD      BIT(6)  /* Remap Disable */
+#define AR71XX_SPI_CTRL_DIV_MASK 0x3f
+
+#define AR71XX_SPI_IOC_DO       BIT(0)  /* Data Out pin */
+#define AR71XX_SPI_IOC_CLK      BIT(8)  /* CLK pin */
+#define AR71XX_SPI_IOC_CS(n)    BIT(16 + (n))
+#define AR71XX_SPI_IOC_CS0      AR71XX_SPI_IOC_CS(0)
+#define AR71XX_SPI_IOC_CS1      AR71XX_SPI_IOC_CS(1)
+#define AR71XX_SPI_IOC_CS2      AR71XX_SPI_IOC_CS(2)
+#define AR71XX_SPI_IOC_CS_ALL   (AR71XX_SPI_IOC_CS0 | AR71XX_SPI_IOC_CS1 | \
+                                 AR71XX_SPI_IOC_CS2)
+
+/*
+ * GPIO block
+ */
+#define AR71XX_GPIO_REG_OE              0x00
+#define AR71XX_GPIO_REG_IN              0x04
+#define AR71XX_GPIO_REG_OUT             0x08
+#define AR71XX_GPIO_REG_SET             0x0c
+#define AR71XX_GPIO_REG_CLEAR           0x10
+#define AR71XX_GPIO_REG_INT_MODE        0x14
+#define AR71XX_GPIO_REG_INT_TYPE        0x18
+#define AR71XX_GPIO_REG_INT_POLARITY    0x1c
+#define AR71XX_GPIO_REG_INT_PENDING     0x20
+#define AR71XX_GPIO_REG_INT_ENABLE      0x24
+#define AR71XX_GPIO_REG_FUNC            0x28
+
+#define AR71XX_GPIO_COUNT               16
+#define AR724X_GPIO_COUNT               18
+#define AR913X_GPIO_COUNT               22
+
+#endif /* __ASM_MACH_AR71XX_REGS_H */
diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h
new file mode 100644
index 00000000000..6a9f168506f
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath79/ath79.h
@@ -0,0 +1,96 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X common definitions
+ *
+ *  Copyright (C) 2008-2011 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  Parts of this file are based on Atheros' 2.6.15 BSP
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef __ASM_MACH_ATH79_H
+#define __ASM_MACH_ATH79_H
+
+#include <linux/types.h>
+#include <linux/io.h>
+
+enum ath79_soc_type {
+        ATH79_SOC_UNKNOWN,
+        ATH79_SOC_AR7130,
+        ATH79_SOC_AR7141,
+        ATH79_SOC_AR7161,
+        ATH79_SOC_AR7240,
+        ATH79_SOC_AR7241,
+        ATH79_SOC_AR7242,
+        ATH79_SOC_AR9130,
+        ATH79_SOC_AR9132
+};
+
+extern enum ath79_soc_type ath79_soc;
+
+static inline int soc_is_ar71xx(void)
+{
+        return (ath79_soc == ATH79_SOC_AR7130 ||
+                ath79_soc == ATH79_SOC_AR7141 ||
+                ath79_soc == ATH79_SOC_AR7161);
+}
+
+static inline int soc_is_ar724x(void)
+{
+        return (ath79_soc == ATH79_SOC_AR7240 ||
+                ath79_soc == ATH79_SOC_AR7241 ||
+                ath79_soc == ATH79_SOC_AR7242);
+}
+
+static inline int soc_is_ar7240(void)
+{
+        return (ath79_soc == ATH79_SOC_AR7240);
+}
+
+static inline int soc_is_ar7241(void)
+{
+        return (ath79_soc == ATH79_SOC_AR7241);
+}
+
+static inline int soc_is_ar7242(void)
+{
+        return (ath79_soc == ATH79_SOC_AR7242);
+}
+
+static inline int soc_is_ar913x(void)
+{
+        return (ath79_soc == ATH79_SOC_AR9130 ||
+                ath79_soc == ATH79_SOC_AR9132);
+}
+
+extern void __iomem *ath79_ddr_base;
+extern void __iomem *ath79_pll_base;
+extern void __iomem *ath79_reset_base;
+
+static inline void ath79_pll_wr(unsigned reg, u32 val)
+{
+        __raw_writel(val, ath79_pll_base + reg);
+}
+
+static inline u32 ath79_pll_rr(unsigned reg)
+{
+        return __raw_readl(ath79_pll_base + reg);
+}
+
+static inline void ath79_reset_wr(unsigned reg, u32 val)
+{
+        __raw_writel(val, ath79_reset_base + reg);
+}
+
+static inline u32 ath79_reset_rr(unsigned reg)
+{
+        return __raw_readl(ath79_reset_base + reg);
+}
+
+void ath79_device_reset_set(u32 mask);
+void ath79_device_reset_clear(u32 mask);
+
+#endif /* __ASM_MACH_ATH79_H */
diff --git a/arch/mips/include/asm/mach-ath79/ath79_spi_platform.h b/arch/mips/include/asm/mach-ath79/ath79_spi_platform.h
new file mode 100644
index 00000000000..aa2283e602f
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath79/ath79_spi_platform.h
@@ -0,0 +1,23 @@
+/*
+ *  Platform data definition for Atheros AR71XX/AR724X/AR913X SPI controller
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#ifndef _ATH79_SPI_PLATFORM_H
+#define _ATH79_SPI_PLATFORM_H
+
+struct ath79_spi_platform_data {
+        unsigned        bus_num;
+        unsigned        num_chipselect;
+};
+
+struct ath79_spi_controller_data {
+        unsigned        gpio;
+};
+
+#endif /* _ATH79_SPI_PLATFORM_H */
diff --git a/arch/mips/include/asm/mach-ath79/cpu-feature-overrides.h b/arch/mips/include/asm/mach-ath79/cpu-feature-overrides.h
new file mode 100644
index 00000000000..4476fa03bf3
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath79/cpu-feature-overrides.h
@@ -0,0 +1,56 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X specific CPU feature overrides
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This file was derived from: include/asm-mips/cpu-features.h
+ *      Copyright (C) 2003, 2004 Ralf Baechle
+ *      Copyright (C) 2004 Maciej W. Rozycki
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+#ifndef __ASM_MACH_ATH79_CPU_FEATURE_OVERRIDES_H
+#define __ASM_MACH_ATH79_CPU_FEATURE_OVERRIDES_H
+
+#define cpu_has_tlb             1
+#define cpu_has_4kex            1
+#define cpu_has_3k_cache        0
+#define cpu_has_4k_cache        1
+#define cpu_has_tx39_cache      0
+#define cpu_has_sb1_cache       0
+#define cpu_has_fpu             0
+#define cpu_has_32fpr           0
+#define cpu_has_counter         1
+#define cpu_has_watch           1
+#define cpu_has_divec           1
+
+#define cpu_has_prefetch        1
+#define cpu_has_ejtag           1
+#define cpu_has_llsc            1
+
+#define cpu_has_mips16          1
+#define cpu_has_mdmx            0
+#define cpu_has_mips3d          0
+#define cpu_has_smartmips       0
+
+#define cpu_has_mips32r1        1
+#define cpu_has_mips32r2        1
+#define cpu_has_mips64r1        0
+#define cpu_has_mips64r2        0
+
+#define cpu_has_dsp             0
+#define cpu_has_mipsmt          0
+
+#define cpu_has_64bits          0
+#define cpu_has_64bit_zero_reg  0
+#define cpu_has_64bit_gp_regs   0
+#define cpu_has_64bit_addresses 0
+
+#define cpu_dcache_line_size()  32
+#define cpu_icache_line_size()  32
+
+#endif /* __ASM_MACH_ATH79_CPU_FEATURE_OVERRIDES_H */
diff --git a/arch/mips/include/asm/mach-ath79/gpio.h b/arch/mips/include/asm/mach-ath79/gpio.h
new file mode 100644
index 00000000000..60dcb62785b
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath79/gpio.h
@@ -0,0 +1,26 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X GPIO API definitions
+ *
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#ifndef __ASM_MACH_ATH79_GPIO_H
+#define __ASM_MACH_ATH79_GPIO_H
+
+#define ARCH_NR_GPIOS   64
+#include <asm-generic/gpio.h>
+
+int gpio_to_irq(unsigned gpio);
+int irq_to_gpio(unsigned irq);
+int gpio_get_value(unsigned gpio);
+void gpio_set_value(unsigned gpio, int value);
+
+#define gpio_cansleep   __gpio_cansleep
+
+#endif /* __ASM_MACH_ATH79_GPIO_H */
diff --git a/arch/mips/include/asm/mach-ath79/irq.h b/arch/mips/include/asm/mach-ath79/irq.h
new file mode 100644
index 00000000000..189bc6eb9c1
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath79/irq.h
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+#ifndef __ASM_MACH_ATH79_IRQ_H
+#define __ASM_MACH_ATH79_IRQ_H
+
+#define MIPS_CPU_IRQ_BASE       0
+#define NR_IRQS                 16
+
+#define ATH79_MISC_IRQ_BASE     8
+#define ATH79_MISC_IRQ_COUNT    8
+
+#define ATH79_CPU_IRQ_IP2       (MIPS_CPU_IRQ_BASE + 2)
+#define ATH79_CPU_IRQ_USB       (MIPS_CPU_IRQ_BASE + 3)
+#define ATH79_CPU_IRQ_GE0       (MIPS_CPU_IRQ_BASE + 4)
+#define ATH79_CPU_IRQ_GE1       (MIPS_CPU_IRQ_BASE + 5)
+#define ATH79_CPU_IRQ_MISC      (MIPS_CPU_IRQ_BASE + 6)
+#define ATH79_CPU_IRQ_TIMER     (MIPS_CPU_IRQ_BASE + 7)
+
+#define ATH79_MISC_IRQ_TIMER    (ATH79_MISC_IRQ_BASE + 0)
+#define ATH79_MISC_IRQ_ERROR    (ATH79_MISC_IRQ_BASE + 1)
+#define ATH79_MISC_IRQ_GPIO     (ATH79_MISC_IRQ_BASE + 2)
+#define ATH79_MISC_IRQ_UART     (ATH79_MISC_IRQ_BASE + 3)
+#define ATH79_MISC_IRQ_WDOG     (ATH79_MISC_IRQ_BASE + 4)
+#define ATH79_MISC_IRQ_PERFC    (ATH79_MISC_IRQ_BASE + 5)
+#define ATH79_MISC_IRQ_OHCI     (ATH79_MISC_IRQ_BASE + 6)
+#define ATH79_MISC_IRQ_DMA      (ATH79_MISC_IRQ_BASE + 7)
+
+#include_next <irq.h>
+
+#endif /* __ASM_MACH_ATH79_IRQ_H */
diff --git a/arch/mips/include/asm/mach-ath79/kernel-entry-init.h b/arch/mips/include/asm/mach-ath79/kernel-entry-init.h
new file mode 100644
index 00000000000..d8d046bccc8
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath79/kernel-entry-init.h
@@ -0,0 +1,32 @@
+/*
+ *  Atheros AR71XX/AR724X/AR913X specific kernel entry setup
+ *
+ *  Copyright (C) 2009 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+#ifndef __ASM_MACH_ATH79_KERNEL_ENTRY_H
+#define __ASM_MACH_ATH79_KERNEL_ENTRY_H
+
+        /*
+         * Some bootloaders set the 'Kseg0 coherency algorithm' to
+         * 'Cacheable, noncoherent, write-through, no write allocate'
+         * and this cause performance issues. Let's go and change it to
+         * 'Cacheable, noncoherent, write-back, write allocate'
+         */
+        .macro  kernel_entry_setup
+        mfc0    t0, CP0_CONFIG
+        li      t1, ~CONF_CM_CMASK
+        and     t0, t1
+        ori     t0, CONF_CM_CACHABLE_NONCOHERENT
+        mtc0    t0, CP0_CONFIG
+        nop
+        .endm
+
+        .macro  smp_slave_setup
+        .endm
+
+#endif /* __ASM_MACH_ATH79_KERNEL_ENTRY_H */
diff --git a/arch/mips/include/asm/mach-ath79/war.h b/arch/mips/include/asm/mach-ath79/war.h
new file mode 100644
index 00000000000..323d9f1d8c4
--- /dev/null
+++ b/arch/mips/include/asm/mach-ath79/war.h
@@ -0,0 +1,25 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2002, 2004, 2007 by Ralf Baechle <ralf@linux-mips.org>
+ */
+#ifndef __ASM_MACH_ATH79_WAR_H
+#define __ASM_MACH_ATH79_WAR_H
+
+#define R4600_V1_INDEX_ICACHEOP_WAR     0
+#define R4600_V1_HIT_CACHEOP_WAR        0
+#define R4600_V2_HIT_CACHEOP_WAR        0
+#define R5432_CP0_INTERRUPT_WAR         0
+#define BCM1250_M3_WAR                  0
+#define SIBYTE_1956_WAR                 0
+#define MIPS4K_ICACHE_REFILL_WAR        0
+#define MIPS_CACHE_SYNC_WAR             0
+#define TX49XX_ICACHE_INDEX_INV_WAR     0
+#define RM9000_CDEX_SMP_WAR             0
+#define ICACHE_REFILLS_WORKAROUND_WAR   0
+#define R10000_LLSC_WAR                 0
+#define MIPS34K_MISSED_ITLB_WAR         0
+
+#endif /* __ASM_MACH_ATH79_WAR_H */
diff --git a/arch/mips/include/asm/mips_machine.h b/arch/mips/include/asm/mips_machine.h
new file mode 100644
index 00000000000..363bb352c7f
--- /dev/null
+++ b/arch/mips/include/asm/mips_machine.h
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+
+#ifndef __ASM_MIPS_MACHINE_H
+#define __ASM_MIPS_MACHINE_H
+
+#include <linux/init.h>
+#include <linux/stddef.h>
+
+#include <asm/bootinfo.h>
+
+struct mips_machine {
+        unsigned long           mach_type;
+        const char              *mach_id;
+        const char              *mach_name;
+        void                    (*mach_setup)(void);
+};
+
+#define MIPS_MACHINE(_type, _id, _name, _setup)                 \
+static const char machine_name_##_type[] __initconst            \
+                        __aligned(1) = _name;                   \
+static const char machine_id_##_type[] __initconst              \
+                        __aligned(1) = _id;                     \
+static struct mips_machine machine_##_type                      \
+                __used __section(.mips.machines.init) =         \
+{                                                               \
+        .mach_type      = _type,                                \
+        .mach_id        = machine_id_##_type,                   \
+        .mach_name      = machine_name_##_type,                 \
+        .mach_setup     = _setup,                               \
+};
+
+extern long __mips_machines_start;
+extern long __mips_machines_end;
+
+#ifdef CONFIG_MIPS_MACHINE
+int  mips_machtype_setup(char *id) __init;
+void mips_machine_setup(void) __init;
+void mips_set_machine_name(const char *name) __init;
+char *mips_get_machine_name(void);
+#else
+static inline int mips_machtype_setup(char *id) { return 1; }
+static inline void mips_machine_setup(void) { }
+static inline void mips_set_machine_name(const char *name) { }
+static inline char *mips_get_machine_name(void) { return NULL; }
+#endif /* CONFIG_MIPS_MACHINE */
+
+#endif /* __ASM_MIPS_MACHINE_H */
diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index d9592733a7b..73c0d45798d 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -29,13 +29,7 @@
 #define TLBMISS_HANDLER_SETUP_PGD(pgd)                          \
         tlbmiss_handler_setup_pgd((unsigned long)(pgd))
 
-static inline void tlbmiss_handler_setup_pgd(unsigned long pgd)
-{
-        /* Check for swapper_pg_dir and convert to physical address. */
-        if ((pgd & CKSEG3) == CKSEG0)
-                pgd = CPHYSADDR(pgd);
-        write_c0_context(pgd << 11);
-}
+extern void tlbmiss_handler_setup_pgd(unsigned long pgd);
 
 #define TLBMISS_HANDLER_SETUP()                                         \
         do {                                                            \
diff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h
index 892062d6d74..dcbd4bb417e 100644
--- a/arch/mips/include/asm/uasm.h
+++ b/arch/mips/include/asm/uasm.h
@@ -115,7 +115,12 @@ Ip_0(_tlbwr);
 Ip_u3u1u2(_xor);
 Ip_u2u1u3(_xori);
 Ip_u2u1msbu3(_dins);
+Ip_u2u1msbu3(_dinsm);
 Ip_u1(_syscall);
+Ip_u1u2s3(_bbit0);
+Ip_u1u2s3(_bbit1);
+Ip_u3u1u2(_lwx);
+Ip_u3u1u2(_ldx);
 
 /* Handle labels. */
 struct uasm_label {
@@ -153,6 +158,7 @@ static inline void __uasminit uasm_l##lb(struct uasm_label **lab, u32 *addr) \
 # define UASM_i_SUBU(buf, rs, rt, rd) uasm_i_dsubu(buf, rs, rt, rd)
 # define UASM_i_LL(buf, rs, rt, off) uasm_i_lld(buf, rs, rt, off)
 # define UASM_i_SC(buf, rs, rt, off) uasm_i_scd(buf, rs, rt, off)
+# define UASM_i_LWX(buf, rs, rt, rd) uasm_i_ldx(buf, rs, rt, rd)
 #else
 # define UASM_i_LW(buf, rs, rt, off) uasm_i_lw(buf, rs, rt, off)
 # define UASM_i_SW(buf, rs, rt, off) uasm_i_sw(buf, rs, rt, off)
@@ -167,6 +173,7 @@ static inline void __uasminit uasm_l##lb(struct uasm_label **lab, u32 *addr) \
 # define UASM_i_SUBU(buf, rs, rt, rd) uasm_i_subu(buf, rs, rt, rd)
 # define UASM_i_LL(buf, rs, rt, off) uasm_i_ll(buf, rs, rt, off)
 # define UASM_i_SC(buf, rs, rt, off) uasm_i_sc(buf, rs, rt, off)
+# define UASM_i_LWX(buf, rs, rt, rd) uasm_i_lwx(buf, rs, rt, rd)
 #endif
 
 #define uasm_i_b(buf, off) uasm_i_beq(buf, 0, 0, off)
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index 22b2e0e3861..cedee2bcbd1 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -95,6 +95,7 @@ obj-$(CONFIG_GPIO_TXX9)		+= gpio_txx9.o
 obj-$(CONFIG_KEXEC)             += machine_kexec.o relocate_kernel.o
 obj-$(CONFIG_EARLY_PRINTK)      += early_printk.o
 obj-$(CONFIG_SPINLOCK_TEST)     += spinlock_test.o
+obj-$(CONFIG_MIPS_MACHINE)      += mips_machine.o
 
 obj-$(CONFIG_OF)                += prom.o
 
@@ -106,4 +107,6 @@ obj-$(CONFIG_MIPS_CPUFREQ)	+= cpufreq/
 
 obj-$(CONFIG_HW_PERF_EVENTS)    += perf_event.o
 
+obj-$(CONFIG_JUMP_LABEL)        += jump_label.o
+
 CPPFLAGS_vmlinux.lds            := $(KBUILD_CFLAGS)
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 68dae7b6b5d..f65d4c8c65a 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -739,6 +739,8 @@ static inline unsigned int decode_config4(struct cpuinfo_mips *c)
             && cpu_has_tlb)
                 c->tlbsize += (config4 & MIPS_CONF4_MMUSIZEEXT) * 0x40;
 
+        c->kscratch_mask = (config4 >> 16) & 0xff;
+
         return config4 & MIPS_CONF_M;
 }
 
diff --git a/arch/mips/kernel/jump_label.c b/arch/mips/kernel/jump_label.c
new file mode 100644
index 00000000000..6001610cfe5
--- /dev/null
+++ b/arch/mips/kernel/jump_label.c
@@ -0,0 +1,54 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (c) 2010 Cavium Networks, Inc.
+ */
+
+#include <linux/jump_label.h>
+#include <linux/kernel.h>
+#include <linux/memory.h>
+#include <linux/mutex.h>
+#include <linux/types.h>
+#include <linux/cpu.h>
+
+#include <asm/cacheflush.h>
+#include <asm/inst.h>
+
+#ifdef HAVE_JUMP_LABEL
+
+#define J_RANGE_MASK ((1ul << 28) - 1)
+
+void arch_jump_label_transform(struct jump_entry *e,
+                               enum jump_label_type type)
+{
+        union mips_instruction insn;
+        union mips_instruction *insn_p =
+                (union mips_instruction *)(unsigned long)e->code;
+
+        /* Jump only works within a 256MB aligned region. */
+        BUG_ON((e->target & ~J_RANGE_MASK) != (e->code & ~J_RANGE_MASK));
+
+        /* Target must have 4 byte alignment. */
+        BUG_ON((e->target & 3) != 0);
+
+        if (type == JUMP_LABEL_ENABLE) {
+                insn.j_format.opcode = j_op;
+                insn.j_format.target = (e->target & J_RANGE_MASK) >> 2;
+        } else {
+                insn.word = 0; /* nop */
+        }
+
+        get_online_cpus();
+        mutex_lock(&text_mutex);
+        *insn_p = insn;
+
+        flush_icache_range((unsigned long)insn_p,
+                           (unsigned long)insn_p + sizeof(*insn_p));
+
+        mutex_unlock(&text_mutex);
+        put_online_cpus();
+}
+
+#endif /* HAVE_JUMP_LABEL */
diff --git a/arch/mips/kernel/mips_machine.c b/arch/mips/kernel/mips_machine.c
new file mode 100644
index 00000000000..411a058d2c5
--- /dev/null
+++ b/arch/mips/kernel/mips_machine.c
@@ -0,0 +1,86 @@
+/*
+ *  Copyright (C) 2008-2010 Gabor Juhos <juhosg@openwrt.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ *
+ */
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+
+#include <asm/mips_machine.h>
+
+static struct mips_machine *mips_machine __initdata;
+static char *mips_machine_name = "Unknown";
+
+#define for_each_machine(mach) \
+        for ((mach) = (struct mips_machine *)&__mips_machines_start; \
+             (mach) && \
+             (unsigned long)(mach) < (unsigned long)&__mips_machines_end; \
+             (mach)++)
+
+__init void mips_set_machine_name(const char *name)
+{
+        char *p;
+
+        if (name == NULL)
+                return;
+
+        p = kstrdup(name, GFP_KERNEL);
+        if (!p)
+                pr_err("MIPS: no memory for machine_name\n");
+
+        mips_machine_name = p;
+}
+
+char *mips_get_machine_name(void)
+{
+        return mips_machine_name;
+}
+
+__init int mips_machtype_setup(char *id)
+{
+        struct mips_machine *mach;
+
+        for_each_machine(mach) {
+                if (mach->mach_id == NULL)
+                        continue;
+
+                if (strcmp(mach->mach_id, id) == 0) {
+                        mips_machtype = mach->mach_type;
+                        return 0;
+                }
+        }
+
+        pr_err("MIPS: no machine found for id '%s', supported machines:\n", id);
+        pr_err("%-24s %s\n", "id", "name");
+        for_each_machine(mach)
+                pr_err("%-24s %s\n", mach->mach_id, mach->mach_name);
+
+        return 1;
+}
+
+__setup("machtype=", mips_machtype_setup);
+
+__init void mips_machine_setup(void)
+{
+        struct mips_machine *mach;
+
+        for_each_machine(mach) {
+                if (mips_machtype == mach->mach_type) {
+                        mips_machine = mach;
+                        break;
+                }
+        }
+
+        if (!mips_machine)
+                return;
+
+        mips_set_machine_name(mips_machine->mach_name);
+        pr_info("MIPS: machine is %s\n", mips_machine_name);
+
+        if (mips_machine->mach_setup)
+                mips_machine->mach_setup();
+}
diff --git a/arch/mips/kernel/module.c b/arch/mips/kernel/module.c
index d87a72e9fac..dd940b70196 100644
--- a/arch/mips/kernel/module.c
+++ b/arch/mips/kernel/module.c
@@ -30,6 +30,8 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
+#include <linux/jump_label.h>
+
 #include <asm/pgtable.h>        /* MODULE_START */
 
 struct mips_hi16 {
@@ -382,6 +384,9 @@ int module_finalize(const Elf_Ehdr *hdr,
         const Elf_Shdr *s;
         char *secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
 
+        /* Make jump label nops. */
+        jump_label_apply_nops(me);
+
         INIT_LIST_HEAD(&me->arch.dbe_list);
         for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) {
                 if (strcmp("__dbe_table", secstrings + s->sh_name) != 0)
diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
index 26109c4d517..e309665b6c8 100644
--- a/arch/mips/kernel/proc.c
+++ b/arch/mips/kernel/proc.c
@@ -12,6 +12,7 @@
 #include <asm/cpu-features.h>
 #include <asm/mipsregs.h>
 #include <asm/processor.h>
+#include <asm/mips_machine.h>
 
 unsigned int vced_count, vcei_count;
 
@@ -31,8 +32,12 @@ static int show_cpuinfo(struct seq_file *m, void *v)
         /*
          * For the first processor also print the system type
          */
-        if (n == 0)
+        if (n == 0) {
                 seq_printf(m, "system type\t\t: %s\n", get_system_type());
+                if (mips_get_machine_name())
+                        seq_printf(m, "machine\t\t\t: %s\n",
+                                   mips_get_machine_name());
+        }
 
         seq_printf(m, "processor\t\t: %ld\n", n);
         sprintf(fmt, "cpu model\t\t: %%s V%%d.%%d%s\n",
@@ -69,6 +74,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                 );
         seq_printf(m, "shadow register sets\t: %d\n",
                        cpu_data[n].srsets);
+        seq_printf(m, "kscratch registers\t: %d\n",
+                   hweight8(cpu_data[n].kscratch_mask));
         seq_printf(m, "core\t\t\t: %d\n", cpu_data[n].core);
 
         sprintf(fmt, "VCE%%c exceptions\t\t: %s\n",
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index acd3f2c49c0..8ad1d5679f1 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -70,7 +70,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
  * mips_io_port_base is the begin of the address space to which x86 style
  * I/O ports are mapped.
  */
-const unsigned long mips_io_port_base __read_mostly = -1;
+const unsigned long mips_io_port_base = -1;
 EXPORT_SYMBOL(mips_io_port_base);
 
 static struct resource code_resource = { .name = "Kernel code", };
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index e9710430254..71350f7f2d8 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1592,7 +1592,6 @@ void __cpuinit per_cpu_trap_init(void)
 #endif /* CONFIG_MIPS_MT_SMTC */
 
         cpu_data[cpu].asid_cache = ASID_FIRST_VERSION;
-        TLBMISS_HANDLER_SETUP();
 
         atomic_inc(&init_mm.mm_count);
         current->active_mm = &init_mm;
@@ -1614,6 +1613,7 @@ void __cpuinit per_cpu_trap_init(void)
                 write_c0_wired(0);
         }
 #endif /* CONFIG_MIPS_MT_SMTC */
+        TLBMISS_HANDLER_SETUP();
 }
 
 /* Install CPU exception handler */
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index f25df73db92..570607b376b 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -98,6 +98,13 @@ SECTIONS
         INIT_TEXT_SECTION(PAGE_SIZE)
         INIT_DATA_SECTION(16)
 
+        . = ALIGN(4);
+        .mips.machines.init : AT(ADDR(.mips.machines.init) - LOAD_OFFSET) {
+                __mips_machines_start = .;
+                *(.mips.machines.init)
+                __mips_machines_end = .;
+        }
+
         /* .exit.text is discarded at runtime, not link time, to deal with
          * references from .rodata
          */
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 93816f3bca6..083d3412d0b 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -26,8 +26,10 @@
 #include <linux/smp.h>
 #include <linux/string.h>
 #include <linux/init.h>
+#include <linux/cache.h>
 
-#include <asm/mmu_context.h>
+#include <asm/cacheflush.h>
+#include <asm/pgtable.h>
 #include <asm/war.h>
 #include <asm/uasm.h>
 
@@ -63,6 +65,52 @@ static inline int __maybe_unused r10000_llsc_war(void)
         return R10000_LLSC_WAR;
 }
 
+static int use_bbit_insns(void)
+{
+        switch (current_cpu_type()) {
+        case CPU_CAVIUM_OCTEON:
+        case CPU_CAVIUM_OCTEON_PLUS:
+        case CPU_CAVIUM_OCTEON2:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
+static int use_lwx_insns(void)
+{
+        switch (current_cpu_type()) {
+        case CPU_CAVIUM_OCTEON2:
+                return 1;
+        default:
+                return 0;
+        }
+}
+#if defined(CONFIG_CAVIUM_OCTEON_CVMSEG_SIZE) && \
+    CONFIG_CAVIUM_OCTEON_CVMSEG_SIZE > 0
+static bool scratchpad_available(void)
+{
+        return true;
+}
+static int scratchpad_offset(int i)
+{
+        /*
+         * CVMSEG starts at address -32768 and extends for
+         * CAVIUM_OCTEON_CVMSEG_SIZE 128 byte cache lines.
+         */
+        i += 1; /* Kernel use starts at the top and works down. */
+        return CONFIG_CAVIUM_OCTEON_CVMSEG_SIZE * 128 - (8 * i) - 32768;
+}
+#else
+static bool scratchpad_available(void)
+{
+        return false;
+}
+static int scratchpad_offset(int i)
+{
+        BUG();
+}
+#endif
 /*
  * Found by experiment: At least some revisions of the 4kc throw under
  * some circumstances a machine check exception, triggered by invalid
@@ -173,11 +221,41 @@ static struct uasm_reloc relocs[128] __cpuinitdata;
 static int check_for_high_segbits __cpuinitdata;
 #endif
 
+static int check_for_high_segbits __cpuinitdata;
+
+static unsigned int kscratch_used_mask __cpuinitdata;
+
+static int __cpuinit allocate_kscratch(void)
+{
+        int r;
+        unsigned int a = cpu_data[0].kscratch_mask & ~kscratch_used_mask;
+
+        r = ffs(a);
+
+        if (r == 0)
+                return -1;
+
+        r--; /* make it zero based */
+
+        kscratch_used_mask |= (1 << r);
+
+        return r;
+}
+
+static int scratch_reg __cpuinitdata;
+static int pgd_reg __cpuinitdata;
+enum vmalloc64_mode {not_refill, refill_scratch, refill_noscratch};
+
 #ifndef CONFIG_MIPS_PGD_C0_CONTEXT
+
 /*
  * CONFIG_MIPS_PGD_C0_CONTEXT implies 64 bit and lack of pgd_current,
  * we cannot do r3000 under these circumstances.
+ *
+ * Declare pgd_current here instead of including mmu_context.h to avoid type
+ * conflicts for tlbmiss_handler_setup_pgd
  */
+extern unsigned long pgd_current[];
 
 /*
  * The R3000 TLB handler is simple.
@@ -440,21 +518,43 @@ static __cpuinit __maybe_unused void build_convert_pte_to_entrylo(u32 **p,
 static __cpuinit void build_restore_pagemask(u32 **p,
                                              struct uasm_reloc **r,
                                              unsigned int tmp,
-                                             enum label_id lid)
+                                             enum label_id lid,
+                                             int restore_scratch)
 {
-        /* Reset default page size */
-        if (PM_DEFAULT_MASK >> 16) {
-                uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16);
-                uasm_i_ori(p, tmp, tmp, PM_DEFAULT_MASK & 0xffff);
-                uasm_il_b(p, r, lid);
-                uasm_i_mtc0(p, tmp, C0_PAGEMASK);
-        } else if (PM_DEFAULT_MASK) {
-                uasm_i_ori(p, tmp, 0, PM_DEFAULT_MASK);
-                uasm_il_b(p, r, lid);
-                uasm_i_mtc0(p, tmp, C0_PAGEMASK);
+        if (restore_scratch) {
+                /* Reset default page size */
+                if (PM_DEFAULT_MASK >> 16) {
+                        uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16);
+                        uasm_i_ori(p, tmp, tmp, PM_DEFAULT_MASK & 0xffff);
+                        uasm_i_mtc0(p, tmp, C0_PAGEMASK);
+                        uasm_il_b(p, r, lid);
+                } else if (PM_DEFAULT_MASK) {
+                        uasm_i_ori(p, tmp, 0, PM_DEFAULT_MASK);
+                        uasm_i_mtc0(p, tmp, C0_PAGEMASK);
+                        uasm_il_b(p, r, lid);
+                } else {
+                        uasm_i_mtc0(p, 0, C0_PAGEMASK);
+                        uasm_il_b(p, r, lid);
+                }
+                if (scratch_reg > 0)
+                        UASM_i_MFC0(p, 1, 31, scratch_reg);
+                else
+                        UASM_i_LW(p, 1, scratchpad_offset(0), 0);
         } else {
-                uasm_il_b(p, r, lid);
-                uasm_i_mtc0(p, 0, C0_PAGEMASK);
+                /* Reset default page size */
+                if (PM_DEFAULT_MASK >> 16) {
+                        uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16);
+                        uasm_i_ori(p, tmp, tmp, PM_DEFAULT_MASK & 0xffff);
+                        uasm_il_b(p, r, lid);
+                        uasm_i_mtc0(p, tmp, C0_PAGEMASK);
+                } else if (PM_DEFAULT_MASK) {
+                        uasm_i_ori(p, tmp, 0, PM_DEFAULT_MASK);
+                        uasm_il_b(p, r, lid);
+                        uasm_i_mtc0(p, tmp, C0_PAGEMASK);
+                } else {
+                        uasm_il_b(p, r, lid);
+                        uasm_i_mtc0(p, 0, C0_PAGEMASK);
+                }
         }
 }
 
@@ -462,7 +562,8 @@ static __cpuinit void build_huge_tlb_write_entry(u32 **p,
                                                  struct uasm_label **l,
                                                  struct uasm_reloc **r,
                                                  unsigned int tmp,
-                                                 enum tlb_write_entry wmode)
+                                                 enum tlb_write_entry wmode,
+                                                 int restore_scratch)
 {
         /* Set huge page tlb entry size */
         uasm_i_lui(p, tmp, PM_HUGE_MASK >> 16);
@@ -471,7 +572,7 @@ static __cpuinit void build_huge_tlb_write_entry(u32 **p,
 
         build_tlb_write_entry(p, l, r, wmode);
 
-        build_restore_pagemask(p, r, tmp, label_leave);
+        build_restore_pagemask(p, r, tmp, label_leave, restore_scratch);
 }
 
 /*
@@ -482,8 +583,12 @@ build_is_huge_pte(u32 **p, struct uasm_reloc **r, unsigned int tmp,
                 unsigned int pmd, int lid)
 {
         UASM_i_LW(p, tmp, 0, pmd);
-        uasm_i_andi(p, tmp, tmp, _PAGE_HUGE);
-        uasm_il_bnez(p, r, tmp, lid);
+        if (use_bbit_insns()) {
+                uasm_il_bbit1(p, r, tmp, ilog2(_PAGE_HUGE), lid);
+        } else {
+                uasm_i_andi(p, tmp, tmp, _PAGE_HUGE);
+                uasm_il_bnez(p, r, tmp, lid);
+        }
 }
 
 static __cpuinit void build_huge_update_entries(u32 **p,
@@ -532,7 +637,7 @@ static __cpuinit void build_huge_handler_tail(u32 **p,
         UASM_i_SW(p, pte, 0, ptr);
 #endif
         build_huge_update_entries(p, pte, ptr);
-        build_huge_tlb_write_entry(p, l, r, pte, tlb_indexed);
+        build_huge_tlb_write_entry(p, l, r, pte, tlb_indexed, 0);
 }
 #endif /* CONFIG_HUGETLB_PAGE */
 
@@ -573,13 +678,22 @@ build_get_pmde64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
         /* No uasm_i_nop needed here, since the next insn doesn't touch TMP. */
 
 #ifdef CONFIG_MIPS_PGD_C0_CONTEXT
-        /*
-         * &pgd << 11 stored in CONTEXT [23..63].
-         */
-        UASM_i_MFC0(p, ptr, C0_CONTEXT);
-        uasm_i_dins(p, ptr, 0, 0, 23); /* Clear lower 23 bits of context. */
-        uasm_i_ori(p, ptr, ptr, 0x540); /* 1 0  1 0 1  << 6  xkphys cached */
-        uasm_i_drotr(p, ptr, ptr, 11);
+        if (pgd_reg != -1) {
+                /* pgd is in pgd_reg */
+                UASM_i_MFC0(p, ptr, 31, pgd_reg);
+        } else {
+                /*
+                 * &pgd << 11 stored in CONTEXT [23..63].
+                 */
+                UASM_i_MFC0(p, ptr, C0_CONTEXT);
+
+                /* Clear lower 23 bits of context. */
+                uasm_i_dins(p, ptr, 0, 0, 23);
+
+                /* 1 0  1 0 1  << 6  xkphys cached */
+                uasm_i_ori(p, ptr, ptr, 0x540);
+                uasm_i_drotr(p, ptr, ptr, 11);
+        }
 #elif defined(CONFIG_SMP)
 # ifdef  CONFIG_MIPS_MT_SMTC
         /*
@@ -620,7 +734,6 @@ build_get_pmde64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
 #endif
 }
 
-enum vmalloc64_mode {not_refill, refill};
 /*
  * BVADDR is the faulting address, PTR is scratch.
  * PTR will hold the pgd for vmalloc.
@@ -638,7 +751,7 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
 
         uasm_l_vmalloc(l, *p);
 
-        if (mode == refill && check_for_high_segbits) {
+        if (mode != not_refill && check_for_high_segbits) {
                 if (single_insn_swpd) {
                         uasm_il_bltz(p, r, bvaddr, label_vmalloc_done);
                         uasm_i_lui(p, ptr, uasm_rel_hi(swpd));
@@ -661,7 +774,7 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
                                 uasm_i_daddiu(p, ptr, ptr, uasm_rel_lo(swpd));
                 }
         }
-        if (mode == refill && check_for_high_segbits) {
+        if (mode != not_refill && check_for_high_segbits) {
                 uasm_l_large_segbits_fault(l, *p);
                 /*
                  * We get here if we are an xsseg address, or if we are
@@ -677,7 +790,15 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
                  */
                 UASM_i_LA(p, ptr, (unsigned long)tlb_do_page_fault_0);
                 uasm_i_jr(p, ptr);
-                uasm_i_nop(p);
+
+                if (mode == refill_scratch) {
+                        if (scratch_reg > 0)
+                                UASM_i_MFC0(p, 1, 31, scratch_reg);
+                        else
+                                UASM_i_LW(p, 1, scratchpad_offset(0), 0);
+                } else {
+                        uasm_i_nop(p);
+                }
         }
 }
 
@@ -834,6 +955,185 @@ static void __cpuinit build_update_entries(u32 **p, unsigned int tmp,
 #endif
 }
 
+struct mips_huge_tlb_info {
+        int huge_pte;
+        int restore_scratch;
+};
+
+static struct mips_huge_tlb_info __cpuinit
+build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l,
+                               struct uasm_reloc **r, unsigned int tmp,
+                               unsigned int ptr, int c0_scratch)
+{
+        struct mips_huge_tlb_info rv;
+        unsigned int even, odd;
+        int vmalloc_branch_delay_filled = 0;
+        const int scratch = 1; /* Our extra working register */
+
+        rv.huge_pte = scratch;
+        rv.restore_scratch = 0;
+
+        if (check_for_high_segbits) {
+                UASM_i_MFC0(p, tmp, C0_BADVADDR);
+
+                if (pgd_reg != -1)
+                        UASM_i_MFC0(p, ptr, 31, pgd_reg);
+                else
+                        UASM_i_MFC0(p, ptr, C0_CONTEXT);
+
+                if (c0_scratch >= 0)
+                        UASM_i_MTC0(p, scratch, 31, c0_scratch);
+                else
+                        UASM_i_SW(p, scratch, scratchpad_offset(0), 0);
+
+                uasm_i_dsrl_safe(p, scratch, tmp,
+                                 PGDIR_SHIFT + PGD_ORDER + PAGE_SHIFT - 3);
+                uasm_il_bnez(p, r, scratch, label_vmalloc);
+
+                if (pgd_reg == -1) {
+                        vmalloc_branch_delay_filled = 1;
+                        /* Clear lower 23 bits of context. */
+                        uasm_i_dins(p, ptr, 0, 0, 23);
+                }
+        } else {
+                if (pgd_reg != -1)
+                        UASM_i_MFC0(p, ptr, 31, pgd_reg);
+                else
+                        UASM_i_MFC0(p, ptr, C0_CONTEXT);
+
+                UASM_i_MFC0(p, tmp, C0_BADVADDR);
+
+                if (c0_scratch >= 0)
+                        UASM_i_MTC0(p, scratch, 31, c0_scratch);
+                else
+                        UASM_i_SW(p, scratch, scratchpad_offset(0), 0);
+
+                if (pgd_reg == -1)
+                        /* Clear lower 23 bits of context. */
+                        uasm_i_dins(p, ptr, 0, 0, 23);
+
+                uasm_il_bltz(p, r, tmp, label_vmalloc);
+        }
+
+        if (pgd_reg == -1) {
+                vmalloc_branch_delay_filled = 1;
+                /* 1 0  1 0 1  << 6  xkphys cached */
+                uasm_i_ori(p, ptr, ptr, 0x540);
+                uasm_i_drotr(p, ptr, ptr, 11);
+        }
+
+#ifdef __PAGETABLE_PMD_FOLDED
+#define LOC_PTEP scratch
+#else
+#define LOC_PTEP ptr
+#endif
+
+        if (!vmalloc_branch_delay_filled)
+                /* get pgd offset in bytes */
+                uasm_i_dsrl_safe(p, scratch, tmp, PGDIR_SHIFT - 3);
+
+        uasm_l_vmalloc_done(l, *p);
+
+        /*
+         *                         tmp          ptr
+         * fall-through case =   badvaddr  *pgd_current
+         * vmalloc case      =   badvaddr  swapper_pg_dir
+         */
+
+        if (vmalloc_branch_delay_filled)
+                /* get pgd offset in bytes */
+                uasm_i_dsrl_safe(p, scratch, tmp, PGDIR_SHIFT - 3);
+
+#ifdef __PAGETABLE_PMD_FOLDED
+        GET_CONTEXT(p, tmp); /* get context reg */
+#endif
+        uasm_i_andi(p, scratch, scratch, (PTRS_PER_PGD - 1) << 3);
+
+        if (use_lwx_insns()) {
+                UASM_i_LWX(p, LOC_PTEP, scratch, ptr);
+        } else {
+                uasm_i_daddu(p, ptr, ptr, scratch); /* add in pgd offset */
+                uasm_i_ld(p, LOC_PTEP, 0, ptr); /* get pmd pointer */
+        }
+
+#ifndef __PAGETABLE_PMD_FOLDED
+        /* get pmd offset in bytes */
+        uasm_i_dsrl_safe(p, scratch, tmp, PMD_SHIFT - 3);
+        uasm_i_andi(p, scratch, scratch, (PTRS_PER_PMD - 1) << 3);
+        GET_CONTEXT(p, tmp); /* get context reg */
+
+        if (use_lwx_insns()) {
+                UASM_i_LWX(p, scratch, scratch, ptr);
+        } else {
+                uasm_i_daddu(p, ptr, ptr, scratch); /* add in pmd offset */
+                UASM_i_LW(p, scratch, 0, ptr);
+        }
+#endif
+        /* Adjust the context during the load latency. */
+        build_adjust_context(p, tmp);
+
+#ifdef CONFIG_HUGETLB_PAGE
+        uasm_il_bbit1(p, r, scratch, ilog2(_PAGE_HUGE), label_tlb_huge_update);
+        /*
+         * The in the LWX case we don't want to do the load in the
+         * delay slot.  It cannot issue in the same cycle and may be
+         * speculative and unneeded.
+         */
+        if (use_lwx_insns())
+                uasm_i_nop(p);
+#endif /* CONFIG_HUGETLB_PAGE */
+
+
+        /* build_update_entries */
+        if (use_lwx_insns()) {
+                even = ptr;
+                odd = tmp;
+                UASM_i_LWX(p, even, scratch, tmp);
+                UASM_i_ADDIU(p, tmp, tmp, sizeof(pte_t));
+                UASM_i_LWX(p, odd, scratch, tmp);
+        } else {
+                UASM_i_ADDU(p, ptr, scratch, tmp); /* add in offset */
+                even = tmp;
+                odd = ptr;
+                UASM_i_LW(p, even, 0, ptr); /* get even pte */
+                UASM_i_LW(p, odd, sizeof(pte_t), ptr); /* get odd pte */
+        }
+        if (kernel_uses_smartmips_rixi) {
+                uasm_i_dsrl_safe(p, even, even, ilog2(_PAGE_NO_EXEC));
+                uasm_i_dsrl_safe(p, odd, odd, ilog2(_PAGE_NO_EXEC));
+                uasm_i_drotr(p, even, even,
+                             ilog2(_PAGE_GLOBAL) - ilog2(_PAGE_NO_EXEC));
+                UASM_i_MTC0(p, even, C0_ENTRYLO0); /* load it */
+                uasm_i_drotr(p, odd, odd,
+                             ilog2(_PAGE_GLOBAL) - ilog2(_PAGE_NO_EXEC));
+        } else {
+                uasm_i_dsrl_safe(p, even, even, ilog2(_PAGE_GLOBAL));
+                UASM_i_MTC0(p, even, C0_ENTRYLO0); /* load it */
+                uasm_i_dsrl_safe(p, odd, odd, ilog2(_PAGE_GLOBAL));
+        }
+        UASM_i_MTC0(p, odd, C0_ENTRYLO1); /* load it */
+
+        if (c0_scratch >= 0) {
+                UASM_i_MFC0(p, scratch, 31, c0_scratch);
+                build_tlb_write_entry(p, l, r, tlb_random);
+                uasm_l_leave(l, *p);
+                rv.restore_scratch = 1;
+        } else if (PAGE_SHIFT == 14 || PAGE_SHIFT == 13)  {
+                build_tlb_write_entry(p, l, r, tlb_random);
+                uasm_l_leave(l, *p);
+                UASM_i_LW(p, scratch, scratchpad_offset(0), 0);
+        } else {
+                UASM_i_LW(p, scratch, scratchpad_offset(0), 0);
+                build_tlb_write_entry(p, l, r, tlb_random);
+                uasm_l_leave(l, *p);
+                rv.restore_scratch = 1;
+        }
+
+        uasm_i_eret(p); /* return from trap */
+
+        return rv;
+}
+
 /*
  * For a 64-bit kernel, we are using the 64-bit XTLB refill exception
  * because EXL == 0.  If we wrap, we can also use the 32 instruction
@@ -849,54 +1149,67 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
         struct uasm_reloc *r = relocs;
         u32 *f;
         unsigned int final_len;
+        struct mips_huge_tlb_info htlb_info;
+        enum vmalloc64_mode vmalloc_mode;
 
         memset(tlb_handler, 0, sizeof(tlb_handler));
         memset(labels, 0, sizeof(labels));
         memset(relocs, 0, sizeof(relocs));
         memset(final_handler, 0, sizeof(final_handler));
 
-        /*
-         * create the plain linear handler
-         */
-        if (bcm1250_m3_war()) {
-                unsigned int segbits = 44;
+        if (scratch_reg == 0)
+                scratch_reg = allocate_kscratch();
 
-                uasm_i_dmfc0(&p, K0, C0_BADVADDR);
-                uasm_i_dmfc0(&p, K1, C0_ENTRYHI);
-                uasm_i_xor(&p, K0, K0, K1);
-                uasm_i_dsrl_safe(&p, K1, K0, 62);
-                uasm_i_dsrl_safe(&p, K0, K0, 12 + 1);
-                uasm_i_dsll_safe(&p, K0, K0, 64 + 12 + 1 - segbits);
-                uasm_i_or(&p, K0, K0, K1);
-                uasm_il_bnez(&p, &r, K0, label_leave);
-                /* No need for uasm_i_nop */
-        }
+        if ((scratch_reg > 0 || scratchpad_available()) && use_bbit_insns()) {
+                htlb_info = build_fast_tlb_refill_handler(&p, &l, &r, K0, K1,
+                                                          scratch_reg);
+                vmalloc_mode = refill_scratch;
+        } else {
+                htlb_info.huge_pte = K0;
+                htlb_info.restore_scratch = 0;
+                vmalloc_mode = refill_noscratch;
+                /*
+                 * create the plain linear handler
+                 */
+                if (bcm1250_m3_war()) {
+                        unsigned int segbits = 44;
+
+                        uasm_i_dmfc0(&p, K0, C0_BADVADDR);
+                        uasm_i_dmfc0(&p, K1, C0_ENTRYHI);
+                        uasm_i_xor(&p, K0, K0, K1);
+                        uasm_i_dsrl_safe(&p, K1, K0, 62);
+                        uasm_i_dsrl_safe(&p, K0, K0, 12 + 1);
+                        uasm_i_dsll_safe(&p, K0, K0, 64 + 12 + 1 - segbits);
+                        uasm_i_or(&p, K0, K0, K1);
+                        uasm_il_bnez(&p, &r, K0, label_leave);
+                        /* No need for uasm_i_nop */
+                }
 
 #ifdef CONFIG_64BIT
-        build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
+                build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
 #else
-        build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
+                build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
 #endif
 
 #ifdef CONFIG_HUGETLB_PAGE
-        build_is_huge_pte(&p, &r, K0, K1, label_tlb_huge_update);
+                build_is_huge_pte(&p, &r, K0, K1, label_tlb_huge_update);
 #endif
 
-        build_get_ptep(&p, K0, K1);
-        build_update_entries(&p, K0, K1);
-        build_tlb_write_entry(&p, &l, &r, tlb_random);
-        uasm_l_leave(&l, p);
-        uasm_i_eret(&p); /* return from trap */
-
+                build_get_ptep(&p, K0, K1);
+                build_update_entries(&p, K0, K1);
+                build_tlb_write_entry(&p, &l, &r, tlb_random);
+                uasm_l_leave(&l, p);
+                uasm_i_eret(&p); /* return from trap */
+        }
 #ifdef CONFIG_HUGETLB_PAGE
         uasm_l_tlb_huge_update(&l, p);
-        UASM_i_LW(&p, K0, 0, K1);
-        build_huge_update_entries(&p, K0, K1);
-        build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random);
+        build_huge_update_entries(&p, htlb_info.huge_pte, K1);
+        build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random,
+                                   htlb_info.restore_scratch);
 #endif
 
 #ifdef CONFIG_64BIT
-        build_get_pgd_vmalloc64(&p, &l, &r, K0, K1, refill);
+        build_get_pgd_vmalloc64(&p, &l, &r, K0, K1, vmalloc_mode);
 #endif
 
         /*
@@ -1014,6 +1327,55 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
 u32 handle_tlbl[FASTPATH_SIZE] __cacheline_aligned;
 u32 handle_tlbs[FASTPATH_SIZE] __cacheline_aligned;
 u32 handle_tlbm[FASTPATH_SIZE] __cacheline_aligned;
+#ifdef CONFIG_MIPS_PGD_C0_CONTEXT
+u32 tlbmiss_handler_setup_pgd[16] __cacheline_aligned;
+
+static void __cpuinit build_r4000_setup_pgd(void)
+{
+        const int a0 = 4;
+        const int a1 = 5;
+        u32 *p = tlbmiss_handler_setup_pgd;
+        struct uasm_label *l = labels;
+        struct uasm_reloc *r = relocs;
+
+        memset(tlbmiss_handler_setup_pgd, 0, sizeof(tlbmiss_handler_setup_pgd));
+        memset(labels, 0, sizeof(labels));
+        memset(relocs, 0, sizeof(relocs));
+
+        pgd_reg = allocate_kscratch();
+
+        if (pgd_reg == -1) {
+                /* PGD << 11 in c0_Context */
+                /*
+                 * If it is a ckseg0 address, convert to a physical
+                 * address.  Shifting right by 29 and adding 4 will
+                 * result in zero for these addresses.
+                 *
+                 */
+                UASM_i_SRA(&p, a1, a0, 29);
+                UASM_i_ADDIU(&p, a1, a1, 4);
+                uasm_il_bnez(&p, &r, a1, label_tlbl_goaround1);
+                uasm_i_nop(&p);
+                uasm_i_dinsm(&p, a0, 0, 29, 64 - 29);
+                uasm_l_tlbl_goaround1(&l, p);
+                UASM_i_SLL(&p, a0, a0, 11);
+                uasm_i_jr(&p, 31);
+                UASM_i_MTC0(&p, a0, C0_CONTEXT);
+        } else {
+                /* PGD in c0_KScratch */
+                uasm_i_jr(&p, 31);
+                UASM_i_MTC0(&p, a0, 31, pgd_reg);
+        }
+        if (p - tlbmiss_handler_setup_pgd > ARRAY_SIZE(tlbmiss_handler_setup_pgd))
+                panic("tlbmiss_handler_setup_pgd space exceeded");
+        uasm_resolve_relocs(relocs, labels);
+        pr_debug("Wrote tlbmiss_handler_setup_pgd (%u instructions).\n",
+                 (unsigned int)(p - tlbmiss_handler_setup_pgd));
+
+        dump_handler(tlbmiss_handler_setup_pgd,
+                     ARRAY_SIZE(tlbmiss_handler_setup_pgd));
+}
+#endif
 
 static void __cpuinit
 iPTE_LW(u32 **p, unsigned int pte, unsigned int ptr)
@@ -1100,14 +1462,20 @@ build_pte_present(u32 **p, struct uasm_reloc **r,
                   unsigned int pte, unsigned int ptr, enum label_id lid)
 {
         if (kernel_uses_smartmips_rixi) {
-                uasm_i_andi(p, pte, pte, _PAGE_PRESENT);
-                uasm_il_beqz(p, r, pte, lid);
+                if (use_bbit_insns()) {
+                        uasm_il_bbit0(p, r, pte, ilog2(_PAGE_PRESENT), lid);
+                        uasm_i_nop(p);
+                } else {
+                        uasm_i_andi(p, pte, pte, _PAGE_PRESENT);
+                        uasm_il_beqz(p, r, pte, lid);
+                        iPTE_LW(p, pte, ptr);
+                }
         } else {
                 uasm_i_andi(p, pte, pte, _PAGE_PRESENT | _PAGE_READ);
                 uasm_i_xori(p, pte, pte, _PAGE_PRESENT | _PAGE_READ);
                 uasm_il_bnez(p, r, pte, lid);
+                iPTE_LW(p, pte, ptr);
         }
-        iPTE_LW(p, pte, ptr);
 }
 
 /* Make PTE valid, store result in PTR. */
@@ -1128,10 +1496,17 @@ static void __cpuinit
 build_pte_writable(u32 **p, struct uasm_reloc **r,
                    unsigned int pte, unsigned int ptr, enum label_id lid)
 {
-        uasm_i_andi(p, pte, pte, _PAGE_PRESENT | _PAGE_WRITE);
-        uasm_i_xori(p, pte, pte, _PAGE_PRESENT | _PAGE_WRITE);
-        uasm_il_bnez(p, r, pte, lid);
-        iPTE_LW(p, pte, ptr);
+        if (use_bbit_insns()) {
+                uasm_il_bbit0(p, r, pte, ilog2(_PAGE_PRESENT), lid);
+                uasm_i_nop(p);
+                uasm_il_bbit0(p, r, pte, ilog2(_PAGE_WRITE), lid);
+                uasm_i_nop(p);
+        } else {
+                uasm_i_andi(p, pte, pte, _PAGE_PRESENT | _PAGE_WRITE);
+                uasm_i_xori(p, pte, pte, _PAGE_PRESENT | _PAGE_WRITE);
+                uasm_il_bnez(p, r, pte, lid);
+                iPTE_LW(p, pte, ptr);
+        }
 }
 
 /* Make PTE writable, update software status bits as well, then store
@@ -1155,12 +1530,19 @@ static void __cpuinit
 build_pte_modifiable(u32 **p, struct uasm_reloc **r,
                      unsigned int pte, unsigned int ptr, enum label_id lid)
 {
-        uasm_i_andi(p, pte, pte, _PAGE_WRITE);
-        uasm_il_beqz(p, r, pte, lid);
-        iPTE_LW(p, pte, ptr);
+        if (use_bbit_insns()) {
+                uasm_il_bbit0(p, r, pte, ilog2(_PAGE_WRITE), lid);
+                uasm_i_nop(p);
+        } else {
+                uasm_i_andi(p, pte, pte, _PAGE_WRITE);
+                uasm_il_beqz(p, r, pte, lid);
+                iPTE_LW(p, pte, ptr);
+        }
 }
 
 #ifndef CONFIG_MIPS_PGD_C0_CONTEXT
+
+
 /*
  * R3000 style TLB load/store/modify handlers.
  */
@@ -1402,14 +1784,23 @@ static void __cpuinit build_r4000_tlb_load_handler(void)
                  * If the page is not _PAGE_VALID, RI or XI could not
                  * have triggered it.  Skip the expensive test..
                  */
-                uasm_i_andi(&p, K0, K0, _PAGE_VALID);
-                uasm_il_beqz(&p, &r, K0, label_tlbl_goaround1);
+                if (use_bbit_insns()) {
+                        uasm_il_bbit0(&p, &r, K0, ilog2(_PAGE_VALID),
+                                      label_tlbl_goaround1);
+                } else {
+                        uasm_i_andi(&p, K0, K0, _PAGE_VALID);
+                        uasm_il_beqz(&p, &r, K0, label_tlbl_goaround1);
+                }
                 uasm_i_nop(&p);
 
                 uasm_i_tlbr(&p);
                 /* Examine  entrylo 0 or 1 based on ptr. */
-                uasm_i_andi(&p, K0, K1, sizeof(pte_t));
-                uasm_i_beqz(&p, K0, 8);
+                if (use_bbit_insns()) {
+                        uasm_i_bbit0(&p, K1, ilog2(sizeof(pte_t)), 8);
+                } else {
+                        uasm_i_andi(&p, K0, K1, sizeof(pte_t));
+                        uasm_i_beqz(&p, K0, 8);
+                }
 
                 UASM_i_MFC0(&p, K0, C0_ENTRYLO0); /* load it in the delay slot*/
                 UASM_i_MFC0(&p, K0, C0_ENTRYLO1); /* load it if ptr is odd */
@@ -1417,12 +1808,18 @@ static void __cpuinit build_r4000_tlb_load_handler(void)
                  * If the entryLo (now in K0) is valid (bit 1), RI or
                  * XI must have triggered it.
                  */
-                uasm_i_andi(&p, K0, K0, 2);
-                uasm_il_bnez(&p, &r, K0, label_nopage_tlbl);
-
-                uasm_l_tlbl_goaround1(&l, p);
-                /* Reload the PTE value */
-                iPTE_LW(&p, K0, K1);
+                if (use_bbit_insns()) {
+                        uasm_il_bbit1(&p, &r, K0, 1, label_nopage_tlbl);
+                        /* Reload the PTE value */
+                        iPTE_LW(&p, K0, K1);
+                        uasm_l_tlbl_goaround1(&l, p);
+                } else {
+                        uasm_i_andi(&p, K0, K0, 2);
+                        uasm_il_bnez(&p, &r, K0, label_nopage_tlbl);
+                        uasm_l_tlbl_goaround1(&l, p);
+                        /* Reload the PTE value */
+                        iPTE_LW(&p, K0, K1);
+                }
         }
         build_make_valid(&p, &r, K0, K1);
         build_r4000_tlbchange_handler_tail(&p, &l, &r, K0, K1);
@@ -1442,23 +1839,35 @@ static void __cpuinit build_r4000_tlb_load_handler(void)
                  * If the page is not _PAGE_VALID, RI or XI could not
                  * have triggered it.  Skip the expensive test..
                  */
-                uasm_i_andi(&p, K0, K0, _PAGE_VALID);
-                uasm_il_beqz(&p, &r, K0, label_tlbl_goaround2);
+                if (use_bbit_insns()) {
+                        uasm_il_bbit0(&p, &r, K0, ilog2(_PAGE_VALID),
+                                      label_tlbl_goaround2);
+                } else {
+                        uasm_i_andi(&p, K0, K0, _PAGE_VALID);
+                        uasm_il_beqz(&p, &r, K0, label_tlbl_goaround2);
+                }
                 uasm_i_nop(&p);
 
                 uasm_i_tlbr(&p);
                 /* Examine  entrylo 0 or 1 based on ptr. */
-                uasm_i_andi(&p, K0, K1, sizeof(pte_t));
-                uasm_i_beqz(&p, K0, 8);
-
+                if (use_bbit_insns()) {
+                        uasm_i_bbit0(&p, K1, ilog2(sizeof(pte_t)), 8);
+                } else {
+                        uasm_i_andi(&p, K0, K1, sizeof(pte_t));
+                        uasm_i_beqz(&p, K0, 8);
+                }
                 UASM_i_MFC0(&p, K0, C0_ENTRYLO0); /* load it in the delay slot*/
                 UASM_i_MFC0(&p, K0, C0_ENTRYLO1); /* load it if ptr is odd */
                 /*
                  * If the entryLo (now in K0) is valid (bit 1), RI or
                  * XI must have triggered it.
                  */
-                uasm_i_andi(&p, K0, K0, 2);
-                uasm_il_beqz(&p, &r, K0, label_tlbl_goaround2);
+                if (use_bbit_insns()) {
+                        uasm_il_bbit0(&p, &r, K0, 1, label_tlbl_goaround2);
+                } else {
+                        uasm_i_andi(&p, K0, K0, 2);
+                        uasm_il_beqz(&p, &r, K0, label_tlbl_goaround2);
+                }
                 /* Reload the PTE value */
                 iPTE_LW(&p, K0, K1);
 
@@ -1466,7 +1875,7 @@ static void __cpuinit build_r4000_tlb_load_handler(void)
                  * We clobbered C0_PAGEMASK, restore it.  On the other branch
                  * it is restored in build_huge_tlb_write_entry.
                  */
-                build_restore_pagemask(&p, &r, K0, label_nopage_tlbl);
+                build_restore_pagemask(&p, &r, K0, label_nopage_tlbl, 0);
 
                 uasm_l_tlbl_goaround2(&l, p);
         }
@@ -1623,13 +2032,16 @@ void __cpuinit build_tlb_refill_handler(void)
                 break;
 
         default:
-                build_r4000_tlb_refill_handler();
                 if (!run_once) {
+#ifdef CONFIG_MIPS_PGD_C0_CONTEXT
+                        build_r4000_setup_pgd();
+#endif
                         build_r4000_tlb_load_handler();
                         build_r4000_tlb_store_handler();
                         build_r4000_tlb_modify_handler();
                         run_once++;
                 }
+                build_r4000_tlb_refill_handler();
         }
 }
 
@@ -1641,4 +2053,8 @@ void __cpuinit flush_tlb_handlers(void)
                            (unsigned long)handle_tlbs + sizeof(handle_tlbs));
         local_flush_icache_range((unsigned long)handle_tlbm,
                            (unsigned long)handle_tlbm + sizeof(handle_tlbm));
+#ifdef CONFIG_MIPS_PGD_C0_CONTEXT
+        local_flush_icache_range((unsigned long)tlbmiss_handler_setup_pgd,
+                           (unsigned long)tlbmiss_handler_setup_pgd + sizeof(handle_tlbm));
+#endif
 }
diff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c
index 23afdebc8e5..5fa185151fc 100644
--- a/arch/mips/mm/uasm.c
+++ b/arch/mips/mm/uasm.c
@@ -68,7 +68,8 @@ enum opcode {
         insn_pref, insn_rfe, insn_sc, insn_scd, insn_sd, insn_sll,
         insn_sra, insn_srl, insn_rotr, insn_subu, insn_sw, insn_tlbp,
         insn_tlbr, insn_tlbwi, insn_tlbwr, insn_xor, insn_xori,
-        insn_dins, insn_syscall, insn_bbit0, insn_bbit1
+        insn_dins, insn_dinsm, insn_syscall, insn_bbit0, insn_bbit1,
+        insn_lwx, insn_ldx
 };
 
 struct insn {
@@ -142,9 +143,12 @@ static struct insn insn_table[] __uasminitdata = {
         { insn_xor,  M(spec_op, 0, 0, 0, 0, xor_op),  RS | RT | RD },
         { insn_xori,  M(xori_op, 0, 0, 0, 0, 0),  RS | RT | UIMM },
         { insn_dins, M(spec3_op, 0, 0, 0, 0, dins_op), RS | RT | RD | RE },
+        { insn_dinsm, M(spec3_op, 0, 0, 0, 0, dinsm_op), RS | RT | RD | RE },
         { insn_syscall, M(spec_op, 0, 0, 0, 0, syscall_op), SCIMM},
         { insn_bbit0, M(lwc2_op, 0, 0, 0, 0, 0), RS | RT | BIMM },
         { insn_bbit1, M(swc2_op, 0, 0, 0, 0, 0), RS | RT | BIMM },
+        { insn_lwx, M(spec3_op, 0, 0, 0, lwx_op, lx_op), RS | RT | RD },
+        { insn_ldx, M(spec3_op, 0, 0, 0, ldx_op, lx_op), RS | RT | RD },
         { insn_invalid, 0, 0 }
 };
 
@@ -152,91 +156,83 @@ static struct insn insn_table[] __uasminitdata = {
 
 static inline __uasminit u32 build_rs(u32 arg)
 {
-        if (arg & ~RS_MASK)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~RS_MASK, KERN_WARNING "Micro-assembler field overflow\n");
 
         return (arg & RS_MASK) << RS_SH;
 }
 
 static inline __uasminit u32 build_rt(u32 arg)
 {
-        if (arg & ~RT_MASK)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~RT_MASK, KERN_WARNING "Micro-assembler field overflow\n");
 
         return (arg & RT_MASK) << RT_SH;
 }
 
 static inline __uasminit u32 build_rd(u32 arg)
 {
-        if (arg & ~RD_MASK)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~RD_MASK, KERN_WARNING "Micro-assembler field overflow\n");
 
         return (arg & RD_MASK) << RD_SH;
 }
 
 static inline __uasminit u32 build_re(u32 arg)
 {
-        if (arg & ~RE_MASK)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~RE_MASK, KERN_WARNING "Micro-assembler field overflow\n");
 
         return (arg & RE_MASK) << RE_SH;
 }
 
 static inline __uasminit u32 build_simm(s32 arg)
 {
-        if (arg > 0x7fff || arg < -0x8000)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg > 0x7fff || arg < -0x8000,
+             KERN_WARNING "Micro-assembler field overflow\n");
 
         return arg & 0xffff;
 }
 
 static inline __uasminit u32 build_uimm(u32 arg)
 {
-        if (arg & ~IMM_MASK)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~IMM_MASK, KERN_WARNING "Micro-assembler field overflow\n");
 
         return arg & IMM_MASK;
 }
 
 static inline __uasminit u32 build_bimm(s32 arg)
 {
-        if (arg > 0x1ffff || arg < -0x20000)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg > 0x1ffff || arg < -0x20000,
+             KERN_WARNING "Micro-assembler field overflow\n");
 
-        if (arg & 0x3)
-                printk(KERN_WARNING "Invalid micro-assembler branch target\n");
+        WARN(arg & 0x3, KERN_WARNING "Invalid micro-assembler branch target\n");
 
         return ((arg < 0) ? (1 << 15) : 0) | ((arg >> 2) & 0x7fff);
 }
 
 static inline __uasminit u32 build_jimm(u32 arg)
 {
-        if (arg & ~((JIMM_MASK) << 2))
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~(JIMM_MASK << 2),
+             KERN_WARNING "Micro-assembler field overflow\n");
 
         return (arg >> 2) & JIMM_MASK;
 }
 
 static inline __uasminit u32 build_scimm(u32 arg)
 {
-        if (arg & ~SCIMM_MASK)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~SCIMM_MASK,
+             KERN_WARNING "Micro-assembler field overflow\n");
 
         return (arg & SCIMM_MASK) << SCIMM_SH;
 }
 
 static inline __uasminit u32 build_func(u32 arg)
 {
-        if (arg & ~FUNC_MASK)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~FUNC_MASK, KERN_WARNING "Micro-assembler field overflow\n");
 
         return arg & FUNC_MASK;
 }
 
 static inline __uasminit u32 build_set(u32 arg)
 {
-        if (arg & ~SET_MASK)
-                printk(KERN_WARNING "Micro-assembler field overflow\n");
+        WARN(arg & ~SET_MASK, KERN_WARNING "Micro-assembler field overflow\n");
 
         return arg & SET_MASK;
 }
@@ -340,6 +336,13 @@ Ip_u2u1msbu3(op)					\
 }                                                       \
 UASM_EXPORT_SYMBOL(uasm_i##op);
 
+#define I_u2u1msb32u3(op)                               \
+Ip_u2u1msbu3(op)                                        \
+{                                                       \
+        build_insn(buf, insn##op, b, a, c+d-33, c);     \
+}                                                       \
+UASM_EXPORT_SYMBOL(uasm_i##op);
+
 #define I_u1u2(op)                                      \
 Ip_u1u2(op)                                             \
 {                                                       \
@@ -422,9 +425,12 @@ I_0(_tlbwr)
 I_u3u1u2(_xor)
 I_u2u1u3(_xori)
 I_u2u1msbu3(_dins);
+I_u2u1msb32u3(_dinsm);
 I_u1(_syscall);
 I_u1u2s3(_bbit0);
 I_u1u2s3(_bbit1);
+I_u3u1u2(_lwx)
+I_u3u1u2(_ldx)
 
 #ifdef CONFIG_CPU_CAVIUM_OCTEON
 #include <asm/octeon/octeon.h>
diff --git a/arch/mips/sibyte/common/sb_tbprof.c b/arch/mips/sibyte/common/sb_tbprof.c
index 87ccdb4b5ac..48853ab5bcf 100644
--- a/arch/mips/sibyte/common/sb_tbprof.c
+++ b/arch/mips/sibyte/common/sb_tbprof.c
@@ -410,14 +410,13 @@ static int sbprof_tb_open(struct inode *inode, struct file *filp)
                 return -EBUSY;
 
         memset(&sbp, 0, sizeof(struct sbprof_tb));
-        sbp.sbprof_tbbuf = vmalloc(MAX_TBSAMPLE_BYTES);
+        sbp.sbprof_tbbuf = vzalloc(MAX_TBSAMPLE_BYTES);
         if (!sbp.sbprof_tbbuf) {
                 sbp.open = SB_CLOSED;
                 wmb();
                 return -ENOMEM;
         }
 
-        memset(sbp.sbprof_tbbuf, 0, MAX_TBSAMPLE_BYTES);
         init_waitqueue_head(&sbp.tb_sync);
         init_waitqueue_head(&sbp.tb_read);
         mutex_init(&sbp.lock);
diff --git a/arch/mips/txx9/generic/pci.c b/arch/mips/txx9/generic/pci.c
index 96e69a00ffc..85a87de17eb 100644
--- a/arch/mips/txx9/generic/pci.c
+++ b/arch/mips/txx9/generic/pci.c
@@ -213,11 +213,8 @@ txx9_alloc_pci_controller(struct pci_controller *pcic,
 
         pcic->mem_offset = 0;   /* busaddr == physaddr */
 
-        printk(KERN_INFO "PCI: IO 0x%08llx-0x%08llx MEM 0x%08llx-0x%08llx\n",
-               (unsigned long long)pcic->mem_resource[1].start,
-               (unsigned long long)pcic->mem_resource[1].end,
-               (unsigned long long)pcic->mem_resource[0].start,
-               (unsigned long long)pcic->mem_resource[0].end);
+        printk(KERN_INFO "PCI: IO %pR MEM %pR\n",
+               &pcic->mem_resource[1], &pcic->mem_resource[0]);
 
         /* register_pci_controller() will request MEM resource */
         release_resource(&pcic->mem_resource[0]);
diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index 8ed41cf2b08..243bfa23fd5 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -1,6 +1,7 @@
 config MN10300
         def_bool y
         select HAVE_OPROFILE
+        select GENERIC_HARDIRQS
 
 config AM33_2
         def_bool n
@@ -34,9 +35,6 @@ config RWSEM_GENERIC_SPINLOCK
 config RWSEM_XCHGADD_ALGORITHM
         bool
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
 config GENERIC_CALIBRATE_DELAY
         def_bool y
 
@@ -79,10 +77,6 @@ config QUICKLIST
 config ARCH_HAS_ILOG2_U32
         def_bool y
 
-# Use the generic interrupt handling code in kernel/irq/
-config GENERIC_HARDIRQS
-        def_bool y
-
 config HOTPLUG_CPU
         def_bool n
 
diff --git a/arch/mn10300/configs/asb2303_defconfig b/arch/mn10300/configs/asb2303_defconfig
index 3f749b69ca7..1fd41ec1dfb 100644
--- a/arch/mn10300/configs/asb2303_defconfig
+++ b/arch/mn10300/configs/asb2303_defconfig
@@ -4,7 +4,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_TINY_RCU=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/mn10300/configs/asb2364_defconfig b/arch/mn10300/configs/asb2364_defconfig
index 83ce2f27b12..31d76261a3d 100644
--- a/arch/mn10300/configs/asb2364_defconfig
+++ b/arch/mn10300/configs/asb2364_defconfig
@@ -15,7 +15,7 @@ CONFIG_CGROUP_CPUACCT=y
 CONFIG_RESOURCE_COUNTERS=y
 CONFIG_RELAY=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
 CONFIG_SLAB=y
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 0888675c98d..fed2946f733 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -12,7 +12,10 @@ config PARISC
         select HAVE_IRQ_WORK
         select HAVE_PERF_EVENTS
         select GENERIC_ATOMIC64 if !64BIT
-        select GENERIC_HARDIRQS_NO__DO_IRQ
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_IRQ_PROBE
+        select IRQ_PER_CPU
+
         help
           The PA-RISC microprocessor is designed by Hewlett-Packard and used
           in many of their workstations & servers (HP9000 700 and 800 series,
@@ -66,22 +69,9 @@ config TIME_LOW_RES
         depends on SMP
         default y
 
-config GENERIC_HARDIRQS
-        def_bool y
-
-config GENERIC_IRQ_PROBE
-        def_bool y
-
 config HAVE_LATENCYTOP_SUPPORT
         def_bool y
 
-config IRQ_PER_CPU
-        bool
-        default y
-
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
 # unless you want to implement ACPI on PA-RISC ... ;-)
 config PM
         bool
diff --git a/arch/parisc/configs/a500_defconfig b/arch/parisc/configs/a500_defconfig
index f9305f30603..b647b182dac 100644
--- a/arch/parisc/configs/a500_defconfig
+++ b/arch/parisc/configs/a500_defconfig
@@ -8,7 +8,7 @@ CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_SLAB=y
 CONFIG_PROFILING=y
diff --git a/arch/parisc/configs/c3000_defconfig b/arch/parisc/configs/c3000_defconfig
index 628d3e02253..311ca367b62 100644
--- a/arch/parisc/configs/c3000_defconfig
+++ b/arch/parisc/configs/c3000_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_SLAB=y
 CONFIG_PROFILING=y
diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
index df971fa0c32..4896ed09058 100644
--- a/arch/parisc/kernel/firmware.c
+++ b/arch/parisc/kernel/firmware.c
@@ -1126,15 +1126,13 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
         unsigned int i;
         unsigned long flags;
 
-        for (i = 0; i < count && i < 79;) {
+        for (i = 0; i < count;) {
                 switch(str[i]) {
                 case '\n':
                         iodc_dbuf[i+0] = '\r';
                         iodc_dbuf[i+1] = '\n';
                         i += 2;
                         goto print;
-                case '\b':      /* BS */
-                        i--; /* overwrite last */
                 default:
                         iodc_dbuf[i] = str[i];
                         i++;
@@ -1142,15 +1140,6 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
                 }
         }
 
-        /* if we're at the end of line, and not already inserting a newline,
-         * insert one anyway. iodc console doesn't claim to support >79 char
-         * lines. don't account for this in the return value.
-         */
-        if (i == 79 && iodc_dbuf[i-1] != '\n') {
-                iodc_dbuf[i+0] = '\r';
-                iodc_dbuf[i+1] = '\n';
-        }
-
 print:
         spin_lock_irqsave(&pdc_lock, flags);
         real32_call(PAGE0->mem_cons.iodc_io,
diff --git a/arch/parisc/kernel/pdc_cons.c b/arch/parisc/kernel/pdc_cons.c
index 11bdd68e576..fc770be465f 100644
--- a/arch/parisc/kernel/pdc_cons.c
+++ b/arch/parisc/kernel/pdc_cons.c
@@ -169,11 +169,11 @@ static int __init pdc_console_tty_driver_init(void)
 
         struct console *tmp;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(tmp)
                 if (tmp == &pdc_cons)
                         break;
-        release_console_sem();
+        console_unlock();
 
         if (!tmp) {
                 printk(KERN_INFO "PDC console driver not registered anymore, not creating %s\n", pdc_cons.name);
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 959f38ccb9a..7d69e9bf5e6 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -36,24 +36,12 @@ config GENERIC_TIME_VSYSCALL
 config GENERIC_CLOCKEVENTS
         def_bool y
 
-config GENERIC_HARDIRQS
-        bool
-        default y
-
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        bool
-        default y
-
 config HAVE_SETUP_PER_CPU_AREA
         def_bool PPC64
 
 config NEED_PER_CPU_EMBED_FIRST_CHUNK
         def_bool PPC64
 
-config IRQ_PER_CPU
-        bool
-        default y
-
 config NR_IRQS
         int "Number of virtual interrupt numbers"
         range 32 32768
@@ -143,6 +131,9 @@ config PPC
         select HAVE_PERF_EVENTS
         select HAVE_REGS_AND_STACK_ACCESS_API
         select HAVE_HW_BREAKPOINT if PERF_EVENTS && PPC_BOOK3S_64
+        select HAVE_GENERIC_HARDIRQS
+        select HAVE_SPARSE_IRQ
+        select IRQ_PER_CPU
 
 config EARLY_PRINTK
         bool
@@ -392,19 +383,6 @@ config IRQ_ALL_CPUS
           CPU.  Generally saying Y is safe, although some problems have been
           reported with SMP Power Macintoshes with this option enabled.
 
-config SPARSE_IRQ
-        bool "Support sparse irq numbering"
-        default n
-        help
-          This enables support for sparse irqs. This is useful for distro
-          kernels that want to define a high CONFIG_NR_CPUS value but still
-          want to have low kernel memory footprint on smaller machines.
-
-          ( Sparse IRQs can also be beneficial on NUMA boxes, as they spread
-            out the irq_desc[] array in a more NUMA-friendly way. )
-
-          If you don't know what to do here, say N.
-
 config NUMA
         bool "NUMA support"
         depends on PPC64
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 96deec63bcf..89178164af5 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -368,7 +368,7 @@ INSTALL := install
 extra-installed         := $(patsubst $(obj)/%, $(DESTDIR)$(WRAPPER_OBJDIR)/%, $(extra-y))
 hostprogs-installed     := $(patsubst %, $(DESTDIR)$(WRAPPER_BINDIR)/%, $(hostprogs-y))
 wrapper-installed       := $(DESTDIR)$(WRAPPER_BINDIR)/wrapper
-dts-installed           := $(patsubst $(obj)/dts/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(obj)/dts/*.dts))
+dts-installed           := $(patsubst $(dtstree)/%, $(DESTDIR)$(WRAPPER_DTSDIR)/%, $(wildcard $(dtstree)/*.dts))
 
 all-installed           := $(extra-installed) $(hostprogs-installed) $(wrapper-installed) $(dts-installed)
 
diff --git a/arch/powerpc/boot/dts/mpc8308rdb.dts b/arch/powerpc/boot/dts/mpc8308rdb.dts
index d3db02f98dd..a0bd1881081 100644
--- a/arch/powerpc/boot/dts/mpc8308rdb.dts
+++ b/arch/powerpc/boot/dts/mpc8308rdb.dts
@@ -109,7 +109,7 @@
                 #address-cells = <1>;
                 #size-cells = <1>;
                 device_type = "soc";
-                compatible = "fsl,mpc8315-immr", "simple-bus";
+                compatible = "fsl,mpc8308-immr", "simple-bus";
                 ranges = <0 0xe0000000 0x00100000>;
                 reg = <0xe0000000 0x00000200>;
                 bus-frequency = <0>;
diff --git a/arch/powerpc/boot/dts/p1022ds.dts b/arch/powerpc/boot/dts/p1022ds.dts
index 2bbecbb4cbf..69422eb24d9 100644
--- a/arch/powerpc/boot/dts/p1022ds.dts
+++ b/arch/powerpc/boot/dts/p1022ds.dts
@@ -291,13 +291,13 @@
                         ranges = <0x0 0xc100 0x200>;
                         cell-index = <1>;
                         dma00: dma-channel@0 {
-                                compatible = "fsl,eloplus-dma-channel";
+                                compatible = "fsl,ssi-dma-channel";
                                 reg = <0x0 0x80>;
                                 cell-index = <0>;
                                 interrupts = <76 2>;
                         };
                         dma01: dma-channel@80 {
-                                compatible = "fsl,eloplus-dma-channel";
+                                compatible = "fsl,ssi-dma-channel";
                                 reg = <0x80 0x80>;
                                 cell-index = <1>;
                                 interrupts = <77 2>;
diff --git a/arch/powerpc/configs/40x/acadia_defconfig b/arch/powerpc/configs/40x/acadia_defconfig
index 97fedceaa30..4182c772340 100644
--- a/arch/powerpc/configs/40x/acadia_defconfig
+++ b/arch/powerpc/configs/40x/acadia_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/40x/ep405_defconfig b/arch/powerpc/configs/40x/ep405_defconfig
index 33b3c24f4ed..2dbb293163f 100644
--- a/arch/powerpc/configs/40x/ep405_defconfig
+++ b/arch/powerpc/configs/40x/ep405_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/40x/hcu4_defconfig b/arch/powerpc/configs/40x/hcu4_defconfig
index 4613079a0ab..ebeb4accad6 100644
--- a/arch/powerpc/configs/40x/hcu4_defconfig
+++ b/arch/powerpc/configs/40x/hcu4_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/40x/kilauea_defconfig b/arch/powerpc/configs/40x/kilauea_defconfig
index 34b8c1a1e75..532ea9d93a1 100644
--- a/arch/powerpc/configs/40x/kilauea_defconfig
+++ b/arch/powerpc/configs/40x/kilauea_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/40x/makalu_defconfig b/arch/powerpc/configs/40x/makalu_defconfig
index 651be09136f..3c142ac1b34 100644
--- a/arch/powerpc/configs/40x/makalu_defconfig
+++ b/arch/powerpc/configs/40x/makalu_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/40x/walnut_defconfig b/arch/powerpc/configs/40x/walnut_defconfig
index ded455e1833..ff57d4828ff 100644
--- a/arch/powerpc/configs/40x/walnut_defconfig
+++ b/arch/powerpc/configs/40x/walnut_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/44x/arches_defconfig b/arch/powerpc/configs/44x/arches_defconfig
index 63746a041d6..3ed16d5c909 100644
--- a/arch/powerpc/configs/44x/arches_defconfig
+++ b/arch/powerpc/configs/44x/arches_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/bamboo_defconfig b/arch/powerpc/configs/44x/bamboo_defconfig
index f5f2a4e3e21..b1b7d2c5c05 100644
--- a/arch/powerpc/configs/44x/bamboo_defconfig
+++ b/arch/powerpc/configs/44x/bamboo_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/bluestone_defconfig b/arch/powerpc/configs/44x/bluestone_defconfig
index ac65b48b8cc..30a0a8e08fd 100644
--- a/arch/powerpc/configs/44x/bluestone_defconfig
+++ b/arch/powerpc/configs/44x/bluestone_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_VM_EVENT_COUNTERS is not set
 # CONFIG_PCI_QUIRKS is not set
 # CONFIG_COMPAT_BRK is not set
diff --git a/arch/powerpc/configs/44x/canyonlands_defconfig b/arch/powerpc/configs/44x/canyonlands_defconfig
index 17e4dd98eed..a46942aac69 100644
--- a/arch/powerpc/configs/44x/canyonlands_defconfig
+++ b/arch/powerpc/configs/44x/canyonlands_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/ebony_defconfig b/arch/powerpc/configs/44x/ebony_defconfig
index fedd03fdf5d..07d77e51f1b 100644
--- a/arch/powerpc/configs/44x/ebony_defconfig
+++ b/arch/powerpc/configs/44x/ebony_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/44x/eiger_defconfig b/arch/powerpc/configs/44x/eiger_defconfig
index ebff7011282..2ce7e9aff09 100644
--- a/arch/powerpc/configs/44x/eiger_defconfig
+++ b/arch/powerpc/configs/44x/eiger_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/icon_defconfig b/arch/powerpc/configs/44x/icon_defconfig
index 865e93fb41f..18730ff9de7 100644
--- a/arch/powerpc/configs/44x/icon_defconfig
+++ b/arch/powerpc/configs/44x/icon_defconfig
@@ -6,7 +6,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/iss476-smp_defconfig b/arch/powerpc/configs/44x/iss476-smp_defconfig
index 8ece4c77441..92f863ac844 100644
--- a/arch/powerpc/configs/44x/iss476-smp_defconfig
+++ b/arch/powerpc/configs/44x/iss476-smp_defconfig
@@ -7,7 +7,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_PROFILING=y
diff --git a/arch/powerpc/configs/44x/katmai_defconfig b/arch/powerpc/configs/44x/katmai_defconfig
index 4ca9b4873c5..34c09144a69 100644
--- a/arch/powerpc/configs/44x/katmai_defconfig
+++ b/arch/powerpc/configs/44x/katmai_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/rainier_defconfig b/arch/powerpc/configs/44x/rainier_defconfig
index e3b65d24207..21c33faf61a 100644
--- a/arch/powerpc/configs/44x/rainier_defconfig
+++ b/arch/powerpc/configs/44x/rainier_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/redwood_defconfig b/arch/powerpc/configs/44x/redwood_defconfig
index 64cd0f3421a..01cc2b1a7f9 100644
--- a/arch/powerpc/configs/44x/redwood_defconfig
+++ b/arch/powerpc/configs/44x/redwood_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/sam440ep_defconfig b/arch/powerpc/configs/44x/sam440ep_defconfig
index 01d03367917..dfcffede16a 100644
--- a/arch/powerpc/configs/44x/sam440ep_defconfig
+++ b/arch/powerpc/configs/44x/sam440ep_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/sequoia_defconfig b/arch/powerpc/configs/44x/sequoia_defconfig
index 89b2f962613..47e399f2892 100644
--- a/arch/powerpc/configs/44x/sequoia_defconfig
+++ b/arch/powerpc/configs/44x/sequoia_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/taishan_defconfig b/arch/powerpc/configs/44x/taishan_defconfig
index e3386cf6f5b..a6a002ed568 100644
--- a/arch/powerpc/configs/44x/taishan_defconfig
+++ b/arch/powerpc/configs/44x/taishan_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/44x/warp_defconfig b/arch/powerpc/configs/44x/warp_defconfig
index 9c13b9dffaf..6cf9d661480 100644
--- a/arch/powerpc/configs/44x/warp_defconfig
+++ b/arch/powerpc/configs/44x/warp_defconfig
@@ -8,7 +8,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/52xx/cm5200_defconfig b/arch/powerpc/configs/52xx/cm5200_defconfig
index f234c4d0b15..69b57daf402 100644
--- a/arch/powerpc/configs/52xx/cm5200_defconfig
+++ b/arch/powerpc/configs/52xx/cm5200_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/52xx/lite5200b_defconfig b/arch/powerpc/configs/52xx/lite5200b_defconfig
index a4a795c8074..f3638ae0a62 100644
--- a/arch/powerpc/configs/52xx/lite5200b_defconfig
+++ b/arch/powerpc/configs/52xx/lite5200b_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/52xx/motionpro_defconfig b/arch/powerpc/configs/52xx/motionpro_defconfig
index 20d53a1aa7e..6828eda02bd 100644
--- a/arch/powerpc/configs/52xx/motionpro_defconfig
+++ b/arch/powerpc/configs/52xx/motionpro_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/52xx/pcm030_defconfig b/arch/powerpc/configs/52xx/pcm030_defconfig
index 6bd58338bf1..7f7e4a87860 100644
--- a/arch/powerpc/configs/52xx/pcm030_defconfig
+++ b/arch/powerpc/configs/52xx/pcm030_defconfig
@@ -8,7 +8,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_VM_EVENT_COUNTERS is not set
 CONFIG_SLAB=y
diff --git a/arch/powerpc/configs/52xx/tqm5200_defconfig b/arch/powerpc/configs/52xx/tqm5200_defconfig
index 3a1f70292d9..959cd2cfc27 100644
--- a/arch/powerpc/configs/52xx/tqm5200_defconfig
+++ b/arch/powerpc/configs/52xx/tqm5200_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_KALLSYMS is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/83xx/asp8347_defconfig b/arch/powerpc/configs/83xx/asp8347_defconfig
index eed42d8919e..d2762d9dcb8 100644
--- a/arch/powerpc/configs/83xx/asp8347_defconfig
+++ b/arch/powerpc/configs/83xx/asp8347_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/kmeter1_defconfig b/arch/powerpc/configs/83xx/kmeter1_defconfig
index e43ecb27dfd..7a7b731c573 100644
--- a/arch/powerpc/configs/83xx/kmeter1_defconfig
+++ b/arch/powerpc/configs/83xx/kmeter1_defconfig
@@ -3,7 +3,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_HOTPLUG is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig b/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
index c2e6ab51d33..c683bce4c26 100644
--- a/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
+++ b/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc8315_rdb_defconfig b/arch/powerpc/configs/83xx/mpc8315_rdb_defconfig
index 1d3b2006591..a721cd3d793 100644
--- a/arch/powerpc/configs/83xx/mpc8315_rdb_defconfig
+++ b/arch/powerpc/configs/83xx/mpc8315_rdb_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc832x_mds_defconfig b/arch/powerpc/configs/83xx/mpc832x_mds_defconfig
index 91fe73bd5ad..a5699a1f7d0 100644
--- a/arch/powerpc/configs/83xx/mpc832x_mds_defconfig
+++ b/arch/powerpc/configs/83xx/mpc832x_mds_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc832x_rdb_defconfig b/arch/powerpc/configs/83xx/mpc832x_rdb_defconfig
index 6d300f20560..b4da1a7e644 100644
--- a/arch/powerpc/configs/83xx/mpc832x_rdb_defconfig
+++ b/arch/powerpc/configs/83xx/mpc832x_rdb_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc834x_itx_defconfig b/arch/powerpc/configs/83xx/mpc834x_itx_defconfig
index b236a67e01f..291f8221d5a 100644
--- a/arch/powerpc/configs/83xx/mpc834x_itx_defconfig
+++ b/arch/powerpc/configs/83xx/mpc834x_itx_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc834x_itxgp_defconfig b/arch/powerpc/configs/83xx/mpc834x_itxgp_defconfig
index 001dead3cde..f8b228aaa03 100644
--- a/arch/powerpc/configs/83xx/mpc834x_itxgp_defconfig
+++ b/arch/powerpc/configs/83xx/mpc834x_itxgp_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc834x_mds_defconfig b/arch/powerpc/configs/83xx/mpc834x_mds_defconfig
index 9dccefca00c..99660c06219 100644
--- a/arch/powerpc/configs/83xx/mpc834x_mds_defconfig
+++ b/arch/powerpc/configs/83xx/mpc834x_mds_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc836x_mds_defconfig b/arch/powerpc/configs/83xx/mpc836x_mds_defconfig
index d4b165d7d29..10b5c4cd0e7 100644
--- a/arch/powerpc/configs/83xx/mpc836x_mds_defconfig
+++ b/arch/powerpc/configs/83xx/mpc836x_mds_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc836x_rdk_defconfig b/arch/powerpc/configs/83xx/mpc836x_rdk_defconfig
index 89ba67274bd..45925d701d2 100644
--- a/arch/powerpc/configs/83xx/mpc836x_rdk_defconfig
+++ b/arch/powerpc/configs/83xx/mpc836x_rdk_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc837x_mds_defconfig b/arch/powerpc/configs/83xx/mpc837x_mds_defconfig
index 2ea6b405046..f367985be6f 100644
--- a/arch/powerpc/configs/83xx/mpc837x_mds_defconfig
+++ b/arch/powerpc/configs/83xx/mpc837x_mds_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/mpc837x_rdb_defconfig b/arch/powerpc/configs/83xx/mpc837x_rdb_defconfig
index bffe3c77503..414eda38159 100644
--- a/arch/powerpc/configs/83xx/mpc837x_rdb_defconfig
+++ b/arch/powerpc/configs/83xx/mpc837x_rdb_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/83xx/sbc834x_defconfig b/arch/powerpc/configs/83xx/sbc834x_defconfig
index fa5c9eefc9a..6d6463fe06f 100644
--- a/arch/powerpc/configs/83xx/sbc834x_defconfig
+++ b/arch/powerpc/configs/83xx/sbc834x_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_SLAB=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/85xx/ksi8560_defconfig b/arch/powerpc/configs/85xx/ksi8560_defconfig
index 385b1af37d7..8f7c1061891 100644
--- a/arch/powerpc/configs/85xx/ksi8560_defconfig
+++ b/arch/powerpc/configs/85xx/ksi8560_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_KSI8560=y
 CONFIG_CPM2=y
diff --git a/arch/powerpc/configs/85xx/mpc8540_ads_defconfig b/arch/powerpc/configs/85xx/mpc8540_ads_defconfig
index 222b704c1f4..55e0725500d 100644
--- a/arch/powerpc/configs/85xx/mpc8540_ads_defconfig
+++ b/arch/powerpc/configs/85xx/mpc8540_ads_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_MPC8540_ADS=y
 CONFIG_NO_HZ=y
diff --git a/arch/powerpc/configs/85xx/mpc8560_ads_defconfig b/arch/powerpc/configs/85xx/mpc8560_ads_defconfig
index 619702de947..d724095530a 100644
--- a/arch/powerpc/configs/85xx/mpc8560_ads_defconfig
+++ b/arch/powerpc/configs/85xx/mpc8560_ads_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_MPC8560_ADS=y
 CONFIG_BINFMT_MISC=y
diff --git a/arch/powerpc/configs/85xx/mpc85xx_cds_defconfig b/arch/powerpc/configs/85xx/mpc85xx_cds_defconfig
index 6bf56e83f95..4b44beaa21a 100644
--- a/arch/powerpc/configs/85xx/mpc85xx_cds_defconfig
+++ b/arch/powerpc/configs/85xx/mpc85xx_cds_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_MPC85xx_CDS=y
 CONFIG_NO_HZ=y
diff --git a/arch/powerpc/configs/85xx/sbc8548_defconfig b/arch/powerpc/configs/85xx/sbc8548_defconfig
index a9a17d05576..5b2b651dfb9 100644
--- a/arch/powerpc/configs/85xx/sbc8548_defconfig
+++ b/arch/powerpc/configs/85xx/sbc8548_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_SBC8548=y
diff --git a/arch/powerpc/configs/85xx/sbc8560_defconfig b/arch/powerpc/configs/85xx/sbc8560_defconfig
index 820e32d8c42..f7fdb0318e4 100644
--- a/arch/powerpc/configs/85xx/sbc8560_defconfig
+++ b/arch/powerpc/configs/85xx/sbc8560_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 # CONFIG_BLK_DEV_BSG is not set
 CONFIG_SBC8560=y
diff --git a/arch/powerpc/configs/85xx/socrates_defconfig b/arch/powerpc/configs/85xx/socrates_defconfig
index b6db3f47af9..77506b5d5a4 100644
--- a/arch/powerpc/configs/85xx/socrates_defconfig
+++ b/arch/powerpc/configs/85xx/socrates_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/85xx/stx_gp3_defconfig b/arch/powerpc/configs/85xx/stx_gp3_defconfig
index 333a41bd2a6..5d4db154bf5 100644
--- a/arch/powerpc/configs/85xx/stx_gp3_defconfig
+++ b/arch/powerpc/configs/85xx/stx_gp3_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODVERSIONS=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/85xx/tqm8540_defconfig b/arch/powerpc/configs/85xx/tqm8540_defconfig
index 33db352f847..ddcb9f37fa1 100644
--- a/arch/powerpc/configs/85xx/tqm8540_defconfig
+++ b/arch/powerpc/configs/85xx/tqm8540_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/85xx/tqm8541_defconfig b/arch/powerpc/configs/85xx/tqm8541_defconfig
index f0c20dfbd4d..981abd6d4b5 100644
--- a/arch/powerpc/configs/85xx/tqm8541_defconfig
+++ b/arch/powerpc/configs/85xx/tqm8541_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/85xx/tqm8548_defconfig b/arch/powerpc/configs/85xx/tqm8548_defconfig
index a883450dcdf..37b3d7227cd 100644
--- a/arch/powerpc/configs/85xx/tqm8548_defconfig
+++ b/arch/powerpc/configs/85xx/tqm8548_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
diff --git a/arch/powerpc/configs/85xx/tqm8555_defconfig b/arch/powerpc/configs/85xx/tqm8555_defconfig
index ff95f90dc17..3593b320c97 100644
--- a/arch/powerpc/configs/85xx/tqm8555_defconfig
+++ b/arch/powerpc/configs/85xx/tqm8555_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/85xx/tqm8560_defconfig b/arch/powerpc/configs/85xx/tqm8560_defconfig
index 8d6c90ea478..de413acc34d 100644
--- a/arch/powerpc/configs/85xx/tqm8560_defconfig
+++ b/arch/powerpc/configs/85xx/tqm8560_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_EPOLL is not set
diff --git a/arch/powerpc/configs/85xx/xes_mpc85xx_defconfig b/arch/powerpc/configs/85xx/xes_mpc85xx_defconfig
index f53efe4a0e0..5ea3124518f 100644
--- a/arch/powerpc/configs/85xx/xes_mpc85xx_defconfig
+++ b/arch/powerpc/configs/85xx/xes_mpc85xx_defconfig
@@ -11,7 +11,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/86xx/gef_ppc9a_defconfig b/arch/powerpc/configs/86xx/gef_ppc9a_defconfig
index 432ebc28d25..4b2441244ea 100644
--- a/arch/powerpc/configs/86xx/gef_ppc9a_defconfig
+++ b/arch/powerpc/configs/86xx/gef_ppc9a_defconfig
@@ -11,7 +11,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/86xx/gef_sbc310_defconfig b/arch/powerpc/configs/86xx/gef_sbc310_defconfig
index ce5e919d9b5..a360ba44b92 100644
--- a/arch/powerpc/configs/86xx/gef_sbc310_defconfig
+++ b/arch/powerpc/configs/86xx/gef_sbc310_defconfig
@@ -11,7 +11,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/86xx/gef_sbc610_defconfig b/arch/powerpc/configs/86xx/gef_sbc610_defconfig
index 589e71e6dc1..be2829dd129 100644
--- a/arch/powerpc/configs/86xx/gef_sbc610_defconfig
+++ b/arch/powerpc/configs/86xx/gef_sbc610_defconfig
@@ -11,7 +11,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/86xx/mpc8610_hpcd_defconfig b/arch/powerpc/configs/86xx/mpc8610_hpcd_defconfig
index 321fb47096d..036bfb2d18c 100644
--- a/arch/powerpc/configs/86xx/mpc8610_hpcd_defconfig
+++ b/arch/powerpc/configs/86xx/mpc8610_hpcd_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 # CONFIG_ELF_CORE is not set
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/86xx/mpc8641_hpcn_defconfig b/arch/powerpc/configs/86xx/mpc8641_hpcn_defconfig
index b5e46399374..0c9c7ed7ec7 100644
--- a/arch/powerpc/configs/86xx/mpc8641_hpcn_defconfig
+++ b/arch/powerpc/configs/86xx/mpc8641_hpcn_defconfig
@@ -10,7 +10,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/86xx/sbc8641d_defconfig b/arch/powerpc/configs/86xx/sbc8641d_defconfig
index 71145c3a64d..0a92ca04564 100644
--- a/arch/powerpc/configs/86xx/sbc8641d_defconfig
+++ b/arch/powerpc/configs/86xx/sbc8641d_defconfig
@@ -11,7 +11,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/adder875_defconfig b/arch/powerpc/configs/adder875_defconfig
index ca84c7fc24d..69128740c14 100644
--- a/arch/powerpc/configs/adder875_defconfig
+++ b/arch/powerpc/configs/adder875_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_BASE_FULL is not set
diff --git a/arch/powerpc/configs/e55xx_smp_defconfig b/arch/powerpc/configs/e55xx_smp_defconfig
index 94d120ef99c..06f95492afc 100644
--- a/arch/powerpc/configs/e55xx_smp_defconfig
+++ b/arch/powerpc/configs/e55xx_smp_defconfig
@@ -12,7 +12,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/ep8248e_defconfig b/arch/powerpc/configs/ep8248e_defconfig
index 2677b08199e..fceffb3cffb 100644
--- a/arch/powerpc/configs/ep8248e_defconfig
+++ b/arch/powerpc/configs/ep8248e_defconfig
@@ -2,7 +2,7 @@ CONFIG_SYSVIPC=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_SLAB=y
 # CONFIG_IOSCHED_CFQ is not set
diff --git a/arch/powerpc/configs/ep88xc_defconfig b/arch/powerpc/configs/ep88xc_defconfig
index f9a3112e544..219fd470ed2 100644
--- a/arch/powerpc/configs/ep88xc_defconfig
+++ b/arch/powerpc/configs/ep88xc_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_BASE_FULL is not set
diff --git a/arch/powerpc/configs/gamecube_defconfig b/arch/powerpc/configs/gamecube_defconfig
index fcf0a398cd6..e74d3a48370 100644
--- a/arch/powerpc/configs/gamecube_defconfig
+++ b/arch/powerpc/configs/gamecube_defconfig
@@ -6,7 +6,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_ELF_CORE is not set
 CONFIG_PERF_COUNTERS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/powerpc/configs/holly_defconfig b/arch/powerpc/configs/holly_defconfig
index b9b63a60952..94ebfee188d 100644
--- a/arch/powerpc/configs/holly_defconfig
+++ b/arch/powerpc/configs/holly_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_PPC_CHRP is not set
diff --git a/arch/powerpc/configs/mgcoge_defconfig b/arch/powerpc/configs/mgcoge_defconfig
index c4ed255af18..39518e91822 100644
--- a/arch/powerpc/configs/mgcoge_defconfig
+++ b/arch/powerpc/configs/mgcoge_defconfig
@@ -3,7 +3,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_SLAB=y
 # CONFIG_IOSCHED_CFQ is not set
diff --git a/arch/powerpc/configs/mgsuvd_defconfig b/arch/powerpc/configs/mgsuvd_defconfig
index f276c7cf555..2a490626015 100644
--- a/arch/powerpc/configs/mgsuvd_defconfig
+++ b/arch/powerpc/configs/mgsuvd_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_BUG is not set
diff --git a/arch/powerpc/configs/mpc7448_hpc2_defconfig b/arch/powerpc/configs/mpc7448_hpc2_defconfig
index 3b9470883de..75f0bbf0f6e 100644
--- a/arch/powerpc/configs/mpc7448_hpc2_defconfig
+++ b/arch/powerpc/configs/mpc7448_hpc2_defconfig
@@ -4,7 +4,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_PPC_CHRP is not set
 # CONFIG_PPC_PMAC is not set
diff --git a/arch/powerpc/configs/mpc8272_ads_defconfig b/arch/powerpc/configs/mpc8272_ads_defconfig
index c7d68ff1a73..6a22400f73c 100644
--- a/arch/powerpc/configs/mpc8272_ads_defconfig
+++ b/arch/powerpc/configs/mpc8272_ads_defconfig
@@ -2,7 +2,7 @@ CONFIG_SYSVIPC=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_PPC_CHRP is not set
 # CONFIG_PPC_PMAC is not set
diff --git a/arch/powerpc/configs/mpc83xx_defconfig b/arch/powerpc/configs/mpc83xx_defconfig
index 5b1b10fd974..5aac9a8bc53 100644
--- a/arch/powerpc/configs/mpc83xx_defconfig
+++ b/arch/powerpc/configs/mpc83xx_defconfig
@@ -3,7 +3,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/mpc85xx_defconfig b/arch/powerpc/configs/mpc85xx_defconfig
index 3aeb5949cfe..99a19d1e9bf 100644
--- a/arch/powerpc/configs/mpc85xx_defconfig
+++ b/arch/powerpc/configs/mpc85xx_defconfig
@@ -10,7 +10,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/mpc85xx_smp_defconfig b/arch/powerpc/configs/mpc85xx_smp_defconfig
index d62c8016f4b..c636f23f8c9 100644
--- a/arch/powerpc/configs/mpc85xx_smp_defconfig
+++ b/arch/powerpc/configs/mpc85xx_smp_defconfig
@@ -12,7 +12,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/mpc866_ads_defconfig b/arch/powerpc/configs/mpc866_ads_defconfig
index 668215cae89..5c258823e69 100644
--- a/arch/powerpc/configs/mpc866_ads_defconfig
+++ b/arch/powerpc/configs/mpc866_ads_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_HOTPLUG is not set
 # CONFIG_BUG is not set
diff --git a/arch/powerpc/configs/mpc86xx_defconfig b/arch/powerpc/configs/mpc86xx_defconfig
index 63b90d47788..55b54318fef 100644
--- a/arch/powerpc/configs/mpc86xx_defconfig
+++ b/arch/powerpc/configs/mpc86xx_defconfig
@@ -10,7 +10,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/mpc885_ads_defconfig b/arch/powerpc/configs/mpc885_ads_defconfig
index f9b83481b00..9e146cdf63d 100644
--- a/arch/powerpc/configs/mpc885_ads_defconfig
+++ b/arch/powerpc/configs/mpc885_ads_defconfig
@@ -4,7 +4,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_BASE_FULL is not set
diff --git a/arch/powerpc/configs/ppc40x_defconfig b/arch/powerpc/configs/ppc40x_defconfig
index 93d7425ce6c..bfd634b5ada 100644
--- a/arch/powerpc/configs/ppc40x_defconfig
+++ b/arch/powerpc/configs/ppc40x_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/ppc44x_defconfig b/arch/powerpc/configs/ppc44x_defconfig
index 2fa05f7be4c..47133202a62 100644
--- a/arch/powerpc/configs/ppc44x_defconfig
+++ b/arch/powerpc/configs/ppc44x_defconfig
@@ -5,7 +5,7 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 CONFIG_MODULES=y
diff --git a/arch/powerpc/configs/pq2fads_defconfig b/arch/powerpc/configs/pq2fads_defconfig
index a4353bef31c..baad8db21b6 100644
--- a/arch/powerpc/configs/pq2fads_defconfig
+++ b/arch/powerpc/configs/pq2fads_defconfig
@@ -3,7 +3,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_PPC_CHRP is not set
 # CONFIG_PPC_PMAC is not set
diff --git a/arch/powerpc/configs/ps3_defconfig b/arch/powerpc/configs/ps3_defconfig
index 49cffe00365..caba919f65d 100644
--- a/arch/powerpc/configs/ps3_defconfig
+++ b/arch/powerpc/configs/ps3_defconfig
@@ -8,7 +8,7 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
 # CONFIG_PERF_EVENTS is not set
 # CONFIG_COMPAT_BRK is not set
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index f87f0e15cfa..9c3f22c6cde 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -2,7 +2,7 @@ CONFIG_PPC64=y
 CONFIG_ALTIVEC=y
 CONFIG_VSX=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=128
+CONFIG_NR_CPUS=1024
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -45,6 +45,8 @@ CONFIG_KEXEC=y
 CONFIG_IRQ_ALL_CPUS=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
+CONFIG_PPC_64K_PAGES=y
+CONFIG_PPC_SUBPAGE_PROT=y
 CONFIG_SCHED_SMT=y
 CONFIG_HOTPLUG_PCI=m
 CONFIG_HOTPLUG_PCI_RPA=m
@@ -184,6 +186,7 @@ CONFIG_ACENIC_OMIT_TIGON_I=y
 CONFIG_E1000=y
 CONFIG_E1000E=y
 CONFIG_TIGON3=y
+CONFIG_BNX2=m
 CONFIG_CHELSIO_T1=m
 CONFIG_CHELSIO_T3=m
 CONFIG_EHEA=y
@@ -311,9 +314,7 @@ CONFIG_DEBUG_KERNEL=y
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
 CONFIG_LATENCYTOP=y
 CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_IRQSOFF_TRACER=y
 CONFIG_SCHED_TRACER=y
-CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
diff --git a/arch/powerpc/configs/storcenter_defconfig b/arch/powerpc/configs/storcenter_defconfig
index 4f0c10a62b9..ebb2a66c99d 100644
--- a/arch/powerpc/configs/storcenter_defconfig
+++ b/arch/powerpc/configs/storcenter_defconfig
@@ -1,7 +1,7 @@
 CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
diff --git a/arch/powerpc/configs/tqm8xx_defconfig b/arch/powerpc/configs/tqm8xx_defconfig
index d0a5b676388..8616fde0896 100644
--- a/arch/powerpc/configs/tqm8xx_defconfig
+++ b/arch/powerpc/configs/tqm8xx_defconfig
@@ -5,7 +5,7 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_SYSCTL_SYSCALL is not set
 # CONFIG_ELF_CORE is not set
 # CONFIG_BASE_FULL is not set
diff --git a/arch/powerpc/configs/wii_defconfig b/arch/powerpc/configs/wii_defconfig
index bb8ba75b7c6..175295fbf4f 100644
--- a/arch/powerpc/configs/wii_defconfig
+++ b/arch/powerpc/configs/wii_defconfig
@@ -7,7 +7,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_ELF_CORE is not set
 CONFIG_PERF_COUNTERS=y
 # CONFIG_VM_EVENT_COUNTERS is not set
diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h
index 96a7d067fbb..921a8470e18 100644
--- a/arch/powerpc/include/asm/feature-fixups.h
+++ b/arch/powerpc/include/asm/feature-fixups.h
@@ -37,18 +37,21 @@ label##2:						\
         .align 2;                                       \
 label##3:
 
-#define MAKE_FTR_SECTION_ENTRY(msk, val, label, sect)   \
-label##4:                                               \
-        .popsection;                                    \
-        .pushsection sect,"a";                          \
-        .align 3;                                       \
-label##5:                                               \
-        FTR_ENTRY_LONG msk;                             \
-        FTR_ENTRY_LONG val;                             \
-        FTR_ENTRY_OFFSET label##1b-label##5b;           \
-        FTR_ENTRY_OFFSET label##2b-label##5b;           \
-        FTR_ENTRY_OFFSET label##3b-label##5b;           \
-        FTR_ENTRY_OFFSET label##4b-label##5b;           \
+#define MAKE_FTR_SECTION_ENTRY(msk, val, label, sect)           \
+label##4:                                                       \
+        .popsection;                                            \
+        .pushsection sect,"a";                                  \
+        .align 3;                                               \
+label##5:                                                       \
+        FTR_ENTRY_LONG msk;                                     \
+        FTR_ENTRY_LONG val;                                     \
+        FTR_ENTRY_OFFSET label##1b-label##5b;                   \
+        FTR_ENTRY_OFFSET label##2b-label##5b;                   \
+        FTR_ENTRY_OFFSET label##3b-label##5b;                   \
+        FTR_ENTRY_OFFSET label##4b-label##5b;                   \
+        .ifgt (label##4b-label##3b)-(label##2b-label##1b);      \
+        .error "Feature section else case larger than body";    \
+        .endif;                                                 \
         .popsection;
 
 
diff --git a/arch/powerpc/include/asm/immap_qe.h b/arch/powerpc/include/asm/immap_qe.h
index 4e10f508570..0edb6842b13 100644
--- a/arch/powerpc/include/asm/immap_qe.h
+++ b/arch/powerpc/include/asm/immap_qe.h
@@ -467,13 +467,22 @@ struct qe_immap {
 extern struct qe_immap __iomem *qe_immr;
 extern phys_addr_t get_qe_base(void);
 
-static inline unsigned long immrbar_virt_to_phys(void *address)
+/*
+ * Returns the offset within the QE address space of the given pointer.
+ *
+ * Note that the QE does not support 36-bit physical addresses, so if
+ * get_qe_base() returns a number above 4GB, the caller will probably fail.
+ */
+static inline phys_addr_t immrbar_virt_to_phys(void *address)
 {
-        if ( ((u32)address >= (u32)qe_immr) &&
-                        ((u32)address < ((u32)qe_immr + QE_IMMAP_SIZE)) )
-                return (unsigned long)(address - (u32)qe_immr +
-                                (u32)get_qe_base());
-        return (unsigned long)virt_to_phys(address);
+        void *q = (void *)qe_immr;
+
+        /* Is it a MURAM address? */
+        if ((address >= q) && (address < (q + QE_IMMAP_SIZE)))
+                return get_qe_base() + (address - q);
+
+        /* It's an address returned by kmalloc */
+        return virt_to_phys(address);
 }
 
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/irqflags.h b/arch/powerpc/include/asm/irqflags.h
index b85d8ddbb66..b0b06d85788 100644
--- a/arch/powerpc/include/asm/irqflags.h
+++ b/arch/powerpc/include/asm/irqflags.h
@@ -12,24 +12,44 @@
 
 #else
 #ifdef CONFIG_TRACE_IRQFLAGS
+#ifdef CONFIG_IRQSOFF_TRACER
+/*
+ * Since the ftrace irqsoff latency trace checks CALLER_ADDR1,
+ * which is the stack frame here, we need to force a stack frame
+ * in case we came from user space.
+ */
+#define TRACE_WITH_FRAME_BUFFER(func)           \
+        mflr    r0;                             \
+        stdu    r1, -32(r1);                    \
+        std     r0, 16(r1);                     \
+        stdu    r1, -32(r1);                    \
+        bl func;                                \
+        ld      r1, 0(r1);                      \
+        ld      r1, 0(r1);
+#else
+#define TRACE_WITH_FRAME_BUFFER(func)           \
+        bl func;
+#endif
+
 /*
  * Most of the CPU's IRQ-state tracing is done from assembly code; we
  * have to call a C function so call a wrapper that saves all the
  * C-clobbered registers.
  */
-#define TRACE_ENABLE_INTS       bl .trace_hardirqs_on
-#define TRACE_DISABLE_INTS      bl .trace_hardirqs_off
-#define TRACE_AND_RESTORE_IRQ_PARTIAL(en,skip)  \
-        cmpdi   en,0;                           \
-        bne     95f;                            \
-        stb     en,PACASOFTIRQEN(r13);          \
-        bl      .trace_hardirqs_off;            \
-        b       skip;                           \
-95:     bl      .trace_hardirqs_on;             \
+#define TRACE_ENABLE_INTS       TRACE_WITH_FRAME_BUFFER(.trace_hardirqs_on)
+#define TRACE_DISABLE_INTS      TRACE_WITH_FRAME_BUFFER(.trace_hardirqs_off)
+
+#define TRACE_AND_RESTORE_IRQ_PARTIAL(en,skip)          \
+        cmpdi   en,0;                                   \
+        bne     95f;                                    \
+        stb     en,PACASOFTIRQEN(r13);                  \
+        TRACE_WITH_FRAME_BUFFER(.trace_hardirqs_off)    \
+        b       skip;                                   \
+95:     TRACE_WITH_FRAME_BUFFER(.trace_hardirqs_on)     \
         li      en,1;
 #define TRACE_AND_RESTORE_IRQ(en)               \
         TRACE_AND_RESTORE_IRQ_PARTIAL(en,96f);  \
-        stb     en,PACASOFTIRQEN(r13);          \
+        stb     en,PACASOFTIRQEN(r13);          \
 96:
 #else
 #define TRACE_ENABLE_INTS
diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
index 8433d36619a..991d5998d6b 100644
--- a/arch/powerpc/include/asm/machdep.h
+++ b/arch/powerpc/include/asm/machdep.h
@@ -116,9 +116,6 @@ struct machdep_calls {
          * If for some reason there is no irq, but the interrupt
          * shouldn't be counted as spurious, return NO_IRQ_IGNORE. */
         unsigned int    (*get_irq)(void);
-#ifdef CONFIG_KEXEC
-        void            (*kexec_cpu_down)(int crash_shutdown, int secondary);
-#endif
 
         /* PCI stuff */
         /* Called after scanning the bus, before allocating resources */
@@ -235,11 +232,7 @@ struct machdep_calls {
         void (*machine_shutdown)(void);
 
 #ifdef CONFIG_KEXEC
-        /* Called to do the minimal shutdown needed to run a kexec'd kernel
-         * to run successfully.
-         * XXX Should we move this one out of kexec scope?
-         */
-        void (*machine_crash_shutdown)(struct pt_regs *regs);
+        void (*kexec_cpu_down)(int crash_shutdown, int secondary);
 
         /* Called to do what every setup is needed on image and the
          * reboot code buffer. Returns 0 on success.
@@ -247,15 +240,6 @@ struct machdep_calls {
          * claims to support kexec.
          */
         int (*machine_kexec_prepare)(struct kimage *image);
-
-        /* Called to handle any machine specific cleanup on image */
-        void (*machine_kexec_cleanup)(struct kimage *image);
-
-        /* Called to perform the _real_ kexec.
-         * Do NOT allocate memory or fail here. We are past the point of
-         * no return.
-         */
-        void (*machine_kexec)(struct kimage *image);
 #endif /* CONFIG_KEXEC */
 
 #ifdef CONFIG_SUSPEND
diff --git a/arch/powerpc/include/asm/mmu-book3e.h b/arch/powerpc/include/asm/mmu-book3e.h
index 8eaed81ea64..17194fcd404 100644
--- a/arch/powerpc/include/asm/mmu-book3e.h
+++ b/arch/powerpc/include/asm/mmu-book3e.h
@@ -40,8 +40,8 @@
 
 /* MAS registers bit definitions */
 
-#define MAS0_TLBSEL(x)          ((x << 28) & 0x30000000)
-#define MAS0_ESEL(x)            ((x << 16) & 0x0FFF0000)
+#define MAS0_TLBSEL(x)          (((x) << 28) & 0x30000000)
+#define MAS0_ESEL(x)            (((x) << 16) & 0x0FFF0000)
 #define MAS0_NV(x)              ((x) & 0x00000FFF)
 #define MAS0_HES                0x00004000
 #define MAS0_WQ_ALLWAYS         0x00000000
@@ -50,12 +50,12 @@
 
 #define MAS1_VALID              0x80000000
 #define MAS1_IPROT              0x40000000
-#define MAS1_TID(x)             ((x << 16) & 0x3FFF0000)
+#define MAS1_TID(x)             (((x) << 16) & 0x3FFF0000)
 #define MAS1_IND                0x00002000
 #define MAS1_TS                 0x00001000
 #define MAS1_TSIZE_MASK         0x00000f80
 #define MAS1_TSIZE_SHIFT        7
-#define MAS1_TSIZE(x)           ((x << MAS1_TSIZE_SHIFT) & MAS1_TSIZE_MASK)
+#define MAS1_TSIZE(x)           (((x) << MAS1_TSIZE_SHIFT) & MAS1_TSIZE_MASK)
 
 #define MAS2_EPN                0xFFFFF000
 #define MAS2_X0                 0x00000040
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 53b64be40eb..da4b2000854 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -101,7 +101,7 @@ extern phys_addr_t kernstart_addr;
 
 #ifdef CONFIG_FLATMEM
 #define ARCH_PFN_OFFSET         (MEMORY_START >> PAGE_SHIFT)
-#define pfn_valid(pfn)          ((pfn) >= ARCH_PFN_OFFSET && (pfn) < (ARCH_PFN_OFFSET + max_mapnr))
+#define pfn_valid(pfn)          ((pfn) >= ARCH_PFN_OFFSET && (pfn) < max_mapnr)
 #endif
 
 #define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index ff0005eec7d..125fc1ad665 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -283,6 +283,7 @@
 #define HID0_NOPTI      (1<<0)          /* No-op dcbt and dcbst instr. */
 
 #define SPRN_HID1       0x3F1           /* Hardware Implementation Register 1 */
+#ifdef CONFIG_6xx
 #define HID1_EMCP       (1<<31)         /* 7450 Machine Check Pin Enable */
 #define HID1_DFS        (1<<22)         /* 7447A Dynamic Frequency Scaling */
 #define HID1_PC0        (1<<16)         /* 7450 PLL_CFG[0] */
@@ -292,6 +293,7 @@
 #define HID1_SYNCBE     (1<<11)         /* 7450 ABE for sync, eieio */
 #define HID1_ABE        (1<<10)         /* 7450 Address Broadcast Enable */
 #define HID1_PS         (1<<16)         /* 750FX PLL selection */
+#endif
 #define SPRN_HID2       0x3F8           /* Hardware Implementation Register 2 */
 #define SPRN_HID2_GEKKO 0x398           /* Gekko HID2 Register */
 #define SPRN_IABR       0x3F2   /* Instruction Address Breakpoint Register */
diff --git a/arch/powerpc/include/asm/reg_booke.h b/arch/powerpc/include/asm/reg_booke.h
index 667a498eaee..e68c69bf741 100644
--- a/arch/powerpc/include/asm/reg_booke.h
+++ b/arch/powerpc/include/asm/reg_booke.h
@@ -246,6 +246,20 @@
                                         store or cache line push */
 #endif
 
+/* Bit definitions for the HID1 */
+#ifdef CONFIG_E500
+/* e500v1/v2 */
+#define HID1_PLL_CFG_MASK 0xfc000000    /* PLL_CFG input pins */
+#define HID1_RFXE       0x00020000      /* Read fault exception enable */
+#define HID1_R1DPE      0x00008000      /* R1 data bus parity enable */
+#define HID1_R2DPE      0x00004000      /* R2 data bus parity enable */
+#define HID1_ASTME      0x00002000      /* Address bus streaming mode enable */
+#define HID1_ABE        0x00001000      /* Address broadcast enable */
+#define HID1_MPXTT      0x00000400      /* MPX re-map transfer type */
+#define HID1_ATS        0x00000080      /* Atomic status */
+#define HID1_MID_MASK   0x0000000f      /* MID input pins */
+#endif
+
 /* Bit definitions for the DBSR. */
 /*
  * DBSR bits which have conflicting definitions on true Book E versus IBM 40x.
diff --git a/arch/powerpc/include/asm/spu.h b/arch/powerpc/include/asm/spu.h
index 0ab8d869e3d..0c8b35d7523 100644
--- a/arch/powerpc/include/asm/spu.h
+++ b/arch/powerpc/include/asm/spu.h
@@ -203,14 +203,6 @@ void spu_irq_setaffinity(struct spu *spu, int cpu);
 void spu_setup_kernel_slbs(struct spu *spu, struct spu_lscsa *lscsa,
                 void *code, int code_size);
 
-#ifdef CONFIG_KEXEC
-void crash_register_spus(struct list_head *list);
-#else
-static inline void crash_register_spus(struct list_head *list)
-{
-}
-#endif
-
 extern void spu_invalidate_slbs(struct spu *spu);
 extern void spu_associate_mm(struct spu *spu, struct mm_struct *mm);
 int spu_64k_pages_available(void);
diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S
index 55cba4a8a95..f8cd9fba4d3 100644
--- a/arch/powerpc/kernel/cpu_setup_6xx.S
+++ b/arch/powerpc/kernel/cpu_setup_6xx.S
@@ -18,7 +18,7 @@
 #include <asm/mmu.h>
 
 _GLOBAL(__setup_cpu_603)
-        mflr    r4
+        mflr    r5
 BEGIN_MMU_FTR_SECTION
         li      r10,0
         mtspr   SPRN_SPRG_603_LRU,r10           /* init SW LRU tracking */
@@ -27,60 +27,60 @@ BEGIN_FTR_SECTION
         bl      __init_fpu_registers
 END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE)
         bl      setup_common_caches
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_604)
-        mflr    r4
+        mflr    r5
         bl      setup_common_caches
         bl      setup_604_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750cx)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         bl      setup_750cx
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750fx)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         bl      setup_750fx
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_7400)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_7400_workarounds
         bl      setup_common_caches
         bl      setup_750_7400_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_7410)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_7410_workarounds
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         li      r3,0
         mtspr   SPRN_L2CR2,r3
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_745x)
-        mflr    r4
+        mflr    r5
         bl      setup_common_caches
         bl      setup_745x_specifics
-        mtlr    r4
+        mtlr    r5
         blr
 
 /* Enable caches for 603's, 604, 750 & 7400 */
@@ -194,10 +194,10 @@ setup_750cx:
         cror    4*cr0+eq,4*cr0+eq,4*cr1+eq
         cror    4*cr0+eq,4*cr0+eq,4*cr2+eq
         bnelr
-        lwz     r6,CPU_SPEC_FEATURES(r5)
+        lwz     r6,CPU_SPEC_FEATURES(r4)
         li      r7,CPU_FTR_CAN_NAP
         andc    r6,r6,r7
-        stw     r6,CPU_SPEC_FEATURES(r5)
+        stw     r6,CPU_SPEC_FEATURES(r4)
         blr
 
 /* 750fx specific
@@ -225,12 +225,12 @@ BEGIN_FTR_SECTION
         andis.  r11,r11,L3CR_L3E@h
         beq     1f
 END_FTR_SECTION_IFSET(CPU_FTR_L3CR)
-        lwz     r6,CPU_SPEC_FEATURES(r5)
+        lwz     r6,CPU_SPEC_FEATURES(r4)
         andi.   r0,r6,CPU_FTR_L3_DISABLE_NAP
         beq     1f
         li      r7,CPU_FTR_CAN_NAP
         andc    r6,r6,r7
-        stw     r6,CPU_SPEC_FEATURES(r5)
+        stw     r6,CPU_SPEC_FEATURES(r4)
 1:
         mfspr   r11,SPRN_HID0
 
diff --git a/arch/powerpc/kernel/cpu_setup_fsl_booke.S b/arch/powerpc/kernel/cpu_setup_fsl_booke.S
index 894e64fa481..5c518ad3445 100644
--- a/arch/powerpc/kernel/cpu_setup_fsl_booke.S
+++ b/arch/powerpc/kernel/cpu_setup_fsl_booke.S
@@ -64,6 +64,12 @@ _GLOBAL(__setup_cpu_e500v2)
         bl      __e500_icache_setup
         bl      __e500_dcache_setup
         bl      __setup_e500_ivors
+#ifdef CONFIG_RAPIDIO
+        /* Ensure that RFXE is set */
+        mfspr   r3,SPRN_HID1
+        oris    r3,r3,HID1_RFXE@h
+        mtspr   SPRN_HID1,r3
+#endif
         mtlr    r4
         blr
 _GLOBAL(__setup_cpu_e500mc)
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index be5ab18b03b..e8e915ce3d8 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -116,7 +116,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/power3",
                 .oprofile_type          = PPC_OPROFILE_RS64,
-                .machine_check          = machine_check_generic,
                 .platform               = "power3",
         },
         {       /* Power3+ */
@@ -132,7 +131,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/power3",
                 .oprofile_type          = PPC_OPROFILE_RS64,
-                .machine_check          = machine_check_generic,
                 .platform               = "power3",
         },
         {       /* Northstar */
@@ -148,7 +146,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/rs64",
                 .oprofile_type          = PPC_OPROFILE_RS64,
-                .machine_check          = machine_check_generic,
                 .platform               = "rs64",
         },
         {       /* Pulsar */
@@ -164,7 +161,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/rs64",
                 .oprofile_type          = PPC_OPROFILE_RS64,
-                .machine_check          = machine_check_generic,
                 .platform               = "rs64",
         },
         {       /* I-star */
@@ -180,7 +176,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/rs64",
                 .oprofile_type          = PPC_OPROFILE_RS64,
-                .machine_check          = machine_check_generic,
                 .platform               = "rs64",
         },
         {       /* S-star */
@@ -196,7 +191,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/rs64",
                 .oprofile_type          = PPC_OPROFILE_RS64,
-                .machine_check          = machine_check_generic,
                 .platform               = "rs64",
         },
         {       /* Power4 */
@@ -212,7 +206,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/power4",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
-                .machine_check          = machine_check_generic,
                 .platform               = "power4",
         },
         {       /* Power4+ */
@@ -228,7 +221,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/power4",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
-                .machine_check          = machine_check_generic,
                 .platform               = "power4",
         },
         {       /* PPC970 */
@@ -247,7 +239,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_restore            = __restore_cpu_ppc970,
                 .oprofile_cpu_type      = "ppc64/970",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
-                .machine_check          = machine_check_generic,
                 .platform               = "ppc970",
         },
         {       /* PPC970FX */
@@ -266,7 +257,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_restore            = __restore_cpu_ppc970,
                 .oprofile_cpu_type      = "ppc64/970",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
-                .machine_check          = machine_check_generic,
                 .platform               = "ppc970",
         },
         {       /* PPC970MP DD1.0 - no DEEPNAP, use regular 970 init */
@@ -285,7 +275,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_restore            = __restore_cpu_ppc970,
                 .oprofile_cpu_type      = "ppc64/970MP",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
-                .machine_check          = machine_check_generic,
                 .platform               = "ppc970",
         },
         {       /* PPC970MP */
@@ -304,7 +293,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_restore            = __restore_cpu_ppc970,
                 .oprofile_cpu_type      = "ppc64/970MP",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
-                .machine_check          = machine_check_generic,
                 .platform               = "ppc970",
         },
         {       /* PPC970GX */
@@ -322,7 +310,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_setup              = __setup_cpu_ppc970,
                 .oprofile_cpu_type      = "ppc64/970",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
-                .machine_check          = machine_check_generic,
                 .platform               = "ppc970",
         },
         {       /* Power5 GR */
@@ -343,7 +330,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                  */
                 .oprofile_mmcra_sihv    = MMCRA_SIHV,
                 .oprofile_mmcra_sipr    = MMCRA_SIPR,
-                .machine_check          = machine_check_generic,
                 .platform               = "power5",
         },
         {       /* Power5++ */
@@ -360,7 +346,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .oprofile_type          = PPC_OPROFILE_POWER4,
                 .oprofile_mmcra_sihv    = MMCRA_SIHV,
                 .oprofile_mmcra_sipr    = MMCRA_SIPR,
-                .machine_check          = machine_check_generic,
                 .platform               = "power5+",
         },
         {       /* Power5 GS */
@@ -378,7 +363,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .oprofile_type          = PPC_OPROFILE_POWER4,
                 .oprofile_mmcra_sihv    = MMCRA_SIHV,
                 .oprofile_mmcra_sipr    = MMCRA_SIPR,
-                .machine_check          = machine_check_generic,
                 .platform               = "power5+",
         },
         {       /* POWER6 in P5+ mode; 2.04-compliant processor */
@@ -390,7 +374,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .mmu_features           = MMU_FTR_HPTE_TABLE,
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
-                .machine_check          = machine_check_generic,
                 .oprofile_cpu_type      = "ppc64/ibm-compat-v1",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
                 .platform               = "power5+",
@@ -413,7 +396,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .oprofile_mmcra_sipr    = POWER6_MMCRA_SIPR,
                 .oprofile_mmcra_clear   = POWER6_MMCRA_THRM |
                         POWER6_MMCRA_OTHER,
-                .machine_check          = machine_check_generic,
                 .platform               = "power6x",
         },
         {       /* 2.05-compliant processor, i.e. Power6 "architected" mode */
@@ -425,7 +407,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .mmu_features           = MMU_FTR_HPTE_TABLE,
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
-                .machine_check          = machine_check_generic,
                 .oprofile_cpu_type      = "ppc64/ibm-compat-v1",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
                 .platform               = "power6",
@@ -440,7 +421,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                         MMU_FTR_TLBIE_206,
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
-                .machine_check          = machine_check_generic,
                 .oprofile_type          = PPC_OPROFILE_POWER4,
                 .oprofile_cpu_type      = "ppc64/ibm-compat-v1",
                 .platform               = "power7",
@@ -492,7 +472,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .pmc_type               = PPC_PMC_IBM,
                 .oprofile_cpu_type      = "ppc64/cell-be",
                 .oprofile_type          = PPC_OPROFILE_CELL,
-                .machine_check          = machine_check_generic,
                 .platform               = "ppc-cell-be",
         },
         {       /* PA Semi PA6T */
@@ -510,7 +489,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_restore            = __restore_cpu_pa6t,
                 .oprofile_cpu_type      = "ppc64/pa6t",
                 .oprofile_type          = PPC_OPROFILE_PA6T,
-                .machine_check          = machine_check_generic,
                 .platform               = "pa6t",
         },
         {       /* default match */
@@ -524,7 +502,6 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .dcache_bsize           = 128,
                 .num_pmcs               = 6,
                 .pmc_type               = PPC_PMC_IBM,
-                .machine_check          = machine_check_generic,
                 .platform               = "power4",
         }
 #endif  /* CONFIG_PPC_BOOK3S_64 */
@@ -2099,8 +2076,8 @@ static void __init setup_cpu_spec(unsigned long offset, struct cpu_spec *s)
          * pointer on ppc64 and booke as we are running at 0 in real mode
          * on ppc64 and reloc_offset is always 0 on booke.
          */
-        if (s->cpu_setup) {
-                s->cpu_setup(offset, s);
+        if (t->cpu_setup) {
+                t->cpu_setup(offset, t);
         }
 #endif /* CONFIG_PPC64 || CONFIG_BOOKE */
 }
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 832c8c4db25..3d569e2aff1 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -48,7 +48,7 @@ int crashing_cpu = -1;
 static cpumask_t cpus_in_crash = CPU_MASK_NONE;
 cpumask_t cpus_in_sr = CPU_MASK_NONE;
 
-#define CRASH_HANDLER_MAX 2
+#define CRASH_HANDLER_MAX 3
 /* NULL terminated list of shutdown handles */
 static crash_shutdown_t crash_shutdown_handles[CRASH_HANDLER_MAX+1];
 static DEFINE_SPINLOCK(crash_handlers_lock);
@@ -125,7 +125,7 @@ static void crash_kexec_prepare_cpus(int cpu)
         smp_wmb();
 
         /*
-         * FIXME: Until we will have the way to stop other CPUSs reliabally,
+         * FIXME: Until we will have the way to stop other CPUs reliably,
          * the crash CPU will send an IPI and wait for other CPUs to
          * respond.
          * Delay of at least 10 seconds.
@@ -254,72 +254,6 @@ void crash_kexec_secondary(struct pt_regs *regs)
         cpus_in_sr = CPU_MASK_NONE;
 }
 #endif
-#ifdef CONFIG_SPU_BASE
-
-#include <asm/spu.h>
-#include <asm/spu_priv1.h>
-
-struct crash_spu_info {
-        struct spu *spu;
-        u32 saved_spu_runcntl_RW;
-        u32 saved_spu_status_R;
-        u32 saved_spu_npc_RW;
-        u64 saved_mfc_sr1_RW;
-        u64 saved_mfc_dar;
-        u64 saved_mfc_dsisr;
-};
-
-#define CRASH_NUM_SPUS  16      /* Enough for current hardware */
-static struct crash_spu_info crash_spu_info[CRASH_NUM_SPUS];
-
-static void crash_kexec_stop_spus(void)
-{
-        struct spu *spu;
-        int i;
-        u64 tmp;
-
-        for (i = 0; i < CRASH_NUM_SPUS; i++) {
-                if (!crash_spu_info[i].spu)
-                        continue;
-
-                spu = crash_spu_info[i].spu;
-
-                crash_spu_info[i].saved_spu_runcntl_RW =
-                        in_be32(&spu->problem->spu_runcntl_RW);
-                crash_spu_info[i].saved_spu_status_R =
-                        in_be32(&spu->problem->spu_status_R);
-                crash_spu_info[i].saved_spu_npc_RW =
-                        in_be32(&spu->problem->spu_npc_RW);
-
-                crash_spu_info[i].saved_mfc_dar    = spu_mfc_dar_get(spu);
-                crash_spu_info[i].saved_mfc_dsisr  = spu_mfc_dsisr_get(spu);
-                tmp = spu_mfc_sr1_get(spu);
-                crash_spu_info[i].saved_mfc_sr1_RW = tmp;
-
-                tmp &= ~MFC_STATE1_MASTER_RUN_CONTROL_MASK;
-                spu_mfc_sr1_set(spu, tmp);
-
-                __delay(200);
-        }
-}
-
-void crash_register_spus(struct list_head *list)
-{
-        struct spu *spu;
-
-        list_for_each_entry(spu, list, full_list) {
-                if (WARN_ON(spu->number >= CRASH_NUM_SPUS))
-                        continue;
-
-                crash_spu_info[spu->number].spu = spu;
-        }
-}
-
-#else
-static inline void crash_kexec_stop_spus(void)
-{
-}
-#endif /* CONFIG_SPU_BASE */
 
 /*
  * Register a function to be called on shutdown.  Only use this if you
@@ -439,8 +373,6 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
         crash_shutdown_cpu = -1;
         __debugger_fault_handler = old_handler;
 
-        crash_kexec_stop_spus();
-
         if (ppc_md.kexec_cpu_down)
                 ppc_md.kexec_cpu_down(1, 0);
 }
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index c22dc1ec1c9..56212bc0ab0 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -880,7 +880,18 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_47x)
          */
         andi.   r10,r9,MSR_EE
         beq     1f
+        /*
+         * Since the ftrace irqsoff latency trace checks CALLER_ADDR1,
+         * which is the stack frame here, we need to force a stack frame
+         * in case we came from user space.
+         */
+        stwu    r1,-32(r1)
+        mflr    r0
+        stw     r0,4(r1)
+        stwu    r1,-32(r1)
         bl      trace_hardirqs_on
+        lwz     r1,0(r1)
+        lwz     r1,0(r1)
         lwz     r9,_MSR(r1)
 1:
 #endif /* CONFIG_TRACE_IRQFLAGS */
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index df7e20c191c..49a170af814 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -15,6 +15,7 @@
 #include <linux/memblock.h>
 #include <linux/of.h>
 #include <linux/irq.h>
+#include <linux/ftrace.h>
 
 #include <asm/machdep.h>
 #include <asm/prom.h>
@@ -44,10 +45,7 @@ void machine_kexec_mask_interrupts(void) {
 
 void machine_crash_shutdown(struct pt_regs *regs)
 {
-        if (ppc_md.machine_crash_shutdown)
-                ppc_md.machine_crash_shutdown(regs);
-        else
-                default_machine_crash_shutdown(regs);
+        default_machine_crash_shutdown(regs);
 }
 
 /*
@@ -65,8 +63,6 @@ int machine_kexec_prepare(struct kimage *image)
 
 void machine_kexec_cleanup(struct kimage *image)
 {
-        if (ppc_md.machine_kexec_cleanup)
-                ppc_md.machine_kexec_cleanup(image);
 }
 
 void arch_crash_save_vmcoreinfo(void)
@@ -87,10 +83,13 @@ void arch_crash_save_vmcoreinfo(void)
  */
 void machine_kexec(struct kimage *image)
 {
-        if (ppc_md.machine_kexec)
-                ppc_md.machine_kexec(image);
-        else
-                default_machine_kexec(image);
+        int save_ftrace_enabled;
+
+        save_ftrace_enabled = __ftrace_enabled_save();
+
+        default_machine_kexec(image);
+
+        __ftrace_enabled_restore(save_ftrace_enabled);
 
         /* Fall back to normal restart if we're still alive. */
         machine_restart(NULL);
diff --git a/arch/powerpc/kernel/perf_event_fsl_emb.c b/arch/powerpc/kernel/perf_event_fsl_emb.c
index 4dcf5f831e9..b0dc8f7069c 100644
--- a/arch/powerpc/kernel/perf_event_fsl_emb.c
+++ b/arch/powerpc/kernel/perf_event_fsl_emb.c
@@ -596,6 +596,7 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
                         if (left <= 0)
                                 left = period;
                         record = 1;
+                        event->hw.last_period = event->hw.sample_period;
                 }
                 if (left < 0x80000000LL)
                         val = 0x80000000LL - left;
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 84906d3fc86..7a1d5cb7693 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -631,7 +631,7 @@ void show_regs(struct pt_regs * regs)
 #ifdef CONFIG_PPC_ADV_DEBUG_REGS
                 printk("DEAR: "REG", ESR: "REG"\n", regs->dar, regs->dsisr);
 #else
-                printk("DAR: "REG", DSISR: "REG"\n", regs->dar, regs->dsisr);
+                printk("DAR: "REG", DSISR: %08lx\n", regs->dar, regs->dsisr);
 #endif
         printk("TASK = %p[%d] '%s' THREAD: %p",
                current, task_pid_nr(current), current->comm, task_thread_info(current));
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 2b442e6c21e..bf5f5ce3a7b 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -256,31 +256,16 @@ static ssize_t rtas_flash_read(struct file *file, char __user *buf,
         struct proc_dir_entry *dp = PDE(file->f_path.dentry->d_inode);
         struct rtas_update_flash_t *uf;
         char msg[RTAS_MSG_MAXLEN];
-        int msglen;
 
-        uf = (struct rtas_update_flash_t *) dp->data;
+        uf = dp->data;
 
         if (!strcmp(dp->name, FIRMWARE_FLASH_NAME)) {
                 get_flash_status_msg(uf->status, msg);
         } else {           /* FIRMWARE_UPDATE_NAME */
                 sprintf(msg, "%d\n", uf->status);
         }
-        msglen = strlen(msg);
-        if (msglen > count)
-                msglen = count;
-
-        if (ppos && *ppos != 0)
-                return 0;       /* be cheap */
-
-        if (!access_ok(VERIFY_WRITE, buf, msglen))
-                return -EINVAL;
 
-        if (copy_to_user(buf, msg, msglen))
-                return -EFAULT;
-
-        if (ppos)
-                *ppos = msglen;
-        return msglen;
+        return simple_read_from_buffer(buf, count, ppos, msg, strlen(msg));
 }
 
 /* constructor for flash_block_cache */
@@ -394,26 +379,13 @@ static ssize_t manage_flash_read(struct file *file, char __user *buf,
         char msg[RTAS_MSG_MAXLEN];
         int msglen;
 
-        args_buf = (struct rtas_manage_flash_t *) dp->data;
+        args_buf = dp->data;
         if (args_buf == NULL)
                 return 0;
 
         msglen = sprintf(msg, "%d\n", args_buf->status);
-        if (msglen > count)
-                msglen = count;
 
-        if (ppos && *ppos != 0)
-                return 0;       /* be cheap */
-
-        if (!access_ok(VERIFY_WRITE, buf, msglen))
-                return -EINVAL;
-
-        if (copy_to_user(buf, msg, msglen))
-                return -EFAULT;
-
-        if (ppos)
-                *ppos = msglen;
-        return msglen;
+        return simple_read_from_buffer(buf, count, ppos, msg, msglen);
 }
 
 static ssize_t manage_flash_write(struct file *file, const char __user *buf,
@@ -495,24 +467,11 @@ static ssize_t validate_flash_read(struct file *file, char __user *buf,
         char msg[RTAS_MSG_MAXLEN];
         int msglen;
 
-        args_buf = (struct rtas_validate_flash_t *) dp->data;
+        args_buf = dp->data;
 
-        if (ppos && *ppos != 0)
-                return 0;       /* be cheap */
-        
         msglen = get_validate_flash_msg(args_buf, msg);
-        if (msglen > count)
-                msglen = count;
-
-        if (!access_ok(VERIFY_WRITE, buf, msglen))
-                return -EINVAL;
-
-        if (copy_to_user(buf, msg, msglen))
-                return -EFAULT;
 
-        if (ppos)
-                *ppos = msglen;
-        return msglen;
+        return simple_read_from_buffer(buf, count, ppos, msg, msglen);
 }
 
 static ssize_t validate_flash_write(struct file *file, const char __user *buf,
diff --git a/arch/powerpc/kernel/rtasd.c b/arch/powerpc/kernel/rtasd.c
index 0438f819fe6..049dbecb5db 100644
--- a/arch/powerpc/kernel/rtasd.c
+++ b/arch/powerpc/kernel/rtasd.c
@@ -160,7 +160,7 @@ static int log_rtas_len(char * buf)
         /* rtas fixed header */
         len = 8;
         err = (struct rtas_error_log *)buf;
-        if (err->extended_log_length) {
+        if (err->extended && err->extended_log_length) {
 
                 /* extended header */
                 len += err->extended_log_length;
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 09e4dea4a85..09d31dbf43f 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -265,11 +265,26 @@ void accumulate_stolen_time(void)
 {
         u64 sst, ust;
 
-        sst = scan_dispatch_log(get_paca()->starttime_user);
-        ust = scan_dispatch_log(get_paca()->starttime);
-        get_paca()->system_time -= sst;
-        get_paca()->user_time -= ust;
-        get_paca()->stolen_time += ust + sst;
+        u8 save_soft_enabled = local_paca->soft_enabled;
+        u8 save_hard_enabled = local_paca->hard_enabled;
+
+        /* We are called early in the exception entry, before
+         * soft/hard_enabled are sync'ed to the expected state
+         * for the exception. We are hard disabled but the PACA
+         * needs to reflect that so various debug stuff doesn't
+         * complain
+         */
+        local_paca->soft_enabled = 0;
+        local_paca->hard_enabled = 0;
+
+        sst = scan_dispatch_log(local_paca->starttime_user);
+        ust = scan_dispatch_log(local_paca->starttime);
+        local_paca->system_time -= sst;
+        local_paca->user_time -= ust;
+        local_paca->stolen_time += ust + sst;
+
+        local_paca->soft_enabled = save_soft_enabled;
+        local_paca->hard_enabled = save_hard_enabled;
 }
 
 static inline u64 calculate_stolen_time(u64 stop_tb)
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 1b2cdc8eec9..bd74fac169b 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -626,12 +626,6 @@ void machine_check_exception(struct pt_regs *regs)
         if (recover > 0)
                 return;
 
-        if (user_mode(regs)) {
-                regs->msr |= MSR_RI;
-                _exception(SIGBUS, regs, BUS_ADRERR, regs->nip);
-                return;
-        }
-
 #if defined(CONFIG_8xx) && defined(CONFIG_PCI)
         /* the qspan pci read routines can cause machine checks -- Cort
          *
@@ -643,16 +637,12 @@ void machine_check_exception(struct pt_regs *regs)
         return;
 #endif
 
-        if (debugger_fault_handler(regs)) {
-                regs->msr |= MSR_RI;
+        if (debugger_fault_handler(regs))
                 return;
-        }
 
         if (check_io_access(regs))
                 return;
 
-        if (debugger_fault_handler(regs))
-                return;
         die("Machine check", regs, SIGBUS);
 
         /* Must die if the interrupt is not recoverable */
diff --git a/arch/powerpc/lib/feature-fixups-test.S b/arch/powerpc/lib/feature-fixups-test.S
index cb737484c5a..f4613118132 100644
--- a/arch/powerpc/lib/feature-fixups-test.S
+++ b/arch/powerpc/lib/feature-fixups-test.S
@@ -172,6 +172,25 @@ globl(ftr_fixup_test6_expected)
 3:      or      3,3,3
 
 
+#if 0
+/* Test that if we have a larger else case the assembler spots it and
+ * reports an error. #if 0'ed so as not to break the build normally.
+ */
+ftr_fixup_test7:
+        or      1,1,1
+BEGIN_FTR_SECTION
+        or      2,2,2
+        or      2,2,2
+        or      2,2,2
+FTR_SECTION_ELSE
+        or      3,3,3
+        or      3,3,3
+        or      3,3,3
+        or      3,3,3
+ALT_FTR_SECTION_END(0, 1)
+        or      1,1,1
+#endif
+
 #define MAKE_MACRO_TEST(TYPE)                                           \
 globl(ftr_fixup_test_ ##TYPE##_macros)                                  \
         or      1,1,1;                                                  \
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index bf5cb91f07d..fd481232957 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -186,7 +186,7 @@ static void unmap_cpu_from_node(unsigned long cpu)
         dbg("removing cpu %lu from node %d\n", cpu, node);
 
         if (cpumask_test_cpu(cpu, node_to_cpumask_map[node])) {
-                cpumask_set_cpu(cpu, node_to_cpumask_map[node]);
+                cpumask_clear_cpu(cpu, node_to_cpumask_map[node]);
         } else {
                 printk(KERN_ERR "WARNING: cpu %lu not found in node %d\n",
                        cpu, node);
@@ -1289,10 +1289,9 @@ u64 memory_hotplug_max(void)
 }
 #endif /* CONFIG_MEMORY_HOTPLUG */
 
-/* Vrtual Processor Home Node (VPHN) support */
+/* Virtual Processor Home Node (VPHN) support */
 #ifdef CONFIG_PPC_SPLPAR
-#define VPHN_NR_CHANGE_CTRS (8)
-static u8 vphn_cpu_change_counts[NR_CPUS][VPHN_NR_CHANGE_CTRS];
+static u8 vphn_cpu_change_counts[NR_CPUS][MAX_DISTANCE_REF_POINTS];
 static cpumask_t cpu_associativity_changes_mask;
 static int vphn_enabled;
 static void set_topology_timer(void);
@@ -1303,16 +1302,18 @@ static void set_topology_timer(void);
  */
 static void setup_cpu_associativity_change_counters(void)
 {
-        int cpu = 0;
+        int cpu;
+
+        /* The VPHN feature supports a maximum of 8 reference points */
+        BUILD_BUG_ON(MAX_DISTANCE_REF_POINTS > 8);
 
         for_each_possible_cpu(cpu) {
-                int i = 0;
+                int i;
                 u8 *counts = vphn_cpu_change_counts[cpu];
                 volatile u8 *hypervisor_counts = lppaca[cpu].vphn_assoc_counts;
 
-                for (i = 0; i < VPHN_NR_CHANGE_CTRS; i++) {
+                for (i = 0; i < distance_ref_points_depth; i++)
                         counts[i] = hypervisor_counts[i];
-                }
         }
 }
 
@@ -1329,7 +1330,7 @@ static void setup_cpu_associativity_change_counters(void)
  */
 static int update_cpu_associativity_changes_mask(void)
 {
-        int cpu = 0, nr_cpus = 0;
+        int cpu, nr_cpus = 0;
         cpumask_t *changes = &cpu_associativity_changes_mask;
 
         cpumask_clear(changes);
@@ -1339,8 +1340,8 @@ static int update_cpu_associativity_changes_mask(void)
                 u8 *counts = vphn_cpu_change_counts[cpu];
                 volatile u8 *hypervisor_counts = lppaca[cpu].vphn_assoc_counts;
 
-                for (i = 0; i < VPHN_NR_CHANGE_CTRS; i++) {
-                        if (hypervisor_counts[i] > counts[i]) {
+                for (i = 0; i < distance_ref_points_depth; i++) {
+                        if (hypervisor_counts[i] != counts[i]) {
                                 counts[i] = hypervisor_counts[i];
                                 changed = 1;
                         }
@@ -1354,8 +1355,11 @@ static int update_cpu_associativity_changes_mask(void)
         return nr_cpus;
 }
 
-/* 6 64-bit registers unpacked into 12 32-bit associativity values */
-#define VPHN_ASSOC_BUFSIZE (6*sizeof(u64)/sizeof(u32))
+/*
+ * 6 64-bit registers unpacked into 12 32-bit associativity values. To form
+ * the complete property we have to add the length in the first cell.
+ */
+#define VPHN_ASSOC_BUFSIZE (6*sizeof(u64)/sizeof(u32) + 1)
 
 /*
  * Convert the associativity domain numbers returned from the hypervisor
@@ -1363,15 +1367,14 @@ static int update_cpu_associativity_changes_mask(void)
  */
 static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
 {
-        int i = 0;
-        int nr_assoc_doms = 0;
+        int i, nr_assoc_doms = 0;
         const u16 *field = (const u16*) packed;
 
 #define VPHN_FIELD_UNUSED       (0xffff)
 #define VPHN_FIELD_MSB          (0x8000)
 #define VPHN_FIELD_MASK         (~VPHN_FIELD_MSB)
 
-        for (i = 0; i < VPHN_ASSOC_BUFSIZE; i++) {
+        for (i = 1; i < VPHN_ASSOC_BUFSIZE; i++) {
                 if (*field == VPHN_FIELD_UNUSED) {
                         /* All significant fields processed, and remaining
                          * fields contain the reserved value of all 1's.
@@ -1379,14 +1382,12 @@ static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
                          */
                         unpacked[i] = *((u32*)field);
                         field += 2;
-                }
-                else if (*field & VPHN_FIELD_MSB) {
+                } else if (*field & VPHN_FIELD_MSB) {
                         /* Data is in the lower 15 bits of this field */
                         unpacked[i] = *field & VPHN_FIELD_MASK;
                         field++;
                         nr_assoc_doms++;
-                }
-                else {
+                } else {
                         /* Data is in the lower 15 bits of this field
                          * concatenated with the next 16 bit field
                          */
@@ -1396,6 +1397,9 @@ static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
                 }
         }
 
+        /* The first cell contains the length of the property */
+        unpacked[0] = nr_assoc_doms;
+
         return nr_assoc_doms;
 }
 
@@ -1405,7 +1409,7 @@ static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
  */
 static long hcall_vphn(unsigned long cpu, unsigned int *associativity)
 {
-        long rc = 0;
+        long rc;
         long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
         u64 flags = 1;
         int hwcpu = get_hard_smp_processor_id(cpu);
@@ -1419,7 +1423,7 @@ static long hcall_vphn(unsigned long cpu, unsigned int *associativity)
 static long vphn_get_associativity(unsigned long cpu,
                                         unsigned int *associativity)
 {
-        long rc = 0;
+        long rc;
 
         rc = hcall_vphn(cpu, associativity);
 
@@ -1445,9 +1449,9 @@ static long vphn_get_associativity(unsigned long cpu,
  */
 int arch_update_cpu_topology(void)
 {
-        int cpu = 0, nid = 0, old_nid = 0;
+        int cpu, nid, old_nid;
         unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
-        struct sys_device *sysdev = NULL;
+        struct sys_device *sysdev;
 
         for_each_cpu_mask(cpu, cpu_associativity_changes_mask) {
                 vphn_get_associativity(cpu, associativity);
@@ -1512,7 +1516,8 @@ int start_topology_update(void)
 {
         int rc = 0;
 
-        if (firmware_has_feature(FW_FEATURE_VPHN)) {
+        if (firmware_has_feature(FW_FEATURE_VPHN) &&
+            get_lppaca()->shared_proc) {
                 vphn_enabled = 1;
                 setup_cpu_associativity_change_counters();
                 init_timer_deferrable(&topology_timer);
diff --git a/arch/powerpc/platforms/83xx/mpc830x_rdb.c b/arch/powerpc/platforms/83xx/mpc830x_rdb.c
index 661d354e4ff..d0c4e15b779 100644
--- a/arch/powerpc/platforms/83xx/mpc830x_rdb.c
+++ b/arch/powerpc/platforms/83xx/mpc830x_rdb.c
@@ -57,12 +57,12 @@ static void __init mpc830x_rdb_init_IRQ(void)
         ipic_set_default_priority();
 }
 
-struct const char *board[] __initdata = {
+static const char *board[] __initdata = {
         "MPC8308RDB",
         "fsl,mpc8308rdb",
         "denx,mpc8308_p1m",
         NULL
-}
+};
 
 /*
  * Called very early, MMU is off, device-tree isn't unflattened
diff --git a/arch/powerpc/platforms/83xx/mpc831x_rdb.c b/arch/powerpc/platforms/83xx/mpc831x_rdb.c
index b54cd736a89..f859ead49a8 100644
--- a/arch/powerpc/platforms/83xx/mpc831x_rdb.c
+++ b/arch/powerpc/platforms/83xx/mpc831x_rdb.c
@@ -60,11 +60,11 @@ static void __init mpc831x_rdb_init_IRQ(void)
         ipic_set_default_priority();
 }
 
-struct const char *board[] __initdata = {
+static const char *board[] __initdata = {
         "MPC8313ERDB",
         "fsl,mpc8315erdb",
         NULL
-}
+};
 
 /*
  * Called very early, MMU is off, device-tree isn't unflattened
diff --git a/arch/powerpc/platforms/83xx/mpc83xx.h b/arch/powerpc/platforms/83xx/mpc83xx.h
index 0fea8811d45..82a434510d8 100644
--- a/arch/powerpc/platforms/83xx/mpc83xx.h
+++ b/arch/powerpc/platforms/83xx/mpc83xx.h
@@ -35,6 +35,8 @@
 
 /* system i/o configuration register high */
 #define MPC83XX_SICRH_OFFS         0x118
+#define MPC8308_SICRH_USB_MASK     0x000c0000
+#define MPC8308_SICRH_USB_ULPI     0x00040000
 #define MPC834X_SICRH_USB_UTMI     0x00020000
 #define MPC831X_SICRH_USB_MASK     0x000000e0
 #define MPC831X_SICRH_USB_ULPI     0x000000a0
diff --git a/arch/powerpc/platforms/83xx/usb.c b/arch/powerpc/platforms/83xx/usb.c
index 3ba4bb7d41b..2c64164722d 100644
--- a/arch/powerpc/platforms/83xx/usb.c
+++ b/arch/powerpc/platforms/83xx/usb.c
@@ -127,7 +127,8 @@ int mpc831x_usb_cfg(void)
 
         /* Configure clock */
         immr_node = of_get_parent(np);
-        if (immr_node && of_device_is_compatible(immr_node, "fsl,mpc8315-immr"))
+        if (immr_node && (of_device_is_compatible(immr_node, "fsl,mpc8315-immr") ||
+                        of_device_is_compatible(immr_node, "fsl,mpc8308-immr")))
                 clrsetbits_be32(immap + MPC83XX_SCCR_OFFS,
                                 MPC8315_SCCR_USB_MASK,
                                 MPC8315_SCCR_USB_DRCM_01);
@@ -138,7 +139,11 @@ int mpc831x_usb_cfg(void)
 
         /* Configure pin mux for ULPI.  There is no pin mux for UTMI */
         if (prop && !strcmp(prop, "ulpi")) {
-                if (of_device_is_compatible(immr_node, "fsl,mpc8315-immr")) {
+                if (of_device_is_compatible(immr_node, "fsl,mpc8308-immr")) {
+                        clrsetbits_be32(immap + MPC83XX_SICRH_OFFS,
+                                        MPC8308_SICRH_USB_MASK,
+                                        MPC8308_SICRH_USB_ULPI);
+                } else if (of_device_is_compatible(immr_node, "fsl,mpc8315-immr")) {
                         clrsetbits_be32(immap + MPC83XX_SICRL_OFFS,
                                         MPC8315_SICRL_USB_MASK,
                                         MPC8315_SICRL_USB_ULPI);
@@ -173,6 +178,9 @@ int mpc831x_usb_cfg(void)
                      !strcmp(prop, "utmi"))) {
                 u32 refsel;
 
+                if (of_device_is_compatible(immr_node, "fsl,mpc8308-immr"))
+                        goto out;
+
                 if (of_device_is_compatible(immr_node, "fsl,mpc8315-immr"))
                         refsel = CONTROL_REFSEL_24MHZ;
                 else
@@ -186,9 +194,11 @@ int mpc831x_usb_cfg(void)
                 temp = CONTROL_PHY_CLK_SEL_ULPI;
 #ifdef CONFIG_USB_OTG
                 /* Set OTG_PORT */
-                dr_mode = of_get_property(np, "dr_mode", NULL);
-                if (dr_mode && !strcmp(dr_mode, "otg"))
-                        temp |= CONTROL_OTG_PORT;
+                if (!of_device_is_compatible(immr_node, "fsl,mpc8308-immr")) {
+                        dr_mode = of_get_property(np, "dr_mode", NULL);
+                        if (dr_mode && !strcmp(dr_mode, "otg"))
+                                temp |= CONTROL_OTG_PORT;
+                }
 #endif /* CONFIG_USB_OTG */
                 out_be32(usb_regs + FSL_USB2_CONTROL_OFFS, temp);
         } else {
@@ -196,6 +206,7 @@ int mpc831x_usb_cfg(void)
                 ret = -EINVAL;
         }
 
+out:
         iounmap(usb_regs);
         of_node_put(np);
         return ret;
diff --git a/arch/powerpc/platforms/cell/cpufreq_spudemand.c b/arch/powerpc/platforms/cell/cpufreq_spudemand.c
index 968c1c0b4d5..d809836bcf5 100644
--- a/arch/powerpc/platforms/cell/cpufreq_spudemand.c
+++ b/arch/powerpc/platforms/cell/cpufreq_spudemand.c
@@ -39,8 +39,6 @@ struct spu_gov_info_struct {
 };
 static DEFINE_PER_CPU(struct spu_gov_info_struct, spu_gov_info);
 
-static struct workqueue_struct *kspugov_wq;
-
 static int calc_freq(struct spu_gov_info_struct *info)
 {
         int cpu;
@@ -71,14 +69,14 @@ static void spu_gov_work(struct work_struct *work)
         __cpufreq_driver_target(info->policy, target_freq, CPUFREQ_RELATION_H);
 
         delay = usecs_to_jiffies(info->poll_int);
-        queue_delayed_work_on(info->policy->cpu, kspugov_wq, &info->work, delay);
+        schedule_delayed_work_on(info->policy->cpu, &info->work, delay);
 }
 
 static void spu_gov_init_work(struct spu_gov_info_struct *info)
 {
         int delay = usecs_to_jiffies(info->poll_int);
         INIT_DELAYED_WORK_DEFERRABLE(&info->work, spu_gov_work);
-        queue_delayed_work_on(info->policy->cpu, kspugov_wq, &info->work, delay);
+        schedule_delayed_work_on(info->policy->cpu, &info->work, delay);
 }
 
 static void spu_gov_cancel_work(struct spu_gov_info_struct *info)
@@ -152,27 +150,15 @@ static int __init spu_gov_init(void)
 {
         int ret;
 
-        kspugov_wq = create_workqueue("kspugov");
-        if (!kspugov_wq) {
-                printk(KERN_ERR "creation of kspugov failed\n");
-                ret = -EFAULT;
-                goto out;
-        }
-
         ret = cpufreq_register_governor(&spu_governor);
-        if (ret) {
+        if (ret)
                 printk(KERN_ERR "registration of governor failed\n");
-                destroy_workqueue(kspugov_wq);
-                goto out;
-        }
-out:
         return ret;
 }
 
 static void __exit spu_gov_exit(void)
 {
         cpufreq_unregister_governor(&spu_governor);
-        destroy_workqueue(kspugov_wq);
 }
 
 
diff --git a/arch/powerpc/platforms/cell/qpace_setup.c b/arch/powerpc/platforms/cell/qpace_setup.c
index 1b574904275..d31c594cfdf 100644
--- a/arch/powerpc/platforms/cell/qpace_setup.c
+++ b/arch/powerpc/platforms/cell/qpace_setup.c
@@ -145,9 +145,4 @@ define_machine(qpace) {
         .calibrate_decr         = generic_calibrate_decr,
         .progress               = qpace_progress,
         .init_IRQ               = iic_init_IRQ,
-#ifdef CONFIG_KEXEC
-        .machine_kexec          = default_machine_kexec,
-        .machine_kexec_prepare  = default_machine_kexec_prepare,
-        .machine_crash_shutdown = default_machine_crash_shutdown,
-#endif
 };
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index 8547e86bfb4..acfaccea5f4 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -37,6 +37,7 @@
 #include <asm/spu_csa.h>
 #include <asm/xmon.h>
 #include <asm/prom.h>
+#include <asm/kexec.h>
 
 const struct spu_management_ops *spu_management_ops;
 EXPORT_SYMBOL_GPL(spu_management_ops);
@@ -727,6 +728,75 @@ static ssize_t spu_stat_show(struct sys_device *sysdev,
 
 static SYSDEV_ATTR(stat, 0644, spu_stat_show, NULL);
 
+#ifdef CONFIG_KEXEC
+
+struct crash_spu_info {
+        struct spu *spu;
+        u32 saved_spu_runcntl_RW;
+        u32 saved_spu_status_R;
+        u32 saved_spu_npc_RW;
+        u64 saved_mfc_sr1_RW;
+        u64 saved_mfc_dar;
+        u64 saved_mfc_dsisr;
+};
+
+#define CRASH_NUM_SPUS  16      /* Enough for current hardware */
+static struct crash_spu_info crash_spu_info[CRASH_NUM_SPUS];
+
+static void crash_kexec_stop_spus(void)
+{
+        struct spu *spu;
+        int i;
+        u64 tmp;
+
+        for (i = 0; i < CRASH_NUM_SPUS; i++) {
+                if (!crash_spu_info[i].spu)
+                        continue;
+
+                spu = crash_spu_info[i].spu;
+
+                crash_spu_info[i].saved_spu_runcntl_RW =
+                        in_be32(&spu->problem->spu_runcntl_RW);
+                crash_spu_info[i].saved_spu_status_R =
+                        in_be32(&spu->problem->spu_status_R);
+                crash_spu_info[i].saved_spu_npc_RW =
+                        in_be32(&spu->problem->spu_npc_RW);
+
+                crash_spu_info[i].saved_mfc_dar    = spu_mfc_dar_get(spu);
+                crash_spu_info[i].saved_mfc_dsisr  = spu_mfc_dsisr_get(spu);
+                tmp = spu_mfc_sr1_get(spu);
+                crash_spu_info[i].saved_mfc_sr1_RW = tmp;
+
+                tmp &= ~MFC_STATE1_MASTER_RUN_CONTROL_MASK;
+                spu_mfc_sr1_set(spu, tmp);
+
+                __delay(200);
+        }
+}
+
+static void crash_register_spus(struct list_head *list)
+{
+        struct spu *spu;
+        int ret;
+
+        list_for_each_entry(spu, list, full_list) {
+                if (WARN_ON(spu->number >= CRASH_NUM_SPUS))
+                        continue;
+
+                crash_spu_info[spu->number].spu = spu;
+        }
+
+        ret = crash_shutdown_register(&crash_kexec_stop_spus);
+        if (ret)
+                printk(KERN_ERR "Could not register SPU crash handler");
+}
+
+#else
+static inline void crash_register_spus(struct list_head *list)
+{
+}
+#endif
+
 static int __init init_spu_base(void)
 {
         int i, ret = 0;
diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
index 02f7b113a31..3c7c3f82d84 100644
--- a/arch/powerpc/platforms/cell/spufs/file.c
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -219,24 +219,17 @@ spufs_mem_write(struct file *file, const char __user *buffer,
         loff_t pos = *ppos;
         int ret;
 
-        if (pos < 0)
-                return -EINVAL;
         if (pos > LS_SIZE)
                 return -EFBIG;
-        if (size > LS_SIZE - pos)
-                size = LS_SIZE - pos;
 
         ret = spu_acquire(ctx);
         if (ret)
                 return ret;
 
         local_store = ctx->ops->get_ls(ctx);
-        ret = copy_from_user(local_store + pos, buffer, size);
+        size = simple_write_to_buffer(local_store, LS_SIZE, ppos, buffer, size);
         spu_release(ctx);
 
-        if (ret)
-                return -EFAULT;
-        *ppos = pos + size;
         return size;
 }
 
@@ -574,18 +567,15 @@ spufs_regs_write(struct file *file, const char __user *buffer,
         if (*pos >= sizeof(lscsa->gprs))
                 return -EFBIG;
 
-        size = min_t(ssize_t, sizeof(lscsa->gprs) - *pos, size);
-        *pos += size;
-
         ret = spu_acquire_saved(ctx);
         if (ret)
                 return ret;
 
-        ret = copy_from_user((char *)lscsa->gprs + *pos - size,
-                             buffer, size) ? -EFAULT : size;
+        size = simple_write_to_buffer(lscsa->gprs, sizeof(lscsa->gprs), pos,
+                                        buffer, size);
 
         spu_release_saved(ctx);
-        return ret;
+        return size;
 }
 
 static const struct file_operations spufs_regs_fops = {
@@ -630,18 +620,15 @@ spufs_fpcr_write(struct file *file, const char __user * buffer,
         if (*pos >= sizeof(lscsa->fpcr))
                 return -EFBIG;
 
-        size = min_t(ssize_t, sizeof(lscsa->fpcr) - *pos, size);
-
         ret = spu_acquire_saved(ctx);
         if (ret)
                 return ret;
 
-        *pos += size;
-        ret = copy_from_user((char *)&lscsa->fpcr + *pos - size,
-                             buffer, size) ? -EFAULT : size;
+        size = simple_write_to_buffer(&lscsa->fpcr, sizeof(lscsa->fpcr), pos,
+                                        buffer, size);
 
         spu_release_saved(ctx);
-        return ret;
+        return size;
 }
 
 static const struct file_operations spufs_fpcr_fops = {
diff --git a/arch/powerpc/platforms/embedded6xx/gamecube.c b/arch/powerpc/platforms/embedded6xx/gamecube.c
index 1106fd99627..a138e14bad2 100644
--- a/arch/powerpc/platforms/embedded6xx/gamecube.c
+++ b/arch/powerpc/platforms/embedded6xx/gamecube.c
@@ -75,14 +75,6 @@ static void gamecube_shutdown(void)
         flipper_quiesce();
 }
 
-#ifdef CONFIG_KEXEC
-static int gamecube_kexec_prepare(struct kimage *image)
-{
-        return 0;
-}
-#endif /* CONFIG_KEXEC */
-
-
 define_machine(gamecube) {
         .name                   = "gamecube",
         .probe                  = gamecube_probe,
@@ -95,9 +87,6 @@ define_machine(gamecube) {
         .calibrate_decr         = generic_calibrate_decr,
         .progress               = udbg_progress,
         .machine_shutdown       = gamecube_shutdown,
-#ifdef CONFIG_KEXEC
-        .machine_kexec_prepare  = gamecube_kexec_prepare,
-#endif
 };
 
 
diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
index 649473a729b..1b5dc1a2e14 100644
--- a/arch/powerpc/platforms/embedded6xx/wii.c
+++ b/arch/powerpc/platforms/embedded6xx/wii.c
@@ -18,7 +18,6 @@
 #include <linux/init.h>
 #include <linux/irq.h>
 #include <linux/seq_file.h>
-#include <linux/kexec.h>
 #include <linux/of_platform.h>
 #include <linux/memblock.h>
 #include <mm/mmu_decl.h>
@@ -226,13 +225,6 @@ static void wii_shutdown(void)
         flipper_quiesce();
 }
 
-#ifdef CONFIG_KEXEC
-static int wii_machine_kexec_prepare(struct kimage *image)
-{
-        return 0;
-}
-#endif /* CONFIG_KEXEC */
-
 define_machine(wii) {
         .name                   = "wii",
         .probe                  = wii_probe,
@@ -246,9 +238,6 @@ define_machine(wii) {
         .calibrate_decr         = generic_calibrate_decr,
         .progress               = udbg_progress,
         .machine_shutdown       = wii_shutdown,
-#ifdef CONFIG_KEXEC
-        .machine_kexec_prepare  = wii_machine_kexec_prepare,
-#endif
 };
 
 static struct of_device_id wii_of_bus[] = {
diff --git a/arch/powerpc/platforms/iseries/Kconfig b/arch/powerpc/platforms/iseries/Kconfig
index 47a20cfb448..e5bc9f75d47 100644
--- a/arch/powerpc/platforms/iseries/Kconfig
+++ b/arch/powerpc/platforms/iseries/Kconfig
@@ -2,7 +2,7 @@ config PPC_ISERIES
         bool "IBM Legacy iSeries"
         depends on PPC64 && PPC_BOOK3S
         select PPC_INDIRECT_IO
-        select PPC_PCI_CHOICE if EMBEDDED
+        select PPC_PCI_CHOICE if EXPERT
 
 menu "iSeries device drivers"
         depends on PPC_ISERIES
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index 5d1b743dbe7..5b3da4b4ea7 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -10,7 +10,7 @@ config PPC_PSERIES
         select RTAS_ERROR_LOGGING
         select PPC_UDBG_16550
         select PPC_NATIVE
-        select PPC_PCI_CHOICE if EMBEDDED
+        select PPC_PCI_CHOICE if EXPERT
         default y
 
 config PPC_SPLPAR
@@ -24,9 +24,9 @@ config PPC_SPLPAR
           two or more partitions.
 
 config EEH
-        bool "PCI Extended Error Handling (EEH)" if EMBEDDED
+        bool "PCI Extended Error Handling (EEH)" if EXPERT
         depends on PPC_PSERIES && PCI
-        default y if !EMBEDDED
+        default y if !EXPERT
 
 config PSERIES_MSI
        bool
diff --git a/arch/powerpc/platforms/pseries/kexec.c b/arch/powerpc/platforms/pseries/kexec.c
index 53cbd53d874..77d38a5e2ff 100644
--- a/arch/powerpc/platforms/pseries/kexec.c
+++ b/arch/powerpc/platforms/pseries/kexec.c
@@ -61,13 +61,3 @@ void __init setup_kexec_cpu_down_xics(void)
 {
         ppc_md.kexec_cpu_down = pseries_kexec_cpu_down_xics;
 }
-
-static int __init pseries_kexec_setup(void)
-{
-        ppc_md.machine_kexec = default_machine_kexec;
-        ppc_md.machine_kexec_prepare = default_machine_kexec_prepare;
-        ppc_md.machine_crash_shutdown = default_machine_crash_shutdown;
-
-        return 0;
-}
-machine_device_initcall(pseries, pseries_kexec_setup);
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 5d3ea9f60dd..ca5d5898d32 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -713,6 +713,13 @@ EXPORT_SYMBOL(arch_free_page);
 /* NB: reg/unreg are called while guarded with the tracepoints_mutex */
 extern long hcall_tracepoint_refcount;
 
+/* 
+ * Since the tracing code might execute hcalls we need to guard against
+ * recursion. One example of this are spinlocks calling H_YIELD on
+ * shared processor partitions.
+ */
+static DEFINE_PER_CPU(unsigned int, hcall_trace_depth);
+
 void hcall_tracepoint_regfunc(void)
 {
         hcall_tracepoint_refcount++;
@@ -725,12 +732,42 @@ void hcall_tracepoint_unregfunc(void)
 
 void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
 {
+        unsigned long flags;
+        unsigned int *depth;
+
+        local_irq_save(flags);
+
+        depth = &__get_cpu_var(hcall_trace_depth);
+
+        if (*depth)
+                goto out;
+
+        (*depth)++;
         trace_hcall_entry(opcode, args);
+        (*depth)--;
+
+out:
+        local_irq_restore(flags);
 }
 
 void __trace_hcall_exit(long opcode, unsigned long retval,
                         unsigned long *retbuf)
 {
+        unsigned long flags;
+        unsigned int *depth;
+
+        local_irq_save(flags);
+
+        depth = &__get_cpu_var(hcall_trace_depth);
+
+        if (*depth)
+                goto out;
+
+        (*depth)++;
         trace_hcall_exit(opcode, retval, retbuf);
+        (*depth)--;
+
+out:
+        local_irq_restore(flags);
 }
 #endif
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index a4fc6da87c2..c55d7ad9c64 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -54,7 +54,8 @@
 static unsigned char ras_log_buf[RTAS_ERROR_LOG_MAX];
 static DEFINE_SPINLOCK(ras_log_buf_lock);
 
-static char mce_data_buf[RTAS_ERROR_LOG_MAX];
+static char global_mce_data_buf[RTAS_ERROR_LOG_MAX];
+static DEFINE_PER_CPU(__u64, mce_data_buf);
 
 static int ras_get_sensor_state_token;
 static int ras_check_exception_token;
@@ -196,12 +197,24 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-/* Get the error information for errors coming through the
+/*
+ * Some versions of FWNMI place the buffer inside the 4kB page starting at
+ * 0x7000. Other versions place it inside the rtas buffer. We check both.
+ */
+#define VALID_FWNMI_BUFFER(A) \
+        ((((A) >= 0x7000) && ((A) < 0x7ff0)) || \
+        (((A) >= rtas.base) && ((A) < (rtas.base + rtas.size - 16))))
+
+/*
+ * Get the error information for errors coming through the
  * FWNMI vectors.  The pt_regs' r3 will be updated to reflect
  * the actual r3 if possible, and a ptr to the error log entry
  * will be returned if found.
  *
- * The mce_data_buf does not have any locks or protection around it,
+ * If the RTAS error is not of the extended type, then we put it in a per
+ * cpu 64bit buffer. If it is the extended type we use global_mce_data_buf.
+ *
+ * The global_mce_data_buf does not have any locks or protection around it,
  * if a second machine check comes in, or a system reset is done
  * before we have logged the error, then we will get corruption in the
  * error log.  This is preferable over holding off on calling
@@ -210,20 +223,31 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id)
  */
 static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs)
 {
-        unsigned long errdata = regs->gpr[3];
-        struct rtas_error_log *errhdr = NULL;
         unsigned long *savep;
+        struct rtas_error_log *h, *errhdr = NULL;
+
+        if (!VALID_FWNMI_BUFFER(regs->gpr[3])) {
+                printk(KERN_ERR "FWNMI: corrupt r3\n");
+                return NULL;
+        }
 
-        if ((errdata >= 0x7000 && errdata < 0x7fff0) ||
-            (errdata >= rtas.base && errdata < rtas.base + rtas.size - 16)) {
-                savep = __va(errdata);
-                regs->gpr[3] = savep[0];        /* restore original r3 */
-                memset(mce_data_buf, 0, RTAS_ERROR_LOG_MAX);
-                memcpy(mce_data_buf, (char *)(savep + 1), RTAS_ERROR_LOG_MAX);
-                errhdr = (struct rtas_error_log *)mce_data_buf;
+        savep = __va(regs->gpr[3]);
+        regs->gpr[3] = savep[0];        /* restore original r3 */
+
+        /* If it isn't an extended log we can use the per cpu 64bit buffer */
+        h = (struct rtas_error_log *)&savep[1];
+        if (!h->extended) {
+                memcpy(&__get_cpu_var(mce_data_buf), h, sizeof(__u64));
+                errhdr = (struct rtas_error_log *)&__get_cpu_var(mce_data_buf);
         } else {
-                printk("FWNMI: corrupt r3\n");
+                int len;
+
+                len = max_t(int, 8+h->extended_log_length, RTAS_ERROR_LOG_MAX);
+                memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX);
+                memcpy(global_mce_data_buf, h, len);
+                errhdr = (struct rtas_error_log *)global_mce_data_buf;
         }
+
         return errhdr;
 }
 
@@ -235,7 +259,7 @@ static void fwnmi_release_errinfo(void)
 {
         int ret = rtas_call(rtas_token("ibm,nmi-interlock"), 0, 1, NULL);
         if (ret != 0)
-                printk("FWNMI: nmi-interlock failed: %d\n", ret);
+                printk(KERN_ERR "FWNMI: nmi-interlock failed: %d\n", ret);
 }
 
 int pSeries_system_reset_exception(struct pt_regs *regs)
@@ -259,31 +283,43 @@ int pSeries_system_reset_exception(struct pt_regs *regs)
  * Return 1 if corrected (or delivered a signal).
  * Return 0 if there is nothing we can do.
  */
-static int recover_mce(struct pt_regs *regs, struct rtas_error_log * err)
+static int recover_mce(struct pt_regs *regs, struct rtas_error_log *err)
 {
-        int nonfatal = 0;
+        int recovered = 0;
 
-        if (err->disposition == RTAS_DISP_FULLY_RECOVERED) {
+        if (!(regs->msr & MSR_RI)) {
+                /* If MSR_RI isn't set, we cannot recover */
+                recovered = 0;
+
+        } else if (err->disposition == RTAS_DISP_FULLY_RECOVERED) {
                 /* Platform corrected itself */
-                nonfatal = 1;
-        } else if ((regs->msr & MSR_RI) &&
-                   user_mode(regs) &&
-                   err->severity == RTAS_SEVERITY_ERROR_SYNC &&
-                   err->disposition == RTAS_DISP_NOT_RECOVERED &&
-                   err->target == RTAS_TARGET_MEMORY &&
-                   err->type == RTAS_TYPE_ECC_UNCORR &&
-                   !(current->pid == 0 || is_global_init(current))) {
-                /* Kill off a user process with an ECC error */
-                printk(KERN_ERR "MCE: uncorrectable ecc error for pid %d\n",
-                       current->pid);
-                /* XXX something better for ECC error? */
-                _exception(SIGBUS, regs, BUS_ADRERR, regs->nip);
-                nonfatal = 1;
+                recovered = 1;
+
+        } else if (err->disposition == RTAS_DISP_LIMITED_RECOVERY) {
+                /* Platform corrected itself but could be degraded */
+                printk(KERN_ERR "MCE: limited recovery, system may "
+                       "be degraded\n");
+                recovered = 1;
+
+        } else if (user_mode(regs) && !is_global_init(current) &&
+                   err->severity == RTAS_SEVERITY_ERROR_SYNC) {
+
+                /*
+                 * If we received a synchronous error when in userspace
+                 * kill the task. Firmware may report details of the fail
+                 * asynchronously, so we can't rely on the target and type
+                 * fields being valid here.
+                 */
+                printk(KERN_ERR "MCE: uncorrectable error, killing task "
+                       "%s:%d\n", current->comm, current->pid);
+
+                _exception(SIGBUS, regs, BUS_MCEERR_AR, regs->nip);
+                recovered = 1;
         }
 
-        log_error((char *)err, ERR_TYPE_RTAS_LOG, !nonfatal);
+        log_error((char *)err, ERR_TYPE_RTAS_LOG, 0);
 
-        return nonfatal;
+        return recovered;
 }
 
 /*
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 9f99bef2ade..8c6cab01327 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -1555,8 +1555,6 @@ int fsl_rio_setup(struct platform_device *dev)
         saved_mcheck_exception = ppc_md.machine_check_exception;
         ppc_md.machine_check_exception = fsl_rio_mcheck_exception;
 #endif
-        /* Ensure that RFXE is set */
-        mtspr(SPRN_HID1, (mfspr(SPRN_HID1) | 0x20000));
 
         return 0;
 err:
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 7c1342618a3..b0c8469e5dd 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -674,7 +674,8 @@ void mpic_unmask_irq(unsigned int irq)
         /* make sure mask gets to controller before we return to user */
         do {
                 if (!loops--) {
-                        printk(KERN_ERR "mpic_enable_irq timeout\n");
+                        printk(KERN_ERR "%s: timeout on hwirq %u\n",
+                               __func__, src);
                         break;
                 }
         } while(mpic_irq_read(src, MPIC_INFO(IRQ_VECTOR_PRI)) & MPIC_VECPRI_MASK);
@@ -695,7 +696,8 @@ void mpic_mask_irq(unsigned int irq)
         /* make sure mask gets to controller before we return to user */
         do {
                 if (!loops--) {
-                        printk(KERN_ERR "mpic_enable_irq timeout\n");
+                        printk(KERN_ERR "%s: timeout on hwirq %u\n",
+                               __func__, src);
                         break;
                 }
         } while(!(mpic_irq_read(src, MPIC_INFO(IRQ_VECTOR_PRI)) & MPIC_VECPRI_MASK));
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index ff19efdf6fe..636bcb81d06 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -406,7 +406,7 @@ config QDIO
           If unsure, say Y.
 
 config CHSC_SCH
-        def_tristate y
+        def_tristate m
         prompt "Support for CHSC subchannels"
         help
           This driver allows usage of CHSC subchannels. A CHSC subchannel
diff --git a/arch/s390/include/asm/cacheflush.h b/arch/s390/include/asm/cacheflush.h
index 405cc97c624..7e1f7762062 100644
--- a/arch/s390/include/asm/cacheflush.h
+++ b/arch/s390/include/asm/cacheflush.h
@@ -1,29 +1,8 @@
 #ifndef _S390_CACHEFLUSH_H
 #define _S390_CACHEFLUSH_H
 
-/* Keep includes the same across arches.  */
-#include <linux/mm.h>
-
 /* Caches aren't brain-dead on the s390. */
-#define flush_cache_all()                       do { } while (0)
-#define flush_cache_mm(mm)                      do { } while (0)
-#define flush_cache_dup_mm(mm)                  do { } while (0)
-#define flush_cache_range(vma, start, end)      do { } while (0)
-#define flush_cache_page(vma, vmaddr, pfn)      do { } while (0)
-#define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 0
-#define flush_dcache_page(page)                 do { } while (0)
-#define flush_dcache_mmap_lock(mapping)         do { } while (0)
-#define flush_dcache_mmap_unlock(mapping)       do { } while (0)
-#define flush_icache_range(start, end)          do { } while (0)
-#define flush_icache_page(vma,pg)               do { } while (0)
-#define flush_icache_user_range(vma,pg,adr,len) do { } while (0)
-#define flush_cache_vmap(start, end)            do { } while (0)
-#define flush_cache_vunmap(start, end)          do { } while (0)
-
-#define copy_to_user_page(vma, page, vaddr, dst, src, len) \
-        memcpy(dst, src, len)
-#define copy_from_user_page(vma, page, vaddr, dst, src, len) \
-        memcpy(dst, src, len)
+#include <asm-generic/cacheflush.h>
 
 #ifdef CONFIG_DEBUG_PAGEALLOC
 void kernel_map_pages(struct page *page, int numpages, int enable);
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index f1f644f2240..9074a54c4d1 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -22,6 +22,7 @@
  */
 
 #include <linux/mm.h>
+#include <linux/pagemap.h>
 #include <linux/swap.h>
 #include <asm/processor.h>
 #include <asm/pgalloc.h>
diff --git a/arch/s390/lib/uaccess_std.c b/arch/s390/lib/uaccess_std.c
index 07deaeee14c..a6c4f7ed24a 100644
--- a/arch/s390/lib/uaccess_std.c
+++ b/arch/s390/lib/uaccess_std.c
@@ -125,9 +125,9 @@ static size_t copy_in_user_std(size_t size, void __user *to,
         unsigned long tmp1;
 
         asm volatile(
+                "   sacf  256\n"
                 "  "AHI"  %0,-1\n"
                 "   jo    5f\n"
-                "   sacf  256\n"
                 "   bras  %3,3f\n"
                 "0:"AHI"  %0,257\n"
                 "1: mvc   0(1,%1),0(%2)\n"
@@ -142,9 +142,8 @@ static size_t copy_in_user_std(size_t size, void __user *to,
                 "3:"AHI"  %0,-256\n"
                 "   jnm   2b\n"
                 "4: ex    %0,1b-0b(%3)\n"
-                "   sacf  0\n"
                 "5: "SLR"  %0,%0\n"
-                "6:\n"
+                "6: sacf  0\n"
                 EX_TABLE(1b,6b) EX_TABLE(2b,0b) EX_TABLE(4b,0b)
                 : "+a" (size), "+a" (to), "+a" (from), "=a" (tmp1)
                 : : "cc", "memory");
@@ -156,9 +155,9 @@ static size_t clear_user_std(size_t size, void __user *to)
         unsigned long tmp1, tmp2;
 
         asm volatile(
+                "   sacf  256\n"
                 "  "AHI"  %0,-1\n"
                 "   jo    5f\n"
-                "   sacf  256\n"
                 "   bras  %3,3f\n"
                 "   xc    0(1,%1),0(%1)\n"
                 "0:"AHI"  %0,257\n"
@@ -178,9 +177,8 @@ static size_t clear_user_std(size_t size, void __user *to)
                 "3:"AHI"  %0,-256\n"
                 "   jnm   2b\n"
                 "4: ex    %0,0(%3)\n"
-                "   sacf  0\n"
                 "5: "SLR"  %0,%0\n"
-                "6:\n"
+                "6: sacf  0\n"
                 EX_TABLE(1b,6b) EX_TABLE(2b,0b) EX_TABLE(4b,0b)
                 : "+a" (size), "+a" (to), "=a" (tmp1), "=a" (tmp2)
                 : : "cc", "memory");
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 0c719c61972..e1850c28cd6 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -336,7 +336,8 @@ void page_table_free(struct mm_struct *mm, unsigned long *table)
         page->flags ^= bits;
         if (page->flags & FRAG_MASK) {
                 /* Page now has some free pgtable fragments. */
-                list_move(&page->lru, &mm->context.pgtable_list);
+                if (!list_empty(&page->lru))
+                        list_move(&page->lru, &mm->context.pgtable_list);
                 page = NULL;
         } else
                 /* All fragments of the 4K page have been freed. */
diff --git a/arch/score/Kconfig b/arch/score/Kconfig
index 4293fdcb539..27b2295f41f 100644
--- a/arch/score/Kconfig
+++ b/arch/score/Kconfig
@@ -1,5 +1,9 @@
 menu "Machine selection"
 
+config SCORE
+       def_bool y
+       select HAVE_GENERIC_HARDIRQS
+
 choice
         prompt "System type"
         default MACH_SPCT6600
@@ -53,9 +57,6 @@ config GENERIC_CLOCKEVENTS
 config SCHED_NO_NO_OMIT_FRAME_POINTER
         def_bool y
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
 config GENERIC_SYSCALL_TABLE
         def_bool y
 
@@ -68,9 +69,6 @@ menu "Kernel type"
 config 32BIT
         def_bool y
 
-config GENERIC_HARDIRQS
-        def_bool y
-
 config ARCH_FLATMEM_ENABLE
         def_bool y
 
diff --git a/arch/score/configs/spct6600_defconfig b/arch/score/configs/spct6600_defconfig
index 9883c50e463..df1edbf507a 100644
--- a/arch/score/configs/spct6600_defconfig
+++ b/arch/score/configs/spct6600_defconfig
@@ -9,7 +9,7 @@ CONFIG_LOG_BUF_SHIFT=12
 CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
 # CONFIG_HOTPLUG is not set
 CONFIG_SLAB=y
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index fff252209f6..8a9011dced1 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -1,6 +1,6 @@
 config SUPERH
         def_bool y
-        select EMBEDDED
+        select EXPERT
         select CLKDEV_LOOKUP
         select HAVE_IDE if HAS_IOPORT
         select HAVE_MEMBLOCK
@@ -15,6 +15,7 @@ config SUPERH
         select HAVE_KERNEL_GZIP
         select HAVE_KERNEL_BZIP2
         select HAVE_KERNEL_LZMA
+        select HAVE_KERNEL_XZ
         select HAVE_KERNEL_LZO
         select HAVE_SYSCALL_TRACEPOINTS
         select HAVE_REGS_AND_STACK_ACCESS_API
diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index 9c8c6e1a2a1..e3d8170ad00 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -200,7 +200,7 @@ endif
 libs-$(CONFIG_SUPERH32)         := arch/sh/lib/ $(libs-y)
 libs-$(CONFIG_SUPERH64)         := arch/sh/lib64/ $(libs-y)
 
-BOOT_TARGETS = uImage uImage.bz2 uImage.gz uImage.lzma uImage.lzo \
+BOOT_TARGETS = uImage uImage.bz2 uImage.gz uImage.lzma uImage.xz uImage.lzo \
                uImage.srec uImage.bin zImage vmlinux.bin vmlinux.srec \
                romImage
 PHONY += $(BOOT_TARGETS)
@@ -230,5 +230,6 @@ define archhelp
         @echo '* uImage.gz                 - Kernel-only image for U-Boot (gzip)'
         @echo '  uImage.bz2                - Kernel-only image for U-Boot (bzip2)'
         @echo '  uImage.lzma               - Kernel-only image for U-Boot (lzma)'
+        @echo '  uImage.xz                 - Kernel-only image for U-Boot (xz)'
         @echo '  uImage.lzo                - Kernel-only image for U-Boot (lzo)'
 endef
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 33b662999fc..701667acfd8 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -1294,6 +1294,7 @@ static int __init arch_setup(void)
         i2c_register_board_info(1, i2c1_devices,
                                 ARRAY_SIZE(i2c1_devices));
 
+#if defined(CONFIG_VIDEO_SH_VOU) || defined(CONFIG_VIDEO_SH_VOU_MODULE)
         /* VOU */
         gpio_request(GPIO_FN_DV_D15, NULL);
         gpio_request(GPIO_FN_DV_D14, NULL);
@@ -1325,6 +1326,7 @@ static int __init arch_setup(void)
 
         /* Remove reset */
         gpio_set_value(GPIO_PTG4, 1);
+#endif
 
         return platform_add_devices(ecovec_devices,
                                     ARRAY_SIZE(ecovec_devices));
diff --git a/arch/sh/boot/Makefile b/arch/sh/boot/Makefile
index 1ce63624c9b..ba515d80024 100644
--- a/arch/sh/boot/Makefile
+++ b/arch/sh/boot/Makefile
@@ -24,12 +24,13 @@ suffix-y := bin
 suffix-$(CONFIG_KERNEL_GZIP)    := gz
 suffix-$(CONFIG_KERNEL_BZIP2)   := bz2
 suffix-$(CONFIG_KERNEL_LZMA)    := lzma
+suffix-$(CONFIG_KERNEL_XZ)      := xz
 suffix-$(CONFIG_KERNEL_LZO)     := lzo
 
 targets := zImage vmlinux.srec romImage uImage uImage.srec uImage.gz \
-           uImage.bz2 uImage.lzma uImage.lzo uImage.bin
+           uImage.bz2 uImage.lzma uImage.xz uImage.lzo uImage.bin
 extra-y += vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma \
-           vmlinux.bin.lzo
+           vmlinux.bin.xz vmlinux.bin.lzo
 subdir- := compressed romimage
 
 $(obj)/zImage: $(obj)/compressed/vmlinux FORCE
@@ -76,6 +77,9 @@ $(obj)/vmlinux.bin.bz2: $(obj)/vmlinux.bin FORCE
 $(obj)/vmlinux.bin.lzma: $(obj)/vmlinux.bin FORCE
         $(call if_changed,lzma)
 
+$(obj)/vmlinux.bin.xz: $(obj)/vmlinux.bin FORCE
+        $(call if_changed,xzkern)
+
 $(obj)/vmlinux.bin.lzo: $(obj)/vmlinux.bin FORCE
         $(call if_changed,lzo)
 
@@ -88,6 +92,9 @@ $(obj)/uImage.gz: $(obj)/vmlinux.bin.gz
 $(obj)/uImage.lzma: $(obj)/vmlinux.bin.lzma
         $(call if_changed,uimage,lzma)
 
+$(obj)/uImage.xz: $(obj)/vmlinux.bin.xz
+        $(call if_changed,uimage,xz)
+
 $(obj)/uImage.lzo: $(obj)/vmlinux.bin.lzo
         $(call if_changed,uimage,lzo)
 
diff --git a/arch/sh/boot/compressed/Makefile b/arch/sh/boot/compressed/Makefile
index cfa5a087a88..e0b0293bae6 100644
--- a/arch/sh/boot/compressed/Makefile
+++ b/arch/sh/boot/compressed/Makefile
@@ -6,7 +6,7 @@
 
 targets         := vmlinux vmlinux.bin vmlinux.bin.gz \
                    vmlinux.bin.bz2 vmlinux.bin.lzma \
-                   vmlinux.bin.lzo \
+                   vmlinux.bin.xz vmlinux.bin.lzo \
                    head_$(BITS).o misc.o piggy.o
 
 OBJECTS = $(obj)/head_$(BITS).o $(obj)/misc.o $(obj)/cache.o
@@ -50,6 +50,8 @@ $(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,bzip2)
 $(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,lzma)
+$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) FORCE
+        $(call if_changed,xzkern)
 $(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE
         $(call if_changed,lzo)
 
diff --git a/arch/sh/boot/compressed/misc.c b/arch/sh/boot/compressed/misc.c
index 27140a6b365..95470a472d2 100644
--- a/arch/sh/boot/compressed/misc.c
+++ b/arch/sh/boot/compressed/misc.c
@@ -61,6 +61,10 @@ static unsigned long free_mem_end_ptr;
 #include "../../../../lib/decompress_unlzma.c"
 #endif
 
+#ifdef CONFIG_KERNEL_XZ
+#include "../../../../lib/decompress_unxz.c"
+#endif
+
 #ifdef CONFIG_KERNEL_LZO
 #include "../../../../lib/decompress_unlzo.c"
 #endif
diff --git a/arch/sh/include/asm/pgtable.h b/arch/sh/include/asm/pgtable.h
index 083ea068e81..db85916b9e9 100644
--- a/arch/sh/include/asm/pgtable.h
+++ b/arch/sh/include/asm/pgtable.h
@@ -134,6 +134,7 @@ typedef pte_t *pte_addr_t;
 extern void pgtable_cache_init(void);
 
 struct vm_area_struct;
+struct mm_struct;
 
 extern void __update_cache(struct vm_area_struct *vma,
                            unsigned long address, pte_t pte);
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh7750.c b/arch/sh/kernel/cpu/sh4/setup-sh7750.c
index c2b0aaaedca..672944f5b19 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh7750.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh7750.c
@@ -230,10 +230,10 @@ static struct platform_device *sh7750_devices[] __initdata = {
 static int __init sh7750_devices_setup(void)
 {
         if (mach_is_rts7751r2d()) {
-                platform_register_device(&scif_device);
+                platform_device_register(&scif_device);
         } else {
-                platform_register_device(&sci_device);
-                platform_register_device(&scif_device);
+                platform_device_register(&sci_device);
+                platform_device_register(&scif_device);
         }
 
         return platform_add_devices(sh7750_devices,
diff --git a/arch/sh/kernel/topology.c b/arch/sh/kernel/topology.c
index 948fdb65693..38e862852dd 100644
--- a/arch/sh/kernel/topology.c
+++ b/arch/sh/kernel/topology.c
@@ -17,6 +17,7 @@
 static DEFINE_PER_CPU(struct cpu, cpu_devices);
 
 cpumask_t cpu_core_map[NR_CPUS];
+EXPORT_SYMBOL(cpu_core_map);
 
 static cpumask_t cpu_coregroup_map(unsigned int cpu)
 {
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 45d9c87d083..95695e97703 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -50,6 +50,7 @@ config SPARC64
         select RTC_DRV_STARFIRE
         select HAVE_PERF_EVENTS
         select PERF_USE_VMALLOC
+        select HAVE_GENERIC_HARDIRQS
 
 config ARCH_DEFCONFIG
         string
@@ -107,10 +108,6 @@ config NEED_PER_CPU_EMBED_FIRST_CHUNK
 config NEED_PER_CPU_PAGE_FIRST_CHUNK
         def_bool y if SPARC64
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        bool
-        def_bool y if SPARC64
-
 config MMU
         bool
         default y
@@ -276,10 +273,6 @@ config HOTPLUG_CPU
           can be controlled through /sys/devices/system/cpu/cpu#.
           Say N if you want to disable CPU hotplug.
 
-config GENERIC_HARDIRQS
-        bool
-        default y if SPARC64
-
 source "kernel/time/Kconfig"
 
 if SPARC64
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index e11b5fcb70e..08948e4e150 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -1,24 +1,33 @@
 # For a description of the syntax of this configuration file,
 # see Documentation/kbuild/config-language.txt.
 
-config MMU
-        def_bool y
-
-config GENERIC_CSUM
-        def_bool y
-
-config GENERIC_HARDIRQS
+config TILE
         def_bool y
+        select HAVE_KVM if !TILEGX
+        select GENERIC_FIND_FIRST_BIT
+        select GENERIC_FIND_NEXT_BIT
+        select USE_GENERIC_SMP_HELPERS
+        select CC_OPTIMIZE_FOR_SIZE
+        select HAVE_GENERIC_HARDIRQS
+        select GENERIC_IRQ_PROBE
+        select GENERIC_PENDING_IRQ if SMP
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
+# FIXME: investigate whether we need/want these options.
+#       select HAVE_IOREMAP_PROT
+#       select HAVE_OPTPROBES
+#       select HAVE_REGS_AND_STACK_ACCESS_API
+#       select HAVE_HW_BREAKPOINT
+#       select PERF_EVENTS
+#       select HAVE_USER_RETURN_NOTIFIER
+#       config NO_BOOTMEM
+#       config ARCH_SUPPORTS_DEBUG_PAGEALLOC
+#       config HUGETLB_PAGE_SIZE_VARIABLE
 
-config GENERIC_IRQ_PROBE
+config MMU
         def_bool y
 
-config GENERIC_PENDING_IRQ
+config GENERIC_CSUM
         def_bool y
-        depends on GENERIC_HARDIRQS && SMP
 
 config SEMAPHORE_SLEEPERS
         def_bool y
@@ -97,26 +106,6 @@ config HVC_TILE
         select HVC_DRIVER
         def_bool y
 
-config TILE
-        def_bool y
-        select HAVE_KVM if !TILEGX
-        select GENERIC_FIND_FIRST_BIT
-        select GENERIC_FIND_NEXT_BIT
-        select USE_GENERIC_SMP_HELPERS
-        select CC_OPTIMIZE_FOR_SIZE
-
-# FIXME: investigate whether we need/want these options.
-#       select HAVE_IOREMAP_PROT
-#       select HAVE_OPTPROBES
-#       select HAVE_REGS_AND_STACK_ACCESS_API
-#       select HAVE_HW_BREAKPOINT
-#       select PERF_EVENTS
-#       select HAVE_USER_RETURN_NOTIFIER
-#       config NO_BOOTMEM
-#       config ARCH_SUPPORTS_DEBUG_PAGEALLOC
-#       config HUGETLB_PAGE_SIZE_VARIABLE
-
-
 # Please note: TILE-Gx support is not yet finalized; this is
 # the preliminary support.  TILE-Gx drivers are only provided
 # with the alpha or beta test versions for Tilera customers.
@@ -220,7 +209,7 @@ config FORCE_MAX_ZONEORDER
 
 choice
         depends on !TILEGX
-        prompt "Memory split" if EMBEDDED
+        prompt "Memory split" if EXPERT
         default VMSPLIT_3G
         ---help---
           Select the desired split between kernel and user memory.
diff --git a/arch/tile/Kconfig.debug b/arch/tile/Kconfig.debug
index a81f0fbf7e6..9bc161a02c7 100644
--- a/arch/tile/Kconfig.debug
+++ b/arch/tile/Kconfig.debug
@@ -3,7 +3,7 @@ menu "Kernel hacking"
 source "lib/Kconfig.debug"
 
 config EARLY_PRINTK
-        bool "Early printk" if EMBEDDED && DEBUG_KERNEL
+        bool "Early printk" if EXPERT && DEBUG_KERNEL
         default y
         help
           Write kernel log output directly via the hypervisor console.
diff --git a/arch/tile/configs/tile_defconfig b/arch/tile/configs/tile_defconfig
index 919c54afd98..0fe54445fda 100644
--- a/arch/tile/configs/tile_defconfig
+++ b/arch/tile/configs/tile_defconfig
@@ -3,7 +3,7 @@ CONFIG_EXPERIMENTAL=y
 CONFIG_SYSVIPC=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE="usr/contents.txt"
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_PROFILING=y
 CONFIG_MODULES=y
diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common
index 049d048b070..e351e14b433 100644
--- a/arch/um/Kconfig.common
+++ b/arch/um/Kconfig.common
@@ -3,14 +3,10 @@ config DEFCONFIG_LIST
         option defconfig_list
         default "arch/$ARCH/defconfig"
 
-# UML uses the generic IRQ subsystem
-config GENERIC_HARDIRQS
-        bool
-        default y
-
 config UML
         bool
         default y
+        select HAVE_GENERIC_HARDIRQS
 
 config MMU
         bool
diff --git a/arch/um/Kconfig.um b/arch/um/Kconfig.um
index f8d1d0d47fe..90a438acbfa 100644
--- a/arch/um/Kconfig.um
+++ b/arch/um/Kconfig.um
@@ -120,9 +120,6 @@ config SMP
 
           If you don't know what to do, say N.
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-        def_bool y
-
 config NR_CPUS
         int "Maximum number of CPUs (2-32)"
         range 2 32
diff --git a/arch/um/defconfig b/arch/um/defconfig
index 564f3de65b4..9f7634f08cf 100644
--- a/arch/um/defconfig
+++ b/arch/um/defconfig
@@ -133,7 +133,7 @@ CONFIG_SYSFS_DEPRECATED=y
 # CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
-# CONFIG_EMBEDDED is not set
+# CONFIG_EXPERT is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 3ed5ad92b02..d5ed94d30aa 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -627,11 +627,11 @@ config APB_TIMER
          as it is off-chip. APB timers are always running regardless of CPU
          C states, they are used as per CPU clockevent device when possible.
 
-# Mark as embedded because too many people got it wrong.
+# Mark as expert because too many people got it wrong.
 # The code disables itself when not needed.
 config DMI
         default y
-        bool "Enable DMI scanning" if EMBEDDED
+        bool "Enable DMI scanning" if EXPERT
         ---help---
           Enabled scanning of DMI to identify machine quirks. Say Y
           here unless you have verified that your setup is not
@@ -639,7 +639,7 @@ config DMI
           BIOS code.
 
 config GART_IOMMU
-        bool "GART IOMMU support" if EMBEDDED
+        bool "GART IOMMU support" if EXPERT
         default y
         select SWIOTLB
         depends on X86_64 && PCI && AMD_NB
@@ -889,7 +889,7 @@ config X86_THERMAL_VECTOR
         depends on X86_MCE_INTEL
 
 config VM86
-        bool "Enable VM86 support" if EMBEDDED
+        bool "Enable VM86 support" if EXPERT
         default y
         depends on X86_32
         ---help---
@@ -1073,7 +1073,7 @@ endchoice
 
 choice
         depends on EXPERIMENTAL
-        prompt "Memory split" if EMBEDDED
+        prompt "Memory split" if EXPERT
         default VMSPLIT_3G
         depends on X86_32
         ---help---
@@ -1135,7 +1135,7 @@ config ARCH_DMA_ADDR_T_64BIT
         def_bool X86_64 || HIGHMEM64G
 
 config DIRECT_GBPAGES
-        bool "Enable 1GB pages for kernel pagetables" if EMBEDDED
+        bool "Enable 1GB pages for kernel pagetables" if EXPERT
         default y
         depends on X86_64
         ---help---
@@ -1369,7 +1369,7 @@ config MATH_EMULATION
 
 config MTRR
         def_bool y
-        prompt "MTRR (Memory Type Range Register) support" if EMBEDDED
+        prompt "MTRR (Memory Type Range Register) support" if EXPERT
         ---help---
           On Intel P6 family processors (Pentium Pro, Pentium II and later)
           the Memory Type Range Registers (MTRRs) may be used to control
@@ -1435,7 +1435,7 @@ config MTRR_SANITIZER_SPARE_REG_NR_DEFAULT
 
 config X86_PAT
         def_bool y
-        prompt "x86 PAT support" if EMBEDDED
+        prompt "x86 PAT support" if EXPERT
         depends on MTRR
         ---help---
           Use PAT attributes to setup page level cache control.
@@ -1539,7 +1539,7 @@ config KEXEC_JUMP
           code in physical address mode via KEXEC
 
 config PHYSICAL_START
-        hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
+        hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
         default "0x1000000"
         ---help---
           This gives the physical address where the kernel is loaded.
@@ -1934,7 +1934,7 @@ config PCI_MMCONFIG
         depends on X86_64 && PCI && ACPI
 
 config PCI_CNB20LE_QUIRK
-        bool "Read CNB20LE Host Bridge Windows" if EMBEDDED
+        bool "Read CNB20LE Host Bridge Windows" if EXPERT
         default n
         depends on PCI && EXPERIMENTAL
         help
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 15588a0ef46..283c5a6a03a 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -424,7 +424,7 @@ config X86_DEBUGCTLMSR
         depends on !(MK6 || MWINCHIPC6 || MWINCHIP3D || MCYRIXIII || M586MMX || M586TSC || M586 || M486 || M386) && !UML
 
 menuconfig PROCESSOR_SELECT
-        bool "Supported processor vendors" if EMBEDDED
+        bool "Supported processor vendors" if EXPERT
         ---help---
           This lets you choose what x86 vendor support code your kernel
           will include.
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 45143bbcfe5..615e18810f4 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -31,7 +31,7 @@ config X86_VERBOSE_BOOTUP
           see errors. Disable this if you want silent bootup.
 
 config EARLY_PRINTK
-        bool "Early printk" if EMBEDDED
+        bool "Early printk" if EXPERT
         default y
         ---help---
           Write kernel log output directly into the VGA buffer or to a serial
@@ -138,7 +138,7 @@ config DEBUG_NX_TEST
 
 config DOUBLEFAULT
         default y
-        bool "Enable doublefault exception handler" if EMBEDDED
+        bool "Enable doublefault exception handler" if EXPERT
         depends on X86_32
         ---help---
           This option allows trapping of rare doublefault exceptions that
diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
index 63e35ec9075..62f084478f7 100644
--- a/arch/x86/include/asm/cacheflush.h
+++ b/arch/x86/include/asm/cacheflush.h
@@ -1,48 +1,8 @@
 #ifndef _ASM_X86_CACHEFLUSH_H
 #define _ASM_X86_CACHEFLUSH_H
 
-/* Keep includes the same across arches.  */
-#include <linux/mm.h>
-
 /* Caches aren't brain-dead on the intel. */
-static inline void flush_cache_all(void) { }
-static inline void flush_cache_mm(struct mm_struct *mm) { }
-static inline void flush_cache_dup_mm(struct mm_struct *mm) { }
-static inline void flush_cache_range(struct vm_area_struct *vma,
-                                     unsigned long start, unsigned long end) { }
-static inline void flush_cache_page(struct vm_area_struct *vma,
-                                    unsigned long vmaddr, unsigned long pfn) { }
-#define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 0
-static inline void flush_dcache_page(struct page *page) { }
-static inline void flush_dcache_mmap_lock(struct address_space *mapping) { }
-static inline void flush_dcache_mmap_unlock(struct address_space *mapping) { }
-static inline void flush_icache_range(unsigned long start,
-                                      unsigned long end) { }
-static inline void flush_icache_page(struct vm_area_struct *vma,
-                                     struct page *page) { }
-static inline void flush_icache_user_range(struct vm_area_struct *vma,
-                                           struct page *page,
-                                           unsigned long addr,
-                                           unsigned long len) { }
-static inline void flush_cache_vmap(unsigned long start, unsigned long end) { }
-static inline void flush_cache_vunmap(unsigned long start,
-                                      unsigned long end) { }
-
-static inline void copy_to_user_page(struct vm_area_struct *vma,
-                                     struct page *page, unsigned long vaddr,
-                                     void *dst, const void *src,
-                                     unsigned long len)
-{
-        memcpy(dst, src, len);
-}
-
-static inline void copy_from_user_page(struct vm_area_struct *vma,
-                                       struct page *page, unsigned long vaddr,
-                                       void *dst, const void *src,
-                                       unsigned long len)
-{
-        memcpy(dst, src, len);
-}
+#include <asm-generic/cacheflush.h>
 
 #ifdef CONFIG_X86_PAT
 /*
diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h
index 4fab24de26b..6e6e7558e70 100644
--- a/arch/x86/include/asm/cpu.h
+++ b/arch/x86/include/asm/cpu.h
@@ -32,5 +32,6 @@ extern void arch_unregister_cpu(int);
 
 DECLARE_PER_CPU(int, cpu_state);
 
+int __cpuinit mwait_usable(const struct cpuinfo_x86 *);
 
 #endif /* _ASM_X86_CPU_H */
diff --git a/arch/x86/include/asm/jump_label.h b/arch/x86/include/asm/jump_label.h
index f52d42e8058..574dbc22893 100644
--- a/arch/x86/include/asm/jump_label.h
+++ b/arch/x86/include/asm/jump_label.h
@@ -14,7 +14,7 @@
         do {                                                    \
                 asm goto("1:"                                   \
                         JUMP_LABEL_INITIAL_NOP                  \
-                        ".pushsection __jump_table,  \"a\" \n\t"\
+                        ".pushsection __jump_table,  \"aw\" \n\t"\
                         _ASM_PTR "1b, %l[" #label "], %c0 \n\t" \
                         ".popsection \n\t"                      \
                         : :  "i" (key) :  : label);             \
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 4a2d4e0c18d..8b5393ec108 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -36,8 +36,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
         unsigned cpu = smp_processor_id();
 
         if (likely(prev != next)) {
-                /* stop flush ipis for the previous mm */
-                cpumask_clear_cpu(cpu, mm_cpumask(prev));
 #ifdef CONFIG_SMP
                 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
                 percpu_write(cpu_tlbstate.active_mm, next);
@@ -47,6 +45,9 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                 /* Re-load page tables */
                 load_cr3(next->pgd);
 
+                /* stop flush ipis for the previous mm */
+                cpumask_clear_cpu(cpu, mm_cpumask(prev));
+
                 /*
                  * load the LDT, if the LDT is different:
                  */
diff --git a/arch/x86/include/asm/numa_32.h b/arch/x86/include/asm/numa_32.h
index a37229011b5..b0ef2b449a9 100644
--- a/arch/x86/include/asm/numa_32.h
+++ b/arch/x86/include/asm/numa_32.h
@@ -1,6 +1,8 @@
 #ifndef _ASM_X86_NUMA_32_H
 #define _ASM_X86_NUMA_32_H
 
+extern int numa_off;
+
 extern int pxm_to_nid(int pxm);
 extern void numa_remove_cpu(int cpu);
 
diff --git a/arch/x86/include/asm/numa_64.h b/arch/x86/include/asm/numa_64.h
index 5ae87285a50..0493be39607 100644
--- a/arch/x86/include/asm/numa_64.h
+++ b/arch/x86/include/asm/numa_64.h
@@ -40,6 +40,7 @@ extern void __cpuinit numa_remove_cpu(int cpu);
 #ifdef CONFIG_NUMA_EMU
 #define FAKE_NODE_MIN_SIZE      ((u64)32 << 20)
 #define FAKE_NODE_MIN_HASH_MASK (~(FAKE_NODE_MIN_SIZE - 1UL))
+void numa_emu_cmdline(char *);
 #endif /* CONFIG_NUMA_EMU */
 #else
 static inline void init_cpu_to_node(void)               { }
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 2071a8b2b32..ebbc4d8ab17 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -558,13 +558,12 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                               pmd_t *pmdp, pmd_t pmd)
 {
-#if PAGETABLE_LEVELS >= 3
         if (sizeof(pmdval_t) > sizeof(long))
                 /* 5 arg words */
                 pv_mmu_ops.set_pmd_at(mm, addr, pmdp, pmd);
         else
-                PVOP_VCALL4(pv_mmu_ops.set_pmd_at, mm, addr, pmdp, pmd.pmd);
-#endif
+                PVOP_VCALL4(pv_mmu_ops.set_pmd_at, mm, addr, pmdp,
+                            native_pmd_val(pmd));
 }
 #endif
 
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 8ee45167e81..7e172955ee5 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -273,34 +273,34 @@ do {									\
         typeof(var) pxo_new__ = (nval);                                 \
         switch (sizeof(var)) {                                          \
         case 1:                                                         \
-                asm("\n1:mov "__percpu_arg(1)",%%al"                    \
-                    "\n\tcmpxchgb %2, "__percpu_arg(1)                  \
+                asm("\n\tmov "__percpu_arg(1)",%%al"                    \
+                    "\n1:\tcmpxchgb %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
-                            : "=a" (pxo_ret__), "+m" (var)              \
+                            : "=&a" (pxo_ret__), "+m" (var)             \
                             : "q" (pxo_new__)                           \
                             : "memory");                                \
                 break;                                                  \
         case 2:                                                         \
-                asm("\n1:mov "__percpu_arg(1)",%%ax"                    \
-                    "\n\tcmpxchgw %2, "__percpu_arg(1)                  \
+                asm("\n\tmov "__percpu_arg(1)",%%ax"                    \
+                    "\n1:\tcmpxchgw %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
-                            : "=a" (pxo_ret__), "+m" (var)              \
+                            : "=&a" (pxo_ret__), "+m" (var)             \
                             : "r" (pxo_new__)                           \
                             : "memory");                                \
                 break;                                                  \
         case 4:                                                         \
-                asm("\n1:mov "__percpu_arg(1)",%%eax"                   \
-                    "\n\tcmpxchgl %2, "__percpu_arg(1)                  \
+                asm("\n\tmov "__percpu_arg(1)",%%eax"                   \
+                    "\n1:\tcmpxchgl %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
-                            : "=a" (pxo_ret__), "+m" (var)              \
+                            : "=&a" (pxo_ret__), "+m" (var)             \
                             : "r" (pxo_new__)                           \
                             : "memory");                                \
                 break;                                                  \
         case 8:                                                         \
-                asm("\n1:mov "__percpu_arg(1)",%%rax"                   \
-                    "\n\tcmpxchgq %2, "__percpu_arg(1)                  \
+                asm("\n\tmov "__percpu_arg(1)",%%rax"                   \
+                    "\n1:\tcmpxchgq %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
-                            : "=a" (pxo_ret__), "+m" (var)              \
+                            : "=&a" (pxo_ret__), "+m" (var)             \
                             : "r" (pxo_new__)                           \
                             : "memory");                                \
                 break;                                                  \
@@ -414,8 +414,6 @@ do {									\
 #define this_cpu_xchg_1(pcp, nval)      percpu_xchg_op(pcp, nval)
 #define this_cpu_xchg_2(pcp, nval)      percpu_xchg_op(pcp, nval)
 #define this_cpu_xchg_4(pcp, nval)      percpu_xchg_op(pcp, nval)
-#define this_cpu_xchg_8(pcp, nval)      percpu_xchg_op(pcp, nval)
-#define this_cpu_cmpxchg_8(pcp, oval, nval)     percpu_cmpxchg_op(pcp, oval, nval)
 
 #define irqsafe_cpu_add_1(pcp, val)     percpu_add_op((pcp), val)
 #define irqsafe_cpu_add_2(pcp, val)     percpu_add_op((pcp), val)
@@ -432,8 +430,6 @@ do {									\
 #define irqsafe_cpu_xchg_1(pcp, nval)   percpu_xchg_op(pcp, nval)
 #define irqsafe_cpu_xchg_2(pcp, nval)   percpu_xchg_op(pcp, nval)
 #define irqsafe_cpu_xchg_4(pcp, nval)   percpu_xchg_op(pcp, nval)
-#define irqsafe_cpu_xchg_8(pcp, nval)   percpu_xchg_op(pcp, nval)
-#define irqsafe_cpu_cmpxchg_8(pcp, oval, nval)  percpu_cmpxchg_op(pcp, oval, nval)
 
 #ifndef CONFIG_M386
 #define __this_cpu_add_return_1(pcp, val) percpu_add_return_op(pcp, val)
@@ -475,11 +471,15 @@ do {									\
 #define this_cpu_or_8(pcp, val)         percpu_to_op("or", (pcp), val)
 #define this_cpu_xor_8(pcp, val)        percpu_to_op("xor", (pcp), val)
 #define this_cpu_add_return_8(pcp, val) percpu_add_return_op(pcp, val)
+#define this_cpu_xchg_8(pcp, nval)      percpu_xchg_op(pcp, nval)
+#define this_cpu_cmpxchg_8(pcp, oval, nval)     percpu_cmpxchg_op(pcp, oval, nval)
 
 #define irqsafe_cpu_add_8(pcp, val)     percpu_add_op((pcp), val)
 #define irqsafe_cpu_and_8(pcp, val)     percpu_to_op("and", (pcp), val)
 #define irqsafe_cpu_or_8(pcp, val)      percpu_to_op("or", (pcp), val)
 #define irqsafe_cpu_xor_8(pcp, val)     percpu_to_op("xor", (pcp), val)
+#define irqsafe_cpu_xchg_8(pcp, nval)   percpu_xchg_op(pcp, nval)
+#define irqsafe_cpu_cmpxchg_8(pcp, oval, nval)  percpu_cmpxchg_op(pcp, oval, nval)
 #endif
 
 /* This is not atomic against other CPUs -- CPU preemption needs to be off */
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 4c2f63c7fc1..1f469513677 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -40,10 +40,7 @@ DECLARE_EARLY_PER_CPU(u16, x86_cpu_to_apicid);
 DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
 
 /* Static state in head.S used to set up a CPU */
-extern struct {
-        void *sp;
-        unsigned short ss;
-} stack_start;
+extern unsigned long stack_start; /* Initial stack pointer address */
 
 struct smp_ops {
         void (*smp_prepare_boot_cpu)(void);
diff --git a/arch/x86/include/asm/system_64.h b/arch/x86/include/asm/system_64.h
deleted file mode 100644
index 1159e091ad0..00000000000
--- a/arch/x86/include/asm/system_64.h
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifndef _ASM_X86_SYSTEM_64_H
-#define _ASM_X86_SYSTEM_64_H
-
-#include <asm/segment.h>
-#include <asm/cmpxchg.h>
-
-
-static inline unsigned long read_cr8(void)
-{
-        unsigned long cr8;
-        asm volatile("movq %%cr8,%0" : "=r" (cr8));
-        return cr8;
-}
-
-static inline void write_cr8(unsigned long val)
-{
-        asm volatile("movq %0,%%cr8" :: "r" (val) : "memory");
-}
-
-#include <linux/irqflags.h>
-
-#endif /* _ASM_X86_SYSTEM_64_H */
diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index 69fd72aa559..68d1537b8c8 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -12,10 +12,8 @@
 #include <linux/cpumask.h>
 #include <asm/segment.h>
 #include <asm/desc.h>
-
-#ifdef CONFIG_X86_32
 #include <asm/pgtable.h>
-#endif
+#include <asm/cacheflush.h>
 
 #include "realmode/wakeup.h"
 #include "sleep.h"
@@ -100,7 +98,7 @@ int acpi_save_state_mem(void)
 #else /* CONFIG_64BIT */
         header->trampoline_segment = setup_trampoline() >> 4;
 #ifdef CONFIG_SMP
-        stack_start.sp = temp_stack + sizeof(temp_stack);
+        stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
         early_gdt_descr.address =
                         (unsigned long)get_cpu_gdt_table(smp_processor_id());
         initial_gs = per_cpu_offset(smp_processor_id());
@@ -149,6 +147,15 @@ void __init acpi_reserve_wakeup_memory(void)
         memblock_x86_reserve_range(mem, mem + WAKEUP_SIZE, "ACPI WAKEUP");
 }
 
+int __init acpi_configure_wakeup_memory(void)
+{
+        if (acpi_realmode)
+                set_memory_x(acpi_realmode, WAKEUP_SIZE >> PAGE_SHIFT);
+
+        return 0;
+}
+arch_initcall(acpi_configure_wakeup_memory);
+
 
 static int __init acpi_sleep_setup(char *str)
 {
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index 7283e98deaa..ec2c19a7b8e 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -45,6 +45,7 @@ static const struct _cache_table __cpuinitconst cache_table[] =
         { 0x0a, LVL_1_DATA, 8 },        /* 2 way set assoc, 32 byte line size */
         { 0x0c, LVL_1_DATA, 16 },       /* 4-way set assoc, 32 byte line size */
         { 0x0d, LVL_1_DATA, 16 },       /* 4-way set assoc, 64 byte line size */
+        { 0x0e, LVL_1_DATA, 24 },       /* 6-way set assoc, 64 byte line size */
         { 0x21, LVL_2,      256 },      /* 8-way set assoc, 64 byte line size */
         { 0x22, LVL_3,      512 },      /* 4-way set assoc, sectored cache, 64 byte line size */
         { 0x23, LVL_3,      MB(1) },    /* 8-way set assoc, sectored cache, 64 byte line size */
@@ -66,6 +67,7 @@ static const struct _cache_table __cpuinitconst cache_table[] =
         { 0x45, LVL_2,      MB(2) },    /* 4-way set assoc, 32 byte line size */
         { 0x46, LVL_3,      MB(4) },    /* 4-way set assoc, 64 byte line size */
         { 0x47, LVL_3,      MB(8) },    /* 8-way set assoc, 64 byte line size */
+        { 0x48, LVL_2,      MB(3) },    /* 12-way set assoc, 64 byte line size */
         { 0x49, LVL_3,      MB(4) },    /* 16-way set assoc, 64 byte line size */
         { 0x4a, LVL_3,      MB(6) },    /* 12-way set assoc, 64 byte line size */
         { 0x4b, LVL_3,      MB(8) },    /* 16-way set assoc, 64 byte line size */
@@ -87,6 +89,7 @@ static const struct _cache_table __cpuinitconst cache_table[] =
         { 0x7c, LVL_2,      MB(1) },    /* 8-way set assoc, sectored cache, 64 byte line size */
         { 0x7d, LVL_2,      MB(2) },    /* 8-way set assoc, 64 byte line size */
         { 0x7f, LVL_2,      512 },      /* 2-way set assoc, 64 byte line size */
+        { 0x80, LVL_2,      512 },      /* 8-way set assoc, 64 byte line size */
         { 0x82, LVL_2,      256 },      /* 8-way set assoc, 32 byte line size */
         { 0x83, LVL_2,      512 },      /* 8-way set assoc, 32 byte line size */
         { 0x84, LVL_2,      MB(1) },    /* 8-way set assoc, 32 byte line size */
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index e12246ff5aa..6f8c5e9da97 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -59,6 +59,7 @@ struct thermal_state {
 
 /* Callback to handle core threshold interrupts */
 int (*platform_thermal_notify)(__u64 msr_val);
+EXPORT_SYMBOL(platform_thermal_notify);
 
 static DEFINE_PER_CPU(struct thermal_state, thermal_state);
 
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 01c0f3ee6cc..bebabec5b44 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -793,13 +793,21 @@ void set_mtrr_aps_delayed_init(void)
 }
 
 /*
- * MTRR initialization for all AP's
+ * Delayed MTRR initialization for all AP's
  */
 void mtrr_aps_init(void)
 {
         if (!use_intel())
                 return;
 
+        /*
+         * Check if someone has requested the delay of AP MTRR initialization,
+         * by doing set_mtrr_aps_delayed_init(), prior to this point. If not,
+         * then we are done.
+         */
+        if (!mtrr_aps_delayed_init)
+                return;
+
         set_mtrr(~0U, 0, 0, 0);
         mtrr_aps_delayed_init = false;
 }
diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
index e56b9bfbabd..f7a0993c1e7 100644
--- a/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/arch/x86/kernel/cpu/perf_event_p4.c
@@ -682,7 +682,7 @@ static int p4_validate_raw_event(struct perf_event *event)
          * if an event is shared accross the logical threads
          * the user needs special permissions to be able to use it
          */
-        if (p4_event_bind_map[v].shared) {
+        if (p4_ht_active() && p4_event_bind_map[v].shared) {
                 if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
                         return -EACCES;
         }
@@ -727,7 +727,8 @@ static int p4_hw_config(struct perf_event *event)
                 event->hw.config = p4_set_ht_bit(event->hw.config);
 
         if (event->attr.type == PERF_TYPE_RAW) {
-
+                struct p4_event_bind *bind;
+                unsigned int esel;
                 /*
                  * Clear bits we reserve to be managed by kernel itself
                  * and never allowed from a user space
@@ -743,6 +744,13 @@ static int p4_hw_config(struct perf_event *event)
                  * bits since we keep additional info here (for cache events and etc)
                  */
                 event->hw.config |= event->attr.config;
+                bind = p4_config_get_bind(event->attr.config);
+                if (!bind) {
+                        rc = -EINVAL;
+                        goto out;
+                }
+                esel = P4_OPCODE_ESEL(bind->opcode);
+                event->hw.config |= p4_config_pack_cccr(P4_CCCR_ESEL(esel));
         }
 
         rc = x86_setup_perfctr(event);
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 64101335de1..a6b6fcf7f0a 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -149,13 +149,13 @@ void dump_trace(struct task_struct *task,
         unsigned used = 0;
         struct thread_info *tinfo;
         int graph = 0;
+        unsigned long dummy;
         unsigned long bp;
 
         if (!task)
                 task = current;
 
         if (!stack) {
-                unsigned long dummy;
                 stack = &dummy;
                 if (task && task != current)
                         stack = (unsigned long *)task->thread.sp;
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index fc293dc8dc3..767d6c43de3 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -85,6 +85,8 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
  */
 __HEAD
 ENTRY(startup_32)
+        movl pa(stack_start),%ecx
+        
         /* test KEEP_SEGMENTS flag to see if the bootloader is asking
                 us to not reload segments */
         testb $(1<<6), BP_loadflags(%esi)
@@ -99,7 +101,9 @@ ENTRY(startup_32)
         movl %eax,%es
         movl %eax,%fs
         movl %eax,%gs
+        movl %eax,%ss
 2:
+        leal -__PAGE_OFFSET(%ecx),%esp
 
 /*
  * Clear BSS first so that there are no surprises...
@@ -145,8 +149,6 @@ ENTRY(startup_32)
  * _brk_end is set up to point to the first "safe" location.
  * Mappings are created both at virtual address 0 (identity mapping)
  * and PAGE_OFFSET for up to _end.
- *
- * Note that the stack is not yet set up!
  */
 #ifdef CONFIG_X86_PAE
 
@@ -282,6 +284,9 @@ ENTRY(startup_32_smp)
         movl %eax,%es
         movl %eax,%fs
         movl %eax,%gs
+        movl pa(stack_start),%ecx
+        movl %eax,%ss
+        leal -__PAGE_OFFSET(%ecx),%esp
 #endif /* CONFIG_SMP */
 default_entry:
 
@@ -347,8 +352,8 @@ default_entry:
         movl %eax,%cr0          /* ..and set paging (PG) bit */
         ljmp $__BOOT_CS,$1f     /* Clear prefetch and normalize %eip */
 1:
-        /* Set up the stack pointer */
-        lss stack_start,%esp
+        /* Shift the stack pointer to a virtual address */
+        addl $__PAGE_OFFSET, %esp
 
 /*
  * Initialize eflags.  Some BIOS's leave bits like NT set.  This would
@@ -360,9 +365,7 @@ default_entry:
 
 #ifdef CONFIG_SMP
         cmpb $0, ready
-        jz  1f                          /* Initial CPU cleans BSS */
-        jmp checkCPUtype
-1:
+        jnz checkCPUtype
 #endif /* CONFIG_SMP */
 
 /*
@@ -470,14 +473,7 @@ is386:	movl $2,%ecx		# set MP
 
         cld                     # gcc2 wants the direction flag cleared at all times
         pushl $0                # fake return address for unwinder
-#ifdef CONFIG_SMP
-        movb ready, %cl
         movb $1, ready
-        cmpb $0,%cl             # the first CPU calls start_kernel
-        je   1f
-        movl (stack_start), %esp
-1:
-#endif /* CONFIG_SMP */
         jmp *(initial_code)
 
 /*
@@ -670,15 +666,15 @@ ENTRY(initial_page_table)
 #endif
 
 .data
+.balign 4
 ENTRY(stack_start)
         .long init_thread_union+THREAD_SIZE
-        .long __BOOT_DS
-
-ready:  .byte 0
 
 early_recursion_flag:
         .long 0
 
+ready:  .byte 0
+
 int_msg:
         .asciz "Unknown interrupt or fault at: %p %p %p\n"
 
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index 48ff6dcffa0..9974d21048f 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -129,8 +129,7 @@ void __cpuinit irq_ctx_init(int cpu)
         irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
                                                THREAD_FLAGS,
                                                THREAD_ORDER));
-        irqctx->tinfo.task              = NULL;
-        irqctx->tinfo.exec_domain       = NULL;
+        memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
         irqctx->tinfo.cpu               = cpu;
         irqctx->tinfo.preempt_count     = HARDIRQ_OFFSET;
         irqctx->tinfo.addr_limit        = MAKE_MM_SEG(0);
@@ -140,10 +139,8 @@ void __cpuinit irq_ctx_init(int cpu)
         irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
                                                THREAD_FLAGS,
                                                THREAD_ORDER));
-        irqctx->tinfo.task              = NULL;
-        irqctx->tinfo.exec_domain       = NULL;
+        memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
         irqctx->tinfo.cpu               = cpu;
-        irqctx->tinfo.preempt_count     = 0;
         irqctx->tinfo.addr_limit        = MAKE_MM_SEG(0);
 
         per_cpu(softirq_ctx, cpu) = irqctx;
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index d8286ed54ff..e764fc05d70 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -14,6 +14,7 @@
 #include <linux/utsname.h>
 #include <trace/events/power.h>
 #include <linux/hw_breakpoint.h>
+#include <asm/cpu.h>
 #include <asm/system.h>
 #include <asm/apic.h>
 #include <asm/syscalls.h>
@@ -505,7 +506,7 @@ static void poll_idle(void)
 #define MWAIT_ECX_EXTENDED_INFO         0x01
 #define MWAIT_EDX_C1                    0xf0
 
-static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
+int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
 {
         u32 eax, ebx, ecx, edx;
 
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 763df77343d..03273b6c272 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -638,7 +638,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
          * target processor state.
          */
         startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
-                         (unsigned long)stack_start.sp);
+                         stack_start);
 
         /*
          * Run STARTUP IPI loop.
@@ -785,7 +785,7 @@ do_rest:
 #endif
         early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
         initial_code = (unsigned long)start_secondary;
-        stack_start.sp = (void *) c_idle.idle->thread.sp;
+        stack_start  = c_idle.idle->thread.sp;
 
         /* start_ip had better be page-aligned! */
         start_ip = setup_trampoline();
@@ -1402,8 +1402,9 @@ static inline void mwait_play_dead(void)
         unsigned int highest_subcstate = 0;
         int i;
         void *mwait_ptr;
+        struct cpuinfo_x86 *c = __this_cpu_ptr(&cpu_info);
 
-        if (!cpu_has(__this_cpu_ptr(&cpu_info), X86_FEATURE_MWAIT))
+        if (!(cpu_has(c, X86_FEATURE_MWAIT) && mwait_usable(c)))
                 return;
         if (!cpu_has(__this_cpu_ptr(&cpu_info), X86_FEATURE_CLFLSH))
                 return;
diff --git a/arch/x86/lguest/Kconfig b/arch/x86/lguest/Kconfig
index 38718041efc..6e121a2a49e 100644
--- a/arch/x86/lguest/Kconfig
+++ b/arch/x86/lguest/Kconfig
@@ -2,6 +2,7 @@ config LGUEST_GUEST
         bool "Lguest guest support"
         select PARAVIRT
         depends on X86_32
+        select VIRTUALIZATION
         select VIRTIO
         select VIRTIO_RING
         select VIRTIO_CONSOLE
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 4996cf5f73a..eba687f0cc0 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -824,7 +824,7 @@ static void __init lguest_init_IRQ(void)
 
         for (i = FIRST_EXTERNAL_VECTOR; i < NR_VECTORS; i++) {
                 /* Some systems map "vectors" to interrupts weirdly.  Not us! */
-                __get_cpu_var(vector_irq)[i] = i - FIRST_EXTERNAL_VECTOR;
+                __this_cpu_write(vector_irq[i], i - FIRST_EXTERNAL_VECTOR);
                 if (i != SYSCALL_VECTOR)
                         set_intr_gate(i, interrupt[i - FIRST_EXTERNAL_VECTOR]);
         }
diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
index 787c52ca49c..ebf6d7887a3 100644
--- a/arch/x86/mm/numa.c
+++ b/arch/x86/mm/numa.c
@@ -2,6 +2,28 @@
 #include <linux/topology.h>
 #include <linux/module.h>
 #include <linux/bootmem.h>
+#include <asm/numa.h>
+#include <asm/acpi.h>
+
+int __initdata numa_off;
+
+static __init int numa_setup(char *opt)
+{
+        if (!opt)
+                return -EINVAL;
+        if (!strncmp(opt, "off", 3))
+                numa_off = 1;
+#ifdef CONFIG_NUMA_EMU
+        if (!strncmp(opt, "fake=", 5))
+                numa_emu_cmdline(opt + 5);
+#endif
+#ifdef CONFIG_ACPI_NUMA
+        if (!strncmp(opt, "noacpi", 6))
+                acpi_numa = -1;
+#endif
+        return 0;
+}
+early_param("numa", numa_setup);
 
 /*
  * Which logical CPUs are on which nodes
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index 1e72102e80c..95ea1551eeb 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -30,7 +30,6 @@ s16 apicid_to_node[MAX_LOCAL_APIC] __cpuinitdata = {
         [0 ... MAX_LOCAL_APIC-1] = NUMA_NO_NODE
 };
 
-int numa_off __initdata;
 static unsigned long __initdata nodemap_addr;
 static unsigned long __initdata nodemap_size;
 
@@ -263,6 +262,11 @@ static struct bootnode nodes[MAX_NUMNODES] __initdata;
 static struct bootnode physnodes[MAX_NUMNODES] __cpuinitdata;
 static char *cmdline __initdata;
 
+void __init numa_emu_cmdline(char *str)
+{
+        cmdline = str;
+}
+
 static int __init setup_physnodes(unsigned long start, unsigned long end,
                                         int acpi, int amd)
 {
@@ -670,24 +674,6 @@ unsigned long __init numa_free_all_bootmem(void)
         return pages;
 }
 
-static __init int numa_setup(char *opt)
-{
-        if (!opt)
-                return -EINVAL;
-        if (!strncmp(opt, "off", 3))
-                numa_off = 1;
-#ifdef CONFIG_NUMA_EMU
-        if (!strncmp(opt, "fake=", 5))
-                cmdline = opt + 5;
-#endif
-#ifdef CONFIG_ACPI_NUMA
-        if (!strncmp(opt, "noacpi", 6))
-                acpi_numa = -1;
-#endif
-        return 0;
-}
-early_param("numa", numa_setup);
-
 #ifdef CONFIG_NUMA
 
 static __init int find_near_online_node(int node)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 8b830ca14ac..d343b3c81f3 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -256,7 +256,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
                                    unsigned long pfn)
 {
         pgprot_t forbidden = __pgprot(0);
-        pgprot_t required = __pgprot(0);
 
         /*
          * The BIOS area between 640k and 1Mb needs to be executable for
@@ -282,12 +281,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
         if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
                    __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
                 pgprot_val(forbidden) |= _PAGE_RW;
-        /*
-         * .data and .bss should always be writable.
-         */
-        if (within(address, (unsigned long)_sdata, (unsigned long)_edata) ||
-            within(address, (unsigned long)__bss_start, (unsigned long)__bss_stop))
-                pgprot_val(required) |= _PAGE_RW;
 
 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
         /*
@@ -327,7 +320,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
 #endif
 
         prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
-        prot = __pgprot(pgprot_val(prot) | pgprot_val(required));
 
         return prot;
 }
diff --git a/arch/x86/mm/srat_32.c b/arch/x86/mm/srat_32.c
index f16434568a5..ae96e7b8051 100644
--- a/arch/x86/mm/srat_32.c
+++ b/arch/x86/mm/srat_32.c
@@ -59,7 +59,6 @@ static struct node_memory_chunk_s __initdata node_memory_chunk[MAXCHUNKS];
 static int __initdata num_memory_chunks; /* total number of memory chunks */
 static u8 __initdata apicid_to_pxm[MAX_APICID];
 
-int numa_off __initdata;
 int acpi_numa __initdata;
 
 static __init void bad_srat(void)
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 7e8d3bc80af..50542efe45f 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1194,7 +1194,7 @@ asmlinkage void __init xen_start_kernel(void)
         per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
 
         local_irq_disable();
-        early_boot_irqs_off();
+        early_boot_irqs_disabled = true;
 
         memblock_init();
 
diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c
index 9d30105a0c4..6a6fe893964 100644
--- a/arch/x86/xen/irq.c
+++ b/arch/x86/xen/irq.c
@@ -126,7 +126,7 @@ static const struct pv_irq_ops xen_irq_ops __initdata = {
 #endif
 };
 
-void __init xen_init_irq_ops()
+void __init xen_init_irq_ops(void)
 {
         pv_irq_ops = xen_irq_ops;
         x86_init.irqs.intr_init = xen_init_IRQ;
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 8f2251d2a3f..fd12d7ce7ff 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -237,6 +237,18 @@ void __init xen_build_dynamic_phys_to_machine(void)
                         p2m_top[topidx] = mid;
                 }
 
+                /*
+                 * As long as the mfn_list has enough entries to completely
+                 * fill a p2m page, pointing into the array is ok. But if
+                 * not the entries beyond the last pfn will be undefined.
+                 */
+                if (unlikely(pfn + P2M_PER_PAGE > max_pfn)) {
+                        unsigned long p2midx;
+
+                        p2midx = max_pfn % P2M_PER_PAGE;
+                        for ( ; p2midx < P2M_PER_PAGE; p2midx++)
+                                mfn_list[pfn + p2midx] = INVALID_P2M_ENTRY;
+                }
                 p2m_top[topidx][mididx] = &mfn_list[pfn];
         }
 
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index b5a7f928234..a8a66a50d44 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -179,8 +179,13 @@ char * __init xen_memory_setup(void)
         e820.nr_map = 0;
         xen_extra_mem_start = mem_end;
         for (i = 0; i < memmap.nr_entries; i++) {
-                unsigned long long end = map[i].addr + map[i].size;
+                unsigned long long end;
 
+                /* Guard against non-page aligned E820 entries. */
+                if (map[i].type == E820_RAM)
+                        map[i].size -= (map[i].size + map[i].addr) % PAGE_SIZE;
+
+                end = map[i].addr + map[i].size;
                 if (map[i].type == E820_RAM && end > mem_end) {
                         /* RAM off the end - may be partially included */
                         u64 delta = min(map[i].size, end - mem_end);
@@ -350,6 +355,7 @@ void __init xen_arch_setup(void)
         boot_cpu_data.hlt_works_ok = 1;
 #endif
         pm_idle = default_idle;
+        boot_option_idle_override = IDLE_HALT;
 
         fiddle_vdso();
 }
diff --git a/arch/xtensa/configs/common_defconfig b/arch/xtensa/configs/common_defconfig
index 1d230ee081b..b90038e40dd 100644
--- a/arch/xtensa/configs/common_defconfig
+++ b/arch/xtensa/configs/common_defconfig
@@ -32,7 +32,7 @@ CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_HOTPLUG is not set
 CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
-# CONFIG_EMBEDDED is not set
+# CONFIG_EXPERT is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
diff --git a/arch/xtensa/configs/iss_defconfig b/arch/xtensa/configs/iss_defconfig
index 7368164843b..0234cd198c5 100644
--- a/arch/xtensa/configs/iss_defconfig
+++ b/arch/xtensa/configs/iss_defconfig
@@ -55,7 +55,7 @@ CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_SYSCTL=y
 CONFIG_ANON_INODES=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
diff --git a/arch/xtensa/configs/s6105_defconfig b/arch/xtensa/configs/s6105_defconfig
index bb84fbc9921..095cd808416 100644
--- a/arch/xtensa/configs/s6105_defconfig
+++ b/arch/xtensa/configs/s6105_defconfig
@@ -55,7 +55,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
-CONFIG_EMBEDDED=y
+CONFIG_EXPERT=y
 CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
diff --git a/block/Kconfig b/block/Kconfig
index 6c9213ef15a..60be1e0455d 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -2,7 +2,7 @@
 # Block layer core configuration
 #
 menuconfig BLOCK
-       bool "Enable the block layer" if EMBEDDED
+       bool "Enable the block layer" if EXPERT
        default y
        help
          Provide block layer support for the kernel.
diff --git a/drivers/Makefile b/drivers/Makefile
index 7eb35f47946..b423bb16c3a 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -24,7 +24,7 @@ obj-$(CONFIG_XEN)		+= xen/
 # regulators early, since some subsystems rely on them to initialize
 obj-$(CONFIG_REGULATOR)         += regulator/
 
-# char/ comes before serial/ etc so that the VT console is the boot-time
+# tty/ comes before char/ so that the VT console is the boot-time
 # default.
 obj-y                           += tty/
 obj-y                           += char/
@@ -38,7 +38,6 @@ obj-$(CONFIG_CONNECTOR)		+= connector/
 obj-$(CONFIG_FB_I810)           += video/i810/
 obj-$(CONFIG_FB_INTEL)          += video/intelfb/
 
-obj-y                           += serial/
 obj-$(CONFIG_PARPORT)           += parport/
 obj-y                           += base/ block/ misc/ mfd/ nfc/
 obj-$(CONFIG_NUBUS)             += nubus/
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 10c7ad59c0e..2aa042a5da6 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -318,7 +318,7 @@ config ACPI_PCI_SLOT
           the module will be called pci_slot.
 
 config X86_PM_TIMER
-        bool "Power Management Timer Support" if EMBEDDED
+        bool "Power Management Timer Support" if EXPERT
         depends on X86
         default y
         help
diff --git a/drivers/acpi/acpica/accommon.h b/drivers/acpi/acpica/accommon.h
index 3e50c74ed4a..e0ba17f0a7c 100644
--- a/drivers/acpi/acpica/accommon.h
+++ b/drivers/acpi/acpica/accommon.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acconfig.h b/drivers/acpi/acpica/acconfig.h
index b17d8de9f6f..ab87396c2c0 100644
--- a/drivers/acpi/acpica/acconfig.h
+++ b/drivers/acpi/acpica/acconfig.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acdebug.h b/drivers/acpi/acpica/acdebug.h
index 72e9d5eb083..eb0b1f8dee6 100644
--- a/drivers/acpi/acpica/acdebug.h
+++ b/drivers/acpi/acpica/acdebug.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acdispat.h b/drivers/acpi/acpica/acdispat.h
index 894a0ff2a94..666271b6541 100644
--- a/drivers/acpi/acpica/acdispat.h
+++ b/drivers/acpi/acpica/acdispat.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acevents.h b/drivers/acpi/acpica/acevents.h
index 70e0b28801a..41d247daf46 100644
--- a/drivers/acpi/acpica/acevents.h
+++ b/drivers/acpi/acpica/acevents.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
index 0e4dba0d032..82a1bd283db 100644
--- a/drivers/acpi/acpica/acglobal.h
+++ b/drivers/acpi/acpica/acglobal.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h
index 258d628793e..e7213beaafc 100644
--- a/drivers/acpi/acpica/achware.h
+++ b/drivers/acpi/acpica/achware.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acinterp.h b/drivers/acpi/acpica/acinterp.h
index 049e203bd62..3731e1c34b8 100644
--- a/drivers/acpi/acpica/acinterp.h
+++ b/drivers/acpi/acpica/acinterp.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 74000f5b7da..54784bb42ce 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
index 8d5c9e0a495..b7491ee1fba 100644
--- a/drivers/acpi/acpica/acmacros.h
+++ b/drivers/acpi/acpica/acmacros.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acnamesp.h b/drivers/acpi/acpica/acnamesp.h
index d44d3bc5b84..79a598c67fe 100644
--- a/drivers/acpi/acpica/acnamesp.h
+++ b/drivers/acpi/acpica/acnamesp.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acobject.h b/drivers/acpi/acpica/acobject.h
index 962a3ccff6f..1055769f2f0 100644
--- a/drivers/acpi/acpica/acobject.h
+++ b/drivers/acpi/acpica/acobject.h
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -97,8 +97,6 @@
 #define AOPOBJ_OBJECT_INITIALIZED   0x08        /* Region is initialized, _REG was run */
 #define AOPOBJ_SETUP_COMPLETE       0x10        /* Region setup is complete */
 #define AOPOBJ_INVALID              0x20        /* Host OS won't allow a Region address */
-#define AOPOBJ_MODULE_LEVEL         0x40        /* Method is actually module-level code */
-#define AOPOBJ_MODIFIED_NAMESPACE   0x80        /* Method modified the namespace */
 
 /******************************************************************************
  *
@@ -175,7 +173,7 @@ struct acpi_object_region {
 };
 
 struct acpi_object_method {
-        ACPI_OBJECT_COMMON_HEADER u8 method_flags;
+        ACPI_OBJECT_COMMON_HEADER u8 info_flags;
         u8 param_count;
         u8 sync_level;
         union acpi_operand_object *mutex;
@@ -183,13 +181,21 @@ struct acpi_object_method {
         union {
                 ACPI_INTERNAL_METHOD implementation;
                 union acpi_operand_object *handler;
-        } extra;
+        } dispatch;
 
         u32 aml_length;
         u8 thread_count;
         acpi_owner_id owner_id;
 };
 
+/* Flags for info_flags field above */
+
+#define ACPI_METHOD_MODULE_LEVEL        0x01    /* Method is actually module-level code */
+#define ACPI_METHOD_INTERNAL_ONLY       0x02    /* Method is implemented internally (_OSI) */
+#define ACPI_METHOD_SERIALIZED          0x04    /* Method is serialized */
+#define ACPI_METHOD_SERIALIZED_PENDING  0x08    /* Method is to be marked serialized */
+#define ACPI_METHOD_MODIFIED_NAMESPACE  0x10    /* Method modified the namespace */
+
 /******************************************************************************
  *
  * Objects that can be notified.  All share a common notify_info area.
diff --git a/drivers/acpi/acpica/acopcode.h b/drivers/acpi/acpica/acopcode.h
index 8c15ff43f42..bb2ccfad737 100644
--- a/drivers/acpi/acpica/acopcode.h
+++ b/drivers/acpi/acpica/acopcode.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acparser.h b/drivers/acpi/acpica/acparser.h
index d0bb0fd3e57..5ea1e06afa2 100644
--- a/drivers/acpi/acpica/acparser.h
+++ b/drivers/acpi/acpica/acparser.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acpredef.h b/drivers/acpi/acpica/acpredef.h
index 10998d369ad..94e73c97cf8 100644
--- a/drivers/acpi/acpica/acpredef.h
+++ b/drivers/acpi/acpica/acpredef.h
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acresrc.h b/drivers/acpi/acpica/acresrc.h
index 528bcbaf4ce..f08b55b7f3a 100644
--- a/drivers/acpi/acpica/acresrc.h
+++ b/drivers/acpi/acpica/acresrc.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acstruct.h b/drivers/acpi/acpica/acstruct.h
index 6e5dd97949f..1623b245dde 100644
--- a/drivers/acpi/acpica/acstruct.h
+++ b/drivers/acpi/acpica/acstruct.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/actables.h b/drivers/acpi/acpica/actables.h
index 62a576e3436..967f08124eb 100644
--- a/drivers/acpi/acpica/actables.h
+++ b/drivers/acpi/acpica/actables.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/acutils.h b/drivers/acpi/acpica/acutils.h
index 72e4183c193..99c140d8e34 100644
--- a/drivers/acpi/acpica/acutils.h
+++ b/drivers/acpi/acpica/acutils.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/amlcode.h b/drivers/acpi/acpica/amlcode.h
index 1f484ba228f..f4f0998d396 100644
--- a/drivers/acpi/acpica/amlcode.h
+++ b/drivers/acpi/acpica/amlcode.h
@@ -7,7 +7,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -480,16 +480,10 @@ typedef enum {
         AML_FIELD_ATTRIB_SMB_BLOCK_CALL = 0x0D
 } AML_ACCESS_ATTRIBUTE;
 
-/* Bit fields in method_flags byte */
+/* Bit fields in the AML method_flags byte */
 
 #define AML_METHOD_ARG_COUNT        0x07
 #define AML_METHOD_SERIALIZED       0x08
 #define AML_METHOD_SYNC_LEVEL       0xF0
 
-/* METHOD_FLAGS_ARG_COUNT is not used internally, define additional flags */
-
-#define AML_METHOD_INTERNAL_ONLY    0x01
-#define AML_METHOD_RESERVED1        0x02
-#define AML_METHOD_RESERVED2        0x04
-
 #endif                          /* __AMLCODE_H__ */
diff --git a/drivers/acpi/acpica/amlresrc.h b/drivers/acpi/acpica/amlresrc.h
index 0e5798fcbb1..59122cde247 100644
--- a/drivers/acpi/acpica/amlresrc.h
+++ b/drivers/acpi/acpica/amlresrc.h
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dsfield.c b/drivers/acpi/acpica/dsfield.c
index 347bee1726f..34be60c0e44 100644
--- a/drivers/acpi/acpica/dsfield.c
+++ b/drivers/acpi/acpica/dsfield.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dsinit.c b/drivers/acpi/acpica/dsinit.c
index cc4a38c5755..a7718bf2b9a 100644
--- a/drivers/acpi/acpica/dsinit.c
+++ b/drivers/acpi/acpica/dsinit.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index d94dd8974b5..5d797751e20 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -43,7 +43,6 @@
 
 #include <acpi/acpi.h>
 #include "accommon.h"
-#include "amlcode.h"
 #include "acdispat.h"
 #include "acinterp.h"
 #include "acnamesp.h"
@@ -201,7 +200,7 @@ acpi_ds_begin_method_execution(struct acpi_namespace_node *method_node,
         /*
          * If this method is serialized, we need to acquire the method mutex.
          */
-        if (obj_desc->method.method_flags & AML_METHOD_SERIALIZED) {
+        if (obj_desc->method.info_flags & ACPI_METHOD_SERIALIZED) {
                 /*
                  * Create a mutex for the method if it is defined to be Serialized
                  * and a mutex has not already been created. We defer the mutex creation
@@ -413,8 +412,9 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
 
         /* Invoke an internal method if necessary */
 
-        if (obj_desc->method.method_flags & AML_METHOD_INTERNAL_ONLY) {
-                status = obj_desc->method.extra.implementation(next_walk_state);
+        if (obj_desc->method.info_flags & ACPI_METHOD_INTERNAL_ONLY) {
+                status =
+                    obj_desc->method.dispatch.implementation(next_walk_state);
                 if (status == AE_OK) {
                         status = AE_CTRL_TERMINATE;
                 }
@@ -579,11 +579,14 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
 
                 /*
                  * Delete any namespace objects created anywhere within the
-                 * namespace by the execution of this method. Unless this method
-                 * is a module-level executable code method, in which case we
-                 * want make the objects permanent.
+                 * namespace by the execution of this method. Unless:
+                 * 1) This method is a module-level executable code method, in which
+                 *    case we want make the objects permanent.
+                 * 2) There are other threads executing the method, in which case we
+                 *    will wait until the last thread has completed.
                  */
-                if (!(method_desc->method.flags & AOPOBJ_MODULE_LEVEL)) {
+                if (!(method_desc->method.info_flags & ACPI_METHOD_MODULE_LEVEL)
+                    && (method_desc->method.thread_count == 1)) {
 
                         /* Delete any direct children of (created by) this method */
 
@@ -593,12 +596,17 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
                         /*
                          * Delete any objects that were created by this method
                          * elsewhere in the namespace (if any were created).
+                         * Use of the ACPI_METHOD_MODIFIED_NAMESPACE optimizes the
+                         * deletion such that we don't have to perform an entire
+                         * namespace walk for every control method execution.
                          */
                         if (method_desc->method.
-                            flags & AOPOBJ_MODIFIED_NAMESPACE) {
+                            info_flags & ACPI_METHOD_MODIFIED_NAMESPACE) {
                                 acpi_ns_delete_namespace_by_owner(method_desc->
                                                                   method.
                                                                   owner_id);
+                                method_desc->method.info_flags &=
+                                    ~ACPI_METHOD_MODIFIED_NAMESPACE;
                         }
                 }
         }
@@ -629,19 +637,43 @@ acpi_ds_terminate_control_method(union acpi_operand_object *method_desc,
                  * Serialized if it appears that the method is incorrectly written and
                  * does not support multiple thread execution. The best example of this
                  * is if such a method creates namespace objects and blocks. A second
-                 * thread will fail with an AE_ALREADY_EXISTS exception
+                 * thread will fail with an AE_ALREADY_EXISTS exception.
                  *
                  * This code is here because we must wait until the last thread exits
-                 * before creating the synchronization semaphore.
+                 * before marking the method as serialized.
                  */
-                if ((method_desc->method.method_flags & AML_METHOD_SERIALIZED)
-                    && (!method_desc->method.mutex)) {
-                        (void)acpi_ds_create_method_mutex(method_desc);
+                if (method_desc->method.
+                    info_flags & ACPI_METHOD_SERIALIZED_PENDING) {
+                        if (walk_state) {
+                                ACPI_INFO((AE_INFO,
+                                           "Marking method %4.4s as Serialized because of AE_ALREADY_EXISTS error",
+                                           walk_state->method_node->name.
+                                           ascii));
+                        }
+
+                        /*
+                         * Method tried to create an object twice and was marked as
+                         * "pending serialized". The probable cause is that the method
+                         * cannot handle reentrancy.
+                         *
+                         * The method was created as not_serialized, but it tried to create
+                         * a named object and then blocked, causing the second thread
+                         * entrance to begin and then fail. Workaround this problem by
+                         * marking the method permanently as Serialized when the last
+                         * thread exits here.
+                         */
+                        method_desc->method.info_flags &=
+                            ~ACPI_METHOD_SERIALIZED_PENDING;
+                        method_desc->method.info_flags |=
+                            ACPI_METHOD_SERIALIZED;
+                        method_desc->method.sync_level = 0;
                 }
 
                 /* No more threads, we can free the owner_id */
 
-                if (!(method_desc->method.flags & AOPOBJ_MODULE_LEVEL)) {
+                if (!
+                    (method_desc->method.
+                     info_flags & ACPI_METHOD_MODULE_LEVEL)) {
                         acpi_ut_release_owner_id(&method_desc->method.owner_id);
                 }
         }
diff --git a/drivers/acpi/acpica/dsmthdat.c b/drivers/acpi/acpica/dsmthdat.c
index 8095306fcd8..905ce29a92e 100644
--- a/drivers/acpi/acpica/dsmthdat.c
+++ b/drivers/acpi/acpica/dsmthdat.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dsobject.c b/drivers/acpi/acpica/dsobject.c
index 8e85f54a8e0..f42e17e5c25 100644
--- a/drivers/acpi/acpica/dsobject.c
+++ b/drivers/acpi/acpica/dsobject.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
index 7c0e7422717..bbecf293aee 100644
--- a/drivers/acpi/acpica/dsopcode.c
+++ b/drivers/acpi/acpica/dsopcode.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c
index 15135c25aa9..2c477ce172f 100644
--- a/drivers/acpi/acpica/dsutils.c
+++ b/drivers/acpi/acpica/dsutils.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dswexec.c b/drivers/acpi/acpica/dswexec.c
index 6b0b5d08d97..fe40e4c6554 100644
--- a/drivers/acpi/acpica/dswexec.c
+++ b/drivers/acpi/acpica/dswexec.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dswload.c b/drivers/acpi/acpica/dswload.c
index 140a9d00295..52566ff5e90 100644
--- a/drivers/acpi/acpica/dswload.c
+++ b/drivers/acpi/acpica/dswload.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dswscope.c b/drivers/acpi/acpica/dswscope.c
index d1e701709da..76a661fc1e0 100644
--- a/drivers/acpi/acpica/dswscope.c
+++ b/drivers/acpi/acpica/dswscope.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/dswstate.c b/drivers/acpi/acpica/dswstate.c
index 83155dd8671..a6c374ef991 100644
--- a/drivers/acpi/acpica/dswstate.c
+++ b/drivers/acpi/acpica/dswstate.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evevent.c b/drivers/acpi/acpica/evevent.c
index e5e313c663a..d458b041e65 100644
--- a/drivers/acpi/acpica/evevent.c
+++ b/drivers/acpi/acpica/evevent.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index 7c339d34ab4..14988a86066 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -471,6 +471,7 @@ static void ACPI_SYSTEM_XFACE acpi_ev_asynch_execute_gpe_method(void *context)
 
         status = acpi_ut_acquire_mutex(ACPI_MTX_EVENTS);
         if (ACPI_FAILURE(status)) {
+                ACPI_FREE(local_gpe_event_info);
                 return_VOID;
         }
 
@@ -478,6 +479,7 @@ static void ACPI_SYSTEM_XFACE acpi_ev_asynch_execute_gpe_method(void *context)
 
         if (!acpi_ev_valid_gpe_event(gpe_event_info)) {
                 status = acpi_ut_release_mutex(ACPI_MTX_EVENTS);
+                ACPI_FREE(local_gpe_event_info);
                 return_VOID;
         }
 
diff --git a/drivers/acpi/acpica/evgpeblk.c b/drivers/acpi/acpica/evgpeblk.c
index 9acb86958c0..ca2c41a5331 100644
--- a/drivers/acpi/acpica/evgpeblk.c
+++ b/drivers/acpi/acpica/evgpeblk.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evgpeinit.c b/drivers/acpi/acpica/evgpeinit.c
index c59dc234059..ce9aa9f9a97 100644
--- a/drivers/acpi/acpica/evgpeinit.c
+++ b/drivers/acpi/acpica/evgpeinit.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evgpeutil.c b/drivers/acpi/acpica/evgpeutil.c
index 10e477494dc..80a81d0c4a8 100644
--- a/drivers/acpi/acpica/evgpeutil.c
+++ b/drivers/acpi/acpica/evgpeutil.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evmisc.c b/drivers/acpi/acpica/evmisc.c
index 38bba66fcce..7dc80946f7b 100644
--- a/drivers/acpi/acpica/evmisc.c
+++ b/drivers/acpi/acpica/evmisc.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
index 98fd210e87b..785a5ee6458 100644
--- a/drivers/acpi/acpica/evregion.c
+++ b/drivers/acpi/acpica/evregion.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evrgnini.c b/drivers/acpi/acpica/evrgnini.c
index 0b47a6dc929..9659cee6093 100644
--- a/drivers/acpi/acpica/evrgnini.c
+++ b/drivers/acpi/acpica/evrgnini.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -590,9 +590,9 @@ acpi_ev_initialize_region(union acpi_operand_object *region_obj,
                                  * See acpi_ns_exec_module_code
                                  */
                                 if (obj_desc->method.
-                                    flags & AOPOBJ_MODULE_LEVEL) {
+                                    info_flags & ACPI_METHOD_MODULE_LEVEL) {
                                         handler_obj =
-                                            obj_desc->method.extra.handler;
+                                            obj_desc->method.dispatch.handler;
                                 }
                                 break;
 
diff --git a/drivers/acpi/acpica/evsci.c b/drivers/acpi/acpica/evsci.c
index 8dfbaa96e42..2ebd40e1a3e 100644
--- a/drivers/acpi/acpica/evsci.c
+++ b/drivers/acpi/acpica/evsci.c
@@ -6,7 +6,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evxface.c b/drivers/acpi/acpica/evxface.c
index 1226689bdb1..e1141402dbe 100644
--- a/drivers/acpi/acpica/evxface.c
+++ b/drivers/acpi/acpica/evxface.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evxfevnt.c b/drivers/acpi/acpica/evxfevnt.c
index 90488c1e0f3..c57b5c707a7 100644
--- a/drivers/acpi/acpica/evxfevnt.c
+++ b/drivers/acpi/acpica/evxfevnt.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evxfgpe.c b/drivers/acpi/acpica/evxfgpe.c
index 416845bc9c1..e9562a7cb2f 100644
--- a/drivers/acpi/acpica/evxfgpe.c
+++ b/drivers/acpi/acpica/evxfgpe.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/evxfregn.c b/drivers/acpi/acpica/evxfregn.c
index ce9314f7945..eb738676371 100644
--- a/drivers/acpi/acpica/evxfregn.c
+++ b/drivers/acpi/acpica/evxfregn.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index 18832205b63..745a42b401f 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exconvrt.c b/drivers/acpi/acpica/exconvrt.c
index b73bc50c5b7..74162a11817 100644
--- a/drivers/acpi/acpica/exconvrt.c
+++ b/drivers/acpi/acpica/exconvrt.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/excreate.c b/drivers/acpi/acpica/excreate.c
index 3c61b48c73f..e7b372d1766 100644
--- a/drivers/acpi/acpica/excreate.c
+++ b/drivers/acpi/acpica/excreate.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -482,13 +482,11 @@ acpi_ex_create_method(u8 * aml_start,
         obj_desc->method.aml_length = aml_length;
 
         /*
-         * Disassemble the method flags. Split off the Arg Count
-         * for efficiency
+         * Disassemble the method flags. Split off the arg_count, Serialized
+         * flag, and sync_level for efficiency.
          */
         method_flags = (u8) operand[1]->integer.value;
 
-        obj_desc->method.method_flags =
-            (u8) (method_flags & ~AML_METHOD_ARG_COUNT);
         obj_desc->method.param_count =
             (u8) (method_flags & AML_METHOD_ARG_COUNT);
 
@@ -497,6 +495,8 @@ acpi_ex_create_method(u8 * aml_start,
          * created for this method when it is parsed.
          */
         if (method_flags & AML_METHOD_SERIALIZED) {
+                obj_desc->method.info_flags = ACPI_METHOD_SERIALIZED;
+
                 /*
                  * ACPI 1.0: sync_level = 0
                  * ACPI 2.0: sync_level = sync_level in method declaration
diff --git a/drivers/acpi/acpica/exdebug.c b/drivers/acpi/acpica/exdebug.c
index be8c98b480d..c7a2f1edd28 100644
--- a/drivers/acpi/acpica/exdebug.c
+++ b/drivers/acpi/acpica/exdebug.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c
index f067bbb0d96..61b8c0e8b74 100644
--- a/drivers/acpi/acpica/exdump.c
+++ b/drivers/acpi/acpica/exdump.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -122,7 +122,7 @@ static struct acpi_exdump_info acpi_ex_dump_event[2] = {
 
 static struct acpi_exdump_info acpi_ex_dump_method[9] = {
         {ACPI_EXD_INIT, ACPI_EXD_TABLE_SIZE(acpi_ex_dump_method), NULL},
-        {ACPI_EXD_UINT8, ACPI_EXD_OFFSET(method.method_flags), "Method Flags"},
+        {ACPI_EXD_UINT8, ACPI_EXD_OFFSET(method.info_flags), "Info Flags"},
         {ACPI_EXD_UINT8, ACPI_EXD_OFFSET(method.param_count),
          "Parameter Count"},
         {ACPI_EXD_UINT8, ACPI_EXD_OFFSET(method.sync_level), "Sync Level"},
diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c
index f17d2ff0031..0bde2230c02 100644
--- a/drivers/acpi/acpica/exfield.c
+++ b/drivers/acpi/acpica/exfield.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
index 38293fd3e08..6c79c29f082 100644
--- a/drivers/acpi/acpica/exfldio.c
+++ b/drivers/acpi/acpica/exfldio.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exmisc.c b/drivers/acpi/acpica/exmisc.c
index 95db4be0877..703d88ed0b3 100644
--- a/drivers/acpi/acpica/exmisc.c
+++ b/drivers/acpi/acpica/exmisc.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exmutex.c b/drivers/acpi/acpica/exmutex.c
index 6af14e43f83..be1c56ead65 100644
--- a/drivers/acpi/acpica/exmutex.c
+++ b/drivers/acpi/acpica/exmutex.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exnames.c b/drivers/acpi/acpica/exnames.c
index d11e539ef76..49ec049c157 100644
--- a/drivers/acpi/acpica/exnames.c
+++ b/drivers/acpi/acpica/exnames.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
index 84e4d185aa2..236ead14b7f 100644
--- a/drivers/acpi/acpica/exoparg1.c
+++ b/drivers/acpi/acpica/exoparg1.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exoparg2.c b/drivers/acpi/acpica/exoparg2.c
index 10e104cf0fb..2571b4a310f 100644
--- a/drivers/acpi/acpica/exoparg2.c
+++ b/drivers/acpi/acpica/exoparg2.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
index 7a08d23befc..1b48d9d28c9 100644
--- a/drivers/acpi/acpica/exoparg3.c
+++ b/drivers/acpi/acpica/exoparg3.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exoparg6.c b/drivers/acpi/acpica/exoparg6.c
index 4b50730cf9a..f4a2787e8e9 100644
--- a/drivers/acpi/acpica/exoparg6.c
+++ b/drivers/acpi/acpica/exoparg6.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c
index 7aae29f73d3..cc95e200040 100644
--- a/drivers/acpi/acpica/exprep.c
+++ b/drivers/acpi/acpica/exprep.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c
index de17e10da0e..f0d5e14f1f2 100644
--- a/drivers/acpi/acpica/exregion.c
+++ b/drivers/acpi/acpica/exregion.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exresnte.c b/drivers/acpi/acpica/exresnte.c
index 1fa4289a687..55997e46948 100644
--- a/drivers/acpi/acpica/exresnte.c
+++ b/drivers/acpi/acpica/exresnte.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exresolv.c b/drivers/acpi/acpica/exresolv.c
index 7ca35ea8ace..db502cd7d93 100644
--- a/drivers/acpi/acpica/exresolv.c
+++ b/drivers/acpi/acpica/exresolv.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exresop.c b/drivers/acpi/acpica/exresop.c
index 8c97cfd6a0f..e3bb00ccdff 100644
--- a/drivers/acpi/acpica/exresop.c
+++ b/drivers/acpi/acpica/exresop.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exstore.c b/drivers/acpi/acpica/exstore.c
index 1624436ba4c..c0c8842dd34 100644
--- a/drivers/acpi/acpica/exstore.c
+++ b/drivers/acpi/acpica/exstore.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exstoren.c b/drivers/acpi/acpica/exstoren.c
index d4af684620c..a979017d56b 100644
--- a/drivers/acpi/acpica/exstoren.c
+++ b/drivers/acpi/acpica/exstoren.c
@@ -7,7 +7,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exstorob.c b/drivers/acpi/acpica/exstorob.c
index e972b667b09..dc665cc554d 100644
--- a/drivers/acpi/acpica/exstorob.c
+++ b/drivers/acpi/acpica/exstorob.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exsystem.c b/drivers/acpi/acpica/exsystem.c
index 675aaa91a77..df66e7b686b 100644
--- a/drivers/acpi/acpica/exsystem.c
+++ b/drivers/acpi/acpica/exsystem.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/exutils.c b/drivers/acpi/acpica/exutils.c
index 4093522eed4..8ad93146dd3 100644
--- a/drivers/acpi/acpica/exutils.c
+++ b/drivers/acpi/acpica/exutils.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/hwacpi.c b/drivers/acpi/acpica/hwacpi.c
index b44274a0b62..fc380d3d45a 100644
--- a/drivers/acpi/acpica/hwacpi.c
+++ b/drivers/acpi/acpica/hwacpi.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/hwgpe.c b/drivers/acpi/acpica/hwgpe.c
index 85c3cbd4304..f610d88a66b 100644
--- a/drivers/acpi/acpica/hwgpe.c
+++ b/drivers/acpi/acpica/hwgpe.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/hwpci.c b/drivers/acpi/acpica/hwpci.c
index ad21c7d8bf4..050fd227951 100644
--- a/drivers/acpi/acpica/hwpci.c
+++ b/drivers/acpi/acpica/hwpci.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/hwregs.c b/drivers/acpi/acpica/hwregs.c
index 5d1273b660a..55accb7018b 100644
--- a/drivers/acpi/acpica/hwregs.c
+++ b/drivers/acpi/acpica/hwregs.c
@@ -7,7 +7,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c
index 3796811276a..2ac28bbe882 100644
--- a/drivers/acpi/acpica/hwsleep.c
+++ b/drivers/acpi/acpica/hwsleep.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/hwtimer.c b/drivers/acpi/acpica/hwtimer.c
index 1ef8e0bb250..9c8eb71a12f 100644
--- a/drivers/acpi/acpica/hwtimer.c
+++ b/drivers/acpi/acpica/hwtimer.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
index e1d9c777b21..5f160587465 100644
--- a/drivers/acpi/acpica/hwvalid.c
+++ b/drivers/acpi/acpica/hwvalid.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/hwxface.c b/drivers/acpi/acpica/hwxface.c
index 50cc3be7772..6f98d210e71 100644
--- a/drivers/acpi/acpica/hwxface.c
+++ b/drivers/acpi/acpica/hwxface.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsaccess.c b/drivers/acpi/acpica/nsaccess.c
index 0cd925be5fc..d93172fd15a 100644
--- a/drivers/acpi/acpica/nsaccess.c
+++ b/drivers/acpi/acpica/nsaccess.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -163,9 +163,9 @@ acpi_status acpi_ns_root_initialize(void)
 #else
                                 /* Mark this as a very SPECIAL method */
 
-                                obj_desc->method.method_flags =
-                                    AML_METHOD_INTERNAL_ONLY;
-                                obj_desc->method.extra.implementation =
+                                obj_desc->method.info_flags =
+                                    ACPI_METHOD_INTERNAL_ONLY;
+                                obj_desc->method.dispatch.implementation =
                                     acpi_ut_osi_implementation;
 #endif
                                 break;
diff --git a/drivers/acpi/acpica/nsalloc.c b/drivers/acpi/acpica/nsalloc.c
index 1e5ff803d9a..1d0ef15d158 100644
--- a/drivers/acpi/acpica/nsalloc.c
+++ b/drivers/acpi/acpica/nsalloc.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -234,8 +234,8 @@ void acpi_ns_install_node(struct acpi_walk_state *walk_state, struct acpi_namesp
                          * modified the namespace. This is used for cleanup when the
                          * method exits.
                          */
-                        walk_state->method_desc->method.flags |=
-                            AOPOBJ_MODIFIED_NAMESPACE;
+                        walk_state->method_desc->method.info_flags |=
+                            ACPI_METHOD_MODIFIED_NAMESPACE;
                 }
         }
 
@@ -341,6 +341,7 @@ void acpi_ns_delete_namespace_subtree(struct acpi_namespace_node *parent_node)
 {
         struct acpi_namespace_node *child_node = NULL;
         u32 level = 1;
+        acpi_status status;
 
         ACPI_FUNCTION_TRACE(ns_delete_namespace_subtree);
 
@@ -348,6 +349,13 @@ void acpi_ns_delete_namespace_subtree(struct acpi_namespace_node *parent_node)
                 return_VOID;
         }
 
+        /* Lock namespace for possible update */
+
+        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+        if (ACPI_FAILURE(status)) {
+                return_VOID;
+        }
+
         /*
          * Traverse the tree of objects until we bubble back up
          * to where we started.
@@ -397,6 +405,7 @@ void acpi_ns_delete_namespace_subtree(struct acpi_namespace_node *parent_node)
                 }
         }
 
+        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return_VOID;
 }
 
diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
index a54dc39e304..b683cc2ff9d 100644
--- a/drivers/acpi/acpica/nsdump.c
+++ b/drivers/acpi/acpica/nsdump.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -624,9 +624,22 @@ acpi_ns_dump_objects(acpi_object_type type,
                      acpi_owner_id owner_id, acpi_handle start_handle)
 {
         struct acpi_walk_info info;
+        acpi_status status;
 
         ACPI_FUNCTION_ENTRY();
 
+        /*
+         * Just lock the entire namespace for the duration of the dump.
+         * We don't want any changes to the namespace during this time,
+         * especially the temporary nodes since we are going to display
+         * them also.
+         */
+        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+        if (ACPI_FAILURE(status)) {
+                acpi_os_printf("Could not acquire namespace mutex\n");
+                return;
+        }
+
         info.debug_level = ACPI_LV_TABLES;
         info.owner_id = owner_id;
         info.display_type = display_type;
@@ -636,6 +649,8 @@ acpi_ns_dump_objects(acpi_object_type type,
                                      ACPI_NS_WALK_TEMP_NODES,
                                      acpi_ns_dump_one_object, NULL,
                                      (void *)&info, NULL);
+
+        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 }
 #endif                          /* ACPI_FUTURE_USAGE */
 
diff --git a/drivers/acpi/acpica/nsdumpdv.c b/drivers/acpi/acpica/nsdumpdv.c
index d2a97921e24..2ed294b7a4d 100644
--- a/drivers/acpi/acpica/nsdumpdv.c
+++ b/drivers/acpi/acpica/nsdumpdv.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nseval.c b/drivers/acpi/acpica/nseval.c
index f52829cc294..c1bd02b1a05 100644
--- a/drivers/acpi/acpica/nseval.c
+++ b/drivers/acpi/acpica/nseval.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -389,7 +389,7 @@ acpi_ns_exec_module_code(union acpi_operand_object *method_obj,
          * acpi_gbl_root_node->Object is NULL at PASS1.
          */
         if ((type == ACPI_TYPE_DEVICE) && parent_node->object) {
-                method_obj->method.extra.handler =
+                method_obj->method.dispatch.handler =
                     parent_node->object->device.handler;
         }
 
diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c
index 0cac7ec0d2e..fd7c6380e29 100644
--- a/drivers/acpi/acpica/nsinit.c
+++ b/drivers/acpi/acpica/nsinit.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsload.c b/drivers/acpi/acpica/nsload.c
index df18be94fef..5f7dc691c18 100644
--- a/drivers/acpi/acpica/nsload.c
+++ b/drivers/acpi/acpica/nsload.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsnames.c b/drivers/acpi/acpica/nsnames.c
index d3104af57e1..d5fa520c3de 100644
--- a/drivers/acpi/acpica/nsnames.c
+++ b/drivers/acpi/acpica/nsnames.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsobject.c b/drivers/acpi/acpica/nsobject.c
index 41a9213dd5a..3bb8bf105ea 100644
--- a/drivers/acpi/acpica/nsobject.c
+++ b/drivers/acpi/acpica/nsobject.c
@@ -6,7 +6,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsparse.c b/drivers/acpi/acpica/nsparse.c
index 5808c89e9fa..b3234fa795b 100644
--- a/drivers/acpi/acpica/nsparse.c
+++ b/drivers/acpi/acpica/nsparse.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nspredef.c b/drivers/acpi/acpica/nspredef.c
index 7096bcda0c7..9fb03fa8ffd 100644
--- a/drivers/acpi/acpica/nspredef.c
+++ b/drivers/acpi/acpica/nspredef.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c
index d1c13669266..1d76ac85b5e 100644
--- a/drivers/acpi/acpica/nsrepair.c
+++ b/drivers/acpi/acpica/nsrepair.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c
index 4ef9f43ea92..973883babee 100644
--- a/drivers/acpi/acpica/nsrepair2.c
+++ b/drivers/acpi/acpica/nsrepair2.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nssearch.c b/drivers/acpi/acpica/nssearch.c
index 41102a84272..28b0d7a62b9 100644
--- a/drivers/acpi/acpica/nssearch.c
+++ b/drivers/acpi/acpica/nssearch.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsutils.c b/drivers/acpi/acpica/nsutils.c
index a7d6ad9c111..cb1b104a69a 100644
--- a/drivers/acpi/acpica/nsutils.c
+++ b/drivers/acpi/acpica/nsutils.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c
index 2cd5be8fe10..345f0c3c6ad 100644
--- a/drivers/acpi/acpica/nswalk.c
+++ b/drivers/acpi/acpica/nswalk.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index ebef8a7fd70..c53f0040e49 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -6,7 +6,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
index b01e45a415e..3fd4526f3db 100644
--- a/drivers/acpi/acpica/nsxfname.c
+++ b/drivers/acpi/acpica/nsxfname.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -603,10 +603,9 @@ acpi_status acpi_install_method(u8 *buffer)
         method_obj->method.param_count = (u8)
             (method_flags & AML_METHOD_ARG_COUNT);
 
-        method_obj->method.method_flags = (u8)
-            (method_flags & ~AML_METHOD_ARG_COUNT);
-
         if (method_flags & AML_METHOD_SERIALIZED) {
+                method_obj->method.info_flags = ACPI_METHOD_SERIALIZED;
+
                 method_obj->method.sync_level = (u8)
                     ((method_flags & AML_METHOD_SYNC_LEVEL) >> 4);
         }
diff --git a/drivers/acpi/acpica/nsxfobj.c b/drivers/acpi/acpica/nsxfobj.c
index a1f04e9b803..db7660f8b86 100644
--- a/drivers/acpi/acpica/nsxfobj.c
+++ b/drivers/acpi/acpica/nsxfobj.c
@@ -6,7 +6,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c
index 7df1a4c9527..e1fad0ee013 100644
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index 2f2e7760938..01dd70d1de5 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -655,7 +655,7 @@ acpi_ps_link_module_code(union acpi_parse_object *parent_op,
                 method_obj->method.aml_start = aml_start;
                 method_obj->method.aml_length = aml_length;
                 method_obj->method.owner_id = owner_id;
-                method_obj->method.flags |= AOPOBJ_MODULE_LEVEL;
+                method_obj->method.info_flags |= ACPI_METHOD_MODULE_LEVEL;
 
                 /*
                  * Save the parent node in next_object. This is cheating, but we
diff --git a/drivers/acpi/acpica/psopcode.c b/drivers/acpi/acpica/psopcode.c
index 2b0c3be2b1b..bed08de7528 100644
--- a/drivers/acpi/acpica/psopcode.c
+++ b/drivers/acpi/acpica/psopcode.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/psparse.c b/drivers/acpi/acpica/psparse.c
index 8d81542194d..9bb0cbd37b5 100644
--- a/drivers/acpi/acpica/psparse.c
+++ b/drivers/acpi/acpica/psparse.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -55,7 +55,6 @@
 #include "acparser.h"
 #include "acdispat.h"
 #include "amlcode.h"
-#include "acnamesp.h"
 #include "acinterp.h"
 
 #define _COMPONENT          ACPI_PARSER
@@ -539,24 +538,16 @@ acpi_status acpi_ps_parse_aml(struct acpi_walk_state *walk_state)
                         /* Check for possible multi-thread reentrancy problem */
 
                         if ((status == AE_ALREADY_EXISTS) &&
-                            (!walk_state->method_desc->method.mutex)) {
-                                ACPI_INFO((AE_INFO,
-                                           "Marking method %4.4s as Serialized because of AE_ALREADY_EXISTS error",
-                                           walk_state->method_node->name.
-                                           ascii));
-
+                            (!(walk_state->method_desc->method.
+                               info_flags & ACPI_METHOD_SERIALIZED))) {
                                 /*
-                                 * Method tried to create an object twice. The probable cause is
-                                 * that the method cannot handle reentrancy.
-                                 *
-                                 * The method is marked not_serialized, but it tried to create
-                                 * a named object, causing the second thread entrance to fail.
-                                 * Workaround this problem by marking the method permanently
-                                 * as Serialized.
+                                 * Method is not serialized and tried to create an object
+                                 * twice. The probable cause is that the method cannot
+                                 * handle reentrancy. Mark as "pending serialized" now, and
+                                 * then mark "serialized" when the last thread exits.
                                  */
-                                walk_state->method_desc->method.method_flags |=
-                                    AML_METHOD_SERIALIZED;
-                                walk_state->method_desc->method.sync_level = 0;
+                                walk_state->method_desc->method.info_flags |=
+                                    ACPI_METHOD_SERIALIZED_PENDING;
                         }
                 }
 
diff --git a/drivers/acpi/acpica/psscope.c b/drivers/acpi/acpica/psscope.c
index 40e2b279ea1..a5faa1323a0 100644
--- a/drivers/acpi/acpica/psscope.c
+++ b/drivers/acpi/acpica/psscope.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/pstree.c b/drivers/acpi/acpica/pstree.c
index d4b970c3630..f1464c03aa4 100644
--- a/drivers/acpi/acpica/pstree.c
+++ b/drivers/acpi/acpica/pstree.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/psutils.c b/drivers/acpi/acpica/psutils.c
index fe29eee5adb..7eda7850342 100644
--- a/drivers/acpi/acpica/psutils.c
+++ b/drivers/acpi/acpica/psutils.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/pswalk.c b/drivers/acpi/acpica/pswalk.c
index 8abb9629443..3312d6368bf 100644
--- a/drivers/acpi/acpica/pswalk.c
+++ b/drivers/acpi/acpica/pswalk.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/psxface.c b/drivers/acpi/acpica/psxface.c
index c42f067cff9..8086805d449 100644
--- a/drivers/acpi/acpica/psxface.c
+++ b/drivers/acpi/acpica/psxface.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -47,7 +47,6 @@
 #include "acdispat.h"
 #include "acinterp.h"
 #include "actables.h"
-#include "amlcode.h"
 
 #define _COMPONENT          ACPI_PARSER
 ACPI_MODULE_NAME("psxface")
@@ -285,15 +284,15 @@ acpi_status acpi_ps_execute_method(struct acpi_evaluate_info *info)
                 goto cleanup;
         }
 
-        if (info->obj_desc->method.flags & AOPOBJ_MODULE_LEVEL) {
+        if (info->obj_desc->method.info_flags & ACPI_METHOD_MODULE_LEVEL) {
                 walk_state->parse_flags |= ACPI_PARSE_MODULE_LEVEL;
         }
 
         /* Invoke an internal method if necessary */
 
-        if (info->obj_desc->method.method_flags & AML_METHOD_INTERNAL_ONLY) {
+        if (info->obj_desc->method.info_flags & ACPI_METHOD_INTERNAL_ONLY) {
                 status =
-                    info->obj_desc->method.extra.implementation(walk_state);
+                    info->obj_desc->method.dispatch.implementation(walk_state);
                 info->return_object = walk_state->return_desc;
 
                 /* Cleanup states */
diff --git a/drivers/acpi/acpica/rsaddr.c b/drivers/acpi/acpica/rsaddr.c
index 226c806ae98..9e66f907842 100644
--- a/drivers/acpi/acpica/rsaddr.c
+++ b/drivers/acpi/acpica/rsaddr.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rscalc.c b/drivers/acpi/acpica/rscalc.c
index d6ebf7ec622..3a8a89ec2ca 100644
--- a/drivers/acpi/acpica/rscalc.c
+++ b/drivers/acpi/acpica/rscalc.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rscreate.c b/drivers/acpi/acpica/rscreate.c
index c80a2eea3a0..4ce6e1147e8 100644
--- a/drivers/acpi/acpica/rscreate.c
+++ b/drivers/acpi/acpica/rscreate.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rsdump.c b/drivers/acpi/acpica/rsdump.c
index f859b0386fe..33db7520c74 100644
--- a/drivers/acpi/acpica/rsdump.c
+++ b/drivers/acpi/acpica/rsdump.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rsinfo.c b/drivers/acpi/acpica/rsinfo.c
index 1fd868b964f..f9ea60872aa 100644
--- a/drivers/acpi/acpica/rsinfo.c
+++ b/drivers/acpi/acpica/rsinfo.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rsio.c b/drivers/acpi/acpica/rsio.c
index 33bff17c0bb..0c7efef008b 100644
--- a/drivers/acpi/acpica/rsio.c
+++ b/drivers/acpi/acpica/rsio.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rsirq.c b/drivers/acpi/acpica/rsirq.c
index 545da40d7fa..50b8ad21116 100644
--- a/drivers/acpi/acpica/rsirq.c
+++ b/drivers/acpi/acpica/rsirq.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rslist.c b/drivers/acpi/acpica/rslist.c
index 7335f22aac2..1bfcef736c5 100644
--- a/drivers/acpi/acpica/rslist.c
+++ b/drivers/acpi/acpica/rslist.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rsmemory.c b/drivers/acpi/acpica/rsmemory.c
index 887b8ba8c43..7cc6d8625f1 100644
--- a/drivers/acpi/acpica/rsmemory.c
+++ b/drivers/acpi/acpica/rsmemory.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rsmisc.c b/drivers/acpi/acpica/rsmisc.c
index f8cd9e87d98..410264b22a2 100644
--- a/drivers/acpi/acpica/rsmisc.c
+++ b/drivers/acpi/acpica/rsmisc.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index 491191e6cf6..231811e5693 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/rsxface.c b/drivers/acpi/acpica/rsxface.c
index 9f6a6e7e1c8..2ff657a28f2 100644
--- a/drivers/acpi/acpica/rsxface.c
+++ b/drivers/acpi/acpica/rsxface.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c
index d2ff4325c42..428d44e2d16 100644
--- a/drivers/acpi/acpica/tbfadt.c
+++ b/drivers/acpi/acpica/tbfadt.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/tbfind.c b/drivers/acpi/acpica/tbfind.c
index 989d5c86786..a55cb2bb5ab 100644
--- a/drivers/acpi/acpica/tbfind.c
+++ b/drivers/acpi/acpica/tbfind.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
index 83d7af8d090..48db0944ce4 100644
--- a/drivers/acpi/acpica/tbinstal.c
+++ b/drivers/acpi/acpica/tbinstal.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 34f9c2bc5e1..0f2d395feab 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/tbxface.c b/drivers/acpi/acpica/tbxface.c
index 4a8b9e6ea57..4b7085dfc68 100644
--- a/drivers/acpi/acpica/tbxface.c
+++ b/drivers/acpi/acpica/tbxface.c
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
index fd2c07d1d3a..7eb6c6cc1ed 100644
--- a/drivers/acpi/acpica/tbxfroot.c
+++ b/drivers/acpi/acpica/tbxfroot.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utalloc.c b/drivers/acpi/acpica/utalloc.c
index 8f089628156..0a697351cf6 100644
--- a/drivers/acpi/acpica/utalloc.c
+++ b/drivers/acpi/acpica/utalloc.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c
index 6fef83f04bc..aded299a2fa 100644
--- a/drivers/acpi/acpica/utcopy.c
+++ b/drivers/acpi/acpica/utcopy.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utdebug.c b/drivers/acpi/acpica/utdebug.c
index f21c486929a..a9bcd816dc2 100644
--- a/drivers/acpi/acpica/utdebug.c
+++ b/drivers/acpi/acpica/utdebug.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
index ed794cd033e..31f5a7832ef 100644
--- a/drivers/acpi/acpica/utdelete.c
+++ b/drivers/acpi/acpica/utdelete.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/uteval.c b/drivers/acpi/acpica/uteval.c
index 22f59ef604e..18f73c9d10b 100644
--- a/drivers/acpi/acpica/uteval.c
+++ b/drivers/acpi/acpica/uteval.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utglobal.c b/drivers/acpi/acpica/utglobal.c
index 508537f884a..97dd9bbf055 100644
--- a/drivers/acpi/acpica/utglobal.c
+++ b/drivers/acpi/acpica/utglobal.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utids.c b/drivers/acpi/acpica/utids.c
index d2906328535..b679ea69354 100644
--- a/drivers/acpi/acpica/utids.c
+++ b/drivers/acpi/acpica/utids.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utinit.c b/drivers/acpi/acpica/utinit.c
index c1b1c803ea9..191b6828cce 100644
--- a/drivers/acpi/acpica/utinit.c
+++ b/drivers/acpi/acpica/utinit.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utlock.c b/drivers/acpi/acpica/utlock.c
index b081cd46a15..f6bb75c6faf 100644
--- a/drivers/acpi/acpica/utlock.c
+++ b/drivers/acpi/acpica/utlock.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utmath.c b/drivers/acpi/acpica/utmath.c
index 49cf7b7fd81..ce481da9bb4 100644
--- a/drivers/acpi/acpica/utmath.c
+++ b/drivers/acpi/acpica/utmath.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utmisc.c b/drivers/acpi/acpica/utmisc.c
index c7d0e05ef5a..c33a852d4f4 100644
--- a/drivers/acpi/acpica/utmisc.c
+++ b/drivers/acpi/acpica/utmisc.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utmutex.c b/drivers/acpi/acpica/utmutex.c
index 199528ff7f1..a946c689f03 100644
--- a/drivers/acpi/acpica/utmutex.c
+++ b/drivers/acpi/acpica/utmutex.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utobject.c b/drivers/acpi/acpica/utobject.c
index fd1fa2749ea..188340a017b 100644
--- a/drivers/acpi/acpica/utobject.c
+++ b/drivers/acpi/acpica/utobject.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utosi.c b/drivers/acpi/acpica/utosi.c
index 18c59a85fdc..1fb10cb8f11 100644
--- a/drivers/acpi/acpica/utosi.c
+++ b/drivers/acpi/acpica/utosi.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index 7965919000b..84e05184424 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utstate.c b/drivers/acpi/acpica/utstate.c
index d35d109b8da..30c21e1a936 100644
--- a/drivers/acpi/acpica/utstate.c
+++ b/drivers/acpi/acpica/utstate.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utxface.c b/drivers/acpi/acpica/utxface.c
index 1f484c9a688..98ad125e14f 100644
--- a/drivers/acpi/acpica/utxface.c
+++ b/drivers/acpi/acpica/utxface.c
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/acpica/utxferror.c b/drivers/acpi/acpica/utxferror.c
index 6f12e314fba..916ae097c43 100644
--- a/drivers/acpi/acpica/utxferror.c
+++ b/drivers/acpi/acpica/utxferror.c
@@ -5,7 +5,7 @@
  ******************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 68bc227e7c4..ac1a599f514 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -998,7 +998,6 @@ static int acpi_battery_resume(struct acpi_device *device)
         if (!device)
                 return -EINVAL;
         battery = acpi_driver_data(device);
-        acpi_battery_refresh(battery);
         battery->update_time = 0;
         acpi_battery_update(battery);
         return 0;
diff --git a/drivers/acpi/nvs.c b/drivers/acpi/nvs.c
index 54b6ab8040a..fa5a1df42b7 100644
--- a/drivers/acpi/nvs.c
+++ b/drivers/acpi/nvs.c
@@ -12,6 +12,7 @@
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
+#include <linux/acpi_io.h>
 #include <acpi/acpiosxf.h>
 
 /*
@@ -80,7 +81,7 @@ void suspend_nvs_free(void)
                         free_page((unsigned long)entry->data);
                         entry->data = NULL;
                         if (entry->kaddr) {
-                                acpi_os_unmap_memory(entry->kaddr, entry->size);
+                                iounmap(entry->kaddr);
                                 entry->kaddr = NULL;
                         }
                 }
@@ -114,8 +115,8 @@ int suspend_nvs_save(void)
 
         list_for_each_entry(entry, &nvs_list, node)
                 if (entry->data) {
-                        entry->kaddr = acpi_os_map_memory(entry->phys_start,
-                                                          entry->size);
+                        entry->kaddr = acpi_os_ioremap(entry->phys_start,
+                                                    entry->size);
                         if (!entry->kaddr) {
                                 suspend_nvs_free();
                                 return -ENOMEM;
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index e2dd6de5d50..b0931818cf9 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -38,6 +38,7 @@
 #include <linux/workqueue.h>
 #include <linux/nmi.h>
 #include <linux/acpi.h>
+#include <linux/acpi_io.h>
 #include <linux/efi.h>
 #include <linux/ioport.h>
 #include <linux/list.h>
@@ -302,9 +303,10 @@ void __iomem *__init_refok
 acpi_os_map_memory(acpi_physical_address phys, acpi_size size)
 {
         struct acpi_ioremap *map, *tmp_map;
-        unsigned long flags, pg_sz;
+        unsigned long flags;
         void __iomem *virt;
-        phys_addr_t pg_off;
+        acpi_physical_address pg_off;
+        acpi_size pg_sz;
 
         if (phys > ULONG_MAX) {
                 printk(KERN_ERR PREFIX "Cannot map memory that high\n");
@@ -320,7 +322,7 @@ acpi_os_map_memory(acpi_physical_address phys, acpi_size size)
 
         pg_off = round_down(phys, PAGE_SIZE);
         pg_sz = round_up(phys + size, PAGE_SIZE) - pg_off;
-        virt = ioremap_cache(pg_off, pg_sz);
+        virt = acpi_os_ioremap(pg_off, pg_sz);
         if (!virt) {
                 kfree(map);
                 return NULL;
@@ -642,7 +644,7 @@ acpi_os_read_memory(acpi_physical_address phys_addr, u32 * value, u32 width)
         virt_addr = acpi_map_vaddr_lookup(phys_addr, size);
         rcu_read_unlock();
         if (!virt_addr) {
-                virt_addr = ioremap_cache(phys_addr, size);
+                virt_addr = acpi_os_ioremap(phys_addr, size);
                 unmap = 1;
         }
         if (!value)
@@ -678,7 +680,7 @@ acpi_os_write_memory(acpi_physical_address phys_addr, u32 value, u32 width)
         virt_addr = acpi_map_vaddr_lookup(phys_addr, size);
         rcu_read_unlock();
         if (!virt_addr) {
-                virt_addr = ioremap_cache(phys_addr, size);
+                virt_addr = acpi_os_ioremap(phys_addr, size);
                 unmap = 1;
         }
 
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index fdd3aeeb6de..d6a8cd14de2 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -166,6 +166,7 @@ static void acpi_pm_finish(void)
         u32 acpi_state = acpi_target_sleep_state;
 
         acpi_ec_unblock_transactions();
+        suspend_nvs_free();
 
         if (acpi_state == ACPI_STATE_S0)
                 return;
@@ -186,7 +187,6 @@ static void acpi_pm_finish(void)
  */
 static void acpi_pm_end(void)
 {
-        suspend_nvs_free();
         /*
          * This is necessary in case acpi_pm_finish() is not called during a
          * failing transition to a sleep state.
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index c6b298d4c13..c2328aed083 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -783,7 +783,7 @@ config PATA_PCMCIA
 
 config PATA_PLATFORM
         tristate "Generic platform device PATA support"
-        depends on EMBEDDED || PPC || HAVE_PATA_PLATFORM
+        depends on EXPERT || PPC || HAVE_PATA_PLATFORM
         help
           This option enables support for generic directly connected ATA
           devices commonly found on embedded systems.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 328826381a2..b8d96ce37fc 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -260,6 +260,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
         { PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
         { PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
+        { PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -379,6 +380,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(MARVELL, 0x6145), board_ahci_mv },        /* 6145 */
         { PCI_VDEVICE(MARVELL, 0x6121), board_ahci_mv },        /* 6121 */
         { PCI_DEVICE(0x1b4b, 0x9123),
+          .class = PCI_CLASS_STORAGE_SATA_AHCI,
+          .class_mask = 0xffffff,
           .driver_data = board_ahci_yes_fbs },                  /* 88se9128 */
 
         /* Promise */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index a31fe96f7de..d4e52e21485 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4138,6 +4138,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
          * device and controller are SATA.
          */
         { "PIONEER DVD-RW  DVRTD08",    "1.00", ATA_HORKAGE_NOSETXFER },
+        { "PIONEER DVD-RW  DVR-212D",   "1.28", ATA_HORKAGE_NOSETXFER },
 
         /* End Marker */
         { }
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 5defc74973d..600f6353ecf 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1099,9 +1099,9 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
                 struct request_queue *q = sdev->request_queue;
                 void *buf;
 
-                /* set the min alignment and padding */
-                blk_queue_update_dma_alignment(sdev->request_queue,
-                                               ATA_DMA_PAD_SZ - 1);
+                sdev->sector_size = ATA_SECT_SIZE;
+
+                /* set DMA padding */
                 blk_queue_update_dma_pad(sdev->request_queue,
                                          ATA_DMA_PAD_SZ - 1);
 
@@ -1115,13 +1115,25 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
 
                 blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN);
         } else {
-                /* ATA devices must be sector aligned */
                 sdev->sector_size = ata_id_logical_sector_size(dev->id);
-                blk_queue_update_dma_alignment(sdev->request_queue,
-                                               sdev->sector_size - 1);
                 sdev->manage_start_stop = 1;
         }
 
+        /*
+         * ata_pio_sectors() expects buffer for each sector to not cross
+         * page boundary.  Enforce it by requiring buffers to be sector
+         * aligned, which works iff sector_size is not larger than
+         * PAGE_SIZE.  ATAPI devices also need the alignment as
+         * IDENTIFY_PACKET is executed as ATA_PROT_PIO.
+         */
+        if (sdev->sector_size > PAGE_SIZE)
+                ata_dev_printk(dev, KERN_WARNING,
+                        "sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
+                        sdev->sector_size);
+
+        blk_queue_update_dma_alignment(sdev->request_queue,
+                                       sdev->sector_size - 1);
+
         if (dev->flags & ATA_DFLAG_AN)
                 set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
 
diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
index d7e57db36bc..538ec38ba99 100644
--- a/drivers/ata/pata_hpt366.c
+++ b/drivers/ata/pata_hpt366.c
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt366"
-#define DRV_VERSION     "0.6.9"
+#define DRV_VERSION     "0.6.10"
 
 struct hpt_clock {
         u8      xfer_mode;
@@ -160,8 +160,8 @@ static int hpt_dma_blacklisted(const struct ata_device *dev, char *modestr,
 
         while (list[i] != NULL) {
                 if (!strcmp(list[i], model_num)) {
-                        printk(KERN_WARNING DRV_NAME ": %s is not supported for %s.\n",
-                                modestr, list[i]);
+                        pr_warning(DRV_NAME ": %s is not supported for %s.\n",
+                                   modestr, list[i]);
                         return 1;
                 }
                 i++;
diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
index efdd18bc866..4c5b5183225 100644
--- a/drivers/ata/pata_hpt37x.c
+++ b/drivers/ata/pata_hpt37x.c
@@ -24,7 +24,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt37x"
-#define DRV_VERSION     "0.6.18"
+#define DRV_VERSION     "0.6.22"
 
 struct hpt_clock {
         u8      xfer_speed;
@@ -229,8 +229,8 @@ static int hpt_dma_blacklisted(const struct ata_device *dev, char *modestr,
 
         while (list[i] != NULL) {
                 if (!strcmp(list[i], model_num)) {
-                        printk(KERN_WARNING DRV_NAME ": %s is not supported for %s.\n",
-                                modestr, list[i]);
+                        pr_warning(DRV_NAME ": %s is not supported for %s.\n",
+                                   modestr, list[i]);
                         return 1;
                 }
                 i++;
@@ -642,7 +642,6 @@ static struct ata_port_operations hpt372_port_ops = {
 static struct ata_port_operations hpt374_fn1_port_ops = {
         .inherits       = &hpt372_port_ops,
         .cable_detect   = hpt374_fn1_cable_detect,
-        .prereset       = hpt37x_pre_reset,
 };
 
 /**
@@ -803,7 +802,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 .udma_mask = ATA_UDMA6,
                 .port_ops = &hpt302_port_ops
         };
-        /* HPT374 - UDMA100, function 1 uses different prereset method */
+        /* HPT374 - UDMA100, function 1 uses different cable_detect method */
         static const struct ata_port_info info_hpt374_fn0 = {
                 .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = ATA_PIO4,
@@ -838,7 +837,8 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         if (rc)
                 return rc;
 
-        if (dev->device == PCI_DEVICE_ID_TTI_HPT366) {
+        switch (dev->device) {
+        case PCI_DEVICE_ID_TTI_HPT366:
                 /* May be a later chip in disguise. Check */
                 /* Older chips are in the HPT366 driver. Ignore them */
                 if (rev < 3)
@@ -863,54 +863,50 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                         chip_table = &hpt372;
                         break;
                 default:
-                        printk(KERN_ERR "pata_hpt37x: Unknown HPT366 subtype, "
+                        pr_err(DRV_NAME ": Unknown HPT366 subtype, "
                                "please report (%d).\n", rev);
                         return -ENODEV;
                 }
-        } else {
-                switch (dev->device) {
-                case PCI_DEVICE_ID_TTI_HPT372:
-                        /* 372N if rev >= 2 */
-                        if (rev >= 2)
-                                return -ENODEV;
-                        ppi[0] = &info_hpt372;
-                        chip_table = &hpt372a;
-                        break;
-                case PCI_DEVICE_ID_TTI_HPT302:
-                        /* 302N if rev > 1 */
-                        if (rev > 1)
-                                return -ENODEV;
-                        ppi[0] = &info_hpt302;
-                        /* Check this */
-                        chip_table = &hpt302;
-                        break;
-                case PCI_DEVICE_ID_TTI_HPT371:
-                        if (rev > 1)
-                                return -ENODEV;
-                        ppi[0] = &info_hpt302;
-                        chip_table = &hpt371;
-                        /*
-                         * Single channel device, master is not present
-                         * but the BIOS (or us for non x86) must mark it
-                         * absent
-                         */
-                        pci_read_config_byte(dev, 0x50, &mcr1);
-                        mcr1 &= ~0x04;
-                        pci_write_config_byte(dev, 0x50, mcr1);
-                        break;
-                case PCI_DEVICE_ID_TTI_HPT374:
-                        chip_table = &hpt374;
-                        if (!(PCI_FUNC(dev->devfn) & 1))
-                                *ppi = &info_hpt374_fn0;
-                        else
-                                *ppi = &info_hpt374_fn1;
-                        break;
-                default:
-                        printk(KERN_ERR
-                               "pata_hpt37x: PCI table is bogus, please report (%d).\n",
-                               dev->device);
-                                return -ENODEV;
-                }
+                break;
+        case PCI_DEVICE_ID_TTI_HPT372:
+                /* 372N if rev >= 2 */
+                if (rev >= 2)
+                        return -ENODEV;
+                ppi[0] = &info_hpt372;
+                chip_table = &hpt372a;
+                break;
+        case PCI_DEVICE_ID_TTI_HPT302:
+                /* 302N if rev > 1 */
+                if (rev > 1)
+                        return -ENODEV;
+                ppi[0] = &info_hpt302;
+                /* Check this */
+                chip_table = &hpt302;
+                break;
+        case PCI_DEVICE_ID_TTI_HPT371:
+                if (rev > 1)
+                        return -ENODEV;
+                ppi[0] = &info_hpt302;
+                chip_table = &hpt371;
+                /*
+                 * Single channel device, master is not present but the BIOS
+                 * (or us for non x86) must mark it absent
+                 */
+                pci_read_config_byte(dev, 0x50, &mcr1);
+                mcr1 &= ~0x04;
+                pci_write_config_byte(dev, 0x50, mcr1);
+                break;
+        case PCI_DEVICE_ID_TTI_HPT374:
+                chip_table = &hpt374;
+                if (!(PCI_FUNC(dev->devfn) & 1))
+                        *ppi = &info_hpt374_fn0;
+                else
+                        *ppi = &info_hpt374_fn1;
+                break;
+        default:
+                pr_err(DRV_NAME ": PCI table is bogus, please report (%d).\n",
+                       dev->device);
+                return -ENODEV;
         }
         /* Ok so this is a chip we support */
 
@@ -957,8 +953,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 u8 sr;
                 u32 total = 0;
 
-                printk(KERN_WARNING
-                       "pata_hpt37x: BIOS has not set timing clocks.\n");
+                pr_warning(DRV_NAME ": BIOS has not set timing clocks.\n");
 
                 /* This is the process the HPT371 BIOS is reported to use */
                 for (i = 0; i < 128; i++) {
@@ -1014,7 +1009,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                                                (f_high << 16) | f_low | 0x100);
                 }
                 if (adjust == 8) {
-                        printk(KERN_ERR "pata_hpt37x: DPLL did not stabilize!\n");
+                        pr_err(DRV_NAME ": DPLL did not stabilize!\n");
                         return -ENODEV;
                 }
                 if (dpll == 3)
@@ -1022,8 +1017,8 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 else
                         private_data = (void *)hpt37x_timings_50;
 
-                printk(KERN_INFO "pata_hpt37x: bus clock %dMHz, using %dMHz DPLL.\n",
-                       MHz[clock_slot], MHz[dpll]);
+                pr_info(DRV_NAME ": bus clock %dMHz, using %dMHz DPLL.\n",
+                        MHz[clock_slot], MHz[dpll]);
         } else {
                 private_data = (void *)chip_table->clocks[clock_slot];
                 /*
@@ -1036,8 +1031,9 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                         ppi[0] = &info_hpt370_33;
                 if (clock_slot < 2 && ppi[0] == &info_hpt370a)
                         ppi[0] = &info_hpt370a_33;
-                printk(KERN_INFO "pata_hpt37x: %s using %dMHz bus clock.\n",
-                       chip_table->name, MHz[clock_slot]);
+
+                pr_info(DRV_NAME ": %s using %dMHz bus clock.\n",
+                        chip_table->name, MHz[clock_slot]);
         }
 
         /* Now kick off ATA set up */
diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
index d2239bbdb79..eca68caf5f4 100644
--- a/drivers/ata/pata_hpt3x2n.c
+++ b/drivers/ata/pata_hpt3x2n.c
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt3x2n"
-#define DRV_VERSION     "0.3.13"
+#define DRV_VERSION     "0.3.14"
 
 enum {
         HPT_PCI_FAST    =       (1 << 31),
@@ -418,7 +418,7 @@ static int hpt3x2n_pci_clock(struct pci_dev *pdev)
                 u16 sr;
                 u32 total = 0;
 
-                printk(KERN_WARNING "pata_hpt3x2n: BIOS clock data not set.\n");
+                pr_warning(DRV_NAME ": BIOS clock data not set.\n");
 
                 /* This is the process the HPT371 BIOS is reported to use */
                 for (i = 0; i < 128; i++) {
@@ -528,8 +528,7 @@ hpt372n:
                 ppi[0] = &info_hpt372n;
                 break;
         default:
-                printk(KERN_ERR
-                       "pata_hpt3x2n: PCI table is bogus please report (%d).\n",
+                pr_err(DRV_NAME ": PCI table is bogus, please report (%d).\n",
                        dev->device);
                 return -ENODEV;
         }
@@ -579,12 +578,11 @@ hpt372n:
                 pci_write_config_dword(dev, 0x5C, (f_high << 16) | f_low);
         }
         if (adjust == 8) {
-                printk(KERN_ERR "pata_hpt3x2n: DPLL did not stabilize!\n");
+                pr_err(DRV_NAME ": DPLL did not stabilize!\n");
                 return -ENODEV;
         }
 
-        printk(KERN_INFO "pata_hpt37x: bus clock %dMHz, using 66MHz DPLL.\n",
-               pci_mhz);
+        pr_info(DRV_NAME ": bus clock %dMHz, using 66MHz DPLL.\n", pci_mhz);
 
         /*
          * Set our private data up. We only need a few flags
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index 8cc536e49a0..d7d8026cde9 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -610,7 +610,7 @@ static struct scsi_host_template mpc52xx_ata_sht = {
 };
 
 static struct ata_port_operations mpc52xx_ata_port_ops = {
-        .inherits               = &ata_sff_port_ops,
+        .inherits               = &ata_bmdma_port_ops,
         .sff_dev_select         = mpc52xx_ata_dev_select,
         .set_piomode            = mpc52xx_ata_set_piomode,
         .set_dmamode            = mpc52xx_ata_set_dmamode,
diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
index bca9cb89a11..487a5473985 100644
--- a/drivers/atm/idt77105.c
+++ b/drivers/atm/idt77105.c
@@ -151,7 +151,7 @@ static int fetch_stats(struct atm_dev *dev,struct idt77105_stats __user *arg,int
         spin_unlock_irqrestore(&idt77105_priv_lock, flags);
         if (arg == NULL)
                 return 0;
-        return copy_to_user(arg, &PRIV(dev)->stats,
+        return copy_to_user(arg, &stats,
                     sizeof(struct idt77105_stats)) ? -EFAULT : 0;
 }
 
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index fd96345bc35..d57e8d0fb82 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -70,7 +70,7 @@ config PREVENT_FIRMWARE_BUILD
           If unsure say Y here.
 
 config FW_LOADER
-        tristate "Userspace firmware loading support" if EMBEDDED
+        tristate "Userspace firmware loading support" if EXPERT
         default y
         ---help---
           This option is provided for the case where no in-kernel-tree modules
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 656493a5e07..42615b419df 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -407,12 +407,15 @@ static int rpm_suspend(struct device *dev, int rpmflags)
                 goto out;
         }
 
+        /* Maybe the parent is now able to suspend. */
         if (parent && !parent->power.ignore_children && !dev->power.irq_safe) {
-                spin_unlock_irq(&dev->power.lock);
+                spin_unlock(&dev->power.lock);
 
-                pm_request_idle(parent);
+                spin_lock(&parent->power.lock);
+                rpm_idle(parent, RPM_ASYNC);
+                spin_unlock(&parent->power.lock);
 
-                spin_lock_irq(&dev->power.lock);
+                spin_lock(&dev->power.lock);
         }
 
  out:
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 949ed09c636..a126e614601 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -47,46 +47,40 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
 #define USB_REQ_DFU_DNLOAD      1
 #define BULK_SIZE               4096
 
-struct ath3k_data {
-        struct usb_device *udev;
-        u8 *fw_data;
-        u32 fw_size;
-        u32 fw_sent;
-};
-
-static int ath3k_load_firmware(struct ath3k_data *data,
-                                unsigned char *firmware,
-                                int count)
+static int ath3k_load_firmware(struct usb_device *udev,
+                                const struct firmware *firmware)
 {
         u8 *send_buf;
         int err, pipe, len, size, sent = 0;
+        int count = firmware->size;
 
-        BT_DBG("ath3k %p udev %p", data, data->udev);
+        BT_DBG("udev %p", udev);
 
-        pipe = usb_sndctrlpipe(data->udev, 0);
+        pipe = usb_sndctrlpipe(udev, 0);
 
-        if ((usb_control_msg(data->udev, pipe,
+        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        if (!send_buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+
+        memcpy(send_buf, firmware->data, 20);
+        if ((err = usb_control_msg(udev, pipe,
                                 USB_REQ_DFU_DNLOAD,
                                 USB_TYPE_VENDOR, 0, 0,
-                                firmware, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
+                                send_buf, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
                 BT_ERR("Can't change to loading configuration err");
-                return -EBUSY;
+                goto error;
         }
         sent += 20;
         count -= 20;
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
-        if (!send_buf) {
-                BT_ERR("Can't allocate memory chunk for firmware");
-                return -ENOMEM;
-        }
-
         while (count) {
                 size = min_t(uint, count, BULK_SIZE);
-                pipe = usb_sndbulkpipe(data->udev, 0x02);
-                memcpy(send_buf, firmware + sent, size);
+                pipe = usb_sndbulkpipe(udev, 0x02);
+                memcpy(send_buf, firmware->data + sent, size);
 
-                err = usb_bulk_msg(data->udev, pipe, send_buf, size,
+                err = usb_bulk_msg(udev, pipe, send_buf, size,
                                         &len, 3000);
 
                 if (err || (len != size)) {
@@ -112,57 +106,28 @@ static int ath3k_probe(struct usb_interface *intf,
 {
         const struct firmware *firmware;
         struct usb_device *udev = interface_to_usbdev(intf);
-        struct ath3k_data *data;
-        int size;
 
         BT_DBG("intf %p id %p", intf, id);
 
         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
                 return -ENODEV;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        data->udev = udev;
-
         if (request_firmware(&firmware, "ath3k-1.fw", &udev->dev) < 0) {
-                kfree(data);
                 return -EIO;
         }
 
-        size = max_t(uint, firmware->size, 4096);
-        data->fw_data = kmalloc(size, GFP_KERNEL);
-        if (!data->fw_data) {
+        if (ath3k_load_firmware(udev, firmware)) {
                 release_firmware(firmware);
-                kfree(data);
-                return -ENOMEM;
-        }
-
-        memcpy(data->fw_data, firmware->data, firmware->size);
-        data->fw_size = firmware->size;
-        data->fw_sent = 0;
-        release_firmware(firmware);
-
-        usb_set_intfdata(intf, data);
-        if (ath3k_load_firmware(data, data->fw_data, data->fw_size)) {
-                usb_set_intfdata(intf, NULL);
-                kfree(data->fw_data);
-                kfree(data);
                 return -EIO;
         }
+        release_firmware(firmware);
 
         return 0;
 }
 
 static void ath3k_disconnect(struct usb_interface *intf)
 {
-        struct ath3k_data *data = usb_get_intfdata(intf);
-
         BT_DBG("ath3k_disconnect intf %p", intf);
-
-        kfree(data->fw_data);
-        kfree(data);
 }
 
 static struct usb_driver ath3k_driver = {
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 0f175a866ef..b7980a83ce2 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -5,7 +5,7 @@
 menu "Character devices"
 
 config VT
-        bool "Virtual terminal" if EMBEDDED
+        bool "Virtual terminal" if EXPERT
         depends on !S390
         select INPUT
         default y
@@ -39,13 +39,13 @@ config VT
 config CONSOLE_TRANSLATIONS
         depends on VT
         default y
-        bool "Enable character translations in console" if EMBEDDED
+        bool "Enable character translations in console" if EXPERT
         ---help---
           This enables support for font mapping and Unicode translation
           on virtual consoles.
 
 config VT_CONSOLE
-        bool "Support for console on virtual terminal" if EMBEDDED
+        bool "Support for console on virtual terminal" if EXPERT
         depends on VT
         default y
         ---help---
@@ -426,10 +426,10 @@ config SGI_MBCS
          If you have an SGI Altix with an attached SABrick
          say Y or M here, otherwise say N.
 
-source "drivers/serial/Kconfig"
+source "drivers/tty/serial/Kconfig"
 
 config UNIX98_PTYS
-        bool "Unix98 PTY support" if EMBEDDED
+        bool "Unix98 PTY support" if EXPERT
         default y
         ---help---
           A pseudo terminal (PTY) is a software device consisting of two
@@ -495,7 +495,7 @@ config LEGACY_PTY_COUNT
 
 config TTY_PRINTK
         bool "TTY driver to output user messages via printk"
-        depends on EMBEDDED
+        depends on EXPERT
         default n
         ---help---
           If you say Y here, the support for writing user messages (i.e.
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index 1e9dffb3377..5bc765d4c3c 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -30,25 +30,12 @@ obj-$(CONFIG_SYNCLINK_GT)	+= synclink_gt.o
 obj-$(CONFIG_AMIGA_BUILTIN_SERIAL) += amiserial.o
 obj-$(CONFIG_SX)                += sx.o generic_serial.o
 obj-$(CONFIG_RIO)               += rio/ generic_serial.o
-obj-$(CONFIG_HVC_CONSOLE)       += hvc_vio.o hvsi.o
-obj-$(CONFIG_HVC_ISERIES)       += hvc_iseries.o
-obj-$(CONFIG_HVC_RTAS)          += hvc_rtas.o
-obj-$(CONFIG_HVC_TILE)          += hvc_tile.o
-obj-$(CONFIG_HVC_DCC)           += hvc_dcc.o
-obj-$(CONFIG_HVC_BEAT)          += hvc_beat.o
-obj-$(CONFIG_HVC_DRIVER)        += hvc_console.o
-obj-$(CONFIG_HVC_IRQ)           += hvc_irq.o
-obj-$(CONFIG_HVC_XEN)           += hvc_xen.o
-obj-$(CONFIG_HVC_IUCV)          += hvc_iucv.o
-obj-$(CONFIG_HVC_UDBG)          += hvc_udbg.o
-obj-$(CONFIG_VIRTIO_CONSOLE)    += virtio_console.o
 obj-$(CONFIG_RAW_DRIVER)        += raw.o
 obj-$(CONFIG_SGI_SNSC)          += snsc.o snsc_event.o
 obj-$(CONFIG_MSPEC)             += mspec.o
 obj-$(CONFIG_MMTIMER)           += mmtimer.o
 obj-$(CONFIG_UV_MMTIMER)        += uv_mmtimer.o
 obj-$(CONFIG_VIOTAPE)           += viotape.o
-obj-$(CONFIG_HVCS)              += hvcs.o
 obj-$(CONFIG_IBM_BSR)           += bsr.o
 obj-$(CONFIG_SGI_MBCS)          += mbcs.o
 obj-$(CONFIG_BRIQ_PANEL)        += briq_panel.o
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index fcd867d923b..d8b1b576556 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -50,7 +50,7 @@ config AGP_ATI
 
 config AGP_AMD
         tristate "AMD Irongate, 761, and 762 chipset support"
-        depends on AGP && (X86_32 || ALPHA)
+        depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
           X on AMD Irongate, 761, and 762 chipsets.
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index b1b4362bc64..45681c0ff3b 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -41,22 +41,8 @@ static int amd_create_page_map(struct amd_page_map *page_map)
         if (page_map->real == NULL)
                 return -ENOMEM;
 
-#ifndef CONFIG_X86
-        SetPageReserved(virt_to_page(page_map->real));
-        global_cache_flush();
-        page_map->remapped = ioremap_nocache(virt_to_phys(page_map->real),
-                                            PAGE_SIZE);
-        if (page_map->remapped == NULL) {
-                ClearPageReserved(virt_to_page(page_map->real));
-                free_page((unsigned long) page_map->real);
-                page_map->real = NULL;
-                return -ENOMEM;
-        }
-        global_cache_flush();
-#else
         set_memory_uc((unsigned long)page_map->real, 1);
         page_map->remapped = page_map->real;
-#endif
 
         for (i = 0; i < PAGE_SIZE / sizeof(unsigned long); i++) {
                 writel(agp_bridge->scratch_page, page_map->remapped+i);
@@ -68,12 +54,7 @@ static int amd_create_page_map(struct amd_page_map *page_map)
 
 static void amd_free_page_map(struct amd_page_map *page_map)
 {
-#ifndef CONFIG_X86
-        iounmap(page_map->remapped);
-        ClearPageReserved(virt_to_page(page_map->real));
-#else
         set_memory_wb((unsigned long)page_map->real, 1);
-#endif
         free_page((unsigned long) page_map->real);
 }
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 857df10c042..b0a0dccc98c 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -774,20 +774,14 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
         dev_info(&pdev->dev, "Intel %s Chipset\n", intel_agp_chipsets[i].name);
 
         /*
-        * If the device has not been properly setup, the following will catch
-        * the problem and should stop the system from crashing.
-        * 20030610 - hamish@zot.org
-        */
-        if (pci_enable_device(pdev)) {
-                dev_err(&pdev->dev, "can't enable PCI device\n");
-                agp_put_bridge(bridge);
-                return -ENODEV;
-        }
-
-        /*
         * The following fixes the case where the BIOS has "forgotten" to
         * provide an address range for the GART.
         * 20030610 - hamish@zot.org
+        * This happens before pci_enable_device() intentionally;
+        * calling pci_enable_device() before assigning the resource
+        * will result in the GART being disabled on machines with such
+        * BIOSs (the GART ends up with a BAR starting at 0, which
+        * conflicts a lot of other devices).
         */
         r = &pdev->resource[0];
         if (!r->start && r->end) {
@@ -798,6 +792,17 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                 }
         }
 
+        /*
+        * If the device has not been properly setup, the following will catch
+        * the problem and should stop the system from crashing.
+        * 20030610 - hamish@zot.org
+        */
+        if (pci_enable_device(pdev)) {
+                dev_err(&pdev->dev, "can't enable PCI device\n");
+                agp_put_bridge(bridge);
+                return -ENODEV;
+        }
+
         /* Fill in the mode register */
         if (cap_ptr) {
                 pci_read_config_dword(pdev,
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 826ab0939a1..fab3d3265ad 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -68,6 +68,7 @@ static struct _intel_private {
         phys_addr_t gma_bus_addr;
         u32 PGETBL_save;
         u32 __iomem *gtt;               /* I915G */
+        bool clear_fake_agp; /* on first access via agp, fill with scratch */
         int num_dcache_entries;
         union {
                 void __iomem *i9xx_flush_page;
@@ -869,21 +870,12 @@ static int intel_fake_agp_free_gatt_table(struct agp_bridge_data *bridge)
 
 static int intel_fake_agp_configure(void)
 {
-        int i;
-
         if (!intel_enable_gtt())
             return -EIO;
 
+        intel_private.clear_fake_agp = true;
         agp_bridge->gart_bus_addr = intel_private.gma_bus_addr;
 
-        for (i = 0; i < intel_private.base.gtt_total_entries; i++) {
-                intel_private.driver->write_entry(intel_private.scratch_page_dma,
-                                                  i, 0);
-        }
-        readl(intel_private.gtt+i-1);   /* PCI Posting. */
-
-        global_cache_flush();
-
         return 0;
 }
 
@@ -945,6 +937,13 @@ static int intel_fake_agp_insert_entries(struct agp_memory *mem,
 {
         int ret = -EINVAL;
 
+        if (intel_private.clear_fake_agp) {
+                int start = intel_private.base.stolen_size / PAGE_SIZE;
+                int end = intel_private.base.gtt_mappable_entries;
+                intel_gtt_clear_range(start, end - start);
+                intel_private.clear_fake_agp = false;
+        }
+
         if (INTEL_GTT_GEN == 1 && type == AGP_DCACHE_MEMORY)
                 return i810_insert_dcache_entries(mem, pg_start, type);
 
diff --git a/drivers/char/bfin_jtag_comm.c b/drivers/char/bfin_jtag_comm.c
index e397df3ad98..16402445f2b 100644
--- a/drivers/char/bfin_jtag_comm.c
+++ b/drivers/char/bfin_jtag_comm.c
@@ -183,16 +183,16 @@ bfin_jc_circ_write(const unsigned char *buf, int count)
 }
 
 #ifndef CONFIG_BFIN_JTAG_COMM_CONSOLE
-# define acquire_console_sem()
-# define release_console_sem()
+# define console_lock()
+# define console_unlock()
 #endif
 static int
 bfin_jc_write(struct tty_struct *tty, const unsigned char *buf, int count)
 {
         int i;
-        acquire_console_sem();
+        console_lock();
         i = bfin_jc_circ_write(buf, count);
-        release_console_sem();
+        console_unlock();
         wake_up_process(bfin_jc_kthread);
         return i;
 }
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 1f46f1cd922..36e0fa161c2 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -364,12 +364,14 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
                     tpm_protected_ordinal_duration[ordinal &
                                                    TPM_PROTECTED_ORDINAL_MASK];
 
-        if (duration_idx != TPM_UNDEFINED)
+        if (duration_idx != TPM_UNDEFINED) {
                 duration = chip->vendor.duration[duration_idx];
-        if (duration <= 0)
+                /* if duration is 0, it's because chip->vendor.duration wasn't */
+                /* filled yet, so we set the lowest timeout just to give enough */
+                /* time for tpm_get_timeouts() to succeed */
+                return (duration <= 0 ? HZ : duration);
+        } else
                 return 2 * 60 * HZ;
-        else
-                return duration;
 }
 EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
 
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index c17a305ecb2..dd21df55689 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -493,9 +493,6 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
                  "1.2 TPM (device-id 0x%X, rev-id %d)\n",
                  vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
 
-        if (is_itpm(to_pnp_dev(dev)))
-                itpm = 1;
-
         if (itpm)
                 dev_info(dev, "Intel iTPM workaround enabled\n");
 
@@ -637,6 +634,9 @@ static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
         else
                 interrupts = 0;
 
+        if (is_itpm(pnp_dev))
+                itpm = 1;
+
         return tpm_tis_init(&pnp_dev->dev, start, len, irq);
 }
 
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index cfb0f527841..effe7974aa9 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -202,17 +202,21 @@ static int __init init_acpi_pm_clocksource(void)
                         printk(KERN_INFO "PM-Timer had inconsistent results:"
                                " 0x%#llx, 0x%#llx - aborting.\n",
                                value1, value2);
+                        pmtmr_ioport = 0;
                         return -EINVAL;
                 }
                 if (i == ACPI_PM_READ_CHECKS) {
                         printk(KERN_INFO "PM-Timer failed consistency check "
                                " (0x%#llx) - aborting.\n", value1);
+                        pmtmr_ioport = 0;
                         return -ENODEV;
                 }
         }
 
-        if (verify_pmtmr_rate() != 0)
+        if (verify_pmtmr_rate() != 0){
+                pmtmr_ioport = 0;
                 return -ENODEV;
+        }
 
         return clocksource_register_hz(&clocksource_acpi_pm,
                                                 PMTMR_TICKS_PER_SEC);
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 01b886e6882..79c47e88d5d 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -196,9 +196,9 @@ static void __init setup_clkevents(struct atmel_tc *tc, int clk32k_divisor_idx)
         clkevt.clkevt.min_delta_ns = clockevent_delta2ns(1, &clkevt.clkevt) + 1;
         clkevt.clkevt.cpumask = cpumask_of(0);
 
-        setup_irq(irq, &tc_irqaction);
-
         clockevents_register_device(&clkevt.clkevt);
+
+        setup_irq(irq, &tc_irqaction);
 }
 
 #else /* !CONFIG_GENERIC_CLOCKEVENTS */
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index a8c8d9c19d7..ca8ee8093d6 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -71,7 +71,7 @@ config CPU_FREQ_DEFAULT_GOV_PERFORMANCE
 
 config CPU_FREQ_DEFAULT_GOV_POWERSAVE
         bool "powersave"
-        depends on EMBEDDED
+        depends on EXPERT
         select CPU_FREQ_GOV_POWERSAVE
         help
           Use the CPUFreq governor 'powersave' as default. This sets
diff --git a/drivers/firewire/Kconfig b/drivers/firewire/Kconfig
index 68f942cb30f..0c56989cd90 100644
--- a/drivers/firewire/Kconfig
+++ b/drivers/firewire/Kconfig
@@ -49,15 +49,13 @@ config FIREWIRE_SBP2
           configuration section.
 
 config FIREWIRE_NET
-        tristate "IP networking over 1394 (EXPERIMENTAL)"
-        depends on FIREWIRE && INET && EXPERIMENTAL
+        tristate "IP networking over 1394"
+        depends on FIREWIRE && INET
         help
           This enables IPv4 over IEEE 1394, providing IP connectivity with
           other implementations of RFC 2734 as found on several operating
           systems.  Multicast support is currently limited.
 
-          NOTE, this driver is not stable yet!
-
           To compile this driver as a module, say M here:  The module will be
           called firewire-net.
 
diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index be0492398ef..24ff35511e2 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -75,6 +75,8 @@ static size_t config_rom_length = 1 + 4 + 1 + 1;
 #define BIB_IRMC                ((1) << 31)
 #define NODE_CAPABILITIES       0x0c0083c0 /* per IEEE 1394 clause 8.3.2.6.5.2 */
 
+#define CANON_OUI               0x000085
+
 static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
 {
         struct fw_descriptor *desc;
@@ -284,6 +286,7 @@ static void bm_work(struct work_struct *work)
         bool root_device_is_running;
         bool root_device_is_cmc;
         bool irm_is_1394_1995_only;
+        bool keep_this_irm;
 
         spin_lock_irq(&card->lock);
 
@@ -305,6 +308,10 @@ static void bm_work(struct work_struct *work)
         irm_is_1394_1995_only = irm_device && irm_device->config_rom &&
                         (irm_device->config_rom[2] & 0x000000f0) == 0;
 
+        /* Canon MV5i works unreliably if it is not root node. */
+        keep_this_irm = irm_device && irm_device->config_rom &&
+                        irm_device->config_rom[3] >> 8 == CANON_OUI;
+
         root_id  = root_node->node_id;
         irm_id   = card->irm_node->node_id;
         local_id = card->local_node->node_id;
@@ -333,7 +340,7 @@ static void bm_work(struct work_struct *work)
                         goto pick_me;
                 }
 
-                if (irm_is_1394_1995_only) {
+                if (irm_is_1394_1995_only && !keep_this_irm) {
                         new_root_id = local_id;
                         fw_notify("%s, making local node (%02x) root.\n",
                                   "IRM is not 1394a compliant", new_root_id);
@@ -382,7 +389,7 @@ static void bm_work(struct work_struct *work)
 
                 spin_lock_irq(&card->lock);
 
-                if (rcode != RCODE_COMPLETE) {
+                if (rcode != RCODE_COMPLETE && !keep_this_irm) {
                         /*
                          * The lock request failed, maybe the IRM
                          * isn't really IRM capable after all. Let's
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index c2e194c5866..7ed08fd1214 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -191,6 +191,7 @@ struct fwnet_peer {
         struct fwnet_device *dev;
         u64 guid;
         u64 fifo;
+        __be32 ip;
 
         /* guarded by dev->lock */
         struct list_head pd_list; /* received partial datagrams */
@@ -570,6 +571,8 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
                                 peer->speed = sspd;
                         if (peer->max_payload > max_payload)
                                 peer->max_payload = max_payload;
+
+                        peer->ip = arp1394->sip;
                 }
                 spin_unlock_irqrestore(&dev->lock, flags);
 
@@ -1470,6 +1473,7 @@ static int fwnet_add_peer(struct fwnet_device *dev,
         peer->dev = dev;
         peer->guid = (u64)device->config_rom[3] << 32 | device->config_rom[4];
         peer->fifo = FWNET_NO_FIFO_ADDR;
+        peer->ip = 0;
         INIT_LIST_HEAD(&peer->pd_list);
         peer->pdg_size = 0;
         peer->datagram_label = 0;
@@ -1589,10 +1593,13 @@ static int fwnet_remove(struct device *_dev)
 
         mutex_lock(&fwnet_device_mutex);
 
+        net = dev->netdev;
+        if (net && peer->ip)
+                arp_invalidate(net, peer->ip);
+
         fwnet_remove_peer(peer, dev);
 
         if (list_empty(&dev->peer_list)) {
-                net = dev->netdev;
                 unregister_netdev(net);
 
                 if (dev->local_fifo != FWNET_NO_FIFO_ADDR)
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index e8b6a13515b..e710424b59e 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -27,7 +27,7 @@ config EDD_OFF
           using the kernel parameter 'edd={on|skipmbr|off}'.
 
 config FIRMWARE_MEMMAP
-    bool "Add firmware-provided memory map to sysfs" if EMBEDDED
+    bool "Add firmware-provided memory map to sysfs" if EXPERT
     default X86
     help
       Add the firmware-provided (unmodified) memory map to /sys/firmware/memmap.
diff --git a/drivers/gpio/langwell_gpio.c b/drivers/gpio/langwell_gpio.c
index d81cc748e77..54d70a47afc 100644
--- a/drivers/gpio/langwell_gpio.c
+++ b/drivers/gpio/langwell_gpio.c
@@ -187,7 +187,7 @@ MODULE_DEVICE_TABLE(pci, lnw_gpio_ids);
 
 static void lnw_irq_handler(unsigned irq, struct irq_desc *desc)
 {
-        struct lnw_gpio *lnw = (struct lnw_gpio *)get_irq_data(irq);
+        struct lnw_gpio *lnw = get_irq_data(irq);
         u32 base, gpio;
         void __iomem *gedr;
         u32 gedr_v;
@@ -206,7 +206,12 @@ static void lnw_irq_handler(unsigned irq, struct irq_desc *desc)
                 /* clear the edge detect status bit */
                 writel(gedr_v, gedr);
         }
-        desc->chip->eoi(irq);
+
+        if (desc->chip->irq_eoi)
+                desc->chip->irq_eoi(irq_get_irq_data(irq));
+        else
+                dev_warn(lnw->chip.dev, "missing EOI handler for irq %d\n", irq);
+
 }
 
 static int __devinit lnw_gpio_probe(struct pci_dev *pdev,
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 64828a7db77..0902d446003 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -23,7 +23,7 @@ config DRM_KMS_HELPER
         tristate
         depends on DRM
         select FB
-        select FRAMEBUFFER_CONSOLE if !EMBEDDED
+        select FRAMEBUFFER_CONSOLE if !EXPERT
         help
           FB and CRTC helpers for KMS drivers.
 
@@ -100,7 +100,10 @@ config DRM_I830
 config DRM_I915
         tristate "i915 driver"
         depends on AGP_INTEL
+        # we need shmfs for the swappable backing store, and in particular
+        # the shmem_readpage() which depends upon tmpfs
         select SHMEM
+        select TMPFS
         select DRM_KMS_HELPER
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 2baa6708e44..654faa803dc 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2674,3 +2674,23 @@ out:
         mutex_unlock(&dev->mode_config.mutex);
         return ret;
 }
+
+void drm_mode_config_reset(struct drm_device *dev)
+{
+        struct drm_crtc *crtc;
+        struct drm_encoder *encoder;
+        struct drm_connector *connector;
+
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+                if (crtc->funcs->reset)
+                        crtc->funcs->reset(crtc);
+
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
+                if (encoder->funcs->reset)
+                        encoder->funcs->reset(encoder);
+
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head)
+                if (connector->funcs->reset)
+                        connector->funcs->reset(connector);
+}
+EXPORT_SYMBOL(drm_mode_config_reset);
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 952b3d4fb2a..92369655dca 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -343,13 +343,12 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         struct drm_encoder *encoder;
         bool ret = true;
 
-        adjusted_mode = drm_mode_duplicate(dev, mode);
-
         crtc->enabled = drm_helper_crtc_in_use(crtc);
-
         if (!crtc->enabled)
                 return true;
 
+        adjusted_mode = drm_mode_duplicate(dev, mode);
+
         saved_hwmode = crtc->hwmode;
         saved_mode = crtc->mode;
         saved_x = crtc->x;
@@ -437,10 +436,9 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
          */
         drm_calc_timestamping_constants(crtc);
 
-        /* XXX free adjustedmode */
-        drm_mode_destroy(dev, adjusted_mode);
         /* FIXME: add subpixel order */
 done:
+        drm_mode_destroy(dev, adjusted_mode);
         if (!ret) {
                 crtc->hwmode = saved_hwmode;
                 crtc->mode = saved_mode;
@@ -497,14 +495,17 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
 
         crtc_funcs = set->crtc->helper_private;
 
+        if (!set->mode)
+                set->fb = NULL;
+
         if (set->fb) {
                 DRM_DEBUG_KMS("[CRTC:%d] [FB:%d] #connectors=%d (x y) (%i %i)\n",
                                 set->crtc->base.id, set->fb->base.id,
                                 (int)set->num_connectors, set->x, set->y);
         } else {
-                DRM_DEBUG_KMS("[CRTC:%d] [NOFB] #connectors=%d (x y) (%i %i)\n",
-                                set->crtc->base.id, (int)set->num_connectors,
-                                set->x, set->y);
+                DRM_DEBUG_KMS("[CRTC:%d] [NOFB]\n", set->crtc->base.id);
+                set->mode = NULL;
+                set->num_connectors = 0;
         }
 
         dev = set->crtc->dev;
@@ -649,8 +650,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 mode_changed = true;
 
         if (mode_changed) {
-                set->crtc->enabled = (set->mode != NULL);
-                if (set->mode != NULL) {
+                set->crtc->enabled = drm_helper_crtc_in_use(set->crtc);
+                if (set->crtc->enabled) {
                         DRM_DEBUG_KMS("attempting to set mode from"
                                         " userspace\n");
                         drm_mode_debug_printmodeline(set->mode);
@@ -665,6 +666,12 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                                 ret = -EINVAL;
                                 goto fail;
                         }
+                        DRM_DEBUG_KMS("Setting connector DPMS state to on\n");
+                        for (i = 0; i < set->num_connectors; i++) {
+                                DRM_DEBUG_KMS("\t[CONNECTOR:%d:%s] set DPMS on\n", set->connectors[i]->base.id,
+                                              drm_get_connector_name(set->connectors[i]));
+                                set->connectors[i]->dpms = DRM_MODE_DPMS_ON;
+                        }
                 }
                 drm_helper_disable_unused_functions(dev);
         } else if (fb_changed) {
@@ -681,12 +688,6 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                         goto fail;
                 }
         }
-        DRM_DEBUG_KMS("Setting connector DPMS state to on\n");
-        for (i = 0; i < set->num_connectors; i++) {
-                DRM_DEBUG_KMS("\t[CONNECTOR:%d:%s] set DPMS on\n", set->connectors[i]->base.id,
-                              drm_get_connector_name(set->connectors[i]));
-                set->connectors[i]->dpms = DRM_MODE_DPMS_ON;
-        }
 
         kfree(save_connectors);
         kfree(save_encoders);
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 5c4f9b9ecdc..6977a1ce9d9 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1533,11 +1533,11 @@ bool drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
 }
 EXPORT_SYMBOL(drm_fb_helper_hotplug_event);
 
-/* The Kconfig DRM_KMS_HELPER selects FRAMEBUFFER_CONSOLE (if !EMBEDDED)
+/* The Kconfig DRM_KMS_HELPER selects FRAMEBUFFER_CONSOLE (if !EXPERT)
  * but the module doesn't depend on any fb console symbols.  At least
  * attempt to load fbcon to avoid leaving the system without a usable console.
  */
-#if defined(CONFIG_FRAMEBUFFER_CONSOLE_MODULE) && !defined(CONFIG_EMBEDDED)
+#if defined(CONFIG_FRAMEBUFFER_CONSOLE_MODULE) && !defined(CONFIG_EXPERT)
 static int __init drm_fb_helper_modinit(void)
 {
         const char *name = "fbcon";
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 0054e957203..3dadfa2a852 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -1250,7 +1250,7 @@ void drm_handle_vblank_events(struct drm_device *dev, int crtc)
  * Drivers should call this routine in their vblank interrupt handlers to
  * update the vblank counter and send any signals that may be pending.
  */
-void drm_handle_vblank(struct drm_device *dev, int crtc)
+bool drm_handle_vblank(struct drm_device *dev, int crtc)
 {
         u32 vblcount;
         s64 diff_ns;
@@ -1258,7 +1258,7 @@ void drm_handle_vblank(struct drm_device *dev, int crtc)
         unsigned long irqflags;
 
         if (!dev->num_crtcs)
-                return;
+                return false;
 
         /* Need timestamp lock to prevent concurrent execution with
          * vblank enable/disable, as this would cause inconsistent
@@ -1269,7 +1269,7 @@ void drm_handle_vblank(struct drm_device *dev, int crtc)
         /* Vblank irq handling disabled. Nothing to do. */
         if (!dev->vblank_enabled[crtc]) {
                 spin_unlock_irqrestore(&dev->vblank_time_lock, irqflags);
-                return;
+                return false;
         }
 
         /* Fetch corresponding timestamp for this vblank interval from
@@ -1311,5 +1311,6 @@ void drm_handle_vblank(struct drm_device *dev, int crtc)
         drm_handle_vblank_events(dev, crtc);
 
         spin_unlock_irqrestore(&dev->vblank_time_lock, irqflags);
+        return true;
 }
 EXPORT_SYMBOL(drm_handle_vblank);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 844f3c972b0..17bd766f208 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -152,7 +152,7 @@ static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
-        struct intel_ring_buffer *ring = LP_RING(dev_priv);
+        int ret;
 
         master_priv->sarea = drm_getsarea(dev);
         if (master_priv->sarea) {
@@ -163,33 +163,22 @@ static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
         }
 
         if (init->ring_size != 0) {
-                if (ring->obj != NULL) {
+                if (LP_RING(dev_priv)->obj != NULL) {
                         i915_dma_cleanup(dev);
                         DRM_ERROR("Client tried to initialize ringbuffer in "
                                   "GEM mode\n");
                         return -EINVAL;
                 }
 
-                ring->size = init->ring_size;
-
-                ring->map.offset = init->ring_start;
-                ring->map.size = init->ring_size;
-                ring->map.type = 0;
-                ring->map.flags = 0;
-                ring->map.mtrr = 0;
-
-                drm_core_ioremap_wc(&ring->map, dev);
-
-                if (ring->map.handle == NULL) {
+                ret = intel_render_ring_init_dri(dev,
+                                                 init->ring_start,
+                                                 init->ring_size);
+                if (ret) {
                         i915_dma_cleanup(dev);
-                        DRM_ERROR("can not ioremap virtual address for"
-                                  " ring buffer\n");
-                        return -ENOMEM;
+                        return ret;
                 }
         }
 
-        ring->virtual_start = ring->map.handle;
-
         dev_priv->cpp = init->cpp;
         dev_priv->back_offset = init->back_offset;
         dev_priv->front_offset = init->front_offset;
@@ -1226,9 +1215,15 @@ static int i915_load_modeset_init(struct drm_device *dev)
         if (ret)
                 DRM_INFO("failed to find VBIOS tables\n");
 
-        /* if we have > 1 VGA cards, then disable the radeon VGA resources */
+        /* If we have > 1 VGA cards, then we need to arbitrate access
+         * to the common VGA resources.
+         *
+         * If we are a secondary display controller (!PCI_DISPLAY_CLASS_VGA),
+         * then we do not take part in VGA arbitration and the
+         * vga_client_register() fails with -ENODEV.
+         */
         ret = vga_client_register(dev->pdev, dev, NULL, i915_vga_set_decode);
-        if (ret)
+        if (ret && ret != -ENODEV)
                 goto cleanup_ringbuffer;
 
         intel_register_dsm_handler();
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 72fea2bcfc4..cfb56d0ff36 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -60,7 +60,7 @@ extern int intel_agp_enabled;
 
 #define INTEL_VGA_DEVICE(id, info) {            \
         .class = PCI_CLASS_DISPLAY_VGA << 8,    \
-        .class_mask = 0xffff00,                 \
+        .class_mask = 0xff0000,                 \
         .vendor = 0x8086,                       \
         .device = id,                           \
         .subvendor = PCI_ANY_ID,                \
@@ -354,6 +354,7 @@ static int i915_drm_thaw(struct drm_device *dev)
                 error = i915_gem_init_ringbuffer(dev);
                 mutex_unlock(&dev->struct_mutex);
 
+                drm_mode_config_reset(dev);
                 drm_irq_install(dev);
 
                 /* Resume the modeset for every activated CRTC */
@@ -542,6 +543,7 @@ int i915_reset(struct drm_device *dev, u8 flags)
 
                 mutex_unlock(&dev->struct_mutex);
                 drm_irq_uninstall(dev);
+                drm_mode_config_reset(dev);
                 drm_irq_install(dev);
                 mutex_lock(&dev->struct_mutex);
         }
@@ -566,6 +568,14 @@ int i915_reset(struct drm_device *dev, u8 flags)
 static int __devinit
 i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
+        /* Only bind to function 0 of the device. Early generations
+         * used function 1 as a placeholder for multi-head. This causes
+         * us confusion instead, especially on the systems where both
+         * functions have the same PCI-ID!
+         */
+        if (PCI_FUNC(pdev->devfn))
+                return -ENODEV;
+
         return drm_get_pci_dev(pdev, ent, &driver);
 }
 
@@ -752,6 +762,9 @@ static int __init i915_init(void)
                 driver.driver_features &= ~DRIVER_MODESET;
 #endif
 
+        if (!(driver.driver_features & DRIVER_MODESET))
+                driver.get_vblank_timestamp = NULL;
+
         return drm_init(&driver);
 }
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 5969f46ac2d..a0149c619cd 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -543,8 +543,11 @@ typedef struct drm_i915_private {
                 /** List of all objects in gtt_space. Used to restore gtt
                  * mappings on resume */
                 struct list_head gtt_list;
-                /** End of mappable part of GTT */
+
+                /** Usable portion of the GTT for GEM */
+                unsigned long gtt_start;
                 unsigned long gtt_mappable_end;
+                unsigned long gtt_end;
 
                 struct io_mapping *gtt_mapping;
                 int gtt_mtrr;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 3dfc848ff75..cf4f74c7c6f 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -140,12 +140,16 @@ void i915_gem_do_init(struct drm_device *dev,
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
 
-        drm_mm_init(&dev_priv->mm.gtt_space, start,
-                    end - start);
+        drm_mm_init(&dev_priv->mm.gtt_space, start, end - start);
 
+        dev_priv->mm.gtt_start = start;
+        dev_priv->mm.gtt_mappable_end = mappable_end;
+        dev_priv->mm.gtt_end = end;
         dev_priv->mm.gtt_total = end - start;
         dev_priv->mm.mappable_gtt_total = min(end, mappable_end) - start;
-        dev_priv->mm.gtt_mappable_end = mappable_end;
+
+        /* Take over this portion of the GTT */
+        intel_gtt_clear_range(start / PAGE_SIZE, (end-start) / PAGE_SIZE);
 }
 
 int
@@ -1857,7 +1861,7 @@ i915_gem_retire_requests_ring(struct drm_device *dev,
 
         seqno = ring->get_seqno(ring);
 
-        for (i = 0; i < I915_NUM_RINGS; i++)
+        for (i = 0; i < ARRAY_SIZE(ring->sync_seqno); i++)
                 if (seqno >= ring->sync_seqno[i])
                         ring->sync_seqno[i] = 0;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index dcfdf4151b6..d2f445e825f 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1175,7 +1175,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                 goto err;
 
         seqno = i915_gem_next_request_seqno(dev, ring);
-        for (i = 0; i < I915_NUM_RINGS-1; i++) {
+        for (i = 0; i < ARRAY_SIZE(ring->sync_seqno); i++) {
                 if (seqno < ring->sync_seqno[i]) {
                         /* The GPU can not handle its semaphore value wrapping,
                          * so every billion or so execbuffers, we need to stall
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 70433ae50ac..b0abdc64aa9 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -34,6 +34,10 @@ void i915_gem_restore_gtt_mappings(struct drm_device *dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj;
 
+        /* First fill our portion of the GTT with scratch pages */
+        intel_gtt_clear_range(dev_priv->mm.gtt_start / PAGE_SIZE,
+                              (dev_priv->mm.gtt_end - dev_priv->mm.gtt_start) / PAGE_SIZE);
+
         list_for_each_entry(obj, &dev_priv->mm.gtt_list, gtt_list) {
                 i915_gem_clflush_object(obj);
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index b8e509ae065..97f946dcc1a 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -274,24 +274,35 @@ int i915_get_crtc_scanoutpos(struct drm_device *dev, int pipe,
         return ret;
 }
 
-int i915_get_vblank_timestamp(struct drm_device *dev, int crtc,
+int i915_get_vblank_timestamp(struct drm_device *dev, int pipe,
                               int *max_error,
                               struct timeval *vblank_time,
                               unsigned flags)
 {
-        struct drm_crtc *drmcrtc;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_crtc *crtc;
 
-        if (crtc < 0 || crtc >= dev->num_crtcs) {
-                DRM_ERROR("Invalid crtc %d\n", crtc);
+        if (pipe < 0 || pipe >= dev_priv->num_pipe) {
+                DRM_ERROR("Invalid crtc %d\n", pipe);
                 return -EINVAL;
         }
 
         /* Get drm_crtc to timestamp: */
-        drmcrtc = intel_get_crtc_for_pipe(dev, crtc);
+        crtc = intel_get_crtc_for_pipe(dev, pipe);
+        if (crtc == NULL) {
+                DRM_ERROR("Invalid crtc %d\n", pipe);
+                return -EINVAL;
+        }
+
+        if (!crtc->enabled) {
+                DRM_DEBUG_KMS("crtc %d is disabled\n", pipe);
+                return -EBUSY;
+        }
 
         /* Helper routine in DRM core does all the work: */
-        return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error,
-                                                     vblank_time, flags, drmcrtc);
+        return drm_calc_vbltimestamp_from_scanoutpos(dev, pipe, max_error,
+                                                     vblank_time, flags,
+                                                     crtc);
 }
 
 /*
@@ -348,8 +359,12 @@ static void notify_ring(struct drm_device *dev,
                         struct intel_ring_buffer *ring)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 seqno = ring->get_seqno(ring);
+        u32 seqno;
 
+        if (ring->obj == NULL)
+                return;
+
+        seqno = ring->get_seqno(ring);
         trace_i915_gem_request_complete(dev, seqno);
 
         ring->irq_seqno = seqno;
@@ -831,6 +846,8 @@ static void i915_capture_error_state(struct drm_device *dev)
                 i++;
         error->pinned_bo_count = i - error->active_bo_count;
 
+        error->active_bo = NULL;
+        error->pinned_bo = NULL;
         if (i) {
                 error->active_bo = kmalloc(sizeof(*error->active_bo)*i,
                                            GFP_ATOMIC);
@@ -1179,18 +1196,18 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                                 intel_finish_page_flip_plane(dev, 1);
                 }
 
-                if (pipea_stats & vblank_status) {
+                if (pipea_stats & vblank_status &&
+                    drm_handle_vblank(dev, 0)) {
                         vblank++;
-                        drm_handle_vblank(dev, 0);
                         if (!dev_priv->flip_pending_is_done) {
                                 i915_pageflip_stall_check(dev, 0);
                                 intel_finish_page_flip(dev, 0);
                         }
                 }
 
-                if (pipeb_stats & vblank_status) {
+                if (pipeb_stats & vblank_status &&
+                    drm_handle_vblank(dev, 1)) {
                         vblank++;
-                        drm_handle_vblank(dev, 1);
                         if (!dev_priv->flip_pending_is_done) {
                                 i915_pageflip_stall_check(dev, 1);
                                 intel_finish_page_flip(dev, 1);
@@ -1278,12 +1295,12 @@ static int i915_wait_irq(struct drm_device * dev, int irq_nr)
         if (master_priv->sarea_priv)
                 master_priv->sarea_priv->perf_boxes |= I915_BOX_WAIT;
 
-        ret = -ENODEV;
         if (ring->irq_get(ring)) {
                 DRM_WAIT_ON(ret, ring->irq_queue, 3 * DRM_HZ,
                             READ_BREADCRUMB(dev_priv) >= irq_nr);
                 ring->irq_put(ring);
-        }
+        } else if (wait_for(READ_BREADCRUMB(dev_priv) >= irq_nr, 3000))
+                ret = -EBUSY;
 
         if (ret == -EBUSY) {
                 DRM_ERROR("EBUSY -- rec: %d emitted: %d\n",
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 40a407f41f6..5cfc68940f1 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -513,6 +513,10 @@
 #define   GEN6_BLITTER_SYNC_STATUS                      (1 << 24)
 #define   GEN6_BLITTER_USER_INTERRUPT                   (1 << 22)
 
+#define GEN6_BLITTER_ECOSKPD    0x221d0
+#define   GEN6_BLITTER_LOCK_SHIFT                       16
+#define   GEN6_BLITTER_FBC_NOTIFY                       (1<<3)
+
 #define GEN6_BSD_SLEEP_PSMI_CONTROL     0x12050
 #define   GEN6_BSD_SLEEP_PSMI_CONTROL_RC_ILDL_MESSAGE_MODIFY_MASK       (1 << 16)
 #define   GEN6_BSD_SLEEP_PSMI_CONTROL_RC_ILDL_MESSAGE_DISABLE           (1 << 0)
@@ -2626,6 +2630,8 @@
 #define DISPLAY_PORT_PLL_BIOS_2         0x46014
 
 #define PCH_DSPCLK_GATE_D       0x42020
+# define DPFCUNIT_CLOCK_GATE_DISABLE            (1 << 9)
+# define DPFCRUNIT_CLOCK_GATE_DISABLE           (1 << 8)
 # define DPFDUNIT_CLOCK_GATE_DISABLE            (1 << 7)
 # define DPARBUNIT_CLOCK_GATE_DISABLE           (1 << 5)
 
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 17035b87ee4..8a77ff4a723 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -535,6 +535,15 @@ static int intel_crt_set_property(struct drm_connector *connector,
         return 0;
 }
 
+static void intel_crt_reset(struct drm_connector *connector)
+{
+        struct drm_device *dev = connector->dev;
+        struct intel_crt *crt = intel_attached_crt(connector);
+
+        if (HAS_PCH_SPLIT(dev))
+                crt->force_hotplug_required = 1;
+}
+
 /*
  * Routines for controlling stuff on the analog port
  */
@@ -548,6 +557,7 @@ static const struct drm_encoder_helper_funcs intel_crt_helper_funcs = {
 };
 
 static const struct drm_connector_funcs intel_crt_connector_funcs = {
+        .reset = intel_crt_reset,
         .dpms = drm_helper_connector_dpms,
         .detect = intel_crt_detect,
         .fill_modes = drm_helper_probe_single_connector_modes,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 98967f3b772..7e42aa58650 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1213,6 +1213,26 @@ static bool g4x_fbc_enabled(struct drm_device *dev)
         return I915_READ(DPFC_CONTROL) & DPFC_CTL_EN;
 }
 
+static void sandybridge_blit_fbc_update(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 blt_ecoskpd;
+
+        /* Make sure blitter notifies FBC of writes */
+        __gen6_force_wake_get(dev_priv);
+        blt_ecoskpd = I915_READ(GEN6_BLITTER_ECOSKPD);
+        blt_ecoskpd |= GEN6_BLITTER_FBC_NOTIFY <<
+                GEN6_BLITTER_LOCK_SHIFT;
+        I915_WRITE(GEN6_BLITTER_ECOSKPD, blt_ecoskpd);
+        blt_ecoskpd |= GEN6_BLITTER_FBC_NOTIFY;
+        I915_WRITE(GEN6_BLITTER_ECOSKPD, blt_ecoskpd);
+        blt_ecoskpd &= ~(GEN6_BLITTER_FBC_NOTIFY <<
+                         GEN6_BLITTER_LOCK_SHIFT);
+        I915_WRITE(GEN6_BLITTER_ECOSKPD, blt_ecoskpd);
+        POSTING_READ(GEN6_BLITTER_ECOSKPD);
+        __gen6_force_wake_put(dev_priv);
+}
+
 static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
 {
         struct drm_device *dev = crtc->dev;
@@ -1266,6 +1286,7 @@ static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
                 I915_WRITE(SNB_DPFC_CTL_SA,
                            SNB_CPU_FENCE_ENABLE | dev_priv->cfb_fence);
                 I915_WRITE(DPFC_CPU_FENCE_OFFSET, crtc->y);
+                sandybridge_blit_fbc_update(dev);
         }
 
         DRM_DEBUG_KMS("enabled fbc on plane %d\n", intel_crtc->plane);
@@ -5530,6 +5551,18 @@ cleanup_work:
         return ret;
 }
 
+static void intel_crtc_reset(struct drm_crtc *crtc)
+{
+        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+
+        /* Reset flags back to the 'unknown' status so that they
+         * will be correctly set on the initial modeset.
+         */
+        intel_crtc->cursor_addr = 0;
+        intel_crtc->dpms_mode = -1;
+        intel_crtc->active = true; /* force the pipe off on setup_init_config */
+}
+
 static struct drm_crtc_helper_funcs intel_helper_funcs = {
         .dpms = intel_crtc_dpms,
         .mode_fixup = intel_crtc_mode_fixup,
@@ -5541,6 +5574,7 @@ static struct drm_crtc_helper_funcs intel_helper_funcs = {
 };
 
 static const struct drm_crtc_funcs intel_crtc_funcs = {
+        .reset = intel_crtc_reset,
         .cursor_set = intel_crtc_cursor_set,
         .cursor_move = intel_crtc_cursor_move,
         .gamma_set = intel_crtc_gamma_set,
@@ -5631,9 +5665,7 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
         dev_priv->plane_to_crtc_mapping[intel_crtc->plane] = &intel_crtc->base;
         dev_priv->pipe_to_crtc_mapping[intel_crtc->pipe] = &intel_crtc->base;
 
-        intel_crtc->cursor_addr = 0;
-        intel_crtc->dpms_mode = -1;
-        intel_crtc->active = true; /* force the pipe off on setup_init_config */
+        intel_crtc_reset(&intel_crtc->base);
 
         if (HAS_PCH_SPLIT(dev)) {
                 intel_helper_funcs.prepare = ironlake_crtc_prepare;
@@ -6286,7 +6318,9 @@ void intel_enable_clock_gating(struct drm_device *dev)
 
                 if (IS_GEN5(dev)) {
                         /* Required for FBC */
-                        dspclk_gate |= DPFDUNIT_CLOCK_GATE_DISABLE;
+                        dspclk_gate |= DPFCUNIT_CLOCK_GATE_DISABLE |
+                                DPFCRUNIT_CLOCK_GATE_DISABLE |
+                                DPFDUNIT_CLOCK_GATE_DISABLE;
                         /* Required for CxSR */
                         dspclk_gate |= DPARBUNIT_CLOCK_GATE_DISABLE;
 
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index f295a7aaadf..64fd64443ca 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -26,6 +26,7 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/acpi_io.h>
 #include <acpi/video.h>
 
 #include "drmP.h"
@@ -476,7 +477,7 @@ int intel_opregion_setup(struct drm_device *dev)
                 return -ENOTSUPP;
         }
 
-        base = ioremap(asls, OPREGION_SIZE);
+        base = acpi_os_ioremap(asls, OPREGION_SIZE);
         if (!base)
                 return -ENOMEM;
 
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 03e33707251..6218fa97aa1 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -34,6 +34,14 @@
 #include "i915_trace.h"
 #include "intel_drv.h"
 
+static inline int ring_space(struct intel_ring_buffer *ring)
+{
+        int space = (ring->head & HEAD_ADDR) - (ring->tail + 8);
+        if (space < 0)
+                space += ring->size;
+        return space;
+}
+
 static u32 i915_gem_get_seqno(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
@@ -204,11 +212,9 @@ static int init_ring_common(struct intel_ring_buffer *ring)
         if (!drm_core_check_feature(ring->dev, DRIVER_MODESET))
                 i915_kernel_lost_context(ring->dev);
         else {
-                ring->head = I915_READ_HEAD(ring) & HEAD_ADDR;
+                ring->head = I915_READ_HEAD(ring);
                 ring->tail = I915_READ_TAIL(ring) & TAIL_ADDR;
-                ring->space = ring->head - (ring->tail + 8);
-                if (ring->space < 0)
-                        ring->space += ring->size;
+                ring->space = ring_space(ring);
         }
 
         return 0;
@@ -921,7 +927,7 @@ static int intel_wrap_ring_buffer(struct intel_ring_buffer *ring)
         }
 
         ring->tail = 0;
-        ring->space = ring->head - 8;
+        ring->space = ring_space(ring);
 
         return 0;
 }
@@ -933,20 +939,22 @@ int intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n)
         unsigned long end;
         u32 head;
 
+        /* If the reported head position has wrapped or hasn't advanced,
+         * fallback to the slow and accurate path.
+         */
+        head = intel_read_status_page(ring, 4);
+        if (head > ring->head) {
+                ring->head = head;
+                ring->space = ring_space(ring);
+                if (ring->space >= n)
+                        return 0;
+        }
+
         trace_i915_ring_wait_begin (dev);
         end = jiffies + 3 * HZ;
         do {
-                /* If the reported head position has wrapped or hasn't advanced,
-                 * fallback to the slow and accurate path.
-                 */
-                head = intel_read_status_page(ring, 4);
-                if (head < ring->actual_head)
-                        head = I915_READ_HEAD(ring);
-                ring->actual_head = head;
-                ring->head = head & HEAD_ADDR;
-                ring->space = ring->head - (ring->tail + 8);
-                if (ring->space < 0)
-                        ring->space += ring->size;
+                ring->head = I915_READ_HEAD(ring);
+                ring->space = ring_space(ring);
                 if (ring->space >= n) {
                         trace_i915_ring_wait_end(dev);
                         return 0;
@@ -1291,6 +1299,48 @@ int intel_init_render_ring_buffer(struct drm_device *dev)
         return intel_init_ring_buffer(dev, ring);
 }
 
+int intel_render_ring_init_dri(struct drm_device *dev, u64 start, u32 size)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring = &dev_priv->ring[RCS];
+
+        *ring = render_ring;
+        if (INTEL_INFO(dev)->gen >= 6) {
+                ring->add_request = gen6_add_request;
+                ring->irq_get = gen6_render_ring_get_irq;
+                ring->irq_put = gen6_render_ring_put_irq;
+        } else if (IS_GEN5(dev)) {
+                ring->add_request = pc_render_add_request;
+                ring->get_seqno = pc_render_get_seqno;
+        }
+
+        ring->dev = dev;
+        INIT_LIST_HEAD(&ring->active_list);
+        INIT_LIST_HEAD(&ring->request_list);
+        INIT_LIST_HEAD(&ring->gpu_write_list);
+
+        ring->size = size;
+        ring->effective_size = ring->size;
+        if (IS_I830(ring->dev))
+                ring->effective_size -= 128;
+
+        ring->map.offset = start;
+        ring->map.size = size;
+        ring->map.type = 0;
+        ring->map.flags = 0;
+        ring->map.mtrr = 0;
+
+        drm_core_ioremap_wc(&ring->map, dev);
+        if (ring->map.handle == NULL) {
+                DRM_ERROR("can not ioremap virtual address for"
+                          " ring buffer\n");
+                return -ENOMEM;
+        }
+
+        ring->virtual_start = (void __force __iomem *)ring->map.handle;
+        return 0;
+}
+
 int intel_init_bsd_ring_buffer(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index be9087e4c9b..6d6fde85a63 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -47,7 +47,6 @@ struct  intel_ring_buffer {
         struct          drm_device *dev;
         struct          drm_i915_gem_object *obj;
 
-        u32             actual_head;
         u32             head;
         u32             tail;
         int             space;
@@ -167,4 +166,7 @@ int intel_init_blt_ring_buffer(struct drm_device *dev);
 u32 intel_ring_get_active_head(struct intel_ring_buffer *ring);
 void intel_ring_setup_status_page(struct intel_ring_buffer *ring);
 
+/* DRI warts */
+int intel_render_ring_init_dri(struct drm_device *dev, u64 start, u32 size);
+
 #endif /* _INTEL_RINGBUFFER_H_ */
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 45cd37652a3..6a09c1413d6 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -473,20 +473,6 @@ static bool intel_sdvo_write_cmd(struct intel_sdvo *intel_sdvo, u8 cmd,
                 return false;
         }
 
-        i = 3;
-        while (status == SDVO_CMD_STATUS_PENDING && i--) {
-                if (!intel_sdvo_read_byte(intel_sdvo,
-                                          SDVO_I2C_CMD_STATUS,
-                                          &status))
-                        return false;
-        }
-        if (status != SDVO_CMD_STATUS_SUCCESS) {
-                DRM_DEBUG_KMS("command returns response %s [%d]\n",
-                              status <= SDVO_CMD_STATUS_SCALING_NOT_SUPP ? cmd_status_names[status] : "???",
-                              status);
-                return false;
-        }
-
         return true;
 }
 
@@ -497,6 +483,8 @@ static bool intel_sdvo_read_response(struct intel_sdvo *intel_sdvo,
         u8 status;
         int i;
 
+        DRM_DEBUG_KMS("%s: R: ", SDVO_NAME(intel_sdvo));
+
         /*
          * The documentation states that all commands will be
          * processed within 15µs, and that we need only poll
@@ -505,14 +493,19 @@ static bool intel_sdvo_read_response(struct intel_sdvo *intel_sdvo,
          *
          * Check 5 times in case the hardware failed to read the docs.
          */
-        do {
+        if (!intel_sdvo_read_byte(intel_sdvo,
+                                  SDVO_I2C_CMD_STATUS,
+                                  &status))
+                goto log_fail;
+
+        while (status == SDVO_CMD_STATUS_PENDING && retry--) {
+                udelay(15);
                 if (!intel_sdvo_read_byte(intel_sdvo,
                                           SDVO_I2C_CMD_STATUS,
                                           &status))
-                        return false;
-        } while (status == SDVO_CMD_STATUS_PENDING && --retry);
+                        goto log_fail;
+        }
 
-        DRM_DEBUG_KMS("%s: R: ", SDVO_NAME(intel_sdvo));
         if (status <= SDVO_CMD_STATUS_SCALING_NOT_SUPP)
                 DRM_LOG_KMS("(%s)", cmd_status_names[status]);
         else
@@ -533,7 +526,7 @@ static bool intel_sdvo_read_response(struct intel_sdvo *intel_sdvo,
         return true;
 
 log_fail:
-        DRM_LOG_KMS("\n");
+        DRM_LOG_KMS("... failed\n");
         return false;
 }
 
@@ -550,6 +543,7 @@ static int intel_sdvo_get_pixel_multiplier(struct drm_display_mode *mode)
 static bool intel_sdvo_set_control_bus_switch(struct intel_sdvo *intel_sdvo,
                                               u8 ddc_bus)
 {
+        /* This must be the immediately preceding write before the i2c xfer */
         return intel_sdvo_write_cmd(intel_sdvo,
                                     SDVO_CMD_SET_CONTROL_BUS_SWITCH,
                                     &ddc_bus, 1);
@@ -557,7 +551,10 @@ static bool intel_sdvo_set_control_bus_switch(struct intel_sdvo *intel_sdvo,
 
 static bool intel_sdvo_set_value(struct intel_sdvo *intel_sdvo, u8 cmd, const void *data, int len)
 {
-        return intel_sdvo_write_cmd(intel_sdvo, cmd, data, len);
+        if (!intel_sdvo_write_cmd(intel_sdvo, cmd, data, len))
+                return false;
+
+        return intel_sdvo_read_response(intel_sdvo, NULL, 0);
 }
 
 static bool
@@ -859,18 +856,21 @@ static bool intel_sdvo_set_avi_infoframe(struct intel_sdvo *intel_sdvo)
 
         intel_dip_infoframe_csum(&avi_if);
 
-        if (!intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_HBUF_INDEX,
+        if (!intel_sdvo_set_value(intel_sdvo,
+                                  SDVO_CMD_SET_HBUF_INDEX,
                                   set_buf_index, 2))
                 return false;
 
         for (i = 0; i < sizeof(avi_if); i += 8) {
-                if (!intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_HBUF_DATA,
+                if (!intel_sdvo_set_value(intel_sdvo,
+                                          SDVO_CMD_SET_HBUF_DATA,
                                           data, 8))
                         return false;
                 data++;
         }
 
-        return intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_HBUF_TXRATE,
+        return intel_sdvo_set_value(intel_sdvo,
+                                    SDVO_CMD_SET_HBUF_TXRATE,
                                     &tx_rate, 1);
 }
 
diff --git a/drivers/gpu/drm/nouveau/Kconfig b/drivers/gpu/drm/nouveau/Kconfig
index 21d6c29c2d2..de70959b9ed 100644
--- a/drivers/gpu/drm/nouveau/Kconfig
+++ b/drivers/gpu/drm/nouveau/Kconfig
@@ -8,7 +8,7 @@ config DRM_NOUVEAU
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
         select FB
-        select FRAMEBUFFER_CONSOLE if !EMBEDDED
+        select FRAMEBUFFER_CONSOLE if !EXPERT
         select FB_BACKLIGHT if DRM_NOUVEAU_BACKLIGHT
         select ACPI_VIDEO if ACPI && X86 && BACKLIGHT_CLASS_DEVICE && VIDEO_OUTPUT_CONTROL && INPUT
         help
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 2aef5cd3acf..49e5e99917e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -6310,6 +6310,9 @@ void merge_like_dcb_entries(struct drm_device *dev, struct dcb_table *dcb)
 static bool
 apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)
 {
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        struct dcb_table *dcb = &dev_priv->vbios.dcb;
+
         /* Dell Precision M6300
          *   DCB entry 2: 02025312 00000010
          *   DCB entry 3: 02026312 00000020
@@ -6327,6 +6330,18 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)
                         return false;
         }
 
+        /* GeForce3 Ti 200
+         *
+         * DCB reports an LVDS output that should be TMDS:
+         *   DCB entry 1: f2005014 ffffffff
+         */
+        if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) {
+                if (*conn == 0xf2005014 && *conf == 0xffffffff) {
+                        fabricate_dcb_output(dcb, OUTPUT_TMDS, 1, 1, 1);
+                        return false;
+                }
+        }
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.c b/drivers/gpu/drm/nouveau/nouveau_drv.c
index 13bb672a16f..f658a04eecf 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.c
@@ -234,9 +234,9 @@ nouveau_pci_suspend(struct pci_dev *pdev, pm_message_t pm_state)
                 pci_set_power_state(pdev, PCI_D3hot);
         }
 
-        acquire_console_sem();
+        console_lock();
         nouveau_fbcon_set_suspend(dev, 1);
-        release_console_sem();
+        console_unlock();
         nouveau_fbcon_restore_accel(dev);
         return 0;
 
@@ -359,9 +359,9 @@ nouveau_pci_resume(struct pci_dev *pdev)
                 nv_crtc->lut.depth = 0;
         }
 
-        acquire_console_sem();
+        console_lock();
         nouveau_fbcon_set_suspend(dev, 0);
-        release_console_sem();
+        console_unlock();
 
         nouveau_fbcon_zfill_all(dev);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 01bffc4412d..9821fcacc3d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -848,9 +848,6 @@ extern void nv10_mem_put_tile_region(struct drm_device *dev,
                                      struct nouveau_fence *fence);
 extern const struct ttm_mem_type_manager_func nouveau_vram_manager;
 
-/* nvc0_vram.c */
-extern const struct ttm_mem_type_manager_func nvc0_vram_manager;
-
 /* nouveau_notifier.c */
 extern int  nouveau_notifier_init_channel(struct nouveau_channel *);
 extern void nouveau_notifier_takedown_channel(struct nouveau_channel *);
diff --git a/drivers/gpu/drm/nouveau/nouveau_pm.c b/drivers/gpu/drm/nouveau/nouveau_pm.c
index fb846a3fef1..f05c0cddfec 100644
--- a/drivers/gpu/drm/nouveau/nouveau_pm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_pm.c
@@ -443,7 +443,7 @@ nouveau_hwmon_fini(struct drm_device *dev)
         struct nouveau_pm_engine *pm = &dev_priv->engine.pm;
 
         if (pm->hwmon) {
-                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_attrgroup);
+                sysfs_remove_group(&dev->pdev->dev.kobj, &hwmon_attrgroup);
                 hwmon_device_unregister(pm->hwmon);
         }
 #endif
diff --git a/drivers/gpu/drm/nouveau/nouveau_temp.c b/drivers/gpu/drm/nouveau/nouveau_temp.c
index 7ecc4adc1e4..8d9968e1cba 100644
--- a/drivers/gpu/drm/nouveau/nouveau_temp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_temp.c
@@ -265,8 +265,8 @@ nouveau_temp_probe_i2c(struct drm_device *dev)
         struct i2c_board_info info[] = {
                 { I2C_BOARD_INFO("w83l785ts", 0x2d) },
                 { I2C_BOARD_INFO("w83781d", 0x2d) },
-                { I2C_BOARD_INFO("f75375", 0x2e) },
                 { I2C_BOARD_INFO("adt7473", 0x2e) },
+                { I2C_BOARD_INFO("f75375", 0x2e) },
                 { I2C_BOARD_INFO("lm99", 0x4c) },
                 { }
         };
diff --git a/drivers/gpu/drm/nouveau/nv50_evo.c b/drivers/gpu/drm/nouveau/nv50_evo.c
index 14e24e906ee..0ea090f4244 100644
--- a/drivers/gpu/drm/nouveau/nv50_evo.c
+++ b/drivers/gpu/drm/nouveau/nv50_evo.c
@@ -283,8 +283,7 @@ nv50_evo_create(struct drm_device *dev)
                         nv50_evo_channel_del(&dev_priv->evo);
                         return ret;
                 }
-        } else
-        if (dev_priv->chipset != 0x50) {
+        } else {
                 ret = nv50_evo_dmaobj_new(evo, 0x3d, NvEvoFB16, 0x70, 0x19,
                                           0, 0xffffffff, 0x00010000);
                 if (ret) {
diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
index 2d7ea75a09d..37e21d2be95 100644
--- a/drivers/gpu/drm/nouveau/nv50_graph.c
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -256,6 +256,7 @@ nv50_graph_destroy_context(struct nouveau_channel *chan)
         struct drm_device *dev = chan->dev;
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+        struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
         int i, hdr = (dev_priv->chipset == 0x50) ? 0x200 : 0x20;
         unsigned long flags;
 
@@ -265,6 +266,7 @@ nv50_graph_destroy_context(struct nouveau_channel *chan)
                 return;
 
         spin_lock_irqsave(&dev_priv->context_switch_lock, flags);
+        pfifo->reassign(dev, false);
         pgraph->fifo_access(dev, false);
 
         if (pgraph->channel(dev) == chan)
@@ -275,6 +277,7 @@ nv50_graph_destroy_context(struct nouveau_channel *chan)
         dev_priv->engine.instmem.flush(dev);
 
         pgraph->fifo_access(dev, true);
+        pfifo->reassign(dev, true);
         spin_unlock_irqrestore(&dev_priv->context_switch_lock, flags);
 
         nouveau_gpuobj_ref(NULL, &chan->ramin_grctx);
diff --git a/drivers/gpu/drm/nouveau/nv50_vm.c b/drivers/gpu/drm/nouveau/nv50_vm.c
index 38e523e1099..459ff08241e 100644
--- a/drivers/gpu/drm/nouveau/nv50_vm.c
+++ b/drivers/gpu/drm/nouveau/nv50_vm.c
@@ -45,11 +45,6 @@ nv50_vm_map_pgt(struct nouveau_gpuobj *pgd, u32 pde,
         }
 
         if (phys & 1) {
-                if (dev_priv->vram_sys_base) {
-                        phys += dev_priv->vram_sys_base;
-                        phys |= 0x30;
-                }
-
                 if (coverage <= 32 * 1024 * 1024)
                         phys |= 0x60;
                 else if (coverage <= 64 * 1024 * 1024)
diff --git a/drivers/gpu/drm/nouveau/nvc0_graph.c b/drivers/gpu/drm/nouveau/nvc0_graph.c
index e6ea7d83187..eb18a7e89f5 100644
--- a/drivers/gpu/drm/nouveau/nvc0_graph.c
+++ b/drivers/gpu/drm/nouveau/nvc0_graph.c
@@ -31,6 +31,7 @@
 #include "nvc0_graph.h"
 
 static void nvc0_graph_isr(struct drm_device *);
+static void nvc0_runk140_isr(struct drm_device *);
 static int  nvc0_graph_unload_context_to(struct drm_device *dev, u64 chan);
 
 void
@@ -281,6 +282,7 @@ nvc0_graph_destroy(struct drm_device *dev)
                 return;
 
         nouveau_irq_unregister(dev, 12);
+        nouveau_irq_unregister(dev, 25);
 
         nouveau_gpuobj_ref(NULL, &priv->unk4188b8);
         nouveau_gpuobj_ref(NULL, &priv->unk4188b4);
@@ -390,6 +392,7 @@ nvc0_graph_create(struct drm_device *dev)
         }
 
         nouveau_irq_register(dev, 12, nvc0_graph_isr);
+        nouveau_irq_register(dev, 25, nvc0_runk140_isr);
         NVOBJ_CLASS(dev, 0x902d, GR); /* 2D */
         NVOBJ_CLASS(dev, 0x9039, GR); /* M2MF */
         NVOBJ_CLASS(dev, 0x9097, GR); /* 3D */
@@ -512,8 +515,8 @@ nvc0_graph_init_gpc_1(struct drm_device *dev)
                         nv_wr32(dev, TP_UNIT(gpc, tp, 0x224), 0xc0000000);
                         nv_wr32(dev, TP_UNIT(gpc, tp, 0x48c), 0xc0000000);
                         nv_wr32(dev, TP_UNIT(gpc, tp, 0x084), 0xc0000000);
-                        nv_wr32(dev, TP_UNIT(gpc, tp, 0xe44), 0x001ffffe);
-                        nv_wr32(dev, TP_UNIT(gpc, tp, 0xe4c), 0x0000000f);
+                        nv_wr32(dev, TP_UNIT(gpc, tp, 0x644), 0x001ffffe);
+                        nv_wr32(dev, TP_UNIT(gpc, tp, 0x64c), 0x0000000f);
                 }
                 nv_wr32(dev, GPC_UNIT(gpc, 0x2c90), 0xffffffff);
                 nv_wr32(dev, GPC_UNIT(gpc, 0x2c94), 0xffffffff);
@@ -777,3 +780,19 @@ nvc0_graph_isr(struct drm_device *dev)
 
         nv_wr32(dev, 0x400500, 0x00010001);
 }
+
+static void
+nvc0_runk140_isr(struct drm_device *dev)
+{
+        u32 units = nv_rd32(dev, 0x00017c) & 0x1f;
+
+        while (units) {
+                u32 unit = ffs(units) - 1;
+                u32 reg = 0x140000 + unit * 0x2000;
+                u32 st0 = nv_mask(dev, reg + 0x1020, 0, 0);
+                u32 st1 = nv_mask(dev, reg + 0x1420, 0, 0);
+
+                NV_INFO(dev, "PRUNK140: %d 0x%08x 0x%08x\n", unit, st0, st1);
+                units &= ~(1 << unit);
+        }
+}
diff --git a/drivers/gpu/drm/nouveau/nvc0_grctx.c b/drivers/gpu/drm/nouveau/nvc0_grctx.c
index b9e68b2d30a..f880ff776db 100644
--- a/drivers/gpu/drm/nouveau/nvc0_grctx.c
+++ b/drivers/gpu/drm/nouveau/nvc0_grctx.c
@@ -1830,7 +1830,7 @@ nvc0_grctx_generate(struct nouveau_channel *chan)
 
         for (tp = 0, id = 0; tp < 4; tp++) {
                 for (gpc = 0; gpc < priv->gpc_nr; gpc++) {
-                        if (tp <= priv->tp_nr[gpc]) {
+                        if (tp < priv->tp_nr[gpc]) {
                                 nv_wr32(dev, TP_UNIT(gpc, tp, 0x698), id);
                                 nv_wr32(dev, TP_UNIT(gpc, tp, 0x4e8), id);
                                 nv_wr32(dev, GPC_UNIT(gpc, 0x0c10 + tp * 4), id);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index b0ab185b86f..b1537000a10 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -555,6 +555,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                         dp_clock = dig_connector->dp_clock;
                                 }
                         }
+/* this might work properly with the new pll algo */
 #if 0 /* doesn't work properly on some laptops */
                         /* use recommended ref_div for ss */
                         if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
@@ -572,6 +573,11 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                         adjusted_clock = mode->clock * 2;
                                 if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT))
                                         pll->flags |= RADEON_PLL_PREFER_CLOSEST_LOWER;
+                                /* rv515 needs more testing with this option */
+                                if (rdev->family != CHIP_RV515) {
+                                        if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
+                                                pll->flags |= RADEON_PLL_IS_LCD;
+                                }
                         } else {
                                 if (encoder->encoder_type != DRM_MODE_ENCODER_DAC)
                                         pll->flags |= RADEON_PLL_NO_ODD_POST_DIV;
@@ -606,14 +612,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                 args.v1.usPixelClock = cpu_to_le16(mode->clock / 10);
                                 args.v1.ucTransmitterID = radeon_encoder->encoder_id;
                                 args.v1.ucEncodeMode = encoder_mode;
-                                if (encoder_mode == ATOM_ENCODER_MODE_DP) {
-                                        if (ss_enabled)
-                                                args.v1.ucConfig |=
-                                                        ADJUST_DISPLAY_CONFIG_SS_ENABLE;
-                                } else if (encoder_mode == ATOM_ENCODER_MODE_LVDS) {
+                                if (ss_enabled)
                                         args.v1.ucConfig |=
                                                 ADJUST_DISPLAY_CONFIG_SS_ENABLE;
-                                }
 
                                 atom_execute_table(rdev->mode_info.atom_context,
                                                    index, (uint32_t *)&args);
@@ -624,12 +625,12 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                 args.v3.sInput.ucTransmitterID = radeon_encoder->encoder_id;
                                 args.v3.sInput.ucEncodeMode = encoder_mode;
                                 args.v3.sInput.ucDispPllConfig = 0;
+                                if (ss_enabled)
+                                        args.v3.sInput.ucDispPllConfig |=
+                                                DISPPLL_CONFIG_SS_ENABLE;
                                 if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
                                         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
                                         if (encoder_mode == ATOM_ENCODER_MODE_DP) {
-                                                if (ss_enabled)
-                                                        args.v3.sInput.ucDispPllConfig |=
-                                                                DISPPLL_CONFIG_SS_ENABLE;
                                                 args.v3.sInput.ucDispPllConfig |=
                                                         DISPPLL_CONFIG_COHERENT_MODE;
                                                 /* 16200 or 27000 */
@@ -649,18 +650,11 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                         }
                                 } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                                         if (encoder_mode == ATOM_ENCODER_MODE_DP) {
-                                                if (ss_enabled)
-                                                        args.v3.sInput.ucDispPllConfig |=
-                                                                DISPPLL_CONFIG_SS_ENABLE;
                                                 args.v3.sInput.ucDispPllConfig |=
                                                         DISPPLL_CONFIG_COHERENT_MODE;
                                                 /* 16200 or 27000 */
                                                 args.v3.sInput.usPixelClock = cpu_to_le16(dp_clock / 10);
-                                        } else if (encoder_mode == ATOM_ENCODER_MODE_LVDS) {
-                                                if (ss_enabled)
-                                                        args.v3.sInput.ucDispPllConfig |=
-                                                                DISPPLL_CONFIG_SS_ENABLE;
-                                        } else {
+                                        } else if (encoder_mode != ATOM_ENCODER_MODE_LVDS) {
                                                 if (mode->clock > 165000)
                                                         args.v3.sInput.ucDispPllConfig |=
                                                                 DISPPLL_CONFIG_DUAL_LINK;
@@ -963,8 +957,16 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
         /* adjust pixel clock as needed */
         adjusted_clock = atombios_adjust_pll(crtc, mode, pll, ss_enabled, &ss);
 
-        radeon_compute_pll(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
-                           &ref_div, &post_div);
+        /* rv515 seems happier with the old algo */
+        if (rdev->family == CHIP_RV515)
+                radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+                                          &ref_div, &post_div);
+        else if (ASIC_IS_AVIVO(rdev))
+                radeon_compute_pll_avivo(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+                                         &ref_div, &post_div);
+        else
+                radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+                                          &ref_div, &post_div);
 
         atombios_crtc_program_ss(crtc, ATOM_DISABLE, radeon_crtc->pll_id, &ss);
 
@@ -1006,6 +1008,7 @@ static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
         struct radeon_bo *rbo;
         uint64_t fb_location;
         uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+        u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE);
         int r;
 
         /* no fb bound */
@@ -1057,11 +1060,17 @@ static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
         case 16:
                 fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_16BPP) |
                              EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB565));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN16);
+#endif
                 break;
         case 24:
         case 32:
                 fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_32BPP) |
                              EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB8888));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN32);
+#endif
                 break;
         default:
                 DRM_ERROR("Unsupported screen depth %d\n",
@@ -1106,6 +1115,7 @@ static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
         WREG32(EVERGREEN_GRPH_SECONDARY_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
                (u32) fb_location & EVERGREEN_GRPH_SURFACE_ADDRESS_MASK);
         WREG32(EVERGREEN_GRPH_CONTROL + radeon_crtc->crtc_offset, fb_format);
+        WREG32(EVERGREEN_GRPH_SWAP_CONTROL + radeon_crtc->crtc_offset, fb_swap);
 
         WREG32(EVERGREEN_GRPH_SURFACE_OFFSET_X + radeon_crtc->crtc_offset, 0);
         WREG32(EVERGREEN_GRPH_SURFACE_OFFSET_Y + radeon_crtc->crtc_offset, 0);
@@ -1162,6 +1172,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
         struct drm_framebuffer *target_fb;
         uint64_t fb_location;
         uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+        u32 fb_swap = R600_D1GRPH_SWAP_ENDIAN_NONE;
         int r;
 
         /* no fb bound */
@@ -1215,12 +1226,18 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
                 fb_format =
                     AVIVO_D1GRPH_CONTROL_DEPTH_16BPP |
                     AVIVO_D1GRPH_CONTROL_16BPP_RGB565;
+#ifdef __BIG_ENDIAN
+                fb_swap = R600_D1GRPH_SWAP_ENDIAN_16BIT;
+#endif
                 break;
         case 24:
         case 32:
                 fb_format =
                     AVIVO_D1GRPH_CONTROL_DEPTH_32BPP |
                     AVIVO_D1GRPH_CONTROL_32BPP_ARGB8888;
+#ifdef __BIG_ENDIAN
+                fb_swap = R600_D1GRPH_SWAP_ENDIAN_32BIT;
+#endif
                 break;
         default:
                 DRM_ERROR("Unsupported screen depth %d\n",
@@ -1260,6 +1277,8 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
         WREG32(AVIVO_D1GRPH_SECONDARY_SURFACE_ADDRESS +
                radeon_crtc->crtc_offset, (u32) fb_location);
         WREG32(AVIVO_D1GRPH_CONTROL + radeon_crtc->crtc_offset, fb_format);
+        if (rdev->family >= CHIP_R600)
+                WREG32(R600_D1GRPH_SWAP_CONTROL + radeon_crtc->crtc_offset, fb_swap);
 
         WREG32(AVIVO_D1GRPH_SURFACE_OFFSET_X + radeon_crtc->crtc_offset, 0);
         WREG32(AVIVO_D1GRPH_SURFACE_OFFSET_Y + radeon_crtc->crtc_offset, 0);
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 4e7778d44b8..695de9a3850 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -187,9 +187,9 @@ static int dp_link_clock_for_mode_clock(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
 int dp_mode_valid(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
 {
         int lanes = dp_lanes_for_mode_clock(dpcd, mode_clock);
-        int bw = dp_lanes_for_mode_clock(dpcd, mode_clock);
+        int dp_clock = dp_link_clock_for_mode_clock(dpcd, mode_clock);
 
-        if ((lanes == 0) || (bw == 0))
+        if ((lanes == 0) || (dp_clock == 0))
                 return MODE_CLOCK_HIGH;
 
         return MODE_OK;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index a8973acb398..ffdc8332b76 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -97,26 +97,29 @@ u32 evergreen_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 }
 
 /* get temperature in millidegrees */
-u32 evergreen_get_temp(struct radeon_device *rdev)
+int evergreen_get_temp(struct radeon_device *rdev)
 {
         u32 temp = (RREG32(CG_MULT_THERMAL_STATUS) & ASIC_T_MASK) >>
                 ASIC_T_SHIFT;
         u32 actual_temp = 0;
 
-        if ((temp >> 10) & 1)
-                actual_temp = 0;
-        else if ((temp >> 9) & 1)
+        if (temp & 0x400)
+                actual_temp = -256;
+        else if (temp & 0x200)
                 actual_temp = 255;
-        else
-                actual_temp = (temp >> 1) & 0xff;
+        else if (temp & 0x100) {
+                actual_temp = temp & 0x1ff;
+                actual_temp |= ~0x1ff;
+        } else
+                actual_temp = temp & 0xff;
 
-        return actual_temp * 1000;
+        return (actual_temp * 1000) / 2;
 }
 
-u32 sumo_get_temp(struct radeon_device *rdev)
+int sumo_get_temp(struct radeon_device *rdev)
 {
         u32 temp = RREG32(CG_THERMAL_STATUS) & 0xff;
-        u32 actual_temp = (temp >> 1) & 0xff;
+        int actual_temp = temp - 49;
 
         return actual_temp * 1000;
 }
@@ -1182,6 +1185,18 @@ static void evergreen_mc_program(struct radeon_device *rdev)
 /*
  * CP.
  */
+void evergreen_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
+{
+        /* set to DX10/11 mode */
+        radeon_ring_write(rdev, PACKET3(PACKET3_MODE_CONTROL, 0));
+        radeon_ring_write(rdev, 1);
+        /* FIXME: implement */
+        radeon_ring_write(rdev, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+        radeon_ring_write(rdev, ib->gpu_addr & 0xFFFFFFFC);
+        radeon_ring_write(rdev, upper_32_bits(ib->gpu_addr) & 0xFF);
+        radeon_ring_write(rdev, ib->length_dw);
+}
+
 
 static int evergreen_cp_load_microcode(struct radeon_device *rdev)
 {
@@ -1233,7 +1248,7 @@ static int evergreen_cp_start(struct radeon_device *rdev)
         cp_me = 0xff;
         WREG32(CP_ME_CNTL, cp_me);
 
-        r = radeon_ring_lock(rdev, evergreen_default_size + 15);
+        r = radeon_ring_lock(rdev, evergreen_default_size + 19);
         if (r) {
                 DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r);
                 return r;
@@ -1266,6 +1281,11 @@ static int evergreen_cp_start(struct radeon_device *rdev)
         radeon_ring_write(rdev, 0xffffffff);
         radeon_ring_write(rdev, 0xffffffff);
 
+        radeon_ring_write(rdev, 0xc0026900);
+        radeon_ring_write(rdev, 0x00000316);
+        radeon_ring_write(rdev, 0x0000000e); /* VGT_VERTEX_REUSE_BLOCK_CNTL */
+        radeon_ring_write(rdev, 0x00000010); /*  */
+
         radeon_ring_unlock_commit(rdev);
 
         return 0;
@@ -2072,6 +2092,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         WREG32(VGT_CACHE_INVALIDATION, vgt_cache_invalidation);
 
         WREG32(VGT_GS_VERTEX_REUSE, 16);
+        WREG32(PA_SU_LINE_STIPPLE_VALUE, 0);
         WREG32(PA_SC_LINE_STIPPLE_STATE, 0);
 
         WREG32(VGT_VERTEX_REUSE_BLOCK_CNTL, 14);
@@ -2201,6 +2222,9 @@ static int evergreen_gpu_soft_reset(struct radeon_device *rdev)
         struct evergreen_mc_save save;
         u32 grbm_reset = 0;
 
+        if (!(RREG32(GRBM_STATUS) & GUI_ACTIVE))
+                return 0;
+
         dev_info(rdev->dev, "GPU softreset \n");
         dev_info(rdev->dev, "  GRBM_STATUS=0x%08X\n",
                 RREG32(GRBM_STATUS));
diff --git a/drivers/gpu/drm/radeon/evergreen_blit_kms.c b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
index b758dc7f2f2..a1ba4b3053d 100644
--- a/drivers/gpu/drm/radeon/evergreen_blit_kms.c
+++ b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
@@ -232,7 +232,7 @@ draw_auto(struct radeon_device *rdev)
 
 }
 
-/* emits 30 */
+/* emits 36 */
 static void
 set_default_state(struct radeon_device *rdev)
 {
@@ -245,6 +245,8 @@ set_default_state(struct radeon_device *rdev)
         int num_hs_threads, num_ls_threads;
         int num_ps_stack_entries, num_vs_stack_entries, num_gs_stack_entries, num_es_stack_entries;
         int num_hs_stack_entries, num_ls_stack_entries;
+        u64 gpu_addr;
+        int dwords;
 
         switch (rdev->family) {
         case CHIP_CEDAR:
@@ -497,6 +499,18 @@ set_default_state(struct radeon_device *rdev)
         radeon_ring_write(rdev, 0x00000000);
         radeon_ring_write(rdev, 0x00000000);
 
+        /* set to DX10/11 mode */
+        radeon_ring_write(rdev, PACKET3(PACKET3_MODE_CONTROL, 0));
+        radeon_ring_write(rdev, 1);
+
+        /* emit an IB pointing at default state */
+        dwords = ALIGN(rdev->r600_blit.state_len, 0x10);
+        gpu_addr = rdev->r600_blit.shader_gpu_addr + rdev->r600_blit.state_offset;
+        radeon_ring_write(rdev, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+        radeon_ring_write(rdev, gpu_addr & 0xFFFFFFFC);
+        radeon_ring_write(rdev, upper_32_bits(gpu_addr) & 0xFF);
+        radeon_ring_write(rdev, dwords);
+
 }
 
 static inline uint32_t i2f(uint32_t input)
@@ -527,8 +541,10 @@ static inline uint32_t i2f(uint32_t input)
 int evergreen_blit_init(struct radeon_device *rdev)
 {
         u32 obj_size;
-        int r;
+        int r, dwords;
         void *ptr;
+        u32 packet2s[16];
+        int num_packet2s = 0;
 
         /* pin copy shader into vram if already initialized */
         if (rdev->r600_blit.shader_obj)
@@ -536,8 +552,17 @@ int evergreen_blit_init(struct radeon_device *rdev)
 
         mutex_init(&rdev->r600_blit.mutex);
         rdev->r600_blit.state_offset = 0;
-        rdev->r600_blit.state_len = 0;
-        obj_size = 0;
+
+        rdev->r600_blit.state_len = evergreen_default_size;
+
+        dwords = rdev->r600_blit.state_len;
+        while (dwords & 0xf) {
+                packet2s[num_packet2s++] = PACKET2(0);
+                dwords++;
+        }
+
+        obj_size = dwords * 4;
+        obj_size = ALIGN(obj_size, 256);
 
         rdev->r600_blit.vs_offset = obj_size;
         obj_size += evergreen_vs_size * 4;
@@ -567,6 +592,12 @@ int evergreen_blit_init(struct radeon_device *rdev)
                 return r;
         }
 
+        memcpy_toio(ptr + rdev->r600_blit.state_offset,
+                    evergreen_default_state, rdev->r600_blit.state_len * 4);
+
+        if (num_packet2s)
+                memcpy_toio(ptr + rdev->r600_blit.state_offset + (rdev->r600_blit.state_len * 4),
+                            packet2s, num_packet2s * 4);
         memcpy(ptr + rdev->r600_blit.vs_offset, evergreen_vs, evergreen_vs_size * 4);
         memcpy(ptr + rdev->r600_blit.ps_offset, evergreen_ps, evergreen_ps_size * 4);
         radeon_bo_kunmap(rdev->r600_blit.shader_obj);
@@ -652,7 +683,7 @@ int evergreen_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
         /* calculate number of loops correctly */
         ring_size = num_loops * dwords_per_loop;
         /* set default  + shaders */
-        ring_size += 46; /* shaders + def state */
+        ring_size += 52; /* shaders + def state */
         ring_size += 10; /* fence emit for VB IB */
         ring_size += 5; /* done copy */
         ring_size += 10; /* fence emit for done copy */
@@ -660,7 +691,7 @@ int evergreen_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
         if (r)
                 return r;
 
-        set_default_state(rdev); /* 30 */
+        set_default_state(rdev); /* 36 */
         set_shaders(rdev); /* 16 */
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 36d32d83d86..afec1aca2a7 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -240,6 +240,7 @@
 #define         FORCE_EOV_MAX_CLK_CNT(x)                        ((x) << 0)
 #define         FORCE_EOV_MAX_REZ_CNT(x)                        ((x) << 16)
 #define PA_SC_LINE_STIPPLE                              0x28A0C
+#define PA_SU_LINE_STIPPLE_VALUE                        0x8A60
 #define PA_SC_LINE_STIPPLE_STATE                        0x8B10
 
 #define SCRATCH_REG0                                    0x8500
@@ -652,6 +653,7 @@
 #define PACKET3_DISPATCH_DIRECT                         0x15
 #define PACKET3_DISPATCH_INDIRECT                       0x16
 #define PACKET3_INDIRECT_BUFFER_END                     0x17
+#define PACKET3_MODE_CONTROL                            0x18
 #define PACKET3_SET_PREDICATION                         0x20
 #define PACKET3_REG_RMW                                 0x21
 #define PACKET3_COND_EXEC                               0x22
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 46da5142b13..5f15820efe1 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1031,8 +1031,8 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
         WREG32(RADEON_CP_CSQ_MODE,
                REG_SET(RADEON_INDIRECT2_START, indirect2_start) |
                REG_SET(RADEON_INDIRECT1_START, indirect1_start));
-        WREG32(0x718, 0);
-        WREG32(0x744, 0x00004D4D);
+        WREG32(RADEON_CP_RB_WPTR_DELAY, 0);
+        WREG32(RADEON_CP_CSQ_MODE, 0x00004D4D);
         WREG32(RADEON_CP_CSQ_CNTL, RADEON_CSQ_PRIBM_INDBM);
         radeon_ring_start(rdev);
         r = radeon_ring_test(rdev);
@@ -2347,10 +2347,10 @@ void r100_vga_set_state(struct radeon_device *rdev, bool state)
 
         temp = RREG32(RADEON_CONFIG_CNTL);
         if (state == false) {
-                temp &= ~(1<<8);
-                temp |= (1<<9);
+                temp &= ~RADEON_CFG_VGA_RAM_EN;
+                temp |= RADEON_CFG_VGA_IO_DIS;
         } else {
-                temp &= ~(1<<9);
+                temp &= ~RADEON_CFG_VGA_IO_DIS;
         }
         WREG32(RADEON_CONFIG_CNTL, temp);
 }
@@ -3522,7 +3522,7 @@ int r100_ring_test(struct radeon_device *rdev)
         if (i < rdev->usec_timeout) {
                 DRM_INFO("ring test succeeded in %d usecs\n", i);
         } else {
-                DRM_ERROR("radeon: ring test failed (sracth(0x%04X)=0x%08X)\n",
+                DRM_ERROR("radeon: ring test failed (scratch(0x%04X)=0x%08X)\n",
                           scratch, tmp);
                 r = -EINVAL;
         }
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index cf862ca580b..55fe5ba7def 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -69,6 +69,9 @@ void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev)
         mb();
 }
 
+#define R300_PTE_WRITEABLE (1 << 2)
+#define R300_PTE_READABLE  (1 << 3)
+
 int rv370_pcie_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
 {
         void __iomem *ptr = (void *)rdev->gart.table.vram.ptr;
@@ -78,7 +81,7 @@ int rv370_pcie_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
         }
         addr = (lower_32_bits(addr) >> 8) |
                ((upper_32_bits(addr) & 0xff) << 24) |
-               0xc;
+               R300_PTE_WRITEABLE | R300_PTE_READABLE;
         /* on x86 we want this to be CPU endian, on powerpc
          * on powerpc without HW swappers, it'll get swapped on way
          * into VRAM - so no need for cpu_to_le32 on VRAM tables */
@@ -135,7 +138,7 @@ int rv370_pcie_gart_enable(struct radeon_device *rdev)
         WREG32_PCIE(RADEON_PCIE_TX_DISCARD_RD_ADDR_LO, rdev->mc.vram_start);
         WREG32_PCIE(RADEON_PCIE_TX_DISCARD_RD_ADDR_HI, 0);
         /* Clear error */
-        WREG32_PCIE(0x18, 0);
+        WREG32_PCIE(RADEON_PCIE_TX_GART_ERROR, 0);
         tmp = RREG32_PCIE(RADEON_PCIE_TX_GART_CNTL);
         tmp |= RADEON_PCIE_TX_GART_EN;
         tmp |= RADEON_PCIE_TX_GART_UNMAPPED_ACCESS_DISCARD;
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index c387346f93a..0b59ed7c7d2 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -96,7 +96,7 @@ void r420_pipes_init(struct radeon_device *rdev)
                        "programming pipes. Bad things might happen.\n");
         }
         /* get max number of pipes */
-        gb_pipe_select = RREG32(0x402C);
+        gb_pipe_select = RREG32(R400_GB_PIPE_SELECT);
         num_pipes = ((gb_pipe_select >> 12) & 3) + 1;
 
         /* SE chips have 1 pipe */
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 3c8677f9e38..2ce80d97656 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -79,8 +79,8 @@ static void r520_gpu_init(struct radeon_device *rdev)
                 WREG32(0x4128, 0xFF);
         }
         r420_pipes_init(rdev);
-        gb_pipe_select = RREG32(0x402C);
-        tmp = RREG32(0x170C);
+        gb_pipe_select = RREG32(R400_GB_PIPE_SELECT);
+        tmp = RREG32(R300_DST_PIPE_CONFIG);
         pipe_select_current = (tmp >> 2) & 3;
         tmp = (1 << pipe_select_current) |
               (((gb_pipe_select >> 8) & 0xF) << 4);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index aca2236268f..650672a0f5a 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -97,12 +97,16 @@ void r600_irq_disable(struct radeon_device *rdev);
 static void r600_pcie_gen2_enable(struct radeon_device *rdev);
 
 /* get temperature in millidegrees */
-u32 rv6xx_get_temp(struct radeon_device *rdev)
+int rv6xx_get_temp(struct radeon_device *rdev)
 {
         u32 temp = (RREG32(CG_THERMAL_STATUS) & ASIC_T_MASK) >>
                 ASIC_T_SHIFT;
+        int actual_temp = temp & 0xff;
 
-        return temp * 1000;
+        if (temp & 0x100)
+                actual_temp -= 256;
+
+        return actual_temp * 1000;
 }
 
 void r600_pm_get_dynpm_state(struct radeon_device *rdev)
@@ -1287,6 +1291,9 @@ int r600_gpu_soft_reset(struct radeon_device *rdev)
                         S_008014_CB2_BUSY(1) | S_008014_CB3_BUSY(1);
         u32 tmp;
 
+        if (!(RREG32(GRBM_STATUS) & GUI_ACTIVE))
+                return 0;
+
         dev_info(rdev->dev, "GPU softreset \n");
         dev_info(rdev->dev, "  R_008010_GRBM_STATUS=0x%08X\n",
                 RREG32(R_008010_GRBM_STATUS));
diff --git a/drivers/gpu/drm/radeon/r600_reg.h b/drivers/gpu/drm/radeon/r600_reg.h
index 33cda016b08..f869897c745 100644
--- a/drivers/gpu/drm/radeon/r600_reg.h
+++ b/drivers/gpu/drm/radeon/r600_reg.h
@@ -81,7 +81,11 @@
 #define R600_MEDIUM_VID_LOWER_GPIO_CNTL                            0x720
 #define R600_LOW_VID_LOWER_GPIO_CNTL                               0x724
 
-
+#define R600_D1GRPH_SWAP_CONTROL                               0x610C
+#       define R600_D1GRPH_SWAP_ENDIAN_NONE                    (0 << 0)
+#       define R600_D1GRPH_SWAP_ENDIAN_16BIT                   (1 << 0)
+#       define R600_D1GRPH_SWAP_ENDIAN_32BIT                   (2 << 0)
+#       define R600_D1GRPH_SWAP_ENDIAN_64BIT                   (3 << 0)
 
 #define R600_HDP_NONSURFACE_BASE                                0x2c04
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 71d2a554bbe..56c48b67ef3 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -179,10 +179,10 @@ void radeon_combios_get_power_modes(struct radeon_device *rdev);
 void radeon_atombios_get_power_modes(struct radeon_device *rdev);
 void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level);
 void rs690_pm_info(struct radeon_device *rdev);
-extern u32 rv6xx_get_temp(struct radeon_device *rdev);
-extern u32 rv770_get_temp(struct radeon_device *rdev);
-extern u32 evergreen_get_temp(struct radeon_device *rdev);
-extern u32 sumo_get_temp(struct radeon_device *rdev);
+extern int rv6xx_get_temp(struct radeon_device *rdev);
+extern int rv770_get_temp(struct radeon_device *rdev);
+extern int evergreen_get_temp(struct radeon_device *rdev);
+extern int sumo_get_temp(struct radeon_device *rdev);
 
 /*
  * Fences.
@@ -812,8 +812,7 @@ struct radeon_pm {
         fixed20_12              sclk;
         fixed20_12              mclk;
         fixed20_12              needed_bandwidth;
-        /* XXX: use a define for num power modes */
-        struct radeon_power_state power_state[8];
+        struct radeon_power_state *power_state;
         /* number of valid power states */
         int                     num_power_states;
         int                     current_power_state_index;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 3a1b1618622..e75d63b8e21 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -759,7 +759,7 @@ static struct radeon_asic evergreen_asic = {
         .gart_tlb_flush = &evergreen_pcie_gart_tlb_flush,
         .gart_set_page = &rs600_gart_set_page,
         .ring_test = &r600_ring_test,
-        .ring_ib_execute = &r600_ring_ib_execute,
+        .ring_ib_execute = &evergreen_ring_ib_execute,
         .irq_set = &evergreen_irq_set,
         .irq_process = &evergreen_irq_process,
         .get_vblank_counter = &evergreen_get_vblank_counter,
@@ -805,7 +805,7 @@ static struct radeon_asic sumo_asic = {
         .gart_tlb_flush = &evergreen_pcie_gart_tlb_flush,
         .gart_set_page = &rs600_gart_set_page,
         .ring_test = &r600_ring_test,
-        .ring_ib_execute = &r600_ring_ib_execute,
+        .ring_ib_execute = &evergreen_ring_ib_execute,
         .irq_set = &evergreen_irq_set,
         .irq_process = &evergreen_irq_process,
         .get_vblank_counter = &evergreen_get_vblank_counter,
@@ -848,7 +848,7 @@ static struct radeon_asic btc_asic = {
         .gart_tlb_flush = &evergreen_pcie_gart_tlb_flush,
         .gart_set_page = &rs600_gart_set_page,
         .ring_test = &r600_ring_test,
-        .ring_ib_execute = &r600_ring_ib_execute,
+        .ring_ib_execute = &evergreen_ring_ib_execute,
         .irq_set = &evergreen_irq_set,
         .irq_process = &evergreen_irq_process,
         .get_vblank_counter = &evergreen_get_vblank_counter,
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index e01f0771853..c59bd98a202 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -355,6 +355,7 @@ int evergreen_resume(struct radeon_device *rdev);
 bool evergreen_gpu_is_lockup(struct radeon_device *rdev);
 int evergreen_asic_reset(struct radeon_device *rdev);
 void evergreen_bandwidth_update(struct radeon_device *rdev);
+void evergreen_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);
 int evergreen_copy_blit(struct radeon_device *rdev,
                         uint64_t src_offset, uint64_t dst_offset,
                         unsigned num_pages, struct radeon_fence *fence);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 1573202a641..5c1cc7ad9a1 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -387,15 +387,11 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                         *line_mux = 0x90;
         }
 
-        /* mac rv630 */
-        if ((dev->pdev->device == 0x9588) &&
-            (dev->pdev->subsystem_vendor == 0x106b) &&
-            (dev->pdev->subsystem_device == 0x00a6)) {
-                if ((supported_device == ATOM_DEVICE_TV1_SUPPORT) &&
-                    (*connector_type == DRM_MODE_CONNECTOR_DVII)) {
-                        *connector_type = DRM_MODE_CONNECTOR_9PinDIN;
-                        *line_mux = CONNECTOR_7PIN_DIN_ENUM_ID1;
-                }
+        /* mac rv630, rv730, others */
+        if ((supported_device == ATOM_DEVICE_TV1_SUPPORT) &&
+            (*connector_type == DRM_MODE_CONNECTOR_DVII)) {
+                *connector_type = DRM_MODE_CONNECTOR_9PinDIN;
+                *line_mux = CONNECTOR_7PIN_DIN_ENUM_ID1;
         }
 
         /* ASUS HD 3600 XT board lists the DVI port as HDMI */
@@ -1167,16 +1163,6 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
                                 p1pll->pll_out_min = 64800;
                         else
                                 p1pll->pll_out_min = 20000;
-                } else if (p1pll->pll_out_min > 64800) {
-                        /* Limiting the pll output range is a good thing generally as
-                         * it limits the number of possible pll combinations for a given
-                         * frequency presumably to the ones that work best on each card.
-                         * However, certain duallink DVI monitors seem to like
-                         * pll combinations that would be limited by this at least on
-                         * pre-DCE 3.0 r6xx hardware.  This might need to be adjusted per
-                         * family.
-                         */
-                        p1pll->pll_out_min = 64800;
                 }
 
                 p1pll->pll_in_min =
@@ -1991,6 +1977,9 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
         num_modes = power_info->info.ucNumOfPowerModeEntries;
         if (num_modes > ATOM_MAX_NUMBEROF_POWER_BLOCK)
                 num_modes = ATOM_MAX_NUMBEROF_POWER_BLOCK;
+        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) * num_modes, GFP_KERNEL);
+        if (!rdev->pm.power_state)
+                return state_index;
         /* last mode is usually default, array is low to high */
         for (i = 0; i < num_modes; i++) {
                 rdev->pm.power_state[state_index].clock_info[0].voltage.type = VOLTAGE_NONE;
@@ -2342,6 +2331,10 @@ static int radeon_atombios_parse_power_table_4_5(struct radeon_device *rdev)
         power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
 
         radeon_atombios_add_pplib_thermal_controller(rdev, &power_info->pplib.sThermalController);
+        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
+                                       power_info->pplib.ucNumStates, GFP_KERNEL);
+        if (!rdev->pm.power_state)
+                return state_index;
         /* first mode is usually default, followed by low to high */
         for (i = 0; i < power_info->pplib.ucNumStates; i++) {
                 mode_index = 0;
@@ -2422,6 +2415,10 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
         non_clock_info_array = (struct NonClockInfoArray *)
                 (mode_info->atom_context->bios + data_offset +
                  power_info->pplib.usNonClockInfoArrayOffset);
+        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
+                                       state_array->ucNumEntries, GFP_KERNEL);
+        if (!rdev->pm.power_state)
+                return state_index;
         for (i = 0; i < state_array->ucNumEntries; i++) {
                 mode_index = 0;
                 power_state = (union pplib_power_state *)&state_array->states[i];
@@ -2495,19 +2492,22 @@ void radeon_atombios_get_power_modes(struct radeon_device *rdev)
                         break;
                 }
         } else {
-                /* add the default mode */
-                rdev->pm.power_state[state_index].type =
-                        POWER_STATE_TYPE_DEFAULT;
-                rdev->pm.power_state[state_index].num_clock_modes = 1;
-                rdev->pm.power_state[state_index].clock_info[0].mclk = rdev->clock.default_mclk;
-                rdev->pm.power_state[state_index].clock_info[0].sclk = rdev->clock.default_sclk;
-                rdev->pm.power_state[state_index].default_clock_mode =
-                        &rdev->pm.power_state[state_index].clock_info[0];
-                rdev->pm.power_state[state_index].clock_info[0].voltage.type = VOLTAGE_NONE;
-                rdev->pm.power_state[state_index].pcie_lanes = 16;
-                rdev->pm.default_power_state_index = state_index;
-                rdev->pm.power_state[state_index].flags = 0;
-                state_index++;
+                rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state), GFP_KERNEL);
+                if (rdev->pm.power_state) {
+                        /* add the default mode */
+                        rdev->pm.power_state[state_index].type =
+                                POWER_STATE_TYPE_DEFAULT;
+                        rdev->pm.power_state[state_index].num_clock_modes = 1;
+                        rdev->pm.power_state[state_index].clock_info[0].mclk = rdev->clock.default_mclk;
+                        rdev->pm.power_state[state_index].clock_info[0].sclk = rdev->clock.default_sclk;
+                        rdev->pm.power_state[state_index].default_clock_mode =
+                                &rdev->pm.power_state[state_index].clock_info[0];
+                        rdev->pm.power_state[state_index].clock_info[0].voltage.type = VOLTAGE_NONE;
+                        rdev->pm.power_state[state_index].pcie_lanes = 16;
+                        rdev->pm.default_power_state_index = state_index;
+                        rdev->pm.power_state[state_index].flags = 0;
+                        state_index++;
+                }
         }
 
         rdev->pm.num_power_states = state_index;
@@ -2623,7 +2623,7 @@ void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev)
         bios_2_scratch &= ~ATOM_S2_VRI_BRIGHT_ENABLE;
 
         /* tell the bios not to handle mode switching */
-        bios_6_scratch |= (ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH | ATOM_S6_ACC_MODE);
+        bios_6_scratch |= ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH;
 
         if (rdev->family >= CHIP_R600) {
                 WREG32(R600_BIOS_2_SCRATCH, bios_2_scratch);
@@ -2674,10 +2674,13 @@ void radeon_atom_output_lock(struct drm_encoder *encoder, bool lock)
         else
                 bios_6_scratch = RREG32(RADEON_BIOS_6_SCRATCH);
 
-        if (lock)
+        if (lock) {
                 bios_6_scratch |= ATOM_S6_CRITICAL_STATE;
-        else
+                bios_6_scratch &= ~ATOM_S6_ACC_MODE;
+        } else {
                 bios_6_scratch &= ~ATOM_S6_CRITICAL_STATE;
+                bios_6_scratch |= ATOM_S6_ACC_MODE;
+        }
 
         if (rdev->family >= CHIP_R600)
                 WREG32(R600_BIOS_6_SCRATCH, bios_6_scratch);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 591fcae8f22..d27ef74590c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2442,6 +2442,17 @@ void radeon_combios_get_power_modes(struct radeon_device *rdev)
 
         rdev->pm.default_power_state_index = -1;
 
+        /* allocate 2 power states */
+        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) * 2, GFP_KERNEL);
+        if (!rdev->pm.power_state) {
+                rdev->pm.default_power_state_index = state_index;
+                rdev->pm.num_power_states = 0;
+
+                rdev->pm.current_power_state_index = rdev->pm.default_power_state_index;
+                rdev->pm.current_clock_mode_index = 0;
+                return;
+        }
+
         if (rdev->flags & RADEON_IS_MOBILITY) {
                 offset = combios_get_table_offset(dev, COMBIOS_POWERPLAY_INFO_TABLE);
                 if (offset) {
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 26091d602b8..0d478932b1a 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -891,9 +891,9 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
                 pci_disable_device(dev->pdev);
                 pci_set_power_state(dev->pdev, PCI_D3hot);
         }
-        acquire_console_sem();
+        console_lock();
         radeon_fbdev_set_suspend(rdev, 1);
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 
@@ -905,11 +905,11 @@ int radeon_resume_kms(struct drm_device *dev)
         if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         pci_set_power_state(dev->pdev, PCI_D0);
         pci_restore_state(dev->pdev);
         if (pci_enable_device(dev->pdev)) {
-                release_console_sem();
+                console_unlock();
                 return -1;
         }
         pci_set_master(dev->pdev);
@@ -920,7 +920,7 @@ int radeon_resume_kms(struct drm_device *dev)
         radeon_restore_bios_scratch_regs(rdev);
 
         radeon_fbdev_set_suspend(rdev, 0);
-        release_console_sem();
+        console_unlock();
 
         /* reset hpd state */
         radeon_hpd_init(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index d26dabf878d..2eff98cfd72 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -780,6 +780,115 @@ static int radeon_ddc_dump(struct drm_connector *connector)
         return ret;
 }
 
+/* avivo */
+static void avivo_get_fb_div(struct radeon_pll *pll,
+                             u32 target_clock,
+                             u32 post_div,
+                             u32 ref_div,
+                             u32 *fb_div,
+                             u32 *frac_fb_div)
+{
+        u32 tmp = post_div * ref_div;
+
+        tmp *= target_clock;
+        *fb_div = tmp / pll->reference_freq;
+        *frac_fb_div = tmp % pll->reference_freq;
+}
+
+static u32 avivo_get_post_div(struct radeon_pll *pll,
+                              u32 target_clock)
+{
+        u32 vco, post_div, tmp;
+
+        if (pll->flags & RADEON_PLL_USE_POST_DIV)
+                return pll->post_div;
+
+        if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP) {
+                if (pll->flags & RADEON_PLL_IS_LCD)
+                        vco = pll->lcd_pll_out_min;
+                else
+                        vco = pll->pll_out_min;
+        } else {
+                if (pll->flags & RADEON_PLL_IS_LCD)
+                        vco = pll->lcd_pll_out_max;
+                else
+                        vco = pll->pll_out_max;
+        }
+
+        post_div = vco / target_clock;
+        tmp = vco % target_clock;
+
+        if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP) {
+                if (tmp)
+                        post_div++;
+        } else {
+                if (!tmp)
+                        post_div--;
+        }
+
+        return post_div;
+}
+
+#define MAX_TOLERANCE 10
+
+void radeon_compute_pll_avivo(struct radeon_pll *pll,
+                              u32 freq,
+                              u32 *dot_clock_p,
+                              u32 *fb_div_p,
+                              u32 *frac_fb_div_p,
+                              u32 *ref_div_p,
+                              u32 *post_div_p)
+{
+        u32 target_clock = freq / 10;
+        u32 post_div = avivo_get_post_div(pll, target_clock);
+        u32 ref_div = pll->min_ref_div;
+        u32 fb_div = 0, frac_fb_div = 0, tmp;
+
+        if (pll->flags & RADEON_PLL_USE_REF_DIV)
+                ref_div = pll->reference_div;
+
+        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV) {
+                avivo_get_fb_div(pll, target_clock, post_div, ref_div, &fb_div, &frac_fb_div);
+                frac_fb_div = (100 * frac_fb_div) / pll->reference_freq;
+                if (frac_fb_div >= 5) {
+                        frac_fb_div -= 5;
+                        frac_fb_div = frac_fb_div / 10;
+                        frac_fb_div++;
+                }
+                if (frac_fb_div >= 10) {
+                        fb_div++;
+                        frac_fb_div = 0;
+                }
+        } else {
+                while (ref_div <= pll->max_ref_div) {
+                        avivo_get_fb_div(pll, target_clock, post_div, ref_div,
+                                         &fb_div, &frac_fb_div);
+                        if (frac_fb_div >= (pll->reference_freq / 2))
+                                fb_div++;
+                        frac_fb_div = 0;
+                        tmp = (pll->reference_freq * fb_div) / (post_div * ref_div);
+                        tmp = (tmp * 10000) / target_clock;
+
+                        if (tmp > (10000 + MAX_TOLERANCE))
+                                ref_div++;
+                        else if (tmp >= (10000 - MAX_TOLERANCE))
+                                break;
+                        else
+                                ref_div++;
+                }
+        }
+
+        *dot_clock_p = ((pll->reference_freq * fb_div * 10) + (pll->reference_freq * frac_fb_div)) /
+                (ref_div * post_div * 10);
+        *fb_div_p = fb_div;
+        *frac_fb_div_p = frac_fb_div;
+        *ref_div_p = ref_div;
+        *post_div_p = post_div;
+        DRM_DEBUG_KMS("%d, pll dividers - fb: %d.%d ref: %d, post %d\n",
+                      *dot_clock_p, fb_div, frac_fb_div, ref_div, post_div);
+}
+
+/* pre-avivo */
 static inline uint32_t radeon_div(uint64_t n, uint32_t d)
 {
         uint64_t mod;
@@ -790,13 +899,13 @@ static inline uint32_t radeon_div(uint64_t n, uint32_t d)
         return n;
 }
 
-void radeon_compute_pll(struct radeon_pll *pll,
-                        uint64_t freq,
-                        uint32_t *dot_clock_p,
-                        uint32_t *fb_div_p,
-                        uint32_t *frac_fb_div_p,
-                        uint32_t *ref_div_p,
-                        uint32_t *post_div_p)
+void radeon_compute_pll_legacy(struct radeon_pll *pll,
+                               uint64_t freq,
+                               uint32_t *dot_clock_p,
+                               uint32_t *fb_div_p,
+                               uint32_t *frac_fb_div_p,
+                               uint32_t *ref_div_p,
+                               uint32_t *post_div_p)
 {
         uint32_t min_ref_div = pll->min_ref_div;
         uint32_t max_ref_div = pll->max_ref_div;
@@ -826,6 +935,9 @@ void radeon_compute_pll(struct radeon_pll *pll,
                 pll_out_max = pll->pll_out_max;
         }
 
+        if (pll_out_min > 64800)
+                pll_out_min = 64800;
+
         if (pll->flags & RADEON_PLL_USE_REF_DIV)
                 min_ref_div = max_ref_div = pll->reference_div;
         else {
@@ -849,7 +961,7 @@ void radeon_compute_pll(struct radeon_pll *pll,
                 max_fractional_feed_div = pll->max_frac_feedback_div;
         }
 
-        for (post_div = max_post_div; post_div >= min_post_div; --post_div) {
+        for (post_div = min_post_div; post_div <= max_post_div; ++post_div) {
                 uint32_t ref_div;
 
                 if ((pll->flags & RADEON_PLL_NO_ODD_POST_DIV) && (post_div & 1))
@@ -965,6 +1077,10 @@ void radeon_compute_pll(struct radeon_pll *pll,
         *frac_fb_div_p = best_frac_feedback_div;
         *ref_div_p = best_ref_div;
         *post_div_p = best_post_div;
+        DRM_DEBUG_KMS("%d %d, pll dividers - fb: %d.%d ref: %d, post %d\n",
+                      freq, best_freq / 1000, best_feedback_div, best_frac_feedback_div,
+                      best_ref_div, best_post_div);
+
 }
 
 static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index d5680a0c87a..275b26a708d 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -48,7 +48,7 @@
  * - 2.5.0 - add get accel 2 to work around ddx breakage for evergreen
  * - 2.6.0 - add tiling config query (r6xx+), add initial HiZ support (r300->r500)
  *   2.7.0 - fixups for r600 2D tiling support. (no external ABI change), add eg dyn gpr regs
- *   2.8.0 - pageflip support, r500 US_FORMAT regs. r500 ARGB2101010 colorbuf, r300->r500 CMASK
+ *   2.8.0 - pageflip support, r500 US_FORMAT regs. r500 ARGB2101010 colorbuf, r300->r500 CMASK, clock crystal query
  */
 #define KMS_DRIVER_MAJOR        2
 #define KMS_DRIVER_MINOR        8
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 8fd184286c0..d4a54224761 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -641,7 +641,7 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         switch (connector->connector_type) {
         case DRM_MODE_CONNECTOR_DVII:
         case DRM_MODE_CONNECTOR_HDMIB: /* HDMI-B is basically DL-DVI; analog works fine */
-                if (drm_detect_monitor_audio(radeon_connector->edid)) {
+                if (drm_detect_monitor_audio(radeon_connector->edid) && radeon_audio) {
                         /* fix me */
                         if (ASIC_IS_DCE4(rdev))
                                 return ATOM_ENCODER_MODE_DVI;
@@ -655,7 +655,7 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         case DRM_MODE_CONNECTOR_DVID:
         case DRM_MODE_CONNECTOR_HDMIA:
         default:
-                if (drm_detect_monitor_audio(radeon_connector->edid)) {
+                if (drm_detect_monitor_audio(radeon_connector->edid) && radeon_audio) {
                         /* fix me */
                         if (ASIC_IS_DCE4(rdev))
                                 return ATOM_ENCODER_MODE_DVI;
@@ -673,7 +673,7 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
                 if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
                     (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
                         return ATOM_ENCODER_MODE_DP;
-                else if (drm_detect_monitor_audio(radeon_connector->edid)) {
+                else if (drm_detect_monitor_audio(radeon_connector->edid) && radeon_audio) {
                         /* fix me */
                         if (ASIC_IS_DCE4(rdev))
                                 return ATOM_ENCODER_MODE_DVI;
@@ -1063,7 +1063,7 @@ atombios_set_edp_panel_power(struct drm_connector *connector, int action)
         if (!ASIC_IS_DCE4(rdev))
                 return;
 
-        if ((action != ATOM_TRANSMITTER_ACTION_POWER_ON) ||
+        if ((action != ATOM_TRANSMITTER_ACTION_POWER_ON) &&
             (action != ATOM_TRANSMITTER_ACTION_POWER_OFF))
                 return;
 
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index a289646e8aa..9ec830c77af 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -110,11 +110,14 @@ void radeon_driver_irq_uninstall_kms(struct drm_device *dev)
 
 int radeon_irq_kms_init(struct radeon_device *rdev)
 {
+        int i;
         int r = 0;
 
         INIT_WORK(&rdev->hotplug_work, radeon_hotplug_work_func);
 
         spin_lock_init(&rdev->irq.sw_lock);
+        for (i = 0; i < rdev->num_crtc; i++)
+                spin_lock_init(&rdev->irq.pflip_lock[i]);
         r = drm_vblank_init(rdev->ddev, rdev->num_crtc);
         if (r) {
                 return r;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 28a53e4a925..8387d32caaa 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -201,6 +201,10 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 }
                 radeon_set_filp_rights(dev, &rdev->cmask_filp, filp, &value);
                 break;
+        case RADEON_INFO_CLOCK_CRYSTAL_FREQ:
+                /* return clock value in KHz */
+                value = rdev->clock.spll.reference_freq * 10;
+                break;
         default:
                 DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                 return -EINVAL;
@@ -243,6 +247,8 @@ void radeon_driver_preclose_kms(struct drm_device *dev,
         struct radeon_device *rdev = dev->dev_private;
         if (rdev->hyperz_filp == file_priv)
                 rdev->hyperz_filp = NULL;
+        if (rdev->cmask_filp == file_priv)
+                rdev->cmask_filp = NULL;
 }
 
 /*
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index ace2e6384d4..cf0638c3b7c 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -778,9 +778,9 @@ static void radeon_set_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)
         DRM_DEBUG_KMS("\n");
 
         if (!use_bios_divs) {
-                radeon_compute_pll(pll, mode->clock,
-                                   &freq, &feedback_div, &frac_fb_div,
-                                   &reference_div, &post_divider);
+                radeon_compute_pll_legacy(pll, mode->clock,
+                                          &freq, &feedback_div, &frac_fb_div,
+                                          &reference_div, &post_divider);
 
                 for (post_div = &post_divs[0]; post_div->divider; ++post_div) {
                         if (post_div->divider == post_divider)
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 12bdeab91c8..6794cdf91f2 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -149,6 +149,7 @@ struct radeon_tmds_pll {
 #define RADEON_PLL_PREFER_CLOSEST_LOWER (1 << 11)
 #define RADEON_PLL_USE_POST_DIV         (1 << 12)
 #define RADEON_PLL_IS_LCD               (1 << 13)
+#define RADEON_PLL_PREFER_MINM_OVER_MAXP (1 << 14)
 
 struct radeon_pll {
         /* reference frequency */
@@ -510,13 +511,21 @@ extern bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                                              struct radeon_atom_ss *ss,
                                              int id, u32 clock);
 
-extern void radeon_compute_pll(struct radeon_pll *pll,
-                               uint64_t freq,
-                               uint32_t *dot_clock_p,
-                               uint32_t *fb_div_p,
-                               uint32_t *frac_fb_div_p,
-                               uint32_t *ref_div_p,
-                               uint32_t *post_div_p);
+extern void radeon_compute_pll_legacy(struct radeon_pll *pll,
+                                      uint64_t freq,
+                                      uint32_t *dot_clock_p,
+                                      uint32_t *fb_div_p,
+                                      uint32_t *frac_fb_div_p,
+                                      uint32_t *ref_div_p,
+                                      uint32_t *post_div_p);
+
+extern void radeon_compute_pll_avivo(struct radeon_pll *pll,
+                                     u32 freq,
+                                     u32 *dot_clock_p,
+                                     u32 *fb_div_p,
+                                     u32 *frac_fb_div_p,
+                                     u32 *ref_div_p,
+                                     u32 *post_div_p);
 
 extern void radeon_setup_encoder_clones(struct drm_device *dev);
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 3b1b2bf9cdd..2aed03bde4b 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -430,7 +430,7 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
 {
         struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
         struct radeon_device *rdev = ddev->dev_private;
-        u32 temp;
+        int temp;
 
         switch (rdev->pm.int_thermal_type) {
         case THERMAL_TYPE_RV6XX:
@@ -646,6 +646,9 @@ void radeon_pm_fini(struct radeon_device *rdev)
 #endif
         }
 
+        if (rdev->pm.power_state)
+                kfree(rdev->pm.power_state);
+
         radeon_hwmon_fini(rdev);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index 3cd4dace57c..ec93a75369e 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -375,6 +375,8 @@
 #define RADEON_CONFIG_APER_SIZE             0x0108
 #define RADEON_CONFIG_BONDS                 0x00e8
 #define RADEON_CONFIG_CNTL                  0x00e0
+#       define RADEON_CFG_VGA_RAM_EN        (1 << 8)
+#       define RADEON_CFG_VGA_IO_DIS        (1 << 9)
 #       define RADEON_CFG_ATI_REV_A11       (0   << 16)
 #       define RADEON_CFG_ATI_REV_A12       (1   << 16)
 #       define RADEON_CFG_ATI_REV_A13       (2   << 16)
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index 5512e4e5e63..c76283d9eb3 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -203,6 +203,9 @@ void rs400_gart_fini(struct radeon_device *rdev)
         radeon_gart_table_ram_free(rdev);
 }
 
+#define RS400_PTE_WRITEABLE (1 << 2)
+#define RS400_PTE_READABLE  (1 << 3)
+
 int rs400_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
 {
         uint32_t entry;
@@ -213,7 +216,7 @@ int rs400_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
 
         entry = (lower_32_bits(addr) & PAGE_MASK) |
                 ((upper_32_bits(addr) & 0xff) << 4) |
-                0xc;
+                RS400_PTE_WRITEABLE | RS400_PTE_READABLE;
         entry = cpu_to_le32(entry);
         rdev->gart.table.ram.ptr[i] = entry;
         return 0;
@@ -226,8 +229,8 @@ int rs400_mc_wait_for_idle(struct radeon_device *rdev)
 
         for (i = 0; i < rdev->usec_timeout; i++) {
                 /* read MC_STATUS */
-                tmp = RREG32(0x0150);
-                if (tmp & (1 << 2)) {
+                tmp = RREG32(RADEON_MC_STATUS);
+                if (tmp & RADEON_MC_IDLE) {
                         return 0;
                 }
                 DRM_UDELAY(1);
@@ -241,7 +244,7 @@ void rs400_gpu_init(struct radeon_device *rdev)
         r420_pipes_init(rdev);
         if (rs400_mc_wait_for_idle(rdev)) {
                 printk(KERN_WARNING "rs400: Failed to wait MC idle while "
-                       "programming pipes. Bad things might happen. %08x\n", RREG32(0x150));
+                       "programming pipes. Bad things might happen. %08x\n", RREG32(RADEON_MC_STATUS));
         }
 }
 
@@ -300,9 +303,9 @@ static int rs400_debugfs_gart_info(struct seq_file *m, void *data)
                 seq_printf(m, "MCCFG_AGP_BASE_2 0x%08x\n", tmp);
                 tmp = RREG32_MC(RS690_MCCFG_AGP_LOCATION);
                 seq_printf(m, "MCCFG_AGP_LOCATION 0x%08x\n", tmp);
-                tmp = RREG32_MC(0x100);
+                tmp = RREG32_MC(RS690_MCCFG_FB_LOCATION);
                 seq_printf(m, "MCCFG_FB_LOCATION 0x%08x\n", tmp);
-                tmp = RREG32(0x134);
+                tmp = RREG32(RS690_HDP_FB_LOCATION);
                 seq_printf(m, "HDP_FB_LOCATION 0x%08x\n", tmp);
         } else {
                 tmp = RREG32(RADEON_AGP_BASE);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 5d569f41f4a..64b57af9371 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -69,13 +69,13 @@ void rv515_ring_start(struct radeon_device *rdev)
                           ISYNC_CPSCRATCH_IDLEGUI);
         radeon_ring_write(rdev, PACKET0(WAIT_UNTIL, 0));
         radeon_ring_write(rdev, WAIT_2D_IDLECLEAN | WAIT_3D_IDLECLEAN);
-        radeon_ring_write(rdev, PACKET0(0x170C, 0));
-        radeon_ring_write(rdev, 1 << 31);
+        radeon_ring_write(rdev, PACKET0(R300_DST_PIPE_CONFIG, 0));
+        radeon_ring_write(rdev, R300_PIPE_AUTO_CONFIG);
         radeon_ring_write(rdev, PACKET0(GB_SELECT, 0));
         radeon_ring_write(rdev, 0);
         radeon_ring_write(rdev, PACKET0(GB_ENABLE, 0));
         radeon_ring_write(rdev, 0);
-        radeon_ring_write(rdev, PACKET0(0x42C8, 0));
+        radeon_ring_write(rdev, PACKET0(R500_SU_REG_DEST, 0));
         radeon_ring_write(rdev, (1 << rdev->num_gb_pipes) - 1);
         radeon_ring_write(rdev, PACKET0(VAP_INDEX_OFFSET, 0));
         radeon_ring_write(rdev, 0);
@@ -153,8 +153,8 @@ void rv515_gpu_init(struct radeon_device *rdev)
         }
         rv515_vga_render_disable(rdev);
         r420_pipes_init(rdev);
-        gb_pipe_select = RREG32(0x402C);
-        tmp = RREG32(0x170C);
+        gb_pipe_select = RREG32(R400_GB_PIPE_SELECT);
+        tmp = RREG32(R300_DST_PIPE_CONFIG);
         pipe_select_current = (tmp >> 2) & 3;
         tmp = (1 << pipe_select_current) |
               (((gb_pipe_select >> 8) & 0xF) << 4);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 491dc900065..2211a323db4 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -78,18 +78,23 @@ u32 rv770_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 }
 
 /* get temperature in millidegrees */
-u32 rv770_get_temp(struct radeon_device *rdev)
+int rv770_get_temp(struct radeon_device *rdev)
 {
         u32 temp = (RREG32(CG_MULT_THERMAL_STATUS) & ASIC_T_MASK) >>
                 ASIC_T_SHIFT;
-        u32 actual_temp = 0;
-
-        if ((temp >> 9) & 1)
-                actual_temp = 0;
-        else
-                actual_temp = (temp >> 1) & 0xff;
-
-        return actual_temp * 1000;
+        int actual_temp;
+
+        if (temp & 0x400)
+                actual_temp = -256;
+        else if (temp & 0x200)
+                actual_temp = 255;
+        else if (temp & 0x100) {
+                actual_temp = temp & 0x1ff;
+                actual_temp |= ~0x1ff;
+        } else
+                actual_temp = temp & 0xff;
+
+        return (actual_temp * 1000) / 2;
 }
 
 void rv770_pm_misc(struct radeon_device *rdev)
diff --git a/drivers/gpu/stub/Kconfig b/drivers/gpu/stub/Kconfig
index 09aea5f1556..70e60a4bb67 100644
--- a/drivers/gpu/stub/Kconfig
+++ b/drivers/gpu/stub/Kconfig
@@ -1,11 +1,13 @@
 config STUB_POULSBO
         tristate "Intel GMA500 Stub Driver"
         depends on PCI
+        depends on NET # for THERMAL
         # Poulsbo stub depends on ACPI_VIDEO when ACPI is enabled
         # but for select to work, need to select ACPI_VIDEO's dependencies, ick
         select BACKLIGHT_CLASS_DEVICE if ACPI
         select INPUT if ACPI
         select ACPI_VIDEO if ACPI
+        select THERMAL if ACPI
         help
           Choose this option if you have a system that has Intel GMA500
           (Poulsbo) integrated graphics. If M is selected, the module will
diff --git a/drivers/gpu/vga/Kconfig b/drivers/gpu/vga/Kconfig
index 8d0e31a2202..96c83a9a76b 100644
--- a/drivers/gpu/vga/Kconfig
+++ b/drivers/gpu/vga/Kconfig
@@ -1,5 +1,5 @@
 config VGA_ARB
-        bool "VGA Arbitration" if EMBEDDED
+        bool "VGA Arbitration" if EXPERT
         default y
         depends on PCI
         help
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index c380c65da41..ace2b1623b2 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -636,7 +636,7 @@ int vga_client_register(struct pci_dev *pdev, void *cookie,
                         void (*irq_set_state)(void *cookie, bool state),
                         unsigned int (*set_vga_decode)(void *cookie, bool decode))
 {
-        int ret = -1;
+        int ret = -ENODEV;
         struct vga_device *vgadev;
         unsigned long flags;
 
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 24cca2f69df..2560f01c1a6 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -62,9 +62,9 @@ config HID_3M_PCT
         Support for 3M PCT touch screens.
 
 config HID_A4TECH
-        tristate "A4 tech mice" if EMBEDDED
+        tristate "A4 tech mice" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for A4 tech X5 and WOP-35 / Trust 450L mice.
 
@@ -77,9 +77,9 @@ config HID_ACRUX_FF
         game controllers.
 
 config HID_APPLE
-        tristate "Apple {i,Power,Mac}Books" if EMBEDDED
+        tristate "Apple {i,Power,Mac}Books" if EXPERT
         depends on (USB_HID || BT_HIDP)
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for some Apple devices which less or more break
         HID specification.
@@ -88,9 +88,9 @@ config HID_APPLE
         MacBooks, MacBook Pros and Apple Aluminum.
 
 config HID_BELKIN
-        tristate "Belkin Flip KVM and Wireless keyboard" if EMBEDDED
+        tristate "Belkin Flip KVM and Wireless keyboard" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Belkin Flip KVM and Wireless keyboard.
 
@@ -101,16 +101,16 @@ config HID_CANDO
         Support for Cando dual touch panel.
 
 config HID_CHERRY
-        tristate "Cherry Cymotion keyboard" if EMBEDDED
+        tristate "Cherry Cymotion keyboard" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Cherry Cymotion keyboard.
 
 config HID_CHICONY
-        tristate "Chicony Tactical pad" if EMBEDDED
+        tristate "Chicony Tactical pad" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Chicony Tactical pad.
 
@@ -130,9 +130,9 @@ config HID_PRODIKEYS
           and some additional multimedia keys.
 
 config HID_CYPRESS
-        tristate "Cypress mouse and barcode readers" if EMBEDDED
+        tristate "Cypress mouse and barcode readers" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for cypress mouse and barcode readers.
 
@@ -174,16 +174,16 @@ config HID_ELECOM
         Support for the ELECOM BM084 (bluetooth mouse).
 
 config HID_EZKEY
-        tristate "Ezkey BTC 8193 keyboard" if EMBEDDED
+        tristate "Ezkey BTC 8193 keyboard" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Ezkey BTC 8193 keyboard.
 
 config HID_KYE
-        tristate "Kye/Genius Ergo Mouse" if EMBEDDED
+        tristate "Kye/Genius Ergo Mouse" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Kye/Genius Ergo Mouse.
 
@@ -212,16 +212,16 @@ config HID_TWINHAN
         Support for Twinhan IR remote control.
 
 config HID_KENSINGTON
-        tristate "Kensington Slimblade Trackball" if EMBEDDED
+        tristate "Kensington Slimblade Trackball" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Kensington Slimblade Trackball.
 
 config HID_LOGITECH
-        tristate "Logitech devices" if EMBEDDED
+        tristate "Logitech devices" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Logitech devices that are not fully compliant with HID standard.
 
@@ -276,9 +276,9 @@ config HID_MAGICMOUSE
         Apple Wireless "Magic" Mouse.
 
 config HID_MICROSOFT
-        tristate "Microsoft non-fully HID-compliant devices" if EMBEDDED
+        tristate "Microsoft non-fully HID-compliant devices" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Microsoft devices that are not fully compliant with HID standard.
 
@@ -289,9 +289,9 @@ config HID_MOSART
         Support for MosArt dual-touch panels.
 
 config HID_MONTEREY
-        tristate "Monterey Genius KB29E keyboard" if EMBEDDED
+        tristate "Monterey Genius KB29E keyboard" if EXPERT
         depends on USB_HID
-        default !EMBEDDED
+        default !EXPERT
         ---help---
         Support for Monterey Genius KB29E.
 
@@ -365,8 +365,8 @@ config HID_PICOLCD
           - IR
 
 config HID_PICOLCD_FB
-        bool "Framebuffer support" if EMBEDDED
-        default !EMBEDDED
+        bool "Framebuffer support" if EXPERT
+        default !EXPERT
         depends on HID_PICOLCD
         depends on HID_PICOLCD=FB || FB=y
         select FB_DEFERRED_IO
@@ -379,8 +379,8 @@ config HID_PICOLCD_FB
           frambuffer device.
 
 config HID_PICOLCD_BACKLIGHT
-        bool "Backlight control" if EMBEDDED
-        default !EMBEDDED
+        bool "Backlight control" if EXPERT
+        default !EXPERT
         depends on HID_PICOLCD
         depends on HID_PICOLCD=BACKLIGHT_CLASS_DEVICE || BACKLIGHT_CLASS_DEVICE=y
         ---help---
@@ -388,16 +388,16 @@ config HID_PICOLCD_BACKLIGHT
           class.
 
 config HID_PICOLCD_LCD
-        bool "Contrast control" if EMBEDDED
-        default !EMBEDDED
+        bool "Contrast control" if EXPERT
+        default !EXPERT
         depends on HID_PICOLCD
         depends on HID_PICOLCD=LCD_CLASS_DEVICE || LCD_CLASS_DEVICE=y
         ---help---
           Provide access to PicoLCD's LCD contrast via lcd class.
 
 config HID_PICOLCD_LEDS
-        bool "GPO via leds class" if EMBEDDED
-        default !EMBEDDED
+        bool "GPO via leds class" if EXPERT
+        default !EXPERT
         depends on HID_PICOLCD
         depends on HID_PICOLCD=LEDS_CLASS || LEDS_CLASS=y
         ---help---
diff --git a/drivers/hid/usbhid/Kconfig b/drivers/hid/usbhid/Kconfig
index 4edb3bef94a..0f20fd17cf0 100644
--- a/drivers/hid/usbhid/Kconfig
+++ b/drivers/hid/usbhid/Kconfig
@@ -45,7 +45,7 @@ config USB_HIDDEV
           If unsure, say Y.
 
 menu "USB HID Boot Protocol drivers"
-        depends on USB!=n && USB_HID!=y && EMBEDDED
+        depends on USB!=n && USB_HID!=y && EXPERT
 
 config USB_KBD
         tristate "USB HIDBP Keyboard (simple Boot) support"
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 35f00dae367..773e484f164 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -618,8 +618,8 @@ config SENSORS_LM93
         depends on I2C
         select HWMON_VID
         help
-          If you say yes here you get support for National Semiconductor LM93
-          sensor chips.
+          If you say yes here you get support for National Semiconductor LM93,
+          LM94, and compatible sensor chips.
 
           This driver can also be built as a module.  If so, the module
           will be called lm93.
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index ce0372f0615..4c0743660e9 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -1072,6 +1072,7 @@ static int applesmc_create_nodes(struct applesmc_node_group *groups, int num)
                         node->sda.dev_attr.show = grp->show;
                         node->sda.dev_attr.store = grp->store;
                         attr = &node->sda.dev_attr.attr;
+                        sysfs_attr_init(attr);
                         attr->name = node->name;
                         attr->mode = S_IRUGO | (grp->store ? S_IWUSR : 0);
                         ret = sysfs_create_file(&pdev->dev.kobj, attr);
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 2d68cf3c223..b5e892017e0 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -13,6 +13,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 
 #include <acpi/acpi.h>
 #include <acpi/acpixf.h>
@@ -22,6 +23,21 @@
 
 #define ATK_HID "ATK0110"
 
+static bool new_if;
+module_param(new_if, bool, 0);
+MODULE_PARM_DESC(new_if, "Override detection heuristic and force the use of the new ATK0110 interface");
+
+static const struct dmi_system_id __initconst atk_force_new_if[] = {
+        {
+                /* Old interface has broken MCH temp monitoring */
+                .ident = "Asus Sabertooth X58",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_NAME, "SABERTOOTH X58")
+                }
+        },
+        { }
+};
+
 /* Minimum time between readings, enforced in order to avoid
  * hogging the CPU.
  */
@@ -1302,7 +1318,9 @@ static int atk_probe_if(struct atk_data *data)
          * analysis of multiple DSDTs indicates that when both interfaces
          * are present the new one (GGRP/GITM) is not functional.
          */
-        if (data->rtmp_handle && data->rvlt_handle && data->rfan_handle)
+        if (new_if)
+                dev_info(dev, "Overriding interface detection\n");
+        if (data->rtmp_handle && data->rvlt_handle && data->rfan_handle && !new_if)
                 data->old_interface = true;
         else if (data->enumerate_handle && data->read_handle &&
                         data->write_handle)
@@ -1420,6 +1438,9 @@ static int __init atk0110_init(void)
                 return -EBUSY;
         }
 
+        if (dmi_check_system(atk_force_new_if))
+                new_if = true;
+
         ret = acpi_bus_register_driver(&atk_driver);
         if (ret)
                 pr_info("acpi_bus_register_driver failed: %d\n", ret);
diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
index 1b674b7d458..d805e8e5796 100644
--- a/drivers/hwmon/lis3lv02d.c
+++ b/drivers/hwmon/lis3lv02d.c
@@ -957,7 +957,7 @@ int lis3lv02d_init_device(struct lis3lv02d *dev)
 
         /* bail if we did not get an IRQ from the bus layer */
         if (!dev->irq) {
-                pr_err("No IRQ. Disabling /dev/freefall\n");
+                pr_debug("No IRQ. Disabling /dev/freefall\n");
                 goto out;
         }
 
diff --git a/drivers/hwmon/lm93.c b/drivers/hwmon/lm93.c
index c9ed14eba5a..3b43df41861 100644
--- a/drivers/hwmon/lm93.c
+++ b/drivers/hwmon/lm93.c
@@ -135,6 +135,11 @@
 #define LM93_MFR_ID             0x73
 #define LM93_MFR_ID_PROTOTYPE   0x72
 
+/* LM94 REGISTER VALUES */
+#define LM94_MFR_ID_2           0x7a
+#define LM94_MFR_ID             0x79
+#define LM94_MFR_ID_PROTOTYPE   0x78
+
 /* SMBus capabilities */
 #define LM93_SMBUS_FUNC_FULL (I2C_FUNC_SMBUS_BYTE_DATA | \
                 I2C_FUNC_SMBUS_WORD_DATA | I2C_FUNC_SMBUS_BLOCK_DATA)
@@ -2504,6 +2509,7 @@ static int lm93_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
         struct i2c_adapter *adapter = client->adapter;
         int mfr, ver;
+        const char *name;
 
         if (!i2c_check_functionality(adapter, LM93_SMBUS_FUNC_MIN))
                 return -ENODEV;
@@ -2517,13 +2523,23 @@ static int lm93_detect(struct i2c_client *client, struct i2c_board_info *info)
         }
 
         ver = lm93_read_byte(client, LM93_REG_VER);
-        if (ver != LM93_MFR_ID && ver != LM93_MFR_ID_PROTOTYPE) {
+        switch (ver) {
+        case LM93_MFR_ID:
+        case LM93_MFR_ID_PROTOTYPE:
+                name = "lm93";
+                break;
+        case LM94_MFR_ID_2:
+        case LM94_MFR_ID:
+        case LM94_MFR_ID_PROTOTYPE:
+                name = "lm94";
+                break;
+        default:
                 dev_dbg(&adapter->dev,
                         "detect failed, bad version id 0x%02x!\n", ver);
                 return -ENODEV;
         }
 
-        strlcpy(info->type, "lm93", I2C_NAME_SIZE);
+        strlcpy(info->type, name, I2C_NAME_SIZE);
         dev_dbg(&adapter->dev,"loading %s at %d,0x%02x\n",
                 client->name, i2c_adapter_id(client->adapter),
                 client->addr);
@@ -2602,6 +2618,7 @@ static int lm93_remove(struct i2c_client *client)
 
 static const struct i2c_device_id lm93_id[] = {
         { "lm93", 0 },
+        { "lm94", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, lm93_id);
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 98ccfeb3f5a..9827c5e686c 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -134,7 +134,7 @@ config BLK_DEV_IDECD
           module will be called ide-cd.
 
 config BLK_DEV_IDECD_VERBOSE_ERRORS
-        bool "Verbose error logging for IDE/ATAPI CDROM driver" if EMBEDDED
+        bool "Verbose error logging for IDE/ATAPI CDROM driver" if EXPERT
         depends on BLK_DEV_IDECD
         default y
         help
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 7acb32e7f81..1fa091e0569 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -263,7 +263,7 @@ static void __setup_broadcast_timer(void *arg)
         clockevents_notify(reason, &cpu);
 }
 
-static int __cpuinit setup_broadcast_cpuhp_notify(struct notifier_block *n,
+static int setup_broadcast_cpuhp_notify(struct notifier_block *n,
                 unsigned long action, void *hcpu)
 {
         int hotcpu = (unsigned long)hcpu;
@@ -273,15 +273,11 @@ static int __cpuinit setup_broadcast_cpuhp_notify(struct notifier_block *n,
                 smp_call_function_single(hotcpu, __setup_broadcast_timer,
                         (void *)true, 1);
                 break;
-        case CPU_DOWN_PREPARE:
-                smp_call_function_single(hotcpu, __setup_broadcast_timer,
-                        (void *)false, 1);
-                break;
         }
         return NOTIFY_OK;
 }
 
-static struct notifier_block __cpuinitdata setup_broadcast_notifier = {
+static struct notifier_block setup_broadcast_notifier = {
         .notifier_call = setup_broadcast_cpuhp_notify,
 };
 
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index e38be1bcc01..fbbfa24cf57 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1079,7 +1079,7 @@ static void ib_sa_remove_one(struct ib_device *device)
 
         ib_unregister_event_handler(&sa_dev->event_handler);
 
-        flush_scheduled_work();
+        flush_workqueue(ib_wq);
 
         for (i = 0; i <= sa_dev->end_port - sa_dev->start_port; ++i) {
                 if (rdma_port_get_link_layer(device, i + 1) == IB_LINK_LAYER_INFINIBAND) {
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ca12acf3837..ec1e9da1488 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -636,6 +636,16 @@ static void ucma_copy_iboe_route(struct rdma_ucm_query_route_resp *resp,
         }
 }
 
+static void ucma_copy_iw_route(struct rdma_ucm_query_route_resp *resp,
+                               struct rdma_route *route)
+{
+        struct rdma_dev_addr *dev_addr;
+
+        dev_addr = &route->addr.dev_addr;
+        rdma_addr_get_dgid(dev_addr, (union ib_gid *) &resp->ib_route[0].dgid);
+        rdma_addr_get_sgid(dev_addr, (union ib_gid *) &resp->ib_route[0].sgid);
+}
+
 static ssize_t ucma_query_route(struct ucma_file *file,
                                 const char __user *inbuf,
                                 int in_len, int out_len)
@@ -670,8 +680,10 @@ static ssize_t ucma_query_route(struct ucma_file *file,
 
         resp.node_guid = (__force __u64) ctx->cm_id->device->node_guid;
         resp.port_num = ctx->cm_id->port_num;
-        if (rdma_node_get_transport(ctx->cm_id->device->node_type) == RDMA_TRANSPORT_IB) {
-                switch (rdma_port_get_link_layer(ctx->cm_id->device, ctx->cm_id->port_num)) {
+        switch (rdma_node_get_transport(ctx->cm_id->device->node_type)) {
+        case RDMA_TRANSPORT_IB:
+                switch (rdma_port_get_link_layer(ctx->cm_id->device,
+                        ctx->cm_id->port_num)) {
                 case IB_LINK_LAYER_INFINIBAND:
                         ucma_copy_ib_route(&resp, &ctx->cm_id->route);
                         break;
@@ -681,6 +693,12 @@ static ssize_t ucma_query_route(struct ucma_file *file,
                 default:
                         break;
                 }
+                break;
+        case RDMA_TRANSPORT_IWARP:
+                ucma_copy_iw_route(&resp, &ctx->cm_id->route);
+                break;
+        default:
+                break;
         }
 
 out:
diff --git a/drivers/infiniband/hw/amso1100/c2_vq.c b/drivers/infiniband/hw/amso1100/c2_vq.c
index 9ce7819b7b2..2ec716fb2ed 100644
--- a/drivers/infiniband/hw/amso1100/c2_vq.c
+++ b/drivers/infiniband/hw/amso1100/c2_vq.c
@@ -107,7 +107,7 @@ struct c2_vq_req *vq_req_alloc(struct c2_dev *c2dev)
         r = kmalloc(sizeof(struct c2_vq_req), GFP_KERNEL);
         if (r) {
                 init_waitqueue_head(&r->wait_object);
-                r->reply_msg = (u64) NULL;
+                r->reply_msg = 0;
                 r->event = 0;
                 r->cm_id = NULL;
                 r->qp = NULL;
@@ -123,7 +123,7 @@ struct c2_vq_req *vq_req_alloc(struct c2_dev *c2dev)
  */
 void vq_req_free(struct c2_dev *c2dev, struct c2_vq_req *r)
 {
-        r->reply_msg = (u64) NULL;
+        r->reply_msg = 0;
         if (atomic_dec_and_test(&r->refcnt)) {
                 kfree(r);
         }
@@ -151,7 +151,7 @@ void vq_req_get(struct c2_dev *c2dev, struct c2_vq_req *r)
 void vq_req_put(struct c2_dev *c2dev, struct c2_vq_req *r)
 {
         if (atomic_dec_and_test(&r->refcnt)) {
-                if (r->reply_msg != (u64) NULL)
+                if (r->reply_msg != 0)
                         vq_repbuf_free(c2dev,
                                        (void *) (unsigned long) r->reply_msg);
                 kfree(r);
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 0dc62b1438b..8b00e6c46f0 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -380,7 +380,7 @@ static void send_flowc(struct c4iw_ep *ep, struct sk_buff *skb)
                                           16)) | FW_WR_FLOWID(ep->hwtid));
 
         flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
-        flowc->mnemval[0].val = cpu_to_be32(0);
+        flowc->mnemval[0].val = cpu_to_be32(PCI_FUNC(ep->com.dev->rdev.lldi.pdev->devfn) << 8);
         flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
         flowc->mnemval[1].val = cpu_to_be32(ep->tx_chan);
         flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 20800900ef3..4f0be25cab1 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -220,7 +220,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                 V_FW_RI_RES_WR_DCAEN(0) |
                 V_FW_RI_RES_WR_DCACPU(0) |
                 V_FW_RI_RES_WR_FBMIN(2) |
-                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_FBMAX(2) |
                 V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
                 V_FW_RI_RES_WR_CIDXFTHRESH(0) |
                 V_FW_RI_RES_WR_EQSIZE(eqsize));
@@ -243,7 +243,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                 V_FW_RI_RES_WR_DCAEN(0) |
                 V_FW_RI_RES_WR_DCACPU(0) |
                 V_FW_RI_RES_WR_FBMIN(2) |
-                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_FBMAX(2) |
                 V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
                 V_FW_RI_RES_WR_CIDXFTHRESH(0) |
                 V_FW_RI_RES_WR_EQSIZE(eqsize));
diff --git a/drivers/infiniband/hw/mthca/Kconfig b/drivers/infiniband/hw/mthca/Kconfig
index 03efc074967..da314c3fec2 100644
--- a/drivers/infiniband/hw/mthca/Kconfig
+++ b/drivers/infiniband/hw/mthca/Kconfig
@@ -7,7 +7,7 @@ config INFINIBAND_MTHCA
           ("Tavor") and the MT25208 PCI Express HCA ("Arbel").
 
 config INFINIBAND_MTHCA_DEBUG
-        bool "Verbose debugging output" if EMBEDDED
+        bool "Verbose debugging output" if EXPERT
         depends on INFINIBAND_MTHCA
         default y
         ---help---
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 50cceb3ab88..b01809a82cb 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -623,7 +623,6 @@ struct qib_chippport_specific {
         u8 ibmalfusesnap;
         struct qib_qsfp_data qsfp_data;
         char epmsgbuf[192]; /* for port error interrupt msg buffer */
-        u8 bounced;
 };
 
 static struct {
@@ -1881,23 +1880,7 @@ static noinline void handle_7322_p_errors(struct qib_pportdata *ppd)
                     IB_PHYSPORTSTATE_DISABLED)
                         qib_set_ib_7322_lstate(ppd, 0,
                                QLOGIC_IB_IBCC_LINKINITCMD_DISABLE);
-                else {
-                        u32 lstate;
-                        /*
-                         * We need the current logical link state before
-                         * lflags are set in handle_e_ibstatuschanged.
-                         */
-                        lstate = qib_7322_iblink_state(ibcs);
-
-                        if (IS_QMH(dd) && !ppd->cpspec->bounced &&
-                            ltstate == IB_PHYSPORTSTATE_LINKUP &&
-                            (lstate >= IB_PORT_INIT &&
-                                lstate <= IB_PORT_ACTIVE)) {
-                                ppd->cpspec->bounced = 1;
-                                qib_7322_set_ib_cfg(ppd, QIB_IB_CFG_LSTATE,
-                                        IB_LINKCMD_DOWN | IB_LINKINITCMD_POLL);
-                        }
-
+                else
                         /*
                          * Since going into a recovery state causes the link
                          * state to go down and since recovery is transitory,
@@ -1911,7 +1894,6 @@ static noinline void handle_7322_p_errors(struct qib_pportdata *ppd)
                             ltstate != IB_PHYSPORTSTATE_RECOVERY_WAITRMT &&
                             ltstate != IB_PHYSPORTSTATE_RECOVERY_IDLE)
                                 qib_handle_e_ibstatuschanged(ppd, ibcs);
-                }
         }
         if (*msg && iserr)
                 qib_dev_porterr(dd, ppd->port, "%s error\n", msg);
@@ -2381,6 +2363,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd)
         qib_write_kreg_port(ppd, krp_rcvctrl, ppd->p_rcvctrl);
         spin_unlock_irqrestore(&dd->cspec->rcvmod_lock, flags);
 
+        /* Hold the link state machine for mezz boards */
+        if (IS_QMH(dd) || IS_QME(dd))
+                qib_set_ib_7322_lstate(ppd, 0,
+                                       QLOGIC_IB_IBCC_LINKINITCMD_DISABLE);
+
         /* Also enable IBSTATUSCHG interrupt.  */
         val = qib_read_kreg_port(ppd, krp_errmask);
         qib_write_kreg_port(ppd, krp_errmask,
@@ -5702,6 +5689,11 @@ static void set_no_qsfp_atten(struct qib_devdata *dd, int change)
                                 ppd->cpspec->h1_val = h1;
                         /* now change the IBC and serdes, overriding generic */
                         init_txdds_table(ppd, 1);
+                        /* Re-enable the physical state machine on mezz boards
+                         * now that the correct settings have been set. */
+                        if (IS_QMH(dd) || IS_QME(dd))
+                                qib_set_ib_7322_lstate(ppd, 0,
+                                            QLOGIC_IB_IBCC_LINKINITCMD_SLEEP);
                         any++;
                 }
                 if (*nxt == '\n')
diff --git a/drivers/infiniband/ulp/ipoib/Kconfig b/drivers/infiniband/ulp/ipoib/Kconfig
index 55855eeabae..cda8eac55ff 100644
--- a/drivers/infiniband/ulp/ipoib/Kconfig
+++ b/drivers/infiniband/ulp/ipoib/Kconfig
@@ -24,7 +24,7 @@ config INFINIBAND_IPOIB_CM
           unless you limit mtu for these destinations to 2044.
 
 config INFINIBAND_IPOIB_DEBUG
-        bool "IP-over-InfiniBand debugging" if EMBEDDED
+        bool "IP-over-InfiniBand debugging" if EXPERT
         depends on INFINIBAND_IPOIB
         default y
         ---help---
diff --git a/drivers/input/Kconfig b/drivers/input/Kconfig
index 07c2cd43109..1903c0f5b92 100644
--- a/drivers/input/Kconfig
+++ b/drivers/input/Kconfig
@@ -6,7 +6,7 @@ menu "Input device support"
         depends on !S390
 
 config INPUT
-        tristate "Generic input layer (needed for keyboard, mouse, ...)" if EMBEDDED
+        tristate "Generic input layer (needed for keyboard, mouse, ...)" if EXPERT
         default y
         help
           Say Y here if you have any input device (mouse, keyboard, tablet,
@@ -67,7 +67,7 @@ config INPUT_SPARSEKMAP
 comment "Userland interfaces"
 
 config INPUT_MOUSEDEV
-        tristate "Mouse interface" if EMBEDDED
+        tristate "Mouse interface" if EXPERT
         default y
         help
           Say Y here if you want your mouse to be accessible as char devices
@@ -150,7 +150,7 @@ config INPUT_EVBUG
           module will be called evbug.
 
 config INPUT_APMPOWER
-        tristate "Input Power Event -> APM Bridge" if EMBEDDED
+        tristate "Input Power Event -> APM Bridge" if EXPERT
         depends on INPUT && APM_EMULATION
         help
           Say Y here if you want suspend key events to trigger a user
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 7b3c0b8fa43..c7a92028f45 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -2,7 +2,7 @@
 # Input core configuration
 #
 menuconfig INPUT_KEYBOARD
-        bool "Keyboards" if EMBEDDED || !X86
+        bool "Keyboards" if EXPERT || !X86
         default y
         help
           Say Y here, and a list of supported keyboards will be displayed.
@@ -57,7 +57,7 @@ config KEYBOARD_ATARI
           module will be called atakbd.
 
 config KEYBOARD_ATKBD
-        tristate "AT keyboard" if EMBEDDED || !X86
+        tristate "AT keyboard" if EXPERT || !X86
         default y
         select SERIO
         select SERIO_LIBPS2
@@ -343,6 +343,16 @@ config KEYBOARD_NOMADIK
           To compile this driver as a module, choose M here: the
           module will be called nmk-ske-keypad.
 
+config KEYBOARD_TEGRA
+        tristate "NVIDIA Tegra internal matrix keyboard controller support"
+        depends on ARCH_TEGRA
+        help
+          Say Y here if you want to use a matrix keyboard connected directly
+          to the internal keyboard controller on Tegra SoCs.
+
+          To compile this driver as a module, choose M here: the
+          module will be called tegra-kbc.
+
 config KEYBOARD_OPENCORES
         tristate "OpenCores Keyboard Controller"
         help
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index 4e5571b72cd..468c627a284 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -42,6 +42,7 @@ obj-$(CONFIG_KEYBOARD_STMPE)		+= stmpe-keypad.o
 obj-$(CONFIG_KEYBOARD_STOWAWAY)         += stowaway.o
 obj-$(CONFIG_KEYBOARD_SUNKBD)           += sunkbd.o
 obj-$(CONFIG_KEYBOARD_TC3589X)          += tc3589x-keypad.o
+obj-$(CONFIG_KEYBOARD_TEGRA)            += tegra-kbc.o
 obj-$(CONFIG_KEYBOARD_TNETV107X)        += tnetv107x-keypad.o
 obj-$(CONFIG_KEYBOARD_TWL4030)          += twl4030_keypad.o
 obj-$(CONFIG_KEYBOARD_XTKBD)            += xtkbd.o
diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index 6069abe31e4..eb3006361ee 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -322,7 +322,7 @@ static void gpio_keys_report_event(struct gpio_button_data *bdata)
         struct gpio_keys_button *button = bdata->button;
         struct input_dev *input = bdata->input;
         unsigned int type = button->type ?: EV_KEY;
-        int state = (gpio_get_value(button->gpio) ? 1 : 0) ^ button->active_low;
+        int state = (gpio_get_value_cansleep(button->gpio) ? 1 : 0) ^ button->active_low;
 
         input_event(input, type, button->code, !!state);
         input_sync(input);
@@ -410,8 +410,8 @@ static int __devinit gpio_keys_setup_key(struct platform_device *pdev,
         if (!button->can_disable)
                 irqflags |= IRQF_SHARED;
 
-        error = request_irq(irq, gpio_keys_isr, irqflags, desc, bdata);
-        if (error) {
+        error = request_any_context_irq(irq, gpio_keys_isr, irqflags, desc, bdata);
+        if (error < 0) {
                 dev_err(dev, "Unable to claim irq %d; error %d\n",
                         irq, error);
                 goto fail3;
diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
new file mode 100644
index 00000000000..ac471b77c18
--- /dev/null
+++ b/drivers/input/keyboard/tegra-kbc.c
@@ -0,0 +1,727 @@
+/*
+ * Keyboard class input driver for the NVIDIA Tegra SoC internal matrix
+ * keyboard controller
+ *
+ * Copyright (c) 2009-2011, NVIDIA Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/input.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/interrupt.h>
+#include <linux/clk.h>
+#include <linux/slab.h>
+#include <mach/clk.h>
+#include <mach/kbc.h>
+
+#define KBC_MAX_DEBOUNCE_CNT    0x3ffu
+
+/* KBC row scan time and delay for beginning the row scan. */
+#define KBC_ROW_SCAN_TIME       16
+#define KBC_ROW_SCAN_DLY        5
+
+/* KBC uses a 32KHz clock so a cycle = 1/32Khz */
+#define KBC_CYCLE_USEC  32
+
+/* KBC Registers */
+
+/* KBC Control Register */
+#define KBC_CONTROL_0   0x0
+#define KBC_FIFO_TH_CNT_SHIFT(cnt)      (cnt << 14)
+#define KBC_DEBOUNCE_CNT_SHIFT(cnt)     (cnt << 4)
+#define KBC_CONTROL_FIFO_CNT_INT_EN     (1 << 3)
+#define KBC_CONTROL_KBC_EN              (1 << 0)
+
+/* KBC Interrupt Register */
+#define KBC_INT_0       0x4
+#define KBC_INT_FIFO_CNT_INT_STATUS     (1 << 2)
+
+#define KBC_ROW_CFG0_0  0x8
+#define KBC_COL_CFG0_0  0x18
+#define KBC_INIT_DLY_0  0x28
+#define KBC_RPT_DLY_0   0x2c
+#define KBC_KP_ENT0_0   0x30
+#define KBC_KP_ENT1_0   0x34
+#define KBC_ROW0_MASK_0 0x38
+
+#define KBC_ROW_SHIFT   3
+
+struct tegra_kbc {
+        void __iomem *mmio;
+        struct input_dev *idev;
+        unsigned int irq;
+        unsigned int wake_enable_rows;
+        unsigned int wake_enable_cols;
+        spinlock_t lock;
+        unsigned int repoll_dly;
+        unsigned long cp_dly_jiffies;
+        const struct tegra_kbc_platform_data *pdata;
+        unsigned short keycode[KBC_MAX_KEY];
+        unsigned short current_keys[KBC_MAX_KPENT];
+        unsigned int num_pressed_keys;
+        struct timer_list timer;
+        struct clk *clk;
+};
+
+static const u32 tegra_kbc_default_keymap[] = {
+        KEY(0, 2, KEY_W),
+        KEY(0, 3, KEY_S),
+        KEY(0, 4, KEY_A),
+        KEY(0, 5, KEY_Z),
+        KEY(0, 7, KEY_FN),
+
+        KEY(1, 7, KEY_LEFTMETA),
+
+        KEY(2, 6, KEY_RIGHTALT),
+        KEY(2, 7, KEY_LEFTALT),
+
+        KEY(3, 0, KEY_5),
+        KEY(3, 1, KEY_4),
+        KEY(3, 2, KEY_R),
+        KEY(3, 3, KEY_E),
+        KEY(3, 4, KEY_F),
+        KEY(3, 5, KEY_D),
+        KEY(3, 6, KEY_X),
+
+        KEY(4, 0, KEY_7),
+        KEY(4, 1, KEY_6),
+        KEY(4, 2, KEY_T),
+        KEY(4, 3, KEY_H),
+        KEY(4, 4, KEY_G),
+        KEY(4, 5, KEY_V),
+        KEY(4, 6, KEY_C),
+        KEY(4, 7, KEY_SPACE),
+
+        KEY(5, 0, KEY_9),
+        KEY(5, 1, KEY_8),
+        KEY(5, 2, KEY_U),
+        KEY(5, 3, KEY_Y),
+        KEY(5, 4, KEY_J),
+        KEY(5, 5, KEY_N),
+        KEY(5, 6, KEY_B),
+        KEY(5, 7, KEY_BACKSLASH),
+
+        KEY(6, 0, KEY_MINUS),
+        KEY(6, 1, KEY_0),
+        KEY(6, 2, KEY_O),
+        KEY(6, 3, KEY_I),
+        KEY(6, 4, KEY_L),
+        KEY(6, 5, KEY_K),
+        KEY(6, 6, KEY_COMMA),
+        KEY(6, 7, KEY_M),
+
+        KEY(7, 1, KEY_EQUAL),
+        KEY(7, 2, KEY_RIGHTBRACE),
+        KEY(7, 3, KEY_ENTER),
+        KEY(7, 7, KEY_MENU),
+
+        KEY(8, 4, KEY_RIGHTSHIFT),
+        KEY(8, 5, KEY_LEFTSHIFT),
+
+        KEY(9, 5, KEY_RIGHTCTRL),
+        KEY(9, 7, KEY_LEFTCTRL),
+
+        KEY(11, 0, KEY_LEFTBRACE),
+        KEY(11, 1, KEY_P),
+        KEY(11, 2, KEY_APOSTROPHE),
+        KEY(11, 3, KEY_SEMICOLON),
+        KEY(11, 4, KEY_SLASH),
+        KEY(11, 5, KEY_DOT),
+
+        KEY(12, 0, KEY_F10),
+        KEY(12, 1, KEY_F9),
+        KEY(12, 2, KEY_BACKSPACE),
+        KEY(12, 3, KEY_3),
+        KEY(12, 4, KEY_2),
+        KEY(12, 5, KEY_UP),
+        KEY(12, 6, KEY_PRINT),
+        KEY(12, 7, KEY_PAUSE),
+
+        KEY(13, 0, KEY_INSERT),
+        KEY(13, 1, KEY_DELETE),
+        KEY(13, 3, KEY_PAGEUP),
+        KEY(13, 4, KEY_PAGEDOWN),
+        KEY(13, 5, KEY_RIGHT),
+        KEY(13, 6, KEY_DOWN),
+        KEY(13, 7, KEY_LEFT),
+
+        KEY(14, 0, KEY_F11),
+        KEY(14, 1, KEY_F12),
+        KEY(14, 2, KEY_F8),
+        KEY(14, 3, KEY_Q),
+        KEY(14, 4, KEY_F4),
+        KEY(14, 5, KEY_F3),
+        KEY(14, 6, KEY_1),
+        KEY(14, 7, KEY_F7),
+
+        KEY(15, 0, KEY_ESC),
+        KEY(15, 1, KEY_GRAVE),
+        KEY(15, 2, KEY_F5),
+        KEY(15, 3, KEY_TAB),
+        KEY(15, 4, KEY_F1),
+        KEY(15, 5, KEY_F2),
+        KEY(15, 6, KEY_CAPSLOCK),
+        KEY(15, 7, KEY_F6),
+};
+
+static const struct matrix_keymap_data tegra_kbc_default_keymap_data = {
+        .keymap         = tegra_kbc_default_keymap,
+        .keymap_size    = ARRAY_SIZE(tegra_kbc_default_keymap),
+};
+
+static void tegra_kbc_report_released_keys(struct input_dev *input,
+                                           unsigned short old_keycodes[],
+                                           unsigned int old_num_keys,
+                                           unsigned short new_keycodes[],
+                                           unsigned int new_num_keys)
+{
+        unsigned int i, j;
+
+        for (i = 0; i < old_num_keys; i++) {
+                for (j = 0; j < new_num_keys; j++)
+                        if (old_keycodes[i] == new_keycodes[j])
+                                break;
+
+                if (j == new_num_keys)
+                        input_report_key(input, old_keycodes[i], 0);
+        }
+}
+
+static void tegra_kbc_report_pressed_keys(struct input_dev *input,
+                                          unsigned char scancodes[],
+                                          unsigned short keycodes[],
+                                          unsigned int num_pressed_keys)
+{
+        unsigned int i;
+
+        for (i = 0; i < num_pressed_keys; i++) {
+                input_event(input, EV_MSC, MSC_SCAN, scancodes[i]);
+                input_report_key(input, keycodes[i], 1);
+        }
+}
+
+static void tegra_kbc_report_keys(struct tegra_kbc *kbc)
+{
+        unsigned char scancodes[KBC_MAX_KPENT];
+        unsigned short keycodes[KBC_MAX_KPENT];
+        u32 val = 0;
+        unsigned int i;
+        unsigned int num_down = 0;
+        unsigned long flags;
+
+        spin_lock_irqsave(&kbc->lock, flags);
+        for (i = 0; i < KBC_MAX_KPENT; i++) {
+                if ((i % 4) == 0)
+                        val = readl(kbc->mmio + KBC_KP_ENT0_0 + i);
+
+                if (val & 0x80) {
+                        unsigned int col = val & 0x07;
+                        unsigned int row = (val >> 3) & 0x0f;
+                        unsigned char scancode =
+                                MATRIX_SCAN_CODE(row, col, KBC_ROW_SHIFT);
+
+                        scancodes[num_down] = scancode;
+                        keycodes[num_down++] = kbc->keycode[scancode];
+                }
+
+                val >>= 8;
+        }
+        spin_unlock_irqrestore(&kbc->lock, flags);
+
+        tegra_kbc_report_released_keys(kbc->idev,
+                                       kbc->current_keys, kbc->num_pressed_keys,
+                                       keycodes, num_down);
+        tegra_kbc_report_pressed_keys(kbc->idev, scancodes, keycodes, num_down);
+        input_sync(kbc->idev);
+
+        memcpy(kbc->current_keys, keycodes, sizeof(kbc->current_keys));
+        kbc->num_pressed_keys = num_down;
+}
+
+static void tegra_kbc_keypress_timer(unsigned long data)
+{
+        struct tegra_kbc *kbc = (struct tegra_kbc *)data;
+        unsigned long flags;
+        u32 val;
+        unsigned int i;
+
+        val = (readl(kbc->mmio + KBC_INT_0) >> 4) & 0xf;
+        if (val) {
+                unsigned long dly;
+
+                tegra_kbc_report_keys(kbc);
+
+                /*
+                 * If more than one keys are pressed we need not wait
+                 * for the repoll delay.
+                 */
+                dly = (val == 1) ? kbc->repoll_dly : 1;
+                mod_timer(&kbc->timer, jiffies + msecs_to_jiffies(dly));
+        } else {
+                /* Release any pressed keys and exit the polling loop */
+                for (i = 0; i < kbc->num_pressed_keys; i++)
+                        input_report_key(kbc->idev, kbc->current_keys[i], 0);
+                input_sync(kbc->idev);
+
+                kbc->num_pressed_keys = 0;
+
+                /* All keys are released so enable the keypress interrupt */
+                spin_lock_irqsave(&kbc->lock, flags);
+                val = readl(kbc->mmio + KBC_CONTROL_0);
+                val |= KBC_CONTROL_FIFO_CNT_INT_EN;
+                writel(val, kbc->mmio + KBC_CONTROL_0);
+                spin_unlock_irqrestore(&kbc->lock, flags);
+        }
+}
+
+static irqreturn_t tegra_kbc_isr(int irq, void *args)
+{
+        struct tegra_kbc *kbc = args;
+        u32 val, ctl;
+
+        /*
+         * Until all keys are released, defer further processing to
+         * the polling loop in tegra_kbc_keypress_timer
+         */
+        ctl = readl(kbc->mmio + KBC_CONTROL_0);
+        ctl &= ~KBC_CONTROL_FIFO_CNT_INT_EN;
+        writel(ctl, kbc->mmio + KBC_CONTROL_0);
+
+        /*
+         * Quickly bail out & reenable interrupts if the fifo threshold
+         * count interrupt wasn't the interrupt source
+         */
+        val = readl(kbc->mmio + KBC_INT_0);
+        writel(val, kbc->mmio + KBC_INT_0);
+
+        if (val & KBC_INT_FIFO_CNT_INT_STATUS) {
+                /*
+                 * Schedule timer to run when hardware is in continuous
+                 * polling mode.
+                 */
+                mod_timer(&kbc->timer, jiffies + kbc->cp_dly_jiffies);
+        } else {
+                ctl |= KBC_CONTROL_FIFO_CNT_INT_EN;
+                writel(ctl, kbc->mmio + KBC_CONTROL_0);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static void tegra_kbc_setup_wakekeys(struct tegra_kbc *kbc, bool filter)
+{
+        const struct tegra_kbc_platform_data *pdata = kbc->pdata;
+        int i;
+        unsigned int rst_val;
+
+        BUG_ON(pdata->wake_cnt > KBC_MAX_KEY);
+        rst_val = (filter && pdata->wake_cnt) ? ~0 : 0;
+
+        for (i = 0; i < KBC_MAX_ROW; i++)
+                writel(rst_val, kbc->mmio + KBC_ROW0_MASK_0 + i * 4);
+
+        if (filter) {
+                for (i = 0; i < pdata->wake_cnt; i++) {
+                        u32 val, addr;
+                        addr = pdata->wake_cfg[i].row * 4 + KBC_ROW0_MASK_0;
+                        val = readl(kbc->mmio + addr);
+                        val &= ~(1 << pdata->wake_cfg[i].col);
+                        writel(val, kbc->mmio + addr);
+                }
+        }
+}
+
+static void tegra_kbc_config_pins(struct tegra_kbc *kbc)
+{
+        const struct tegra_kbc_platform_data *pdata = kbc->pdata;
+        int i;
+
+        for (i = 0; i < KBC_MAX_GPIO; i++) {
+                u32 r_shft = 5 * (i % 6);
+                u32 c_shft = 4 * (i % 8);
+                u32 r_mask = 0x1f << r_shft;
+                u32 c_mask = 0x0f << c_shft;
+                u32 r_offs = (i / 6) * 4 + KBC_ROW_CFG0_0;
+                u32 c_offs = (i / 8) * 4 + KBC_COL_CFG0_0;
+                u32 row_cfg = readl(kbc->mmio + r_offs);
+                u32 col_cfg = readl(kbc->mmio + c_offs);
+
+                row_cfg &= ~r_mask;
+                col_cfg &= ~c_mask;
+
+                if (pdata->pin_cfg[i].is_row)
+                        row_cfg |= ((pdata->pin_cfg[i].num << 1) | 1) << r_shft;
+                else
+                        col_cfg |= ((pdata->pin_cfg[i].num << 1) | 1) << c_shft;
+
+                writel(row_cfg, kbc->mmio + r_offs);
+                writel(col_cfg, kbc->mmio + c_offs);
+        }
+}
+
+static int tegra_kbc_start(struct tegra_kbc *kbc)
+{
+        const struct tegra_kbc_platform_data *pdata = kbc->pdata;
+        unsigned long flags;
+        unsigned int debounce_cnt;
+        u32 val = 0;
+
+        clk_enable(kbc->clk);
+
+        /* Reset the KBC controller to clear all previous status.*/
+        tegra_periph_reset_assert(kbc->clk);
+        udelay(100);
+        tegra_periph_reset_deassert(kbc->clk);
+        udelay(100);
+
+        tegra_kbc_config_pins(kbc);
+        tegra_kbc_setup_wakekeys(kbc, false);
+
+        writel(pdata->repeat_cnt, kbc->mmio + KBC_RPT_DLY_0);
+
+        /* Keyboard debounce count is maximum of 12 bits. */
+        debounce_cnt = min(pdata->debounce_cnt, KBC_MAX_DEBOUNCE_CNT);
+        val = KBC_DEBOUNCE_CNT_SHIFT(debounce_cnt);
+        val |= KBC_FIFO_TH_CNT_SHIFT(1); /* set fifo interrupt threshold to 1 */
+        val |= KBC_CONTROL_FIFO_CNT_INT_EN;  /* interrupt on FIFO threshold */
+        val |= KBC_CONTROL_KBC_EN;     /* enable */
+        writel(val, kbc->mmio + KBC_CONTROL_0);
+
+        /*
+         * Compute the delay(ns) from interrupt mode to continuous polling
+         * mode so the timer routine is scheduled appropriately.
+         */
+        val = readl(kbc->mmio + KBC_INIT_DLY_0);
+        kbc->cp_dly_jiffies = usecs_to_jiffies((val & 0xfffff) * 32);
+
+        kbc->num_pressed_keys = 0;
+
+        /*
+         * Atomically clear out any remaining entries in the key FIFO
+         * and enable keyboard interrupts.
+         */
+        spin_lock_irqsave(&kbc->lock, flags);
+        while (1) {
+                val = readl(kbc->mmio + KBC_INT_0);
+                val >>= 4;
+                if (!val)
+                        break;
+
+                val = readl(kbc->mmio + KBC_KP_ENT0_0);
+                val = readl(kbc->mmio + KBC_KP_ENT1_0);
+        }
+        writel(0x7, kbc->mmio + KBC_INT_0);
+        spin_unlock_irqrestore(&kbc->lock, flags);
+
+        enable_irq(kbc->irq);
+
+        return 0;
+}
+
+static void tegra_kbc_stop(struct tegra_kbc *kbc)
+{
+        unsigned long flags;
+        u32 val;
+
+        spin_lock_irqsave(&kbc->lock, flags);
+        val = readl(kbc->mmio + KBC_CONTROL_0);
+        val &= ~1;
+        writel(val, kbc->mmio + KBC_CONTROL_0);
+        spin_unlock_irqrestore(&kbc->lock, flags);
+
+        disable_irq(kbc->irq);
+        del_timer_sync(&kbc->timer);
+
+        clk_disable(kbc->clk);
+}
+
+static int tegra_kbc_open(struct input_dev *dev)
+{
+        struct tegra_kbc *kbc = input_get_drvdata(dev);
+
+        return tegra_kbc_start(kbc);
+}
+
+static void tegra_kbc_close(struct input_dev *dev)
+{
+        struct tegra_kbc *kbc = input_get_drvdata(dev);
+
+        return tegra_kbc_stop(kbc);
+}
+
+static bool __devinit
+tegra_kbc_check_pin_cfg(const struct tegra_kbc_platform_data *pdata,
+                        struct device *dev, unsigned int *num_rows)
+{
+        int i;
+
+        *num_rows = 0;
+
+        for (i = 0; i < KBC_MAX_GPIO; i++) {
+                const struct tegra_kbc_pin_cfg *pin_cfg = &pdata->pin_cfg[i];
+
+                if (pin_cfg->is_row) {
+                        if (pin_cfg->num >= KBC_MAX_ROW) {
+                                dev_err(dev,
+                                        "pin_cfg[%d]: invalid row number %d\n",
+                                        i, pin_cfg->num);
+                                return false;
+                        }
+                        (*num_rows)++;
+                } else {
+                        if (pin_cfg->num >= KBC_MAX_COL) {
+                                dev_err(dev,
+                                        "pin_cfg[%d]: invalid column number %d\n",
+                                        i, pin_cfg->num);
+                                return false;
+                        }
+                }
+        }
+
+        return true;
+}
+
+static int __devinit tegra_kbc_probe(struct platform_device *pdev)
+{
+        const struct tegra_kbc_platform_data *pdata = pdev->dev.platform_data;
+        const struct matrix_keymap_data *keymap_data;
+        struct tegra_kbc *kbc;
+        struct input_dev *input_dev;
+        struct resource *res;
+        int irq;
+        int err;
+        int i;
+        int num_rows = 0;
+        unsigned int debounce_cnt;
+        unsigned int scan_time_rows;
+
+        if (!pdata)
+                return -EINVAL;
+
+        if (!tegra_kbc_check_pin_cfg(pdata, &pdev->dev, &num_rows))
+                return -EINVAL;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to get I/O memory\n");
+                return -ENXIO;
+        }
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "failed to get keyboard IRQ\n");
+                return -ENXIO;
+        }
+
+        kbc = kzalloc(sizeof(*kbc), GFP_KERNEL);
+        input_dev = input_allocate_device();
+        if (!kbc || !input_dev) {
+                err = -ENOMEM;
+                goto err_free_mem;
+        }
+
+        kbc->pdata = pdata;
+        kbc->idev = input_dev;
+        kbc->irq = irq;
+        spin_lock_init(&kbc->lock);
+        setup_timer(&kbc->timer, tegra_kbc_keypress_timer, (unsigned long)kbc);
+
+        res = request_mem_region(res->start, resource_size(res), pdev->name);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to request I/O memory\n");
+                err = -EBUSY;
+                goto err_free_mem;
+        }
+
+        kbc->mmio = ioremap(res->start, resource_size(res));
+        if (!kbc->mmio) {
+                dev_err(&pdev->dev, "failed to remap I/O memory\n");
+                err = -ENXIO;
+                goto err_free_mem_region;
+        }
+
+        kbc->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(kbc->clk)) {
+                dev_err(&pdev->dev, "failed to get keyboard clock\n");
+                err = PTR_ERR(kbc->clk);
+                goto err_iounmap;
+        }
+
+        kbc->wake_enable_rows = 0;
+        kbc->wake_enable_cols = 0;
+        for (i = 0; i < pdata->wake_cnt; i++) {
+                kbc->wake_enable_rows |= (1 << pdata->wake_cfg[i].row);
+                kbc->wake_enable_cols |= (1 << pdata->wake_cfg[i].col);
+        }
+
+        /*
+         * The time delay between two consecutive reads of the FIFO is
+         * the sum of the repeat time and the time taken for scanning
+         * the rows. There is an additional delay before the row scanning
+         * starts. The repoll delay is computed in milliseconds.
+         */
+        debounce_cnt = min(pdata->debounce_cnt, KBC_MAX_DEBOUNCE_CNT);
+        scan_time_rows = (KBC_ROW_SCAN_TIME + debounce_cnt) * num_rows;
+        kbc->repoll_dly = KBC_ROW_SCAN_DLY + scan_time_rows + pdata->repeat_cnt;
+        kbc->repoll_dly = ((kbc->repoll_dly * KBC_CYCLE_USEC) + 999) / 1000;
+
+        input_dev->name = pdev->name;
+        input_dev->id.bustype = BUS_HOST;
+        input_dev->dev.parent = &pdev->dev;
+        input_dev->open = tegra_kbc_open;
+        input_dev->close = tegra_kbc_close;
+
+        input_set_drvdata(input_dev, kbc);
+
+        input_dev->evbit[0] = BIT_MASK(EV_KEY);
+        input_set_capability(input_dev, EV_MSC, MSC_SCAN);
+
+        input_dev->keycode = kbc->keycode;
+        input_dev->keycodesize = sizeof(kbc->keycode[0]);
+        input_dev->keycodemax = ARRAY_SIZE(kbc->keycode);
+
+        keymap_data = pdata->keymap_data ?: &tegra_kbc_default_keymap_data;
+        matrix_keypad_build_keymap(keymap_data, KBC_ROW_SHIFT,
+                                   input_dev->keycode, input_dev->keybit);
+
+        err = request_irq(kbc->irq, tegra_kbc_isr, IRQF_TRIGGER_HIGH,
+                          pdev->name, kbc);
+        if (err) {
+                dev_err(&pdev->dev, "failed to request keyboard IRQ\n");
+                goto err_put_clk;
+        }
+
+        disable_irq(kbc->irq);
+
+        err = input_register_device(kbc->idev);
+        if (err) {
+                dev_err(&pdev->dev, "failed to register input device\n");
+                goto err_free_irq;
+        }
+
+        platform_set_drvdata(pdev, kbc);
+        device_init_wakeup(&pdev->dev, pdata->wakeup);
+
+        return 0;
+
+err_free_irq:
+        free_irq(kbc->irq, pdev);
+err_put_clk:
+        clk_put(kbc->clk);
+err_iounmap:
+        iounmap(kbc->mmio);
+err_free_mem_region:
+        release_mem_region(res->start, resource_size(res));
+err_free_mem:
+        input_free_device(kbc->idev);
+        kfree(kbc);
+
+        return err;
+}
+
+static int __devexit tegra_kbc_remove(struct platform_device *pdev)
+{
+        struct tegra_kbc *kbc = platform_get_drvdata(pdev);
+        struct resource *res;
+
+        free_irq(kbc->irq, pdev);
+        clk_put(kbc->clk);
+
+        input_unregister_device(kbc->idev);
+        iounmap(kbc->mmio);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        release_mem_region(res->start, resource_size(res));
+
+        kfree(kbc);
+
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int tegra_kbc_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct tegra_kbc *kbc = platform_get_drvdata(pdev);
+
+        if (device_may_wakeup(&pdev->dev)) {
+                tegra_kbc_setup_wakekeys(kbc, true);
+                enable_irq_wake(kbc->irq);
+                /* Forcefully clear the interrupt status */
+                writel(0x7, kbc->mmio + KBC_INT_0);
+                msleep(30);
+        } else {
+                mutex_lock(&kbc->idev->mutex);
+                if (kbc->idev->users)
+                        tegra_kbc_stop(kbc);
+                mutex_unlock(&kbc->idev->mutex);
+        }
+
+        return 0;
+}
+
+static int tegra_kbc_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct tegra_kbc *kbc = platform_get_drvdata(pdev);
+        int err = 0;
+
+        if (device_may_wakeup(&pdev->dev)) {
+                disable_irq_wake(kbc->irq);
+                tegra_kbc_setup_wakekeys(kbc, false);
+        } else {
+                mutex_lock(&kbc->idev->mutex);
+                if (kbc->idev->users)
+                        err = tegra_kbc_start(kbc);
+                mutex_unlock(&kbc->idev->mutex);
+        }
+
+        return err;
+}
+#endif
+
+static SIMPLE_DEV_PM_OPS(tegra_kbc_pm_ops, tegra_kbc_suspend, tegra_kbc_resume);
+
+static struct platform_driver tegra_kbc_driver = {
+        .probe          = tegra_kbc_probe,
+        .remove         = __devexit_p(tegra_kbc_remove),
+        .driver = {
+                .name   = "tegra-kbc",
+                .owner  = THIS_MODULE,
+                .pm     = &tegra_kbc_pm_ops,
+        },
+};
+
+static void __exit tegra_kbc_exit(void)
+{
+        platform_driver_unregister(&tegra_kbc_driver);
+}
+module_exit(tegra_kbc_exit);
+
+static int __init tegra_kbc_init(void)
+{
+        return platform_driver_register(&tegra_kbc_driver);
+}
+module_init(tegra_kbc_init);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Rakesh Iyer <riyer@nvidia.com>");
+MODULE_DESCRIPTION("Tegra matrix keyboard controller driver");
+MODULE_ALIAS("platform:tegra-kbc");
diff --git a/drivers/input/keyboard/tnetv107x-keypad.c b/drivers/input/keyboard/tnetv107x-keypad.c
index b4a81ebfab9..c8f097a15d8 100644
--- a/drivers/input/keyboard/tnetv107x-keypad.c
+++ b/drivers/input/keyboard/tnetv107x-keypad.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/err.h>
 #include <linux/errno.h>
 #include <linux/input.h>
 #include <linux/platform_device.h>
@@ -219,9 +220,9 @@ static int __devinit keypad_probe(struct platform_device *pdev)
         }
 
         kp->clk = clk_get(dev, NULL);
-        if (!kp->clk) {
+        if (IS_ERR(kp->clk)) {
                 dev_err(dev, "cannot claim device clock\n");
-                error = -EINVAL;
+                error = PTR_ERR(kp->clk);
                 goto error_clk;
         }
 
diff --git a/drivers/input/misc/ixp4xx-beeper.c b/drivers/input/misc/ixp4xx-beeper.c
index 9dfd6e5f786..1f38302a595 100644
--- a/drivers/input/misc/ixp4xx-beeper.c
+++ b/drivers/input/misc/ixp4xx-beeper.c
@@ -69,11 +69,7 @@ static int ixp4xx_spkr_event(struct input_dev *dev, unsigned int type, unsigned
         }
 
         if (value > 20 && value < 32767)
-#ifndef FREQ
-                count = (ixp4xx_get_board_tick_rate() / (value * 4)) - 1;
-#else
-                count = (FREQ / (value * 4)) - 1;
-#endif
+                count = (IXP4XX_TIMER_FREQ / (value * 4)) - 1;
 
         ixp4xx_spkr_control(pin, count);
 
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index bf5fd7f6a31..9c1e6ee8353 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -39,7 +39,7 @@ config MOUSE_PS2
           module will be called psmouse.
 
 config MOUSE_PS2_ALPS
-        bool "ALPS PS/2 mouse protocol extension" if EMBEDDED
+        bool "ALPS PS/2 mouse protocol extension" if EXPERT
         default y
         depends on MOUSE_PS2
         help
@@ -49,7 +49,7 @@ config MOUSE_PS2_ALPS
           If unsure, say Y.
 
 config MOUSE_PS2_LOGIPS2PP
-        bool "Logitech PS/2++ mouse protocol extension" if EMBEDDED
+        bool "Logitech PS/2++ mouse protocol extension" if EXPERT
         default y
         depends on MOUSE_PS2
         help
@@ -59,7 +59,7 @@ config MOUSE_PS2_LOGIPS2PP
           If unsure, say Y.
 
 config MOUSE_PS2_SYNAPTICS
-        bool "Synaptics PS/2 mouse protocol extension" if EMBEDDED
+        bool "Synaptics PS/2 mouse protocol extension" if EXPERT
         default y
         depends on MOUSE_PS2
         help
@@ -69,7 +69,7 @@ config MOUSE_PS2_SYNAPTICS
           If unsure, say Y.
 
 config MOUSE_PS2_LIFEBOOK
-        bool "Fujitsu Lifebook PS/2 mouse protocol extension" if EMBEDDED
+        bool "Fujitsu Lifebook PS/2 mouse protocol extension" if EXPERT
         default y
         depends on MOUSE_PS2 && X86 && DMI
         help
@@ -79,7 +79,7 @@ config MOUSE_PS2_LIFEBOOK
           If unsure, say Y.
 
 config MOUSE_PS2_TRACKPOINT
-        bool "IBM Trackpoint PS/2 mouse protocol extension" if EMBEDDED
+        bool "IBM Trackpoint PS/2 mouse protocol extension" if EXPERT
         default y
         depends on MOUSE_PS2
         help
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index da392c22fc6..aa186cf6c51 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -755,23 +755,26 @@ static int synaptics_reconnect(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         struct synaptics_data old_priv = *priv;
+        int retry = 0;
+        int error;
 
-        psmouse_reset(psmouse);
+        do {
+                psmouse_reset(psmouse);
+                error = synaptics_detect(psmouse, 0);
+        } while (error && ++retry < 3);
 
-        if (synaptics_detect(psmouse, 0))
+        if (error)
                 return -1;
 
+        if (retry > 1)
+                printk(KERN_DEBUG "Synaptics reconnected after %d tries\n",
+                        retry);
+
         if (synaptics_query_hardware(psmouse)) {
                 printk(KERN_ERR "Unable to query Synaptics hardware.\n");
                 return -1;
         }
 
-        if (old_priv.identity != priv->identity ||
-            old_priv.model_id != priv->model_id ||
-            old_priv.capabilities != priv->capabilities ||
-            old_priv.ext_cap != priv->ext_cap)
-                return -1;
-
         if (synaptics_set_absolute_mode(psmouse)) {
                 printk(KERN_ERR "Unable to initialize Synaptics hardware.\n");
                 return -1;
@@ -782,6 +785,19 @@ static int synaptics_reconnect(struct psmouse *psmouse)
                 return -1;
         }
 
+        if (old_priv.identity != priv->identity ||
+            old_priv.model_id != priv->model_id ||
+            old_priv.capabilities != priv->capabilities ||
+            old_priv.ext_cap != priv->ext_cap) {
+                printk(KERN_ERR "Synaptics hardware appears to be different: "
+                        "id(%ld-%ld), model(%ld-%ld), caps(%lx-%lx), ext(%lx-%lx).\n",
+                        old_priv.identity, priv->identity,
+                        old_priv.model_id, priv->model_id,
+                        old_priv.capabilities, priv->capabilities,
+                        old_priv.ext_cap, priv->ext_cap);
+                return -1;
+        }
+
         return 0;
 }
 
diff --git a/drivers/input/serio/Kconfig b/drivers/input/serio/Kconfig
index 307eef77a17..55f2c2293ec 100644
--- a/drivers/input/serio/Kconfig
+++ b/drivers/input/serio/Kconfig
@@ -2,7 +2,7 @@
 # Input core configuration
 #
 config SERIO
-        tristate "Serial I/O support" if EMBEDDED || !X86
+        tristate "Serial I/O support" if EXPERT || !X86
         default y
         help
           Say Yes here if you have any input device that uses serial I/O to
@@ -19,7 +19,7 @@ config SERIO
 if SERIO
 
 config SERIO_I8042
-        tristate "i8042 PC Keyboard controller" if EMBEDDED || !X86
+        tristate "i8042 PC Keyboard controller" if EXPERT || !X86
         default y
         depends on !PARISC && (!ARM || ARCH_SHARK || FOOTBRIDGE_HOST) && \
                    (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN
@@ -168,7 +168,7 @@ config SERIO_MACEPS2
           module will be called maceps2.
 
 config SERIO_LIBPS2
-        tristate "PS/2 driver library" if EMBEDDED
+        tristate "PS/2 driver library" if EXPERT
         depends on SERIO_I8042 || SERIO_I8042=n
         help
           Say Y here if you are using a driver for device connected
diff --git a/drivers/input/serio/ct82c710.c b/drivers/input/serio/ct82c710.c
index 448c7724beb..85281656724 100644
--- a/drivers/input/serio/ct82c710.c
+++ b/drivers/input/serio/ct82c710.c
@@ -111,9 +111,11 @@ static void ct82c710_close(struct serio *serio)
 static int ct82c710_open(struct serio *serio)
 {
         unsigned char status;
+        int err;
 
-        if (request_irq(CT82C710_IRQ, ct82c710_interrupt, 0, "ct82c710", NULL))
-                return -1;
+        err = request_irq(CT82C710_IRQ, ct82c710_interrupt, 0, "ct82c710", NULL);
+        if (err)
+                return err;
 
         status = inb_p(CT82C710_STATUS);
 
@@ -131,7 +133,7 @@ static int ct82c710_open(struct serio *serio)
                 status &= ~(CT82C710_ENABLE | CT82C710_INTS_ON);
                 outb_p(status, CT82C710_STATUS);
                 free_irq(CT82C710_IRQ, NULL);
-                return -1;
+                return -EBUSY;
         }
 
         return 0;
diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
index 6e362de3f41..8755f5f3ad3 100644
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -116,14 +116,15 @@ static void serport_ldisc_close(struct tty_struct *tty)
 
 /*
  * serport_ldisc_receive() is called by the low level tty driver when characters
- * are ready for us. We forward the characters, one by one to the 'interrupt'
- * routine.
+ * are ready for us. We forward the characters and flags, one by one to the
+ * 'interrupt' routine.
  */
 
 static void serport_ldisc_receive(struct tty_struct *tty, const unsigned char *cp, char *fp, int count)
 {
         struct serport *serport = (struct serport*) tty->disc_data;
         unsigned long flags;
+        unsigned int ch_flags;
         int i;
 
         spin_lock_irqsave(&serport->lock, flags);
@@ -131,8 +132,23 @@ static void serport_ldisc_receive(struct tty_struct *tty, const unsigned char *c
         if (!test_bit(SERPORT_ACTIVE, &serport->flags))
                 goto out;
 
-        for (i = 0; i < count; i++)
-                serio_interrupt(serport->serio, cp[i], 0);
+        for (i = 0; i < count; i++) {
+                switch (fp[i]) {
+                case TTY_FRAME:
+                        ch_flags = SERIO_FRAME;
+                        break;
+
+                case TTY_PARITY:
+                        ch_flags = SERIO_PARITY;
+                        break;
+
+                default:
+                        ch_flags = 0;
+                        break;
+                }
+
+                serio_interrupt(serport->serio, cp[i], ch_flags);
+        }
 
 out:
         spin_unlock_irqrestore(&serport->lock, flags);
diff --git a/drivers/input/sparse-keymap.c b/drivers/input/sparse-keymap.c
index a29a7812bd4..7729e547ba6 100644
--- a/drivers/input/sparse-keymap.c
+++ b/drivers/input/sparse-keymap.c
@@ -201,6 +201,7 @@ int sparse_keymap_setup(struct input_dev *dev,
                         break;
 
                 case KE_SW:
+                case KE_VSW:
                         __set_bit(EV_SW, dev->evbit);
                         __set_bit(entry->sw.code, dev->swbit);
                         break;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 518782999fe..367fa82a607 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1101,6 +1101,13 @@ void wacom_setup_device_quirks(struct wacom_features *features)
         }
 }
 
+static unsigned int wacom_calculate_touch_res(unsigned int logical_max,
+                                              unsigned int physical_max)
+{
+       /* Touch physical dimensions are in 100th of mm */
+       return (logical_max * 100) / physical_max;
+}
+
 void wacom_setup_input_capabilities(struct input_dev *input_dev,
                                     struct wacom_wac *wacom_wac)
 {
@@ -1228,8 +1235,12 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
         case TABLETPC:
                 if (features->device_type == BTN_TOOL_DOUBLETAP ||
                     features->device_type == BTN_TOOL_TRIPLETAP) {
-                        input_set_abs_params(input_dev, ABS_RX, 0, features->x_phy, 0, 0);
-                        input_set_abs_params(input_dev, ABS_RY, 0, features->y_phy, 0, 0);
+                        input_abs_set_res(input_dev, ABS_X,
+                                wacom_calculate_touch_res(features->x_max,
+                                                        features->x_phy));
+                        input_abs_set_res(input_dev, ABS_Y,
+                                wacom_calculate_touch_res(features->y_max,
+                                                        features->y_phy));
                         __set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
                 }
 
@@ -1272,6 +1283,12 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                         input_set_abs_params(input_dev, ABS_MT_PRESSURE,
                                              0, features->pressure_max,
                                              features->pressure_fuzz, 0);
+                        input_abs_set_res(input_dev, ABS_X,
+                                wacom_calculate_touch_res(features->x_max,
+                                                        features->x_phy));
+                        input_abs_set_res(input_dev, ABS_Y,
+                                wacom_calculate_touch_res(features->y_max,
+                                                        features->y_phy));
                 } else if (features->device_type == BTN_TOOL_PEN) {
                         __set_bit(BTN_TOOL_RUBBER, input_dev->keybit);
                         __set_bit(BTN_TOOL_PEN, input_dev->keybit);
@@ -1426,6 +1443,10 @@ static struct wacom_features wacom_features_0xD3 =
         { "Wacom Bamboo 2FG 6x8", WACOM_PKGLEN_BBFUN,     21648, 13530, 1023, 63, BAMBOO_PT };
 static const struct wacom_features wacom_features_0xD4 =
         { "Wacom Bamboo Pen",     WACOM_PKGLEN_BBFUN,     14720,  9200,  255, 63, BAMBOO_PT };
+static struct wacom_features wacom_features_0xD6 =
+        { "Wacom BambooPT 2FG 4x5", WACOM_PKGLEN_BBFUN,   14720,  9200, 1023, 63, BAMBOO_PT };
+static struct wacom_features wacom_features_0xD7 =
+        { "Wacom BambooPT 2FG Small", WACOM_PKGLEN_BBFUN, 14720,  9200, 1023, 63, BAMBOO_PT };
 static struct wacom_features wacom_features_0xD8 =
         { "Wacom Bamboo Comic 2FG", WACOM_PKGLEN_BBFUN,   21648, 13530, 1023, 63, BAMBOO_PT };
 static struct wacom_features wacom_features_0xDA =
@@ -1507,6 +1528,8 @@ const struct usb_device_id wacom_ids[] = {
         { USB_DEVICE_WACOM(0xD2) },
         { USB_DEVICE_WACOM(0xD3) },
         { USB_DEVICE_WACOM(0xD4) },
+        { USB_DEVICE_WACOM(0xD6) },
+        { USB_DEVICE_WACOM(0xD7) },
         { USB_DEVICE_WACOM(0xD8) },
         { USB_DEVICE_WACOM(0xDA) },
         { USB_DEVICE_WACOM(0xDB) },
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 0c9f4b158ff..61834ae282e 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -540,62 +540,62 @@ config TOUCHSCREEN_MC13783
 
 config TOUCHSCREEN_USB_EGALAX
         default y
-        bool "eGalax, eTurboTouch CT-410/510/700 device support" if EMBEDDED
+        bool "eGalax, eTurboTouch CT-410/510/700 device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_PANJIT
         default y
-        bool "PanJit device support" if EMBEDDED
+        bool "PanJit device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_3M
         default y
-        bool "3M/Microtouch EX II series device support" if EMBEDDED
+        bool "3M/Microtouch EX II series device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_ITM
         default y
-        bool "ITM device support" if EMBEDDED
+        bool "ITM device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_ETURBO
         default y
-        bool "eTurboTouch (non-eGalax compatible) device support" if EMBEDDED
+        bool "eTurboTouch (non-eGalax compatible) device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_GUNZE
         default y
-        bool "Gunze AHL61 device support" if EMBEDDED
+        bool "Gunze AHL61 device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_DMC_TSC10
         default y
-        bool "DMC TSC-10/25 device support" if EMBEDDED
+        bool "DMC TSC-10/25 device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_IRTOUCH
         default y
-        bool "IRTOUCHSYSTEMS/UNITOP device support" if EMBEDDED
+        bool "IRTOUCHSYSTEMS/UNITOP device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_IDEALTEK
         default y
-        bool "IdealTEK URTC1000 device support" if EMBEDDED
+        bool "IdealTEK URTC1000 device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_GENERAL_TOUCH
         default y
-        bool "GeneralTouch Touchscreen device support" if EMBEDDED
+        bool "GeneralTouch Touchscreen device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_GOTOP
         default y
-        bool "GoTop Super_Q2/GogoPen/PenPower tablet device support" if EMBEDDED
+        bool "GoTop Super_Q2/GogoPen/PenPower tablet device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_JASTEC
         default y
-        bool "JASTEC/DigiTech DTR-02U USB touch controller device support" if EMBEDDED
+        bool "JASTEC/DigiTech DTR-02U USB touch controller device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_E2I
@@ -605,17 +605,17 @@ config TOUCHSCREEN_USB_E2I
 
 config TOUCHSCREEN_USB_ZYTRONIC
         default y
-        bool "Zytronic controller" if EMBEDDED
+        bool "Zytronic controller" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_ETT_TC45USB
         default y
-        bool "ET&T USB series TC4UM/TC5UH touchscreen controller support" if EMBEDDED
+        bool "ET&T USB series TC4UM/TC5UH touchscreen controller support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_USB_NEXIO
         default y
-        bool "NEXIO/iNexio device support" if EMBEDDED
+        bool "NEXIO/iNexio device support" if EXPERT
         depends on TOUCHSCREEN_USB_COMPOSITE
 
 config TOUCHSCREEN_TOUCHIT213
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index f7fa9ef4cd6..1507ce108d5 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -12,6 +12,7 @@
 #include <linux/input.h>
 #include <linux/input/bu21013.h>
 #include <linux/slab.h>
+#include <linux/regulator/consumer.h>
 
 #define PEN_DOWN_INTR   0
 #define MAX_FINGERS     2
@@ -139,6 +140,7 @@
  * @chip: pointer to the touch panel controller
  * @in_dev: pointer to the input device structure
  * @intr_pin: interrupt pin value
+ * @regulator: pointer to the Regulator used for touch screen
  *
  * Touch panel device data structure
  */
@@ -149,6 +151,7 @@ struct bu21013_ts_data {
         const struct bu21013_platform_device *chip;
         struct input_dev *in_dev;
         unsigned int intr_pin;
+        struct regulator *regulator;
 };
 
 /**
@@ -456,6 +459,20 @@ static int __devinit bu21013_probe(struct i2c_client *client,
         bu21013_data->in_dev = in_dev;
         bu21013_data->chip = pdata;
         bu21013_data->client = client;
+
+        bu21013_data->regulator = regulator_get(&client->dev, "V-TOUCH");
+        if (IS_ERR(bu21013_data->regulator)) {
+                dev_err(&client->dev, "regulator_get failed\n");
+                error = PTR_ERR(bu21013_data->regulator);
+                goto err_free_mem;
+        }
+
+        error = regulator_enable(bu21013_data->regulator);
+        if (error < 0) {
+                dev_err(&client->dev, "regulator enable failed\n");
+                goto err_put_regulator;
+        }
+
         bu21013_data->touch_stopped = false;
         init_waitqueue_head(&bu21013_data->wait);
 
@@ -464,7 +481,7 @@ static int __devinit bu21013_probe(struct i2c_client *client,
                 error = pdata->cs_en(pdata->cs_pin);
                 if (error < 0) {
                         dev_err(&client->dev, "chip init failed\n");
-                        goto err_free_mem;
+                        goto err_disable_regulator;
                 }
         }
 
@@ -485,9 +502,9 @@ static int __devinit bu21013_probe(struct i2c_client *client,
         __set_bit(EV_ABS, in_dev->evbit);
 
         input_set_abs_params(in_dev, ABS_MT_POSITION_X, 0,
-                                                pdata->x_max_res, 0, 0);
+                                                pdata->touch_x_max, 0, 0);
         input_set_abs_params(in_dev, ABS_MT_POSITION_Y, 0,
-                                                pdata->y_max_res, 0, 0);
+                                                pdata->touch_y_max, 0, 0);
         input_set_drvdata(in_dev, bu21013_data);
 
         error = request_threaded_irq(pdata->irq, NULL, bu21013_gpio_irq,
@@ -513,6 +530,10 @@ err_free_irq:
         bu21013_free_irq(bu21013_data);
 err_cs_disable:
         pdata->cs_dis(pdata->cs_pin);
+err_disable_regulator:
+        regulator_disable(bu21013_data->regulator);
+err_put_regulator:
+        regulator_put(bu21013_data->regulator);
 err_free_mem:
         input_free_device(in_dev);
         kfree(bu21013_data);
@@ -535,6 +556,10 @@ static int __devexit bu21013_remove(struct i2c_client *client)
         bu21013_data->chip->cs_dis(bu21013_data->chip->cs_pin);
 
         input_unregister_device(bu21013_data->in_dev);
+
+        regulator_disable(bu21013_data->regulator);
+        regulator_put(bu21013_data->regulator);
+
         kfree(bu21013_data);
 
         device_init_wakeup(&client->dev, false);
@@ -561,6 +586,8 @@ static int bu21013_suspend(struct device *dev)
         else
                 disable_irq(bu21013_data->chip->irq);
 
+        regulator_disable(bu21013_data->regulator);
+
         return 0;
 }
 
@@ -577,6 +604,12 @@ static int bu21013_resume(struct device *dev)
         struct i2c_client *client = bu21013_data->client;
         int retval;
 
+        retval = regulator_enable(bu21013_data->regulator);
+        if (retval < 0) {
+                dev_err(&client->dev, "bu21013 regulator enable failed\n");
+                return retval;
+        }
+
         retval = bu21013_init_chip(bu21013_data);
         if (retval < 0) {
                 dev_err(&client->dev, "bu21013 controller config failed\n");
diff --git a/drivers/input/touchscreen/tnetv107x-ts.c b/drivers/input/touchscreen/tnetv107x-ts.c
index cf1dba2e267..22a3411e93c 100644
--- a/drivers/input/touchscreen/tnetv107x-ts.c
+++ b/drivers/input/touchscreen/tnetv107x-ts.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/err.h>
 #include <linux/errno.h>
 #include <linux/input.h>
 #include <linux/platform_device.h>
@@ -289,9 +290,9 @@ static int __devinit tsc_probe(struct platform_device *pdev)
         }
 
         ts->clk = clk_get(dev, NULL);
-        if (!ts->clk) {
+        if (IS_ERR(ts->clk)) {
                 dev_err(dev, "cannot claim device clock\n");
-                error = -EINVAL;
+                error = PTR_ERR(ts->clk);
                 goto error_clk;
         }
 
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index f2b5bab5e6a..1f355bb85e5 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1627,7 +1627,7 @@ __setup("icn=", icn_setup);
 static int __init icn_init(void)
 {
         char *p;
-        char rev[20];
+        char rev[21];
 
         memset(&dev, 0, sizeof(icn_dev));
         dev.memaddr = (membase & 0x0ffc000);
@@ -1638,6 +1638,7 @@ static int __init icn_init(void)
 
         if ((p = strchr(revision, ':'))) {
                 strncpy(rev, p + 1, 20);
+                rev[20] = '\0';
                 p = strchr(rev, '$');
                 if (p)
                         *p = 0;
diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
index da3fa8dcdf5..666daf77872 100644
--- a/drivers/leds/leds-pwm.c
+++ b/drivers/leds/leds-pwm.c
@@ -69,6 +69,7 @@ static int led_pwm_probe(struct platform_device *pdev)
                 led_dat->pwm = pwm_request(cur_led->pwm_id,
                                 cur_led->name);
                 if (IS_ERR(led_dat->pwm)) {
+                        ret = PTR_ERR(led_dat->pwm);
                         dev_err(&pdev->dev, "unable to request PWM %d\n",
                                         cur_led->pwm_id);
                         goto err;
diff --git a/drivers/leds/ledtrig-gpio.c b/drivers/leds/ledtrig-gpio.c
index 991d93be0f4..ecc4bf3f37a 100644
--- a/drivers/leds/ledtrig-gpio.c
+++ b/drivers/leds/ledtrig-gpio.c
@@ -99,7 +99,7 @@ static ssize_t gpio_trig_inverted_show(struct device *dev,
         struct led_classdev *led = dev_get_drvdata(dev);
         struct gpio_trig_data *gpio_data = led->trigger_data;
 
-        return sprintf(buf, "%s\n", gpio_data->inverted ? "yes" : "no");
+        return sprintf(buf, "%u\n", gpio_data->inverted);
 }
 
 static ssize_t gpio_trig_inverted_store(struct device *dev,
@@ -107,16 +107,17 @@ static ssize_t gpio_trig_inverted_store(struct device *dev,
 {
         struct led_classdev *led = dev_get_drvdata(dev);
         struct gpio_trig_data *gpio_data = led->trigger_data;
-        unsigned inverted;
+        unsigned long inverted;
         int ret;
 
-        ret = sscanf(buf, "%u", &inverted);
-        if (ret < 1) {
-                dev_err(dev, "invalid value\n");
+        ret = strict_strtoul(buf, 10, &inverted);
+        if (ret < 0)
+                return ret;
+
+        if (inverted > 1)
                 return -EINVAL;
-        }
 
-        gpio_data->inverted = !!inverted;
+        gpio_data->inverted = inverted;
 
         /* After inverting, we need to update the LED. */
         schedule_work(&gpio_data->work);
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
index 04b22128a47..d21578ee95d 100644
--- a/drivers/lguest/page_tables.c
+++ b/drivers/lguest/page_tables.c
@@ -1137,7 +1137,7 @@ void free_guest_pagetable(struct lguest *lg)
  */
 void map_switcher_in_guest(struct lg_cpu *cpu, struct lguest_pages *pages)
 {
-        pte_t *switcher_pte_page = __get_cpu_var(switcher_pte_pages);
+        pte_t *switcher_pte_page = __this_cpu_read(switcher_pte_pages);
         pte_t regs_pte;
 
 #ifdef CONFIG_X86_PAE
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index b4eb675a807..9f1659c3d1f 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -90,8 +90,8 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
          * meanwhile).  If that's not the case, we pretend everything in the
          * Guest has changed.
          */
-        if (__get_cpu_var(lg_last_cpu) != cpu || cpu->last_pages != pages) {
-                __get_cpu_var(lg_last_cpu) = cpu;
+        if (__this_cpu_read(lg_last_cpu) != cpu || cpu->last_pages != pages) {
+                __this_cpu_write(lg_last_cpu, cpu);
                 cpu->last_pages = pages;
                 cpu->changed = CHANGED_ALL;
         }
diff --git a/drivers/macintosh/therm_pm72.c b/drivers/macintosh/therm_pm72.c
index 2e041fd0a00..f3a29f264db 100644
--- a/drivers/macintosh/therm_pm72.c
+++ b/drivers/macintosh/therm_pm72.c
@@ -443,7 +443,7 @@ static int fan_read_reg(int reg, unsigned char *buf, int nb)
         tries = 0;
         for (;;) {
                 nr = i2c_master_recv(fcu, buf, nb);
-                if (nr > 0 || (nr < 0 && nr != ENODEV) || tries >= 100)
+                if (nr > 0 || (nr < 0 && nr != -ENODEV) || tries >= 100)
                         break;
                 msleep(10);
                 ++tries;
@@ -464,7 +464,7 @@ static int fan_write_reg(int reg, const unsigned char *ptr, int nb)
         tries = 0;
         for (;;) {
                 nw = i2c_master_send(fcu, buf, nb);
-                if (nw > 0 || (nw < 0 && nw != EIO) || tries >= 100)
+                if (nw > 0 || (nw < 0 && nw != -EIO) || tries >= 100)
                         break;
                 msleep(10);
                 ++tries;
diff --git a/drivers/media/common/saa7146_core.c b/drivers/media/common/saa7146_core.c
index 982f000a57f..9f47e383c57 100644
--- a/drivers/media/common/saa7146_core.c
+++ b/drivers/media/common/saa7146_core.c
@@ -452,7 +452,7 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
         INFO(("found saa7146 @ mem %p (revision %d, irq %d) (0x%04x,0x%04x).\n", dev->mem, dev->revision, pci->irq, pci->subsystem_vendor, pci->subsystem_device));
         dev->ext = ext;
 
-        mutex_init(&dev->lock);
+        mutex_init(&dev->v4l2_lock);
         spin_lock_init(&dev->int_slock);
         spin_lock_init(&dev->slock);
 
diff --git a/drivers/media/common/saa7146_fops.c b/drivers/media/common/saa7146_fops.c
index e3fedc60fe7..1bd3dd762c6 100644
--- a/drivers/media/common/saa7146_fops.c
+++ b/drivers/media/common/saa7146_fops.c
@@ -15,18 +15,15 @@ int saa7146_res_get(struct saa7146_fh *fh, unsigned int bit)
         }
 
         /* is it free? */
-        mutex_lock(&dev->lock);
         if (vv->resources & bit) {
                 DEB_D(("locked! vv->resources:0x%02x, we want:0x%02x\n",vv->resources,bit));
                 /* no, someone else uses it */
-                mutex_unlock(&dev->lock);
                 return 0;
         }
         /* it's free, grab it */
         fh->resources  |= bit;
         vv->resources |= bit;
         DEB_D(("res: get 0x%02x, cur:0x%02x\n",bit,vv->resources));
-        mutex_unlock(&dev->lock);
         return 1;
 }
 
@@ -37,11 +34,9 @@ void saa7146_res_free(struct saa7146_fh *fh, unsigned int bits)
 
         BUG_ON((fh->resources & bits) != bits);
 
-        mutex_lock(&dev->lock);
         fh->resources  &= ~bits;
         vv->resources &= ~bits;
         DEB_D(("res: put 0x%02x, cur:0x%02x\n",bits,vv->resources));
-        mutex_unlock(&dev->lock);
 }
 
 
@@ -396,7 +391,7 @@ static const struct v4l2_file_operations video_fops =
         .write          = fops_write,
         .poll           = fops_poll,
         .mmap           = fops_mmap,
-        .ioctl          = video_ioctl2,
+        .unlocked_ioctl = video_ioctl2,
 };
 
 static void vv_callback(struct saa7146_dev *dev, unsigned long status)
@@ -505,6 +500,7 @@ int saa7146_register_device(struct video_device **vid, struct saa7146_dev* dev,
         vfd->fops = &video_fops;
         vfd->ioctl_ops = &dev->ext_vv_data->ops;
         vfd->release = video_device_release;
+        vfd->lock = &dev->v4l2_lock;
         vfd->tvnorms = 0;
         for (i = 0; i < dev->ext_vv_data->num_stds; i++)
                 vfd->tvnorms |= dev->ext_vv_data->stds[i].id;
diff --git a/drivers/media/common/saa7146_vbi.c b/drivers/media/common/saa7146_vbi.c
index 2d4533ab22b..afe85801d6c 100644
--- a/drivers/media/common/saa7146_vbi.c
+++ b/drivers/media/common/saa7146_vbi.c
@@ -412,7 +412,7 @@ static int vbi_open(struct saa7146_dev *dev, struct file *file)
                             V4L2_BUF_TYPE_VBI_CAPTURE,
                             V4L2_FIELD_SEQ_TB, // FIXME: does this really work?
                             sizeof(struct saa7146_buf),
-                            file, NULL);
+                            file, &dev->v4l2_lock);
 
         init_timer(&fh->vbi_read_timeout);
         fh->vbi_read_timeout.function = vbi_read_timeout;
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index 0ac5c619aec..9aafa4e969a 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -553,8 +553,6 @@ static int vidioc_s_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *f
                 }
         }
 
-        mutex_lock(&dev->lock);
-
         /* ok, accept it */
         vv->ov_fb = *fb;
         vv->ov_fmt = fmt;
@@ -563,8 +561,6 @@ static int vidioc_s_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *f
                 vv->ov_fb.fmt.bytesperline = vv->ov_fb.fmt.width * fmt->depth / 8;
                 DEB_D(("setting bytesperline to %d\n", vv->ov_fb.fmt.bytesperline));
         }
-
-        mutex_unlock(&dev->lock);
         return 0;
 }
 
@@ -649,8 +645,6 @@ static int vidioc_s_ctrl(struct file *file, void *fh, struct v4l2_control *c)
                 return -EINVAL;
         }
 
-        mutex_lock(&dev->lock);
-
         switch (ctrl->type) {
         case V4L2_CTRL_TYPE_BOOLEAN:
         case V4L2_CTRL_TYPE_MENU:
@@ -693,7 +687,6 @@ static int vidioc_s_ctrl(struct file *file, void *fh, struct v4l2_control *c)
                 /* fixme: we can support changing VFLIP and HFLIP here... */
                 if (IS_CAPTURE_ACTIVE(fh) != 0) {
                         DEB_D(("V4L2_CID_HFLIP while active capture.\n"));
-                        mutex_unlock(&dev->lock);
                         return -EBUSY;
                 }
                 vv->hflip = c->value;
@@ -701,16 +694,13 @@ static int vidioc_s_ctrl(struct file *file, void *fh, struct v4l2_control *c)
         case V4L2_CID_VFLIP:
                 if (IS_CAPTURE_ACTIVE(fh) != 0) {
                         DEB_D(("V4L2_CID_VFLIP while active capture.\n"));
-                        mutex_unlock(&dev->lock);
                         return -EBUSY;
                 }
                 vv->vflip = c->value;
                 break;
         default:
-                mutex_unlock(&dev->lock);
                 return -EINVAL;
         }
-        mutex_unlock(&dev->lock);
 
         if (IS_OVERLAY_ACTIVE(fh) != 0) {
                 saa7146_stop_preview(fh);
@@ -902,22 +892,18 @@ static int vidioc_s_fmt_vid_overlay(struct file *file, void *__fh, struct v4l2_f
         err = vidioc_try_fmt_vid_overlay(file, fh, f);
         if (0 != err)
                 return err;
-        mutex_lock(&dev->lock);
         fh->ov.win    = f->fmt.win;
         fh->ov.nclips = f->fmt.win.clipcount;
         if (fh->ov.nclips > 16)
                 fh->ov.nclips = 16;
         if (copy_from_user(fh->ov.clips, f->fmt.win.clips,
                                 sizeof(struct v4l2_clip) * fh->ov.nclips)) {
-                mutex_unlock(&dev->lock);
                 return -EFAULT;
         }
 
         /* fh->ov.fh is used to indicate that we have valid overlay informations, too */
         fh->ov.fh = fh;
 
-        mutex_unlock(&dev->lock);
-
         /* check if our current overlay is active */
         if (IS_OVERLAY_ACTIVE(fh) != 0) {
                 saa7146_stop_preview(fh);
@@ -976,8 +962,6 @@ static int vidioc_s_std(struct file *file, void *fh, v4l2_std_id *id)
                 }
         }
 
-        mutex_lock(&dev->lock);
-
         for (i = 0; i < dev->ext_vv_data->num_stds; i++)
                 if (*id & dev->ext_vv_data->stds[i].id)
                         break;
@@ -988,8 +972,6 @@ static int vidioc_s_std(struct file *file, void *fh, v4l2_std_id *id)
                 found = 1;
         }
 
-        mutex_unlock(&dev->lock);
-
         if (vv->ov_suspend != NULL) {
                 saa7146_start_preview(vv->ov_suspend);
                 vv->ov_suspend = NULL;
@@ -1354,7 +1336,7 @@ static int video_open(struct saa7146_dev *dev, struct file *file)
                             V4L2_BUF_TYPE_VIDEO_CAPTURE,
                             V4L2_FIELD_INTERLACED,
                             sizeof(struct saa7146_buf),
-                            file, NULL);
+                            file, &dev->v4l2_lock);
 
         return 0;
 }
diff --git a/drivers/media/common/tuners/Kconfig b/drivers/media/common/tuners/Kconfig
index 78b089526e0..6fc79f15dcb 100644
--- a/drivers/media/common/tuners/Kconfig
+++ b/drivers/media/common/tuners/Kconfig
@@ -34,7 +34,7 @@ config MEDIA_TUNER
 config MEDIA_TUNER_CUSTOMISE
         bool "Customize analog and hybrid tuner modules to build"
         depends on MEDIA_TUNER
-        default y if EMBEDDED
+        default y if EXPERT
         help
           This allows the user to deselect tuner drivers unnecessary
           for their hardware from the build. Use this option with care
diff --git a/drivers/media/common/tuners/tda8290.c b/drivers/media/common/tuners/tda8290.c
index c9062ceddc7..bc6a67768af 100644
--- a/drivers/media/common/tuners/tda8290.c
+++ b/drivers/media/common/tuners/tda8290.c
@@ -95,8 +95,7 @@ static int tda8295_i2c_bridge(struct dvb_frontend *fe, int close)
                 msleep(20);
         } else {
                 msg = disable;
-                tuner_i2c_xfer_send(&priv->i2c_props, msg, 1);
-                tuner_i2c_xfer_recv(&priv->i2c_props, &msg[1], 1);
+                tuner_i2c_xfer_send_recv(&priv->i2c_props, msg, 1, &msg[1], 1);
 
                 buf[2] = msg[1];
                 buf[2] &= ~0x04;
@@ -233,19 +232,22 @@ static void tda8290_set_params(struct dvb_frontend *fe,
                 tuner_i2c_xfer_send(&priv->i2c_props, pll_bw_nom, 2);
         }
 
+
         tda8290_i2c_bridge(fe, 1);
 
         if (fe->ops.tuner_ops.set_analog_params)
                 fe->ops.tuner_ops.set_analog_params(fe, params);
 
         for (i = 0; i < 3; i++) {
-                tuner_i2c_xfer_send(&priv->i2c_props, &addr_pll_stat, 1);
-                tuner_i2c_xfer_recv(&priv->i2c_props, &pll_stat, 1);
+                tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                         &addr_pll_stat, 1, &pll_stat, 1);
                 if (pll_stat & 0x80) {
-                        tuner_i2c_xfer_send(&priv->i2c_props, &addr_adc_sat, 1);
-                        tuner_i2c_xfer_recv(&priv->i2c_props, &adc_sat, 1);
-                        tuner_i2c_xfer_send(&priv->i2c_props, &addr_agc_stat, 1);
-                        tuner_i2c_xfer_recv(&priv->i2c_props, &agc_stat, 1);
+                        tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                                 &addr_adc_sat, 1,
+                                                 &adc_sat, 1);
+                        tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                                 &addr_agc_stat, 1,
+                                                 &agc_stat, 1);
                         tuner_dbg("tda8290 is locked, AGC: %d\n", agc_stat);
                         break;
                 } else {
@@ -259,20 +261,22 @@ static void tda8290_set_params(struct dvb_frontend *fe,
                            agc_stat, adc_sat, pll_stat & 0x80);
                 tuner_i2c_xfer_send(&priv->i2c_props, gainset_2, 2);
                 msleep(100);
-                tuner_i2c_xfer_send(&priv->i2c_props, &addr_agc_stat, 1);
-                tuner_i2c_xfer_recv(&priv->i2c_props, &agc_stat, 1);
-                tuner_i2c_xfer_send(&priv->i2c_props, &addr_pll_stat, 1);
-                tuner_i2c_xfer_recv(&priv->i2c_props, &pll_stat, 1);
+                tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                         &addr_agc_stat, 1, &agc_stat, 1);
+                tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                         &addr_pll_stat, 1, &pll_stat, 1);
                 if ((agc_stat > 115) || !(pll_stat & 0x80)) {
                         tuner_dbg("adjust gain, step 2. Agc: %d, lock: %d\n",
                                    agc_stat, pll_stat & 0x80);
                         if (priv->cfg.agcf)
                                 priv->cfg.agcf(fe);
                         msleep(100);
-                        tuner_i2c_xfer_send(&priv->i2c_props, &addr_agc_stat, 1);
-                        tuner_i2c_xfer_recv(&priv->i2c_props, &agc_stat, 1);
-                        tuner_i2c_xfer_send(&priv->i2c_props, &addr_pll_stat, 1);
-                        tuner_i2c_xfer_recv(&priv->i2c_props, &pll_stat, 1);
+                        tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                                 &addr_agc_stat, 1,
+                                                 &agc_stat, 1);
+                        tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                                 &addr_pll_stat, 1,
+                                                 &pll_stat, 1);
                         if((agc_stat > 115) || !(pll_stat & 0x80)) {
                                 tuner_dbg("adjust gain, step 3. Agc: %d\n", agc_stat);
                                 tuner_i2c_xfer_send(&priv->i2c_props, adc_head_12, 2);
@@ -284,10 +288,12 @@ static void tda8290_set_params(struct dvb_frontend *fe,
 
         /* l/ l' deadlock? */
         if(priv->tda8290_easy_mode & 0x60) {
-                tuner_i2c_xfer_send(&priv->i2c_props, &addr_adc_sat, 1);
-                tuner_i2c_xfer_recv(&priv->i2c_props, &adc_sat, 1);
-                tuner_i2c_xfer_send(&priv->i2c_props, &addr_pll_stat, 1);
-                tuner_i2c_xfer_recv(&priv->i2c_props, &pll_stat, 1);
+                tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                         &addr_adc_sat, 1,
+                                         &adc_sat, 1);
+                tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                         &addr_pll_stat, 1,
+                                         &pll_stat, 1);
                 if ((adc_sat > 20) || !(pll_stat & 0x80)) {
                         tuner_dbg("trying to resolve SECAM L deadlock\n");
                         tuner_i2c_xfer_send(&priv->i2c_props, agc_rst_on, 2);
@@ -307,8 +313,7 @@ static void tda8295_power(struct dvb_frontend *fe, int enable)
         struct tda8290_priv *priv = fe->analog_demod_priv;
         unsigned char buf[] = { 0x30, 0x00 }; /* clb_stdbt */
 
-        tuner_i2c_xfer_send(&priv->i2c_props, &buf[0], 1);
-        tuner_i2c_xfer_recv(&priv->i2c_props, &buf[1], 1);
+        tuner_i2c_xfer_send_recv(&priv->i2c_props, &buf[0], 1, &buf[1], 1);
 
         if (enable)
                 buf[1] = 0x01;
@@ -323,8 +328,7 @@ static void tda8295_set_easy_mode(struct dvb_frontend *fe, int enable)
         struct tda8290_priv *priv = fe->analog_demod_priv;
         unsigned char buf[] = { 0x01, 0x00 };
 
-        tuner_i2c_xfer_send(&priv->i2c_props, &buf[0], 1);
-        tuner_i2c_xfer_recv(&priv->i2c_props, &buf[1], 1);
+        tuner_i2c_xfer_send_recv(&priv->i2c_props, &buf[0], 1, &buf[1], 1);
 
         if (enable)
                 buf[1] = 0x01; /* rising edge sets regs 0x02 - 0x23 */
@@ -353,8 +357,7 @@ static void tda8295_agc1_out(struct dvb_frontend *fe, int enable)
         struct tda8290_priv *priv = fe->analog_demod_priv;
         unsigned char buf[] = { 0x02, 0x00 }; /* DIV_FUNC */
 
-        tuner_i2c_xfer_send(&priv->i2c_props, &buf[0], 1);
-        tuner_i2c_xfer_recv(&priv->i2c_props, &buf[1], 1);
+        tuner_i2c_xfer_send_recv(&priv->i2c_props, &buf[0], 1, &buf[1], 1);
 
         if (enable)
                 buf[1] &= ~0x40;
@@ -370,10 +373,10 @@ static void tda8295_agc2_out(struct dvb_frontend *fe, int enable)
         unsigned char set_gpio_cf[]    = { 0x44, 0x00 };
         unsigned char set_gpio_val[]   = { 0x46, 0x00 };
 
-        tuner_i2c_xfer_send(&priv->i2c_props, &set_gpio_cf[0], 1);
-        tuner_i2c_xfer_recv(&priv->i2c_props, &set_gpio_cf[1], 1);
-        tuner_i2c_xfer_send(&priv->i2c_props, &set_gpio_val[0], 1);
-        tuner_i2c_xfer_recv(&priv->i2c_props, &set_gpio_val[1], 1);
+        tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                 &set_gpio_cf[0], 1, &set_gpio_cf[1], 1);
+        tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                 &set_gpio_val[0], 1, &set_gpio_val[1], 1);
 
         set_gpio_cf[1] &= 0xf0; /* clear GPIO_0 bits 3-0 */
 
@@ -392,8 +395,7 @@ static int tda8295_has_signal(struct dvb_frontend *fe)
         unsigned char hvpll_stat = 0x26;
         unsigned char ret;
 
-        tuner_i2c_xfer_send(&priv->i2c_props, &hvpll_stat, 1);
-        tuner_i2c_xfer_recv(&priv->i2c_props, &ret, 1);
+        tuner_i2c_xfer_send_recv(&priv->i2c_props, &hvpll_stat, 1, &ret, 1);
         return (ret & 0x01) ? 65535 : 0;
 }
 
@@ -413,8 +415,8 @@ static void tda8295_set_params(struct dvb_frontend *fe,
         tda8295_power(fe, 1);
         tda8295_agc1_out(fe, 1);
 
-        tuner_i2c_xfer_send(&priv->i2c_props, &blanking_mode[0], 1);
-        tuner_i2c_xfer_recv(&priv->i2c_props, &blanking_mode[1], 1);
+        tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                 &blanking_mode[0], 1, &blanking_mode[1], 1);
 
         tda8295_set_video_std(fe);
 
@@ -447,8 +449,8 @@ static int tda8290_has_signal(struct dvb_frontend *fe)
         unsigned char i2c_get_afc[1] = { 0x1B };
         unsigned char afc = 0;
 
-        tuner_i2c_xfer_send(&priv->i2c_props, i2c_get_afc, ARRAY_SIZE(i2c_get_afc));
-        tuner_i2c_xfer_recv(&priv->i2c_props, &afc, 1);
+        tuner_i2c_xfer_send_recv(&priv->i2c_props,
+                                 i2c_get_afc, ARRAY_SIZE(i2c_get_afc), &afc, 1);
         return (afc & 0x80)? 65535:0;
 }
 
@@ -654,20 +656,26 @@ static int tda829x_find_tuner(struct dvb_frontend *fe)
 static int tda8290_probe(struct tuner_i2c_props *i2c_props)
 {
 #define TDA8290_ID 0x89
-        unsigned char tda8290_id[] = { 0x1f, 0x00 };
+        u8 reg = 0x1f, id;
+        struct i2c_msg msg_read[] = {
+                { .addr = 0x4b, .flags = 0, .len = 1, .buf = &reg },
+                { .addr = 0x4b, .flags = I2C_M_RD, .len = 1, .buf = &id },
+        };
 
         /* detect tda8290 */
-        tuner_i2c_xfer_send(i2c_props, &tda8290_id[0], 1);
-        tuner_i2c_xfer_recv(i2c_props, &tda8290_id[1], 1);
+        if (i2c_transfer(i2c_props->adap, msg_read, 2) != 2) {
+                printk(KERN_WARNING "%s: tda8290 couldn't read register 0x%02x\n",
+                               __func__, reg);
+                return -ENODEV;
+        }
 
-        if (tda8290_id[1] == TDA8290_ID) {
+        if (id == TDA8290_ID) {
                 if (debug)
                         printk(KERN_DEBUG "%s: tda8290 detected @ %d-%04x\n",
                                __func__, i2c_adapter_id(i2c_props->adap),
                                i2c_props->addr);
                 return 0;
         }
-
         return -ENODEV;
 }
 
@@ -675,16 +683,23 @@ static int tda8295_probe(struct tuner_i2c_props *i2c_props)
 {
 #define TDA8295_ID 0x8a
 #define TDA8295C2_ID 0x8b
-        unsigned char tda8295_id[] = { 0x2f, 0x00 };
+        u8 reg = 0x2f, id;
+        struct i2c_msg msg_read[] = {
+                { .addr = 0x4b, .flags = 0, .len = 1, .buf = &reg },
+                { .addr = 0x4b, .flags = I2C_M_RD, .len = 1, .buf = &id },
+        };
 
-        /* detect tda8295 */
-        tuner_i2c_xfer_send(i2c_props, &tda8295_id[0], 1);
-        tuner_i2c_xfer_recv(i2c_props, &tda8295_id[1], 1);
+        /* detect tda8290 */
+        if (i2c_transfer(i2c_props->adap, msg_read, 2) != 2) {
+                printk(KERN_WARNING "%s: tda8290 couldn't read register 0x%02x\n",
+                               __func__, reg);
+                return -ENODEV;
+        }
 
-        if ((tda8295_id[1] & 0xfe) == TDA8295_ID) {
+        if ((id & 0xfe) == TDA8295_ID) {
                 if (debug)
                         printk(KERN_DEBUG "%s: %s detected @ %d-%04x\n",
-                               __func__, (tda8295_id[1] == TDA8295_ID) ?
+                               __func__, (id == TDA8295_ID) ?
                                "tda8295c1" : "tda8295c2",
                                i2c_adapter_id(i2c_props->adap),
                                i2c_props->addr);
@@ -740,9 +755,11 @@ struct dvb_frontend *tda829x_attach(struct dvb_frontend *fe,
                        sizeof(struct analog_demod_ops));
         }
 
-        if ((!(cfg) || (TDA829X_PROBE_TUNER == cfg->probe_tuner)) &&
-            (tda829x_find_tuner(fe) < 0))
-                goto fail;
+        if (!(cfg) || (TDA829X_PROBE_TUNER == cfg->probe_tuner)) {
+                tda8295_power(fe, 1);
+                if (tda829x_find_tuner(fe) < 0)
+                        goto fail;
+        }
 
         switch (priv->ver) {
         case TDA8290:
@@ -786,6 +803,8 @@ struct dvb_frontend *tda829x_attach(struct dvb_frontend *fe,
         return fe;
 
 fail:
+        memset(&fe->ops.analog_ops, 0, sizeof(struct analog_demod_ops));
+
         tda829x_release(fe);
         return NULL;
 }
@@ -809,8 +828,8 @@ int tda829x_probe(struct i2c_adapter *i2c_adap, u8 i2c_addr)
         int i;
 
         /* rule out tda9887, which would return the same byte repeatedly */
-        tuner_i2c_xfer_send(&i2c_props, soft_reset, 1);
-        tuner_i2c_xfer_recv(&i2c_props, buf, PROBE_BUFFER_SIZE);
+        tuner_i2c_xfer_send_recv(&i2c_props,
+                                 soft_reset, 1, buf, PROBE_BUFFER_SIZE);
         for (i = 1; i < PROBE_BUFFER_SIZE; i++) {
                 if (buf[i] != buf[0])
                         break;
@@ -827,13 +846,12 @@ int tda829x_probe(struct i2c_adapter *i2c_adap, u8 i2c_addr)
         /* fall back to old probing method */
         tuner_i2c_xfer_send(&i2c_props, easy_mode_b, 2);
         tuner_i2c_xfer_send(&i2c_props, soft_reset, 2);
-        tuner_i2c_xfer_send(&i2c_props, &addr_dto_lsb, 1);
-        tuner_i2c_xfer_recv(&i2c_props, &data, 1);
+        tuner_i2c_xfer_send_recv(&i2c_props, &addr_dto_lsb, 1, &data, 1);
         if (data == 0) {
                 tuner_i2c_xfer_send(&i2c_props, easy_mode_g, 2);
                 tuner_i2c_xfer_send(&i2c_props, soft_reset, 2);
-                tuner_i2c_xfer_send(&i2c_props, &addr_dto_lsb, 1);
-                tuner_i2c_xfer_recv(&i2c_props, &data, 1);
+                tuner_i2c_xfer_send_recv(&i2c_props,
+                                         &addr_dto_lsb, 1, &data, 1);
                 if (data == 0x7b) {
                         return 0;
                 }
diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
index 8ca48f76dfa..98ffb40728e 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
@@ -514,8 +514,8 @@ struct dib0700_rc_response {
         union {
                 u16 system16;
                 struct {
-                        u8 system;
                         u8 not_system;
+                        u8 system;
                 };
         };
         u8 data;
@@ -575,7 +575,7 @@ static void dib0700_rc_urb_completion(struct urb *purb)
                 if ((poll_reply->system ^ poll_reply->not_system) != 0xff) {
                         deb_data("NEC extended protocol\n");
                         /* NEC extended code - 24 bits */
-                        keycode = poll_reply->system16 << 8 | poll_reply->data;
+                        keycode = be16_to_cpu(poll_reply->system16) << 8 | poll_reply->data;
                 } else {
                         deb_data("NEC normal protocol\n");
                         /* normal NEC code - 16 bits */
@@ -587,7 +587,7 @@ static void dib0700_rc_urb_completion(struct urb *purb)
                 deb_data("RC5 protocol\n");
                 /* RC5 Protocol */
                 toggle = poll_reply->report_id;
-                keycode = poll_reply->system16 << 8 | poll_reply->data;
+                keycode = poll_reply->system << 8 | poll_reply->data;
 
                 break;
         }
diff --git a/drivers/media/dvb/firewire/firedtv-rc.c b/drivers/media/dvb/firewire/firedtv-rc.c
index fcf3828472b..f82d4a93feb 100644
--- a/drivers/media/dvb/firewire/firedtv-rc.c
+++ b/drivers/media/dvb/firewire/firedtv-rc.c
@@ -172,7 +172,8 @@ void fdtv_unregister_rc(struct firedtv *fdtv)
 
 void fdtv_handle_rc(struct firedtv *fdtv, unsigned int code)
 {
-        u16 *keycode = fdtv->remote_ctrl_dev->keycode;
+        struct input_dev *idev = fdtv->remote_ctrl_dev;
+        u16 *keycode = idev->keycode;
 
         if (code >= 0x0300 && code <= 0x031f)
                 code = keycode[code - 0x0300];
@@ -188,6 +189,8 @@ void fdtv_handle_rc(struct firedtv *fdtv, unsigned int code)
                 return;
         }
 
-        input_report_key(fdtv->remote_ctrl_dev, code, 1);
-        input_report_key(fdtv->remote_ctrl_dev, code, 0);
+        input_report_key(idev, code, 1);
+        input_sync(idev);
+        input_report_key(idev, code, 0);
+        input_sync(idev);
 }
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index ef3e43a0319..b8519ba511e 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -1,7 +1,7 @@
 config DVB_FE_CUSTOMISE
         bool "Customise the frontend modules to build"
         depends on DVB_CORE
-        default y if EMBEDDED
+        default y if EXPERT
         help
           This allows the user to select/deselect frontend drivers for their
           hardware from the build.
diff --git a/drivers/media/dvb/frontends/af9013.c b/drivers/media/dvb/frontends/af9013.c
index ce222055526..ba25fa0b0fc 100644
--- a/drivers/media/dvb/frontends/af9013.c
+++ b/drivers/media/dvb/frontends/af9013.c
@@ -334,11 +334,11 @@ static int af9013_set_freq_ctrl(struct af9013_state *state, fe_bandwidth_t bw)
                                 if_sample_freq = 3300000; /* 3.3 MHz */
                                 break;
                         case BANDWIDTH_7_MHZ:
-                                if_sample_freq = 3800000; /* 3.8 MHz */
+                                if_sample_freq = 3500000; /* 3.5 MHz */
                                 break;
                         case BANDWIDTH_8_MHZ:
                         default:
-                                if_sample_freq = 4300000; /* 4.3 MHz */
+                                if_sample_freq = 4000000; /* 4.0 MHz */
                                 break;
                         }
                 } else if (state->config.tuner == AF9013_TUNER_TDA18218) {
diff --git a/drivers/media/dvb/frontends/ix2505v.c b/drivers/media/dvb/frontends/ix2505v.c
index 6360c681ded..6c2e929bd79 100644
--- a/drivers/media/dvb/frontends/ix2505v.c
+++ b/drivers/media/dvb/frontends/ix2505v.c
@@ -311,7 +311,7 @@ struct dvb_frontend *ix2505v_attach(struct dvb_frontend *fe,
         return fe;
 
 error:
-        ix2505v_release(fe);
+        kfree(state);
         return NULL;
 }
 EXPORT_SYMBOL(ix2505v_attach);
diff --git a/drivers/media/dvb/frontends/mb86a20s.c b/drivers/media/dvb/frontends/mb86a20s.c
index d3ad3e75a35..cc4acd2f920 100644
--- a/drivers/media/dvb/frontends/mb86a20s.c
+++ b/drivers/media/dvb/frontends/mb86a20s.c
@@ -43,6 +43,8 @@ struct mb86a20s_state {
         const struct mb86a20s_config *config;
 
         struct dvb_frontend frontend;
+
+        bool need_init;
 };
 
 struct regdata {
@@ -318,7 +320,7 @@ static int mb86a20s_i2c_writereg(struct mb86a20s_state *state,
 
         rc = i2c_transfer(state->i2c, &msg, 1);
         if (rc != 1) {
-                printk("%s: writereg rcor(rc == %i, reg == 0x%02x,"
+                printk("%s: writereg error (rc == %i, reg == 0x%02x,"
                          " data == 0x%02x)\n", __func__, rc, reg, data);
                 return rc;
         }
@@ -353,7 +355,7 @@ static int mb86a20s_i2c_readreg(struct mb86a20s_state *state,
         rc = i2c_transfer(state->i2c, msg, 2);
 
         if (rc != 2) {
-                rc("%s: reg=0x%x (rcor=%d)\n", __func__, reg, rc);
+                rc("%s: reg=0x%x (error=%d)\n", __func__, reg, rc);
                 return rc;
         }
 
@@ -382,23 +384,31 @@ static int mb86a20s_initfe(struct dvb_frontend *fe)
         /* Initialize the frontend */
         rc = mb86a20s_writeregdata(state, mb86a20s_init);
         if (rc < 0)
-                return rc;
+                goto err;
 
         if (!state->config->is_serial) {
                 regD5 &= ~1;
 
                 rc = mb86a20s_writereg(state, 0x50, 0xd5);
                 if (rc < 0)
-                        return rc;
+                        goto err;
                 rc = mb86a20s_writereg(state, 0x51, regD5);
                 if (rc < 0)
-                        return rc;
+                        goto err;
         }
 
         if (fe->ops.i2c_gate_ctrl)
                 fe->ops.i2c_gate_ctrl(fe, 1);
 
-        return 0;
+err:
+        if (rc < 0) {
+                state->need_init = true;
+                printk(KERN_INFO "mb86a20s: Init failed. Will try again later\n");
+        } else {
+                state->need_init = false;
+                dprintk("Initialization succeded.\n");
+        }
+        return rc;
 }
 
 static int mb86a20s_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
@@ -485,8 +495,22 @@ static int mb86a20s_set_frontend(struct dvb_frontend *fe,
 
         if (fe->ops.i2c_gate_ctrl)
                 fe->ops.i2c_gate_ctrl(fe, 1);
+        dprintk("Calling tuner set parameters\n");
         fe->ops.tuner_ops.set_params(fe, p);
 
+        /*
+         * Make it more reliable: if, for some reason, the initial
+         * device initialization doesn't happen, initialize it when
+         * a SBTVD parameters are adjusted.
+         *
+         * Unfortunately, due to a hard to track bug at tda829x/tda18271,
+         * the agc callback logic is not called during DVB attach time,
+         * causing mb86a20s to not be initialized with Kworld SBTVD.
+         * So, this hack is needed, in order to make Kworld SBTVD to work.
+         */
+        if (state->need_init)
+                mb86a20s_initfe(fe);
+
         if (fe->ops.i2c_gate_ctrl)
                 fe->ops.i2c_gate_ctrl(fe, 0);
         rc = mb86a20s_writeregdata(state, mb86a20s_reset_reception);
diff --git a/drivers/media/dvb/ttpci/av7110_ca.c b/drivers/media/dvb/ttpci/av7110_ca.c
index 122c7280691..9fc1dd0ba4c 100644
--- a/drivers/media/dvb/ttpci/av7110_ca.c
+++ b/drivers/media/dvb/ttpci/av7110_ca.c
@@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg)
         {
                 ca_slot_info_t *info=(ca_slot_info_t *)parg;
 
-                if (info->num > 1)
+                if (info->num < 0 || info->num > 1)
                         return -EINVAL;
                 av7110->ci_slot[info->num].num = info->num;
                 av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index 3c5a4739ed7..ecdffa6aac6 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -151,20 +151,6 @@ config RADIO_GEMTEK_PROBE
           following ports will be probed: 0x20c, 0x30c, 0x24c, 0x34c, 0x248 and
           0x28c.
 
-config RADIO_GEMTEK_PCI
-        tristate "GemTek PCI Radio Card support"
-        depends on VIDEO_V4L2 && PCI
-        ---help---
-          Choose Y here if you have this PCI FM radio card.
-
-          In order to control your radio card, you will need to use programs
-          that are compatible with the Video for Linux API.  Information on
-          this API and pointers to "v4l" programs may be found at
-          <file:Documentation/video4linux/API.html>.
-
-          To compile this driver as a module, choose M here: the
-          module will be called radio-gemtek-pci.
-
 config RADIO_MAXIRADIO
         tristate "Guillemot MAXI Radio FM 2000 radio"
         depends on VIDEO_V4L2 && PCI
diff --git a/drivers/media/radio/Makefile b/drivers/media/radio/Makefile
index d2970748a69..717656d2f74 100644
--- a/drivers/media/radio/Makefile
+++ b/drivers/media/radio/Makefile
@@ -13,7 +13,6 @@ obj-$(CONFIG_RADIO_MAXIRADIO) += radio-maxiradio.o
 obj-$(CONFIG_RADIO_RTRACK) += radio-aimslab.o
 obj-$(CONFIG_RADIO_ZOLTRIX) += radio-zoltrix.o
 obj-$(CONFIG_RADIO_GEMTEK) += radio-gemtek.o
-obj-$(CONFIG_RADIO_GEMTEK_PCI) += radio-gemtek-pci.o
 obj-$(CONFIG_RADIO_TRUST) += radio-trust.o
 obj-$(CONFIG_I2C_SI4713) += si4713-i2c.o
 obj-$(CONFIG_RADIO_SI4713) += radio-si4713.o
diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
index 6cc5d130fbc..4ce10dbeadd 100644
--- a/drivers/media/radio/radio-aimslab.c
+++ b/drivers/media/radio/radio-aimslab.c
@@ -31,6 +31,7 @@
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
 #include <linux/ioport.h>       /* request_region               */
+#include <linux/delay.h>        /* msleep                       */
 #include <linux/videodev2.h>    /* kernel radio structs         */
 #include <linux/version.h>      /* for KERNEL_VERSION MACRO     */
 #include <linux/io.h>           /* outb, outb_p                 */
diff --git a/drivers/media/radio/radio-gemtek-pci.c b/drivers/media/radio/radio-gemtek-pci.c
deleted file mode 100644
index 28fa85ba208..00000000000
--- a/drivers/media/radio/radio-gemtek-pci.c
+++ /dev/null
@@ -1,478 +0,0 @@
-/*
- ***************************************************************************
- *
- *     radio-gemtek-pci.c - Gemtek PCI Radio driver
- *     (C) 2001 Vladimir Shebordaev <vshebordaev@mail.ru>
- *
- ***************************************************************************
- *
- *     This program is free software; you can redistribute it and/or
- *     modify it under the terms of the GNU General Public License as
- *     published by the Free Software Foundation; either version 2 of
- *     the License, or (at your option) any later version.
- *
- *     This program is distributed in the hope that it will be useful,
- *     but WITHOUT ANY WARRANTY; without even the implied warranty of
- *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *     GNU General Public License for more details.
- *
- *     You should have received a copy of the GNU General Public
- *     License along with this program; if not, write to the Free
- *     Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
- *     USA.
- *
- ***************************************************************************
- *
- *     Gemtek Corp still silently refuses to release any specifications
- *     of their multimedia devices, so the protocol still has to be
- *     reverse engineered.
- *
- *     The v4l code was inspired by Jonas Munsin's  Gemtek serial line
- *     radio device driver.
- *
- *     Please, let me know if this piece of code was useful :)
- *
- *     TODO: multiple device support and portability were not tested
- *
- *     Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
- *
- ***************************************************************************
- */
-
-#include <linux/types.h>
-#include <linux/list.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/pci.h>
-#include <linux/videodev2.h>
-#include <linux/errno.h>
-#include <linux/version.h>      /* for KERNEL_VERSION MACRO     */
-#include <linux/io.h>
-#include <linux/slab.h>
-#include <media/v4l2-device.h>
-#include <media/v4l2-ioctl.h>
-
-MODULE_AUTHOR("Vladimir Shebordaev <vshebordaev@mail.ru>");
-MODULE_DESCRIPTION("The video4linux driver for the Gemtek PCI Radio Card");
-MODULE_LICENSE("GPL");
-
-static int nr_radio = -1;
-static int mx = 1;
-
-module_param(mx, bool, 0);
-MODULE_PARM_DESC(mx, "single digit: 1 - turn off the turner upon module exit (default), 0 - do not");
-module_param(nr_radio, int, 0);
-MODULE_PARM_DESC(nr_radio, "video4linux device number to use");
-
-#define RADIO_VERSION KERNEL_VERSION(0, 0, 2)
-
-#ifndef PCI_VENDOR_ID_GEMTEK
-#define PCI_VENDOR_ID_GEMTEK 0x5046
-#endif
-
-#ifndef PCI_DEVICE_ID_GEMTEK_PR103
-#define PCI_DEVICE_ID_GEMTEK_PR103 0x1001
-#endif
-
-#ifndef GEMTEK_PCI_RANGE_LOW
-#define GEMTEK_PCI_RANGE_LOW (87*16000)
-#endif
-
-#ifndef GEMTEK_PCI_RANGE_HIGH
-#define GEMTEK_PCI_RANGE_HIGH (108*16000)
-#endif
-
-struct gemtek_pci {
-        struct v4l2_device v4l2_dev;
-        struct video_device vdev;
-        struct mutex lock;
-        struct pci_dev *pdev;
-
-        u32 iobase;
-        u32 length;
-
-        u32 current_frequency;
-        u8  mute;
-};
-
-static inline struct gemtek_pci *to_gemtek_pci(struct v4l2_device *v4l2_dev)
-{
-        return container_of(v4l2_dev, struct gemtek_pci, v4l2_dev);
-}
-
-static inline u8 gemtek_pci_out(u16 value, u32 port)
-{
-        outw(value, port);
-
-        return (u8)value;
-}
-
-#define _b0(v) (*((u8 *)&v))
-
-static void __gemtek_pci_cmd(u16 value, u32 port, u8 *last_byte, int keep)
-{
-        u8 byte = *last_byte;
-
-        if (!value) {
-                if (!keep)
-                        value = (u16)port;
-                byte &= 0xfd;
-        } else
-                byte |= 2;
-
-        _b0(value) = byte;
-        outw(value, port);
-        byte |= 1;
-        _b0(value) = byte;
-        outw(value, port);
-        byte &= 0xfe;
-        _b0(value) = byte;
-        outw(value, port);
-
-        *last_byte = byte;
-}
-
-static inline void gemtek_pci_nil(u32 port, u8 *last_byte)
-{
-        __gemtek_pci_cmd(0x00, port, last_byte, false);
-}
-
-static inline void gemtek_pci_cmd(u16 cmd, u32 port, u8 *last_byte)
-{
-        __gemtek_pci_cmd(cmd, port, last_byte, true);
-}
-
-static void gemtek_pci_setfrequency(struct gemtek_pci *card, unsigned long frequency)
-{
-        int i;
-        u32 value = frequency / 200 + 856;
-        u16 mask = 0x8000;
-        u8 last_byte;
-        u32 port = card->iobase;
-
-        mutex_lock(&card->lock);
-        card->current_frequency = frequency;
-        last_byte = gemtek_pci_out(0x06, port);
-
-        i = 0;
-        do {
-                gemtek_pci_nil(port, &last_byte);
-                i++;
-        } while (i < 9);
-
-        i = 0;
-        do {
-                gemtek_pci_cmd(value & mask, port, &last_byte);
-                mask >>= 1;
-                i++;
-        } while (i < 16);
-
-        outw(0x10, port);
-        mutex_unlock(&card->lock);
-}
-
-
-static void gemtek_pci_mute(struct gemtek_pci *card)
-{
-        mutex_lock(&card->lock);
-        outb(0x1f, card->iobase);
-        card->mute = true;
-        mutex_unlock(&card->lock);
-}
-
-static void gemtek_pci_unmute(struct gemtek_pci *card)
-{
-        if (card->mute) {
-                gemtek_pci_setfrequency(card, card->current_frequency);
-                card->mute = false;
-        }
-}
-
-static int gemtek_pci_getsignal(struct gemtek_pci *card)
-{
-        int sig;
-
-        mutex_lock(&card->lock);
-        sig = (inb(card->iobase) & 0x08) ? 0 : 1;
-        mutex_unlock(&card->lock);
-        return sig;
-}
-
-static int vidioc_querycap(struct file *file, void *priv,
-                                        struct v4l2_capability *v)
-{
-        struct gemtek_pci *card = video_drvdata(file);
-
-        strlcpy(v->driver, "radio-gemtek-pci", sizeof(v->driver));
-        strlcpy(v->card, "GemTek PCI Radio", sizeof(v->card));
-        snprintf(v->bus_info, sizeof(v->bus_info), "PCI:%s", pci_name(card->pdev));
-        v->version = RADIO_VERSION;
-        v->capabilities = V4L2_CAP_TUNER | V4L2_CAP_RADIO;
-        return 0;
-}
-
-static int vidioc_g_tuner(struct file *file, void *priv,
-                                        struct v4l2_tuner *v)
-{
-        struct gemtek_pci *card = video_drvdata(file);
-
-        if (v->index > 0)
-                return -EINVAL;
-
-        strlcpy(v->name, "FM", sizeof(v->name));
-        v->type = V4L2_TUNER_RADIO;
-        v->rangelow = GEMTEK_PCI_RANGE_LOW;
-        v->rangehigh = GEMTEK_PCI_RANGE_HIGH;
-        v->rxsubchans = V4L2_TUNER_SUB_MONO;
-        v->capability = V4L2_TUNER_CAP_LOW;
-        v->audmode = V4L2_TUNER_MODE_MONO;
-        v->signal = 0xffff * gemtek_pci_getsignal(card);
-        return 0;
-}
-
-static int vidioc_s_tuner(struct file *file, void *priv,
-                                        struct v4l2_tuner *v)
-{
-        return v->index ? -EINVAL : 0;
-}
-
-static int vidioc_s_frequency(struct file *file, void *priv,
-                                        struct v4l2_frequency *f)
-{
-        struct gemtek_pci *card = video_drvdata(file);
-
-        if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
-                return -EINVAL;
-        if (f->frequency < GEMTEK_PCI_RANGE_LOW ||
-            f->frequency > GEMTEK_PCI_RANGE_HIGH)
-                return -EINVAL;
-        gemtek_pci_setfrequency(card, f->frequency);
-        card->mute = false;
-        return 0;
-}
-
-static int vidioc_g_frequency(struct file *file, void *priv,
-                                        struct v4l2_frequency *f)
-{
-        struct gemtek_pci *card = video_drvdata(file);
-
-        if (f->tuner != 0)
-                return -EINVAL;
-        f->type = V4L2_TUNER_RADIO;
-        f->frequency = card->current_frequency;
-        return 0;
-}
-
-static int vidioc_queryctrl(struct file *file, void *priv,
-                                        struct v4l2_queryctrl *qc)
-{
-        switch (qc->id) {
-        case V4L2_CID_AUDIO_MUTE:
-                return v4l2_ctrl_query_fill(qc, 0, 1, 1, 1);
-        case V4L2_CID_AUDIO_VOLUME:
-                return v4l2_ctrl_query_fill(qc, 0, 65535, 65535, 65535);
-        }
-        return -EINVAL;
-}
-
-static int vidioc_g_ctrl(struct file *file, void *priv,
-                                        struct v4l2_control *ctrl)
-{
-        struct gemtek_pci *card = video_drvdata(file);
-
-        switch (ctrl->id) {
-        case V4L2_CID_AUDIO_MUTE:
-                ctrl->value = card->mute;
-                return 0;
-        case V4L2_CID_AUDIO_VOLUME:
-                if (card->mute)
-                        ctrl->value = 0;
-                else
-                        ctrl->value = 65535;
-                return 0;
-        }
-        return -EINVAL;
-}
-
-static int vidioc_s_ctrl(struct file *file, void *priv,
-                                        struct v4l2_control *ctrl)
-{
-        struct gemtek_pci *card = video_drvdata(file);
-
-        switch (ctrl->id) {
-        case V4L2_CID_AUDIO_MUTE:
-                if (ctrl->value)
-                        gemtek_pci_mute(card);
-                else
-                        gemtek_pci_unmute(card);
-                return 0;
-        case V4L2_CID_AUDIO_VOLUME:
-                if (ctrl->value)
-                        gemtek_pci_unmute(card);
-                else
-                        gemtek_pci_mute(card);
-                return 0;
-        }
-        return -EINVAL;
-}
-
-static int vidioc_g_input(struct file *filp, void *priv, unsigned int *i)
-{
-        *i = 0;
-        return 0;
-}
-
-static int vidioc_s_input(struct file *filp, void *priv, unsigned int i)
-{
-        return i ? -EINVAL : 0;
-}
-
-static int vidioc_g_audio(struct file *file, void *priv,
-                                        struct v4l2_audio *a)
-{
-        a->index = 0;
-        strlcpy(a->name, "Radio", sizeof(a->name));
-        a->capability = V4L2_AUDCAP_STEREO;
-        return 0;
-}
-
-static int vidioc_s_audio(struct file *file, void *priv,
-                                        struct v4l2_audio *a)
-{
-        return a->index ? -EINVAL : 0;
-}
-
-enum {
-        GEMTEK_PR103
-};
-
-static char *card_names[] __devinitdata = {
-        "GEMTEK_PR103"
-};
-
-static struct pci_device_id gemtek_pci_id[] =
-{
-        { PCI_VENDOR_ID_GEMTEK, PCI_DEVICE_ID_GEMTEK_PR103,
-          PCI_ANY_ID, PCI_ANY_ID, 0, 0, GEMTEK_PR103 },
-        { 0 }
-};
-
-MODULE_DEVICE_TABLE(pci, gemtek_pci_id);
-
-static const struct v4l2_file_operations gemtek_pci_fops = {
-        .owner          = THIS_MODULE,
-        .unlocked_ioctl = video_ioctl2,
-};
-
-static const struct v4l2_ioctl_ops gemtek_pci_ioctl_ops = {
-        .vidioc_querycap    = vidioc_querycap,
-        .vidioc_g_tuner     = vidioc_g_tuner,
-        .vidioc_s_tuner     = vidioc_s_tuner,
-        .vidioc_g_audio     = vidioc_g_audio,
-        .vidioc_s_audio     = vidioc_s_audio,
-        .vidioc_g_input     = vidioc_g_input,
-        .vidioc_s_input     = vidioc_s_input,
-        .vidioc_g_frequency = vidioc_g_frequency,
-        .vidioc_s_frequency = vidioc_s_frequency,
-        .vidioc_queryctrl   = vidioc_queryctrl,
-        .vidioc_g_ctrl      = vidioc_g_ctrl,
-        .vidioc_s_ctrl      = vidioc_s_ctrl,
-};
-
-static int __devinit gemtek_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
-{
-        struct gemtek_pci *card;
-        struct v4l2_device *v4l2_dev;
-        int res;
-
-        card = kzalloc(sizeof(struct gemtek_pci), GFP_KERNEL);
-        if (card == NULL) {
-                dev_err(&pdev->dev, "out of memory\n");
-                return -ENOMEM;
-        }
-
-        v4l2_dev = &card->v4l2_dev;
-        mutex_init(&card->lock);
-        card->pdev = pdev;
-
-        strlcpy(v4l2_dev->name, "gemtek_pci", sizeof(v4l2_dev->name));
-
-        res = v4l2_device_register(&pdev->dev, v4l2_dev);
-        if (res < 0) {
-                v4l2_err(v4l2_dev, "Could not register v4l2_device\n");
-                kfree(card);
-                return res;
-        }
-
-        if (pci_enable_device(pdev))
-                goto err_pci;
-
-        card->iobase = pci_resource_start(pdev, 0);
-        card->length = pci_resource_len(pdev, 0);
-
-        if (request_region(card->iobase, card->length, card_names[pci_id->driver_data]) == NULL) {
-                v4l2_err(v4l2_dev, "i/o port already in use\n");
-                goto err_pci;
-        }
-
-        strlcpy(card->vdev.name, v4l2_dev->name, sizeof(card->vdev.name));
-        card->vdev.v4l2_dev = v4l2_dev;
-        card->vdev.fops = &gemtek_pci_fops;
-        card->vdev.ioctl_ops = &gemtek_pci_ioctl_ops;
-        card->vdev.release = video_device_release_empty;
-        video_set_drvdata(&card->vdev, card);
-
-        gemtek_pci_mute(card);
-
-        if (video_register_device(&card->vdev, VFL_TYPE_RADIO, nr_radio) < 0)
-                goto err_video;
-
-        v4l2_info(v4l2_dev, "Gemtek PCI Radio (rev. %d) found at 0x%04x-0x%04x.\n",
-                pdev->revision, card->iobase, card->iobase + card->length - 1);
-
-        return 0;
-
-err_video:
-        release_region(card->iobase, card->length);
-
-err_pci:
-        v4l2_device_unregister(v4l2_dev);
-        kfree(card);
-        return -ENODEV;
-}
-
-static void __devexit gemtek_pci_remove(struct pci_dev *pdev)
-{
-        struct v4l2_device *v4l2_dev = dev_get_drvdata(&pdev->dev);
-        struct gemtek_pci *card = to_gemtek_pci(v4l2_dev);
-
-        video_unregister_device(&card->vdev);
-        v4l2_device_unregister(v4l2_dev);
-
-        release_region(card->iobase, card->length);
-
-        if (mx)
-                gemtek_pci_mute(card);
-
-        kfree(card);
-}
-
-static struct pci_driver gemtek_pci_driver = {
-        .name           = "gemtek_pci",
-        .id_table       = gemtek_pci_id,
-        .probe          = gemtek_pci_probe,
-        .remove         = __devexit_p(gemtek_pci_remove),
-};
-
-static int __init gemtek_pci_init(void)
-{
-        return pci_register_driver(&gemtek_pci_driver);
-}
-
-static void __exit gemtek_pci_exit(void)
-{
-        pci_unregister_driver(&gemtek_pci_driver);
-}
-
-module_init(gemtek_pci_init);
-module_exit(gemtek_pci_exit);
diff --git a/drivers/media/radio/radio-maxiradio.c b/drivers/media/radio/radio-maxiradio.c
index 6459a220b0d..5c2a9058c09 100644
--- a/drivers/media/radio/radio-maxiradio.c
+++ b/drivers/media/radio/radio-maxiradio.c
@@ -77,8 +77,8 @@ MODULE_PARM_DESC(debug, "activates debug info");
 /* TEA5757 pin mappings */
 static const int clk = 1, data = 2, wren = 4, mo_st = 8, power = 16;
 
-#define FREQ_LO         (50 * 16000)
-#define FREQ_HI         (150 * 16000)
+#define FREQ_LO         (87 * 16000)
+#define FREQ_HI         (108 * 16000)
 
 #define FREQ_IF         171200 /* 10.7*16000   */
 #define FREQ_STEP       200    /* 12.5*16      */
diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c
index dd6bd364efa..7ecc8e65766 100644
--- a/drivers/media/radio/radio-wl1273.c
+++ b/drivers/media/radio/radio-wl1273.c
@@ -1407,7 +1407,7 @@ static const struct v4l2_file_operations wl1273_fops = {
         .read           = wl1273_fm_fops_read,
         .write          = wl1273_fm_fops_write,
         .poll           = wl1273_fm_fops_poll,
-        .ioctl          = video_ioctl2,
+        .unlocked_ioctl = video_ioctl2,
         .open           = wl1273_fm_fops_open,
         .release        = wl1273_fm_fops_release,
 };
diff --git a/drivers/media/radio/si470x/radio-si470x-common.c b/drivers/media/radio/si470x/radio-si470x-common.c
index ac76dfe5b3f..60c176fe328 100644
--- a/drivers/media/radio/si470x/radio-si470x-common.c
+++ b/drivers/media/radio/si470x/radio-si470x-common.c
@@ -357,7 +357,8 @@ int si470x_start(struct si470x_device *radio)
                 goto done;
 
         /* sysconfig 1 */
-        radio->registers[SYSCONFIG1] = SYSCONFIG1_DE;
+        radio->registers[SYSCONFIG1] =
+                (de << 11) & SYSCONFIG1_DE;             /* DE*/
         retval = si470x_set_register(radio, SYSCONFIG1);
         if (retval < 0)
                 goto done;
@@ -687,12 +688,8 @@ static int si470x_vidioc_g_tuner(struct file *file, void *priv,
         /* driver constants */
         strcpy(tuner->name, "FM");
         tuner->type = V4L2_TUNER_RADIO;
-#if defined(CONFIG_USB_SI470X) || defined(CONFIG_USB_SI470X_MODULE)
         tuner->capability = V4L2_TUNER_CAP_LOW | V4L2_TUNER_CAP_STEREO |
                             V4L2_TUNER_CAP_RDS | V4L2_TUNER_CAP_RDS_BLOCK_IO;
-#else
-        tuner->capability = V4L2_TUNER_CAP_LOW | V4L2_TUNER_CAP_STEREO;
-#endif
 
         /* range limits */
         switch ((radio->registers[SYSCONFIG2] & SYSCONFIG2_BAND) >> 6) {
@@ -718,12 +715,10 @@ static int si470x_vidioc_g_tuner(struct file *file, void *priv,
                 tuner->rxsubchans = V4L2_TUNER_SUB_MONO;
         else
                 tuner->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
-#if defined(CONFIG_USB_SI470X) || defined(CONFIG_USB_SI470X_MODULE)
         /* If there is a reliable method of detecting an RDS channel,
            then this code should check for that before setting this
            RDS subchannel. */
         tuner->rxsubchans |= V4L2_TUNER_SUB_RDS;
-#endif
 
         /* mono/stereo selector */
         if ((radio->registers[POWERCFG] & POWERCFG_MONO) == 0)
diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index 80b3c319f69..1ac49139158 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -446,27 +446,27 @@ static void ene_rx_setup(struct ene_device *dev)
 
 select_timeout:
         if (dev->rx_fan_input_inuse) {
-                dev->rdev->rx_resolution = MS_TO_NS(ENE_FW_SAMPLE_PERIOD_FAN);
+                dev->rdev->rx_resolution = US_TO_NS(ENE_FW_SAMPLE_PERIOD_FAN);
 
                 /* Fan input doesn't support timeouts, it just ends the
                         input with a maximum sample */
                 dev->rdev->min_timeout = dev->rdev->max_timeout =
-                        MS_TO_NS(ENE_FW_SMPL_BUF_FAN_MSK *
+                        US_TO_NS(ENE_FW_SMPL_BUF_FAN_MSK *
                                 ENE_FW_SAMPLE_PERIOD_FAN);
         } else {
-                dev->rdev->rx_resolution = MS_TO_NS(sample_period);
+                dev->rdev->rx_resolution = US_TO_NS(sample_period);
 
                 /* Theoreticly timeout is unlimited, but we cap it
                  * because it was seen that on one device, it
                  * would stop sending spaces after around 250 msec.
                  * Besides, this is close to 2^32 anyway and timeout is u32.
                  */
-                dev->rdev->min_timeout = MS_TO_NS(127 * sample_period);
-                dev->rdev->max_timeout = MS_TO_NS(200000);
+                dev->rdev->min_timeout = US_TO_NS(127 * sample_period);
+                dev->rdev->max_timeout = US_TO_NS(200000);
         }
 
         if (dev->hw_learning_and_tx_capable)
-                dev->rdev->tx_resolution = MS_TO_NS(sample_period);
+                dev->rdev->tx_resolution = US_TO_NS(sample_period);
 
         if (dev->rdev->timeout > dev->rdev->max_timeout)
                 dev->rdev->timeout = dev->rdev->max_timeout;
@@ -801,7 +801,7 @@ static irqreturn_t ene_isr(int irq, void *data)
 
                 dbg("RX: %d (%s)", hw_sample, pulse ? "pulse" : "space");
 
-                ev.duration = MS_TO_NS(hw_sample);
+                ev.duration = US_TO_NS(hw_sample);
                 ev.pulse = pulse;
                 ir_raw_event_store_with_filter(dev->rdev, &ev);
         }
@@ -821,7 +821,7 @@ static void ene_setup_default_settings(struct ene_device *dev)
         dev->learning_mode_enabled = learning_mode_force;
 
         /* Set reasonable default timeout */
-        dev->rdev->timeout = MS_TO_NS(150000);
+        dev->rdev->timeout = US_TO_NS(150000);
 }
 
 /* Upload all hardware settings at once. Used at load and resume time */
@@ -1004,6 +1004,10 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
         /* validate resources */
         error = -ENODEV;
 
+        /* init these to -1, as 0 is valid for both */
+        dev->hw_io = -1;
+        dev->irq = -1;
+
         if (!pnp_port_valid(pnp_dev, 0) ||
             pnp_port_len(pnp_dev, 0) < ENE_IO_SIZE)
                 goto error;
@@ -1072,6 +1076,8 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
                 rdev->input_name = "ENE eHome Infrared Remote Transceiver";
         }
 
+        dev->rdev = rdev;
+
         ene_rx_setup_hw_buffer(dev);
         ene_setup_default_settings(dev);
         ene_setup_hw_settings(dev);
@@ -1083,7 +1089,6 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
         if (error < 0)
                 goto error;
 
-        dev->rdev = rdev;
         ene_notice("driver has been succesfully loaded");
         return 0;
 error:
diff --git a/drivers/media/rc/ene_ir.h b/drivers/media/rc/ene_ir.h
index c179baf34cb..337a41d4450 100644
--- a/drivers/media/rc/ene_ir.h
+++ b/drivers/media/rc/ene_ir.h
@@ -201,8 +201,6 @@
 #define dbg_verbose(format, ...)        __dbg(2, format, ## __VA_ARGS__)
 #define dbg_regs(format, ...)           __dbg(3, format, ## __VA_ARGS__)
 
-#define MS_TO_NS(msec) ((msec) * 1000)
-
 struct ene_device {
         struct pnp_dev *pnp_dev;
         struct rc_dev *rdev;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 6811512b4e8..e7dc6b46fdf 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -988,7 +988,6 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
         int retval;
         struct imon_context *ictx = rc->priv;
         struct device *dev = ictx->dev;
-        bool pad_mouse;
         unsigned char ir_proto_packet[] = {
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86 };
 
@@ -1000,29 +999,20 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
         case RC_TYPE_RC6:
                 dev_dbg(dev, "Configuring IR receiver for MCE protocol\n");
                 ir_proto_packet[0] = 0x01;
-                pad_mouse = false;
                 break;
         case RC_TYPE_UNKNOWN:
         case RC_TYPE_OTHER:
                 dev_dbg(dev, "Configuring IR receiver for iMON protocol\n");
-                if (pad_stabilize && !nomouse)
-                        pad_mouse = true;
-                else {
+                if (!pad_stabilize)
                         dev_dbg(dev, "PAD stabilize functionality disabled\n");
-                        pad_mouse = false;
-                }
                 /* ir_proto_packet[0] = 0x00; // already the default */
                 rc_type = RC_TYPE_OTHER;
                 break;
         default:
                 dev_warn(dev, "Unsupported IR protocol specified, overriding "
                          "to iMON IR protocol\n");
-                if (pad_stabilize && !nomouse)
-                        pad_mouse = true;
-                else {
+                if (!pad_stabilize)
                         dev_dbg(dev, "PAD stabilize functionality disabled\n");
-                        pad_mouse = false;
-                }
                 /* ir_proto_packet[0] = 0x00; // already the default */
                 rc_type = RC_TYPE_OTHER;
                 break;
@@ -1035,7 +1025,7 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
                 goto out;
 
         ictx->rc_type = rc_type;
-        ictx->pad_mouse = pad_mouse;
+        ictx->pad_mouse = false;
 
 out:
         return retval;
@@ -1517,7 +1507,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
                         spin_unlock_irqrestore(&ictx->kc_lock, flags);
                         return;
                 } else {
-                        ictx->pad_mouse = 0;
+                        ictx->pad_mouse = false;
                         dev_dbg(dev, "mouse mode disabled, passing key value\n");
                 }
         }
@@ -1756,7 +1746,6 @@ static void imon_get_ffdc_type(struct imon_context *ictx)
         printk(KERN_CONT " (id 0x%02x)\n", ffdc_cfg_byte);
 
         ictx->display_type = detected_display_type;
-        ictx->rdev->allowed_protos = allowed_protos;
         ictx->rc_type = allowed_protos;
 }
 
@@ -1839,10 +1828,6 @@ static struct rc_dev *imon_init_rdev(struct imon_context *ictx)
         rdev->allowed_protos = RC_TYPE_OTHER | RC_TYPE_RC6; /* iMON PAD or MCE */
         rdev->change_protocol = imon_ir_change_protocol;
         rdev->driver_name = MOD_NAME;
-        if (ictx->rc_type == RC_TYPE_RC6)
-                rdev->map_name = RC_MAP_IMON_MCE;
-        else
-                rdev->map_name = RC_MAP_IMON_PAD;
 
         /* Enable front-panel buttons and/or knobs */
         memcpy(ictx->usb_tx_buf, &fp_packet, sizeof(fp_packet));
@@ -1851,11 +1836,18 @@ static struct rc_dev *imon_init_rdev(struct imon_context *ictx)
         if (ret)
                 dev_info(ictx->dev, "panel buttons/knobs setup failed\n");
 
-        if (ictx->product == 0xffdc)
+        if (ictx->product == 0xffdc) {
                 imon_get_ffdc_type(ictx);
+                rdev->allowed_protos = ictx->rc_type;
+        }
 
         imon_set_display_type(ictx);
 
+        if (ictx->rc_type == RC_TYPE_RC6)
+                rdev->map_name = RC_MAP_IMON_MCE;
+        else
+                rdev->map_name = RC_MAP_IMON_PAD;
+
         ret = rc_register_device(rdev);
         if (ret < 0) {
                 dev_err(ictx->dev, "remote input dev register failed\n");
@@ -2108,18 +2100,6 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf)
                 goto find_endpoint_failed;
         }
 
-        ictx->idev = imon_init_idev(ictx);
-        if (!ictx->idev) {
-                dev_err(dev, "%s: input device setup failed\n", __func__);
-                goto idev_setup_failed;
-        }
-
-        ictx->rdev = imon_init_rdev(ictx);
-        if (!ictx->rdev) {
-                dev_err(dev, "%s: rc device setup failed\n", __func__);
-                goto rdev_setup_failed;
-        }
-
         usb_fill_int_urb(ictx->rx_urb_intf0, ictx->usbdev_intf0,
                 usb_rcvintpipe(ictx->usbdev_intf0,
                         ictx->rx_endpoint_intf0->bEndpointAddress),
@@ -2133,13 +2113,25 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf)
                 goto urb_submit_failed;
         }
 
+        ictx->idev = imon_init_idev(ictx);
+        if (!ictx->idev) {
+                dev_err(dev, "%s: input device setup failed\n", __func__);
+                goto idev_setup_failed;
+        }
+
+        ictx->rdev = imon_init_rdev(ictx);
+        if (!ictx->rdev) {
+                dev_err(dev, "%s: rc device setup failed\n", __func__);
+                goto rdev_setup_failed;
+        }
+
         return ictx;
 
-urb_submit_failed:
-        rc_unregister_device(ictx->rdev);
 rdev_setup_failed:
         input_unregister_device(ictx->idev);
 idev_setup_failed:
+        usb_kill_urb(ictx->rx_urb_intf0);
+urb_submit_failed:
 find_endpoint_failed:
         mutex_unlock(&ictx->lock);
         usb_free_urb(tx_urb);
diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
index f011c5d9dea..1c5cc65ea1e 100644
--- a/drivers/media/rc/ir-lirc-codec.c
+++ b/drivers/media/rc/ir-lirc-codec.c
@@ -1,4 +1,4 @@
-/* ir-lirc-codec.c - ir-core to classic lirc interface bridge
+/* ir-lirc-codec.c - rc-core to classic lirc interface bridge
  *
  * Copyright (C) 2010 by Jarod Wilson <jarod@redhat.com>
  *
@@ -47,6 +47,7 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
         /* Carrier reports */
         if (ev.carrier_report) {
                 sample = LIRC_FREQUENCY(ev.carrier);
+                IR_dprintk(2, "carrier report (freq: %d)\n", sample);
 
         /* Packet end */
         } else if (ev.timeout) {
@@ -62,6 +63,7 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
                         return 0;
 
                 sample = LIRC_TIMEOUT(ev.duration / 1000);
+                IR_dprintk(2, "timeout report (duration: %d)\n", sample);
 
         /* Normal sample */
         } else {
@@ -85,6 +87,8 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
 
                 sample = ev.pulse ? LIRC_PULSE(ev.duration / 1000) :
                                         LIRC_SPACE(ev.duration / 1000);
+                IR_dprintk(2, "delivering %uus %s to lirc_dev\n",
+                           TO_US(ev.duration), TO_STR(ev.pulse));
         }
 
         lirc_buffer_write(dev->raw->lirc.drv->rbuf,
diff --git a/drivers/media/rc/ir-raw.c b/drivers/media/rc/ir-raw.c
index 185baddcbf1..73230ff93b8 100644
--- a/drivers/media/rc/ir-raw.c
+++ b/drivers/media/rc/ir-raw.c
@@ -233,7 +233,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_handle);
 
 /* used internally by the sysfs interface */
 u64
-ir_raw_get_allowed_protocols()
+ir_raw_get_allowed_protocols(void)
 {
         u64 protocols;
         mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/rc/keymaps/rc-dib0700-nec.c b/drivers/media/rc/keymaps/rc-dib0700-nec.c
index c59851b203d..7a5f5300caf 100644
--- a/drivers/media/rc/keymaps/rc-dib0700-nec.c
+++ b/drivers/media/rc/keymaps/rc-dib0700-nec.c
@@ -19,35 +19,35 @@
 
 static struct rc_map_table dib0700_nec_table[] = {
         /* Key codes for the Pixelview SBTVD remote */
-        { 0x8613, KEY_MUTE },
-        { 0x8612, KEY_POWER },
-        { 0x8601, KEY_1 },
-        { 0x8602, KEY_2 },
-        { 0x8603, KEY_3 },
-        { 0x8604, KEY_4 },
-        { 0x8605, KEY_5 },
-        { 0x8606, KEY_6 },
-        { 0x8607, KEY_7 },
-        { 0x8608, KEY_8 },
-        { 0x8609, KEY_9 },
-        { 0x8600, KEY_0 },
-        { 0x860d, KEY_CHANNELUP },
-        { 0x8619, KEY_CHANNELDOWN },
-        { 0x8610, KEY_VOLUMEUP },
-        { 0x860c, KEY_VOLUMEDOWN },
+        { 0x866b13, KEY_MUTE },
+        { 0x866b12, KEY_POWER },
+        { 0x866b01, KEY_1 },
+        { 0x866b02, KEY_2 },
+        { 0x866b03, KEY_3 },
+        { 0x866b04, KEY_4 },
+        { 0x866b05, KEY_5 },
+        { 0x866b06, KEY_6 },
+        { 0x866b07, KEY_7 },
+        { 0x866b08, KEY_8 },
+        { 0x866b09, KEY_9 },
+        { 0x866b00, KEY_0 },
+        { 0x866b0d, KEY_CHANNELUP },
+        { 0x866b19, KEY_CHANNELDOWN },
+        { 0x866b10, KEY_VOLUMEUP },
+        { 0x866b0c, KEY_VOLUMEDOWN },
 
-        { 0x860a, KEY_CAMERA },
-        { 0x860b, KEY_ZOOM },
-        { 0x861b, KEY_BACKSPACE },
-        { 0x8615, KEY_ENTER },
+        { 0x866b0a, KEY_CAMERA },
+        { 0x866b0b, KEY_ZOOM },
+        { 0x866b1b, KEY_BACKSPACE },
+        { 0x866b15, KEY_ENTER },
 
-        { 0x861d, KEY_UP },
-        { 0x861e, KEY_DOWN },
-        { 0x860e, KEY_LEFT },
-        { 0x860f, KEY_RIGHT },
+        { 0x866b1d, KEY_UP },
+        { 0x866b1e, KEY_DOWN },
+        { 0x866b0e, KEY_LEFT },
+        { 0x866b0f, KEY_RIGHT },
 
-        { 0x8618, KEY_RECORD },
-        { 0x861a, KEY_STOP },
+        { 0x866b18, KEY_RECORD },
+        { 0x866b1a, KEY_STOP },
 
         /* Key codes for the EvolutePC TVWay+ remote */
         { 0x7a00, KEY_MENU },
diff --git a/drivers/media/rc/keymaps/rc-rc6-mce.c b/drivers/media/rc/keymaps/rc-rc6-mce.c
index 3bf3337875d..2f5dc0622b9 100644
--- a/drivers/media/rc/keymaps/rc-rc6-mce.c
+++ b/drivers/media/rc/keymaps/rc-rc6-mce.c
@@ -3,6 +3,9 @@
  *
  * Copyright (c) 2010 by Jarod Wilson <jarod@redhat.com>
  *
+ * See http://mediacenterguides.com/book/export/html/31 for details on
+ * key mappings.
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
@@ -60,6 +63,9 @@ static struct rc_map_table rc6_mce[] = {
         { 0x800f0426, KEY_EPG },                /* Guide */
         { 0x800f0427, KEY_ZOOM },               /* Aspect */
 
+        { 0x800f0432, KEY_MODE },               /* Visualization */
+        { 0x800f0433, KEY_PRESENTATION },       /* Slide Show */
+        { 0x800f0434, KEY_EJECTCD },
         { 0x800f043a, KEY_BRIGHTNESSUP },
 
         { 0x800f0446, KEY_TV },
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 0fef6efad53..6df0a498064 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -48,7 +48,6 @@
 #define USB_BUFLEN              32 /* USB reception buffer length */
 #define USB_CTRL_MSG_SZ         2  /* Size of usb ctrl msg on gen1 hw */
 #define MCE_G1_INIT_MSGS        40 /* Init messages on gen1 hw to throw out */
-#define MS_TO_NS(msec)          ((msec) * 1000)
 
 /* MCE constants */
 #define MCE_CMDBUF_SIZE         384  /* MCE Command buffer length */
@@ -817,7 +816,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, int index)
         switch (ir->buf_in[index]) {
         /* 2-byte return value commands */
         case MCE_CMD_S_TIMEOUT:
-                ir->rc->timeout = MS_TO_NS((hi << 8 | lo) / 2);
+                ir->rc->timeout = US_TO_NS((hi << 8 | lo) / 2);
                 break;
 
         /* 1-byte return value commands */
@@ -856,9 +855,10 @@ static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
                         break;
                 case PARSE_IRDATA:
                         ir->rem--;
+                        init_ir_raw_event(&rawir);
                         rawir.pulse = ((ir->buf_in[i] & MCE_PULSE_BIT) != 0);
                         rawir.duration = (ir->buf_in[i] & MCE_PULSE_MASK)
-                                         * MS_TO_NS(MCE_TIME_UNIT);
+                                         * US_TO_NS(MCE_TIME_UNIT);
 
                         dev_dbg(ir->dev, "Storing %s with duration %d\n",
                                 rawir.pulse ? "pulse" : "space",
@@ -884,6 +884,8 @@ static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
                                              i, ir->rem + 1, false);
                         if (ir->rem)
                                 ir->parser_state = PARSE_IRDATA;
+                        else
+                                ir_raw_event_reset(ir->rc);
                         break;
                 }
 
@@ -1061,7 +1063,7 @@ static struct rc_dev *mceusb_init_rc_dev(struct mceusb_dev *ir)
         rc->priv = ir;
         rc->driver_type = RC_DRIVER_IR_RAW;
         rc->allowed_protos = RC_TYPE_ALL;
-        rc->timeout = MS_TO_NS(1000);
+        rc->timeout = US_TO_NS(1000);
         if (!ir->flags.no_tx) {
                 rc->s_tx_mask = mceusb_set_tx_mask;
                 rc->s_tx_carrier = mceusb_set_tx_carrier;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index dd4caf8ef80..273d9d67479 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -460,7 +460,7 @@ static u32 nvt_rx_carrier_detect(struct nvt_dev *nvt)
                 return 0;
         }
 
-        carrier = (count * 1000000) / duration;
+        carrier = MS_TO_NS(count) / duration;
 
         if ((carrier > MAX_CARRIER) || (carrier < MIN_CARRIER))
                 nvt_dbg("WTF? Carrier frequency out of range!");
@@ -612,8 +612,8 @@ static void nvt_process_rx_ir_data(struct nvt_dev *nvt)
                 sample = nvt->buf[i];
 
                 rawir.pulse = ((sample & BUF_PULSE_BIT) != 0);
-                rawir.duration = (sample & BUF_LEN_MASK)
-                                        * SAMPLE_PERIOD * 1000;
+                rawir.duration = US_TO_NS((sample & BUF_LEN_MASK)
+                                          * SAMPLE_PERIOD);
 
                 if ((sample & BUF_LEN_MASK) == BUF_LEN_MASK) {
                         if (nvt->rawir.pulse == rawir.pulse)
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 72be8a02118..512a2f4ada0 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -458,21 +458,27 @@ static int ir_getkeycode(struct input_dev *idev,
                 index = ir_lookup_by_scancode(rc_map, scancode);
         }
 
-        if (index >= rc_map->len) {
-                if (!(ke->flags & INPUT_KEYMAP_BY_INDEX))
-                        IR_dprintk(1, "unknown key for scancode 0x%04x\n",
-                                   scancode);
+        if (index < rc_map->len) {
+                entry = &rc_map->scan[index];
+
+                ke->index = index;
+                ke->keycode = entry->keycode;
+                ke->len = sizeof(entry->scancode);
+                memcpy(ke->scancode, &entry->scancode, sizeof(entry->scancode));
+
+        } else if (!(ke->flags & INPUT_KEYMAP_BY_INDEX)) {
+                /*
+                 * We do not really know the valid range of scancodes
+                 * so let's respond with KEY_RESERVED to anything we
+                 * do not have mapping for [yet].
+                 */
+                ke->index = index;
+                ke->keycode = KEY_RESERVED;
+        } else {
                 retval = -EINVAL;
                 goto out;
         }
 
-        entry = &rc_map->scan[index];
-
-        ke->index = index;
-        ke->keycode = entry->keycode;
-        ke->len = sizeof(entry->scancode);
-        memcpy(ke->scancode, &entry->scancode, sizeof(entry->scancode));
-
         retval = 0;
 
 out:
diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c
index 6e2911c2abf..e435d94c077 100644
--- a/drivers/media/rc/streamzap.c
+++ b/drivers/media/rc/streamzap.c
@@ -164,7 +164,7 @@ static void sz_push_full_pulse(struct streamzap_ir *sz,
                                 sz->signal_start.tv_usec -
                                 sz->signal_last.tv_usec);
                         rawir.duration -= sz->sum;
-                        rawir.duration *= 1000;
+                        rawir.duration = US_TO_NS(rawir.duration);
                         rawir.duration &= IR_MAX_DURATION;
                 }
                 sz_push(sz, rawir);
@@ -177,7 +177,7 @@ static void sz_push_full_pulse(struct streamzap_ir *sz,
         rawir.duration = ((int) value) * SZ_RESOLUTION;
         rawir.duration += SZ_RESOLUTION / 2;
         sz->sum += rawir.duration;
-        rawir.duration *= 1000;
+        rawir.duration = US_TO_NS(rawir.duration);
         rawir.duration &= IR_MAX_DURATION;
         sz_push(sz, rawir);
 }
@@ -197,7 +197,7 @@ static void sz_push_full_space(struct streamzap_ir *sz,
         rawir.duration = ((int) value) * SZ_RESOLUTION;
         rawir.duration += SZ_RESOLUTION / 2;
         sz->sum += rawir.duration;
-        rawir.duration *= 1000;
+        rawir.duration = US_TO_NS(rawir.duration);
         sz_push(sz, rawir);
 }
 
@@ -273,6 +273,7 @@ static void streamzap_callback(struct urb *urb)
                                 if (sz->timeout_enabled)
                                         sz_push(sz, rawir);
                                 ir_raw_event_handle(sz->rdev);
+                                ir_raw_event_reset(sz->rdev);
                         } else {
                                 sz_push_full_space(sz, sz->buf_in[i]);
                         }
@@ -290,6 +291,7 @@ static void streamzap_callback(struct urb *urb)
                 }
         }
 
+        ir_raw_event_handle(sz->rdev);
         usb_submit_urb(urb, GFP_ATOMIC);
 
         return;
@@ -430,13 +432,13 @@ static int __devinit streamzap_probe(struct usb_interface *intf,
         sz->decoder_state = PulseSpace;
         /* FIXME: don't yet have a way to set this */
         sz->timeout_enabled = true;
-        sz->rdev->timeout = (((SZ_TIMEOUT * SZ_RESOLUTION * 1000) &
+        sz->rdev->timeout = ((US_TO_NS(SZ_TIMEOUT * SZ_RESOLUTION) &
                                 IR_MAX_DURATION) | 0x03000000);
         #if 0
         /* not yet supported, depends on patches from maxim */
         /* see also: LIRC_GET_REC_RESOLUTION and LIRC_SET_REC_TIMEOUT */
-        sz->min_timeout = SZ_TIMEOUT * SZ_RESOLUTION * 1000;
-        sz->max_timeout = SZ_TIMEOUT * SZ_RESOLUTION * 1000;
+        sz->min_timeout = US_TO_NS(SZ_TIMEOUT * SZ_RESOLUTION);
+        sz->max_timeout = US_TO_NS(SZ_TIMEOUT * SZ_RESOLUTION);
         #endif
 
         do_gettimeofday(&sz->signal_start);
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index eb875af05e7..aa021600e9d 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -78,7 +78,7 @@ config VIDEO_FIXED_MINOR_RANGES
 
 config VIDEO_HELPER_CHIPS_AUTO
         bool "Autoselect pertinent encoders/decoders and other helper chips"
-        default y if !EMBEDDED
+        default y if !EXPERT
         ---help---
           Most video cards may require additional modules to encode or
           decode audio/video standards. This option will autoselect
@@ -141,15 +141,6 @@ config VIDEO_TDA9840
           To compile this driver as a module, choose M here: the
           module will be called tda9840.
 
-config VIDEO_TDA9875
-        tristate "Philips TDA9875 audio processor"
-        depends on VIDEO_V4L2 && I2C
-        ---help---
-          Support for tda9875 audio decoder chip found on some bt8xx boards.
-
-          To compile this driver as a module, choose M here: the
-          module will be called tda9875.
-
 config VIDEO_TEA6415C
         tristate "Philips TEA6415C audio processor"
         depends on I2C
diff --git a/drivers/media/video/Makefile b/drivers/media/video/Makefile
index 81e38cb0b84..a509d317e25 100644
--- a/drivers/media/video/Makefile
+++ b/drivers/media/video/Makefile
@@ -27,7 +27,6 @@ obj-$(CONFIG_VIDEO_V4L2_COMMON) += v4l2-common.o
 obj-$(CONFIG_VIDEO_TUNER) += tuner.o
 obj-$(CONFIG_VIDEO_TVAUDIO) += tvaudio.o
 obj-$(CONFIG_VIDEO_TDA7432) += tda7432.o
-obj-$(CONFIG_VIDEO_TDA9875) += tda9875.o
 obj-$(CONFIG_VIDEO_SAA6588) += saa6588.o
 obj-$(CONFIG_VIDEO_TDA9840) += tda9840.o
 obj-$(CONFIG_VIDEO_TEA6415C) += tea6415c.o
diff --git a/drivers/media/video/adv7175.c b/drivers/media/video/adv7175.c
index f318b51448b..d2327dbb473 100644
--- a/drivers/media/video/adv7175.c
+++ b/drivers/media/video/adv7175.c
@@ -303,11 +303,22 @@ static int adv7175_g_chip_ident(struct v4l2_subdev *sd, struct v4l2_dbg_chip_ide
         return v4l2_chip_ident_i2c_client(client, chip, V4L2_IDENT_ADV7175, 0);
 }
 
+static int adv7175_s_power(struct v4l2_subdev *sd, int on)
+{
+        if (on)
+                adv7175_write(sd, 0x01, 0x00);
+        else
+                adv7175_write(sd, 0x01, 0x78);
+
+        return 0;
+}
+
 /* ----------------------------------------------------------------------- */
 
 static const struct v4l2_subdev_core_ops adv7175_core_ops = {
         .g_chip_ident = adv7175_g_chip_ident,
         .init = adv7175_init,
+        .s_power = adv7175_s_power,
 };
 
 static const struct v4l2_subdev_video_ops adv7175_video_ops = {
diff --git a/drivers/media/video/bt8xx/bttv-cards.c b/drivers/media/video/bt8xx/bttv-cards.c
index 49efcf660ba..7f58756d72c 100644
--- a/drivers/media/video/bt8xx/bttv-cards.c
+++ b/drivers/media/video/bt8xx/bttv-cards.c
@@ -1373,7 +1373,6 @@ struct tvcard bttv_tvcards[] = {
                 .gpiomute       = 0x1800,
                 .audio_mode_gpio= fv2000s_audio,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .needs_tvaudio  = 1,
                 .pll            = PLL_28,
                 .tuner_type     = TUNER_PHILIPS_PAL,
@@ -1511,7 +1510,6 @@ struct tvcard bttv_tvcards[] = {
                 .gpiomute       = 0x09,
                 .needs_tvaudio  = 1,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .pll            = PLL_28,
                 .tuner_type     = TUNER_PHILIPS_PAL,
                 .tuner_addr     = ADDR_UNSET,
@@ -1550,7 +1548,6 @@ struct tvcard bttv_tvcards[] = {
                 .gpiomask2      = 0x07ff,
                 .muxsel         = MUXSEL(3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3),
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .muxsel_hook    = rv605_muxsel,
@@ -1686,7 +1683,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
         [BTTV_BOARD_OSPREY1x0_848] = {
@@ -1699,7 +1695,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
 
@@ -1714,7 +1709,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
         [BTTV_BOARD_OSPREY1x1] = {
@@ -1727,7 +1721,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
         [BTTV_BOARD_OSPREY1x1_SVID] = {
@@ -1740,7 +1733,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
         [BTTV_BOARD_OSPREY2xx] = {
@@ -1753,7 +1745,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
 
@@ -1768,7 +1759,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
         [BTTV_BOARD_OSPREY2x0] = {
@@ -1781,7 +1771,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
         [BTTV_BOARD_OSPREY500] = {
@@ -1794,7 +1783,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
         [BTTV_BOARD_OSPREY540] = {
@@ -1805,7 +1793,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
 
@@ -1820,7 +1807,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,      /* must avoid, conflicts with the bt860 */
         },
         [BTTV_BOARD_IDS_EAGLE] = {
@@ -1835,7 +1821,6 @@ struct tvcard bttv_tvcards[] = {
                 .muxsel         = MUXSEL(2, 2, 2, 2),
                 .muxsel_hook    = eagle_muxsel,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .pll            = PLL_28,
         },
         [BTTV_BOARD_PINNACLESAT] = {
@@ -1846,7 +1831,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .muxsel         = MUXSEL(3, 1),
                 .pll            = PLL_28,
@@ -1897,7 +1881,6 @@ struct tvcard bttv_tvcards[] = {
                 .svhs           = 2,
                 .gpiomask       = 0,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .muxsel         = MUXSEL(2, 0, 1),
                 .pll            = PLL_28,
@@ -1970,7 +1953,6 @@ struct tvcard bttv_tvcards[] = {
                 /* Tuner, CVid, SVid, CVid over SVid connector */
                 .muxsel         = MUXSEL(2, 3, 1, 1),
                 .gpiomask       = 0,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .tuner_type     = TUNER_PHILIPS_PAL_I,
                 .tuner_addr     = ADDR_UNSET,
@@ -2017,7 +1999,6 @@ struct tvcard bttv_tvcards[] = {
                 .muxsel         = MUXSEL(2,2,2,2, 3,3,3,3, 1,1,1,1, 0,0,0,0),
                 .muxsel_hook    = xguard_muxsel,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .pll            = PLL_28,
         },
@@ -2029,7 +2010,6 @@ struct tvcard bttv_tvcards[] = {
                 .svhs           = NO_SVHS,
                 .muxsel         = MUXSEL(2, 3, 1, 0),
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .pll            = PLL_28,
                 .tuner_type     = TUNER_ABSENT,
@@ -2134,7 +2114,6 @@ struct tvcard bttv_tvcards[] = {
                 .svhs           = NO_SVHS,   /* card has no svhs */
                 .needs_tvaudio  = 0,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .gpiomask       = 0x00,
                 .muxsel         = MUXSEL(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0),
@@ -2156,7 +2135,6 @@ struct tvcard bttv_tvcards[] = {
         [BTTV_BOARD_TWINHAN_DST] = {
                 .name           = "Twinhan DST + clones",
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
@@ -2171,7 +2149,6 @@ struct tvcard bttv_tvcards[] = {
                 /* Vid In, SVid In, Vid over SVid in connector */
                 .muxsel         = MUXSEL(3, 1, 1, 3),
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
@@ -2226,7 +2203,6 @@ struct tvcard bttv_tvcards[] = {
                 .svhs           = NO_SVHS,
                 .muxsel         = MUXSEL(2, 3, 1, 0),
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .needs_tvaudio  = 0,
                 .tuner_type     = TUNER_ABSENT,
@@ -2278,7 +2254,6 @@ struct tvcard bttv_tvcards[] = {
                 .gpiomask       = 0,
                 .gpiomask2      = 0x3C<<16,/*Set the GPIO[18]->GPIO[21] as output pin.==> drive the video inputs through analog multiplexers*/
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 /*878A input is always MUX0, see above.*/
                 .muxsel         = MUXSEL(2, 2, 2, 2),
@@ -2302,7 +2277,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_TEMIC_PAL,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
         },
         [BTTV_BOARD_AVDVBT_771] = {
                 /* Wolfram Joost <wojo@frokaschwei.de> */
@@ -2313,7 +2287,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_addr     = ADDR_UNSET,
                 .muxsel         = MUXSEL(3, 3),
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .pll            = PLL_28,
                 .has_dvb        = 1,
@@ -2329,7 +2302,6 @@ struct tvcard bttv_tvcards[] = {
                 .svhs           = 1,
                 .muxsel         = MUXSEL(3, 1, 2, 0), /* Comp0, S-Video, ?, ? */
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .pll            = PLL_28,
                 .tuner_type     = TUNER_ABSENT,
@@ -2393,7 +2365,6 @@ struct tvcard bttv_tvcards[] = {
                 /* Chris Pascoe <c.pascoe@itee.uq.edu.au> */
                 .name           = "DViCO FusionHDTV DVB-T Lite",
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .pll            = PLL_28,
                 .no_video       = 1,
@@ -2440,7 +2411,6 @@ struct tvcard bttv_tvcards[] = {
                 .muxsel         = MUXSEL(2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2),
                 .pll            = PLL_28,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
@@ -2478,7 +2448,6 @@ struct tvcard bttv_tvcards[] = {
                 .pll            = PLL_28,
                 .no_msp34xx     = 1,
                 .no_tda7432     = 1,
-                .no_tda9875     = 1,
                 .muxsel_hook    = kodicom4400r_muxsel,
         },
         [BTTV_BOARD_KODICOM_4400R_SL] = {
@@ -2500,7 +2469,6 @@ struct tvcard bttv_tvcards[] = {
                 .pll            = PLL_28,
                 .no_msp34xx     = 1,
                 .no_tda7432     = 1,
-                .no_tda9875     = 1,
                 .muxsel_hook    = kodicom4400r_muxsel,
         },
                 /* ---- card 0x86---------------------------------- */
@@ -2530,7 +2498,6 @@ struct tvcard bttv_tvcards[] = {
                 .gpiomux        = { 0x00400005, 0, 0x00000001, 0 },
                 .gpiomute       = 0x00c00007,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .has_dvb        = 1,
         },
@@ -2630,7 +2597,6 @@ struct tvcard bttv_tvcards[] = {
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
                 /* ---- card 0x8d ---------------------------------- */
@@ -2658,7 +2624,6 @@ struct tvcard bttv_tvcards[] = {
                 .muxsel         = MUXSEL(2, 3, 1, 1),
                 .gpiomux        = { 100000, 100002, 100002, 100000 },
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .pll            = PLL_28,
                 .tuner_type     = TUNER_TNF_5335MF,
@@ -2674,7 +2639,6 @@ struct tvcard bttv_tvcards[] = {
                 .gpiomask       = 0x0f, /* old: 7 */
                 .muxsel         = MUXSEL(0, 1, 3, 2), /* Composite 0-3 */
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
                 .tuner_type     = TUNER_ABSENT,
                 .tuner_addr     = ADDR_UNSET,
@@ -2732,7 +2696,6 @@ struct tvcard bttv_tvcards[] = {
                 .gpiomux        = { 0x00400005, 0, 0x00000001, 0 },
                 .gpiomute       = 0x00c00007,
                 .no_msp34xx     = 1,
-                .no_tda9875     = 1,
                 .no_tda7432     = 1,
         },
         /* ---- card 0x95---------------------------------- */
@@ -2874,7 +2837,6 @@ struct tvcard bttv_tvcards[] = {
                 .pll            = PLL_28,
                 .no_msp34xx     = 1,
                 .no_tda7432     = 1,
-                .no_tda9875     = 1,
                 .muxsel_hook    = gv800s_muxsel,
         },
                 [BTTV_BOARD_GEOVISION_GV800S_SL] = {
@@ -2899,7 +2861,6 @@ struct tvcard bttv_tvcards[] = {
                 .pll            = PLL_28,
                 .no_msp34xx     = 1,
                 .no_tda7432     = 1,
-                .no_tda9875     = 1,
                 .muxsel_hook    = gv800s_muxsel,
         },
         [BTTV_BOARD_PV183] = {
diff --git a/drivers/media/video/bt8xx/bttv.h b/drivers/media/video/bt8xx/bttv.h
index fd62bf15d77..c6333595c6b 100644
--- a/drivers/media/video/bt8xx/bttv.h
+++ b/drivers/media/video/bt8xx/bttv.h
@@ -234,7 +234,6 @@ struct tvcard {
 
         /* i2c audio flags */
         unsigned int no_msp34xx:1;
-        unsigned int no_tda9875:1;
         unsigned int no_tda7432:1;
         unsigned int needs_tvaudio:1;
         unsigned int msp34xx_alt:1;
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index 49f1b8f1418..55ffd60ffa7 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -2001,6 +2001,11 @@ static int cafe_pci_probe(struct pci_dev *pdev,
                 .min_width = 320,
                 .min_height = 240,
         };
+        struct i2c_board_info ov7670_info = {
+                .type = "ov7670",
+                .addr = 0x42,
+                .platform_data = &sensor_cfg,
+        };
 
         /*
          * Start putting together one of our big camera structures.
@@ -2062,9 +2067,9 @@ static int cafe_pci_probe(struct pci_dev *pdev,
         if (dmi_check_system(olpc_xo1_dmi))
                 sensor_cfg.clock_speed = 45;
 
-        cam->sensor_addr = 0x42;
-        cam->sensor = v4l2_i2c_new_subdev_cfg(&cam->v4l2_dev, &cam->i2c_adapter,
-                        "ov7670", 0, &sensor_cfg, cam->sensor_addr, NULL);
+        cam->sensor_addr = ov7670_info.addr;
+        cam->sensor = v4l2_i2c_new_subdev_board(&cam->v4l2_dev, &cam->i2c_adapter,
+                        &ov7670_info, NULL);
         if (cam->sensor == NULL) {
                 ret = -ENODEV;
                 goto out_smbus;
diff --git a/drivers/media/video/cpia2/cpia2.h b/drivers/media/video/cpia2/cpia2.h
index 916c13d5cf7..6d6d1843791 100644
--- a/drivers/media/video/cpia2/cpia2.h
+++ b/drivers/media/video/cpia2/cpia2.h
@@ -378,7 +378,7 @@ struct cpia2_fh {
 
 struct camera_data {
         /* locks */
-        struct mutex busy_lock; /* guard against SMP multithreading */
+        struct mutex v4l2_lock; /* serialize file operations */
         struct v4l2_prio_state prio;
 
         /* camera status */
diff --git a/drivers/media/video/cpia2/cpia2_core.c b/drivers/media/video/cpia2/cpia2_core.c
index 9606bc01b80..aaffca8e13f 100644
--- a/drivers/media/video/cpia2/cpia2_core.c
+++ b/drivers/media/video/cpia2/cpia2_core.c
@@ -2247,7 +2247,7 @@ struct camera_data *cpia2_init_camera_struct(void)
 
 
         cam->present = 1;
-        mutex_init(&cam->busy_lock);
+        mutex_init(&cam->v4l2_lock);
         init_waitqueue_head(&cam->wq_stream);
 
         return cam;
@@ -2365,9 +2365,9 @@ long cpia2_read(struct camera_data *cam,
                 char __user *buf, unsigned long count, int noblock)
 {
         struct framebuf *frame;
-        if (!count) {
+
+        if (!count)
                 return 0;
-        }
 
         if (!buf) {
                 ERR("%s: buffer NULL\n",__func__);
@@ -2379,17 +2379,12 @@ long cpia2_read(struct camera_data *cam,
                 return -EINVAL;
         }
 
-        /* make this _really_ smp and multithread-safe */
-        if (mutex_lock_interruptible(&cam->busy_lock))
-                return -ERESTARTSYS;
-
         if (!cam->present) {
                 LOG("%s: camera removed\n",__func__);
-                mutex_unlock(&cam->busy_lock);
                 return 0;       /* EOF */
         }
 
-        if(!cam->streaming) {
+        if (!cam->streaming) {
                 /* Start streaming */
                 cpia2_usb_stream_start(cam,
                                        cam->params.camera_state.stream_mode);
@@ -2398,42 +2393,31 @@ long cpia2_read(struct camera_data *cam,
         /* Copy cam->curbuff in case it changes while we're processing */
         frame = cam->curbuff;
         if (noblock && frame->status != FRAME_READY) {
-                mutex_unlock(&cam->busy_lock);
                 return -EAGAIN;
         }
 
-        if(frame->status != FRAME_READY) {
-                mutex_unlock(&cam->busy_lock);
+        if (frame->status != FRAME_READY) {
+                mutex_unlock(&cam->v4l2_lock);
                 wait_event_interruptible(cam->wq_stream,
                                !cam->present ||
                                (frame = cam->curbuff)->status == FRAME_READY);
+                mutex_lock(&cam->v4l2_lock);
                 if (signal_pending(current))
                         return -ERESTARTSYS;
-                /* make this _really_ smp and multithread-safe */
-                if (mutex_lock_interruptible(&cam->busy_lock)) {
-                        return -ERESTARTSYS;
-                }
-                if(!cam->present) {
-                        mutex_unlock(&cam->busy_lock);
+                if (!cam->present)
                         return 0;
-                }
         }
 
         /* copy data to user space */
-        if (frame->length > count) {
-                mutex_unlock(&cam->busy_lock);
+        if (frame->length > count)
                 return -EFAULT;
-        }
-        if (copy_to_user(buf, frame->data, frame->length)) {
-                mutex_unlock(&cam->busy_lock);
+        if (copy_to_user(buf, frame->data, frame->length))
                 return -EFAULT;
-        }
 
         count = frame->length;
 
         frame->status = FRAME_EMPTY;
 
-        mutex_unlock(&cam->busy_lock);
         return count;
 }
 
@@ -2447,17 +2431,13 @@ unsigned int cpia2_poll(struct camera_data *cam, struct file *filp,
 {
         unsigned int status=0;
 
-        if(!cam) {
+        if (!cam) {
                 ERR("%s: Internal error, camera_data not found!\n",__func__);
                 return POLLERR;
         }
 
-        mutex_lock(&cam->busy_lock);
-
-        if(!cam->present) {
-                mutex_unlock(&cam->busy_lock);
+        if (!cam->present)
                 return POLLHUP;
-        }
 
         if(!cam->streaming) {
                 /* Start streaming */
@@ -2465,16 +2445,13 @@ unsigned int cpia2_poll(struct camera_data *cam, struct file *filp,
                                        cam->params.camera_state.stream_mode);
         }
 
-        mutex_unlock(&cam->busy_lock);
         poll_wait(filp, &cam->wq_stream, wait);
-        mutex_lock(&cam->busy_lock);
 
         if(!cam->present)
                 status = POLLHUP;
         else if(cam->curbuff->status == FRAME_READY)
                 status = POLLIN | POLLRDNORM;
 
-        mutex_unlock(&cam->busy_lock);
         return status;
 }
 
@@ -2496,29 +2473,19 @@ int cpia2_remap_buffer(struct camera_data *cam, struct vm_area_struct *vma)
 
         DBG("mmap offset:%ld size:%ld\n", start_offset, size);
 
-        /* make this _really_ smp-safe */
-        if (mutex_lock_interruptible(&cam->busy_lock))
-                return -ERESTARTSYS;
-
-        if (!cam->present) {
-                mutex_unlock(&cam->busy_lock);
+        if (!cam->present)
                 return -ENODEV;
-        }
 
         if (size > cam->frame_size*cam->num_frames  ||
             (start_offset % cam->frame_size) != 0 ||
-            (start_offset+size > cam->frame_size*cam->num_frames)) {
-                mutex_unlock(&cam->busy_lock);
+            (start_offset+size > cam->frame_size*cam->num_frames))
                 return -EINVAL;
-        }
 
         pos = ((unsigned long) (cam->frame_buffer)) + start_offset;
         while (size > 0) {
                 page = kvirt_to_pa(pos);
-                if (remap_pfn_range(vma, start, page >> PAGE_SHIFT, PAGE_SIZE, PAGE_SHARED)) {
-                        mutex_unlock(&cam->busy_lock);
+                if (remap_pfn_range(vma, start, page >> PAGE_SHIFT, PAGE_SIZE, PAGE_SHARED))
                         return -EAGAIN;
-                }
                 start += PAGE_SIZE;
                 pos += PAGE_SIZE;
                 if (size > PAGE_SIZE)
@@ -2528,7 +2495,5 @@ int cpia2_remap_buffer(struct camera_data *cam, struct vm_area_struct *vma)
         }
 
         cam->mmapped = true;
-        mutex_unlock(&cam->busy_lock);
         return 0;
 }
-
diff --git a/drivers/media/video/cpia2/cpia2_v4l.c b/drivers/media/video/cpia2/cpia2_v4l.c
index 7edf80b0d01..9bad3984293 100644
--- a/drivers/media/video/cpia2/cpia2_v4l.c
+++ b/drivers/media/video/cpia2/cpia2_v4l.c
@@ -238,59 +238,40 @@ static struct v4l2_queryctrl controls[] = {
 static int cpia2_open(struct file *file)
 {
         struct camera_data *cam = video_drvdata(file);
-        int retval = 0;
+        struct cpia2_fh *fh;
 
         if (!cam) {
                 ERR("Internal error, camera_data not found!\n");
                 return -ENODEV;
         }
 
-        if(mutex_lock_interruptible(&cam->busy_lock))
-                return -ERESTARTSYS;
-
-        if(!cam->present) {
-                retval = -ENODEV;
-                goto err_return;
-        }
+        if (!cam->present)
+                return -ENODEV;
 
-        if (cam->open_count > 0) {
-                goto skip_init;
-        }
+        if (cam->open_count == 0) {
+                if (cpia2_allocate_buffers(cam))
+                        return -ENOMEM;
 
-        if (cpia2_allocate_buffers(cam)) {
-                retval = -ENOMEM;
-                goto err_return;
-        }
+                /* reset the camera */
+                if (cpia2_reset_camera(cam) < 0)
+                        return -EIO;
 
-        /* reset the camera */
-        if (cpia2_reset_camera(cam) < 0) {
-                retval = -EIO;
-                goto err_return;
+                cam->APP_len = 0;
+                cam->COM_len = 0;
         }
 
-        cam->APP_len = 0;
-        cam->COM_len = 0;
-
-skip_init:
-        {
-                struct cpia2_fh *fh = kmalloc(sizeof(*fh),GFP_KERNEL);
-                if(!fh) {
-                        retval = -ENOMEM;
-                        goto err_return;
-                }
-                file->private_data = fh;
-                fh->prio = V4L2_PRIORITY_UNSET;
-                v4l2_prio_open(&cam->prio, &fh->prio);
-                fh->mmapped = 0;
-        }
+        fh = kmalloc(sizeof(*fh), GFP_KERNEL);
+        if (!fh)
+                return -ENOMEM;
+        file->private_data = fh;
+        fh->prio = V4L2_PRIORITY_UNSET;
+        v4l2_prio_open(&cam->prio, &fh->prio);
+        fh->mmapped = 0;
 
         ++cam->open_count;
 
         cpia2_dbg_dump_registers(cam);
-
-err_return:
-        mutex_unlock(&cam->busy_lock);
-        return retval;
+        return 0;
 }
 
 /******************************************************************************
@@ -304,15 +285,11 @@ static int cpia2_close(struct file *file)
         struct camera_data *cam = video_get_drvdata(dev);
         struct cpia2_fh *fh = file->private_data;
 
-        mutex_lock(&cam->busy_lock);
-
         if (cam->present &&
-            (cam->open_count == 1
-             || fh->prio == V4L2_PRIORITY_RECORD
-            )) {
+            (cam->open_count == 1 || fh->prio == V4L2_PRIORITY_RECORD)) {
                 cpia2_usb_stream_stop(cam);
 
-                if(cam->open_count == 1) {
+                if (cam->open_count == 1) {
                         /* save camera state for later open */
                         cpia2_save_camera_state(cam);
 
@@ -321,26 +298,21 @@ static int cpia2_close(struct file *file)
                 }
         }
 
-        {
-                if(fh->mmapped)
-                        cam->mmapped = 0;
-                v4l2_prio_close(&cam->prio, fh->prio);
-                file->private_data = NULL;
-                kfree(fh);
-        }
+        if (fh->mmapped)
+                cam->mmapped = 0;
+        v4l2_prio_close(&cam->prio, fh->prio);
+        file->private_data = NULL;
+        kfree(fh);
 
         if (--cam->open_count == 0) {
                 cpia2_free_buffers(cam);
                 if (!cam->present) {
                         video_unregister_device(dev);
-                        mutex_unlock(&cam->busy_lock);
                         kfree(cam);
                         return 0;
                 }
         }
 
-        mutex_unlock(&cam->busy_lock);
-
         return 0;
 }
 
@@ -405,11 +377,11 @@ static int sync(struct camera_data *cam, int frame_nr)
                         return 0;
                 }
 
-                mutex_unlock(&cam->busy_lock);
+                mutex_unlock(&cam->v4l2_lock);
                 wait_event_interruptible(cam->wq_stream,
                                          !cam->streaming ||
                                          frame->status == FRAME_READY);
-                mutex_lock(&cam->busy_lock);
+                mutex_lock(&cam->v4l2_lock);
                 if (signal_pending(current))
                         return -ERESTARTSYS;
                 if(!cam->present)
@@ -1293,11 +1265,11 @@ static int ioctl_dqbuf(void *arg,struct camera_data *cam, struct file *file)
         if(frame < 0) {
                 /* Wait for a frame to become available */
                 struct framebuf *cb=cam->curbuff;
-                mutex_unlock(&cam->busy_lock);
+                mutex_unlock(&cam->v4l2_lock);
                 wait_event_interruptible(cam->wq_stream,
                                          !cam->present ||
                                          (cb=cam->curbuff)->status == FRAME_READY);
-                mutex_lock(&cam->busy_lock);
+                mutex_lock(&cam->v4l2_lock);
                 if (signal_pending(current))
                         return -ERESTARTSYS;
                 if(!cam->present)
@@ -1337,14 +1309,8 @@ static long cpia2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
         if (!cam)
                 return -ENOTTY;
 
-        /* make this _really_ smp-safe */
-        if (mutex_lock_interruptible(&cam->busy_lock))
-                return -ERESTARTSYS;
-
-        if (!cam->present) {
-                mutex_unlock(&cam->busy_lock);
+        if (!cam->present)
                 return -ENODEV;
-        }
 
         /* Priority check */
         switch (cmd) {
@@ -1352,10 +1318,8 @@ static long cpia2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
         {
                 struct cpia2_fh *fh = file->private_data;
                 retval = v4l2_prio_check(&cam->prio, fh->prio);
-                if(retval) {
-                        mutex_unlock(&cam->busy_lock);
+                if (retval)
                         return retval;
-                }
                 break;
         }
         default:
@@ -1529,7 +1493,6 @@ static long cpia2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
                 break;
         }
 
-        mutex_unlock(&cam->busy_lock);
         return retval;
 }
 
@@ -1596,7 +1559,7 @@ static const struct v4l2_file_operations cpia2_fops = {
         .release        = cpia2_close,
         .read           = cpia2_v4l_read,
         .poll           = cpia2_v4l_poll,
-        .ioctl          = cpia2_ioctl,
+        .unlocked_ioctl = cpia2_ioctl,
         .mmap           = cpia2_mmap,
 };
 
@@ -1620,6 +1583,7 @@ int cpia2_register_camera(struct camera_data *cam)
 
         memcpy(cam->vdev, &cpia2_template, sizeof(cpia2_template));
         video_set_drvdata(cam->vdev, cam);
+        cam->vdev->lock = &cam->v4l2_lock;
 
         reset_camera_struct_v4l(cam);
 
diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
index 133ec2bac18..944af8adbe0 100644
--- a/drivers/media/video/cx18/cx18-driver.c
+++ b/drivers/media/video/cx18/cx18-driver.c
@@ -664,7 +664,7 @@ static int __devinit cx18_create_in_workq(struct cx18 *cx)
 {
         snprintf(cx->in_workq_name, sizeof(cx->in_workq_name), "%s-in",
                  cx->v4l2_dev.name);
-        cx->in_work_queue = create_singlethread_workqueue(cx->in_workq_name);
+        cx->in_work_queue = alloc_ordered_workqueue(cx->in_workq_name, 0);
         if (cx->in_work_queue == NULL) {
                 CX18_ERR("Unable to create incoming mailbox handler thread\n");
                 return -ENOMEM;
@@ -672,18 +672,6 @@ static int __devinit cx18_create_in_workq(struct cx18 *cx)
         return 0;
 }
 
-static int __devinit cx18_create_out_workq(struct cx18 *cx)
-{
-        snprintf(cx->out_workq_name, sizeof(cx->out_workq_name), "%s-out",
-                 cx->v4l2_dev.name);
-        cx->out_work_queue = create_workqueue(cx->out_workq_name);
-        if (cx->out_work_queue == NULL) {
-                CX18_ERR("Unable to create outgoing mailbox handler threads\n");
-                return -ENOMEM;
-        }
-        return 0;
-}
-
 static void __devinit cx18_init_in_work_orders(struct cx18 *cx)
 {
         int i;
@@ -710,15 +698,9 @@ static int __devinit cx18_init_struct1(struct cx18 *cx)
         mutex_init(&cx->epu2apu_mb_lock);
         mutex_init(&cx->epu2cpu_mb_lock);
 
-        ret = cx18_create_out_workq(cx);
-        if (ret)
-                return ret;
-
         ret = cx18_create_in_workq(cx);
-        if (ret) {
-                destroy_workqueue(cx->out_work_queue);
+        if (ret)
                 return ret;
-        }
 
         cx18_init_in_work_orders(cx);
 
@@ -1107,7 +1089,6 @@ free_mem:
         release_mem_region(cx->base_addr, CX18_MEM_SIZE);
 free_workqueues:
         destroy_workqueue(cx->in_work_queue);
-        destroy_workqueue(cx->out_work_queue);
 err:
         if (retval == 0)
                 retval = -ENODEV;
@@ -1259,7 +1240,6 @@ static void cx18_remove(struct pci_dev *pci_dev)
         cx18_halt_firmware(cx);
 
         destroy_workqueue(cx->in_work_queue);
-        destroy_workqueue(cx->out_work_queue);
 
         cx18_streams_cleanup(cx, 1);
 
diff --git a/drivers/media/video/cx18/cx18-driver.h b/drivers/media/video/cx18/cx18-driver.h
index f6f3e50d4bd..306caac6d3f 100644
--- a/drivers/media/video/cx18/cx18-driver.h
+++ b/drivers/media/video/cx18/cx18-driver.h
@@ -617,9 +617,6 @@ struct cx18 {
         struct cx18_in_work_order in_work_order[CX18_MAX_IN_WORK_ORDERS];
         char epu_debug_str[256]; /* CX18_EPU_DEBUG is rare: use shared space */
 
-        struct workqueue_struct *out_work_queue;
-        char out_workq_name[12]; /* "cx18-NN-out" */
-
         /* i2c */
         struct i2c_adapter i2c_adap[2];
         struct i2c_algo_bit_data i2c_algo[2];
diff --git a/drivers/media/video/cx18/cx18-streams.h b/drivers/media/video/cx18/cx18-streams.h
index 51765eb12d3..713b0e61536 100644
--- a/drivers/media/video/cx18/cx18-streams.h
+++ b/drivers/media/video/cx18/cx18-streams.h
@@ -42,8 +42,7 @@ static inline bool cx18_stream_enabled(struct cx18_stream *s)
 /* Related to submission of mdls to firmware */
 static inline void cx18_stream_load_fw_queue(struct cx18_stream *s)
 {
-        struct cx18 *cx = s->cx;
-        queue_work(cx->out_work_queue, &s->out_work_order);
+        schedule_work(&s->out_work_order);
 }
 
 static inline void cx18_stream_put_mdl_fw(struct cx18_stream *s,
diff --git a/drivers/media/video/cx231xx/cx231xx-dvb.c b/drivers/media/video/cx231xx/cx231xx-dvb.c
index fe59a1c3f06..363aa600422 100644
--- a/drivers/media/video/cx231xx/cx231xx-dvb.c
+++ b/drivers/media/video/cx231xx/cx231xx-dvb.c
@@ -28,7 +28,6 @@
 #include <media/videobuf-vmalloc.h>
 
 #include "xc5000.h"
-#include "dvb_dummy_fe.h"
 #include "s5h1432.h"
 #include "tda18271.h"
 #include "s5h1411.h"
@@ -619,7 +618,7 @@ static int dvb_init(struct cx231xx *dev)
 
                 if (dev->dvb->frontend == NULL) {
                         printk(DRIVER_NAME
-                               ": Failed to attach dummy front end\n");
+                               ": Failed to attach s5h1411 front end\n");
                         result = -EINVAL;
                         goto out_free;
                 }
@@ -665,7 +664,7 @@ static int dvb_init(struct cx231xx *dev)
 
                 if (dev->dvb->frontend == NULL) {
                         printk(DRIVER_NAME
-                               ": Failed to attach dummy front end\n");
+                               ": Failed to attach s5h1411 front end\n");
                         result = -EINVAL;
                         goto out_free;
                 }
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index f16461844c5..6fc09dd41b9 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1682,20 +1682,6 @@ static int cx25840_log_status(struct v4l2_subdev *sd)
         return 0;
 }
 
-static int cx25840_s_config(struct v4l2_subdev *sd, int irq, void *platform_data)
-{
-        struct cx25840_state *state = to_state(sd);
-        struct i2c_client *client = v4l2_get_subdevdata(sd);
-
-        if (platform_data) {
-                struct cx25840_platform_data *pdata = platform_data;
-
-                state->pvr150_workaround = pdata->pvr150_workaround;
-                set_input(client, state->vid_input, state->aud_input);
-        }
-        return 0;
-}
-
 static int cx23885_irq_handler(struct v4l2_subdev *sd, u32 status,
                                bool *handled)
 {
@@ -1787,7 +1773,6 @@ static const struct v4l2_ctrl_ops cx25840_ctrl_ops = {
 
 static const struct v4l2_subdev_core_ops cx25840_core_ops = {
         .log_status = cx25840_log_status,
-        .s_config = cx25840_s_config,
         .g_chip_ident = cx25840_g_chip_ident,
         .g_ctrl = v4l2_subdev_g_ctrl,
         .s_ctrl = v4l2_subdev_s_ctrl,
@@ -1974,7 +1959,6 @@ static int cx25840_probe(struct i2c_client *client,
         state->vid_input = CX25840_COMPOSITE7;
         state->aud_input = CX25840_AUDIO8;
         state->audclk_freq = 48000;
-        state->pvr150_workaround = 0;
         state->audmode = V4L2_TUNER_MODE_LANG1;
         state->vbi_line_offset = 8;
         state->id = id;
@@ -2034,6 +2018,12 @@ static int cx25840_probe(struct i2c_client *client,
         v4l2_ctrl_cluster(2, &state->volume);
         v4l2_ctrl_handler_setup(&state->hdl);
 
+        if (client->dev.platform_data) {
+                struct cx25840_platform_data *pdata = client->dev.platform_data;
+
+                state->pvr150_workaround = pdata->pvr150_workaround;
+        }
+
         cx25840_ir_probe(sd);
         return 0;
 }
diff --git a/drivers/media/video/davinci/vpif.c b/drivers/media/video/davinci/vpif.c
index 1f532e31cd4..9f3bfc1eb24 100644
--- a/drivers/media/video/davinci/vpif.c
+++ b/drivers/media/video/davinci/vpif.c
@@ -41,6 +41,183 @@ spinlock_t vpif_lock;
 
 void __iomem *vpif_base;
 
+/**
+ * ch_params: video standard configuration parameters for vpif
+ * The table must include all presets from supported subdevices.
+ */
+const struct vpif_channel_config_params ch_params[] = {
+        /* HDTV formats */
+        {
+                .name = "480p59_94",
+                .width = 720,
+                .height = 480,
+                .frm_fmt = 1,
+                .ycmux_mode = 0,
+                .eav2sav = 138-8,
+                .sav2eav = 720,
+                .l1 = 1,
+                .l3 = 43,
+                .l5 = 523,
+                .vsize = 525,
+                .capture_format = 0,
+                .vbi_supported = 0,
+                .hd_sd = 1,
+                .dv_preset = V4L2_DV_480P59_94,
+        },
+        {
+                .name = "576p50",
+                .width = 720,
+                .height = 576,
+                .frm_fmt = 1,
+                .ycmux_mode = 0,
+                .eav2sav = 144-8,
+                .sav2eav = 720,
+                .l1 = 1,
+                .l3 = 45,
+                .l5 = 621,
+                .vsize = 625,
+                .capture_format = 0,
+                .vbi_supported = 0,
+                .hd_sd = 1,
+                .dv_preset = V4L2_DV_576P50,
+        },
+        {
+                .name = "720p50",
+                .width = 1280,
+                .height = 720,
+                .frm_fmt = 1,
+                .ycmux_mode = 0,
+                .eav2sav = 700-8,
+                .sav2eav = 1280,
+                .l1 = 1,
+                .l3 = 26,
+                .l5 = 746,
+                .vsize = 750,
+                .capture_format = 0,
+                .vbi_supported = 0,
+                .hd_sd = 1,
+                .dv_preset = V4L2_DV_720P50,
+        },
+        {
+                .name = "720p60",
+                .width = 1280,
+                .height = 720,
+                .frm_fmt = 1,
+                .ycmux_mode = 0,
+                .eav2sav = 370 - 8,
+                .sav2eav = 1280,
+                .l1 = 1,
+                .l3 = 26,
+                .l5 = 746,
+                .vsize = 750,
+                .capture_format = 0,
+                .vbi_supported = 0,
+                .hd_sd = 1,
+                .dv_preset = V4L2_DV_720P60,
+        },
+        {
+                .name = "1080I50",
+                .width = 1920,
+                .height = 1080,
+                .frm_fmt = 0,
+                .ycmux_mode = 0,
+                .eav2sav = 720 - 8,
+                .sav2eav = 1920,
+                .l1 = 1,
+                .l3 = 21,
+                .l5 = 561,
+                .l7 = 563,
+                .l9 = 584,
+                .l11 = 1124,
+                .vsize = 1125,
+                .capture_format = 0,
+                .vbi_supported = 0,
+                .hd_sd = 1,
+                .dv_preset = V4L2_DV_1080I50,
+        },
+        {
+                .name = "1080I60",
+                .width = 1920,
+                .height = 1080,
+                .frm_fmt = 0,
+                .ycmux_mode = 0,
+                .eav2sav = 280 - 8,
+                .sav2eav = 1920,
+                .l1 = 1,
+                .l3 = 21,
+                .l5 = 561,
+                .l7 = 563,
+                .l9 = 584,
+                .l11 = 1124,
+                .vsize = 1125,
+                .capture_format = 0,
+                .vbi_supported = 0,
+                .hd_sd = 1,
+                .dv_preset = V4L2_DV_1080I60,
+        },
+        {
+                .name = "1080p60",
+                .width = 1920,
+                .height = 1080,
+                .frm_fmt = 1,
+                .ycmux_mode = 0,
+                .eav2sav = 280 - 8,
+                .sav2eav = 1920,
+                .l1 = 1,
+                .l3 = 42,
+                .l5 = 1122,
+                .vsize = 1125,
+                .capture_format = 0,
+                .vbi_supported = 0,
+                .hd_sd = 1,
+                .dv_preset = V4L2_DV_1080P60,
+        },
+
+        /* SDTV formats */
+        {
+                .name = "NTSC_M",
+                .width = 720,
+                .height = 480,
+                .frm_fmt = 0,
+                .ycmux_mode = 1,
+                .eav2sav = 268,
+                .sav2eav = 1440,
+                .l1 = 1,
+                .l3 = 23,
+                .l5 = 263,
+                .l7 = 266,
+                .l9 = 286,
+                .l11 = 525,
+                .vsize = 525,
+                .capture_format = 0,
+                .vbi_supported = 1,
+                .hd_sd = 0,
+                .stdid = V4L2_STD_525_60,
+        },
+        {
+                .name = "PAL_BDGHIK",
+                .width = 720,
+                .height = 576,
+                .frm_fmt = 0,
+                .ycmux_mode = 1,
+                .eav2sav = 280,
+                .sav2eav = 1440,
+                .l1 = 1,
+                .l3 = 23,
+                .l5 = 311,
+                .l7 = 313,
+                .l9 = 336,
+                .l11 = 624,
+                .vsize = 625,
+                .capture_format = 0,
+                .vbi_supported = 1,
+                .hd_sd = 0,
+                .stdid = V4L2_STD_625_50,
+        },
+};
+
+const unsigned int vpif_ch_params_count = ARRAY_SIZE(ch_params);
+
 static inline void vpif_wr_bit(u32 reg, u32 bit, u32 val)
 {
         if (val)
diff --git a/drivers/media/video/davinci/vpif.h b/drivers/media/video/davinci/vpif.h
index ebd5c4338eb..10550bd93b0 100644
--- a/drivers/media/video/davinci/vpif.h
+++ b/drivers/media/video/davinci/vpif.h
@@ -577,12 +577,10 @@ struct vpif_channel_config_params {
         char name[VPIF_MAX_NAME];       /* Name of the mode */
         u16 width;                      /* Indicates width of the image */
         u16 height;                     /* Indicates height of the image */
-        u8 fps;
-        u8 frm_fmt;                     /* Indicates whether this is interlaced
-                                         * or progressive format */
-        u8 ycmux_mode;                  /* Indicates whether this mode requires
-                                         * single or two channels */
-        u16 eav2sav;                    /* length of sav 2 eav */
+        u8 frm_fmt;                     /* Interlaced (0) or progressive (1) */
+        u8 ycmux_mode;                  /* This mode requires one (0) or two (1)
+                                           channels */
+        u16 eav2sav;                    /* length of eav 2 sav */
         u16 sav2eav;                    /* length of sav 2 eav */
         u16 l1, l3, l5, l7, l9, l11;    /* Other parameter configurations */
         u16 vsize;                      /* Vertical size of the image */
@@ -590,10 +588,14 @@ struct vpif_channel_config_params {
                                          * is in BT or in CCD/CMOS */
         u8  vbi_supported;              /* Indicates whether this mode
                                          * supports capturing vbi or not */
-        u8 hd_sd;
-        v4l2_std_id stdid;
+        u8 hd_sd;                       /* HDTV (1) or SDTV (0) format */
+        v4l2_std_id stdid;              /* SDTV format */
+        u32 dv_preset;                  /* HDTV format */
 };
 
+extern const unsigned int vpif_ch_params_count;
+extern const struct vpif_channel_config_params ch_params[];
+
 struct vpif_video_params;
 struct vpif_params;
 struct vpif_vbi_params;
diff --git a/drivers/media/video/davinci/vpif_capture.c b/drivers/media/video/davinci/vpif_capture.c
index 193abab6b35..d93ad74a34c 100644
--- a/drivers/media/video/davinci/vpif_capture.c
+++ b/drivers/media/video/davinci/vpif_capture.c
@@ -37,6 +37,7 @@
 #include <linux/slab.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-ioctl.h>
+#include <media/v4l2-chip-ident.h>
 
 #include "vpif_capture.h"
 #include "vpif.h"
@@ -81,20 +82,6 @@ static struct vpif_device vpif_obj = { {NULL} };
 static struct device *vpif_dev;
 
 /**
- * ch_params: video standard configuration parameters for vpif
- */
-static const struct vpif_channel_config_params ch_params[] = {
-        {
-                "NTSC_M", 720, 480, 30, 0, 1, 268, 1440, 1, 23, 263, 266,
-                286, 525, 525, 0, 1, 0, V4L2_STD_525_60,
-        },
-        {
-                "PAL_BDGHIK", 720, 576, 25, 0, 1, 280, 1440, 1, 23, 311, 313,
-                336, 624, 625, 0, 1, 0, V4L2_STD_625_50,
-        },
-};
-
-/**
  * vpif_uservirt_to_phys : translate user/virtual address to phy address
  * @virtp: user/virtual address
  *
@@ -342,7 +329,7 @@ static void vpif_schedule_next_buffer(struct common_obj *common)
  * @dev_id: dev_id ptr
  *
  * It changes status of the captured buffer, takes next buffer from the queue
- * and sets its address in VPIF  registers
+ * and sets its address in VPIF registers
  */
 static irqreturn_t vpif_channel_isr(int irq, void *dev_id)
 {
@@ -435,24 +422,31 @@ static int vpif_update_std_info(struct channel_obj *ch)
         struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];
         struct vpif_params *vpifparams = &ch->vpifparams;
         const struct vpif_channel_config_params *config;
-        struct vpif_channel_config_params *std_info;
+        struct vpif_channel_config_params *std_info = &vpifparams->std_info;
         struct video_obj *vid_ch = &ch->video;
         int index;
 
         vpif_dbg(2, debug, "vpif_update_std_info\n");
 
-        std_info = &vpifparams->std_info;
-
-        for (index = 0; index < ARRAY_SIZE(ch_params); index++) {
+        for (index = 0; index < vpif_ch_params_count; index++) {
                 config = &ch_params[index];
-                if (config->stdid & vid_ch->stdid) {
-                        memcpy(std_info, config, sizeof(*config));
-                        break;
+                if (config->hd_sd == 0) {
+                        vpif_dbg(2, debug, "SD format\n");
+                        if (config->stdid & vid_ch->stdid) {
+                                memcpy(std_info, config, sizeof(*config));
+                                break;
+                        }
+                } else {
+                        vpif_dbg(2, debug, "HD format\n");
+                        if (config->dv_preset == vid_ch->dv_preset) {
+                                memcpy(std_info, config, sizeof(*config));
+                                break;
+                        }
                 }
         }
 
         /* standard not found */
-        if (index == ARRAY_SIZE(ch_params))
+        if (index == vpif_ch_params_count)
                 return -EINVAL;
 
         common->fmt.fmt.pix.width = std_info->width;
@@ -462,6 +456,7 @@ static int vpif_update_std_info(struct channel_obj *ch)
         common->fmt.fmt.pix.bytesperline = std_info->width;
         vpifparams->video_params.hpitch = std_info->width;
         vpifparams->video_params.storage_mode = std_info->frm_fmt;
+
         return 0;
 }
 
@@ -757,7 +752,7 @@ static int vpif_open(struct file *filep)
         struct video_obj *vid_ch;
         struct channel_obj *ch;
         struct vpif_fh *fh;
-        int i, ret = 0;
+        int i;
 
         vpif_dbg(2, debug, "vpif_open\n");
 
@@ -766,9 +761,6 @@ static int vpif_open(struct file *filep)
         vid_ch = &ch->video;
         common = &ch->common[VPIF_VIDEO_INDEX];
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         if (NULL == ch->curr_subdev_info) {
                 /**
                  * search through the sub device to see a registered
@@ -785,8 +777,7 @@ static int vpif_open(struct file *filep)
                 }
                 if (i == config->subdev_count) {
                         vpif_err("No sub device registered\n");
-                        ret = -ENOENT;
-                        goto exit;
+                        return -ENOENT;
                 }
         }
 
@@ -794,8 +785,7 @@ static int vpif_open(struct file *filep)
         fh = kzalloc(sizeof(struct vpif_fh), GFP_KERNEL);
         if (NULL == fh) {
                 vpif_err("unable to allocate memory for file handle object\n");
-                ret = -ENOMEM;
-                goto exit;
+                return -ENOMEM;
         }
 
         /* store pointer to fh in private_data member of filep */
@@ -815,9 +805,7 @@ static int vpif_open(struct file *filep)
         /* Initialize priority of this instance to default priority */
         fh->prio = V4L2_PRIORITY_UNSET;
         v4l2_prio_open(&ch->prio, &fh->prio);
-exit:
-        mutex_unlock(&common->lock);
-        return ret;
+        return 0;
 }
 
 /**
@@ -837,9 +825,6 @@ static int vpif_release(struct file *filep)
 
         common = &ch->common[VPIF_VIDEO_INDEX];
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         /* if this instance is doing IO */
         if (fh->io_allowed[VPIF_VIDEO_INDEX]) {
                 /* Reset io_usrs member of channel object */
@@ -863,9 +848,6 @@ static int vpif_release(struct file *filep)
         /* Decrement channel usrs counter */
         ch->usrs--;
 
-        /* unlock mutex on channel object */
-        mutex_unlock(&common->lock);
-
         /* Close the priority */
         v4l2_prio_close(&ch->prio, fh->prio);
 
@@ -890,7 +872,6 @@ static int vpif_reqbufs(struct file *file, void *priv,
         struct channel_obj *ch = fh->channel;
         struct common_obj *common;
         u8 index = 0;
-        int ret = 0;
 
         vpif_dbg(2, debug, "vpif_reqbufs\n");
 
@@ -913,13 +894,8 @@ static int vpif_reqbufs(struct file *file, void *priv,
 
         common = &ch->common[index];
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
-        if (0 != common->io_usrs) {
-                ret = -EBUSY;
-                goto reqbuf_exit;
-        }
+        if (0 != common->io_usrs)
+                return -EBUSY;
 
         /* Initialize videobuf queue as per the buffer type */
         videobuf_queue_dma_contig_init(&common->buffer_queue,
@@ -928,7 +904,7 @@ static int vpif_reqbufs(struct file *file, void *priv,
                                             reqbuf->type,
                                             common->fmt.fmt.pix.field,
                                             sizeof(struct videobuf_buffer), fh,
-                                            NULL);
+                                            &common->lock);
 
         /* Set io allowed member of file handle to TRUE */
         fh->io_allowed[index] = 1;
@@ -939,11 +915,7 @@ static int vpif_reqbufs(struct file *file, void *priv,
         INIT_LIST_HEAD(&common->dma_queue);
 
         /* Allocate buffers */
-        ret = videobuf_reqbufs(&common->buffer_queue, reqbuf);
-
-reqbuf_exit:
-        mutex_unlock(&common->lock);
-        return ret;
+        return videobuf_reqbufs(&common->buffer_queue, reqbuf);
 }
 
 /**
@@ -1157,11 +1129,6 @@ static int vpif_streamon(struct file *file, void *priv,
                 return ret;
         }
 
-        if (mutex_lock_interruptible(&common->lock)) {
-                ret = -ERESTARTSYS;
-                goto streamoff_exit;
-        }
-
         /* If buffer queue is empty, return error */
         if (list_empty(&common->dma_queue)) {
                 vpif_dbg(1, debug, "buffer queue is empty\n");
@@ -1240,13 +1207,10 @@ static int vpif_streamon(struct file *file, void *priv,
                 enable_channel1(1);
         }
         channel_first_int[VPIF_VIDEO_INDEX][ch->channel_id] = 1;
-        mutex_unlock(&common->lock);
         return ret;
 
 exit:
-        mutex_unlock(&common->lock);
-streamoff_exit:
-        ret = videobuf_streamoff(&common->buffer_queue);
+        videobuf_streamoff(&common->buffer_queue);
         return ret;
 }
 
@@ -1284,9 +1248,6 @@ static int vpif_streamoff(struct file *file, void *priv,
                 return -EINVAL;
         }
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         /* disable channel */
         if (VPIF_CHANNEL0_VIDEO == ch->channel_id) {
                 enable_channel0(0);
@@ -1304,8 +1265,6 @@ static int vpif_streamoff(struct file *file, void *priv,
         if (ret && (ret != -ENOIOCTLCMD))
                 vpif_dbg(1, debug, "stream off failed in subdev\n");
 
-        mutex_unlock(&common->lock);
-
         return videobuf_streamoff(&common->buffer_queue);
 }
 
@@ -1381,21 +1340,16 @@ static int vpif_querystd(struct file *file, void *priv, v4l2_std_id *std_id)
 {
         struct vpif_fh *fh = priv;
         struct channel_obj *ch = fh->channel;
-        struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];
         int ret = 0;
 
         vpif_dbg(2, debug, "vpif_querystd\n");
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         /* Call querystd function of decoder device */
         ret = v4l2_subdev_call(vpif_obj.sd[ch->curr_sd_index], video,
                                 querystd, std_id);
         if (ret < 0)
                 vpif_dbg(1, debug, "Failed to set standard for sub devices\n");
 
-        mutex_unlock(&common->lock);
         return ret;
 }
 
@@ -1451,16 +1405,14 @@ static int vpif_s_std(struct file *file, void *priv, v4l2_std_id *std_id)
         fh->initialized = 1;
 
         /* Call encoder subdevice function to set the standard */
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         ch->video.stdid = *std_id;
+        ch->video.dv_preset = V4L2_DV_INVALID;
+        memset(&ch->video.bt_timings, 0, sizeof(ch->video.bt_timings));
 
         /* Get the information about the standard */
         if (vpif_update_std_info(ch)) {
-                ret = -EINVAL;
                 vpif_err("Error getting the standard info\n");
-                goto s_std_exit;
+                return -EINVAL;
         }
 
         /* Configure the default format information */
@@ -1471,9 +1423,6 @@ static int vpif_s_std(struct file *file, void *priv, v4l2_std_id *std_id)
                                 s_std, *std_id);
         if (ret < 0)
                 vpif_dbg(1, debug, "Failed to set standard for sub devices\n");
-
-s_std_exit:
-        mutex_unlock(&common->lock);
         return ret;
 }
 
@@ -1567,9 +1516,6 @@ static int vpif_s_input(struct file *file, void *priv, unsigned int index)
                 return -EINVAL;
         }
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         /* first setup input path from sub device to vpif */
         if (config->setup_input_path) {
                 ret = config->setup_input_path(ch->channel_id,
@@ -1578,7 +1524,7 @@ static int vpif_s_input(struct file *file, void *priv, unsigned int index)
                         vpif_dbg(1, debug, "couldn't setup input path for the"
                                 " sub device %s, for input index %d\n",
                                 subdev_info->name, index);
-                        goto exit;
+                        return ret;
                 }
         }
 
@@ -1589,7 +1535,7 @@ static int vpif_s_input(struct file *file, void *priv, unsigned int index)
                                         input, output, 0);
                 if (ret < 0) {
                         vpif_dbg(1, debug, "Failed to set input\n");
-                        goto exit;
+                        return ret;
                 }
         }
         vid_ch->input_idx = index;
@@ -1600,9 +1546,6 @@ static int vpif_s_input(struct file *file, void *priv, unsigned int index)
 
         /* update tvnorms from the sub device input info */
         ch->video_dev->tvnorms = chan_cfg->inputs[index].input.std;
-
-exit:
-        mutex_unlock(&common->lock);
         return ret;
 }
 
@@ -1671,11 +1614,7 @@ static int vpif_g_fmt_vid_cap(struct file *file, void *priv,
                 return -EINVAL;
 
         /* Fill in the information about format */
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         *fmt = common->fmt;
-        mutex_unlock(&common->lock);
         return 0;
 }
 
@@ -1694,7 +1633,7 @@ static int vpif_s_fmt_vid_cap(struct file *file, void *priv,
         struct v4l2_pix_format *pixfmt;
         int ret = 0;
 
-        vpif_dbg(2, debug, "VIDIOC_S_FMT\n");
+        vpif_dbg(2, debug, "%s\n", __func__);
 
         /* If streaming is started, return error */
         if (common->started) {
@@ -1723,12 +1662,7 @@ static int vpif_s_fmt_vid_cap(struct file *file, void *priv,
         if (ret)
                 return ret;
         /* store the format in the channel object */
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         common->fmt = *fmt;
-        mutex_unlock(&common->lock);
-
         return 0;
 }
 
@@ -1807,6 +1741,306 @@ static int vpif_cropcap(struct file *file, void *priv,
         return 0;
 }
 
+/**
+ * vpif_enum_dv_presets() - ENUM_DV_PRESETS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @preset: input preset
+ */
+static int vpif_enum_dv_presets(struct file *file, void *priv,
+                struct v4l2_dv_enum_preset *preset)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+
+        return v4l2_subdev_call(vpif_obj.sd[ch->curr_sd_index],
+                        video, enum_dv_presets, preset);
+}
+
+/**
+ * vpif_query_dv_presets() - QUERY_DV_PRESET handler
+ * @file: file ptr
+ * @priv: file handle
+ * @preset: input preset
+ */
+static int vpif_query_dv_preset(struct file *file, void *priv,
+                struct v4l2_dv_preset *preset)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+
+        return v4l2_subdev_call(vpif_obj.sd[ch->curr_sd_index],
+                       video, query_dv_preset, preset);
+}
+/**
+ * vpif_s_dv_presets() - S_DV_PRESETS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @preset: input preset
+ */
+static int vpif_s_dv_preset(struct file *file, void *priv,
+                struct v4l2_dv_preset *preset)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];
+        int ret = 0;
+
+        if (common->started) {
+                vpif_dbg(1, debug, "streaming in progress\n");
+                return -EBUSY;
+        }
+
+        if ((VPIF_CHANNEL0_VIDEO == ch->channel_id) ||
+            (VPIF_CHANNEL1_VIDEO == ch->channel_id)) {
+                if (!fh->initialized) {
+                        vpif_dbg(1, debug, "Channel Busy\n");
+                        return -EBUSY;
+                }
+        }
+
+        ret = v4l2_prio_check(&ch->prio, fh->prio);
+        if (ret)
+                return ret;
+
+        fh->initialized = 1;
+
+        /* Call encoder subdevice function to set the standard */
+        if (mutex_lock_interruptible(&common->lock))
+                return -ERESTARTSYS;
+
+        ch->video.dv_preset = preset->preset;
+        ch->video.stdid = V4L2_STD_UNKNOWN;
+        memset(&ch->video.bt_timings, 0, sizeof(ch->video.bt_timings));
+
+        /* Get the information about the standard */
+        if (vpif_update_std_info(ch)) {
+                vpif_dbg(1, debug, "Error getting the standard info\n");
+                ret = -EINVAL;
+        } else {
+                /* Configure the default format information */
+                vpif_config_format(ch);
+
+                ret = v4l2_subdev_call(vpif_obj.sd[ch->curr_sd_index],
+                                video, s_dv_preset, preset);
+        }
+
+        mutex_unlock(&common->lock);
+
+        return ret;
+}
+/**
+ * vpif_g_dv_presets() - G_DV_PRESETS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @preset: input preset
+ */
+static int vpif_g_dv_preset(struct file *file, void *priv,
+                struct v4l2_dv_preset *preset)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+
+        preset->preset = ch->video.dv_preset;
+
+        return 0;
+}
+
+/**
+ * vpif_s_dv_timings() - S_DV_TIMINGS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @timings: digital video timings
+ */
+static int vpif_s_dv_timings(struct file *file, void *priv,
+                struct v4l2_dv_timings *timings)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct vpif_params *vpifparams = &ch->vpifparams;
+        struct vpif_channel_config_params *std_info = &vpifparams->std_info;
+        struct video_obj *vid_ch = &ch->video;
+        struct v4l2_bt_timings *bt = &vid_ch->bt_timings;
+        int ret;
+
+        if (timings->type != V4L2_DV_BT_656_1120) {
+                vpif_dbg(2, debug, "Timing type not defined\n");
+                return -EINVAL;
+        }
+
+        /* Configure subdevice timings, if any */
+        ret = v4l2_subdev_call(vpif_obj.sd[ch->curr_sd_index],
+                        video, s_dv_timings, timings);
+        if (ret == -ENOIOCTLCMD) {
+                vpif_dbg(2, debug, "Custom DV timings not supported by "
+                                "subdevice\n");
+                return -EINVAL;
+        }
+        if (ret < 0) {
+                vpif_dbg(2, debug, "Error setting custom DV timings\n");
+                return ret;
+        }
+
+        if (!(timings->bt.width && timings->bt.height &&
+                                (timings->bt.hbackporch ||
+                                 timings->bt.hfrontporch ||
+                                 timings->bt.hsync) &&
+                                timings->bt.vfrontporch &&
+                                (timings->bt.vbackporch ||
+                                 timings->bt.vsync))) {
+                vpif_dbg(2, debug, "Timings for width, height, "
+                                "horizontal back porch, horizontal sync, "
+                                "horizontal front porch, vertical back porch, "
+                                "vertical sync and vertical back porch "
+                                "must be defined\n");
+                return -EINVAL;
+        }
+
+        *bt = timings->bt;
+
+        /* Configure video port timings */
+
+        std_info->eav2sav = bt->hbackporch + bt->hfrontporch +
+                bt->hsync - 8;
+        std_info->sav2eav = bt->width;
+
+        std_info->l1 = 1;
+        std_info->l3 = bt->vsync + bt->vbackporch + 1;
+
+        if (bt->interlaced) {
+                if (bt->il_vbackporch || bt->il_vfrontporch || bt->il_vsync) {
+                        std_info->vsize = bt->height * 2 +
+                                bt->vfrontporch + bt->vsync + bt->vbackporch +
+                                bt->il_vfrontporch + bt->il_vsync +
+                                bt->il_vbackporch;
+                        std_info->l5 = std_info->vsize/2 -
+                                (bt->vfrontporch - 1);
+                        std_info->l7 = std_info->vsize/2 + 1;
+                        std_info->l9 = std_info->l7 + bt->il_vsync +
+                                bt->il_vbackporch + 1;
+                        std_info->l11 = std_info->vsize -
+                                (bt->il_vfrontporch - 1);
+                } else {
+                        vpif_dbg(2, debug, "Required timing values for "
+                                        "interlaced BT format missing\n");
+                        return -EINVAL;
+                }
+        } else {
+                std_info->vsize = bt->height + bt->vfrontporch +
+                        bt->vsync + bt->vbackporch;
+                std_info->l5 = std_info->vsize - (bt->vfrontporch - 1);
+        }
+        strncpy(std_info->name, "Custom timings BT656/1120", VPIF_MAX_NAME);
+        std_info->width = bt->width;
+        std_info->height = bt->height;
+        std_info->frm_fmt = bt->interlaced ? 0 : 1;
+        std_info->ycmux_mode = 0;
+        std_info->capture_format = 0;
+        std_info->vbi_supported = 0;
+        std_info->hd_sd = 1;
+        std_info->stdid = 0;
+        std_info->dv_preset = V4L2_DV_INVALID;
+
+        vid_ch->stdid = 0;
+        vid_ch->dv_preset = V4L2_DV_INVALID;
+        return 0;
+}
+
+/**
+ * vpif_g_dv_timings() - G_DV_TIMINGS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @timings: digital video timings
+ */
+static int vpif_g_dv_timings(struct file *file, void *priv,
+                struct v4l2_dv_timings *timings)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct video_obj *vid_ch = &ch->video;
+        struct v4l2_bt_timings *bt = &vid_ch->bt_timings;
+
+        timings->bt = *bt;
+
+        return 0;
+}
+
+/*
+ * vpif_g_chip_ident() - Identify the chip
+ * @file: file ptr
+ * @priv: file handle
+ * @chip: chip identity
+ *
+ * Returns zero or -EINVAL if read operations fails.
+ */
+static int vpif_g_chip_ident(struct file *file, void *priv,
+                struct v4l2_dbg_chip_ident *chip)
+{
+        chip->ident = V4L2_IDENT_NONE;
+        chip->revision = 0;
+        if (chip->match.type != V4L2_CHIP_MATCH_I2C_DRIVER &&
+                        chip->match.type != V4L2_CHIP_MATCH_I2C_ADDR) {
+                vpif_dbg(2, debug, "match_type is invalid.\n");
+                return -EINVAL;
+        }
+
+        return v4l2_device_call_until_err(&vpif_obj.v4l2_dev, 0, core,
+                        g_chip_ident, chip);
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+/*
+ * vpif_dbg_g_register() - Read register
+ * @file: file ptr
+ * @priv: file handle
+ * @reg: register to be read
+ *
+ * Debugging only
+ * Returns zero or -EINVAL if read operations fails.
+ */
+static int vpif_dbg_g_register(struct file *file, void *priv,
+                struct v4l2_dbg_register *reg){
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+
+        return v4l2_subdev_call(vpif_obj.sd[ch->curr_sd_index], core,
+                        g_register, reg);
+}
+
+/*
+ * vpif_dbg_s_register() - Write to register
+ * @file: file ptr
+ * @priv: file handle
+ * @reg: register to be modified
+ *
+ * Debugging only
+ * Returns zero or -EINVAL if write operations fails.
+ */
+static int vpif_dbg_s_register(struct file *file, void *priv,
+                struct v4l2_dbg_register *reg){
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+
+        return v4l2_subdev_call(vpif_obj.sd[ch->curr_sd_index], core,
+                        s_register, reg);
+}
+#endif
+
+/*
+ * vpif_log_status() - Status information
+ * @file: file ptr
+ * @priv: file handle
+ *
+ * Returns zero.
+ */
+static int vpif_log_status(struct file *filep, void *priv)
+{
+        /* status for sub devices */
+        v4l2_device_call_all(&vpif_obj.v4l2_dev, 0, core, log_status);
+
+        return 0;
+}
+
 /* vpif capture ioctl operations */
 static const struct v4l2_ioctl_ops vpif_ioctl_ops = {
         .vidioc_querycap                = vpif_querycap,
@@ -1829,6 +2063,18 @@ static const struct v4l2_ioctl_ops vpif_ioctl_ops = {
         .vidioc_streamon                = vpif_streamon,
         .vidioc_streamoff               = vpif_streamoff,
         .vidioc_cropcap                 = vpif_cropcap,
+        .vidioc_enum_dv_presets         = vpif_enum_dv_presets,
+        .vidioc_s_dv_preset             = vpif_s_dv_preset,
+        .vidioc_g_dv_preset             = vpif_g_dv_preset,
+        .vidioc_query_dv_preset         = vpif_query_dv_preset,
+        .vidioc_s_dv_timings            = vpif_s_dv_timings,
+        .vidioc_g_dv_timings            = vpif_g_dv_timings,
+        .vidioc_g_chip_ident            = vpif_g_chip_ident,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        .vidioc_g_register              = vpif_dbg_g_register,
+        .vidioc_s_register              = vpif_dbg_s_register,
+#endif
+        .vidioc_log_status              = vpif_log_status,
 };
 
 /* vpif file operations */
@@ -1836,7 +2082,7 @@ static struct v4l2_file_operations vpif_fops = {
         .owner = THIS_MODULE,
         .open = vpif_open,
         .release = vpif_release,
-        .ioctl = video_ioctl2,
+        .unlocked_ioctl = video_ioctl2,
         .mmap = vpif_mmap,
         .poll = vpif_poll
 };
@@ -1979,6 +2225,7 @@ static __init int vpif_probe(struct platform_device *pdev)
                 common = &(ch->common[VPIF_VIDEO_INDEX]);
                 spin_lock_init(&common->irqlock);
                 mutex_init(&common->lock);
+                ch->video_dev->lock = &common->lock;
                 /* Initialize prio member of channel object */
                 v4l2_prio_init(&ch->prio);
                 err = video_register_device(ch->video_dev,
@@ -2026,9 +2273,9 @@ static __init int vpif_probe(struct platform_device *pdev)
                 if (vpif_obj.sd[i])
                         vpif_obj.sd[i]->grp_id = 1 << i;
         }
-        v4l2_info(&vpif_obj.v4l2_dev, "DM646x VPIF Capture driver"
-                  " initialized\n");
 
+        v4l2_info(&vpif_obj.v4l2_dev,
+                        "DM646x VPIF capture driver initialized\n");
         return 0;
 
 probe_subdev_out:
diff --git a/drivers/media/video/davinci/vpif_capture.h b/drivers/media/video/davinci/vpif_capture.h
index 4e12ec8cac6..7a4196dfdce 100644
--- a/drivers/media/video/davinci/vpif_capture.h
+++ b/drivers/media/video/davinci/vpif_capture.h
@@ -59,6 +59,8 @@ struct video_obj {
         enum v4l2_field buf_field;
         /* Currently selected or default standard */
         v4l2_std_id stdid;
+        u32 dv_preset;
+        struct v4l2_bt_timings bt_timings;
         /* This is to track the last input that is passed to application */
         u32 input_idx;
 };
diff --git a/drivers/media/video/davinci/vpif_display.c b/drivers/media/video/davinci/vpif_display.c
index 412c65d54fe..cdf659abdc2 100644
--- a/drivers/media/video/davinci/vpif_display.c
+++ b/drivers/media/video/davinci/vpif_display.c
@@ -38,6 +38,7 @@
 #include <media/adv7343.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-ioctl.h>
+#include <media/v4l2-chip-ident.h>
 
 #include <mach/dm646x.h>
 
@@ -84,17 +85,6 @@ static struct vpif_config_params config_params = {
 static struct vpif_device vpif_obj = { {NULL} };
 static struct device *vpif_dev;
 
-static const struct vpif_channel_config_params ch_params[] = {
-        {
-                "NTSC", 720, 480, 30, 0, 1, 268, 1440, 1, 23, 263, 266,
-                286, 525, 525, 0, 1, 0, V4L2_STD_525_60,
-        },
-        {
-                "PAL", 720, 576, 25, 0, 1, 280, 1440, 1, 23, 311, 313,
-                336, 624, 625, 0, 1, 0, V4L2_STD_625_50,
-        },
-};
-
 /*
  * vpif_uservirt_to_phys: This function is used to convert user
  * space virtual address to physical address.
@@ -373,30 +363,54 @@ static irqreturn_t vpif_channel_isr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static int vpif_get_std_info(struct channel_obj *ch)
+static int vpif_update_std_info(struct channel_obj *ch)
 {
-        struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];
         struct video_obj *vid_ch = &ch->video;
         struct vpif_params *vpifparams = &ch->vpifparams;
         struct vpif_channel_config_params *std_info = &vpifparams->std_info;
         const struct vpif_channel_config_params *config;
 
-        int index;
-
-        std_info->stdid = vid_ch->stdid;
-        if (!std_info->stdid)
-                return -1;
+        int i;
 
-        for (index = 0; index < ARRAY_SIZE(ch_params); index++) {
-                config = &ch_params[index];
-                if (config->stdid & std_info->stdid) {
-                        memcpy(std_info, config, sizeof(*config));
-                        break;
+        for (i = 0; i < vpif_ch_params_count; i++) {
+                config = &ch_params[i];
+                if (config->hd_sd == 0) {
+                        vpif_dbg(2, debug, "SD format\n");
+                        if (config->stdid & vid_ch->stdid) {
+                                memcpy(std_info, config, sizeof(*config));
+                                break;
+                        }
+                } else {
+                        vpif_dbg(2, debug, "HD format\n");
+                        if (config->dv_preset == vid_ch->dv_preset) {
+                                memcpy(std_info, config, sizeof(*config));
+                                break;
+                        }
                 }
         }
 
-        if (index == ARRAY_SIZE(ch_params))
-                return -1;
+        if (i == vpif_ch_params_count) {
+                vpif_dbg(1, debug, "Format not found\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int vpif_update_resolution(struct channel_obj *ch)
+{
+        struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];
+        struct video_obj *vid_ch = &ch->video;
+        struct vpif_params *vpifparams = &ch->vpifparams;
+        struct vpif_channel_config_params *std_info = &vpifparams->std_info;
+
+        if (!vid_ch->stdid && !vid_ch->dv_preset && !vid_ch->bt_timings.height)
+                return -EINVAL;
+
+        if (vid_ch->stdid || vid_ch->dv_preset) {
+                if (vpif_update_std_info(ch))
+                        return -EINVAL;
+        }
 
         common->fmt.fmt.pix.width = std_info->width;
         common->fmt.fmt.pix.height = std_info->height;
@@ -404,8 +418,8 @@ static int vpif_get_std_info(struct channel_obj *ch)
                         common->fmt.fmt.pix.width, common->fmt.fmt.pix.height);
 
         /* Set height and width paramateres */
-        ch->common[VPIF_VIDEO_INDEX].height = std_info->height;
-        ch->common[VPIF_VIDEO_INDEX].width = std_info->width;
+        common->height = std_info->height;
+        common->width = std_info->width;
 
         return 0;
 }
@@ -516,10 +530,8 @@ static int vpif_check_format(struct channel_obj *ch,
         else
                 sizeimage = config_params.channel_bufsize[ch->channel_id];
 
-        if (vpif_get_std_info(ch)) {
-                vpif_err("Error getting the standard info\n");
+        if (vpif_update_resolution(ch))
                 return -EINVAL;
-        }
 
         hpitch = pixfmt->bytesperline;
         vpitch = sizeimage / (hpitch * 2);
@@ -568,7 +580,10 @@ static void vpif_config_addr(struct channel_obj *ch, int muxmode)
 static int vpif_mmap(struct file *filep, struct vm_area_struct *vma)
 {
         struct vpif_fh *fh = filep->private_data;
-        struct common_obj *common = &fh->channel->common[VPIF_VIDEO_INDEX];
+        struct channel_obj *ch = fh->channel;
+        struct common_obj *common = &(ch->common[VPIF_VIDEO_INDEX]);
+
+        vpif_dbg(2, debug, "vpif_mmap\n");
 
         return videobuf_mmap_mapper(&common->buffer_queue, vma);
 }
@@ -637,9 +652,6 @@ static int vpif_release(struct file *filep)
         struct channel_obj *ch = fh->channel;
         struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         /* if this instance is doing IO */
         if (fh->io_allowed[VPIF_VIDEO_INDEX]) {
                 /* Reset io_usrs member of channel object */
@@ -662,8 +674,6 @@ static int vpif_release(struct file *filep)
                     config_params.numbuffers[ch->channel_id];
         }
 
-        mutex_unlock(&common->lock);
-
         /* Decrement channel usrs counter */
         atomic_dec(&ch->usrs);
         /* If this file handle has initialize encoder device, reset it */
@@ -680,7 +690,12 @@ static int vpif_release(struct file *filep)
 }
 
 /* functions implementing ioctls */
-
+/**
+ * vpif_querycap() - QUERYCAP handler
+ * @file: file ptr
+ * @priv: file handle
+ * @cap: ptr to v4l2_capability structure
+ */
 static int vpif_querycap(struct file *file, void  *priv,
                                 struct v4l2_capability *cap)
 {
@@ -722,17 +737,9 @@ static int vpif_g_fmt_vid_out(struct file *file, void *priv,
         if (common->fmt.type != fmt->type)
                 return -EINVAL;
 
-        /* Fill in the information about format */
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
-        if (vpif_get_std_info(ch)) {
-                vpif_err("Error getting the standard info\n");
+        if (vpif_update_resolution(ch))
                 return -EINVAL;
-        }
-
         *fmt = common->fmt;
-        mutex_unlock(&common->lock);
         return 0;
 }
 
@@ -773,12 +780,7 @@ static int vpif_s_fmt_vid_out(struct file *file, void *priv,
         /* store the pix format in the channel object */
         common->fmt.fmt.pix = *pixfmt;
         /* store the format in the channel object */
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         common->fmt = *fmt;
-        mutex_unlock(&common->lock);
-
         return 0;
 }
 
@@ -808,7 +810,6 @@ static int vpif_reqbufs(struct file *file, void *priv,
         struct common_obj *common;
         enum v4l2_field field;
         u8 index = 0;
-        int ret = 0;
 
         /* This file handle has not initialized the channel,
            It is not allowed to do settings */
@@ -826,18 +827,12 @@ static int vpif_reqbufs(struct file *file, void *priv,
         index = VPIF_VIDEO_INDEX;
 
         common = &ch->common[index];
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
 
-        if (common->fmt.type != reqbuf->type) {
-                ret = -EINVAL;
-                goto reqbuf_exit;
-        }
+        if (common->fmt.type != reqbuf->type)
+                return -EINVAL;
 
-        if (0 != common->io_usrs) {
-                ret = -EBUSY;
-                goto reqbuf_exit;
-        }
+        if (0 != common->io_usrs)
+                return -EBUSY;
 
         if (reqbuf->type == V4L2_BUF_TYPE_VIDEO_OUTPUT) {
                 if (common->fmt.fmt.pix.field == V4L2_FIELD_ANY)
@@ -854,7 +849,7 @@ static int vpif_reqbufs(struct file *file, void *priv,
                                             &common->irqlock,
                                             reqbuf->type, field,
                                             sizeof(struct videobuf_buffer), fh,
-                                            NULL);
+                                            &common->lock);
 
         /* Set io allowed member of file handle to TRUE */
         fh->io_allowed[index] = 1;
@@ -865,11 +860,7 @@ static int vpif_reqbufs(struct file *file, void *priv,
         INIT_LIST_HEAD(&common->dma_queue);
 
         /* Allocate buffers */
-        ret = videobuf_reqbufs(&common->buffer_queue, reqbuf);
-
-reqbuf_exit:
-        mutex_unlock(&common->lock);
-        return ret;
+        return videobuf_reqbufs(&common->buffer_queue, reqbuf);
 }
 
 static int vpif_querybuf(struct file *file, void *priv,
@@ -990,22 +981,19 @@ static int vpif_s_std(struct file *file, void *priv, v4l2_std_id *std_id)
         }
 
         /* Call encoder subdevice function to set the standard */
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         ch->video.stdid = *std_id;
+        ch->video.dv_preset = V4L2_DV_INVALID;
+        memset(&ch->video.bt_timings, 0, sizeof(ch->video.bt_timings));
+
         /* Get the information about the standard */
-        if (vpif_get_std_info(ch)) {
-                vpif_err("Error getting the standard info\n");
+        if (vpif_update_resolution(ch))
                 return -EINVAL;
-        }
 
         if ((ch->vpifparams.std_info.width *
                 ch->vpifparams.std_info.height * 2) >
                 config_params.channel_bufsize[ch->channel_id]) {
                 vpif_err("invalid std for this size\n");
-                ret = -EINVAL;
-                goto s_std_exit;
+                return -EINVAL;
         }
 
         common->fmt.fmt.pix.bytesperline = common->fmt.fmt.pix.width;
@@ -1016,16 +1004,13 @@ static int vpif_s_std(struct file *file, void *priv, v4l2_std_id *std_id)
                                                 s_std_output, *std_id);
         if (ret < 0) {
                 vpif_err("Failed to set output standard\n");
-                goto s_std_exit;
+                return ret;
         }
 
         ret = v4l2_device_call_until_err(&vpif_obj.v4l2_dev, 1, core,
                                                         s_std, *std_id);
         if (ret < 0)
                 vpif_err("Failed to set standard for sub devices\n");
-
-s_std_exit:
-        mutex_unlock(&common->lock);
         return ret;
 }
 
@@ -1090,21 +1075,17 @@ static int vpif_streamon(struct file *file, void *priv,
         if (ret < 0)
                 return ret;
 
-        /* Call videobuf_streamon to start streaming  in videobuf */
+        /* Call videobuf_streamon to start streaming in videobuf */
         ret = videobuf_streamon(&common->buffer_queue);
         if (ret < 0) {
                 vpif_err("videobuf_streamon\n");
                 return ret;
         }
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         /* If buffer queue is empty, return error */
         if (list_empty(&common->dma_queue)) {
                 vpif_err("buffer queue is empty\n");
-                ret = -EIO;
-                goto streamon_exit;
+                return -EIO;
         }
 
         /* Get the next frame from the buffer queue */
@@ -1130,8 +1111,7 @@ static int vpif_streamon(struct file *file, void *priv,
                         || (!ch->vpifparams.std_info.frm_fmt
                         && (common->fmt.fmt.pix.field == V4L2_FIELD_NONE))) {
                         vpif_err("conflict in field format and std format\n");
-                        ret = -EINVAL;
-                        goto streamon_exit;
+                        return -EINVAL;
                 }
 
                 /* clock settings */
@@ -1140,13 +1120,13 @@ static int vpif_streamon(struct file *file, void *priv,
                                                 ch->vpifparams.std_info.hd_sd);
                 if (ret < 0) {
                         vpif_err("can't set clock\n");
-                        goto streamon_exit;
+                        return ret;
                 }
 
                 /* set the parameters and addresses */
                 ret = vpif_set_video_params(vpif, ch->channel_id + 2);
                 if (ret < 0)
-                        goto streamon_exit;
+                        return ret;
 
                 common->started = ret;
                 vpif_config_addr(ch, ret);
@@ -1171,9 +1151,6 @@ static int vpif_streamon(struct file *file, void *priv,
                 }
                 channel_first_int[VPIF_VIDEO_INDEX][ch->channel_id] = 1;
         }
-
-streamon_exit:
-        mutex_unlock(&common->lock);
         return ret;
 }
 
@@ -1199,9 +1176,6 @@ static int vpif_streamoff(struct file *file, void *priv,
                 return -EINVAL;
         }
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         if (buftype == V4L2_BUF_TYPE_VIDEO_OUTPUT) {
                 /* disable channel */
                 if (VPIF_CHANNEL2_VIDEO == ch->channel_id) {
@@ -1216,8 +1190,6 @@ static int vpif_streamoff(struct file *file, void *priv,
         }
 
         common->started = 0;
-        mutex_unlock(&common->lock);
-
         return videobuf_streamoff(&common->buffer_queue);
 }
 
@@ -1264,13 +1236,9 @@ static int vpif_s_output(struct file *file, void *priv, unsigned int i)
         struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];
         int ret = 0;
 
-        if (mutex_lock_interruptible(&common->lock))
-                return -ERESTARTSYS;
-
         if (common->started) {
                 vpif_err("Streaming in progress\n");
-                ret = -EBUSY;
-                goto s_output_exit;
+                return -EBUSY;
         }
 
         ret = v4l2_device_call_until_err(&vpif_obj.v4l2_dev, 1, video,
@@ -1280,9 +1248,6 @@ static int vpif_s_output(struct file *file, void *priv, unsigned int i)
                 vpif_err("Failed to set output standard\n");
 
         vid_ch->output_id = i;
-
-s_output_exit:
-        mutex_unlock(&common->lock);
         return ret;
 }
 
@@ -1315,6 +1280,287 @@ static int vpif_s_priority(struct file *file, void *priv, enum v4l2_priority p)
         return v4l2_prio_change(&ch->prio, &fh->prio, p);
 }
 
+/**
+ * vpif_enum_dv_presets() - ENUM_DV_PRESETS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @preset: input preset
+ */
+static int vpif_enum_dv_presets(struct file *file, void *priv,
+                struct v4l2_dv_enum_preset *preset)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct video_obj *vid_ch = &ch->video;
+
+        return v4l2_subdev_call(vpif_obj.sd[vid_ch->output_id],
+                        video, enum_dv_presets, preset);
+}
+
+/**
+ * vpif_s_dv_presets() - S_DV_PRESETS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @preset: input preset
+ */
+static int vpif_s_dv_preset(struct file *file, void *priv,
+                struct v4l2_dv_preset *preset)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct common_obj *common = &ch->common[VPIF_VIDEO_INDEX];
+        struct video_obj *vid_ch = &ch->video;
+        int ret = 0;
+
+        if (common->started) {
+                vpif_dbg(1, debug, "streaming in progress\n");
+                return -EBUSY;
+        }
+
+        ret = v4l2_prio_check(&ch->prio, fh->prio);
+        if (ret != 0)
+                return ret;
+
+        fh->initialized = 1;
+
+        /* Call encoder subdevice function to set the standard */
+        if (mutex_lock_interruptible(&common->lock))
+                return -ERESTARTSYS;
+
+        ch->video.dv_preset = preset->preset;
+        ch->video.stdid = V4L2_STD_UNKNOWN;
+        memset(&ch->video.bt_timings, 0, sizeof(ch->video.bt_timings));
+
+        /* Get the information about the standard */
+        if (vpif_update_resolution(ch)) {
+                ret = -EINVAL;
+        } else {
+                /* Configure the default format information */
+                vpif_config_format(ch);
+
+                ret = v4l2_subdev_call(vpif_obj.sd[vid_ch->output_id],
+                                video, s_dv_preset, preset);
+        }
+
+        mutex_unlock(&common->lock);
+
+        return ret;
+}
+/**
+ * vpif_g_dv_presets() - G_DV_PRESETS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @preset: input preset
+ */
+static int vpif_g_dv_preset(struct file *file, void *priv,
+                struct v4l2_dv_preset *preset)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+
+        preset->preset = ch->video.dv_preset;
+
+        return 0;
+}
+/**
+ * vpif_s_dv_timings() - S_DV_TIMINGS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @timings: digital video timings
+ */
+static int vpif_s_dv_timings(struct file *file, void *priv,
+                struct v4l2_dv_timings *timings)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct vpif_params *vpifparams = &ch->vpifparams;
+        struct vpif_channel_config_params *std_info = &vpifparams->std_info;
+        struct video_obj *vid_ch = &ch->video;
+        struct v4l2_bt_timings *bt = &vid_ch->bt_timings;
+        int ret;
+
+        if (timings->type != V4L2_DV_BT_656_1120) {
+                vpif_dbg(2, debug, "Timing type not defined\n");
+                return -EINVAL;
+        }
+
+        /* Configure subdevice timings, if any */
+        ret = v4l2_subdev_call(vpif_obj.sd[vid_ch->output_id],
+                        video, s_dv_timings, timings);
+        if (ret == -ENOIOCTLCMD) {
+                vpif_dbg(2, debug, "Custom DV timings not supported by "
+                                "subdevice\n");
+                return -EINVAL;
+        }
+        if (ret < 0) {
+                vpif_dbg(2, debug, "Error setting custom DV timings\n");
+                return ret;
+        }
+
+        if (!(timings->bt.width && timings->bt.height &&
+                                (timings->bt.hbackporch ||
+                                 timings->bt.hfrontporch ||
+                                 timings->bt.hsync) &&
+                                timings->bt.vfrontporch &&
+                                (timings->bt.vbackporch ||
+                                 timings->bt.vsync))) {
+                vpif_dbg(2, debug, "Timings for width, height, "
+                                "horizontal back porch, horizontal sync, "
+                                "horizontal front porch, vertical back porch, "
+                                "vertical sync and vertical back porch "
+                                "must be defined\n");
+                return -EINVAL;
+        }
+
+        *bt = timings->bt;
+
+        /* Configure video port timings */
+
+        std_info->eav2sav = bt->hbackporch + bt->hfrontporch +
+                bt->hsync - 8;
+        std_info->sav2eav = bt->width;
+
+        std_info->l1 = 1;
+        std_info->l3 = bt->vsync + bt->vbackporch + 1;
+
+        if (bt->interlaced) {
+                if (bt->il_vbackporch || bt->il_vfrontporch || bt->il_vsync) {
+                        std_info->vsize = bt->height * 2 +
+                                bt->vfrontporch + bt->vsync + bt->vbackporch +
+                                bt->il_vfrontporch + bt->il_vsync +
+                                bt->il_vbackporch;
+                        std_info->l5 = std_info->vsize/2 -
+                                (bt->vfrontporch - 1);
+                        std_info->l7 = std_info->vsize/2 + 1;
+                        std_info->l9 = std_info->l7 + bt->il_vsync +
+                                bt->il_vbackporch + 1;
+                        std_info->l11 = std_info->vsize -
+                                (bt->il_vfrontporch - 1);
+                } else {
+                        vpif_dbg(2, debug, "Required timing values for "
+                                        "interlaced BT format missing\n");
+                        return -EINVAL;
+                }
+        } else {
+                std_info->vsize = bt->height + bt->vfrontporch +
+                        bt->vsync + bt->vbackporch;
+                std_info->l5 = std_info->vsize - (bt->vfrontporch - 1);
+        }
+        strncpy(std_info->name, "Custom timings BT656/1120",
+                        VPIF_MAX_NAME);
+        std_info->width = bt->width;
+        std_info->height = bt->height;
+        std_info->frm_fmt = bt->interlaced ? 0 : 1;
+        std_info->ycmux_mode = 0;
+        std_info->capture_format = 0;
+        std_info->vbi_supported = 0;
+        std_info->hd_sd = 1;
+        std_info->stdid = 0;
+        std_info->dv_preset = V4L2_DV_INVALID;
+
+        vid_ch->stdid = 0;
+        vid_ch->dv_preset = V4L2_DV_INVALID;
+
+        return 0;
+}
+
+/**
+ * vpif_g_dv_timings() - G_DV_TIMINGS handler
+ * @file: file ptr
+ * @priv: file handle
+ * @timings: digital video timings
+ */
+static int vpif_g_dv_timings(struct file *file, void *priv,
+                struct v4l2_dv_timings *timings)
+{
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct video_obj *vid_ch = &ch->video;
+        struct v4l2_bt_timings *bt = &vid_ch->bt_timings;
+
+        timings->bt = *bt;
+
+        return 0;
+}
+
+/*
+ * vpif_g_chip_ident() - Identify the chip
+ * @file: file ptr
+ * @priv: file handle
+ * @chip: chip identity
+ *
+ * Returns zero or -EINVAL if read operations fails.
+ */
+static int vpif_g_chip_ident(struct file *file, void *priv,
+                struct v4l2_dbg_chip_ident *chip)
+{
+        chip->ident = V4L2_IDENT_NONE;
+        chip->revision = 0;
+        if (chip->match.type != V4L2_CHIP_MATCH_I2C_DRIVER &&
+                        chip->match.type != V4L2_CHIP_MATCH_I2C_ADDR) {
+                vpif_dbg(2, debug, "match_type is invalid.\n");
+                return -EINVAL;
+        }
+
+        return v4l2_device_call_until_err(&vpif_obj.v4l2_dev, 0, core,
+                        g_chip_ident, chip);
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+/*
+ * vpif_dbg_g_register() - Read register
+ * @file: file ptr
+ * @priv: file handle
+ * @reg: register to be read
+ *
+ * Debugging only
+ * Returns zero or -EINVAL if read operations fails.
+ */
+static int vpif_dbg_g_register(struct file *file, void *priv,
+                struct v4l2_dbg_register *reg){
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct video_obj *vid_ch = &ch->video;
+
+        return v4l2_subdev_call(vpif_obj.sd[vid_ch->output_id], core,
+                        g_register, reg);
+}
+
+/*
+ * vpif_dbg_s_register() - Write to register
+ * @file: file ptr
+ * @priv: file handle
+ * @reg: register to be modified
+ *
+ * Debugging only
+ * Returns zero or -EINVAL if write operations fails.
+ */
+static int vpif_dbg_s_register(struct file *file, void *priv,
+                struct v4l2_dbg_register *reg){
+        struct vpif_fh *fh = priv;
+        struct channel_obj *ch = fh->channel;
+        struct video_obj *vid_ch = &ch->video;
+
+        return v4l2_subdev_call(vpif_obj.sd[vid_ch->output_id], core,
+                        s_register, reg);
+}
+#endif
+
+/*
+ * vpif_log_status() - Status information
+ * @file: file ptr
+ * @priv: file handle
+ *
+ * Returns zero.
+ */
+static int vpif_log_status(struct file *filep, void *priv)
+{
+        /* status for sub devices */
+        v4l2_device_call_all(&vpif_obj.v4l2_dev, 0, core, log_status);
+
+        return 0;
+}
+
 /* vpif display ioctl operations */
 static const struct v4l2_ioctl_ops vpif_ioctl_ops = {
         .vidioc_querycap                = vpif_querycap,
@@ -1336,13 +1582,24 @@ static const struct v4l2_ioctl_ops vpif_ioctl_ops = {
         .vidioc_s_output                = vpif_s_output,
         .vidioc_g_output                = vpif_g_output,
         .vidioc_cropcap                 = vpif_cropcap,
+        .vidioc_enum_dv_presets         = vpif_enum_dv_presets,
+        .vidioc_s_dv_preset             = vpif_s_dv_preset,
+        .vidioc_g_dv_preset             = vpif_g_dv_preset,
+        .vidioc_s_dv_timings            = vpif_s_dv_timings,
+        .vidioc_g_dv_timings            = vpif_g_dv_timings,
+        .vidioc_g_chip_ident            = vpif_g_chip_ident,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        .vidioc_g_register              = vpif_dbg_g_register,
+        .vidioc_s_register              = vpif_dbg_s_register,
+#endif
+        .vidioc_log_status              = vpif_log_status,
 };
 
 static const struct v4l2_file_operations vpif_fops = {
         .owner          = THIS_MODULE,
         .open           = vpif_open,
         .release        = vpif_release,
-        .ioctl          = video_ioctl2,
+        .unlocked_ioctl = video_ioctl2,
         .mmap           = vpif_mmap,
         .poll           = vpif_poll
 };
@@ -1526,6 +1783,7 @@ static __init int vpif_probe(struct platform_device *pdev)
                 v4l2_prio_init(&ch->prio);
                 ch->common[VPIF_VIDEO_INDEX].fmt.type =
                                                 V4L2_BUF_TYPE_VIDEO_OUTPUT;
+                ch->video_dev->lock = &common->lock;
 
                 /* register video device */
                 vpif_dbg(1, debug, "channel=%x,channel->video_dev=%x\n",
@@ -1565,6 +1823,8 @@ static __init int vpif_probe(struct platform_device *pdev)
                         vpif_obj.sd[i]->grp_id = 1 << i;
         }
 
+        v4l2_info(&vpif_obj.v4l2_dev,
+                        "DM646x VPIF display driver initialized\n");
         return 0;
 
 probe_subdev_out:
diff --git a/drivers/media/video/davinci/vpif_display.h b/drivers/media/video/davinci/vpif_display.h
index a2a7cd166bb..b53aaa88307 100644
--- a/drivers/media/video/davinci/vpif_display.h
+++ b/drivers/media/video/davinci/vpif_display.h
@@ -67,6 +67,8 @@ struct video_obj {
                                          * most recent displayed frame only */
         v4l2_std_id stdid;              /* Currently selected or default
                                          * standard */
+        u32 dv_preset;
+        struct v4l2_bt_timings bt_timings;
         u32 output_id;                  /* Current output id */
 };
 
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 099d5df8c57..87f77a34eea 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -33,6 +33,7 @@
 #include <media/saa7115.h>
 #include <media/tvp5150.h>
 #include <media/tvaudio.h>
+#include <media/mt9v011.h>
 #include <media/i2c-addr.h>
 #include <media/tveeprom.h>
 #include <media/v4l2-common.h>
@@ -1917,11 +1918,6 @@ static unsigned short tvp5150_addrs[] = {
         I2C_CLIENT_END
 };
 
-static unsigned short mt9v011_addrs[] = {
-        0xba >> 1,
-        I2C_CLIENT_END
-};
-
 static unsigned short msp3400_addrs[] = {
         0x80 >> 1,
         0x88 >> 1,
@@ -2437,6 +2433,7 @@ void em28xx_register_i2c_ir(struct em28xx *dev)
                 dev->init_data.ir_codes = RC_MAP_RC5_HAUPPAUGE_NEW;
                 dev->init_data.get_key = em28xx_get_key_em_haup;
                 dev->init_data.name = "i2c IR (EM2840 Hauppauge)";
+                break;
         case EM2820_BOARD_LEADTEK_WINFAST_USBII_DELUXE:
                 dev->init_data.ir_codes = RC_MAP_WINFAST_USBII_DELUXE;
                 dev->init_data.get_key = em28xx_get_key_winfast_usbii_deluxe;
@@ -2623,11 +2620,17 @@ void em28xx_card_setup(struct em28xx *dev)
                         "tvp5150", 0, tvp5150_addrs);
 
         if (dev->em28xx_sensor == EM28XX_MT9V011) {
+                struct mt9v011_platform_data pdata;
+                struct i2c_board_info mt9v011_info = {
+                        .type = "mt9v011",
+                        .addr = 0xba >> 1,
+                        .platform_data = &pdata,
+                };
                 struct v4l2_subdev *sd;
 
-                sd = v4l2_i2c_new_subdev(&dev->v4l2_dev,
-                         &dev->i2c_adap, "mt9v011", 0, mt9v011_addrs);
-                v4l2_subdev_call(sd, core, s_config, 0, &dev->sensor_xtal);
+                pdata.xtal = dev->sensor_xtal;
+                sd = v4l2_i2c_new_subdev_board(&dev->v4l2_dev, &dev->i2c_adap,
+                                &mt9v011_info, NULL);
         }
 
 
diff --git a/drivers/media/video/et61x251/et61x251.h b/drivers/media/video/et61x251/et61x251.h
index cc77d144df3..bf66189cb26 100644
--- a/drivers/media/video/et61x251/et61x251.h
+++ b/drivers/media/video/et61x251/et61x251.h
@@ -59,31 +59,7 @@
 /*****************************************************************************/
 
 static const struct usb_device_id et61x251_id_table[] = {
-        { USB_DEVICE(0x102c, 0x6151), },
         { USB_DEVICE(0x102c, 0x6251), },
-        { USB_DEVICE(0x102c, 0x6253), },
-        { USB_DEVICE(0x102c, 0x6254), },
-        { USB_DEVICE(0x102c, 0x6255), },
-        { USB_DEVICE(0x102c, 0x6256), },
-        { USB_DEVICE(0x102c, 0x6257), },
-        { USB_DEVICE(0x102c, 0x6258), },
-        { USB_DEVICE(0x102c, 0x6259), },
-        { USB_DEVICE(0x102c, 0x625a), },
-        { USB_DEVICE(0x102c, 0x625b), },
-        { USB_DEVICE(0x102c, 0x625c), },
-        { USB_DEVICE(0x102c, 0x625d), },
-        { USB_DEVICE(0x102c, 0x625e), },
-        { USB_DEVICE(0x102c, 0x625f), },
-        { USB_DEVICE(0x102c, 0x6260), },
-        { USB_DEVICE(0x102c, 0x6261), },
-        { USB_DEVICE(0x102c, 0x6262), },
-        { USB_DEVICE(0x102c, 0x6263), },
-        { USB_DEVICE(0x102c, 0x6264), },
-        { USB_DEVICE(0x102c, 0x6265), },
-        { USB_DEVICE(0x102c, 0x6266), },
-        { USB_DEVICE(0x102c, 0x6267), },
-        { USB_DEVICE(0x102c, 0x6268), },
-        { USB_DEVICE(0x102c, 0x6269), },
         { }
 };
 
diff --git a/drivers/media/video/gspca/benq.c b/drivers/media/video/gspca/benq.c
index 62904393350..a09c4709d61 100644
--- a/drivers/media/video/gspca/benq.c
+++ b/drivers/media/video/gspca/benq.c
@@ -276,7 +276,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x04a5, 0x3035)},
         {}
 };
diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index 1eacb6c7926..8b398493f96 100644
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -1040,14 +1040,14 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const struct usb_device_id device_table[] __devinitconst = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0572, 0x0041)},
         {}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int __devinit sd_probe(struct usb_interface *intf,
+static int sd_probe(struct usb_interface *intf,
                         const struct usb_device_id *id)
 {
         return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/cpia1.c b/drivers/media/video/gspca/cpia1.c
index c1ae05f4661..4bf2cab98d6 100644
--- a/drivers/media/video/gspca/cpia1.c
+++ b/drivers/media/video/gspca/cpia1.c
@@ -2088,7 +2088,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0553, 0x0002)},
         {USB_DEVICE(0x0813, 0x0001)},
         {}
diff --git a/drivers/media/video/gspca/etoms.c b/drivers/media/video/gspca/etoms.c
index a594b36d619..4b2c483fce6 100644
--- a/drivers/media/video/gspca/etoms.c
+++ b/drivers/media/video/gspca/etoms.c
@@ -864,7 +864,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const struct usb_device_id device_table[] __devinitconst = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x102c, 0x6151), .driver_info = SENSOR_PAS106},
 #if !defined CONFIG_USB_ET61X251 && !defined CONFIG_USB_ET61X251_MODULE
         {USB_DEVICE(0x102c, 0x6251), .driver_info = SENSOR_TAS5130CXX},
@@ -875,7 +875,7 @@ static const struct usb_device_id device_table[] __devinitconst = {
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int __devinit sd_probe(struct usb_interface *intf,
+static int sd_probe(struct usb_interface *intf,
                     const struct usb_device_id *id)
 {
         return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/finepix.c b/drivers/media/video/gspca/finepix.c
index d78226455d1..987b4b69d7a 100644
--- a/drivers/media/video/gspca/finepix.c
+++ b/drivers/media/video/gspca/finepix.c
@@ -229,7 +229,7 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 /* Table of supported USB devices */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x04cb, 0x0104)},
         {USB_DEVICE(0x04cb, 0x0109)},
         {USB_DEVICE(0x04cb, 0x010b)},
diff --git a/drivers/media/video/gspca/gl860/gl860.c b/drivers/media/video/gspca/gl860/gl860.c
index b05bec7321b..99083038cec 100644
--- a/drivers/media/video/gspca/gl860/gl860.c
+++ b/drivers/media/video/gspca/gl860/gl860.c
@@ -488,7 +488,7 @@ static void sd_callback(struct gspca_dev *gspca_dev)
 
 /*=================== USB driver structure initialisation ==================*/
 
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x05e3, 0x0503)},
         {USB_DEVICE(0x05e3, 0xf191)},
         {}
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 442970073e8..f21f2a258ae 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -55,7 +55,7 @@ MODULE_AUTHOR("Jean-François Moine <http://moinejf.free.fr>");
 MODULE_DESCRIPTION("GSPCA USB Camera Driver");
 MODULE_LICENSE("GPL");
 
-#define DRIVER_VERSION_NUMBER   KERNEL_VERSION(2, 11, 0)
+#define DRIVER_VERSION_NUMBER   KERNEL_VERSION(2, 12, 0)
 
 #ifdef GSPCA_DEBUG
 int gspca_debug = D_ERR | D_PROBE;
@@ -508,8 +508,8 @@ static int gspca_is_compressed(__u32 format)
         return 0;
 }
 
-static int frame_alloc(struct gspca_dev *gspca_dev,
-                        unsigned int count)
+static int frame_alloc(struct gspca_dev *gspca_dev, struct file *file,
+                        enum v4l2_memory memory, unsigned int count)
 {
         struct gspca_frame *frame;
         unsigned int frsz;
@@ -519,7 +519,6 @@ static int frame_alloc(struct gspca_dev *gspca_dev,
         frsz = gspca_dev->cam.cam_mode[i].sizeimage;
         PDEBUG(D_STREAM, "frame alloc frsz: %d", frsz);
         frsz = PAGE_ALIGN(frsz);
-        gspca_dev->frsz = frsz;
         if (count >= GSPCA_MAX_FRAMES)
                 count = GSPCA_MAX_FRAMES - 1;
         gspca_dev->frbuf = vmalloc_32(frsz * count);
@@ -527,6 +526,9 @@ static int frame_alloc(struct gspca_dev *gspca_dev,
                 err("frame alloc failed");
                 return -ENOMEM;
         }
+        gspca_dev->capt_file = file;
+        gspca_dev->memory = memory;
+        gspca_dev->frsz = frsz;
         gspca_dev->nframes = count;
         for (i = 0; i < count; i++) {
                 frame = &gspca_dev->frame[i];
@@ -535,7 +537,7 @@ static int frame_alloc(struct gspca_dev *gspca_dev,
                 frame->v4l2_buf.flags = 0;
                 frame->v4l2_buf.field = V4L2_FIELD_NONE;
                 frame->v4l2_buf.length = frsz;
-                frame->v4l2_buf.memory = gspca_dev->memory;
+                frame->v4l2_buf.memory = memory;
                 frame->v4l2_buf.sequence = 0;
                 frame->data = gspca_dev->frbuf + i * frsz;
                 frame->v4l2_buf.m.offset = i * frsz;
@@ -558,6 +560,9 @@ static void frame_free(struct gspca_dev *gspca_dev)
                         gspca_dev->frame[i].data = NULL;
         }
         gspca_dev->nframes = 0;
+        gspca_dev->frsz = 0;
+        gspca_dev->capt_file = NULL;
+        gspca_dev->memory = GSPCA_MEMORY_NO;
 }
 
 static void destroy_urbs(struct gspca_dev *gspca_dev)
@@ -1210,29 +1215,15 @@ static void gspca_release(struct video_device *vfd)
 static int dev_open(struct file *file)
 {
         struct gspca_dev *gspca_dev;
-        int ret;
 
         PDEBUG(D_STREAM, "[%s] open", current->comm);
         gspca_dev = (struct gspca_dev *) video_devdata(file);
-        if (mutex_lock_interruptible(&gspca_dev->queue_lock))
-                return -ERESTARTSYS;
-        if (!gspca_dev->present) {
-                ret = -ENODEV;
-                goto out;
-        }
-
-        if (gspca_dev->users > 4) {     /* (arbitrary value) */
-                ret = -EBUSY;
-                goto out;
-        }
+        if (!gspca_dev->present)
+                return -ENODEV;
 
         /* protect the subdriver against rmmod */
-        if (!try_module_get(gspca_dev->module)) {
-                ret = -ENODEV;
-                goto out;
-        }
-
-        gspca_dev->users++;
+        if (!try_module_get(gspca_dev->module))
+                return -ENODEV;
 
         file->private_data = gspca_dev;
 #ifdef GSPCA_DEBUG
@@ -1244,14 +1235,7 @@ static int dev_open(struct file *file)
                 gspca_dev->vdev.debug &= ~(V4L2_DEBUG_IOCTL
                                         | V4L2_DEBUG_IOCTL_ARG);
 #endif
-        ret = 0;
-out:
-        mutex_unlock(&gspca_dev->queue_lock);
-        if (ret != 0)
-                PDEBUG(D_ERR|D_STREAM, "open failed err %d", ret);
-        else
-                PDEBUG(D_STREAM, "open done");
-        return ret;
+        return 0;
 }
 
 static int dev_close(struct file *file)
@@ -1261,7 +1245,6 @@ static int dev_close(struct file *file)
         PDEBUG(D_STREAM, "[%s] close", current->comm);
         if (mutex_lock_interruptible(&gspca_dev->queue_lock))
                 return -ERESTARTSYS;
-        gspca_dev->users--;
 
         /* if the file did the capture, free the streaming resources */
         if (gspca_dev->capt_file == file) {
@@ -1272,8 +1255,6 @@ static int dev_close(struct file *file)
                         mutex_unlock(&gspca_dev->usb_lock);
                 }
                 frame_free(gspca_dev);
-                gspca_dev->capt_file = NULL;
-                gspca_dev->memory = GSPCA_MEMORY_NO;
         }
         file->private_data = NULL;
         module_put(gspca_dev->module);
@@ -1516,6 +1497,7 @@ static int vidioc_reqbufs(struct file *file, void *priv,
                 return -ERESTARTSYS;
 
         if (gspca_dev->memory != GSPCA_MEMORY_NO
+            && gspca_dev->memory != GSPCA_MEMORY_READ
             && gspca_dev->memory != rb->memory) {
                 ret = -EBUSY;
                 goto out;
@@ -1544,19 +1526,18 @@ static int vidioc_reqbufs(struct file *file, void *priv,
                 gspca_stream_off(gspca_dev);
                 mutex_unlock(&gspca_dev->usb_lock);
         }
+        /* Don't restart the stream when switching from read to mmap mode */
+        if (gspca_dev->memory == GSPCA_MEMORY_READ)
+                streaming = 0;
 
         /* free the previous allocated buffers, if any */
-        if (gspca_dev->nframes != 0) {
+        if (gspca_dev->nframes != 0)
                 frame_free(gspca_dev);
-                gspca_dev->capt_file = NULL;
-        }
         if (rb->count == 0)                     /* unrequest */
                 goto out;
-        gspca_dev->memory = rb->memory;
-        ret = frame_alloc(gspca_dev, rb->count);
+        ret = frame_alloc(gspca_dev, file, rb->memory, rb->count);
         if (ret == 0) {
                 rb->count = gspca_dev->nframes;
-                gspca_dev->capt_file = file;
                 if (streaming)
                         ret = gspca_init_transfer(gspca_dev);
         }
@@ -1630,11 +1611,15 @@ static int vidioc_streamoff(struct file *file, void *priv,
 
         if (buf_type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                 return -EINVAL;
-        if (!gspca_dev->streaming)
-                return 0;
+
         if (mutex_lock_interruptible(&gspca_dev->queue_lock))
                 return -ERESTARTSYS;
 
+        if (!gspca_dev->streaming) {
+                ret = 0;
+                goto out;
+        }
+
         /* check the capture file */
         if (gspca_dev->capt_file != file) {
                 ret = -EBUSY;
@@ -1649,6 +1634,8 @@ static int vidioc_streamoff(struct file *file, void *priv,
         gspca_dev->usb_err = 0;
         gspca_stream_off(gspca_dev);
         mutex_unlock(&gspca_dev->usb_lock);
+        /* In case another thread is waiting in dqbuf */
+        wake_up_interruptible(&gspca_dev->wq);
 
         /* empty the transfer queues */
         atomic_set(&gspca_dev->fr_q, 0);
@@ -1827,33 +1814,77 @@ out:
         return ret;
 }
 
+static int frame_ready_nolock(struct gspca_dev *gspca_dev, struct file *file,
+                                enum v4l2_memory memory)
+{
+        if (!gspca_dev->present)
+                return -ENODEV;
+        if (gspca_dev->capt_file != file || gspca_dev->memory != memory ||
+                        !gspca_dev->streaming)
+                return -EINVAL;
+
+        /* check if a frame is ready */
+        return gspca_dev->fr_o != atomic_read(&gspca_dev->fr_i);
+}
+
+static int frame_ready(struct gspca_dev *gspca_dev, struct file *file,
+                        enum v4l2_memory memory)
+{
+        int ret;
+
+        if (mutex_lock_interruptible(&gspca_dev->queue_lock))
+                return -ERESTARTSYS;
+        ret = frame_ready_nolock(gspca_dev, file, memory);
+        mutex_unlock(&gspca_dev->queue_lock);
+        return ret;
+}
+
 /*
- * wait for a video frame
+ * dequeue a video buffer
  *
- * If a frame is ready, its index is returned.
+ * If nonblock_ing is false, block until a buffer is available.
  */
-static int frame_wait(struct gspca_dev *gspca_dev,
-                        int nonblock_ing)
+static int vidioc_dqbuf(struct file *file, void *priv,
+                        struct v4l2_buffer *v4l2_buf)
 {
-        int i, ret;
+        struct gspca_dev *gspca_dev = priv;
+        struct gspca_frame *frame;
+        int i, j, ret;
 
-        /* check if a frame is ready */
-        i = gspca_dev->fr_o;
-        if (i == atomic_read(&gspca_dev->fr_i)) {
-                if (nonblock_ing)
+        PDEBUG(D_FRAM, "dqbuf");
+
+        if (mutex_lock_interruptible(&gspca_dev->queue_lock))
+                return -ERESTARTSYS;
+
+        for (;;) {
+                ret = frame_ready_nolock(gspca_dev, file, v4l2_buf->memory);
+                if (ret < 0)
+                        goto out;
+                if (ret > 0)
+                        break;
+
+                mutex_unlock(&gspca_dev->queue_lock);
+
+                if (file->f_flags & O_NONBLOCK)
                         return -EAGAIN;
 
                 /* wait till a frame is ready */
                 ret = wait_event_interruptible_timeout(gspca_dev->wq,
-                        i != atomic_read(&gspca_dev->fr_i) ||
-                        !gspca_dev->streaming || !gspca_dev->present,
+                        frame_ready(gspca_dev, file, v4l2_buf->memory),
                         msecs_to_jiffies(3000));
                 if (ret < 0)
                         return ret;
-                if (ret == 0 || !gspca_dev->streaming || !gspca_dev->present)
+                if (ret == 0)
                         return -EIO;
+
+                if (mutex_lock_interruptible(&gspca_dev->queue_lock))
+                        return -ERESTARTSYS;
         }
 
+        i = gspca_dev->fr_o;
+        j = gspca_dev->fr_queue[i];
+        frame = &gspca_dev->frame[j];
+
         gspca_dev->fr_o = (i + 1) % GSPCA_MAX_FRAMES;
 
         if (gspca_dev->sd_desc->dq_callback) {
@@ -1863,46 +1894,12 @@ static int frame_wait(struct gspca_dev *gspca_dev,
                         gspca_dev->sd_desc->dq_callback(gspca_dev);
                 mutex_unlock(&gspca_dev->usb_lock);
         }
-        return gspca_dev->fr_queue[i];
-}
-
-/*
- * dequeue a video buffer
- *
- * If nonblock_ing is false, block until a buffer is available.
- */
-static int vidioc_dqbuf(struct file *file, void *priv,
-                        struct v4l2_buffer *v4l2_buf)
-{
-        struct gspca_dev *gspca_dev = priv;
-        struct gspca_frame *frame;
-        int i, ret;
-
-        PDEBUG(D_FRAM, "dqbuf");
-        if (v4l2_buf->memory != gspca_dev->memory)
-                return -EINVAL;
-
-        if (!gspca_dev->present)
-                return -ENODEV;
-
-        /* if not streaming, be sure the application will not loop forever */
-        if (!(file->f_flags & O_NONBLOCK)
-            && !gspca_dev->streaming && gspca_dev->users == 1)
-                return -EINVAL;
 
-        /* only the capturing file may dequeue */
-        if (gspca_dev->capt_file != file)
-                return -EINVAL;
-
-        /* only one dequeue / read at a time */
-        if (mutex_lock_interruptible(&gspca_dev->read_lock))
-                return -ERESTARTSYS;
+        frame->v4l2_buf.flags &= ~V4L2_BUF_FLAG_DONE;
+        memcpy(v4l2_buf, &frame->v4l2_buf, sizeof *v4l2_buf);
+        PDEBUG(D_FRAM, "dqbuf %d", j);
+        ret = 0;
 
-        ret = frame_wait(gspca_dev, file->f_flags & O_NONBLOCK);
-        if (ret < 0)
-                goto out;
-        i = ret;                                /* frame index */
-        frame = &gspca_dev->frame[i];
         if (gspca_dev->memory == V4L2_MEMORY_USERPTR) {
                 if (copy_to_user((__u8 __user *) frame->v4l2_buf.m.userptr,
                                  frame->data,
@@ -1910,15 +1907,10 @@ static int vidioc_dqbuf(struct file *file, void *priv,
                         PDEBUG(D_ERR|D_STREAM,
                                 "dqbuf cp to user failed");
                         ret = -EFAULT;
-                        goto out;
                 }
         }
-        frame->v4l2_buf.flags &= ~V4L2_BUF_FLAG_DONE;
-        memcpy(v4l2_buf, &frame->v4l2_buf, sizeof *v4l2_buf);
-        PDEBUG(D_FRAM, "dqbuf %d", i);
-        ret = 0;
 out:
-        mutex_unlock(&gspca_dev->read_lock);
+        mutex_unlock(&gspca_dev->queue_lock);
         return ret;
 }
 
@@ -2033,9 +2025,7 @@ static unsigned int dev_poll(struct file *file, poll_table *wait)
         poll_wait(file, &gspca_dev->wq, wait);
 
         /* if reqbufs is not done, the user would use read() */
-        if (gspca_dev->nframes == 0) {
-                if (gspca_dev->memory != GSPCA_MEMORY_NO)
-                        return POLLERR;         /* not the 1st time */
+        if (gspca_dev->memory == GSPCA_MEMORY_NO) {
                 ret = read_alloc(gspca_dev, file);
                 if (ret != 0)
                         return POLLERR;
@@ -2067,18 +2057,10 @@ static ssize_t dev_read(struct file *file, char __user *data,
         PDEBUG(D_FRAM, "read (%zd)", count);
         if (!gspca_dev->present)
                 return -ENODEV;
-        switch (gspca_dev->memory) {
-        case GSPCA_MEMORY_NO:                   /* first time */
+        if (gspca_dev->memory == GSPCA_MEMORY_NO) { /* first time ? */
                 ret = read_alloc(gspca_dev, file);
                 if (ret != 0)
                         return ret;
-                break;
-        case GSPCA_MEMORY_READ:
-                if (gspca_dev->capt_file == file)
-                        break;
-                /* fall thru */
-        default:
-                return -EINVAL;
         }
 
         /* get a frame */
@@ -2266,7 +2248,6 @@ int gspca_dev_probe2(struct usb_interface *intf,
                 goto out;
 
         mutex_init(&gspca_dev->usb_lock);
-        mutex_init(&gspca_dev->read_lock);
         mutex_init(&gspca_dev->queue_lock);
         init_waitqueue_head(&gspca_dev->wq);
 
@@ -2341,12 +2322,11 @@ void gspca_disconnect(struct usb_interface *intf)
         PDEBUG(D_PROBE, "%s disconnect",
                 video_device_node_name(&gspca_dev->vdev));
         mutex_lock(&gspca_dev->usb_lock);
+
         gspca_dev->present = 0;
+        wake_up_interruptible(&gspca_dev->wq);
 
-        if (gspca_dev->streaming) {
-                destroy_urbs(gspca_dev);
-                wake_up_interruptible(&gspca_dev->wq);
-        }
+        destroy_urbs(gspca_dev);
 
 #if defined(CONFIG_INPUT) || defined(CONFIG_INPUT_MODULE)
         gspca_input_destroy_urb(gspca_dev);
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index 97b77a26a2e..41755226d38 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -205,14 +205,12 @@ struct gspca_dev {
 
         wait_queue_head_t wq;           /* wait queue */
         struct mutex usb_lock;          /* usb exchange protection */
-        struct mutex read_lock;         /* read protection */
         struct mutex queue_lock;        /* ISOC queue protection */
         int usb_err;                    /* USB error - protected by usb_lock */
         u16 pkt_size;                   /* ISOC packet size */
 #ifdef CONFIG_PM
         char frozen;                    /* suspend - resume */
 #endif
-        char users;                     /* number of opens */
         char present;                   /* device connected */
         char nbufread;                  /* number of buffers for read() */
         char memory;                    /* memory type (V4L2_MEMORY_xxx) */
diff --git a/drivers/media/video/gspca/jeilinj.c b/drivers/media/video/gspca/jeilinj.c
index a35e87bb038..06b777f5379 100644
--- a/drivers/media/video/gspca/jeilinj.c
+++ b/drivers/media/video/gspca/jeilinj.c
@@ -314,7 +314,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 }
 
 /* Table of supported USB devices */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0979, 0x0280)},
         {}
 };
diff --git a/drivers/media/video/gspca/jpeg.h b/drivers/media/video/gspca/jpeg.h
index de63c36806c..ab54910418b 100644
--- a/drivers/media/video/gspca/jpeg.h
+++ b/drivers/media/video/gspca/jpeg.h
@@ -141,9 +141,9 @@ static void jpeg_define(u8 *jpeg_hdr,
         memcpy(jpeg_hdr, jpeg_head, sizeof jpeg_head);
 #ifndef CONEX_CAM
         jpeg_hdr[JPEG_HEIGHT_OFFSET + 0] = height >> 8;
-        jpeg_hdr[JPEG_HEIGHT_OFFSET + 1] = height & 0xff;
+        jpeg_hdr[JPEG_HEIGHT_OFFSET + 1] = height;
         jpeg_hdr[JPEG_HEIGHT_OFFSET + 2] = width >> 8;
-        jpeg_hdr[JPEG_HEIGHT_OFFSET + 3] = width & 0xff;
+        jpeg_hdr[JPEG_HEIGHT_OFFSET + 3] = width;
         jpeg_hdr[JPEG_HEIGHT_OFFSET + 6] = samplesY;
 #endif
 }
diff --git a/drivers/media/video/gspca/konica.c b/drivers/media/video/gspca/konica.c
index d2ce65dcbfd..5964691c0e9 100644
--- a/drivers/media/video/gspca/konica.c
+++ b/drivers/media/video/gspca/konica.c
@@ -607,7 +607,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x04c8, 0x0720)}, /* Intel YC 76 */
         {}
 };
diff --git a/drivers/media/video/gspca/m5602/m5602_core.c b/drivers/media/video/gspca/m5602/m5602_core.c
index c872b93a335..a7722b1aef9 100644
--- a/drivers/media/video/gspca/m5602/m5602_core.c
+++ b/drivers/media/video/gspca/m5602/m5602_core.c
@@ -28,7 +28,7 @@ int force_sensor;
 static int dump_bridge;
 int dump_sensor;
 
-static const __devinitdata struct usb_device_id m5602_table[] = {
+static const struct usb_device_id m5602_table[] = {
         {USB_DEVICE(0x0402, 0x5602)},
         {}
 };
diff --git a/drivers/media/video/gspca/mars.c b/drivers/media/video/gspca/mars.c
index a81536e7869..cb4d0bf0d78 100644
--- a/drivers/media/video/gspca/mars.c
+++ b/drivers/media/video/gspca/mars.c
@@ -490,7 +490,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x093a, 0x050f)},
         {}
 };
diff --git a/drivers/media/video/gspca/mr97310a.c b/drivers/media/video/gspca/mr97310a.c
index 7607a288b51..3884c9d300c 100644
--- a/drivers/media/video/gspca/mr97310a.c
+++ b/drivers/media/video/gspca/mr97310a.c
@@ -1229,7 +1229,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x08ca, 0x0110)},   /* Trust Spyc@m 100 */
         {USB_DEVICE(0x08ca, 0x0111)},   /* Aiptek Pencam VGA+ */
         {USB_DEVICE(0x093a, 0x010f)},   /* All other known MR97310A VGA cams */
diff --git a/drivers/media/video/gspca/ov519.c b/drivers/media/video/gspca/ov519.c
index e1c3b9328ac..8ab2c452c25 100644
--- a/drivers/media/video/gspca/ov519.c
+++ b/drivers/media/video/gspca/ov519.c
@@ -488,7 +488,6 @@ static const struct v4l2_pix_format ovfx2_ov3610_mode[] = {
 #define R511_SNAP_PXDIV                 0x1c
 #define R511_SNAP_LNDIV                 0x1d
 #define R511_SNAP_UV_EN                 0x1e
-#define R511_SNAP_UV_EN                 0x1e
 #define R511_SNAP_OPTS                  0x1f
 
 #define R511_DRAM_FLOW_CTL              0x20
@@ -1847,8 +1846,7 @@ static const struct ov_i2c_regvals norm_7670[] = {
         { 0x6c, 0x0a },
         { 0x6d, 0x55 },
         { 0x6e, 0x11 },
-        { 0x6f, 0x9f },
-                                        /* "9e for advance AWB" */
+        { 0x6f, 0x9f },                 /* "9e for advance AWB" */
         { 0x6a, 0x40 },
         { OV7670_R01_BLUE, 0x40 },
         { OV7670_R02_RED, 0x60 },
@@ -3054,7 +3052,7 @@ static void ov519_configure(struct sd *sd)
 {
         static const struct ov_regvals init_519[] = {
                 { 0x5a, 0x6d }, /* EnableSystem */
-                { 0x53, 0x9b },
+                { 0x53, 0x9b }, /* don't enable the microcontroller */
                 { OV519_R54_EN_CLK1, 0xff }, /* set bit2 to enable jpeg */
                 { 0x5d, 0x03 },
                 { 0x49, 0x01 },
@@ -4747,7 +4745,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x4003), .driver_info = BRIDGE_W9968CF },
         {USB_DEVICE(0x041e, 0x4052), .driver_info = BRIDGE_OV519 },
         {USB_DEVICE(0x041e, 0x405f), .driver_info = BRIDGE_OV519 },
diff --git a/drivers/media/video/gspca/ov534.c b/drivers/media/video/gspca/ov534.c
index 0edf93973b1..04da2280273 100644
--- a/drivers/media/video/gspca/ov534.c
+++ b/drivers/media/video/gspca/ov534.c
@@ -479,15 +479,20 @@ static void ov534_reg_write(struct gspca_dev *gspca_dev, u16 reg, u8 val)
         struct usb_device *udev = gspca_dev->dev;
         int ret;
 
-        PDEBUG(D_USBO, "reg=0x%04x, val=0%02x", reg, val);
+        if (gspca_dev->usb_err < 0)
+                return;
+
+        PDEBUG(D_USBO, "SET 01 0000 %04x %02x", reg, val);
         gspca_dev->usb_buf[0] = val;
         ret = usb_control_msg(udev,
                               usb_sndctrlpipe(udev, 0),
                               0x01,
                               USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                               0x00, reg, gspca_dev->usb_buf, 1, CTRL_TIMEOUT);
-        if (ret < 0)
+        if (ret < 0) {
                 err("write failed %d", ret);
+                gspca_dev->usb_err = ret;
+        }
 }
 
 static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg)
@@ -495,14 +500,18 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg)
         struct usb_device *udev = gspca_dev->dev;
         int ret;
 
+        if (gspca_dev->usb_err < 0)
+                return 0;
         ret = usb_control_msg(udev,
                               usb_rcvctrlpipe(udev, 0),
                               0x01,
                               USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                               0x00, reg, gspca_dev->usb_buf, 1, CTRL_TIMEOUT);
-        PDEBUG(D_USBI, "reg=0x%04x, data=0x%02x", reg, gspca_dev->usb_buf[0]);
-        if (ret < 0)
+        PDEBUG(D_USBI, "GET 01 0000 %04x %02x", reg, gspca_dev->usb_buf[0]);
+        if (ret < 0) {
                 err("read failed %d", ret);
+                gspca_dev->usb_err = ret;
+        }
         return gspca_dev->usb_buf[0];
 }
 
@@ -558,13 +567,15 @@ static int sccb_check_status(struct gspca_dev *gspca_dev)
 
 static void sccb_reg_write(struct gspca_dev *gspca_dev, u8 reg, u8 val)
 {
-        PDEBUG(D_USBO, "reg: 0x%02x, val: 0x%02x", reg, val);
+        PDEBUG(D_USBO, "sccb write: %02x %02x", reg, val);
         ov534_reg_write(gspca_dev, OV534_REG_SUBADDR, reg);
         ov534_reg_write(gspca_dev, OV534_REG_WRITE, val);
         ov534_reg_write(gspca_dev, OV534_REG_OPERATION, OV534_OP_WRITE_3);
 
-        if (!sccb_check_status(gspca_dev))
+        if (!sccb_check_status(gspca_dev)) {
                 err("sccb_reg_write failed");
+                gspca_dev->usb_err = -EIO;
+        }
 }
 
 static u8 sccb_reg_read(struct gspca_dev *gspca_dev, u16 reg)
@@ -885,7 +896,7 @@ static int sd_init(struct gspca_dev *gspca_dev)
         ov534_set_led(gspca_dev, 0);
         set_frame_rate(gspca_dev);
 
-        return 0;
+        return gspca_dev->usb_err;
 }
 
 static int sd_start(struct gspca_dev *gspca_dev)
@@ -920,7 +931,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
         ov534_set_led(gspca_dev, 1);
         ov534_reg_write(gspca_dev, 0xe0, 0x00);
-        return 0;
+        return gspca_dev->usb_err;
 }
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
@@ -1289,7 +1300,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x1415, 0x2000)},
         {}
 };
diff --git a/drivers/media/video/gspca/ov534_9.c b/drivers/media/video/gspca/ov534_9.c
index c5244b4b477..aaf5428c57f 100644
--- a/drivers/media/video/gspca/ov534_9.c
+++ b/drivers/media/video/gspca/ov534_9.c
@@ -1429,7 +1429,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x06f8, 0x3003)},
         {}
 };
diff --git a/drivers/media/video/gspca/pac207.c b/drivers/media/video/gspca/pac207.c
index 96f9986305b..81739a2f205 100644
--- a/drivers/media/video/gspca/pac207.c
+++ b/drivers/media/video/gspca/pac207.c
@@ -530,7 +530,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x4028)},
         {USB_DEVICE(0x093a, 0x2460)},
         {USB_DEVICE(0x093a, 0x2461)},
diff --git a/drivers/media/video/gspca/pac7302.c b/drivers/media/video/gspca/pac7302.c
index 2700975abce..5615d7bd830 100644
--- a/drivers/media/video/gspca/pac7302.c
+++ b/drivers/media/video/gspca/pac7302.c
@@ -1184,7 +1184,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const struct usb_device_id device_table[] __devinitconst = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x06f8, 0x3009)},
         {USB_DEVICE(0x093a, 0x2620)},
         {USB_DEVICE(0x093a, 0x2621)},
@@ -1201,7 +1201,7 @@ static const struct usb_device_id device_table[] __devinitconst = {
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int __devinit sd_probe(struct usb_interface *intf,
+static int sd_probe(struct usb_interface *intf,
                         const struct usb_device_id *id)
 {
         return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index 6820f5d58b1..f8801b50e64 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -837,7 +837,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const struct usb_device_id device_table[] __devinitconst = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x093a, 0x2600)},
         {USB_DEVICE(0x093a, 0x2601)},
         {USB_DEVICE(0x093a, 0x2603)},
@@ -849,7 +849,7 @@ static const struct usb_device_id device_table[] __devinitconst = {
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int __devinit sd_probe(struct usb_interface *intf,
+static int sd_probe(struct usb_interface *intf,
                         const struct usb_device_id *id)
 {
         return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/sn9c2028.c b/drivers/media/video/gspca/sn9c2028.c
index 40a06680502..4271f86dfe0 100644
--- a/drivers/media/video/gspca/sn9c2028.c
+++ b/drivers/media/video/gspca/sn9c2028.c
@@ -703,7 +703,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0458, 0x7005)}, /* Genius Smart 300, version 2 */
         /* The Genius Smart is untested. I can't find an owner ! */
         /* {USB_DEVICE(0x0c45, 0x8000)}, DC31VC, Don't know this camera */
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index cb08d00d0a3..fcf29897b71 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -2470,7 +2470,7 @@ static const struct sd_desc sd_desc = {
                         | (SENSOR_ ## sensor << 8) \
                         | (i2c_addr)
 
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0c45, 0x6240), SN9C20X(MT9M001, 0x5d, 0)},
         {USB_DEVICE(0x0c45, 0x6242), SN9C20X(MT9M111, 0x5d, 0)},
         {USB_DEVICE(0x0c45, 0x6248), SN9C20X(OV9655, 0x30, 0)},
diff --git a/drivers/media/video/gspca/sonixb.c b/drivers/media/video/gspca/sonixb.c
index 73504a3f87b..c6cd68d66b5 100644
--- a/drivers/media/video/gspca/sonixb.c
+++ b/drivers/media/video/gspca/sonixb.c
@@ -23,8 +23,15 @@
 /* Some documentation on known sonixb registers:
 
 Reg     Use
+sn9c101 / sn9c102:
 0x10    high nibble red gain low nibble blue gain
 0x11    low nibble green gain
+sn9c103:
+0x05    red gain 0-127
+0x06    blue gain 0-127
+0x07    green gain 0-127
+all:
+0x08-0x0f i2c / 3wire registers
 0x12    hstart
 0x13    vstart
 0x15    hsize (hsize = register-value * 16)
@@ -88,12 +95,9 @@ struct sd {
 typedef const __u8 sensor_init_t[8];
 
 struct sensor_data {
-        const __u8 *bridge_init[2];
-        int bridge_init_size[2];
+        const __u8 *bridge_init;
         sensor_init_t *sensor_init;
         int sensor_init_size;
-        sensor_init_t *sensor_bridge_init[2];
-        int sensor_bridge_init_size[2];
         int flags;
         unsigned ctrl_dis;
         __u8 sensor_addr;
@@ -114,7 +118,6 @@ struct sensor_data {
 #define NO_FREQ (1 << FREQ_IDX)
 #define NO_BRIGHTNESS (1 << BRIGHTNESS_IDX)
 
-#define COMP2 0x8f
 #define COMP 0xc7               /* 0x87 //0x07 */
 #define COMP1 0xc9              /* 0x89 //0x09 */
 
@@ -123,15 +126,11 @@ struct sensor_data {
 
 #define SYS_CLK 0x04
 
-#define SENS(bridge_1, bridge_3, sensor, sensor_1, \
-        sensor_3, _flags, _ctrl_dis, _sensor_addr) \
+#define SENS(bridge, sensor, _flags, _ctrl_dis, _sensor_addr) \
 { \
-        .bridge_init = { bridge_1, bridge_3 }, \
-        .bridge_init_size = { sizeof(bridge_1), sizeof(bridge_3) }, \
+        .bridge_init = bridge, \
         .sensor_init = sensor, \
         .sensor_init_size = sizeof(sensor), \
-        .sensor_bridge_init = { sensor_1, sensor_3,}, \
-        .sensor_bridge_init_size = { sizeof(sensor_1), sizeof(sensor_3)}, \
         .flags = _flags, .ctrl_dis = _ctrl_dis, .sensor_addr = _sensor_addr \
 }
 
@@ -311,7 +310,6 @@ static const __u8 initHv7131d[] = {
         0x00, 0x00,
         0x00, 0x00, 0x00, 0x02, 0x02, 0x00,
         0x28, 0x1e, 0x60, 0x8e, 0x42,
-        0x1d, 0x10, 0x02, 0x03, 0x0f, 0x0c
 };
 static const __u8 hv7131d_sensor_init[][8] = {
         {0xa0, 0x11, 0x01, 0x04, 0x00, 0x00, 0x00, 0x17},
@@ -326,7 +324,6 @@ static const __u8 initHv7131r[] = {
         0x00, 0x00,
         0x00, 0x00, 0x00, 0x02, 0x01, 0x00,
         0x28, 0x1e, 0x60, 0x8a, 0x20,
-        0x1d, 0x10, 0x02, 0x03, 0x0f, 0x0c
 };
 static const __u8 hv7131r_sensor_init[][8] = {
         {0xc0, 0x11, 0x31, 0x38, 0x2a, 0x2e, 0x00, 0x10},
@@ -339,7 +336,7 @@ static const __u8 initOv6650[] = {
         0x44, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
         0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
         0x00, 0x01, 0x01, 0x0a, 0x16, 0x12, 0x68, 0x8b,
-        0x10, 0x1d, 0x10, 0x02, 0x02, 0x09, 0x07
+        0x10,
 };
 static const __u8 ov6650_sensor_init[][8] = {
         /* Bright, contrast, etc are set through SCBB interface.
@@ -378,24 +375,13 @@ static const __u8 initOv7630[] = {
         0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* r09 .. r10 */
         0x00, 0x01, 0x01, 0x0a,                         /* r11 .. r14 */
         0x28, 0x1e,                     /* H & V sizes     r15 .. r16 */
-        0x68, COMP2, MCK_INIT1,                         /* r17 .. r19 */
-        0x1d, 0x10, 0x02, 0x03, 0x0f, 0x0c              /* r1a .. r1f */
-};
-static const __u8 initOv7630_3[] = {
-        0x44, 0x44, 0x00, 0x1a, 0x20, 0x20, 0x20, 0x80, /* r01 .. r08 */
-        0x21, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* r09 .. r10 */
-        0x00, 0x02, 0x01, 0x0a,                         /* r11 .. r14 */
-        0x28, 0x1e,                     /* H & V sizes     r15 .. r16 */
         0x68, 0x8f, MCK_INIT1,                          /* r17 .. r19 */
-        0x1d, 0x10, 0x02, 0x03, 0x0f, 0x0c, 0x00,       /* r1a .. r20 */
-        0x10, 0x20, 0x30, 0x40, 0x50, 0x60, 0x70, 0x80, /* r21 .. r28 */
-        0x90, 0xa0, 0xb0, 0xc0, 0xd0, 0xe0, 0xf0, 0xff  /* r29 .. r30 */
 };
 static const __u8 ov7630_sensor_init[][8] = {
         {0xa0, 0x21, 0x12, 0x80, 0x00, 0x00, 0x00, 0x10},
         {0xb0, 0x21, 0x01, 0x77, 0x3a, 0x00, 0x00, 0x10},
 /*      {0xd0, 0x21, 0x12, 0x7c, 0x01, 0x80, 0x34, 0x10},          jfm */
-        {0xd0, 0x21, 0x12, 0x1c, 0x00, 0x80, 0x34, 0x10},       /* jfm */
+        {0xd0, 0x21, 0x12, 0x5c, 0x00, 0x80, 0x34, 0x10},       /* jfm */
         {0xa0, 0x21, 0x1b, 0x04, 0x00, 0x80, 0x34, 0x10},
         {0xa0, 0x21, 0x20, 0x44, 0x00, 0x80, 0x34, 0x10},
         {0xa0, 0x21, 0x23, 0xee, 0x00, 0x80, 0x34, 0x10},
@@ -413,16 +399,11 @@ static const __u8 ov7630_sensor_init[][8] = {
         {0xd0, 0x21, 0x17, 0x1c, 0xbd, 0x06, 0xf6, 0x10},
 };
 
-static const __u8 ov7630_sensor_init_3[][8] = {
-        {0xa0, 0x21, 0x13, 0x80, 0x00,  0x00, 0x00, 0x10},
-};
-
 static const __u8 initPas106[] = {
         0x04, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x81, 0x40, 0x00, 0x00, 0x00,
         0x00, 0x00,
         0x00, 0x00, 0x00, 0x04, 0x01, 0x00,
         0x16, 0x12, 0x24, COMP1, MCK_INIT1,
-        0x18, 0x10, 0x02, 0x02, 0x09, 0x07
 };
 /* compression 0x86 mckinit1 0x2b */
 
@@ -496,7 +477,6 @@ static const __u8 initPas202[] = {
         0x00, 0x00,
         0x00, 0x00, 0x00, 0x06, 0x03, 0x0a,
         0x28, 0x1e, 0x20, 0x89, 0x20,
-        0x00, 0x00, 0x02, 0x03, 0x0f, 0x0c
 };
 
 /* "Known" PAS202BCB registers:
@@ -537,7 +517,6 @@ static const __u8 initTas5110c[] = {
         0x00, 0x00,
         0x00, 0x00, 0x00, 0x45, 0x09, 0x0a,
         0x16, 0x12, 0x60, 0x86, 0x2b,
-        0x14, 0x0a, 0x02, 0x02, 0x09, 0x07
 };
 /* Same as above, except a different hstart */
 static const __u8 initTas5110d[] = {
@@ -545,12 +524,19 @@ static const __u8 initTas5110d[] = {
         0x00, 0x00,
         0x00, 0x00, 0x00, 0x41, 0x09, 0x0a,
         0x16, 0x12, 0x60, 0x86, 0x2b,
-        0x14, 0x0a, 0x02, 0x02, 0x09, 0x07
 };
-static const __u8 tas5110_sensor_init[][8] = {
+/* tas5110c is 3 wire, tas5110d is 2 wire (regular i2c) */
+static const __u8 tas5110c_sensor_init[][8] = {
         {0x30, 0x11, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x10},
         {0x30, 0x11, 0x02, 0x20, 0xa9, 0x00, 0x00, 0x10},
-        {0xa0, 0x61, 0x9a, 0xca, 0x00, 0x00, 0x00, 0x17},
+};
+/* Known TAS5110D registers
+ * reg02: gain, bit order reversed!! 0 == max gain, 255 == min gain
+ * reg03: bit3: vflip, bit4: ~hflip, bit7: ~gainboost (~ == inverted)
+ *        Note: writing reg03 seems to only work when written together with 02
+ */
+static const __u8 tas5110d_sensor_init[][8] = {
+        {0xa0, 0x61, 0x9a, 0xca, 0x00, 0x00, 0x00, 0x17}, /* reset */
 };
 
 static const __u8 initTas5130[] = {
@@ -558,7 +544,6 @@ static const __u8 initTas5130[] = {
         0x00, 0x00,
         0x00, 0x00, 0x00, 0x68, 0x0c, 0x0a,
         0x28, 0x1e, 0x60, COMP, MCK_INIT,
-        0x18, 0x10, 0x04, 0x03, 0x11, 0x0c
 };
 static const __u8 tas5130_sensor_init[][8] = {
 /*      {0x30, 0x11, 0x00, 0x40, 0x47, 0x00, 0x00, 0x10},
@@ -569,21 +554,18 @@ static const __u8 tas5130_sensor_init[][8] = {
 };
 
 static struct sensor_data sensor_data[] = {
-SENS(initHv7131d, NULL, hv7131d_sensor_init, NULL, NULL, F_GAIN, NO_BRIGHTNESS|NO_FREQ, 0),
-SENS(initHv7131r, NULL, hv7131r_sensor_init, NULL, NULL, 0, NO_BRIGHTNESS|NO_EXPO|NO_FREQ, 0),
-SENS(initOv6650, NULL, ov6650_sensor_init, NULL, NULL, F_GAIN|F_SIF, 0, 0x60),
-SENS(initOv7630, initOv7630_3, ov7630_sensor_init, NULL, ov7630_sensor_init_3,
-        F_GAIN, 0, 0x21),
-SENS(initPas106, NULL, pas106_sensor_init, NULL, NULL, F_GAIN|F_SIF, NO_FREQ,
-        0),
-SENS(initPas202, initPas202, pas202_sensor_init, NULL, NULL, F_GAIN,
-        NO_FREQ, 0),
-SENS(initTas5110c, NULL, tas5110_sensor_init, NULL, NULL,
-        F_GAIN|F_SIF|F_COARSE_EXPO, NO_BRIGHTNESS|NO_FREQ, 0),
-SENS(initTas5110d, NULL, tas5110_sensor_init, NULL, NULL,
-        F_GAIN|F_SIF|F_COARSE_EXPO, NO_BRIGHTNESS|NO_FREQ, 0),
-SENS(initTas5130, NULL, tas5130_sensor_init, NULL, NULL, 0, NO_EXPO|NO_FREQ,
-        0),
+SENS(initHv7131d, hv7131d_sensor_init, F_GAIN, NO_BRIGHTNESS|NO_FREQ, 0),
+SENS(initHv7131r, hv7131r_sensor_init, 0, NO_BRIGHTNESS|NO_EXPO|NO_FREQ, 0),
+SENS(initOv6650, ov6650_sensor_init, F_GAIN|F_SIF, 0, 0x60),
+SENS(initOv7630, ov7630_sensor_init, F_GAIN, 0, 0x21),
+SENS(initPas106, pas106_sensor_init, F_GAIN|F_SIF, NO_FREQ, 0),
+SENS(initPas202, pas202_sensor_init, F_GAIN, NO_FREQ, 0),
+SENS(initTas5110c, tas5110c_sensor_init, F_GAIN|F_SIF|F_COARSE_EXPO,
+        NO_BRIGHTNESS|NO_FREQ, 0),
+SENS(initTas5110d, tas5110d_sensor_init, F_GAIN|F_SIF|F_COARSE_EXPO,
+        NO_BRIGHTNESS|NO_FREQ, 0),
+SENS(initTas5130, tas5130_sensor_init, F_GAIN,
+        NO_BRIGHTNESS|NO_EXPO|NO_FREQ, 0),
 };
 
 /* get one byte in gspca_dev->usb_buf */
@@ -655,7 +637,6 @@ static void i2c_w_vector(struct gspca_dev *gspca_dev,
 static void setbrightness(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
-        __u8 value;
 
         switch (sd->sensor) {
         case  SENSOR_OV6650:
@@ -697,17 +678,6 @@ static void setbrightness(struct gspca_dev *gspca_dev)
                         goto err;
                 break;
             }
-        case SENSOR_TAS5130CXX: {
-                __u8 i2c[] =
-                        {0x30, 0x11, 0x02, 0x20, 0x70, 0x00, 0x00, 0x10};
-
-                value = 0xff - sd->brightness;
-                i2c[4] = value;
-                PDEBUG(D_CONF, "brightness %d : %d", value, i2c[4]);
-                if (i2c_w(gspca_dev, i2c) < 0)
-                        goto err;
-                break;
-            }
         }
         return;
 err:
@@ -733,7 +703,7 @@ static void setsensorgain(struct gspca_dev *gspca_dev)
                 break;
             }
         case SENSOR_TAS5110C:
-        case SENSOR_TAS5110D: {
+        case SENSOR_TAS5130CXX: {
                 __u8 i2c[] =
                         {0x30, 0x11, 0x02, 0x20, 0x70, 0x00, 0x00, 0x10};
 
@@ -742,6 +712,23 @@ static void setsensorgain(struct gspca_dev *gspca_dev)
                         goto err;
                 break;
             }
+        case SENSOR_TAS5110D: {
+                __u8 i2c[] = {
+                        0xb0, 0x61, 0x02, 0x00, 0x10, 0x00, 0x00, 0x17 };
+                gain = 255 - gain;
+                /* The bits in the register are the wrong way around!! */
+                i2c[3] |= (gain & 0x80) >> 7;
+                i2c[3] |= (gain & 0x40) >> 5;
+                i2c[3] |= (gain & 0x20) >> 3;
+                i2c[3] |= (gain & 0x10) >> 1;
+                i2c[3] |= (gain & 0x08) << 1;
+                i2c[3] |= (gain & 0x04) << 3;
+                i2c[3] |= (gain & 0x02) << 5;
+                i2c[3] |= (gain & 0x01) << 7;
+                if (i2c_w(gspca_dev, i2c) < 0)
+                        goto err;
+                break;
+            }
 
         case SENSOR_OV6650:
                 gain >>= 1;
@@ -796,7 +783,7 @@ static void setgain(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
         __u8 gain;
-        __u8 buf[2] = { 0, 0 };
+        __u8 buf[3] = { 0, 0, 0 };
 
         if (sensor_data[sd->sensor].flags & F_GAIN) {
                 /* Use the sensor gain to do the actual gain */
@@ -804,13 +791,18 @@ static void setgain(struct gspca_dev *gspca_dev)
                 return;
         }
 
-        gain = sd->gain >> 4;
-
-        /* red and blue gain */
-        buf[0] = gain << 4 | gain;
-        /* green gain */
-        buf[1] = gain;
-        reg_w(gspca_dev, 0x10, buf, 2);
+        if (sd->bridge == BRIDGE_103) {
+                gain = sd->gain >> 1;
+                buf[0] = gain; /* Red */
+                buf[1] = gain; /* Green */
+                buf[2] = gain; /* Blue */
+                reg_w(gspca_dev, 0x05, buf, 3);
+        } else {
+                gain = sd->gain >> 4;
+                buf[0] = gain << 4 | gain; /* Red and blue */
+                buf[1] = gain; /* Green */
+                reg_w(gspca_dev, 0x10, buf, 2);
+        }
 }
 
 static void setexposure(struct gspca_dev *gspca_dev)
@@ -1049,7 +1041,7 @@ static void do_autogain(struct gspca_dev *gspca_dev)
                 desired_avg_lum = 5000;
         } else {
                 deadzone = 1500;
-                desired_avg_lum = 18000;
+                desired_avg_lum = 13000;
         }
 
         if (sensor_data[sd->sensor].flags & F_COARSE_EXPO)
@@ -1127,53 +1119,91 @@ static int sd_start(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
         struct cam *cam = &gspca_dev->cam;
-        int mode, l;
-        const __u8 *sn9c10x;
-        __u8 reg12_19[8];
+        int i, mode;
+        __u8 regs[0x31];
 
         mode = cam->cam_mode[gspca_dev->curr_mode].priv & 0x07;
-        sn9c10x = sensor_data[sd->sensor].bridge_init[sd->bridge];
-        l = sensor_data[sd->sensor].bridge_init_size[sd->bridge];
-        memcpy(reg12_19, &sn9c10x[0x12 - 1], 8);
-        reg12_19[6] = sn9c10x[0x18 - 1] | (mode << 4);
-        /* Special cases where reg 17 and or 19 value depends on mode */
+        /* Copy registers 0x01 - 0x19 from the template */
+        memcpy(&regs[0x01], sensor_data[sd->sensor].bridge_init, 0x19);
+        /* Set the mode */
+        regs[0x18] |= mode << 4;
+
+        /* Set bridge gain to 1.0 */
+        if (sd->bridge == BRIDGE_103) {
+                regs[0x05] = 0x20; /* Red */
+                regs[0x06] = 0x20; /* Green */
+                regs[0x07] = 0x20; /* Blue */
+        } else {
+                regs[0x10] = 0x00; /* Red and blue */
+                regs[0x11] = 0x00; /* Green */
+        }
+
+        /* Setup pixel numbers and auto exposure window */
+        if (sensor_data[sd->sensor].flags & F_SIF) {
+                regs[0x1a] = 0x14; /* HO_SIZE 640, makes no sense */
+                regs[0x1b] = 0x0a; /* VO_SIZE 320, makes no sense */
+                regs[0x1c] = 0x02; /* AE H-start 64 */
+                regs[0x1d] = 0x02; /* AE V-start 64 */
+                regs[0x1e] = 0x09; /* AE H-end 288 */
+                regs[0x1f] = 0x07; /* AE V-end 224 */
+        } else {
+                regs[0x1a] = 0x1d; /* HO_SIZE 960, makes no sense */
+                regs[0x1b] = 0x10; /* VO_SIZE 512, makes no sense */
+                regs[0x1c] = 0x05; /* AE H-start 160 */
+                regs[0x1d] = 0x03; /* AE V-start 96 */
+                regs[0x1e] = 0x0f; /* AE H-end 480 */
+                regs[0x1f] = 0x0c; /* AE V-end 384 */
+        }
+
+        /* Setup the gamma table (only used with the sn9c103 bridge) */
+        for (i = 0; i < 16; i++)
+                regs[0x20 + i] = i * 16;
+        regs[0x20 + i] = 255;
+
+        /* Special cases where some regs depend on mode or bridge */
         switch (sd->sensor) {
         case SENSOR_TAS5130CXX:
-                /* probably not mode specific at all most likely the upper
+                /* FIXME / TESTME
+                   probably not mode specific at all most likely the upper
                    nibble of 0x19 is exposure (clock divider) just as with
                    the tas5110, we need someone to test this. */
-                reg12_19[7] = mode ? 0x23 : 0x43;
+                regs[0x19] = mode ? 0x23 : 0x43;
                 break;
+        case SENSOR_OV7630:
+                /* FIXME / TESTME for some reason with the 101/102 bridge the
+                   clock is set to 12 Mhz (reg1 == 0x04), rather then 24.
+                   Also the hstart needs to go from 1 to 2 when using a 103,
+                   which is likely related. This does not seem right. */
+                if (sd->bridge == BRIDGE_103) {
+                        regs[0x01] = 0x44; /* Select 24 Mhz clock */
+                        regs[0x12] = 0x02; /* Set hstart to 2 */
+                }
         }
         /* Disable compression when the raw bayer format has been selected */
         if (cam->cam_mode[gspca_dev->curr_mode].priv & MODE_RAW)
-                reg12_19[6] &= ~0x80;
+                regs[0x18] &= ~0x80;
 
         /* Vga mode emulation on SIF sensor? */
         if (cam->cam_mode[gspca_dev->curr_mode].priv & MODE_REDUCED_SIF) {
-                reg12_19[0] += 16; /* 0x12: hstart adjust */
-                reg12_19[1] += 24; /* 0x13: vstart adjust */
-                reg12_19[3] = 320 / 16; /* 0x15: hsize */
-                reg12_19[4] = 240 / 16; /* 0x16: vsize */
+                regs[0x12] += 16;       /* hstart adjust */
+                regs[0x13] += 24;       /* vstart adjust */
+                regs[0x15]  = 320 / 16; /* hsize */
+                regs[0x16]  = 240 / 16; /* vsize */
         }
 
         /* reg 0x01 bit 2 video transfert on */
-        reg_w(gspca_dev, 0x01, &sn9c10x[0x01 - 1], 1);
+        reg_w(gspca_dev, 0x01, &regs[0x01], 1);
         /* reg 0x17 SensorClk enable inv Clk 0x60 */
-        reg_w(gspca_dev, 0x17, &sn9c10x[0x17 - 1], 1);
+        reg_w(gspca_dev, 0x17, &regs[0x17], 1);
         /* Set the registers from the template */
-        reg_w(gspca_dev, 0x01, sn9c10x, l);
+        reg_w(gspca_dev, 0x01, &regs[0x01],
+              (sd->bridge == BRIDGE_103) ? 0x30 : 0x1f);
 
         /* Init the sensor */
         i2c_w_vector(gspca_dev, sensor_data[sd->sensor].sensor_init,
                         sensor_data[sd->sensor].sensor_init_size);
-        if (sensor_data[sd->sensor].sensor_bridge_init[sd->bridge])
-                i2c_w_vector(gspca_dev,
-                        sensor_data[sd->sensor].sensor_bridge_init[sd->bridge],
-                        sensor_data[sd->sensor].sensor_bridge_init_size[
-                                sd->bridge]);
 
-        /* Mode specific sensor setup */
+        /* Mode / bridge specific sensor setup */
         switch (sd->sensor) {
         case SENSOR_PAS202: {
                 const __u8 i2cpclockdiv[] =
@@ -1181,27 +1211,37 @@ static int sd_start(struct gspca_dev *gspca_dev)
                 /* clockdiv from 4 to 3 (7.5 -> 10 fps) when in low res mode */
                 if (mode)
                         i2c_w(gspca_dev, i2cpclockdiv);
+                break;
             }
+        case SENSOR_OV7630:
+                /* FIXME / TESTME We should be able to handle this identical
+                   for the 101/102 and the 103 case */
+                if (sd->bridge == BRIDGE_103) {
+                        const __u8 i2c[] = { 0xa0, 0x21, 0x13,
+                                             0x80, 0x00, 0x00, 0x00, 0x10 };
+                        i2c_w(gspca_dev, i2c);
+                }
+                break;
         }
         /* H_size V_size 0x28, 0x1e -> 640x480. 0x16, 0x12 -> 352x288 */
-        reg_w(gspca_dev, 0x15, &reg12_19[3], 2);
+        reg_w(gspca_dev, 0x15, &regs[0x15], 2);
         /* compression register */
-        reg_w(gspca_dev, 0x18, &reg12_19[6], 1);
+        reg_w(gspca_dev, 0x18, &regs[0x18], 1);
         /* H_start */
-        reg_w(gspca_dev, 0x12, &reg12_19[0], 1);
+        reg_w(gspca_dev, 0x12, &regs[0x12], 1);
         /* V_START */
-        reg_w(gspca_dev, 0x13, &reg12_19[1], 1);
+        reg_w(gspca_dev, 0x13, &regs[0x13], 1);
         /* reset 0x17 SensorClk enable inv Clk 0x60 */
                                 /*fixme: ov7630 [17]=68 8f (+20 if 102)*/
-        reg_w(gspca_dev, 0x17, &reg12_19[5], 1);
+        reg_w(gspca_dev, 0x17, &regs[0x17], 1);
         /*MCKSIZE ->3 */        /*fixme: not ov7630*/
-        reg_w(gspca_dev, 0x19, &reg12_19[7], 1);
+        reg_w(gspca_dev, 0x19, &regs[0x19], 1);
         /* AE_STRX AE_STRY AE_ENDX AE_ENDY */
-        reg_w(gspca_dev, 0x1c, &sn9c10x[0x1c - 1], 4);
+        reg_w(gspca_dev, 0x1c, &regs[0x1c], 4);
         /* Enable video transfert */
-        reg_w(gspca_dev, 0x01, &sn9c10x[0], 1);
+        reg_w(gspca_dev, 0x01, &regs[0x01], 1);
         /* Compression */
-        reg_w(gspca_dev, 0x18, &reg12_19[6], 2);
+        reg_w(gspca_dev, 0x18, &regs[0x18], 2);
         msleep(20);
 
         sd->reg11 = -1;
@@ -1525,15 +1565,15 @@ static const struct sd_desc sd_desc = {
         .driver_info = (SENSOR_ ## sensor << 8) | BRIDGE_ ## bridge
 
 
-static const struct usb_device_id device_table[] __devinitconst = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0c45, 0x6001), SB(TAS5110C, 102)}, /* TAS5110C1B */
         {USB_DEVICE(0x0c45, 0x6005), SB(TAS5110C, 101)}, /* TAS5110C1B */
         {USB_DEVICE(0x0c45, 0x6007), SB(TAS5110D, 101)}, /* TAS5110D */
         {USB_DEVICE(0x0c45, 0x6009), SB(PAS106, 101)},
         {USB_DEVICE(0x0c45, 0x600d), SB(PAS106, 101)},
         {USB_DEVICE(0x0c45, 0x6011), SB(OV6650, 101)},
-#if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
         {USB_DEVICE(0x0c45, 0x6019), SB(OV7630, 101)},
+#if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
         {USB_DEVICE(0x0c45, 0x6024), SB(TAS5130CXX, 102)},
         {USB_DEVICE(0x0c45, 0x6025), SB(TAS5130CXX, 102)},
 #endif
@@ -1544,18 +1584,22 @@ static const struct usb_device_id device_table[] __devinitconst = {
         {USB_DEVICE(0x0c45, 0x602c), SB(OV7630, 102)},
         {USB_DEVICE(0x0c45, 0x602d), SB(HV7131R, 102)},
         {USB_DEVICE(0x0c45, 0x602e), SB(OV7630, 102)},
-        /* {USB_DEVICE(0x0c45, 0x602b), SB(MI03XX, 102)}, */ /* MI0343 MI0360 MI0330 */
+        /* {USB_DEVICE(0x0c45, 0x6030), SB(MI03XX, 102)}, */ /* MI0343 MI0360 MI0330 */
+        /* {USB_DEVICE(0x0c45, 0x6082), SB(MI03XX, 103)}, */ /* MI0343 MI0360 */
+        {USB_DEVICE(0x0c45, 0x6083), SB(HV7131D, 103)},
+        {USB_DEVICE(0x0c45, 0x608c), SB(HV7131R, 103)},
+        /* {USB_DEVICE(0x0c45, 0x608e), SB(CISVF10, 103)}, */
         {USB_DEVICE(0x0c45, 0x608f), SB(OV7630, 103)},
-#if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
+        {USB_DEVICE(0x0c45, 0x60a8), SB(PAS106, 103)},
+        {USB_DEVICE(0x0c45, 0x60aa), SB(TAS5130CXX, 103)},
         {USB_DEVICE(0x0c45, 0x60af), SB(PAS202, 103)},
-#endif
         {USB_DEVICE(0x0c45, 0x60b0), SB(OV7630, 103)},
         {}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int __devinit sd_probe(struct usb_interface *intf,
+static int sd_probe(struct usb_interface *intf,
                         const struct usb_device_id *id)
 {
         return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index 2d0bb17a30a..d6f39ce1b7e 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -25,12 +25,12 @@
 #include "gspca.h"
 #include "jpeg.h"
 
-#define V4L2_CID_INFRARED (V4L2_CID_PRIVATE_BASE + 0)
-
 MODULE_AUTHOR("Jean-François Moine <http://moinejf.free.fr>");
 MODULE_DESCRIPTION("GSPCA/SONIX JPEG USB Camera Driver");
 MODULE_LICENSE("GPL");
 
+static int starcam;
+
 /* controls */
 enum e_ctrl {
         BRIGHTNESS,
@@ -43,7 +43,7 @@ enum e_ctrl {
         HFLIP,
         VFLIP,
         SHARPNESS,
-        INFRARED,
+        ILLUM,
         FREQ,
         NCTRLS          /* number of controls */
 };
@@ -100,7 +100,8 @@ enum sensors {
 };
 
 /* device flags */
-#define PDN_INV 1               /* inverse pin S_PWR_DN / sn_xxx tables */
+#define F_PDN_INV       0x01    /* inverse pin S_PWR_DN / sn_xxx tables */
+#define F_ILLUM         0x02    /* presence of illuminator */
 
 /* sn9c1xx definitions */
 /* register 0x01 */
@@ -124,7 +125,7 @@ static void setgamma(struct gspca_dev *gspca_dev);
 static void setautogain(struct gspca_dev *gspca_dev);
 static void sethvflip(struct gspca_dev *gspca_dev);
 static void setsharpness(struct gspca_dev *gspca_dev);
-static void setinfrared(struct gspca_dev *gspca_dev);
+static void setillum(struct gspca_dev *gspca_dev);
 static void setfreq(struct gspca_dev *gspca_dev);
 
 static const struct ctrl sd_ctrls[NCTRLS] = {
@@ -251,18 +252,17 @@ static const struct ctrl sd_ctrls[NCTRLS] = {
             },
             .set_control = setsharpness
         },
-/* mt9v111 only */
-[INFRARED] = {
+[ILLUM] = {
             {
-                .id      = V4L2_CID_INFRARED,
+                .id      = V4L2_CID_ILLUMINATORS_1,
                 .type    = V4L2_CTRL_TYPE_BOOLEAN,
-                .name    = "Infrared",
+                .name    = "Illuminator / infrared",
                 .minimum = 0,
                 .maximum = 1,
                 .step    = 1,
                 .default_value = 0,
             },
-            .set_control = setinfrared
+            .set_control = setillum
         },
 /* ov7630/ov7648/ov7660 only */
 [FREQ] = {
@@ -282,32 +282,26 @@ static const struct ctrl sd_ctrls[NCTRLS] = {
 /* table of the disabled controls */
 static const __u32 ctrl_dis[] = {
 [SENSOR_ADCM1700] =     (1 << AUTOGAIN) |
-                        (1 << INFRARED) |
                         (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
 
-[SENSOR_GC0307] =       (1 << INFRARED) |
-                        (1 << HFLIP) |
+[SENSOR_GC0307] =       (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
 
-[SENSOR_HV7131R] =      (1 << INFRARED) |
-                        (1 << HFLIP) |
+[SENSOR_HV7131R] =      (1 << HFLIP) |
                         (1 << FREQ),
 
-[SENSOR_MI0360] =       (1 << INFRARED) |
-                        (1 << HFLIP) |
+[SENSOR_MI0360] =       (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
 
-[SENSOR_MI0360B] =      (1 << INFRARED) |
-                        (1 << HFLIP) |
+[SENSOR_MI0360B] =      (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
 
-[SENSOR_MO4000] =       (1 << INFRARED) |
-                        (1 << HFLIP) |
+[SENSOR_MO4000] =       (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
 
@@ -315,40 +309,32 @@ static const __u32 ctrl_dis[] = {
                         (1 << VFLIP) |
                         (1 << FREQ),
 
-[SENSOR_OM6802] =       (1 << INFRARED) |
-                        (1 << HFLIP) |
+[SENSOR_OM6802] =       (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
 
-[SENSOR_OV7630] =       (1 << INFRARED) |
-                        (1 << HFLIP),
+[SENSOR_OV7630] =       (1 << HFLIP),
 
-[SENSOR_OV7648] =       (1 << INFRARED) |
-                        (1 << HFLIP),
+[SENSOR_OV7648] =       (1 << HFLIP),
 
 [SENSOR_OV7660] =       (1 << AUTOGAIN) |
-                        (1 << INFRARED) |
                         (1 << HFLIP) |
                         (1 << VFLIP),
 
 [SENSOR_PO1030] =       (1 << AUTOGAIN) |
-                        (1 << INFRARED) |
                         (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
 
 [SENSOR_PO2030N] =      (1 << AUTOGAIN) |
-                        (1 << INFRARED) |
                         (1 << FREQ),
 
 [SENSOR_SOI768] =       (1 << AUTOGAIN) |
-                        (1 << INFRARED) |
                         (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
 
 [SENSOR_SP80708] =      (1 << AUTOGAIN) |
-                        (1 << INFRARED) |
                         (1 << HFLIP) |
                         (1 << VFLIP) |
                         (1 << FREQ),
@@ -1822,44 +1808,46 @@ static int sd_init(struct gspca_dev *gspca_dev)
         PDEBUG(D_PROBE, "Sonix chip id: %02x", regF1);
         switch (sd->bridge) {
         case BRIDGE_SN9C102P:
+        case BRIDGE_SN9C105:
                 if (regF1 != 0x11)
                         return -ENODEV;
+                break;
+        default:
+/*      case BRIDGE_SN9C110: */
+/*      case BRIDGE_SN9C120: */
+                if (regF1 != 0x12)
+                        return -ENODEV;
+        }
+
+        switch (sd->sensor) {
+        case SENSOR_MI0360:
+                mi0360_probe(gspca_dev);
+                break;
+        case SENSOR_OV7630:
+                ov7630_probe(gspca_dev);
+                break;
+        case SENSOR_OV7648:
+                ov7648_probe(gspca_dev);
+                break;
+        case SENSOR_PO2030N:
+                po2030n_probe(gspca_dev);
+                break;
+        }
+
+        switch (sd->bridge) {
+        case BRIDGE_SN9C102P:
                 reg_w1(gspca_dev, 0x02, regGpio[1]);
                 break;
         case BRIDGE_SN9C105:
-                if (regF1 != 0x11)
-                        return -ENODEV;
-                if (sd->sensor == SENSOR_MI0360)
-                        mi0360_probe(gspca_dev);
                 reg_w(gspca_dev, 0x01, regGpio, 2);
                 break;
+        case BRIDGE_SN9C110:
+                reg_w1(gspca_dev, 0x02, 0x62);
+                break;
         case BRIDGE_SN9C120:
-                if (regF1 != 0x12)
-                        return -ENODEV;
-                switch (sd->sensor) {
-                case SENSOR_MI0360:
-                        mi0360_probe(gspca_dev);
-                        break;
-                case SENSOR_OV7630:
-                        ov7630_probe(gspca_dev);
-                        break;
-                case SENSOR_OV7648:
-                        ov7648_probe(gspca_dev);
-                        break;
-                case SENSOR_PO2030N:
-                        po2030n_probe(gspca_dev);
-                        break;
-                }
                 regGpio[1] = 0x70;              /* no audio */
                 reg_w(gspca_dev, 0x01, regGpio, 2);
                 break;
-        default:
-/*      case BRIDGE_SN9C110: */
-/*      case BRIDGE_SN9C325: */
-                if (regF1 != 0x12)
-                        return -ENODEV;
-                reg_w1(gspca_dev, 0x02, 0x62);
-                break;
         }
 
         if (sd->sensor == SENSOR_OM6802)
@@ -1874,6 +1862,8 @@ static int sd_init(struct gspca_dev *gspca_dev)
         sd->i2c_addr = sn9c1xx[9];
 
         gspca_dev->ctrl_dis = ctrl_dis[sd->sensor];
+        if (!(sd->flags & F_ILLUM))
+                gspca_dev->ctrl_dis |= (1 << ILLUM);
 
         return gspca_dev->usb_err;
 }
@@ -2197,16 +2187,28 @@ static void setsharpness(struct gspca_dev *gspca_dev)
         reg_w1(gspca_dev, 0x99, sd->ctrls[SHARPNESS].val);
 }
 
-static void setinfrared(struct gspca_dev *gspca_dev)
+static void setillum(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
 
-        if (gspca_dev->ctrl_dis & (1 << INFRARED))
+        if (gspca_dev->ctrl_dis & (1 << ILLUM))
                 return;
-/*fixme: different sequence for StarCam Clip and StarCam 370i */
-/* Clip */
-        i2c_w1(gspca_dev, 0x02,                         /* gpio */
-                sd->ctrls[INFRARED].val ? 0x66 : 0x64);
+        switch (sd->sensor) {
+        case SENSOR_ADCM1700:
+                reg_w1(gspca_dev, 0x02,                         /* gpio */
+                        sd->ctrls[ILLUM].val ? 0x64 : 0x60);
+                break;
+        case SENSOR_MT9V111:
+                if (starcam)
+                        reg_w1(gspca_dev, 0x02,
+                                sd->ctrls[ILLUM].val ?
+                                                0x55 : 0x54);   /* 370i */
+                else
+                        reg_w1(gspca_dev, 0x02,
+                                sd->ctrls[ILLUM].val ?
+                                                0x66 : 0x64);   /* Clip */
+                break;
+        }
 }
 
 static void setfreq(struct gspca_dev *gspca_dev)
@@ -2344,7 +2346,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
         /* sensor clock already enabled in sd_init */
         /* reg_w1(gspca_dev, 0xf1, 0x00); */
         reg01 = sn9c1xx[1];
-        if (sd->flags & PDN_INV)
+        if (sd->flags & F_PDN_INV)
                 reg01 ^= S_PDN_INV;             /* power down inverted */
         reg_w1(gspca_dev, 0x01, reg01);
 
@@ -2907,13 +2909,11 @@ static const struct sd_desc sd_desc = {
         .driver_info = (BRIDGE_ ## bridge << 16) \
                         | (SENSOR_ ## sensor << 8) \
                         | (flags)
-static const __devinitdata struct usb_device_id device_table[] = {
-#if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0458, 0x7025), BS(SN9C120, MI0360)},
         {USB_DEVICE(0x0458, 0x702e), BS(SN9C120, OV7660)},
-#endif
-        {USB_DEVICE(0x045e, 0x00f5), BSF(SN9C105, OV7660, PDN_INV)},
-        {USB_DEVICE(0x045e, 0x00f7), BSF(SN9C105, OV7660, PDN_INV)},
+        {USB_DEVICE(0x045e, 0x00f5), BSF(SN9C105, OV7660, F_PDN_INV)},
+        {USB_DEVICE(0x045e, 0x00f7), BSF(SN9C105, OV7660, F_PDN_INV)},
         {USB_DEVICE(0x0471, 0x0327), BS(SN9C105, MI0360)},
         {USB_DEVICE(0x0471, 0x0328), BS(SN9C105, MI0360)},
         {USB_DEVICE(0x0471, 0x0330), BS(SN9C105, MI0360)},
@@ -2925,7 +2925,7 @@ static const __devinitdata struct usb_device_id device_table[] = {
 /*      {USB_DEVICE(0x0c45, 0x607b), BS(SN9C102P, OV7660)}, */
         {USB_DEVICE(0x0c45, 0x607c), BS(SN9C102P, HV7131R)},
 /*      {USB_DEVICE(0x0c45, 0x607e), BS(SN9C102P, OV7630)}, */
-        {USB_DEVICE(0x0c45, 0x60c0), BS(SN9C105, MI0360)},
+        {USB_DEVICE(0x0c45, 0x60c0), BSF(SN9C105, MI0360, F_ILLUM)},
                                                 /* or MT9V111 */
 /*      {USB_DEVICE(0x0c45, 0x60c2), BS(SN9C105, P1030xC)}, */
 /*      {USB_DEVICE(0x0c45, 0x60c8), BS(SN9C105, OM6802)}, */
@@ -2936,10 +2936,8 @@ static const __devinitdata struct usb_device_id device_table[] = {
 /*      {USB_DEVICE(0x0c45, 0x60fa), BS(SN9C105, OV7648)}, */
 /*      {USB_DEVICE(0x0c45, 0x60f2), BS(SN9C105, OV7660)}, */
         {USB_DEVICE(0x0c45, 0x60fb), BS(SN9C105, OV7660)},
-#if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
         {USB_DEVICE(0x0c45, 0x60fc), BS(SN9C105, HV7131R)},
         {USB_DEVICE(0x0c45, 0x60fe), BS(SN9C105, OV7630)},
-#endif
         {USB_DEVICE(0x0c45, 0x6100), BS(SN9C120, MI0360)},      /*sn9c128*/
         {USB_DEVICE(0x0c45, 0x6102), BS(SN9C120, PO2030N)},     /* /GC0305*/
 /*      {USB_DEVICE(0x0c45, 0x6108), BS(SN9C120, OM6802)}, */
@@ -2962,16 +2960,15 @@ static const __devinitdata struct usb_device_id device_table[] = {
 /*      {USB_DEVICE(0x0c45, 0x6132), BS(SN9C120, OV7670)}, */
         {USB_DEVICE(0x0c45, 0x6138), BS(SN9C120, MO4000)},
         {USB_DEVICE(0x0c45, 0x613a), BS(SN9C120, OV7648)},
-#if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
         {USB_DEVICE(0x0c45, 0x613b), BS(SN9C120, OV7660)},
-#endif
         {USB_DEVICE(0x0c45, 0x613c), BS(SN9C120, HV7131R)},
         {USB_DEVICE(0x0c45, 0x613e), BS(SN9C120, OV7630)},
         {USB_DEVICE(0x0c45, 0x6142), BS(SN9C120, PO2030N)},     /*sn9c120b*/
                                                 /* or GC0305 / GC0307 */
         {USB_DEVICE(0x0c45, 0x6143), BS(SN9C120, SP80708)},     /*sn9c120b*/
         {USB_DEVICE(0x0c45, 0x6148), BS(SN9C120, OM6802)},      /*sn9c120b*/
-        {USB_DEVICE(0x0c45, 0x614a), BS(SN9C120, ADCM1700)},    /*sn9c120b*/
+        {USB_DEVICE(0x0c45, 0x614a), BSF(SN9C120, ADCM1700, F_ILLUM)},
+/*      {USB_DEVICE(0x0c45, 0x614c), BS(SN9C120, GC0306)}, */   /*sn9c120b*/
         {}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
@@ -3007,3 +3004,7 @@ static void __exit sd_mod_exit(void)
 
 module_init(sd_mod_init);
 module_exit(sd_mod_exit);
+
+module_param(starcam, int, 0644);
+MODULE_PARM_DESC(starcam,
+        "StarCam model. 0: Clip, 1: 370i");
diff --git a/drivers/media/video/gspca/spca1528.c b/drivers/media/video/gspca/spca1528.c
index e6433866441..76c006b2bc8 100644
--- a/drivers/media/video/gspca/spca1528.c
+++ b/drivers/media/video/gspca/spca1528.c
@@ -555,7 +555,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x04fc, 0x1528)},
         {}
 };
diff --git a/drivers/media/video/gspca/spca500.c b/drivers/media/video/gspca/spca500.c
index 8e202b9039f..45552c3ff8d 100644
--- a/drivers/media/video/gspca/spca500.c
+++ b/drivers/media/video/gspca/spca500.c
@@ -1051,7 +1051,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x040a, 0x0300), .driver_info = KodakEZ200},
         {USB_DEVICE(0x041e, 0x400a), .driver_info = CreativePCCam300},
         {USB_DEVICE(0x046d, 0x0890), .driver_info = LogitechTraveler},
diff --git a/drivers/media/video/gspca/spca501.c b/drivers/media/video/gspca/spca501.c
index 642839a11e8..f7ef282cc60 100644
--- a/drivers/media/video/gspca/spca501.c
+++ b/drivers/media/video/gspca/spca501.c
@@ -2155,7 +2155,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x040a, 0x0002), .driver_info = KodakDVC325},
         {USB_DEVICE(0x0497, 0xc001), .driver_info = SmileIntlCamera},
         {USB_DEVICE(0x0506, 0x00df), .driver_info = ThreeComHomeConnectLite},
diff --git a/drivers/media/video/gspca/spca505.c b/drivers/media/video/gspca/spca505.c
index bc9dd9034ab..e5bf865147d 100644
--- a/drivers/media/video/gspca/spca505.c
+++ b/drivers/media/video/gspca/spca505.c
@@ -786,7 +786,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x401d), .driver_info = Nxultra},
         {USB_DEVICE(0x0733, 0x0430), .driver_info = IntelPCCameraPro},
 /*fixme: may be UsbGrabberPV321 BRIDGE_SPCA506 SENSOR_SAA7113 */
diff --git a/drivers/media/video/gspca/spca508.c b/drivers/media/video/gspca/spca508.c
index 7307638ac91..34831937152 100644
--- a/drivers/media/video/gspca/spca508.c
+++ b/drivers/media/video/gspca/spca508.c
@@ -1509,7 +1509,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0130, 0x0130), .driver_info = HamaUSBSightcam},
         {USB_DEVICE(0x041e, 0x4018), .driver_info = CreativeVista},
         {USB_DEVICE(0x0733, 0x0110), .driver_info = ViewQuestVQ110},
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index 3a162c6d546..e836e778dfb 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -1061,7 +1061,7 @@ static const struct sd_desc *sd_desc[2] = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x401a), .driver_info = Rev072A},
         {USB_DEVICE(0x041e, 0x403b), .driver_info = Rev012A},
         {USB_DEVICE(0x0458, 0x7004), .driver_info = Rev072A},
diff --git a/drivers/media/video/gspca/sq905.c b/drivers/media/video/gspca/sq905.c
index 40406774577..2e9c0617519 100644
--- a/drivers/media/video/gspca/sq905.c
+++ b/drivers/media/video/gspca/sq905.c
@@ -396,7 +396,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 }
 
 /* Table of supported USB devices */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x2770, 0x9120)},
         {}
 };
diff --git a/drivers/media/video/gspca/sq905c.c b/drivers/media/video/gspca/sq905c.c
index 8ba19954385..457563b7a71 100644
--- a/drivers/media/video/gspca/sq905c.c
+++ b/drivers/media/video/gspca/sq905c.c
@@ -298,7 +298,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 }
 
 /* Table of supported USB devices */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x2770, 0x905c)},
         {USB_DEVICE(0x2770, 0x9050)},
         {USB_DEVICE(0x2770, 0x9051)},
diff --git a/drivers/media/video/gspca/sq930x.c b/drivers/media/video/gspca/sq930x.c
index a4a98811b9e..8215d5dcd45 100644
--- a/drivers/media/video/gspca/sq930x.c
+++ b/drivers/media/video/gspca/sq930x.c
@@ -1163,7 +1163,7 @@ static const struct sd_desc sd_desc = {
 #define ST(sensor, type) \
         .driver_info = (SENSOR_ ## sensor << 8) \
                         | (type)
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x4038), ST(MI0360, 0)},
         {USB_DEVICE(0x041e, 0x403c), ST(LZ24BP, 0)},
         {USB_DEVICE(0x041e, 0x403d), ST(LZ24BP, 0)},
diff --git a/drivers/media/video/gspca/stk014.c b/drivers/media/video/gspca/stk014.c
index 11a192b95ed..87be52b5e1e 100644
--- a/drivers/media/video/gspca/stk014.c
+++ b/drivers/media/video/gspca/stk014.c
@@ -495,7 +495,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x05e1, 0x0893)},
         {}
 };
diff --git a/drivers/media/video/gspca/stv0680.c b/drivers/media/video/gspca/stv0680.c
index b199ad4666b..e2ef41cf72d 100644
--- a/drivers/media/video/gspca/stv0680.c
+++ b/drivers/media/video/gspca/stv0680.c
@@ -327,7 +327,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0553, 0x0202)},
         {USB_DEVICE(0x041e, 0x4007)},
         {}
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx.c b/drivers/media/video/gspca/stv06xx/stv06xx.c
index 28ea4175b80..7e066142929 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx.c
+++ b/drivers/media/video/gspca/stv06xx/stv06xx.c
@@ -564,7 +564,7 @@ static int stv06xx_config(struct gspca_dev *gspca_dev,
 
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         /* QuickCam Express */
         {USB_DEVICE(0x046d, 0x0840), .driver_info = BRIDGE_STV600 },
         /* LEGO cam / QuickCam Web */
diff --git a/drivers/media/video/gspca/sunplus.c b/drivers/media/video/gspca/sunplus.c
index a9cbcd6011d..543542af272 100644
--- a/drivers/media/video/gspca/sunplus.c
+++ b/drivers/media/video/gspca/sunplus.c
@@ -1162,7 +1162,7 @@ static const struct sd_desc sd_desc = {
 #define BS(bridge, subtype) \
         .driver_info = (BRIDGE_ ## bridge << 8) \
                         | (subtype)
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x400b), BS(SPCA504C, 0)},
         {USB_DEVICE(0x041e, 0x4012), BS(SPCA504C, 0)},
         {USB_DEVICE(0x041e, 0x4013), BS(SPCA504C, 0)},
diff --git a/drivers/media/video/gspca/t613.c b/drivers/media/video/gspca/t613.c
index 8f0c33116e0..a3eccd81576 100644
--- a/drivers/media/video/gspca/t613.c
+++ b/drivers/media/video/gspca/t613.c
@@ -1416,7 +1416,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x17a1, 0x0128)},
         {}
 };
diff --git a/drivers/media/video/gspca/tv8532.c b/drivers/media/video/gspca/tv8532.c
index 38c22f0a426..933ef2ca658 100644
--- a/drivers/media/video/gspca/tv8532.c
+++ b/drivers/media/video/gspca/tv8532.c
@@ -388,7 +388,7 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x046d, 0x0920)},
         {USB_DEVICE(0x046d, 0x0921)},
         {USB_DEVICE(0x0545, 0x808b)},
diff --git a/drivers/media/video/gspca/vc032x.c b/drivers/media/video/gspca/vc032x.c
index 9b2ae1b6cc7..6caed734a06 100644
--- a/drivers/media/video/gspca/vc032x.c
+++ b/drivers/media/video/gspca/vc032x.c
@@ -4192,7 +4192,7 @@ static const struct sd_desc sd_desc = {
 #define BF(bridge, flags) \
         .driver_info = (BRIDGE_ ## bridge << 8) \
                 | (flags)
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x405b), BF(VC0323, FL_VFLIP)},
         {USB_DEVICE(0x046d, 0x0892), BF(VC0321, 0)},
         {USB_DEVICE(0x046d, 0x0896), BF(VC0321, 0)},
diff --git a/drivers/media/video/gspca/xirlink_cit.c b/drivers/media/video/gspca/xirlink_cit.c
index 5b5039a0203..c089a0f6f1d 100644
--- a/drivers/media/video/gspca/xirlink_cit.c
+++ b/drivers/media/video/gspca/xirlink_cit.c
@@ -3270,7 +3270,7 @@ static const struct sd_desc sd_desc_isoc_nego = {
 };
 
 /* -- module initialisation -- */
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         { USB_DEVICE_VER(0x0545, 0x8080, 0x0001, 0x0001), .driver_info = CIT_MODEL0 },
         { USB_DEVICE_VER(0x0545, 0x8080, 0x0002, 0x0002), .driver_info = CIT_MODEL1 },
         { USB_DEVICE_VER(0x0545, 0x8080, 0x030a, 0x030a), .driver_info = CIT_MODEL2 },
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index 14b85d48316..47236a58bf3 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -5793,7 +5793,7 @@ static void usb_exchange(struct gspca_dev *gspca_dev,
                         break;
                 default:
 /*              case 0xdd:       * delay */
-                        msleep(action->val / 64 + 10);
+                        msleep(action->idx);
                         break;
                 }
                 action++;
@@ -5830,7 +5830,7 @@ static void setmatrix(struct gspca_dev *gspca_dev)
                 [SENSOR_GC0305] =       gc0305_matrix,
                 [SENSOR_HDCS2020b] =    NULL,
                 [SENSOR_HV7131B] =      NULL,
-                [SENSOR_HV7131R] =      NULL,
+                [SENSOR_HV7131R] =      po2030_matrix,
                 [SENSOR_ICM105A] =      po2030_matrix,
                 [SENSOR_MC501CB] =      NULL,
                 [SENSOR_MT9V111_1] =    gc0305_matrix,
@@ -5936,6 +5936,7 @@ static void setquality(struct gspca_dev *gspca_dev)
         case SENSOR_ADCM2700:
         case SENSOR_GC0305:
         case SENSOR_HV7131B:
+        case SENSOR_HV7131R:
         case SENSOR_OV7620:
         case SENSOR_PAS202B:
         case SENSOR_PO2030:
@@ -6108,11 +6109,13 @@ static void send_unknown(struct gspca_dev *gspca_dev, int sensor)
                 reg_w(gspca_dev, 0x02, 0x003b);
                 reg_w(gspca_dev, 0x00, 0x0038);
                 break;
+        case SENSOR_HV7131R:
         case SENSOR_PAS202B:
                 reg_w(gspca_dev, 0x03, 0x003b);
                 reg_w(gspca_dev, 0x0c, 0x003a);
                 reg_w(gspca_dev, 0x0b, 0x0039);
-                reg_w(gspca_dev, 0x0b, 0x0038);
+                if (sensor == SENSOR_PAS202B)
+                        reg_w(gspca_dev, 0x0b, 0x0038);
                 break;
         }
 }
@@ -6704,10 +6707,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
                 reg_w(gspca_dev, 0x02, 0x003b);
                 reg_w(gspca_dev, 0x00, 0x0038);
                 break;
+        case SENSOR_HV7131R:
         case SENSOR_PAS202B:
                 reg_w(gspca_dev, 0x03, 0x003b);
                 reg_w(gspca_dev, 0x0c, 0x003a);
                 reg_w(gspca_dev, 0x0b, 0x0039);
+                if (sd->sensor == SENSOR_HV7131R)
+                        reg_w(gspca_dev, 0x50, ZC3XX_R11D_GLOBALGAIN);
                 break;
         }
 
@@ -6720,6 +6726,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
                 break;
         case SENSOR_PAS202B:
         case SENSOR_GC0305:
+        case SENSOR_HV7131R:
         case SENSOR_TAS5130C:
                 reg_r(gspca_dev, 0x0008);
                 /* fall thru */
@@ -6760,6 +6767,12 @@ static int sd_start(struct gspca_dev *gspca_dev)
                                                 /* ms-win + */
                 reg_w(gspca_dev, 0x40, 0x0117);
                 break;
+        case SENSOR_HV7131R:
+                i2c_write(gspca_dev, 0x25, 0x04, 0x00); /* exposure */
+                i2c_write(gspca_dev, 0x26, 0x93, 0x00);
+                i2c_write(gspca_dev, 0x27, 0xe0, 0x00);
+                reg_w(gspca_dev, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN);
+                break;
         case SENSOR_GC0305:
         case SENSOR_TAS5130C:
                 reg_w(gspca_dev, 0x09, 0x01ad); /* (from win traces) */
@@ -6808,9 +6821,17 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 {
         struct sd *sd = (struct sd *) gspca_dev;
 
-        if (data[0] == 0xff && data[1] == 0xd8) {       /* start of frame */
+        /* check the JPEG end of frame */
+        if (len >= 3
+         && data[len - 3] == 0xff && data[len - 2] == 0xd9) {
+/*fixme: what does the last byte mean?*/
                 gspca_frame_add(gspca_dev, LAST_PACKET,
-                                        NULL, 0);
+                                        data, len - 1);
+                return;
+        }
+
+        /* check the JPEG start of a frame */
+        if (data[0] == 0xff && data[1] == 0xd8) {
                 /* put the JPEG header in the new frame */
                 gspca_frame_add(gspca_dev, FIRST_PACKET,
                         sd->jpeg_hdr, JPEG_HDR_SZ);
@@ -6909,7 +6930,7 @@ static const struct sd_desc sd_desc = {
 #endif
 };
 
-static const __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x041e)},
         {USB_DEVICE(0x041e, 0x4017)},
         {USB_DEVICE(0x041e, 0x401c), .driver_info = SENSOR_PAS106},
diff --git a/drivers/media/video/hdpvr/Makefile b/drivers/media/video/hdpvr/Makefile
index e0230fcb2e3..3baa9f613ca 100644
--- a/drivers/media/video/hdpvr/Makefile
+++ b/drivers/media/video/hdpvr/Makefile
@@ -1,6 +1,4 @@
-hdpvr-objs      := hdpvr-control.o hdpvr-core.o hdpvr-video.o
-
-hdpvr-$(CONFIG_I2C) += hdpvr-i2c.o
+hdpvr-objs      := hdpvr-control.o hdpvr-core.o hdpvr-video.o hdpvr-i2c.o
 
 obj-$(CONFIG_VIDEO_HDPVR) += hdpvr.o
 
diff --git a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
index f7d1ee55185..a27d93b503a 100644
--- a/drivers/media/video/hdpvr/hdpvr-core.c
+++ b/drivers/media/video/hdpvr/hdpvr-core.c
@@ -283,6 +283,7 @@ static int hdpvr_probe(struct usb_interface *interface,
         struct hdpvr_device *dev;
         struct usb_host_interface *iface_desc;
         struct usb_endpoint_descriptor *endpoint;
+        struct i2c_client *client;
         size_t buffer_size;
         int i;
         int retval = -ENOMEM;
@@ -378,25 +379,35 @@ static int hdpvr_probe(struct usb_interface *interface,
                 goto error;
         }
 
-#ifdef CONFIG_I2C
-        /* until i2c is working properly */
-        retval = 0; /* hdpvr_register_i2c_adapter(dev); */
+#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
+        retval = hdpvr_register_i2c_adapter(dev);
         if (retval < 0) {
-                v4l2_err(&dev->v4l2_dev, "registering i2c adapter failed\n");
+                v4l2_err(&dev->v4l2_dev, "i2c adapter register failed\n");
                 goto error;
         }
 
-        /* until i2c is working properly */
-        retval = 0; /* hdpvr_register_i2c_ir(dev); */
-        if (retval < 0)
-                v4l2_err(&dev->v4l2_dev, "registering i2c IR devices failed\n");
-#endif /* CONFIG_I2C */
+        client = hdpvr_register_ir_rx_i2c(dev);
+        if (!client) {
+                v4l2_err(&dev->v4l2_dev, "i2c IR RX device register failed\n");
+                goto reg_fail;
+        }
+
+        client = hdpvr_register_ir_tx_i2c(dev);
+        if (!client) {
+                v4l2_err(&dev->v4l2_dev, "i2c IR TX device register failed\n");
+                goto reg_fail;
+        }
+#endif
 
         /* let the user know what node this device is now attached to */
         v4l2_info(&dev->v4l2_dev, "device now attached to %s\n",
                   video_device_node_name(dev->video_dev));
         return 0;
 
+reg_fail:
+#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
+        i2c_del_adapter(&dev->i2c_adapter);
+#endif
 error:
         if (dev) {
                 /* Destroy single thread */
@@ -426,6 +437,9 @@ static void hdpvr_disconnect(struct usb_interface *interface)
         mutex_lock(&dev->io_mutex);
         hdpvr_cancel_queue(dev);
         mutex_unlock(&dev->io_mutex);
+#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
+        i2c_del_adapter(&dev->i2c_adapter);
+#endif
         video_unregister_device(dev->video_dev);
         atomic_dec(&dev_nr);
 }
diff --git a/drivers/media/video/hdpvr/hdpvr-i2c.c b/drivers/media/video/hdpvr/hdpvr-i2c.c
index 24966aa02a7..e53fa55d56a 100644
--- a/drivers/media/video/hdpvr/hdpvr-i2c.c
+++ b/drivers/media/video/hdpvr/hdpvr-i2c.c
@@ -13,6 +13,8 @@
  *
  */
 
+#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
+
 #include <linux/i2c.h>
 #include <linux/slab.h>
 
@@ -28,106 +30,86 @@
 #define Z8F0811_IR_TX_I2C_ADDR  0x70
 #define Z8F0811_IR_RX_I2C_ADDR  0x71
 
-static const u8 ir_i2c_addrs[] = {
-        Z8F0811_IR_TX_I2C_ADDR,
-        Z8F0811_IR_RX_I2C_ADDR,
-};
-
-static const char * const ir_devicenames[] = {
-        "ir_tx_z8f0811_hdpvr",
-        "ir_rx_z8f0811_hdpvr",
-};
 
-static int hdpvr_new_i2c_ir(struct hdpvr_device *dev, struct i2c_adapter *adap,
-                            const char *type, u8 addr)
+struct i2c_client *hdpvr_register_ir_tx_i2c(struct hdpvr_device *dev)
 {
-        struct i2c_board_info info;
         struct IR_i2c_init_data *init_data = &dev->ir_i2c_init_data;
-        unsigned short addr_list[2] = { addr, I2C_CLIENT_END };
+        struct i2c_board_info hdpvr_ir_tx_i2c_board_info = {
+                I2C_BOARD_INFO("ir_tx_z8f0811_hdpvr", Z8F0811_IR_TX_I2C_ADDR),
+        };
 
-        memset(&info, 0, sizeof(struct i2c_board_info));
-        strlcpy(info.type, type, I2C_NAME_SIZE);
-
-        /* Our default information for ir-kbd-i2c.c to use */
-        switch (addr) {
-        case Z8F0811_IR_RX_I2C_ADDR:
-                init_data->ir_codes = RC_MAP_HAUPPAUGE_NEW;
-                init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR;
-                init_data->type = RC_TYPE_RC5;
-                init_data->name = "HD PVR";
-                info.platform_data = init_data;
-                break;
-        }
+        init_data->name = "HD-PVR";
+        hdpvr_ir_tx_i2c_board_info.platform_data = init_data;
 
-        return i2c_new_probed_device(adap, &info, addr_list, NULL) == NULL ?
-               -1 : 0;
+        return i2c_new_device(&dev->i2c_adapter, &hdpvr_ir_tx_i2c_board_info);
 }
 
-int hdpvr_register_i2c_ir(struct hdpvr_device *dev)
+struct i2c_client *hdpvr_register_ir_rx_i2c(struct hdpvr_device *dev)
 {
-        int i;
-        int ret = 0;
+        struct IR_i2c_init_data *init_data = &dev->ir_i2c_init_data;
+        struct i2c_board_info hdpvr_ir_rx_i2c_board_info = {
+                I2C_BOARD_INFO("ir_rx_z8f0811_hdpvr", Z8F0811_IR_RX_I2C_ADDR),
+        };
 
-        for (i = 0; i < ARRAY_SIZE(ir_i2c_addrs); i++)
-                ret += hdpvr_new_i2c_ir(dev, dev->i2c_adapter,
-                                        ir_devicenames[i], ir_i2c_addrs[i]);
+        /* Our default information for ir-kbd-i2c.c to use */
+        init_data->ir_codes = RC_MAP_HAUPPAUGE_NEW;
+        init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR;
+        init_data->type = RC_TYPE_RC5;
+        init_data->name = "HD-PVR";
+        hdpvr_ir_rx_i2c_board_info.platform_data = init_data;
 
-        return ret;
+        return i2c_new_device(&dev->i2c_adapter, &hdpvr_ir_rx_i2c_board_info);
 }
 
-static int hdpvr_i2c_read(struct hdpvr_device *dev, unsigned char addr,
-                          char *data, int len)
+static int hdpvr_i2c_read(struct hdpvr_device *dev, int bus,
+                          unsigned char addr, char *data, int len)
 {
         int ret;
-        char *buf = kmalloc(len, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
+
+        if (len > sizeof(dev->i2c_buf))
+                return -EINVAL;
 
         ret = usb_control_msg(dev->udev,
                               usb_rcvctrlpipe(dev->udev, 0),
                               REQTYPE_I2C_READ, CTRL_READ_REQUEST,
-                              0x100|addr, 0, buf, len, 1000);
+                              (bus << 8) | addr, 0, &dev->i2c_buf, len, 1000);
 
         if (ret == len) {
-                memcpy(data, buf, len);
+                memcpy(data, &dev->i2c_buf, len);
                 ret = 0;
         } else if (ret >= 0)
                 ret = -EIO;
 
-        kfree(buf);
-
         return ret;
 }
 
-static int hdpvr_i2c_write(struct hdpvr_device *dev, unsigned char addr,
-                           char *data, int len)
+static int hdpvr_i2c_write(struct hdpvr_device *dev, int bus,
+                           unsigned char addr, char *data, int len)
 {
         int ret;
-        char *buf = kmalloc(len, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
 
-        memcpy(buf, data, len);
+        if (len > sizeof(dev->i2c_buf))
+                return -EINVAL;
+
+        memcpy(&dev->i2c_buf, data, len);
         ret = usb_control_msg(dev->udev,
                               usb_sndctrlpipe(dev->udev, 0),
                               REQTYPE_I2C_WRITE, CTRL_WRITE_REQUEST,
-                              0x100|addr, 0, buf, len, 1000);
+                              (bus << 8) | addr, 0, &dev->i2c_buf, len, 1000);
 
         if (ret < 0)
-                goto error;
+                return ret;
 
         ret = usb_control_msg(dev->udev,
                               usb_rcvctrlpipe(dev->udev, 0),
                               REQTYPE_I2C_WRITE_STATT, CTRL_READ_REQUEST,
-                              0, 0, buf, 2, 1000);
+                              0, 0, &dev->i2c_buf, 2, 1000);
 
-        if (ret == 2)
+        if ((ret == 2) && (dev->i2c_buf[1] == (len - 1)))
                 ret = 0;
         else if (ret >= 0)
                 ret = -EIO;
 
-error:
-        kfree(buf);
         return ret;
 }
 
@@ -146,10 +128,10 @@ static int hdpvr_transfer(struct i2c_adapter *i2c_adapter, struct i2c_msg *msgs,
                 addr = msgs[i].addr << 1;
 
                 if (msgs[i].flags & I2C_M_RD)
-                        retval = hdpvr_i2c_read(dev, addr, msgs[i].buf,
+                        retval = hdpvr_i2c_read(dev, 1, addr, msgs[i].buf,
                                                 msgs[i].len);
                 else
-                        retval = hdpvr_i2c_write(dev, addr, msgs[i].buf,
+                        retval = hdpvr_i2c_write(dev, 1, addr, msgs[i].buf,
                                                  msgs[i].len);
         }
 
@@ -168,30 +150,47 @@ static struct i2c_algorithm hdpvr_algo = {
         .functionality = hdpvr_functionality,
 };
 
+static struct i2c_adapter hdpvr_i2c_adapter_template = {
+        .name   = "Hauppage HD PVR I2C",
+        .owner  = THIS_MODULE,
+        .algo   = &hdpvr_algo,
+};
+
+static int hdpvr_activate_ir(struct hdpvr_device *dev)
+{
+        char buffer[8];
+
+        mutex_lock(&dev->i2c_mutex);
+
+        hdpvr_i2c_read(dev, 0, 0x54, buffer, 1);
+
+        buffer[0] = 0;
+        buffer[1] = 0x8;
+        hdpvr_i2c_write(dev, 1, 0x54, buffer, 2);
+
+        buffer[1] = 0x18;
+        hdpvr_i2c_write(dev, 1, 0x54, buffer, 2);
+
+        mutex_unlock(&dev->i2c_mutex);
+
+        return 0;
+}
+
 int hdpvr_register_i2c_adapter(struct hdpvr_device *dev)
 {
-        struct i2c_adapter *i2c_adap;
         int retval = -ENOMEM;
 
-        i2c_adap = kzalloc(sizeof(struct i2c_adapter), GFP_KERNEL);
-        if (i2c_adap == NULL)
-                goto error;
-
-        strlcpy(i2c_adap->name, "Hauppauge HD PVR I2C",
-                sizeof(i2c_adap->name));
-        i2c_adap->algo  = &hdpvr_algo;
-        i2c_adap->owner = THIS_MODULE;
-        i2c_adap->dev.parent = &dev->udev->dev;
+        hdpvr_activate_ir(dev);
 
-        i2c_set_adapdata(i2c_adap, dev);
+        memcpy(&dev->i2c_adapter, &hdpvr_i2c_adapter_template,
+               sizeof(struct i2c_adapter));
+        dev->i2c_adapter.dev.parent = &dev->udev->dev;
 
-        retval = i2c_add_adapter(i2c_adap);
+        i2c_set_adapdata(&dev->i2c_adapter, dev);
 
-        if (!retval)
-                dev->i2c_adapter = i2c_adap;
-        else
-                kfree(i2c_adap);
+        retval = i2c_add_adapter(&dev->i2c_adapter);
 
-error:
         return retval;
 }
+
+#endif
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index d38fe1043e4..514aea76eaa 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -1220,12 +1220,9 @@ static void hdpvr_device_release(struct video_device *vdev)
         v4l2_device_unregister(&dev->v4l2_dev);
 
         /* deregister I2C adapter */
-#ifdef CONFIG_I2C
+#if defined(CONFIG_I2C) || (CONFIG_I2C_MODULE)
         mutex_lock(&dev->i2c_mutex);
-        if (dev->i2c_adapter)
-                i2c_del_adapter(dev->i2c_adapter);
-        kfree(dev->i2c_adapter);
-        dev->i2c_adapter = NULL;
+        i2c_del_adapter(&dev->i2c_adapter);
         mutex_unlock(&dev->i2c_mutex);
 #endif /* CONFIG_I2C */
 
diff --git a/drivers/media/video/hdpvr/hdpvr.h b/drivers/media/video/hdpvr/hdpvr.h
index 37f1e4c7675..072f23c570f 100644
--- a/drivers/media/video/hdpvr/hdpvr.h
+++ b/drivers/media/video/hdpvr/hdpvr.h
@@ -25,6 +25,7 @@
         KERNEL_VERSION(HDPVR_MAJOR_VERSION, HDPVR_MINOR_VERSION, HDPVR_RELEASE)
 
 #define HDPVR_MAX 8
+#define HDPVR_I2C_MAX_SIZE 128
 
 /* Define these values to match your devices */
 #define HD_PVR_VENDOR_ID        0x2040
@@ -106,9 +107,11 @@ struct hdpvr_device {
         struct work_struct      worker;
 
         /* I2C adapter */
-        struct i2c_adapter      *i2c_adapter;
+        struct i2c_adapter      i2c_adapter;
         /* I2C lock */
         struct mutex            i2c_mutex;
+        /* I2C message buffer space */
+        char                    i2c_buf[HDPVR_I2C_MAX_SIZE];
 
         /* For passing data to ir-kbd-i2c */
         struct IR_i2c_init_data ir_i2c_init_data;
@@ -310,7 +313,8 @@ int hdpvr_cancel_queue(struct hdpvr_device *dev);
 /* i2c adapter registration */
 int hdpvr_register_i2c_adapter(struct hdpvr_device *dev);
 
-int hdpvr_register_i2c_ir(struct hdpvr_device *dev);
+struct i2c_client *hdpvr_register_ir_rx_i2c(struct hdpvr_device *dev);
+struct i2c_client *hdpvr_register_ir_tx_i2c(struct hdpvr_device *dev);
 
 /*========================================================================*/
 /* buffer management */
diff --git a/drivers/media/video/ir-kbd-i2c.c b/drivers/media/video/ir-kbd-i2c.c
index c87b6bc4555..a221ad68b33 100644
--- a/drivers/media/video/ir-kbd-i2c.c
+++ b/drivers/media/video/ir-kbd-i2c.c
@@ -128,6 +128,19 @@ static int get_key_haup(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 
 static int get_key_haup_xvr(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 {
+        int ret;
+        unsigned char buf[1] = { 0 };
+
+        /*
+         * This is the same apparent "are you ready?" poll command observed
+         * watching Windows driver traffic and implemented in lirc_zilog. With
+         * this added, we get far saner remote behavior with z8 chips on usb
+         * connected devices, even with the default polling interval of 100ms.
+         */
+        ret = i2c_master_send(ir->c, buf, 1);
+        if (ret != 1)
+                return (ret < 0) ? ret : -EINVAL;
+
         return get_key_haup_common (ir, ir_key, ir_raw, 6, 3);
 }
 
@@ -244,15 +257,17 @@ static void ir_key_poll(struct IR_i2c *ir)
         static u32 ir_key, ir_raw;
         int rc;
 
-        dprintk(2,"ir_poll_key\n");
+        dprintk(3, "%s\n", __func__);
         rc = ir->get_key(ir, &ir_key, &ir_raw);
         if (rc < 0) {
                 dprintk(2,"error\n");
                 return;
         }
 
-        if (rc)
+        if (rc) {
+                dprintk(1, "%s: keycode = 0x%04x\n", __func__, ir_key);
                 rc_keydown(ir->rc, ir_key, 0);
+        }
 }
 
 static void ir_work(struct work_struct *work)
@@ -321,6 +336,12 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
                 rc_type     = RC_TYPE_OTHER;
                 ir_codes    = RC_MAP_AVERMEDIA_CARDBUS;
                 break;
+        case 0x71:
+                name        = "Hauppauge/Zilog Z8";
+                ir->get_key = get_key_haup_xvr;
+                rc_type     = RC_TYPE_RC5;
+                ir_codes    = hauppauge ? RC_MAP_HAUPPAUGE_NEW : RC_MAP_RC5_TV;
+                break;
         }
 
         /* Let the caller override settings */
diff --git a/drivers/media/video/ivtv/ivtv-i2c.c b/drivers/media/video/ivtv/ivtv-i2c.c
index e103b8fc745..9fb86a081c0 100644
--- a/drivers/media/video/ivtv/ivtv-i2c.c
+++ b/drivers/media/video/ivtv/ivtv-i2c.c
@@ -300,10 +300,15 @@ int ivtv_i2c_register(struct ivtv *itv, unsigned idx)
                                 adap, type, 0, I2C_ADDRS(hw_addrs[idx]));
         } else if (hw == IVTV_HW_CX25840) {
                 struct cx25840_platform_data pdata;
+                struct i2c_board_info cx25840_info = {
+                        .type = "cx25840",
+                        .addr = hw_addrs[idx],
+                        .platform_data = &pdata,
+                };
 
                 pdata.pvr150_workaround = itv->pvr150_workaround;
-                sd = v4l2_i2c_new_subdev_cfg(&itv->v4l2_dev,
-                                adap, type, 0, &pdata, hw_addrs[idx], NULL);
+                sd = v4l2_i2c_new_subdev_board(&itv->v4l2_dev, adap,
+                                &cx25840_info, NULL);
         } else {
                 sd = v4l2_i2c_new_subdev(&itv->v4l2_dev,
                                 adap, type, hw_addrs[idx], NULL);
diff --git a/drivers/media/video/mt9v011.c b/drivers/media/video/mt9v011.c
index 209ff97261a..4904d25f689 100644
--- a/drivers/media/video/mt9v011.c
+++ b/drivers/media/video/mt9v011.c
@@ -12,17 +12,41 @@
 #include <asm/div64.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-chip-ident.h>
-#include "mt9v011.h"
+#include <media/mt9v011.h>
 
 MODULE_DESCRIPTION("Micron mt9v011 sensor driver");
 MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@redhat.com>");
 MODULE_LICENSE("GPL");
 
-
 static int debug;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0-2)");
 
+#define R00_MT9V011_CHIP_VERSION        0x00
+#define R01_MT9V011_ROWSTART            0x01
+#define R02_MT9V011_COLSTART            0x02
+#define R03_MT9V011_HEIGHT              0x03
+#define R04_MT9V011_WIDTH               0x04
+#define R05_MT9V011_HBLANK              0x05
+#define R06_MT9V011_VBLANK              0x06
+#define R07_MT9V011_OUT_CTRL            0x07
+#define R09_MT9V011_SHUTTER_WIDTH       0x09
+#define R0A_MT9V011_CLK_SPEED           0x0a
+#define R0B_MT9V011_RESTART             0x0b
+#define R0C_MT9V011_SHUTTER_DELAY       0x0c
+#define R0D_MT9V011_RESET               0x0d
+#define R1E_MT9V011_DIGITAL_ZOOM        0x1e
+#define R20_MT9V011_READ_MODE           0x20
+#define R2B_MT9V011_GREEN_1_GAIN        0x2b
+#define R2C_MT9V011_BLUE_GAIN           0x2c
+#define R2D_MT9V011_RED_GAIN            0x2d
+#define R2E_MT9V011_GREEN_2_GAIN        0x2e
+#define R35_MT9V011_GLOBAL_GAIN         0x35
+#define RF1_MT9V011_CHIP_ENABLE         0xf1
+
+#define MT9V011_VERSION                 0x8232
+#define MT9V011_REV_B_VERSION           0x8243
+
 /* supported controls */
 static struct v4l2_queryctrl mt9v011_qctrl[] = {
         {
@@ -469,23 +493,6 @@ static int mt9v011_s_mbus_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt
         return 0;
 }
 
-static int mt9v011_s_config(struct v4l2_subdev *sd, int dumb, void *data)
-{
-        struct mt9v011 *core = to_mt9v011(sd);
-        unsigned *xtal = data;
-
-        v4l2_dbg(1, debug, sd, "s_config called\n");
-
-        if (xtal) {
-                core->xtal = *xtal;
-                v4l2_dbg(1, debug, sd, "xtal set to %d.%03d MHz\n",
-                         *xtal / 1000000, (*xtal / 1000) % 1000);
-        }
-
-        return 0;
-}
-
-
 #ifdef CONFIG_VIDEO_ADV_DEBUG
 static int mt9v011_g_register(struct v4l2_subdev *sd,
                               struct v4l2_dbg_register *reg)
@@ -536,7 +543,6 @@ static const struct v4l2_subdev_core_ops mt9v011_core_ops = {
         .g_ctrl = mt9v011_g_ctrl,
         .s_ctrl = mt9v011_s_ctrl,
         .reset = mt9v011_reset,
-        .s_config = mt9v011_s_config,
         .g_chip_ident = mt9v011_g_chip_ident,
 #ifdef CONFIG_VIDEO_ADV_DEBUG
         .g_register = mt9v011_g_register,
@@ -596,6 +602,14 @@ static int mt9v011_probe(struct i2c_client *c,
         core->height = 480;
         core->xtal = 27000000;  /* Hz */
 
+        if (c->dev.platform_data) {
+                struct mt9v011_platform_data *pdata = c->dev.platform_data;
+
+                core->xtal = pdata->xtal;
+                v4l2_dbg(1, debug, sd, "xtal set to %d.%03d MHz\n",
+                        core->xtal / 1000000, (core->xtal / 1000) % 1000);
+        }
+
         v4l_info(c, "chip found @ 0x%02x (%s - chip version 0x%04x)\n",
                  c->addr << 1, c->adapter->name, version);
 
diff --git a/drivers/media/video/mt9v011.h b/drivers/media/video/mt9v011.h
deleted file mode 100644
index 3350fd6083c..00000000000
--- a/drivers/media/video/mt9v011.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * mt9v011 -Micron 1/4-Inch VGA Digital Image Sensor
- *
- * Copyright (c) 2009 Mauro Carvalho Chehab (mchehab@redhat.com)
- * This code is placed under the terms of the GNU General Public License v2
- */
-
-#ifndef MT9V011_H_
-#define MT9V011_H_
-
-#define R00_MT9V011_CHIP_VERSION        0x00
-#define R01_MT9V011_ROWSTART            0x01
-#define R02_MT9V011_COLSTART            0x02
-#define R03_MT9V011_HEIGHT              0x03
-#define R04_MT9V011_WIDTH               0x04
-#define R05_MT9V011_HBLANK              0x05
-#define R06_MT9V011_VBLANK              0x06
-#define R07_MT9V011_OUT_CTRL            0x07
-#define R09_MT9V011_SHUTTER_WIDTH       0x09
-#define R0A_MT9V011_CLK_SPEED           0x0a
-#define R0B_MT9V011_RESTART             0x0b
-#define R0C_MT9V011_SHUTTER_DELAY       0x0c
-#define R0D_MT9V011_RESET               0x0d
-#define R1E_MT9V011_DIGITAL_ZOOM        0x1e
-#define R20_MT9V011_READ_MODE           0x20
-#define R2B_MT9V011_GREEN_1_GAIN        0x2b
-#define R2C_MT9V011_BLUE_GAIN           0x2c
-#define R2D_MT9V011_RED_GAIN            0x2d
-#define R2E_MT9V011_GREEN_2_GAIN        0x2e
-#define R35_MT9V011_GLOBAL_GAIN         0x35
-#define RF1_MT9V011_CHIP_ENABLE         0xf1
-
-#define MT9V011_VERSION                 0x8232
-#define MT9V011_REV_B_VERSION           0x8243
-
-#endif
diff --git a/drivers/media/video/ov7670.c b/drivers/media/video/ov7670.c
index c881a64b41f..d4e7c11553c 100644
--- a/drivers/media/video/ov7670.c
+++ b/drivers/media/video/ov7670.c
@@ -1449,47 +1449,6 @@ static int ov7670_g_chip_ident(struct v4l2_subdev *sd,
         return v4l2_chip_ident_i2c_client(client, chip, V4L2_IDENT_OV7670, 0);
 }
 
-static int ov7670_s_config(struct v4l2_subdev *sd, int dumb, void *data)
-{
-        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        struct ov7670_config *config = data;
-        struct ov7670_info *info = to_state(sd);
-        int ret;
-
-        info->clock_speed = 30; /* default: a guess */
-
-        /*
-         * Must apply configuration before initializing device, because it
-         * selects I/O method.
-         */
-        if (config) {
-                info->min_width = config->min_width;
-                info->min_height = config->min_height;
-                info->use_smbus = config->use_smbus;
-
-                if (config->clock_speed)
-                        info->clock_speed = config->clock_speed;
-        }
-
-        /* Make sure it's an ov7670 */
-        ret = ov7670_detect(sd);
-        if (ret) {
-                v4l_dbg(1, debug, client,
-                        "chip found @ 0x%x (%s) is not an ov7670 chip.\n",
-                        client->addr << 1, client->adapter->name);
-                kfree(info);
-                return ret;
-        }
-        v4l_info(client, "chip found @ 0x%02x (%s)\n",
-                        client->addr << 1, client->adapter->name);
-
-        info->fmt = &ov7670_formats[0];
-        info->sat = 128;        /* Review this */
-        info->clkrc = info->clock_speed / 30;
-
-        return 0;
-}
-
 #ifdef CONFIG_VIDEO_ADV_DEBUG
 static int ov7670_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
 {
@@ -1528,7 +1487,6 @@ static const struct v4l2_subdev_core_ops ov7670_core_ops = {
         .s_ctrl = ov7670_s_ctrl,
         .queryctrl = ov7670_queryctrl,
         .reset = ov7670_reset,
-        .s_config = ov7670_s_config,
         .init = ov7670_init,
 #ifdef CONFIG_VIDEO_ADV_DEBUG
         .g_register = ov7670_g_register,
@@ -1558,6 +1516,7 @@ static int ov7670_probe(struct i2c_client *client,
 {
         struct v4l2_subdev *sd;
         struct ov7670_info *info;
+        int ret;
 
         info = kzalloc(sizeof(struct ov7670_info), GFP_KERNEL);
         if (info == NULL)
@@ -1565,6 +1524,37 @@ static int ov7670_probe(struct i2c_client *client,
         sd = &info->sd;
         v4l2_i2c_subdev_init(sd, client, &ov7670_ops);
 
+        info->clock_speed = 30; /* default: a guess */
+        if (client->dev.platform_data) {
+                struct ov7670_config *config = client->dev.platform_data;
+
+                /*
+                 * Must apply configuration before initializing device, because it
+                 * selects I/O method.
+                 */
+                info->min_width = config->min_width;
+                info->min_height = config->min_height;
+                info->use_smbus = config->use_smbus;
+
+                if (config->clock_speed)
+                        info->clock_speed = config->clock_speed;
+        }
+
+        /* Make sure it's an ov7670 */
+        ret = ov7670_detect(sd);
+        if (ret) {
+                v4l_dbg(1, debug, client,
+                        "chip found @ 0x%x (%s) is not an ov7670 chip.\n",
+                        client->addr << 1, client->adapter->name);
+                kfree(info);
+                return ret;
+        }
+        v4l_info(client, "chip found @ 0x%02x (%s)\n",
+                        client->addr << 1, client->adapter->name);
+
+        info->fmt = &ov7670_formats[0];
+        info->sat = 128;        /* Review this */
+        info->clkrc = info->clock_speed / 30;
         return 0;
 }
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
index ac94a8bf883..305e6aaa844 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
@@ -40,6 +40,7 @@
 #include "pvrusb2-io.h"
 #include <media/v4l2-device.h>
 #include <media/cx2341x.h>
+#include <media/ir-kbd-i2c.h>
 #include "pvrusb2-devattr.h"
 
 /* Legal values for PVR2_CID_HSM */
@@ -202,6 +203,7 @@ struct pvr2_hdw {
 
         /* IR related */
         unsigned int ir_scheme_active; /* IR scheme as seen from the outside */
+        struct IR_i2c_init_data ir_init_data; /* params passed to IR modules */
 
         /* Frequency table */
         unsigned int freqTable[FREQTABLE_SIZE];
diff --git a/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c b/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
index 7cbe18c4ca9..451ecd485f9 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/i2c.h>
+#include <media/ir-kbd-i2c.h>
 #include "pvrusb2-i2c-core.h"
 #include "pvrusb2-hdw-internal.h"
 #include "pvrusb2-debug.h"
@@ -48,13 +49,6 @@ module_param_named(disable_autoload_ir_video, pvr2_disable_ir_video,
 MODULE_PARM_DESC(disable_autoload_ir_video,
                  "1=do not try to autoload ir_video IR receiver");
 
-/* Mapping of IR schemes to known I2C addresses - if any */
-static const unsigned char ir_video_addresses[] = {
-        [PVR2_IR_SCHEME_ZILOG] = 0x71,
-        [PVR2_IR_SCHEME_29XXX] = 0x18,
-        [PVR2_IR_SCHEME_24XXX] = 0x18,
-};
-
 static int pvr2_i2c_write(struct pvr2_hdw *hdw, /* Context */
                           u8 i2c_addr,      /* I2C address we're talking to */
                           u8 *data,         /* Data to write */
@@ -574,26 +568,55 @@ static void do_i2c_scan(struct pvr2_hdw *hdw)
 static void pvr2_i2c_register_ir(struct pvr2_hdw *hdw)
 {
         struct i2c_board_info info;
-        unsigned char addr = 0;
+        struct IR_i2c_init_data *init_data = &hdw->ir_init_data;
         if (pvr2_disable_ir_video) {
                 pvr2_trace(PVR2_TRACE_INFO,
                            "Automatic binding of ir_video has been disabled.");
                 return;
         }
-        if (hdw->ir_scheme_active < ARRAY_SIZE(ir_video_addresses)) {
-                addr = ir_video_addresses[hdw->ir_scheme_active];
-        }
-        if (!addr) {
+        memset(&info, 0, sizeof(struct i2c_board_info));
+        switch (hdw->ir_scheme_active) {
+        case PVR2_IR_SCHEME_24XXX: /* FX2-controlled IR */
+        case PVR2_IR_SCHEME_29XXX: /* Original 29xxx device */
+                init_data->ir_codes              = RC_MAP_HAUPPAUGE_NEW;
+                init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP;
+                init_data->type                  = RC_TYPE_RC5;
+                init_data->name                  = hdw->hdw_desc->description;
+                init_data->polling_interval      = 100; /* ms From ir-kbd-i2c */
+                /* IR Receiver */
+                info.addr          = 0x18;
+                info.platform_data = init_data;
+                strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+                pvr2_trace(PVR2_TRACE_INFO, "Binding %s to i2c address 0x%02x.",
+                           info.type, info.addr);
+                i2c_new_device(&hdw->i2c_adap, &info);
+                break;
+        case PVR2_IR_SCHEME_ZILOG:     /* HVR-1950 style */
+        case PVR2_IR_SCHEME_24XXX_MCE: /* 24xxx MCE device */
+                init_data->ir_codes              = RC_MAP_HAUPPAUGE_NEW;
+                init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR;
+                init_data->type                  = RC_TYPE_RC5;
+                init_data->name                  = hdw->hdw_desc->description;
+                /* IR Receiver */
+                info.addr          = 0x71;
+                info.platform_data = init_data;
+                strlcpy(info.type, "ir_rx_z8f0811_haup", I2C_NAME_SIZE);
+                pvr2_trace(PVR2_TRACE_INFO, "Binding %s to i2c address 0x%02x.",
+                           info.type, info.addr);
+                i2c_new_device(&hdw->i2c_adap, &info);
+                /* IR Trasmitter */
+                info.addr          = 0x70;
+                info.platform_data = init_data;
+                strlcpy(info.type, "ir_tx_z8f0811_haup", I2C_NAME_SIZE);
+                pvr2_trace(PVR2_TRACE_INFO, "Binding %s to i2c address 0x%02x.",
+                           info.type, info.addr);
+                i2c_new_device(&hdw->i2c_adap, &info);
+                break;
+        default:
                 /* The device either doesn't support I2C-based IR or we
                    don't know (yet) how to operate IR on the device. */
-                return;
+                break;
         }
-        pvr2_trace(PVR2_TRACE_INFO,
-                   "Binding ir_video to i2c address 0x%02x.", addr);
-        memset(&info, 0, sizeof(struct i2c_board_info));
-        strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
-        info.addr = addr;
-        i2c_new_device(&hdw->i2c_adap, &info);
 }
 
 void pvr2_i2c_core_init(struct pvr2_hdw *hdw)
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index f35459d1f42..0db90922ee9 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -1565,7 +1565,7 @@ static int saa711x_probe(struct i2c_client *client,
         chip_id = name[5];
 
         /* Check whether this chip is part of the saa711x series */
-        if (memcmp(name, "1f711", 5)) {
+        if (memcmp(name + 1, "f711", 4)) {
                 v4l_dbg(1, debug, client, "chip found @ 0x%x (ID %s) does not match a known saa711x chip.\n",
                         client->addr << 1, name);
                 return -ENODEV;
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index e7aa588c6c5..deb8fcf4aa4 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -5179,18 +5179,8 @@ struct saa7134_board saa7134_boards[] = {
         [SAA7134_BOARD_KWORLD_PCI_SBTVD_FULLSEG] = {
                 .name           = "Kworld PCI SBTVD/ISDB-T Full-Seg Hybrid",
                 .audio_clock    = 0x00187de7,
-#if 0
-        /*
-         * FIXME: Analog mode doesn't work, if digital is enabled. The proper
-         * fix is to use tda8290 driver, but Kworld seems to use an
-         * unsupported version of tda8295.
-         */
-                .tuner_type     = TUNER_NXP_TDA18271,   /* TUNER_PHILIPS_TDA8290 */
-                .tuner_addr     = 0x60,
-#else
-                .tuner_type     = UNSET,
+                .tuner_type     = TUNER_PHILIPS_TDA8290,
                 .tuner_addr     = ADDR_UNSET,
-#endif
                 .radio_type     = UNSET,
                 .radio_addr     = ADDR_UNSET,
                 .gpiomask       = 0x8e054000,
@@ -6932,10 +6922,17 @@ static inline int saa7134_kworld_sbtvd_toggle_agc(struct saa7134_dev *dev,
         /* toggle AGC switch through GPIO 27 */
         switch (mode) {
         case TDA18271_ANALOG:
-                saa7134_set_gpio(dev, 27, 0);
+                saa_writel(SAA7134_GPIO_GPMODE0 >> 2, 0x4000);
+                saa_writel(SAA7134_GPIO_GPSTATUS0 >> 2, 0x4000);
+                msleep(20);
                 break;
         case TDA18271_DIGITAL:
-                saa7134_set_gpio(dev, 27, 1);
+                saa_writel(SAA7134_GPIO_GPMODE0 >> 2, 0x14000);
+                saa_writel(SAA7134_GPIO_GPSTATUS0 >> 2, 0x14000);
+                msleep(20);
+                saa_writel(SAA7134_GPIO_GPMODE0 >> 2, 0x54000);
+                saa_writel(SAA7134_GPIO_GPSTATUS0 >> 2, 0x54000);
+                msleep(30);
                 break;
         default:
                 return -EINVAL;
@@ -6993,6 +6990,7 @@ static int saa7134_tda8290_callback(struct saa7134_dev *dev,
 int saa7134_tuner_callback(void *priv, int component, int command, int arg)
 {
         struct saa7134_dev *dev = priv;
+
         if (dev != NULL) {
                 switch (dev->tuner_type) {
                 case TUNER_PHILIPS_TDA8290:
@@ -7659,36 +7657,11 @@ int saa7134_board_init2(struct saa7134_dev *dev)
                 break;
         }
         case SAA7134_BOARD_KWORLD_PCI_SBTVD_FULLSEG:
-        {
-                struct i2c_msg msg = { .addr = 0x4b, .flags = 0 };
-                int i;
-                static u8 buffer[][2] = {
-                        {0x30, 0x31},
-                        {0xff, 0x00},
-                        {0x41, 0x03},
-                        {0x41, 0x1a},
-                        {0xff, 0x02},
-                        {0x34, 0x00},
-                        {0x45, 0x97},
-                        {0x45, 0xc1},
-                };
                 saa_writel(SAA7134_GPIO_GPMODE0 >> 2, 0x4000);
                 saa_writel(SAA7134_GPIO_GPSTATUS0 >> 2, 0x4000);
 
-                /*
-                 * FIXME: identify what device is at addr 0x4b and what means
-                 * this initialization
-                 */
-                for (i = 0; i < ARRAY_SIZE(buffer); i++) {
-                        msg.buf = &buffer[i][0];
-                        msg.len = ARRAY_SIZE(buffer[0]);
-                        if (i2c_transfer(&dev->i2c_adap, &msg, 1) != 1)
-                                printk(KERN_WARNING
-                                       "%s: Unable to enable tuner(%i).\n",
-                                       dev->name, i);
-                }
+                saa7134_set_gpio(dev, 27, 0);
                 break;
-        }
         } /* switch() */
 
         /* initialize tuner */
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 3315a48a848..f65cad287b8 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -237,12 +237,39 @@ static struct tda18271_std_map mb86a20s_tda18271_std_map = {
 static struct tda18271_config kworld_tda18271_config = {
         .std_map = &mb86a20s_tda18271_std_map,
         .gate    = TDA18271_GATE_DIGITAL,
+        .config  = 3,   /* Use tuner callback for AGC */
+
 };
 
 static const struct mb86a20s_config kworld_mb86a20s_config = {
         .demod_address = 0x10,
 };
 
+static int kworld_sbtvd_gate_ctrl(struct dvb_frontend* fe, int enable)
+{
+        struct saa7134_dev *dev = fe->dvb->priv;
+
+        unsigned char initmsg[] = {0x45, 0x97};
+        unsigned char msg_enable[] = {0x45, 0xc1};
+        unsigned char msg_disable[] = {0x45, 0x81};
+        struct i2c_msg msg = {.addr = 0x4b, .flags = 0, .buf = initmsg, .len = 2};
+
+        if (i2c_transfer(&dev->i2c_adap, &msg, 1) != 1) {
+                wprintk("could not access the I2C gate\n");
+                return -EIO;
+        }
+        if (enable)
+                msg.buf = msg_enable;
+        else
+                msg.buf = msg_disable;
+        if (i2c_transfer(&dev->i2c_adap, &msg, 1) != 1) {
+                wprintk("could not access the I2C gate\n");
+                return -EIO;
+        }
+        msleep(20);
+        return 0;
+}
+
 /* ==================================================================
  * tda1004x based DVB-T cards, helper functions
  */
@@ -623,37 +650,6 @@ static struct tda827x_config tda827x_cfg_2_sw42 = {
 
 /* ------------------------------------------------------------------ */
 
-static int __kworld_sbtvd_i2c_gate_ctrl(struct saa7134_dev *dev, int enable)
-{
-        unsigned char initmsg[] = {0x45, 0x97};
-        unsigned char msg_enable[] = {0x45, 0xc1};
-        unsigned char msg_disable[] = {0x45, 0x81};
-        struct i2c_msg msg = {.addr = 0x4b, .flags = 0, .buf = initmsg, .len = 2};
-
-        if (i2c_transfer(&dev->i2c_adap, &msg, 1) != 1) {
-                wprintk("could not access the I2C gate\n");
-                return -EIO;
-        }
-        if (enable)
-                msg.buf = msg_enable;
-        else
-                msg.buf = msg_disable;
-        if (i2c_transfer(&dev->i2c_adap, &msg, 1) != 1) {
-                wprintk("could not access the I2C gate\n");
-                return -EIO;
-        }
-        msleep(20);
-        return 0;
-}
-static int kworld_sbtvd_i2c_gate_ctrl(struct dvb_frontend *fe, int enable)
-{
-        struct saa7134_dev *dev = fe->dvb->priv;
-
-        return __kworld_sbtvd_i2c_gate_ctrl(dev, enable);
-}
-
-/* ------------------------------------------------------------------ */
-
 static struct tda1004x_config tda827x_lifeview_config = {
         .demod_address = 0x08,
         .invert        = 1,
@@ -1660,27 +1656,23 @@ static int dvb_init(struct saa7134_dev *dev)
                 }
                 break;
         case SAA7134_BOARD_KWORLD_PCI_SBTVD_FULLSEG:
-                __kworld_sbtvd_i2c_gate_ctrl(dev, 0);
-                saa_writel(SAA7134_GPIO_GPMODE0 >> 2, 0x14000);
-                saa_writel(SAA7134_GPIO_GPSTATUS0 >> 2, 0x14000);
-                msleep(20);
-                saa_writel(SAA7134_GPIO_GPMODE0 >> 2, 0x54000);
-                saa_writel(SAA7134_GPIO_GPSTATUS0 >> 2, 0x54000);
-                msleep(20);
+                /* Switch to digital mode */
+                saa7134_tuner_callback(dev, 0,
+                                       TDA18271_CALLBACK_CMD_AGC_ENABLE, 1);
                 fe0->dvb.frontend = dvb_attach(mb86a20s_attach,
                                                &kworld_mb86a20s_config,
                                                &dev->i2c_adap);
-                __kworld_sbtvd_i2c_gate_ctrl(dev, 1);
                 if (fe0->dvb.frontend != NULL) {
+                        dvb_attach(tda829x_attach, fe0->dvb.frontend,
+                                   &dev->i2c_adap, 0x4b,
+                                   &tda829x_no_probe);
                         dvb_attach(tda18271_attach, fe0->dvb.frontend,
                                    0x60, &dev->i2c_adap,
                                    &kworld_tda18271_config);
-                        /*
-                         * Only after success, it can initialize the gate, otherwise
-                         * an OOPS will hit, due to kfree(fe0->dvb.frontend)
-                         */
-                        fe0->dvb.frontend->ops.i2c_gate_ctrl = kworld_sbtvd_i2c_gate_ctrl;
+                        fe0->dvb.frontend->ops.i2c_gate_ctrl = kworld_sbtvd_gate_ctrl;
                 }
+
+                /* mb86a20s need to use the I2C gateway */
                 break;
         default:
                 wprintk("Huh? unknown DVB card?\n");
diff --git a/drivers/media/video/sn9c102/sn9c102_devtable.h b/drivers/media/video/sn9c102/sn9c102_devtable.h
index 41064c7b5ef..b3d2cc72965 100644
--- a/drivers/media/video/sn9c102/sn9c102_devtable.h
+++ b/drivers/media/video/sn9c102/sn9c102_devtable.h
@@ -47,8 +47,8 @@ static const struct usb_device_id sn9c102_id_table[] = {
         { SN9C102_USB_DEVICE(0x0c45, 0x6009, BRIDGE_SN9C102), },
         { SN9C102_USB_DEVICE(0x0c45, 0x600d, BRIDGE_SN9C102), },
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x6011, BRIDGE_SN9C102), }, OV6650 */
-#endif
         { SN9C102_USB_DEVICE(0x0c45, 0x6019, BRIDGE_SN9C102), },
+#endif
         { SN9C102_USB_DEVICE(0x0c45, 0x6024, BRIDGE_SN9C102), },
         { SN9C102_USB_DEVICE(0x0c45, 0x6025, BRIDGE_SN9C102), },
 #if !defined CONFIG_USB_GSPCA_SONIXB && !defined CONFIG_USB_GSPCA_SONIXB_MODULE
@@ -56,78 +56,68 @@ static const struct usb_device_id sn9c102_id_table[] = {
         { SN9C102_USB_DEVICE(0x0c45, 0x6029, BRIDGE_SN9C102), },
         { SN9C102_USB_DEVICE(0x0c45, 0x602a, BRIDGE_SN9C102), },
 #endif
-        { SN9C102_USB_DEVICE(0x0c45, 0x602b, BRIDGE_SN9C102), },
+        { SN9C102_USB_DEVICE(0x0c45, 0x602b, BRIDGE_SN9C102), }, /* not in sonixb */
 #if !defined CONFIG_USB_GSPCA_SONIXB && !defined CONFIG_USB_GSPCA_SONIXB_MODULE
         { SN9C102_USB_DEVICE(0x0c45, 0x602c, BRIDGE_SN9C102), },
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x602d, BRIDGE_SN9C102), }, HV7131R */
         { SN9C102_USB_DEVICE(0x0c45, 0x602e, BRIDGE_SN9C102), },
 #endif
-        { SN9C102_USB_DEVICE(0x0c45, 0x6030, BRIDGE_SN9C102), },
+        { SN9C102_USB_DEVICE(0x0c45, 0x6030, BRIDGE_SN9C102), }, /* not in sonixb */
         /* SN9C103 */
-        { SN9C102_USB_DEVICE(0x0c45, 0x6080, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x6082, BRIDGE_SN9C103), },
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x6080, BRIDGE_SN9C103), }, non existent ? */
+        { SN9C102_USB_DEVICE(0x0c45, 0x6082, BRIDGE_SN9C103), }, /* not in sonixb */
+#if !defined CONFIG_USB_GSPCA_SONIXB && !defined CONFIG_USB_GSPCA_SONIXB_MODULE
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x6083, BRIDGE_SN9C103), }, HY7131D/E */
-        { SN9C102_USB_DEVICE(0x0c45, 0x6088, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x608a, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x608b, BRIDGE_SN9C103), },
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x6088, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x608a, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x608b, BRIDGE_SN9C103), }, non existent ? */
         { SN9C102_USB_DEVICE(0x0c45, 0x608c, BRIDGE_SN9C103), },
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x608e, BRIDGE_SN9C103), }, CISVF10 */
-#if !defined CONFIG_USB_GSPCA_SONIXB && !defined CONFIG_USB_GSPCA_SONIXB_MODULE
         { SN9C102_USB_DEVICE(0x0c45, 0x608f, BRIDGE_SN9C103), },
-#endif
-        { SN9C102_USB_DEVICE(0x0c45, 0x60a0, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60a2, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60a3, BRIDGE_SN9C103), },
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60a0, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60a2, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60a3, BRIDGE_SN9C103), }, non existent ? */
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x60a8, BRIDGE_SN9C103), }, PAS106 */
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x60aa, BRIDGE_SN9C103), }, TAS5130 */
-/*      { SN9C102_USB_DEVICE(0x0c45, 0x60ab, BRIDGE_SN9C103), }, TAS5130 */
-        { SN9C102_USB_DEVICE(0x0c45, 0x60ac, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60ae, BRIDGE_SN9C103), },
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60ab, BRIDGE_SN9C103), }, TAS5110, non existent */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60ac, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60ae, BRIDGE_SN9C103), }, non existent ? */
         { SN9C102_USB_DEVICE(0x0c45, 0x60af, BRIDGE_SN9C103), },
-#if !defined CONFIG_USB_GSPCA_SONIXB && !defined CONFIG_USB_GSPCA_SONIXB_MODULE
         { SN9C102_USB_DEVICE(0x0c45, 0x60b0, BRIDGE_SN9C103), },
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60b2, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60b3, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60b8, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60ba, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60bb, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60bc, BRIDGE_SN9C103), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60be, BRIDGE_SN9C103), }, non existent ? */
 #endif
-        { SN9C102_USB_DEVICE(0x0c45, 0x60b2, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60b3, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60b8, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60ba, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60bb, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60bc, BRIDGE_SN9C103), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60be, BRIDGE_SN9C103), },
         /* SN9C105 */
 #if !defined CONFIG_USB_GSPCA_SONIXJ && !defined CONFIG_USB_GSPCA_SONIXJ_MODULE
         { SN9C102_USB_DEVICE(0x045e, 0x00f5, BRIDGE_SN9C105), },
         { SN9C102_USB_DEVICE(0x045e, 0x00f7, BRIDGE_SN9C105), },
         { SN9C102_USB_DEVICE(0x0471, 0x0327, BRIDGE_SN9C105), },
         { SN9C102_USB_DEVICE(0x0471, 0x0328, BRIDGE_SN9C105), },
-#endif
         { SN9C102_USB_DEVICE(0x0c45, 0x60c0, BRIDGE_SN9C105), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60c2, BRIDGE_SN9C105), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60c8, BRIDGE_SN9C105), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60cc, BRIDGE_SN9C105), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60ea, BRIDGE_SN9C105), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60ec, BRIDGE_SN9C105), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60ef, BRIDGE_SN9C105), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x60fa, BRIDGE_SN9C105), },
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60c2, BRIDGE_SN9C105), }, PO1030 */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60c8, BRIDGE_SN9C105), }, OM6801 */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60cc, BRIDGE_SN9C105), }, HV7131GP */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60ea, BRIDGE_SN9C105), }, non existent ? */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60ec, BRIDGE_SN9C105), }, MO4000 */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60ef, BRIDGE_SN9C105), }, ICM105C */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x60fa, BRIDGE_SN9C105), }, OV7648 */
         { SN9C102_USB_DEVICE(0x0c45, 0x60fb, BRIDGE_SN9C105), },
         { SN9C102_USB_DEVICE(0x0c45, 0x60fc, BRIDGE_SN9C105), },
         { SN9C102_USB_DEVICE(0x0c45, 0x60fe, BRIDGE_SN9C105), },
         /* SN9C120 */
         { SN9C102_USB_DEVICE(0x0458, 0x7025, BRIDGE_SN9C120), },
-#if !defined CONFIG_USB_GSPCA_SONIXJ && !defined CONFIG_USB_GSPCA_SONIXJ_MODULE
-        { SN9C102_USB_DEVICE(0x0c45, 0x6102, BRIDGE_SN9C120), },
-#endif
-        { SN9C102_USB_DEVICE(0x0c45, 0x6108, BRIDGE_SN9C120), },
-        { SN9C102_USB_DEVICE(0x0c45, 0x610f, BRIDGE_SN9C120), },
-#if !defined CONFIG_USB_GSPCA_SONIXJ && !defined CONFIG_USB_GSPCA_SONIXJ_MODULE
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x6102, BRIDGE_SN9C120), }, po2030 */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x6108, BRIDGE_SN9C120), }, om6801 */
+/*      { SN9C102_USB_DEVICE(0x0c45, 0x610f, BRIDGE_SN9C120), }, S5K53BEB */
         { SN9C102_USB_DEVICE(0x0c45, 0x6130, BRIDGE_SN9C120), },
-#endif
 /*      { SN9C102_USB_DEVICE(0x0c45, 0x6138, BRIDGE_SN9C120), }, MO8000 */
-#if !defined CONFIG_USB_GSPCA_SONIXJ && !defined CONFIG_USB_GSPCA_SONIXJ_MODULE
         { SN9C102_USB_DEVICE(0x0c45, 0x613a, BRIDGE_SN9C120), },
-#endif
         { SN9C102_USB_DEVICE(0x0c45, 0x613b, BRIDGE_SN9C120), },
-#if !defined CONFIG_USB_GSPCA_SONIXJ && !defined CONFIG_USB_GSPCA_SONIXJ_MODULE
         { SN9C102_USB_DEVICE(0x0c45, 0x613c, BRIDGE_SN9C120), },
         { SN9C102_USB_DEVICE(0x0c45, 0x613e, BRIDGE_SN9C120), },
 #endif
diff --git a/drivers/media/video/sr030pc30.c b/drivers/media/video/sr030pc30.c
index 864696b7a00..c901721a1db 100644
--- a/drivers/media/video/sr030pc30.c
+++ b/drivers/media/video/sr030pc30.c
@@ -714,15 +714,6 @@ static int sr030pc30_base_config(struct v4l2_subdev *sd)
         return ret;
 }
 
-static int sr030pc30_s_config(struct v4l2_subdev *sd,
-                              int irq, void *platform_data)
-{
-        struct sr030pc30_info *info = to_sr030pc30(sd);
-
-        info->pdata = platform_data;
-        return 0;
-}
-
 static int sr030pc30_s_stream(struct v4l2_subdev *sd, int enable)
 {
         return 0;
@@ -763,7 +754,6 @@ static int sr030pc30_s_power(struct v4l2_subdev *sd, int on)
 }
 
 static const struct v4l2_subdev_core_ops sr030pc30_core_ops = {
-        .s_config       = sr030pc30_s_config,
         .s_power        = sr030pc30_s_power,
         .queryctrl      = sr030pc30_queryctrl,
         .s_ctrl         = sr030pc30_s_ctrl,
diff --git a/drivers/media/video/tda9875.c b/drivers/media/video/tda9875.c
deleted file mode 100644
index 35b6ff5db31..00000000000
--- a/drivers/media/video/tda9875.c
+++ /dev/null
@@ -1,411 +0,0 @@
-/*
- * For the TDA9875 chip
- * (The TDA9875 is used on the Diamond DTV2000 french version
- * Other cards probably use these chips as well.)
- * This driver will not complain if used with any
- * other i2c device with the same address.
- *
- * Copyright (c) 2000 Guillaume Delvit based on Gerd Knorr source and
- * Eric Sandeen
- * Copyright (c) 2006 Mauro Carvalho Chehab <mchehab@infradead.org>
- * This code is placed under the terms of the GNU General Public License
- * Based on tda9855.c by Steve VanDeBogart (vandebo@uclink.berkeley.edu)
- * Which was based on tda8425.c by Greg Alexander (c) 1998
- *
- * OPTIONS:
- * debug   - set to 1 if you'd like to see debug messages
- *
- *  Revision: 0.1 - original version
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/timer.h>
-#include <linux/delay.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/i2c.h>
-#include <linux/videodev2.h>
-#include <media/v4l2-device.h>
-#include <media/i2c-addr.h>
-
-static int debug; /* insmod parameter */
-module_param(debug, int, S_IRUGO | S_IWUSR);
-MODULE_LICENSE("GPL");
-
-
-/* This is a superset of the TDA9875 */
-struct tda9875 {
-        struct v4l2_subdev sd;
-        int rvol, lvol;
-        int bass, treble;
-};
-
-static inline struct tda9875 *to_state(struct v4l2_subdev *sd)
-{
-        return container_of(sd, struct tda9875, sd);
-}
-
-#define dprintk  if (debug) printk
-
-/* The TDA9875 is made by Philips Semiconductor
- * http://www.semiconductors.philips.com
- * TDA9875: I2C-bus controlled DSP audio processor, FM demodulator
- *
- */
-
-                /* subaddresses for TDA9875 */
-#define TDA9875_MUT         0x12  /*General mute  (value --> 0b11001100*/
-#define TDA9875_CFG         0x01  /* Config register (value --> 0b00000000 */
-#define TDA9875_DACOS       0x13  /*DAC i/o select (ADC) 0b0000100*/
-#define TDA9875_LOSR        0x16  /*Line output select regirter 0b0100 0001*/
-
-#define TDA9875_CH1V        0x0c  /*Channel 1 volume (mute)*/
-#define TDA9875_CH2V        0x0d  /*Channel 2 volume (mute)*/
-#define TDA9875_SC1         0x14  /*SCART 1 in (mono)*/
-#define TDA9875_SC2         0x15  /*SCART 2 in (mono)*/
-
-#define TDA9875_ADCIS       0x17  /*ADC input select (mono) 0b0110 000*/
-#define TDA9875_AER         0x19  /*Audio effect (AVL+Pseudo) 0b0000 0110*/
-#define TDA9875_MCS         0x18  /*Main channel select (DAC) 0b0000100*/
-#define TDA9875_MVL         0x1a  /* Main volume gauche */
-#define TDA9875_MVR         0x1b  /* Main volume droite */
-#define TDA9875_MBA         0x1d  /* Main Basse */
-#define TDA9875_MTR         0x1e  /* Main treble */
-#define TDA9875_ACS         0x1f  /* Auxilary channel select (FM) 0b0000000*/
-#define TDA9875_AVL         0x20  /* Auxilary volume gauche */
-#define TDA9875_AVR         0x21  /* Auxilary volume droite */
-#define TDA9875_ABA         0x22  /* Auxilary Basse */
-#define TDA9875_ATR         0x23  /* Auxilary treble */
-
-#define TDA9875_MSR         0x02  /* Monitor select register */
-#define TDA9875_C1MSB       0x03  /* Carrier 1 (FM) frequency register MSB */
-#define TDA9875_C1MIB       0x04  /* Carrier 1 (FM) frequency register (16-8]b */
-#define TDA9875_C1LSB       0x05  /* Carrier 1 (FM) frequency register LSB */
-#define TDA9875_C2MSB       0x06  /* Carrier 2 (nicam) frequency register MSB */
-#define TDA9875_C2MIB       0x07  /* Carrier 2 (nicam) frequency register (16-8]b */
-#define TDA9875_C2LSB       0x08  /* Carrier 2 (nicam) frequency register LSB */
-#define TDA9875_DCR         0x09  /* Demodulateur configuration regirter*/
-#define TDA9875_DEEM        0x0a  /* FM de-emphasis regirter*/
-#define TDA9875_FMAT        0x0b  /* FM Matrix regirter*/
-
-/* values */
-#define TDA9875_MUTE_ON     0xff /* general mute */
-#define TDA9875_MUTE_OFF    0xcc /* general no mute */
-
-
-
-/* Begin code */
-
-static int tda9875_write(struct v4l2_subdev *sd, int subaddr, unsigned char val)
-{
-        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        unsigned char buffer[2];
-
-        v4l2_dbg(1, debug, sd, "Writing %d 0x%x\n", subaddr, val);
-        buffer[0] = subaddr;
-        buffer[1] = val;
-        if (2 != i2c_master_send(client, buffer, 2)) {
-                v4l2_warn(sd, "I/O error, trying (write %d 0x%x)\n",
-                       subaddr, val);
-                return -1;
-        }
-        return 0;
-}
-
-
-static int i2c_read_register(struct i2c_client *client, int addr, int reg)
-{
-        unsigned char write[1];
-        unsigned char read[1];
-        struct i2c_msg msgs[2] = {
-                { addr, 0,        1, write },
-                { addr, I2C_M_RD, 1, read  }
-        };
-
-        write[0] = reg;
-
-        if (2 != i2c_transfer(client->adapter, msgs, 2)) {
-                v4l_warn(client, "I/O error (read2)\n");
-                return -1;
-        }
-        v4l_dbg(1, debug, client, "chip_read2: reg%d=0x%x\n", reg, read[0]);
-        return read[0];
-}
-
-static void tda9875_set(struct v4l2_subdev *sd)
-{
-        struct tda9875 *tda = to_state(sd);
-        unsigned char a;
-
-        v4l2_dbg(1, debug, sd, "tda9875_set(%04x,%04x,%04x,%04x)\n",
-                tda->lvol, tda->rvol, tda->bass, tda->treble);
-
-        a = tda->lvol & 0xff;
-        tda9875_write(sd, TDA9875_MVL, a);
-        a =tda->rvol & 0xff;
-        tda9875_write(sd, TDA9875_MVR, a);
-        a =tda->bass & 0xff;
-        tda9875_write(sd, TDA9875_MBA, a);
-        a =tda->treble  & 0xff;
-        tda9875_write(sd, TDA9875_MTR, a);
-}
-
-static void do_tda9875_init(struct v4l2_subdev *sd)
-{
-        struct tda9875 *t = to_state(sd);
-
-        v4l2_dbg(1, debug, sd, "In tda9875_init\n");
-        tda9875_write(sd, TDA9875_CFG, 0xd0); /*reg de config 0 (reset)*/
-        tda9875_write(sd, TDA9875_MSR, 0x03);    /* Monitor 0b00000XXX*/
-        tda9875_write(sd, TDA9875_C1MSB, 0x00);  /*Car1(FM) MSB XMHz*/
-        tda9875_write(sd, TDA9875_C1MIB, 0x00);  /*Car1(FM) MIB XMHz*/
-        tda9875_write(sd, TDA9875_C1LSB, 0x00);  /*Car1(FM) LSB XMHz*/
-        tda9875_write(sd, TDA9875_C2MSB, 0x00);  /*Car2(NICAM) MSB XMHz*/
-        tda9875_write(sd, TDA9875_C2MIB, 0x00);  /*Car2(NICAM) MIB XMHz*/
-        tda9875_write(sd, TDA9875_C2LSB, 0x00);  /*Car2(NICAM) LSB XMHz*/
-        tda9875_write(sd, TDA9875_DCR, 0x00);    /*Demod config 0x00*/
-        tda9875_write(sd, TDA9875_DEEM, 0x44);   /*DE-Emph 0b0100 0100*/
-        tda9875_write(sd, TDA9875_FMAT, 0x00);   /*FM Matrix reg 0x00*/
-        tda9875_write(sd, TDA9875_SC1, 0x00);    /* SCART 1 (SC1)*/
-        tda9875_write(sd, TDA9875_SC2, 0x01);    /* SCART 2 (sc2)*/
-
-        tda9875_write(sd, TDA9875_CH1V, 0x10);  /* Channel volume 1 mute*/
-        tda9875_write(sd, TDA9875_CH2V, 0x10);  /* Channel volume 2 mute */
-        tda9875_write(sd, TDA9875_DACOS, 0x02); /* sig DAC i/o(in:nicam)*/
-        tda9875_write(sd, TDA9875_ADCIS, 0x6f); /* sig ADC input(in:mono)*/
-        tda9875_write(sd, TDA9875_LOSR, 0x00);  /* line out (in:mono)*/
-        tda9875_write(sd, TDA9875_AER, 0x00);   /*06 Effect (AVL+PSEUDO) */
-        tda9875_write(sd, TDA9875_MCS, 0x44);   /* Main ch select (DAC) */
-        tda9875_write(sd, TDA9875_MVL, 0x03);   /* Vol Main left 10dB */
-        tda9875_write(sd, TDA9875_MVR, 0x03);   /* Vol Main right 10dB*/
-        tda9875_write(sd, TDA9875_MBA, 0x00);   /* Main Bass Main 0dB*/
-        tda9875_write(sd, TDA9875_MTR, 0x00);   /* Main Treble Main 0dB*/
-        tda9875_write(sd, TDA9875_ACS, 0x44);   /* Aux chan select (dac)*/
-        tda9875_write(sd, TDA9875_AVL, 0x00);   /* Vol Aux left 0dB*/
-        tda9875_write(sd, TDA9875_AVR, 0x00);   /* Vol Aux right 0dB*/
-        tda9875_write(sd, TDA9875_ABA, 0x00);   /* Aux Bass Main 0dB*/
-        tda9875_write(sd, TDA9875_ATR, 0x00);   /* Aux Aigus Main 0dB*/
-
-        tda9875_write(sd, TDA9875_MUT, 0xcc);   /* General mute  */
-
-        t->lvol = t->rvol = 0;          /* 0dB */
-        t->bass = 0;                    /* 0dB */
-        t->treble = 0;                  /* 0dB */
-        tda9875_set(sd);
-}
-
-
-static int tda9875_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
-{
-        struct tda9875 *t = to_state(sd);
-
-        switch (ctrl->id) {
-        case V4L2_CID_AUDIO_VOLUME:
-        {
-                int left = (t->lvol+84)*606;
-                int right = (t->rvol+84)*606;
-
-                ctrl->value=max(left,right);
-                return 0;
-        }
-        case V4L2_CID_AUDIO_BALANCE:
-        {
-                int left = (t->lvol+84)*606;
-                int right = (t->rvol+84)*606;
-                int volume = max(left,right);
-                int balance = (32768*min(left,right))/
-                              (volume ? volume : 1);
-                ctrl->value=(left<right)?
-                        (65535-balance) : balance;
-                return 0;
-        }
-        case V4L2_CID_AUDIO_BASS:
-                ctrl->value = (t->bass+12)*2427;    /* min -12 max +15 */
-                return 0;
-        case V4L2_CID_AUDIO_TREBLE:
-                ctrl->value = (t->treble+12)*2730;/* min -12 max +12 */
-                return 0;
-        }
-        return -EINVAL;
-}
-
-static int tda9875_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
-{
-        struct tda9875 *t = to_state(sd);
-        int chvol = 0, volume = 0, balance = 0, left, right;
-
-        switch (ctrl->id) {
-        case V4L2_CID_AUDIO_VOLUME:
-                left = (t->lvol+84)*606;
-                right = (t->rvol+84)*606;
-
-                volume = max(left,right);
-                balance = (32768*min(left,right))/
-                              (volume ? volume : 1);
-                balance =(left<right)?
-                        (65535-balance) : balance;
-
-                volume = ctrl->value;
-
-                chvol=1;
-                break;
-        case V4L2_CID_AUDIO_BALANCE:
-                left = (t->lvol+84)*606;
-                right = (t->rvol+84)*606;
-
-                volume=max(left,right);
-
-                balance = ctrl->value;
-
-                chvol=1;
-                break;
-        case V4L2_CID_AUDIO_BASS:
-                t->bass = ((ctrl->value/2400)-12) & 0xff;
-                if (t->bass > 15)
-                        t->bass = 15;
-                if (t->bass < -12)
-                        t->bass = -12 & 0xff;
-                break;
-        case V4L2_CID_AUDIO_TREBLE:
-                t->treble = ((ctrl->value/2700)-12) & 0xff;
-                if (t->treble > 12)
-                        t->treble = 12;
-                if (t->treble < -12)
-                        t->treble = -12 & 0xff;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        if (chvol) {
-                left = (min(65536 - balance,32768) *
-                        volume) / 32768;
-                right = (min(balance,32768) *
-                                volume) / 32768;
-                t->lvol = ((left/606)-84) & 0xff;
-                if (t->lvol > 24)
-                        t->lvol = 24;
-                if (t->lvol < -84)
-                        t->lvol = -84 & 0xff;
-
-                t->rvol = ((right/606)-84) & 0xff;
-                if (t->rvol > 24)
-                        t->rvol = 24;
-                if (t->rvol < -84)
-                        t->rvol = -84 & 0xff;
-        }
-
-        tda9875_set(sd);
-        return 0;
-}
-
-static int tda9875_queryctrl(struct v4l2_subdev *sd, struct v4l2_queryctrl *qc)
-{
-        switch (qc->id) {
-        case V4L2_CID_AUDIO_VOLUME:
-                return v4l2_ctrl_query_fill(qc, 0, 65535, 65535 / 100, 58880);
-        case V4L2_CID_AUDIO_BASS:
-        case V4L2_CID_AUDIO_TREBLE:
-                return v4l2_ctrl_query_fill(qc, 0, 65535, 65535 / 100, 32768);
-        }
-        return -EINVAL;
-}
-
-/* ----------------------------------------------------------------------- */
-
-static const struct v4l2_subdev_core_ops tda9875_core_ops = {
-        .queryctrl = tda9875_queryctrl,
-        .g_ctrl = tda9875_g_ctrl,
-        .s_ctrl = tda9875_s_ctrl,
-};
-
-static const struct v4l2_subdev_ops tda9875_ops = {
-        .core = &tda9875_core_ops,
-};
-
-/* ----------------------------------------------------------------------- */
-
-
-/* *********************** *
- * i2c interface functions *
- * *********************** */
-
-static int tda9875_checkit(struct i2c_client *client, int addr)
-{
-        int dic, rev;
-
-        dic = i2c_read_register(client, addr, 254);
-        rev = i2c_read_register(client, addr, 255);
-
-        if (dic == 0 || dic == 2) { /* tda9875 and tda9875A */
-                v4l_info(client, "tda9875%s rev. %d detected at 0x%02x\n",
-                        dic == 0 ? "" : "A", rev, addr << 1);
-                return 1;
-        }
-        v4l_info(client, "no such chip at 0x%02x (dic=0x%x rev=0x%x)\n",
-                        addr << 1, dic, rev);
-        return 0;
-}
-
-static int tda9875_probe(struct i2c_client *client,
-                        const struct i2c_device_id *id)
-{
-        struct tda9875 *t;
-        struct v4l2_subdev *sd;
-
-        v4l_info(client, "chip found @ 0x%02x (%s)\n",
-                        client->addr << 1, client->adapter->name);
-
-        if (!tda9875_checkit(client, client->addr))
-                return -ENODEV;
-
-        t = kzalloc(sizeof(*t), GFP_KERNEL);
-        if (!t)
-                return -ENOMEM;
-        sd = &t->sd;
-        v4l2_i2c_subdev_init(sd, client, &tda9875_ops);
-
-        do_tda9875_init(sd);
-        return 0;
-}
-
-static int tda9875_remove(struct i2c_client *client)
-{
-        struct v4l2_subdev *sd = i2c_get_clientdata(client);
-
-        do_tda9875_init(sd);
-        v4l2_device_unregister_subdev(sd);
-        kfree(to_state(sd));
-        return 0;
-}
-
-static const struct i2c_device_id tda9875_id[] = {
-        { "tda9875", 0 },
-        { }
-};
-MODULE_DEVICE_TABLE(i2c, tda9875_id);
-
-static struct i2c_driver tda9875_driver = {
-        .driver = {
-                .owner  = THIS_MODULE,
-                .name   = "tda9875",
-        },
-        .probe          = tda9875_probe,
-        .remove         = tda9875_remove,
-        .id_table       = tda9875_id,
-};
-
-static __init int init_tda9875(void)
-{
-        return i2c_add_driver(&tda9875_driver);
-}
-
-static __exit void exit_tda9875(void)
-{
-        i2c_del_driver(&tda9875_driver);
-}
-
-module_init(init_tda9875);
-module_exit(exit_tda9875);
diff --git a/drivers/media/video/tlg2300/pd-video.c b/drivers/media/video/tlg2300/pd-video.c
index a1ffe18640f..df33a1d188b 100644
--- a/drivers/media/video/tlg2300/pd-video.c
+++ b/drivers/media/video/tlg2300/pd-video.c
@@ -512,19 +512,20 @@ int alloc_bulk_urbs_generic(struct urb **urb_array, int num,
                         int buf_size, gfp_t gfp_flags,
                         usb_complete_t complete_fn, void *context)
 {
-        struct urb *urb;
-        void *mem;
-        int i;
+        int i = 0;
 
-        for (i = 0; i < num; i++) {
-                urb = usb_alloc_urb(0, gfp_flags);
+        for (; i < num; i++) {
+                void *mem;
+                struct urb *urb = usb_alloc_urb(0, gfp_flags);
                 if (urb == NULL)
                         return i;
 
                 mem = usb_alloc_coherent(udev, buf_size, gfp_flags,
                                          &urb->transfer_dma);
-                if (mem == NULL)
+                if (mem == NULL) {
+                        usb_free_urb(urb);
                         return i;
+                }
 
                 usb_fill_bulk_urb(urb, udev, usb_rcvbulkpipe(udev, ep_addr),
                                 mem, buf_size, complete_fn, context);
diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
index 3f0871b550a..810eef43c21 100644
--- a/drivers/media/video/v4l2-common.c
+++ b/drivers/media/video/v4l2-common.c
@@ -407,18 +407,6 @@ struct v4l2_subdev *v4l2_i2c_new_subdev_board(struct v4l2_device *v4l2_dev,
         /* Decrease the module use count to match the first try_module_get. */
         module_put(client->driver->driver.owner);
 
-        if (sd) {
-                /* We return errors from v4l2_subdev_call only if we have the
-                   callback as the .s_config is not mandatory */
-                int err = v4l2_subdev_call(sd, core, s_config,
-                                info->irq, info->platform_data);
-
-                if (err && err != -ENOIOCTLCMD) {
-                        v4l2_device_unregister_subdev(sd);
-                        sd = NULL;
-                }
-        }
-
 error:
         /* If we have a client but no subdev, then something went wrong and
            we must unregister the client. */
@@ -428,9 +416,8 @@ error:
 }
 EXPORT_SYMBOL_GPL(v4l2_i2c_new_subdev_board);
 
-struct v4l2_subdev *v4l2_i2c_new_subdev_cfg(struct v4l2_device *v4l2_dev,
+struct v4l2_subdev *v4l2_i2c_new_subdev(struct v4l2_device *v4l2_dev,
                 struct i2c_adapter *adapter, const char *client_type,
-                int irq, void *platform_data,
                 u8 addr, const unsigned short *probe_addrs)
 {
         struct i2c_board_info info;
@@ -440,12 +427,10 @@ struct v4l2_subdev *v4l2_i2c_new_subdev_cfg(struct v4l2_device *v4l2_dev,
         memset(&info, 0, sizeof(info));
         strlcpy(info.type, client_type, sizeof(info.type));
         info.addr = addr;
-        info.irq = irq;
-        info.platform_data = platform_data;
 
         return v4l2_i2c_new_subdev_board(v4l2_dev, adapter, &info, probe_addrs);
 }
-EXPORT_SYMBOL_GPL(v4l2_i2c_new_subdev_cfg);
+EXPORT_SYMBOL_GPL(v4l2_i2c_new_subdev);
 
 /* Return i2c client address of v4l2_subdev. */
 unsigned short v4l2_i2c_subdev_addr(struct v4l2_subdev *sd)
diff --git a/drivers/media/video/v4l2-ctrls.c b/drivers/media/video/v4l2-ctrls.c
index 8f81efcfcf5..ef66d2af0c5 100644
--- a/drivers/media/video/v4l2-ctrls.c
+++ b/drivers/media/video/v4l2-ctrls.c
@@ -569,7 +569,7 @@ static int user_to_new(struct v4l2_ext_control *c,
         int ret;
         u32 size;
 
-        ctrl->has_new = 1;
+        ctrl->is_new = 1;
         switch (ctrl->type) {
         case V4L2_CTRL_TYPE_INTEGER64:
                 ctrl->val64 = c->value64;
@@ -1280,8 +1280,12 @@ int v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler *hdl)
                 if (ctrl->done)
                         continue;
 
-                for (i = 0; i < master->ncontrols; i++)
-                        cur_to_new(master->cluster[i]);
+                for (i = 0; i < master->ncontrols; i++) {
+                        if (master->cluster[i]) {
+                                cur_to_new(master->cluster[i]);
+                                master->cluster[i]->is_new = 1;
+                        }
+                }
 
                 /* Skip button controls and read-only controls. */
                 if (ctrl->type == V4L2_CTRL_TYPE_BUTTON ||
@@ -1340,12 +1344,15 @@ int v4l2_queryctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_queryctrl *qc)
 
         ctrl = ref->ctrl;
         memset(qc, 0, sizeof(*qc));
-        qc->id = ctrl->id;
+        if (id >= V4L2_CID_PRIVATE_BASE)
+                qc->id = id;
+        else
+                qc->id = ctrl->id;
         strlcpy(qc->name, ctrl->name, sizeof(qc->name));
         qc->minimum = ctrl->minimum;
         qc->maximum = ctrl->maximum;
         qc->default_value = ctrl->default_value;
-        if (qc->type == V4L2_CTRL_TYPE_MENU)
+        if (ctrl->type == V4L2_CTRL_TYPE_MENU)
                 qc->step = 1;
         else
                 qc->step = ctrl->step;
@@ -1645,7 +1652,7 @@ static int try_or_set_control_cluster(struct v4l2_ctrl *master, bool set)
                 if (ctrl == NULL)
                         continue;
 
-                if (ctrl->has_new) {
+                if (ctrl->is_new) {
                         /* Double check this: it may have changed since the
                            last check in try_or_set_ext_ctrls(). */
                         if (set && (ctrl->flags & V4L2_CTRL_FLAG_GRABBED))
@@ -1719,13 +1726,13 @@ static int try_or_set_ext_ctrls(struct v4l2_ctrl_handler *hdl,
 
                 v4l2_ctrl_lock(ctrl);
 
-                /* Reset the 'has_new' flags of the cluster */
+                /* Reset the 'is_new' flags of the cluster */
                 for (j = 0; j < master->ncontrols; j++)
                         if (master->cluster[j])
-                                master->cluster[j]->has_new = 0;
+                                master->cluster[j]->is_new = 0;
 
                 /* Copy the new caller-supplied control values.
-                   user_to_new() sets 'has_new' to 1. */
+                   user_to_new() sets 'is_new' to 1. */
                 ret = cluster_walk(i, cs, helpers, user_to_new);
 
                 if (!ret)
@@ -1820,15 +1827,18 @@ static int set_ctrl(struct v4l2_ctrl *ctrl, s32 *val)
         int ret;
         int i;
 
+        if (ctrl->flags & V4L2_CTRL_FLAG_READ_ONLY)
+                return -EACCES;
+
         v4l2_ctrl_lock(ctrl);
 
-        /* Reset the 'has_new' flags of the cluster */
+        /* Reset the 'is_new' flags of the cluster */
         for (i = 0; i < master->ncontrols; i++)
                 if (master->cluster[i])
-                        master->cluster[i]->has_new = 0;
+                        master->cluster[i]->is_new = 0;
 
         ctrl->val = *val;
-        ctrl->has_new = 1;
+        ctrl->is_new = 1;
         ret = try_or_set_control_cluster(master, false);
         if (!ret)
                 ret = try_or_set_control_cluster(master, true);
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 359e23290a7..341764a3a99 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -419,6 +419,10 @@ static int get_index(struct video_device *vdev)
  *      The registration code assigns minor numbers and device node numbers
  *      based on the requested type and registers the new device node with
  *      the kernel.
+ *
+ *      This function assumes that struct video_device was zeroed when it
+ *      was allocated and does not contain any stale date.
+ *
  *      An error is returned if no free minor or device node number could be
  *      found, or if the registration of the device node failed.
  *
@@ -440,7 +444,6 @@ static int __video_register_device(struct video_device *vdev, int type, int nr,
         int minor_offset = 0;
         int minor_cnt = VIDEO_NUM_DEVICES;
         const char *name_base;
-        void *priv = vdev->dev.p;
 
         /* A minor value of -1 marks this video device as never
            having been registered */
@@ -559,10 +562,6 @@ static int __video_register_device(struct video_device *vdev, int type, int nr,
         }
 
         /* Part 4: register the device with sysfs */
-        memset(&vdev->dev, 0, sizeof(vdev->dev));
-        /* The memset above cleared the device's device_private, so
-           put back the copy we made earlier. */
-        vdev->dev.p = priv;
         vdev->dev.class = &video_class;
         vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor);
         if (vdev->parent)
diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
index 7fe6f92af48..ce64fe16bc6 100644
--- a/drivers/media/video/v4l2-device.c
+++ b/drivers/media/video/v4l2-device.c
@@ -100,6 +100,7 @@ void v4l2_device_unregister(struct v4l2_device *v4l2_dev)
                            is a platform bus, then it is never deleted. */
                         if (client)
                                 i2c_unregister_device(client);
+                        continue;
                 }
 #endif
 #if defined(CONFIG_SPI)
@@ -108,6 +109,7 @@ void v4l2_device_unregister(struct v4l2_device *v4l2_dev)
 
                         if (spi)
                                 spi_unregister_device(spi);
+                        continue;
                 }
 #endif
         }
@@ -126,11 +128,19 @@ int v4l2_device_register_subdev(struct v4l2_device *v4l2_dev,
         WARN_ON(sd->v4l2_dev != NULL);
         if (!try_module_get(sd->owner))
                 return -ENODEV;
+        sd->v4l2_dev = v4l2_dev;
+        if (sd->internal_ops && sd->internal_ops->registered) {
+                err = sd->internal_ops->registered(sd);
+                if (err)
+                        return err;
+        }
         /* This just returns 0 if either of the two args is NULL */
         err = v4l2_ctrl_add_handler(v4l2_dev->ctrl_handler, sd->ctrl_handler);
-        if (err)
+        if (err) {
+                if (sd->internal_ops && sd->internal_ops->unregistered)
+                        sd->internal_ops->unregistered(sd);
                 return err;
-        sd->v4l2_dev = v4l2_dev;
+        }
         spin_lock(&v4l2_dev->lock);
         list_add_tail(&sd->list, &v4l2_dev->subdevs);
         spin_unlock(&v4l2_dev->lock);
@@ -146,6 +156,8 @@ void v4l2_device_unregister_subdev(struct v4l2_subdev *sd)
         spin_lock(&sd->v4l2_dev->lock);
         list_del(&sd->list);
         spin_unlock(&sd->v4l2_dev->lock);
+        if (sd->internal_ops && sd->internal_ops->unregistered)
+                sd->internal_ops->unregistered(sd);
         sd->v4l2_dev = NULL;
         module_put(sd->owner);
 }
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index 7e47f15f350..f51327ef675 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -1659,20 +1659,24 @@ static long __video_do_ioctl(struct file *file,
         {
                 struct v4l2_dbg_register *p = arg;
 
-                if (!capable(CAP_SYS_ADMIN))
-                        ret = -EPERM;
-                else if (ops->vidioc_g_register)
-                        ret = ops->vidioc_g_register(file, fh, p);
+                if (ops->vidioc_g_register) {
+                        if (!capable(CAP_SYS_ADMIN))
+                                ret = -EPERM;
+                        else
+                                ret = ops->vidioc_g_register(file, fh, p);
+                }
                 break;
         }
         case VIDIOC_DBG_S_REGISTER:
         {
                 struct v4l2_dbg_register *p = arg;
 
-                if (!capable(CAP_SYS_ADMIN))
-                        ret = -EPERM;
-                else if (ops->vidioc_s_register)
-                        ret = ops->vidioc_s_register(file, fh, p);
+                if (ops->vidioc_s_register) {
+                        if (!capable(CAP_SYS_ADMIN))
+                                ret = -EPERM;
+                        else
+                                ret = ops->vidioc_s_register(file, fh, p);
+                }
                 break;
         }
 #endif
diff --git a/drivers/media/video/w9966.c b/drivers/media/video/w9966.c
index 019ee206cbe..fa35639d0c1 100644
--- a/drivers/media/video/w9966.c
+++ b/drivers/media/video/w9966.c
@@ -937,6 +937,7 @@ static void w9966_term(struct w9966 *cam)
                 parport_unregister_device(cam->pdev);
                 w9966_set_state(cam, W9966_STATE_PDEV, 0);
         }
+        memset(cam, 0, sizeof(*cam));
 }
 
 
diff --git a/drivers/media/video/zoran/zoran_card.c b/drivers/media/video/zoran/zoran_card.c
index 9cdc3bb15b1..9f2bac51964 100644
--- a/drivers/media/video/zoran/zoran_card.c
+++ b/drivers/media/video/zoran/zoran_card.c
@@ -1041,7 +1041,7 @@ zr36057_init (struct zoran *zr)
         /* allocate memory *before* doing anything to the hardware
          * in case allocation fails */
         zr->stat_com = kzalloc(BUZ_NUM_STAT_COM * 4, GFP_KERNEL);
-        zr->video_dev = kmalloc(sizeof(struct video_device), GFP_KERNEL);
+        zr->video_dev = video_device_alloc();
         if (!zr->stat_com || !zr->video_dev) {
                 dprintk(1,
                         KERN_ERR
diff --git a/drivers/mmc/host/bfin_sdh.c b/drivers/mmc/host/bfin_sdh.c
index bac7d62866b..0371bf50224 100644
--- a/drivers/mmc/host/bfin_sdh.c
+++ b/drivers/mmc/host/bfin_sdh.c
@@ -462,7 +462,7 @@ static int __devinit sdh_probe(struct platform_device *pdev)
                 goto out;
         }
 
-        mmc = mmc_alloc_host(sizeof(*mmc), &pdev->dev);
+        mmc = mmc_alloc_host(sizeof(struct sdh_host), &pdev->dev);
         if (!mmc) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c
index b3a0ab0e4c2..74218ad677e 100644
--- a/drivers/mmc/host/jz4740_mmc.c
+++ b/drivers/mmc/host/jz4740_mmc.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/mmc/host.h>
+#include <linux/err.h>
 #include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/interrupt.h>
@@ -827,8 +828,8 @@ static int __devinit jz4740_mmc_probe(struct platform_device* pdev)
         }
 
         host->clk = clk_get(&pdev->dev, "mmc");
-        if (!host->clk) {
-                ret = -ENOENT;
+        if (IS_ERR(host->clk)) {
+                ret = PTR_ERR(host->clk);
                 dev_err(&pdev->dev, "Failed to get mmc clock\n");
                 goto err_free_host;
         }
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 56302282566..2d6de3e03e2 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -14,6 +14,7 @@
 #include <linux/ioport.h>
 #include <linux/device.h>
 #include <linux/interrupt.h>
+#include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/err.h>
 #include <linux/highmem.h>
@@ -46,10 +47,6 @@ static unsigned int fmax = 515633;
  *            is asserted (likewise for RX)
  * @fifohalfsize: number of bytes that can be written when MCI_TXFIFOHALFEMPTY
  *                is asserted (likewise for RX)
- * @broken_blockend: the MCI_DATABLOCKEND is broken on the hardware
- *              and will not work at all.
- * @broken_blockend_dma: the MCI_DATABLOCKEND is broken on the hardware when
- *              using DMA.
  * @sdio: variant supports SDIO
  * @st_clkdiv: true if using a ST-specific clock divider algorithm
  */
@@ -59,8 +56,6 @@ struct variant_data {
         unsigned int            datalength_bits;
         unsigned int            fifosize;
         unsigned int            fifohalfsize;
-        bool                    broken_blockend;
-        bool                    broken_blockend_dma;
         bool                    sdio;
         bool                    st_clkdiv;
 };
@@ -76,7 +71,6 @@ static struct variant_data variant_u300 = {
         .fifohalfsize           = 8 * 4,
         .clkreg_enable          = 1 << 13, /* HWFCEN */
         .datalength_bits        = 16,
-        .broken_blockend_dma    = true,
         .sdio                   = true,
 };
 
@@ -86,7 +80,6 @@ static struct variant_data variant_ux500 = {
         .clkreg                 = MCI_CLK_ENABLE,
         .clkreg_enable          = 1 << 14, /* HWFCEN */
         .datalength_bits        = 24,
-        .broken_blockend        = true,
         .sdio                   = true,
         .st_clkdiv              = true,
 };
@@ -210,8 +203,6 @@ static void mmci_start_data(struct mmci_host *host, struct mmc_data *data)
         host->data = data;
         host->size = data->blksz * data->blocks;
         host->data_xfered = 0;
-        host->blockend = false;
-        host->dataend = false;
 
         mmci_init_sg(host, data);
 
@@ -288,21 +279,26 @@ static void
 mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
               unsigned int status)
 {
-        struct variant_data *variant = host->variant;
-
         /* First check for errors */
         if (status & (MCI_DATACRCFAIL|MCI_DATATIMEOUT|MCI_TXUNDERRUN|MCI_RXOVERRUN)) {
+                u32 remain, success;
+
+                /* Calculate how far we are into the transfer */
+                remain = readl(host->base + MMCIDATACNT);
+                success = data->blksz * data->blocks - remain;
+
                 dev_dbg(mmc_dev(host->mmc), "MCI ERROR IRQ (status %08x)\n", status);
-                if (status & MCI_DATACRCFAIL)
+                if (status & MCI_DATACRCFAIL) {
+                        /* Last block was not successful */
+                        host->data_xfered = round_down(success - 1, data->blksz);
                         data->error = -EILSEQ;
-                else if (status & MCI_DATATIMEOUT)
+                } else if (status & MCI_DATATIMEOUT) {
+                        host->data_xfered = round_down(success, data->blksz);
                         data->error = -ETIMEDOUT;
-                else if (status & (MCI_TXUNDERRUN|MCI_RXOVERRUN))
+                } else if (status & (MCI_TXUNDERRUN|MCI_RXOVERRUN)) {
+                        host->data_xfered = round_down(success, data->blksz);
                         data->error = -EIO;
-
-                /* Force-complete the transaction */
-                host->blockend = true;
-                host->dataend = true;
+                }
 
                 /*
                  * We hit an error condition.  Ensure that any data
@@ -321,61 +317,14 @@ mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
                 }
         }
 
-        /*
-         * On ARM variants in PIO mode, MCI_DATABLOCKEND
-         * is always sent first, and we increase the
-         * transfered number of bytes for that IRQ. Then
-         * MCI_DATAEND follows and we conclude the transaction.
-         *
-         * On the Ux500 single-IRQ variant MCI_DATABLOCKEND
-         * doesn't seem to immediately clear from the status,
-         * so we can't use it keep count when only one irq is
-         * used because the irq will hit for other reasons, and
-         * then the flag is still up. So we use the MCI_DATAEND
-         * IRQ at the end of the entire transfer because
-         * MCI_DATABLOCKEND is broken.
-         *
-         * In the U300, the IRQs can arrive out-of-order,
-         * e.g. MCI_DATABLOCKEND sometimes arrives after MCI_DATAEND,
-         * so for this case we use the flags "blockend" and
-         * "dataend" to make sure both IRQs have arrived before
-         * concluding the transaction. (This does not apply
-         * to the Ux500 which doesn't fire MCI_DATABLOCKEND
-         * at all.) In DMA mode it suffers from the same problem
-         * as the Ux500.
-         */
-        if (status & MCI_DATABLOCKEND) {
-                /*
-                 * Just being a little over-cautious, we do not
-                 * use this progressive update if the hardware blockend
-                 * flag is unreliable: since it can stay high between
-                 * IRQs it will corrupt the transfer counter.
-                 */
-                if (!variant->broken_blockend)
-                        host->data_xfered += data->blksz;
-                host->blockend = true;
-        }
-
-        if (status & MCI_DATAEND)
-                host->dataend = true;
+        if (status & MCI_DATABLOCKEND)
+                dev_err(mmc_dev(host->mmc), "stray MCI_DATABLOCKEND interrupt\n");
 
-        /*
-         * On variants with broken blockend we shall only wait for dataend,
-         * on others we must sync with the blockend signal since they can
-         * appear out-of-order.
-         */
-        if (host->dataend && (host->blockend || variant->broken_blockend)) {
+        if (status & MCI_DATAEND || data->error) {
                 mmci_stop_data(host);
 
-                /* Reset these flags */
-                host->blockend = false;
-                host->dataend = false;
-
-                /*
-                 * Variants with broken blockend flags need to handle the
-                 * end of the entire transfer here.
-                 */
-                if (variant->broken_blockend && !data->error)
+                if (!data->error)
+                        /* The error clause is handled above, success! */
                         host->data_xfered += data->blksz * data->blocks;
 
                 if (!data->stop) {
@@ -394,15 +343,15 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
 
         host->cmd = NULL;
 
-        cmd->resp[0] = readl(base + MMCIRESPONSE0);
-        cmd->resp[1] = readl(base + MMCIRESPONSE1);
-        cmd->resp[2] = readl(base + MMCIRESPONSE2);
-        cmd->resp[3] = readl(base + MMCIRESPONSE3);
-
         if (status & MCI_CMDTIMEOUT) {
                 cmd->error = -ETIMEDOUT;
         } else if (status & MCI_CMDCRCFAIL && cmd->flags & MMC_RSP_CRC) {
                 cmd->error = -EILSEQ;
+        } else {
+                cmd->resp[0] = readl(base + MMCIRESPONSE0);
+                cmd->resp[1] = readl(base + MMCIRESPONSE1);
+                cmd->resp[2] = readl(base + MMCIRESPONSE2);
+                cmd->resp[3] = readl(base + MMCIRESPONSE3);
         }
 
         if (!cmd->data || cmd->error) {
@@ -770,7 +719,6 @@ static int __devinit mmci_probe(struct amba_device *dev, struct amba_id *id)
         struct variant_data *variant = id->data;
         struct mmci_host *host;
         struct mmc_host *mmc;
-        unsigned int mask;
         int ret;
 
         /* must have platform data */
@@ -951,12 +899,7 @@ static int __devinit mmci_probe(struct amba_device *dev, struct amba_id *id)
                         goto irq0_free;
         }
 
-        mask = MCI_IRQENABLE;
-        /* Don't use the datablockend flag if it's broken */
-        if (variant->broken_blockend)
-                mask &= ~MCI_DATABLOCKEND;
-
-        writel(mask, host->base + MMCIMASK0);
+        writel(MCI_IRQENABLE, host->base + MMCIMASK0);
 
         amba_set_drvdata(dev, mmc);
 
diff --git a/drivers/mmc/host/mmci.h b/drivers/mmc/host/mmci.h
index df06f01aac8..c1df7b82d36 100644
--- a/drivers/mmc/host/mmci.h
+++ b/drivers/mmc/host/mmci.h
@@ -137,7 +137,7 @@
 #define MCI_IRQENABLE   \
         (MCI_CMDCRCFAILMASK|MCI_DATACRCFAILMASK|MCI_CMDTIMEOUTMASK|     \
         MCI_DATATIMEOUTMASK|MCI_TXUNDERRUNMASK|MCI_RXOVERRUNMASK|       \
-        MCI_CMDRESPENDMASK|MCI_CMDSENTMASK|MCI_DATABLOCKENDMASK)
+        MCI_CMDRESPENDMASK|MCI_CMDSENTMASK)
 
 /* These interrupts are directed to IRQ1 when two IRQ lines are available */
 #define MCI_IRQ1MASK \
@@ -177,9 +177,6 @@ struct mmci_host {
         struct timer_list       timer;
         unsigned int            oldstat;
 
-        bool                    blockend;
-        bool                    dataend;
-
         /* pio stuff */
         struct sg_mapping_iter  sg_miter;
         unsigned int            size;
diff --git a/drivers/mmc/host/msm_sdcc.c b/drivers/mmc/host/msm_sdcc.c
index 5decfd0bd61..153ab977a01 100644
--- a/drivers/mmc/host/msm_sdcc.c
+++ b/drivers/mmc/host/msm_sdcc.c
@@ -383,14 +383,30 @@ static int msmsdcc_config_dma(struct msmsdcc_host *host, struct mmc_data *data)
         host->curr.user_pages = 0;
 
         box = &nc->cmd[0];
-        for (i = 0; i < host->dma.num_ents; i++) {
-                box->cmd = CMD_MODE_BOX;
 
-        /* Initialize sg dma address */
-        sg->dma_address = page_to_dma(mmc_dev(host->mmc), sg_page(sg))
-                                + sg->offset;
+        /* location of command block must be 64 bit aligned */
+        BUG_ON(host->dma.cmd_busaddr & 0x07);
 
-        if (i == (host->dma.num_ents - 1))
+        nc->cmdptr = (host->dma.cmd_busaddr >> 3) | CMD_PTR_LP;
+        host->dma.hdr.cmdptr = DMOV_CMD_PTR_LIST |
+                               DMOV_CMD_ADDR(host->dma.cmdptr_busaddr);
+        host->dma.hdr.complete_func = msmsdcc_dma_complete_func;
+
+        n = dma_map_sg(mmc_dev(host->mmc), host->dma.sg,
+                        host->dma.num_ents, host->dma.dir);
+        if (n == 0) {
+                printk(KERN_ERR "%s: Unable to map in all sg elements\n",
+                        mmc_hostname(host->mmc));
+                host->dma.sg = NULL;
+                host->dma.num_ents = 0;
+                return -ENOMEM;
+        }
+
+        for_each_sg(host->dma.sg, sg, n, i) {
+
+                box->cmd = CMD_MODE_BOX;
+
+                if (i == n - 1)
                         box->cmd |= CMD_LC;
                 rows = (sg_dma_len(sg) % MCI_FIFOSIZE) ?
                         (sg_dma_len(sg) / MCI_FIFOSIZE) + 1 :
@@ -418,27 +434,6 @@ static int msmsdcc_config_dma(struct msmsdcc_host *host, struct mmc_data *data)
                         box->cmd |= CMD_DST_CRCI(crci);
                 }
                 box++;
-                sg++;
-        }
-
-        /* location of command block must be 64 bit aligned */
-        BUG_ON(host->dma.cmd_busaddr & 0x07);
-
-        nc->cmdptr = (host->dma.cmd_busaddr >> 3) | CMD_PTR_LP;
-        host->dma.hdr.cmdptr = DMOV_CMD_PTR_LIST |
-                               DMOV_CMD_ADDR(host->dma.cmdptr_busaddr);
-        host->dma.hdr.complete_func = msmsdcc_dma_complete_func;
-
-        n = dma_map_sg(mmc_dev(host->mmc), host->dma.sg,
-                        host->dma.num_ents, host->dma.dir);
-/* dsb inside dma_map_sg will write nc out to mem as well */
-
-        if (n != host->dma.num_ents) {
-                printk(KERN_ERR "%s: Unable to map in all sg elements\n",
-                        mmc_hostname(host->mmc));
-                host->dma.sg = NULL;
-                host->dma.num_ents = 0;
-                return -ENOMEM;
         }
 
         return 0;
@@ -1331,9 +1326,6 @@ msmsdcc_probe(struct platform_device *pdev)
         if (host->timer.function)
                 pr_info("%s: Polling status mode enabled\n", mmc_hostname(mmc));
 
-#if BUSCLK_PWRSAVE
-        msmsdcc_disable_clocks(host, 1);
-#endif
         return 0;
  cmd_irq_free:
         free_irq(cmd_irqres->start, host);
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 17203586305..5309ab95aad 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -277,10 +277,43 @@ static void sdhci_cmu_set_clock(struct sdhci_host *host, unsigned int clock)
         host->clock = clock;
 }
 
+/**
+ * sdhci_s3c_platform_8bit_width - support 8bit buswidth
+ * @host: The SDHCI host being queried
+ * @width: MMC_BUS_WIDTH_ macro for the bus width being requested
+ *
+ * We have 8-bit width support but is not a v3 controller.
+ * So we add platform_8bit_width() and support 8bit width.
+ */
+static int sdhci_s3c_platform_8bit_width(struct sdhci_host *host, int width)
+{
+        u8 ctrl;
+
+        ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
+
+        switch (width) {
+        case MMC_BUS_WIDTH_8:
+                ctrl |= SDHCI_CTRL_8BITBUS;
+                ctrl &= ~SDHCI_CTRL_4BITBUS;
+                break;
+        case MMC_BUS_WIDTH_4:
+                ctrl |= SDHCI_CTRL_4BITBUS;
+                ctrl &= ~SDHCI_CTRL_8BITBUS;
+                break;
+        default:
+                break;
+        }
+
+        sdhci_writeb(host, ctrl, SDHCI_HOST_CONTROL);
+
+        return 0;
+}
+
 static struct sdhci_ops sdhci_s3c_ops = {
         .get_max_clock          = sdhci_s3c_get_max_clk,
         .set_clock              = sdhci_s3c_set_clock,
         .get_min_clock          = sdhci_s3c_get_min_clock,
+        .platform_8bit_width    = sdhci_s3c_platform_8bit_width,
 };
 
 static void sdhci_s3c_notify_change(struct platform_device *dev, int state)
@@ -473,6 +506,9 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
         if (pdata->cd_type == S3C_SDHCI_CD_PERMANENT)
                 host->mmc->caps = MMC_CAP_NONREMOVABLE;
 
+        if (pdata->host_caps)
+                host->mmc->caps |= pdata->host_caps;
+
         host->quirks |= (SDHCI_QUIRK_32BIT_DMA_ADDR |
                          SDHCI_QUIRK_32BIT_DMA_SIZE);
 
diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c
index f8f65df9b01..f08f944ac53 100644
--- a/drivers/mmc/host/ushc.c
+++ b/drivers/mmc/host/ushc.c
@@ -19,7 +19,6 @@
 #include <linux/module.h>
 #include <linux/usb.h>
 #include <linux/kernel.h>
-#include <linux/usb.h>
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/mmc/host.h>
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index f49e49dc592..5ebe280225d 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -672,33 +672,7 @@ static int io_init(struct ubi_device *ubi)
                 ubi->nor_flash = 1;
         }
 
-        /*
-         * Set UBI min. I/O size (@ubi->min_io_size). We use @mtd->writebufsize
-         * for these purposes, not @mtd->writesize. At the moment this does not
-         * matter for NAND, because currently @mtd->writebufsize is equivalent to
-         * @mtd->writesize for all NANDs. However, some CFI NOR flashes may
-         * have @mtd->writebufsize which is multiple of @mtd->writesize.
-         *
-         * The reason we use @mtd->writebufsize for @ubi->min_io_size is that
-         * UBI and UBIFS recovery algorithms rely on the fact that if there was
-         * an unclean power cut, then we can find offset of the last corrupted
-         * node, align the offset to @ubi->min_io_size, read the rest of the
-         * eraseblock starting from this offset, and check whether there are
-         * only 0xFF bytes. If yes, then we are probably dealing with a
-         * corruption caused by a power cut, if not, then this is probably some
-         * severe corruption.
-         *
-         * Thus, we have to use the maximum write unit size of the flash, which
-         * is @mtd->writebufsize, because @mtd->writesize is the minimum write
-         * size, not the maximum.
-         */
-        if (ubi->mtd->type == MTD_NANDFLASH)
-                ubi_assert(ubi->mtd->writebufsize == ubi->mtd->writesize);
-        else if (ubi->mtd->type == MTD_NORFLASH)
-                ubi_assert(ubi->mtd->writebufsize % ubi->mtd->writesize == 0);
-
-        ubi->min_io_size = ubi->mtd->writebufsize;
-
+        ubi->min_io_size = ubi->mtd->writesize;
         ubi->hdrs_min_io_size = ubi->mtd->writesize >> ubi->mtd->subpage_sft;
 
         /*
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 16fe4f9b719..03823327db2 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2864,7 +2864,7 @@ config MLX4_CORE
         default n
 
 config MLX4_DEBUG
-        bool "Verbose debugging output" if (MLX4_CORE && EMBEDDED)
+        bool "Verbose debugging output" if (MLX4_CORE && EXPERT)
         depends on MLX4_CORE
         default y
         ---help---
diff --git a/drivers/net/arm/ks8695net.c b/drivers/net/arm/ks8695net.c
index 62d6f88cbab..aa07657744c 100644
--- a/drivers/net/arm/ks8695net.c
+++ b/drivers/net/arm/ks8695net.c
@@ -1644,7 +1644,7 @@ ks8695_cleanup(void)
 module_init(ks8695_init);
 module_exit(ks8695_cleanup);
 
-MODULE_AUTHOR("Simtec Electronics")
+MODULE_AUTHOR("Simtec Electronics");
 MODULE_DESCRIPTION("Micrel KS8695 (Centaur) Ethernet driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" MODULENAME);
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index a699bbf20eb..3824382faec 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -48,6 +48,7 @@ static DEFINE_PCI_DEVICE_TABLE(atl1c_pci_tbl) = {
         {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATHEROS_L2C_B)},
         {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATHEROS_L2C_B2)},
         {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATHEROS_L1D)},
+        {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATHEROS_L1D_2_0)},
         /* required last entry */
         { 0 }
 };
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index de40d3b7152..28a32a6c8bf 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -312,11 +312,9 @@ void be_link_status_update(struct be_adapter *adapter, bool link_up)
         if (adapter->link_up != link_up) {
                 adapter->link_speed = -1;
                 if (link_up) {
-                        netif_start_queue(netdev);
                         netif_carrier_on(netdev);
                         printk(KERN_INFO "%s: Link up\n", netdev->name);
                 } else {
-                        netif_stop_queue(netdev);
                         netif_carrier_off(netdev);
                         printk(KERN_INFO "%s: Link down\n", netdev->name);
                 }
@@ -2628,8 +2626,6 @@ static void be_netdev_init(struct net_device *netdev)
 
         netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
                 BE_NAPI_WEIGHT);
-
-        netif_stop_queue(netdev);
 }
 
 static void be_unmap_pci_bars(struct be_adapter *adapter)
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index df99edf3464..0ba59d5aeb7 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -7553,6 +7553,10 @@ bnx2_set_flags(struct net_device *dev, u32 data)
             !(data & ETH_FLAG_RXVLAN))
                 return -EINVAL;
 
+        /* TSO with VLAN tag won't work with current firmware */
+        if (!(data & ETH_FLAG_TXVLAN))
+                return -EINVAL;
+
         rc = ethtool_op_set_flags(dev, data, ETH_FLAG_RXHASH | ETH_FLAG_RXVLAN |
                                   ETH_FLAG_TXVLAN);
         if (rc)
@@ -7962,11 +7966,8 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 
                 /* AER (Advanced Error Reporting) hooks */
                 err = pci_enable_pcie_error_reporting(pdev);
-                if (err) {
-                        dev_err(&pdev->dev, "pci_enable_pcie_error_reporting "
-                                            "failed 0x%x\n", err);
-                        /* non-fatal, continue */
-                }
+                if (!err)
+                        bp->flags |= BNX2_FLAG_AER_ENABLED;
 
         } else {
                 bp->pcix_cap = pci_find_capability(pdev, PCI_CAP_ID_PCIX);
@@ -8229,8 +8230,10 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         return 0;
 
 err_out_unmap:
-        if (bp->flags & BNX2_FLAG_PCIE)
+        if (bp->flags & BNX2_FLAG_AER_ENABLED) {
                 pci_disable_pcie_error_reporting(pdev);
+                bp->flags &= ~BNX2_FLAG_AER_ENABLED;
+        }
 
         if (bp->regview) {
                 iounmap(bp->regview);
@@ -8418,8 +8421,10 @@ bnx2_remove_one(struct pci_dev *pdev)
 
         kfree(bp->temp_stats_blk);
 
-        if (bp->flags & BNX2_FLAG_PCIE)
+        if (bp->flags & BNX2_FLAG_AER_ENABLED) {
                 pci_disable_pcie_error_reporting(pdev);
+                bp->flags &= ~BNX2_FLAG_AER_ENABLED;
+        }
 
         free_netdev(dev);
 
@@ -8535,7 +8540,7 @@ static pci_ers_result_t bnx2_io_slot_reset(struct pci_dev *pdev)
         }
         rtnl_unlock();
 
-        if (!(bp->flags & BNX2_FLAG_PCIE))
+        if (!(bp->flags & BNX2_FLAG_AER_ENABLED))
                 return result;
 
         err = pci_cleanup_aer_uncorrect_error_status(pdev);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 5488a2e82fe..f459fb2f9ad 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6741,6 +6741,7 @@ struct bnx2 {
 #define BNX2_FLAG_JUMBO_BROKEN          0x00000800
 #define BNX2_FLAG_CAN_KEEP_VLAN         0x00001000
 #define BNX2_FLAG_BROKEN_STATS          0x00002000
+#define BNX2_FLAG_AER_ENABLED           0x00004000
 
         struct bnx2_napi        bnx2_napi[BNX2_MAX_MSIX_VEC];
 
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index a6cd335c943..653c62475cb 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -22,8 +22,8 @@
  * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
 
-#define DRV_MODULE_VERSION      "1.62.00-3"
-#define DRV_MODULE_RELDATE      "2010/12/21"
+#define DRV_MODULE_VERSION      "1.62.00-5"
+#define DRV_MODULE_RELDATE      "2011/01/30"
 #define BNX2X_BC_VER            0x040200
 
 #define BNX2X_MULTI_QUEUE
diff --git a/drivers/net/bnx2x/bnx2x_hsi.h b/drivers/net/bnx2x/bnx2x_hsi.h
index 6238d4f6398..548f5631c0d 100644
--- a/drivers/net/bnx2x/bnx2x_hsi.h
+++ b/drivers/net/bnx2x/bnx2x_hsi.h
@@ -352,6 +352,10 @@ struct port_hw_cfg {			    /* port 0: 0x12c  port 1: 0x2bc */
 #define PORT_HW_CFG_LANE_SWAP_CFG_31203120          0x0000d8d8
         /* forced only */
 #define PORT_HW_CFG_LANE_SWAP_CFG_32103210          0x0000e4e4
+    /*  Indicate whether to swap the external phy polarity */
+#define PORT_HW_CFG_SWAP_PHY_POLARITY_MASK             0x00010000
+#define PORT_HW_CFG_SWAP_PHY_POLARITY_DISABLED      0x00000000
+#define PORT_HW_CFG_SWAP_PHY_POLARITY_ENABLED       0x00010000
 
         u32 external_phy_config;
 #define PORT_HW_CFG_SERDES_EXT_PHY_TYPE_MASK        0xff000000
diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index 43b0de24f39..dd1210fddff 100644
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -1573,7 +1573,7 @@ static void bnx2x_set_aer_mmd_xgxs(struct link_params *params,
 
         offset = phy->addr + ser_lane;
         if (CHIP_IS_E2(bp))
-                aer_val = 0x2800 + offset - 1;
+                aer_val = 0x3800 + offset - 1;
         else
                 aer_val = 0x3800 + offset;
         CL45_WR_OVER_CL22(bp, phy,
@@ -3166,7 +3166,23 @@ u8 bnx2x_set_led(struct link_params *params,
                 if (!vars->link_up)
                         break;
         case LED_MODE_ON:
-                if (SINGLE_MEDIA_DIRECT(params)) {
+                if (params->phy[EXT_PHY1].type ==
+                    PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727 &&
+                    CHIP_IS_E2(bp) && params->num_phys == 2) {
+                        /**
+                        * This is a work-around for E2+8727 Configurations
+                        */
+                        if (mode == LED_MODE_ON ||
+                                speed == SPEED_10000){
+                                REG_WR(bp, NIG_REG_LED_MODE_P0 + port*4, 0);
+                                REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
+
+                                tmp = EMAC_RD(bp, EMAC_REG_EMAC_LED);
+                                EMAC_WR(bp, EMAC_REG_EMAC_LED,
+                                        (tmp | EMAC_LED_OVERRIDE));
+                                return rc;
+                        }
+                } else if (SINGLE_MEDIA_DIRECT(params)) {
                         /**
                         * This is a work-around for HW issue found when link
                         * is up in CL73
@@ -3854,11 +3870,14 @@ static void bnx2x_8073_resolve_fc(struct bnx2x_phy *phy,
                            pause_result);
         }
 }
-
-static void bnx2x_8073_8727_external_rom_boot(struct bnx2x *bp,
+static u8 bnx2x_8073_8727_external_rom_boot(struct bnx2x *bp,
                                               struct bnx2x_phy *phy,
                                               u8 port)
 {
+        u32 count = 0;
+        u16 fw_ver1, fw_msgout;
+        u8 rc = 0;
+
         /* Boot port from external ROM  */
         /* EDC grst */
         bnx2x_cl45_write(bp, phy,
@@ -3888,56 +3907,45 @@ static void bnx2x_8073_8727_external_rom_boot(struct bnx2x *bp,
                        MDIO_PMA_REG_GEN_CTRL,
                        MDIO_PMA_REG_GEN_CTRL_ROM_RESET_INTERNAL_MP);
 
-        /* wait for 120ms for code download via SPI port */
-        msleep(120);
+        /* Delay 100ms per the PHY specifications */
+        msleep(100);
+
+        /* 8073 sometimes taking longer to download */
+        do {
+                count++;
+                if (count > 300) {
+                        DP(NETIF_MSG_LINK,
+                                 "bnx2x_8073_8727_external_rom_boot port %x:"
+                                 "Download failed. fw version = 0x%x\n",
+                                 port, fw_ver1);
+                        rc = -EINVAL;
+                        break;
+                }
+
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD,
+                                MDIO_PMA_REG_ROM_VER1, &fw_ver1);
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD,
+                                MDIO_PMA_REG_M8051_MSGOUT_REG, &fw_msgout);
+
+                msleep(1);
+        } while (fw_ver1 == 0 || fw_ver1 == 0x4321 ||
+                        ((fw_msgout & 0xff) != 0x03 && (phy->type ==
+                        PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8073)));
 
         /* Clear ser_boot_ctl bit */
         bnx2x_cl45_write(bp, phy,
                        MDIO_PMA_DEVAD,
                        MDIO_PMA_REG_MISC_CTRL1, 0x0000);
         bnx2x_save_bcm_spirom_ver(bp, phy, port);
-}
 
-static void bnx2x_8073_set_xaui_low_power_mode(struct bnx2x *bp,
-                                               struct bnx2x_phy *phy)
-{
-        u16 val;
-        bnx2x_cl45_read(bp, phy,
-                        MDIO_PMA_DEVAD, MDIO_PMA_REG_8073_CHIP_REV, &val);
-
-        if (val == 0) {
-                /* Mustn't set low power mode in 8073 A0 */
-                return;
-        }
-
-        /* Disable PLL sequencer (use read-modify-write to clear bit 13) */
-        bnx2x_cl45_read(bp, phy,
-                        MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, &val);
-        val &= ~(1<<13);
-        bnx2x_cl45_write(bp, phy,
-                       MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, val);
-
-        /* PLL controls */
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805E, 0x1077);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805D, 0x0000);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805C, 0x030B);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805B, 0x1240);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805A, 0x2490);
-
-        /* Tx Controls */
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A7, 0x0C74);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A6, 0x9041);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A5, 0x4640);
-
-        /* Rx Controls */
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FE, 0x01C4);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FD, 0x9249);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FC, 0x2015);
+        DP(NETIF_MSG_LINK,
+                 "bnx2x_8073_8727_external_rom_boot port %x:"
+                 "Download complete. fw version = 0x%x\n",
+                 port, fw_ver1);
 
-        /* Enable PLL sequencer  (use read-modify-write to set bit 13) */
-        bnx2x_cl45_read(bp, phy, MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, &val);
-        val |= (1<<13);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, val);
+        return rc;
 }
 
 /******************************************************************/
@@ -4098,8 +4106,6 @@ static u8 bnx2x_8073_config_init(struct bnx2x_phy *phy,
 
         bnx2x_8073_set_pause_cl37(params, phy, vars);
 
-        bnx2x_8073_set_xaui_low_power_mode(bp, phy);
-
         bnx2x_cl45_read(bp, phy,
                         MDIO_PMA_DEVAD, MDIO_PMA_REG_M8051_MSGOUT_REG, &tmp1);
 
@@ -4108,6 +4114,25 @@ static u8 bnx2x_8073_config_init(struct bnx2x_phy *phy,
 
         DP(NETIF_MSG_LINK, "Before rom RX_ALARM(port1): 0x%x\n", tmp1);
 
+        /**
+         * If this is forced speed, set to KR or KX (all other are not
+         * supported)
+         */
+        /* Swap polarity if required - Must be done only in non-1G mode */
+        if (params->lane_config & PORT_HW_CFG_SWAP_PHY_POLARITY_ENABLED) {
+                /* Configure the 8073 to swap _P and _N of the KR lines */
+                DP(NETIF_MSG_LINK, "Swapping polarity for the 8073\n");
+                /* 10G Rx/Tx and 1G Tx signal polarity swap */
+                bnx2x_cl45_read(bp, phy,
+                                MDIO_PMA_DEVAD,
+                                MDIO_PMA_REG_8073_OPT_DIGITAL_CTRL, &val);
+                bnx2x_cl45_write(bp, phy,
+                                 MDIO_PMA_DEVAD,
+                                 MDIO_PMA_REG_8073_OPT_DIGITAL_CTRL,
+                                 (val | (3<<9)));
+        }
+
+
         /* Enable CL37 BAM */
         if (REG_RD(bp, params->shmem_base +
                          offsetof(struct shmem_region, dev_info.
@@ -4314,8 +4339,32 @@ static u8 bnx2x_8073_read_status(struct bnx2x_phy *phy,
         }
 
         if (link_up) {
+                /* Swap polarity if required */
+                if (params->lane_config &
+                    PORT_HW_CFG_SWAP_PHY_POLARITY_ENABLED) {
+                        /* Configure the 8073 to swap P and N of the KR lines */
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_XS_DEVAD,
+                                        MDIO_XS_REG_8073_RX_CTRL_PCIE, &val1);
+                        /**
+                        * Set bit 3 to invert Rx in 1G mode and clear this bit
+                        * when it`s in 10G mode.
+                        */
+                        if (vars->line_speed == SPEED_1000) {
+                                DP(NETIF_MSG_LINK, "Swapping 1G polarity for"
+                                              "the 8073\n");
+                                val1 |= (1<<3);
+                        } else
+                                val1 &= ~(1<<3);
+
+                        bnx2x_cl45_write(bp, phy,
+                                         MDIO_XS_DEVAD,
+                                         MDIO_XS_REG_8073_RX_CTRL_PCIE,
+                                         val1);
+                }
                 bnx2x_ext_phy_10G_an_resolve(bp, phy, vars);
                 bnx2x_8073_resolve_fc(phy, params, vars);
+                vars->duplex = DUPLEX_FULL;
         }
         return link_up;
 }
@@ -5062,6 +5111,7 @@ static u8 bnx2x_8706_8726_read_status(struct bnx2x_phy *phy,
                 else
                         vars->line_speed = SPEED_10000;
                 bnx2x_ext_phy_resolve_fc(phy, params, vars);
+                vars->duplex = DUPLEX_FULL;
         }
         return link_up;
 }
@@ -5758,8 +5808,11 @@ static u8 bnx2x_8727_read_status(struct bnx2x_phy *phy,
                 DP(NETIF_MSG_LINK, "port %x: External link is down\n",
                            params->port);
         }
-        if (link_up)
+        if (link_up) {
                 bnx2x_ext_phy_resolve_fc(phy, params, vars);
+                vars->duplex = DUPLEX_FULL;
+                DP(NETIF_MSG_LINK, "duplex = 0x%x\n", vars->duplex);
+        }
 
         if ((DUAL_MEDIA(params)) &&
             (phy->req_line_speed == SPEED_1000)) {
@@ -5875,10 +5928,26 @@ static void bnx2x_848xx_set_led(struct bnx2x *bp,
                          MDIO_PMA_REG_8481_LED2_MASK,
                          0x18);
 
+        /* Select activity source by Tx and Rx, as suggested by PHY AE */
         bnx2x_cl45_write(bp, phy,
                          MDIO_PMA_DEVAD,
                          MDIO_PMA_REG_8481_LED3_MASK,
-                         0x0040);
+                         0x0006);
+
+        /* Select the closest activity blink rate to that in 10/100/1000 */
+        bnx2x_cl45_write(bp, phy,
+                        MDIO_PMA_DEVAD,
+                        MDIO_PMA_REG_8481_LED3_BLINK,
+                        0);
+
+        bnx2x_cl45_read(bp, phy,
+                        MDIO_PMA_DEVAD,
+                        MDIO_PMA_REG_84823_CTL_LED_CTL_1, &val);
+        val |= MDIO_PMA_REG_84823_LED3_STRETCH_EN; /* stretch_en for LED3*/
+
+        bnx2x_cl45_write(bp, phy,
+                         MDIO_PMA_DEVAD,
+                         MDIO_PMA_REG_84823_CTL_LED_CTL_1, val);
 
         /* 'Interrupt Mask' */
         bnx2x_cl45_write(bp, phy,
@@ -6126,6 +6195,7 @@ static u8 bnx2x_848xx_read_status(struct bnx2x_phy *phy,
         /* Check link 10G */
         if (val2 & (1<<11)) {
                 vars->line_speed = SPEED_10000;
+                vars->duplex = DUPLEX_FULL;
                 link_up = 1;
                 bnx2x_ext_phy_10G_an_resolve(bp, phy, vars);
         } else { /* Check Legacy speed link */
@@ -6405,6 +6475,18 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LED1_MASK,
                                          0x80);
+
+                        /* Tell LED3 to blink on source */
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                        &val);
+                        val &= ~(7<<6);
+                        val |= (1<<6); /* A83B[8:6]= 1 */
+                        bnx2x_cl45_write(bp, phy,
+                                         MDIO_PMA_DEVAD,
+                                         MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                         val);
                 }
                 break;
         }
@@ -6489,6 +6571,7 @@ static u8 bnx2x_7101_read_status(struct bnx2x_phy *phy,
                                 MDIO_AN_DEVAD, MDIO_AN_REG_MASTER_STATUS,
                                 &val2);
                 vars->line_speed = SPEED_10000;
+                vars->duplex = DUPLEX_FULL;
                 DP(NETIF_MSG_LINK, "SFX7101 AN status 0x%x->Master=%x\n",
                            val2, (val2 & (1<<14)));
                 bnx2x_ext_phy_10G_an_resolve(bp, phy, vars);
@@ -7605,10 +7688,13 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp,
         struct bnx2x_phy phy[PORT_MAX];
         struct bnx2x_phy *phy_blk[PORT_MAX];
         u16 val;
-        s8 port;
+        s8 port = 0;
         s8 port_of_path = 0;
-
-        bnx2x_ext_phy_hw_reset(bp, 0);
+        u32 swap_val, swap_override;
+        swap_val = REG_RD(bp,  NIG_REG_PORT_SWAP);
+        swap_override = REG_RD(bp,  NIG_REG_STRAP_OVERRIDE);
+        port ^= (swap_val && swap_override);
+        bnx2x_ext_phy_hw_reset(bp, port);
         /* PART1 - Reset both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 u32 shmem_base, shmem2_base;
@@ -7663,7 +7749,6 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp,
 
         /* PART2 - Download firmware to both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
-                u16 fw_ver1;
                 if (CHIP_IS_E2(bp))
                         port_of_path = 0;
                 else
@@ -7671,19 +7756,9 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp,
 
                 DP(NETIF_MSG_LINK, "Loading spirom for phy address 0x%x\n",
                            phy_blk[port]->addr);
-                bnx2x_8073_8727_external_rom_boot(bp, phy_blk[port],
-                                                  port_of_path);
-
-                bnx2x_cl45_read(bp, phy_blk[port],
-                              MDIO_PMA_DEVAD,
-                              MDIO_PMA_REG_ROM_VER1, &fw_ver1);
-                if (fw_ver1 == 0 || fw_ver1 == 0x4321) {
-                        DP(NETIF_MSG_LINK,
-                                 "bnx2x_8073_common_init_phy port %x:"
-                                 "Download failed. fw version = 0x%x\n",
-                                 port, fw_ver1);
+                if (bnx2x_8073_8727_external_rom_boot(bp, phy_blk[port],
+                                                      port_of_path))
                         return -EINVAL;
-                }
 
                 /* Only set bit 10 = 1 (Tx power down) */
                 bnx2x_cl45_read(bp, phy_blk[port],
@@ -7848,27 +7923,17 @@ static u8 bnx2x_8727_common_init_phy(struct bnx2x *bp,
         }
         /* PART2 - Download firmware to both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
-                u16 fw_ver1;
                  if (CHIP_IS_E2(bp))
                         port_of_path = 0;
                 else
                         port_of_path = port;
                 DP(NETIF_MSG_LINK, "Loading spirom for phy address 0x%x\n",
                            phy_blk[port]->addr);
-                bnx2x_8073_8727_external_rom_boot(bp, phy_blk[port],
-                                                  port_of_path);
-                bnx2x_cl45_read(bp, phy_blk[port],
-                              MDIO_PMA_DEVAD,
-                              MDIO_PMA_REG_ROM_VER1, &fw_ver1);
-                if (fw_ver1 == 0 || fw_ver1 == 0x4321) {
-                        DP(NETIF_MSG_LINK,
-                                 "bnx2x_8727_common_init_phy port %x:"
-                                 "Download failed. fw version = 0x%x\n",
-                                 port, fw_ver1);
+                if (bnx2x_8073_8727_external_rom_boot(bp, phy_blk[port],
+                                                      port_of_path))
                         return -EINVAL;
-                }
-        }
 
+        }
         return 0;
 }
 
@@ -7916,6 +7981,7 @@ u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base_path[],
                          u32 shmem2_base_path[], u32 chip_id)
 {
         u8 rc = 0;
+        u32 phy_ver;
         u8 phy_index;
         u32 ext_phy_type, ext_phy_config;
         DP(NETIF_MSG_LINK, "Begin common phy init\n");
@@ -7923,6 +7989,16 @@ u8 bnx2x_common_init_phy(struct bnx2x *bp, u32 shmem_base_path[],
         if (CHIP_REV_IS_EMUL(bp))
                 return 0;
 
+        /* Check if common init was already done */
+        phy_ver = REG_RD(bp, shmem_base_path[0] +
+                         offsetof(struct shmem_region,
+                                  port_mb[PORT_0].ext_phy_fw_version));
+        if (phy_ver) {
+                DP(NETIF_MSG_LINK, "Not doing common init; phy ver is 0x%x\n",
+                               phy_ver);
+                return 0;
+        }
+
         /* Read the ext_phy_type for arbitrary port(0) */
         for (phy_index = EXT_PHY1; phy_index < MAX_PHYS;
               phy_index++) {
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index 8cdcf5b39d1..f40740e68ea 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -2301,15 +2301,10 @@ static void bnx2x_rxq_set_mac_filters(struct bnx2x *bp, u16 cl_id, u32 filters)
                 /* accept matched ucast */
                 drop_all_ucast = 0;
         }
-        if (filters & BNX2X_ACCEPT_MULTICAST) {
+        if (filters & BNX2X_ACCEPT_MULTICAST)
                 /* accept matched mcast */
                 drop_all_mcast = 0;
-                if (IS_MF_SI(bp))
-                        /* since mcast addresses won't arrive with ovlan,
-                         * fw needs to accept all of them in
-                         * switch-independent mode */
-                        accp_all_mcast = 1;
-        }
+
         if (filters & BNX2X_ACCEPT_ALL_UNICAST) {
                 /* accept all mcast */
                 drop_all_ucast = 0;
@@ -5296,10 +5291,6 @@ static int bnx2x_init_hw_common(struct bnx2x *bp, u32 load_code)
                 }
         }
 
-        bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
-                                                       bp->common.shmem_base,
-                                                       bp->common.shmem2_base);
-
         bnx2x_setup_fan_failure_detection(bp);
 
         /* clear PXP2 attentions */
@@ -5503,9 +5494,6 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
 
         bnx2x_init_block(bp, MCP_BLOCK, init_stage);
         bnx2x_init_block(bp, DMAE_BLOCK, init_stage);
-        bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
-                                                       bp->common.shmem_base,
-                                                       bp->common.shmem2_base);
         if (bnx2x_fan_failure_det_req(bp, bp->common.shmem_base,
                                       bp->common.shmem2_base, port)) {
                 u32 reg_addr = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
@@ -8379,6 +8367,17 @@ static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
                  (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN))
                 bp->mdio.prtad =
                         XGXS_EXT_PHY_ADDR(ext_phy_config);
+
+        /*
+         * Check if hw lock is required to access MDC/MDIO bus to the PHY(s)
+         * In MF mode, it is set to cover self test cases
+         */
+        if (IS_MF(bp))
+                bp->port.need_hw_lock = 1;
+        else
+                bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
+                                                        bp->common.shmem_base,
+                                                        bp->common.shmem2_base);
 }
 
 static void __devinit bnx2x_get_mac_hwinfo(struct bnx2x *bp)
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index c939683e3d6..e01330bb36c 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -6194,7 +6194,11 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_CTL_REG_84823_MEDIA_PRIORITY_COPPER        0x0000
 #define MDIO_CTL_REG_84823_MEDIA_PRIORITY_FIBER         0x0100
 #define MDIO_CTL_REG_84823_MEDIA_FIBER_1G                       0x1000
+#define MDIO_CTL_REG_84823_USER_CTRL_REG                0x4005
+#define MDIO_CTL_REG_84823_USER_CTRL_CMS                0x0080
 
+#define MDIO_PMA_REG_84823_CTL_LED_CTL_1                0xa8e3
+#define MDIO_PMA_REG_84823_LED3_STRETCH_EN              0x0080
 
 #define IGU_FUNC_BASE                   0x0400
 
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 171782e2bb3..1024ae15822 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2470,6 +2470,10 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
         if (!(dev->flags & IFF_MASTER))
                 goto out;
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out;
+
         if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
                 goto out;
 
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index f4e638c6512..5c6fba802f2 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -326,6 +326,10 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
                 goto out;
         }
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out;
+
         if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
                 goto out;
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b1025b85acf..163e0b06eaa 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2733,6 +2733,10 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack
         if (!slave || !slave_do_arp_validate(bond, slave))
                 goto out_unlock;
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out_unlock;
+
         if (!pskb_may_pull(skb, arp_hdr_len(dev)))
                 goto out_unlock;
 
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index d5a9db60ade..5dec456fd4a 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -23,7 +23,7 @@ config CAN_SLCAN
 
           As only the sending and receiving of CAN frames is implemented, this
           driver should work with the (serial/USB) CAN hardware from:
-          www.canusb.com / www.can232.com / www.mictronic.com / www.canhack.de
+          www.canusb.com / www.can232.com / www.mictronics.de / www.canhack.de
 
           Userspace tools to attach the SLCAN line discipline (slcan_attach,
           slcand) can be found in the can-utils at the SocketCAN SVN, see
@@ -117,6 +117,8 @@ source "drivers/net/can/sja1000/Kconfig"
 
 source "drivers/net/can/usb/Kconfig"
 
+source "drivers/net/can/softing/Kconfig"
+
 config CAN_DEBUG_DEVICES
         bool "CAN devices debugging messages"
         depends on CAN
diff --git a/drivers/net/can/Makefile b/drivers/net/can/Makefile
index 07ca159ba3f..53c82a71778 100644
--- a/drivers/net/can/Makefile
+++ b/drivers/net/can/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_CAN_DEV)		+= can-dev.o
 can-dev-y                       := dev.o
 
 obj-y                           += usb/
+obj-y                           += softing/
 
 obj-$(CONFIG_CAN_SJA1000)       += sja1000/
 obj-$(CONFIG_CAN_MSCAN)         += mscan/
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 7ef83d06f7e..57d2ffbbb43 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -2,7 +2,7 @@
  * at91_can.c - CAN network driver for AT91 SoC CAN controller
  *
  * (C) 2007 by Hans J. Koch <hjk@hansjkoch.de>
- * (C) 2008, 2009, 2010 by Marc Kleine-Budde <kernel@pengutronix.de>
+ * (C) 2008, 2009, 2010, 2011 by Marc Kleine-Budde <kernel@pengutronix.de>
  *
  * This software may be distributed under the terms of the GNU General
  * Public License ("GPL") version 2 as distributed in the 'COPYING'
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/platform_device.h>
+#include <linux/rtnetlink.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
@@ -40,22 +41,23 @@
 
 #include <mach/board.h>
 
-#define AT91_NAPI_WEIGHT        12
+#define AT91_NAPI_WEIGHT        11
 
 /*
  * RX/TX Mailbox split
  * don't dare to touch
  */
-#define AT91_MB_RX_NUM          12
+#define AT91_MB_RX_NUM          11
 #define AT91_MB_TX_SHIFT        2
 
-#define AT91_MB_RX_FIRST        0
+#define AT91_MB_RX_FIRST        1
 #define AT91_MB_RX_LAST         (AT91_MB_RX_FIRST + AT91_MB_RX_NUM - 1)
 
 #define AT91_MB_RX_MASK(i)      ((1 << (i)) - 1)
 #define AT91_MB_RX_SPLIT        8
 #define AT91_MB_RX_LOW_LAST     (AT91_MB_RX_SPLIT - 1)
-#define AT91_MB_RX_LOW_MASK     (AT91_MB_RX_MASK(AT91_MB_RX_SPLIT))
+#define AT91_MB_RX_LOW_MASK     (AT91_MB_RX_MASK(AT91_MB_RX_SPLIT) & \
+                                 ~AT91_MB_RX_MASK(AT91_MB_RX_FIRST))
 
 #define AT91_MB_TX_NUM          (1 << AT91_MB_TX_SHIFT)
 #define AT91_MB_TX_FIRST        (AT91_MB_RX_LAST + 1)
@@ -168,6 +170,8 @@ struct at91_priv {
 
         struct clk              *clk;
         struct at91_can_data    *pdata;
+
+        canid_t                 mb0_id;
 };
 
 static struct can_bittiming_const at91_bittiming_const = {
@@ -220,6 +224,18 @@ static inline void set_mb_mode(const struct at91_priv *priv, unsigned int mb,
         set_mb_mode_prio(priv, mb, mode, 0);
 }
 
+static inline u32 at91_can_id_to_reg_mid(canid_t can_id)
+{
+        u32 reg_mid;
+
+        if (can_id & CAN_EFF_FLAG)
+                reg_mid = (can_id & CAN_EFF_MASK) | AT91_MID_MIDE;
+        else
+                reg_mid = (can_id & CAN_SFF_MASK) << 18;
+
+        return reg_mid;
+}
+
 /*
  * Swtich transceiver on or off
  */
@@ -233,12 +249,22 @@ static void at91_setup_mailboxes(struct net_device *dev)
 {
         struct at91_priv *priv = netdev_priv(dev);
         unsigned int i;
+        u32 reg_mid;
 
         /*
-         * The first 12 mailboxes are used as a reception FIFO. The
-         * last mailbox is configured with overwrite option. The
-         * overwrite flag indicates a FIFO overflow.
+         * Due to a chip bug (errata 50.2.6.3 & 50.3.5.3) the first
+         * mailbox is disabled. The next 11 mailboxes are used as a
+         * reception FIFO. The last mailbox is configured with
+         * overwrite option. The overwrite flag indicates a FIFO
+         * overflow.
          */
+        reg_mid = at91_can_id_to_reg_mid(priv->mb0_id);
+        for (i = 0; i < AT91_MB_RX_FIRST; i++) {
+                set_mb_mode(priv, i, AT91_MB_MODE_DISABLED);
+                at91_write(priv, AT91_MID(i), reg_mid);
+                at91_write(priv, AT91_MCR(i), 0x0);     /* clear dlc */
+        }
+
         for (i = AT91_MB_RX_FIRST; i < AT91_MB_RX_LAST; i++)
                 set_mb_mode(priv, i, AT91_MB_MODE_RX);
         set_mb_mode(priv, AT91_MB_RX_LAST, AT91_MB_MODE_RX_OVRWR);
@@ -254,7 +280,8 @@ static void at91_setup_mailboxes(struct net_device *dev)
                 set_mb_mode_prio(priv, i, AT91_MB_MODE_TX, 0);
 
         /* Reset tx and rx helper pointers */
-        priv->tx_next = priv->tx_echo = priv->rx_next = 0;
+        priv->tx_next = priv->tx_echo = 0;
+        priv->rx_next = AT91_MB_RX_FIRST;
 }
 
 static int at91_set_bittiming(struct net_device *dev)
@@ -372,12 +399,7 @@ static netdev_tx_t at91_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 netdev_err(dev, "BUG! TX buffer full when queue awake!\n");
                 return NETDEV_TX_BUSY;
         }
-
-        if (cf->can_id & CAN_EFF_FLAG)
-                reg_mid = (cf->can_id & CAN_EFF_MASK) | AT91_MID_MIDE;
-        else
-                reg_mid = (cf->can_id & CAN_SFF_MASK) << 18;
-
+        reg_mid = at91_can_id_to_reg_mid(cf->can_id);
         reg_mcr = ((cf->can_id & CAN_RTR_FLAG) ? AT91_MCR_MRTR : 0) |
                 (cf->can_dlc << 16) | AT91_MCR_MTCR;
 
@@ -539,27 +561,31 @@ static void at91_read_msg(struct net_device *dev, unsigned int mb)
  *
  * Theory of Operation:
  *
- * 12 of the 16 mailboxes on the chip are reserved for RX. we split
- * them into 2 groups. The lower group holds 8 and upper 4 mailboxes.
+ * 11 of the 16 mailboxes on the chip are reserved for RX. we split
+ * them into 2 groups. The lower group holds 7 and upper 4 mailboxes.
  *
  * Like it or not, but the chip always saves a received CAN message
  * into the first free mailbox it finds (starting with the
  * lowest). This makes it very difficult to read the messages in the
  * right order from the chip. This is how we work around that problem:
  *
- * The first message goes into mb nr. 0 and issues an interrupt. All
+ * The first message goes into mb nr. 1 and issues an interrupt. All
  * rx ints are disabled in the interrupt handler and a napi poll is
  * scheduled. We read the mailbox, but do _not_ reenable the mb (to
  * receive another message).
  *
  *    lower mbxs      upper
- *   ______^______    __^__
- *  /             \  /     \
+ *     ____^______    __^__
+ *    /           \  /     \
  * +-+-+-+-+-+-+-+-++-+-+-+-+
- * |x|x|x|x|x|x|x|x|| | | | |
+ * | |x|x|x|x|x|x|x|| | | | |
  * +-+-+-+-+-+-+-+-++-+-+-+-+
  *  0 0 0 0 0 0  0 0 0 0 1 1  \ mail
  *  0 1 2 3 4 5  6 7 8 9 0 1  / box
+ *  ^
+ *  |
+ *   \
+ *     unused, due to chip bug
  *
  * The variable priv->rx_next points to the next mailbox to read a
  * message from. As long we're in the lower mailboxes we just read the
@@ -590,10 +616,10 @@ static int at91_poll_rx(struct net_device *dev, int quota)
                         "order of incoming frames cannot be guaranteed\n");
 
  again:
-        for (mb = find_next_bit(addr, AT91_MB_RX_NUM, priv->rx_next);
-             mb < AT91_MB_RX_NUM && quota > 0;
+        for (mb = find_next_bit(addr, AT91_MB_RX_LAST + 1, priv->rx_next);
+             mb < AT91_MB_RX_LAST + 1 && quota > 0;
              reg_sr = at91_read(priv, AT91_SR),
-             mb = find_next_bit(addr, AT91_MB_RX_NUM, ++priv->rx_next)) {
+             mb = find_next_bit(addr, AT91_MB_RX_LAST + 1, ++priv->rx_next)) {
                 at91_read_msg(dev, mb);
 
                 /* reactivate mailboxes */
@@ -610,8 +636,8 @@ static int at91_poll_rx(struct net_device *dev, int quota)
 
         /* upper group completed, look again in lower */
         if (priv->rx_next > AT91_MB_RX_LOW_LAST &&
-            quota > 0 && mb >= AT91_MB_RX_NUM) {
-                priv->rx_next = 0;
+            quota > 0 && mb > AT91_MB_RX_LAST) {
+                priv->rx_next = AT91_MB_RX_FIRST;
                 goto again;
         }
 
@@ -1037,6 +1063,64 @@ static const struct net_device_ops at91_netdev_ops = {
         .ndo_start_xmit = at91_start_xmit,
 };
 
+static ssize_t at91_sysfs_show_mb0_id(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct at91_priv *priv = netdev_priv(to_net_dev(dev));
+
+        if (priv->mb0_id & CAN_EFF_FLAG)
+                return snprintf(buf, PAGE_SIZE, "0x%08x\n", priv->mb0_id);
+        else
+                return snprintf(buf, PAGE_SIZE, "0x%03x\n", priv->mb0_id);
+}
+
+static ssize_t at91_sysfs_set_mb0_id(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct at91_priv *priv = netdev_priv(ndev);
+        unsigned long can_id;
+        ssize_t ret;
+        int err;
+
+        rtnl_lock();
+
+        if (ndev->flags & IFF_UP) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        err = strict_strtoul(buf, 0, &can_id);
+        if (err) {
+                ret = err;
+                goto out;
+        }
+
+        if (can_id & CAN_EFF_FLAG)
+                can_id &= CAN_EFF_MASK | CAN_EFF_FLAG;
+        else
+                can_id &= CAN_SFF_MASK;
+
+        priv->mb0_id = can_id;
+        ret = count;
+
+ out:
+        rtnl_unlock();
+        return ret;
+}
+
+static DEVICE_ATTR(mb0_id, S_IWUSR | S_IRUGO,
+        at91_sysfs_show_mb0_id, at91_sysfs_set_mb0_id);
+
+static struct attribute *at91_sysfs_attrs[] = {
+        &dev_attr_mb0_id.attr,
+        NULL,
+};
+
+static struct attribute_group at91_sysfs_attr_group = {
+        .attrs = at91_sysfs_attrs,
+};
+
 static int __devinit at91_can_probe(struct platform_device *pdev)
 {
         struct net_device *dev;
@@ -1082,6 +1166,7 @@ static int __devinit at91_can_probe(struct platform_device *pdev)
         dev->netdev_ops = &at91_netdev_ops;
         dev->irq = irq;
         dev->flags |= IFF_ECHO;
+        dev->sysfs_groups[0] = &at91_sysfs_attr_group;
 
         priv = netdev_priv(dev);
         priv->can.clock.freq = clk_get_rate(clk);
@@ -1093,6 +1178,7 @@ static int __devinit at91_can_probe(struct platform_device *pdev)
         priv->dev = dev;
         priv->clk = clk;
         priv->pdata = pdev->dev.platform_data;
+        priv->mb0_id = 0x7ff;
 
         netif_napi_add(dev, &priv->napi, at91_poll, AT91_NAPI_WEIGHT);
 
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index b9a6d7a5a73..366f5cc050a 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -1618,7 +1618,7 @@ static ssize_t ican3_sysfs_set_term(struct device *dev,
         return count;
 }
 
-static DEVICE_ATTR(termination, S_IWUGO | S_IRUGO, ican3_sysfs_show_term,
+static DEVICE_ATTR(termination, S_IWUSR | S_IRUGO, ican3_sysfs_show_term,
                                                    ican3_sysfs_set_term);
 
 static struct attribute *ican3_sysfs_attrs[] = {
diff --git a/drivers/net/can/softing/Kconfig b/drivers/net/can/softing/Kconfig
new file mode 100644
index 00000000000..8ba81b3ddd9
--- /dev/null
+++ b/drivers/net/can/softing/Kconfig
@@ -0,0 +1,30 @@
+config CAN_SOFTING
+        tristate "Softing Gmbh CAN generic support"
+        depends on CAN_DEV && HAS_IOMEM
+        ---help---
+          Support for CAN cards from Softing Gmbh & some cards
+          from Vector Gmbh.
+          Softing Gmbh CAN cards come with 1 or 2 physical busses.
+          Those cards typically use Dual Port RAM to communicate
+          with the host CPU. The interface is then identical for PCI
+          and PCMCIA cards. This driver operates on a platform device,
+          which has been created by softing_cs or softing_pci driver.
+          Warning:
+          The API of the card does not allow fine control per bus, but
+          controls the 2 busses on the card together.
+          As such, some actions (start/stop/busoff recovery) on 1 bus
+          must bring down the other bus too temporarily.
+
+config CAN_SOFTING_CS
+        tristate "Softing Gmbh CAN pcmcia cards"
+        depends on PCMCIA
+        select CAN_SOFTING
+        ---help---
+          Support for PCMCIA cards from Softing Gmbh & some cards
+          from Vector Gmbh.
+          You need firmware for these, which you can get at
+          http://developer.berlios.de/projects/socketcan/
+          This version of the driver is written against
+          firmware version 4.6 (softing-fw-4.6-binaries.tar.gz)
+          In order to use the card as CAN device, you need the Softing generic
+          support too.
diff --git a/drivers/net/can/softing/Makefile b/drivers/net/can/softing/Makefile
new file mode 100644
index 00000000000..c5e5016c742
--- /dev/null
+++ b/drivers/net/can/softing/Makefile
@@ -0,0 +1,6 @@
+
+softing-y := softing_main.o softing_fw.o
+obj-$(CONFIG_CAN_SOFTING) += softing.o
+obj-$(CONFIG_CAN_SOFTING_CS) += softing_cs.o
+
+ccflags-$(CONFIG_CAN_DEBUG_DEVICES) := -DDEBUG
diff --git a/drivers/net/can/softing/softing.h b/drivers/net/can/softing/softing.h
new file mode 100644
index 00000000000..7ec9f4db3d5
--- /dev/null
+++ b/drivers/net/can/softing/softing.h
@@ -0,0 +1,167 @@
+/*
+ * softing common interfaces
+ *
+ * by Kurt Van Dijck, 2008-2010
+ */
+
+#include <linux/atomic.h>
+#include <linux/netdevice.h>
+#include <linux/ktime.h>
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/can.h>
+#include <linux/can/dev.h>
+
+#include "softing_platform.h"
+
+struct softing;
+
+struct softing_priv {
+        struct can_priv can; /* must be the first member! */
+        struct net_device *netdev;
+        struct softing *card;
+        struct {
+                int pending;
+                /* variables wich hold the circular buffer */
+                int echo_put;
+                int echo_get;
+        } tx;
+        struct can_bittiming_const btr_const;
+        int index;
+        uint8_t output;
+        uint16_t chip;
+};
+#define netdev2softing(netdev)  ((struct softing_priv *)netdev_priv(netdev))
+
+struct softing {
+        const struct softing_platform_data *pdat;
+        struct platform_device *pdev;
+        struct net_device *net[2];
+        spinlock_t spin; /* protect this structure & DPRAM access */
+        ktime_t ts_ref;
+        ktime_t ts_overflow; /* timestamp overflow value, in ktime */
+
+        struct {
+                /* indication of firmware status */
+                int up;
+                /* protection of the 'up' variable */
+                struct mutex lock;
+        } fw;
+        struct {
+                int nr;
+                int requested;
+                int svc_count;
+                unsigned int dpram_position;
+        } irq;
+        struct {
+                int pending;
+                int last_bus;
+                /*
+                 * keep the bus that last tx'd a message,
+                 * in order to let every netdev queue resume
+                 */
+        } tx;
+        __iomem uint8_t *dpram;
+        unsigned long dpram_phys;
+        unsigned long dpram_size;
+        struct {
+                uint16_t fw_version, hw_version, license, serial;
+                uint16_t chip[2];
+                unsigned int freq; /* remote cpu's operating frequency */
+        } id;
+};
+
+extern int softing_default_output(struct net_device *netdev);
+
+extern ktime_t softing_raw2ktime(struct softing *card, u32 raw);
+
+extern int softing_chip_poweron(struct softing *card);
+
+extern int softing_bootloader_command(struct softing *card, int16_t cmd,
+                const char *msg);
+
+/* Load firmware after reset */
+extern int softing_load_fw(const char *file, struct softing *card,
+                        __iomem uint8_t *virt, unsigned int size, int offset);
+
+/* Load final application firmware after bootloader */
+extern int softing_load_app_fw(const char *file, struct softing *card);
+
+/*
+ * enable or disable irq
+ * only called with fw.lock locked
+ */
+extern int softing_enable_irq(struct softing *card, int enable);
+
+/* start/stop 1 bus on card */
+extern int softing_startstop(struct net_device *netdev, int up);
+
+/* netif_rx() */
+extern int softing_netdev_rx(struct net_device *netdev,
+                const struct can_frame *msg, ktime_t ktime);
+
+/* SOFTING DPRAM mappings */
+#define DPRAM_RX                0x0000
+        #define DPRAM_RX_SIZE   32
+        #define DPRAM_RX_CNT    16
+#define DPRAM_RX_RD             0x0201  /* uint8_t */
+#define DPRAM_RX_WR             0x0205  /* uint8_t */
+#define DPRAM_RX_LOST           0x0207  /* uint8_t */
+
+#define DPRAM_FCT_PARAM         0x0300  /* int16_t [20] */
+#define DPRAM_FCT_RESULT        0x0328  /* int16_t */
+#define DPRAM_FCT_HOST          0x032b  /* uint16_t */
+
+#define DPRAM_INFO_BUSSTATE     0x0331  /* uint16_t */
+#define DPRAM_INFO_BUSSTATE2    0x0335  /* uint16_t */
+#define DPRAM_INFO_ERRSTATE     0x0339  /* uint16_t */
+#define DPRAM_INFO_ERRSTATE2    0x033d  /* uint16_t */
+#define DPRAM_RESET             0x0341  /* uint16_t */
+#define DPRAM_CLR_RECV_FIFO     0x0345  /* uint16_t */
+#define DPRAM_RESET_TIME        0x034d  /* uint16_t */
+#define DPRAM_TIME              0x0350  /* uint64_t */
+#define DPRAM_WR_START          0x0358  /* uint8_t */
+#define DPRAM_WR_END            0x0359  /* uint8_t */
+#define DPRAM_RESET_RX_FIFO     0x0361  /* uint16_t */
+#define DPRAM_RESET_TX_FIFO     0x0364  /* uint8_t */
+#define DPRAM_READ_FIFO_LEVEL   0x0365  /* uint8_t */
+#define DPRAM_RX_FIFO_LEVEL     0x0366  /* uint16_t */
+#define DPRAM_TX_FIFO_LEVEL     0x0366  /* uint16_t */
+
+#define DPRAM_TX                0x0400  /* uint16_t */
+        #define DPRAM_TX_SIZE   16
+        #define DPRAM_TX_CNT    32
+#define DPRAM_TX_RD             0x0601  /* uint8_t */
+#define DPRAM_TX_WR             0x0605  /* uint8_t */
+
+#define DPRAM_COMMAND           0x07e0  /* uint16_t */
+#define DPRAM_RECEIPT           0x07f0  /* uint16_t */
+#define DPRAM_IRQ_TOHOST        0x07fe  /* uint8_t */
+#define DPRAM_IRQ_TOCARD        0x07ff  /* uint8_t */
+
+#define DPRAM_V2_RESET          0x0e00  /* uint8_t */
+#define DPRAM_V2_IRQ_TOHOST     0x0e02  /* uint8_t */
+
+#define TXMAX   (DPRAM_TX_CNT - 1)
+
+/* DPRAM return codes */
+#define RES_NONE        0
+#define RES_OK          1
+#define RES_NOK         2
+#define RES_UNKNOWN     3
+/* DPRAM flags */
+#define CMD_TX          0x01
+#define CMD_ACK         0x02
+#define CMD_XTD         0x04
+#define CMD_RTR         0x08
+#define CMD_ERR         0x10
+#define CMD_BUS2        0x80
+
+/* returned fifo entry bus state masks */
+#define SF_MASK_BUSOFF          0x80
+#define SF_MASK_EPASSIVE        0x60
+
+/* bus states */
+#define STATE_BUSOFF    2
+#define STATE_EPASSIVE  1
+#define STATE_EACTIVE   0
diff --git a/drivers/net/can/softing/softing_cs.c b/drivers/net/can/softing/softing_cs.c
new file mode 100644
index 00000000000..300fe75dd1a
--- /dev/null
+++ b/drivers/net/can/softing/softing_cs.c
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2008-2010
+ *
+ * - Kurt Van Dijck, EIA Electronics
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the version 2 of the GNU General Public License
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include <pcmcia/cistpl.h>
+#include <pcmcia/ds.h>
+
+#include "softing_platform.h"
+
+static int softingcs_index;
+static spinlock_t softingcs_index_lock;
+
+static int softingcs_reset(struct platform_device *pdev, int v);
+static int softingcs_enable_irq(struct platform_device *pdev, int v);
+
+/*
+ * platform_data descriptions
+ */
+#define MHZ (1000*1000)
+static const struct softing_platform_data softingcs_platform_data[] = {
+{
+        .name = "CANcard",
+        .manf = 0x0168, .prod = 0x001,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 16 * MHZ, .max_brp = 32, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancard.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "CANcard-NEC",
+        .manf = 0x0168, .prod = 0x002,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 16 * MHZ, .max_brp = 32, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancard.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "CANcard-SJA",
+        .manf = 0x0168, .prod = 0x004,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 20 * MHZ, .max_brp = 32, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cansja.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "CANcard-2",
+        .manf = 0x0168, .prod = 0x005,
+        .generation = 2,
+        .nbus = 2,
+        .freq = 24 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x1000,
+        .boot = {0x0000, 0x000000, fw_dir "bcard2.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard2.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancrd2.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = NULL,
+}, {
+        .name = "Vector-CANcard",
+        .manf = 0x0168, .prod = 0x081,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 16 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancard.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "Vector-CANcard-SJA",
+        .manf = 0x0168, .prod = 0x084,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 20 * MHZ, .max_brp = 32, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cansja.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "Vector-CANcard-2",
+        .manf = 0x0168, .prod = 0x085,
+        .generation = 2,
+        .nbus = 2,
+        .freq = 24 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x1000,
+        .boot = {0x0000, 0x000000, fw_dir "bcard2.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard2.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancrd2.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = NULL,
+}, {
+        .name = "EDICcard-NEC",
+        .manf = 0x0168, .prod = 0x102,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 16 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancard.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "EDICcard-2",
+        .manf = 0x0168, .prod = 0x105,
+        .generation = 2,
+        .nbus = 2,
+        .freq = 24 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x1000,
+        .boot = {0x0000, 0x000000, fw_dir "bcard2.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard2.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancrd2.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = NULL,
+}, {
+        0, 0,
+},
+};
+
+MODULE_FIRMWARE(fw_dir "bcard.bin");
+MODULE_FIRMWARE(fw_dir "ldcard.bin");
+MODULE_FIRMWARE(fw_dir "cancard.bin");
+MODULE_FIRMWARE(fw_dir "cansja.bin");
+
+MODULE_FIRMWARE(fw_dir "bcard2.bin");
+MODULE_FIRMWARE(fw_dir "ldcard2.bin");
+MODULE_FIRMWARE(fw_dir "cancrd2.bin");
+
+static __devinit const struct softing_platform_data
+*softingcs_find_platform_data(unsigned int manf, unsigned int prod)
+{
+        const struct softing_platform_data *lp;
+
+        for (lp = softingcs_platform_data; lp->manf; ++lp) {
+                if ((lp->manf == manf) && (lp->prod == prod))
+                        return lp;
+        }
+        return NULL;
+}
+
+/*
+ * platformdata callbacks
+ */
+static int softingcs_reset(struct platform_device *pdev, int v)
+{
+        struct pcmcia_device *pcmcia = to_pcmcia_dev(pdev->dev.parent);
+
+        dev_dbg(&pdev->dev, "pcmcia config [2] %02x\n", v ? 0 : 0x20);
+        return pcmcia_write_config_byte(pcmcia, 2, v ? 0 : 0x20);
+}
+
+static int softingcs_enable_irq(struct platform_device *pdev, int v)
+{
+        struct pcmcia_device *pcmcia = to_pcmcia_dev(pdev->dev.parent);
+
+        dev_dbg(&pdev->dev, "pcmcia config [0] %02x\n", v ? 0x60 : 0);
+        return pcmcia_write_config_byte(pcmcia, 0, v ? 0x60 : 0);
+}
+
+/*
+ * pcmcia check
+ */
+static __devinit int softingcs_probe_config(struct pcmcia_device *pcmcia,
+                void *priv_data)
+{
+        struct softing_platform_data *pdat = priv_data;
+        struct resource *pres;
+        int memspeed = 0;
+
+        WARN_ON(!pdat);
+        pres = pcmcia->resource[PCMCIA_IOMEM_0];
+        if (resource_size(pres) < 0x1000)
+                return -ERANGE;
+
+        pres->flags |= WIN_MEMORY_TYPE_CM | WIN_ENABLE;
+        if (pdat->generation < 2) {
+                pres->flags |= WIN_USE_WAIT | WIN_DATA_WIDTH_8;
+                memspeed = 3;
+        } else {
+                pres->flags |= WIN_DATA_WIDTH_16;
+        }
+        return pcmcia_request_window(pcmcia, pres, memspeed);
+}
+
+static __devexit void softingcs_remove(struct pcmcia_device *pcmcia)
+{
+        struct platform_device *pdev = pcmcia->priv;
+
+        /* free bits */
+        platform_device_unregister(pdev);
+        /* release pcmcia stuff */
+        pcmcia_disable_device(pcmcia);
+}
+
+/*
+ * platform_device wrapper
+ * pdev->resource has 2 entries: io & irq
+ */
+static void softingcs_pdev_release(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        kfree(pdev);
+}
+
+static __devinit int softingcs_probe(struct pcmcia_device *pcmcia)
+{
+        int ret;
+        struct platform_device *pdev;
+        const struct softing_platform_data *pdat;
+        struct resource *pres;
+        struct dev {
+                struct platform_device pdev;
+                struct resource res[2];
+        } *dev;
+
+        /* find matching platform_data */
+        pdat = softingcs_find_platform_data(pcmcia->manf_id, pcmcia->card_id);
+        if (!pdat)
+                return -ENOTTY;
+
+        /* setup pcmcia device */
+        pcmcia->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IOMEM |
+                CONF_AUTO_SET_VPP | CONF_AUTO_CHECK_VCC;
+        ret = pcmcia_loop_config(pcmcia, softingcs_probe_config, (void *)pdat);
+        if (ret)
+                goto pcmcia_failed;
+
+        ret = pcmcia_enable_device(pcmcia);
+        if (ret < 0)
+                goto pcmcia_failed;
+
+        pres = pcmcia->resource[PCMCIA_IOMEM_0];
+        if (!pres) {
+                ret = -EBADF;
+                goto pcmcia_bad;
+        }
+
+        /* create softing platform device */
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev) {
+                ret = -ENOMEM;
+                goto mem_failed;
+        }
+        dev->pdev.resource = dev->res;
+        dev->pdev.num_resources = ARRAY_SIZE(dev->res);
+        dev->pdev.dev.release = softingcs_pdev_release;
+
+        pdev = &dev->pdev;
+        pdev->dev.platform_data = (void *)pdat;
+        pdev->dev.parent = &pcmcia->dev;
+        pcmcia->priv = pdev;
+
+        /* platform device resources */
+        pdev->resource[0].flags = IORESOURCE_MEM;
+        pdev->resource[0].start = pres->start;
+        pdev->resource[0].end = pres->end;
+
+        pdev->resource[1].flags = IORESOURCE_IRQ;
+        pdev->resource[1].start = pcmcia->irq;
+        pdev->resource[1].end = pdev->resource[1].start;
+
+        /* platform device setup */
+        spin_lock(&softingcs_index_lock);
+        pdev->id = softingcs_index++;
+        spin_unlock(&softingcs_index_lock);
+        pdev->name = "softing";
+        dev_set_name(&pdev->dev, "softingcs.%i", pdev->id);
+        ret = platform_device_register(pdev);
+        if (ret < 0)
+                goto platform_failed;
+
+        dev_info(&pcmcia->dev, "created %s\n", dev_name(&pdev->dev));
+        return 0;
+
+platform_failed:
+        kfree(dev);
+mem_failed:
+pcmcia_bad:
+pcmcia_failed:
+        pcmcia_disable_device(pcmcia);
+        pcmcia->priv = NULL;
+        return ret ?: -ENODEV;
+}
+
+static /*const*/ struct pcmcia_device_id softingcs_ids[] = {
+        /* softing */
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0001),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0002),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0004),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0005),
+        /* vector, manufacturer? */
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0081),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0084),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0085),
+        /* EDIC */
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0102),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0105),
+        PCMCIA_DEVICE_NULL,
+};
+
+MODULE_DEVICE_TABLE(pcmcia, softingcs_ids);
+
+static struct pcmcia_driver softingcs_driver = {
+        .owner          = THIS_MODULE,
+        .name           = "softingcs",
+        .id_table       = softingcs_ids,
+        .probe          = softingcs_probe,
+        .remove         = __devexit_p(softingcs_remove),
+};
+
+static int __init softingcs_start(void)
+{
+        spin_lock_init(&softingcs_index_lock);
+        return pcmcia_register_driver(&softingcs_driver);
+}
+
+static void __exit softingcs_stop(void)
+{
+        pcmcia_unregister_driver(&softingcs_driver);
+}
+
+module_init(softingcs_start);
+module_exit(softingcs_stop);
+
+MODULE_DESCRIPTION("softing CANcard driver"
+                ", links PCMCIA card to softing driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing/softing_fw.c
new file mode 100644
index 00000000000..b520784fb19
--- /dev/null
+++ b/drivers/net/can/softing/softing_fw.c
@@ -0,0 +1,691 @@
+/*
+ * Copyright (C) 2008-2010
+ *
+ * - Kurt Van Dijck, EIA Electronics
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the version 2 of the GNU General Public License
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/firmware.h>
+#include <linux/sched.h>
+#include <asm/div64.h>
+
+#include "softing.h"
+
+/*
+ * low level DPRAM command.
+ * Make sure that card->dpram[DPRAM_FCT_HOST] is preset
+ */
+static int _softing_fct_cmd(struct softing *card, int16_t cmd, uint16_t vector,
+                const char *msg)
+{
+        int ret;
+        unsigned long stamp;
+
+        iowrite16(cmd, &card->dpram[DPRAM_FCT_PARAM]);
+        iowrite8(vector >> 8, &card->dpram[DPRAM_FCT_HOST + 1]);
+        iowrite8(vector, &card->dpram[DPRAM_FCT_HOST]);
+        /* be sure to flush this to the card */
+        wmb();
+        stamp = jiffies + 1 * HZ;
+        /* wait for card */
+        do {
+                /* DPRAM_FCT_HOST is _not_ aligned */
+                ret = ioread8(&card->dpram[DPRAM_FCT_HOST]) +
+                        (ioread8(&card->dpram[DPRAM_FCT_HOST + 1]) << 8);
+                /* don't have any cached variables */
+                rmb();
+                if (ret == RES_OK)
+                        /* read return-value now */
+                        return ioread16(&card->dpram[DPRAM_FCT_RESULT]);
+
+                if ((ret != vector) || time_after(jiffies, stamp))
+                        break;
+                /* process context => relax */
+                usleep_range(500, 10000);
+        } while (1);
+
+        ret = (ret == RES_NONE) ? -ETIMEDOUT : -ECANCELED;
+        dev_alert(&card->pdev->dev, "firmware %s failed (%i)\n", msg, ret);
+        return ret;
+}
+
+static int softing_fct_cmd(struct softing *card, int16_t cmd, const char *msg)
+{
+        int ret;
+
+        ret = _softing_fct_cmd(card, cmd, 0, msg);
+        if (ret > 0) {
+                dev_alert(&card->pdev->dev, "%s returned %u\n", msg, ret);
+                ret = -EIO;
+        }
+        return ret;
+}
+
+int softing_bootloader_command(struct softing *card, int16_t cmd,
+                const char *msg)
+{
+        int ret;
+        unsigned long stamp;
+
+        iowrite16(RES_NONE, &card->dpram[DPRAM_RECEIPT]);
+        iowrite16(cmd, &card->dpram[DPRAM_COMMAND]);
+        /* be sure to flush this to the card */
+        wmb();
+        stamp = jiffies + 3 * HZ;
+        /* wait for card */
+        do {
+                ret = ioread16(&card->dpram[DPRAM_RECEIPT]);
+                /* don't have any cached variables */
+                rmb();
+                if (ret == RES_OK)
+                        return 0;
+                if (time_after(jiffies, stamp))
+                        break;
+                /* process context => relax */
+                usleep_range(500, 10000);
+        } while (!signal_pending(current));
+
+        ret = (ret == RES_NONE) ? -ETIMEDOUT : -ECANCELED;
+        dev_alert(&card->pdev->dev, "bootloader %s failed (%i)\n", msg, ret);
+        return ret;
+}
+
+static int fw_parse(const uint8_t **pmem, uint16_t *ptype, uint32_t *paddr,
+                uint16_t *plen, const uint8_t **pdat)
+{
+        uint16_t checksum[2];
+        const uint8_t *mem;
+        const uint8_t *end;
+
+        /*
+         * firmware records are a binary, unaligned stream composed of:
+         * uint16_t type;
+         * uint32_t addr;
+         * uint16_t len;
+         * uint8_t dat[len];
+         * uint16_t checksum;
+         * all values in little endian.
+         * We could define a struct for this, with __attribute__((packed)),
+         * but would that solve the alignment in _all_ cases (cfr. the
+         * struct itself may be an odd address)?
+         *
+         * I chose to use leXX_to_cpup() since this solves both
+         * endianness & alignment.
+         */
+        mem = *pmem;
+        *ptype = le16_to_cpup((void *)&mem[0]);
+        *paddr = le32_to_cpup((void *)&mem[2]);
+        *plen = le16_to_cpup((void *)&mem[6]);
+        *pdat = &mem[8];
+        /* verify checksum */
+        end = &mem[8 + *plen];
+        checksum[0] = le16_to_cpup((void *)end);
+        for (checksum[1] = 0; mem < end; ++mem)
+                checksum[1] += *mem;
+        if (checksum[0] != checksum[1])
+                return -EINVAL;
+        /* increment */
+        *pmem += 10 + *plen;
+        return 0;
+}
+
+int softing_load_fw(const char *file, struct softing *card,
+                __iomem uint8_t *dpram, unsigned int size, int offset)
+{
+        const struct firmware *fw;
+        int ret;
+        const uint8_t *mem, *end, *dat;
+        uint16_t type, len;
+        uint32_t addr;
+        uint8_t *buf = NULL;
+        int buflen = 0;
+        int8_t type_end = 0;
+
+        ret = request_firmware(&fw, file, &card->pdev->dev);
+        if (ret < 0)
+                return ret;
+        dev_dbg(&card->pdev->dev, "%s, firmware(%s) got %u bytes"
+                ", offset %c0x%04x\n",
+                card->pdat->name, file, (unsigned int)fw->size,
+                (offset >= 0) ? '+' : '-', (unsigned int)abs(offset));
+        /* parse the firmware */
+        mem = fw->data;
+        end = &mem[fw->size];
+        /* look for header record */
+        ret = fw_parse(&mem, &type, &addr, &len, &dat);
+        if (ret < 0)
+                goto failed;
+        if (type != 0xffff)
+                goto failed;
+        if (strncmp("Structured Binary Format, Softing GmbH" , dat, len)) {
+                ret = -EINVAL;
+                goto failed;
+        }
+        /* ok, we had a header */
+        while (mem < end) {
+                ret = fw_parse(&mem, &type, &addr, &len, &dat);
+                if (ret < 0)
+                        goto failed;
+                if (type == 3) {
+                        /* start address, not used here */
+                        continue;
+                } else if (type == 1) {
+                        /* eof */
+                        type_end = 1;
+                        break;
+                } else if (type != 0) {
+                        ret = -EINVAL;
+                        goto failed;
+                }
+
+                if ((addr + len + offset) > size)
+                        goto failed;
+                memcpy_toio(&dpram[addr + offset], dat, len);
+                /* be sure to flush caches from IO space */
+                mb();
+                if (len > buflen) {
+                        /* align buflen */
+                        buflen = (len + (1024-1)) & ~(1024-1);
+                        buf = krealloc(buf, buflen, GFP_KERNEL);
+                        if (!buf) {
+                                ret = -ENOMEM;
+                                goto failed;
+                        }
+                }
+                /* verify record data */
+                memcpy_fromio(buf, &dpram[addr + offset], len);
+                if (memcmp(buf, dat, len)) {
+                        /* is not ok */
+                        dev_alert(&card->pdev->dev, "DPRAM readback failed\n");
+                        ret = -EIO;
+                        goto failed;
+                }
+        }
+        if (!type_end)
+                /* no end record seen */
+                goto failed;
+        ret = 0;
+failed:
+        kfree(buf);
+        release_firmware(fw);
+        if (ret < 0)
+                dev_info(&card->pdev->dev, "firmware %s failed\n", file);
+        return ret;
+}
+
+int softing_load_app_fw(const char *file, struct softing *card)
+{
+        const struct firmware *fw;
+        const uint8_t *mem, *end, *dat;
+        int ret, j;
+        uint16_t type, len;
+        uint32_t addr, start_addr = 0;
+        unsigned int sum, rx_sum;
+        int8_t type_end = 0, type_entrypoint = 0;
+
+        ret = request_firmware(&fw, file, &card->pdev->dev);
+        if (ret) {
+                dev_alert(&card->pdev->dev, "request_firmware(%s) got %i\n",
+                        file, ret);
+                return ret;
+        }
+        dev_dbg(&card->pdev->dev, "firmware(%s) got %lu bytes\n",
+                file, (unsigned long)fw->size);
+        /* parse the firmware */
+        mem = fw->data;
+        end = &mem[fw->size];
+        /* look for header record */
+        ret = fw_parse(&mem, &type, &addr, &len, &dat);
+        if (ret)
+                goto failed;
+        ret = -EINVAL;
+        if (type != 0xffff) {
+                dev_alert(&card->pdev->dev, "firmware starts with type 0x%x\n",
+                        type);
+                goto failed;
+        }
+        if (strncmp("Structured Binary Format, Softing GmbH", dat, len)) {
+                dev_alert(&card->pdev->dev, "firmware string '%.*s' fault\n",
+                                len, dat);
+                goto failed;
+        }
+        /* ok, we had a header */
+        while (mem < end) {
+                ret = fw_parse(&mem, &type, &addr, &len, &dat);
+                if (ret)
+                        goto failed;
+
+                if (type == 3) {
+                        /* start address */
+                        start_addr = addr;
+                        type_entrypoint = 1;
+                        continue;
+                } else if (type == 1) {
+                        /* eof */
+                        type_end = 1;
+                        break;
+                } else if (type != 0) {
+                        dev_alert(&card->pdev->dev,
+                                        "unknown record type 0x%04x\n", type);
+                        ret = -EINVAL;
+                        goto failed;
+                }
+
+                /* regualar data */
+                for (sum = 0, j = 0; j < len; ++j)
+                        sum += dat[j];
+                /* work in 16bit (target) */
+                sum &= 0xffff;
+
+                memcpy_toio(&card->dpram[card->pdat->app.offs], dat, len);
+                iowrite32(card->pdat->app.offs + card->pdat->app.addr,
+                                &card->dpram[DPRAM_COMMAND + 2]);
+                iowrite32(addr, &card->dpram[DPRAM_COMMAND + 6]);
+                iowrite16(len, &card->dpram[DPRAM_COMMAND + 10]);
+                iowrite8(1, &card->dpram[DPRAM_COMMAND + 12]);
+                ret = softing_bootloader_command(card, 1, "loading app.");
+                if (ret < 0)
+                        goto failed;
+                /* verify checksum */
+                rx_sum = ioread16(&card->dpram[DPRAM_RECEIPT + 2]);
+                if (rx_sum != sum) {
+                        dev_alert(&card->pdev->dev, "SRAM seems to be damaged"
+                                ", wanted 0x%04x, got 0x%04x\n", sum, rx_sum);
+                        ret = -EIO;
+                        goto failed;
+                }
+        }
+        if (!type_end || !type_entrypoint)
+                goto failed;
+        /* start application in card */
+        iowrite32(start_addr, &card->dpram[DPRAM_COMMAND + 2]);
+        iowrite8(1, &card->dpram[DPRAM_COMMAND + 6]);
+        ret = softing_bootloader_command(card, 3, "start app.");
+        if (ret < 0)
+                goto failed;
+        ret = 0;
+failed:
+        release_firmware(fw);
+        if (ret < 0)
+                dev_info(&card->pdev->dev, "firmware %s failed\n", file);
+        return ret;
+}
+
+static int softing_reset_chip(struct softing *card)
+{
+        int ret;
+
+        do {
+                /* reset chip */
+                iowrite8(0, &card->dpram[DPRAM_RESET_RX_FIFO]);
+                iowrite8(0, &card->dpram[DPRAM_RESET_RX_FIFO+1]);
+                iowrite8(1, &card->dpram[DPRAM_RESET]);
+                iowrite8(0, &card->dpram[DPRAM_RESET+1]);
+
+                ret = softing_fct_cmd(card, 0, "reset_can");
+                if (!ret)
+                        break;
+                if (signal_pending(current))
+                        /* don't wait any longer */
+                        break;
+        } while (1);
+        card->tx.pending = 0;
+        return ret;
+}
+
+int softing_chip_poweron(struct softing *card)
+{
+        int ret;
+        /* sync */
+        ret = _softing_fct_cmd(card, 99, 0x55, "sync-a");
+        if (ret < 0)
+                goto failed;
+
+        ret = _softing_fct_cmd(card, 99, 0xaa, "sync-b");
+        if (ret < 0)
+                goto failed;
+
+        ret = softing_reset_chip(card);
+        if (ret < 0)
+                goto failed;
+        /* get_serial */
+        ret = softing_fct_cmd(card, 43, "get_serial_number");
+        if (ret < 0)
+                goto failed;
+        card->id.serial = ioread32(&card->dpram[DPRAM_FCT_PARAM]);
+        /* get_version */
+        ret = softing_fct_cmd(card, 12, "get_version");
+        if (ret < 0)
+                goto failed;
+        card->id.fw_version = ioread16(&card->dpram[DPRAM_FCT_PARAM + 2]);
+        card->id.hw_version = ioread16(&card->dpram[DPRAM_FCT_PARAM + 4]);
+        card->id.license = ioread16(&card->dpram[DPRAM_FCT_PARAM + 6]);
+        card->id.chip[0] = ioread16(&card->dpram[DPRAM_FCT_PARAM + 8]);
+        card->id.chip[1] = ioread16(&card->dpram[DPRAM_FCT_PARAM + 10]);
+        return 0;
+failed:
+        return ret;
+}
+
+static void softing_initialize_timestamp(struct softing *card)
+{
+        uint64_t ovf;
+
+        card->ts_ref = ktime_get();
+
+        /* 16MHz is the reference */
+        ovf = 0x100000000ULL * 16;
+        do_div(ovf, card->pdat->freq ?: 16);
+
+        card->ts_overflow = ktime_add_us(ktime_set(0, 0), ovf);
+}
+
+ktime_t softing_raw2ktime(struct softing *card, u32 raw)
+{
+        uint64_t rawl;
+        ktime_t now, real_offset;
+        ktime_t target;
+        ktime_t tmp;
+
+        now = ktime_get();
+        real_offset = ktime_sub(ktime_get_real(), now);
+
+        /* find nsec from card */
+        rawl = raw * 16;
+        do_div(rawl, card->pdat->freq ?: 16);
+        target = ktime_add_us(card->ts_ref, rawl);
+        /* test for overflows */
+        tmp = ktime_add(target, card->ts_overflow);
+        while (unlikely(ktime_to_ns(tmp) > ktime_to_ns(now))) {
+                card->ts_ref = ktime_add(card->ts_ref, card->ts_overflow);
+                target = tmp;
+                tmp = ktime_add(target, card->ts_overflow);
+        }
+        return ktime_add(target, real_offset);
+}
+
+static inline int softing_error_reporting(struct net_device *netdev)
+{
+        struct softing_priv *priv = netdev_priv(netdev);
+
+        return (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
+                ? 1 : 0;
+}
+
+int softing_startstop(struct net_device *dev, int up)
+{
+        int ret;
+        struct softing *card;
+        struct softing_priv *priv;
+        struct net_device *netdev;
+        int bus_bitmask_start;
+        int j, error_reporting;
+        struct can_frame msg;
+        const struct can_bittiming *bt;
+
+        priv = netdev_priv(dev);
+        card = priv->card;
+
+        if (!card->fw.up)
+                return -EIO;
+
+        ret = mutex_lock_interruptible(&card->fw.lock);
+        if (ret)
+                return ret;
+
+        bus_bitmask_start = 0;
+        if (dev && up)
+                /* prepare to start this bus as well */
+                bus_bitmask_start |= (1 << priv->index);
+        /* bring netdevs down */
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                netdev = card->net[j];
+                if (!netdev)
+                        continue;
+                priv = netdev_priv(netdev);
+
+                if (dev != netdev)
+                        netif_stop_queue(netdev);
+
+                if (netif_running(netdev)) {
+                        if (dev != netdev)
+                                bus_bitmask_start |= (1 << j);
+                        priv->tx.pending = 0;
+                        priv->tx.echo_put = 0;
+                        priv->tx.echo_get = 0;
+                        /*
+                         * this bus' may just have called open_candev()
+                         * which is rather stupid to call close_candev()
+                         * already
+                         * but we may come here from busoff recovery too
+                         * in which case the echo_skb _needs_ flushing too.
+                         * just be sure to call open_candev() again
+                         */
+                        close_candev(netdev);
+                }
+                priv->can.state = CAN_STATE_STOPPED;
+        }
+        card->tx.pending = 0;
+
+        softing_enable_irq(card, 0);
+        ret = softing_reset_chip(card);
+        if (ret)
+                goto failed;
+        if (!bus_bitmask_start)
+                /* no busses to be brought up */
+                goto card_done;
+
+        if ((bus_bitmask_start & 1) && (bus_bitmask_start & 2)
+                        && (softing_error_reporting(card->net[0])
+                                != softing_error_reporting(card->net[1]))) {
+                dev_alert(&card->pdev->dev,
+                                "err_reporting flag differs for busses\n");
+                goto invalid;
+        }
+        error_reporting = 0;
+        if (bus_bitmask_start & 1) {
+                netdev = card->net[0];
+                priv = netdev_priv(netdev);
+                error_reporting += softing_error_reporting(netdev);
+                /* init chip 1 */
+                bt = &priv->can.bittiming;
+                iowrite16(bt->brp, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(bt->sjw, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                iowrite16(bt->phase_seg1 + bt->prop_seg,
+                                &card->dpram[DPRAM_FCT_PARAM + 6]);
+                iowrite16(bt->phase_seg2, &card->dpram[DPRAM_FCT_PARAM + 8]);
+                iowrite16((priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES) ? 1 : 0,
+                                &card->dpram[DPRAM_FCT_PARAM + 10]);
+                ret = softing_fct_cmd(card, 1, "initialize_chip[0]");
+                if (ret < 0)
+                        goto failed;
+                /* set mode */
+                iowrite16(0, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(0, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                ret = softing_fct_cmd(card, 3, "set_mode[0]");
+                if (ret < 0)
+                        goto failed;
+                /* set filter */
+                /* 11bit id & mask */
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(0x07ff, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                /* 29bit id.lo & mask.lo & id.hi & mask.hi */
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 6]);
+                iowrite16(0xffff, &card->dpram[DPRAM_FCT_PARAM + 8]);
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 10]);
+                iowrite16(0x1fff, &card->dpram[DPRAM_FCT_PARAM + 12]);
+                ret = softing_fct_cmd(card, 7, "set_filter[0]");
+                if (ret < 0)
+                        goto failed;
+                /* set output control */
+                iowrite16(priv->output, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                ret = softing_fct_cmd(card, 5, "set_output[0]");
+                if (ret < 0)
+                        goto failed;
+        }
+        if (bus_bitmask_start & 2) {
+                netdev = card->net[1];
+                priv = netdev_priv(netdev);
+                error_reporting += softing_error_reporting(netdev);
+                /* init chip2 */
+                bt = &priv->can.bittiming;
+                iowrite16(bt->brp, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(bt->sjw, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                iowrite16(bt->phase_seg1 + bt->prop_seg,
+                                &card->dpram[DPRAM_FCT_PARAM + 6]);
+                iowrite16(bt->phase_seg2, &card->dpram[DPRAM_FCT_PARAM + 8]);
+                iowrite16((priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES) ? 1 : 0,
+                                &card->dpram[DPRAM_FCT_PARAM + 10]);
+                ret = softing_fct_cmd(card, 2, "initialize_chip[1]");
+                if (ret < 0)
+                        goto failed;
+                /* set mode2 */
+                iowrite16(0, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(0, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                ret = softing_fct_cmd(card, 4, "set_mode[1]");
+                if (ret < 0)
+                        goto failed;
+                /* set filter2 */
+                /* 11bit id & mask */
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(0x07ff, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                /* 29bit id.lo & mask.lo & id.hi & mask.hi */
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 6]);
+                iowrite16(0xffff, &card->dpram[DPRAM_FCT_PARAM + 8]);
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 10]);
+                iowrite16(0x1fff, &card->dpram[DPRAM_FCT_PARAM + 12]);
+                ret = softing_fct_cmd(card, 8, "set_filter[1]");
+                if (ret < 0)
+                        goto failed;
+                /* set output control2 */
+                iowrite16(priv->output, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                ret = softing_fct_cmd(card, 6, "set_output[1]");
+                if (ret < 0)
+                        goto failed;
+        }
+        /* enable_error_frame */
+        /*
+         * Error reporting is switched off at the moment since
+         * the receiving of them is not yet 100% verified
+         * This should be enabled sooner or later
+         *
+        if (error_reporting) {
+                ret = softing_fct_cmd(card, 51, "enable_error_frame");
+                if (ret < 0)
+                        goto failed;
+        }
+        */
+        /* initialize interface */
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 2]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 4]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 6]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 8]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 10]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 12]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 14]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 16]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 18]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 20]);
+        ret = softing_fct_cmd(card, 17, "initialize_interface");
+        if (ret < 0)
+                goto failed;
+        /* enable_fifo */
+        ret = softing_fct_cmd(card, 36, "enable_fifo");
+        if (ret < 0)
+                goto failed;
+        /* enable fifo tx ack */
+        ret = softing_fct_cmd(card, 13, "fifo_tx_ack[0]");
+        if (ret < 0)
+                goto failed;
+        /* enable fifo tx ack2 */
+        ret = softing_fct_cmd(card, 14, "fifo_tx_ack[1]");
+        if (ret < 0)
+                goto failed;
+        /* start_chip */
+        ret = softing_fct_cmd(card, 11, "start_chip");
+        if (ret < 0)
+                goto failed;
+        iowrite8(0, &card->dpram[DPRAM_INFO_BUSSTATE]);
+        iowrite8(0, &card->dpram[DPRAM_INFO_BUSSTATE2]);
+        if (card->pdat->generation < 2) {
+                iowrite8(0, &card->dpram[DPRAM_V2_IRQ_TOHOST]);
+                /* flush the DPRAM caches */
+                wmb();
+        }
+
+        softing_initialize_timestamp(card);
+
+        /*
+         * do socketcan notifications/status changes
+         * from here, no errors should occur, or the failed: part
+         * must be reviewed
+         */
+        memset(&msg, 0, sizeof(msg));
+        msg.can_id = CAN_ERR_FLAG | CAN_ERR_RESTARTED;
+        msg.can_dlc = CAN_ERR_DLC;
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                if (!(bus_bitmask_start & (1 << j)))
+                        continue;
+                netdev = card->net[j];
+                if (!netdev)
+                        continue;
+                priv = netdev_priv(netdev);
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+                open_candev(netdev);
+                if (dev != netdev) {
+                        /* notify other busses on the restart */
+                        softing_netdev_rx(netdev, &msg, ktime_set(0, 0));
+                        ++priv->can.can_stats.restarts;
+                }
+                netif_wake_queue(netdev);
+        }
+
+        /* enable interrupts */
+        ret = softing_enable_irq(card, 1);
+        if (ret)
+                goto failed;
+card_done:
+        mutex_unlock(&card->fw.lock);
+        return 0;
+invalid:
+        ret = -EINVAL;
+failed:
+        softing_enable_irq(card, 0);
+        softing_reset_chip(card);
+        mutex_unlock(&card->fw.lock);
+        /* bring all other interfaces down */
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                netdev = card->net[j];
+                if (!netdev)
+                        continue;
+                dev_close(netdev);
+        }
+        return ret;
+}
+
+int softing_default_output(struct net_device *netdev)
+{
+        struct softing_priv *priv = netdev_priv(netdev);
+        struct softing *card = priv->card;
+
+        switch (priv->chip) {
+        case 1000:
+                return (card->pdat->generation < 2) ? 0xfb : 0xfa;
+        case 5:
+                return 0x60;
+        default:
+                return 0x40;
+        }
+}
diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
new file mode 100644
index 00000000000..5157e15e96e
--- /dev/null
+++ b/drivers/net/can/softing/softing_main.c
@@ -0,0 +1,893 @@
+/*
+ * Copyright (C) 2008-2010
+ *
+ * - Kurt Van Dijck, EIA Electronics
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the version 2 of the GNU General Public License
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+
+#include "softing.h"
+
+#define TX_ECHO_SKB_MAX (((TXMAX+1)/2)-1)
+
+/*
+ * test is a specific CAN netdev
+ * is online (ie. up 'n running, not sleeping, not busoff
+ */
+static inline int canif_is_active(struct net_device *netdev)
+{
+        struct can_priv *can = netdev_priv(netdev);
+
+        if (!netif_running(netdev))
+                return 0;
+        return (can->state <= CAN_STATE_ERROR_PASSIVE);
+}
+
+/* reset DPRAM */
+static inline void softing_set_reset_dpram(struct softing *card)
+{
+        if (card->pdat->generation >= 2) {
+                spin_lock_bh(&card->spin);
+                iowrite8(ioread8(&card->dpram[DPRAM_V2_RESET]) & ~1,
+                                &card->dpram[DPRAM_V2_RESET]);
+                spin_unlock_bh(&card->spin);
+        }
+}
+
+static inline void softing_clr_reset_dpram(struct softing *card)
+{
+        if (card->pdat->generation >= 2) {
+                spin_lock_bh(&card->spin);
+                iowrite8(ioread8(&card->dpram[DPRAM_V2_RESET]) | 1,
+                                &card->dpram[DPRAM_V2_RESET]);
+                spin_unlock_bh(&card->spin);
+        }
+}
+
+/* trigger the tx queue-ing */
+static netdev_tx_t softing_netdev_start_xmit(struct sk_buff *skb,
+                struct net_device *dev)
+{
+        struct softing_priv *priv = netdev_priv(dev);
+        struct softing *card = priv->card;
+        int ret;
+        uint8_t *ptr;
+        uint8_t fifo_wr, fifo_rd;
+        struct can_frame *cf = (struct can_frame *)skb->data;
+        uint8_t buf[DPRAM_TX_SIZE];
+
+        if (can_dropped_invalid_skb(dev, skb))
+                return NETDEV_TX_OK;
+
+        spin_lock(&card->spin);
+
+        ret = NETDEV_TX_BUSY;
+        if (!card->fw.up ||
+                        (card->tx.pending >= TXMAX) ||
+                        (priv->tx.pending >= TX_ECHO_SKB_MAX))
+                goto xmit_done;
+        fifo_wr = ioread8(&card->dpram[DPRAM_TX_WR]);
+        fifo_rd = ioread8(&card->dpram[DPRAM_TX_RD]);
+        if (fifo_wr == fifo_rd)
+                /* fifo full */
+                goto xmit_done;
+        memset(buf, 0, sizeof(buf));
+        ptr = buf;
+        *ptr = CMD_TX;
+        if (cf->can_id & CAN_RTR_FLAG)
+                *ptr |= CMD_RTR;
+        if (cf->can_id & CAN_EFF_FLAG)
+                *ptr |= CMD_XTD;
+        if (priv->index)
+                *ptr |= CMD_BUS2;
+        ++ptr;
+        *ptr++ = cf->can_dlc;
+        *ptr++ = (cf->can_id >> 0);
+        *ptr++ = (cf->can_id >> 8);
+        if (cf->can_id & CAN_EFF_FLAG) {
+                *ptr++ = (cf->can_id >> 16);
+                *ptr++ = (cf->can_id >> 24);
+        } else {
+                /* increment 1, not 2 as you might think */
+                ptr += 1;
+        }
+        if (!(cf->can_id & CAN_RTR_FLAG))
+                memcpy(ptr, &cf->data[0], cf->can_dlc);
+        memcpy_toio(&card->dpram[DPRAM_TX + DPRAM_TX_SIZE * fifo_wr],
+                        buf, DPRAM_TX_SIZE);
+        if (++fifo_wr >= DPRAM_TX_CNT)
+                fifo_wr = 0;
+        iowrite8(fifo_wr, &card->dpram[DPRAM_TX_WR]);
+        card->tx.last_bus = priv->index;
+        ++card->tx.pending;
+        ++priv->tx.pending;
+        can_put_echo_skb(skb, dev, priv->tx.echo_put);
+        ++priv->tx.echo_put;
+        if (priv->tx.echo_put >= TX_ECHO_SKB_MAX)
+                priv->tx.echo_put = 0;
+        /* can_put_echo_skb() saves the skb, safe to return TX_OK */
+        ret = NETDEV_TX_OK;
+xmit_done:
+        spin_unlock(&card->spin);
+        if (card->tx.pending >= TXMAX) {
+                int j;
+                for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                        if (card->net[j])
+                                netif_stop_queue(card->net[j]);
+                }
+        }
+        if (ret != NETDEV_TX_OK)
+                netif_stop_queue(dev);
+
+        return ret;
+}
+
+/*
+ * shortcut for skb delivery
+ */
+int softing_netdev_rx(struct net_device *netdev, const struct can_frame *msg,
+                ktime_t ktime)
+{
+        struct sk_buff *skb;
+        struct can_frame *cf;
+
+        skb = alloc_can_skb(netdev, &cf);
+        if (!skb)
+                return -ENOMEM;
+        memcpy(cf, msg, sizeof(*msg));
+        skb->tstamp = ktime;
+        return netif_rx(skb);
+}
+
+/*
+ * softing_handle_1
+ * pop 1 entry from the DPRAM queue, and process
+ */
+static int softing_handle_1(struct softing *card)
+{
+        struct net_device *netdev;
+        struct softing_priv *priv;
+        ktime_t ktime;
+        struct can_frame msg;
+        int cnt = 0, lost_msg;
+        uint8_t fifo_rd, fifo_wr, cmd;
+        uint8_t *ptr;
+        uint32_t tmp_u32;
+        uint8_t buf[DPRAM_RX_SIZE];
+
+        memset(&msg, 0, sizeof(msg));
+        /* test for lost msgs */
+        lost_msg = ioread8(&card->dpram[DPRAM_RX_LOST]);
+        if (lost_msg) {
+                int j;
+                /* reset condition */
+                iowrite8(0, &card->dpram[DPRAM_RX_LOST]);
+                /* prepare msg */
+                msg.can_id = CAN_ERR_FLAG | CAN_ERR_CRTL;
+                msg.can_dlc = CAN_ERR_DLC;
+                msg.data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+                /*
+                 * service to all busses, we don't know which it was applicable
+                 * but only service busses that are online
+                 */
+                for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                        netdev = card->net[j];
+                        if (!netdev)
+                                continue;
+                        if (!canif_is_active(netdev))
+                                /* a dead bus has no overflows */
+                                continue;
+                        ++netdev->stats.rx_over_errors;
+                        softing_netdev_rx(netdev, &msg, ktime_set(0, 0));
+                }
+                /* prepare for other use */
+                memset(&msg, 0, sizeof(msg));
+                ++cnt;
+        }
+
+        fifo_rd = ioread8(&card->dpram[DPRAM_RX_RD]);
+        fifo_wr = ioread8(&card->dpram[DPRAM_RX_WR]);
+
+        if (++fifo_rd >= DPRAM_RX_CNT)
+                fifo_rd = 0;
+        if (fifo_wr == fifo_rd)
+                return cnt;
+
+        memcpy_fromio(buf, &card->dpram[DPRAM_RX + DPRAM_RX_SIZE*fifo_rd],
+                        DPRAM_RX_SIZE);
+        mb();
+        /* trigger dual port RAM */
+        iowrite8(fifo_rd, &card->dpram[DPRAM_RX_RD]);
+
+        ptr = buf;
+        cmd = *ptr++;
+        if (cmd == 0xff)
+                /* not quite usefull, probably the card has got out */
+                return 0;
+        netdev = card->net[0];
+        if (cmd & CMD_BUS2)
+                netdev = card->net[1];
+        priv = netdev_priv(netdev);
+
+        if (cmd & CMD_ERR) {
+                uint8_t can_state, state;
+
+                state = *ptr++;
+
+                msg.can_id = CAN_ERR_FLAG;
+                msg.can_dlc = CAN_ERR_DLC;
+
+                if (state & SF_MASK_BUSOFF) {
+                        can_state = CAN_STATE_BUS_OFF;
+                        msg.can_id |= CAN_ERR_BUSOFF;
+                        state = STATE_BUSOFF;
+                } else if (state & SF_MASK_EPASSIVE) {
+                        can_state = CAN_STATE_ERROR_PASSIVE;
+                        msg.can_id |= CAN_ERR_CRTL;
+                        msg.data[1] = CAN_ERR_CRTL_TX_PASSIVE;
+                        state = STATE_EPASSIVE;
+                } else {
+                        can_state = CAN_STATE_ERROR_ACTIVE;
+                        msg.can_id |= CAN_ERR_CRTL;
+                        state = STATE_EACTIVE;
+                }
+                /* update DPRAM */
+                iowrite8(state, &card->dpram[priv->index ?
+                                DPRAM_INFO_BUSSTATE2 : DPRAM_INFO_BUSSTATE]);
+                /* timestamp */
+                tmp_u32 = le32_to_cpup((void *)ptr);
+                ptr += 4;
+                ktime = softing_raw2ktime(card, tmp_u32);
+
+                ++netdev->stats.rx_errors;
+                /* update internal status */
+                if (can_state != priv->can.state) {
+                        priv->can.state = can_state;
+                        if (can_state == CAN_STATE_ERROR_PASSIVE)
+                                ++priv->can.can_stats.error_passive;
+                        else if (can_state == CAN_STATE_BUS_OFF) {
+                                /* this calls can_close_cleanup() */
+                                can_bus_off(netdev);
+                                netif_stop_queue(netdev);
+                        }
+                        /* trigger socketcan */
+                        softing_netdev_rx(netdev, &msg, ktime);
+                }
+
+        } else {
+                if (cmd & CMD_RTR)
+                        msg.can_id |= CAN_RTR_FLAG;
+                msg.can_dlc = get_can_dlc(*ptr++);
+                if (cmd & CMD_XTD) {
+                        msg.can_id |= CAN_EFF_FLAG;
+                        msg.can_id |= le32_to_cpup((void *)ptr);
+                        ptr += 4;
+                } else {
+                        msg.can_id |= le16_to_cpup((void *)ptr);
+                        ptr += 2;
+                }
+                /* timestamp */
+                tmp_u32 = le32_to_cpup((void *)ptr);
+                ptr += 4;
+                ktime = softing_raw2ktime(card, tmp_u32);
+                if (!(msg.can_id & CAN_RTR_FLAG))
+                        memcpy(&msg.data[0], ptr, 8);
+                ptr += 8;
+                /* update socket */
+                if (cmd & CMD_ACK) {
+                        /* acknowledge, was tx msg */
+                        struct sk_buff *skb;
+                        skb = priv->can.echo_skb[priv->tx.echo_get];
+                        if (skb)
+                                skb->tstamp = ktime;
+                        can_get_echo_skb(netdev, priv->tx.echo_get);
+                        ++priv->tx.echo_get;
+                        if (priv->tx.echo_get >= TX_ECHO_SKB_MAX)
+                                priv->tx.echo_get = 0;
+                        if (priv->tx.pending)
+                                --priv->tx.pending;
+                        if (card->tx.pending)
+                                --card->tx.pending;
+                        ++netdev->stats.tx_packets;
+                        if (!(msg.can_id & CAN_RTR_FLAG))
+                                netdev->stats.tx_bytes += msg.can_dlc;
+                } else {
+                        int ret;
+
+                        ret = softing_netdev_rx(netdev, &msg, ktime);
+                        if (ret == NET_RX_SUCCESS) {
+                                ++netdev->stats.rx_packets;
+                                if (!(msg.can_id & CAN_RTR_FLAG))
+                                        netdev->stats.rx_bytes += msg.can_dlc;
+                        } else {
+                                ++netdev->stats.rx_dropped;
+                        }
+                }
+        }
+        ++cnt;
+        return cnt;
+}
+
+/*
+ * real interrupt handler
+ */
+static irqreturn_t softing_irq_thread(int irq, void *dev_id)
+{
+        struct softing *card = (struct softing *)dev_id;
+        struct net_device *netdev;
+        struct softing_priv *priv;
+        int j, offset, work_done;
+
+        work_done = 0;
+        spin_lock_bh(&card->spin);
+        while (softing_handle_1(card) > 0) {
+                ++card->irq.svc_count;
+                ++work_done;
+        }
+        spin_unlock_bh(&card->spin);
+        /* resume tx queue's */
+        offset = card->tx.last_bus;
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                if (card->tx.pending >= TXMAX)
+                        break;
+                netdev = card->net[(j + offset + 1) % card->pdat->nbus];
+                if (!netdev)
+                        continue;
+                priv = netdev_priv(netdev);
+                if (!canif_is_active(netdev))
+                        /* it makes no sense to wake dead busses */
+                        continue;
+                if (priv->tx.pending >= TX_ECHO_SKB_MAX)
+                        continue;
+                ++work_done;
+                netif_wake_queue(netdev);
+        }
+        return work_done ? IRQ_HANDLED : IRQ_NONE;
+}
+
+/*
+ * interrupt routines:
+ * schedule the 'real interrupt handler'
+ */
+static irqreturn_t softing_irq_v2(int irq, void *dev_id)
+{
+        struct softing *card = (struct softing *)dev_id;
+        uint8_t ir;
+
+        ir = ioread8(&card->dpram[DPRAM_V2_IRQ_TOHOST]);
+        iowrite8(0, &card->dpram[DPRAM_V2_IRQ_TOHOST]);
+        return (1 == ir) ? IRQ_WAKE_THREAD : IRQ_NONE;
+}
+
+static irqreturn_t softing_irq_v1(int irq, void *dev_id)
+{
+        struct softing *card = (struct softing *)dev_id;
+        uint8_t ir;
+
+        ir = ioread8(&card->dpram[DPRAM_IRQ_TOHOST]);
+        iowrite8(0, &card->dpram[DPRAM_IRQ_TOHOST]);
+        return ir ? IRQ_WAKE_THREAD : IRQ_NONE;
+}
+
+/*
+ * netdev/candev inter-operability
+ */
+static int softing_netdev_open(struct net_device *ndev)
+{
+        int ret;
+
+        /* check or determine and set bittime */
+        ret = open_candev(ndev);
+        if (!ret)
+                ret = softing_startstop(ndev, 1);
+        return ret;
+}
+
+static int softing_netdev_stop(struct net_device *ndev)
+{
+        int ret;
+
+        netif_stop_queue(ndev);
+
+        /* softing cycle does close_candev() */
+        ret = softing_startstop(ndev, 0);
+        return ret;
+}
+
+static int softing_candev_set_mode(struct net_device *ndev, enum can_mode mode)
+{
+        int ret;
+
+        switch (mode) {
+        case CAN_MODE_START:
+                /* softing_startstop does close_candev() */
+                ret = softing_startstop(ndev, 1);
+                return ret;
+        case CAN_MODE_STOP:
+        case CAN_MODE_SLEEP:
+                return -EOPNOTSUPP;
+        }
+        return 0;
+}
+
+/*
+ * Softing device management helpers
+ */
+int softing_enable_irq(struct softing *card, int enable)
+{
+        int ret;
+
+        if (!card->irq.nr) {
+                return 0;
+        } else if (card->irq.requested && !enable) {
+                free_irq(card->irq.nr, card);
+                card->irq.requested = 0;
+        } else if (!card->irq.requested && enable) {
+                ret = request_threaded_irq(card->irq.nr,
+                                (card->pdat->generation >= 2) ?
+                                        softing_irq_v2 : softing_irq_v1,
+                                softing_irq_thread, IRQF_SHARED,
+                                dev_name(&card->pdev->dev), card);
+                if (ret) {
+                        dev_alert(&card->pdev->dev,
+                                        "request_threaded_irq(%u) failed\n",
+                                        card->irq.nr);
+                        return ret;
+                }
+                card->irq.requested = 1;
+        }
+        return 0;
+}
+
+static void softing_card_shutdown(struct softing *card)
+{
+        int fw_up = 0;
+
+        if (mutex_lock_interruptible(&card->fw.lock))
+                /* return -ERESTARTSYS */;
+        fw_up = card->fw.up;
+        card->fw.up = 0;
+
+        if (card->irq.requested && card->irq.nr) {
+                free_irq(card->irq.nr, card);
+                card->irq.requested = 0;
+        }
+        if (fw_up) {
+                if (card->pdat->enable_irq)
+                        card->pdat->enable_irq(card->pdev, 0);
+                softing_set_reset_dpram(card);
+                if (card->pdat->reset)
+                        card->pdat->reset(card->pdev, 1);
+        }
+        mutex_unlock(&card->fw.lock);
+}
+
+static __devinit int softing_card_boot(struct softing *card)
+{
+        int ret, j;
+        static const uint8_t stream[] = {
+                0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, };
+        unsigned char back[sizeof(stream)];
+
+        if (mutex_lock_interruptible(&card->fw.lock))
+                return -ERESTARTSYS;
+        if (card->fw.up) {
+                mutex_unlock(&card->fw.lock);
+                return 0;
+        }
+        /* reset board */
+        if (card->pdat->enable_irq)
+                card->pdat->enable_irq(card->pdev, 1);
+        /* boot card */
+        softing_set_reset_dpram(card);
+        if (card->pdat->reset)
+                card->pdat->reset(card->pdev, 1);
+        for (j = 0; (j + sizeof(stream)) < card->dpram_size;
+                        j += sizeof(stream)) {
+
+                memcpy_toio(&card->dpram[j], stream, sizeof(stream));
+                /* flush IO cache */
+                mb();
+                memcpy_fromio(back, &card->dpram[j], sizeof(stream));
+
+                if (!memcmp(back, stream, sizeof(stream)))
+                        continue;
+                /* memory is not equal */
+                dev_alert(&card->pdev->dev, "dpram failed at 0x%04x\n", j);
+                ret = -EIO;
+                goto failed;
+        }
+        wmb();
+        /* load boot firmware */
+        ret = softing_load_fw(card->pdat->boot.fw, card, card->dpram,
+                                card->dpram_size,
+                                card->pdat->boot.offs - card->pdat->boot.addr);
+        if (ret < 0)
+                goto failed;
+        /* load loader firmware */
+        ret = softing_load_fw(card->pdat->load.fw, card, card->dpram,
+                                card->dpram_size,
+                                card->pdat->load.offs - card->pdat->load.addr);
+        if (ret < 0)
+                goto failed;
+
+        if (card->pdat->reset)
+                card->pdat->reset(card->pdev, 0);
+        softing_clr_reset_dpram(card);
+        ret = softing_bootloader_command(card, 0, "card boot");
+        if (ret < 0)
+                goto failed;
+        ret = softing_load_app_fw(card->pdat->app.fw, card);
+        if (ret < 0)
+                goto failed;
+
+        ret = softing_chip_poweron(card);
+        if (ret < 0)
+                goto failed;
+
+        card->fw.up = 1;
+        mutex_unlock(&card->fw.lock);
+        return 0;
+failed:
+        card->fw.up = 0;
+        if (card->pdat->enable_irq)
+                card->pdat->enable_irq(card->pdev, 0);
+        softing_set_reset_dpram(card);
+        if (card->pdat->reset)
+                card->pdat->reset(card->pdev, 1);
+        mutex_unlock(&card->fw.lock);
+        return ret;
+}
+
+/*
+ * netdev sysfs
+ */
+static ssize_t show_channel(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct softing_priv *priv = netdev2softing(ndev);
+
+        return sprintf(buf, "%i\n", priv->index);
+}
+
+static ssize_t show_chip(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct softing_priv *priv = netdev2softing(ndev);
+
+        return sprintf(buf, "%i\n", priv->chip);
+}
+
+static ssize_t show_output(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct softing_priv *priv = netdev2softing(ndev);
+
+        return sprintf(buf, "0x%02x\n", priv->output);
+}
+
+static ssize_t store_output(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t count)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct softing_priv *priv = netdev2softing(ndev);
+        struct softing *card = priv->card;
+        unsigned long val;
+        int ret;
+
+        ret = strict_strtoul(buf, 0, &val);
+        if (ret < 0)
+                return ret;
+        val &= 0xFF;
+
+        ret = mutex_lock_interruptible(&card->fw.lock);
+        if (ret)
+                return -ERESTARTSYS;
+        if (netif_running(ndev)) {
+                mutex_unlock(&card->fw.lock);
+                return -EBUSY;
+        }
+        priv->output = val;
+        mutex_unlock(&card->fw.lock);
+        return count;
+}
+
+static const DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
+static const DEVICE_ATTR(chip, S_IRUGO, show_chip, NULL);
+static const DEVICE_ATTR(output, S_IRUGO | S_IWUSR, show_output, store_output);
+
+static const struct attribute *const netdev_sysfs_attrs[] = {
+        &dev_attr_channel.attr,
+        &dev_attr_chip.attr,
+        &dev_attr_output.attr,
+        NULL,
+};
+static const struct attribute_group netdev_sysfs_group = {
+        .name = NULL,
+        .attrs = (struct attribute **)netdev_sysfs_attrs,
+};
+
+static const struct net_device_ops softing_netdev_ops = {
+        .ndo_open = softing_netdev_open,
+        .ndo_stop = softing_netdev_stop,
+        .ndo_start_xmit = softing_netdev_start_xmit,
+};
+
+static const struct can_bittiming_const softing_btr_const = {
+        .tseg1_min = 1,
+        .tseg1_max = 16,
+        .tseg2_min = 1,
+        .tseg2_max = 8,
+        .sjw_max = 4, /* overruled */
+        .brp_min = 1,
+        .brp_max = 32, /* overruled */
+        .brp_inc = 1,
+};
+
+
+static __devinit struct net_device *softing_netdev_create(struct softing *card,
+                uint16_t chip_id)
+{
+        struct net_device *netdev;
+        struct softing_priv *priv;
+
+        netdev = alloc_candev(sizeof(*priv), TX_ECHO_SKB_MAX);
+        if (!netdev) {
+                dev_alert(&card->pdev->dev, "alloc_candev failed\n");
+                return NULL;
+        }
+        priv = netdev_priv(netdev);
+        priv->netdev = netdev;
+        priv->card = card;
+        memcpy(&priv->btr_const, &softing_btr_const, sizeof(priv->btr_const));
+        priv->btr_const.brp_max = card->pdat->max_brp;
+        priv->btr_const.sjw_max = card->pdat->max_sjw;
+        priv->can.bittiming_const = &priv->btr_const;
+        priv->can.clock.freq = 8000000;
+        priv->chip = chip_id;
+        priv->output = softing_default_output(netdev);
+        SET_NETDEV_DEV(netdev, &card->pdev->dev);
+
+        netdev->flags |= IFF_ECHO;
+        netdev->netdev_ops = &softing_netdev_ops;
+        priv->can.do_set_mode = softing_candev_set_mode;
+        priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES;
+
+        return netdev;
+}
+
+static __devinit int softing_netdev_register(struct net_device *netdev)
+{
+        int ret;
+
+        netdev->sysfs_groups[0] = &netdev_sysfs_group;
+        ret = register_candev(netdev);
+        if (ret) {
+                dev_alert(&netdev->dev, "register failed\n");
+                return ret;
+        }
+        return 0;
+}
+
+static void softing_netdev_cleanup(struct net_device *netdev)
+{
+        unregister_candev(netdev);
+        free_candev(netdev);
+}
+
+/*
+ * sysfs for Platform device
+ */
+#define DEV_ATTR_RO(name, member) \
+static ssize_t show_##name(struct device *dev, \
+                struct device_attribute *attr, char *buf) \
+{ \
+        struct softing *card = platform_get_drvdata(to_platform_device(dev)); \
+        return sprintf(buf, "%u\n", card->member); \
+} \
+static DEVICE_ATTR(name, 0444, show_##name, NULL)
+
+#define DEV_ATTR_RO_STR(name, member) \
+static ssize_t show_##name(struct device *dev, \
+                struct device_attribute *attr, char *buf) \
+{ \
+        struct softing *card = platform_get_drvdata(to_platform_device(dev)); \
+        return sprintf(buf, "%s\n", card->member); \
+} \
+static DEVICE_ATTR(name, 0444, show_##name, NULL)
+
+DEV_ATTR_RO(serial, id.serial);
+DEV_ATTR_RO_STR(firmware, pdat->app.fw);
+DEV_ATTR_RO(firmware_version, id.fw_version);
+DEV_ATTR_RO_STR(hardware, pdat->name);
+DEV_ATTR_RO(hardware_version, id.hw_version);
+DEV_ATTR_RO(license, id.license);
+DEV_ATTR_RO(frequency, id.freq);
+DEV_ATTR_RO(txpending, tx.pending);
+
+static struct attribute *softing_pdev_attrs[] = {
+        &dev_attr_serial.attr,
+        &dev_attr_firmware.attr,
+        &dev_attr_firmware_version.attr,
+        &dev_attr_hardware.attr,
+        &dev_attr_hardware_version.attr,
+        &dev_attr_license.attr,
+        &dev_attr_frequency.attr,
+        &dev_attr_txpending.attr,
+        NULL,
+};
+
+static const struct attribute_group softing_pdev_group = {
+        .name = NULL,
+        .attrs = softing_pdev_attrs,
+};
+
+/*
+ * platform driver
+ */
+static __devexit int softing_pdev_remove(struct platform_device *pdev)
+{
+        struct softing *card = platform_get_drvdata(pdev);
+        int j;
+
+        /* first, disable card*/
+        softing_card_shutdown(card);
+
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                if (!card->net[j])
+                        continue;
+                softing_netdev_cleanup(card->net[j]);
+                card->net[j] = NULL;
+        }
+        sysfs_remove_group(&pdev->dev.kobj, &softing_pdev_group);
+
+        iounmap(card->dpram);
+        kfree(card);
+        return 0;
+}
+
+static __devinit int softing_pdev_probe(struct platform_device *pdev)
+{
+        const struct softing_platform_data *pdat = pdev->dev.platform_data;
+        struct softing *card;
+        struct net_device *netdev;
+        struct softing_priv *priv;
+        struct resource *pres;
+        int ret;
+        int j;
+
+        if (!pdat) {
+                dev_warn(&pdev->dev, "no platform data\n");
+                return -EINVAL;
+        }
+        if (pdat->nbus > ARRAY_SIZE(card->net)) {
+                dev_warn(&pdev->dev, "%u nets??\n", pdat->nbus);
+                return -EINVAL;
+        }
+
+        card = kzalloc(sizeof(*card), GFP_KERNEL);
+        if (!card)
+                return -ENOMEM;
+        card->pdat = pdat;
+        card->pdev = pdev;
+        platform_set_drvdata(pdev, card);
+        mutex_init(&card->fw.lock);
+        spin_lock_init(&card->spin);
+
+        ret = -EINVAL;
+        pres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!pres)
+                goto platform_resource_failed;;
+        card->dpram_phys = pres->start;
+        card->dpram_size = pres->end - pres->start + 1;
+        card->dpram = ioremap_nocache(card->dpram_phys, card->dpram_size);
+        if (!card->dpram) {
+                dev_alert(&card->pdev->dev, "dpram ioremap failed\n");
+                goto ioremap_failed;
+        }
+
+        pres = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (pres)
+                card->irq.nr = pres->start;
+
+        /* reset card */
+        ret = softing_card_boot(card);
+        if (ret < 0) {
+                dev_alert(&pdev->dev, "failed to boot\n");
+                goto boot_failed;
+        }
+
+        /* only now, the chip's are known */
+        card->id.freq = card->pdat->freq;
+
+        ret = sysfs_create_group(&pdev->dev.kobj, &softing_pdev_group);
+        if (ret < 0) {
+                dev_alert(&card->pdev->dev, "sysfs failed\n");
+                goto sysfs_failed;
+        }
+
+        ret = -ENOMEM;
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                card->net[j] = netdev =
+                        softing_netdev_create(card, card->id.chip[j]);
+                if (!netdev) {
+                        dev_alert(&pdev->dev, "failed to make can[%i]", j);
+                        goto netdev_failed;
+                }
+                priv = netdev_priv(card->net[j]);
+                priv->index = j;
+                ret = softing_netdev_register(netdev);
+                if (ret) {
+                        free_candev(netdev);
+                        card->net[j] = NULL;
+                        dev_alert(&card->pdev->dev,
+                                        "failed to register can[%i]\n", j);
+                        goto netdev_failed;
+                }
+        }
+        dev_info(&card->pdev->dev, "%s ready.\n", card->pdat->name);
+        return 0;
+
+netdev_failed:
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                if (!card->net[j])
+                        continue;
+                softing_netdev_cleanup(card->net[j]);
+        }
+        sysfs_remove_group(&pdev->dev.kobj, &softing_pdev_group);
+sysfs_failed:
+        softing_card_shutdown(card);
+boot_failed:
+        iounmap(card->dpram);
+ioremap_failed:
+platform_resource_failed:
+        kfree(card);
+        return ret;
+}
+
+static struct platform_driver softing_driver = {
+        .driver = {
+                .name = "softing",
+                .owner = THIS_MODULE,
+        },
+        .probe = softing_pdev_probe,
+        .remove = __devexit_p(softing_pdev_remove),
+};
+
+MODULE_ALIAS("platform:softing");
+
+static int __init softing_start(void)
+{
+        return platform_driver_register(&softing_driver);
+}
+
+static void __exit softing_stop(void)
+{
+        platform_driver_unregister(&softing_driver);
+}
+
+module_init(softing_start);
+module_exit(softing_stop);
+
+MODULE_DESCRIPTION("Softing DPRAM CAN driver");
+MODULE_AUTHOR("Kurt Van Dijck <kurt.van.dijck@eia.be>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/can/softing/softing_platform.h b/drivers/net/can/softing/softing_platform.h
new file mode 100644
index 00000000000..ebbf6981562
--- /dev/null
+++ b/drivers/net/can/softing/softing_platform.h
@@ -0,0 +1,40 @@
+
+#include <linux/platform_device.h>
+
+#ifndef _SOFTING_DEVICE_H_
+#define _SOFTING_DEVICE_H_
+
+/* softing firmware directory prefix */
+#define fw_dir "softing-4.6/"
+
+struct softing_platform_data {
+        unsigned int manf;
+        unsigned int prod;
+        /*
+         * generation
+         * 1st with NEC or SJA1000
+         * 8bit, exclusive interrupt, ...
+         * 2nd only SJA1000
+         * 16bit, shared interrupt
+         */
+        int generation;
+        int nbus; /* # busses on device */
+        unsigned int freq; /* operating frequency in Hz */
+        unsigned int max_brp;
+        unsigned int max_sjw;
+        unsigned long dpram_size;
+        const char *name;
+        struct {
+                unsigned long offs;
+                unsigned long addr;
+                const char *fw;
+        } boot, load, app;
+        /*
+         * reset() function
+         * bring pdev in or out of reset, depending on value
+         */
+        int (*reset)(struct platform_device *pdev, int value);
+        int (*enable_irq)(struct platform_device *pdev, int value);
+};
+
+#endif
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 263a2944566..7ff170cbc7d 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -699,13 +699,13 @@ static void cnic_free_dma(struct cnic_dev *dev, struct cnic_dma *dma)
 static void cnic_setup_page_tbl(struct cnic_dev *dev, struct cnic_dma *dma)
 {
         int i;
-        u32 *page_table = dma->pgtbl;
+        __le32 *page_table = (__le32 *) dma->pgtbl;
 
         for (i = 0; i < dma->num_pages; i++) {
                 /* Each entry needs to be in big endian format. */
-                *page_table = (u32) ((u64) dma->pg_map_arr[i] >> 32);
+                *page_table = cpu_to_le32((u64) dma->pg_map_arr[i] >> 32);
                 page_table++;
-                *page_table = (u32) dma->pg_map_arr[i];
+                *page_table = cpu_to_le32(dma->pg_map_arr[i] & 0xffffffff);
                 page_table++;
         }
 }
@@ -713,13 +713,13 @@ static void cnic_setup_page_tbl(struct cnic_dev *dev, struct cnic_dma *dma)
 static void cnic_setup_page_tbl_le(struct cnic_dev *dev, struct cnic_dma *dma)
 {
         int i;
-        u32 *page_table = dma->pgtbl;
+        __le32 *page_table = (__le32 *) dma->pgtbl;
 
         for (i = 0; i < dma->num_pages; i++) {
                 /* Each entry needs to be in little endian format. */
-                *page_table = dma->pg_map_arr[i] & 0xffffffff;
+                *page_table = cpu_to_le32(dma->pg_map_arr[i] & 0xffffffff);
                 page_table++;
-                *page_table = (u32) ((u64) dma->pg_map_arr[i] >> 32);
+                *page_table = cpu_to_le32((u64) dma->pg_map_arr[i] >> 32);
                 page_table++;
         }
 }
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index 059c1eec8c3..ec35d458102 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -2710,6 +2710,8 @@ static int cxgb_open(struct net_device *dev)
         struct port_info *pi = netdev_priv(dev);
         struct adapter *adapter = pi->adapter;
 
+        netif_carrier_off(dev);
+
         if (!(adapter->flags & FULL_INIT_DONE)) {
                 err = cxgb_up(adapter);
                 if (err < 0)
@@ -3661,7 +3663,6 @@ static int __devinit init_one(struct pci_dev *pdev,
                 pi->xact_addr_filt = -1;
                 pi->rx_offload = RX_CSO;
                 pi->port_id = i;
-                netif_carrier_off(netdev);
                 netdev->irq = pdev->irq;
 
                 netdev->features |= NETIF_F_SG | TSO_FLAGS;
diff --git a/drivers/net/depca.c b/drivers/net/depca.c
index 1b48b68ad4f..8b0084d17c8 100644
--- a/drivers/net/depca.c
+++ b/drivers/net/depca.c
@@ -1094,7 +1094,7 @@ static int depca_rx(struct net_device *dev)
                                 }
                         }
                         /* Change buffer ownership for this last frame, back to the adapter */
-                        for (; lp->rx_old != entry; lp->rx_old = (++lp->rx_old) & lp->rxRingMask) {
+                        for (; lp->rx_old != entry; lp->rx_old = (lp->rx_old + 1) & lp->rxRingMask) {
                                 writel(readl(&lp->rx_ring[lp->rx_old].base) | R_OWN, &lp->rx_ring[lp->rx_old].base);
                         }
                         writel(readl(&lp->rx_ring[entry].base) | R_OWN, &lp->rx_ring[entry].base);
@@ -1103,7 +1103,7 @@ static int depca_rx(struct net_device *dev)
                 /*
                    ** Update entry information
                  */
-                lp->rx_new = (++lp->rx_new) & lp->rxRingMask;
+                lp->rx_new = (lp->rx_new + 1) & lp->rxRingMask;
         }
 
         return 0;
@@ -1148,7 +1148,7 @@ static int depca_tx(struct net_device *dev)
                 }
 
                 /* Update all the pointers */
-                lp->tx_old = (++lp->tx_old) & lp->txRingMask;
+                lp->tx_old = (lp->tx_old + 1) & lp->txRingMask;
         }
 
         return 0;
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index e1a8216ff69..c05db604605 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -1753,8 +1753,6 @@ rio_close (struct net_device *dev)
 
         /* Free all the skbuffs in the queue. */
         for (i = 0; i < RX_RING_SIZE; i++) {
-                np->rx_ring[i].status = 0;
-                np->rx_ring[i].fraginfo = 0;
                 skb = np->rx_skbuff[i];
                 if (skb) {
                         pci_unmap_single(np->pdev,
@@ -1763,6 +1761,8 @@ rio_close (struct net_device *dev)
                         dev_kfree_skb (skb);
                         np->rx_skbuff[i] = NULL;
                 }
+                np->rx_ring[i].status = 0;
+                np->rx_ring[i].fraginfo = 0;
         }
         for (i = 0; i < TX_RING_SIZE; i++) {
                 skb = np->tx_skbuff[i];
diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c
index 112c5aa9af7..907b05a1c65 100644
--- a/drivers/net/enc28j60.c
+++ b/drivers/net/enc28j60.c
@@ -812,7 +812,7 @@ static void enc28j60_read_tsv(struct enc28j60_net *priv, u8 tsv[TSV_SIZE])
         if (netif_msg_hw(priv))
                 printk(KERN_DEBUG DRV_NAME ": reading TSV at addr:0x%04x\n",
                          endptr + 1);
-        enc28j60_mem_read(priv, endptr + 1, sizeof(tsv), tsv);
+        enc28j60_mem_read(priv, endptr + 1, TSV_SIZE, tsv);
 }
 
 static void enc28j60_dump_tsv(struct enc28j60_net *priv, const char *msg,
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 119aa2000c2..5ed8f9f9419 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1920,7 +1920,7 @@ int startup_gfar(struct net_device *ndev)
                 if (err) {
                         for (j = 0; j < i; j++)
                                 free_grp_irqs(&priv->gfargrp[j]);
-                                goto irq_fail;
+                        goto irq_fail;
                 }
         }
 
diff --git a/drivers/net/irda/sh_irda.c b/drivers/net/irda/sh_irda.c
index 9e3f4f54281..4488bd581ec 100644
--- a/drivers/net/irda/sh_irda.c
+++ b/drivers/net/irda/sh_irda.c
@@ -635,7 +635,7 @@ static int sh_irda_hard_xmit(struct sk_buff *skb, struct net_device *ndev)
 
         ret = sh_irda_set_baudrate(self, speed);
         if (ret < 0)
-                return ret;
+                goto sh_irda_hard_xmit_end;
 
         self->tx_buff.len = 0;
         if (skb->len) {
@@ -652,11 +652,21 @@ static int sh_irda_hard_xmit(struct sk_buff *skb, struct net_device *ndev)
 
                 sh_irda_write(self, IRTFLR, self->tx_buff.len);
                 sh_irda_write(self, IRTCTR, ARMOD | TE);
-        }
+        } else
+                goto sh_irda_hard_xmit_end;
 
         dev_kfree_skb(skb);
 
         return 0;
+
+sh_irda_hard_xmit_end:
+        sh_irda_set_baudrate(self, 9600);
+        netif_wake_queue(self->ndev);
+        sh_irda_rcv_ctrl(self, 1);
+        dev_kfree_skb(skb);
+
+        return ret;
+
 }
 
 static int sh_irda_ioctl(struct net_device *ndev, struct ifreq *ifreq, int cmd)
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 4ffdc18fcb8..2765a3ce9c2 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -1286,6 +1286,21 @@ static DEFINE_PCI_DEVICE_TABLE(mlx4_pci_table) = {
         { PCI_VDEVICE(MELLANOX, 0x6764) }, /* MT26468 ConnectX EN 10GigE PCIe gen2*/
         { PCI_VDEVICE(MELLANOX, 0x6746) }, /* MT26438 ConnectX EN 40GigE PCIe gen2 5GT/s */
         { PCI_VDEVICE(MELLANOX, 0x676e) }, /* MT26478 ConnectX2 40GigE PCIe gen2 */
+        { PCI_VDEVICE(MELLANOX, 0x1002) }, /* MT25400 Family [ConnectX-2 Virtual Function] */
+        { PCI_VDEVICE(MELLANOX, 0x1003) }, /* MT27500 Family [ConnectX-3] */
+        { PCI_VDEVICE(MELLANOX, 0x1004) }, /* MT27500 Family [ConnectX-3 Virtual Function] */
+        { PCI_VDEVICE(MELLANOX, 0x1005) }, /* MT27510 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1006) }, /* MT27511 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1007) }, /* MT27520 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1008) }, /* MT27521 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1009) }, /* MT27530 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100a) }, /* MT27531 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100b) }, /* MT27540 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100c) }, /* MT27541 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100d) }, /* MT27550 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100e) }, /* MT27551 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100f) }, /* MT27560 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1010) }, /* MT27561 Family */
         { 0, }
 };
 
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index 2541321bad8..9fb59d3f9c9 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -4489,6 +4489,9 @@ static int niu_alloc_channels(struct niu *np)
 {
         struct niu_parent *parent = np->parent;
         int first_rx_channel, first_tx_channel;
+        int num_rx_rings, num_tx_rings;
+        struct rx_ring_info *rx_rings;
+        struct tx_ring_info *tx_rings;
         int i, port, err;
 
         port = np->port;
@@ -4498,18 +4501,21 @@ static int niu_alloc_channels(struct niu *np)
                 first_tx_channel += parent->txchan_per_port[i];
         }
 
-        np->num_rx_rings = parent->rxchan_per_port[port];
-        np->num_tx_rings = parent->txchan_per_port[port];
+        num_rx_rings = parent->rxchan_per_port[port];
+        num_tx_rings = parent->txchan_per_port[port];
 
-        netif_set_real_num_rx_queues(np->dev, np->num_rx_rings);
-        netif_set_real_num_tx_queues(np->dev, np->num_tx_rings);
-
-        np->rx_rings = kcalloc(np->num_rx_rings, sizeof(struct rx_ring_info),
-                               GFP_KERNEL);
+        rx_rings = kcalloc(num_rx_rings, sizeof(struct rx_ring_info),
+                           GFP_KERNEL);
         err = -ENOMEM;
-        if (!np->rx_rings)
+        if (!rx_rings)
                 goto out_err;
 
+        np->num_rx_rings = num_rx_rings;
+        smp_wmb();
+        np->rx_rings = rx_rings;
+
+        netif_set_real_num_rx_queues(np->dev, num_rx_rings);
+
         for (i = 0; i < np->num_rx_rings; i++) {
                 struct rx_ring_info *rp = &np->rx_rings[i];
 
@@ -4538,12 +4544,18 @@ static int niu_alloc_channels(struct niu *np)
                         return err;
         }
 
-        np->tx_rings = kcalloc(np->num_tx_rings, sizeof(struct tx_ring_info),
-                               GFP_KERNEL);
+        tx_rings = kcalloc(num_tx_rings, sizeof(struct tx_ring_info),
+                           GFP_KERNEL);
         err = -ENOMEM;
-        if (!np->tx_rings)
+        if (!tx_rings)
                 goto out_err;
 
+        np->num_tx_rings = num_tx_rings;
+        smp_wmb();
+        np->tx_rings = tx_rings;
+
+        netif_set_real_num_tx_queues(np->dev, num_tx_rings);
+
         for (i = 0; i < np->num_tx_rings; i++) {
                 struct tx_ring_info *rp = &np->tx_rings[i];
 
@@ -6246,11 +6258,17 @@ static void niu_sync_mac_stats(struct niu *np)
 static void niu_get_rx_stats(struct niu *np)
 {
         unsigned long pkts, dropped, errors, bytes;
+        struct rx_ring_info *rx_rings;
         int i;
 
         pkts = dropped = errors = bytes = 0;
+
+        rx_rings = ACCESS_ONCE(np->rx_rings);
+        if (!rx_rings)
+                goto no_rings;
+
         for (i = 0; i < np->num_rx_rings; i++) {
-                struct rx_ring_info *rp = &np->rx_rings[i];
+                struct rx_ring_info *rp = &rx_rings[i];
 
                 niu_sync_rx_discard_stats(np, rp, 0);
 
@@ -6259,6 +6277,8 @@ static void niu_get_rx_stats(struct niu *np)
                 dropped += rp->rx_dropped;
                 errors += rp->rx_errors;
         }
+
+no_rings:
         np->dev->stats.rx_packets = pkts;
         np->dev->stats.rx_bytes = bytes;
         np->dev->stats.rx_dropped = dropped;
@@ -6268,16 +6288,24 @@ static void niu_get_rx_stats(struct niu *np)
 static void niu_get_tx_stats(struct niu *np)
 {
         unsigned long pkts, errors, bytes;
+        struct tx_ring_info *tx_rings;
         int i;
 
         pkts = errors = bytes = 0;
+
+        tx_rings = ACCESS_ONCE(np->tx_rings);
+        if (!tx_rings)
+                goto no_rings;
+
         for (i = 0; i < np->num_tx_rings; i++) {
-                struct tx_ring_info *rp = &np->tx_rings[i];
+                struct tx_ring_info *rp = &tx_rings[i];
 
                 pkts += rp->tx_packets;
                 bytes += rp->tx_bytes;
                 errors += rp->tx_errors;
         }
+
+no_rings:
         np->dev->stats.tx_packets = pkts;
         np->dev->stats.tx_bytes = bytes;
         np->dev->stats.tx_errors = errors;
@@ -6287,9 +6315,10 @@ static struct net_device_stats *niu_get_stats(struct net_device *dev)
 {
         struct niu *np = netdev_priv(dev);
 
-        niu_get_rx_stats(np);
-        niu_get_tx_stats(np);
-
+        if (netif_running(dev)) {
+                niu_get_rx_stats(np);
+                niu_get_tx_stats(np);
+        }
         return &dev->stats;
 }
 
diff --git a/drivers/net/ns83820.c b/drivers/net/ns83820.c
index 84134c766f3..a41b2cf4d91 100644
--- a/drivers/net/ns83820.c
+++ b/drivers/net/ns83820.c
@@ -1988,12 +1988,11 @@ static int __devinit ns83820_init_one(struct pci_dev *pci_dev,
         }
 
         ndev = alloc_etherdev(sizeof(struct ns83820));
-        dev = PRIV(ndev);
-
         err = -ENOMEM;
-        if (!dev)
+        if (!ndev)
                 goto out;
 
+        dev = PRIV(ndev);
         dev->ndev = ndev;
 
         spin_lock_init(&dev->rx_info.lock);
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index d7355306a73..1bf12339441 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -2247,7 +2247,7 @@ static void pch_gbe_remove(struct pci_dev *pdev)
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct pch_gbe_adapter *adapter = netdev_priv(netdev);
 
-        flush_scheduled_work();
+        cancel_work_sync(&adapter->reset_task);
         unregister_netdev(netdev);
 
         pch_gbe_hal_phy_hw_reset(&adapter->hw);
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 1f42f6ac855..d3cb7720586 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -1488,12 +1488,10 @@ static void ei_rx_overrun(struct net_device *dev)
     
         /* 
          * Wait a full Tx time (1.2ms) + some guard time, NS says 1.6ms total.
-         * Early datasheets said to poll the reset bit, but now they say that
-         * it "is not a reliable indicator and subsequently should be ignored."
-         * We wait at least 10ms.
+         * We wait at least 2ms.
          */
 
-        mdelay(10);
+        mdelay(2);
 
         /*
          * Reset RBCR[01] back to zero as per magic incantation.
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index bde7d61f193..59ccf0c5c61 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -973,7 +973,8 @@ static void __rtl8169_check_link_status(struct net_device *dev,
                 if (pm)
                         pm_request_resume(&tp->pci_dev->dev);
                 netif_carrier_on(dev);
-                netif_info(tp, ifup, dev, "link up\n");
+                if (net_ratelimit())
+                        netif_info(tp, ifup, dev, "link up\n");
         } else {
                 netif_carrier_off(dev);
                 netif_info(tp, ifdown, dev, "link down\n");
@@ -3757,7 +3758,8 @@ static void rtl_hw_start_8168(struct net_device *dev)
         RTL_W16(IntrMitigate, 0x5151);
 
         /* Work around for RxFIFO overflow. */
-        if (tp->mac_version == RTL_GIGA_MAC_VER_11) {
+        if (tp->mac_version == RTL_GIGA_MAC_VER_11 ||
+            tp->mac_version == RTL_GIGA_MAC_VER_22) {
                 tp->intr_event |= RxFIFOOver | PCSTimeout;
                 tp->intr_event &= ~RxOverflow;
         }
@@ -4639,12 +4641,33 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                         break;
                 }
 
-                /* Work around for rx fifo overflow */
-                if (unlikely(status & RxFIFOOver) &&
-                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
-                        netif_stop_queue(dev);
-                        rtl8169_tx_timeout(dev);
-                        break;
+                if (unlikely(status & RxFIFOOver)) {
+                        switch (tp->mac_version) {
+                        /* Work around for rx fifo overflow */
+                        case RTL_GIGA_MAC_VER_11:
+                        case RTL_GIGA_MAC_VER_22:
+                        case RTL_GIGA_MAC_VER_26:
+                                netif_stop_queue(dev);
+                                rtl8169_tx_timeout(dev);
+                                goto done;
+                        /* Testers needed. */
+                        case RTL_GIGA_MAC_VER_17:
+                        case RTL_GIGA_MAC_VER_19:
+                        case RTL_GIGA_MAC_VER_20:
+                        case RTL_GIGA_MAC_VER_21:
+                        case RTL_GIGA_MAC_VER_23:
+                        case RTL_GIGA_MAC_VER_24:
+                        case RTL_GIGA_MAC_VER_27:
+                        case RTL_GIGA_MAC_VER_28:
+                        /* Experimental science. Pktgen proof. */
+                        case RTL_GIGA_MAC_VER_12:
+                        case RTL_GIGA_MAC_VER_25:
+                                if (status == RxFIFOOver)
+                                        goto done;
+                                break;
+                        default:
+                                break;
+                        }
                 }
 
                 if (unlikely(status & SYSErr)) {
@@ -4680,7 +4703,7 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                         (status & RxFIFOOver) ? (status | RxOverflow) : status);
                 status = RTL_R16(IntrStatus);
         }
-
+done:
         return IRQ_RETVAL(handled);
 }
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 7841a8f6999..93b32d36661 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -60,12 +60,6 @@
 #define BAR_0   0
 #define BAR_2   2
 
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-#define TG3_VLAN_TAG_USED 1
-#else
-#define TG3_VLAN_TAG_USED 0
-#endif
-
 #include "tg3.h"
 
 #define DRV_MODULE_NAME         "tg3"
@@ -134,9 +128,6 @@
                                  TG3_TX_RING_SIZE)
 #define NEXT_TX(N)              (((N) + 1) & (TG3_TX_RING_SIZE - 1))
 
-#define TG3_RX_DMA_ALIGN                16
-#define TG3_RX_HEADROOM                 ALIGN(VLAN_HLEN, TG3_RX_DMA_ALIGN)
-
 #define TG3_DMA_BYTE_ENAB               64
 
 #define TG3_RX_STD_DMA_SZ               1536
@@ -4722,8 +4713,6 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 struct sk_buff *skb;
                 dma_addr_t dma_addr;
                 u32 opaque_key, desc_idx, *post_ptr;
-                bool hw_vlan __maybe_unused = false;
-                u16 vtag __maybe_unused = 0;
 
                 desc_idx = desc->opaque & RXD_OPAQUE_INDEX_MASK;
                 opaque_key = desc->opaque & RXD_OPAQUE_RING_MASK;
@@ -4782,12 +4771,12 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                         tg3_recycle_rx(tnapi, tpr, opaque_key,
                                        desc_idx, *post_ptr);
 
-                        copy_skb = netdev_alloc_skb(tp->dev, len + VLAN_HLEN +
+                        copy_skb = netdev_alloc_skb(tp->dev, len +
                                                     TG3_RAW_IP_ALIGN);
                         if (copy_skb == NULL)
                                 goto drop_it_no_recycle;
 
-                        skb_reserve(copy_skb, TG3_RAW_IP_ALIGN + VLAN_HLEN);
+                        skb_reserve(copy_skb, TG3_RAW_IP_ALIGN);
                         skb_put(copy_skb, len);
                         pci_dma_sync_single_for_cpu(tp->pdev, dma_addr, len, PCI_DMA_FROMDEVICE);
                         skb_copy_from_linear_data(skb, copy_skb->data, len);
@@ -4814,30 +4803,11 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 }
 
                 if (desc->type_flags & RXD_FLAG_VLAN &&
-                    !(tp->rx_mode & RX_MODE_KEEP_VLAN_TAG)) {
-                        vtag = desc->err_vlan & RXD_VLAN_MASK;
-#if TG3_VLAN_TAG_USED
-                        if (tp->vlgrp)
-                                hw_vlan = true;
-                        else
-#endif
-                        {
-                                struct vlan_ethhdr *ve = (struct vlan_ethhdr *)
-                                                    __skb_push(skb, VLAN_HLEN);
-
-                                memmove(ve, skb->data + VLAN_HLEN,
-                                        ETH_ALEN * 2);
-                                ve->h_vlan_proto = htons(ETH_P_8021Q);
-                                ve->h_vlan_TCI = htons(vtag);
-                        }
-                }
+                    !(tp->rx_mode & RX_MODE_KEEP_VLAN_TAG))
+                        __vlan_hwaccel_put_tag(skb,
+                                               desc->err_vlan & RXD_VLAN_MASK);
 
-#if TG3_VLAN_TAG_USED
-                if (hw_vlan)
-                        vlan_gro_receive(&tnapi->napi, tp->vlgrp, vtag, skb);
-                else
-#endif
-                        napi_gro_receive(&tnapi->napi, skb);
+                napi_gro_receive(&tnapi->napi, skb);
 
                 received++;
                 budget--;
@@ -5740,11 +5710,9 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb,
                 base_flags |= TXD_FLAG_TCPUDP_CSUM;
         }
 
-#if TG3_VLAN_TAG_USED
         if (vlan_tx_tag_present(skb))
                 base_flags |= (TXD_FLAG_VLAN |
                                (vlan_tx_tag_get(skb) << 16));
-#endif
 
         len = skb_headlen(skb);
 
@@ -5986,11 +5954,10 @@ static netdev_tx_t tg3_start_xmit_dma_bug(struct sk_buff *skb,
                         }
                 }
         }
-#if TG3_VLAN_TAG_USED
+
         if (vlan_tx_tag_present(skb))
                 base_flags |= (TXD_FLAG_VLAN |
                                (vlan_tx_tag_get(skb) << 16));
-#endif
 
         if ((tp->tg3_flags3 & TG3_FLG3_USE_JUMBO_BDFLAG) &&
             !mss && skb->len > VLAN_ETH_FRAME_LEN)
@@ -9532,17 +9499,10 @@ static void __tg3_set_rx_mode(struct net_device *dev)
         rx_mode = tp->rx_mode & ~(RX_MODE_PROMISC |
                                   RX_MODE_KEEP_VLAN_TAG);
 
+#if !defined(CONFIG_VLAN_8021Q) && !defined(CONFIG_VLAN_8021Q_MODULE)
         /* When ASF is in use, we always keep the RX_MODE_KEEP_VLAN_TAG
          * flag clear.
          */
-#if TG3_VLAN_TAG_USED
-        if (!tp->vlgrp &&
-            !(tp->tg3_flags & TG3_FLAG_ENABLE_ASF))
-                rx_mode |= RX_MODE_KEEP_VLAN_TAG;
-#else
-        /* By definition, VLAN is disabled always in this
-         * case.
-         */
         if (!(tp->tg3_flags & TG3_FLAG_ENABLE_ASF))
                 rx_mode |= RX_MODE_KEEP_VLAN_TAG;
 #endif
@@ -11230,31 +11190,6 @@ static int tg3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         return -EOPNOTSUPP;
 }
 
-#if TG3_VLAN_TAG_USED
-static void tg3_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
-{
-        struct tg3 *tp = netdev_priv(dev);
-
-        if (!netif_running(dev)) {
-                tp->vlgrp = grp;
-                return;
-        }
-
-        tg3_netif_stop(tp);
-
-        tg3_full_lock(tp, 0);
-
-        tp->vlgrp = grp;
-
-        /* Update RX_MODE_KEEP_VLAN_TAG bit in RX_MODE register. */
-        __tg3_set_rx_mode(dev);
-
-        tg3_netif_start(tp);
-
-        tg3_full_unlock(tp);
-}
-#endif
-
 static int tg3_get_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
 {
         struct tg3 *tp = netdev_priv(dev);
@@ -13066,9 +13001,7 @@ static struct pci_dev * __devinit tg3_find_peer(struct tg3 *);
 
 static void inline vlan_features_add(struct net_device *dev, unsigned long flags)
 {
-#if TG3_VLAN_TAG_USED
         dev->vlan_features |= flags;
-#endif
 }
 
 static inline u32 tg3_rx_ret_ring_size(struct tg3 *tp)
@@ -13861,11 +13794,11 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         else
                 tp->tg3_flags &= ~TG3_FLAG_POLL_SERDES;
 
-        tp->rx_offset = NET_IP_ALIGN + TG3_RX_HEADROOM;
+        tp->rx_offset = NET_IP_ALIGN;
         tp->rx_copy_thresh = TG3_RX_COPY_THRESHOLD;
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 &&
             (tp->tg3_flags & TG3_FLAG_PCIX_MODE) != 0) {
-                tp->rx_offset -= NET_IP_ALIGN;
+                tp->rx_offset = 0;
 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
                 tp->rx_copy_thresh = ~(u16)0;
 #endif
@@ -14629,9 +14562,6 @@ static const struct net_device_ops tg3_netdev_ops = {
         .ndo_do_ioctl           = tg3_ioctl,
         .ndo_tx_timeout         = tg3_tx_timeout,
         .ndo_change_mtu         = tg3_change_mtu,
-#if TG3_VLAN_TAG_USED
-        .ndo_vlan_rx_register   = tg3_vlan_rx_register,
-#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = tg3_poll_controller,
 #endif
@@ -14648,9 +14578,6 @@ static const struct net_device_ops tg3_netdev_ops_dma_bug = {
         .ndo_do_ioctl           = tg3_ioctl,
         .ndo_tx_timeout         = tg3_tx_timeout,
         .ndo_change_mtu         = tg3_change_mtu,
-#if TG3_VLAN_TAG_USED
-        .ndo_vlan_rx_register   = tg3_vlan_rx_register,
-#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = tg3_poll_controller,
 #endif
@@ -14700,9 +14627,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 
         SET_NETDEV_DEV(dev, &pdev->dev);
 
-#if TG3_VLAN_TAG_USED
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-#endif
 
         tp = netdev_priv(dev);
         tp->pdev = pdev;
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index d62c8d937c8..f528243e1a4 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2808,9 +2808,6 @@ struct tg3 {
         u32                             rx_std_max_post;
         u32                             rx_offset;
         u32                             rx_pkt_map_sz;
-#if TG3_VLAN_TAG_USED
-        struct vlan_group               *vlgrp;
-#endif
 
 
         /* begin "everything else" cacheline(s) section */
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index d776c4a8d3c..04e8ce14a1d 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -54,7 +54,7 @@
 #include <linux/usb/usbnet.h>
 #include <linux/usb/cdc.h>
 
-#define DRIVER_VERSION                          "30-Nov-2010"
+#define DRIVER_VERSION                          "17-Jan-2011"
 
 /* CDC NCM subclass 3.2.1 */
 #define USB_CDC_NCM_NDP16_LENGTH_MIN            0x10
@@ -868,15 +868,19 @@ static void cdc_ncm_tx_timeout(unsigned long arg)
         if (ctx->tx_timer_pending != 0) {
                 ctx->tx_timer_pending--;
                 restart = 1;
-        } else
+        } else {
                 restart = 0;
+        }
 
         spin_unlock(&ctx->mtx);
 
-        if (restart)
+        if (restart) {
+                spin_lock(&ctx->mtx);
                 cdc_ncm_tx_timeout_start(ctx);
-        else if (ctx->netdev != NULL)
+                spin_unlock(&ctx->mtx);
+        } else if (ctx->netdev != NULL) {
                 usbnet_start_xmit(NULL, ctx->netdev);
+        }
 }
 
 static struct sk_buff *
@@ -900,7 +904,6 @@ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
         skb_out = cdc_ncm_fill_tx_frame(ctx, skb);
         if (ctx->tx_curr_skb != NULL)
                 need_timer = 1;
-        spin_unlock(&ctx->mtx);
 
         /* Start timer, if there is a remaining skb */
         if (need_timer)
@@ -908,6 +911,8 @@ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
 
         if (skb_out)
                 dev->net->stats.tx_packets += ctx->tx_curr_frame_num;
+
+        spin_unlock(&ctx->mtx);
         return skb_out;
 
 error:
@@ -1020,8 +1025,8 @@ static int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in)
                 if (((offset + temp) > actlen) ||
                     (temp > CDC_NCM_MAX_DATAGRAM_SIZE) || (temp < ETH_HLEN)) {
                         pr_debug("invalid frame detected (ignored)"
-                                "offset[%u]=%u, length=%u, skb=%p\n",
-                                                        x, offset, temp, skb_in);
+                                        "offset[%u]=%u, length=%u, skb=%p\n",
+                                        x, offset, temp, skb_in);
                         if (!x)
                                 goto error;
                         break;
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 5e98643a4a2..7dc84971f26 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -406,6 +406,7 @@ static int kaweth_download_firmware(struct kaweth_device *kaweth,
 
         if (fw->size > KAWETH_FIRMWARE_BUF_SIZE) {
                 err("Firmware too big: %zu", fw->size);
+                release_firmware(fw);
                 return -ENOSPC;
         }
         data_len = fw->size;
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index d143e8b72b5..cc14b4a7504 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -48,6 +48,9 @@ static atomic_t devices_found;
 static int enable_mq = 1;
 static int irq_share_mode;
 
+static void
+vmxnet3_write_mac_addr(struct vmxnet3_adapter *adapter, u8 *mac);
+
 /*
  *    Enable/Disable the given intr
  */
@@ -139,9 +142,13 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
 {
         u32 ret;
         int i;
+        unsigned long flags;
 
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD, VMXNET3_CMD_GET_LINK);
         ret = VMXNET3_READ_BAR1_REG(adapter, VMXNET3_REG_CMD);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+
         adapter->link_speed = ret >> 16;
         if (ret & 1) { /* Link is up. */
                 printk(KERN_INFO "%s: NIC Link is Up %d Mbps\n",
@@ -183,8 +190,10 @@ vmxnet3_process_events(struct vmxnet3_adapter *adapter)
 
         /* Check if there is an error on xmit/recv queues */
         if (events & (VMXNET3_ECR_TQERR | VMXNET3_ECR_RQERR)) {
+                spin_lock(&adapter->cmd_lock);
                 VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                        VMXNET3_CMD_GET_QUEUE_STATUS);
+                spin_unlock(&adapter->cmd_lock);
 
                 for (i = 0; i < adapter->num_tx_queues; i++)
                         if (adapter->tqd_start[i].status.stopped)
@@ -804,30 +813,25 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                    skb_transport_header(skb))->doff * 4;
                 ctx->copy_size = ctx->eth_ip_hdr_size + ctx->l4_hdr_size;
         } else {
-                unsigned int pull_size;
-
                 if (skb->ip_summed == CHECKSUM_PARTIAL) {
                         ctx->eth_ip_hdr_size = skb_checksum_start_offset(skb);
 
                         if (ctx->ipv4) {
                                 struct iphdr *iph = (struct iphdr *)
                                                     skb_network_header(skb);
-                                if (iph->protocol == IPPROTO_TCP) {
-                                        pull_size = ctx->eth_ip_hdr_size +
-                                                    sizeof(struct tcphdr);
-
-                                        if (unlikely(!pskb_may_pull(skb,
-                                                                pull_size))) {
-                                                goto err;
-                                        }
+                                if (iph->protocol == IPPROTO_TCP)
                                         ctx->l4_hdr_size = ((struct tcphdr *)
                                            skb_transport_header(skb))->doff * 4;
-                                } else if (iph->protocol == IPPROTO_UDP) {
+                                else if (iph->protocol == IPPROTO_UDP)
+                                        /*
+                                         * Use tcp header size so that bytes to
+                                         * be copied are more than required by
+                                         * the device.
+                                         */
                                         ctx->l4_hdr_size =
-                                                        sizeof(struct udphdr);
-                                } else {
+                                                        sizeof(struct tcphdr);
+                                else
                                         ctx->l4_hdr_size = 0;
-                                }
                         } else {
                                 /* for simplicity, don't copy L4 headers */
                                 ctx->l4_hdr_size = 0;
@@ -1859,18 +1863,14 @@ vmxnet3_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         struct Vmxnet3_DriverShared *shared = adapter->shared;
         u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
+        unsigned long flags;
 
         if (grp) {
                 /* add vlan rx stripping. */
                 if (adapter->netdev->features & NETIF_F_HW_VLAN_RX) {
                         int i;
-                        struct Vmxnet3_DSDevRead *devRead = &shared->devRead;
                         adapter->vlan_grp = grp;
 
-                        /* update FEATURES to device */
-                        devRead->misc.uptFeatures |= UPT1_F_RXVLAN;
-                        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
-                                               VMXNET3_CMD_UPDATE_FEATURE);
                         /*
                          *  Clear entire vfTable; then enable untagged pkts.
                          *  Note: setting one entry in vfTable to non-zero turns
@@ -1880,8 +1880,10 @@ vmxnet3_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
                                 vfTable[i] = 0;
 
                         VMXNET3_SET_VFTABLE_ENTRY(vfTable, 0);
+                        spin_lock_irqsave(&adapter->cmd_lock, flags);
                         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                                VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
                 } else {
                         printk(KERN_ERR "%s: vlan_rx_register when device has "
                                "no NETIF_F_HW_VLAN_RX\n", netdev->name);
@@ -1900,13 +1902,10 @@ vmxnet3_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
                                  */
                                 vfTable[i] = 0;
                         }
+                        spin_lock_irqsave(&adapter->cmd_lock, flags);
                         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                                VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-
-                        /* update FEATURES to device */
-                        devRead->misc.uptFeatures &= ~UPT1_F_RXVLAN;
-                        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
-                                               VMXNET3_CMD_UPDATE_FEATURE);
+                        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
                 }
         }
 }
@@ -1939,10 +1938,13 @@ vmxnet3_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
+        unsigned long flags;
 
         VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 }
 
 
@@ -1951,10 +1953,13 @@ vmxnet3_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
+        unsigned long flags;
 
         VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 }
 
 
@@ -1985,6 +1990,7 @@ static void
 vmxnet3_set_mc(struct net_device *netdev)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+        unsigned long flags;
         struct Vmxnet3_RxFilterConf *rxConf =
                                         &adapter->shared->devRead.rxFilterConf;
         u8 *new_table = NULL;
@@ -2020,6 +2026,7 @@ vmxnet3_set_mc(struct net_device *netdev)
                 rxConf->mfTablePA = 0;
         }
 
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         if (new_mode != rxConf->rxMode) {
                 rxConf->rxMode = cpu_to_le32(new_mode);
                 VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
@@ -2028,6 +2035,7 @@ vmxnet3_set_mc(struct net_device *netdev)
 
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_UPDATE_MAC_FILTERS);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 
         kfree(new_table);
 }
@@ -2080,10 +2088,8 @@ vmxnet3_setup_driver_shared(struct vmxnet3_adapter *adapter)
                 devRead->misc.uptFeatures |= UPT1_F_LRO;
                 devRead->misc.maxNumRxSG = cpu_to_le16(1 + MAX_SKB_FRAGS);
         }
-        if ((adapter->netdev->features & NETIF_F_HW_VLAN_RX) &&
-            adapter->vlan_grp) {
+        if (adapter->netdev->features & NETIF_F_HW_VLAN_RX)
                 devRead->misc.uptFeatures |= UPT1_F_RXVLAN;
-        }
 
         devRead->misc.mtu = cpu_to_le32(adapter->netdev->mtu);
         devRead->misc.queueDescPA = cpu_to_le64(adapter->queue_desc_pa);
@@ -2168,6 +2174,8 @@ vmxnet3_setup_driver_shared(struct vmxnet3_adapter *adapter)
         /* rx filter settings */
         devRead->rxFilterConf.rxMode = 0;
         vmxnet3_restore_vlan(adapter);
+        vmxnet3_write_mac_addr(adapter, adapter->netdev->dev_addr);
+
         /* the rest are already zeroed */
 }
 
@@ -2177,6 +2185,7 @@ vmxnet3_activate_dev(struct vmxnet3_adapter *adapter)
 {
         int err, i;
         u32 ret;
+        unsigned long flags;
 
         dev_dbg(&adapter->netdev->dev, "%s: skb_buf_size %d, rx_buf_per_pkt %d,"
                 " ring sizes %u %u %u\n", adapter->netdev->name,
@@ -2206,9 +2215,11 @@ vmxnet3_activate_dev(struct vmxnet3_adapter *adapter)
                                adapter->shared_pa));
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_DSAH, VMXNET3_GET_ADDR_HI(
                                adapter->shared_pa));
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_ACTIVATE_DEV);
         ret = VMXNET3_READ_BAR1_REG(adapter, VMXNET3_REG_CMD);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 
         if (ret != 0) {
                 printk(KERN_ERR "Failed to activate dev %s: error %u\n",
@@ -2255,7 +2266,10 @@ rq_err:
 void
 vmxnet3_reset_dev(struct vmxnet3_adapter *adapter)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD, VMXNET3_CMD_RESET_DEV);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 }
 
 
@@ -2263,12 +2277,15 @@ int
 vmxnet3_quiesce_dev(struct vmxnet3_adapter *adapter)
 {
         int i;
+        unsigned long flags;
         if (test_and_set_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state))
                 return 0;
 
 
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_QUIESCE_DEV);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
         vmxnet3_disable_all_intrs(adapter);
 
         for (i = 0; i < adapter->num_rx_queues; i++)
@@ -2426,7 +2443,7 @@ vmxnet3_adjust_rx_ring_size(struct vmxnet3_adapter *adapter)
         sz = adapter->rx_buf_per_pkt * VMXNET3_RING_SIZE_ALIGN;
         ring0_size = adapter->rx_queue[0].rx_ring[0].size;
         ring0_size = (ring0_size + sz - 1) / sz * sz;
-        ring0_size = min_t(u32, rq->rx_ring[0].size, VMXNET3_RX_RING_MAX_SIZE /
+        ring0_size = min_t(u32, ring0_size, VMXNET3_RX_RING_MAX_SIZE /
                            sz * sz);
         ring1_size = adapter->rx_queue[0].rx_ring[1].size;
         comp_size = ring0_size + ring1_size;
@@ -2695,7 +2712,7 @@ vmxnet3_acquire_msix_vectors(struct vmxnet3_adapter *adapter,
                         break;
                 } else {
                         /* If fails to enable required number of MSI-x vectors
-                         * try enabling 3 of them. One each for rx, tx and event
+                         * try enabling minimum number of vectors required.
                          */
                         vectors = vector_threshold;
                         printk(KERN_ERR "Failed to enable %d MSI-X for %s, try"
@@ -2718,9 +2735,11 @@ vmxnet3_alloc_intr_resources(struct vmxnet3_adapter *adapter)
         u32 cfg;
 
         /* intr settings */
+        spin_lock(&adapter->cmd_lock);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_GET_CONF_INTR);
         cfg = VMXNET3_READ_BAR1_REG(adapter, VMXNET3_REG_CMD);
+        spin_unlock(&adapter->cmd_lock);
         adapter->intr.type = cfg & 0x3;
         adapter->intr.mask_mode = (cfg >> 2) & 0x3;
 
@@ -2755,7 +2774,7 @@ vmxnet3_alloc_intr_resources(struct vmxnet3_adapter *adapter)
                  */
                 if (err == VMXNET3_LINUX_MIN_MSIX_VECT) {
                         if (adapter->share_intr != VMXNET3_INTR_BUDDYSHARE
-                            || adapter->num_rx_queues != 2) {
+                            || adapter->num_rx_queues != 1) {
                                 adapter->share_intr = VMXNET3_INTR_TXSHARE;
                                 printk(KERN_ERR "Number of rx queues : 1\n");
                                 adapter->num_rx_queues = 1;
@@ -2905,6 +2924,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         adapter->netdev = netdev;
         adapter->pdev = pdev;
 
+        spin_lock_init(&adapter->cmd_lock);
         adapter->shared = pci_alloc_consistent(adapter->pdev,
                           sizeof(struct Vmxnet3_DriverShared),
                           &adapter->shared_pa);
@@ -3108,11 +3128,15 @@ vmxnet3_suspend(struct device *device)
         u8 *arpreq;
         struct in_device *in_dev;
         struct in_ifaddr *ifa;
+        unsigned long flags;
         int i = 0;
 
         if (!netif_running(netdev))
                 return 0;
 
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                napi_disable(&adapter->rx_queue[i].napi);
+
         vmxnet3_disable_all_intrs(adapter);
         vmxnet3_free_irqs(adapter);
         vmxnet3_free_intr_resources(adapter);
@@ -3188,8 +3212,10 @@ skip_arp:
         adapter->shared->devRead.pmConfDesc.confPA = cpu_to_le64(virt_to_phys(
                                                                  pmConf));
 
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_UPDATE_PMCFG);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 
         pci_save_state(pdev);
         pci_enable_wake(pdev, pci_choose_state(pdev, PMSG_SUSPEND),
@@ -3204,7 +3230,8 @@ skip_arp:
 static int
 vmxnet3_resume(struct device *device)
 {
-        int err;
+        int err, i = 0;
+        unsigned long flags;
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
@@ -3232,10 +3259,14 @@ vmxnet3_resume(struct device *device)
 
         pci_enable_wake(pdev, PCI_D0, 0);
 
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_UPDATE_PMCFG);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
         vmxnet3_alloc_intr_resources(adapter);
         vmxnet3_request_irqs(adapter);
+        for (i = 0; i < adapter->num_rx_queues; i++)
+                napi_enable(&adapter->rx_queue[i].napi);
         vmxnet3_enable_all_intrs(adapter);
 
         return 0;
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index 8e17fc8a7fe..81254be85b9 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -45,6 +45,7 @@ static int
 vmxnet3_set_rx_csum(struct net_device *netdev, u32 val)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+        unsigned long flags;
 
         if (adapter->rxcsum != val) {
                 adapter->rxcsum = val;
@@ -56,8 +57,10 @@ vmxnet3_set_rx_csum(struct net_device *netdev, u32 val)
                                 adapter->shared->devRead.misc.uptFeatures &=
                                 ~UPT1_F_RXCSUM;
 
+                        spin_lock_irqsave(&adapter->cmd_lock, flags);
                         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                                VMXNET3_CMD_UPDATE_FEATURE);
+                        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
                 }
         }
         return 0;
@@ -68,76 +71,78 @@ vmxnet3_set_rx_csum(struct net_device *netdev, u32 val)
 static const struct vmxnet3_stat_desc
 vmxnet3_tq_dev_stats[] = {
         /* description,         offset */
-        { "TSO pkts tx",        offsetof(struct UPT1_TxStats, TSOPktsTxOK) },
-        { "TSO bytes tx",       offsetof(struct UPT1_TxStats, TSOBytesTxOK) },
-        { "ucast pkts tx",      offsetof(struct UPT1_TxStats, ucastPktsTxOK) },
-        { "ucast bytes tx",     offsetof(struct UPT1_TxStats, ucastBytesTxOK) },
-        { "mcast pkts tx",      offsetof(struct UPT1_TxStats, mcastPktsTxOK) },
-        { "mcast bytes tx",     offsetof(struct UPT1_TxStats, mcastBytesTxOK) },
-        { "bcast pkts tx",      offsetof(struct UPT1_TxStats, bcastPktsTxOK) },
-        { "bcast bytes tx",     offsetof(struct UPT1_TxStats, bcastBytesTxOK) },
-        { "pkts tx err",        offsetof(struct UPT1_TxStats, pktsTxError) },
-        { "pkts tx discard",    offsetof(struct UPT1_TxStats, pktsTxDiscard) },
+        { "Tx Queue#",        0 },
+        { "  TSO pkts tx",      offsetof(struct UPT1_TxStats, TSOPktsTxOK) },
+        { "  TSO bytes tx",     offsetof(struct UPT1_TxStats, TSOBytesTxOK) },
+        { "  ucast pkts tx",    offsetof(struct UPT1_TxStats, ucastPktsTxOK) },
+        { "  ucast bytes tx",   offsetof(struct UPT1_TxStats, ucastBytesTxOK) },
+        { "  mcast pkts tx",    offsetof(struct UPT1_TxStats, mcastPktsTxOK) },
+        { "  mcast bytes tx",   offsetof(struct UPT1_TxStats, mcastBytesTxOK) },
+        { "  bcast pkts tx",    offsetof(struct UPT1_TxStats, bcastPktsTxOK) },
+        { "  bcast bytes tx",   offsetof(struct UPT1_TxStats, bcastBytesTxOK) },
+        { "  pkts tx err",      offsetof(struct UPT1_TxStats, pktsTxError) },
+        { "  pkts tx discard",  offsetof(struct UPT1_TxStats, pktsTxDiscard) },
 };
 
 /* per tq stats maintained by the driver */
 static const struct vmxnet3_stat_desc
 vmxnet3_tq_driver_stats[] = {
         /* description,         offset */
-        {"drv dropped tx total", offsetof(struct vmxnet3_tq_driver_stats,
-                                        drop_total) },
-        { "   too many frags",  offsetof(struct vmxnet3_tq_driver_stats,
-                                        drop_too_many_frags) },
-        { "   giant hdr",       offsetof(struct vmxnet3_tq_driver_stats,
-                                        drop_oversized_hdr) },
-        { "   hdr err",         offsetof(struct vmxnet3_tq_driver_stats,
-                                        drop_hdr_inspect_err) },
-        { "   tso",             offsetof(struct vmxnet3_tq_driver_stats,
-                                        drop_tso) },
-        { "ring full",          offsetof(struct vmxnet3_tq_driver_stats,
-                                        tx_ring_full) },
-        { "pkts linearized",    offsetof(struct vmxnet3_tq_driver_stats,
-                                        linearized) },
-        { "hdr cloned",         offsetof(struct vmxnet3_tq_driver_stats,
-                                        copy_skb_header) },
-        { "giant hdr",          offsetof(struct vmxnet3_tq_driver_stats,
-                                        oversized_hdr) },
+        {"  drv dropped tx total",      offsetof(struct vmxnet3_tq_driver_stats,
+                                                 drop_total) },
+        { "     too many frags", offsetof(struct vmxnet3_tq_driver_stats,
+                                          drop_too_many_frags) },
+        { "     giant hdr",     offsetof(struct vmxnet3_tq_driver_stats,
+                                         drop_oversized_hdr) },
+        { "     hdr err",       offsetof(struct vmxnet3_tq_driver_stats,
+                                         drop_hdr_inspect_err) },
+        { "     tso",           offsetof(struct vmxnet3_tq_driver_stats,
+                                         drop_tso) },
+        { "  ring full",        offsetof(struct vmxnet3_tq_driver_stats,
+                                         tx_ring_full) },
+        { "  pkts linearized",  offsetof(struct vmxnet3_tq_driver_stats,
+                                         linearized) },
+        { "  hdr cloned",       offsetof(struct vmxnet3_tq_driver_stats,
+                                         copy_skb_header) },
+        { "  giant hdr",        offsetof(struct vmxnet3_tq_driver_stats,
+                                         oversized_hdr) },
 };
 
 /* per rq stats maintained by the device */
 static const struct vmxnet3_stat_desc
 vmxnet3_rq_dev_stats[] = {
-        { "LRO pkts rx",        offsetof(struct UPT1_RxStats, LROPktsRxOK) },
-        { "LRO byte rx",        offsetof(struct UPT1_RxStats, LROBytesRxOK) },
-        { "ucast pkts rx",      offsetof(struct UPT1_RxStats, ucastPktsRxOK) },
-        { "ucast bytes rx",     offsetof(struct UPT1_RxStats, ucastBytesRxOK) },
-        { "mcast pkts rx",      offsetof(struct UPT1_RxStats, mcastPktsRxOK) },
-        { "mcast bytes rx",     offsetof(struct UPT1_RxStats, mcastBytesRxOK) },
-        { "bcast pkts rx",      offsetof(struct UPT1_RxStats, bcastPktsRxOK) },
-        { "bcast bytes rx",     offsetof(struct UPT1_RxStats, bcastBytesRxOK) },
-        { "pkts rx out of buf", offsetof(struct UPT1_RxStats, pktsRxOutOfBuf) },
-        { "pkts rx err",        offsetof(struct UPT1_RxStats, pktsRxError) },
+        { "Rx Queue#",        0 },
+        { "  LRO pkts rx",      offsetof(struct UPT1_RxStats, LROPktsRxOK) },
+        { "  LRO byte rx",      offsetof(struct UPT1_RxStats, LROBytesRxOK) },
+        { "  ucast pkts rx",    offsetof(struct UPT1_RxStats, ucastPktsRxOK) },
+        { "  ucast bytes rx",   offsetof(struct UPT1_RxStats, ucastBytesRxOK) },
+        { "  mcast pkts rx",    offsetof(struct UPT1_RxStats, mcastPktsRxOK) },
+        { "  mcast bytes rx",   offsetof(struct UPT1_RxStats, mcastBytesRxOK) },
+        { "  bcast pkts rx",    offsetof(struct UPT1_RxStats, bcastPktsRxOK) },
+        { "  bcast bytes rx",   offsetof(struct UPT1_RxStats, bcastBytesRxOK) },
+        { "  pkts rx OOB",      offsetof(struct UPT1_RxStats, pktsRxOutOfBuf) },
+        { "  pkts rx err",      offsetof(struct UPT1_RxStats, pktsRxError) },
 };
 
 /* per rq stats maintained by the driver */
 static const struct vmxnet3_stat_desc
 vmxnet3_rq_driver_stats[] = {
         /* description,         offset */
-        { "drv dropped rx total", offsetof(struct vmxnet3_rq_driver_stats,
-                                           drop_total) },
-        { "   err",            offsetof(struct vmxnet3_rq_driver_stats,
-                                        drop_err) },
-        { "   fcs",            offsetof(struct vmxnet3_rq_driver_stats,
-                                        drop_fcs) },
-        { "rx buf alloc fail", offsetof(struct vmxnet3_rq_driver_stats,
-                                        rx_buf_alloc_failure) },
+        { "  drv dropped rx total", offsetof(struct vmxnet3_rq_driver_stats,
+                                             drop_total) },
+        { "     err",           offsetof(struct vmxnet3_rq_driver_stats,
+                                         drop_err) },
+        { "     fcs",           offsetof(struct vmxnet3_rq_driver_stats,
+                                         drop_fcs) },
+        { "  rx buf alloc fail", offsetof(struct vmxnet3_rq_driver_stats,
+                                          rx_buf_alloc_failure) },
 };
 
 /* gloabl stats maintained by the driver */
 static const struct vmxnet3_stat_desc
 vmxnet3_global_stats[] = {
         /* description,         offset */
-        { "tx timeout count",   offsetof(struct vmxnet3_adapter,
+        { "tx timeout count",   offsetof(struct vmxnet3_adapter,
                                          tx_timeout_count) }
 };
 
@@ -151,12 +156,15 @@ vmxnet3_get_stats(struct net_device *netdev)
         struct UPT1_TxStats *devTxStats;
         struct UPT1_RxStats *devRxStats;
         struct net_device_stats *net_stats = &netdev->stats;
+        unsigned long flags;
         int i;
 
         adapter = netdev_priv(netdev);
 
         /* Collect the dev stats into the shared area */
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD, VMXNET3_CMD_GET_STATS);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 
         memset(net_stats, 0, sizeof(*net_stats));
         for (i = 0; i < adapter->num_tx_queues; i++) {
@@ -193,12 +201,15 @@ vmxnet3_get_stats(struct net_device *netdev)
 static int
 vmxnet3_get_sset_count(struct net_device *netdev, int sset)
 {
+        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         switch (sset) {
         case ETH_SS_STATS:
-                return ARRAY_SIZE(vmxnet3_tq_dev_stats) +
-                        ARRAY_SIZE(vmxnet3_tq_driver_stats) +
-                        ARRAY_SIZE(vmxnet3_rq_dev_stats) +
-                        ARRAY_SIZE(vmxnet3_rq_driver_stats) +
+                return (ARRAY_SIZE(vmxnet3_tq_dev_stats) +
+                        ARRAY_SIZE(vmxnet3_tq_driver_stats)) *
+                       adapter->num_tx_queues +
+                       (ARRAY_SIZE(vmxnet3_rq_dev_stats) +
+                        ARRAY_SIZE(vmxnet3_rq_driver_stats)) *
+                       adapter->num_rx_queues +
                         ARRAY_SIZE(vmxnet3_global_stats);
         default:
                 return -EOPNOTSUPP;
@@ -206,10 +217,16 @@ vmxnet3_get_sset_count(struct net_device *netdev, int sset)
 }
 
 
+/* Should be multiple of 4 */
+#define NUM_TX_REGS     8
+#define NUM_RX_REGS     12
+
 static int
 vmxnet3_get_regs_len(struct net_device *netdev)
 {
-        return 20 * sizeof(u32);
+        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+        return (adapter->num_tx_queues * NUM_TX_REGS * sizeof(u32) +
+                adapter->num_rx_queues * NUM_RX_REGS * sizeof(u32));
 }
 
 
@@ -240,29 +257,37 @@ vmxnet3_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
 static void
 vmxnet3_get_strings(struct net_device *netdev, u32 stringset, u8 *buf)
 {
+         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         if (stringset == ETH_SS_STATS) {
-                int i;
-
-                for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_dev_stats); i++) {
-                        memcpy(buf, vmxnet3_tq_dev_stats[i].desc,
-                               ETH_GSTRING_LEN);
-                        buf += ETH_GSTRING_LEN;
-                }
-                for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_driver_stats); i++) {
-                        memcpy(buf, vmxnet3_tq_driver_stats[i].desc,
-                               ETH_GSTRING_LEN);
-                        buf += ETH_GSTRING_LEN;
-                }
-                for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_dev_stats); i++) {
-                        memcpy(buf, vmxnet3_rq_dev_stats[i].desc,
-                               ETH_GSTRING_LEN);
-                        buf += ETH_GSTRING_LEN;
+                int i, j;
+                for (j = 0; j < adapter->num_tx_queues; j++) {
+                        for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_dev_stats); i++) {
+                                memcpy(buf, vmxnet3_tq_dev_stats[i].desc,
+                                       ETH_GSTRING_LEN);
+                                buf += ETH_GSTRING_LEN;
+                        }
+                        for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_driver_stats);
+                             i++) {
+                                memcpy(buf, vmxnet3_tq_driver_stats[i].desc,
+                                       ETH_GSTRING_LEN);
+                                buf += ETH_GSTRING_LEN;
+                        }
                 }
-                for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_driver_stats); i++) {
-                        memcpy(buf, vmxnet3_rq_driver_stats[i].desc,
-                               ETH_GSTRING_LEN);
-                        buf += ETH_GSTRING_LEN;
+
+                for (j = 0; j < adapter->num_rx_queues; j++) {
+                        for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_dev_stats); i++) {
+                                memcpy(buf, vmxnet3_rq_dev_stats[i].desc,
+                                       ETH_GSTRING_LEN);
+                                buf += ETH_GSTRING_LEN;
+                        }
+                        for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_driver_stats);
+                             i++) {
+                                memcpy(buf, vmxnet3_rq_driver_stats[i].desc,
+                                       ETH_GSTRING_LEN);
+                                buf += ETH_GSTRING_LEN;
+                        }
                 }
+
                 for (i = 0; i < ARRAY_SIZE(vmxnet3_global_stats); i++) {
                         memcpy(buf, vmxnet3_global_stats[i].desc,
                                 ETH_GSTRING_LEN);
@@ -277,6 +302,7 @@ vmxnet3_set_flags(struct net_device *netdev, u32 data)
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         u8 lro_requested = (data & ETH_FLAG_LRO) == 0 ? 0 : 1;
         u8 lro_present = (netdev->features & NETIF_F_LRO) == 0 ? 0 : 1;
+        unsigned long flags;
 
         if (data & ~ETH_FLAG_LRO)
                 return -EOPNOTSUPP;
@@ -292,8 +318,10 @@ vmxnet3_set_flags(struct net_device *netdev, u32 data)
                 else
                         adapter->shared->devRead.misc.uptFeatures &=
                                                         ~UPT1_F_LRO;
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
                 VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                        VMXNET3_CMD_UPDATE_FEATURE);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
         }
         return 0;
 }
@@ -303,30 +331,41 @@ vmxnet3_get_ethtool_stats(struct net_device *netdev,
                           struct ethtool_stats *stats, u64  *buf)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+        unsigned long flags;
         u8 *base;
         int i;
         int j = 0;
 
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD, VMXNET3_CMD_GET_STATS);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 
         /* this does assume each counter is 64-bit wide */
-/* TODO change this for multiple queues */
-
-        base = (u8 *)&adapter->tqd_start[j].stats;
-        for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_dev_stats); i++)
-                *buf++ = *(u64 *)(base + vmxnet3_tq_dev_stats[i].offset);
-
-        base = (u8 *)&adapter->tx_queue[j].stats;
-        for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_driver_stats); i++)
-                *buf++ = *(u64 *)(base + vmxnet3_tq_driver_stats[i].offset);
-
-        base = (u8 *)&adapter->rqd_start[j].stats;
-        for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_dev_stats); i++)
-                *buf++ = *(u64 *)(base + vmxnet3_rq_dev_stats[i].offset);
+        for (j = 0; j < adapter->num_tx_queues; j++) {
+                base = (u8 *)&adapter->tqd_start[j].stats;
+                *buf++ = (u64)j;
+                for (i = 1; i < ARRAY_SIZE(vmxnet3_tq_dev_stats); i++)
+                        *buf++ = *(u64 *)(base +
+                                          vmxnet3_tq_dev_stats[i].offset);
+
+                base = (u8 *)&adapter->tx_queue[j].stats;
+                for (i = 0; i < ARRAY_SIZE(vmxnet3_tq_driver_stats); i++)
+                        *buf++ = *(u64 *)(base +
+                                          vmxnet3_tq_driver_stats[i].offset);
+        }
 
-        base = (u8 *)&adapter->rx_queue[j].stats;
-        for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_driver_stats); i++)
-                *buf++ = *(u64 *)(base + vmxnet3_rq_driver_stats[i].offset);
+        for (j = 0; j < adapter->num_tx_queues; j++) {
+                base = (u8 *)&adapter->rqd_start[j].stats;
+                *buf++ = (u64) j;
+                for (i = 1; i < ARRAY_SIZE(vmxnet3_rq_dev_stats); i++)
+                        *buf++ = *(u64 *)(base +
+                                          vmxnet3_rq_dev_stats[i].offset);
+
+                base = (u8 *)&adapter->rx_queue[j].stats;
+                for (i = 0; i < ARRAY_SIZE(vmxnet3_rq_driver_stats); i++)
+                        *buf++ = *(u64 *)(base +
+                                          vmxnet3_rq_driver_stats[i].offset);
+        }
 
         base = (u8 *)adapter;
         for (i = 0; i < ARRAY_SIZE(vmxnet3_global_stats); i++)
@@ -339,7 +378,7 @@ vmxnet3_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *p)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         u32 *buf = p;
-        int i = 0;
+        int i = 0, j = 0;
 
         memset(p, 0, vmxnet3_get_regs_len(netdev));
 
@@ -348,31 +387,35 @@ vmxnet3_get_regs(struct net_device *netdev, struct ethtool_regs *regs, void *p)
         /* Update vmxnet3_get_regs_len if we want to dump more registers */
 
         /* make each ring use multiple of 16 bytes */
-/* TODO change this for multiple queues */
-        buf[0] = adapter->tx_queue[i].tx_ring.next2fill;
-        buf[1] = adapter->tx_queue[i].tx_ring.next2comp;
-        buf[2] = adapter->tx_queue[i].tx_ring.gen;
-        buf[3] = 0;
-
-        buf[4] = adapter->tx_queue[i].comp_ring.next2proc;
-        buf[5] = adapter->tx_queue[i].comp_ring.gen;
-        buf[6] = adapter->tx_queue[i].stopped;
-        buf[7] = 0;
-
-        buf[8] = adapter->rx_queue[i].rx_ring[0].next2fill;
-        buf[9] = adapter->rx_queue[i].rx_ring[0].next2comp;
-        buf[10] = adapter->rx_queue[i].rx_ring[0].gen;
-        buf[11] = 0;
-
-        buf[12] = adapter->rx_queue[i].rx_ring[1].next2fill;
-        buf[13] = adapter->rx_queue[i].rx_ring[1].next2comp;
-        buf[14] = adapter->rx_queue[i].rx_ring[1].gen;
-        buf[15] = 0;
-
-        buf[16] = adapter->rx_queue[i].comp_ring.next2proc;
-        buf[17] = adapter->rx_queue[i].comp_ring.gen;
-        buf[18] = 0;
-        buf[19] = 0;
+        for (i = 0; i < adapter->num_tx_queues; i++) {
+                buf[j++] = adapter->tx_queue[i].tx_ring.next2fill;
+                buf[j++] = adapter->tx_queue[i].tx_ring.next2comp;
+                buf[j++] = adapter->tx_queue[i].tx_ring.gen;
+                buf[j++] = 0;
+
+                buf[j++] = adapter->tx_queue[i].comp_ring.next2proc;
+                buf[j++] = adapter->tx_queue[i].comp_ring.gen;
+                buf[j++] = adapter->tx_queue[i].stopped;
+                buf[j++] = 0;
+        }
+
+        for (i = 0; i < adapter->num_rx_queues; i++) {
+                buf[j++] = adapter->rx_queue[i].rx_ring[0].next2fill;
+                buf[j++] = adapter->rx_queue[i].rx_ring[0].next2comp;
+                buf[j++] = adapter->rx_queue[i].rx_ring[0].gen;
+                buf[j++] = 0;
+
+                buf[j++] = adapter->rx_queue[i].rx_ring[1].next2fill;
+                buf[j++] = adapter->rx_queue[i].rx_ring[1].next2comp;
+                buf[j++] = adapter->rx_queue[i].rx_ring[1].gen;
+                buf[j++] = 0;
+
+                buf[j++] = adapter->rx_queue[i].comp_ring.next2proc;
+                buf[j++] = adapter->rx_queue[i].comp_ring.gen;
+                buf[j++] = 0;
+                buf[j++] = 0;
+        }
+
 }
 
 
@@ -574,6 +617,7 @@ vmxnet3_set_rss_indir(struct net_device *netdev,
                       const struct ethtool_rxfh_indir *p)
 {
         unsigned int i;
+        unsigned long flags;
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
         struct UPT1_RSSConf *rssConf = adapter->rss_conf;
 
@@ -592,8 +636,10 @@ vmxnet3_set_rss_indir(struct net_device *netdev,
         for (i = 0; i < rssConf->indTableSize; i++)
                 rssConf->indTable[i] = p->ring_index[i];
 
+        spin_lock_irqsave(&adapter->cmd_lock, flags);
         VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
                                VMXNET3_CMD_UPDATE_RSSIDT);
+        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
 
         return 0;
 
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 7fadeed37f0..fb5d245ac87 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -68,10 +68,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.0.16.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.0.25.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01001000
+#define VMXNET3_DRIVER_VERSION_NUM      0x01001900
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
@@ -289,7 +289,7 @@ struct vmxnet3_rx_queue {
 
 #define VMXNET3_LINUX_MAX_MSIX_VECT     (VMXNET3_DEVICE_MAX_TX_QUEUES + \
                                          VMXNET3_DEVICE_MAX_RX_QUEUES + 1)
-#define VMXNET3_LINUX_MIN_MSIX_VECT     3    /* 1 for each : tx, rx and event */
+#define VMXNET3_LINUX_MIN_MSIX_VECT     2 /* 1 for tx-rx pair and 1 for event */
 
 
 struct vmxnet3_intr {
@@ -317,6 +317,7 @@ struct vmxnet3_adapter {
         struct vmxnet3_rx_queue         rx_queue[VMXNET3_DEVICE_MAX_RX_QUEUES];
         struct vlan_group               *vlan_grp;
         struct vmxnet3_intr             intr;
+        spinlock_t                      cmd_lock;
         struct Vmxnet3_DriverShared     *shared;
         struct Vmxnet3_PMConf           *pm_conf;
         struct Vmxnet3_TxQueueDesc      *tqd_start;     /* all tx queue desc */
diff --git a/drivers/net/vxge/vxge-config.c b/drivers/net/vxge/vxge-config.c
index 01c05f53e2f..228d4f7a58a 100644
--- a/drivers/net/vxge/vxge-config.c
+++ b/drivers/net/vxge/vxge-config.c
@@ -3690,7 +3690,7 @@ __vxge_hw_vpath_rts_table_get(struct __vxge_hw_vpath_handle *vp,
         if (status != VXGE_HW_OK)
                 goto exit;
 
-        if ((rts_table != VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA) ||
+        if ((rts_table != VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA) &&
             (rts_table !=
              VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT))
                 *data1 = 0;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 019a74d533a..09ae4ef0fd5 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2294,6 +2294,8 @@ ath5k_tx_complete_poll_work(struct work_struct *work)
         int i;
         bool needreset = false;
 
+        mutex_lock(&sc->lock);
+
         for (i = 0; i < ARRAY_SIZE(sc->txqs); i++) {
                 if (sc->txqs[i].setup) {
                         txq = &sc->txqs[i];
@@ -2321,6 +2323,8 @@ ath5k_tx_complete_poll_work(struct work_struct *work)
                 ath5k_reset(sc, NULL, true);
         }
 
+        mutex_unlock(&sc->lock);
+
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
                 msecs_to_jiffies(ATH5K_TX_COMPLETE_POLL_INT));
 }
diff --git a/drivers/net/wireless/ath/ath5k/dma.c b/drivers/net/wireless/ath/ath5k/dma.c
index 0064be7ce5c..21091c26a9a 100644
--- a/drivers/net/wireless/ath/ath5k/dma.c
+++ b/drivers/net/wireless/ath/ath5k/dma.c
@@ -838,9 +838,9 @@ int ath5k_hw_dma_stop(struct ath5k_hw *ah)
         for (i = 0; i < qmax; i++) {
                 err = ath5k_hw_stop_tx_dma(ah, i);
                 /* -EINVAL -> queue inactive */
-                if (err != -EINVAL)
+                if (err && err != -EINVAL)
                         return err;
         }
 
-        return err;
+        return 0;
 }
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index e5f2b96a4c6..a702817daf7 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -86,7 +86,7 @@ int ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
         if (!ah->ah_bwmode) {
                 dur = ieee80211_generic_frame_duration(sc->hw,
                                                 NULL, len, rate);
-                return dur;
+                return le16_to_cpu(dur);
         }
 
         bitrate = rate->bitrate;
@@ -265,8 +265,6 @@ static inline void ath5k_hw_write_rate_duration(struct ath5k_hw *ah)
                  * what rate we should choose to TX ACKs. */
                 tx_time = ath5k_hw_get_frame_duration(ah, 10, rate);
 
-                tx_time = le16_to_cpu(tx_time);
-
                 ath5k_hw_reg_write(ah, tx_time, reg);
 
                 if (!(rate->flags & IEEE80211_RATE_SHORT_PREAMBLE))
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index ea2e7d714bd..5e300bd3d26 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -679,10 +679,6 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
 
         /* Do NF cal only at longer intervals */
         if (longcal || nfcal_pending) {
-                /* Do periodic PAOffset Cal */
-                ar9002_hw_pa_cal(ah, false);
-                ar9002_hw_olc_temp_compensation(ah);
-
                 /*
                  * Get the value from the previous NF cal and update
                  * history buffer.
@@ -697,8 +693,12 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
                         ath9k_hw_loadnf(ah, ah->curchan);
                 }
 
-                if (longcal)
+                if (longcal) {
                         ath9k_hw_start_nfcal(ah, false);
+                        /* Do periodic PAOffset Cal */
+                        ar9002_hw_pa_cal(ah, false);
+                        ar9002_hw_olc_temp_compensation(ah);
+                }
         }
 
         return iscaldone;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index f8a7771faee..f44c84ab5dc 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -426,9 +426,8 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                 }
 
                 /* WAR for ASPM system hang */
-                if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
+                if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
                         val |= (AR_WA_BIT6 | AR_WA_BIT7);
-                }
 
                 if (AR_SREV_9285E_20(ah))
                         val |= AR_WA_BIT23;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 81f9cf294de..9ecca93392e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -1842,7 +1842,7 @@ static const u32 ar9300_2p2_soc_preamble[][2] = {
 
 static const u32 ar9300PciePhy_pll_on_clkreq_disable_L1_2p2[][2] = {
         /* Addr      allmodes  */
-        {0x00004040, 0x08212e5e},
+        {0x00004040, 0x0821265e},
         {0x00004040, 0x0008003b},
         {0x00004044, 0x00000000},
 };
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 6137634e46c..06fb2c85053 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -146,8 +146,8 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                 /* Sleep Setting */
 
                 INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
-                                ar9300PciePhy_clkreq_enable_L1_2p2,
-                                ARRAY_SIZE(ar9300PciePhy_clkreq_enable_L1_2p2),
+                                ar9300PciePhy_pll_on_clkreq_disable_L1_2p2,
+                                ARRAY_SIZE(ar9300PciePhy_pll_on_clkreq_disable_L1_2p2),
                                 2);
 
                 /* Fast clock modal settings */
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 1ce506f2311..780ac5eac50 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -78,7 +78,7 @@ struct tx_frame_hdr {
         u8 node_idx;
         u8 vif_idx;
         u8 tidno;
-        u32 flags; /* ATH9K_HTC_TX_* */
+        __be32 flags; /* ATH9K_HTC_TX_* */
         u8 key_type;
         u8 keyix;
         u8 reserved[26];
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 38433f9bfe5..0352f0994ca 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -142,9 +142,6 @@ static void ath9k_deinit_priv(struct ath9k_htc_priv *priv)
 {
         ath9k_htc_exit_debug(priv->ah);
         ath9k_hw_deinit(priv->ah);
-        tasklet_kill(&priv->swba_tasklet);
-        tasklet_kill(&priv->rx_tasklet);
-        tasklet_kill(&priv->tx_tasklet);
         kfree(priv->ah);
         priv->ah = NULL;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index f4d576bc3cc..6bb59958f71 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1025,12 +1025,6 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         int ret = 0;
         u8 cmd_rsp;
 
-        /* Cancel all the running timers/work .. */
-        cancel_work_sync(&priv->fatal_work);
-        cancel_work_sync(&priv->ps_work);
-        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
-        ath9k_led_stop_brightness(priv);
-
         mutex_lock(&priv->mutex);
 
         if (priv->op_flags & OP_INVALID) {
@@ -1044,8 +1038,23 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
         WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
         WMI_CMD(WMI_STOP_RECV_CMDID);
+
+        tasklet_kill(&priv->swba_tasklet);
+        tasklet_kill(&priv->rx_tasklet);
+        tasklet_kill(&priv->tx_tasklet);
+
         skb_queue_purge(&priv->tx_queue);
 
+        mutex_unlock(&priv->mutex);
+
+        /* Cancel all the running timers/work .. */
+        cancel_work_sync(&priv->fatal_work);
+        cancel_work_sync(&priv->ps_work);
+        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
+        ath9k_led_stop_brightness(priv);
+
+        mutex_lock(&priv->mutex);
+
         /* Remove monitor interface here */
         if (ah->opmode == NL80211_IFTYPE_MONITOR) {
                 if (ath9k_htc_remove_monitor_interface(priv))
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 33f36029fa4..7a5ffca2195 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -113,6 +113,7 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
 
         if (ieee80211_is_data(fc)) {
                 struct tx_frame_hdr tx_hdr;
+                u32 flags = 0;
                 u8 *qc;
 
                 memset(&tx_hdr, 0, sizeof(struct tx_frame_hdr));
@@ -136,13 +137,14 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
                 /* Check for RTS protection */
                 if (priv->hw->wiphy->rts_threshold != (u32) -1)
                         if (skb->len > priv->hw->wiphy->rts_threshold)
-                                tx_hdr.flags |= ATH9K_HTC_TX_RTSCTS;
+                                flags |= ATH9K_HTC_TX_RTSCTS;
 
                 /* CTS-to-self */
-                if (!(tx_hdr.flags & ATH9K_HTC_TX_RTSCTS) &&
+                if (!(flags & ATH9K_HTC_TX_RTSCTS) &&
                     (priv->op_flags & OP_PROTECT_ENABLE))
-                        tx_hdr.flags |= ATH9K_HTC_TX_CTSONLY;
+                        flags |= ATH9K_HTC_TX_CTSONLY;
 
+                tx_hdr.flags = cpu_to_be32(flags);
                 tx_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
                 if (tx_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
                         tx_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1afb8bb8575..9f01e50d5cd 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -369,6 +369,9 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         else
                 ah->config.ht_enable = 0;
 
+        /* PAPRD needs some more work to be enabled */
+        ah->config.paprd_disable = 1;
+
         ah->config.rx_intr_mitigation = true;
         ah->config.pcieSerDesWrite = true;
 
@@ -1933,7 +1936,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->rx_status_len = sizeof(struct ar9003_rxs);
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
-                if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                if (!ah->config.paprd_disable &&
+                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 5a3dfec45e9..ea9fde67064 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -225,6 +225,7 @@ struct ath9k_ops_config {
         u32 pcie_waen;
         u8 analog_shiftreg;
         u8 ht_enable;
+        u8 paprd_disable;
         u32 ofdm_trig_low;
         u32 ofdm_trig_high;
         u32 cck_trig_high;
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 767d8b86f1e..087a6a95edd 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -598,8 +598,6 @@ err_btcoex:
 err_queues:
         ath9k_hw_deinit(ah);
 err_hw:
-        tasklet_kill(&sc->intr_tq);
-        tasklet_kill(&sc->bcon_tasklet);
 
         kfree(ah);
         sc->sc_ah = NULL;
@@ -807,9 +805,6 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
 
         ath9k_hw_deinit(sc->sc_ah);
 
-        tasklet_kill(&sc->intr_tq);
-        tasklet_kill(&sc->bcon_tasklet);
-
         kfree(sc->sc_ah);
         sc->sc_ah = NULL;
 }
@@ -824,6 +819,8 @@ void ath9k_deinit_device(struct ath_softc *sc)
         wiphy_rfkill_stop_polling(sc->hw->wiphy);
         ath_deinit_leds(sc);
 
+        ath9k_ps_restore(sc);
+
         for (i = 0; i < sc->num_sec_wiphy; i++) {
                 struct ath_wiphy *aphy = sc->sec_wiphy[i];
                 if (aphy == NULL)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index f90a6ca94a7..9040c2ff190 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -325,6 +325,8 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
 {
         struct ieee80211_hw *hw = sc->hw;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_tx_control txctl;
         int time_left;
 
@@ -342,8 +344,12 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
         init_completion(&sc->paprd_complete);
         sc->paprd_pending = true;
         txctl.paprd = BIT(chain);
-        if (ath_tx_start(hw, skb, &txctl) != 0)
+
+        if (ath_tx_start(hw, skb, &txctl) != 0) {
+                ath_dbg(common, ATH_DBG_XMIT, "PAPRD TX failed\n");
+                dev_kfree_skb_any(skb);
                 return false;
+        }
 
         time_left = wait_for_completion_timeout(&sc->paprd_complete,
                         msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
@@ -592,14 +598,12 @@ void ath9k_tasklet(unsigned long data)
         u32 status = sc->intrstatus;
         u32 rxmask;
 
-        ath9k_ps_wakeup(sc);
-
         if (status & ATH9K_INT_FATAL) {
                 ath_reset(sc, true);
-                ath9k_ps_restore(sc);
                 return;
         }
 
+        ath9k_ps_wakeup(sc);
         spin_lock(&sc->sc_pcu_lock);
 
         if (!ath9k_hw_check_alive(ah))
@@ -955,8 +959,6 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
 
         spin_unlock_bh(&sc->sc_pcu_lock);
         ath9k_ps_restore(sc);
-
-        ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
 }
 
 int ath_reset(struct ath_softc *sc, bool retry_tx)
@@ -969,6 +971,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         /* Stop ANI */
         del_timer_sync(&common->ani.timer);
 
+        ath9k_ps_wakeup(sc);
         spin_lock_bh(&sc->sc_pcu_lock);
 
         ieee80211_stop_queues(hw);
@@ -1015,6 +1018,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
 
         /* Start ANI */
         ath_start_ani(common);
+        ath9k_ps_restore(sc);
 
         return r;
 }
@@ -1309,6 +1313,9 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         spin_lock_bh(&sc->sc_pcu_lock);
 
+        /* prevent tasklets to enable interrupts once we disable them */
+        ah->imask &= ~ATH9K_INT_GLOBAL;
+
         /* make sure h/w will not generate any interrupt
          * before setting the invalid flag. */
         ath9k_hw_disable_interrupts(ah);
@@ -1326,6 +1333,12 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         spin_unlock_bh(&sc->sc_pcu_lock);
 
+        /* we can now sync irq and kill any running tasklets, since we already
+         * disabled interrupts and not holding a spin lock */
+        synchronize_irq(sc->irq);
+        tasklet_kill(&sc->intr_tq);
+        tasklet_kill(&sc->bcon_tasklet);
+
         ath9k_ps_restore(sc);
 
         sc->ps_idle = true;
@@ -1701,7 +1714,9 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 skip_chan_change:
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
                 sc->config.txpowlimit = 2 * conf->power_level;
+                ath9k_ps_wakeup(sc);
                 ath_update_txpow(sc);
+                ath9k_ps_restore(sc);
         }
 
         spin_lock_bh(&sc->wiphy_lock);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 332d1feb5c1..33a37edbaf7 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2113,9 +2113,7 @@ static void ath_tx_complete_poll_work(struct work_struct *work)
         if (needreset) {
                 ath_dbg(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
                         "tx hung, resetting the chip\n");
-                ath9k_ps_wakeup(sc);
                 ath_reset(sc, true);
-                ath9k_ps_restore(sc);
         }
 
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 3f1e5f1bf84..91a9f525346 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2624,6 +2624,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .fw_name_pre = IWL4965_FW_PRE,
         .ucode_api_max = IWL4965_UCODE_API_MAX,
         .ucode_api_min = IWL4965_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
index 97906dd442e..27b5a3eec9d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
@@ -152,11 +152,14 @@ int iwl_eeprom_check_sku(struct iwl_priv *priv)
 
         eeprom_sku = iwl_eeprom_query16(priv, EEPROM_SKU_CAP);
 
-        priv->cfg->sku = ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
+        if (!priv->cfg->sku) {
+                /* not using sku overwrite */
+                priv->cfg->sku =
+                        ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
                         EEPROM_SKU_CAP_BAND_POS);
-        if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
-                priv->cfg->sku |= IWL_SKU_N;
-
+                if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
+                        priv->cfg->sku |= IWL_SKU_N;
+        }
         if (!priv->cfg->sku) {
                 IWL_ERR(priv, "Invalid device sku\n");
                 return -EINVAL;
@@ -168,7 +171,7 @@ int iwl_eeprom_check_sku(struct iwl_priv *priv)
                 /* not using .cfg overwrite */
                 radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
                 priv->cfg->valid_tx_ant = EEPROM_RF_CFG_TX_ANT_MSK(radio_cfg);
-                priv->cfg->valid_rx_ant = EEPROM_RF_CFG_TX_ANT_MSK(radio_cfg);
+                priv->cfg->valid_rx_ant = EEPROM_RF_CFG_RX_ANT_MSK(radio_cfg);
                 if (!priv->cfg->valid_tx_ant || !priv->cfg->valid_rx_ant) {
                         IWL_ERR(priv, "Invalid chain (0X%x, 0X%x)\n",
                                 priv->cfg->valid_tx_ant,
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index 13a69ebf2a9..5091d77e02c 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -126,6 +126,7 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
         ndev = alloc_netdev_mq(0, "wlan%d", ether_setup, IWM_TX_QUEUES);
         if (!ndev) {
                 dev_err(dev, "no memory for network device instance\n");
+                ret = -ENOMEM;
                 goto out_priv;
         }
 
@@ -138,6 +139,7 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
                                     GFP_KERNEL);
         if (!iwm->umac_profile) {
                 dev_err(dev, "Couldn't alloc memory for profile\n");
+                ret = -ENOMEM;
                 goto out_profile;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00firmware.c b/drivers/net/wireless/rt2x00/rt2x00firmware.c
index f0e1eb72bef..be0ff78c1b1 100644
--- a/drivers/net/wireless/rt2x00/rt2x00firmware.c
+++ b/drivers/net/wireless/rt2x00/rt2x00firmware.c
@@ -58,6 +58,7 @@ static int rt2x00lib_request_firmware(struct rt2x00_dev *rt2x00dev)
 
         if (!fw || !fw->size || !fw->data) {
                 ERROR(rt2x00dev, "Failed to read Firmware.\n");
+                release_firmware(fw);
                 return -ENOENT;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 0b4e8590cbb..029be3c6c03 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2446,6 +2446,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index b8433f3a9bc..62876cd5c41 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -726,9 +726,9 @@ static int efuse_pg_packet_read(struct ieee80211_hw *hw, u8 offset, u8 *data)
 }
 
 static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
-                                u8 efuse_data, u8 offset, int *bcontinual,
-                                u8 *write_state, struct pgpkt_struct target_pkt,
-                                int *repeat_times, int *bresult, u8 word_en)
+                        u8 efuse_data, u8 offset, int *bcontinual,
+                        u8 *write_state, struct pgpkt_struct *target_pkt,
+                        int *repeat_times, int *bresult, u8 word_en)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct pgpkt_struct tmp_pkt;
@@ -744,8 +744,8 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
         tmp_pkt.word_en = tmp_header & 0x0F;
         tmp_word_cnts = efuse_calculate_word_cnts(tmp_pkt.word_en);
 
-        if (tmp_pkt.offset != target_pkt.offset) {
-                efuse_addr = efuse_addr + (tmp_word_cnts * 2) + 1;
+        if (tmp_pkt.offset != target_pkt->offset) {
+                *efuse_addr = *efuse_addr + (tmp_word_cnts * 2) + 1;
                 *write_state = PG_STATE_HEADER;
         } else {
                 for (tmpindex = 0; tmpindex < (tmp_word_cnts * 2); tmpindex++) {
@@ -756,23 +756,23 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                 }
 
                 if (bdataempty == false) {
-                        efuse_addr = efuse_addr + (tmp_word_cnts * 2) + 1;
+                        *efuse_addr = *efuse_addr + (tmp_word_cnts * 2) + 1;
                         *write_state = PG_STATE_HEADER;
                 } else {
                         match_word_en = 0x0F;
-                        if (!((target_pkt.word_en & BIT(0)) |
+                        if (!((target_pkt->word_en & BIT(0)) |
                              (tmp_pkt.word_en & BIT(0))))
                                 match_word_en &= (~BIT(0));
 
-                        if (!((target_pkt.word_en & BIT(1)) |
+                        if (!((target_pkt->word_en & BIT(1)) |
                              (tmp_pkt.word_en & BIT(1))))
                                 match_word_en &= (~BIT(1));
 
-                        if (!((target_pkt.word_en & BIT(2)) |
+                        if (!((target_pkt->word_en & BIT(2)) |
                              (tmp_pkt.word_en & BIT(2))))
                                 match_word_en &= (~BIT(2));
 
-                        if (!((target_pkt.word_en & BIT(3)) |
+                        if (!((target_pkt->word_en & BIT(3)) |
                              (tmp_pkt.word_en & BIT(3))))
                                 match_word_en &= (~BIT(3));
 
@@ -780,7 +780,7 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                 badworden = efuse_word_enable_data_write(
                                                             hw, *efuse_addr + 1,
                                                             tmp_pkt.word_en,
-                                                            target_pkt.data);
+                                                            target_pkt->data);
 
                                 if (0x0F != (badworden & 0x0F)) {
                                         u8 reorg_offset = offset;
@@ -791,26 +791,26 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                 }
 
                                 tmp_word_en = 0x0F;
-                                if ((target_pkt.word_en & BIT(0)) ^
+                                if ((target_pkt->word_en & BIT(0)) ^
                                     (match_word_en & BIT(0)))
                                         tmp_word_en &= (~BIT(0));
 
-                                if ((target_pkt.word_en & BIT(1)) ^
+                                if ((target_pkt->word_en & BIT(1)) ^
                                     (match_word_en & BIT(1)))
                                         tmp_word_en &= (~BIT(1));
 
-                                if ((target_pkt.word_en & BIT(2)) ^
+                                if ((target_pkt->word_en & BIT(2)) ^
                                         (match_word_en & BIT(2)))
                                         tmp_word_en &= (~BIT(2));
 
-                                if ((target_pkt.word_en & BIT(3)) ^
+                                if ((target_pkt->word_en & BIT(3)) ^
                                     (match_word_en & BIT(3)))
                                         tmp_word_en &= (~BIT(3));
 
                                 if ((tmp_word_en & 0x0F) != 0x0F) {
                                         *efuse_addr = efuse_get_current_size(hw);
-                                        target_pkt.offset = offset;
-                                        target_pkt.word_en = tmp_word_en;
+                                        target_pkt->offset = offset;
+                                        target_pkt->word_en = tmp_word_en;
                                 } else
                                         *bcontinual = false;
                                 *write_state = PG_STATE_HEADER;
@@ -821,8 +821,8 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                 }
                         } else {
                                 *efuse_addr += (2 * tmp_word_cnts) + 1;
-                                target_pkt.offset = offset;
-                                target_pkt.word_en = word_en;
+                                target_pkt->offset = offset;
+                                target_pkt->word_en = word_en;
                                 *write_state = PG_STATE_HEADER;
                         }
                 }
@@ -938,7 +938,7 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
                                 efuse_write_data_case1(hw, &efuse_addr,
                                                        efuse_data, offset,
                                                        &bcontinual,
-                                                       &write_state, target_pkt,
+                                                       &write_state, &target_pkt,
                                                        &repeat_times, &bresult,
                                                        word_en);
                         else
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 0fa36aa6701..1758d446324 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -619,6 +619,13 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                         struct sk_buff *uskb = NULL;
                                         u8 *pdata;
                                         uskb = dev_alloc_skb(skb->len + 128);
+                                        if (!uskb) {
+                                                RT_TRACE(rtlpriv,
+                                                        (COMP_INTR | COMP_RECV),
+                                                        DBG_EMERG,
+                                                        ("can't alloc rx skb\n"));
+                                                goto done;
+                                        }
                                         memcpy(IEEE80211_SKB_RXCB(uskb),
                                                         &rx_status,
                                                         sizeof(rx_status));
@@ -641,7 +648,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
                         if (unlikely(!new_skb)) {
                                 RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),
-                                         DBG_DMESG,
+                                         DBG_EMERG,
                                          ("can't alloc skb for rx\n"));
                                 goto done;
                         }
@@ -1066,9 +1073,9 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw)
                         struct sk_buff *skb =
                             dev_alloc_skb(rtlpci->rxbuffersize);
                         u32 bufferaddress;
-                        entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
                         if (!skb)
                                 return 0;
+                        entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
 
                         /*skb->dev = dev; */
 
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 46714910f98..7145ea54378 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -110,9 +110,8 @@ static void wl1271_spi_reset(struct wl1271 *wl)
         spi_message_add_tail(&t, &m);
 
         spi_sync(wl_to_spi(wl), &m);
-        kfree(cmd);
-
         wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+        kfree(cmd);
 }
 
 static void wl1271_spi_init(struct wl1271 *wl)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 546de574982..da1f1212034 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -120,6 +120,9 @@ struct netfront_info {
         unsigned long rx_pfn_array[NET_RX_RING_SIZE];
         struct multicall_entry rx_mcl[NET_RX_RING_SIZE+1];
         struct mmu_update rx_mmu[NET_RX_RING_SIZE];
+
+        /* Statistics */
+        int rx_gso_checksum_fixup;
 };
 
 struct netfront_rx_info {
@@ -770,11 +773,29 @@ static RING_IDX xennet_fill_frags(struct netfront_info *np,
         return cons;
 }
 
-static int skb_checksum_setup(struct sk_buff *skb)
+static int checksum_setup(struct net_device *dev, struct sk_buff *skb)
 {
         struct iphdr *iph;
         unsigned char *th;
         int err = -EPROTO;
+        int recalculate_partial_csum = 0;
+
+        /*
+         * A GSO SKB must be CHECKSUM_PARTIAL. However some buggy
+         * peers can fail to set NETRXF_csum_blank when sending a GSO
+         * frame. In this case force the SKB to CHECKSUM_PARTIAL and
+         * recalculate the partial checksum.
+         */
+        if (skb->ip_summed != CHECKSUM_PARTIAL && skb_is_gso(skb)) {
+                struct netfront_info *np = netdev_priv(dev);
+                np->rx_gso_checksum_fixup++;
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                recalculate_partial_csum = 1;
+        }
+
+        /* A non-CHECKSUM_PARTIAL SKB does not require setup. */
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                return 0;
 
         if (skb->protocol != htons(ETH_P_IP))
                 goto out;
@@ -788,9 +809,23 @@ static int skb_checksum_setup(struct sk_buff *skb)
         switch (iph->protocol) {
         case IPPROTO_TCP:
                 skb->csum_offset = offsetof(struct tcphdr, check);
+
+                if (recalculate_partial_csum) {
+                        struct tcphdr *tcph = (struct tcphdr *)th;
+                        tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                         skb->len - iph->ihl*4,
+                                                         IPPROTO_TCP, 0);
+                }
                 break;
         case IPPROTO_UDP:
                 skb->csum_offset = offsetof(struct udphdr, check);
+
+                if (recalculate_partial_csum) {
+                        struct udphdr *udph = (struct udphdr *)th;
+                        udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                         skb->len - iph->ihl*4,
+                                                         IPPROTO_UDP, 0);
+                }
                 break;
         default:
                 if (net_ratelimit())
@@ -829,13 +864,11 @@ static int handle_incoming_queue(struct net_device *dev,
                 /* Ethernet work: Delayed to here as it peeks the header. */
                 skb->protocol = eth_type_trans(skb, dev);
 
-                if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                        if (skb_checksum_setup(skb)) {
-                                kfree_skb(skb);
-                                packets_dropped++;
-                                dev->stats.rx_errors++;
-                                continue;
-                        }
+                if (checksum_setup(dev, skb)) {
+                        kfree_skb(skb);
+                        packets_dropped++;
+                        dev->stats.rx_errors++;
+                        continue;
                 }
 
                 dev->stats.rx_packets++;
@@ -1632,12 +1665,59 @@ static void netback_changed(struct xenbus_device *dev,
         }
 }
 
+static const struct xennet_stat {
+        char name[ETH_GSTRING_LEN];
+        u16 offset;
+} xennet_stats[] = {
+        {
+                "rx_gso_checksum_fixup",
+                offsetof(struct netfront_info, rx_gso_checksum_fixup)
+        },
+};
+
+static int xennet_get_sset_count(struct net_device *dev, int string_set)
+{
+        switch (string_set) {
+        case ETH_SS_STATS:
+                return ARRAY_SIZE(xennet_stats);
+        default:
+                return -EINVAL;
+        }
+}
+
+static void xennet_get_ethtool_stats(struct net_device *dev,
+                                     struct ethtool_stats *stats, u64 * data)
+{
+        void *np = netdev_priv(dev);
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(xennet_stats); i++)
+                data[i] = *(int *)(np + xennet_stats[i].offset);
+}
+
+static void xennet_get_strings(struct net_device *dev, u32 stringset, u8 * data)
+{
+        int i;
+
+        switch (stringset) {
+        case ETH_SS_STATS:
+                for (i = 0; i < ARRAY_SIZE(xennet_stats); i++)
+                        memcpy(data + i * ETH_GSTRING_LEN,
+                               xennet_stats[i].name, ETH_GSTRING_LEN);
+                break;
+        }
+}
+
 static const struct ethtool_ops xennet_ethtool_ops =
 {
         .set_tx_csum = ethtool_op_set_tx_csum,
         .set_sg = xennet_set_sg,
         .set_tso = xennet_set_tso,
         .get_link = ethtool_op_get_link,
+
+        .get_sset_count = xennet_get_sset_count,
+        .get_ethtool_stats = xennet_get_ethtool_stats,
+        .get_strings = xennet_get_strings,
 };
 
 #ifdef CONFIG_SYSFS
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index a2d9d1e5926..a848e02e6be 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -678,7 +678,7 @@ void parport_unregister_device(struct pardevice *dev)
 
         /* Make sure we haven't left any pointers around in the wait
          * list. */
-        spin_lock (&port->waitlist_lock);
+        spin_lock_irq(&port->waitlist_lock);
         if (dev->waitprev || dev->waitnext || port->waithead == dev) {
                 if (dev->waitprev)
                         dev->waitprev->waitnext = dev->waitnext;
@@ -689,7 +689,7 @@ void parport_unregister_device(struct pardevice *dev)
                 else
                         port->waittail = dev->waitprev;
         }
-        spin_unlock (&port->waitlist_lock);
+        spin_unlock_irq(&port->waitlist_lock);
 
         kfree(dev->state);
         kfree(dev);
diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig
index dda70981b7a..dc29348264c 100644
--- a/drivers/pci/pcie/Kconfig
+++ b/drivers/pci/pcie/Kconfig
@@ -31,7 +31,7 @@ source "drivers/pci/pcie/aer/Kconfig"
 # PCI Express ASPM
 #
 config PCIEASPM
-        bool "PCI Express ASPM control" if EMBEDDED
+        bool "PCI Express ASPM control" if EXPERT
         depends on PCI && PCIEPORTBUS
         default y
         help
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index de886f3dfd3..6e318ce4113 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -69,7 +69,7 @@ comment "PC-card bridges"
 config YENTA
         tristate "CardBus yenta-compatible bridge support"
         depends on PCI
-        select CARDBUS if !EMBEDDED
+        select CARDBUS if !EXPERT
         select PCCARD_NONSTATIC if PCMCIA != n
         ---help---
           This option enables support for CardBus host bridges.  Virtually
@@ -84,27 +84,27 @@ config YENTA
 
 config YENTA_O2
         default y
-        bool "Special initialization for O2Micro bridges" if EMBEDDED
+        bool "Special initialization for O2Micro bridges" if EXPERT
         depends on YENTA
 
 config YENTA_RICOH
         default y
-        bool "Special initialization for Ricoh bridges" if EMBEDDED
+        bool "Special initialization for Ricoh bridges" if EXPERT
         depends on YENTA
 
 config YENTA_TI
         default y
-        bool "Special initialization for TI and EnE bridges" if EMBEDDED
+        bool "Special initialization for TI and EnE bridges" if EXPERT
         depends on YENTA
 
 config YENTA_ENE_TUNE
         default y
-        bool "Auto-tune EnE bridges for CB cards" if EMBEDDED
+        bool "Auto-tune EnE bridges for CB cards" if EXPERT
         depends on YENTA_TI && CARDBUS
 
 config YENTA_TOSHIBA
         default y
-        bool "Special initialization for Toshiba ToPIC bridges" if EMBEDDED
+        bool "Special initialization for Toshiba ToPIC bridges" if EXPERT
         depends on YENTA
 
 config PD6729
diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
index 1752ef006d2..a91d510a798 100644
--- a/drivers/platform/x86/intel_scu_ipc.c
+++ b/drivers/platform/x86/intel_scu_ipc.c
@@ -26,7 +26,6 @@
 #include <linux/sfi.h>
 #include <asm/mrst.h>
 #include <asm/intel_scu_ipc.h>
-#include <asm/mrst.h>
 
 /* IPC defines the following message types */
 #define IPCMSG_WATCHDOG_TIMER 0xF8 /* Set Kernel Watchdog Threshold */
@@ -161,7 +160,7 @@ static int pwr_reg_rdwr(u16 *addr, u8 *data, u32 count, u32 op, u32 id)
 {
         int i, nc, bytes, d;
         u32 offset = 0;
-        u32 err = 0;
+        int err;
         u8 cbuf[IPC_WWBUF_SIZE] = { };
         u32 *wbuf = (u32 *)&cbuf;
 
@@ -404,7 +403,7 @@ EXPORT_SYMBOL(intel_scu_ipc_update_register);
  */
 int intel_scu_ipc_simple_command(int cmd, int sub)
 {
-        u32 err = 0;
+        int err;
 
         mutex_lock(&ipclock);
         if (ipcdev.pdev == NULL) {
@@ -434,8 +433,7 @@ EXPORT_SYMBOL(intel_scu_ipc_simple_command);
 int intel_scu_ipc_command(int cmd, int sub, u32 *in, int inlen,
                                                         u32 *out, int outlen)
 {
-        u32 err = 0;
-        int i = 0;
+        int i, err;
 
         mutex_lock(&ipclock);
         if (ipcdev.pdev == NULL) {
diff --git a/drivers/platform/x86/intel_scu_ipcutil.c b/drivers/platform/x86/intel_scu_ipcutil.c
index ba3231d0819..b93a03259c1 100644
--- a/drivers/platform/x86/intel_scu_ipcutil.c
+++ b/drivers/platform/x86/intel_scu_ipcutil.c
@@ -128,6 +128,6 @@ static void __exit ipc_module_exit(void)
 module_init(ipc_module_init);
 module_exit(ipc_module_exit);
 
-MODULE_LICENSE("GPL V2");
+MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Utility driver for intel scu ipc");
 MODULE_AUTHOR("Sreedhara <sreedhara.ds@intel.com>");
diff --git a/drivers/pps/clients/pps-ktimer.c b/drivers/pps/clients/pps-ktimer.c
index 2728469d388..82583b0ff82 100644
--- a/drivers/pps/clients/pps-ktimer.c
+++ b/drivers/pps/clients/pps-ktimer.c
@@ -46,8 +46,6 @@ static void pps_ktimer_event(unsigned long ptr)
         /* First of all we get the time stamp... */
         pps_get_ts(&ts);
 
-        dev_info(pps->dev, "PPS event at %lu\n", jiffies);
-
         pps_event(pps, &ts, PPS_CAPTUREASSERT, NULL);
 
         mod_timer(&ktimer, jiffies + HZ);
diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c
index 32221efd9ca..c571d6dd8f6 100644
--- a/drivers/pps/clients/pps_parport.c
+++ b/drivers/pps/clients/pps_parport.c
@@ -163,7 +163,7 @@ static void parport_attach(struct parport *port)
         }
 
         device->pardev = parport_register_device(port, KBUILD_MODNAME,
-                        NULL, NULL, parport_irq, 0, device);
+                        NULL, NULL, parport_irq, PARPORT_FLAG_EXCL, device);
         if (!device->pardev) {
                 pr_err("couldn't register with %s\n", port->name);
                 goto err_free;
diff --git a/drivers/pps/generators/pps_gen_parport.c b/drivers/pps/generators/pps_gen_parport.c
index 5c32f8dacf5..b93af3ebb5b 100644
--- a/drivers/pps/generators/pps_gen_parport.c
+++ b/drivers/pps/generators/pps_gen_parport.c
@@ -198,7 +198,7 @@ static void parport_attach(struct parport *port)
         }
 
         device.pardev = parport_register_device(port, KBUILD_MODNAME,
-                        NULL, NULL, NULL, 0, &device);
+                        NULL, NULL, NULL, PARPORT_FLAG_EXCL, &device);
         if (!device.pardev) {
                 pr_err("couldn't register with %s\n", port->name);
                 return;
diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index 467e82bd092..a50391b6ba2 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -943,6 +943,8 @@ static int rio_enum_complete(struct rio_mport *port)
  * @port: Master port to send transactions
  * @destid: Current destination ID in network
  * @hopcount: Number of hops into the network
+ * @prev: previous rio_dev
+ * @prev_port: previous port number
  *
  * Recursively discovers a RIO network.  Transactions are sent via the
  * master port passed in @port.
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 4941cade319..cdd97192dc6 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -97,18 +97,6 @@ config RTC_INTF_DEV
 
           If unsure, say Y.
 
-config RTC_INTF_DEV_UIE_EMUL
-        bool "RTC UIE emulation on dev interface"
-        depends on RTC_INTF_DEV
-        help
-          Provides an emulation for RTC_UIE if the underlying rtc chip
-          driver does not expose RTC_UIE ioctls. Those requests generate
-          once-per-second update interrupts, used for synchronization.
-
-          The emulation code will read the time from the hardware
-          clock several times per second, please enable this option
-          only if you know that you really need it.
-
 config RTC_DRV_TEST
         tristate "Test driver/device"
         help
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index 9583cbcc6b7..c404b61386b 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -143,6 +143,7 @@ struct rtc_device *rtc_device_register(const char *name, struct device *dev,
         rtc->id = id;
         rtc->ops = ops;
         rtc->owner = owner;
+        rtc->irq_freq = 1;
         rtc->max_user_freq = 64;
         rtc->dev.parent = dev;
         rtc->dev.class = rtc_class;
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 90384b9f6b2..a0c01967244 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -16,6 +16,9 @@
 #include <linux/log2.h>
 #include <linux/workqueue.h>
 
+static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer);
+static void rtc_timer_remove(struct rtc_device *rtc, struct rtc_timer *timer);
+
 static int __rtc_read_time(struct rtc_device *rtc, struct rtc_time *tm)
 {
         int err;
@@ -120,12 +123,18 @@ int rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
         err = mutex_lock_interruptible(&rtc->ops_lock);
         if (err)
                 return err;
-        alarm->enabled = rtc->aie_timer.enabled;
-        if (alarm->enabled)
+        if (rtc->ops == NULL)
+                err = -ENODEV;
+        else if (!rtc->ops->read_alarm)
+                err = -EINVAL;
+        else {
+                memset(alarm, 0, sizeof(struct rtc_wkalrm));
+                alarm->enabled = rtc->aie_timer.enabled;
                 alarm->time = rtc_ktime_to_tm(rtc->aie_timer.node.expires);
+        }
         mutex_unlock(&rtc->ops_lock);
 
-        return 0;
+        return err;
 }
 EXPORT_SYMBOL_GPL(rtc_read_alarm);
 
@@ -175,16 +184,14 @@ int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
                 return err;
         if (rtc->aie_timer.enabled) {
                 rtc_timer_remove(rtc, &rtc->aie_timer);
-                rtc->aie_timer.enabled = 0;
         }
         rtc->aie_timer.node.expires = rtc_tm_to_ktime(alarm->time);
         rtc->aie_timer.period = ktime_set(0, 0);
         if (alarm->enabled) {
-                rtc->aie_timer.enabled = 1;
-                rtc_timer_enqueue(rtc, &rtc->aie_timer);
+                err = rtc_timer_enqueue(rtc, &rtc->aie_timer);
         }
         mutex_unlock(&rtc->ops_lock);
-        return 0;
+        return err;
 }
 EXPORT_SYMBOL_GPL(rtc_set_alarm);
 
@@ -195,15 +202,15 @@ int rtc_alarm_irq_enable(struct rtc_device *rtc, unsigned int enabled)
                 return err;
 
         if (rtc->aie_timer.enabled != enabled) {
-                if (enabled) {
-                        rtc->aie_timer.enabled = 1;
-                        rtc_timer_enqueue(rtc, &rtc->aie_timer);
-                } else {
+                if (enabled)
+                        err = rtc_timer_enqueue(rtc, &rtc->aie_timer);
+                else
                         rtc_timer_remove(rtc, &rtc->aie_timer);
-                        rtc->aie_timer.enabled = 0;
-                }
         }
 
+        if (err)
+                return err;
+
         if (!rtc->ops)
                 err = -ENODEV;
         else if (!rtc->ops->alarm_irq_enable)
@@ -235,12 +242,9 @@ int rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled)
                 now = rtc_tm_to_ktime(tm);
                 rtc->uie_rtctimer.node.expires = ktime_add(now, onesec);
                 rtc->uie_rtctimer.period = ktime_set(1, 0);
-                rtc->uie_rtctimer.enabled = 1;
-                rtc_timer_enqueue(rtc, &rtc->uie_rtctimer);
-        } else {
+                err = rtc_timer_enqueue(rtc, &rtc->uie_rtctimer);
+        } else
                 rtc_timer_remove(rtc, &rtc->uie_rtctimer);
-                rtc->uie_rtctimer.enabled = 0;
-        }
 
 out:
         mutex_unlock(&rtc->ops_lock);
@@ -460,6 +464,9 @@ int rtc_irq_set_freq(struct rtc_device *rtc, struct rtc_task *task, int freq)
         int err = 0;
         unsigned long flags;
 
+        if (freq <= 0)
+                return -EINVAL;
+
         spin_lock_irqsave(&rtc->irq_task_lock, flags);
         if (rtc->irq_task != NULL && task == NULL)
                 err = -EBUSY;
@@ -488,10 +495,13 @@ EXPORT_SYMBOL_GPL(rtc_irq_set_freq);
  * Enqueues a timer onto the rtc devices timerqueue and sets
  * the next alarm event appropriately.
  *
+ * Sets the enabled bit on the added timer.
+ *
  * Must hold ops_lock for proper serialization of timerqueue
  */
-void rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer)
+static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer)
 {
+        timer->enabled = 1;
         timerqueue_add(&rtc->timerqueue, &timer->node);
         if (&timer->node == timerqueue_getnext(&rtc->timerqueue)) {
                 struct rtc_wkalrm alarm;
@@ -501,7 +511,13 @@ void rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer)
                 err = __rtc_set_alarm(rtc, &alarm);
                 if (err == -ETIME)
                         schedule_work(&rtc->irqwork);
+                else if (err) {
+                        timerqueue_del(&rtc->timerqueue, &timer->node);
+                        timer->enabled = 0;
+                        return err;
+                }
         }
+        return 0;
 }
 
 /**
@@ -512,13 +528,15 @@ void rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer)
  * Removes a timer onto the rtc devices timerqueue and sets
  * the next alarm event appropriately.
  *
+ * Clears the enabled bit on the removed timer.
+ *
  * Must hold ops_lock for proper serialization of timerqueue
  */
-void rtc_timer_remove(struct rtc_device *rtc, struct rtc_timer *timer)
+static void rtc_timer_remove(struct rtc_device *rtc, struct rtc_timer *timer)
 {
         struct timerqueue_node *next = timerqueue_getnext(&rtc->timerqueue);
         timerqueue_del(&rtc->timerqueue, &timer->node);
-
+        timer->enabled = 0;
         if (next == &timer->node) {
                 struct rtc_wkalrm alarm;
                 int err;
@@ -626,8 +644,7 @@ int rtc_timer_start(struct rtc_device *rtc, struct rtc_timer* timer,
         timer->node.expires = expires;
         timer->period = period;
 
-        timer->enabled = 1;
-        rtc_timer_enqueue(rtc, timer);
+        ret = rtc_timer_enqueue(rtc, timer);
 
         mutex_unlock(&rtc->ops_lock);
         return ret;
@@ -645,7 +662,6 @@ int rtc_timer_cancel(struct rtc_device *rtc, struct rtc_timer* timer)
         mutex_lock(&rtc->ops_lock);
         if (timer->enabled)
                 rtc_timer_remove(rtc, timer);
-        timer->enabled = 0;
         mutex_unlock(&rtc->ops_lock);
         return ret;
 }
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 4155805dcdf..2b771f18d1a 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -319,6 +319,9 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
 
         private = (struct dasd_eckd_private *) device->private;
         lcu = private->lcu;
+        /* nothing to do if already disconnected */
+        if (!lcu)
+                return;
         device->discipline->get_uid(device, &uid);
         spin_lock_irqsave(&lcu->lock, flags);
         list_del_init(&device->alias_list);
@@ -680,6 +683,9 @@ int dasd_alias_remove_device(struct dasd_device *device)
 
         private = (struct dasd_eckd_private *) device->private;
         lcu = private->lcu;
+        /* nothing to do if already removed */
+        if (!lcu)
+                return 0;
         spin_lock_irqsave(&lcu->lock, flags);
         _remove_device_from_lcu(lcu, device);
         spin_unlock_irqrestore(&lcu->lock, flags);
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index e9fff2b9bce..5640c89cd9d 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -476,7 +476,7 @@ static inline void inbound_primed(struct qdio_q *q, int count)
 static int get_inbound_buffer_frontier(struct qdio_q *q)
 {
         int count, stop;
-        unsigned char state;
+        unsigned char state = 0;
 
         /*
          * Don't check 128 buffers, as otherwise qdio_inbound_q_moved
@@ -643,7 +643,7 @@ void qdio_inbound_processing(unsigned long data)
 static int get_outbound_buffer_frontier(struct qdio_q *q)
 {
         int count, stop;
-        unsigned char state;
+        unsigned char state = 0;
 
         if (need_siga_sync(q))
                 if (((queue_type(q) != QDIO_IQDIO_QFMT) &&
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index 65ebee0a326..b6a6356d09b 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -565,7 +565,7 @@ static int netiucv_callback_connreq(struct iucv_path *path,
         struct iucv_event ev;
         int rc;
 
-        if (memcmp(iucvMagic, ipuser, sizeof(ipuser)))
+        if (memcmp(iucvMagic, ipuser, 16))
                 /* ipuser must match iucvMagic. */
                 return -EINVAL;
         rc = -EINVAL;
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 29f848bfc12..019ae58ab91 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -988,16 +988,30 @@ static void qeth_get_channel_path_desc(struct qeth_card *card)
         chp_dsc = (struct channelPath_dsc *)ccw_device_get_chp_desc(ccwdev, 0);
         if (chp_dsc != NULL) {
                 /* CHPP field bit 6 == 1 -> single queue */
-                if ((chp_dsc->chpp & 0x02) == 0x02)
+                if ((chp_dsc->chpp & 0x02) == 0x02) {
+                        if ((atomic_read(&card->qdio.state) !=
+                                QETH_QDIO_UNINITIALIZED) &&
+                            (card->qdio.no_out_queues == 4))
+                                /* change from 4 to 1 outbound queues */
+                                qeth_free_qdio_buffers(card);
                         card->qdio.no_out_queues = 1;
+                        if (card->qdio.default_out_queue != 0)
+                                dev_info(&card->gdev->dev,
+                                        "Priority Queueing not supported\n");
+                        card->qdio.default_out_queue = 0;
+                } else {
+                        if ((atomic_read(&card->qdio.state) !=
+                                QETH_QDIO_UNINITIALIZED) &&
+                            (card->qdio.no_out_queues == 1)) {
+                                /* change from 1 to 4 outbound queues */
+                                qeth_free_qdio_buffers(card);
+                                card->qdio.default_out_queue = 2;
+                        }
+                        card->qdio.no_out_queues = 4;
+                }
                 card->info.func_level = 0x4100 + chp_dsc->desc;
                 kfree(chp_dsc);
         }
-        if (card->qdio.no_out_queues == 1) {
-                card->qdio.default_out_queue = 0;
-                dev_info(&card->gdev->dev,
-                        "Priority Queueing not supported\n");
-        }
         QETH_DBF_TEXT_(SETUP, 2, "nr:%x", card->qdio.no_out_queues);
         QETH_DBF_TEXT_(SETUP, 2, "lvl:%02x", card->info.func_level);
         return;
@@ -1832,33 +1846,6 @@ static inline int qeth_get_initial_mtu_for_card(struct qeth_card *card)
         }
 }
 
-static inline int qeth_get_max_mtu_for_card(int cardtype)
-{
-        switch (cardtype) {
-
-        case QETH_CARD_TYPE_UNKNOWN:
-        case QETH_CARD_TYPE_OSD:
-        case QETH_CARD_TYPE_OSN:
-        case QETH_CARD_TYPE_OSM:
-        case QETH_CARD_TYPE_OSX:
-                return 61440;
-        case QETH_CARD_TYPE_IQD:
-                return 57344;
-        default:
-                return 1500;
-        }
-}
-
-static inline int qeth_get_mtu_out_of_mpc(int cardtype)
-{
-        switch (cardtype) {
-        case QETH_CARD_TYPE_IQD:
-                return 1;
-        default:
-                return 0;
-        }
-}
-
 static inline int qeth_get_mtu_outof_framesize(int framesize)
 {
         switch (framesize) {
@@ -1881,10 +1868,9 @@ static inline int qeth_mtu_is_valid(struct qeth_card *card, int mtu)
         case QETH_CARD_TYPE_OSD:
         case QETH_CARD_TYPE_OSM:
         case QETH_CARD_TYPE_OSX:
-                return ((mtu >= 576) && (mtu <= 61440));
         case QETH_CARD_TYPE_IQD:
                 return ((mtu >= 576) &&
-                        (mtu <= card->info.max_mtu + 4096 - 32));
+                        (mtu <= card->info.max_mtu));
         case QETH_CARD_TYPE_OSN:
         case QETH_CARD_TYPE_UNKNOWN:
         default:
@@ -1907,7 +1893,7 @@ static int qeth_ulp_enable_cb(struct qeth_card *card, struct qeth_reply *reply,
         memcpy(&card->token.ulp_filter_r,
                QETH_ULP_ENABLE_RESP_FILTER_TOKEN(iob->data),
                QETH_MPC_TOKEN_LENGTH);
-        if (qeth_get_mtu_out_of_mpc(card->info.type)) {
+        if (card->info.type == QETH_CARD_TYPE_IQD) {
                 memcpy(&framesize, QETH_ULP_ENABLE_RESP_MAX_MTU(iob->data), 2);
                 mtu = qeth_get_mtu_outof_framesize(framesize);
                 if (!mtu) {
@@ -1915,12 +1901,21 @@ static int qeth_ulp_enable_cb(struct qeth_card *card, struct qeth_reply *reply,
                         QETH_DBF_TEXT_(SETUP, 2, "  rc%d", iob->rc);
                         return 0;
                 }
-                card->info.max_mtu = mtu;
+                if (card->info.initial_mtu && (card->info.initial_mtu != mtu)) {
+                        /* frame size has changed */
+                        if (card->dev &&
+                            ((card->dev->mtu == card->info.initial_mtu) ||
+                             (card->dev->mtu > mtu)))
+                                card->dev->mtu = mtu;
+                        qeth_free_qdio_buffers(card);
+                }
                 card->info.initial_mtu = mtu;
+                card->info.max_mtu = mtu;
                 card->qdio.in_buf_size = mtu + 2 * PAGE_SIZE;
         } else {
                 card->info.initial_mtu = qeth_get_initial_mtu_for_card(card);
-                card->info.max_mtu = qeth_get_max_mtu_for_card(card->info.type);
+                card->info.max_mtu = *(__u16 *)QETH_ULP_ENABLE_RESP_MAX_MTU(
+                        iob->data);
                 card->qdio.in_buf_size = QETH_IN_BUF_SIZE_DEFAULT;
         }
 
@@ -3775,6 +3770,47 @@ static inline int qeth_get_qdio_q_format(struct qeth_card *card)
         }
 }
 
+static void qeth_determine_capabilities(struct qeth_card *card)
+{
+        int rc;
+        int length;
+        char *prcd;
+        struct ccw_device *ddev;
+        int ddev_offline = 0;
+
+        QETH_DBF_TEXT(SETUP, 2, "detcapab");
+        ddev = CARD_DDEV(card);
+        if (!ddev->online) {
+                ddev_offline = 1;
+                rc = ccw_device_set_online(ddev);
+                if (rc) {
+                        QETH_DBF_TEXT_(SETUP, 2, "3err%d", rc);
+                        goto out;
+                }
+        }
+
+        rc = qeth_read_conf_data(card, (void **) &prcd, &length);
+        if (rc) {
+                QETH_DBF_MESSAGE(2, "%s qeth_read_conf_data returned %i\n",
+                        dev_name(&card->gdev->dev), rc);
+                QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc);
+                goto out_offline;
+        }
+        qeth_configure_unitaddr(card, prcd);
+        qeth_configure_blkt_default(card, prcd);
+        kfree(prcd);
+
+        rc = qdio_get_ssqd_desc(ddev, &card->ssqd);
+        if (rc)
+                QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+
+out_offline:
+        if (ddev_offline == 1)
+                ccw_device_set_offline(ddev);
+out:
+        return;
+}
+
 static int qeth_qdio_establish(struct qeth_card *card)
 {
         struct qdio_initialize init_data;
@@ -3905,6 +3941,7 @@ int qeth_core_hardsetup_card(struct qeth_card *card)
 
         QETH_DBF_TEXT(SETUP, 2, "hrdsetup");
         atomic_set(&card->force_alloc_skb, 0);
+        qeth_get_channel_path_desc(card);
 retry:
         if (retries)
                 QETH_DBF_MESSAGE(2, "%s Retrying to do IDX activates.\n",
@@ -3933,6 +3970,7 @@ retriable:
                 else
                         goto retry;
         }
+        qeth_determine_capabilities(card);
         qeth_init_tokens(card);
         qeth_init_func_level(card);
         rc = qeth_idx_activate_channel(&card->read, qeth_idx_read_cb);
@@ -4202,41 +4240,6 @@ void qeth_core_free_discipline(struct qeth_card *card)
         card->discipline.ccwgdriver = NULL;
 }
 
-static void qeth_determine_capabilities(struct qeth_card *card)
-{
-        int rc;
-        int length;
-        char *prcd;
-
-        QETH_DBF_TEXT(SETUP, 2, "detcapab");
-        rc = ccw_device_set_online(CARD_DDEV(card));
-        if (rc) {
-                QETH_DBF_TEXT_(SETUP, 2, "3err%d", rc);
-                goto out;
-        }
-
-
-        rc = qeth_read_conf_data(card, (void **) &prcd, &length);
-        if (rc) {
-                QETH_DBF_MESSAGE(2, "%s qeth_read_conf_data returned %i\n",
-                        dev_name(&card->gdev->dev), rc);
-                QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc);
-                goto out_offline;
-        }
-        qeth_configure_unitaddr(card, prcd);
-        qeth_configure_blkt_default(card, prcd);
-        kfree(prcd);
-
-        rc = qdio_get_ssqd_desc(CARD_DDEV(card), &card->ssqd);
-        if (rc)
-                QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
-
-out_offline:
-        ccw_device_set_offline(CARD_DDEV(card));
-out:
-        return;
-}
-
 static int qeth_core_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 7a7a1b66478..ada0fe78237 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -573,13 +573,13 @@ static int qeth_l2_send_setmac_cb(struct qeth_card *card,
                 case IPA_RC_L2_DUP_LAYER3_MAC:
                         dev_warn(&card->gdev->dev,
                                 "MAC address %pM already exists\n",
-                                card->dev->dev_addr);
+                                cmd->data.setdelmac.mac);
                         break;
                 case IPA_RC_L2_MAC_NOT_AUTH_BY_HYP:
                 case IPA_RC_L2_MAC_NOT_AUTH_BY_ADP:
                         dev_warn(&card->gdev->dev,
                                 "MAC address %pM is not authorized\n",
-                                card->dev->dev_addr);
+                                cmd->data.setdelmac.mac);
                         break;
                 default:
                         break;
@@ -831,12 +831,14 @@ tx_drop:
         return NETDEV_TX_OK;
 }
 
-static int qeth_l2_open(struct net_device *dev)
+static int __qeth_l2_open(struct net_device *dev)
 {
         struct qeth_card *card = dev->ml_priv;
         int rc = 0;
 
         QETH_CARD_TEXT(card, 4, "qethopen");
+        if (card->state == CARD_STATE_UP)
+                return rc;
         if (card->state != CARD_STATE_SOFTSETUP)
                 return -ENODEV;
 
@@ -857,6 +859,18 @@ static int qeth_l2_open(struct net_device *dev)
         return rc;
 }
 
+static int qeth_l2_open(struct net_device *dev)
+{
+        struct qeth_card *card = dev->ml_priv;
+
+        QETH_CARD_TEXT(card, 5, "qethope_");
+        if (qeth_wait_for_threads(card, QETH_RECOVER_THREAD)) {
+                QETH_CARD_TEXT(card, 3, "openREC");
+                return -ERESTARTSYS;
+        }
+        return __qeth_l2_open(dev);
+}
+
 static int qeth_l2_stop(struct net_device *dev)
 {
         struct qeth_card *card = dev->ml_priv;
@@ -1046,7 +1060,7 @@ contin:
         if (recover_flag == CARD_STATE_RECOVER) {
                 if (recovery_mode &&
                     card->info.type != QETH_CARD_TYPE_OSN) {
-                        qeth_l2_open(card->dev);
+                        __qeth_l2_open(card->dev);
                 } else {
                         rtnl_lock();
                         dev_open(card->dev);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index e227e465bfc..d09b0c44fc3 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -2998,7 +2998,9 @@ static inline void qeth_l3_hdr_csum(struct qeth_card *card,
          */
         if (iph->protocol == IPPROTO_UDP)
                 hdr->hdr.l3.ext_flags |= QETH_HDR_EXT_UDP;
-        hdr->hdr.l3.ext_flags |= QETH_HDR_EXT_CSUM_TRANSP_REQ;
+        hdr->hdr.l3.ext_flags |= QETH_HDR_EXT_CSUM_TRANSP_REQ |
+                QETH_HDR_EXT_CSUM_HDR_REQ;
+        iph->check = 0;
         if (card->options.performance_stats)
                 card->perf_stats.tx_csum++;
 }
@@ -3240,12 +3242,14 @@ tx_drop:
         return NETDEV_TX_OK;
 }
 
-static int qeth_l3_open(struct net_device *dev)
+static int __qeth_l3_open(struct net_device *dev)
 {
         struct qeth_card *card = dev->ml_priv;
         int rc = 0;
 
         QETH_CARD_TEXT(card, 4, "qethopen");
+        if (card->state == CARD_STATE_UP)
+                return rc;
         if (card->state != CARD_STATE_SOFTSETUP)
                 return -ENODEV;
         card->data.state = CH_STATE_UP;
@@ -3260,6 +3264,18 @@ static int qeth_l3_open(struct net_device *dev)
         return rc;
 }
 
+static int qeth_l3_open(struct net_device *dev)
+{
+        struct qeth_card *card = dev->ml_priv;
+
+        QETH_CARD_TEXT(card, 5, "qethope_");
+        if (qeth_wait_for_threads(card, QETH_RECOVER_THREAD)) {
+                QETH_CARD_TEXT(card, 3, "openREC");
+                return -ERESTARTSYS;
+        }
+        return __qeth_l3_open(dev);
+}
+
 static int qeth_l3_stop(struct net_device *dev)
 {
         struct qeth_card *card = dev->ml_priv;
@@ -3564,7 +3580,7 @@ contin:
                 netif_carrier_off(card->dev);
         if (recover_flag == CARD_STATE_RECOVER) {
                 if (recovery_mode)
-                        qeth_l3_open(card->dev);
+                        __qeth_l3_open(card->dev);
                 else {
                         rtnl_lock();
                         dev_open(card->dev);
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index 65e1cf10494..207b7d74244 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -60,7 +60,7 @@ static struct iucv_handler smsg_handler = {
 static int smsg_path_pending(struct iucv_path *path, u8 ipvmid[8],
                              u8 ipuser[16])
 {
-        if (strncmp(ipvmid, "*MSG    ", sizeof(ipvmid)) != 0)
+        if (strncmp(ipvmid, "*MSG    ", 8) != 0)
                 return -EINVAL;
         /* Path pending from *MSG. */
         return iucv_path_accept(path, &smsg_handler, "SMSGIUCV        ", NULL);
diff --git a/drivers/scsi/arcmsr/arcmsr.h b/drivers/scsi/arcmsr/arcmsr.h
index 475c31ae985..77b26f5b9c3 100644
--- a/drivers/scsi/arcmsr/arcmsr.h
+++ b/drivers/scsi/arcmsr/arcmsr.h
@@ -2,7 +2,7 @@
 *******************************************************************************
 **        O.S   : Linux
 **   FILE NAME  : arcmsr.h
-**        BY    : Erich Chen
+**        BY    : Nick Cheng
 **   Description: SCSI RAID Device Driver for
 **                ARECA RAID Host adapter
 *******************************************************************************
@@ -46,8 +46,12 @@
 struct device_attribute;
 /*The limit of outstanding scsi command that firmware can handle*/
 #define ARCMSR_MAX_OUTSTANDING_CMD                                              256
-#define ARCMSR_MAX_FREECCB_NUM                                                  320
-#define ARCMSR_DRIVER_VERSION                "Driver Version 1.20.00.15 2010/02/02"
+#ifdef CONFIG_XEN
+        #define ARCMSR_MAX_FREECCB_NUM  160
+#else
+        #define ARCMSR_MAX_FREECCB_NUM  320
+#endif
+#define ARCMSR_DRIVER_VERSION                "Driver Version 1.20.00.15 2010/08/05"
 #define ARCMSR_SCSI_INITIATOR_ID                                                255
 #define ARCMSR_MAX_XFER_SECTORS                                                 512
 #define ARCMSR_MAX_XFER_SECTORS_B                                               4096
@@ -60,7 +64,6 @@ struct device_attribute;
 #define ARCMSR_MAX_HBB_POSTQUEUE                                                264
 #define ARCMSR_MAX_XFER_LEN                                                     0x26000 /* 152K */
 #define ARCMSR_CDB_SG_PAGE_LENGTH                                               256 
-#define SCSI_CMD_ARECA_SPECIFIC                                         0xE1
 #ifndef PCI_DEVICE_ID_ARECA_1880
 #define PCI_DEVICE_ID_ARECA_1880 0x1880
  #endif
diff --git a/drivers/scsi/arcmsr/arcmsr_attr.c b/drivers/scsi/arcmsr/arcmsr_attr.c
index a4e04c50c43..acdae33de52 100644
--- a/drivers/scsi/arcmsr/arcmsr_attr.c
+++ b/drivers/scsi/arcmsr/arcmsr_attr.c
@@ -2,7 +2,7 @@
 *******************************************************************************
 **        O.S   : Linux
 **   FILE NAME  : arcmsr_attr.c
-**        BY    : Erich Chen
+**        BY    : Nick Cheng
 **   Description: attributes exported to sysfs and device host
 *******************************************************************************
 ** Copyright (C) 2002 - 2005, Areca Technology Corporation All rights reserved
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 1cadcd6b7da..984bd527c6c 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -2,7 +2,7 @@
 *******************************************************************************
 **        O.S   : Linux
 **   FILE NAME  : arcmsr_hba.c
-**        BY    : Erich Chen
+**        BY    : Nick Cheng
 **   Description: SCSI RAID Device Driver for
 **                ARECA RAID Host adapter
 *******************************************************************************
@@ -76,7 +76,7 @@ MODULE_DESCRIPTION("ARECA (ARC11xx/12xx/16xx/1880) SATA/SAS RAID Host Bus Adapte
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(ARCMSR_DRIVER_VERSION);
 static int sleeptime = 10;
-static int retrycount = 30;
+static int retrycount = 12;
 wait_queue_head_t wait_q;
 static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
                                         struct scsi_cmnd *cmd);
@@ -187,7 +187,6 @@ int arcmsr_sleep_for_bus_reset(struct scsi_cmnd *cmd)
                 if (isleep > 0) {
                         msleep(isleep*1000);
                 }
-                printk(KERN_NOTICE "wake-up\n");
                 return 0;
 }
 
@@ -921,7 +920,6 @@ static void arcmsr_report_ccb_state(struct AdapterControlBlock *acb,
 }
 
 static void arcmsr_drain_donequeue(struct AdapterControlBlock *acb, struct CommandControlBlock *pCCB, bool error)
-
 {
         int id, lun;
         if ((pCCB->acb != acb) || (pCCB->startdone != ARCMSR_CCB_START)) {
@@ -948,7 +946,7 @@ static void arcmsr_drain_donequeue(struct AdapterControlBlock *acb, struct Comma
                                 , pCCB->startdone
                                 , atomic_read(&acb->ccboutstandingcount));
                   return;
-                }
+        }
         arcmsr_report_ccb_state(acb, pCCB, error);
 }
 
@@ -981,7 +979,7 @@ static void arcmsr_done4abort_postqueue(struct AdapterControlBlock *acb)
         case ACB_ADAPTER_TYPE_B: {
                 struct MessageUnit_B *reg = acb->pmuB;
                 /*clear all outbound posted Q*/
-                writel(ARCMSR_DOORBELL_INT_CLEAR_PATTERN, &reg->iop2drv_doorbell); /* clear doorbell interrupt */
+                writel(ARCMSR_DOORBELL_INT_CLEAR_PATTERN, reg->iop2drv_doorbell); /* clear doorbell interrupt */
                 for (i = 0; i < ARCMSR_MAX_HBB_POSTQUEUE; i++) {
                         if ((flag_ccb = readl(&reg->done_qbuffer[i])) != 0) {
                                 writel(0, &reg->done_qbuffer[i]);
@@ -1511,7 +1509,6 @@ static void arcmsr_hba_postqueue_isr(struct AdapterControlBlock *acb)
                 arcmsr_drain_donequeue(acb, pCCB, error);
         }
 }
-
 static void arcmsr_hbb_postqueue_isr(struct AdapterControlBlock *acb)
 {
         uint32_t index;
@@ -2106,10 +2103,6 @@ static int arcmsr_queue_command_lck(struct scsi_cmnd *cmd,
         if (atomic_read(&acb->ccboutstandingcount) >=
                         ARCMSR_MAX_OUTSTANDING_CMD)
                 return SCSI_MLQUEUE_HOST_BUSY;
-        if ((scsicmd == SCSI_CMD_ARECA_SPECIFIC)) {
-                printk(KERN_NOTICE "Receiveing SCSI_CMD_ARECA_SPECIFIC command..\n");
-                return 0;
-        }
         ccb = arcmsr_get_freeccb(acb);
         if (!ccb)
                 return SCSI_MLQUEUE_HOST_BUSY;
@@ -2393,6 +2386,7 @@ static int arcmsr_polling_hbb_ccbdone(struct AdapterControlBlock *acb,
         int index, rtn;
         bool error;
         polling_hbb_ccb_retry:
+
         poll_count++;
         /* clear doorbell interrupt */
         writel(ARCMSR_DOORBELL_INT_CLEAR_PATTERN, reg->iop2drv_doorbell);
@@ -2663,6 +2657,7 @@ static void arcmsr_request_hba_device_map(struct AdapterControlBlock *acb)
 {
         struct MessageUnit_A __iomem *reg = acb->pmuA;
         if (unlikely(atomic_read(&acb->rq_map_token) == 0) || ((acb->acb_flags & ACB_F_BUS_RESET) != 0 ) || ((acb->acb_flags & ACB_F_ABORT) != 0 )){
+                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                 return;
         } else {
                 acb->fw_flag = FW_NORMAL;
@@ -2670,8 +2665,10 @@ static void arcmsr_request_hba_device_map(struct AdapterControlBlock *acb)
                         atomic_set(&acb->rq_map_token, 16);
                 }
                 atomic_set(&acb->ante_token_value, atomic_read(&acb->rq_map_token));
-                if (atomic_dec_and_test(&acb->rq_map_token))
+                if (atomic_dec_and_test(&acb->rq_map_token)) {
+                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                         return;
+                }
                 writel(ARCMSR_INBOUND_MESG0_GET_CONFIG, &reg->inbound_msgaddr0);
                 mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
         }
@@ -2682,15 +2679,18 @@ static void arcmsr_request_hbb_device_map(struct AdapterControlBlock *acb)
 {
         struct MessageUnit_B __iomem *reg = acb->pmuB;
         if (unlikely(atomic_read(&acb->rq_map_token) == 0) || ((acb->acb_flags & ACB_F_BUS_RESET) != 0 ) || ((acb->acb_flags & ACB_F_ABORT) != 0 )){
+                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                 return;
         } else {
                 acb->fw_flag = FW_NORMAL;
                 if (atomic_read(&acb->ante_token_value) == atomic_read(&acb->rq_map_token)) {
-                        atomic_set(&acb->rq_map_token,16);
+                        atomic_set(&acb->rq_map_token, 16);
                 }
                 atomic_set(&acb->ante_token_value, atomic_read(&acb->rq_map_token));
-                if(atomic_dec_and_test(&acb->rq_map_token))
+                if (atomic_dec_and_test(&acb->rq_map_token)) {
+                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                         return;
+                }
                 writel(ARCMSR_MESSAGE_GET_CONFIG, reg->drv2iop_doorbell);
                 mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
         }
@@ -2701,6 +2701,7 @@ static void arcmsr_request_hbc_device_map(struct AdapterControlBlock *acb)
 {
         struct MessageUnit_C __iomem *reg = acb->pmuC;
         if (unlikely(atomic_read(&acb->rq_map_token) == 0) || ((acb->acb_flags & ACB_F_BUS_RESET) != 0) || ((acb->acb_flags & ACB_F_ABORT) != 0)) {
+                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                 return;
         } else {
                 acb->fw_flag = FW_NORMAL;
@@ -2708,8 +2709,10 @@ static void arcmsr_request_hbc_device_map(struct AdapterControlBlock *acb)
                         atomic_set(&acb->rq_map_token, 16);
                 }
                 atomic_set(&acb->ante_token_value, atomic_read(&acb->rq_map_token));
-                if (atomic_dec_and_test(&acb->rq_map_token))
+                if (atomic_dec_and_test(&acb->rq_map_token)) {
+                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                         return;
+                }
                 writel(ARCMSR_INBOUND_MESG0_GET_CONFIG, &reg->inbound_msgaddr0);
                 writel(ARCMSR_HBCMU_DRV2IOP_MESSAGE_CMD_DONE, &reg->inbound_doorbell);
                 mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
@@ -2897,6 +2900,8 @@ static uint8_t arcmsr_iop_reset(struct AdapterControlBlock *acb)
         uint32_t intmask_org;
         uint8_t rtnval = 0x00;
         int i = 0;
+        unsigned long flags;
+
         if (atomic_read(&acb->ccboutstandingcount) != 0) {
                 /* disable all outbound interrupt */
                 intmask_org = arcmsr_disable_outbound_ints(acb);
@@ -2907,7 +2912,12 @@ static uint8_t arcmsr_iop_reset(struct AdapterControlBlock *acb)
                 for (i = 0; i < ARCMSR_MAX_FREECCB_NUM; i++) {
                         ccb = acb->pccb_pool[i];
                         if (ccb->startdone == ARCMSR_CCB_START) {
-                                arcmsr_ccb_complete(ccb);
+                                scsi_dma_unmap(ccb->pcmd);
+                                ccb->startdone = ARCMSR_CCB_DONE;
+                                ccb->ccb_flags = 0;
+                                spin_lock_irqsave(&acb->ccblist_lock, flags);
+                                list_add_tail(&ccb->list, &acb->ccb_free_list);
+                                spin_unlock_irqrestore(&acb->ccblist_lock, flags);
                         }
                 }
                 atomic_set(&acb->ccboutstandingcount, 0);
@@ -2920,8 +2930,7 @@ static uint8_t arcmsr_iop_reset(struct AdapterControlBlock *acb)
 
 static int arcmsr_bus_reset(struct scsi_cmnd *cmd)
 {
-        struct AdapterControlBlock *acb =
-                (struct AdapterControlBlock *)cmd->device->host->hostdata;
+        struct AdapterControlBlock *acb;
         uint32_t intmask_org, outbound_doorbell;
         int retry_count = 0;
         int rtn = FAILED;
@@ -2971,31 +2980,16 @@ sleep_again:
                                 atomic_set(&acb->rq_map_token, 16);
                                 atomic_set(&acb->ante_token_value, 16);
                                 acb->fw_flag = FW_NORMAL;
-                                init_timer(&acb->eternal_timer);
-                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6*HZ);
-                                acb->eternal_timer.data = (unsigned long) acb;
-                                acb->eternal_timer.function = &arcmsr_request_device_map;
-                                add_timer(&acb->eternal_timer);
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
                                 rtn = SUCCESS;
                                 printk(KERN_ERR "arcmsr: scsi  bus reset eh returns with success\n");
                         } else {
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
-                                if (atomic_read(&acb->rq_map_token) == 0) {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        init_timer(&acb->eternal_timer);
-                                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6*HZ);
-                                        acb->eternal_timer.data = (unsigned long) acb;
-                                        acb->eternal_timer.function = &arcmsr_request_device_map;
-                                        add_timer(&acb->eternal_timer);
-                                } else {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
-                                }
+                                atomic_set(&acb->rq_map_token, 16);
+                                atomic_set(&acb->ante_token_value, 16);
+                                acb->fw_flag = FW_NORMAL;
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
                                 rtn = SUCCESS;
                         }
                         break;
@@ -3007,21 +3001,10 @@ sleep_again:
                                 rtn = FAILED;
                         } else {
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
-                                if (atomic_read(&acb->rq_map_token) == 0) {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        init_timer(&acb->eternal_timer);
-                                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6*HZ);
-                                        acb->eternal_timer.data = (unsigned long) acb;
-                                        acb->eternal_timer.function = &arcmsr_request_device_map;
-                                        add_timer(&acb->eternal_timer);
-                                } else {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
-                                }
+                                atomic_set(&acb->rq_map_token, 16);
+                                atomic_set(&acb->ante_token_value, 16);
+                                acb->fw_flag = FW_NORMAL;
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                                 rtn = SUCCESS;
                         }
                         break;
@@ -3067,31 +3050,16 @@ sleep:
                                 atomic_set(&acb->rq_map_token, 16);
                                 atomic_set(&acb->ante_token_value, 16);
                                 acb->fw_flag = FW_NORMAL;
-                                init_timer(&acb->eternal_timer);
-                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6 * HZ);
-                                acb->eternal_timer.data = (unsigned long) acb;
-                                acb->eternal_timer.function = &arcmsr_request_device_map;
-                                add_timer(&acb->eternal_timer);
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
                                 rtn = SUCCESS;
                                 printk(KERN_ERR "arcmsr: scsi bus reset eh returns with success\n");
                         } else {
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
-                                if (atomic_read(&acb->rq_map_token) == 0) {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        init_timer(&acb->eternal_timer);
-                                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6*HZ);
-                                        acb->eternal_timer.data = (unsigned long) acb;
-                                        acb->eternal_timer.function = &arcmsr_request_device_map;
-                                        add_timer(&acb->eternal_timer);
-                                } else {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
-                                }
+                                atomic_set(&acb->rq_map_token, 16);
+                                atomic_set(&acb->ante_token_value, 16);
+                                acb->fw_flag = FW_NORMAL;
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
                                 rtn = SUCCESS;
                         }
                         break;
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 5815cbeb27a..9a7aaf5f131 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -646,6 +646,7 @@ void sas_scsi_recover_host(struct Scsi_Host *shost)
 
         spin_lock_irqsave(shost->host_lock, flags);
         list_splice_init(&shost->eh_cmd_q, &eh_work_q);
+        shost->host_eh_scheduled = 0;
         spin_unlock_irqrestore(shost->host_lock, flags);
 
         SAS_DPRINTK("Enter %s\n", __func__);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index b2a817055b8..9ead0399808 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -2176,9 +2176,9 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
                 /* adjust hba_queue_depth, reply_free_queue_depth,
                  * and queue_size
                  */
-                ioc->hba_queue_depth -= queue_diff;
-                ioc->reply_free_queue_depth -= queue_diff;
-                queue_size -= queue_diff;
+                ioc->hba_queue_depth -= (queue_diff / 2);
+                ioc->reply_free_queue_depth -= (queue_diff / 2);
+                queue_size = facts->MaxReplyDescriptorPostQueueDepth;
         }
         ioc->reply_post_queue_depth = queue_size;
 
@@ -3941,6 +3941,8 @@ mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc)
 static void
 _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
 {
+        mpt2sas_scsih_reset_handler(ioc, reset_phase);
+        mpt2sas_ctl_reset_handler(ioc, reset_phase);
         switch (reset_phase) {
         case MPT2_IOC_PRE_RESET:
                 dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: "
@@ -3971,8 +3973,6 @@ _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
                     "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
                 break;
         }
-        mpt2sas_scsih_reset_handler(ioc, reset_phase);
-        mpt2sas_ctl_reset_handler(ioc, reset_phase);
 }
 
 /**
@@ -4026,6 +4026,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
 {
         int r;
         unsigned long flags;
+        u8 pe_complete = ioc->wait_for_port_enable_to_complete;
 
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
             __func__));
@@ -4068,6 +4069,14 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
         if (r)
                 goto out;
         _base_reset_handler(ioc, MPT2_IOC_AFTER_RESET);
+
+        /* If this hard reset is called while port enable is active, then
+         * there is no reason to call make_ioc_operational
+         */
+        if (pe_complete) {
+                r = -EFAULT;
+                goto out;
+        }
         r = _base_make_ioc_operational(ioc, sleep_flag);
         if (!r)
                 _base_reset_handler(ioc, MPT2_IOC_DONE_RESET);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index eda347c5797..5ded3db6e31 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -819,7 +819,7 @@ _scsih_is_end_device(u32 device_info)
 }
 
 /**
- * mptscsih_get_scsi_lookup - returns scmd entry
+ * _scsih_scsi_lookup_get - returns scmd entry
  * @ioc: per adapter object
  * @smid: system request message index
  *
@@ -832,6 +832,28 @@ _scsih_scsi_lookup_get(struct MPT2SAS_ADAPTER *ioc, u16 smid)
 }
 
 /**
+ * _scsih_scsi_lookup_get_clear - returns scmd entry
+ * @ioc: per adapter object
+ * @smid: system request message index
+ *
+ * Returns the smid stored scmd pointer.
+ * Then will derefrence the stored scmd pointer.
+ */
+static inline struct scsi_cmnd *
+_scsih_scsi_lookup_get_clear(struct MPT2SAS_ADAPTER *ioc, u16 smid)
+{
+        unsigned long flags;
+        struct scsi_cmnd *scmd;
+
+        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+        scmd = ioc->scsi_lookup[smid - 1].scmd;
+        ioc->scsi_lookup[smid - 1].scmd = NULL;
+        spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+
+        return scmd;
+}
+
+/**
  * _scsih_scsi_lookup_find_by_scmd - scmd lookup
  * @ioc: per adapter object
  * @smid: system request message index
@@ -2981,9 +3003,6 @@ _scsih_check_topo_delete_events(struct MPT2SAS_ADAPTER *ioc,
         u16 handle;
 
         for (i = 0 ; i < event_data->NumEntries; i++) {
-                if (event_data->PHY[i].PhyStatus &
-                    MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT)
-                        continue;
                 handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
                 if (!handle)
                         continue;
@@ -3210,7 +3229,7 @@ _scsih_flush_running_cmds(struct MPT2SAS_ADAPTER *ioc)
         u16 count = 0;
 
         for (smid = 1; smid <= ioc->scsiio_depth; smid++) {
-                scmd = _scsih_scsi_lookup_get(ioc, smid);
+                scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
                 if (!scmd)
                         continue;
                 count++;
@@ -3804,7 +3823,7 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         u32 response_code = 0;
 
         mpi_reply = mpt2sas_base_get_reply_virt_addr(ioc, reply);
-        scmd = _scsih_scsi_lookup_get(ioc, smid);
+        scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
         if (scmd == NULL)
                 return 1;
 
@@ -5005,6 +5024,12 @@ _scsih_sas_device_status_change_event(struct MPT2SAS_ADAPTER *ioc,
                      event_data);
 #endif
 
+        /* In MPI Revision K (0xC), the internal device reset complete was
+         * implemented, so avoid setting tm_busy flag for older firmware.
+         */
+        if ((ioc->facts.HeaderVersion >> 8) < 0xC)
+                return;
+
         if (event_data->ReasonCode !=
             MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET &&
            event_data->ReasonCode !=
@@ -5099,6 +5124,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
     struct fw_event_work *fw_event)
 {
         struct scsi_cmnd *scmd;
+        struct scsi_device *sdev;
         u16 smid, handle;
         u32 lun;
         struct MPT2SAS_DEVICE *sas_device_priv_data;
@@ -5109,12 +5135,17 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
         Mpi2EventDataSasBroadcastPrimitive_t *event_data = fw_event->event_data;
 #endif
         u16 ioc_status;
+        unsigned long flags;
+        int r;
+
         dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "broadcast primative: "
             "phy number(%d), width(%d)\n", ioc->name, event_data->PhyNum,
             event_data->PortWidth));
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
             __func__));
 
+        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+        ioc->broadcast_aen_busy = 0;
         termination_count = 0;
         query_count = 0;
         mpi_reply = ioc->tm_cmds.reply;
@@ -5122,7 +5153,8 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                 scmd = _scsih_scsi_lookup_get(ioc, smid);
                 if (!scmd)
                         continue;
-                sas_device_priv_data = scmd->device->hostdata;
+                sdev = scmd->device;
+                sas_device_priv_data = sdev->hostdata;
                 if (!sas_device_priv_data || !sas_device_priv_data->sas_target)
                         continue;
                  /* skip hidden raid components */
@@ -5138,6 +5170,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                 lun = sas_device_priv_data->lun;
                 query_count++;
 
+                spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
                 mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
                     MPI2_SCSITASKMGMT_TASKTYPE_QUERY_TASK, smid, 30, NULL);
                 ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
@@ -5147,14 +5180,20 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                     (mpi_reply->ResponseCode ==
                      MPI2_SCSITASKMGMT_RSP_TM_SUCCEEDED ||
                      mpi_reply->ResponseCode ==
-                     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC))
+                     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC)) {
+                        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
                         continue;
-
-                mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
-                    MPI2_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET, 0, 30, NULL);
+                }
+                r = mpt2sas_scsih_issue_tm(ioc, handle, sdev->channel, sdev->id,
+                    sdev->lun, MPI2_SCSITASKMGMT_TASKTYPE_ABORT_TASK, smid, 30,
+                    scmd);
+                if (r == FAILED)
+                        sdev_printk(KERN_WARNING, sdev, "task abort: FAILED "
+                            "scmd(%p)\n", scmd);
                 termination_count += le32_to_cpu(mpi_reply->TerminationCount);
+                spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
         }
-        ioc->broadcast_aen_busy = 0;
+        spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
 
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT
             "%s - exit, query_count = %d termination_count = %d\n",
@@ -6626,6 +6665,7 @@ _scsih_remove(struct pci_dev *pdev)
                 destroy_workqueue(wq);
 
         /* release all the volumes */
+        _scsih_ir_shutdown(ioc);
         list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list,
             list) {
                 if (raid_device->starget) {
diff --git a/drivers/sh/intc/chip.c b/drivers/sh/intc/chip.c
index de885a0f917..f33e2dd9793 100644
--- a/drivers/sh/intc/chip.c
+++ b/drivers/sh/intc/chip.c
@@ -173,7 +173,8 @@ int intc_set_priority(unsigned int irq, unsigned int prio)
         return 0;
 }
 
-#define VALID(x) (x | 0x80)
+#define SENSE_VALID_FLAG 0x80
+#define VALID(x) (x | SENSE_VALID_FLAG)
 
 static unsigned char intc_irq_sense_table[IRQ_TYPE_SENSE_MASK + 1] = {
         [IRQ_TYPE_EDGE_FALLING] = VALID(0),
@@ -201,7 +202,8 @@ static int intc_set_type(struct irq_data *data, unsigned int type)
         ihp = intc_find_irq(d->sense, d->nr_sense, irq);
         if (ihp) {
                 addr = INTC_REG(d, _INTC_ADDR_E(ihp->handle), 0);
-                intc_reg_fns[_INTC_FN(ihp->handle)](addr, ihp->handle, value);
+                intc_reg_fns[_INTC_FN(ihp->handle)](addr, ihp->handle,
+                                                    value & ~SENSE_VALID_FLAG);
         }
 
         return 0;
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 13bfa9d4808..bb233a9cbad 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -53,6 +53,14 @@ if SPI_MASTER
 
 comment "SPI Master Controller Drivers"
 
+config SPI_ATH79
+        tristate "Atheros AR71XX/AR724X/AR913X SPI controller driver"
+        depends on ATH79 && GENERIC_GPIO
+        select SPI_BITBANG
+        help
+          This enables support for the SPI controller present on the
+          Atheros AR71XX/AR724X/AR913X SoCs.
+
 config SPI_ATMEL
         tristate "Atmel SPI Controller"
         depends on (ARCH_AT91 || AVR32)
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index 3a42463c92a..86d1b5f9bbd 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_SPI_MASTER)		+= spi.o
 
 # SPI master controller drivers (bus)
 obj-$(CONFIG_SPI_ATMEL)                 += atmel_spi.o
+obj-$(CONFIG_SPI_ATH79)                 += ath79_spi.o
 obj-$(CONFIG_SPI_BFIN)                  += spi_bfin5xx.o
 obj-$(CONFIG_SPI_BITBANG)               += spi_bitbang.o
 obj-$(CONFIG_SPI_AU1550)                += au1550_spi.o
diff --git a/drivers/spi/ath79_spi.c b/drivers/spi/ath79_spi.c
new file mode 100644
index 00000000000..fcff810ea3b
--- /dev/null
+++ b/drivers/spi/ath79_spi.c
@@ -0,0 +1,292 @@
+/*
+ * SPI controller driver for the Atheros AR71XX/AR724X/AR913X SoCs
+ *
+ * Copyright (C) 2009-2011 Gabor Juhos <juhosg@openwrt.org>
+ *
+ * This driver has been based on the spi-gpio.c:
+ *      Copyright (C) 2006,2008 David Brownell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/spi_bitbang.h>
+#include <linux/bitops.h>
+#include <linux/gpio.h>
+
+#include <asm/mach-ath79/ar71xx_regs.h>
+#include <asm/mach-ath79/ath79_spi_platform.h>
+
+#define DRV_NAME        "ath79-spi"
+
+struct ath79_spi {
+        struct spi_bitbang      bitbang;
+        u32                     ioc_base;
+        u32                     reg_ctrl;
+        void __iomem            *base;
+};
+
+static inline u32 ath79_spi_rr(struct ath79_spi *sp, unsigned reg)
+{
+        return ioread32(sp->base + reg);
+}
+
+static inline void ath79_spi_wr(struct ath79_spi *sp, unsigned reg, u32 val)
+{
+        iowrite32(val, sp->base + reg);
+}
+
+static inline struct ath79_spi *ath79_spidev_to_sp(struct spi_device *spi)
+{
+        return spi_master_get_devdata(spi->master);
+}
+
+static void ath79_spi_chipselect(struct spi_device *spi, int is_active)
+{
+        struct ath79_spi *sp = ath79_spidev_to_sp(spi);
+        int cs_high = (spi->mode & SPI_CS_HIGH) ? is_active : !is_active;
+
+        if (is_active) {
+                /* set initial clock polarity */
+                if (spi->mode & SPI_CPOL)
+                        sp->ioc_base |= AR71XX_SPI_IOC_CLK;
+                else
+                        sp->ioc_base &= ~AR71XX_SPI_IOC_CLK;
+
+                ath79_spi_wr(sp, AR71XX_SPI_REG_IOC, sp->ioc_base);
+        }
+
+        if (spi->chip_select) {
+                struct ath79_spi_controller_data *cdata = spi->controller_data;
+
+                /* SPI is normally active-low */
+                gpio_set_value(cdata->gpio, cs_high);
+        } else {
+                if (cs_high)
+                        sp->ioc_base |= AR71XX_SPI_IOC_CS0;
+                else
+                        sp->ioc_base &= ~AR71XX_SPI_IOC_CS0;
+
+                ath79_spi_wr(sp, AR71XX_SPI_REG_IOC, sp->ioc_base);
+        }
+
+}
+
+static int ath79_spi_setup_cs(struct spi_device *spi)
+{
+        struct ath79_spi *sp = ath79_spidev_to_sp(spi);
+        struct ath79_spi_controller_data *cdata;
+
+        cdata = spi->controller_data;
+        if (spi->chip_select && !cdata)
+                return -EINVAL;
+
+        /* enable GPIO mode */
+        ath79_spi_wr(sp, AR71XX_SPI_REG_FS, AR71XX_SPI_FS_GPIO);
+
+        /* save CTRL register */
+        sp->reg_ctrl = ath79_spi_rr(sp, AR71XX_SPI_REG_CTRL);
+        sp->ioc_base = ath79_spi_rr(sp, AR71XX_SPI_REG_IOC);
+
+        /* TODO: setup speed? */
+        ath79_spi_wr(sp, AR71XX_SPI_REG_CTRL, 0x43);
+
+        if (spi->chip_select) {
+                int status = 0;
+
+                status = gpio_request(cdata->gpio, dev_name(&spi->dev));
+                if (status)
+                        return status;
+
+                status = gpio_direction_output(cdata->gpio,
+                                               spi->mode & SPI_CS_HIGH);
+                if (status) {
+                        gpio_free(cdata->gpio);
+                        return status;
+                }
+        } else {
+                if (spi->mode & SPI_CS_HIGH)
+                        sp->ioc_base |= AR71XX_SPI_IOC_CS0;
+                else
+                        sp->ioc_base &= ~AR71XX_SPI_IOC_CS0;
+                ath79_spi_wr(sp, AR71XX_SPI_REG_IOC, sp->ioc_base);
+        }
+
+        return 0;
+}
+
+static void ath79_spi_cleanup_cs(struct spi_device *spi)
+{
+        struct ath79_spi *sp = ath79_spidev_to_sp(spi);
+
+        if (spi->chip_select) {
+                struct ath79_spi_controller_data *cdata = spi->controller_data;
+                gpio_free(cdata->gpio);
+        }
+
+        /* restore CTRL register */
+        ath79_spi_wr(sp, AR71XX_SPI_REG_CTRL, sp->reg_ctrl);
+        /* disable GPIO mode */
+        ath79_spi_wr(sp, AR71XX_SPI_REG_FS, 0);
+}
+
+static int ath79_spi_setup(struct spi_device *spi)
+{
+        int status = 0;
+
+        if (spi->bits_per_word > 32)
+                return -EINVAL;
+
+        if (!spi->controller_state) {
+                status = ath79_spi_setup_cs(spi);
+                if (status)
+                        return status;
+        }
+
+        status = spi_bitbang_setup(spi);
+        if (status && !spi->controller_state)
+                ath79_spi_cleanup_cs(spi);
+
+        return status;
+}
+
+static void ath79_spi_cleanup(struct spi_device *spi)
+{
+        ath79_spi_cleanup_cs(spi);
+        spi_bitbang_cleanup(spi);
+}
+
+static u32 ath79_spi_txrx_mode0(struct spi_device *spi, unsigned nsecs,
+                               u32 word, u8 bits)
+{
+        struct ath79_spi *sp = ath79_spidev_to_sp(spi);
+        u32 ioc = sp->ioc_base;
+
+        /* clock starts at inactive polarity */
+        for (word <<= (32 - bits); likely(bits); bits--) {
+                u32 out;
+
+                if (word & (1 << 31))
+                        out = ioc | AR71XX_SPI_IOC_DO;
+                else
+                        out = ioc & ~AR71XX_SPI_IOC_DO;
+
+                /* setup MSB (to slave) on trailing edge */
+                ath79_spi_wr(sp, AR71XX_SPI_REG_IOC, out);
+                ath79_spi_wr(sp, AR71XX_SPI_REG_IOC, out | AR71XX_SPI_IOC_CLK);
+
+                word <<= 1;
+        }
+
+        return ath79_spi_rr(sp, AR71XX_SPI_REG_RDS);
+}
+
+static __devinit int ath79_spi_probe(struct platform_device *pdev)
+{
+        struct spi_master *master;
+        struct ath79_spi *sp;
+        struct ath79_spi_platform_data *pdata;
+        struct resource *r;
+        int ret;
+
+        master = spi_alloc_master(&pdev->dev, sizeof(*sp));
+        if (master == NULL) {
+                dev_err(&pdev->dev, "failed to allocate spi master\n");
+                return -ENOMEM;
+        }
+
+        sp = spi_master_get_devdata(master);
+        platform_set_drvdata(pdev, sp);
+
+        pdata = pdev->dev.platform_data;
+
+        master->setup = ath79_spi_setup;
+        master->cleanup = ath79_spi_cleanup;
+        if (pdata) {
+                master->bus_num = pdata->bus_num;
+                master->num_chipselect = pdata->num_chipselect;
+        } else {
+                master->bus_num = -1;
+                master->num_chipselect = 1;
+        }
+
+        sp->bitbang.master = spi_master_get(master);
+        sp->bitbang.chipselect = ath79_spi_chipselect;
+        sp->bitbang.txrx_word[SPI_MODE_0] = ath79_spi_txrx_mode0;
+        sp->bitbang.setup_transfer = spi_bitbang_setup_transfer;
+        sp->bitbang.flags = SPI_CS_HIGH;
+
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (r == NULL) {
+                ret = -ENOENT;
+                goto err_put_master;
+        }
+
+        sp->base = ioremap(r->start, r->end - r->start + 1);
+        if (!sp->base) {
+                ret = -ENXIO;
+                goto err_put_master;
+        }
+
+        ret = spi_bitbang_start(&sp->bitbang);
+        if (ret)
+                goto err_unmap;
+
+        return 0;
+
+err_unmap:
+        iounmap(sp->base);
+err_put_master:
+        platform_set_drvdata(pdev, NULL);
+        spi_master_put(sp->bitbang.master);
+
+        return ret;
+}
+
+static __devexit int ath79_spi_remove(struct platform_device *pdev)
+{
+        struct ath79_spi *sp = platform_get_drvdata(pdev);
+
+        spi_bitbang_stop(&sp->bitbang);
+        iounmap(sp->base);
+        platform_set_drvdata(pdev, NULL);
+        spi_master_put(sp->bitbang.master);
+
+        return 0;
+}
+
+static struct platform_driver ath79_spi_driver = {
+        .probe          = ath79_spi_probe,
+        .remove         = __devexit_p(ath79_spi_remove),
+        .driver         = {
+                .name   = DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+};
+
+static __init int ath79_spi_init(void)
+{
+        return platform_driver_register(&ath79_spi_driver);
+}
+module_init(ath79_spi_init);
+
+static __exit void ath79_spi_exit(void)
+{
+        platform_driver_unregister(&ath79_spi_driver);
+}
+module_exit(ath79_spi_exit);
+
+MODULE_DESCRIPTION("SPI controller driver for Atheros AR71XX/AR724X/AR913X");
+MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
index 2d8cc455dbc..42cdaa9a4d8 100644
--- a/drivers/ssb/Kconfig
+++ b/drivers/ssb/Kconfig
@@ -82,7 +82,7 @@ config SSB_SDIOHOST
 
 config SSB_SILENT
         bool "No SSB kernel messages"
-        depends on SSB && EMBEDDED
+        depends on SSB && EXPERT
         help
           This option turns off all Sonics Silicon Backplane printks.
           Note that you won't be able to identify problems, once
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
index 0e298dba9fc..29b8ab44ea4 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
@@ -360,8 +360,8 @@ int PSSendOps(void *arg)
                 status = 1;
                 goto complete;
         }
-        len = (firmware->size > MAX_BDADDR_FORMAT_LENGTH)? MAX_BDADDR_FORMAT_LENGTH: firmware->size;
-        memcpy(config_bdaddr, firmware->data,len);
+        len = min(firmware->size, MAX_BDADDR_FORMAT_LENGTH - 1);
+        memcpy(config_bdaddr, firmware->data, len);
         config_bdaddr[len] = '\0';
         write_bdaddr(hdev,config_bdaddr,BDADDR_TYPE_STRING);
         A_RELEASE_FIRMWARE(firmware);
diff --git a/drivers/staging/brcm80211/sys/wl_mac80211.c b/drivers/staging/brcm80211/sys/wl_mac80211.c
index bdd629d72a7..f1235884cc5 100644
--- a/drivers/staging/brcm80211/sys/wl_mac80211.c
+++ b/drivers/staging/brcm80211/sys/wl_mac80211.c
@@ -209,11 +209,8 @@ static void wl_ops_stop(struct ieee80211_hw *hw)
         struct wl_info *wl = hw->priv;
         ASSERT(wl);
         WL_LOCK(wl);
-        wl_down(wl);
         ieee80211_stop_queues(hw);
         WL_UNLOCK(wl);
-
-        return;
 }
 
 static int
@@ -246,7 +243,14 @@ wl_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 static void
 wl_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
-        return;
+        struct wl_info *wl;
+
+        wl = HW_TO_WL(hw);
+
+        /* put driver in down state */
+        WL_LOCK(wl);
+        wl_down(wl);
+        WL_UNLOCK(wl);
 }
 
 static int
@@ -779,7 +783,7 @@ static struct wl_info *wl_attach(u16 vendor, u16 device, unsigned long regs,
         wl_found++;
         return wl;
 
- fail:
+fail:
         wl_free(wl);
 fail1:
         return NULL;
@@ -1090,7 +1094,6 @@ wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 }
 
-#ifdef LINUXSTA_PS
 static int wl_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct wl_info *wl;
@@ -1105,11 +1108,12 @@ static int wl_suspend(struct pci_dev *pdev, pm_message_t state)
                 return -ENODEV;
         }
 
+        /* only need to flag hw is down for proper resume */
         WL_LOCK(wl);
-        wl_down(wl);
         wl->pub->hw_up = false;
         WL_UNLOCK(wl);
-        pci_save_state(pdev, wl->pci_psstate);
+
+        pci_save_state(pdev);
         pci_disable_device(pdev);
         return pci_set_power_state(pdev, PCI_D3hot);
 }
@@ -1133,7 +1137,7 @@ static int wl_resume(struct pci_dev *pdev)
         if (err)
                 return err;
 
-        pci_restore_state(pdev, wl->pci_psstate);
+        pci_restore_state(pdev);
 
         err = pci_enable_device(pdev);
         if (err)
@@ -1145,13 +1149,12 @@ static int wl_resume(struct pci_dev *pdev)
         if ((val & 0x0000ff00) != 0)
                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
 
-        WL_LOCK(wl);
-        err = wl_up(wl);
-        WL_UNLOCK(wl);
-
+        /*
+        *  done. driver will be put in up state
+        *  in wl_ops_add_interface() call.
+        */
         return err;
 }
-#endif                          /* LINUXSTA_PS */
 
 static void wl_remove(struct pci_dev *pdev)
 {
@@ -1184,14 +1187,12 @@ static void wl_remove(struct pci_dev *pdev)
 }
 
 static struct pci_driver wl_pci_driver = {
- .name  = "brcm80211",
- .probe = wl_pci_probe,
-#ifdef LINUXSTA_PS
- .suspend = wl_suspend,
- .resume  = wl_resume,
-#endif                          /* LINUXSTA_PS */
- .remove   = __devexit_p(wl_remove),
- .id_table = wl_id_table,
+        .name = "brcm80211",
+        .probe = wl_pci_probe,
+        .suspend = wl_suspend,
+        .resume = wl_resume,
+        .remove = __devexit_p(wl_remove),
+        .id_table = wl_id_table,
 };
 
 /**
diff --git a/drivers/staging/brcm80211/sys/wlc_mac80211.c b/drivers/staging/brcm80211/sys/wlc_mac80211.c
index 1d5d01ac0a9..a1303863686 100644
--- a/drivers/staging/brcm80211/sys/wlc_mac80211.c
+++ b/drivers/staging/brcm80211/sys/wlc_mac80211.c
@@ -5126,7 +5126,6 @@ wlc_sendpkt_mac80211(struct wlc_info *wlc, struct sk_buff *sdu,
         fifo = prio2fifo[prio];
 
         ASSERT((uint) skb_headroom(sdu) >= TXOFF);
-        ASSERT(!(sdu->cloned));
         ASSERT(!(sdu->next));
         ASSERT(!(sdu->prev));
         ASSERT(fifo < NFIFO);
diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
index 4d1868d04ba..0728c3c0cb0 100644
--- a/drivers/staging/comedi/drivers/ni_labpc.c
+++ b/drivers/staging/comedi/drivers/ni_labpc.c
@@ -575,7 +575,8 @@ int labpc_common_attach(struct comedi_device *dev, unsigned long iobase,
         /* grab our IRQ */
         if (irq) {
                 isr_flags = 0;
-                if (thisboard->bustype == pci_bustype)
+                if (thisboard->bustype == pci_bustype
+                    || thisboard->bustype == pcmcia_bustype)
                         isr_flags |= IRQF_SHARED;
                 if (request_irq(irq, labpc_interrupt, isr_flags,
                                 driver_labpc.driver_name, dev)) {
diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
index b3d05fcfe6d..4fb809485d9 100644
--- a/drivers/staging/hv/blkvsc_drv.c
+++ b/drivers/staging/hv/blkvsc_drv.c
@@ -368,6 +368,7 @@ static int blkvsc_probe(struct device *device)
                 blkdev->gd->first_minor = 0;
         blkdev->gd->fops = &block_ops;
         blkdev->gd->private_data = blkdev;
+        blkdev->gd->driverfs_dev = &(blkdev->device_ctx->device);
         sprintf(blkdev->gd->disk_name, "hd%c", 'a' + devnum);
 
         blkvsc_do_inquiry(blkdev);
diff --git a/drivers/staging/hv/netvsc.c b/drivers/staging/hv/netvsc.c
index df9cd131e95..0edbe7483a4 100644
--- a/drivers/staging/hv/netvsc.c
+++ b/drivers/staging/hv/netvsc.c
@@ -1279,7 +1279,7 @@ static void netvsc_channel_cb(void *context)
         /* ASSERT(device); */
 
         packet = kzalloc(NETVSC_PACKET_SIZE * sizeof(unsigned char),
-                         GFP_KERNEL);
+                         GFP_ATOMIC);
         if (!packet)
                 return;
         buffer = packet;
diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
index 0147b407512..54706a16dc0 100644
--- a/drivers/staging/hv/netvsc_drv.c
+++ b/drivers/staging/hv/netvsc_drv.c
@@ -358,7 +358,6 @@ static int netvsc_probe(struct device *device)
 
         /* Set initial state */
         netif_carrier_off(net);
-        netif_stop_queue(net);
 
         net_device_ctx = netdev_priv(net);
         net_device_ctx->device_ctx = device_ctx;
diff --git a/drivers/staging/iio/adc/ad7476_core.c b/drivers/staging/iio/adc/ad7476_core.c
index deb68c8a6e1..b8b54da67c6 100644
--- a/drivers/staging/iio/adc/ad7476_core.c
+++ b/drivers/staging/iio/adc/ad7476_core.c
@@ -68,7 +68,7 @@ static ssize_t ad7476_show_scale(struct device *dev,
         /* Corresponds to Vref / 2^(bits) */
         unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
 
-        return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+        return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad7476_show_scale, NULL, 0);
 
diff --git a/drivers/staging/iio/adc/ad7887_core.c b/drivers/staging/iio/adc/ad7887_core.c
index 685908995d4..5d85efab658 100644
--- a/drivers/staging/iio/adc/ad7887_core.c
+++ b/drivers/staging/iio/adc/ad7887_core.c
@@ -68,7 +68,7 @@ static ssize_t ad7887_show_scale(struct device *dev,
         /* Corresponds to Vref / 2^(bits) */
         unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
 
-        return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+        return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad7887_show_scale, NULL, 0);
 
diff --git a/drivers/staging/iio/adc/ad799x_core.c b/drivers/staging/iio/adc/ad799x_core.c
index 6309d521a86..89ccf375a18 100644
--- a/drivers/staging/iio/adc/ad799x_core.c
+++ b/drivers/staging/iio/adc/ad799x_core.c
@@ -432,7 +432,7 @@ static ssize_t ad799x_show_scale(struct device *dev,
         /* Corresponds to Vref / 2^(bits) */
         unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
 
-        return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+        return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 
 static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad799x_show_scale, NULL, 0);
diff --git a/drivers/staging/iio/dac/ad5446.c b/drivers/staging/iio/dac/ad5446.c
index e3387cd3114..0f87ecac82f 100644
--- a/drivers/staging/iio/dac/ad5446.c
+++ b/drivers/staging/iio/dac/ad5446.c
@@ -87,7 +87,7 @@ static ssize_t ad5446_show_scale(struct device *dev,
         /* Corresponds to Vref / 2^(bits) */
         unsigned int scale_uv = (st->vref_mv * 1000) >> st->chip_info->bits;
 
-        return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+        return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 static IIO_DEVICE_ATTR(out_scale, S_IRUGO, ad5446_show_scale, NULL, 0);
 
diff --git a/drivers/staging/lirc/TODO.lirc_zilog b/drivers/staging/lirc/TODO.lirc_zilog
index 6aa312df401..2d0263f0793 100644
--- a/drivers/staging/lirc/TODO.lirc_zilog
+++ b/drivers/staging/lirc/TODO.lirc_zilog
@@ -1,13 +1,37 @@
-The binding between hdpvr and lirc_zilog is currently disabled,
+1. Both ir-kbd-i2c and lirc_zilog provide support for RX events.
+The 'tx_only' lirc_zilog module parameter will allow ir-kbd-i2c
+and lirc_zilog to coexist in the kernel, if the user requires such a set-up.
+However the IR unit will not work well without coordination between the
+two modules.  A shared mutex, for transceiver access locking, needs to be
+supplied by bridge drivers, in struct IR_i2_init_data, to both ir-kbd-i2c
+and lirc_zilog, before they will coexist usefully.  This should be fixed
+before moving out of staging.
+
+2. References and locking need careful examination.  For cx18 and ivtv PCI
+cards, which are not easily "hot unplugged", the imperfect state of reference
+counting and locking is acceptable if not correct.  For USB connected units
+like HD PVR, PVR USB2, HVR-1900, and HVR1950, the likelyhood of an Ooops on
+unplug is probably great.  Proper reference counting and locking needs to be
+implemented before this module is moved out of staging.
+
+3. The binding between hdpvr and lirc_zilog is currently disabled,
 due to an OOPS reported a few years ago when both the hdpvr and cx18
 drivers were loaded in his system. More details can be seen at:
         http://www.mail-archive.com/linux-media@vger.kernel.org/msg09163.html
 More tests need to be done, in order to fix the reported issue.
 
-There's a conflict between ir-kbd-i2c: Both provide support for RX events.
-Such conflict needs to be fixed, before moving it out of staging.
+4. In addition to providing a shared mutex for transceiver access
+locking, bridge drivers, if able, should provide a chip reset() callback
+to lirc_zilog via struct IR_i2c_init_data.  cx18 and ivtv already have routines
+to perform Z8 chip resets via GPIO manipulations.  This will allow lirc_zilog
+to bring the chip back to normal when it hangs, in the same places the
+original lirc_pvr150 driver code does.  This is not strictly needed, so it
+is not required to move lirc_zilog out of staging.
+
+5. Both lirc_zilog and ir-kbd-i2c support the Zilog Z8 for IR, as programmed
+and installed on Hauppauge products.  When working on either module, developers
+must consider at least the following bridge drivers which mention an IR Rx unit
+at address 0x71 (indicative of a Z8):
 
-The way I2C probe works, it will try to register the driver twice, one
-for RX and another for TX. The logic needs to be fixed to avoid such
-issue.
+        ivtv cx18 hdpvr pvrusb2 bt8xx cx88 saa7134
 
diff --git a/drivers/staging/lirc/lirc_imon.c b/drivers/staging/lirc/lirc_imon.c
index 0da6b9518af..235cab0eb08 100644
--- a/drivers/staging/lirc/lirc_imon.c
+++ b/drivers/staging/lirc/lirc_imon.c
@@ -447,6 +447,7 @@ static ssize_t vfd_write(struct file *file, const char *buf,
 
 exit:
         mutex_unlock(&context->ctx_lock);
+        kfree(data_buf);
 
         return (!retval) ? n_bytes : retval;
 }
diff --git a/drivers/staging/lirc/lirc_it87.c b/drivers/staging/lirc/lirc_it87.c
index 929ae579546..5938616f3e8 100644
--- a/drivers/staging/lirc/lirc_it87.c
+++ b/drivers/staging/lirc/lirc_it87.c
@@ -232,6 +232,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
                 i++;
         }
         terminate_send(tx_buf[i - 1]);
+        kfree(tx_buf);
         return n;
 }
 
diff --git a/drivers/staging/lirc/lirc_parallel.c b/drivers/staging/lirc/lirc_parallel.c
index dfd2c447e67..3a9c09881b2 100644
--- a/drivers/staging/lirc/lirc_parallel.c
+++ b/drivers/staging/lirc/lirc_parallel.c
@@ -376,6 +376,7 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
         unsigned long flags;
         int counttimer;
         int *wbuf;
+        ssize_t ret;
 
         if (!is_claimed)
                 return -EBUSY;
@@ -393,8 +394,10 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
         if (timer == 0) {
                 /* try again if device is ready */
                 timer = init_lirc_timer();
-                if (timer == 0)
-                        return -EIO;
+                if (timer == 0) {
+                        ret = -EIO;
+                        goto out;
+                }
         }
 
         /* adjust values from usecs */
@@ -420,7 +423,8 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
                         if (check_pselecd && (in(1) & LP_PSELECD)) {
                                 lirc_off();
                                 local_irq_restore(flags);
-                                return -EIO;
+                                ret = -EIO;
+                                goto out;
                         }
                 } while (counttimer < wbuf[i]);
                 i++;
@@ -436,7 +440,8 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
                         level = newlevel;
                         if (check_pselecd && (in(1) & LP_PSELECD)) {
                                 local_irq_restore(flags);
-                                return -EIO;
+                                ret = -EIO;
+                                goto out;
                         }
                 } while (counttimer < wbuf[i]);
                 i++;
@@ -445,7 +450,11 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
 #else
         /* place code that handles write without external timer here */
 #endif
-        return n;
+        ret = n;
+out:
+        kfree(wbuf);
+
+        return ret;
 }
 
 static unsigned int lirc_poll(struct file *file, poll_table *wait)
diff --git a/drivers/staging/lirc/lirc_sasem.c b/drivers/staging/lirc/lirc_sasem.c
index 998485ebdbc..925eabe1485 100644
--- a/drivers/staging/lirc/lirc_sasem.c
+++ b/drivers/staging/lirc/lirc_sasem.c
@@ -448,6 +448,7 @@ static ssize_t vfd_write(struct file *file, const char *buf,
 exit:
 
         mutex_unlock(&context->ctx_lock);
+        kfree(data_buf);
 
         return (!retval) ? n_bytes : retval;
 }
diff --git a/drivers/staging/lirc/lirc_serial.c b/drivers/staging/lirc/lirc_serial.c
index 9bcf149c426..1c3099b388e 100644
--- a/drivers/staging/lirc/lirc_serial.c
+++ b/drivers/staging/lirc/lirc_serial.c
@@ -966,7 +966,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
         if (n % sizeof(int) || count % 2 == 0)
                 return -EINVAL;
         wbuf = memdup_user(buf, n);
-        if (PTR_ERR(wbuf))
+        if (IS_ERR(wbuf))
                 return PTR_ERR(wbuf);
         spin_lock_irqsave(&hardware[type].lock, flags);
         if (type == LIRC_IRDEO) {
@@ -981,6 +981,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
         }
         off();
         spin_unlock_irqrestore(&hardware[type].lock, flags);
+        kfree(wbuf);
         return n;
 }
 
diff --git a/drivers/staging/lirc/lirc_sir.c b/drivers/staging/lirc/lirc_sir.c
index c553ab62623..76be7b8c620 100644
--- a/drivers/staging/lirc/lirc_sir.c
+++ b/drivers/staging/lirc/lirc_sir.c
@@ -330,6 +330,7 @@ static ssize_t lirc_write(struct file *file, const char *buf, size_t n,
         /* enable receiver */
         Ser2UTCR3 = UTCR3_RXE|UTCR3_RIE;
 #endif
+        kfree(tx_buf);
         return count;
 }
 
diff --git a/drivers/staging/lirc/lirc_zilog.c b/drivers/staging/lirc/lirc_zilog.c
index ad29bb1275a..0aad0d7a74a 100644
--- a/drivers/staging/lirc/lirc_zilog.c
+++ b/drivers/staging/lirc/lirc_zilog.c
@@ -20,6 +20,9 @@
  *
  * parts are cut&pasted from the lirc_i2c.c driver
  *
+ * Numerous changes updating lirc_zilog.c in kernel 2.6.38 and later are
+ * Copyright (C) 2011 Andy Walls <awalls@md.metrocast.net>
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 2 of the License, or
@@ -60,38 +63,44 @@
 #include <media/lirc_dev.h>
 #include <media/lirc.h>
 
-struct IR {
-        struct lirc_driver l;
-
-        /* Device info */
-        struct mutex ir_lock;
-        int open;
-        bool is_hdpvr;
-
+struct IR_rx {
         /* RX device */
-        struct i2c_client c_rx;
-        int have_rx;
+        struct i2c_client *c;
 
         /* RX device buffer & lock */
         struct lirc_buffer buf;
         struct mutex buf_lock;
 
         /* RX polling thread data */
-        struct completion *t_notify;
-        struct completion *t_notify2;
-        int shutdown;
         struct task_struct *task;
 
         /* RX read data */
         unsigned char b[3];
+        bool hdpvr_data_fmt;
+};
 
+struct IR_tx {
         /* TX device */
-        struct i2c_client c_tx;
+        struct i2c_client *c;
+
+        /* TX additional actions needed */
         int need_boot;
-        int have_tx;
+        bool post_tx_ready_poll;
+};
+
+struct IR {
+        struct lirc_driver l;
+
+        struct mutex ir_lock;
+        int open;
+
+        struct i2c_adapter *adapter;
+        struct IR_rx *rx;
+        struct IR_tx *tx;
 };
 
 /* Minor -> data mapping */
+static struct mutex ir_devices_lock;
 static struct IR *ir_devices[MAX_IRCTL_DEVICES];
 
 /* Block size for IR transmitter */
@@ -124,14 +133,11 @@ static struct mutex tx_data_lock;
 #define zilog_notify(s, args...) printk(KERN_NOTICE KBUILD_MODNAME ": " s, \
                                         ## args)
 #define zilog_error(s, args...) printk(KERN_ERR KBUILD_MODNAME ": " s, ## args)
-
-#define ZILOG_HAUPPAUGE_IR_RX_NAME "Zilog/Hauppauge IR RX"
-#define ZILOG_HAUPPAUGE_IR_TX_NAME "Zilog/Hauppauge IR TX"
+#define zilog_info(s, args...) printk(KERN_INFO KBUILD_MODNAME ": " s, ## args)
 
 /* module parameters */
 static int debug;       /* debug output */
-static int disable_rx;  /* disable RX device */
-static int disable_tx;  /* disable TX device */
+static int tx_only;     /* only handle the IR Tx function */
 static int minor = -1;  /* minor number */
 
 #define dprintk(fmt, args...)                                           \
@@ -150,8 +156,12 @@ static int add_to_buf(struct IR *ir)
         int ret;
         int failures = 0;
         unsigned char sendbuf[1] = { 0 };
+        struct IR_rx *rx = ir->rx;
 
-        if (lirc_buffer_full(&ir->buf)) {
+        if (rx == NULL)
+                return -ENXIO;
+
+        if (lirc_buffer_full(&rx->buf)) {
                 dprintk("buffer overflow\n");
                 return -EOVERFLOW;
         }
@@ -161,17 +171,25 @@ static int add_to_buf(struct IR *ir)
          * data and we have space
          */
         do {
+                if (kthread_should_stop())
+                        return -ENODATA;
+
                 /*
                  * Lock i2c bus for the duration.  RX/TX chips interfere so
                  * this is worth it
                  */
                 mutex_lock(&ir->ir_lock);
 
+                if (kthread_should_stop()) {
+                        mutex_unlock(&ir->ir_lock);
+                        return -ENODATA;
+                }
+
                 /*
                  * Send random "poll command" (?)  Windows driver does this
                  * and it is a good point to detect chip failure.
                  */
-                ret = i2c_master_send(&ir->c_rx, sendbuf, 1);
+                ret = i2c_master_send(rx->c, sendbuf, 1);
                 if (ret != 1) {
                         zilog_error("i2c_master_send failed with %d\n", ret);
                         if (failures >= 3) {
@@ -186,45 +204,53 @@ static int add_to_buf(struct IR *ir)
                                     "trying reset\n");
 
                         set_current_state(TASK_UNINTERRUPTIBLE);
+                        if (kthread_should_stop()) {
+                                mutex_unlock(&ir->ir_lock);
+                                return -ENODATA;
+                        }
                         schedule_timeout((100 * HZ + 999) / 1000);
-                        ir->need_boot = 1;
+                        ir->tx->need_boot = 1;
 
                         ++failures;
                         mutex_unlock(&ir->ir_lock);
                         continue;
                 }
 
-                ret = i2c_master_recv(&ir->c_rx, keybuf, sizeof(keybuf));
+                if (kthread_should_stop()) {
+                        mutex_unlock(&ir->ir_lock);
+                        return -ENODATA;
+                }
+                ret = i2c_master_recv(rx->c, keybuf, sizeof(keybuf));
                 mutex_unlock(&ir->ir_lock);
                 if (ret != sizeof(keybuf)) {
                         zilog_error("i2c_master_recv failed with %d -- "
                                     "keeping last read buffer\n", ret);
                 } else {
-                        ir->b[0] = keybuf[3];
-                        ir->b[1] = keybuf[4];
-                        ir->b[2] = keybuf[5];
-                        dprintk("key (0x%02x/0x%02x)\n", ir->b[0], ir->b[1]);
+                        rx->b[0] = keybuf[3];
+                        rx->b[1] = keybuf[4];
+                        rx->b[2] = keybuf[5];
+                        dprintk("key (0x%02x/0x%02x)\n", rx->b[0], rx->b[1]);
                 }
 
                 /* key pressed ? */
-                if (ir->is_hdpvr) {
+                if (rx->hdpvr_data_fmt) {
                         if (got_data && (keybuf[0] == 0x80))
                                 return 0;
                         else if (got_data && (keybuf[0] == 0x00))
                                 return -ENODATA;
-                } else if ((ir->b[0] & 0x80) == 0)
+                } else if ((rx->b[0] & 0x80) == 0)
                         return got_data ? 0 : -ENODATA;
 
                 /* look what we have */
-                code = (((__u16)ir->b[0] & 0x7f) << 6) | (ir->b[1] >> 2);
+                code = (((__u16)rx->b[0] & 0x7f) << 6) | (rx->b[1] >> 2);
 
                 codes[0] = (code >> 8) & 0xff;
                 codes[1] = code & 0xff;
 
                 /* return it */
-                lirc_buffer_write(&ir->buf, codes);
+                lirc_buffer_write(&rx->buf, codes);
                 ++got_data;
-        } while (!lirc_buffer_full(&ir->buf));
+        } while (!lirc_buffer_full(&rx->buf));
 
         return 0;
 }
@@ -242,46 +268,35 @@ static int add_to_buf(struct IR *ir)
 static int lirc_thread(void *arg)
 {
         struct IR *ir = arg;
-
-        if (ir->t_notify != NULL)
-                complete(ir->t_notify);
+        struct IR_rx *rx = ir->rx;
 
         dprintk("poll thread started\n");
 
-        do {
-                if (ir->open) {
-                        set_current_state(TASK_INTERRUPTIBLE);
+        while (!kthread_should_stop()) {
+                set_current_state(TASK_INTERRUPTIBLE);
 
-                        /*
-                         * This is ~113*2 + 24 + jitter (2*repeat gap +
-                         * code length).  We use this interval as the chip
-                         * resets every time you poll it (bad!).  This is
-                         * therefore just sufficient to catch all of the
-                         * button presses.  It makes the remote much more
-                         * responsive.  You can see the difference by
-                         * running irw and holding down a button.  With
-                         * 100ms, the old polling interval, you'll notice
-                         * breaks in the repeat sequence corresponding to
-                         * lost keypresses.
-                         */
-                        schedule_timeout((260 * HZ) / 1000);
-                        if (ir->shutdown)
-                                break;
-                        if (!add_to_buf(ir))
-                                wake_up_interruptible(&ir->buf.wait_poll);
-                } else {
-                        /* if device not opened so we can sleep half a second */
-                        set_current_state(TASK_INTERRUPTIBLE);
+                /* if device not opened, we can sleep half a second */
+                if (!ir->open) {
                         schedule_timeout(HZ/2);
+                        continue;
                 }
-        } while (!ir->shutdown);
-
-        if (ir->t_notify2 != NULL)
-                wait_for_completion(ir->t_notify2);
 
-        ir->task = NULL;
-        if (ir->t_notify != NULL)
-                complete(ir->t_notify);
+                /*
+                 * This is ~113*2 + 24 + jitter (2*repeat gap + code length).
+                 * We use this interval as the chip resets every time you poll
+                 * it (bad!).  This is therefore just sufficient to catch all
+                 * of the button presses.  It makes the remote much more
+                 * responsive.  You can see the difference by running irw and
+                 * holding down a button.  With 100ms, the old polling
+                 * interval, you'll notice breaks in the repeat sequence
+                 * corresponding to lost keypresses.
+                 */
+                schedule_timeout((260 * HZ) / 1000);
+                if (kthread_should_stop())
+                        break;
+                if (!add_to_buf(ir))
+                        wake_up_interruptible(&rx->buf.wait_poll);
+        }
 
         dprintk("poll thread ended\n");
         return 0;
@@ -299,10 +314,10 @@ static int set_use_inc(void *data)
          * this is completely broken code. lirc_unregister_driver()
          * must be possible even when the device is open
          */
-        if (ir->c_rx.addr)
-                i2c_use_client(&ir->c_rx);
-        if (ir->c_tx.addr)
-                i2c_use_client(&ir->c_tx);
+        if (ir->rx != NULL)
+                i2c_use_client(ir->rx->c);
+        if (ir->tx != NULL)
+                i2c_use_client(ir->tx->c);
 
         return 0;
 }
@@ -311,10 +326,10 @@ static void set_use_dec(void *data)
 {
         struct IR *ir = data;
 
-        if (ir->c_rx.addr)
-                i2c_release_client(&ir->c_rx);
-        if (ir->c_tx.addr)
-                i2c_release_client(&ir->c_tx);
+        if (ir->rx)
+                i2c_release_client(ir->rx->c);
+        if (ir->tx)
+                i2c_release_client(ir->tx->c);
         if (ir->l.owner != NULL)
                 module_put(ir->l.owner);
 }
@@ -453,7 +468,7 @@ corrupt:
 }
 
 /* send a block of data to the IR TX device */
-static int send_data_block(struct IR *ir, unsigned char *data_block)
+static int send_data_block(struct IR_tx *tx, unsigned char *data_block)
 {
         int i, j, ret;
         unsigned char buf[5];
@@ -467,7 +482,7 @@ static int send_data_block(struct IR *ir, unsigned char *data_block)
                         buf[1 + j] = data_block[i + j];
                 dprintk("%02x %02x %02x %02x %02x",
                         buf[0], buf[1], buf[2], buf[3], buf[4]);
-                ret = i2c_master_send(&ir->c_tx, buf, tosend + 1);
+                ret = i2c_master_send(tx->c, buf, tosend + 1);
                 if (ret != tosend + 1) {
                         zilog_error("i2c_master_send failed with %d\n", ret);
                         return ret < 0 ? ret : -EFAULT;
@@ -478,38 +493,50 @@ static int send_data_block(struct IR *ir, unsigned char *data_block)
 }
 
 /* send boot data to the IR TX device */
-static int send_boot_data(struct IR *ir)
+static int send_boot_data(struct IR_tx *tx)
 {
-        int ret;
+        int ret, i;
         unsigned char buf[4];
 
         /* send the boot block */
-        ret = send_data_block(ir, tx_data->boot_data);
+        ret = send_data_block(tx, tx_data->boot_data);
         if (ret != 0)
                 return ret;
 
-        /* kick it off? */
+        /* Hit the go button to activate the new boot data */
         buf[0] = 0x00;
         buf[1] = 0x20;
-        ret = i2c_master_send(&ir->c_tx, buf, 2);
+        ret = i2c_master_send(tx->c, buf, 2);
         if (ret != 2) {
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
         }
-        ret = i2c_master_send(&ir->c_tx, buf, 1);
+
+        /*
+         * Wait for zilog to settle after hitting go post boot block upload.
+         * Without this delay, the HD-PVR and HVR-1950 both return an -EIO
+         * upon attempting to get firmware revision, and tx probe thus fails.
+         */
+        for (i = 0; i < 10; i++) {
+                ret = i2c_master_send(tx->c, buf, 1);
+                if (ret == 1)
+                        break;
+                udelay(100);
+        }
+
         if (ret != 1) {
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
         }
 
         /* Here comes the firmware version... (hopefully) */
-        ret = i2c_master_recv(&ir->c_tx, buf, 4);
+        ret = i2c_master_recv(tx->c, buf, 4);
         if (ret != 4) {
                 zilog_error("i2c_master_recv failed with %d\n", ret);
                 return 0;
         }
-        if (buf[0] != 0x80) {
-                zilog_error("unexpected IR TX response: %02x\n", buf[0]);
+        if ((buf[0] != 0x80) && (buf[0] != 0xa0)) {
+                zilog_error("unexpected IR TX init response: %02x\n", buf[0]);
                 return 0;
         }
         zilog_notify("Zilog/Hauppauge IR blaster firmware version "
@@ -543,7 +570,7 @@ static void fw_unload(void)
 }
 
 /* load "firmware" for the IR TX device */
-static int fw_load(struct IR *ir)
+static int fw_load(struct IR_tx *tx)
 {
         int ret;
         unsigned int i;
@@ -558,7 +585,7 @@ static int fw_load(struct IR *ir)
         }
 
         /* Request codeset data file */
-        ret = request_firmware(&fw_entry, "haup-ir-blaster.bin", &ir->c_tx.dev);
+        ret = request_firmware(&fw_entry, "haup-ir-blaster.bin", &tx->c->dev);
         if (ret != 0) {
                 zilog_error("firmware haup-ir-blaster.bin not available "
                             "(%d)\n", ret);
@@ -685,20 +712,20 @@ out:
 }
 
 /* initialise the IR TX device */
-static int tx_init(struct IR *ir)
+static int tx_init(struct IR_tx *tx)
 {
         int ret;
 
         /* Load 'firmware' */
-        ret = fw_load(ir);
+        ret = fw_load(tx);
         if (ret != 0)
                 return ret;
 
         /* Send boot block */
-        ret = send_boot_data(ir);
+        ret = send_boot_data(tx);
         if (ret != 0)
                 return ret;
-        ir->need_boot = 0;
+        tx->need_boot = 0;
 
         /* Looks good */
         return 0;
@@ -714,20 +741,20 @@ static loff_t lseek(struct file *filep, loff_t offset, int orig)
 static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
 {
         struct IR *ir = filep->private_data;
-        unsigned char buf[ir->buf.chunk_size];
+        struct IR_rx *rx = ir->rx;
         int ret = 0, written = 0;
         DECLARE_WAITQUEUE(wait, current);
 
         dprintk("read called\n");
-        if (ir->c_rx.addr == 0)
+        if (rx == NULL)
                 return -ENODEV;
 
-        if (mutex_lock_interruptible(&ir->buf_lock))
+        if (mutex_lock_interruptible(&rx->buf_lock))
                 return -ERESTARTSYS;
 
-        if (n % ir->buf.chunk_size) {
+        if (n % rx->buf.chunk_size) {
                 dprintk("read result = -EINVAL\n");
-                mutex_unlock(&ir->buf_lock);
+                mutex_unlock(&rx->buf_lock);
                 return -EINVAL;
         }
 
@@ -736,7 +763,7 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
          * to avoid losing scan code (in case when queue is awaken somewhere
          * between while condition checking and scheduling)
          */
-        add_wait_queue(&ir->buf.wait_poll, &wait);
+        add_wait_queue(&rx->buf.wait_poll, &wait);
         set_current_state(TASK_INTERRUPTIBLE);
 
         /*
@@ -744,7 +771,7 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
          * mode and 'copy_to_user' is happy, wait for data.
          */
         while (written < n && ret == 0) {
-                if (lirc_buffer_empty(&ir->buf)) {
+                if (lirc_buffer_empty(&rx->buf)) {
                         /*
                          * According to the read(2) man page, 'written' can be
                          * returned as less than 'n', instead of blocking
@@ -764,16 +791,17 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
                         schedule();
                         set_current_state(TASK_INTERRUPTIBLE);
                 } else {
-                        lirc_buffer_read(&ir->buf, buf);
+                        unsigned char buf[rx->buf.chunk_size];
+                        lirc_buffer_read(&rx->buf, buf);
                         ret = copy_to_user((void *)outbuf+written, buf,
-                                           ir->buf.chunk_size);
-                        written += ir->buf.chunk_size;
+                                           rx->buf.chunk_size);
+                        written += rx->buf.chunk_size;
                 }
         }
 
-        remove_wait_queue(&ir->buf.wait_poll, &wait);
+        remove_wait_queue(&rx->buf.wait_poll, &wait);
         set_current_state(TASK_RUNNING);
-        mutex_unlock(&ir->buf_lock);
+        mutex_unlock(&rx->buf_lock);
 
         dprintk("read result = %s (%d)\n",
                 ret ? "-EFAULT" : "OK", ret);
@@ -782,7 +810,7 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
 }
 
 /* send a keypress to the IR TX device */
-static int send_code(struct IR *ir, unsigned int code, unsigned int key)
+static int send_code(struct IR_tx *tx, unsigned int code, unsigned int key)
 {
         unsigned char data_block[TX_BLOCK_SIZE];
         unsigned char buf[2];
@@ -799,26 +827,34 @@ static int send_code(struct IR *ir, unsigned int code, unsigned int key)
                 return ret;
 
         /* Send the data block */
-        ret = send_data_block(ir, data_block);
+        ret = send_data_block(tx, data_block);
         if (ret != 0)
                 return ret;
 
         /* Send data block length? */
         buf[0] = 0x00;
         buf[1] = 0x40;
-        ret = i2c_master_send(&ir->c_tx, buf, 2);
+        ret = i2c_master_send(tx->c, buf, 2);
         if (ret != 2) {
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
         }
-        ret = i2c_master_send(&ir->c_tx, buf, 1);
+
+        /* Give the z8 a moment to process data block */
+        for (i = 0; i < 10; i++) {
+                ret = i2c_master_send(tx->c, buf, 1);
+                if (ret == 1)
+                        break;
+                udelay(100);
+        }
+
         if (ret != 1) {
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
         }
 
         /* Send finished download? */
-        ret = i2c_master_recv(&ir->c_tx, buf, 1);
+        ret = i2c_master_recv(tx->c, buf, 1);
         if (ret != 1) {
                 zilog_error("i2c_master_recv failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
@@ -832,7 +868,7 @@ static int send_code(struct IR *ir, unsigned int code, unsigned int key)
         /* Send prepare command? */
         buf[0] = 0x00;
         buf[1] = 0x80;
-        ret = i2c_master_send(&ir->c_tx, buf, 2);
+        ret = i2c_master_send(tx->c, buf, 2);
         if (ret != 2) {
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
@@ -843,7 +879,7 @@ static int send_code(struct IR *ir, unsigned int code, unsigned int key)
          * last i2c_master_recv always fails with a -5, so for now, we're
          * going to skip this whole mess and say we're done on the HD PVR
          */
-        if (ir->is_hdpvr) {
+        if (!tx->post_tx_ready_poll) {
                 dprintk("sent code %u, key %u\n", code, key);
                 return 0;
         }
@@ -857,7 +893,7 @@ static int send_code(struct IR *ir, unsigned int code, unsigned int key)
         for (i = 0; i < 20; ++i) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
                 schedule_timeout((50 * HZ + 999) / 1000);
-                ret = i2c_master_send(&ir->c_tx, buf, 1);
+                ret = i2c_master_send(tx->c, buf, 1);
                 if (ret == 1)
                         break;
                 dprintk("NAK expected: i2c_master_send "
@@ -870,7 +906,7 @@ static int send_code(struct IR *ir, unsigned int code, unsigned int key)
         }
 
         /* Seems to be an 'ok' response */
-        i = i2c_master_recv(&ir->c_tx, buf, 1);
+        i = i2c_master_recv(tx->c, buf, 1);
         if (i != 1) {
                 zilog_error("i2c_master_recv failed with %d\n", ret);
                 return -EFAULT;
@@ -895,10 +931,11 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
                           loff_t *ppos)
 {
         struct IR *ir = filep->private_data;
+        struct IR_tx *tx = ir->tx;
         size_t i;
         int failures = 0;
 
-        if (ir->c_tx.addr == 0)
+        if (tx == NULL)
                 return -ENODEV;
 
         /* Validate user parameters */
@@ -919,15 +956,15 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
                 }
 
                 /* Send boot data first if required */
-                if (ir->need_boot == 1) {
-                        ret = send_boot_data(ir);
+                if (tx->need_boot == 1) {
+                        ret = send_boot_data(tx);
                         if (ret == 0)
-                                ir->need_boot = 0;
+                                tx->need_boot = 0;
                 }
 
                 /* Send the code */
                 if (ret == 0) {
-                        ret = send_code(ir, (unsigned)command >> 16,
+                        ret = send_code(tx, (unsigned)command >> 16,
                                             (unsigned)command & 0xFFFF);
                         if (ret == -EPROTO) {
                                 mutex_unlock(&ir->ir_lock);
@@ -952,7 +989,7 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
                         }
                         set_current_state(TASK_UNINTERRUPTIBLE);
                         schedule_timeout((100 * HZ + 999) / 1000);
-                        ir->need_boot = 1;
+                        tx->need_boot = 1;
                         ++failures;
                 } else
                         i += sizeof(int);
@@ -969,22 +1006,23 @@ static ssize_t write(struct file *filep, const char *buf, size_t n,
 static unsigned int poll(struct file *filep, poll_table *wait)
 {
         struct IR *ir = filep->private_data;
+        struct IR_rx *rx = ir->rx;
         unsigned int ret;
 
         dprintk("poll called\n");
-        if (ir->c_rx.addr == 0)
+        if (rx == NULL)
                 return -ENODEV;
 
-        mutex_lock(&ir->buf_lock);
+        mutex_lock(&rx->buf_lock);
 
-        poll_wait(filep, &ir->buf.wait_poll, wait);
+        poll_wait(filep, &rx->buf.wait_poll, wait);
 
         dprintk("poll result = %s\n",
-                lirc_buffer_empty(&ir->buf) ? "0" : "POLLIN|POLLRDNORM");
+                lirc_buffer_empty(&rx->buf) ? "0" : "POLLIN|POLLRDNORM");
 
-        ret = lirc_buffer_empty(&ir->buf) ? 0 : (POLLIN|POLLRDNORM);
+        ret = lirc_buffer_empty(&rx->buf) ? 0 : (POLLIN|POLLRDNORM);
 
-        mutex_unlock(&ir->buf_lock);
+        mutex_unlock(&rx->buf_lock);
         return ret;
 }
 
@@ -994,10 +1032,9 @@ static long ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
         int result;
         unsigned long mode, features = 0;
 
-        if (ir->c_rx.addr != 0)
+        features |= LIRC_CAN_SEND_PULSE;
+        if (ir->rx != NULL)
                 features |= LIRC_CAN_REC_LIRCCODE;
-        if (ir->c_tx.addr != 0)
-                features |= LIRC_CAN_SEND_PULSE;
 
         switch (cmd) {
         case LIRC_GET_LENGTH:
@@ -1024,15 +1061,9 @@ static long ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
                         result = -EINVAL;
                 break;
         case LIRC_GET_SEND_MODE:
-                if (!(features&LIRC_CAN_SEND_MASK))
-                        return -ENOSYS;
-
                 result = put_user(LIRC_MODE_PULSE, (unsigned long *) arg);
                 break;
         case LIRC_SET_SEND_MODE:
-                if (!(features&LIRC_CAN_SEND_MASK))
-                        return -ENOSYS;
-
                 result = get_user(mode, (unsigned long *) arg);
                 if (!result && mode != LIRC_MODE_PULSE)
                         return -EINVAL;
@@ -1043,6 +1074,15 @@ static long ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
         return result;
 }
 
+/* ir_devices_lock must be held */
+static struct IR *find_ir_device_by_minor(unsigned int minor)
+{
+        if (minor >= MAX_IRCTL_DEVICES)
+                return NULL;
+
+        return ir_devices[minor];
+}
+
 /*
  * Open the IR device.  Get hold of our IR structure and
  * stash it in private_data for the file
@@ -1051,15 +1091,15 @@ static int open(struct inode *node, struct file *filep)
 {
         struct IR *ir;
         int ret;
+        unsigned int minor = MINOR(node->i_rdev);
 
         /* find our IR struct */
-        unsigned minor = MINOR(node->i_rdev);
-        if (minor >= MAX_IRCTL_DEVICES) {
-                dprintk("minor %d: open result = -ENODEV\n",
-                        minor);
+        mutex_lock(&ir_devices_lock);
+        ir = find_ir_device_by_minor(minor);
+        mutex_unlock(&ir_devices_lock);
+
+        if (ir == NULL)
                 return -ENODEV;
-        }
-        ir = ir_devices[minor];
 
         /* increment in use count */
         mutex_lock(&ir->ir_lock);
@@ -1106,7 +1146,6 @@ static struct lirc_driver lirc_template = {
 
 static int ir_remove(struct i2c_client *client);
 static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id);
-static int ir_command(struct i2c_client *client, unsigned int cmd, void *arg);
 
 #define ID_FLAG_TX      0x01
 #define ID_FLAG_HDPVR   0x02
@@ -1126,7 +1165,6 @@ static struct i2c_driver driver = {
         },
         .probe          = ir_probe,
         .remove         = ir_remove,
-        .command        = ir_command,
         .id_table       = ir_transceiver_id,
 };
 
@@ -1144,214 +1182,253 @@ static const struct file_operations lirc_fops = {
         .release        = close
 };
 
-static int ir_remove(struct i2c_client *client)
+static void destroy_rx_kthread(struct IR_rx *rx)
 {
-        struct IR *ir = i2c_get_clientdata(client);
+        /* end up polling thread */
+        if (rx != NULL && !IS_ERR_OR_NULL(rx->task)) {
+                kthread_stop(rx->task);
+                rx->task = NULL;
+        }
+}
 
-        mutex_lock(&ir->ir_lock);
+/* ir_devices_lock must be held */
+static int add_ir_device(struct IR *ir)
+{
+        int i;
 
-        if (ir->have_rx || ir->have_tx) {
-                DECLARE_COMPLETION(tn);
-                DECLARE_COMPLETION(tn2);
-
-                /* end up polling thread */
-                if (ir->task && !IS_ERR(ir->task)) {
-                        ir->t_notify = &tn;
-                        ir->t_notify2 = &tn2;
-                        ir->shutdown = 1;
-                        wake_up_process(ir->task);
-                        complete(&tn2);
-                        wait_for_completion(&tn);
-                        ir->t_notify = NULL;
-                        ir->t_notify2 = NULL;
+        for (i = 0; i < MAX_IRCTL_DEVICES; i++)
+                if (ir_devices[i] == NULL) {
+                        ir_devices[i] = ir;
+                        break;
                 }
 
-        } else {
-                mutex_unlock(&ir->ir_lock);
-                zilog_error("%s: detached from something we didn't "
-                            "attach to\n", __func__);
-                return -ENODEV;
+        return i == MAX_IRCTL_DEVICES ? -ENOMEM : i;
+}
+
+/* ir_devices_lock must be held */
+static void del_ir_device(struct IR *ir)
+{
+        int i;
+
+        for (i = 0; i < MAX_IRCTL_DEVICES; i++)
+                if (ir_devices[i] == ir) {
+                        ir_devices[i] = NULL;
+                        break;
+                }
+}
+
+static int ir_remove(struct i2c_client *client)
+{
+        struct IR *ir = i2c_get_clientdata(client);
+
+        mutex_lock(&ir_devices_lock);
+
+        if (ir == NULL) {
+                /* We destroyed everything when the first client came through */
+                mutex_unlock(&ir_devices_lock);
+                return 0;
         }
 
-        /* unregister lirc driver */
-        if (ir->l.minor >= 0 && ir->l.minor < MAX_IRCTL_DEVICES) {
-                lirc_unregister_driver(ir->l.minor);
-                ir_devices[ir->l.minor] = NULL;
+        /* Good-bye LIRC */
+        lirc_unregister_driver(ir->l.minor);
+
+        /* Good-bye Rx */
+        destroy_rx_kthread(ir->rx);
+        if (ir->rx != NULL) {
+                if (ir->rx->buf.fifo_initialized)
+                        lirc_buffer_free(&ir->rx->buf);
+                i2c_set_clientdata(ir->rx->c, NULL);
+                kfree(ir->rx);
         }
 
-        /* free memory */
-        lirc_buffer_free(&ir->buf);
-        mutex_unlock(&ir->ir_lock);
+        /* Good-bye Tx */
+        i2c_set_clientdata(ir->tx->c, NULL);
+        kfree(ir->tx);
+
+        /* Good-bye IR */
+        del_ir_device(ir);
         kfree(ir);
 
+        mutex_unlock(&ir_devices_lock);
         return 0;
 }
 
-static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
+
+/* ir_devices_lock must be held */
+static struct IR *find_ir_device_by_adapter(struct i2c_adapter *adapter)
 {
+        int i;
         struct IR *ir = NULL;
+
+        for (i = 0; i < MAX_IRCTL_DEVICES; i++)
+                if (ir_devices[i] != NULL &&
+                    ir_devices[i]->adapter == adapter) {
+                        ir = ir_devices[i];
+                        break;
+                }
+
+        return ir;
+}
+
+static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
+{
+        struct IR *ir;
         struct i2c_adapter *adap = client->adapter;
-        char buf;
         int ret;
-        int have_rx = 0, have_tx = 0;
+        bool tx_probe = false;
 
-        dprintk("%s: adapter name (%s) nr %d, i2c_device_id name (%s), "
-                "client addr=0x%02x\n",
-                __func__, adap->name, adap->nr, id->name, client->addr);
+        dprintk("%s: %s on i2c-%d (%s), client addr=0x%02x\n",
+                __func__, id->name, adap->nr, adap->name, client->addr);
 
         /*
-         * FIXME - This probe function probes both the Tx and Rx
-         * addresses of the IR microcontroller.
-         *
-         * However, the I2C subsystem is passing along one I2C client at a
-         * time, based on matches to the ir_transceiver_id[] table above.
-         * The expectation is that each i2c_client address will be probed
-         * individually by drivers so the I2C subsystem can mark all client
-         * addresses as claimed or not.
-         *
-         * This probe routine causes only one of the client addresses, TX or RX,
-         * to be claimed.  This will cause a problem if the I2C subsystem is
-         * subsequently triggered to probe unclaimed clients again.
+         * The IR receiver    is at i2c address 0x71.
+         * The IR transmitter is at i2c address 0x70.
          */
-        /*
-         * The external IR receiver is at i2c address 0x71.
-         * The IR transmitter is at 0x70.
-         */
-        client->addr = 0x70;
 
-        if (!disable_tx) {
-                if (i2c_master_recv(client, &buf, 1) == 1)
-                        have_tx = 1;
-                dprintk("probe 0x70 @ %s: %s\n",
-                        adap->name, have_tx ? "success" : "failed");
-        }
+        if (id->driver_data & ID_FLAG_TX)
+                tx_probe = true;
+        else if (tx_only) /* module option */
+                return -ENXIO;
 
-        if (!disable_rx) {
-                client->addr = 0x71;
-                if (i2c_master_recv(client, &buf, 1) == 1)
-                        have_rx = 1;
-                dprintk("probe 0x71 @ %s: %s\n",
-                        adap->name, have_rx ? "success" : "failed");
-        }
+        zilog_info("probing IR %s on %s (i2c-%d)\n",
+                   tx_probe ? "Tx" : "Rx", adap->name, adap->nr);
 
-        if (!(have_rx || have_tx)) {
-                zilog_error("%s: no devices found\n", adap->name);
-                goto out_nodev;
-        }
+        mutex_lock(&ir_devices_lock);
 
-        printk(KERN_INFO "lirc_zilog: chip found with %s\n",
-                have_rx && have_tx ? "RX and TX" :
-                        have_rx ? "RX only" : "TX only");
+        /* Use a single struct IR instance for both the Rx and Tx functions */
+        ir = find_ir_device_by_adapter(adap);
+        if (ir == NULL) {
+                ir = kzalloc(sizeof(struct IR), GFP_KERNEL);
+                if (ir == NULL) {
+                        ret = -ENOMEM;
+                        goto out_no_ir;
+                }
+                /* store for use in ir_probe() again, and open() later on */
+                ret = add_ir_device(ir);
+                if (ret)
+                        goto out_free_ir;
+
+                ir->adapter = adap;
+                mutex_init(&ir->ir_lock);
+
+                /* set lirc_dev stuff */
+                memcpy(&ir->l, &lirc_template, sizeof(struct lirc_driver));
+                ir->l.minor       = minor; /* module option */
+                ir->l.code_length = 13;
+                ir->l.rbuf        = NULL;
+                ir->l.fops        = &lirc_fops;
+                ir->l.data        = ir;
+                ir->l.dev         = &adap->dev;
+                ir->l.sample_rate = 0;
+        }
 
-        ir = kzalloc(sizeof(struct IR), GFP_KERNEL);
+        if (tx_probe) {
+                /* Set up a struct IR_tx instance */
+                ir->tx = kzalloc(sizeof(struct IR_tx), GFP_KERNEL);
+                if (ir->tx == NULL) {
+                        ret = -ENOMEM;
+                        goto out_free_xx;
+                }
 
-        if (!ir)
-                goto out_nomem;
+                ir->tx->c = client;
+                ir->tx->need_boot = 1;
+                ir->tx->post_tx_ready_poll =
+                               (id->driver_data & ID_FLAG_HDPVR) ? false : true;
+        } else {
+                /* Set up a struct IR_rx instance */
+                ir->rx = kzalloc(sizeof(struct IR_rx), GFP_KERNEL);
+                if (ir->rx == NULL) {
+                        ret = -ENOMEM;
+                        goto out_free_xx;
+                }
 
-        ret = lirc_buffer_init(&ir->buf, 2, BUFLEN / 2);
-        if (ret)
-                goto out_nomem;
+                ret = lirc_buffer_init(&ir->rx->buf, 2, BUFLEN / 2);
+                if (ret)
+                        goto out_free_xx;
 
-        mutex_init(&ir->ir_lock);
-        mutex_init(&ir->buf_lock);
-        ir->need_boot = 1;
-        ir->is_hdpvr = (id->driver_data & ID_FLAG_HDPVR) ? true : false;
+                mutex_init(&ir->rx->buf_lock);
+                ir->rx->c = client;
+                ir->rx->hdpvr_data_fmt =
+                               (id->driver_data & ID_FLAG_HDPVR) ? true : false;
 
-        memcpy(&ir->l, &lirc_template, sizeof(struct lirc_driver));
-        ir->l.minor = -1;
+                /* set lirc_dev stuff */
+                ir->l.rbuf = &ir->rx->buf;
+        }
 
-        /* I2C attach to device */
         i2c_set_clientdata(client, ir);
 
-        /* initialise RX device */
-        if (have_rx) {
-                DECLARE_COMPLETION(tn);
-                memcpy(&ir->c_rx, client, sizeof(struct i2c_client));
-
-                ir->c_rx.addr = 0x71;
-                strlcpy(ir->c_rx.name, ZILOG_HAUPPAUGE_IR_RX_NAME,
-                        I2C_NAME_SIZE);
+        /* Proceed only if we have the required Tx and Rx clients ready to go */
+        if (ir->tx == NULL ||
+            (ir->rx == NULL && !tx_only)) {
+                zilog_info("probe of IR %s on %s (i2c-%d) done. Waiting on "
+                           "IR %s.\n", tx_probe ? "Tx" : "Rx", adap->name,
+                           adap->nr, tx_probe ? "Rx" : "Tx");
+                goto out_ok;
+        }
 
+        /* initialise RX device */
+        if (ir->rx != NULL) {
                 /* try to fire up polling thread */
-                ir->t_notify = &tn;
-                ir->task = kthread_run(lirc_thread, ir, "lirc_zilog");
-                if (IS_ERR(ir->task)) {
-                        ret = PTR_ERR(ir->task);
-                        zilog_error("lirc_register_driver: cannot run "
-                                    "poll thread %d\n", ret);
-                        goto err;
+                ir->rx->task = kthread_run(lirc_thread, ir,
+                                           "zilog-rx-i2c-%d", adap->nr);
+                if (IS_ERR(ir->rx->task)) {
+                        ret = PTR_ERR(ir->rx->task);
+                        zilog_error("%s: could not start IR Rx polling thread"
+                                    "\n", __func__);
+                        goto out_free_xx;
                 }
-                wait_for_completion(&tn);
-                ir->t_notify = NULL;
-                ir->have_rx = 1;
         }
 
-        /* initialise TX device */
-        if (have_tx) {
-                memcpy(&ir->c_tx, client, sizeof(struct i2c_client));
-                ir->c_tx.addr = 0x70;
-                strlcpy(ir->c_tx.name, ZILOG_HAUPPAUGE_IR_TX_NAME,
-                        I2C_NAME_SIZE);
-                ir->have_tx = 1;
-        }
-
-        /* set lirc_dev stuff */
-        ir->l.code_length = 13;
-        ir->l.rbuf        = &ir->buf;
-        ir->l.fops        = &lirc_fops;
-        ir->l.data        = ir;
-        ir->l.minor       = minor;
-        ir->l.dev         = &adap->dev;
-        ir->l.sample_rate = 0;
-
         /* register with lirc */
         ir->l.minor = lirc_register_driver(&ir->l);
         if (ir->l.minor < 0 || ir->l.minor >= MAX_IRCTL_DEVICES) {
-                zilog_error("ir_attach: \"minor\" must be between 0 and %d "
-                            "(%d)!\n", MAX_IRCTL_DEVICES-1, ir->l.minor);
+                zilog_error("%s: \"minor\" must be between 0 and %d (%d)!\n",
+                            __func__, MAX_IRCTL_DEVICES-1, ir->l.minor);
                 ret = -EBADRQC;
-                goto err;
+                goto out_free_thread;
         }
 
-        /* store this for getting back in open() later on */
-        ir_devices[ir->l.minor] = ir;
-
         /*
          * if we have the tx device, load the 'firmware'.  We do this
          * after registering with lirc as otherwise hotplug seems to take
          * 10s to create the lirc device.
          */
-        if (have_tx) {
-                /* Special TX init */
-                ret = tx_init(ir);
-                if (ret != 0)
-                        goto err;
-        }
+        ret = tx_init(ir->tx);
+        if (ret != 0)
+                goto out_unregister;
 
+        zilog_info("probe of IR %s on %s (i2c-%d) done. IR unit ready.\n",
+                   tx_probe ? "Tx" : "Rx", adap->name, adap->nr);
+out_ok:
+        mutex_unlock(&ir_devices_lock);
         return 0;
 
-err:
-        /* undo everything, hopefully... */
-        if (ir->c_rx.addr)
-                ir_remove(&ir->c_rx);
-        if (ir->c_tx.addr)
-                ir_remove(&ir->c_tx);
-        return ret;
-
-out_nodev:
-        zilog_error("no device found\n");
-        return -ENODEV;
-
-out_nomem:
-        zilog_error("memory allocation failure\n");
+out_unregister:
+        lirc_unregister_driver(ir->l.minor);
+out_free_thread:
+        destroy_rx_kthread(ir->rx);
+out_free_xx:
+        if (ir->rx != NULL) {
+                if (ir->rx->buf.fifo_initialized)
+                        lirc_buffer_free(&ir->rx->buf);
+                if (ir->rx->c != NULL)
+                        i2c_set_clientdata(ir->rx->c, NULL);
+                kfree(ir->rx);
+        }
+        if (ir->tx != NULL) {
+                if (ir->tx->c != NULL)
+                        i2c_set_clientdata(ir->tx->c, NULL);
+                kfree(ir->tx);
+        }
+out_free_ir:
+        del_ir_device(ir);
         kfree(ir);
-        return -ENOMEM;
-}
-
-static int ir_command(struct i2c_client *client, unsigned int cmd, void *arg)
-{
-        /* nothing */
-        return 0;
+out_no_ir:
+        zilog_error("%s: probing IR %s on %s (i2c-%d) failed with %d\n",
+                    __func__, tx_probe ? "Tx" : "Rx", adap->name, adap->nr,
+                   ret);
+        mutex_unlock(&ir_devices_lock);
+        return ret;
 }
 
 static int __init zilog_init(void)
@@ -1361,6 +1438,7 @@ static int __init zilog_init(void)
         zilog_notify("Zilog/Hauppauge IR driver initializing\n");
 
         mutex_init(&tx_data_lock);
+        mutex_init(&ir_devices_lock);
 
         request_module("firmware_class");
 
@@ -1386,7 +1464,8 @@ module_exit(zilog_exit);
 
 MODULE_DESCRIPTION("Zilog/Hauppauge infrared transmitter driver (i2c stack)");
 MODULE_AUTHOR("Gerd Knorr, Michal Kochanowicz, Christoph Bartelmus, "
-              "Ulrich Mueller, Stefan Jahn, Jerome Brock, Mark Weaver");
+              "Ulrich Mueller, Stefan Jahn, Jerome Brock, Mark Weaver, "
+              "Andy Walls");
 MODULE_LICENSE("GPL");
 /* for compat with old name, which isn't all that accurate anymore */
 MODULE_ALIAS("lirc_pvr150");
@@ -1397,8 +1476,5 @@ MODULE_PARM_DESC(minor, "Preferred minor device number");
 module_param(debug, bool, 0644);
 MODULE_PARM_DESC(debug, "Enable debugging messages");
 
-module_param(disable_rx, bool, 0644);
-MODULE_PARM_DESC(disable_rx, "Disable the IR receiver device");
-
-module_param(disable_tx, bool, 0644);
-MODULE_PARM_DESC(disable_tx, "Disable the IR transmitter device");
+module_param(tx_only, bool, 0644);
+MODULE_PARM_DESC(tx_only, "Only handle the IR transmit function");
diff --git a/drivers/staging/msm/msm_fb.c b/drivers/staging/msm/msm_fb.c
index 23fa049b51f..a2f29d46405 100644
--- a/drivers/staging/msm/msm_fb.c
+++ b/drivers/staging/msm/msm_fb.c
@@ -347,7 +347,7 @@ static int msm_fb_suspend(struct platform_device *pdev, pm_message_t state)
         if ((!mfd) || (mfd->key != MFD_KEY))
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(mfd->fbi, 1);
 
         ret = msm_fb_suspend_sub(mfd);
@@ -358,7 +358,7 @@ static int msm_fb_suspend(struct platform_device *pdev, pm_message_t state)
                 pdev->dev.power.power_state = state;
         }
 
-        release_console_sem();
+        console_unlock();
         return ret;
 }
 #else
@@ -431,11 +431,11 @@ static int msm_fb_resume(struct platform_device *pdev)
         if ((!mfd) || (mfd->key != MFD_KEY))
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         ret = msm_fb_resume_sub(mfd);
         pdev->dev.power.power_state = PMSG_ON;
         fb_set_suspend(mfd->fbi, 1);
-        release_console_sem();
+        console_unlock();
 
         return ret;
 }
diff --git a/drivers/staging/olpc_dcon/olpc_dcon.c b/drivers/staging/olpc_dcon/olpc_dcon.c
index 9f26dc9408b..56a283d1a74 100644
--- a/drivers/staging/olpc_dcon/olpc_dcon.c
+++ b/drivers/staging/olpc_dcon/olpc_dcon.c
@@ -373,17 +373,17 @@ static void dcon_source_switch(struct work_struct *work)
                  *
                  * For now, we just hope..
                  */
-                acquire_console_sem();
+                console_lock();
                 ignore_fb_events = 1;
                 if (fb_blank(fbinfo, FB_BLANK_UNBLANK)) {
                         ignore_fb_events = 0;
-                        release_console_sem();
+                        console_unlock();
                         printk(KERN_ERR "olpc-dcon:  Failed to enter CPU mode\n");
                         dcon_pending = DCON_SOURCE_DCON;
                         return;
                 }
                 ignore_fb_events = 0;
-                release_console_sem();
+                console_unlock();
 
                 /* And turn off the DCON */
                 pdata->set_dconload(1);
@@ -435,12 +435,12 @@ static void dcon_source_switch(struct work_struct *work)
                         }
                 }
 
-                acquire_console_sem();
+                console_lock();
                 ignore_fb_events = 1;
                 if (fb_blank(fbinfo, FB_BLANK_POWERDOWN))
                         printk(KERN_ERR "olpc-dcon:  couldn't blank fb!\n");
                 ignore_fb_events = 0;
-                release_console_sem();
+                console_unlock();
 
                 printk(KERN_INFO "olpc-dcon: The DCON has control\n");
                 break;
diff --git a/drivers/staging/rt2860/rt_main_dev.c b/drivers/staging/rt2860/rt_main_dev.c
index 701561d6b6f..236dd36d349 100644
--- a/drivers/staging/rt2860/rt_main_dev.c
+++ b/drivers/staging/rt2860/rt_main_dev.c
@@ -484,8 +484,6 @@ struct net_device *RtmpPhyNetDevInit(struct rt_rtmp_adapter *pAd,
         net_dev->ml_priv = (void *)pAd;
         pAd->net_dev = net_dev;
 
-        netif_stop_queue(net_dev);
-
         return net_dev;
 
 }
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index ee68d51caa4..322bf49ee90 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -106,6 +106,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x0411, 0x016f)},   /* MelCo.,Inc. WLI-UC-G301N */
         {USB_DEVICE(0x1737, 0x0070)},   /* Linksys WUSB100 */
         {USB_DEVICE(0x1737, 0x0071)},   /* Linksys WUSB600N */
+        {USB_DEVICE(0x1737, 0x0078)},   /* Linksys WUSB100v2 */
         {USB_DEVICE(0x0411, 0x00e8)},   /* Buffalo WLI-UC-G300N */
         {USB_DEVICE(0x050d, 0x815c)},   /* Belkin F5D8053 */
         {USB_DEVICE(0x100D, 0x9031)},   /* Motorola 2770 */
diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c
index 32088a641eb..84be383abec 100644
--- a/drivers/staging/rtl8712/hal_init.c
+++ b/drivers/staging/rtl8712/hal_init.c
@@ -128,12 +128,13 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
         u8 *ptmpchar = NULL, *ppayload, *ptr;
         struct tx_desc *ptx_desc;
         u32 txdscp_sz = sizeof(struct tx_desc);
+        u8 ret = _FAIL;
 
         ulfilelength = rtl871x_open_fw(padapter, &phfwfile_hdl, &pmappedfw);
         if (pmappedfw && (ulfilelength > 0)) {
                 update_fwhdr(&fwhdr, pmappedfw);
                 if (chk_fwhdr(&fwhdr, ulfilelength) == _FAIL)
-                        goto exit_fail;
+                        goto firmware_rel;
                 fill_fwpriv(padapter, &fwhdr.fwpriv);
                 /* firmware check ok */
                 maxlen = (fwhdr.img_IMEM_size > fwhdr.img_SRAM_size) ?
@@ -141,7 +142,7 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
                 maxlen += txdscp_sz;
                 ptmpchar = _malloc(maxlen + FWBUFF_ALIGN_SZ);
                 if (ptmpchar == NULL)
-                        return _FAIL;
+                        goto firmware_rel;
 
                 ptx_desc = (struct tx_desc *)(ptmpchar + FWBUFF_ALIGN_SZ -
                             ((addr_t)(ptmpchar) & (FWBUFF_ALIGN_SZ - 1)));
@@ -273,11 +274,13 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
                         goto exit_fail;
         } else
                 goto exit_fail;
-        return _SUCCESS;
+        ret = _SUCCESS;
 
 exit_fail:
         kfree(ptmpchar);
-        return _FAIL;
+firmware_rel:
+        release_firmware((struct firmware *)phfwfile_hdl);
+        return ret;
 }
 
 uint rtl8712_hal_init(struct _adapter *padapter)
diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
index a692ee88b9e..21ce2af447b 100644
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -47,54 +47,123 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
 static void r871xu_dev_remove(struct usb_interface *pusb_intf);
 
 static struct usb_device_id rtl871x_usb_id_tbl[] = {
-        /*92SU
-         * Realtek */
-        {USB_DEVICE(0x0bda, 0x8171)},
-        {USB_DEVICE(0x0bda, 0x8172)},
+
+/* RTL8188SU */
+        /* Realtek */
+        {USB_DEVICE(0x0BDA, 0x8171)},
         {USB_DEVICE(0x0bda, 0x8173)},
-        {USB_DEVICE(0x0bda, 0x8174)},
         {USB_DEVICE(0x0bda, 0x8712)},
         {USB_DEVICE(0x0bda, 0x8713)},
         {USB_DEVICE(0x0bda, 0xC512)},
-        /* Abocom  */
+        /* Abocom */
         {USB_DEVICE(0x07B8, 0x8188)},
+        /* ASUS */
+        {USB_DEVICE(0x0B05, 0x1786)},
+        {USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
+        /* Belkin */
+        {USB_DEVICE(0x050D, 0x945A)},
         /* Corega */
-        {USB_DEVICE(0x07aa, 0x0047)},
-        /* Dlink */
-        {USB_DEVICE(0x07d1, 0x3303)},
-        {USB_DEVICE(0x07d1, 0x3302)},
-        {USB_DEVICE(0x07d1, 0x3300)},
-        /* Dlink for Skyworth */
-        {USB_DEVICE(0x14b2, 0x3300)},
-        {USB_DEVICE(0x14b2, 0x3301)},
-        {USB_DEVICE(0x14b2, 0x3302)},
+        {USB_DEVICE(0x07AA, 0x0047)},
+        /* D-Link */
+        {USB_DEVICE(0x2001, 0x3306)},
+        {USB_DEVICE(0x07D1, 0x3306)}, /* 11n mode disable */
+        /* Edimax */
+        {USB_DEVICE(0x7392, 0x7611)},
         /* EnGenius */
         {USB_DEVICE(0x1740, 0x9603)},
-        {USB_DEVICE(0x1740, 0x9605)},
+        /* Hawking */
+        {USB_DEVICE(0x0E66, 0x0016)},
+        /* Hercules */
+        {USB_DEVICE(0x06F8, 0xE034)},
+        {USB_DEVICE(0x06F8, 0xE032)},
+        /* Logitec */
+        {USB_DEVICE(0x0789, 0x0167)},
+        /* PCI */
+        {USB_DEVICE(0x2019, 0xAB28)},
+        {USB_DEVICE(0x2019, 0xED16)},
+        /* Sitecom */
+        {USB_DEVICE(0x0DF6, 0x0057)},
+        {USB_DEVICE(0x0DF6, 0x0045)},
+        {USB_DEVICE(0x0DF6, 0x0059)}, /* 11n mode disable */
+        {USB_DEVICE(0x0DF6, 0x004B)},
+        {USB_DEVICE(0x0DF6, 0x0063)},
+        /* Sweex */
+        {USB_DEVICE(0x177F, 0x0154)},
+        /* Thinkware */
+        {USB_DEVICE(0x0BDA, 0x5077)},
+        /* Toshiba */
+        {USB_DEVICE(0x1690, 0x0752)},
+        /* - */
+        {USB_DEVICE(0x20F4, 0x646B)},
+        {USB_DEVICE(0x083A, 0xC512)},
+
+/* RTL8191SU */
+        /* Realtek */
+        {USB_DEVICE(0x0BDA, 0x8172)},
+        /* Amigo */
+        {USB_DEVICE(0x0EB0, 0x9061)},
+        /* ASUS/EKB */
+        {USB_DEVICE(0x0BDA, 0x8172)},
+        {USB_DEVICE(0x13D3, 0x3323)},
+        {USB_DEVICE(0x13D3, 0x3311)}, /* 11n mode disable */
+        {USB_DEVICE(0x13D3, 0x3342)},
+        /* ASUS/EKBLenovo */
+        {USB_DEVICE(0x13D3, 0x3333)},
+        {USB_DEVICE(0x13D3, 0x3334)},
+        {USB_DEVICE(0x13D3, 0x3335)}, /* 11n mode disable */
+        {USB_DEVICE(0x13D3, 0x3336)}, /* 11n mode disable */
+        /* ASUS/Media BOX */
+        {USB_DEVICE(0x13D3, 0x3309)},
         /* Belkin */
-        {USB_DEVICE(0x050d, 0x815F)},
-        {USB_DEVICE(0x050d, 0x945A)},
-        {USB_DEVICE(0x050d, 0x845A)},
-        /* Guillemot */
-        {USB_DEVICE(0x06f8, 0xe031)},
+        {USB_DEVICE(0x050D, 0x815F)},
+        /* D-Link */
+        {USB_DEVICE(0x07D1, 0x3302)},
+        {USB_DEVICE(0x07D1, 0x3300)},
+        {USB_DEVICE(0x07D1, 0x3303)},
         /* Edimax */
-        {USB_DEVICE(0x7392, 0x7611)},
         {USB_DEVICE(0x7392, 0x7612)},
-        {USB_DEVICE(0x7392, 0x7622)},
-        /* Sitecom */
-        {USB_DEVICE(0x0DF6, 0x0045)},
+        /* EnGenius */
+        {USB_DEVICE(0x1740, 0x9605)},
+        /* Guillemot */
+        {USB_DEVICE(0x06F8, 0xE031)},
         /* Hawking */
         {USB_DEVICE(0x0E66, 0x0015)},
-        {USB_DEVICE(0x0E66, 0x0016)},
-        {USB_DEVICE(0x0b05, 0x1786)},
-        {USB_DEVICE(0x0b05, 0x1791)},    /* 11n mode disable */
-
+        /* Mediao */
         {USB_DEVICE(0x13D3, 0x3306)},
-        {USB_DEVICE(0x13D3, 0x3309)},
+        /* PCI */
+        {USB_DEVICE(0x2019, 0xED18)},
+        {USB_DEVICE(0x2019, 0x4901)},
+        /* Sitecom */
+        {USB_DEVICE(0x0DF6, 0x0058)},
+        {USB_DEVICE(0x0DF6, 0x0049)},
+        {USB_DEVICE(0x0DF6, 0x004C)},
+        {USB_DEVICE(0x0DF6, 0x0064)},
+        /* Skyworth */
+        {USB_DEVICE(0x14b2, 0x3300)},
+        {USB_DEVICE(0x14b2, 0x3301)},
+        {USB_DEVICE(0x14B2, 0x3302)},
+        /* - */
+        {USB_DEVICE(0x04F2, 0xAFF2)},
+        {USB_DEVICE(0x04F2, 0xAFF5)},
+        {USB_DEVICE(0x04F2, 0xAFF6)},
+        {USB_DEVICE(0x13D3, 0x3339)},
+        {USB_DEVICE(0x13D3, 0x3340)}, /* 11n mode disable */
+        {USB_DEVICE(0x13D3, 0x3341)}, /* 11n mode disable */
         {USB_DEVICE(0x13D3, 0x3310)},
-        {USB_DEVICE(0x13D3, 0x3311)},    /* 11n mode disable */
         {USB_DEVICE(0x13D3, 0x3325)},
-        {USB_DEVICE(0x083A, 0xC512)},
+
+/* RTL8192SU */
+        /* Realtek */
+        {USB_DEVICE(0x0BDA, 0x8174)},
+        {USB_DEVICE(0x0BDA, 0x8174)},
+        /* Belkin */
+        {USB_DEVICE(0x050D, 0x845A)},
+        /* Corega */
+        {USB_DEVICE(0x07AA, 0x0051)},
+        /* Edimax */
+        {USB_DEVICE(0x7392, 0x7622)},
+        /* NEC */
+        {USB_DEVICE(0x0409, 0x02B6)},
         {}
 };
 
@@ -103,8 +172,20 @@ MODULE_DEVICE_TABLE(usb, rtl871x_usb_id_tbl);
 static struct specific_device_id specific_device_id_tbl[] = {
         {.idVendor = 0x0b05, .idProduct = 0x1791,
                  .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x0df6, .idProduct = 0x0059,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3306,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
         {.idVendor = 0x13D3, .idProduct = 0x3311,
                  .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3335,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3336,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3340,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3341,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
         {}
 };
 
diff --git a/drivers/staging/sm7xx/smtcfb.c b/drivers/staging/sm7xx/smtcfb.c
index 0bc113c44d3..d007e4a12c1 100644
--- a/drivers/staging/sm7xx/smtcfb.c
+++ b/drivers/staging/sm7xx/smtcfb.c
@@ -1044,9 +1044,9 @@ static int __maybe_unused smtcfb_suspend(struct pci_dev *pdev, pm_message_t msg)
 
         /* when doing suspend, call fb apis and pci apis */
         if (msg.event == PM_EVENT_SUSPEND) {
-                acquire_console_sem();
+                console_lock();
                 fb_set_suspend(&sfb->fb, 1);
-                release_console_sem();
+                console_unlock();
                 retv = pci_save_state(pdev);
                 pci_disable_device(pdev);
                 retv = pci_choose_state(pdev, msg);
@@ -1105,9 +1105,9 @@ static int __maybe_unused smtcfb_resume(struct pci_dev *pdev)
 
         smtcfb_setmode(sfb);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(&sfb->fb, 0);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/staging/speakup/kobjects.c b/drivers/staging/speakup/kobjects.c
index 408bb9b3303..07a7f543259 100644
--- a/drivers/staging/speakup/kobjects.c
+++ b/drivers/staging/speakup/kobjects.c
@@ -332,7 +332,7 @@ static ssize_t silent_store(struct kobject *kobj, struct kobj_attribute *attr,
         unsigned long flags;
 
         len = strlen(buf);
-        if (len > 0 || len < 3) {
+        if (len > 0 && len < 3) {
                 ch = buf[0];
                 if (ch == '\n')
                         ch = '0';
diff --git a/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c b/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c
index e8f047e86a3..80183a7e662 100644
--- a/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c
+++ b/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c
@@ -986,12 +986,6 @@ static int __devinit synaptics_rmi4_probe
         input_set_abs_params(rmi4_data->input_dev, ABS_MT_TOUCH_MAJOR, 0,
                                                 MAX_TOUCH_MAJOR, 0, 0);
 
-        retval = input_register_device(rmi4_data->input_dev);
-        if (retval) {
-                dev_err(&client->dev, "%s:input register failed\n", __func__);
-                goto err_input_register;
-        }
-
         /* Clear interrupts */
         synaptics_rmi4_i2c_block_read(rmi4_data,
                         rmi4_data->fn01_data_base_addr + 1, intr_status,
@@ -1003,15 +997,20 @@ static int __devinit synaptics_rmi4_probe
         if (retval) {
                 dev_err(&client->dev, "%s:Unable to get attn irq %d\n",
                                 __func__, platformdata->irq_number);
-                goto err_request_irq;
+                goto err_unset_clientdata;
+        }
+
+        retval = input_register_device(rmi4_data->input_dev);
+        if (retval) {
+                dev_err(&client->dev, "%s:input register failed\n", __func__);
+                goto err_free_irq;
         }
 
         return retval;
 
-err_request_irq:
+err_free_irq:
         free_irq(platformdata->irq_number, rmi4_data);
-        input_unregister_device(rmi4_data->input_dev);
-err_input_register:
+err_unset_clientdata:
         i2c_set_clientdata(client, NULL);
 err_query_dev:
         if (platformdata->regulator_en) {
diff --git a/drivers/staging/tidspbridge/core/io_sm.c b/drivers/staging/tidspbridge/core/io_sm.c
index 571864555dd..27e0aa81a58 100644
--- a/drivers/staging/tidspbridge/core/io_sm.c
+++ b/drivers/staging/tidspbridge/core/io_sm.c
@@ -949,7 +949,7 @@ func_end:
  *      Calls the Bridge's CHNL_ISR to determine if this interrupt is ours, then
  *      schedules a DPC to dispatch I/O.
  */
-void io_mbox_msg(u32 msg)
+int io_mbox_msg(struct notifier_block *self, unsigned long len, void *msg)
 {
         struct io_mgr *pio_mgr;
         struct dev_object *dev_obj;
@@ -959,9 +959,9 @@ void io_mbox_msg(u32 msg)
         dev_get_io_mgr(dev_obj, &pio_mgr);
 
         if (!pio_mgr)
-                return;
+                return NOTIFY_BAD;
 
-        pio_mgr->intr_val = (u16)msg;
+        pio_mgr->intr_val = (u16)((u32)msg);
         if (pio_mgr->intr_val & MBX_PM_CLASS)
                 io_dispatch_pm(pio_mgr);
 
@@ -973,7 +973,7 @@ void io_mbox_msg(u32 msg)
                 spin_unlock_irqrestore(&pio_mgr->dpc_lock, flags);
                 tasklet_schedule(&pio_mgr->dpc_tasklet);
         }
-        return;
+        return NOTIFY_OK;
 }
 
 /*
diff --git a/drivers/staging/tidspbridge/core/tiomap3430.c b/drivers/staging/tidspbridge/core/tiomap3430.c
index a3b0a183d57..a3f69f6f505 100644
--- a/drivers/staging/tidspbridge/core/tiomap3430.c
+++ b/drivers/staging/tidspbridge/core/tiomap3430.c
@@ -223,6 +223,10 @@ static struct bridge_drv_interface drv_interface_fxns = {
         bridge_msg_set_queue_id,
 };
 
+static struct notifier_block dsp_mbox_notifier = {
+        .notifier_call = io_mbox_msg,
+};
+
 static inline void flush_all(struct bridge_dev_context *dev_context)
 {
         if (dev_context->dw_brd_state == BRD_DSP_HIBERNATION ||
@@ -553,7 +557,7 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
                  * Enable Mailbox events and also drain any pending
                  * stale messages.
                  */
-                dev_context->mbox = omap_mbox_get("dsp");
+                dev_context->mbox = omap_mbox_get("dsp", &dsp_mbox_notifier);
                 if (IS_ERR(dev_context->mbox)) {
                         dev_context->mbox = NULL;
                         pr_err("%s: Failed to get dsp mailbox handle\n",
@@ -563,8 +567,6 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
 
         }
         if (!status) {
-                dev_context->mbox->rxq->callback = (int (*)(void *))io_mbox_msg;
-
 /*PM_IVA2GRPSEL_PER = 0xC0;*/
                 temp = readl(resources->dw_per_pm_base + 0xA8);
                 temp = (temp & 0xFFFFFF30) | 0xC0;
@@ -685,7 +687,7 @@ static int bridge_brd_stop(struct bridge_dev_context *dev_ctxt)
         /* Disable the mailbox interrupts */
         if (dev_context->mbox) {
                 omap_mbox_disable_irq(dev_context->mbox, IRQ_RX);
-                omap_mbox_put(dev_context->mbox);
+                omap_mbox_put(dev_context->mbox, &dsp_mbox_notifier);
                 dev_context->mbox = NULL;
         }
         /* Reset IVA2 clocks*/
@@ -786,10 +788,7 @@ static int bridge_dev_create(struct bridge_dev_context
 
         pt_attrs = kzalloc(sizeof(struct pg_table_attrs), GFP_KERNEL);
         if (pt_attrs != NULL) {
-                /* Assuming that we use only DSP's memory map
-                 * until 0x4000:0000 , we would need only 1024
-                 * L1 enties i.e L1 size = 4K */
-                pt_attrs->l1_size = 0x1000;
+                pt_attrs->l1_size = SZ_16K; /* 4096 entries of 32 bits */
                 align_size = pt_attrs->l1_size;
                 /* Align sizes are expected to be power of 2 */
                 /* we like to get aligned on L1 table size */
diff --git a/drivers/staging/tidspbridge/include/dspbridge/io_sm.h b/drivers/staging/tidspbridge/include/dspbridge/io_sm.h
index 18aec55d864..8242c70e09d 100644
--- a/drivers/staging/tidspbridge/include/dspbridge/io_sm.h
+++ b/drivers/staging/tidspbridge/include/dspbridge/io_sm.h
@@ -72,22 +72,17 @@ extern void io_dpc(unsigned long ref_data);
 /*
  *  ======== io_mbox_msg ========
  *  Purpose:
- *      Main interrupt handler for the shared memory Bridge channel manager.
- *      Calls the Bridge's chnlsm_isr to determine if this interrupt is ours,
- *      then schedules a DPC to dispatch I/O.
+ *      Main message handler for the shared memory Bridge channel manager.
+ *      Determine if this message is ours, then schedules a DPC to
+ *      dispatch I/O.
  *  Parameters:
- *      ref_data:   Pointer to the channel manager object for this board.
- *                  Set in an initial call to ISR_Install().
+ *      self:   Pointer to its own notifier_block struct.
+ *      len:    Length of message.
+ *      msg:    Message code received.
  *  Returns:
- *      TRUE if interrupt handled; FALSE otherwise.
- *  Requires:
- *      Must be in locked memory if executing in kernel mode.
- *      Must only call functions which are in locked memory if Kernel mode.
- *      Must only call asynchronous services.
- *      Interrupts are disabled and EOI for this interrupt has been sent.
- *  Ensures:
+ *      NOTIFY_OK if handled; NOTIFY_BAD otherwise.
  */
-void io_mbox_msg(u32 msg);
+int io_mbox_msg(struct notifier_block *self, unsigned long len, void *msg);
 
 /*
  *  ======== io_request_chnl ========
diff --git a/drivers/staging/tm6000/tm6000-video.c b/drivers/staging/tm6000/tm6000-video.c
index 8fe017c3721..eb9b9f1bc13 100644
--- a/drivers/staging/tm6000/tm6000-video.c
+++ b/drivers/staging/tm6000/tm6000-video.c
@@ -1450,29 +1450,55 @@ static struct video_device tm6000_template = {
  * ------------------------------------------------------------------
  */
 
-int tm6000_v4l2_register(struct tm6000_core *dev)
+static struct video_device *vdev_init(struct tm6000_core *dev,
+                const struct video_device
+                *template, const char *type_name)
 {
-        int ret = -1;
         struct video_device *vfd;
 
         vfd = video_device_alloc();
-        if(!vfd) {
+        if (NULL == vfd)
+                return NULL;
+
+        *vfd = *template;
+        vfd->v4l2_dev = &dev->v4l2_dev;
+        vfd->release = video_device_release;
+        vfd->debug = tm6000_debug;
+        vfd->lock = &dev->lock;
+
+        snprintf(vfd->name, sizeof(vfd->name), "%s %s", dev->name, type_name);
+
+        video_set_drvdata(vfd, dev);
+        return vfd;
+}
+
+int tm6000_v4l2_register(struct tm6000_core *dev)
+{
+        int ret = -1;
+
+        dev->vfd = vdev_init(dev, &tm6000_template, "video");
+
+        if (!dev->vfd) {
+                printk(KERN_INFO "%s: can't register video device\n",
+                       dev->name);
                 return -ENOMEM;
         }
-        dev->vfd = vfd;
 
         /* init video dma queues */
         INIT_LIST_HEAD(&dev->vidq.active);
         INIT_LIST_HEAD(&dev->vidq.queued);
 
-        memcpy(dev->vfd, &tm6000_template, sizeof(*(dev->vfd)));
-        dev->vfd->debug = tm6000_debug;
-        dev->vfd->lock = &dev->lock;
+        ret = video_register_device(dev->vfd, VFL_TYPE_GRABBER, video_nr);
 
-        vfd->v4l2_dev = &dev->v4l2_dev;
-        video_set_drvdata(vfd, dev);
+        if (ret < 0) {
+                printk(KERN_INFO "%s: can't register video device\n",
+                       dev->name);
+                return ret;
+        }
+
+        printk(KERN_INFO "%s: registered device %s\n",
+               dev->name, video_device_node_name(dev->vfd));
 
-        ret = video_register_device(dev->vfd, VFL_TYPE_GRABBER, video_nr);
         printk(KERN_INFO "Trident TVMaster TM5600/TM6000/TM6010 USB2 board (Load status: %d)\n", ret);
         return ret;
 }
diff --git a/drivers/staging/usbip/stub.h b/drivers/staging/usbip/stub.h
index 30dbfb6d16f..d73267961ef 100644
--- a/drivers/staging/usbip/stub.h
+++ b/drivers/staging/usbip/stub.h
@@ -32,6 +32,7 @@
 
 struct stub_device {
         struct usb_interface *interface;
+        struct usb_device *udev;
         struct list_head list;
 
         struct usbip_device ud;
diff --git a/drivers/staging/usbip/stub_dev.c b/drivers/staging/usbip/stub_dev.c
index b186b5fed2b..a7ce51cc890 100644
--- a/drivers/staging/usbip/stub_dev.c
+++ b/drivers/staging/usbip/stub_dev.c
@@ -258,10 +258,11 @@ static void stub_shutdown_connection(struct usbip_device *ud)
 static void stub_device_reset(struct usbip_device *ud)
 {
         struct stub_device *sdev = container_of(ud, struct stub_device, ud);
-        struct usb_device *udev = interface_to_usbdev(sdev->interface);
+        struct usb_device *udev = sdev->udev;
         int ret;
 
         usbip_udbg("device reset");
+
         ret = usb_lock_device_for_reset(udev, sdev->interface);
         if (ret < 0) {
                 dev_err(&udev->dev, "lock for reset\n");
@@ -309,7 +310,8 @@ static void stub_device_unusable(struct usbip_device *ud)
  *
  * Allocates and initializes a new stub_device struct.
  */
-static struct stub_device *stub_device_alloc(struct usb_interface *interface)
+static struct stub_device *stub_device_alloc(struct usb_device *udev,
+                                             struct usb_interface *interface)
 {
         struct stub_device *sdev;
         int busnum = interface_to_busnum(interface);
@@ -324,7 +326,8 @@ static struct stub_device *stub_device_alloc(struct usb_interface *interface)
                 return NULL;
         }
 
-        sdev->interface = interface;
+        sdev->interface = usb_get_intf(interface);
+        sdev->udev = usb_get_dev(udev);
 
         /*
          * devid is defined with devnum when this driver is first allocated.
@@ -450,11 +453,12 @@ static int stub_probe(struct usb_interface *interface,
                         return err;
                 }
 
+                usb_get_intf(interface);
                 return 0;
         }
 
         /* ok. this is my device. */
-        sdev = stub_device_alloc(interface);
+        sdev = stub_device_alloc(udev, interface);
         if (!sdev)
                 return -ENOMEM;
 
@@ -476,6 +480,8 @@ static int stub_probe(struct usb_interface *interface,
                 dev_err(&interface->dev, "create sysfs files for %s\n",
                         udev_busid);
                 usb_set_intfdata(interface, NULL);
+                usb_put_intf(interface);
+
                 busid_priv->interf_count = 0;
 
                 busid_priv->sdev = NULL;
@@ -545,6 +551,7 @@ static void stub_disconnect(struct usb_interface *interface)
         if (busid_priv->interf_count > 1) {
                 busid_priv->interf_count--;
                 shutdown_busid(busid_priv);
+                usb_put_intf(interface);
                 return;
         }
 
@@ -554,6 +561,9 @@ static void stub_disconnect(struct usb_interface *interface)
         /* 1. shutdown the current connection */
         shutdown_busid(busid_priv);
 
+        usb_put_dev(sdev->udev);
+        usb_put_intf(interface);
+
         /* 3. free sdev */
         busid_priv->sdev = NULL;
         stub_device_free(sdev);
diff --git a/drivers/staging/usbip/stub_rx.c b/drivers/staging/usbip/stub_rx.c
index 3de6fd2539d..ae6ac82754a 100644
--- a/drivers/staging/usbip/stub_rx.c
+++ b/drivers/staging/usbip/stub_rx.c
@@ -364,7 +364,7 @@ static struct stub_priv *stub_priv_alloc(struct stub_device *sdev,
 
 static int get_pipe(struct stub_device *sdev, int epnum, int dir)
 {
-        struct usb_device *udev = interface_to_usbdev(sdev->interface);
+        struct usb_device *udev = sdev->udev;
         struct usb_host_endpoint *ep;
         struct usb_endpoint_descriptor *epd = NULL;
 
@@ -484,7 +484,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
         int ret;
         struct stub_priv *priv;
         struct usbip_device *ud = &sdev->ud;
-        struct usb_device *udev = interface_to_usbdev(sdev->interface);
+        struct usb_device *udev = sdev->udev;
         int pipe = get_pipe(sdev, pdu->base.ep, pdu->base.direction);
 
 
diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
index 41a1fe5138f..afc3b1a7188 100644
--- a/drivers/staging/usbip/vhci.h
+++ b/drivers/staging/usbip/vhci.h
@@ -100,9 +100,6 @@ struct vhci_hcd {
          * But, the index of this array begins from 0.
          */
         struct vhci_device vdev[VHCI_NPORTS];
-
-        /* vhci_device which has not been assiged its address yet */
-        int pending_port;
 };
 
 
@@ -119,6 +116,9 @@ void rh_port_disconnect(int rhport);
 void vhci_rx_loop(struct usbip_task *ut);
 void vhci_tx_loop(struct usbip_task *ut);
 
+struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
+                                            __u32 seqnum);
+
 #define hardware                (&the_controller->pdev.dev)
 
 static inline struct vhci_device *port_to_vdev(__u32 port)
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 08bd26a245d..a35fe61268d 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -138,8 +138,6 @@ void rh_port_connect(int rhport, enum usb_device_speed speed)
          * the_controller->vdev[rhport].ud.status = VDEV_CONNECT;
          * spin_unlock(&the_controller->vdev[rhport].ud.lock); */
 
-        the_controller->pending_port = rhport;
-
         spin_unlock_irqrestore(&the_controller->lock, flags);
 
         usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
@@ -559,6 +557,7 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
         struct device *dev = &urb->dev->dev;
         int ret = 0;
         unsigned long flags;
+        struct vhci_device *vdev;
 
         usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n",
                     hcd, urb, mem_flags);
@@ -574,6 +573,18 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                 return urb->status;
         }
 
+        vdev = port_to_vdev(urb->dev->portnum-1);
+
+        /* refuse enqueue for dead connection */
+        spin_lock(&vdev->ud.lock);
+        if (vdev->ud.status == VDEV_ST_NULL || vdev->ud.status == VDEV_ST_ERROR) {
+                usbip_uerr("enqueue for inactive port %d\n", vdev->rhport);
+                spin_unlock(&vdev->ud.lock);
+                spin_unlock_irqrestore(&the_controller->lock, flags);
+                return -ENODEV;
+        }
+        spin_unlock(&vdev->ud.lock);
+
         ret = usb_hcd_link_urb_to_ep(hcd, urb);
         if (ret)
                 goto no_need_unlink;
@@ -592,8 +603,6 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                 __u8 type = usb_pipetype(urb->pipe);
                 struct usb_ctrlrequest *ctrlreq =
                                 (struct usb_ctrlrequest *) urb->setup_packet;
-                struct vhci_device *vdev =
-                                port_to_vdev(the_controller->pending_port);
 
                 if (type != PIPE_CONTROL || !ctrlreq) {
                         dev_err(dev, "invalid request to devnum 0\n");
@@ -607,7 +616,9 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                         dev_info(dev, "SetAddress Request (%d) to port %d\n",
                                  ctrlreq->wValue, vdev->rhport);
 
-                        vdev->udev = urb->dev;
+                        if (vdev->udev)
+                                usb_put_dev(vdev->udev);
+                        vdev->udev = usb_get_dev(urb->dev);
 
                         spin_lock(&vdev->ud.lock);
                         vdev->ud.status = VDEV_ST_USED;
@@ -627,8 +638,9 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                                                 "Get_Descriptor to device 0 "
                                                 "(get max pipe size)\n");
 
-                        /* FIXME: reference count? (usb_get_dev()) */
-                        vdev->udev = urb->dev;
+                        if (vdev->udev)
+                                usb_put_dev(vdev->udev);
+                        vdev->udev = usb_get_dev(urb->dev);
                         goto out;
 
                 default:
@@ -805,7 +817,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         return 0;
 }
 
-
 static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
 {
         struct vhci_unlink *unlink, *tmp;
@@ -813,11 +824,34 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
         spin_lock(&vdev->priv_lock);
 
         list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) {
+                usbip_uinfo("unlink cleanup tx %lu\n", unlink->unlink_seqnum);
                 list_del(&unlink->list);
                 kfree(unlink);
         }
 
         list_for_each_entry_safe(unlink, tmp, &vdev->unlink_rx, list) {
+                struct urb *urb;
+
+                /* give back URB of unanswered unlink request */
+                usbip_uinfo("unlink cleanup rx %lu\n", unlink->unlink_seqnum);
+
+                urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
+                if (!urb) {
+                        usbip_uinfo("the urb (seqnum %lu) was already given back\n",
+                                                        unlink->unlink_seqnum);
+                        list_del(&unlink->list);
+                        kfree(unlink);
+                        continue;
+                }
+
+                urb->status = -ENODEV;
+
+                spin_lock(&the_controller->lock);
+                usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
+                spin_unlock(&the_controller->lock);
+
+                usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status);
+
                 list_del(&unlink->list);
                 kfree(unlink);
         }
@@ -887,6 +921,10 @@ static void vhci_device_reset(struct usbip_device *ud)
         vdev->speed  = 0;
         vdev->devid  = 0;
 
+        if (vdev->udev)
+                usb_put_dev(vdev->udev);
+        vdev->udev = NULL;
+
         ud->tcp_socket = NULL;
 
         ud->status = VDEV_ST_NULL;
diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
index 8147d7202b2..bf699147094 100644
--- a/drivers/staging/usbip/vhci_rx.c
+++ b/drivers/staging/usbip/vhci_rx.c
@@ -23,16 +23,14 @@
 #include "vhci.h"
 
 
-/* get URB from transmitted urb queue */
-static struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
+/* get URB from transmitted urb queue. caller must hold vdev->priv_lock */
+struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
                                             __u32 seqnum)
 {
         struct vhci_priv *priv, *tmp;
         struct urb *urb = NULL;
         int status;
 
-        spin_lock(&vdev->priv_lock);
-
         list_for_each_entry_safe(priv, tmp, &vdev->priv_rx, list) {
                 if (priv->seqnum == seqnum) {
                         urb = priv->urb;
@@ -63,8 +61,6 @@ static struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
                 }
         }
 
-        spin_unlock(&vdev->priv_lock);
-
         return urb;
 }
 
@@ -74,9 +70,11 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
         struct usbip_device *ud = &vdev->ud;
         struct urb *urb;
 
+        spin_lock(&vdev->priv_lock);
 
         urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum);
 
+        spin_unlock(&vdev->priv_lock);
 
         if (!urb) {
                 usbip_uerr("cannot find a urb of seqnum %u\n",
@@ -161,7 +159,12 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
                 return;
         }
 
+        spin_lock(&vdev->priv_lock);
+
         urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
+
+        spin_unlock(&vdev->priv_lock);
+
         if (!urb) {
                 /*
                  * I get the result of a unlink request. But, it seems that I
@@ -190,6 +193,19 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
         return;
 }
 
+static int vhci_priv_tx_empty(struct vhci_device *vdev)
+{
+        int empty = 0;
+
+        spin_lock(&vdev->priv_lock);
+
+        empty = list_empty(&vdev->priv_rx);
+
+        spin_unlock(&vdev->priv_lock);
+
+        return empty;
+}
+
 /* recv a pdu */
 static void vhci_rx_pdu(struct usbip_device *ud)
 {
@@ -202,11 +218,29 @@ static void vhci_rx_pdu(struct usbip_device *ud)
 
         memset(&pdu, 0, sizeof(pdu));
 
-
         /* 1. receive a pdu header */
         ret = usbip_xmit(0, ud->tcp_socket, (char *) &pdu, sizeof(pdu), 0);
+        if (ret < 0) {
+                if (ret == -ECONNRESET)
+                        usbip_uinfo("connection reset by peer\n");
+                else if (ret == -EAGAIN) {
+                        /* ignore if connection was idle */
+                        if (vhci_priv_tx_empty(vdev))
+                                return;
+                        usbip_uinfo("connection timed out with pending urbs\n");
+                } else if (ret != -ERESTARTSYS)
+                        usbip_uinfo("xmit failed %d\n", ret);
+
+                usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+                return;
+        }
+        if (ret == 0) {
+                usbip_uinfo("connection closed");
+                usbip_event_add(ud, VDEV_EVENT_DOWN);
+                return;
+        }
         if (ret != sizeof(pdu)) {
-                usbip_uerr("receiving pdu failed! size is %d, should be %d\n",
+                usbip_uerr("received pdu size is %d, should be %d\n",
                                         ret, (unsigned int)sizeof(pdu));
                 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
                 return;
diff --git a/drivers/staging/vme/bridges/Module.symvers b/drivers/staging/vme/bridges/Module.symvers
deleted file mode 100644
index e69de29bb2d..00000000000
--- a/drivers/staging/vme/bridges/Module.symvers
+++ /dev/null
diff --git a/drivers/staging/xgifb/vb_setmode.c b/drivers/staging/xgifb/vb_setmode.c
index 7016fdd2509..e19b932492e 100644
--- a/drivers/staging/xgifb/vb_setmode.c
+++ b/drivers/staging/xgifb/vb_setmode.c
@@ -3954,8 +3954,8 @@ void XGI_GetCRT2ResInfo(unsigned short ModeNo, unsigned short ModeIdIndex,
 unsigned char XGI_IsLCDDualLink(struct vb_device_info *pVBInfo)
 {
 
-        if ((((pVBInfo->VBInfo & SetCRT2ToLCD) | SetCRT2ToLCDA))
-                        && (pVBInfo->LCDInfo & SetLCDDualLink)) /* shampoo0129 */
+        if ((pVBInfo->VBInfo & (SetCRT2ToLCD | SetCRT2ToLCDA)) &&
+                        (pVBInfo->LCDInfo & SetLCDDualLink)) /* shampoo0129 */
                 return 1;
 
         return 0;
@@ -8773,7 +8773,7 @@ unsigned short XGI_GetVCLK2Ptr(unsigned short ModeNo,
 
         if (pVBInfo->IF_DEF_LVDS == 0) {
                 CRT2Index = CRT2Index >> 6; /*  for LCD */
-                if (((pVBInfo->VBInfo & SetCRT2ToLCD) | SetCRT2ToLCDA)) { /*301b*/
+                if (pVBInfo->VBInfo & (SetCRT2ToLCD | SetCRT2ToLCDA)) { /*301b*/
                         if (pVBInfo->LCDResInfo != Panel1024x768)
                                 VCLKIndex = LCDXlat2VCLK[CRT2Index];
                         else
diff --git a/drivers/tty/Makefile b/drivers/tty/Makefile
index c43ef48b1a0..396277216e4 100644
--- a/drivers/tty/Makefile
+++ b/drivers/tty/Makefile
@@ -9,3 +9,5 @@ obj-$(CONFIG_N_GSM)		+= n_gsm.o
 obj-$(CONFIG_R3964)             += n_r3964.o
 
 obj-y                           += vt/
+obj-$(CONFIG_HVC_DRIVER)        += hvc/
+obj-y                           += serial/
diff --git a/drivers/tty/hvc/Makefile b/drivers/tty/hvc/Makefile
new file mode 100644
index 00000000000..e6bed5f177f
--- /dev/null
+++ b/drivers/tty/hvc/Makefile
@@ -0,0 +1,13 @@
+obj-$(CONFIG_HVC_CONSOLE)       += hvc_vio.o hvsi.o
+obj-$(CONFIG_HVC_ISERIES)       += hvc_iseries.o
+obj-$(CONFIG_HVC_RTAS)          += hvc_rtas.o
+obj-$(CONFIG_HVC_TILE)          += hvc_tile.o
+obj-$(CONFIG_HVC_DCC)           += hvc_dcc.o
+obj-$(CONFIG_HVC_BEAT)          += hvc_beat.o
+obj-$(CONFIG_HVC_DRIVER)        += hvc_console.o
+obj-$(CONFIG_HVC_IRQ)           += hvc_irq.o
+obj-$(CONFIG_HVC_XEN)           += hvc_xen.o
+obj-$(CONFIG_HVC_IUCV)          += hvc_iucv.o
+obj-$(CONFIG_HVC_UDBG)          += hvc_udbg.o
+obj-$(CONFIG_HVCS)              += hvcs.o
+obj-$(CONFIG_VIRTIO_CONSOLE)    += virtio_console.o
diff --git a/drivers/char/hvc_beat.c b/drivers/tty/hvc/hvc_beat.c
index 5fe4631e2a6..5fe4631e2a6 100644
--- a/drivers/char/hvc_beat.c
+++ b/drivers/tty/hvc/hvc_beat.c
diff --git a/drivers/char/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index e9cba13ee80..e9cba13ee80 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
diff --git a/drivers/char/hvc_console.h b/drivers/tty/hvc/hvc_console.h
index 54381eba4e4..54381eba4e4 100644
--- a/drivers/char/hvc_console.h
+++ b/drivers/tty/hvc/hvc_console.h
diff --git a/drivers/char/hvc_dcc.c b/drivers/tty/hvc/hvc_dcc.c
index 6470f63deb4..6470f63deb4 100644
--- a/drivers/char/hvc_dcc.c
+++ b/drivers/tty/hvc/hvc_dcc.c
diff --git a/drivers/char/hvc_irq.c b/drivers/tty/hvc/hvc_irq.c
index 2623e177e8d..2623e177e8d 100644
--- a/drivers/char/hvc_irq.c
+++ b/drivers/tty/hvc/hvc_irq.c
diff --git a/drivers/char/hvc_iseries.c b/drivers/tty/hvc/hvc_iseries.c
index 21c54955084..21c54955084 100644
--- a/drivers/char/hvc_iseries.c
+++ b/drivers/tty/hvc/hvc_iseries.c
diff --git a/drivers/char/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c
index c3425bb3a1f..c3425bb3a1f 100644
--- a/drivers/char/hvc_iucv.c
+++ b/drivers/tty/hvc/hvc_iucv.c
diff --git a/drivers/char/hvc_rtas.c b/drivers/tty/hvc/hvc_rtas.c
index 61c4a61558d..61c4a61558d 100644
--- a/drivers/char/hvc_rtas.c
+++ b/drivers/tty/hvc/hvc_rtas.c
diff --git a/drivers/char/hvc_tile.c b/drivers/tty/hvc/hvc_tile.c
index 7a84a059547..7a84a059547 100644
--- a/drivers/char/hvc_tile.c
+++ b/drivers/tty/hvc/hvc_tile.c
diff --git a/drivers/char/hvc_udbg.c b/drivers/tty/hvc/hvc_udbg.c
index b0957e61a7b..b0957e61a7b 100644
--- a/drivers/char/hvc_udbg.c
+++ b/drivers/tty/hvc/hvc_udbg.c
diff --git a/drivers/char/hvc_vio.c b/drivers/tty/hvc/hvc_vio.c
index 5e2f52b3332..5e2f52b3332 100644
--- a/drivers/char/hvc_vio.c
+++ b/drivers/tty/hvc/hvc_vio.c
diff --git a/drivers/char/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index 3740e327f18..3740e327f18 100644
--- a/drivers/char/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
diff --git a/drivers/char/hvcs.c b/drivers/tty/hvc/hvcs.c
index bedc6c1b6fa..bedc6c1b6fa 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
diff --git a/drivers/char/hvsi.c b/drivers/tty/hvc/hvsi.c
index 67a75a502c0..67a75a502c0 100644
--- a/drivers/char/hvsi.c
+++ b/drivers/tty/hvc/hvsi.c
diff --git a/drivers/char/virtio_console.c b/drivers/tty/hvc/virtio_console.c
index 896a2ced1d2..896a2ced1d2 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/tty/hvc/virtio_console.c
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 47d32281032..52fc0c9a636 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -581,8 +581,9 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                            __u8 __user *buf, size_t nr)
 {
         struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
-        int ret;
+        int ret = 0;
         struct n_hdlc_buf *rbuf;
+        DECLARE_WAITQUEUE(wait, current);
 
         if (debuglevel >= DEBUG_LEVEL_INFO)     
                 printk("%s(%d)n_hdlc_tty_read() called\n",__FILE__,__LINE__);
@@ -598,57 +599,55 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                 return -EFAULT;
         }
 
-        tty_lock();
+        add_wait_queue(&tty->read_wait, &wait);
 
         for (;;) {
                 if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
-                        tty_unlock();
-                        return -EIO;
+                        ret = -EIO;
+                        break;
                 }
+                if (tty_hung_up_p(file))
+                        break;
 
-                n_hdlc = tty2n_hdlc (tty);
-                if (!n_hdlc || n_hdlc->magic != HDLC_MAGIC ||
-                         tty != n_hdlc->tty) {
-                        tty_unlock();
-                        return 0;
-                }
+                set_current_state(TASK_INTERRUPTIBLE);
 
                 rbuf = n_hdlc_buf_get(&n_hdlc->rx_buf_list);
-                if (rbuf)
+                if (rbuf) {
+                        if (rbuf->count > nr) {
+                                /* too large for caller's buffer */
+                                ret = -EOVERFLOW;
+                        } else {
+                                if (copy_to_user(buf, rbuf->buf, rbuf->count))
+                                        ret = -EFAULT;
+                                else
+                                        ret = rbuf->count;
+                        }
+
+                        if (n_hdlc->rx_free_buf_list.count >
+                            DEFAULT_RX_BUF_COUNT)
+                                kfree(rbuf);
+                        else
+                                n_hdlc_buf_put(&n_hdlc->rx_free_buf_list, rbuf);
                         break;
+                }
                         
                 /* no data */
                 if (file->f_flags & O_NONBLOCK) {
-                        tty_unlock();
-                        return -EAGAIN;
+                        ret = -EAGAIN;
+                        break;
                 }
-                        
-                interruptible_sleep_on (&tty->read_wait);
+
+                schedule();
+
                 if (signal_pending(current)) {
-                        tty_unlock();
-                        return -EINTR;
+                        ret = -EINTR;
+                        break;
                 }
         }
-                
-        if (rbuf->count > nr)
-                /* frame too large for caller's buffer (discard frame) */
-                ret = -EOVERFLOW;
-        else {
-                /* Copy the data to the caller's buffer */
-                if (copy_to_user(buf, rbuf->buf, rbuf->count))
-                        ret = -EFAULT;
-                else
-                        ret = rbuf->count;
-        }
-        
-        /* return HDLC buffer to free list unless the free list */
-        /* count has exceeded the default value, in which case the */
-        /* buffer is freed back to the OS to conserve memory */
-        if (n_hdlc->rx_free_buf_list.count > DEFAULT_RX_BUF_COUNT)
-                kfree(rbuf);
-        else    
-                n_hdlc_buf_put(&n_hdlc->rx_free_buf_list,rbuf);
-        tty_unlock();
+
+        remove_wait_queue(&tty->read_wait, &wait);
+        __set_current_state(TASK_RUNNING);
+
         return ret;
         
 }       /* end of n_hdlc_tty_read() */
@@ -691,14 +690,15 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
                 count = maxframe;
         }
         
-        tty_lock();
-
         add_wait_queue(&tty->write_wait, &wait);
-        set_current_state(TASK_INTERRUPTIBLE);
+
+        for (;;) {
+                set_current_state(TASK_INTERRUPTIBLE);
         
-        /* Allocate transmit buffer */
-        /* sleep until transmit buffer available */             
-        while (!(tbuf = n_hdlc_buf_get(&n_hdlc->tx_free_buf_list))) {
+                tbuf = n_hdlc_buf_get(&n_hdlc->tx_free_buf_list);
+                if (tbuf)
+                        break;
+
                 if (file->f_flags & O_NONBLOCK) {
                         error = -EAGAIN;
                         break;
@@ -719,7 +719,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
                 }
         }
 
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(&tty->write_wait, &wait);
 
         if (!error) {           
@@ -731,7 +731,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
                 n_hdlc_buf_put(&n_hdlc->tx_buf_list,tbuf);
                 n_hdlc_send_frames(n_hdlc,tty);
         }
-        tty_unlock();
+
         return error;
         
 }       /* end of n_hdlc_tty_write() */
diff --git a/drivers/serial/21285.c b/drivers/tty/serial/21285.c
index d89aa38c5cf..d89aa38c5cf 100644
--- a/drivers/serial/21285.c
+++ b/drivers/tty/serial/21285.c
diff --git a/drivers/serial/68328serial.c b/drivers/tty/serial/68328serial.c
index be0ebce36e5..be0ebce36e5 100644
--- a/drivers/serial/68328serial.c
+++ b/drivers/tty/serial/68328serial.c
diff --git a/drivers/serial/68328serial.h b/drivers/tty/serial/68328serial.h
index 664ceb0a158..664ceb0a158 100644
--- a/drivers/serial/68328serial.h
+++ b/drivers/tty/serial/68328serial.h
diff --git a/drivers/serial/68360serial.c b/drivers/tty/serial/68360serial.c
index 88b13356ec1..88b13356ec1 100644
--- a/drivers/serial/68360serial.c
+++ b/drivers/tty/serial/68360serial.c
diff --git a/drivers/serial/8250.c b/drivers/tty/serial/8250.c
index b25e6e49053..3975df6f7fd 100644
--- a/drivers/serial/8250.c
+++ b/drivers/tty/serial/8250.c
@@ -236,7 +236,8 @@ static const struct serial8250_config uart_config[] = {
                 .fifo_size      = 128,
                 .tx_loadsz      = 128,
                 .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
-                .flags          = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
+                /* UART_CAP_EFR breaks billionon CF bluetooth card. */
+                .flags          = UART_CAP_FIFO | UART_CAP_SLEEP,
         },
         [PORT_16654] = {
                 .name           = "ST16654",
diff --git a/drivers/serial/8250.h b/drivers/tty/serial/8250.h
index 6e19ea3e48d..6e19ea3e48d 100644
--- a/drivers/serial/8250.h
+++ b/drivers/tty/serial/8250.h
diff --git a/drivers/serial/8250_accent.c b/drivers/tty/serial/8250_accent.c
index 9c10262f246..9c10262f246 100644
--- a/drivers/serial/8250_accent.c
+++ b/drivers/tty/serial/8250_accent.c
diff --git a/drivers/serial/8250_acorn.c b/drivers/tty/serial/8250_acorn.c
index b0ce8c56f1a..b0ce8c56f1a 100644
--- a/drivers/serial/8250_acorn.c
+++ b/drivers/tty/serial/8250_acorn.c
diff --git a/drivers/serial/8250_boca.c b/drivers/tty/serial/8250_boca.c
index 3bfe0f7b26f..3bfe0f7b26f 100644
--- a/drivers/serial/8250_boca.c
+++ b/drivers/tty/serial/8250_boca.c
diff --git a/drivers/serial/8250_early.c b/drivers/tty/serial/8250_early.c
index eaafb98debe..eaafb98debe 100644
--- a/drivers/serial/8250_early.c
+++ b/drivers/tty/serial/8250_early.c
diff --git a/drivers/serial/8250_exar_st16c554.c b/drivers/tty/serial/8250_exar_st16c554.c
index 567143ace15..567143ace15 100644
--- a/drivers/serial/8250_exar_st16c554.c
+++ b/drivers/tty/serial/8250_exar_st16c554.c
diff --git a/drivers/serial/8250_fourport.c b/drivers/tty/serial/8250_fourport.c
index 6375d68b791..6375d68b791 100644
--- a/drivers/serial/8250_fourport.c
+++ b/drivers/tty/serial/8250_fourport.c
diff --git a/drivers/serial/8250_gsc.c b/drivers/tty/serial/8250_gsc.c
index d8c0ffbfa6e..d8c0ffbfa6e 100644
--- a/drivers/serial/8250_gsc.c
+++ b/drivers/tty/serial/8250_gsc.c
diff --git a/drivers/serial/8250_hp300.c b/drivers/tty/serial/8250_hp300.c
index c13438c9301..c13438c9301 100644
--- a/drivers/serial/8250_hp300.c
+++ b/drivers/tty/serial/8250_hp300.c
diff --git a/drivers/serial/8250_hub6.c b/drivers/tty/serial/8250_hub6.c
index 7609150e7d5..7609150e7d5 100644
--- a/drivers/serial/8250_hub6.c
+++ b/drivers/tty/serial/8250_hub6.c
diff --git a/drivers/serial/8250_mca.c b/drivers/tty/serial/8250_mca.c
index d10be944ad4..d10be944ad4 100644
--- a/drivers/serial/8250_mca.c
+++ b/drivers/tty/serial/8250_mca.c
diff --git a/drivers/serial/8250_pci.c b/drivers/tty/serial/8250_pci.c
index 8b8930f700b..8b8930f700b 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/tty/serial/8250_pci.c
diff --git a/drivers/serial/8250_pnp.c b/drivers/tty/serial/8250_pnp.c
index 4822cb50cd0..4822cb50cd0 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/tty/serial/8250_pnp.c
diff --git a/drivers/serial/Kconfig b/drivers/tty/serial/Kconfig
index b7a4d81e643..5c4b3475621 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -81,7 +81,7 @@ config SERIAL_8250_GSC
         default SERIAL_8250
 
 config SERIAL_8250_PCI
-        tristate "8250/16550 PCI device support" if EMBEDDED
+        tristate "8250/16550 PCI device support" if EXPERT
         depends on SERIAL_8250 && PCI
         default SERIAL_8250
         help
@@ -90,7 +90,7 @@ config SERIAL_8250_PCI
           Saves about 9K.
 
 config SERIAL_8250_PNP
-        tristate "8250/16550 PNP device support" if EMBEDDED
+        tristate "8250/16550 PNP device support" if EXPERT
         depends on SERIAL_8250 && PNP
         default SERIAL_8250
         help
@@ -1518,6 +1518,7 @@ config SERIAL_BCM63XX_CONSOLE
 config SERIAL_GRLIB_GAISLER_APBUART
         tristate "GRLIB APBUART serial support"
         depends on OF
+        select SERIAL_CORE
         ---help---
         Add support for the GRLIB APBUART serial port.
 
diff --git a/drivers/serial/Makefile b/drivers/tty/serial/Makefile
index c8550719de5..c8550719de5 100644
--- a/drivers/serial/Makefile
+++ b/drivers/tty/serial/Makefile
diff --git a/drivers/serial/altera_jtaguart.c b/drivers/tty/serial/altera_jtaguart.c
index f9b49b5ff5e..f9b49b5ff5e 100644
--- a/drivers/serial/altera_jtaguart.c
+++ b/drivers/tty/serial/altera_jtaguart.c
diff --git a/drivers/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
index 721216292a5..721216292a5 100644
--- a/drivers/serial/altera_uart.c
+++ b/drivers/tty/serial/altera_uart.c
diff --git a/drivers/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c
index 2904aa04412..2904aa04412 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/tty/serial/amba-pl010.c
diff --git a/drivers/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index e76d7d00012..e76d7d00012 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
diff --git a/drivers/serial/apbuart.c b/drivers/tty/serial/apbuart.c
index 095a5d56261..095a5d56261 100644
--- a/drivers/serial/apbuart.c
+++ b/drivers/tty/serial/apbuart.c
diff --git a/drivers/serial/apbuart.h b/drivers/tty/serial/apbuart.h
index 5faf87c8d2b..5faf87c8d2b 100644
--- a/drivers/serial/apbuart.h
+++ b/drivers/tty/serial/apbuart.h
diff --git a/drivers/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index 2a1d52fb493..2a1d52fb493 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
diff --git a/drivers/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index a1a0e55d080..a1a0e55d080 100644
--- a/drivers/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
diff --git a/drivers/serial/bfin_5xx.c b/drivers/tty/serial/bfin_5xx.c
index e381b895b04..e381b895b04 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/tty/serial/bfin_5xx.c
diff --git a/drivers/serial/bfin_sport_uart.c b/drivers/tty/serial/bfin_sport_uart.c
index e95c524d9d1..e95c524d9d1 100644
--- a/drivers/serial/bfin_sport_uart.c
+++ b/drivers/tty/serial/bfin_sport_uart.c
diff --git a/drivers/serial/bfin_sport_uart.h b/drivers/tty/serial/bfin_sport_uart.h
index 6d06ce1d567..6d06ce1d567 100644
--- a/drivers/serial/bfin_sport_uart.h
+++ b/drivers/tty/serial/bfin_sport_uart.h
diff --git a/drivers/serial/clps711x.c b/drivers/tty/serial/clps711x.c
index b6acd19b458..b6acd19b458 100644
--- a/drivers/serial/clps711x.c
+++ b/drivers/tty/serial/clps711x.c
diff --git a/drivers/serial/cpm_uart/Makefile b/drivers/tty/serial/cpm_uart/Makefile
index e072724ea75..e072724ea75 100644
--- a/drivers/serial/cpm_uart/Makefile
+++ b/drivers/tty/serial/cpm_uart/Makefile
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/tty/serial/cpm_uart/cpm_uart.h
index b754dcf0fda..b754dcf0fda 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/tty/serial/cpm_uart/cpm_uart.h
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
index 8692ff98fc0..8692ff98fc0 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/tty/serial/cpm_uart/cpm_uart_cpm1.c
index 3fc1d66e32c..3fc1d66e32c 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_cpm1.c
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.h b/drivers/tty/serial/cpm_uart/cpm_uart_cpm1.h
index 10eecd6af6d..10eecd6af6d 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.h
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_cpm1.h
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm2.c b/drivers/tty/serial/cpm_uart/cpm_uart_cpm2.c
index 814ac006393..814ac006393 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm2.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_cpm2.c
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm2.h b/drivers/tty/serial/cpm_uart/cpm_uart_cpm2.h
index 7194c63dcf5..7194c63dcf5 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm2.h
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_cpm2.h
diff --git a/drivers/serial/crisv10.c b/drivers/tty/serial/crisv10.c
index bcc31f2140a..bcc31f2140a 100644
--- a/drivers/serial/crisv10.c
+++ b/drivers/tty/serial/crisv10.c
diff --git a/drivers/serial/crisv10.h b/drivers/tty/serial/crisv10.h
index ea0beb46a10..ea0beb46a10 100644
--- a/drivers/serial/crisv10.h
+++ b/drivers/tty/serial/crisv10.h
diff --git a/drivers/serial/dz.c b/drivers/tty/serial/dz.c
index 57421d77632..57421d77632 100644
--- a/drivers/serial/dz.c
+++ b/drivers/tty/serial/dz.c
diff --git a/drivers/serial/dz.h b/drivers/tty/serial/dz.h
index faf169ed27b..faf169ed27b 100644
--- a/drivers/serial/dz.h
+++ b/drivers/tty/serial/dz.h
diff --git a/drivers/serial/icom.c b/drivers/tty/serial/icom.c
index 53a46822705..53a46822705 100644
--- a/drivers/serial/icom.c
+++ b/drivers/tty/serial/icom.c
diff --git a/drivers/serial/icom.h b/drivers/tty/serial/icom.h
index c8029e0025c..c8029e0025c 100644
--- a/drivers/serial/icom.h
+++ b/drivers/tty/serial/icom.h
diff --git a/drivers/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c
index ab93763862d..ab93763862d 100644
--- a/drivers/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
diff --git a/drivers/serial/ifx6x60.h b/drivers/tty/serial/ifx6x60.h
index deb7b8d977d..deb7b8d977d 100644
--- a/drivers/serial/ifx6x60.h
+++ b/drivers/tty/serial/ifx6x60.h
diff --git a/drivers/serial/imx.c b/drivers/tty/serial/imx.c
index dfcf4b1878a..dfcf4b1878a 100644
--- a/drivers/serial/imx.c
+++ b/drivers/tty/serial/imx.c
diff --git a/drivers/serial/ioc3_serial.c b/drivers/tty/serial/ioc3_serial.c
index ee43efc7bdc..ee43efc7bdc 100644
--- a/drivers/serial/ioc3_serial.c
+++ b/drivers/tty/serial/ioc3_serial.c
diff --git a/drivers/serial/ioc4_serial.c b/drivers/tty/serial/ioc4_serial.c
index fcfe82653ac..fcfe82653ac 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/tty/serial/ioc4_serial.c
diff --git a/drivers/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c
index ebff4a1d4bc..ebff4a1d4bc 100644
--- a/drivers/serial/ip22zilog.c
+++ b/drivers/tty/serial/ip22zilog.c
diff --git a/drivers/serial/ip22zilog.h b/drivers/tty/serial/ip22zilog.h
index a59a9a8341d..a59a9a8341d 100644
--- a/drivers/serial/ip22zilog.h
+++ b/drivers/tty/serial/ip22zilog.h
diff --git a/drivers/serial/jsm/Makefile b/drivers/tty/serial/jsm/Makefile
index e46b6e0f8b1..e46b6e0f8b1 100644
--- a/drivers/serial/jsm/Makefile
+++ b/drivers/tty/serial/jsm/Makefile
diff --git a/drivers/serial/jsm/jsm.h b/drivers/tty/serial/jsm/jsm.h
index 38a509c684c..38a509c684c 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/tty/serial/jsm/jsm.h
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/tty/serial/jsm/jsm_driver.c
index 18f548449c6..18f548449c6 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/tty/serial/jsm/jsm_driver.c
diff --git a/drivers/serial/jsm/jsm_neo.c b/drivers/tty/serial/jsm/jsm_neo.c
index 7960d9633c1..7960d9633c1 100644
--- a/drivers/serial/jsm/jsm_neo.c
+++ b/drivers/tty/serial/jsm/jsm_neo.c
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/tty/serial/jsm/jsm_tty.c
index 7a4a914ecff..7a4a914ecff 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/tty/serial/jsm/jsm_tty.c
diff --git a/drivers/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
index 25a8bc565f4..25a8bc565f4 100644
--- a/drivers/serial/kgdboc.c
+++ b/drivers/tty/serial/kgdboc.c
diff --git a/drivers/serial/m32r_sio.c b/drivers/tty/serial/m32r_sio.c
index bea5c215460..bea5c215460 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/tty/serial/m32r_sio.c
diff --git a/drivers/serial/m32r_sio.h b/drivers/tty/serial/m32r_sio.h
index e9b7e11793b..e9b7e11793b 100644
--- a/drivers/serial/m32r_sio.h
+++ b/drivers/tty/serial/m32r_sio.h
diff --git a/drivers/serial/m32r_sio_reg.h b/drivers/tty/serial/m32r_sio_reg.h
index 4671473793e..4671473793e 100644
--- a/drivers/serial/m32r_sio_reg.h
+++ b/drivers/tty/serial/m32r_sio_reg.h
diff --git a/drivers/serial/max3100.c b/drivers/tty/serial/max3100.c
index beb1afa27d8..beb1afa27d8 100644
--- a/drivers/serial/max3100.c
+++ b/drivers/tty/serial/max3100.c
diff --git a/drivers/serial/max3107-aava.c b/drivers/tty/serial/max3107-aava.c
index a1fe304f2f5..a1fe304f2f5 100644
--- a/drivers/serial/max3107-aava.c
+++ b/drivers/tty/serial/max3107-aava.c
diff --git a/drivers/serial/max3107.c b/drivers/tty/serial/max3107.c
index 910870edf70..910870edf70 100644
--- a/drivers/serial/max3107.c
+++ b/drivers/tty/serial/max3107.c
diff --git a/drivers/serial/max3107.h b/drivers/tty/serial/max3107.h
index 7ab63239250..7ab63239250 100644
--- a/drivers/serial/max3107.h
+++ b/drivers/tty/serial/max3107.h
diff --git a/drivers/serial/mcf.c b/drivers/tty/serial/mcf.c
index 3394b7cc172..3394b7cc172 100644
--- a/drivers/serial/mcf.c
+++ b/drivers/tty/serial/mcf.c
diff --git a/drivers/serial/mfd.c b/drivers/tty/serial/mfd.c
index d40010a22ec..d40010a22ec 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/tty/serial/mfd.c
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/tty/serial/mpc52xx_uart.c
index 126ec7f568e..126ec7f568e 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/tty/serial/mpc52xx_uart.c
diff --git a/drivers/serial/mpsc.c b/drivers/tty/serial/mpsc.c
index 6a9c6605666..6a9c6605666 100644
--- a/drivers/serial/mpsc.c
+++ b/drivers/tty/serial/mpsc.c
diff --git a/drivers/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
index b62857bf2fd..b62857bf2fd 100644
--- a/drivers/serial/mrst_max3110.c
+++ b/drivers/tty/serial/mrst_max3110.c
diff --git a/drivers/serial/mrst_max3110.h b/drivers/tty/serial/mrst_max3110.h
index d1ef43af397..d1ef43af397 100644
--- a/drivers/serial/mrst_max3110.h
+++ b/drivers/tty/serial/mrst_max3110.h
diff --git a/drivers/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
index 8e43a7b69e6..8e43a7b69e6 100644
--- a/drivers/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
diff --git a/drivers/serial/msm_serial.h b/drivers/tty/serial/msm_serial.h
index f6ca9ca79e9..f6ca9ca79e9 100644
--- a/drivers/serial/msm_serial.h
+++ b/drivers/tty/serial/msm_serial.h
diff --git a/drivers/serial/mux.c b/drivers/tty/serial/mux.c
index 9711e06a837..9711e06a837 100644
--- a/drivers/serial/mux.c
+++ b/drivers/tty/serial/mux.c
diff --git a/drivers/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 6d01ac96810..6d01ac96810 100644
--- a/drivers/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
diff --git a/drivers/serial/netx-serial.c b/drivers/tty/serial/netx-serial.c
index 7735c9f35fa..7735c9f35fa 100644
--- a/drivers/serial/netx-serial.c
+++ b/drivers/tty/serial/netx-serial.c
diff --git a/drivers/serial/nwpserial.c b/drivers/tty/serial/nwpserial.c
index de173671e3d..de173671e3d 100644
--- a/drivers/serial/nwpserial.c
+++ b/drivers/tty/serial/nwpserial.c
diff --git a/drivers/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index 5c7abe4c94d..5c7abe4c94d 100644
--- a/drivers/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
diff --git a/drivers/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index 7f2f0105878..7f2f0105878 100644
--- a/drivers/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
diff --git a/drivers/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index 70a61458ec4..70a61458ec4 100644
--- a/drivers/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
diff --git a/drivers/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index 5b9cde79e4e..5b9cde79e4e 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c
diff --git a/drivers/serial/pmac_zilog.h b/drivers/tty/serial/pmac_zilog.h
index cbc34fbb1b2..cbc34fbb1b2 100644
--- a/drivers/serial/pmac_zilog.h
+++ b/drivers/tty/serial/pmac_zilog.h
diff --git a/drivers/serial/pnx8xxx_uart.c b/drivers/tty/serial/pnx8xxx_uart.c
index 0aa75a97531..0aa75a97531 100644
--- a/drivers/serial/pnx8xxx_uart.c
+++ b/drivers/tty/serial/pnx8xxx_uart.c
diff --git a/drivers/serial/pxa.c b/drivers/tty/serial/pxa.c
index 1102a39b44f..1102a39b44f 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/tty/serial/pxa.c
diff --git a/drivers/serial/s3c2400.c b/drivers/tty/serial/s3c2400.c
index fed1a9a1ffb..fed1a9a1ffb 100644
--- a/drivers/serial/s3c2400.c
+++ b/drivers/tty/serial/s3c2400.c
diff --git a/drivers/serial/s3c2410.c b/drivers/tty/serial/s3c2410.c
index 73f089d3efd..73f089d3efd 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/tty/serial/s3c2410.c
diff --git a/drivers/serial/s3c2412.c b/drivers/tty/serial/s3c2412.c
index 1700b1a2fb7..1700b1a2fb7 100644
--- a/drivers/serial/s3c2412.c
+++ b/drivers/tty/serial/s3c2412.c
diff --git a/drivers/serial/s3c2440.c b/drivers/tty/serial/s3c2440.c
index 094cc3904b1..094cc3904b1 100644
--- a/drivers/serial/s3c2440.c
+++ b/drivers/tty/serial/s3c2440.c
diff --git a/drivers/serial/s3c24a0.c b/drivers/tty/serial/s3c24a0.c
index fad6083ca42..fad6083ca42 100644
--- a/drivers/serial/s3c24a0.c
+++ b/drivers/tty/serial/s3c24a0.c
diff --git a/drivers/serial/s3c6400.c b/drivers/tty/serial/s3c6400.c
index 4be92ab5005..4be92ab5005 100644
--- a/drivers/serial/s3c6400.c
+++ b/drivers/tty/serial/s3c6400.c
diff --git a/drivers/serial/s5pv210.c b/drivers/tty/serial/s5pv210.c
index 6ebccd70a70..6ebccd70a70 100644
--- a/drivers/serial/s5pv210.c
+++ b/drivers/tty/serial/s5pv210.c
diff --git a/drivers/serial/sa1100.c b/drivers/tty/serial/sa1100.c
index 2199d819a98..2199d819a98 100644
--- a/drivers/serial/sa1100.c
+++ b/drivers/tty/serial/sa1100.c
diff --git a/drivers/serial/samsung.c b/drivers/tty/serial/samsung.c
index 2335edafe90..2335edafe90 100644
--- a/drivers/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
diff --git a/drivers/serial/samsung.h b/drivers/tty/serial/samsung.h
index 0ac06a07d25..0ac06a07d25 100644
--- a/drivers/serial/samsung.h
+++ b/drivers/tty/serial/samsung.h
diff --git a/drivers/serial/sb1250-duart.c b/drivers/tty/serial/sb1250-duart.c
index a2f2b325449..602d9845c52 100644
--- a/drivers/serial/sb1250-duart.c
+++ b/drivers/tty/serial/sb1250-duart.c
@@ -829,7 +829,7 @@ static void __init sbd_probe_duarts(void)
 #ifdef CONFIG_SERIAL_SB1250_DUART_CONSOLE
 /*
  * Serial console stuff.  Very basic, polling driver for doing serial
- * console output.  The console_sem is held by the caller, so we
+ * console output.  The console_lock is held by the caller, so we
  * shouldn't be interrupted for more console activity.
  */
 static void sbd_console_putchar(struct uart_port *uport, int ch)
diff --git a/drivers/serial/sc26xx.c b/drivers/tty/serial/sc26xx.c
index 75038ad2b24..75038ad2b24 100644
--- a/drivers/serial/sc26xx.c
+++ b/drivers/tty/serial/sc26xx.c
diff --git a/drivers/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 460a72d91bb..460a72d91bb 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
diff --git a/drivers/serial/serial_cs.c b/drivers/tty/serial/serial_cs.c
index 93760b2ea17..93760b2ea17 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/tty/serial/serial_cs.c
diff --git a/drivers/serial/serial_ks8695.c b/drivers/tty/serial/serial_ks8695.c
index b1962025b1a..b1962025b1a 100644
--- a/drivers/serial/serial_ks8695.c
+++ b/drivers/tty/serial/serial_ks8695.c
diff --git a/drivers/serial/serial_lh7a40x.c b/drivers/tty/serial/serial_lh7a40x.c
index ea744707c4d..ea744707c4d 100644
--- a/drivers/serial/serial_lh7a40x.c
+++ b/drivers/tty/serial/serial_lh7a40x.c
diff --git a/drivers/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
index c50e9fbbf74..c50e9fbbf74 100644
--- a/drivers/serial/serial_txx9.c
+++ b/drivers/tty/serial/serial_txx9.c
diff --git a/drivers/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 92c91c83edd..92c91c83edd 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
diff --git a/drivers/serial/sh-sci.h b/drivers/tty/serial/sh-sci.h
index b223d6cbf33..b223d6cbf33 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/tty/serial/sh-sci.h
diff --git a/drivers/serial/sn_console.c b/drivers/tty/serial/sn_console.c
index cff9a306660..cff9a306660 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/tty/serial/sn_console.c
diff --git a/drivers/serial/suncore.c b/drivers/tty/serial/suncore.c
index 6381a0282ee..6381a0282ee 100644
--- a/drivers/serial/suncore.c
+++ b/drivers/tty/serial/suncore.c
diff --git a/drivers/serial/suncore.h b/drivers/tty/serial/suncore.h
index db2057936c3..db2057936c3 100644
--- a/drivers/serial/suncore.h
+++ b/drivers/tty/serial/suncore.h
diff --git a/drivers/serial/sunhv.c b/drivers/tty/serial/sunhv.c
index c9014868297..c9014868297 100644
--- a/drivers/serial/sunhv.c
+++ b/drivers/tty/serial/sunhv.c
diff --git a/drivers/serial/sunsab.c b/drivers/tty/serial/sunsab.c
index 5b246b18f42..5b246b18f42 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/tty/serial/sunsab.c
diff --git a/drivers/serial/sunsab.h b/drivers/tty/serial/sunsab.h
index b78e1f7b805..b78e1f7b805 100644
--- a/drivers/serial/sunsab.h
+++ b/drivers/tty/serial/sunsab.h
diff --git a/drivers/serial/sunsu.c b/drivers/tty/serial/sunsu.c
index 551ebfe3ccb..551ebfe3ccb 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/tty/serial/sunsu.c
diff --git a/drivers/serial/sunzilog.c b/drivers/tty/serial/sunzilog.c
index c1967ac1c07..c1967ac1c07 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/tty/serial/sunzilog.c
diff --git a/drivers/serial/sunzilog.h b/drivers/tty/serial/sunzilog.h
index 5dec7b47cc3..5dec7b47cc3 100644
--- a/drivers/serial/sunzilog.h
+++ b/drivers/tty/serial/sunzilog.h
diff --git a/drivers/serial/timbuart.c b/drivers/tty/serial/timbuart.c
index 1f36b7eb735..1f36b7eb735 100644
--- a/drivers/serial/timbuart.c
+++ b/drivers/tty/serial/timbuart.c
diff --git a/drivers/serial/timbuart.h b/drivers/tty/serial/timbuart.h
index 7e566766bc4..7e566766bc4 100644
--- a/drivers/serial/timbuart.h
+++ b/drivers/tty/serial/timbuart.h
diff --git a/drivers/serial/uartlite.c b/drivers/tty/serial/uartlite.c
index d2fce865b73..d2fce865b73 100644
--- a/drivers/serial/uartlite.c
+++ b/drivers/tty/serial/uartlite.c
diff --git a/drivers/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
index 3f4848e2174..3f4848e2174 100644
--- a/drivers/serial/ucc_uart.c
+++ b/drivers/tty/serial/ucc_uart.c
diff --git a/drivers/serial/vr41xx_siu.c b/drivers/tty/serial/vr41xx_siu.c
index 3beb6ab4fa6..3beb6ab4fa6 100644
--- a/drivers/serial/vr41xx_siu.c
+++ b/drivers/tty/serial/vr41xx_siu.c
diff --git a/drivers/serial/vt8500_serial.c b/drivers/tty/serial/vt8500_serial.c
index 322bf56c0d8..322bf56c0d8 100644
--- a/drivers/serial/vt8500_serial.c
+++ b/drivers/tty/serial/vt8500_serial.c
diff --git a/drivers/serial/zs.c b/drivers/tty/serial/zs.c
index 1a7fd3e7031..1a7fd3e7031 100644
--- a/drivers/serial/zs.c
+++ b/drivers/tty/serial/zs.c
diff --git a/drivers/serial/zs.h b/drivers/tty/serial/zs.h
index aa921b57d82..aa921b57d82 100644
--- a/drivers/serial/zs.h
+++ b/drivers/tty/serial/zs.h
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index c556ed9db13..8e0dd254eb1 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -46,7 +46,7 @@
 #include <asm/irq_regs.h>
 
 /* Whether we react on sysrq keys or just ignore them */
-static int __read_mostly sysrq_enabled = 1;
+static int __read_mostly sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
 static bool __read_mostly sysrq_always_enabled;
 
 static bool sysrq_on(void)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 464d09d9787..0065da4b11c 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -3256,8 +3256,8 @@ static ssize_t show_cons_active(struct device *dev,
         struct console *c;
         ssize_t count = 0;
 
-        acquire_console_sem();
-        for (c = console_drivers; c; c = c->next) {
+        console_lock();
+        for_each_console(c) {
                 if (!c->device)
                         continue;
                 if (!c->write)
@@ -3271,7 +3271,7 @@ static ssize_t show_cons_active(struct device *dev,
         while (i--)
                 count += sprintf(buf + count, "%s%d%c",
                                  cs[i]->name, cs[i]->index, i ? ' ':'\n');
-        release_console_sem();
+        console_unlock();
 
         return count;
 }
@@ -3306,7 +3306,7 @@ int __init tty_init(void)
         if (IS_ERR(consdev))
                 consdev = NULL;
         else
-                device_create_file(consdev, &dev_attr_active);
+                WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
 
 #ifdef CONFIG_VT
         vty_init(&console_fops);
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index ebae344ce91..c956ed6c83a 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -316,9 +316,9 @@ int paste_selection(struct tty_struct *tty)
         /* always called with BTM from vt_ioctl */
         WARN_ON(!tty_locked());
 
-        acquire_console_sem();
+        console_lock();
         poke_blanked_console();
-        release_console_sem();
+        console_unlock();
 
         ld = tty_ldisc_ref(tty);
         if (!ld) {
diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
index eab3a1ff99e..a672ed192d3 100644
--- a/drivers/tty/vt/vc_screen.c
+++ b/drivers/tty/vt/vc_screen.c
@@ -202,7 +202,7 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         /* Select the proper current console and verify
          * sanity of the situation under the console lock.
          */
-        acquire_console_sem();
+        console_lock();
 
         attr = (currcons & 128);
         currcons = (currcons & 127);
@@ -336,9 +336,9 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
                  * the pagefault handling code may want to call printk().
                  */
 
-                release_console_sem();
+                console_unlock();
                 ret = copy_to_user(buf, con_buf_start, orig_count);
-                acquire_console_sem();
+                console_lock();
 
                 if (ret) {
                         read += (orig_count - ret);
@@ -354,7 +354,7 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         if (read)
                 ret = read;
 unlock_out:
-        release_console_sem();
+        console_unlock();
         mutex_unlock(&con_buf_mtx);
         return ret;
 }
@@ -379,7 +379,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
         /* Select the proper current console and verify
          * sanity of the situation under the console lock.
          */
-        acquire_console_sem();
+        console_lock();
 
         attr = (currcons & 128);
         currcons = (currcons & 127);
@@ -414,9 +414,9 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
                 /* Temporarily drop the console lock so that we can read
                  * in the write data from userspace safely.
                  */
-                release_console_sem();
+                console_unlock();
                 ret = copy_from_user(con_buf, buf, this_round);
-                acquire_console_sem();
+                console_lock();
 
                 if (ret) {
                         this_round -= ret;
@@ -542,7 +542,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
                 vcs_scr_updated(vc);
 
 unlock_out:
-        release_console_sem();
+        console_unlock();
 
         mutex_unlock(&con_buf_mtx);
 
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 76407eca9ab..147ede3423d 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1003,9 +1003,9 @@ static int vt_resize(struct tty_struct *tty, struct winsize *ws)
         struct vc_data *vc = tty->driver_data;
         int ret;
 
-        acquire_console_sem();
+        console_lock();
         ret = vc_do_resize(tty, vc, ws->ws_col, ws->ws_row);
-        release_console_sem();
+        console_unlock();
         return ret;
 }
 
@@ -1271,7 +1271,7 @@ static void default_attr(struct vc_data *vc)
         vc->vc_color = vc->vc_def_color;
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_m(struct vc_data *vc)
 {
         int i;
@@ -1415,7 +1415,7 @@ int mouse_reporting(void)
         return vc_cons[fg_console].d->vc_report_mouse;
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void set_mode(struct vc_data *vc, int on_off)
 {
         int i;
@@ -1485,7 +1485,7 @@ static void set_mode(struct vc_data *vc, int on_off)
                 }
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void setterm_command(struct vc_data *vc)
 {
         switch(vc->vc_par[0]) {
@@ -1545,7 +1545,7 @@ static void setterm_command(struct vc_data *vc)
         }
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_at(struct vc_data *vc, unsigned int nr)
 {
         if (nr > vc->vc_cols - vc->vc_x)
@@ -1555,7 +1555,7 @@ static void csi_at(struct vc_data *vc, unsigned int nr)
         insert_char(vc, nr);
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_L(struct vc_data *vc, unsigned int nr)
 {
         if (nr > vc->vc_rows - vc->vc_y)
@@ -1566,7 +1566,7 @@ static void csi_L(struct vc_data *vc, unsigned int nr)
         vc->vc_need_wrap = 0;
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_P(struct vc_data *vc, unsigned int nr)
 {
         if (nr > vc->vc_cols - vc->vc_x)
@@ -1576,7 +1576,7 @@ static void csi_P(struct vc_data *vc, unsigned int nr)
         delete_char(vc, nr);
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_M(struct vc_data *vc, unsigned int nr)
 {
         if (nr > vc->vc_rows - vc->vc_y)
@@ -1587,7 +1587,7 @@ static void csi_M(struct vc_data *vc, unsigned int nr)
         vc->vc_need_wrap = 0;
 }
 
-/* console_sem is held (except via vc_init->reset_terminal */
+/* console_lock is held (except via vc_init->reset_terminal */
 static void save_cur(struct vc_data *vc)
 {
         vc->vc_saved_x          = vc->vc_x;
@@ -1603,7 +1603,7 @@ static void save_cur(struct vc_data *vc)
         vc->vc_saved_G1         = vc->vc_G1_charset;
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void restore_cur(struct vc_data *vc)
 {
         gotoxy(vc, vc->vc_saved_x, vc->vc_saved_y);
@@ -1625,7 +1625,7 @@ enum { ESnormal, ESesc, ESsquare, ESgetpars, ESgotpars, ESfunckey,
         EShash, ESsetG0, ESsetG1, ESpercent, ESignore, ESnonstd,
         ESpalette };
 
-/* console_sem is held (except via vc_init()) */
+/* console_lock is held (except via vc_init()) */
 static void reset_terminal(struct vc_data *vc, int do_clear)
 {
         vc->vc_top              = 0;
@@ -1685,7 +1685,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
             csi_J(vc, 2);
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
 {
         /*
@@ -2119,7 +2119,7 @@ static int is_double_width(uint32_t ucs)
         return bisearch(ucs, double_width, ARRAY_SIZE(double_width) - 1);
 }
 
-/* acquires console_sem */
+/* acquires console_lock */
 static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int count)
 {
 #ifdef VT_BUF_VRAM_ONLY
@@ -2147,11 +2147,11 @@ static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int co
 
         might_sleep();
 
-        acquire_console_sem();
+        console_lock();
         vc = tty->driver_data;
         if (vc == NULL) {
                 printk(KERN_ERR "vt: argh, driver_data is NULL !\n");
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -2159,7 +2159,7 @@ static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int co
         if (!vc_cons_allocated(currcons)) {
             /* could this happen? */
                 printk_once("con_write: tty %d not allocated\n", currcons+1);
-            release_console_sem();
+            console_unlock();
             return 0;
         }
 
@@ -2375,7 +2375,7 @@ rescan_last_byte:
         }
         FLUSH
         console_conditional_schedule();
-        release_console_sem();
+        console_unlock();
         notify_update(vc);
         return n;
 #undef FLUSH
@@ -2388,11 +2388,11 @@ rescan_last_byte:
  * us to do the switches asynchronously (needed when we want
  * to switch due to a keyboard interrupt).  Synchronization
  * with other console code and prevention of re-entrancy is
- * ensured with console_sem.
+ * ensured with console_lock.
  */
 static void console_callback(struct work_struct *ignored)
 {
-        acquire_console_sem();
+        console_lock();
 
         if (want_console >= 0) {
                 if (want_console != fg_console &&
@@ -2422,7 +2422,7 @@ static void console_callback(struct work_struct *ignored)
         }
         notify_update(vc_cons[fg_console].d);
 
-        release_console_sem();
+        console_unlock();
 }
 
 int set_console(int nr)
@@ -2603,7 +2603,7 @@ static struct console vt_console_driver = {
  */
 
 /*
- * Generally a bit racy with respect to console_sem().
+ * Generally a bit racy with respect to console_lock();.
  *
  * There are some functions which don't need it.
  *
@@ -2629,17 +2629,17 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
         switch (type)
         {
                 case TIOCL_SETSEL:
-                        acquire_console_sem();
+                        console_lock();
                         ret = set_selection((struct tiocl_selection __user *)(p+1), tty);
-                        release_console_sem();
+                        console_unlock();
                         break;
                 case TIOCL_PASTESEL:
                         ret = paste_selection(tty);
                         break;
                 case TIOCL_UNBLANKSCREEN:
-                        acquire_console_sem();
+                        console_lock();
                         unblank_screen();
-                        release_console_sem();
+                        console_unlock();
                         break;
                 case TIOCL_SELLOADLUT:
                         ret = sel_loadlut(p);
@@ -2688,10 +2688,10 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
                         }
                         break;
                 case TIOCL_BLANKSCREEN: /* until explicitly unblanked, not only poked */
-                        acquire_console_sem();
+                        console_lock();
                         ignore_poke = 1;
                         do_blank_screen(0);
-                        release_console_sem();
+                        console_unlock();
                         break;
                 case TIOCL_BLANKEDSCREEN:
                         ret = console_blanked;
@@ -2790,11 +2790,11 @@ static void con_flush_chars(struct tty_struct *tty)
                 return;
 
         /* if we race with con_close(), vt may be null */
-        acquire_console_sem();
+        console_lock();
         vc = tty->driver_data;
         if (vc)
                 set_cursor(vc);
-        release_console_sem();
+        console_unlock();
 }
 
 /*
@@ -2805,7 +2805,7 @@ static int con_open(struct tty_struct *tty, struct file *filp)
         unsigned int currcons = tty->index;
         int ret = 0;
 
-        acquire_console_sem();
+        console_lock();
         if (tty->driver_data == NULL) {
                 ret = vc_allocate(currcons);
                 if (ret == 0) {
@@ -2813,7 +2813,7 @@ static int con_open(struct tty_struct *tty, struct file *filp)
 
                         /* Still being freed */
                         if (vc->port.tty) {
-                                release_console_sem();
+                                console_unlock();
                                 return -ERESTARTSYS;
                         }
                         tty->driver_data = vc;
@@ -2827,11 +2827,11 @@ static int con_open(struct tty_struct *tty, struct file *filp)
                                 tty->termios->c_iflag |= IUTF8;
                         else
                                 tty->termios->c_iflag &= ~IUTF8;
-                        release_console_sem();
+                        console_unlock();
                         return ret;
                 }
         }
-        release_console_sem();
+        console_unlock();
         return ret;
 }
 
@@ -2844,9 +2844,9 @@ static void con_shutdown(struct tty_struct *tty)
 {
         struct vc_data *vc = tty->driver_data;
         BUG_ON(vc == NULL);
-        acquire_console_sem();
+        console_lock();
         vc->port.tty = NULL;
-        release_console_sem();
+        console_unlock();
         tty_shutdown(tty);
 }
 
@@ -2893,13 +2893,13 @@ static int __init con_init(void)
         struct vc_data *vc;
         unsigned int currcons = 0, i;
 
-        acquire_console_sem();
+        console_lock();
 
         if (conswitchp)
                 display_desc = conswitchp->con_startup();
         if (!display_desc) {
                 fg_console = 0;
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -2946,7 +2946,7 @@ static int __init con_init(void)
         printable = 1;
         printk("\n");
 
-        release_console_sem();
+        console_unlock();
 
 #ifdef CONFIG_VT_CONSOLE
         register_console(&vt_console_driver);
@@ -2994,7 +2994,7 @@ int __init vty_init(const struct file_operations *console_fops)
         if (IS_ERR(tty0dev))
                 tty0dev = NULL;
         else
-                device_create_file(tty0dev, &dev_attr_active);
+                WARN_ON(device_create_file(tty0dev, &dev_attr_active) < 0);
 
         vcs_init();
 
@@ -3037,7 +3037,7 @@ static int bind_con_driver(const struct consw *csw, int first, int last,
         if (!try_module_get(owner))
                 return -ENODEV;
 
-        acquire_console_sem();
+        console_lock();
 
         /* check if driver is registered */
         for (i = 0; i < MAX_NR_CON_DRIVER; i++) {
@@ -3122,7 +3122,7 @@ static int bind_con_driver(const struct consw *csw, int first, int last,
 
         retval = 0;
 err:
-        release_console_sem();
+        console_unlock();
         module_put(owner);
         return retval;
 };
@@ -3171,7 +3171,7 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt)
         if (!try_module_get(owner))
                 return -ENODEV;
 
-        acquire_console_sem();
+        console_lock();
 
         /* check if driver is registered and if it is unbindable */
         for (i = 0; i < MAX_NR_CON_DRIVER; i++) {
@@ -3185,7 +3185,7 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt)
         }
 
         if (retval) {
-                release_console_sem();
+                console_unlock();
                 goto err;
         }
 
@@ -3204,12 +3204,12 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt)
         }
 
         if (retval) {
-                release_console_sem();
+                console_unlock();
                 goto err;
         }
 
         if (!con_is_bound(csw)) {
-                release_console_sem();
+                console_unlock();
                 goto err;
         }
 
@@ -3238,7 +3238,7 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt)
         if (!con_is_bound(csw))
                 con_driver->flag &= ~CON_DRIVER_FLAG_INIT;
 
-        release_console_sem();
+        console_unlock();
         /* ignore return value, binding should not fail */
         bind_con_driver(defcsw, first, last, deflt);
 err:
@@ -3538,14 +3538,14 @@ int register_con_driver(const struct consw *csw, int first, int last)
         if (!try_module_get(owner))
                 return -ENODEV;
 
-        acquire_console_sem();
+        console_lock();
 
         for (i = 0; i < MAX_NR_CON_DRIVER; i++) {
                 con_driver = &registered_con_driver[i];
 
                 /* already registered */
                 if (con_driver->con == csw)
-                        retval = -EINVAL;
+                        retval = -EBUSY;
         }
 
         if (retval)
@@ -3592,7 +3592,7 @@ int register_con_driver(const struct consw *csw, int first, int last)
         }
 
 err:
-        release_console_sem();
+        console_unlock();
         module_put(owner);
         return retval;
 }
@@ -3613,7 +3613,7 @@ int unregister_con_driver(const struct consw *csw)
 {
         int i, retval = -ENODEV;
 
-        acquire_console_sem();
+        console_lock();
 
         /* cannot unregister a bound driver */
         if (con_is_bound(csw))
@@ -3639,7 +3639,7 @@ int unregister_con_driver(const struct consw *csw)
                 }
         }
 err:
-        release_console_sem();
+        console_unlock();
         return retval;
 }
 EXPORT_SYMBOL(unregister_con_driver);
@@ -3656,7 +3656,12 @@ int take_over_console(const struct consw *csw, int first, int last, int deflt)
         int err;
 
         err = register_con_driver(csw, first, last);
-
+        /* if we get an busy error we still want to bind the console driver
+         * and return success, as we may have unbound the console driver
+         * but not unregistered it.
+        */
+        if (err == -EBUSY)
+                err = 0;
         if (!err)
                 bind_con_driver(csw, first, last, deflt);
 
@@ -3934,9 +3939,9 @@ int con_set_cmap(unsigned char __user *arg)
 {
         int rc;
 
-        acquire_console_sem();
+        console_lock();
         rc = set_get_cmap (arg,1);
-        release_console_sem();
+        console_unlock();
 
         return rc;
 }
@@ -3945,9 +3950,9 @@ int con_get_cmap(unsigned char __user *arg)
 {
         int rc;
 
-        acquire_console_sem();
+        console_lock();
         rc = set_get_cmap (arg,0);
-        release_console_sem();
+        console_unlock();
 
         return rc;
 }
@@ -3994,12 +3999,12 @@ static int con_font_get(struct vc_data *vc, struct console_font_op *op)
         } else
                 font.data = NULL;
 
-        acquire_console_sem();
+        console_lock();
         if (vc->vc_sw->con_font_get)
                 rc = vc->vc_sw->con_font_get(vc, &font);
         else
                 rc = -ENOSYS;
-        release_console_sem();
+        console_unlock();
 
         if (rc)
                 goto out;
@@ -4076,12 +4081,12 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
         font.data = memdup_user(op->data, size);
         if (IS_ERR(font.data))
                 return PTR_ERR(font.data);
-        acquire_console_sem();
+        console_lock();
         if (vc->vc_sw->con_font_set)
                 rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
         else
                 rc = -ENOSYS;
-        release_console_sem();
+        console_unlock();
         kfree(font.data);
         return rc;
 }
@@ -4103,12 +4108,12 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
         else
                 name[MAX_FONT_NAME - 1] = 0;
 
-        acquire_console_sem();
+        console_lock();
         if (vc->vc_sw->con_font_default)
                 rc = vc->vc_sw->con_font_default(vc, &font, s);
         else
                 rc = -ENOSYS;
-        release_console_sem();
+        console_unlock();
         if (!rc) {
                 op->width = font.width;
                 op->height = font.height;
@@ -4124,7 +4129,7 @@ static int con_font_copy(struct vc_data *vc, struct console_font_op *op)
         if (vc->vc_mode != KD_TEXT)
                 return -EINVAL;
 
-        acquire_console_sem();
+        console_lock();
         if (!vc->vc_sw->con_font_copy)
                 rc = -ENOSYS;
         else if (con < 0 || !vc_cons_allocated(con))
@@ -4133,7 +4138,7 @@ static int con_font_copy(struct vc_data *vc, struct console_font_op *op)
                 rc = 0;
         else
                 rc = vc->vc_sw->con_font_copy(vc, con);
-        release_console_sem();
+        console_unlock();
         return rc;
 }
 
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index 6b68a0fb461..1235ebda6e1 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -649,12 +649,12 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 /*
                  * explicitly blank/unblank the screen if switching modes
                  */
-                acquire_console_sem();
+                console_lock();
                 if (arg == KD_TEXT)
                         do_unblank_screen(1);
                 else
                         do_blank_screen(1);
-                release_console_sem();
+                console_unlock();
                 break;
 
         case KDGETMODE:
@@ -893,7 +893,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         ret = -EINVAL;
                         goto out;
                 }
-                acquire_console_sem();
+                console_lock();
                 vc->vt_mode = tmp;
                 /* the frsig is ignored, so we set it to 0 */
                 vc->vt_mode.frsig = 0;
@@ -901,7 +901,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 vc->vt_pid = get_pid(task_pid(current));
                 /* no switch is required -- saw@shade.msu.ru */
                 vc->vt_newvt = -1;
-                release_console_sem();
+                console_unlock();
                 break;
         }
 
@@ -910,9 +910,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 struct vt_mode tmp;
                 int rc;
 
-                acquire_console_sem();
+                console_lock();
                 memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode));
-                release_console_sem();
+                console_unlock();
 
                 rc = copy_to_user(up, &tmp, sizeof(struct vt_mode));
                 if (rc)
@@ -965,9 +965,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         ret =  -ENXIO;
                 else {
                         arg--;
-                        acquire_console_sem();
+                        console_lock();
                         ret = vc_allocate(arg);
-                        release_console_sem();
+                        console_unlock();
                         if (ret)
                                 break;
                         set_console(arg);
@@ -990,7 +990,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         ret = -ENXIO;
                 else {
                         vsa.console--;
-                        acquire_console_sem();
+                        console_lock();
                         ret = vc_allocate(vsa.console);
                         if (ret == 0) {
                                 struct vc_data *nvc;
@@ -1003,7 +1003,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                                 put_pid(nvc->vt_pid);
                                 nvc->vt_pid = get_pid(task_pid(current));
                         }
-                        release_console_sem();
+                        console_unlock();
                         if (ret)
                                 break;
                         /* Commence switch and lock */
@@ -1044,7 +1044,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 /*
                  * Switching-from response
                  */
-                acquire_console_sem();
+                console_lock();
                 if (vc->vt_newvt >= 0) {
                         if (arg == 0)
                                 /*
@@ -1063,7 +1063,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                                 vc->vt_newvt = -1;
                                 ret = vc_allocate(newvt);
                                 if (ret) {
-                                        release_console_sem();
+                                        console_unlock();
                                         break;
                                 }
                                 /*
@@ -1083,7 +1083,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         if (arg != VT_ACKACQ)
                                 ret = -EINVAL;
                 }
-                release_console_sem();
+                console_unlock();
                 break;
 
          /*
@@ -1096,20 +1096,20 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 }
                 if (arg == 0) {
                     /* deallocate all unused consoles, but leave 0 */
-                        acquire_console_sem();
+                        console_lock();
                         for (i=1; i<MAX_NR_CONSOLES; i++)
                                 if (! VT_BUSY(i))
                                         vc_deallocate(i);
-                        release_console_sem();
+                        console_unlock();
                 } else {
                         /* deallocate a single console, if possible */
                         arg--;
                         if (VT_BUSY(arg))
                                 ret = -EBUSY;
                         else if (arg) {                       /* leave 0 */
-                                acquire_console_sem();
+                                console_lock();
                                 vc_deallocate(arg);
-                                release_console_sem();
+                                console_unlock();
                         }
                 }
                 break;
@@ -1126,7 +1126,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                     get_user(cc, &vtsizes->v_cols))
                         ret = -EFAULT;
                 else {
-                        acquire_console_sem();
+                        console_lock();
                         for (i = 0; i < MAX_NR_CONSOLES; i++) {
                                 vc = vc_cons[i].d;
 
@@ -1135,7 +1135,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                                         vc_resize(vc_cons[i].d, cc, ll);
                                 }
                         }
-                        release_console_sem();
+                        console_unlock();
                 }
                 break;
         }
@@ -1187,14 +1187,14 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 for (i = 0; i < MAX_NR_CONSOLES; i++) {
                         if (!vc_cons[i].d)
                                 continue;
-                        acquire_console_sem();
+                        console_lock();
                         if (vlin)
                                 vc_cons[i].d->vc_scan_lines = vlin;
                         if (clin)
                                 vc_cons[i].d->vc_font.height = clin;
                         vc_cons[i].d->vc_resize_user = 1;
                         vc_resize(vc_cons[i].d, cc, ll);
-                        release_console_sem();
+                        console_unlock();
                 }
                 break;
         }
@@ -1367,7 +1367,7 @@ void vc_SAK(struct work_struct *work)
         struct vc_data *vc;
         struct tty_struct *tty;
 
-        acquire_console_sem();
+        console_lock();
         vc = vc_con->d;
         if (vc) {
                 tty = vc->port.tty;
@@ -1379,7 +1379,7 @@ void vc_SAK(struct work_struct *work)
                         __do_SAK(tty);
                 reset_vc(vc);
         }
-        release_console_sem();
+        console_unlock();
 }
 
 #ifdef CONFIG_COMPAT
@@ -1737,10 +1737,10 @@ int vt_move_to_console(unsigned int vt, int alloc)
 {
         int prev;
 
-        acquire_console_sem();
+        console_lock();
         /* Graphics mode - up to X */
         if (disable_vt_switch) {
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
         prev = fg_console;
@@ -1748,7 +1748,7 @@ int vt_move_to_console(unsigned int vt, int alloc)
         if (alloc && vc_allocate(vt)) {
                 /* we can't have a free VC for now. Too bad,
                  * we don't want to mess the screen for now. */
-                release_console_sem();
+                console_unlock();
                 return -ENOSPC;
         }
 
@@ -1758,10 +1758,10 @@ int vt_move_to_console(unsigned int vt, int alloc)
                  * Let the calling function know so it can decide
                  * what to do.
                  */
-                release_console_sem();
+                console_unlock();
                 return -EIO;
         }
-        release_console_sem();
+        console_unlock();
         tty_lock();
         if (vt_waitactive(vt + 1)) {
                 pr_debug("Suspend: Can't switch VCs.");
@@ -1781,8 +1781,8 @@ int vt_move_to_console(unsigned int vt, int alloc)
  */
 void pm_set_vt_switch(int do_switch)
 {
-        acquire_console_sem();
+        console_lock();
         disable_vt_switch = !do_switch;
-        release_console_sem();
+        console_unlock();
 }
 EXPORT_SYMBOL(pm_set_vt_switch);
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 6ee4451bfe2..47085e5879a 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -342,7 +342,7 @@ static ssize_t wdm_write
                 goto outnp;
         }
 
-        if (!file->f_flags && O_NONBLOCK)
+        if (!(file->f_flags & O_NONBLOCK))
                 r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
                                                                 &desc->flags));
         else
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index bcc24779ba0..18d02e32a3d 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -123,9 +123,9 @@ config USB_OTG
 
 config USB_OTG_WHITELIST
         bool "Rely on OTG Targeted Peripherals List"
-        depends on USB_OTG || EMBEDDED
+        depends on USB_OTG || EXPERT
         default y if USB_OTG
-        default n if EMBEDDED
+        default n if EXPERT
         help
           If you say Y here, the "otg_whitelist.h" file will be used as a
           product whitelist, so USB peripherals not listed there will be
@@ -141,7 +141,7 @@ config USB_OTG_WHITELIST
 
 config USB_OTG_BLACKLIST_HUB
         bool "Disable external hubs"
-        depends on USB_OTG || EMBEDDED
+        depends on USB_OTG || EXPERT
         help
           If you say Y here, then Linux will refuse to enumerate
           external hubs.  OTG hosts are allowed to reduce hardware
diff --git a/drivers/usb/core/endpoint.c b/drivers/usb/core/endpoint.c
index 9da25056302..df502a98d0d 100644
--- a/drivers/usb/core/endpoint.c
+++ b/drivers/usb/core/endpoint.c
@@ -192,12 +192,12 @@ int usb_create_ep_devs(struct device *parent,
         ep_dev->dev.parent = parent;
         ep_dev->dev.release = ep_device_release;
         dev_set_name(&ep_dev->dev, "ep_%02x", endpoint->desc.bEndpointAddress);
-        device_enable_async_suspend(&ep_dev->dev);
 
         retval = device_register(&ep_dev->dev);
         if (retval)
                 goto error_register;
 
+        device_enable_async_suspend(&ep_dev->dev);
         endpoint->ep_dev = ep_dev;
         return retval;
 
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index b55d46070a2..f71e8e307e0 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -405,7 +405,12 @@ static int suspend_common(struct device *dev, bool do_wakeup)
                         return retval;
         }
 
-        synchronize_irq(pci_dev->irq);
+        /* If MSI-X is enabled, the driver will have synchronized all vectors
+         * in pci_suspend(). If MSI or legacy PCI is enabled, that will be
+         * synchronized here.
+         */
+        if (!hcd->msix_enabled)
+                synchronize_irq(pci_dev->irq);
 
         /* Downstream ports from this root hub should already be quiesced, so
          * there will be no DMA activity.  Now we can shut down the upstream
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index b98efae6a1c..4310cc4b1cb 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -676,6 +676,8 @@ static void hub_init_func3(struct work_struct *ws);
 static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 {
         struct usb_device *hdev = hub->hdev;
+        struct usb_hcd *hcd;
+        int ret;
         int port1;
         int status;
         bool need_debounce_delay = false;
@@ -714,6 +716,25 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         usb_autopm_get_interface_no_resume(
                                         to_usb_interface(hub->intfdev));
                         return;         /* Continues at init2: below */
+                } else if (type == HUB_RESET_RESUME) {
+                        /* The internal host controller state for the hub device
+                         * may be gone after a host power loss on system resume.
+                         * Update the device's info so the HW knows it's a hub.
+                         */
+                        hcd = bus_to_hcd(hdev->bus);
+                        if (hcd->driver->update_hub_device) {
+                                ret = hcd->driver->update_hub_device(hcd, hdev,
+                                                &hub->tt, GFP_NOIO);
+                                if (ret < 0) {
+                                        dev_err(hub->intfdev, "Host not "
+                                                        "accepting hub info "
+                                                        "update.\n");
+                                        dev_err(hub->intfdev, "LS/FS devices "
+                                                        "and hubs may not work "
+                                                        "under this hub\n.");
+                                }
+                        }
+                        hub_power_on(hub, true);
                 } else {
                         hub_power_on(hub, true);
                 }
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 1dc9739277b..06bb9d4587e 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -509,7 +509,7 @@ config USB_LANGWELL
         select USB_GADGET_SELECTED
 
 config USB_GADGET_EG20T
-        boolean "Intel EG20T(Topcliff) USB Device controller"
+        boolean "Intel EG20T PCH/OKI SEMICONDUCTOR ML7213 IOH UDC"
         depends on PCI
         select USB_GADGET_DUALSPEED
         help
@@ -525,6 +525,11 @@ config USB_GADGET_EG20T
           This driver dose not support interrupt transfer or isochronous
           transfer modes.
 
+          This driver also can be used for OKI SEMICONDUCTOR's ML7213 which is
+          for IVI(In-Vehicle Infotainment) use.
+          ML7213 is companion chip for Intel Atom E6xx series.
+          ML7213 is completely compatible for Intel EG20T PCH.
+
 config USB_EG20T
         tristate
         depends on USB_GADGET_EG20T
diff --git a/drivers/usb/gadget/ci13xxx_udc.c b/drivers/usb/gadget/ci13xxx_udc.c
index 31656a2b4ab..a1c67ae1572 100644
--- a/drivers/usb/gadget/ci13xxx_udc.c
+++ b/drivers/usb/gadget/ci13xxx_udc.c
@@ -76,10 +76,21 @@ static DEFINE_SPINLOCK(udc_lock);
 
 /* control endpoint description */
 static const struct usb_endpoint_descriptor
-ctrl_endpt_desc = {
+ctrl_endpt_out_desc = {
         .bLength         = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
+        .bEndpointAddress = USB_DIR_OUT,
+        .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
+};
+
+static const struct usb_endpoint_descriptor
+ctrl_endpt_in_desc = {
+        .bLength         = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+
+        .bEndpointAddress = USB_DIR_IN,
         .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
         .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
 };
@@ -265,10 +276,10 @@ static int hw_device_init(void __iomem *base)
         hw_bank.size /= sizeof(u32);
 
         reg = hw_aread(ABS_DCCPARAMS, DCCPARAMS_DEN) >> ffs_nr(DCCPARAMS_DEN);
-        if (reg == 0 || reg > ENDPT_MAX)
-                return -ENODEV;
+        hw_ep_max = reg * 2;   /* cache hw ENDPT_MAX */
 
-        hw_ep_max = reg;   /* cache hw ENDPT_MAX */
+        if (hw_ep_max == 0 || hw_ep_max > ENDPT_MAX)
+                return -ENODEV;
 
         /* setup lock mode ? */
 
@@ -1197,16 +1208,17 @@ static ssize_t show_qheads(struct device *dev, struct device_attribute *attr,
         }
 
         spin_lock_irqsave(udc->lock, flags);
-        for (i = 0; i < hw_ep_max; i++) {
-                struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
+        for (i = 0; i < hw_ep_max/2; i++) {
+                struct ci13xxx_ep *mEpRx = &udc->ci13xxx_ep[i];
+                struct ci13xxx_ep *mEpTx = &udc->ci13xxx_ep[i + hw_ep_max/2];
                 n += scnprintf(buf + n, PAGE_SIZE - n,
                                "EP=%02i: RX=%08X TX=%08X\n",
-                               i, (u32)mEp->qh[RX].dma, (u32)mEp->qh[TX].dma);
+                               i, (u32)mEpRx->qh.dma, (u32)mEpTx->qh.dma);
                 for (j = 0; j < (sizeof(struct ci13xxx_qh)/sizeof(u32)); j++) {
                         n += scnprintf(buf + n, PAGE_SIZE - n,
                                        " %04X:    %08X    %08X\n", j,
-                                       *((u32 *)mEp->qh[RX].ptr + j),
-                                       *((u32 *)mEp->qh[TX].ptr + j));
+                                       *((u32 *)mEpRx->qh.ptr + j),
+                                       *((u32 *)mEpTx->qh.ptr + j));
                 }
         }
         spin_unlock_irqrestore(udc->lock, flags);
@@ -1293,7 +1305,7 @@ static ssize_t show_requests(struct device *dev, struct device_attribute *attr,
         unsigned long flags;
         struct list_head   *ptr = NULL;
         struct ci13xxx_req *req = NULL;
-        unsigned i, j, k, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32);
+        unsigned i, j, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32);
 
         dbg_trace("[%s] %p\n", __func__, buf);
         if (attr == NULL || buf == NULL) {
@@ -1303,22 +1315,20 @@ static ssize_t show_requests(struct device *dev, struct device_attribute *attr,
 
         spin_lock_irqsave(udc->lock, flags);
         for (i = 0; i < hw_ep_max; i++)
-                for (k = RX; k <= TX; k++)
-                        list_for_each(ptr, &udc->ci13xxx_ep[i].qh[k].queue)
-                        {
-                                req = list_entry(ptr,
-                                                 struct ci13xxx_req, queue);
+                list_for_each(ptr, &udc->ci13xxx_ep[i].qh.queue)
+                {
+                        req = list_entry(ptr, struct ci13xxx_req, queue);
+
+                        n += scnprintf(buf + n, PAGE_SIZE - n,
+                                        "EP=%02i: TD=%08X %s\n",
+                                        i % hw_ep_max/2, (u32)req->dma,
+                                        ((i < hw_ep_max/2) ? "RX" : "TX"));
 
+                        for (j = 0; j < qSize; j++)
                                 n += scnprintf(buf + n, PAGE_SIZE - n,
-                                               "EP=%02i: TD=%08X %s\n",
-                                               i, (u32)req->dma,
-                                               ((k == RX) ? "RX" : "TX"));
-
-                                for (j = 0; j < qSize; j++)
-                                        n += scnprintf(buf + n, PAGE_SIZE - n,
-                                                       " %04X:    %08X\n", j,
-                                                       *((u32 *)req->ptr + j));
-                        }
+                                                " %04X:    %08X\n", j,
+                                                *((u32 *)req->ptr + j));
+                }
         spin_unlock_irqrestore(udc->lock, flags);
 
         return n;
@@ -1467,12 +1477,12 @@ static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
          *  At this point it's guaranteed exclusive access to qhead
          *  (endpt is not primed) so it's no need to use tripwire
          */
-        mEp->qh[mEp->dir].ptr->td.next   = mReq->dma;    /* TERMINATE = 0 */
-        mEp->qh[mEp->dir].ptr->td.token &= ~TD_STATUS;   /* clear status */
+        mEp->qh.ptr->td.next   = mReq->dma;    /* TERMINATE = 0 */
+        mEp->qh.ptr->td.token &= ~TD_STATUS;   /* clear status */
         if (mReq->req.zero == 0)
-                mEp->qh[mEp->dir].ptr->cap |=  QH_ZLT;
+                mEp->qh.ptr->cap |=  QH_ZLT;
         else
-                mEp->qh[mEp->dir].ptr->cap &= ~QH_ZLT;
+                mEp->qh.ptr->cap &= ~QH_ZLT;
 
         wmb();   /* synchronize before ep prime */
 
@@ -1542,11 +1552,11 @@ __acquires(mEp->lock)
 
         hw_ep_flush(mEp->num, mEp->dir);
 
-        while (!list_empty(&mEp->qh[mEp->dir].queue)) {
+        while (!list_empty(&mEp->qh.queue)) {
 
                 /* pop oldest request */
                 struct ci13xxx_req *mReq = \
-                        list_entry(mEp->qh[mEp->dir].queue.next,
+                        list_entry(mEp->qh.queue.next,
                                    struct ci13xxx_req, queue);
                 list_del_init(&mReq->queue);
                 mReq->req.status = -ESHUTDOWN;
@@ -1571,8 +1581,6 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
 {
         struct usb_ep *ep;
         struct ci13xxx    *udc = container_of(gadget, struct ci13xxx, gadget);
-        struct ci13xxx_ep *mEp = container_of(gadget->ep0,
-                                              struct ci13xxx_ep, ep);
 
         trace("%p", gadget);
 
@@ -1583,7 +1591,8 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
         gadget_for_each_ep(ep, gadget) {
                 usb_ep_fifo_flush(ep);
         }
-        usb_ep_fifo_flush(gadget->ep0);
+        usb_ep_fifo_flush(&udc->ep0out.ep);
+        usb_ep_fifo_flush(&udc->ep0in.ep);
 
         udc->driver->disconnect(gadget);
 
@@ -1591,11 +1600,12 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
         gadget_for_each_ep(ep, gadget) {
                 usb_ep_disable(ep);
         }
-        usb_ep_disable(gadget->ep0);
+        usb_ep_disable(&udc->ep0out.ep);
+        usb_ep_disable(&udc->ep0in.ep);
 
-        if (mEp->status != NULL) {
-                usb_ep_free_request(gadget->ep0, mEp->status);
-                mEp->status = NULL;
+        if (udc->status != NULL) {
+                usb_ep_free_request(&udc->ep0in.ep, udc->status);
+                udc->status = NULL;
         }
 
         return 0;
@@ -1614,7 +1624,6 @@ static void isr_reset_handler(struct ci13xxx *udc)
 __releases(udc->lock)
 __acquires(udc->lock)
 {
-        struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[0];
         int retval;
 
         trace("%p", udc);
@@ -1635,11 +1644,15 @@ __acquires(udc->lock)
         if (retval)
                 goto done;
 
-        retval = usb_ep_enable(&mEp->ep, &ctrl_endpt_desc);
+        retval = usb_ep_enable(&udc->ep0out.ep, &ctrl_endpt_out_desc);
+        if (retval)
+                goto done;
+
+        retval = usb_ep_enable(&udc->ep0in.ep, &ctrl_endpt_in_desc);
         if (!retval) {
-                mEp->status = usb_ep_alloc_request(&mEp->ep, GFP_ATOMIC);
-                if (mEp->status == NULL) {
-                        usb_ep_disable(&mEp->ep);
+                udc->status = usb_ep_alloc_request(&udc->ep0in.ep, GFP_ATOMIC);
+                if (udc->status == NULL) {
+                        usb_ep_disable(&udc->ep0out.ep);
                         retval = -ENOMEM;
                 }
         }
@@ -1672,16 +1685,17 @@ static void isr_get_status_complete(struct usb_ep *ep, struct usb_request *req)
 
 /**
  * isr_get_status_response: get_status request response
- * @ep:    endpoint
+ * @udc: udc struct
  * @setup: setup request packet
  *
  * This function returns an error code
  */
-static int isr_get_status_response(struct ci13xxx_ep *mEp,
+static int isr_get_status_response(struct ci13xxx *udc,
                                    struct usb_ctrlrequest *setup)
 __releases(mEp->lock)
 __acquires(mEp->lock)
 {
+        struct ci13xxx_ep *mEp = &udc->ep0in;
         struct usb_request *req = NULL;
         gfp_t gfp_flags = GFP_ATOMIC;
         int dir, num, retval;
@@ -1736,27 +1750,23 @@ __acquires(mEp->lock)
 
 /**
  * isr_setup_status_phase: queues the status phase of a setup transation
- * @mEp: endpoint
+ * @udc: udc struct
  *
  * This function returns an error code
  */
-static int isr_setup_status_phase(struct ci13xxx_ep *mEp)
+static int isr_setup_status_phase(struct ci13xxx *udc)
 __releases(mEp->lock)
 __acquires(mEp->lock)
 {
         int retval;
+        struct ci13xxx_ep *mEp;
 
-        trace("%p", mEp);
-
-        /* mEp is always valid & configured */
-
-        if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                mEp->dir = (mEp->dir == TX) ? RX : TX;
+        trace("%p", udc);
 
-        mEp->status->no_interrupt = 1;
+        mEp = (udc->ep0_dir == TX) ? &udc->ep0out : &udc->ep0in;
 
         spin_unlock(mEp->lock);
-        retval = usb_ep_queue(&mEp->ep, mEp->status, GFP_ATOMIC);
+        retval = usb_ep_queue(&mEp->ep, udc->status, GFP_ATOMIC);
         spin_lock(mEp->lock);
 
         return retval;
@@ -1778,11 +1788,11 @@ __acquires(mEp->lock)
 
         trace("%p", mEp);
 
-        if (list_empty(&mEp->qh[mEp->dir].queue))
+        if (list_empty(&mEp->qh.queue))
                 return -EINVAL;
 
         /* pop oldest request */
-        mReq = list_entry(mEp->qh[mEp->dir].queue.next,
+        mReq = list_entry(mEp->qh.queue.next,
                           struct ci13xxx_req, queue);
         list_del_init(&mReq->queue);
 
@@ -1794,10 +1804,10 @@ __acquires(mEp->lock)
 
         dbg_done(_usb_addr(mEp), mReq->ptr->token, retval);
 
-        if (!list_empty(&mEp->qh[mEp->dir].queue)) {
+        if (!list_empty(&mEp->qh.queue)) {
                 struct ci13xxx_req* mReqEnq;
 
-                mReqEnq = list_entry(mEp->qh[mEp->dir].queue.next,
+                mReqEnq = list_entry(mEp->qh.queue.next,
                                   struct ci13xxx_req, queue);
                 _hardware_enqueue(mEp, mReqEnq);
         }
@@ -1836,16 +1846,14 @@ __acquires(udc->lock)
                 int type, num, err = -EINVAL;
                 struct usb_ctrlrequest req;
 
-
                 if (mEp->desc == NULL)
                         continue;   /* not configured */
 
-                if ((mEp->dir == RX && hw_test_and_clear_complete(i)) ||
-                    (mEp->dir == TX && hw_test_and_clear_complete(i + 16))) {
+                if (hw_test_and_clear_complete(i)) {
                         err = isr_tr_complete_low(mEp);
                         if (mEp->type == USB_ENDPOINT_XFER_CONTROL) {
                                 if (err > 0)   /* needs status phase */
-                                        err = isr_setup_status_phase(mEp);
+                                        err = isr_setup_status_phase(udc);
                                 if (err < 0) {
                                         dbg_event(_usb_addr(mEp),
                                                   "ERROR", err);
@@ -1866,15 +1874,22 @@ __acquires(udc->lock)
                         continue;
                 }
 
+                /*
+                 * Flush data and handshake transactions of previous
+                 * setup packet.
+                 */
+                _ep_nuke(&udc->ep0out);
+                _ep_nuke(&udc->ep0in);
+
                 /* read_setup_packet */
                 do {
                         hw_test_and_set_setup_guard();
-                        memcpy(&req, &mEp->qh[RX].ptr->setup, sizeof(req));
+                        memcpy(&req, &mEp->qh.ptr->setup, sizeof(req));
                 } while (!hw_test_and_clear_setup_guard());
 
                 type = req.bRequestType;
 
-                mEp->dir = (type & USB_DIR_IN) ? TX : RX;
+                udc->ep0_dir = (type & USB_DIR_IN) ? TX : RX;
 
                 dbg_setup(_usb_addr(mEp), &req);
 
@@ -1895,7 +1910,7 @@ __acquires(udc->lock)
                                 if (err)
                                         break;
                         }
-                        err = isr_setup_status_phase(mEp);
+                        err = isr_setup_status_phase(udc);
                         break;
                 case USB_REQ_GET_STATUS:
                         if (type != (USB_DIR_IN|USB_RECIP_DEVICE)   &&
@@ -1905,7 +1920,7 @@ __acquires(udc->lock)
                         if (le16_to_cpu(req.wLength) != 2 ||
                             le16_to_cpu(req.wValue)  != 0)
                                 break;
-                        err = isr_get_status_response(mEp, &req);
+                        err = isr_get_status_response(udc, &req);
                         break;
                 case USB_REQ_SET_ADDRESS:
                         if (type != (USB_DIR_OUT|USB_RECIP_DEVICE))
@@ -1916,7 +1931,7 @@ __acquires(udc->lock)
                         err = hw_usb_set_address((u8)le16_to_cpu(req.wValue));
                         if (err)
                                 break;
-                        err = isr_setup_status_phase(mEp);
+                        err = isr_setup_status_phase(udc);
                         break;
                 case USB_REQ_SET_FEATURE:
                         if (type != (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
@@ -1932,12 +1947,12 @@ __acquires(udc->lock)
                         spin_lock(udc->lock);
                         if (err)
                                 break;
-                        err = isr_setup_status_phase(mEp);
+                        err = isr_setup_status_phase(udc);
                         break;
                 default:
 delegate:
                         if (req.wLength == 0)   /* no data phase */
-                                mEp->dir = TX;
+                                udc->ep0_dir = TX;
 
                         spin_unlock(udc->lock);
                         err = udc->driver->setup(&udc->gadget, &req);
@@ -1968,7 +1983,7 @@ static int ep_enable(struct usb_ep *ep,
                      const struct usb_endpoint_descriptor *desc)
 {
         struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
-        int direction, retval = 0;
+        int retval = 0;
         unsigned long flags;
 
         trace("%p, %p", ep, desc);
@@ -1982,7 +1997,7 @@ static int ep_enable(struct usb_ep *ep,
 
         mEp->desc = desc;
 
-        if (!list_empty(&mEp->qh[mEp->dir].queue))
+        if (!list_empty(&mEp->qh.queue))
                 warn("enabling a non-empty endpoint!");
 
         mEp->dir  = usb_endpoint_dir_in(desc) ? TX : RX;
@@ -1991,29 +2006,22 @@ static int ep_enable(struct usb_ep *ep,
 
         mEp->ep.maxpacket = __constant_le16_to_cpu(desc->wMaxPacketSize);
 
-        direction = mEp->dir;
-        do {
-                dbg_event(_usb_addr(mEp), "ENABLE", 0);
+        dbg_event(_usb_addr(mEp), "ENABLE", 0);
 
-                mEp->qh[mEp->dir].ptr->cap = 0;
+        mEp->qh.ptr->cap = 0;
 
-                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                        mEp->qh[mEp->dir].ptr->cap |=  QH_IOS;
-                else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
-                        mEp->qh[mEp->dir].ptr->cap &= ~QH_MULT;
-                else
-                        mEp->qh[mEp->dir].ptr->cap &= ~QH_ZLT;
-
-                mEp->qh[mEp->dir].ptr->cap |=
-                        (mEp->ep.maxpacket << ffs_nr(QH_MAX_PKT)) & QH_MAX_PKT;
-                mEp->qh[mEp->dir].ptr->td.next |= TD_TERMINATE;   /* needed? */
-
-                retval |= hw_ep_enable(mEp->num, mEp->dir, mEp->type);
+        if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                mEp->qh.ptr->cap |=  QH_IOS;
+        else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
+                mEp->qh.ptr->cap &= ~QH_MULT;
+        else
+                mEp->qh.ptr->cap &= ~QH_ZLT;
 
-                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                        mEp->dir = (mEp->dir == TX) ? RX : TX;
+        mEp->qh.ptr->cap |=
+                (mEp->ep.maxpacket << ffs_nr(QH_MAX_PKT)) & QH_MAX_PKT;
+        mEp->qh.ptr->td.next |= TD_TERMINATE;   /* needed? */
 
-        } while (mEp->dir != direction);
+        retval |= hw_ep_enable(mEp->num, mEp->dir, mEp->type);
 
         spin_unlock_irqrestore(mEp->lock, flags);
         return retval;
@@ -2146,7 +2154,7 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
         spin_lock_irqsave(mEp->lock, flags);
 
         if (mEp->type == USB_ENDPOINT_XFER_CONTROL &&
-            !list_empty(&mEp->qh[mEp->dir].queue)) {
+            !list_empty(&mEp->qh.queue)) {
                 _ep_nuke(mEp);
                 retval = -EOVERFLOW;
                 warn("endpoint ctrl %X nuked", _usb_addr(mEp));
@@ -2170,9 +2178,9 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
         /* push request */
         mReq->req.status = -EINPROGRESS;
         mReq->req.actual = 0;
-        list_add_tail(&mReq->queue, &mEp->qh[mEp->dir].queue);
+        list_add_tail(&mReq->queue, &mEp->qh.queue);
 
-        if (list_is_singular(&mEp->qh[mEp->dir].queue))
+        if (list_is_singular(&mEp->qh.queue))
                 retval = _hardware_enqueue(mEp, mReq);
 
         if (retval == -EALREADY) {
@@ -2199,7 +2207,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
         trace("%p, %p", ep, req);
 
         if (ep == NULL || req == NULL || mEp->desc == NULL ||
-            list_empty(&mReq->queue)  || list_empty(&mEp->qh[mEp->dir].queue))
+            list_empty(&mReq->queue)  || list_empty(&mEp->qh.queue))
                 return -EINVAL;
 
         spin_lock_irqsave(mEp->lock, flags);
@@ -2244,7 +2252,7 @@ static int ep_set_halt(struct usb_ep *ep, int value)
 #ifndef STALL_IN
         /* g_file_storage MS compliant but g_zero fails chapter 9 compliance */
         if (value && mEp->type == USB_ENDPOINT_XFER_BULK && mEp->dir == TX &&
-            !list_empty(&mEp->qh[mEp->dir].queue)) {
+            !list_empty(&mEp->qh.queue)) {
                 spin_unlock_irqrestore(mEp->lock, flags);
                 return -EAGAIN;
         }
@@ -2355,7 +2363,7 @@ static int ci13xxx_vbus_session(struct usb_gadget *_gadget, int is_active)
                 if (is_active) {
                         pm_runtime_get_sync(&_gadget->dev);
                         hw_device_reset(udc);
-                        hw_device_state(udc->ci13xxx_ep[0].qh[RX].dma);
+                        hw_device_state(udc->ep0out.qh.dma);
                 } else {
                         hw_device_state(0);
                         if (udc->udc_driver->notify_event)
@@ -2390,7 +2398,8 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                 int (*bind)(struct usb_gadget *))
 {
         struct ci13xxx *udc = _udc;
-        unsigned long i, k, flags;
+        unsigned long flags;
+        int i, j;
         int retval = -ENOMEM;
 
         trace("%p", driver);
@@ -2427,45 +2436,46 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
 
         info("hw_ep_max = %d", hw_ep_max);
 
-        udc->driver = driver;
         udc->gadget.dev.driver = NULL;
 
         retval = 0;
-        for (i = 0; i < hw_ep_max; i++) {
-                struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
+        for (i = 0; i < hw_ep_max/2; i++) {
+                for (j = RX; j <= TX; j++) {
+                        int k = i + j * hw_ep_max/2;
+                        struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[k];
 
-                scnprintf(mEp->name, sizeof(mEp->name), "ep%i", (int)i);
+                        scnprintf(mEp->name, sizeof(mEp->name), "ep%i%s", i,
+                                        (j == TX)  ? "in" : "out");
 
-                mEp->lock         = udc->lock;
-                mEp->device       = &udc->gadget.dev;
-                mEp->td_pool      = udc->td_pool;
+                        mEp->lock         = udc->lock;
+                        mEp->device       = &udc->gadget.dev;
+                        mEp->td_pool      = udc->td_pool;
 
-                mEp->ep.name      = mEp->name;
-                mEp->ep.ops       = &usb_ep_ops;
-                mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+                        mEp->ep.name      = mEp->name;
+                        mEp->ep.ops       = &usb_ep_ops;
+                        mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
 
-                /* this allocation cannot be random */
-                for (k = RX; k <= TX; k++) {
-                        INIT_LIST_HEAD(&mEp->qh[k].queue);
+                        INIT_LIST_HEAD(&mEp->qh.queue);
                         spin_unlock_irqrestore(udc->lock, flags);
-                        mEp->qh[k].ptr = dma_pool_alloc(udc->qh_pool,
-                                                        GFP_KERNEL,
-                                                        &mEp->qh[k].dma);
+                        mEp->qh.ptr = dma_pool_alloc(udc->qh_pool, GFP_KERNEL,
+                                        &mEp->qh.dma);
                         spin_lock_irqsave(udc->lock, flags);
-                        if (mEp->qh[k].ptr == NULL)
+                        if (mEp->qh.ptr == NULL)
                                 retval = -ENOMEM;
                         else
-                                memset(mEp->qh[k].ptr, 0,
-                                       sizeof(*mEp->qh[k].ptr));
-                }
-                if (i == 0)
-                        udc->gadget.ep0 = &mEp->ep;
-                else
+                                memset(mEp->qh.ptr, 0, sizeof(*mEp->qh.ptr));
+
+                        /* skip ep0 out and in endpoints */
+                        if (i == 0)
+                                continue;
+
                         list_add_tail(&mEp->ep.ep_list, &udc->gadget.ep_list);
+                }
         }
         if (retval)
                 goto done;
 
+        udc->gadget.ep0 = &udc->ep0in.ep;
         /* bind gadget */
         driver->driver.bus     = NULL;
         udc->gadget.dev.driver = &driver->driver;
@@ -2479,6 +2489,7 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                 goto done;
         }
 
+        udc->driver = driver;
         pm_runtime_get_sync(&udc->gadget.dev);
         if (udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS) {
                 if (udc->vbus_active) {
@@ -2490,14 +2501,12 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                 }
         }
 
-        retval = hw_device_state(udc->ci13xxx_ep[0].qh[RX].dma);
+        retval = hw_device_state(udc->ep0out.qh.dma);
         if (retval)
                 pm_runtime_put_sync(&udc->gadget.dev);
 
  done:
         spin_unlock_irqrestore(udc->lock, flags);
-        if (retval)
-                usb_gadget_unregister_driver(driver);
         return retval;
 }
 EXPORT_SYMBOL(usb_gadget_probe_driver);
@@ -2510,7 +2519,7 @@ EXPORT_SYMBOL(usb_gadget_probe_driver);
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
         struct ci13xxx *udc = _udc;
-        unsigned long i, k, flags;
+        unsigned long i, flags;
 
         trace("%p", driver);
 
@@ -2546,17 +2555,14 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
         for (i = 0; i < hw_ep_max; i++) {
                 struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
 
-                if (i == 0)
-                        udc->gadget.ep0 = NULL;
-                else if (!list_empty(&mEp->ep.ep_list))
+                if (!list_empty(&mEp->ep.ep_list))
                         list_del_init(&mEp->ep.ep_list);
 
-                for (k = RX; k <= TX; k++)
-                        if (mEp->qh[k].ptr != NULL)
-                                dma_pool_free(udc->qh_pool,
-                                              mEp->qh[k].ptr, mEp->qh[k].dma);
+                if (mEp->qh.ptr != NULL)
+                        dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
         }
 
+        udc->gadget.ep0 = NULL;
         udc->driver = NULL;
 
         spin_unlock_irqrestore(udc->lock, flags);
diff --git a/drivers/usb/gadget/ci13xxx_udc.h b/drivers/usb/gadget/ci13xxx_udc.h
index f61fed07f76..a2492b65f98 100644
--- a/drivers/usb/gadget/ci13xxx_udc.h
+++ b/drivers/usb/gadget/ci13xxx_udc.h
@@ -20,7 +20,7 @@
  * DEFINE
  *****************************************************************************/
 #define CI13XXX_PAGE_SIZE  4096ul /* page size for TD's */
-#define ENDPT_MAX          (16)
+#define ENDPT_MAX          (32)
 #define CTRL_PAYLOAD_MAX   (64)
 #define RX        (0)  /* similar to USB_DIR_OUT but can be used as an index */
 #define TX        (1)  /* similar to USB_DIR_IN  but can be used as an index */
@@ -88,8 +88,7 @@ struct ci13xxx_ep {
                 struct list_head   queue;
                 struct ci13xxx_qh *ptr;
                 dma_addr_t         dma;
-        }                                      qh[2];
-        struct usb_request                    *status;
+        }                                      qh;
         int                                    wedge;
 
         /* global resources */
@@ -119,9 +118,13 @@ struct ci13xxx {
 
         struct dma_pool           *qh_pool;   /* DMA pool for queue heads */
         struct dma_pool           *td_pool;   /* DMA pool for transfer descs */
+        struct usb_request        *status;    /* ep0 status request */
 
         struct usb_gadget          gadget;     /* USB slave device */
         struct ci13xxx_ep          ci13xxx_ep[ENDPT_MAX]; /* extended endpts */
+        u32                        ep0_dir;    /* ep0 direction */
+#define ep0out ci13xxx_ep[0]
+#define ep0in  ci13xxx_ep[16]
 
         struct usb_gadget_driver  *driver;     /* 3rd party gadget driver */
         struct ci13xxx_udc_driver *udc_driver; /* device controller driver */
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index f6ff8456d52..1ba4befe336 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -928,8 +928,9 @@ unknown:
                  */
                 switch (ctrl->bRequestType & USB_RECIP_MASK) {
                 case USB_RECIP_INTERFACE:
-                        if (cdev->config)
-                                f = cdev->config->interface[intf];
+                        if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
+                                break;
+                        f = cdev->config->interface[intf];
                         break;
 
                 case USB_RECIP_ENDPOINT:
diff --git a/drivers/usb/gadget/pch_udc.c b/drivers/usb/gadget/pch_udc.c
index 0c8dd81dddc..b120dbb64d0 100644
--- a/drivers/usb/gadget/pch_udc.c
+++ b/drivers/usb/gadget/pch_udc.c
@@ -198,10 +198,10 @@
 #define PCH_UDC_BRLEN           0x0F    /* Burst length */
 #define PCH_UDC_THLEN           0x1F    /* Threshold length */
 /* Value of EP Buffer Size */
-#define UDC_EP0IN_BUFF_SIZE     64
-#define UDC_EPIN_BUFF_SIZE      512
-#define UDC_EP0OUT_BUFF_SIZE    64
-#define UDC_EPOUT_BUFF_SIZE     512
+#define UDC_EP0IN_BUFF_SIZE     16
+#define UDC_EPIN_BUFF_SIZE      256
+#define UDC_EP0OUT_BUFF_SIZE    16
+#define UDC_EPOUT_BUFF_SIZE     256
 /* Value of EP maximum packet size */
 #define UDC_EP0IN_MAX_PKT_SIZE  64
 #define UDC_EP0OUT_MAX_PKT_SIZE 64
@@ -351,7 +351,7 @@ struct pch_udc_dev {
         struct pci_pool         *data_requests;
         struct pci_pool         *stp_requests;
         dma_addr_t                      dma_addr;
-        unsigned long                   ep0out_buf[64];
+        void                            *ep0out_buf;
         struct usb_ctrlrequest          setup_data;
         unsigned long                   phys_addr;
         void __iomem                    *base_addr;
@@ -361,6 +361,8 @@ struct pch_udc_dev {
 
 #define PCH_UDC_PCI_BAR                 1
 #define PCI_DEVICE_ID_INTEL_EG20T_UDC   0x8808
+#define PCI_VENDOR_ID_ROHM              0x10DB
+#define PCI_DEVICE_ID_ML7213_IOH_UDC    0x801D
 
 static const char       ep0_string[] = "ep0in";
 static DEFINE_SPINLOCK(udc_stall_spinlock);     /* stall spin lock */
@@ -1219,11 +1221,11 @@ static void complete_req(struct pch_udc_ep *ep, struct pch_udc_request *req,
         dev = ep->dev;
         if (req->dma_mapped) {
                 if (ep->in)
-                        pci_unmap_single(dev->pdev, req->req.dma,
-                                         req->req.length, PCI_DMA_TODEVICE);
+                        dma_unmap_single(&dev->pdev->dev, req->req.dma,
+                                         req->req.length, DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(dev->pdev, req->req.dma,
-                                         req->req.length, PCI_DMA_FROMDEVICE);
+                        dma_unmap_single(&dev->pdev->dev, req->req.dma,
+                                         req->req.length, DMA_FROM_DEVICE);
                 req->dma_mapped = 0;
                 req->req.dma = DMA_ADDR_INVALID;
         }
@@ -1414,7 +1416,6 @@ static void pch_udc_start_rxrequest(struct pch_udc_ep *ep,
 
         pch_udc_clear_dma(ep->dev, DMA_DIR_RX);
         td_data = req->td_data;
-        ep->td_data = req->td_data;
         /* Set the status bits for all descriptors */
         while (1) {
                 td_data->status = (td_data->status & ~PCH_UDC_BUFF_STS) |
@@ -1613,15 +1614,19 @@ static int pch_udc_pcd_queue(struct usb_ep *usbep, struct usb_request *usbreq,
         if (usbreq->length &&
             ((usbreq->dma == DMA_ADDR_INVALID) || !usbreq->dma)) {
                 if (ep->in)
-                        usbreq->dma = pci_map_single(dev->pdev, usbreq->buf,
-                                        usbreq->length, PCI_DMA_TODEVICE);
+                        usbreq->dma = dma_map_single(&dev->pdev->dev,
+                                                     usbreq->buf,
+                                                     usbreq->length,
+                                                     DMA_TO_DEVICE);
                 else
-                        usbreq->dma = pci_map_single(dev->pdev, usbreq->buf,
-                                        usbreq->length, PCI_DMA_FROMDEVICE);
+                        usbreq->dma = dma_map_single(&dev->pdev->dev,
+                                                     usbreq->buf,
+                                                     usbreq->length,
+                                                     DMA_FROM_DEVICE);
                 req->dma_mapped = 1;
         }
         if (usbreq->length > 0) {
-                retval = prepare_dma(ep, req, gfp);
+                retval = prepare_dma(ep, req, GFP_ATOMIC);
                 if (retval)
                         goto probe_end;
         }
@@ -1646,7 +1651,6 @@ static int pch_udc_pcd_queue(struct usb_ep *usbep, struct usb_request *usbreq,
                         pch_udc_wait_ep_stall(ep);
                         pch_udc_ep_clear_nak(ep);
                         pch_udc_enable_ep_interrupts(ep->dev, (1 << ep->num));
-                        pch_udc_set_dma(dev, DMA_DIR_TX);
                 }
         }
         /* Now add this request to the ep's pending requests */
@@ -1926,6 +1930,7 @@ static void pch_udc_complete_receiver(struct pch_udc_ep *ep)
             PCH_UDC_BS_DMA_DONE)
                 return;
         pch_udc_clear_dma(ep->dev, DMA_DIR_RX);
+        pch_udc_ep_set_ddptr(ep, 0);
         if ((req->td_data_last->status & PCH_UDC_RXTX_STS) !=
             PCH_UDC_RTS_SUCC) {
                 dev_err(&dev->pdev->dev, "Invalid RXTX status (0x%08x) "
@@ -1963,7 +1968,7 @@ static void pch_udc_svc_data_in(struct pch_udc_dev *dev, int ep_num)
         u32     epsts;
         struct pch_udc_ep       *ep;
 
-        ep = &dev->ep[2*ep_num];
+        ep = &dev->ep[UDC_EPIN_IDX(ep_num)];
         epsts = ep->epsts;
         ep->epsts = 0;
 
@@ -2008,7 +2013,7 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
         struct pch_udc_ep               *ep;
         struct pch_udc_request          *req = NULL;
 
-        ep = &dev->ep[2*ep_num + 1];
+        ep = &dev->ep[UDC_EPOUT_IDX(ep_num)];
         epsts = ep->epsts;
         ep->epsts = 0;
 
@@ -2025,10 +2030,11 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
         }
         if (epsts & UDC_EPSTS_HE)
                 return;
-        if (epsts & UDC_EPSTS_RSS)
+        if (epsts & UDC_EPSTS_RSS) {
                 pch_udc_ep_set_stall(ep);
                 pch_udc_enable_ep_interrupts(ep->dev,
                                              PCH_UDC_EPINT(ep->in, ep->num));
+        }
         if (epsts & UDC_EPSTS_RCS) {
                 if (!dev->prot_stall) {
                         pch_udc_ep_clear_stall(ep);
@@ -2060,8 +2066,10 @@ static void pch_udc_svc_control_in(struct pch_udc_dev *dev)
 {
         u32     epsts;
         struct pch_udc_ep       *ep;
+        struct pch_udc_ep       *ep_out;
 
         ep = &dev->ep[UDC_EP0IN_IDX];
+        ep_out = &dev->ep[UDC_EP0OUT_IDX];
         epsts = ep->epsts;
         ep->epsts = 0;
 
@@ -2073,8 +2081,16 @@ static void pch_udc_svc_control_in(struct pch_udc_dev *dev)
                 return;
         if (epsts & UDC_EPSTS_HE)
                 return;
-        if ((epsts & UDC_EPSTS_TDC) && (!dev->stall))
+        if ((epsts & UDC_EPSTS_TDC) && (!dev->stall)) {
                 pch_udc_complete_transfer(ep);
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
+                ep_out->td_data->status = (ep_out->td_data->status &
+                                        ~PCH_UDC_BUFF_STS) |
+                                        PCH_UDC_BS_HST_RDY;
+                pch_udc_ep_clear_nak(ep_out);
+                pch_udc_set_dma(dev, DMA_DIR_RX);
+                pch_udc_ep_set_rrdy(ep_out);
+        }
         /* On IN interrupt, provide data if we have any */
         if ((epsts & UDC_EPSTS_IN) && !(epsts & UDC_EPSTS_TDC) &&
              !(epsts & UDC_EPSTS_TXEMPTY))
@@ -2102,11 +2118,9 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
                 dev->stall = 0;
                 dev->ep[UDC_EP0IN_IDX].halted = 0;
                 dev->ep[UDC_EP0OUT_IDX].halted = 0;
-                /* In data not ready */
-                pch_udc_ep_set_nak(&(dev->ep[UDC_EP0IN_IDX]));
                 dev->setup_data = ep->td_stp->request;
                 pch_udc_init_setup_buff(ep->td_stp);
-                pch_udc_clear_dma(dev, DMA_DIR_TX);
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
                 pch_udc_ep_fifo_flush(&(dev->ep[UDC_EP0IN_IDX]),
                                       dev->ep[UDC_EP0IN_IDX].in);
                 if ((dev->setup_data.bRequestType & USB_DIR_IN))
@@ -2122,14 +2136,23 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
                 setup_supported = dev->driver->setup(&dev->gadget,
                                                      &dev->setup_data);
                 spin_lock(&dev->lock);
+
+                if (dev->setup_data.bRequestType & USB_DIR_IN) {
+                        ep->td_data->status = (ep->td_data->status &
+                                                ~PCH_UDC_BUFF_STS) |
+                                                PCH_UDC_BS_HST_RDY;
+                        pch_udc_ep_set_ddptr(ep, ep->td_data_phys);
+                }
                 /* ep0 in returns data on IN phase */
                 if (setup_supported >= 0 && setup_supported <
                                             UDC_EP0IN_MAX_PKT_SIZE) {
                         pch_udc_ep_clear_nak(&(dev->ep[UDC_EP0IN_IDX]));
                         /* Gadget would have queued a request when
                          * we called the setup */
-                        pch_udc_set_dma(dev, DMA_DIR_RX);
-                        pch_udc_ep_clear_nak(ep);
+                        if (!(dev->setup_data.bRequestType & USB_DIR_IN)) {
+                                pch_udc_set_dma(dev, DMA_DIR_RX);
+                                pch_udc_ep_clear_nak(ep);
+                        }
                 } else if (setup_supported < 0) {
                         /* if unsupported request, then stall */
                         pch_udc_ep_set_stall(&(dev->ep[UDC_EP0IN_IDX]));
@@ -2142,22 +2165,13 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
                 }
         } else if ((((stat & UDC_EPSTS_OUT_MASK) >> UDC_EPSTS_OUT_SHIFT) ==
                      UDC_EPSTS_OUT_DATA) && !dev->stall) {
-                if (list_empty(&ep->queue)) {
-                        dev_err(&dev->pdev->dev, "%s: No request\n", __func__);
-                        ep->td_data->status = (ep->td_data->status &
-                                               ~PCH_UDC_BUFF_STS) |
-                                               PCH_UDC_BS_HST_RDY;
-                        pch_udc_set_dma(dev, DMA_DIR_RX);
-                } else {
-                        /* control write */
-                        /* next function will pickuo an clear the status */
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
+                pch_udc_ep_set_ddptr(ep, 0);
+                if (!list_empty(&ep->queue)) {
                         ep->epsts = stat;
-
-                        pch_udc_svc_data_out(dev, 0);
-                        /* re-program desc. pointer for possible ZLPs */
-                        pch_udc_ep_set_ddptr(ep, ep->td_data_phys);
-                        pch_udc_set_dma(dev, DMA_DIR_RX);
+                        pch_udc_svc_data_out(dev, PCH_UDC_EP0);
                 }
+                pch_udc_set_dma(dev, DMA_DIR_RX);
         }
         pch_udc_ep_set_rrdy(ep);
 }
@@ -2174,7 +2188,7 @@ static void pch_udc_postsvc_epinters(struct pch_udc_dev *dev, int ep_num)
         struct pch_udc_ep       *ep;
         struct pch_udc_request *req;
 
-        ep = &dev->ep[2*ep_num];
+        ep = &dev->ep[UDC_EPIN_IDX(ep_num)];
         if (!list_empty(&ep->queue)) {
                 req = list_entry(ep->queue.next, struct pch_udc_request, queue);
                 pch_udc_enable_ep_interrupts(ep->dev,
@@ -2196,13 +2210,13 @@ static void pch_udc_read_all_epstatus(struct pch_udc_dev *dev, u32 ep_intr)
         for (i = 0; i < PCH_UDC_USED_EP_NUM; i++) {
                 /* IN */
                 if (ep_intr & (0x1 << i)) {
-                        ep = &dev->ep[2*i];
+                        ep = &dev->ep[UDC_EPIN_IDX(i)];
                         ep->epsts = pch_udc_read_ep_status(ep);
                         pch_udc_clear_ep_status(ep, ep->epsts);
                 }
                 /* OUT */
                 if (ep_intr & (0x10000 << i)) {
-                        ep = &dev->ep[2*i+1];
+                        ep = &dev->ep[UDC_EPOUT_IDX(i)];
                         ep->epsts = pch_udc_read_ep_status(ep);
                         pch_udc_clear_ep_status(ep, ep->epsts);
                 }
@@ -2563,9 +2577,6 @@ static void pch_udc_pcd_reinit(struct pch_udc_dev *dev)
         dev->ep[UDC_EP0IN_IDX].ep.maxpacket = UDC_EP0IN_MAX_PKT_SIZE;
         dev->ep[UDC_EP0OUT_IDX].ep.maxpacket = UDC_EP0OUT_MAX_PKT_SIZE;
 
-        dev->dma_addr = pci_map_single(dev->pdev, dev->ep0out_buf, 256,
-                                  PCI_DMA_FROMDEVICE);
-
         /* remove ep0 in and out from the list.  They have own pointer */
         list_del_init(&dev->ep[UDC_EP0IN_IDX].ep.ep_list);
         list_del_init(&dev->ep[UDC_EP0OUT_IDX].ep.ep_list);
@@ -2637,6 +2648,13 @@ static int init_dma_pools(struct pch_udc_dev *dev)
         dev->ep[UDC_EP0IN_IDX].td_stp_phys = 0;
         dev->ep[UDC_EP0IN_IDX].td_data = NULL;
         dev->ep[UDC_EP0IN_IDX].td_data_phys = 0;
+
+        dev->ep0out_buf = kzalloc(UDC_EP0OUT_BUFF_SIZE * 4, GFP_KERNEL);
+        if (!dev->ep0out_buf)
+                return -ENOMEM;
+        dev->dma_addr = dma_map_single(&dev->pdev->dev, dev->ep0out_buf,
+                                       UDC_EP0OUT_BUFF_SIZE * 4,
+                                       DMA_FROM_DEVICE);
         return 0;
 }
 
@@ -2700,7 +2718,8 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 
         pch_udc_disable_interrupts(dev, UDC_DEVINT_MSK);
 
-        /* Assues that there are no pending requets with this driver */
+        /* Assures that there are no pending requests with this driver */
+        driver->disconnect(&dev->gadget);
         driver->unbind(&dev->gadget);
         dev->gadget.dev.driver = NULL;
         dev->driver = NULL;
@@ -2750,6 +2769,11 @@ static void pch_udc_remove(struct pci_dev *pdev)
                 pci_pool_destroy(dev->stp_requests);
         }
 
+        if (dev->dma_addr)
+                dma_unmap_single(&dev->pdev->dev, dev->dma_addr,
+                                 UDC_EP0OUT_BUFF_SIZE * 4, DMA_FROM_DEVICE);
+        kfree(dev->ep0out_buf);
+
         pch_udc_exit(dev);
 
         if (dev->irq_registered)
@@ -2792,11 +2816,7 @@ static int pch_udc_resume(struct pci_dev *pdev)
         int ret;
 
         pci_set_power_state(pdev, PCI_D0);
-        ret = pci_restore_state(pdev);
-        if (ret) {
-                dev_err(&pdev->dev, "%s: pci_restore_state failed\n", __func__);
-                return ret;
-        }
+        pci_restore_state(pdev);
         ret = pci_enable_device(pdev);
         if (ret) {
                 dev_err(&pdev->dev, "%s: pci_enable_device failed\n", __func__);
@@ -2914,6 +2934,11 @@ static DEFINE_PCI_DEVICE_TABLE(pch_udc_pcidev_id) = {
                 .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
                 .class_mask = 0xffffffff,
         },
+        {
+                PCI_DEVICE(PCI_VENDOR_ID_ROHM, PCI_DEVICE_ID_ML7213_IOH_UDC),
+                .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
+                .class_mask = 0xffffffff,
+        },
         { 0 },
 };
 
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index 2fc8636316c..12ff6cffedc 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -131,31 +131,31 @@ static struct printer_dev usb_printer_gadget;
  * parameters are in UTF-8 (superset of ASCII's 7 bit characters).
  */
 
-static ushort __initdata idVendor;
+static ushort idVendor;
 module_param(idVendor, ushort, S_IRUGO);
 MODULE_PARM_DESC(idVendor, "USB Vendor ID");
 
-static ushort __initdata idProduct;
+static ushort idProduct;
 module_param(idProduct, ushort, S_IRUGO);
 MODULE_PARM_DESC(idProduct, "USB Product ID");
 
-static ushort __initdata bcdDevice;
+static ushort bcdDevice;
 module_param(bcdDevice, ushort, S_IRUGO);
 MODULE_PARM_DESC(bcdDevice, "USB Device version (BCD)");
 
-static char *__initdata iManufacturer;
+static char *iManufacturer;
 module_param(iManufacturer, charp, S_IRUGO);
 MODULE_PARM_DESC(iManufacturer, "USB Manufacturer string");
 
-static char *__initdata iProduct;
+static char *iProduct;
 module_param(iProduct, charp, S_IRUGO);
 MODULE_PARM_DESC(iProduct, "USB Product string");
 
-static char *__initdata iSerialNum;
+static char *iSerialNum;
 module_param(iSerialNum, charp, S_IRUGO);
 MODULE_PARM_DESC(iSerialNum, "1");
 
-static char *__initdata iPNPstring;
+static char *iPNPstring;
 module_param(iPNPstring, charp, S_IRUGO);
 MODULE_PARM_DESC(iPNPstring, "MFG:linux;MDL:g_printer;CLS:PRINTER;SN:1;");
 
@@ -1596,13 +1596,12 @@ cleanup(void)
         int status;
 
         mutex_lock(&usb_printer_gadget.lock_printer_io);
-        class_destroy(usb_gadget_class);
-        unregister_chrdev_region(g_printer_devno, 2);
-
         status = usb_gadget_unregister_driver(&printer_driver);
         if (status)
                 ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
 
+        unregister_chrdev_region(g_printer_devno, 2);
+        class_destroy(usb_gadget_class);
         mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 86e42892016..5c761df7fa8 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -52,7 +52,6 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
         struct resource *res;
         int irq;
         int retval;
-        unsigned int temp;
 
         pr_debug("initializing FSL-SOC USB Controller\n");
 
@@ -126,18 +125,6 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
                 goto err3;
         }
 
-        /*
-         * Check if it is MPC5121 SoC, otherwise set pdata->have_sysif_regs
-         * flag for 83xx or 8536 system interface registers.
-         */
-        if (pdata->big_endian_mmio)
-                temp = in_be32(hcd->regs + FSL_SOC_USB_ID);
-        else
-                temp = in_le32(hcd->regs + FSL_SOC_USB_ID);
-
-        if ((temp & ID_MSK) != (~((temp & NID_MSK) >> 8) & ID_MSK))
-                pdata->have_sysif_regs = 1;
-
         /* Enable USB controller, 83xx or 8536 */
         if (pdata->have_sysif_regs)
                 setbits32(hcd->regs + FSL_SOC_USB_CTRL, 0x4);
diff --git a/drivers/usb/host/ehci-fsl.h b/drivers/usb/host/ehci-fsl.h
index 2c835379522..3fabed33d94 100644
--- a/drivers/usb/host/ehci-fsl.h
+++ b/drivers/usb/host/ehci-fsl.h
@@ -19,9 +19,6 @@
 #define _EHCI_FSL_H
 
 /* offsets for the non-ehci registers in the FSL SOC USB controller */
-#define FSL_SOC_USB_ID          0x0
-#define ID_MSK                  0x3f
-#define NID_MSK                 0x3f00
 #define FSL_SOC_USB_ULPIVP      0x170
 #define FSL_SOC_USB_PORTSC1     0x184
 #define PORT_PTS_MSK            (3<<30)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 6fee3cd58ef..74dcf49bd01 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -572,6 +572,8 @@ static int ehci_init(struct usb_hcd *hcd)
         ehci->iaa_watchdog.function = ehci_iaa_watchdog;
         ehci->iaa_watchdog.data = (unsigned long) ehci;
 
+        hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
+
         /*
          * hw default: 1K periodic list heads, one per frame.
          * periodic_size can shrink by USBCMD update if hcc_params allows.
@@ -579,11 +581,20 @@ static int ehci_init(struct usb_hcd *hcd)
         ehci->periodic_size = DEFAULT_I_TDPS;
         INIT_LIST_HEAD(&ehci->cached_itd_list);
         INIT_LIST_HEAD(&ehci->cached_sitd_list);
+
+        if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
+                /* periodic schedule size can be smaller than default */
+                switch (EHCI_TUNE_FLS) {
+                case 0: ehci->periodic_size = 1024; break;
+                case 1: ehci->periodic_size = 512; break;
+                case 2: ehci->periodic_size = 256; break;
+                default:        BUG();
+                }
+        }
         if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
                 return retval;
 
         /* controllers may cache some of the periodic schedule ... */
-        hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
         if (HCC_ISOC_CACHE(hcc_params))         // full frame cache
                 ehci->i_thresh = 2 + 8;
         else                                    // N microframes cached
@@ -637,12 +648,6 @@ static int ehci_init(struct usb_hcd *hcd)
                 /* periodic schedule size can be smaller than default */
                 temp &= ~(3 << 2);
                 temp |= (EHCI_TUNE_FLS << 2);
-                switch (EHCI_TUNE_FLS) {
-                case 0: ehci->periodic_size = 1024; break;
-                case 1: ehci->periodic_size = 512; break;
-                case 2: ehci->periodic_size = 256; break;
-                default:        BUG();
-                }
         }
         if (HCC_LPM(hcc_params)) {
                 /* support link power management EHCI 1.1 addendum */
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index fa59b26fc5b..c8e360d7d97 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -21,10 +21,13 @@
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/usb/otg.h>
+#include <linux/usb/ulpi.h>
 #include <linux/slab.h>
 
 #include <mach/mxc_ehci.h>
 
+#include <asm/mach-types.h>
+
 #define ULPI_VIEWPORT_OFFSET    0x170
 
 struct ehci_mxc_priv {
@@ -114,6 +117,7 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
         struct usb_hcd *hcd;
         struct resource *res;
         int irq, ret;
+        unsigned int flags;
         struct ehci_mxc_priv *priv;
         struct device *dev = &pdev->dev;
         struct ehci_hcd *ehci;
@@ -177,8 +181,8 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
                 clk_enable(priv->ahbclk);
         }
 
-        /* "dr" device has its own clock */
-        if (pdev->id == 0) {
+        /* "dr" device has its own clock on i.MX51 */
+        if (cpu_is_mx51() && (pdev->id == 0)) {
                 priv->phy1clk = clk_get(dev, "usb_phy1");
                 if (IS_ERR(priv->phy1clk)) {
                         ret = PTR_ERR(priv->phy1clk);
@@ -240,6 +244,23 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
         if (ret)
                 goto err_add;
 
+        if (pdata->otg) {
+                /*
+                 * efikamx and efikasb have some hardware bug which is
+                 * preventing usb to work unless CHRGVBUS is set.
+                 * It's in violation of USB specs
+                 */
+                if (machine_is_mx51_efikamx() || machine_is_mx51_efikasb()) {
+                        flags = otg_io_read(pdata->otg, ULPI_OTG_CTRL);
+                        flags |= ULPI_OTG_CTRL_CHRGVBUS;
+                        ret = otg_io_write(pdata->otg, flags, ULPI_OTG_CTRL);
+                        if (ret) {
+                                dev_err(dev, "unable to set CHRVBUS\n");
+                                goto err_add;
+                        }
+                }
+        }
+
         return 0;
 
 err_add:
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 76179c39c0e..bed07d4aab0 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -44,28 +44,35 @@ static int ehci_pci_reinit(struct ehci_hcd *ehci, struct pci_dev *pdev)
         return 0;
 }
 
-static int ehci_quirk_amd_SB800(struct ehci_hcd *ehci)
+static int ehci_quirk_amd_hudson(struct ehci_hcd *ehci)
 {
         struct pci_dev *amd_smbus_dev;
         u8 rev = 0;
 
         amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
-        if (!amd_smbus_dev)
-                return 0;
-
-        pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
-        if (rev < 0x40) {
-                pci_dev_put(amd_smbus_dev);
-                amd_smbus_dev = NULL;
-                return 0;
+        if (amd_smbus_dev) {
+                pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+                if (rev < 0x40) {
+                        pci_dev_put(amd_smbus_dev);
+                        amd_smbus_dev = NULL;
+                        return 0;
+                }
+        } else {
+                amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x780b, NULL);
+                if (!amd_smbus_dev)
+                        return 0;
+                pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+                if (rev < 0x11 || rev > 0x18) {
+                        pci_dev_put(amd_smbus_dev);
+                        amd_smbus_dev = NULL;
+                        return 0;
+                }
         }
 
         if (!amd_nb_dev)
                 amd_nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x1510, NULL);
-        if (!amd_nb_dev)
-                ehci_err(ehci, "QUIRK: unable to get AMD NB device\n");
 
-        ehci_info(ehci, "QUIRK: Enable AMD SB800 L1 fix\n");
+        ehci_info(ehci, "QUIRK: Enable exception for AMD Hudson ASPM\n");
 
         pci_dev_put(amd_smbus_dev);
         amd_smbus_dev = NULL;
@@ -131,7 +138,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
         /* cache this readonly data; minimize chip reads */
         ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
 
-        if (ehci_quirk_amd_SB800(ehci))
+        if (ehci_quirk_amd_hudson(ehci))
                 ehci->amd_l1_fix = 1;
 
         retval = ehci_halt(ehci);
diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
index 574b99ea070..79a66d622f9 100644
--- a/drivers/usb/host/fsl-mph-dr-of.c
+++ b/drivers/usb/host/fsl-mph-dr-of.c
@@ -262,19 +262,24 @@ static void fsl_usb2_mpc5121_exit(struct platform_device *pdev)
         }
 }
 
-struct fsl_usb2_platform_data fsl_usb2_mpc5121_pd = {
+static struct fsl_usb2_platform_data fsl_usb2_mpc5121_pd = {
         .big_endian_desc = 1,
         .big_endian_mmio = 1,
         .es = 1,
+        .have_sysif_regs = 0,
         .le_setup_buf = 1,
         .init = fsl_usb2_mpc5121_init,
         .exit = fsl_usb2_mpc5121_exit,
 };
 #endif /* CONFIG_PPC_MPC512x */
 
+static struct fsl_usb2_platform_data fsl_usb2_mpc8xxx_pd = {
+        .have_sysif_regs = 1,
+};
+
 static const struct of_device_id fsl_usb2_mph_dr_of_match[] = {
-        { .compatible = "fsl-usb2-mph", },
-        { .compatible = "fsl-usb2-dr", },
+        { .compatible = "fsl-usb2-mph", .data = &fsl_usb2_mpc8xxx_pd, },
+        { .compatible = "fsl-usb2-dr", .data = &fsl_usb2_mpc8xxx_pd, },
 #ifdef CONFIG_PPC_MPC512x
         { .compatible = "fsl,mpc5121-usb2-dr", .data = &fsl_usb2_mpc5121_pd, },
 #endif
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index df558f6f84e..3e8211c1ce5 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -308,11 +308,8 @@ static int room_on_ring(struct xhci_hcd *xhci, struct xhci_ring *ring,
 /* Ring the host controller doorbell after placing a command on the ring */
 void xhci_ring_cmd_db(struct xhci_hcd *xhci)
 {
-        u32 temp;
-
         xhci_dbg(xhci, "// Ding dong!\n");
-        temp = xhci_readl(xhci, &xhci->dba->doorbell[0]) & DB_MASK;
-        xhci_writel(xhci, temp | DB_TARGET_HOST, &xhci->dba->doorbell[0]);
+        xhci_writel(xhci, DB_VALUE_HOST, &xhci->dba->doorbell[0]);
         /* Flush PCI posted writes */
         xhci_readl(xhci, &xhci->dba->doorbell[0]);
 }
@@ -322,26 +319,24 @@ void xhci_ring_ep_doorbell(struct xhci_hcd *xhci,
                 unsigned int ep_index,
                 unsigned int stream_id)
 {
-        struct xhci_virt_ep *ep;
-        unsigned int ep_state;
-        u32 field;
         __u32 __iomem *db_addr = &xhci->dba->doorbell[slot_id];
+        struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
+        unsigned int ep_state = ep->ep_state;
 
-        ep = &xhci->devs[slot_id]->eps[ep_index];
-        ep_state = ep->ep_state;
         /* Don't ring the doorbell for this endpoint if there are pending
-         * cancellations because the we don't want to interrupt processing.
+         * cancellations because we don't want to interrupt processing.
          * We don't want to restart any stream rings if there's a set dequeue
          * pointer command pending because the device can choose to start any
          * stream once the endpoint is on the HW schedule.
          * FIXME - check all the stream rings for pending cancellations.
          */
-        if (!(ep_state & EP_HALT_PENDING) && !(ep_state & SET_DEQ_PENDING)
-                        && !(ep_state & EP_HALTED)) {
-                field = xhci_readl(xhci, db_addr) & DB_MASK;
-                field |= EPI_TO_DB(ep_index) | STREAM_ID_TO_DB(stream_id);
-                xhci_writel(xhci, field, db_addr);
-        }
+        if ((ep_state & EP_HALT_PENDING) || (ep_state & SET_DEQ_PENDING) ||
+            (ep_state & EP_HALTED))
+                return;
+        xhci_writel(xhci, DB_VALUE(ep_index, stream_id), db_addr);
+        /* The CPU has better things to do at this point than wait for a
+         * write-posting flush.  It'll get there soon enough.
+         */
 }
 
 /* Ring the doorbell for any rings with pending URBs */
@@ -1188,7 +1183,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
 
         addr = &xhci->op_regs->port_status_base + NUM_PORT_REGS * (port_id - 1);
         temp = xhci_readl(xhci, addr);
-        if ((temp & PORT_CONNECT) && (hcd->state == HC_STATE_SUSPENDED)) {
+        if (hcd->state == HC_STATE_SUSPENDED) {
                 xhci_dbg(xhci, "resume root hub\n");
                 usb_hcd_resume_root_hub(hcd);
         }
@@ -1710,8 +1705,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 /* Others already handled above */
                 break;
         }
-        dev_dbg(&td->urb->dev->dev,
-                        "ep %#x - asked for %d bytes, "
+        xhci_dbg(xhci, "ep %#x - asked for %d bytes, "
                         "%d bytes untransferred\n",
                         td->urb->ep->desc.bEndpointAddress,
                         td->urb->transfer_buffer_length,
@@ -2389,7 +2383,8 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
         }
         xhci_dbg(xhci, "\n");
         if (!in_interrupt())
-                dev_dbg(&urb->dev->dev, "ep %#x - urb len = %d, sglist used, num_trbs = %d\n",
+                xhci_dbg(xhci, "ep %#x - urb len = %d, sglist used, "
+                                "num_trbs = %d\n",
                                 urb->ep->desc.bEndpointAddress,
                                 urb->transfer_buffer_length,
                                 num_trbs);
@@ -2414,14 +2409,17 @@ static void check_trb_math(struct urb *urb, int num_trbs, int running_total)
 
 static void giveback_first_trb(struct xhci_hcd *xhci, int slot_id,
                 unsigned int ep_index, unsigned int stream_id, int start_cycle,
-                struct xhci_generic_trb *start_trb, struct xhci_td *td)
+                struct xhci_generic_trb *start_trb)
 {
         /*
          * Pass all the TRBs to the hardware at once and make sure this write
          * isn't reordered.
          */
         wmb();
-        start_trb->field[3] |= start_cycle;
+        if (start_cycle)
+                start_trb->field[3] |= start_cycle;
+        else
+                start_trb->field[3] &= ~0x1;
         xhci_ring_ep_doorbell(xhci, slot_id, ep_index, stream_id);
 }
 
@@ -2449,7 +2447,7 @@ int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
          * to set the polling interval (once the API is added).
          */
         if (xhci_interval != ep_interval) {
-                if (!printk_ratelimit())
+                if (printk_ratelimit())
                         dev_dbg(&urb->dev->dev, "Driver uses different interval"
                                         " (%d microframe%s) than xHCI "
                                         "(%d microframe%s)\n",
@@ -2551,9 +2549,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 u32 remainder = 0;
 
                 /* Don't change the cycle bit of the first TRB until later */
-                if (first_trb)
+                if (first_trb) {
                         first_trb = false;
-                else
+                        if (start_cycle == 0)
+                                field |= 0x1;
+                } else
                         field |= ep_ring->cycle_state;
 
                 /* Chain all the TRBs together; clear the chain bit in the last
@@ -2625,7 +2625,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
         check_trb_math(urb, num_trbs, running_total);
         giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
-                        start_cycle, start_trb, td);
+                        start_cycle, start_trb);
         return 0;
 }
 
@@ -2671,7 +2671,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         /* FIXME: this doesn't deal with URB_ZERO_PACKET - need one more */
 
         if (!in_interrupt())
-                dev_dbg(&urb->dev->dev, "ep %#x - urb len = %#x (%d), addr = %#llx, num_trbs = %d\n",
+                xhci_dbg(xhci, "ep %#x - urb len = %#x (%d), "
+                                "addr = %#llx, num_trbs = %d\n",
                                 urb->ep->desc.bEndpointAddress,
                                 urb->transfer_buffer_length,
                                 urb->transfer_buffer_length,
@@ -2711,9 +2712,11 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 field = 0;
 
                 /* Don't change the cycle bit of the first TRB until later */
-                if (first_trb)
+                if (first_trb) {
                         first_trb = false;
-                else
+                        if (start_cycle == 0)
+                                field |= 0x1;
+                } else
                         field |= ep_ring->cycle_state;
 
                 /* Chain all the TRBs together; clear the chain bit in the last
@@ -2757,7 +2760,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
         check_trb_math(urb, num_trbs, running_total);
         giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
-                        start_cycle, start_trb, td);
+                        start_cycle, start_trb);
         return 0;
 }
 
@@ -2818,13 +2821,17 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         /* Queue setup TRB - see section 6.4.1.2.1 */
         /* FIXME better way to translate setup_packet into two u32 fields? */
         setup = (struct usb_ctrlrequest *) urb->setup_packet;
+        field = 0;
+        field |= TRB_IDT | TRB_TYPE(TRB_SETUP);
+        if (start_cycle == 0)
+                field |= 0x1;
         queue_trb(xhci, ep_ring, false, true,
                         /* FIXME endianness is probably going to bite my ass here. */
                         setup->bRequestType | setup->bRequest << 8 | setup->wValue << 16,
                         setup->wIndex | setup->wLength << 16,
                         TRB_LEN(8) | TRB_INTR_TARGET(0),
                         /* Immediate data in pointer */
-                        TRB_IDT | TRB_TYPE(TRB_SETUP));
+                        field);
 
         /* If there's data, queue data TRBs */
         field = 0;
@@ -2859,7 +2866,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                         field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);
 
         giveback_first_trb(xhci, slot_id, ep_index, 0,
-                        start_cycle, start_trb, td);
+                        start_cycle, start_trb);
         return 0;
 }
 
@@ -2900,6 +2907,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         int running_total, trb_buff_len, td_len, td_remain_len, ret;
         u64 start_addr, addr;
         int i, j;
+        bool more_trbs_coming;
 
         ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
 
@@ -2910,7 +2918,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         }
 
         if (!in_interrupt())
-                dev_dbg(&urb->dev->dev, "ep %#x - urb len = %#x (%d),"
+                xhci_dbg(xhci, "ep %#x - urb len = %#x (%d),"
                                 " addr = %#llx, num_tds = %d\n",
                                 urb->ep->desc.bEndpointAddress,
                                 urb->transfer_buffer_length,
@@ -2950,7 +2958,10 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                                 field |= TRB_TYPE(TRB_ISOC);
                                 /* Assume URB_ISO_ASAP is set */
                                 field |= TRB_SIA;
-                                if (i > 0)
+                                if (i == 0) {
+                                        if (start_cycle == 0)
+                                                field |= 0x1;
+                                } else
                                         field |= ep_ring->cycle_state;
                                 first_trb = false;
                         } else {
@@ -2965,9 +2976,11 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                          */
                         if (j < trbs_per_td - 1) {
                                 field |= TRB_CHAIN;
+                                more_trbs_coming = true;
                         } else {
                                 td->last_trb = ep_ring->enqueue;
                                 field |= TRB_IOC;
+                                more_trbs_coming = false;
                         }
 
                         /* Calculate TRB length */
@@ -2980,7 +2993,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                         length_field = TRB_LEN(trb_buff_len) |
                                 remainder |
                                 TRB_INTR_TARGET(0);
-                        queue_trb(xhci, ep_ring, false, false,
+                        queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                 lower_32_bits(addr),
                                 upper_32_bits(addr),
                                 length_field,
@@ -3003,10 +3016,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 }
         }
 
-        wmb();
-        start_trb->field[3] |= start_cycle;
-
-        xhci_ring_ep_doorbell(xhci, slot_id, ep_index, urb->stream_id);
+        giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
+                        start_cycle, start_trb);
         return 0;
 }
 
@@ -3064,7 +3075,7 @@ int xhci_queue_isoc_tx_prepare(struct xhci_hcd *xhci, gfp_t mem_flags,
          * to set the polling interval (once the API is added).
          */
         if (xhci_interval != ep_interval) {
-                if (!printk_ratelimit())
+                if (printk_ratelimit())
                         dev_dbg(&urb->dev->dev, "Driver uses different interval"
                                         " (%d microframe%s) than xHCI "
                                         "(%d microframe%s)\n",
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 45e4a3108cc..34cf4e16587 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -226,7 +226,8 @@ static int xhci_setup_msi(struct xhci_hcd *xhci)
 static int xhci_setup_msix(struct xhci_hcd *xhci)
 {
         int i, ret = 0;
-        struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+        struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
 
         /*
          * calculate number of msi-x vectors supported.
@@ -265,6 +266,7 @@ static int xhci_setup_msix(struct xhci_hcd *xhci)
                         goto disable_msix;
         }
 
+        hcd->msix_enabled = 1;
         return ret;
 
 disable_msix:
@@ -280,7 +282,8 @@ free_entries:
 /* Free any IRQs and disable MSI-X */
 static void xhci_cleanup_msix(struct xhci_hcd *xhci)
 {
-        struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+        struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
 
         xhci_free_irq(xhci);
 
@@ -292,6 +295,7 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci)
                 pci_disable_msi(pdev);
         }
 
+        hcd->msix_enabled = 0;
         return;
 }
 
@@ -508,9 +512,10 @@ void xhci_stop(struct usb_hcd *hcd)
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
         xhci_reset(xhci);
-        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
+        xhci_cleanup_msix(xhci);
+
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
         /* Tell the event ring poll function not to reschedule */
         xhci->zombie = 1;
@@ -544,9 +549,10 @@ void xhci_shutdown(struct usb_hcd *hcd)
 
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
-        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
+        xhci_cleanup_msix(xhci);
+
         xhci_dbg(xhci, "xhci_shutdown completed - status = %x\n",
                     xhci_readl(xhci, &xhci->op_regs->status));
 }
@@ -647,6 +653,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
         int                     rc = 0;
         struct usb_hcd          *hcd = xhci_to_hcd(xhci);
         u32                     command;
+        int                     i;
 
         spin_lock_irq(&xhci->lock);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
@@ -677,10 +684,15 @@ int xhci_suspend(struct xhci_hcd *xhci)
                 spin_unlock_irq(&xhci->lock);
                 return -ETIMEDOUT;
         }
-        /* step 5: remove core well power */
-        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
+        /* step 5: remove core well power */
+        /* synchronize irq when using MSI-X */
+        if (xhci->msix_entries) {
+                for (i = 0; i < xhci->msix_count; i++)
+                        synchronize_irq(xhci->msix_entries[i].vector);
+        }
+
         return rc;
 }
 
@@ -694,7 +706,6 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 {
         u32                     command, temp = 0;
         struct usb_hcd          *hcd = xhci_to_hcd(xhci);
-        struct pci_dev          *pdev = to_pci_dev(hcd->self.controller);
         int     old_state, retval;
 
         old_state = hcd->state;
@@ -729,9 +740,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                 xhci_dbg(xhci, "Stop HCD\n");
                 xhci_halt(xhci);
                 xhci_reset(xhci);
-                if (hibernated)
-                        xhci_cleanup_msix(xhci);
                 spin_unlock_irq(&xhci->lock);
+                xhci_cleanup_msix(xhci);
 
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
                 /* Tell the event ring poll function not to reschedule */
@@ -765,30 +775,6 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                 return retval;
         }
 
-        spin_unlock_irq(&xhci->lock);
-        /* Re-setup MSI-X */
-        if (hcd->irq)
-                free_irq(hcd->irq, hcd);
-        hcd->irq = -1;
-
-        retval = xhci_setup_msix(xhci);
-        if (retval)
-                /* fall back to msi*/
-                retval = xhci_setup_msi(xhci);
-
-        if (retval) {
-                /* fall back to legacy interrupt*/
-                retval = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
-                                        hcd->irq_descr, hcd);
-                if (retval) {
-                        xhci_err(xhci, "request interrupt %d failed\n",
-                                        pdev->irq);
-                        return retval;
-                }
-                hcd->irq = pdev->irq;
-        }
-
-        spin_lock_irq(&xhci->lock);
         /* step 4: set Run/Stop bit */
         command = xhci_readl(xhci, &xhci->op_regs->command);
         command |= CMD_RUN;
@@ -2445,8 +2431,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
                 xhci_err(xhci, "Error while assigning device slot ID\n");
                 return 0;
         }
-        /* xhci_alloc_virt_device() does not touch rings; no need to lock */
-        if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_KERNEL)) {
+        /* xhci_alloc_virt_device() does not touch rings; no need to lock.
+         * Use GFP_NOIO, since this function can be called from
+         * xhci_discover_or_reset_device(), which may be called as part of
+         * mass storage driver error handling.
+         */
+        if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_NOIO)) {
                 /* Disable slot, if we can do it without mem alloc */
                 xhci_warn(xhci, "Could not allocate xHCI USB device data structures\n");
                 spin_lock_irqsave(&xhci->lock, flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 170c367112d..7f236fd2201 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -436,22 +436,18 @@ struct xhci_run_regs {
 /**
  * struct doorbell_array
  *
+ * Bits  0 -  7: Endpoint target
+ * Bits  8 - 15: RsvdZ
+ * Bits 16 - 31: Stream ID
+ *
  * Section 5.6
  */
 struct xhci_doorbell_array {
         u32     doorbell[256];
 };
 
-#define DB_TARGET_MASK          0xFFFFFF00
-#define DB_STREAM_ID_MASK       0x0000FFFF
-#define DB_TARGET_HOST          0x0
-#define DB_STREAM_ID_HOST       0x0
-#define DB_MASK                 (0xff << 8)
-
-/* Endpoint Target - bits 0:7 */
-#define EPI_TO_DB(p)            (((p) + 1) & 0xff)
-#define STREAM_ID_TO_DB(p)      (((p) & 0xffff) << 16)
-
+#define DB_VALUE(ep, stream)    ((((ep) + 1) & 0xff) | ((stream) << 16))
+#define DB_VALUE_HOST           0x00000000
 
 /**
  * struct xhci_protocol_caps
diff --git a/drivers/usb/misc/usbled.c b/drivers/usb/misc/usbled.c
index 1732d9bc097..1616ad1793a 100644
--- a/drivers/usb/misc/usbled.c
+++ b/drivers/usb/misc/usbled.c
@@ -45,7 +45,7 @@ struct usb_led {
 
 static void change_color(struct usb_led *led)
 {
-        int retval;
+        int retval = 0;
         unsigned char *buffer;
 
         buffer = kmalloc(8, GFP_KERNEL);
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index 4ff21587ab0..f7a20573803 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -776,7 +776,6 @@ static const struct usb_device_id uss720_table[] = {
         { USB_DEVICE(0x0557, 0x2001) },
         { USB_DEVICE(0x0729, 0x1284) },
         { USB_DEVICE(0x1293, 0x0002) },
-        { USB_DEVICE(0x1293, 0x0002) },
         { USB_DEVICE(0x050d, 0x0002) },
         { }                                             /* Terminating entry */
 };
diff --git a/drivers/usb/otg/nop-usb-xceiv.c b/drivers/usb/otg/nop-usb-xceiv.c
index e70014ab097..8acf165fe13 100644
--- a/drivers/usb/otg/nop-usb-xceiv.c
+++ b/drivers/usb/otg/nop-usb-xceiv.c
@@ -132,6 +132,8 @@ static int __devinit nop_usb_xceiv_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, nop);
 
+        BLOCKING_INIT_NOTIFIER_HEAD(&nop->otg.notifier);
+
         return 0;
 exit:
         kfree(nop);
diff --git a/drivers/usb/otg/ulpi.c b/drivers/usb/otg/ulpi.c
index 059d9ac0ab5..770d799d5af 100644
--- a/drivers/usb/otg/ulpi.c
+++ b/drivers/usb/otg/ulpi.c
@@ -45,7 +45,7 @@ struct ulpi_info {
 /* ULPI hardcoded IDs, used for probing */
 static struct ulpi_info ulpi_ids[] = {
         ULPI_INFO(ULPI_ID(0x04cc, 0x1504), "NXP ISP1504"),
-        ULPI_INFO(ULPI_ID(0x0424, 0x0006), "SMSC USB3319"),
+        ULPI_INFO(ULPI_ID(0x0424, 0x0006), "SMSC USB331x"),
 };
 
 static int ulpi_set_otg_flags(struct otg_transceiver *otg)
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 63f7cc45bca..7b8815ddf36 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -486,12 +486,22 @@ static void ch341_read_int_callback(struct urb *urb)
         if (actual_length >= 4) {
                 struct ch341_private *priv = usb_get_serial_port_data(port);
                 unsigned long flags;
+                u8 prev_line_status = priv->line_status;
 
                 spin_lock_irqsave(&priv->lock, flags);
                 priv->line_status = (~(data[2])) & CH341_BITS_MODEM_STAT;
                 if ((data[1] & CH341_MULT_STAT))
                         priv->multi_status_change = 1;
                 spin_unlock_irqrestore(&priv->lock, flags);
+
+                if ((priv->line_status ^ prev_line_status) & CH341_BIT_DCD) {
+                        struct tty_struct *tty = tty_port_tty_get(&port->port);
+                        if (tty)
+                                usb_serial_handle_dcd_change(port, tty,
+                                            priv->line_status & CH341_BIT_DCD);
+                        tty_kref_put(tty);
+                }
+
                 wake_up_interruptible(&priv->delta_msr_wait);
         }
 
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 8d7731dbf47..735ea03157a 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -49,7 +49,6 @@ static int cp210x_tiocmset_port(struct usb_serial_port *port, struct file *,
 static void cp210x_break_ctl(struct tty_struct *, int);
 static int cp210x_startup(struct usb_serial *);
 static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
-static int cp210x_carrier_raised(struct usb_serial_port *p);
 
 static int debug;
 
@@ -87,7 +86,6 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */
         { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
         { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */
-        { USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */
         { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
         { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
         { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
@@ -110,7 +108,9 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
         { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
         { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
+        { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
         { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
+        { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
         { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
         { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
@@ -165,8 +165,7 @@ static struct usb_serial_driver cp210x_device = {
         .tiocmget               = cp210x_tiocmget,
         .tiocmset               = cp210x_tiocmset,
         .attach                 = cp210x_startup,
-        .dtr_rts                = cp210x_dtr_rts,
-        .carrier_raised         = cp210x_carrier_raised
+        .dtr_rts                = cp210x_dtr_rts
 };
 
 /* Config request types */
@@ -765,15 +764,6 @@ static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
         return result;
 }
 
-static int cp210x_carrier_raised(struct usb_serial_port *p)
-{
-        unsigned int control;
-        cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
-        if (control & CONTROL_DCD)
-                return 1;
-        return 0;
-}
-
 static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
 {
         struct usb_serial_port *port = tty->driver_data;
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index b92070c103c..666e5a6edd8 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -455,7 +455,6 @@ static int digi_write_room(struct tty_struct *tty);
 static int digi_chars_in_buffer(struct tty_struct *tty);
 static int digi_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void digi_close(struct usb_serial_port *port);
-static int digi_carrier_raised(struct usb_serial_port *port);
 static void digi_dtr_rts(struct usb_serial_port *port, int on);
 static int digi_startup_device(struct usb_serial *serial);
 static int digi_startup(struct usb_serial *serial);
@@ -511,7 +510,6 @@ static struct usb_serial_driver digi_acceleport_2_device = {
         .open =                         digi_open,
         .close =                        digi_close,
         .dtr_rts =                      digi_dtr_rts,
-        .carrier_raised =               digi_carrier_raised,
         .write =                        digi_write,
         .write_room =                   digi_write_room,
         .write_bulk_callback =          digi_write_bulk_callback,
@@ -1339,14 +1337,6 @@ static void digi_dtr_rts(struct usb_serial_port *port, int on)
         digi_set_modem_signals(port, on * (TIOCM_DTR|TIOCM_RTS), 1);
 }
 
-static int digi_carrier_raised(struct usb_serial_port *port)
-{
-        struct digi_port *priv = usb_get_serial_port_data(port);
-        if (priv->dp_modem_signals & TIOCM_CD)
-                return 1;
-        return 0;
-}
-
 static int digi_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         int ret;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index a2668d08926..4787c0cd063 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -676,7 +676,17 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
-        { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C2_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2D_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2VT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2VR_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVR_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVR_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index bf086728548..ed160def858 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -569,11 +569,23 @@
 #define OCT_US101_PID           0x0421  /* OCT US101 USB to RS-232 */
 
 /*
- * Icom ID-1 digital transceiver
- */
-
-#define ICOM_ID1_VID            0x0C26
-#define ICOM_ID1_PID            0x0004
+ * Definitions for Icom Inc. devices
+ */
+#define ICOM_VID                0x0C26 /* Icom vendor ID */
+/* Note: ID-1 is a communications tranceiver for HAM-radio operators */
+#define ICOM_ID_1_PID           0x0004 /* ID-1 USB to RS-232 */
+/* Note: OPC is an Optional cable to connect an Icom Tranceiver */
+#define ICOM_OPC_U_UC_PID       0x0018 /* OPC-478UC, OPC-1122U cloning cable */
+/* Note: ID-RP* devices are Icom Repeater Devices for HAM-radio */
+#define ICOM_ID_RP2C1_PID       0x0009 /* ID-RP2C Asset 1 to RS-232 */
+#define ICOM_ID_RP2C2_PID       0x000A /* ID-RP2C Asset 2 to RS-232 */
+#define ICOM_ID_RP2D_PID        0x000B /* ID-RP2D configuration port*/
+#define ICOM_ID_RP2VT_PID       0x000C /* ID-RP2V Transmit config port */
+#define ICOM_ID_RP2VR_PID       0x000D /* ID-RP2V Receive config port */
+#define ICOM_ID_RP4KVT_PID      0x0010 /* ID-RP4000V Transmit config port */
+#define ICOM_ID_RP4KVR_PID      0x0011 /* ID-RP4000V Receive config port */
+#define ICOM_ID_RP2KVT_PID      0x0012 /* ID-RP2000V Transmit config port */
+#define ICOM_ID_RP2KVR_PID      0x0013 /* ID-RP2000V Receive config port */
 
 /*
  * GN Otometrics (http://www.otometrics.com)
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index e6833e216fc..e4db5ad2bc5 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -479,6 +479,26 @@ int usb_serial_handle_break(struct usb_serial_port *port)
 }
 EXPORT_SYMBOL_GPL(usb_serial_handle_break);
 
+/**
+ *      usb_serial_handle_dcd_change - handle a change of carrier detect state
+ *      @port: usb_serial_port structure for the open port
+ *      @tty: tty_struct structure for the port
+ *      @status: new carrier detect status, nonzero if active
+ */
+void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
+                                struct tty_struct *tty, unsigned int status)
+{
+        struct tty_port *port = &usb_port->port;
+
+        dbg("%s - port %d, status %d", __func__, usb_port->number, status);
+
+        if (status)
+                wake_up_interruptible(&port->open_wait);
+        else if (tty && !C_CLOCAL(tty))
+                tty_hangup(tty);
+}
+EXPORT_SYMBOL_GPL(usb_serial_handle_dcd_change);
+
 int usb_serial_generic_resume(struct usb_serial *serial)
 {
         struct usb_serial_port *port;
diff --git a/drivers/usb/serial/io_tables.h b/drivers/usb/serial/io_tables.h
index 6ab2a3f97fe..178b22eb32b 100644
--- a/drivers/usb/serial/io_tables.h
+++ b/drivers/usb/serial/io_tables.h
@@ -199,6 +199,7 @@ static struct usb_serial_driver epic_device = {
                 .name           = "epic",
         },
         .description            = "EPiC device",
+        .usb_driver             = &io_driver,
         .id_table               = Epic_port_id_table,
         .num_ports              = 1,
         .open                   = edge_open,
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 12ed594f5f8..99b97c04896 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -1275,6 +1275,7 @@ static struct usb_serial_driver iuu_device = {
                    .name = "iuu_phoenix",
                    },
         .id_table = id_table,
+        .usb_driver = &iuu_driver,
         .num_ports = 1,
         .bulk_in_size = 512,
         .bulk_out_size = 512,
diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h
index 2d8baf6ac47..ce134dc28dd 100644
--- a/drivers/usb/serial/keyspan.h
+++ b/drivers/usb/serial/keyspan.h
@@ -546,6 +546,7 @@ static struct usb_serial_driver keyspan_pre_device = {
                 .name           = "keyspan_no_firm",
         },
         .description            = "Keyspan - (without firmware)",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_pre_ids,
         .num_ports              = 1,
         .attach                 = keyspan_fake_startup,
@@ -557,6 +558,7 @@ static struct usb_serial_driver keyspan_1port_device = {
                 .name           = "keyspan_1",
         },
         .description            = "Keyspan 1 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_1port_ids,
         .num_ports              = 1,
         .open                   = keyspan_open,
@@ -579,6 +581,7 @@ static struct usb_serial_driver keyspan_2port_device = {
                 .name           = "keyspan_2",
         },
         .description            = "Keyspan 2 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_2port_ids,
         .num_ports              = 2,
         .open                   = keyspan_open,
@@ -601,6 +604,7 @@ static struct usb_serial_driver keyspan_4port_device = {
                 .name           = "keyspan_4",
         },
         .description            = "Keyspan 4 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_4port_ids,
         .num_ports              = 4,
         .open                   = keyspan_open,
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index a10dd5676cc..554a8693a46 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -679,22 +679,6 @@ static void keyspan_pda_dtr_rts(struct usb_serial_port *port, int on)
         }
 }
 
-static int keyspan_pda_carrier_raised(struct usb_serial_port *port)
-{
-        struct usb_serial *serial = port->serial;
-        unsigned char modembits;
-
-        /* If we can read the modem status and the DCD is low then
-           carrier is not raised yet */
-        if (keyspan_pda_get_modem_info(serial, &modembits) >= 0) {
-                if (!(modembits & (1>>6)))
-                        return 0;
-        }
-        /* Carrier raised, or we failed (eg disconnected) so
-           progress accordingly */
-        return 1;
-}
-
 
 static int keyspan_pda_open(struct tty_struct *tty,
                                         struct usb_serial_port *port)
@@ -881,7 +865,6 @@ static struct usb_serial_driver keyspan_pda_device = {
         .id_table =             id_table_std,
         .num_ports =            1,
         .dtr_rts =              keyspan_pda_dtr_rts,
-        .carrier_raised =       keyspan_pda_carrier_raised,
         .open =                 keyspan_pda_open,
         .close =                keyspan_pda_close,
         .write =                keyspan_pda_write,
diff --git a/drivers/usb/serial/moto_modem.c b/drivers/usb/serial/moto_modem.c
index cf1718394e1..653465f61d4 100644
--- a/drivers/usb/serial/moto_modem.c
+++ b/drivers/usb/serial/moto_modem.c
@@ -44,6 +44,7 @@ static struct usb_serial_driver moto_device = {
                 .name =         "moto-modem",
         },
         .id_table =             id_table,
+        .usb_driver =           &moto_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 748778288d9..5f46838dfee 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -382,7 +382,16 @@ static void option_instat_callback(struct urb *urb);
 #define HAIER_VENDOR_ID                         0x201e
 #define HAIER_PRODUCT_CE100                     0x2009
 
-#define CINTERION_VENDOR_ID                     0x0681
+/* Cinterion (formerly Siemens) products */
+#define SIEMENS_VENDOR_ID                               0x0681
+#define CINTERION_VENDOR_ID                             0x1e2d
+#define CINTERION_PRODUCT_HC25_MDM              0x0047
+#define CINTERION_PRODUCT_HC25_MDMNET   0x0040
+#define CINTERION_PRODUCT_HC28_MDM              0x004C
+#define CINTERION_PRODUCT_HC28_MDMNET   0x004A /* same for HC28J */
+#define CINTERION_PRODUCT_EU3_E                 0x0051
+#define CINTERION_PRODUCT_EU3_P                 0x0052
+#define CINTERION_PRODUCT_PH8                   0x0053
 
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID                      0x0b3c
@@ -944,7 +953,17 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) },
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
-        { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
+        /* Cinterion */
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, 
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
         { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
         { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index 5be866bb7a4..73613205be7 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -157,6 +157,7 @@ static struct usb_serial_driver oti6858_device = {
                 .name =         "oti6858",
         },
         .id_table =             id_table,
+        .usb_driver =           &oti6858_driver,
         .num_ports =            1,
         .open =                 oti6858_open,
         .close =                oti6858_close,
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 8ae4c6cbc38..08c9181b8e4 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -50,6 +50,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
@@ -677,9 +678,11 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
 {
 
         struct pl2303_private *priv = usb_get_serial_port_data(port);
+        struct tty_struct *tty;
         unsigned long flags;
         u8 status_idx = UART_STATE;
         u8 length = UART_STATE + 1;
+        u8 prev_line_status;
         u16 idv, idp;
 
         idv = le16_to_cpu(port->serial->dev->descriptor.idVendor);
@@ -701,11 +704,20 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
 
         /* Save off the uart status for others to look at */
         spin_lock_irqsave(&priv->lock, flags);
+        prev_line_status = priv->line_status;
         priv->line_status = data[status_idx];
         spin_unlock_irqrestore(&priv->lock, flags);
         if (priv->line_status & UART_BREAK_ERROR)
                 usb_serial_handle_break(port);
         wake_up_interruptible(&priv->delta_msr_wait);
+
+        tty = tty_port_tty_get(&port->port);
+        if (!tty)
+                return;
+        if ((priv->line_status ^ prev_line_status) & UART_DCD)
+                usb_serial_handle_dcd_change(port, tty,
+                                priv->line_status & UART_DCD);
+        tty_kref_put(tty);
 }
 
 static void pl2303_read_int_callback(struct urb *urb)
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 43eb9bdad42..1b025f75daf 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -21,6 +21,7 @@
 #define PL2303_PRODUCT_ID_MMX           0x0612
 #define PL2303_PRODUCT_ID_GPRS          0x0609
 #define PL2303_PRODUCT_ID_HCR331        0x331a
+#define PL2303_PRODUCT_ID_MOTOROLA      0x0307
 
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
index 214a3e50429..30b73e68a90 100644
--- a/drivers/usb/serial/qcaux.c
+++ b/drivers/usb/serial/qcaux.c
@@ -36,6 +36,7 @@
 #define UTSTARCOM_PRODUCT_UM175_V1              0x3712
 #define UTSTARCOM_PRODUCT_UM175_V2              0x3714
 #define UTSTARCOM_PRODUCT_UM175_ALLTEL          0x3715
+#define PANTECH_PRODUCT_UML290_VZW              0x3718
 
 /* CMOTECH devices */
 #define CMOTECH_VENDOR_ID                       0x16d8
@@ -66,6 +67,7 @@ static struct usb_device_id id_table[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
@@ -84,6 +86,7 @@ static struct usb_serial_driver qcaux_device = {
                 .name =         "qcaux",
         },
         .id_table =             id_table,
+        .usb_driver =           &qcaux_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/siemens_mpi.c b/drivers/usb/serial/siemens_mpi.c
index cb8195cabfd..74cd4ccdb3f 100644
--- a/drivers/usb/serial/siemens_mpi.c
+++ b/drivers/usb/serial/siemens_mpi.c
@@ -42,6 +42,7 @@ static struct usb_serial_driver siemens_usb_mpi_device = {
                 .name =         "siemens_mpi",
         },
         .id_table =             id_table,
+        .usb_driver =           &siemens_usb_mpi_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 765aa983bf5..cbfb70bffdd 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -133,7 +133,7 @@ struct spcp8x5_usb_ctrl_arg {
 
 /* how come ??? */
 #define UART_STATE                      0x08
-#define UART_STATE_TRANSIENT_MASK       0x74
+#define UART_STATE_TRANSIENT_MASK       0x75
 #define UART_DCD                        0x01
 #define UART_DSR                        0x02
 #define UART_BREAK_ERROR                0x04
@@ -525,6 +525,10 @@ static void spcp8x5_process_read_urb(struct urb *urb)
                 /* overrun is special, not associated with a char */
                 if (status & UART_OVERRUN_ERROR)
                         tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+
+                if (status & UART_DCD)
+                        usb_serial_handle_dcd_change(port, tty,
+                                   priv->line_status & MSR_STATUS_LINE_DCD);
         }
 
         tty_insert_flip_string_fixed_flag(tty, data, tty_flag,
@@ -645,6 +649,7 @@ static struct usb_serial_driver spcp8x5_device = {
                 .name =         "SPCP8x5",
         },
         .id_table               = id_table,
+        .usb_driver             = &spcp8x5_driver,
         .num_ports              = 1,
         .open                   = spcp8x5_open,
         .dtr_rts                = spcp8x5_dtr_rts,
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 6954de50c0f..546a52179be 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1344,11 +1344,15 @@ int usb_serial_register(struct usb_serial_driver *driver)
                 return -ENODEV;
 
         fixup_generic(driver);
-        if (driver->usb_driver)
-                driver->usb_driver->supports_autosuspend = 1;
 
         if (!driver->description)
                 driver->description = driver->driver.name;
+        if (!driver->usb_driver) {
+                WARN(1, "Serial driver %s has no usb_driver\n",
+                                driver->description);
+                return -EINVAL;
+        }
+        driver->usb_driver->supports_autosuspend = 1;
 
         /* Add this device to our list of devices */
         mutex_lock(&table_lock);
diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
index f2ed6a31be7..95a82148ee8 100644
--- a/drivers/usb/serial/usb_debug.c
+++ b/drivers/usb/serial/usb_debug.c
@@ -75,6 +75,7 @@ static struct usb_serial_driver debug_device = {
                 .name =         "debug",
         },
         .id_table =             id_table,
+        .usb_driver =           &debug_driver,
         .num_ports =            1,
         .bulk_out_size =        USB_DEBUG_MAX_PACKET_SIZE,
         .break_ctl =            usb_debug_break_ctl,
diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
index c854fdebe0a..2c855302622 100644
--- a/drivers/usb/storage/unusual_cypress.h
+++ b/drivers/usb/storage/unusual_cypress.h
@@ -31,4 +31,9 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x9999,
                 "Cypress ISD-300LP",
                 USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
 
+UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999,
+                "Super Top",
+                "USB 2.0  SATA BRIDGE",
+                USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+
 #endif /* defined(CONFIG_USB_STORAGE_CYPRESS_ATACB) || ... */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index fcc1e32ce25..24bd5d7c3de 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1044,6 +1044,15 @@ UNUSUAL_DEV(  0x084d, 0x0011, 0x0110, 0x0110,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_BULK32),
 
+/* Reported by <ttkspam@free.fr>
+ * The device reports a vendor-specific device class, requiring an
+ * explicit vendor/product match.
+ */
+UNUSUAL_DEV(  0x0851, 0x1542, 0x0002, 0x0002,
+                "MagicPixel",
+                "FW_Omega2",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL, 0),
+
 /* Andrew Lunn <andrew@lunn.ch>
  * PanDigital Digital Picture Frame. Does not like ALLOW_MEDIUM_REMOVAL
  * on LUN 4.
@@ -1872,6 +1881,15 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_READ_DISC_INFO ),
 
+/* Patch by Richard Schütz <r.schtz@t-online.de>
+ * This external hard drive enclosure uses a JMicron chip which
+ * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
+UNUSUAL_DEV(  0x1e68, 0x001b, 0x0000, 0x0000,
+                "TrekStor GmbH & Co. KG",
+                "DataStation maxi g.u",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
 UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
                 "ST",
                 "2A",
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 9b3ca103135..f616cefc95b 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -128,8 +128,7 @@ static void handle_tx(struct vhost_net *net)
         size_t hdr_size;
         struct socket *sock;
 
-        /* TODO: check that we are running from vhost_worker?
-         * Not sure it's worth it, it's straight-forward enough. */
+        /* TODO: check that we are running from vhost_worker? */
         sock = rcu_dereference_check(vq->private_data, 1);
         if (!sock)
                 return;
@@ -306,7 +305,8 @@ static void handle_rx_big(struct vhost_net *net)
         size_t len, total_len = 0;
         int err;
         size_t hdr_size;
-        struct socket *sock = rcu_dereference(vq->private_data);
+        /* TODO: check that we are running from vhost_worker? */
+        struct socket *sock = rcu_dereference_check(vq->private_data, 1);
         if (!sock || skb_queue_empty(&sock->sk->sk_receive_queue))
                 return;
 
@@ -415,7 +415,8 @@ static void handle_rx_mergeable(struct vhost_net *net)
         int err, headcount;
         size_t vhost_hlen, sock_hlen;
         size_t vhost_len, sock_len;
-        struct socket *sock = rcu_dereference(vq->private_data);
+        /* TODO: check that we are running from vhost_worker? */
+        struct socket *sock = rcu_dereference_check(vq->private_data, 1);
         if (!sock || skb_queue_empty(&sock->sk->sk_receive_queue))
                 return;
 
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 2af44b7b1f3..b3363ae3851 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -173,9 +173,9 @@ static inline int vhost_has_feature(struct vhost_dev *dev, int bit)
 {
         unsigned acked_features;
 
-        acked_features =
-                rcu_dereference_index_check(dev->acked_features,
-                                            lockdep_is_held(&dev->mutex));
+        /* TODO: check that we are running from vhost_worker or dev mutex is
+         * held? */
+        acked_features = rcu_dereference_index_check(dev->acked_features, 1);
         return acked_features & (1 << bit);
 }
 
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index d916ac04aba..6bafb51bb43 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1227,7 +1227,7 @@ config FB_CARILLO_RANCH
 
 config FB_INTEL
         tristate "Intel 830M/845G/852GM/855GM/865G/915G/945G/945GM/965G/965GM support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && FB && PCI && X86 && AGP_INTEL && EMBEDDED
+        depends on EXPERIMENTAL && FB && PCI && X86 && AGP_INTEL && EXPERT
         select FB_MODE_HELPERS
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c
index d583bea608f..391ac939f01 100644
--- a/drivers/video/arkfb.c
+++ b/drivers/video/arkfb.c
@@ -23,7 +23,7 @@
 #include <linux/svga.h>
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <linux/console.h> /* Why should fb driver call console functions? because acquire_console_sem() */
+#include <linux/console.h> /* Why should fb driver call console functions? because console_lock() */
 #include <video/vga.h>
 
 #ifdef CONFIG_MTRR
@@ -1091,12 +1091,12 @@ static int ark_pci_suspend (struct pci_dev* dev, pm_message_t state)
 
         dev_info(info->device, "suspend\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if ((state.event == PM_EVENT_FREEZE) || (par->ref_count == 0)) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -1107,7 +1107,7 @@ static int ark_pci_suspend (struct pci_dev* dev, pm_message_t state)
         pci_set_power_state(dev, pci_choose_state(dev, state));
 
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -1122,7 +1122,7 @@ static int ark_pci_resume (struct pci_dev* dev)
 
         dev_info(info->device, "resume\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if (par->ref_count == 0)
@@ -1141,7 +1141,7 @@ static int ark_pci_resume (struct pci_dev* dev)
 
 fail:
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 #else
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index dd9de2e8058..4cb6a576c56 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1860,11 +1860,11 @@ static void aty128_early_resume(void *data)
 {
         struct aty128fb_par *par = data;
 
-        if (try_acquire_console_sem())
+        if (!console_trylock())
                 return;
         pci_restore_state(par->pdev);
         aty128_do_resume(par->pdev);
-        release_console_sem();
+        console_unlock();
 }
 #endif /* CONFIG_PPC_PMAC */
 
@@ -2438,7 +2438,7 @@ static int aty128_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 
         printk(KERN_DEBUG "aty128fb: suspending...\n");
         
-        acquire_console_sem();
+        console_lock();
 
         fb_set_suspend(info, 1);
 
@@ -2470,7 +2470,7 @@ static int aty128_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         if (state.event != PM_EVENT_ON)
                 aty128_set_suspend(par, 1);
 
-        release_console_sem();
+        console_unlock();
 
         pdev->dev.power.power_state = state;
 
@@ -2527,9 +2527,9 @@ static int aty128_pci_resume(struct pci_dev *pdev)
 {
         int rc;
 
-        acquire_console_sem();
+        console_lock();
         rc = aty128_do_resume(pdev);
-        release_console_sem();
+        console_unlock();
 
         return rc;
 }
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index 767ab4fb1a0..94e293fce1d 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -2069,7 +2069,7 @@ static int atyfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         if (state.event == pdev->dev.power.power_state.event)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
 
         fb_set_suspend(info, 1);
 
@@ -2097,14 +2097,14 @@ static int atyfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                 par->lock_blank = 0;
                 atyfb_blank(FB_BLANK_UNBLANK, info);
                 fb_set_suspend(info, 0);
-                release_console_sem();
+                console_unlock();
                 return -EIO;
         }
 #else
         pci_set_power_state(pdev, pci_choose_state(pdev, state));
 #endif
 
-        release_console_sem();
+        console_unlock();
 
         pdev->dev.power.power_state = state;
 
@@ -2133,7 +2133,7 @@ static int atyfb_pci_resume(struct pci_dev *pdev)
         if (pdev->dev.power.power_state.event == PM_EVENT_ON)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
 
         /*
          * PCI state will have been restored by the core, so
@@ -2161,7 +2161,7 @@ static int atyfb_pci_resume(struct pci_dev *pdev)
         par->lock_blank = 0;
         atyfb_blank(FB_BLANK_UNBLANK, info);
 
-        release_console_sem();
+        console_unlock();
 
         pdev->dev.power.power_state = PMSG_ON;
 
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index c4e17642d9c..92bda584851 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -2626,7 +2626,7 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
                 goto done;
         }
 
-        acquire_console_sem();
+        console_lock();
 
         fb_set_suspend(info, 1);
 
@@ -2690,7 +2690,7 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
         if (rinfo->pm_mode & radeon_pm_d2)
                 radeon_set_suspend(rinfo, 1);
 
-        release_console_sem();
+        console_unlock();
 
  done:
         pdev->dev.power.power_state = mesg;
@@ -2715,10 +2715,10 @@ int radeonfb_pci_resume(struct pci_dev *pdev)
                 return 0;
 
         if (rinfo->no_schedule) {
-                if (try_acquire_console_sem())
+                if (!console_trylock())
                         return 0;
         } else
-                acquire_console_sem();
+                console_lock();
 
         printk(KERN_DEBUG "radeonfb (%s): resuming from state: %d...\n",
                pci_name(pdev), pdev->dev.power.power_state.event);
@@ -2783,7 +2783,7 @@ int radeonfb_pci_resume(struct pci_dev *pdev)
         pdev->dev.power.power_state = PMSG_ON;
 
  bail:
-        release_console_sem();
+        console_unlock();
 
         return rc;
 }
diff --git a/drivers/video/backlight/88pm860x_bl.c b/drivers/video/backlight/88pm860x_bl.c
index c789c46e38a..b224396b86d 100644
--- a/drivers/video/backlight/88pm860x_bl.c
+++ b/drivers/video/backlight/88pm860x_bl.c
@@ -21,7 +21,7 @@
 #define MAX_BRIGHTNESS          (0xFF)
 #define MIN_BRIGHTNESS          (0)
 
-#define CURRENT_MASK            (0x1F << 1)
+#define CURRENT_BITMASK         (0x1F << 1)
 
 struct pm860x_backlight_data {
         struct pm860x_chip *chip;
@@ -85,7 +85,7 @@ static int pm860x_backlight_set(struct backlight_device *bl, int brightness)
         if ((data->current_brightness == 0) && brightness) {
                 if (data->iset) {
                         ret = pm860x_set_bits(data->i2c, wled_idc(data->port),
-                                              CURRENT_MASK, data->iset);
+                                              CURRENT_BITMASK, data->iset);
                         if (ret < 0)
                                 goto out;
                 }
diff --git a/drivers/video/bf537-lq035.c b/drivers/video/bf537-lq035.c
index 18c507874ff..47c21fb2c82 100644
--- a/drivers/video/bf537-lq035.c
+++ b/drivers/video/bf537-lq035.c
@@ -696,6 +696,7 @@ static int __devinit bfin_lq035_probe(struct platform_device *pdev)
 {
         struct backlight_properties props;
         dma_addr_t dma_handle;
+        int ret;
 
         if (request_dma(CH_PPI, KBUILD_MODNAME)) {
                 pr_err("couldn't request PPI DMA\n");
@@ -704,17 +705,16 @@ static int __devinit bfin_lq035_probe(struct platform_device *pdev)
 
         if (request_ports()) {
                 pr_err("couldn't request gpio port\n");
-                free_dma(CH_PPI);
-                return -EFAULT;
+                ret = -EFAULT;
+                goto out_ports;
         }
 
         fb_buffer = dma_alloc_coherent(NULL, TOTAL_VIDEO_MEM_SIZE,
                                        &dma_handle, GFP_KERNEL);
         if (fb_buffer == NULL) {
                 pr_err("couldn't allocate dma buffer\n");
-                free_dma(CH_PPI);
-                free_ports();
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out_dma_coherent;
         }
 
         if (L1_DATA_A_LENGTH)
@@ -725,10 +725,8 @@ static int __devinit bfin_lq035_probe(struct platform_device *pdev)
 
         if (dma_desc_table == NULL) {
                 pr_err("couldn't allocate dma descriptor\n");
-                free_dma(CH_PPI);
-                free_ports();
-                dma_free_coherent(NULL, TOTAL_VIDEO_MEM_SIZE, fb_buffer, 0);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out_table;
         }
 
         bfin_lq035_fb.screen_base = (void *)fb_buffer;
@@ -771,31 +769,21 @@ static int __devinit bfin_lq035_probe(struct platform_device *pdev)
         bfin_lq035_fb.pseudo_palette = kzalloc(sizeof(u32) * 16, GFP_KERNEL);
         if (bfin_lq035_fb.pseudo_palette == NULL) {
                 pr_err("failed to allocate pseudo_palette\n");
-                free_dma(CH_PPI);
-                free_ports();
-                dma_free_coherent(NULL, TOTAL_VIDEO_MEM_SIZE, fb_buffer, 0);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out_palette;
         }
 
         if (fb_alloc_cmap(&bfin_lq035_fb.cmap, NBR_PALETTE, 0) < 0) {
                 pr_err("failed to allocate colormap (%d entries)\n",
                         NBR_PALETTE);
-                free_dma(CH_PPI);
-                free_ports();
-                dma_free_coherent(NULL, TOTAL_VIDEO_MEM_SIZE, fb_buffer, 0);
-                kfree(bfin_lq035_fb.pseudo_palette);
-                return -EFAULT;
+                ret = -EFAULT;
+                goto out_cmap;
         }
 
         if (register_framebuffer(&bfin_lq035_fb) < 0) {
                 pr_err("unable to register framebuffer\n");
-                free_dma(CH_PPI);
-                free_ports();
-                dma_free_coherent(NULL, TOTAL_VIDEO_MEM_SIZE, fb_buffer, 0);
-                fb_buffer = NULL;
-                kfree(bfin_lq035_fb.pseudo_palette);
-                fb_dealloc_cmap(&bfin_lq035_fb.cmap);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_reg;
         }
 
         i2c_add_driver(&ad5280_driver);
@@ -807,11 +795,31 @@ static int __devinit bfin_lq035_probe(struct platform_device *pdev)
 
         lcd_dev = lcd_device_register(KBUILD_MODNAME, &pdev->dev, NULL,
                                       &bfin_lcd_ops);
+        if (IS_ERR(lcd_dev)) {
+                pr_err("unable to register lcd\n");
+                ret = PTR_ERR(lcd_dev);
+                goto out_lcd;
+        }
         lcd_dev->props.max_contrast = 255,
 
         pr_info("initialized");
 
         return 0;
+out_lcd:
+        unregister_framebuffer(&bfin_lq035_fb);
+out_reg:
+        fb_dealloc_cmap(&bfin_lq035_fb.cmap);
+out_cmap:
+        kfree(bfin_lq035_fb.pseudo_palette);
+out_palette:
+out_table:
+        dma_free_coherent(NULL, TOTAL_VIDEO_MEM_SIZE, fb_buffer, 0);
+        fb_buffer = NULL;
+out_dma_coherent:
+        free_ports();
+out_ports:
+        free_dma(CH_PPI);
+        return ret;
 }
 
 static int __devexit bfin_lq035_remove(struct platform_device *pdev)
diff --git a/drivers/video/chipsfb.c b/drivers/video/chipsfb.c
index d637e1f5317..cff742abdc5 100644
--- a/drivers/video/chipsfb.c
+++ b/drivers/video/chipsfb.c
@@ -460,10 +460,10 @@ static int chipsfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         if (!(state.event & PM_EVENT_SLEEP))
                 goto done;
 
-        acquire_console_sem();
+        console_lock();
         chipsfb_blank(1, p);
         fb_set_suspend(p, 1);
-        release_console_sem();
+        console_unlock();
  done:
         pdev->dev.power.power_state = state;
         return 0;
@@ -473,10 +473,10 @@ static int chipsfb_pci_resume(struct pci_dev *pdev)
 {
         struct fb_info *p = pci_get_drvdata(pdev);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(p, 0);
         chipsfb_blank(0, p);
-        release_console_sem();
+        console_unlock();
 
         pdev->dev.power.power_state = PMSG_ON;
         return 0;
diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
index 5a35f22372b..2209e354f53 100644
--- a/drivers/video/console/Kconfig
+++ b/drivers/video/console/Kconfig
@@ -5,7 +5,7 @@
 menu "Console display driver support"
 
 config VGA_CONSOLE
-        bool "VGA text console" if EMBEDDED || !X86
+        bool "VGA text console" if EXPERT || !X86
         depends on !4xx && !8xx && !SPARC && !M68K && !PARISC && !FRV && !SUPERH && !BLACKFIN && !AVR32 && !MN10300 && (!ARM || ARCH_FOOTBRIDGE || ARCH_INTEGRATOR || ARCH_NETWINDER)
         default y
         help
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 7ccc967831f..9c092b8d64e 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -375,14 +375,14 @@ static void fb_flashcursor(struct work_struct *work)
         int c;
         int mode;
 
-        acquire_console_sem();
+        console_lock();
         if (ops && ops->currcon != -1)
                 vc = vc_cons[ops->currcon].d;
 
         if (!vc || !CON_IS_VISIBLE(vc) ||
             registered_fb[con2fb_map[vc->vc_num]] != info ||
             vc->vc_deccm != 1) {
-                release_console_sem();
+                console_unlock();
                 return;
         }
 
@@ -392,7 +392,7 @@ static void fb_flashcursor(struct work_struct *work)
                 CM_ERASE : CM_DRAW;
         ops->cursor(vc, info, mode, softback_lines, get_color(vc, info, c, 1),
                     get_color(vc, info, c, 0));
-        release_console_sem();
+        console_unlock();
 }
 
 static void cursor_timer_handler(unsigned long dev_addr)
@@ -836,7 +836,7 @@ static int set_con2fb_map(int unit, int newidx, int user)
 
         found = search_fb_in_map(newidx);
 
-        acquire_console_sem();
+        console_lock();
         con2fb_map[unit] = newidx;
         if (!err && !found)
                 err = con2fb_acquire_newinfo(vc, info, unit, oldidx);
@@ -863,7 +863,7 @@ static int set_con2fb_map(int unit, int newidx, int user)
         if (!search_fb_in_map(info_idx))
                 info_idx = newidx;
 
-        release_console_sem();
+        console_unlock();
         return err;
 }
 
@@ -3321,7 +3321,7 @@ static ssize_t store_rotate(struct device *device,
         if (fbcon_has_exited)
                 return count;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3331,7 +3331,7 @@ static ssize_t store_rotate(struct device *device,
         rotate = simple_strtoul(buf, last, 0);
         fbcon_rotate(info, rotate);
 err:
-        release_console_sem();
+        console_unlock();
         return count;
 }
 
@@ -3346,7 +3346,7 @@ static ssize_t store_rotate_all(struct device *device,
         if (fbcon_has_exited)
                 return count;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3356,7 +3356,7 @@ static ssize_t store_rotate_all(struct device *device,
         rotate = simple_strtoul(buf, last, 0);
         fbcon_rotate_all(info, rotate);
 err:
-        release_console_sem();
+        console_unlock();
         return count;
 }
 
@@ -3369,7 +3369,7 @@ static ssize_t show_rotate(struct device *device,
         if (fbcon_has_exited)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3378,7 +3378,7 @@ static ssize_t show_rotate(struct device *device,
         info = registered_fb[idx];
         rotate = fbcon_get_rotate(info);
 err:
-        release_console_sem();
+        console_unlock();
         return snprintf(buf, PAGE_SIZE, "%d\n", rotate);
 }
 
@@ -3392,7 +3392,7 @@ static ssize_t show_cursor_blink(struct device *device,
         if (fbcon_has_exited)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3406,7 +3406,7 @@ static ssize_t show_cursor_blink(struct device *device,
 
         blink = (ops->flags & FBCON_FLAGS_CURSOR_TIMER) ? 1 : 0;
 err:
-        release_console_sem();
+        console_unlock();
         return snprintf(buf, PAGE_SIZE, "%d\n", blink);
 }
 
@@ -3421,7 +3421,7 @@ static ssize_t store_cursor_blink(struct device *device,
         if (fbcon_has_exited)
                 return count;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3443,7 +3443,7 @@ static ssize_t store_cursor_blink(struct device *device,
         }
 
 err:
-        release_console_sem();
+        console_unlock();
         return count;
 }
 
@@ -3482,7 +3482,7 @@ static void fbcon_start(void)
         if (num_registered_fb) {
                 int i;
 
-                acquire_console_sem();
+                console_lock();
 
                 for (i = 0; i < FB_MAX; i++) {
                         if (registered_fb[i] != NULL) {
@@ -3491,7 +3491,7 @@ static void fbcon_start(void)
                         }
                 }
 
-                release_console_sem();
+                console_unlock();
                 fbcon_takeover(0);
         }
 }
@@ -3552,7 +3552,7 @@ static int __init fb_console_init(void)
 {
         int i;
 
-        acquire_console_sem();
+        console_lock();
         fb_register_client(&fbcon_event_notifier);
         fbcon_device = device_create(fb_class, NULL, MKDEV(0, 0), NULL,
                                      "fbcon");
@@ -3568,7 +3568,7 @@ static int __init fb_console_init(void)
         for (i = 0; i < MAX_NR_CONSOLES; i++)
                 con2fb_map[i] = -1;
 
-        release_console_sem();
+        console_unlock();
         fbcon_start();
         return 0;
 }
@@ -3591,12 +3591,12 @@ static void __exit fbcon_deinit_device(void)
 
 static void __exit fb_console_exit(void)
 {
-        acquire_console_sem();
+        console_lock();
         fb_unregister_client(&fbcon_event_notifier);
         fbcon_deinit_device();
         device_destroy(fb_class, MKDEV(0, 0));
         fbcon_exit();
-        release_console_sem();
+        console_unlock();
         unregister_con_driver(&fb_con);
 }       
 
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index c97491b8b39..915fd74da7a 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -202,11 +202,7 @@ static void vgacon_scrollback_init(int pitch)
         }
 }
 
-/*
- * Called only duing init so call of alloc_bootmen is ok.
- * Marked __init_refok to silence modpost.
- */
-static void __init_refok vgacon_scrollback_startup(void)
+static void vgacon_scrollback_startup(void)
 {
         vgacon_scrollback = kcalloc(CONFIG_VGACON_SOFT_SCROLLBACK_SIZE, 1024, GFP_NOWAIT);
         vgacon_scrollback_init(vga_video_num_columns * 2);
diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c
index c265aed09e0..8d61ef96eed 100644
--- a/drivers/video/da8xx-fb.c
+++ b/drivers/video/da8xx-fb.c
@@ -1092,9 +1092,10 @@ static int __init fb_probe(struct platform_device *device)
 
 irq_freq:
 #ifdef CONFIG_CPU_FREQ
+        lcd_da8xx_cpufreq_deregister(par);
+#endif
 err_cpu_freq:
         unregister_framebuffer(da8xx_fb_info);
-#endif
 
 err_dealloc_cmap:
         fb_dealloc_cmap(&da8xx_fb_info->cmap);
@@ -1130,14 +1131,14 @@ static int fb_suspend(struct platform_device *dev, pm_message_t state)
         struct fb_info *info = platform_get_drvdata(dev);
         struct da8xx_fb_par *par = info->par;
 
-        acquire_console_sem();
+        console_lock();
         if (par->panel_power_ctrl)
                 par->panel_power_ctrl(0);
 
         fb_set_suspend(info, 1);
         lcd_disable_raster();
         clk_disable(par->lcdc_clk);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -1146,14 +1147,14 @@ static int fb_resume(struct platform_device *dev)
         struct fb_info *info = platform_get_drvdata(dev);
         struct da8xx_fb_par *par = info->par;
 
-        acquire_console_sem();
+        console_lock();
         if (par->panel_power_ctrl)
                 par->panel_power_ctrl(1);
 
         clk_enable(par->lcdc_clk);
         lcd_enable_raster();
         fb_set_suspend(info, 0);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 4ac1201ad6c..e2bf95370e4 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1036,11 +1036,11 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
                         return -EFAULT;
                 if (!lock_fb_info(info))
                         return -ENODEV;
-                acquire_console_sem();
+                console_lock();
                 info->flags |= FBINFO_MISC_USEREVENT;
                 ret = fb_set_var(info, &var);
                 info->flags &= ~FBINFO_MISC_USEREVENT;
-                release_console_sem();
+                console_unlock();
                 unlock_fb_info(info);
                 if (!ret && copy_to_user(argp, &var, sizeof(var)))
                         ret = -EFAULT;
@@ -1072,9 +1072,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
                         return -EFAULT;
                 if (!lock_fb_info(info))
                         return -ENODEV;
-                acquire_console_sem();
+                console_lock();
                 ret = fb_pan_display(info, &var);
-                release_console_sem();
+                console_unlock();
                 unlock_fb_info(info);
                 if (ret == 0 && copy_to_user(argp, &var, sizeof(var)))
                         return -EFAULT;
@@ -1119,11 +1119,11 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
         case FBIOBLANK:
                 if (!lock_fb_info(info))
                         return -ENODEV;
-                acquire_console_sem();
+                console_lock();
                 info->flags |= FBINFO_MISC_USEREVENT;
                 ret = fb_blank(info, arg);
                 info->flags &= ~FBINFO_MISC_USEREVENT;
-                release_console_sem();
+                console_unlock();
                 unlock_fb_info(info);
                 break;
         default:
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c
index 0a08f134122..f4a32779168 100644
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbsysfs.c
@@ -90,11 +90,11 @@ static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var)
         int err;
 
         var->activate |= FB_ACTIVATE_FORCE;
-        acquire_console_sem();
+        console_lock();
         fb_info->flags |= FBINFO_MISC_USEREVENT;
         err = fb_set_var(fb_info, var);
         fb_info->flags &= ~FBINFO_MISC_USEREVENT;
-        release_console_sem();
+        console_unlock();
         if (err)
                 return err;
         return 0;
@@ -175,7 +175,7 @@ static ssize_t store_modes(struct device *device,
         if (i * sizeof(struct fb_videomode) != count)
                 return -EINVAL;
 
-        acquire_console_sem();
+        console_lock();
         list_splice(&fb_info->modelist, &old_list);
         fb_videomode_to_modelist((const struct fb_videomode *)buf, i,
                                  &fb_info->modelist);
@@ -185,7 +185,7 @@ static ssize_t store_modes(struct device *device,
         } else
                 fb_destroy_modelist(&old_list);
 
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -301,11 +301,11 @@ static ssize_t store_blank(struct device *device,
         char *last = NULL;
         int err;
 
-        acquire_console_sem();
+        console_lock();
         fb_info->flags |= FBINFO_MISC_USEREVENT;
         err = fb_blank(fb_info, simple_strtoul(buf, &last, 0));
         fb_info->flags &= ~FBINFO_MISC_USEREVENT;
-        release_console_sem();
+        console_unlock();
         if (err < 0)
                 return err;
         return count;
@@ -364,9 +364,9 @@ static ssize_t store_pan(struct device *device,
                 return -EINVAL;
         var.yoffset = simple_strtoul(last, &last, 0);
 
-        acquire_console_sem();
+        console_lock();
         err = fb_pan_display(fb_info, &var);
-        release_console_sem();
+        console_unlock();
 
         if (err < 0)
                 return err;
@@ -399,9 +399,9 @@ static ssize_t store_fbstate(struct device *device,
 
         state = simple_strtoul(buf, &last, 0);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(fb_info, (int)state);
-        release_console_sem();
+        console_unlock();
 
         return count;
 }
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 70b1d9d51c9..b4f19db9bb5 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -344,10 +344,10 @@ static int gxfb_suspend(struct pci_dev *pdev, pm_message_t state)
         struct fb_info *info = pci_get_drvdata(pdev);
 
         if (state.event == PM_EVENT_SUSPEND) {
-                acquire_console_sem();
+                console_lock();
                 gx_powerdown(info);
                 fb_set_suspend(info, 1);
-                release_console_sem();
+                console_unlock();
         }
 
         /* there's no point in setting PCI states; we emulate PCI, so
@@ -361,7 +361,7 @@ static int gxfb_resume(struct pci_dev *pdev)
         struct fb_info *info = pci_get_drvdata(pdev);
         int ret;
 
-        acquire_console_sem();
+        console_lock();
         ret = gx_powerup(info);
         if (ret) {
                 printk(KERN_ERR "gxfb:  power up failed!\n");
@@ -369,7 +369,7 @@ static int gxfb_resume(struct pci_dev *pdev)
         }
 
         fb_set_suspend(info, 0);
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 #endif
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/geode/lxfb_core.c
index 39bdbedf43b..416851ca875 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/geode/lxfb_core.c
@@ -465,10 +465,10 @@ static int lxfb_suspend(struct pci_dev *pdev, pm_message_t state)
         struct fb_info *info = pci_get_drvdata(pdev);
 
         if (state.event == PM_EVENT_SUSPEND) {
-                acquire_console_sem();
+                console_lock();
                 lx_powerdown(info);
                 fb_set_suspend(info, 1);
-                release_console_sem();
+                console_unlock();
         }
 
         /* there's no point in setting PCI states; we emulate PCI, so
@@ -482,7 +482,7 @@ static int lxfb_resume(struct pci_dev *pdev)
         struct fb_info *info = pci_get_drvdata(pdev);
         int ret;
 
-        acquire_console_sem();
+        console_lock();
         ret = lx_powerup(info);
         if (ret) {
                 printk(KERN_ERR "lxfb:  power up failed!\n");
@@ -490,7 +490,7 @@ static int lxfb_resume(struct pci_dev *pdev)
         }
 
         fb_set_suspend(info, 0);
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 #else
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index 5743ea25e81..318f6fb895b 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -1574,7 +1574,7 @@ static int i810fb_suspend(struct pci_dev *dev, pm_message_t mesg)
                 return 0;
         }
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(info, 1);
 
         if (info->fbops->fb_sync)
@@ -1587,7 +1587,7 @@ static int i810fb_suspend(struct pci_dev *dev, pm_message_t mesg)
         pci_save_state(dev);
         pci_disable_device(dev);
         pci_set_power_state(dev, pci_choose_state(dev, mesg));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -1605,7 +1605,7 @@ static int i810fb_resume(struct pci_dev *dev)
                 return 0;
         }
 
-        acquire_console_sem();
+        console_lock();
         pci_set_power_state(dev, PCI_D0);
         pci_restore_state(dev);
 
@@ -1621,7 +1621,7 @@ static int i810fb_resume(struct pci_dev *dev)
         fb_set_suspend (info, 0);
         info->fbops->fb_blank(VESA_NO_BLANKING, info);
 fail:
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 /***********************************************************************
diff --git a/drivers/video/jz4740_fb.c b/drivers/video/jz4740_fb.c
index 670ecaa0385..de366937c93 100644
--- a/drivers/video/jz4740_fb.c
+++ b/drivers/video/jz4740_fb.c
@@ -778,9 +778,9 @@ static int jzfb_suspend(struct device *dev)
 {
         struct jzfb *jzfb = dev_get_drvdata(dev);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(jzfb->fb, 1);
-        release_console_sem();
+        console_unlock();
 
         mutex_lock(&jzfb->lock);
         if (jzfb->is_enabled)
@@ -800,9 +800,9 @@ static int jzfb_resume(struct device *dev)
                 jzfb_enable(jzfb);
         mutex_unlock(&jzfb->lock);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(jzfb->fb, 0);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index cb013919e9c..7e3a490e8d7 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -1177,9 +1177,9 @@ static int mx3fb_suspend(struct platform_device *pdev, pm_message_t state)
         struct mx3fb_data *mx3fb = platform_get_drvdata(pdev);
         struct mx3fb_info *mx3_fbi = mx3fb->fbi->par;
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(mx3fb->fbi, 1);
-        release_console_sem();
+        console_unlock();
 
         if (mx3_fbi->blank == FB_BLANK_UNBLANK) {
                 sdc_disable_channel(mx3_fbi);
@@ -1202,9 +1202,9 @@ static int mx3fb_resume(struct platform_device *pdev)
                 sdc_set_brightness(mx3fb, mx3fb->backlight_level);
         }
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(mx3fb->fbi, 0);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index 62498bd662f..f838d9e277f 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -696,6 +696,8 @@ static int nuc900fb_remove(struct platform_device *pdev)
         nuc900fb_stop_lcd(fbinfo);
         msleep(1);
 
+        unregister_framebuffer(fbinfo);
+        nuc900fb_cpufreq_deregister(fbi);
         nuc900fb_unmap_video_memory(fbinfo);
 
         iounmap(fbi->io);
@@ -723,7 +725,7 @@ static int nuc900fb_suspend(struct platform_device *dev, pm_message_t state)
         struct fb_info     *fbinfo = platform_get_drvdata(dev);
         struct nuc900fb_info *info = fbinfo->par;
 
-        nuc900fb_stop_lcd();
+        nuc900fb_stop_lcd(fbinfo);
         msleep(1);
         clk_disable(info->clk);
         return 0;
@@ -740,7 +742,7 @@ static int nuc900fb_resume(struct platform_device *dev)
         msleep(1);
 
         nuc900fb_init_registers(fbinfo);
-        nuc900fb_activate_var(bfinfo);
+        nuc900fb_activate_var(fbinfo);
 
         return 0;
 }
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index efe10ff86d6..081dc474527 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1057,7 +1057,7 @@ static int nvidiafb_suspend(struct pci_dev *dev, pm_message_t mesg)
 
         if (mesg.event == PM_EVENT_PRETHAW)
                 mesg.event = PM_EVENT_FREEZE;
-        acquire_console_sem();
+        console_lock();
         par->pm_state = mesg.event;
 
         if (mesg.event & PM_EVENT_SLEEP) {
@@ -1070,7 +1070,7 @@ static int nvidiafb_suspend(struct pci_dev *dev, pm_message_t mesg)
         }
         dev->dev.power.power_state = mesg;
 
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 
@@ -1079,7 +1079,7 @@ static int nvidiafb_resume(struct pci_dev *dev)
         struct fb_info *info = pci_get_drvdata(dev);
         struct nvidia_par *par = info->par;
 
-        acquire_console_sem();
+        console_lock();
         pci_set_power_state(dev, PCI_D0);
 
         if (par->pm_state != PM_EVENT_FREEZE) {
@@ -1097,7 +1097,7 @@ static int nvidiafb_resume(struct pci_dev *dev)
         nvidiafb_blank(FB_BLANK_UNBLANK, info);
 
 fail:
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 #else
diff --git a/drivers/video/ps3fb.c b/drivers/video/ps3fb.c
index 9c0144ee7ae..65560a1a043 100644
--- a/drivers/video/ps3fb.c
+++ b/drivers/video/ps3fb.c
@@ -513,9 +513,9 @@ static int ps3fb_release(struct fb_info *info, int user)
         if (atomic_dec_and_test(&ps3fb.f_count)) {
                 if (atomic_read(&ps3fb.ext_flip)) {
                         atomic_set(&ps3fb.ext_flip, 0);
-                        if (!try_acquire_console_sem()) {
+                        if (console_trylock()) {
                                 ps3fb_sync(info, 0);    /* single buffer */
-                                release_console_sem();
+                                console_unlock();
                         }
                 }
         }
@@ -830,14 +830,14 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd,
                         if (vmode) {
                                 var = info->var;
                                 fb_videomode_to_var(&var, vmode);
-                                acquire_console_sem();
+                                console_lock();
                                 info->flags |= FBINFO_MISC_USEREVENT;
                                 /* Force, in case only special bits changed */
                                 var.activate |= FB_ACTIVATE_FORCE;
                                 par->new_mode_id = val;
                                 retval = fb_set_var(info, &var);
                                 info->flags &= ~FBINFO_MISC_USEREVENT;
-                                release_console_sem();
+                                console_unlock();
                         }
                         break;
                 }
@@ -881,9 +881,9 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd,
                         break;
 
                 dev_dbg(info->device, "PS3FB_IOCTL_FSEL:%d\n", val);
-                acquire_console_sem();
+                console_lock();
                 retval = ps3fb_sync(info, val);
-                release_console_sem();
+                console_unlock();
                 break;
 
         default:
@@ -903,9 +903,9 @@ static int ps3fbd(void *arg)
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (ps3fb.is_kicked) {
                         ps3fb.is_kicked = 0;
-                        acquire_console_sem();
+                        console_lock();
                         ps3fb_sync(info, 0);    /* single buffer */
-                        release_console_sem();
+                        console_unlock();
                 }
                 schedule();
         }
diff --git a/drivers/video/pxa168fb.c b/drivers/video/pxa168fb.c
index cea6403ae71..35f61dd0cb3 100644
--- a/drivers/video/pxa168fb.c
+++ b/drivers/video/pxa168fb.c
@@ -701,16 +701,12 @@ static int __devinit pxa168fb_probe(struct platform_device *pdev)
          */
         pxa168fb_init_mode(info, mi);
 
-        ret = pxa168fb_check_var(&info->var, info);
-        if (ret)
-                goto failed_free_fbmem;
-
         /*
          * Fill in sane defaults.
          */
         ret = pxa168fb_check_var(&info->var, info);
         if (ret)
-                goto failed;
+                goto failed_free_fbmem;
 
         /*
          * enable controller clock
diff --git a/drivers/video/pxa3xx-gcu.c b/drivers/video/pxa3xx-gcu.c
index b81168df253..cf4beb9dc9b 100644
--- a/drivers/video/pxa3xx-gcu.c
+++ b/drivers/video/pxa3xx-gcu.c
@@ -1,5 +1,5 @@
 /*
- *  pxa3xx-gc.c - Linux kernel module for PXA3xx graphics controllers
+ *  pxa3xx-gcu.c - Linux kernel module for PXA3xx graphics controllers
  *
  *  This driver needs a DirectFB counterpart in user space, communication
  *  is handled via mmap()ed memory areas and an ioctl.
@@ -421,7 +421,7 @@ pxa3xx_gcu_misc_write(struct file *filp, const char *buff,
                 buffer->next = priv->free;
                 priv->free = buffer;
                 spin_unlock_irqrestore(&priv->spinlock, flags);
-                return ret;
+                return -EFAULT;
         }
 
         buffer->length = words;
diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
index dce8c97b433..75738a92861 100644
--- a/drivers/video/s3fb.c
+++ b/drivers/video/s3fb.c
@@ -22,7 +22,7 @@
 #include <linux/svga.h>
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <linux/console.h> /* Why should fb driver call console functions? because acquire_console_sem() */
+#include <linux/console.h> /* Why should fb driver call console functions? because console_lock() */
 #include <video/vga.h>
 
 #ifdef CONFIG_MTRR
@@ -1113,12 +1113,12 @@ static int s3_pci_suspend(struct pci_dev* dev, pm_message_t state)
 
         dev_info(info->device, "suspend\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if ((state.event == PM_EVENT_FREEZE) || (par->ref_count == 0)) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -1129,7 +1129,7 @@ static int s3_pci_suspend(struct pci_dev* dev, pm_message_t state)
         pci_set_power_state(dev, pci_choose_state(dev, state));
 
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -1145,12 +1145,12 @@ static int s3_pci_resume(struct pci_dev* dev)
 
         dev_info(info->device, "resume\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if (par->ref_count == 0) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -1159,7 +1159,7 @@ static int s3_pci_resume(struct pci_dev* dev)
         err = pci_enable_device(dev);
         if (err) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 dev_err(info->device, "error %d enabling device for resume\n", err);
                 return err;
         }
@@ -1169,7 +1169,7 @@ static int s3_pci_resume(struct pci_dev* dev)
         fb_set_suspend(info, 0);
 
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 842d157e102..487911e2926 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -2373,7 +2373,7 @@ static int savagefb_suspend(struct pci_dev *dev, pm_message_t mesg)
         if (mesg.event == PM_EVENT_FREEZE)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(info, 1);
 
         if (info->fbops->fb_sync)
@@ -2385,7 +2385,7 @@ static int savagefb_suspend(struct pci_dev *dev, pm_message_t mesg)
         pci_save_state(dev);
         pci_disable_device(dev);
         pci_set_power_state(dev, pci_choose_state(dev, mesg));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -2409,7 +2409,7 @@ static int savagefb_resume(struct pci_dev* dev)
                 return 0;
         }
 
-        acquire_console_sem();
+        console_lock();
 
         pci_set_power_state(dev, PCI_D0);
         pci_restore_state(dev);
@@ -2423,7 +2423,7 @@ static int savagefb_resume(struct pci_dev* dev)
         savagefb_set_par(info);
         fb_set_suspend(info, 0);
         savagefb_blank(FB_BLANK_UNBLANK, info);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/sh_mobile_hdmi.c b/drivers/video/sh_mobile_hdmi.c
index 74d9f546a2e..2b9e56a6bde 100644
--- a/drivers/video/sh_mobile_hdmi.c
+++ b/drivers/video/sh_mobile_hdmi.c
@@ -1151,7 +1151,7 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
 
                 ch = info->par;
 
-                acquire_console_sem();
+                console_lock();
 
                 /* HDMI plug in */
                 if (!sh_hdmi_must_reconfigure(hdmi) &&
@@ -1171,7 +1171,7 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
                         fb_set_suspend(info, 0);
                 }
 
-                release_console_sem();
+                console_unlock();
         } else {
                 ret = 0;
                 if (!hdmi->info)
@@ -1181,12 +1181,12 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
                 fb_destroy_modedb(hdmi->monspec.modedb);
                 hdmi->monspec.modedb = NULL;
 
-                acquire_console_sem();
+                console_lock();
 
                 /* HDMI disconnect */
                 fb_set_suspend(hdmi->info, 1);
 
-                release_console_sem();
+                console_unlock();
                 pm_runtime_put(hdmi->dev);
         }
 
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index bd4840a8a6b..bf12e53aed5 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -912,9 +912,9 @@ static int sh_mobile_release(struct fb_info *info, int user)
 
         /* Nothing to reconfigure, when called from fbcon */
         if (user) {
-                acquire_console_sem();
+                console_lock();
                 sh_mobile_fb_reconfig(info);
-                release_console_sem();
+                console_unlock();
         }
 
         mutex_unlock(&ch->open_lock);
diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c
index b7dc1800efa..bcb44a594eb 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/sm501fb.c
@@ -2010,9 +2010,9 @@ static int sm501fb_suspend_fb(struct sm501fb_info *info,
 
         /* tell console/fb driver we are suspending */
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(fbi, 1);
-        release_console_sem();
+        console_unlock();
 
         /* backup copies in case chip is powered down over suspend */
 
@@ -2069,9 +2069,9 @@ static void sm501fb_resume_fb(struct sm501fb_info *info,
                 memcpy_toio(par->cursor.k_addr, par->store_cursor,
                             par->cursor.size);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(fbi, 0);
-        release_console_sem();
+        console_unlock();
 
         vfree(par->store_fb);
         vfree(par->store_cursor);
diff --git a/drivers/video/tmiofb.c b/drivers/video/tmiofb.c
index 6913fe168c2..dfef88c803d 100644
--- a/drivers/video/tmiofb.c
+++ b/drivers/video/tmiofb.c
@@ -25,7 +25,7 @@
 #include <linux/fb.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
-/* Why should fb driver call console functions? because acquire_console_sem() */
+/* Why should fb driver call console functions? because console_lock() */
 #include <linux/console.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/tmio.h>
@@ -944,7 +944,7 @@ static int tmiofb_suspend(struct platform_device *dev, pm_message_t state)
         struct mfd_cell *cell = dev->dev.platform_data;
         int retval = 0;
 
-        acquire_console_sem();
+        console_lock();
 
         fb_set_suspend(info, 1);
 
@@ -965,7 +965,7 @@ static int tmiofb_suspend(struct platform_device *dev, pm_message_t state)
         if (cell->suspend)
                 retval = cell->suspend(dev);
 
-        release_console_sem();
+        console_unlock();
 
         return retval;
 }
@@ -976,7 +976,7 @@ static int tmiofb_resume(struct platform_device *dev)
         struct mfd_cell *cell = dev->dev.platform_data;
         int retval = 0;
 
-        acquire_console_sem();
+        console_lock();
 
         if (cell->resume) {
                 retval = cell->resume(dev);
@@ -992,7 +992,7 @@ static int tmiofb_resume(struct platform_device *dev)
 
         fb_set_suspend(info, 0);
 out:
-        release_console_sem();
+        console_unlock();
         return retval;
 }
 #else
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index 289edd51952..4e66349e436 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -1674,17 +1674,17 @@ static int parse_mode(const char *str, u32 *xres, u32 *yres)
 #ifdef CONFIG_PM
 static int viafb_suspend(void *unused)
 {
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(viafbinfo, 1);
         viafb_sync(viafbinfo);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
 
 static int viafb_resume(void *unused)
 {
-        acquire_console_sem();
+        console_lock();
         if (viaparinfo->shared->vdev->engine_mmio)
                 viafb_reset_engine(viaparinfo);
         viafb_set_par(viafbinfo);
@@ -1692,7 +1692,7 @@ static int viafb_resume(void *unused)
                 viafb_set_par(viafbinfo1);
         fb_set_suspend(viafbinfo, 0);
 
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 
diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c
index 85d76ec4c63..a2965ab92cf 100644
--- a/drivers/video/vt8623fb.c
+++ b/drivers/video/vt8623fb.c
@@ -23,7 +23,7 @@
 #include <linux/svga.h>
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <linux/console.h> /* Why should fb driver call console functions? because acquire_console_sem() */
+#include <linux/console.h> /* Why should fb driver call console functions? because console_lock() */
 #include <video/vga.h>
 
 #ifdef CONFIG_MTRR
@@ -819,12 +819,12 @@ static int vt8623_pci_suspend(struct pci_dev* dev, pm_message_t state)
 
         dev_info(info->device, "suspend\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if ((state.event == PM_EVENT_FREEZE) || (par->ref_count == 0)) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -835,7 +835,7 @@ static int vt8623_pci_suspend(struct pci_dev* dev, pm_message_t state)
         pci_set_power_state(dev, pci_choose_state(dev, state));
 
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -850,7 +850,7 @@ static int vt8623_pci_resume(struct pci_dev* dev)
 
         dev_info(info->device, "resume\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if (par->ref_count == 0)
@@ -869,7 +869,7 @@ static int vt8623_pci_resume(struct pci_dev* dev)
 
 fail:
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
index 3e6934d4bea..a20218c2fda 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/xen-fbfront.c
@@ -491,12 +491,12 @@ xenfb_make_preferred_console(void)
         if (console_set_on_cmdline)
                 return;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(c) {
                 if (!strcmp(c->name, "tty") && c->index == 0)
                         break;
         }
-        release_console_sem();
+        console_unlock();
         if (c) {
                 unregister_console(c);
                 c->flags |= CON_CONSDEV;
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index ef8d9d558fc..4fb5b2bf234 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -96,11 +96,6 @@ static struct pci_device_id virtio_pci_id_table[] = {
 
 MODULE_DEVICE_TABLE(pci, virtio_pci_id_table);
 
-/* A PCI device has it's own struct device and so does a virtio device so
- * we create a place for the virtio devices to show up in sysfs.  I think it
- * would make more sense for virtio to not insist on having it's own device. */
-static struct device *virtio_pci_root;
-
 /* Convert a generic virtio device to our structure */
 static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
 {
@@ -629,7 +624,7 @@ static int __devinit virtio_pci_probe(struct pci_dev *pci_dev,
         if (vp_dev == NULL)
                 return -ENOMEM;
 
-        vp_dev->vdev.dev.parent = virtio_pci_root;
+        vp_dev->vdev.dev.parent = &pci_dev->dev;
         vp_dev->vdev.dev.release = virtio_pci_release_dev;
         vp_dev->vdev.config = &virtio_pci_config_ops;
         vp_dev->pci_dev = pci_dev;
@@ -717,17 +712,7 @@ static struct pci_driver virtio_pci_driver = {
 
 static int __init virtio_pci_init(void)
 {
-        int err;
-
-        virtio_pci_root = root_device_register("virtio-pci");
-        if (IS_ERR(virtio_pci_root))
-                return PTR_ERR(virtio_pci_root);
-
-        err = pci_register_driver(&virtio_pci_driver);
-        if (err)
-                root_device_unregister(virtio_pci_root);
-
-        return err;
+        return pci_register_driver(&virtio_pci_driver);
 }
 
 module_init(virtio_pci_init);
@@ -735,7 +720,6 @@ module_init(virtio_pci_init);
 static void __exit virtio_pci_exit(void)
 {
         pci_unregister_driver(&virtio_pci_driver);
-        root_device_unregister(virtio_pci_root);
 }
 
 module_exit(virtio_pci_exit);
diff --git a/drivers/xen/xenfs/xenbus.c b/drivers/xen/xenfs/xenbus.c
index 1c1236087f7..bbd000f88af 100644
--- a/drivers/xen/xenfs/xenbus.c
+++ b/drivers/xen/xenfs/xenbus.c
@@ -122,6 +122,7 @@ static ssize_t xenbus_file_read(struct file *filp,
         int ret;
 
         mutex_lock(&u->reply_mutex);
+again:
         while (list_empty(&u->read_buffers)) {
                 mutex_unlock(&u->reply_mutex);
                 if (filp->f_flags & O_NONBLOCK)
@@ -144,7 +145,7 @@ static ssize_t xenbus_file_read(struct file *filp,
                 i += sz - ret;
                 rb->cons += sz - ret;
 
-                if (ret != sz) {
+                if (ret != 0) {
                         if (i == 0)
                                 i = -EFAULT;
                         goto out;
@@ -160,6 +161,8 @@ static ssize_t xenbus_file_read(struct file *filp,
                                         struct read_buffer, list);
                 }
         }
+        if (i == 0)
+                goto again;
 
 out:
         mutex_unlock(&u->reply_mutex);
@@ -407,6 +410,7 @@ static int xenbus_write_watch(unsigned msg_type, struct xenbus_file_priv *u)
 
                 mutex_lock(&u->reply_mutex);
                 rc = queue_reply(&u->read_buffers, &reply, sizeof(reply));
+                wake_up(&u->read_waitq);
                 mutex_unlock(&u->reply_mutex);
         }
 
@@ -455,7 +459,7 @@ static ssize_t xenbus_file_write(struct file *filp,
 
         ret = copy_from_user(u->u.buffer + u->len, ubuf, len);
 
-        if (ret == len) {
+        if (ret != 0) {
                 rc = -EFAULT;
                 goto out;
         }
@@ -488,21 +492,6 @@ static ssize_t xenbus_file_write(struct file *filp,
         msg_type = u->u.msg.type;
 
         switch (msg_type) {
-        case XS_TRANSACTION_START:
-        case XS_TRANSACTION_END:
-        case XS_DIRECTORY:
-        case XS_READ:
-        case XS_GET_PERMS:
-        case XS_RELEASE:
-        case XS_GET_DOMAIN_PATH:
-        case XS_WRITE:
-        case XS_MKDIR:
-        case XS_RM:
-        case XS_SET_PERMS:
-                /* Send out a transaction */
-                ret = xenbus_write_transaction(msg_type, u);
-                break;
-
         case XS_WATCH:
         case XS_UNWATCH:
                 /* (Un)Ask for some path to be watched for changes */
@@ -510,7 +499,8 @@ static ssize_t xenbus_file_write(struct file *filp,
                 break;
 
         default:
-                ret = -EINVAL;
+                /* Send out a transaction */
+                ret = xenbus_write_transaction(msg_type, u);
                 break;
         }
         if (ret != 0)
@@ -555,6 +545,7 @@ static int xenbus_file_release(struct inode *inode, struct file *filp)
         struct xenbus_file_priv *u = filp->private_data;
         struct xenbus_transaction_holder *trans, *tmp;
         struct watch_adapter *watch, *tmp_watch;
+        struct read_buffer *rb, *tmp_rb;
 
         /*
          * No need for locking here because there are no other users,
@@ -573,6 +564,10 @@ static int xenbus_file_release(struct inode *inode, struct file *filp)
                 free_watch_adapter(watch);
         }
 
+        list_for_each_entry_safe(rb, tmp_rb, &u->read_buffers, list) {
+                list_del(&rb->list);
+                kfree(rb);
+        }
         kfree(u);
 
         return 0;
diff --git a/fs/Kconfig b/fs/Kconfig
index 9a7921ae476..3db9caa57ed 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -50,7 +50,7 @@ config EXPORTFS
         tristate
 
 config FILE_LOCKING
-        bool "Enable POSIX file locking API" if EMBEDDED
+        bool "Enable POSIX file locking API" if EXPERT
         default y
         help
           This option enables standard file locking support, required
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index 15b5ca2a260..9c949348510 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -37,6 +37,9 @@ static struct posix_acl *btrfs_get_acl(struct inode *inode, int type)
         char *value = NULL;
         struct posix_acl *acl;
 
+        if (!IS_POSIXACL(inode))
+                return NULL;
+
         acl = get_cached_acl(inode, type);
         if (acl != ACL_NOT_CACHED)
                 return acl;
@@ -84,6 +87,9 @@ static int btrfs_xattr_acl_get(struct dentry *dentry, const char *name,
         struct posix_acl *acl;
         int ret = 0;
 
+        if (!IS_POSIXACL(dentry->d_inode))
+                return -EOPNOTSUPP;
+
         acl = btrfs_get_acl(dentry->d_inode, type);
 
         if (IS_ERR(acl))
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index f745287fbf2..4d2110eafe2 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -562,7 +562,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
         u64 em_len;
         u64 em_start;
         struct extent_map *em;
-        int ret;
+        int ret = -ENOMEM;
         u32 *sums;
 
         tree = &BTRFS_I(inode)->io_tree;
@@ -577,6 +577,9 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
 
         compressed_len = em->block_len;
         cb = kmalloc(compressed_bio_size(root, compressed_len), GFP_NOFS);
+        if (!cb)
+                goto out;
+
         atomic_set(&cb->pending_bios, 0);
         cb->errors = 0;
         cb->inode = inode;
@@ -597,13 +600,18 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
 
         nr_pages = (compressed_len + PAGE_CACHE_SIZE - 1) /
                                  PAGE_CACHE_SIZE;
-        cb->compressed_pages = kmalloc(sizeof(struct page *) * nr_pages,
+        cb->compressed_pages = kzalloc(sizeof(struct page *) * nr_pages,
                                        GFP_NOFS);
+        if (!cb->compressed_pages)
+                goto fail1;
+
         bdev = BTRFS_I(inode)->root->fs_info->fs_devices->latest_bdev;
 
         for (page_index = 0; page_index < nr_pages; page_index++) {
                 cb->compressed_pages[page_index] = alloc_page(GFP_NOFS |
                                                               __GFP_HIGHMEM);
+                if (!cb->compressed_pages[page_index])
+                        goto fail2;
         }
         cb->nr_pages = nr_pages;
 
@@ -614,6 +622,8 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
         cb->len = uncompressed_len;
 
         comp_bio = compressed_bio_alloc(bdev, cur_disk_byte, GFP_NOFS);
+        if (!comp_bio)
+                goto fail2;
         comp_bio->bi_private = cb;
         comp_bio->bi_end_io = end_compressed_bio_read;
         atomic_inc(&cb->pending_bios);
@@ -681,6 +691,17 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
 
         bio_put(comp_bio);
         return 0;
+
+fail2:
+        for (page_index = 0; page_index < nr_pages; page_index++)
+                free_page((unsigned long)cb->compressed_pages[page_index]);
+
+        kfree(cb->compressed_pages);
+fail1:
+        kfree(cb);
+out:
+        free_extent_map(em);
+        return ret;
 }
 
 static struct list_head comp_idle_workspace[BTRFS_COMPRESS_TYPES];
@@ -900,7 +921,7 @@ int btrfs_decompress(int type, unsigned char *data_in, struct page *dest_page,
         return ret;
 }
 
-void __exit btrfs_exit_compress(void)
+void btrfs_exit_compress(void)
 {
         free_workspaces();
 }
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index b531c36455d..fdce8799b98 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1550,6 +1550,7 @@ static int transaction_kthread(void *arg)
                 spin_unlock(&root->fs_info->new_trans_lock);
 
                 trans = btrfs_join_transaction(root, 1);
+                BUG_ON(IS_ERR(trans));
                 if (transid == trans->transid) {
                         ret = btrfs_commit_transaction(trans, root);
                         BUG_ON(ret);
@@ -2453,10 +2454,14 @@ int btrfs_commit_super(struct btrfs_root *root)
         up_write(&root->fs_info->cleanup_work_sem);
 
         trans = btrfs_join_transaction(root, 1);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
         ret = btrfs_commit_transaction(trans, root);
         BUG_ON(ret);
         /* run commit again to drop the original snapshot */
         trans = btrfs_join_transaction(root, 1);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
         btrfs_commit_transaction(trans, root);
         ret = btrfs_write_and_wait_transaction(NULL, root);
         BUG_ON(ret);
@@ -2554,6 +2559,8 @@ int close_ctree(struct btrfs_root *root)
         kfree(fs_info->chunk_root);
         kfree(fs_info->dev_root);
         kfree(fs_info->csum_root);
+        kfree(fs_info);
+
         return 0;
 }
 
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 9786963b07e..ff27d7a477b 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -171,6 +171,8 @@ static struct dentry *btrfs_get_parent(struct dentry *child)
         int ret;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return ERR_PTR(-ENOMEM);
 
         if (dir->i_ino == BTRFS_FIRST_FREE_OBJECTID) {
                 key.objectid = root->root_key.objectid;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b55269340ce..4e7e012ad66 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -320,11 +320,6 @@ static int caching_kthread(void *data)
         if (!path)
                 return -ENOMEM;
 
-        exclude_super_stripes(extent_root, block_group);
-        spin_lock(&block_group->space_info->lock);
-        block_group->space_info->bytes_readonly += block_group->bytes_super;
-        spin_unlock(&block_group->space_info->lock);
-
         last = max_t(u64, block_group->key.objectid, BTRFS_SUPER_INFO_OFFSET);
 
         /*
@@ -467,8 +462,10 @@ static int cache_block_group(struct btrfs_block_group_cache *cache,
                         cache->cached = BTRFS_CACHE_NO;
                 }
                 spin_unlock(&cache->lock);
-                if (ret == 1)
+                if (ret == 1) {
+                        free_excluded_extents(fs_info->extent_root, cache);
                         return 0;
+                }
         }
 
         if (load_cache_only)
@@ -3344,8 +3341,10 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
         u64 reserved;
         u64 max_reclaim;
         u64 reclaimed = 0;
+        long time_left;
         int pause = 1;
         int nr_pages = (2 * 1024 * 1024) >> PAGE_CACHE_SHIFT;
+        int loops = 0;
 
         block_rsv = &root->fs_info->delalloc_block_rsv;
         space_info = block_rsv->space_info;
@@ -3358,7 +3357,7 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
 
         max_reclaim = min(reserved, to_reclaim);
 
-        while (1) {
+        while (loops < 1024) {
                 /* have the flusher threads jump in and do some IO */
                 smp_mb();
                 nr_pages = min_t(unsigned long, nr_pages,
@@ -3366,8 +3365,12 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
                 writeback_inodes_sb_nr_if_idle(root->fs_info->sb, nr_pages);
 
                 spin_lock(&space_info->lock);
-                if (reserved > space_info->bytes_reserved)
+                if (reserved > space_info->bytes_reserved) {
+                        loops = 0;
                         reclaimed += reserved - space_info->bytes_reserved;
+                } else {
+                        loops++;
+                }
                 reserved = space_info->bytes_reserved;
                 spin_unlock(&space_info->lock);
 
@@ -3378,7 +3381,12 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
                         return -EAGAIN;
 
                 __set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(pause);
+                time_left = schedule_timeout(pause);
+
+                /* We were interrupted, exit */
+                if (time_left)
+                        break;
+
                 pause <<= 1;
                 if (pause > HZ / 10)
                         pause = HZ / 10;
@@ -3588,8 +3596,20 @@ void block_rsv_release_bytes(struct btrfs_block_rsv *block_rsv,
 
         if (num_bytes > 0) {
                 if (dest) {
-                        block_rsv_add_bytes(dest, num_bytes, 0);
-                } else {
+                        spin_lock(&dest->lock);
+                        if (!dest->full) {
+                                u64 bytes_to_add;
+
+                                bytes_to_add = dest->size - dest->reserved;
+                                bytes_to_add = min(num_bytes, bytes_to_add);
+                                dest->reserved += bytes_to_add;
+                                if (dest->reserved >= dest->size)
+                                        dest->full = 1;
+                                num_bytes -= bytes_to_add;
+                        }
+                        spin_unlock(&dest->lock);
+                }
+                if (num_bytes) {
                         spin_lock(&space_info->lock);
                         space_info->bytes_reserved -= num_bytes;
                         spin_unlock(&space_info->lock);
@@ -4012,6 +4032,7 @@ void btrfs_delalloc_release_metadata(struct inode *inode, u64 num_bytes)
 
         num_bytes = ALIGN(num_bytes, root->sectorsize);
         atomic_dec(&BTRFS_I(inode)->outstanding_extents);
+        WARN_ON(atomic_read(&BTRFS_I(inode)->outstanding_extents) < 0);
 
         spin_lock(&BTRFS_I(inode)->accounting_lock);
         nr_extents = atomic_read(&BTRFS_I(inode)->outstanding_extents);
@@ -5633,6 +5654,7 @@ use_block_rsv(struct btrfs_trans_handle *trans,
               struct btrfs_root *root, u32 blocksize)
 {
         struct btrfs_block_rsv *block_rsv;
+        struct btrfs_block_rsv *global_rsv = &root->fs_info->global_block_rsv;
         int ret;
 
         block_rsv = get_block_rsv(trans, root);
@@ -5640,14 +5662,39 @@ use_block_rsv(struct btrfs_trans_handle *trans,
         if (block_rsv->size == 0) {
                 ret = reserve_metadata_bytes(trans, root, block_rsv,
                                              blocksize, 0);
-                if (ret)
+                /*
+                 * If we couldn't reserve metadata bytes try and use some from
+                 * the global reserve.
+                 */
+                if (ret && block_rsv != global_rsv) {
+                        ret = block_rsv_use_bytes(global_rsv, blocksize);
+                        if (!ret)
+                                return global_rsv;
+                        return ERR_PTR(ret);
+                } else if (ret) {
                         return ERR_PTR(ret);
+                }
                 return block_rsv;
         }
 
         ret = block_rsv_use_bytes(block_rsv, blocksize);
         if (!ret)
                 return block_rsv;
+        if (ret) {
+                WARN_ON(1);
+                ret = reserve_metadata_bytes(trans, root, block_rsv, blocksize,
+                                             0);
+                if (!ret) {
+                        spin_lock(&block_rsv->lock);
+                        block_rsv->size += blocksize;
+                        spin_unlock(&block_rsv->lock);
+                        return block_rsv;
+                } else if (ret && block_rsv != global_rsv) {
+                        ret = block_rsv_use_bytes(global_rsv, blocksize);
+                        if (!ret)
+                                return global_rsv;
+                }
+        }
 
         return ERR_PTR(-ENOSPC);
 }
@@ -6221,6 +6268,8 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
         BUG_ON(!wc);
 
         trans = btrfs_start_transaction(tree_root, 0);
+        BUG_ON(IS_ERR(trans));
+
         if (block_rsv)
                 trans->block_rsv = block_rsv;
 
@@ -6318,6 +6367,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
 
                         btrfs_end_transaction_throttle(trans, tree_root);
                         trans = btrfs_start_transaction(tree_root, 0);
+                        BUG_ON(IS_ERR(trans));
                         if (block_rsv)
                                 trans->block_rsv = block_rsv;
                 }
@@ -6446,6 +6496,8 @@ static noinline int relocate_inode_pages(struct inode *inode, u64 start,
         int ret = 0;
 
         ra = kzalloc(sizeof(*ra), GFP_NOFS);
+        if (!ra)
+                return -ENOMEM;
 
         mutex_lock(&inode->i_mutex);
         first_index = start >> PAGE_CACHE_SHIFT;
@@ -7477,7 +7529,7 @@ int btrfs_drop_dead_reloc_roots(struct btrfs_root *root)
                 BUG_ON(reloc_root->commit_root != NULL);
                 while (1) {
                         trans = btrfs_join_transaction(root, 1);
-                        BUG_ON(!trans);
+                        BUG_ON(IS_ERR(trans));
 
                         mutex_lock(&root->fs_info->drop_mutex);
                         ret = btrfs_drop_snapshot(trans, reloc_root);
@@ -7535,7 +7587,7 @@ int btrfs_cleanup_reloc_trees(struct btrfs_root *root)
 
         if (found) {
                 trans = btrfs_start_transaction(root, 1);
-                BUG_ON(!trans);
+                BUG_ON(IS_ERR(trans));
                 ret = btrfs_commit_transaction(trans, root);
                 BUG_ON(ret);
         }
@@ -7779,7 +7831,7 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
 
 
         trans = btrfs_start_transaction(extent_root, 1);
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
 
         if (extent_key->objectid == 0) {
                 ret = del_extent_zero(trans, extent_root, path, extent_key);
@@ -8270,6 +8322,13 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                 if (block_group->cached == BTRFS_CACHE_STARTED)
                         wait_block_group_cache_done(block_group);
 
+                /*
+                 * We haven't cached this block group, which means we could
+                 * possibly have excluded extents on this block group.
+                 */
+                if (block_group->cached == BTRFS_CACHE_NO)
+                        free_excluded_extents(info->extent_root, block_group);
+
                 btrfs_remove_free_space_cache(block_group);
                 btrfs_put_block_group(block_group);
 
@@ -8385,6 +8444,13 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                 cache->sectorsize = root->sectorsize;
 
                 /*
+                 * We need to exclude the super stripes now so that the space
+                 * info has super bytes accounted for, otherwise we'll think
+                 * we have more space than we actually do.
+                 */
+                exclude_super_stripes(root, cache);
+
+                /*
                  * check for two cases, either we are full, and therefore
                  * don't need to bother with the caching work since we won't
                  * find any space, or we are empty, and we can just add all
@@ -8392,12 +8458,10 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                  * time, particularly in the full case.
                  */
                 if (found_key.offset == btrfs_block_group_used(&cache->item)) {
-                        exclude_super_stripes(root, cache);
                         cache->last_byte_to_unpin = (u64)-1;
                         cache->cached = BTRFS_CACHE_FINISHED;
                         free_excluded_extents(root, cache);
                 } else if (btrfs_block_group_used(&cache->item) == 0) {
-                        exclude_super_stripes(root, cache);
                         cache->last_byte_to_unpin = (u64)-1;
                         cache->cached = BTRFS_CACHE_FINISHED;
                         add_new_free_space(cache, root->fs_info,
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 2e993cf1766..5e76a474cb7 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1865,7 +1865,7 @@ static int submit_one_bio(int rw, struct bio *bio, int mirror_num,
         bio_get(bio);
 
         if (tree->ops && tree->ops->submit_bio_hook)
-                tree->ops->submit_bio_hook(page->mapping->host, rw, bio,
+                ret = tree->ops->submit_bio_hook(page->mapping->host, rw, bio,
                                            mirror_num, bio_flags, start);
         else
                 submit_bio(rw, bio);
@@ -1920,6 +1920,8 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
                 nr = bio_get_nr_vecs(bdev);
 
         bio = btrfs_bio_alloc(bdev, sector, nr, GFP_NOFS | __GFP_HIGH);
+        if (!bio)
+                return -ENOMEM;
 
         bio_add_page(bio, page, page_size, offset);
         bio->bi_end_io = end_io_func;
@@ -2126,7 +2128,7 @@ int extent_read_full_page(struct extent_io_tree *tree, struct page *page,
         ret = __extent_read_full_page(tree, page, get_extent, &bio, 0,
                                       &bio_flags);
         if (bio)
-                submit_one_bio(READ, bio, 0, bio_flags);
+                ret = submit_one_bio(READ, bio, 0, bio_flags);
         return ret;
 }
 
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index a562a250ae7..4f19a3e1bf3 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -536,6 +536,8 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
         root = root->fs_info->csum_root;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
 
         while (1) {
                 key.objectid = BTRFS_EXTENT_CSUM_OBJECTID;
@@ -548,7 +550,10 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
                         if (path->slots[0] == 0)
                                 goto out;
                         path->slots[0]--;
+                } else if (ret < 0) {
+                        goto out;
                 }
+
                 leaf = path->nodes[0];
                 btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index c800d58f301..c1d3a818731 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -793,8 +793,12 @@ again:
         for (i = 0; i < num_pages; i++) {
                 pages[i] = grab_cache_page(inode->i_mapping, index + i);
                 if (!pages[i]) {
-                        err = -ENOMEM;
-                        BUG_ON(1);
+                        int c;
+                        for (c = i - 1; c >= 0; c--) {
+                                unlock_page(pages[c]);
+                                page_cache_release(pages[c]);
+                        }
+                        return -ENOMEM;
                 }
                 wait_on_page_writeback(pages[i]);
         }
@@ -946,6 +950,10 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
                      PAGE_CACHE_SIZE, PAGE_CACHE_SIZE /
                      (sizeof(struct page *)));
         pages = kmalloc(nrptrs * sizeof(struct page *), GFP_KERNEL);
+        if (!pages) {
+                ret = -ENOMEM;
+                goto out;
+        }
 
         /* generic_write_checks can change our pos */
         start_pos = pos;
@@ -984,8 +992,8 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
                 size_t write_bytes = min(iov_iter_count(&i),
                                          nrptrs * (size_t)PAGE_CACHE_SIZE -
                                          offset);
-                size_t num_pages = (write_bytes + PAGE_CACHE_SIZE - 1) >>
-                                        PAGE_CACHE_SHIFT;
+                size_t num_pages = (write_bytes + offset +
+                                    PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
                 WARN_ON(num_pages > nrptrs);
                 memset(pages, 0, sizeof(struct page *) * nrptrs);
@@ -1015,8 +1023,8 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
 
                 copied = btrfs_copy_from_user(pos, num_pages,
                                            write_bytes, pages, &i);
-                dirty_pages = (copied + PAGE_CACHE_SIZE - 1) >>
-                                        PAGE_CACHE_SHIFT;
+                dirty_pages = (copied + offset + PAGE_CACHE_SIZE - 1) >>
+                                PAGE_CACHE_SHIFT;
 
                 if (num_pages > dirty_pages) {
                         if (copied > 0)
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 60d68426695..a0390657451 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -987,11 +987,18 @@ tree_search_offset(struct btrfs_block_group_cache *block_group,
         return entry;
 }
 
-static void unlink_free_space(struct btrfs_block_group_cache *block_group,
-                              struct btrfs_free_space *info)
+static inline void
+__unlink_free_space(struct btrfs_block_group_cache *block_group,
+                    struct btrfs_free_space *info)
 {
         rb_erase(&info->offset_index, &block_group->free_space_offset);
         block_group->free_extents--;
+}
+
+static void unlink_free_space(struct btrfs_block_group_cache *block_group,
+                              struct btrfs_free_space *info)
+{
+        __unlink_free_space(block_group, info);
         block_group->free_space -= info->bytes;
 }
 
@@ -1016,14 +1023,18 @@ static void recalculate_thresholds(struct btrfs_block_group_cache *block_group)
         u64 max_bytes;
         u64 bitmap_bytes;
         u64 extent_bytes;
+        u64 size = block_group->key.offset;
 
         /*
          * The goal is to keep the total amount of memory used per 1gb of space
          * at or below 32k, so we need to adjust how much memory we allow to be
          * used by extent based free space tracking
          */
-        max_bytes = MAX_CACHE_BYTES_PER_GIG *
-                (div64_u64(block_group->key.offset, 1024 * 1024 * 1024));
+        if (size < 1024 * 1024 * 1024)
+                max_bytes = MAX_CACHE_BYTES_PER_GIG;
+        else
+                max_bytes = MAX_CACHE_BYTES_PER_GIG *
+                        div64_u64(size, 1024 * 1024 * 1024);
 
         /*
          * we want to account for 1 more bitmap than what we have so we can make
@@ -1171,6 +1182,16 @@ static void add_new_bitmap(struct btrfs_block_group_cache *block_group,
         recalculate_thresholds(block_group);
 }
 
+static void free_bitmap(struct btrfs_block_group_cache *block_group,
+                        struct btrfs_free_space *bitmap_info)
+{
+        unlink_free_space(block_group, bitmap_info);
+        kfree(bitmap_info->bitmap);
+        kfree(bitmap_info);
+        block_group->total_bitmaps--;
+        recalculate_thresholds(block_group);
+}
+
 static noinline int remove_from_bitmap(struct btrfs_block_group_cache *block_group,
                               struct btrfs_free_space *bitmap_info,
                               u64 *offset, u64 *bytes)
@@ -1195,6 +1216,7 @@ again:
          */
         search_start = *offset;
         search_bytes = *bytes;
+        search_bytes = min(search_bytes, end - search_start + 1);
         ret = search_bitmap(block_group, bitmap_info, &search_start,
                             &search_bytes);
         BUG_ON(ret < 0 || search_start != *offset);
@@ -1211,13 +1233,8 @@ again:
 
         if (*bytes) {
                 struct rb_node *next = rb_next(&bitmap_info->offset_index);
-                if (!bitmap_info->bytes) {
-                        unlink_free_space(block_group, bitmap_info);
-                        kfree(bitmap_info->bitmap);
-                        kfree(bitmap_info);
-                        block_group->total_bitmaps--;
-                        recalculate_thresholds(block_group);
-                }
+                if (!bitmap_info->bytes)
+                        free_bitmap(block_group, bitmap_info);
 
                 /*
                  * no entry after this bitmap, but we still have bytes to
@@ -1250,13 +1267,8 @@ again:
                         return -EAGAIN;
 
                 goto again;
-        } else if (!bitmap_info->bytes) {
-                unlink_free_space(block_group, bitmap_info);
-                kfree(bitmap_info->bitmap);
-                kfree(bitmap_info);
-                block_group->total_bitmaps--;
-                recalculate_thresholds(block_group);
-        }
+        } else if (!bitmap_info->bytes)
+                free_bitmap(block_group, bitmap_info);
 
         return 0;
 }
@@ -1359,22 +1371,14 @@ out:
         return ret;
 }
 
-int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
-                         u64 offset, u64 bytes)
+bool try_merge_free_space(struct btrfs_block_group_cache *block_group,
+                          struct btrfs_free_space *info, bool update_stat)
 {
-        struct btrfs_free_space *right_info = NULL;
-        struct btrfs_free_space *left_info = NULL;
-        struct btrfs_free_space *info = NULL;
-        int ret = 0;
-
-        info = kzalloc(sizeof(struct btrfs_free_space), GFP_NOFS);
-        if (!info)
-                return -ENOMEM;
-
-        info->offset = offset;
-        info->bytes = bytes;
-
-        spin_lock(&block_group->tree_lock);
+        struct btrfs_free_space *left_info;
+        struct btrfs_free_space *right_info;
+        bool merged = false;
+        u64 offset = info->offset;
+        u64 bytes = info->bytes;
 
         /*
          * first we want to see if there is free space adjacent to the range we
@@ -1388,37 +1392,62 @@ int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
         else
                 left_info = tree_search_offset(block_group, offset - 1, 0, 0);
 
-        /*
-         * If there was no extent directly to the left or right of this new
-         * extent then we know we're going to have to allocate a new extent, so
-         * before we do that see if we need to drop this into a bitmap
-         */
-        if ((!left_info || left_info->bitmap) &&
-            (!right_info || right_info->bitmap)) {
-                ret = insert_into_bitmap(block_group, info);
-
-                if (ret < 0) {
-                        goto out;
-                } else if (ret) {
-                        ret = 0;
-                        goto out;
-                }
-        }
-
         if (right_info && !right_info->bitmap) {
-                unlink_free_space(block_group, right_info);
+                if (update_stat)
+                        unlink_free_space(block_group, right_info);
+                else
+                        __unlink_free_space(block_group, right_info);
                 info->bytes += right_info->bytes;
                 kfree(right_info);
+                merged = true;
         }
 
         if (left_info && !left_info->bitmap &&
             left_info->offset + left_info->bytes == offset) {
-                unlink_free_space(block_group, left_info);
+                if (update_stat)
+                        unlink_free_space(block_group, left_info);
+                else
+                        __unlink_free_space(block_group, left_info);
                 info->offset = left_info->offset;
                 info->bytes += left_info->bytes;
                 kfree(left_info);
+                merged = true;
         }
 
+        return merged;
+}
+
+int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
+                         u64 offset, u64 bytes)
+{
+        struct btrfs_free_space *info;
+        int ret = 0;
+
+        info = kzalloc(sizeof(struct btrfs_free_space), GFP_NOFS);
+        if (!info)
+                return -ENOMEM;
+
+        info->offset = offset;
+        info->bytes = bytes;
+
+        spin_lock(&block_group->tree_lock);
+
+        if (try_merge_free_space(block_group, info, true))
+                goto link;
+
+        /*
+         * There was no extent directly to the left or right of this new
+         * extent then we know we're going to have to allocate a new extent, so
+         * before we do that see if we need to drop this into a bitmap
+         */
+        ret = insert_into_bitmap(block_group, info);
+        if (ret < 0) {
+                goto out;
+        } else if (ret) {
+                ret = 0;
+                goto out;
+        }
+link:
         ret = link_free_space(block_group, info);
         if (ret)
                 kfree(info);
@@ -1621,6 +1650,7 @@ __btrfs_return_cluster_to_free_space(
                 node = rb_next(&entry->offset_index);
                 rb_erase(&entry->offset_index, &cluster->root);
                 BUG_ON(entry->bitmap);
+                try_merge_free_space(block_group, entry, false);
                 tree_insert_offset(&block_group->free_space_offset,
                                    entry->offset, &entry->offset_index, 0);
         }
@@ -1685,13 +1715,8 @@ u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
         ret = offset;
         if (entry->bitmap) {
                 bitmap_clear_bits(block_group, entry, offset, bytes);
-                if (!entry->bytes) {
-                        unlink_free_space(block_group, entry);
-                        kfree(entry->bitmap);
-                        kfree(entry);
-                        block_group->total_bitmaps--;
-                        recalculate_thresholds(block_group);
-                }
+                if (!entry->bytes)
+                        free_bitmap(block_group, entry);
         } else {
                 unlink_free_space(block_group, entry);
                 entry->offset += bytes;
@@ -1789,6 +1814,8 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
 
         ret = search_start;
         bitmap_clear_bits(block_group, entry, ret, bytes);
+        if (entry->bytes == 0)
+                free_bitmap(block_group, entry);
 out:
         spin_unlock(&cluster->lock);
         spin_unlock(&block_group->tree_lock);
@@ -1842,15 +1869,26 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                 entry->offset += bytes;
                 entry->bytes -= bytes;
 
-                if (entry->bytes == 0) {
+                if (entry->bytes == 0)
                         rb_erase(&entry->offset_index, &cluster->root);
-                        kfree(entry);
-                }
                 break;
         }
 out:
         spin_unlock(&cluster->lock);
 
+        if (!ret)
+                return 0;
+
+        spin_lock(&block_group->tree_lock);
+
+        block_group->free_space -= bytes;
+        if (entry->bytes == 0) {
+                block_group->free_extents--;
+                kfree(entry);
+        }
+
+        spin_unlock(&block_group->tree_lock);
+
         return ret;
 }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 160b55b3e13..bcc461a9695 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -416,7 +416,7 @@ again:
         }
         if (start == 0) {
                 trans = btrfs_join_transaction(root, 1);
-                BUG_ON(!trans);
+                BUG_ON(IS_ERR(trans));
                 btrfs_set_trans_block_group(trans, inode);
                 trans->block_rsv = &root->fs_info->delalloc_block_rsv;
 
@@ -612,6 +612,7 @@ retry:
                             GFP_NOFS);
 
                 trans = btrfs_join_transaction(root, 1);
+                BUG_ON(IS_ERR(trans));
                 ret = btrfs_reserve_extent(trans, root,
                                            async_extent->compressed_size,
                                            async_extent->compressed_size,
@@ -771,7 +772,7 @@ static noinline int cow_file_range(struct inode *inode,
 
         BUG_ON(root == root->fs_info->tree_root);
         trans = btrfs_join_transaction(root, 1);
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
         btrfs_set_trans_block_group(trans, inode);
         trans->block_rsv = &root->fs_info->delalloc_block_rsv;
 
@@ -1049,7 +1050,7 @@ static noinline int run_delalloc_nocow(struct inode *inode,
         } else {
                 trans = btrfs_join_transaction(root, 1);
         }
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
 
         cow_start = (u64)-1;
         cur_offset = start;
@@ -1557,6 +1558,7 @@ out:
 out_page:
         unlock_page(page);
         page_cache_release(page);
+        kfree(fixup);
 }
 
 /*
@@ -1703,7 +1705,7 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
                                 trans = btrfs_join_transaction_nolock(root, 1);
                         else
                                 trans = btrfs_join_transaction(root, 1);
-                        BUG_ON(!trans);
+                        BUG_ON(IS_ERR(trans));
                         btrfs_set_trans_block_group(trans, inode);
                         trans->block_rsv = &root->fs_info->delalloc_block_rsv;
                         ret = btrfs_update_inode(trans, root, inode);
@@ -1720,6 +1722,7 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
                 trans = btrfs_join_transaction_nolock(root, 1);
         else
                 trans = btrfs_join_transaction(root, 1);
+        BUG_ON(IS_ERR(trans));
         btrfs_set_trans_block_group(trans, inode);
         trans->block_rsv = &root->fs_info->delalloc_block_rsv;
 
@@ -2354,6 +2357,7 @@ void btrfs_orphan_cleanup(struct btrfs_root *root)
                  */
                 if (is_bad_inode(inode)) {
                         trans = btrfs_start_transaction(root, 0);
+                        BUG_ON(IS_ERR(trans));
                         btrfs_orphan_del(trans, inode);
                         btrfs_end_transaction(trans, root);
                         iput(inode);
@@ -2381,6 +2385,7 @@ void btrfs_orphan_cleanup(struct btrfs_root *root)
 
         if (root->orphan_block_rsv || root->orphan_item_inserted) {
                 trans = btrfs_join_transaction(root, 1);
+                BUG_ON(IS_ERR(trans));
                 btrfs_end_transaction(trans, root);
         }
 
@@ -2641,7 +2646,7 @@ int btrfs_unlink_inode(struct btrfs_trans_handle *trans,
         path = btrfs_alloc_path();
         if (!path) {
                 ret = -ENOMEM;
-                goto err;
+                goto out;
         }
 
         path->leave_spinning = 1;
@@ -2714,9 +2719,10 @@ static int check_path_shared(struct btrfs_root *root,
         struct extent_buffer *eb;
         int level;
         u64 refs = 1;
-        int uninitialized_var(ret);
 
         for (level = 0; level < BTRFS_MAX_LEVEL; level++) {
+                int ret;
+
                 if (!path->nodes[level])
                         break;
                 eb = path->nodes[level];
@@ -2727,7 +2733,7 @@ static int check_path_shared(struct btrfs_root *root,
                 if (refs > 1)
                         return 1;
         }
-        return ret; /* XXX callers? */
+        return 0;
 }
 
 /*
@@ -4134,7 +4140,7 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
         }
         srcu_read_unlock(&root->fs_info->subvol_srcu, index);
 
-        if (root != sub_root) {
+        if (!IS_ERR(inode) && root != sub_root) {
                 down_read(&root->fs_info->cleanup_work_sem);
                 if (!(inode->i_sb->s_flags & MS_RDONLY))
                         btrfs_orphan_cleanup(sub_root);
@@ -4347,6 +4353,8 @@ int btrfs_write_inode(struct inode *inode, struct writeback_control *wbc)
                         trans = btrfs_join_transaction_nolock(root, 1);
                 else
                         trans = btrfs_join_transaction(root, 1);
+                if (IS_ERR(trans))
+                        return PTR_ERR(trans);
                 btrfs_set_trans_block_group(trans, inode);
                 if (nolock)
                         ret = btrfs_end_transaction_nolock(trans, root);
@@ -4372,6 +4380,7 @@ void btrfs_dirty_inode(struct inode *inode)
                 return;
 
         trans = btrfs_join_transaction(root, 1);
+        BUG_ON(IS_ERR(trans));
         btrfs_set_trans_block_group(trans, inode);
 
         ret = btrfs_update_inode(trans, root, inode);
@@ -5176,6 +5185,8 @@ again:
                                 em = NULL;
                                 btrfs_release_path(root, path);
                                 trans = btrfs_join_transaction(root, 1);
+                                if (IS_ERR(trans))
+                                        return ERR_CAST(trans);
                                 goto again;
                         }
                         map = kmap(page);
@@ -5280,8 +5291,8 @@ static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
         btrfs_drop_extent_cache(inode, start, start + len - 1, 0);
 
         trans = btrfs_join_transaction(root, 0);
-        if (!trans)
-                return ERR_PTR(-ENOMEM);
+        if (IS_ERR(trans))
+                return ERR_CAST(trans);
 
         trans->block_rsv = &root->fs_info->delalloc_block_rsv;
 
@@ -5505,7 +5516,7 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
                  * while we look for nocow cross refs
                  */
                 trans = btrfs_join_transaction(root, 0);
-                if (!trans)
+                if (IS_ERR(trans))
                         goto must_cow;
 
                 if (can_nocow_odirect(trans, inode, start, len) == 1) {
@@ -5640,7 +5651,7 @@ again:
         BUG_ON(!ordered);
 
         trans = btrfs_join_transaction(root, 1);
-        if (!trans) {
+        if (IS_ERR(trans)) {
                 err = -ENOMEM;
                 goto out;
         }
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index a506a22b522..02d224e8c83 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -203,7 +203,7 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg)
 
 
         trans = btrfs_join_transaction(root, 1);
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
 
         ret = btrfs_update_inode(trans, root, inode);
         BUG_ON(ret);
@@ -907,6 +907,10 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
 
         if (new_size > old_size) {
                 trans = btrfs_start_transaction(root, 0);
+                if (IS_ERR(trans)) {
+                        ret = PTR_ERR(trans);
+                        goto out_unlock;
+                }
                 ret = btrfs_grow_device(trans, device, new_size);
                 btrfs_commit_transaction(trans, root);
         } else {
@@ -1898,7 +1902,10 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 
                         memcpy(&new_key, &key, sizeof(new_key));
                         new_key.objectid = inode->i_ino;
-                        new_key.offset = key.offset + destoff - off;
+                        if (off <= key.offset)
+                                new_key.offset = key.offset + destoff - off;
+                        else
+                                new_key.offset = destoff;
 
                         trans = btrfs_start_transaction(root, 1);
                         if (IS_ERR(trans)) {
@@ -2082,7 +2089,7 @@ static long btrfs_ioctl_trans_start(struct file *file)
 
         ret = -ENOMEM;
         trans = btrfs_start_ioctl_transaction(root, 0);
-        if (!trans)
+        if (IS_ERR(trans))
                 goto out_drop;
 
         file->private_data = trans;
@@ -2138,9 +2145,9 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
         path->leave_spinning = 1;
 
         trans = btrfs_start_transaction(root, 1);
-        if (!trans) {
+        if (IS_ERR(trans)) {
                 btrfs_free_path(path);
-                return -ENOMEM;
+                return PTR_ERR(trans);
         }
 
         dir_id = btrfs_super_root_dir(&root->fs_info->super_copy);
@@ -2334,6 +2341,8 @@ static noinline long btrfs_ioctl_start_sync(struct file *file, void __user *argp
         u64 transid;
 
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
         transid = trans->transid;
         btrfs_commit_transaction_async(trans, root, 0);
 
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 2b61e1ddcd9..083a5547737 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -141,7 +141,7 @@ static inline struct rb_node *tree_search(struct btrfs_ordered_inode_tree *tree,
                                           u64 file_offset)
 {
         struct rb_root *root = &tree->tree;
-        struct rb_node *prev;
+        struct rb_node *prev = NULL;
         struct rb_node *ret;
         struct btrfs_ordered_extent *entry;
 
diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
index 0d126be22b6..fb2605d998e 100644
--- a/fs/btrfs/print-tree.c
+++ b/fs/btrfs/print-tree.c
@@ -260,6 +260,7 @@ void btrfs_print_leaf(struct btrfs_root *root, struct extent_buffer *l)
 #else
                         BUG();
 #endif
+                        break;
                 case BTRFS_BLOCK_GROUP_ITEM_KEY:
                         bi = btrfs_item_ptr(l, i,
                                             struct btrfs_block_group_item);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 045c9c2b2d7..1f5556acb53 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -2028,6 +2028,7 @@ static noinline_for_stack int merge_reloc_root(struct reloc_control *rc,
 
         while (1) {
                 trans = btrfs_start_transaction(root, 0);
+                BUG_ON(IS_ERR(trans));
                 trans->block_rsv = rc->block_rsv;
 
                 ret = btrfs_block_rsv_check(trans, root, rc->block_rsv,
@@ -2147,6 +2148,12 @@ again:
         }
 
         trans = btrfs_join_transaction(rc->extent_root, 1);
+        if (IS_ERR(trans)) {
+                if (!err)
+                        btrfs_block_rsv_release(rc->extent_root,
+                                                rc->block_rsv, num_bytes);
+                return PTR_ERR(trans);
+        }
 
         if (!err) {
                 if (num_bytes != rc->merging_rsv_size) {
@@ -3222,6 +3229,7 @@ truncate:
         trans = btrfs_join_transaction(root, 0);
         if (IS_ERR(trans)) {
                 btrfs_free_path(path);
+                ret = PTR_ERR(trans);
                 goto out;
         }
 
@@ -3628,6 +3636,7 @@ int prepare_to_relocate(struct reloc_control *rc)
         set_reloc_control(rc);
 
         trans = btrfs_join_transaction(rc->extent_root, 1);
+        BUG_ON(IS_ERR(trans));
         btrfs_commit_transaction(trans, rc->extent_root);
         return 0;
 }
@@ -3657,6 +3666,7 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
 
         while (1) {
                 trans = btrfs_start_transaction(rc->extent_root, 0);
+                BUG_ON(IS_ERR(trans));
 
                 if (update_backref_cache(trans, &rc->backref_cache)) {
                         btrfs_end_transaction(trans, rc->extent_root);
@@ -3804,7 +3814,10 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
 
         /* get rid of pinned extents */
         trans = btrfs_join_transaction(rc->extent_root, 1);
-        btrfs_commit_transaction(trans, rc->extent_root);
+        if (IS_ERR(trans))
+                err = PTR_ERR(trans);
+        else
+                btrfs_commit_transaction(trans, rc->extent_root);
 out_free:
         btrfs_free_block_rsv(rc->extent_root, rc->block_rsv);
         btrfs_free_path(path);
@@ -4022,6 +4035,7 @@ static noinline_for_stack int mark_garbage_root(struct btrfs_root *root)
         int ret;
 
         trans = btrfs_start_transaction(root->fs_info->tree_root, 0);
+        BUG_ON(IS_ERR(trans));
 
         memset(&root->root_item.drop_progress, 0,
                 sizeof(root->root_item.drop_progress));
@@ -4125,6 +4139,11 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         set_reloc_control(rc);
 
         trans = btrfs_join_transaction(rc->extent_root, 1);
+        if (IS_ERR(trans)) {
+                unset_reloc_control(rc);
+                err = PTR_ERR(trans);
+                goto out_free;
+        }
 
         rc->merge_reloc_tree = 1;
 
@@ -4154,9 +4173,13 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         unset_reloc_control(rc);
 
         trans = btrfs_join_transaction(rc->extent_root, 1);
-        btrfs_commit_transaction(trans, rc->extent_root);
-out:
+        if (IS_ERR(trans))
+                err = PTR_ERR(trans);
+        else
+                btrfs_commit_transaction(trans, rc->extent_root);
+out_free:
         kfree(rc);
+out:
         while (!list_empty(&reloc_roots)) {
                 reloc_root = list_entry(reloc_roots.next,
                                         struct btrfs_root, root_list);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index b2130c46fdb..a004008f7d2 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -383,7 +383,7 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
                 struct btrfs_fs_devices **fs_devices)
 {
         substring_t args[MAX_OPT_ARGS];
-        char *opts, *p;
+        char *opts, *orig, *p;
         int error = 0;
         int intarg;
 
@@ -397,6 +397,7 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
         opts = kstrdup(options, GFP_KERNEL);
         if (!opts)
                 return -ENOMEM;
+        orig = opts;
 
         while ((p = strsep(&opts, ",")) != NULL) {
                 int token;
@@ -432,7 +433,7 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
         }
 
  out_free_opts:
-        kfree(opts);
+        kfree(orig);
  out:
         /*
          * If no subvolume name is specified we use the default one.  Allocate
@@ -623,6 +624,8 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
         btrfs_wait_ordered_extents(root, 0, 0);
 
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
         ret = btrfs_commit_transaction(trans, root);
         return ret;
 }
@@ -761,6 +764,8 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                 }
 
                 btrfs_close_devices(fs_devices);
+                kfree(fs_info);
+                kfree(tree_root);
         } else {
                 char b[BDEVNAME_SIZE];
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index bae5c7b8bbe..3d73c8d93bb 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1161,6 +1161,11 @@ int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans,
         INIT_DELAYED_WORK(&ac->work, do_async_commit);
         ac->root = root;
         ac->newtrans = btrfs_join_transaction(root, 0);
+        if (IS_ERR(ac->newtrans)) {
+                int err = PTR_ERR(ac->newtrans);
+                kfree(ac);
+                return err;
+        }
 
         /* take transaction reference */
         mutex_lock(&root->fs_info->trans_mutex);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 054744ac571..a4bbb854dfd 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -338,6 +338,12 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
                 }
                 dst_copy = kmalloc(item_size, GFP_NOFS);
                 src_copy = kmalloc(item_size, GFP_NOFS);
+                if (!dst_copy || !src_copy) {
+                        btrfs_release_path(root, path);
+                        kfree(dst_copy);
+                        kfree(src_copy);
+                        return -ENOMEM;
+                }
 
                 read_extent_buffer(eb, src_copy, src_ptr, item_size);
 
@@ -665,6 +671,9 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,
         btrfs_dir_item_key_to_cpu(leaf, di, &location);
         name_len = btrfs_dir_name_len(leaf, di);
         name = kmalloc(name_len, GFP_NOFS);
+        if (!name)
+                return -ENOMEM;
+
         read_extent_buffer(leaf, name, (unsigned long)(di + 1), name_len);
         btrfs_release_path(root, path);
 
@@ -744,6 +753,9 @@ static noinline int backref_in_log(struct btrfs_root *log,
         int match = 0;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
         ret = btrfs_search_slot(NULL, log, key, path, 0, 0);
         if (ret != 0)
                 goto out;
@@ -967,6 +979,8 @@ static noinline int fixup_inode_link_count(struct btrfs_trans_handle *trans,
         key.offset = (u64)-1;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
 
         while (1) {
                 ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
@@ -1178,6 +1192,9 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
 
         name_len = btrfs_dir_name_len(eb, di);
         name = kmalloc(name_len, GFP_NOFS);
+        if (!name)
+                return -ENOMEM;
+
         log_type = btrfs_dir_type(eb, di);
         read_extent_buffer(eb, name, (unsigned long)(di + 1),
                    name_len);
@@ -1692,6 +1709,8 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                 root_owner = btrfs_header_owner(parent);
 
                 next = btrfs_find_create_tree_block(root, bytenr, blocksize);
+                if (!next)
+                        return -ENOMEM;
 
                 if (*level == 1) {
                         wc->process_func(root, next, wc, ptr_gen);
@@ -2032,6 +2051,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
                 wait_log_commit(trans, log_root_tree,
                                 log_root_tree->log_transid);
                 mutex_unlock(&log_root_tree->log_mutex);
+                ret = 0;
                 goto out;
         }
         atomic_set(&log_root_tree->log_commit[index2], 1);
@@ -2096,7 +2116,7 @@ out:
         smp_mb();
         if (waitqueue_active(&root->log_commit_wait[index1]))
                 wake_up(&root->log_commit_wait[index1]);
-        return 0;
+        return ret;
 }
 
 static void free_log_tree(struct btrfs_trans_handle *trans,
@@ -2194,6 +2214,9 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
 
         log = root->log_root;
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
         di = btrfs_lookup_dir_item(trans, log, path, dir->i_ino,
                                    name, name_len, -1);
         if (IS_ERR(di)) {
@@ -2594,6 +2617,9 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
 
         ins_data = kmalloc(nr * sizeof(struct btrfs_key) +
                            nr * sizeof(u32), GFP_NOFS);
+        if (!ins_data)
+                return -ENOMEM;
+
         ins_sizes = (u32 *)ins_data;
         ins_keys = (struct btrfs_key *)(ins_data + nr * sizeof(u32));
 
@@ -2725,7 +2751,13 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
         log = root->log_root;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
         dst_path = btrfs_alloc_path();
+        if (!dst_path) {
+                btrfs_free_path(path);
+                return -ENOMEM;
+        }
 
         min_key.objectid = inode->i_ino;
         min_key.type = BTRFS_INODE_ITEM_KEY;
@@ -3080,6 +3112,7 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree)
         BUG_ON(!path);
 
         trans = btrfs_start_transaction(fs_info->tree_root, 0);
+        BUG_ON(IS_ERR(trans));
 
         wc.trans = trans;
         wc.pin = 1;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d158530233b..2636a051e4b 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1213,6 +1213,10 @@ static int btrfs_rm_dev_item(struct btrfs_root *root,
                 return -ENOMEM;
 
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans)) {
+                btrfs_free_path(path);
+                return PTR_ERR(trans);
+        }
         key.objectid = BTRFS_DEV_ITEMS_OBJECTID;
         key.type = BTRFS_DEV_ITEM_KEY;
         key.offset = device->devid;
@@ -1606,6 +1610,12 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         }
 
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans)) {
+                kfree(device);
+                ret = PTR_ERR(trans);
+                goto error;
+        }
+
         lock_chunks(root);
 
         device->writeable = 1;
@@ -1873,7 +1883,7 @@ static int btrfs_relocate_chunk(struct btrfs_root *root,
                 return ret;
 
         trans = btrfs_start_transaction(root, 0);
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
 
         lock_chunks(root);
 
@@ -2047,7 +2057,7 @@ int btrfs_balance(struct btrfs_root *dev_root)
                 BUG_ON(ret);
 
                 trans = btrfs_start_transaction(dev_root, 0);
-                BUG_ON(!trans);
+                BUG_ON(IS_ERR(trans));
 
                 ret = btrfs_grow_device(trans, device, old_size);
                 BUG_ON(ret);
@@ -2213,6 +2223,11 @@ again:
 
         /* Shrinking succeeded, else we would be at "done". */
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans)) {
+                ret = PTR_ERR(trans);
+                goto done;
+        }
+
         lock_chunks(root);
 
         device->disk_total_bytes = new_size;
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 60d27bc9eb8..6b61ded701e 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1560,9 +1560,10 @@ retry_locked:
                 /* NOTE: no side-effects allowed, until we take s_mutex */
 
                 revoking = cap->implemented & ~cap->issued;
-                if (revoking)
-                        dout(" mds%d revoking %s\n", cap->mds,
-                             ceph_cap_string(revoking));
+                dout(" mds%d cap %p issued %s implemented %s revoking %s\n",
+                     cap->mds, cap, ceph_cap_string(cap->issued),
+                     ceph_cap_string(cap->implemented),
+                     ceph_cap_string(revoking));
 
                 if (cap == ci->i_auth_cap &&
                     (cap->issued & CEPH_CAP_FILE_WR)) {
@@ -1658,6 +1659,8 @@ ack:
 
                 if (cap == ci->i_auth_cap && ci->i_dirty_caps)
                         flushing = __mark_caps_flushing(inode, session);
+                else
+                        flushing = 0;
 
                 mds = cap->mds;  /* remember mds, so we don't repeat */
                 sent++;
@@ -1940,6 +1943,35 @@ void ceph_kick_flushing_caps(struct ceph_mds_client *mdsc,
         }
 }
 
+static void kick_flushing_inode_caps(struct ceph_mds_client *mdsc,
+                                     struct ceph_mds_session *session,
+                                     struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_cap *cap;
+        int delayed = 0;
+
+        spin_lock(&inode->i_lock);
+        cap = ci->i_auth_cap;
+        dout("kick_flushing_inode_caps %p flushing %s flush_seq %lld\n", inode,
+             ceph_cap_string(ci->i_flushing_caps), ci->i_cap_flush_seq);
+        __ceph_flush_snaps(ci, &session, 1);
+        if (ci->i_flushing_caps) {
+                delayed = __send_cap(mdsc, cap, CEPH_CAP_OP_FLUSH,
+                                     __ceph_caps_used(ci),
+                                     __ceph_caps_wanted(ci),
+                                     cap->issued | cap->implemented,
+                                     ci->i_flushing_caps, NULL);
+                if (delayed) {
+                        spin_lock(&inode->i_lock);
+                        __cap_delay_requeue(mdsc, ci);
+                        spin_unlock(&inode->i_lock);
+                }
+        } else {
+                spin_unlock(&inode->i_lock);
+        }
+}
+
 
 /*
  * Take references to capabilities we hold, so that we don't release
@@ -2687,7 +2719,7 @@ static void handle_cap_import(struct ceph_mds_client *mdsc,
         ceph_add_cap(inode, session, cap_id, -1,
                      issued, wanted, seq, mseq, realmino, CEPH_CAP_FLAG_AUTH,
                      NULL /* no caps context */);
-        try_flush_caps(inode, session, NULL);
+        kick_flushing_inode_caps(mdsc, session, inode);
         up_read(&mdsc->snap_rwsem);
 
         /* make sure we re-request max_size, if necessary */
@@ -2785,8 +2817,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         case CEPH_CAP_OP_IMPORT:
                 handle_cap_import(mdsc, inode, h, session,
                                   snaptrace, snaptrace_len);
-                ceph_check_caps(ceph_inode(inode), CHECK_CAPS_NODELAY,
-                                session);
+                ceph_check_caps(ceph_inode(inode), 0, session);
                 goto done_unlocked;
         }
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index e835eff551e..5625463aa47 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -710,10 +710,6 @@ static int fill_inode(struct inode *inode,
                         ci->i_ceph_flags |= CEPH_I_COMPLETE;
                         ci->i_max_offset = 2;
                 }
-
-                /* it may be better to set st_size in getattr instead? */
-                if (ceph_test_mount_opt(ceph_sb_to_client(inode->i_sb), RBYTES))
-                        inode->i_size = ci->i_rbytes;
                 break;
         default:
                 pr_err("fill_inode %llx.%llx BAD mode 0%o\n",
@@ -1819,7 +1815,11 @@ int ceph_getattr(struct vfsmount *mnt, struct dentry *dentry,
                 else
                         stat->dev = 0;
                 if (S_ISDIR(inode->i_mode)) {
-                        stat->size = ci->i_rbytes;
+                        if (ceph_test_mount_opt(ceph_sb_to_client(inode->i_sb),
+                                                RBYTES))
+                                stat->size = ci->i_rbytes;
+                        else
+                                stat->size = ci->i_files + ci->i_subdirs;
                         stat->blocks = 0;
                         stat->blksize = 65536;
                 }
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 1e30d194a8e..a1ee8fa3a8e 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -693,9 +693,11 @@ static int __choose_mds(struct ceph_mds_client *mdsc,
                                 dout("choose_mds %p %llx.%llx "
                                      "frag %u mds%d (%d/%d)\n",
                                      inode, ceph_vinop(inode),
-                                     frag.frag, frag.mds,
+                                     frag.frag, mds,
                                      (int)r, frag.ndist);
-                                return mds;
+                                if (ceph_mdsmap_get_state(mdsc->mdsmap, mds) >=
+                                    CEPH_MDS_STATE_ACTIVE)
+                                        return mds;
                         }
 
                         /* since this file/dir wasn't known to be
@@ -708,7 +710,9 @@ static int __choose_mds(struct ceph_mds_client *mdsc,
                                 dout("choose_mds %p %llx.%llx "
                                      "frag %u mds%d (auth)\n",
                                      inode, ceph_vinop(inode), frag.frag, mds);
-                                return mds;
+                                if (ceph_mdsmap_get_state(mdsc->mdsmap, mds) >=
+                                    CEPH_MDS_STATE_ACTIVE)
+                                        return mds;
                         }
                 }
         }
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index bf6f0f34082..9c5085465a6 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -290,6 +290,8 @@ static int parse_mount_options(struct ceph_mount_options **pfsopt,
 
         fsopt->rsize = CEPH_MOUNT_RSIZE_DEFAULT;
         fsopt->snapdir_name = kstrdup(CEPH_SNAPDIRNAME_DEFAULT, GFP_KERNEL);
+        fsopt->caps_wanted_delay_min = CEPH_CAPS_WANTED_DELAY_MIN_DEFAULT;
+        fsopt->caps_wanted_delay_max = CEPH_CAPS_WANTED_DELAY_MAX_DEFAULT;
         fsopt->cap_release_safety = CEPH_CAP_RELEASE_SAFETY_DEFAULT;
         fsopt->max_readdir = CEPH_MAX_READDIR_DEFAULT;
         fsopt->max_readdir_bytes = CEPH_MAX_READDIR_BYTES_DEFAULT;
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 6e12a6ba5f7..8c9eba6ef9d 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -219,6 +219,7 @@ static struct ceph_inode_xattr *__get_xattr(struct ceph_inode_info *ci,
         struct rb_node **p;
         struct rb_node *parent = NULL;
         struct ceph_inode_xattr *xattr = NULL;
+        int name_len = strlen(name);
         int c;
 
         p = &ci->i_xattrs.index.rb_node;
@@ -226,6 +227,8 @@ static struct ceph_inode_xattr *__get_xattr(struct ceph_inode_info *ci,
                 parent = *p;
                 xattr = rb_entry(parent, struct ceph_inode_xattr, node);
                 c = strncmp(name, xattr->name, xattr->name_len);
+                if (c == 0 && name_len > xattr->name_len)
+                        c = 1;
                 if (c < 0)
                         p = &(*p)->rb_left;
                 else if (c > 0)
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index ee45648b0d1..7cb0f7f847e 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -3,6 +3,7 @@ config CIFS
         depends on INET
         select NLS
         select CRYPTO
+        select CRYPTO_MD4
         select CRYPTO_MD5
         select CRYPTO_HMAC
         select CRYPTO_ARC4
diff --git a/fs/cifs/Makefile b/fs/cifs/Makefile
index 43b19dd3919..d87558448e3 100644
--- a/fs/cifs/Makefile
+++ b/fs/cifs/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_CIFS) += cifs.o
 
 cifs-y := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o \
           link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o \
-          md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o \
+          cifs_unicode.o nterr.o xattr.o cifsencrypt.o \
           readdir.o ioctl.o sess.o export.o
 
 cifs-$(CONFIG_CIFS_ACL) += cifsacl.o
diff --git a/fs/cifs/README b/fs/cifs/README
index 46af99ab361..fe168359082 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -452,6 +452,11 @@ A partial list of the supported mount options follows:
                 if oplock (caching token) is granted and held. Note that
                 direct allows write operations larger than page size
                 to be sent to the server.
+  strictcache   Use for switching on strict cache mode. In this mode the
+                client read from the cache all the time it has Oplock Level II,
+                otherwise - read from the server. All written data are stored
+                in the cache, but if the client doesn't have Exclusive Oplock,
+                it writes the data to the server.
   acl           Allow setfacl and getfacl to manage posix ACLs if server
                 supports them.  (default)
   noacl         Do not allow setfacl and getfacl calls on this mount
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index ede98300a8c..65829d32128 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -79,11 +79,11 @@ void cifs_dump_mids(struct TCP_Server_Info *server)
         spin_lock(&GlobalMid_Lock);
         list_for_each(tmp, &server->pending_mid_q) {
                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
-                cERROR(1, "State: %d Cmd: %d Pid: %d Tsk: %p Mid %d",
+                cERROR(1, "State: %d Cmd: %d Pid: %d Cbdata: %p Mid %d",
                         mid_entry->midState,
                         (int)mid_entry->command,
                         mid_entry->pid,
-                        mid_entry->tsk,
+                        mid_entry->callback_data,
                         mid_entry->mid);
 #ifdef CONFIG_CIFS_STATS2
                 cERROR(1, "IsLarge: %d buf: %p time rcv: %ld now: %ld",
@@ -218,11 +218,11 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
                                 mid_entry = list_entry(tmp3, struct mid_q_entry,
                                         qhead);
                                 seq_printf(m, "\tState: %d com: %d pid:"
-                                                " %d tsk: %p mid %d\n",
+                                                " %d cbdata: %p mid %d\n",
                                                 mid_entry->midState,
                                                 (int)mid_entry->command,
                                                 mid_entry->pid,
-                                                mid_entry->tsk,
+                                                mid_entry->callback_data,
                                                 mid_entry->mid);
                         }
                         spin_unlock(&GlobalMid_Lock);
@@ -331,7 +331,7 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
                                 atomic_read(&totSmBufAllocCount));
 #endif /* CONFIG_CIFS_STATS2 */
 
-        seq_printf(m, "Operations (MIDs): %d\n", midCount.counter);
+        seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
         seq_printf(m,
                 "\n%d session %d share reconnects\n",
                 tcpSesReconnectCount.counter, tconInfoReconnectCount.counter);
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 7ed36536e75..0a265ad9e42 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -282,8 +282,6 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         cFYI(1, "in %s", __func__);
         BUG_ON(IS_ROOT(mntpt));
 
-        xid = GetXid();
-
         /*
          * The MSDFS spec states that paths in DFS referral requests and
          * responses must be prefixed by a single '\' character instead of
@@ -293,20 +291,21 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         mnt = ERR_PTR(-ENOMEM);
         full_path = build_path_from_dentry(mntpt);
         if (full_path == NULL)
-                goto free_xid;
+                goto cdda_exit;
 
         cifs_sb = CIFS_SB(mntpt->d_inode->i_sb);
         tlink = cifs_sb_tlink(cifs_sb);
-        mnt = ERR_PTR(-EINVAL);
         if (IS_ERR(tlink)) {
                 mnt = ERR_CAST(tlink);
                 goto free_full_path;
         }
         ses = tlink_tcon(tlink)->ses;
 
+        xid = GetXid();
         rc = get_dfs_path(xid, ses, full_path + 1, cifs_sb->local_nls,
                 &num_referrals, &referrals,
                 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+        FreeXid(xid);
 
         cifs_put_tlink(tlink);
 
@@ -339,8 +338,7 @@ success:
         free_dfs_info_array(referrals, num_referrals);
 free_full_path:
         kfree(full_path);
-free_xid:
-        FreeXid(xid);
+cdda_exit:
         cFYI(1, "leaving %s" , __func__);
         return mnt;
 }
diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
index 7852cd67705..ac51cd2d33a 100644
--- a/fs/cifs/cifs_fs_sb.h
+++ b/fs/cifs/cifs_fs_sb.h
@@ -40,6 +40,7 @@
 #define CIFS_MOUNT_FSCACHE      0x8000 /* local caching enabled */
 #define CIFS_MOUNT_MF_SYMLINKS  0x10000 /* Minshall+French Symlinks enabled */
 #define CIFS_MOUNT_MULTIUSER    0x20000 /* multiuser mount */
+#define CIFS_MOUNT_STRICT_IO    0x40000 /* strict cache mode */
 
 struct cifs_sb_info {
         struct rb_root tlink_tree;
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 430f510a172..fc0fd4fde30 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -44,10 +44,14 @@ cifs_ucs2_bytes(const __le16 *from, int maxbytes,
         int charlen, outlen = 0;
         int maxwords = maxbytes / 2;
         char tmp[NLS_MAX_CHARSET_SIZE];
+        __u16 ftmp;
 
-        for (i = 0; i < maxwords && from[i]; i++) {
-                charlen = codepage->uni2char(le16_to_cpu(from[i]), tmp,
-                                             NLS_MAX_CHARSET_SIZE);
+        for (i = 0; i < maxwords; i++) {
+                ftmp = get_unaligned_le16(&from[i]);
+                if (ftmp == 0)
+                        break;
+
+                charlen = codepage->uni2char(ftmp, tmp, NLS_MAX_CHARSET_SIZE);
                 if (charlen > 0)
                         outlen += charlen;
                 else
@@ -58,9 +62,9 @@ cifs_ucs2_bytes(const __le16 *from, int maxbytes,
 }
 
 /*
- * cifs_mapchar - convert a little-endian char to proper char in codepage
+ * cifs_mapchar - convert a host-endian char to proper char in codepage
  * @target - where converted character should be copied
- * @src_char - 2 byte little-endian source character
+ * @src_char - 2 byte host-endian source character
  * @cp - codepage to which character should be converted
  * @mapchar - should character be mapped according to mapchars mount option?
  *
@@ -69,7 +73,7 @@ cifs_ucs2_bytes(const __le16 *from, int maxbytes,
  * enough to hold the result of the conversion (at least NLS_MAX_CHARSET_SIZE).
  */
 static int
-cifs_mapchar(char *target, const __le16 src_char, const struct nls_table *cp,
+cifs_mapchar(char *target, const __u16 src_char, const struct nls_table *cp,
              bool mapchar)
 {
         int len = 1;
@@ -82,7 +86,7 @@ cifs_mapchar(char *target, const __le16 src_char, const struct nls_table *cp,
          *     build_path_from_dentry are modified, as they use slash as
          *     separator.
          */
-        switch (le16_to_cpu(src_char)) {
+        switch (src_char) {
         case UNI_COLON:
                 *target = ':';
                 break;
@@ -109,8 +113,7 @@ out:
         return len;
 
 cp_convert:
-        len = cp->uni2char(le16_to_cpu(src_char), target,
-                           NLS_MAX_CHARSET_SIZE);
+        len = cp->uni2char(src_char, target, NLS_MAX_CHARSET_SIZE);
         if (len <= 0) {
                 *target = '?';
                 len = 1;
@@ -149,6 +152,7 @@ cifs_from_ucs2(char *to, const __le16 *from, int tolen, int fromlen,
         int nullsize = nls_nullsize(codepage);
         int fromwords = fromlen / 2;
         char tmp[NLS_MAX_CHARSET_SIZE];
+        __u16 ftmp;
 
         /*
          * because the chars can be of varying widths, we need to take care
@@ -158,19 +162,23 @@ cifs_from_ucs2(char *to, const __le16 *from, int tolen, int fromlen,
          */
         safelen = tolen - (NLS_MAX_CHARSET_SIZE + nullsize);
 
-        for (i = 0; i < fromwords && from[i]; i++) {
+        for (i = 0; i < fromwords; i++) {
+                ftmp = get_unaligned_le16(&from[i]);
+                if (ftmp == 0)
+                        break;
+
                 /*
                  * check to see if converting this character might make the
                  * conversion bleed into the null terminator
                  */
                 if (outlen >= safelen) {
-                        charlen = cifs_mapchar(tmp, from[i], codepage, mapchar);
+                        charlen = cifs_mapchar(tmp, ftmp, codepage, mapchar);
                         if ((outlen + charlen) > (tolen - nullsize))
                                 break;
                 }
 
                 /* put converted char into 'to' buffer */
-                charlen = cifs_mapchar(&to[outlen], from[i], codepage, mapchar);
+                charlen = cifs_mapchar(&to[outlen], ftmp, codepage, mapchar);
                 outlen += charlen;
         }
 
@@ -193,24 +201,21 @@ cifs_strtoUCS(__le16 *to, const char *from, int len,
 {
         int charlen;
         int i;
-        wchar_t *wchar_to = (wchar_t *)to; /* needed to quiet sparse */
+        wchar_t wchar_to; /* needed to quiet sparse */
 
         for (i = 0; len && *from; i++, from += charlen, len -= charlen) {
-
-                /* works for 2.4.0 kernel or later */
-                charlen = codepage->char2uni(from, len, &wchar_to[i]);
+                charlen = codepage->char2uni(from, len, &wchar_to);
                 if (charlen < 1) {
-                        cERROR(1, "strtoUCS: char2uni of %d returned %d",
-                                (int)*from, charlen);
+                        cERROR(1, "strtoUCS: char2uni of 0x%x returned %d",
+                                *from, charlen);
                         /* A question mark */
-                        to[i] = cpu_to_le16(0x003f);
+                        wchar_to = 0x003f;
                         charlen = 1;
-                } else
-                        to[i] = cpu_to_le16(wchar_to[i]);
-
+                }
+                put_unaligned_le16(wchar_to, &to[i]);
         }
 
-        to[i] = 0;
+        put_unaligned_le16(0, &to[i]);
         return i;
 }
 
@@ -252,3 +257,79 @@ cifs_strndup_from_ucs(const char *src, const int maxlen, const bool is_unicode,
         return dst;
 }
 
+/*
+ * Convert 16 bit Unicode pathname to wire format from string in current code
+ * page. Conversion may involve remapping up the six characters that are
+ * only legal in POSIX-like OS (if they are present in the string). Path
+ * names are little endian 16 bit Unicode on the wire
+ */
+int
+cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
+                 const struct nls_table *cp, int mapChars)
+{
+        int i, j, charlen;
+        int len_remaining = maxlen;
+        char src_char;
+        __u16 temp;
+
+        if (!mapChars)
+                return cifs_strtoUCS(target, source, PATH_MAX, cp);
+
+        for (i = 0, j = 0; i < maxlen; j++) {
+                src_char = source[i];
+                switch (src_char) {
+                case 0:
+                        put_unaligned_le16(0, &target[j]);
+                        goto ctoUCS_out;
+                case ':':
+                        temp = UNI_COLON;
+                        break;
+                case '*':
+                        temp = UNI_ASTERIK;
+                        break;
+                case '?':
+                        temp = UNI_QUESTION;
+                        break;
+                case '<':
+                        temp = UNI_LESSTHAN;
+                        break;
+                case '>':
+                        temp = UNI_GRTRTHAN;
+                        break;
+                case '|':
+                        temp = UNI_PIPE;
+                        break;
+                /*
+                 * FIXME: We can not handle remapping backslash (UNI_SLASH)
+                 * until all the calls to build_path_from_dentry are modified,
+                 * as they use backslash as separator.
+                 */
+                default:
+                        charlen = cp->char2uni(source+i, len_remaining,
+                                                &temp);
+                        /*
+                         * if no match, use question mark, which at least in
+                         * some cases serves as wild card
+                         */
+                        if (charlen < 1) {
+                                temp = 0x003f;
+                                charlen = 1;
+                        }
+                        len_remaining -= charlen;
+                        /*
+                         * character may take more than one byte in the source
+                         * string, but will take exactly two bytes in the
+                         * target string
+                         */
+                        i += charlen;
+                        continue;
+                }
+                put_unaligned_le16(temp, &target[j]);
+                i++; /* move to next char in source string */
+                len_remaining--;
+        }
+
+ctoUCS_out:
+        return i;
+}
+
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index a437ec391a0..beeebf19423 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -41,9 +41,12 @@ static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
 ;
 
 
-/* security id for everyone */
+/* security id for everyone/world system group */
 static const struct cifs_sid sid_everyone = {
         1, 1, {0, 0, 0, 0, 0, 1}, {0} };
+/* security id for Authenticated Users system group */
+static const struct cifs_sid sid_authusers = {
+        1, 1, {0, 0, 0, 0, 0, 5}, {11} };
 /* group users */
 static const struct cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
 
@@ -365,10 +368,14 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
         if (num_aces  > 0) {
                 umode_t user_mask = S_IRWXU;
                 umode_t group_mask = S_IRWXG;
-                umode_t other_mask = S_IRWXO;
+                umode_t other_mask = S_IRWXU | S_IRWXG | S_IRWXO;
 
                 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
                                 GFP_KERNEL);
+                if (!ppace) {
+                        cERROR(1, "DACL memory allocation error");
+                        return;
+                }
 
                 for (i = 0; i < num_aces; ++i) {
                         ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
@@ -390,6 +397,12 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
                                                      ppace[i]->type,
                                                      &fattr->cf_mode,
                                                      &other_mask);
+                        if (compare_sids(&(ppace[i]->sid), &sid_authusers))
+                                access_flags_to_mode(ppace[i]->access_req,
+                                                     ppace[i]->type,
+                                                     &fattr->cf_mode,
+                                                     &other_mask);
+
 
 /*                      memcpy((void *)(&(cifscred->aces[i])),
                                 (void *)ppace[i],
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 66f3d50d067..a51585f9852 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -24,7 +24,6 @@
 #include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifs_debug.h"
-#include "md5.h"
 #include "cifs_unicode.h"
 #include "cifsproto.h"
 #include "ntlmssp.h"
@@ -37,11 +36,6 @@
 /* Note that the smb header signature field on input contains the
         sequence number before this function is called */
 
-extern void mdfour(unsigned char *out, unsigned char *in, int n);
-extern void E_md4hash(const unsigned char *passwd, unsigned char *p16);
-extern void SMBencrypt(unsigned char *passwd, const unsigned char *c8,
-                       unsigned char *p24);
-
 static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
                                 struct TCP_Server_Info *server, char *signature)
 {
@@ -234,6 +228,7 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu,
 /* first calculate 24 bytes ntlm response and then 16 byte session key */
 int setup_ntlm_response(struct cifsSesInfo *ses)
 {
+        int rc = 0;
         unsigned int temp_len = CIFS_SESS_KEY_SIZE + CIFS_AUTH_RESP_SIZE;
         char temp_key[CIFS_SESS_KEY_SIZE];
 
@@ -247,13 +242,26 @@ int setup_ntlm_response(struct cifsSesInfo *ses)
         }
         ses->auth_key.len = temp_len;
 
-        SMBNTencrypt(ses->password, ses->server->cryptkey,
+        rc = SMBNTencrypt(ses->password, ses->server->cryptkey,
                         ses->auth_key.response + CIFS_SESS_KEY_SIZE);
+        if (rc) {
+                cFYI(1, "%s Can't generate NTLM response, error: %d",
+                        __func__, rc);
+                return rc;
+        }
 
-        E_md4hash(ses->password, temp_key);
-        mdfour(ses->auth_key.response, temp_key, CIFS_SESS_KEY_SIZE);
+        rc = E_md4hash(ses->password, temp_key);
+        if (rc) {
+                cFYI(1, "%s Can't generate NT hash, error: %d", __func__, rc);
+                return rc;
+        }
 
-        return 0;
+        rc = mdfour(ses->auth_key.response, temp_key, CIFS_SESS_KEY_SIZE);
+        if (rc)
+                cFYI(1, "%s Can't generate NTLM session key, error: %d",
+                        __func__, rc);
+
+        return rc;
 }
 
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
@@ -649,9 +657,10 @@ calc_seckey(struct cifsSesInfo *ses)
         get_random_bytes(sec_key, CIFS_SESS_KEY_SIZE);
 
         tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
-        if (!tfm_arc4 || IS_ERR(tfm_arc4)) {
+        if (IS_ERR(tfm_arc4)) {
+                rc = PTR_ERR(tfm_arc4);
                 cERROR(1, "could not allocate crypto API arc4\n");
-                return PTR_ERR(tfm_arc4);
+                return rc;
         }
 
         desc.tfm = tfm_arc4;
@@ -700,14 +709,13 @@ cifs_crypto_shash_allocate(struct TCP_Server_Info *server)
         unsigned int size;
 
         server->secmech.hmacmd5 = crypto_alloc_shash("hmac(md5)", 0, 0);
-        if (!server->secmech.hmacmd5 ||
-                        IS_ERR(server->secmech.hmacmd5)) {
+        if (IS_ERR(server->secmech.hmacmd5)) {
                 cERROR(1, "could not allocate crypto hmacmd5\n");
                 return PTR_ERR(server->secmech.hmacmd5);
         }
 
         server->secmech.md5 = crypto_alloc_shash("md5", 0, 0);
-        if (!server->secmech.md5 || IS_ERR(server->secmech.md5)) {
+        if (IS_ERR(server->secmech.md5)) {
                 cERROR(1, "could not allocate crypto md5\n");
                 rc = PTR_ERR(server->secmech.md5);
                 goto crypto_allocate_md5_fail;
diff --git a/fs/cifs/cifsencrypt.h b/fs/cifs/cifsencrypt.h
deleted file mode 100644
index 15d2ec00647..00000000000
--- a/fs/cifs/cifsencrypt.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- *   fs/cifs/cifsencrypt.h
- *
- *   Copyright (c) International Business Machines  Corp., 2005
- *   Author(s): Steve French (sfrench@us.ibm.com)
- *
- *   Externs for misc. small encryption routines
- *   so we do not have to put them in cifsproto.h
- *
- *   This library is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU Lesser General Public License as published
- *   by the Free Software Foundation; either version 2.1 of the License, or
- *   (at your option) any later version.
- *
- *   This library is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
- *   the GNU Lesser General Public License for more details.
- *
- *   You should have received a copy of the GNU Lesser General Public License
- *   along with this library; if not, write to the Free Software
- *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-/* md4.c */
-extern void mdfour(unsigned char *out, unsigned char *in, int n);
-/* smbdes.c */
-extern void E_P16(unsigned char *p14, unsigned char *p16);
-extern void E_P24(unsigned char *p21, const unsigned char *c8,
-                  unsigned char *p24);
-
-
-
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index d9f652a522a..f2970136d17 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -77,7 +77,11 @@ unsigned int cifs_max_pending = CIFS_MAX_REQ;
 module_param(cifs_max_pending, int, 0);
 MODULE_PARM_DESC(cifs_max_pending, "Simultaneous requests to server. "
                                    "Default: 50 Range: 2 to 256");
-
+unsigned short echo_retries = 5;
+module_param(echo_retries, ushort, 0644);
+MODULE_PARM_DESC(echo_retries, "Number of echo attempts before giving up and "
+                               "reconnecting server. Default: 5. 0 means "
+                               "never reconnect.");
 extern mempool_t *cifs_sm_req_poolp;
 extern mempool_t *cifs_req_poolp;
 extern mempool_t *cifs_mid_poolp;
@@ -596,10 +600,17 @@ static ssize_t cifs_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
 {
         struct inode *inode = iocb->ki_filp->f_path.dentry->d_inode;
         ssize_t written;
+        int rc;
 
         written = generic_file_aio_write(iocb, iov, nr_segs, pos);
-        if (!CIFS_I(inode)->clientCanCacheAll)
-                filemap_fdatawrite(inode->i_mapping);
+
+        if (CIFS_I(inode)->clientCanCacheAll)
+                return written;
+
+        rc = filemap_fdatawrite(inode->i_mapping);
+        if (rc)
+                cFYI(1, "cifs_file_aio_write: %d rc on %p inode", rc, inode);
+
         return written;
 }
 
@@ -729,6 +740,25 @@ const struct file_operations cifs_file_ops = {
         .setlease = cifs_setlease,
 };
 
+const struct file_operations cifs_file_strict_ops = {
+        .read = do_sync_read,
+        .write = do_sync_write,
+        .aio_read = cifs_strict_readv,
+        .aio_write = cifs_strict_writev,
+        .open = cifs_open,
+        .release = cifs_close,
+        .lock = cifs_lock,
+        .fsync = cifs_strict_fsync,
+        .flush = cifs_flush,
+        .mmap = cifs_file_strict_mmap,
+        .splice_read = generic_file_splice_read,
+        .llseek = cifs_llseek,
+#ifdef CONFIG_CIFS_POSIX
+        .unlocked_ioctl = cifs_ioctl,
+#endif /* CONFIG_CIFS_POSIX */
+        .setlease = cifs_setlease,
+};
+
 const struct file_operations cifs_file_direct_ops = {
         /* no aio, no readv -
            BB reevaluate whether they can be done with directio, no cache */
@@ -747,6 +777,7 @@ const struct file_operations cifs_file_direct_ops = {
         .llseek = cifs_llseek,
         .setlease = cifs_setlease,
 };
+
 const struct file_operations cifs_file_nobrl_ops = {
         .read = do_sync_read,
         .write = do_sync_write,
@@ -765,6 +796,24 @@ const struct file_operations cifs_file_nobrl_ops = {
         .setlease = cifs_setlease,
 };
 
+const struct file_operations cifs_file_strict_nobrl_ops = {
+        .read = do_sync_read,
+        .write = do_sync_write,
+        .aio_read = cifs_strict_readv,
+        .aio_write = cifs_strict_writev,
+        .open = cifs_open,
+        .release = cifs_close,
+        .fsync = cifs_strict_fsync,
+        .flush = cifs_flush,
+        .mmap = cifs_file_strict_mmap,
+        .splice_read = generic_file_splice_read,
+        .llseek = cifs_llseek,
+#ifdef CONFIG_CIFS_POSIX
+        .unlocked_ioctl = cifs_ioctl,
+#endif /* CONFIG_CIFS_POSIX */
+        .setlease = cifs_setlease,
+};
+
 const struct file_operations cifs_file_direct_nobrl_ops = {
         /* no mmap, no aio, no readv -
            BB reevaluate whether they can be done with directio, no cache */
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 851030f7493..4a3330235d5 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -61,6 +61,7 @@ extern int cifs_rename(struct inode *, struct dentry *, struct inode *,
                        struct dentry *);
 extern int cifs_revalidate_file(struct file *filp);
 extern int cifs_revalidate_dentry(struct dentry *);
+extern void cifs_invalidate_mapping(struct inode *inode);
 extern int cifs_getattr(struct vfsmount *, struct dentry *, struct kstat *);
 extern int cifs_setattr(struct dentry *, struct iattr *);
 
@@ -72,19 +73,27 @@ extern const struct inode_operations cifs_dfs_referral_inode_operations;
 /* Functions related to files and directories */
 extern const struct file_operations cifs_file_ops;
 extern const struct file_operations cifs_file_direct_ops; /* if directio mnt */
-extern const struct file_operations cifs_file_nobrl_ops;
-extern const struct file_operations cifs_file_direct_nobrl_ops; /* no brlocks */
+extern const struct file_operations cifs_file_strict_ops; /* if strictio mnt */
+extern const struct file_operations cifs_file_nobrl_ops; /* no brlocks */
+extern const struct file_operations cifs_file_direct_nobrl_ops;
+extern const struct file_operations cifs_file_strict_nobrl_ops;
 extern int cifs_open(struct inode *inode, struct file *file);
 extern int cifs_close(struct inode *inode, struct file *file);
 extern int cifs_closedir(struct inode *inode, struct file *file);
 extern ssize_t cifs_user_read(struct file *file, char __user *read_data,
-                         size_t read_size, loff_t *poffset);
+                              size_t read_size, loff_t *poffset);
+extern ssize_t cifs_strict_readv(struct kiocb *iocb, const struct iovec *iov,
+                                 unsigned long nr_segs, loff_t pos);
 extern ssize_t cifs_user_write(struct file *file, const char __user *write_data,
-                         size_t write_size, loff_t *poffset);
+                               size_t write_size, loff_t *poffset);
+extern ssize_t cifs_strict_writev(struct kiocb *iocb, const struct iovec *iov,
+                                  unsigned long nr_segs, loff_t pos);
 extern int cifs_lock(struct file *, int, struct file_lock *);
 extern int cifs_fsync(struct file *, int);
+extern int cifs_strict_fsync(struct file *, int);
 extern int cifs_flush(struct file *, fl_owner_t id);
 extern int cifs_file_mmap(struct file * , struct vm_area_struct *);
+extern int cifs_file_strict_mmap(struct file * , struct vm_area_struct *);
 extern const struct file_operations cifs_dir_ops;
 extern int cifs_dir_open(struct inode *inode, struct file *file);
 extern int cifs_readdir(struct file *file, void *direntry, filldir_t filldir);
@@ -118,5 +127,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* EXPERIMENTAL */
 
-#define CIFS_VERSION   "1.68"
+#define CIFS_VERSION   "1.70"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 606ca8bb710..edd5b29b53c 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -161,32 +161,27 @@ struct TCP_Server_Info {
         int srv_count; /* reference counter */
         /* 15 character server name + 0x20 16th byte indicating type = srv */
         char server_RFC1001_name[RFC1001_NAME_LEN_WITH_NULL];
+        enum statusEnum tcpStatus; /* what we think the status is */
         char *hostname; /* hostname portion of UNC string */
         struct socket *ssocket;
         struct sockaddr_storage dstaddr;
         struct sockaddr_storage srcaddr; /* locally bind to this IP */
+#ifdef CONFIG_NET_NS
+        struct net *net;
+#endif
         wait_queue_head_t response_q;
         wait_queue_head_t request_q; /* if more than maxmpx to srvr must block*/
         struct list_head pending_mid_q;
-        void *Server_NlsInfo;   /* BB - placeholder for future NLS info  */
-        unsigned short server_codepage; /* codepage for the server    */
-        enum protocolEnum protocolType;
-        char versionMajor;
-        char versionMinor;
-        bool svlocal:1;                 /* local server or remote */
         bool noblocksnd;                /* use blocking sendmsg */
         bool noautotune;                /* do not autotune send buf sizes */
         bool tcp_nodelay;
         atomic_t inFlight;  /* number of requests on the wire to server */
-#ifdef CONFIG_CIFS_STATS2
-        atomic_t inSend; /* requests trying to send */
-        atomic_t num_waiters;   /* blocked waiting to get in sendrecv */
-#endif
-        enum statusEnum tcpStatus; /* what we think the status is */
         struct mutex srv_mutex;
         struct task_struct *tsk;
         char server_GUID[16];
         char secMode;
+        bool session_estab; /* mark when very first sess is established */
+        u16 dialect; /* dialect index that server chose */
         enum securityEnum secType;
         unsigned int maxReq;    /* Clients should submit no more */
         /* than maxReq distinct unanswered SMBs to the server when using  */
@@ -199,8 +194,6 @@ struct TCP_Server_Info {
         unsigned int max_vcs;   /* maximum number of smb sessions, at least
                                    those that can be specified uniquely with
                                    vcnumbers */
-        char sessid[4];         /* unique token id for this session */
-        /* (returned on Negotiate */
         int capabilities; /* allow selective disabling of caps by smb sess */
         int timeAdj;  /* Adjust for difference in server time zone in sec */
         __u16 CurrentMid;         /* multiplex id - rotating counter */
@@ -210,20 +203,53 @@ struct TCP_Server_Info {
         __u32 sequence_number; /* for signing, protected by srv_mutex */
         struct session_key session_key;
         unsigned long lstrp; /* when we got last response from this server */
-        u16 dialect; /* dialect index that server chose */
         struct cifs_secmech secmech; /* crypto sec mech functs, descriptors */
         /* extended security flavors that server supports */
+        bool    sec_ntlmssp;            /* supports NTLMSSP */
+        bool    sec_kerberosu2u;        /* supports U2U Kerberos */
         bool    sec_kerberos;           /* supports plain Kerberos */
         bool    sec_mskerberos;         /* supports legacy MS Kerberos */
-        bool    sec_kerberosu2u;        /* supports U2U Kerberos */
-        bool    sec_ntlmssp;            /* supports NTLMSSP */
-        bool session_estab; /* mark when very first sess is established */
+        struct delayed_work     echo; /* echo ping workqueue job */
 #ifdef CONFIG_CIFS_FSCACHE
         struct fscache_cookie   *fscache; /* client index cache cookie */
 #endif
+#ifdef CONFIG_CIFS_STATS2
+        atomic_t inSend; /* requests trying to send */
+        atomic_t num_waiters;   /* blocked waiting to get in sendrecv */
+#endif
 };
 
 /*
+ * Macros to allow the TCP_Server_Info->net field and related code to drop out
+ * when CONFIG_NET_NS isn't set.
+ */
+
+#ifdef CONFIG_NET_NS
+
+static inline struct net *cifs_net_ns(struct TCP_Server_Info *srv)
+{
+        return srv->net;
+}
+
+static inline void cifs_set_net_ns(struct TCP_Server_Info *srv, struct net *net)
+{
+        srv->net = net;
+}
+
+#else
+
+static inline struct net *cifs_net_ns(struct TCP_Server_Info *srv)
+{
+        return &init_net;
+}
+
+static inline void cifs_set_net_ns(struct TCP_Server_Info *srv, struct net *net)
+{
+}
+
+#endif
+
+/*
  * Session structure.  One of these for each uid session with a particular host
  */
 struct cifsSesInfo {
@@ -446,11 +472,11 @@ struct cifsInodeInfo {
         /* BB add in lists for dirty pages i.e. write caching info for oplock */
         struct list_head openFileList;
         __u32 cifsAttrs; /* e.g. DOS archive bit, sparse, compressed, system */
-        unsigned long time;     /* jiffies of last update/check of inode */
-        bool clientCanCacheRead:1;      /* read oplock */
-        bool clientCanCacheAll:1;       /* read and writebehind oplock */
-        bool delete_pending:1;          /* DELETE_ON_CLOSE is set */
-        bool invalid_mapping:1;         /* pagecache is invalid */
+        bool clientCanCacheRead;        /* read oplock */
+        bool clientCanCacheAll;         /* read and writebehind oplock */
+        bool delete_pending;            /* DELETE_ON_CLOSE is set */
+        bool invalid_mapping;           /* pagecache is invalid */
+        unsigned long time;             /* jiffies of last update of inode */
         u64  server_eof;                /* current file size on server */
         u64  uniqueid;                  /* server inode number */
         u64  createtime;                /* creation time on server */
@@ -508,6 +534,18 @@ static inline void cifs_stats_bytes_read(struct cifsTconInfo *tcon,
 
 #endif
 
+struct mid_q_entry;
+
+/*
+ * This is the prototype for the mid callback function. When creating one,
+ * take special care to avoid deadlocks. Things to bear in mind:
+ *
+ * - it will be called by cifsd
+ * - the GlobalMid_Lock will be held
+ * - the mid will be removed from the pending_mid_q list
+ */
+typedef void (mid_callback_t)(struct mid_q_entry *mid);
+
 /* one of these for every pending CIFS request to the server */
 struct mid_q_entry {
         struct list_head qhead; /* mids waiting on reply from this server */
@@ -519,7 +557,8 @@ struct mid_q_entry {
         unsigned long when_sent; /* time when smb send finished */
         unsigned long when_received; /* when demux complete (taken off wire) */
 #endif
-        struct task_struct *tsk;        /* task waiting for response */
+        mid_callback_t *callback; /* call completion callback */
+        void *callback_data;      /* general purpose pointer for callback */
         struct smb_hdr *resp_buf;       /* response buffer */
         int midState;   /* wish this were enum but can not pass to wait_event */
         __u8 command;   /* smb command code */
@@ -622,12 +661,9 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param,
 #define   CIFS_IOVEC            4    /* array of response buffers */
 
 /* Type of Request to SendReceive2 */
-#define   CIFS_STD_OP           0    /* normal request timeout */
-#define   CIFS_LONG_OP          1    /* long op (up to 45 sec, oplock time) */
-#define   CIFS_VLONG_OP         2    /* sloow op - can take up to 180 seconds */
-#define   CIFS_BLOCKING_OP      4    /* operation can block */
-#define   CIFS_ASYNC_OP         8    /* do not wait for response */
-#define   CIFS_TIMEOUT_MASK 0x00F    /* only one of 5 above set in req */
+#define   CIFS_BLOCKING_OP      1    /* operation can block */
+#define   CIFS_ASYNC_OP         2    /* do not wait for response */
+#define   CIFS_TIMEOUT_MASK 0x003    /* only one of above set in req */
 #define   CIFS_LOG_ERROR    0x010    /* log NT STATUS if non-zero */
 #define   CIFS_LARGE_BUF_OP 0x020    /* large request buffer */
 #define   CIFS_NO_RESP      0x040    /* no response buffer required */
@@ -790,6 +826,9 @@ GLOBAL_EXTERN unsigned int cifs_min_rcv;    /* min size of big ntwrk buf pool */
 GLOBAL_EXTERN unsigned int cifs_min_small;  /* min size of small buf pool */
 GLOBAL_EXTERN unsigned int cifs_max_pending; /* MAX requests at once to server*/
 
+/* reconnect after this many failed echo attempts */
+GLOBAL_EXTERN unsigned short echo_retries;
+
 void cifs_oplock_break(struct work_struct *work);
 void cifs_oplock_break_get(struct cifsFileInfo *cfile);
 void cifs_oplock_break_put(struct cifsFileInfo *cfile);
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index de36b09763a..b5c8cc5d7a7 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -23,6 +23,7 @@
 #define _CIFSPDU_H
 
 #include <net/sock.h>
+#include <asm/unaligned.h>
 #include "smbfsctl.h"
 
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
@@ -50,6 +51,7 @@
 #define SMB_COM_SETATTR               0x09 /* trivial response */
 #define SMB_COM_LOCKING_ANDX          0x24 /* trivial response */
 #define SMB_COM_COPY                  0x29 /* trivial rsp, fail filename ignrd*/
+#define SMB_COM_ECHO                  0x2B /* echo request */
 #define SMB_COM_OPEN_ANDX             0x2D /* Legacy open for old servers */
 #define SMB_COM_READ_ANDX             0x2E
 #define SMB_COM_WRITE_ANDX            0x2F
@@ -425,11 +427,49 @@ struct smb_hdr {
         __u16 Mid;
         __u8 WordCount;
 } __attribute__((packed));
-/* given a pointer to an smb_hdr retrieve the value of byte count */
-#define BCC(smb_var) (*(__u16 *)((char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount)))
-#define BCC_LE(smb_var) (*(__le16 *)((char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount)))
+
+/* given a pointer to an smb_hdr retrieve a char pointer to the byte count */
+#define BCC(smb_var) ((unsigned char *)(smb_var) + sizeof(struct smb_hdr) + \
+                         (2 * (smb_var)->WordCount))
+
 /* given a pointer to an smb_hdr retrieve the pointer to the byte area */
-#define pByteArea(smb_var) ((unsigned char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount) + 2)
+#define pByteArea(smb_var) (BCC(smb_var) + 2)
+
+/* get the converted ByteCount for a SMB packet and return it */
+static inline __u16
+get_bcc(struct smb_hdr *hdr)
+{
+        __u16 *bc_ptr = (__u16 *)BCC(hdr);
+
+        return get_unaligned(bc_ptr);
+}
+
+/* get the unconverted ByteCount for a SMB packet and return it */
+static inline __u16
+get_bcc_le(struct smb_hdr *hdr)
+{
+        __le16 *bc_ptr = (__le16 *)BCC(hdr);
+
+        return get_unaligned_le16(bc_ptr);
+}
+
+/* set the ByteCount for a SMB packet in host-byte order */
+static inline void
+put_bcc(__u16 count, struct smb_hdr *hdr)
+{
+        __u16 *bc_ptr = (__u16 *)BCC(hdr);
+
+        put_unaligned(count, bc_ptr);
+}
+
+/* set the ByteCount for a SMB packet in little-endian */
+static inline void
+put_bcc_le(__u16 count, struct smb_hdr *hdr)
+{
+        __le16 *bc_ptr = (__le16 *)BCC(hdr);
+
+        put_unaligned_le16(count, bc_ptr);
+}
 
 /*
  * Computer Name Length (since Netbios name was length 16 with last byte 0x20)
@@ -760,6 +800,20 @@ typedef struct smb_com_tconx_rsp_ext {
  *
  */
 
+typedef struct smb_com_echo_req {
+        struct  smb_hdr hdr;
+        __le16  EchoCount;
+        __le16  ByteCount;
+        char    Data[1];
+} __attribute__((packed)) ECHO_REQ;
+
+typedef struct smb_com_echo_rsp {
+        struct  smb_hdr hdr;
+        __le16  SequenceNumber;
+        __le16  ByteCount;
+        char    Data[1];
+} __attribute__((packed)) ECHO_RSP;
+
 typedef struct smb_com_logoff_andx_req {
         struct smb_hdr hdr;     /* wct = 2 */
         __u8 AndXCommand;
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index e6d1481b16c..8096f27ad9a 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -61,6 +61,12 @@ extern char *cifs_compose_mount_options(const char *sb_mountdata,
                 const char *fullpath, const struct dfs_info3_param *ref,
                 char **devname);
 /* extern void renew_parental_timestamps(struct dentry *direntry);*/
+extern struct mid_q_entry *AllocMidQEntry(const struct smb_hdr *smb_buffer,
+                                        struct TCP_Server_Info *server);
+extern void DeleteMidQEntry(struct mid_q_entry *midEntry);
+extern int cifs_call_async(struct TCP_Server_Info *server,
+                           struct smb_hdr *in_buf, mid_callback_t *callback,
+                           void *cbdata);
 extern int SendReceive(const unsigned int /* xid */ , struct cifsSesInfo *,
                         struct smb_hdr * /* input */ ,
                         struct smb_hdr * /* out */ ,
@@ -79,6 +85,8 @@ extern int checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length);
 extern bool is_valid_oplock_break(struct smb_hdr *smb,
                                   struct TCP_Server_Info *);
 extern bool is_size_safe_to_change(struct cifsInodeInfo *, __u64 eof);
+extern void cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset,
+                            unsigned int bytes_written);
 extern struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *, bool);
 extern struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *, bool);
 extern unsigned int smbCalcSize(struct smb_hdr *ptr);
@@ -347,12 +355,13 @@ extern int CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
                         const __u16 netfid, const __u64 len,
                         const __u64 offset, const __u32 numUnlock,
                         const __u32 numLock, const __u8 lockType,
-                        const bool waitFlag);
+                        const bool waitFlag, const __u8 oplock_level);
 extern int CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                         const __u16 smb_file_id, const int get_flag,
                         const __u64 len, struct file_lock *,
                         const __u16 lock_type, const bool waitFlag);
 extern int CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon);
+extern int CIFSSMBEcho(struct TCP_Server_Info *server);
 extern int CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses);
 
 extern struct cifsSesInfo *sesInfoAlloc(void);
@@ -366,7 +375,7 @@ extern int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *,
 extern int cifs_verify_signature(struct smb_hdr *,
                                  struct TCP_Server_Info *server,
                                 __u32 expected_sequence_number);
-extern void SMBNTencrypt(unsigned char *, unsigned char *, unsigned char *);
+extern int SMBNTencrypt(unsigned char *, unsigned char *, unsigned char *);
 extern int setup_ntlm_response(struct cifsSesInfo *);
 extern int setup_ntlmv2_rsp(struct cifsSesInfo *, const struct nls_table *);
 extern int cifs_crypto_shash_allocate(struct TCP_Server_Info *);
@@ -416,4 +425,11 @@ extern bool CIFSCouldBeMFSymlink(const struct cifs_fattr *fattr);
 extern int CIFSCheckMFSymlink(struct cifs_fattr *fattr,
                 const unsigned char *path,
                 struct cifs_sb_info *cifs_sb, int xid);
+extern int mdfour(unsigned char *, unsigned char *, int);
+extern int E_md4hash(const unsigned char *passwd, unsigned char *p16);
+extern void SMBencrypt(unsigned char *passwd, const unsigned char *c8,
+                        unsigned char *p24);
+extern void E_P16(unsigned char *p14, unsigned char *p16);
+extern void E_P24(unsigned char *p21, const unsigned char *c8,
+                        unsigned char *p24);
 #endif                  /* _CIFSPROTO_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 2f6795e524d..904aa47e351 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -136,9 +136,6 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
                 }
         }
 
-        if (ses->status == CifsExiting)
-                return -EIO;
-
         /*
          * Give demultiplex thread up to 10 seconds to reconnect, should be
          * greater than cifs socket timeout which is 7 seconds
@@ -156,7 +153,7 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
                  * retrying until process is killed or server comes
                  * back on-line
                  */
-                if (!tcon->retry || ses->status == CifsExiting) {
+                if (!tcon->retry) {
                         cFYI(1, "gave up waiting on reconnect in smb_init");
                         return -EHOSTDOWN;
                 }
@@ -331,37 +328,35 @@ smb_init_no_reconnect(int smb_command, int wct, struct cifsTconInfo *tcon,
 
 static int validate_t2(struct smb_t2_rsp *pSMB)
 {
-        int rc = -EINVAL;
-        int total_size;
-        char *pBCC;
+        unsigned int total_size;
+
+        /* check for plausible wct */
+        if (pSMB->hdr.WordCount < 10)
+                goto vt2_err;
 
-        /* check for plausible wct, bcc and t2 data and parm sizes */
         /* check for parm and data offset going beyond end of smb */
-        if (pSMB->hdr.WordCount >= 10) {
-                if ((le16_to_cpu(pSMB->t2_rsp.ParameterOffset) <= 1024) &&
-                   (le16_to_cpu(pSMB->t2_rsp.DataOffset) <= 1024)) {
-                        /* check that bcc is at least as big as parms + data */
-                        /* check that bcc is less than negotiated smb buffer */
-                        total_size = le16_to_cpu(pSMB->t2_rsp.ParameterCount);
-                        if (total_size < 512) {
-                                total_size +=
-                                        le16_to_cpu(pSMB->t2_rsp.DataCount);
-                                /* BCC le converted in SendReceive */
-                                pBCC = (pSMB->hdr.WordCount * 2) +
-                                        sizeof(struct smb_hdr) +
-                                        (char *)pSMB;
-                                if ((total_size <= (*(u16 *)pBCC)) &&
-                                   (total_size <
-                                        CIFSMaxBufSize+MAX_CIFS_HDR_SIZE)) {
-                                        return 0;
-                                }
-                        }
-                }
-        }
+        if (get_unaligned_le16(&pSMB->t2_rsp.ParameterOffset) > 1024 ||
+            get_unaligned_le16(&pSMB->t2_rsp.DataOffset) > 1024)
+                goto vt2_err;
+
+        /* check that bcc is at least as big as parms + data */
+        /* check that bcc is less than negotiated smb buffer */
+        total_size = get_unaligned_le16(&pSMB->t2_rsp.ParameterCount);
+        if (total_size >= 512)
+                goto vt2_err;
+
+        total_size += get_unaligned_le16(&pSMB->t2_rsp.DataCount);
+        if (total_size > get_bcc(&pSMB->hdr) ||
+            total_size >= CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)
+                goto vt2_err;
+
+        return 0;
+vt2_err:
         cifs_dump_mem("Invalid transact2 SMB: ", (char *)pSMB,
                 sizeof(struct smb_t2_rsp) + 16);
-        return rc;
+        return -EINVAL;
 }
+
 int
 CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
 {
@@ -452,7 +447,6 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                 server->maxBuf = min((__u32)le16_to_cpu(rsp->MaxBufSize),
                                 (__u32)CIFSMaxBufSize + MAX_CIFS_HDR_SIZE);
                 server->max_vcs = le16_to_cpu(rsp->MaxNumberVcs);
-                GETU32(server->sessid) = le32_to_cpu(rsp->SessionKey);
                 /* even though we do not use raw we might as well set this
                 accurately, in case we ever find a need for it */
                 if ((le16_to_cpu(rsp->RawMode) & RAW_ENABLE) == RAW_ENABLE) {
@@ -566,7 +560,6 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                         (__u32) CIFSMaxBufSize + MAX_CIFS_HDR_SIZE);
         server->max_rw = le32_to_cpu(pSMBr->MaxRawSize);
         cFYI(DBG2, "Max buf = %d", ses->server->maxBuf);
-        GETU32(ses->server->sessid) = le32_to_cpu(pSMBr->SessionKey);
         server->capabilities = le32_to_cpu(pSMBr->Capabilities);
         server->timeAdj = (int)(__s16)le16_to_cpu(pSMBr->ServerTimeZone);
         server->timeAdj *= 60;
@@ -706,6 +699,53 @@ CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon)
         return rc;
 }
 
+/*
+ * This is a no-op for now. We're not really interested in the reply, but
+ * rather in the fact that the server sent one and that server->lstrp
+ * gets updated.
+ *
+ * FIXME: maybe we should consider checking that the reply matches request?
+ */
+static void
+cifs_echo_callback(struct mid_q_entry *mid)
+{
+        struct TCP_Server_Info *server = mid->callback_data;
+
+        DeleteMidQEntry(mid);
+        atomic_dec(&server->inFlight);
+        wake_up(&server->request_q);
+}
+
+int
+CIFSSMBEcho(struct TCP_Server_Info *server)
+{
+        ECHO_REQ *smb;
+        int rc = 0;
+
+        cFYI(1, "In echo request");
+
+        rc = small_smb_init(SMB_COM_ECHO, 0, NULL, (void **)&smb);
+        if (rc)
+                return rc;
+
+        /* set up echo request */
+        smb->hdr.Tid = cpu_to_le16(0xffff);
+        smb->hdr.WordCount = 1;
+        put_unaligned_le16(1, &smb->EchoCount);
+        put_bcc_le(1, &smb->hdr);
+        smb->Data[0] = 'a';
+        smb->hdr.smb_buf_length += 3;
+
+        rc = cifs_call_async(server, (struct smb_hdr *)smb,
+                                cifs_echo_callback, server);
+        if (rc)
+                cFYI(1, "Echo request failed: %d", rc);
+
+        cifs_small_buf_release(smb);
+
+        return rc;
+}
+
 int
 CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
 {
@@ -1193,7 +1233,7 @@ OldOpenRetry:
         pSMB->ByteCount = cpu_to_le16(count);
         /* long_op set to 1 to allow for oplock break timeouts */
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *)pSMBr, &bytes_returned, CIFS_LONG_OP);
+                        (struct smb_hdr *)pSMBr, &bytes_returned, 0);
         cifs_stats_inc(&tcon->num_opens);
         if (rc) {
                 cFYI(1, "Error in Open = %d", rc);
@@ -1306,7 +1346,7 @@ openRetry:
         pSMB->ByteCount = cpu_to_le16(count);
         /* long_op set to 1 to allow for oplock break timeouts */
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *)pSMBr, &bytes_returned, CIFS_LONG_OP);
+                        (struct smb_hdr *)pSMBr, &bytes_returned, 0);
         cifs_stats_inc(&tcon->num_opens);
         if (rc) {
                 cFYI(1, "Error in Open = %d", rc);
@@ -1388,7 +1428,7 @@ CIFSSMBRead(const int xid, struct cifsTconInfo *tcon, const int netfid,
         iov[0].iov_base = (char *)pSMB;
         iov[0].iov_len = pSMB->hdr.smb_buf_length + 4;
         rc = SendReceive2(xid, tcon->ses, iov, 1 /* num iovecs */,
-                         &resp_buf_type, CIFS_STD_OP | CIFS_LOG_ERROR);
+                         &resp_buf_type, CIFS_LOG_ERROR);
         cifs_stats_inc(&tcon->num_reads);
         pSMBr = (READ_RSP *)iov[0].iov_base;
         if (rc) {
@@ -1663,7 +1703,8 @@ int
 CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
             const __u16 smb_file_id, const __u64 len,
             const __u64 offset, const __u32 numUnlock,
-            const __u32 numLock, const __u8 lockType, const bool waitFlag)
+            const __u32 numLock, const __u8 lockType,
+            const bool waitFlag, const __u8 oplock_level)
 {
         int rc = 0;
         LOCK_REQ *pSMB = NULL;
@@ -1691,6 +1732,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         pSMB->NumberOfLocks = cpu_to_le16(numLock);
         pSMB->NumberOfUnlocks = cpu_to_le16(numUnlock);
         pSMB->LockType = lockType;
+        pSMB->OplockLevel = oplock_level;
         pSMB->AndXCommand = 0xFF;       /* none */
         pSMB->Fid = smb_file_id; /* netfid stays le */
 
@@ -3087,7 +3129,7 @@ CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon, __u16 fid,
         iov[0].iov_len = pSMB->hdr.smb_buf_length + 4;
 
         rc = SendReceive2(xid, tcon->ses, iov, 1 /* num iovec */, &buf_type,
-                         CIFS_STD_OP);
+                         0);
         cifs_stats_inc(&tcon->num_acl_get);
         if (rc) {
                 cFYI(1, "Send error in QuerySecDesc = %d", rc);
@@ -4869,7 +4911,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
                    __u16 fid, __u32 pid_of_opener, bool SetAllocation)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
-        char *data_offset;
         struct file_end_of_file_info *parm_data;
         int rc = 0;
         __u16 params, param_offset, offset, byte_count, count;
@@ -4893,8 +4934,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
         param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
         offset = param_offset + params;
 
-        data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
-
         count = sizeof(struct file_end_of_file_info);
         pSMB->MaxParameterCount = cpu_to_le16(2);
         /* BB find exact max SMB PDU from sess structure BB */
@@ -5562,7 +5601,7 @@ QAllEAsRetry:
         }
 
         /* make sure list_len doesn't go past end of SMB */
-        end_of_smb = (char *)pByteArea(&pSMBr->hdr) + BCC(&pSMBr->hdr);
+        end_of_smb = (char *)pByteArea(&pSMBr->hdr) + get_bcc(&pSMBr->hdr);
         if ((char *)ea_response_data + list_len > end_of_smb) {
                 cFYI(1, "EA list appears to go beyond SMB");
                 rc = -EIO;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 9f59887badd..257b6d895e2 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -52,8 +52,8 @@
 #define CIFS_PORT 445
 #define RFC1001_PORT 139
 
-extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
-                         unsigned char *p24);
+/* SMB echo "timeout" -- FIXME: tunable? */
+#define SMB_ECHO_INTERVAL (60 * HZ)
 
 extern mempool_t *cifs_req_poolp;
 
@@ -84,6 +84,7 @@ struct smb_vol {
         bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
         bool server_ino:1; /* use inode numbers from server ie UniqueId */
         bool direct_io:1;
+        bool strict_io:1; /* strict cache behavior */
         bool remap:1;      /* set to remap seven reserved chars in filenames */
         bool posix_paths:1; /* unset to not ask for posix pathnames. */
         bool no_linux_ext:1;
@@ -152,6 +153,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
 
         /* before reconnecting the tcp session, mark the smb session (uid)
                 and the tid bad so they are not used until reconnected */
+        cFYI(1, "%s: marking sessions and tcons for reconnect", __func__);
         spin_lock(&cifs_tcp_ses_lock);
         list_for_each(tmp, &server->smb_ses_list) {
                 ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
@@ -163,7 +165,9 @@ cifs_reconnect(struct TCP_Server_Info *server)
                 }
         }
         spin_unlock(&cifs_tcp_ses_lock);
+
         /* do not want to be sending data on a socket we are freeing */
+        cFYI(1, "%s: tearing down socket", __func__);
         mutex_lock(&server->srv_mutex);
         if (server->ssocket) {
                 cFYI(1, "State: 0x%x Flags: 0x%lx", server->ssocket->state,
@@ -180,22 +184,20 @@ cifs_reconnect(struct TCP_Server_Info *server)
         kfree(server->session_key.response);
         server->session_key.response = NULL;
         server->session_key.len = 0;
+        server->lstrp = jiffies;
+        mutex_unlock(&server->srv_mutex);
 
+        /* mark submitted MIDs for retry and issue callback */
+        cFYI(1, "%s: issuing mid callbacks", __func__);
         spin_lock(&GlobalMid_Lock);
-        list_for_each(tmp, &server->pending_mid_q) {
-                mid_entry = list_entry(tmp, struct
-                                        mid_q_entry,
-                                        qhead);
-                if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
-                                /* Mark other intransit requests as needing
-                                   retry so we do not immediately mark the
-                                   session bad again (ie after we reconnect
-                                   below) as they timeout too */
+        list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
+                mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
+                if (mid_entry->midState == MID_REQUEST_SUBMITTED)
                         mid_entry->midState = MID_RETRY_NEEDED;
-                }
+                list_del_init(&mid_entry->qhead);
+                mid_entry->callback(mid_entry);
         }
         spin_unlock(&GlobalMid_Lock);
-        mutex_unlock(&server->srv_mutex);
 
         while ((server->tcpStatus != CifsExiting) &&
                (server->tcpStatus != CifsGood)) {
@@ -212,10 +214,9 @@ cifs_reconnect(struct TCP_Server_Info *server)
                         if (server->tcpStatus != CifsExiting)
                                 server->tcpStatus = CifsGood;
                         spin_unlock(&GlobalMid_Lock);
-        /*              atomic_set(&server->inFlight,0);*/
-                        wake_up(&server->response_q);
                 }
         }
+
         return rc;
 }
 
@@ -229,9 +230,8 @@ cifs_reconnect(struct TCP_Server_Info *server)
 static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
 {
         struct smb_t2_rsp *pSMBt;
-        int total_data_size;
-        int data_in_this_rsp;
         int remaining;
+        __u16 total_data_size, data_in_this_rsp;
 
         if (pSMB->Command != SMB_COM_TRANSACTION2)
                 return 0;
@@ -245,8 +245,8 @@ static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
 
         pSMBt = (struct smb_t2_rsp *)pSMB;
 
-        total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
-        data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
+        total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
+        data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 
         remaining = total_data_size - data_in_this_rsp;
 
@@ -272,21 +272,18 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
 {
         struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
         struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
-        int total_data_size;
-        int total_in_buf;
-        int remaining;
-        int total_in_buf2;
         char *data_area_of_target;
         char *data_area_of_buf2;
-        __u16 byte_count;
+        int remaining;
+        __u16 byte_count, total_data_size, total_in_buf, total_in_buf2;
 
-        total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
+        total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 
-        if (total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
+        if (total_data_size !=
+            get_unaligned_le16(&pSMB2->t2_rsp.TotalDataCount))
                 cFYI(1, "total data size of primary and secondary t2 differ");
-        }
 
-        total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
+        total_in_buf = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);
 
         remaining = total_data_size - total_in_buf;
 
@@ -296,28 +293,28 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
         if (remaining == 0) /* nothing to do, ignore */
                 return 0;
 
-        total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
+        total_in_buf2 = get_unaligned_le16(&pSMB2->t2_rsp.DataCount);
         if (remaining < total_in_buf2) {
                 cFYI(1, "transact2 2nd response contains too much data");
         }
 
         /* find end of first SMB data area */
         data_area_of_target = (char *)&pSMBt->hdr.Protocol +
-                                le16_to_cpu(pSMBt->t2_rsp.DataOffset);
+                                get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
         /* validate target area */
 
-        data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
-                                        le16_to_cpu(pSMB2->t2_rsp.DataOffset);
+        data_area_of_buf2 = (char *)&pSMB2->hdr.Protocol +
+                                get_unaligned_le16(&pSMB2->t2_rsp.DataOffset);
 
         data_area_of_target += total_in_buf;
 
         /* copy second buffer into end of first buffer */
         memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
         total_in_buf += total_in_buf2;
-        pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
-        byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
+        put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
+        byte_count = get_bcc_le(pTargetSMB);
         byte_count += total_in_buf2;
-        BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
+        put_bcc_le(byte_count, pTargetSMB);
 
         byte_count = pTargetSMB->smb_buf_length;
         byte_count += total_in_buf2;
@@ -331,7 +328,30 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
                 return 0; /* we are done */
         } else /* more responses to go */
                 return 1;
+}
+
+static void
+cifs_echo_request(struct work_struct *work)
+{
+        int rc;
+        struct TCP_Server_Info *server = container_of(work,
+                                        struct TCP_Server_Info, echo.work);
 
+        /*
+         * We cannot send an echo until the NEGOTIATE_PROTOCOL request is done.
+         * Also, no need to ping if we got a response recently
+         */
+        if (server->tcpStatus != CifsGood ||
+            time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
+                goto requeue_echo;
+
+        rc = CIFSSMBEcho(server);
+        if (rc)
+                cFYI(1, "Unable to send echo request to server: %s",
+                        server->hostname);
+
+requeue_echo:
+        queue_delayed_work(system_nrt_wq, &server->echo, SMB_ECHO_INTERVAL);
 }
 
 static int
@@ -345,8 +365,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
         struct msghdr smb_msg;
         struct kvec iov;
         struct socket *csocket = server->ssocket;
-        struct list_head *tmp;
-        struct cifsSesInfo *ses;
+        struct list_head *tmp, *tmp2;
         struct task_struct *task_to_wake = NULL;
         struct mid_q_entry *mid_entry;
         char temp;
@@ -399,7 +418,20 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                 smb_msg.msg_control = NULL;
                 smb_msg.msg_controllen = 0;
                 pdu_length = 4; /* enough to get RFC1001 header */
+
 incomplete_rcv:
+                if (echo_retries > 0 &&
+                    time_after(jiffies, server->lstrp +
+                                        (echo_retries * SMB_ECHO_INTERVAL))) {
+                        cERROR(1, "Server %s has not responded in %d seconds. "
+                                  "Reconnecting...", server->hostname,
+                                  (echo_retries * SMB_ECHO_INTERVAL / HZ));
+                        cifs_reconnect(server);
+                        csocket = server->ssocket;
+                        wake_up(&server->response_q);
+                        continue;
+                }
+
                 length =
                     kernel_recvmsg(csocket, &smb_msg,
                                 &iov, 1, pdu_length, 0 /* BB other flags? */);
@@ -550,19 +582,20 @@ incomplete_rcv:
                 else if (reconnect == 1)
                         continue;
 
-                length += 4; /* account for rfc1002 hdr */
-
+                total_read += 4; /* account for rfc1002 hdr */
 
-                dump_smb(smb_buffer, length);
-                if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
-                        cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
+                dump_smb(smb_buffer, total_read);
+                if (checkSMB(smb_buffer, smb_buffer->Mid, total_read)) {
+                        cifs_dump_mem("Bad SMB: ", smb_buffer,
+                                        total_read < 48 ? total_read : 48);
                         continue;
                 }
 
+                mid_entry = NULL;
+                server->lstrp = jiffies;
 
-                task_to_wake = NULL;
                 spin_lock(&GlobalMid_Lock);
-                list_for_each(tmp, &server->pending_mid_q) {
+                list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 
                         if ((mid_entry->mid == smb_buffer->Mid) &&
@@ -603,20 +636,19 @@ incomplete_rcv:
                                 mid_entry->resp_buf = smb_buffer;
                                 mid_entry->largeBuf = isLargeBuf;
 multi_t2_fnd:
-                                task_to_wake = mid_entry->tsk;
                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
 #ifdef CONFIG_CIFS_STATS2
                                 mid_entry->when_received = jiffies;
 #endif
-                                /* so we do not time out requests to  server
-                                which is still responding (since server could
-                                be busy but not dead) */
-                                server->lstrp = jiffies;
+                                list_del_init(&mid_entry->qhead);
+                                mid_entry->callback(mid_entry);
                                 break;
                         }
+                        mid_entry = NULL;
                 }
                 spin_unlock(&GlobalMid_Lock);
-                if (task_to_wake) {
+
+                if (mid_entry != NULL) {
                         /* Was previous buf put in mpx struct for multi-rsp? */
                         if (!isMultiRsp) {
                                 /* smb buffer will be freed by user thread */
@@ -625,11 +657,10 @@ multi_t2_fnd:
                                 else
                                         smallbuf = NULL;
                         }
-                        wake_up_process(task_to_wake);
                 } else if (!is_valid_oplock_break(smb_buffer, server) &&
                            !isMultiRsp) {
                         cERROR(1, "No task to wake, unknown frame received! "
-                                   "NumMids %d", midCount.counter);
+                                   "NumMids %d", atomic_read(&midCount));
                         cifs_dump_mem("Received Data is: ", (char *)smb_buffer,
                                       sizeof(struct smb_hdr));
 #ifdef CONFIG_CIFS_DEBUG2
@@ -677,44 +708,16 @@ multi_t2_fnd:
         if (smallbuf) /* no sense logging a debug message if NULL */
                 cifs_small_buf_release(smallbuf);
 
-        /*
-         * BB: we shouldn't have to do any of this. It shouldn't be
-         * possible to exit from the thread with active SMB sessions
-         */
-        spin_lock(&cifs_tcp_ses_lock);
-        if (list_empty(&server->pending_mid_q)) {
-                /* loop through server session structures attached to this and
-                    mark them dead */
-                list_for_each(tmp, &server->smb_ses_list) {
-                        ses = list_entry(tmp, struct cifsSesInfo,
-                                         smb_ses_list);
-                        ses->status = CifsExiting;
-                        ses->server = NULL;
-                }
-                spin_unlock(&cifs_tcp_ses_lock);
-        } else {
-                /* although we can not zero the server struct pointer yet,
-                since there are active requests which may depnd on them,
-                mark the corresponding SMB sessions as exiting too */
-                list_for_each(tmp, &server->smb_ses_list) {
-                        ses = list_entry(tmp, struct cifsSesInfo,
-                                         smb_ses_list);
-                        ses->status = CifsExiting;
-                }
-
+        if (!list_empty(&server->pending_mid_q)) {
                 spin_lock(&GlobalMid_Lock);
-                list_for_each(tmp, &server->pending_mid_q) {
-                mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
-                        if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
-                                cFYI(1, "Clearing Mid 0x%x - waking up ",
+                list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
+                        mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
+                        cFYI(1, "Clearing Mid 0x%x - issuing callback",
                                          mid_entry->mid);
-                                task_to_wake = mid_entry->tsk;
-                                if (task_to_wake)
-                                        wake_up_process(task_to_wake);
-                        }
+                        list_del_init(&mid_entry->qhead);
+                        mid_entry->callback(mid_entry);
                 }
                 spin_unlock(&GlobalMid_Lock);
-                spin_unlock(&cifs_tcp_ses_lock);
                 /* 1/8th of sec is more than enough time for them to exit */
                 msleep(125);
         }
@@ -732,18 +735,6 @@ multi_t2_fnd:
                 coming home not much else we can do but free the memory */
         }
 
-        /* last chance to mark ses pointers invalid
-        if there are any pointing to this (e.g
-        if a crazy root user tried to kill cifsd
-        kernel thread explicitly this might happen) */
-        /* BB: This shouldn't be necessary, see above */
-        spin_lock(&cifs_tcp_ses_lock);
-        list_for_each(tmp, &server->smb_ses_list) {
-                ses = list_entry(tmp, struct cifsSesInfo, smb_ses_list);
-                ses->server = NULL;
-        }
-        spin_unlock(&cifs_tcp_ses_lock);
-
         kfree(server->hostname);
         task_to_wake = xchg(&server->tsk, NULL);
         kfree(server);
@@ -1355,6 +1346,8 @@ cifs_parse_mount_options(char *options, const char *devname,
                         vol->direct_io = 1;
                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
                         vol->direct_io = 1;
+                } else if (strnicmp(data, "strictcache", 11) == 0) {
+                        vol->strict_io = 1;
                 } else if (strnicmp(data, "noac", 4) == 0) {
                         printk(KERN_WARNING "CIFS: Mount option noac not "
                                 "supported. Instead set "
@@ -1579,6 +1572,9 @@ cifs_find_tcp_session(struct sockaddr *addr, struct smb_vol *vol)
 
         spin_lock(&cifs_tcp_ses_lock);
         list_for_each_entry(server, &cifs_tcp_ses_list, tcp_ses_list) {
+                if (!net_eq(cifs_net_ns(server), current->nsproxy->net_ns))
+                        continue;
+
                 if (!match_address(server, addr,
                                    (struct sockaddr *)&vol->srcaddr))
                         continue;
@@ -1609,9 +1605,13 @@ cifs_put_tcp_session(struct TCP_Server_Info *server)
                 return;
         }
 
+        put_net(cifs_net_ns(server));
+
         list_del_init(&server->tcp_ses_list);
         spin_unlock(&cifs_tcp_ses_lock);
 
+        cancel_delayed_work_sync(&server->echo);
+
         spin_lock(&GlobalMid_Lock);
         server->tcpStatus = CifsExiting;
         spin_unlock(&GlobalMid_Lock);
@@ -1681,6 +1681,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                 goto out_err;
         }
 
+        cifs_set_net_ns(tcp_ses, get_net(current->nsproxy->net_ns));
         tcp_ses->hostname = extract_hostname(volume_info->UNC);
         if (IS_ERR(tcp_ses->hostname)) {
                 rc = PTR_ERR(tcp_ses->hostname);
@@ -1701,8 +1702,10 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
                 volume_info->target_rfc1001_name, RFC1001_NAME_LEN_WITH_NULL);
         tcp_ses->session_estab = false;
         tcp_ses->sequence_number = 0;
+        tcp_ses->lstrp = jiffies;
         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
+        INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
 
         /*
          * at this point we are the only ones with the pointer
@@ -1751,11 +1754,16 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
 
         cifs_fscache_get_client_cookie(tcp_ses);
 
+        /* queue echo request delayed work */
+        queue_delayed_work(system_nrt_wq, &tcp_ses->echo, SMB_ECHO_INTERVAL);
+
         return tcp_ses;
 
 out_err_crypto_release:
         cifs_crypto_shash_release(tcp_ses);
 
+        put_net(cifs_net_ns(tcp_ses));
+
 out_err:
         if (tcp_ses) {
                 if (!IS_ERR(tcp_ses->hostname))
@@ -2267,8 +2275,8 @@ generic_ip_connect(struct TCP_Server_Info *server)
         }
 
         if (socket == NULL) {
-                rc = sock_create_kern(sfamily, SOCK_STREAM,
-                                      IPPROTO_TCP, &socket);
+                rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
+                                   IPPROTO_TCP, &socket, 1);
                 if (rc < 0) {
                         cERROR(1, "Error %d creating socket", rc);
                         server->ssocket = NULL;
@@ -2580,6 +2588,8 @@ static void setup_cifs_sb(struct smb_vol *pvolume_info,
         if (pvolume_info->multiuser)
                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
                                             CIFS_MOUNT_NO_PERM);
+        if (pvolume_info->strict_io)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_STRICT_IO;
         if (pvolume_info->direct_io) {
                 cFYI(1, "mounting share using direct i/o");
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
@@ -2936,8 +2946,8 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
         TCONX_RSP *pSMBr;
         unsigned char *bcc_ptr;
         int rc = 0;
-        int length, bytes_left;
-        __u16 count;
+        int length;
+        __u16 bytes_left, count;
 
         if (ses == NULL)
                 return -EIO;
@@ -2965,7 +2975,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                 bcc_ptr++;              /* skip password */
                 /* already aligned so no need to do it below */
         } else {
-                pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
+                pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
                 /* BB FIXME add code to fail this if NTLMv2 or Kerberos
                    specified as required (when that support is added to
                    the vfs in the future) as only NTLM or the much
@@ -2981,9 +2991,10 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                                          bcc_ptr);
                 else
 #endif /* CIFS_WEAK_PW_HASH */
-                SMBNTencrypt(tcon->password, ses->server->cryptkey, bcc_ptr);
+                rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
+                                        bcc_ptr);
 
-                bcc_ptr += CIFS_SESS_KEY_SIZE;
+                bcc_ptr += CIFS_AUTH_RESP_SIZE;
                 if (ses->capabilities & CAP_UNICODE) {
                         /* must align unicode strings */
                         *bcc_ptr = 0; /* null byte password */
@@ -3021,7 +3032,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
         pSMB->ByteCount = cpu_to_le16(count);
 
         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
-                         CIFS_STD_OP);
+                         0);
 
         /* above now done in SendReceive */
         if ((rc == 0) && (tcon != NULL)) {
@@ -3031,7 +3042,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                 tcon->need_reconnect = false;
                 tcon->tid = smb_buffer_response->Tid;
                 bcc_ptr = pByteArea(smb_buffer_response);
-                bytes_left = BCC(smb_buffer_response);
+                bytes_left = get_bcc(smb_buffer_response);
                 length = strnlen(bcc_ptr, bytes_left - 2);
                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
                         is_unicode = true;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index d843631c028..e964b1cd5dd 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -287,6 +287,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
         struct inode *inode = cifs_file->dentry->d_inode;
         struct cifsTconInfo *tcon = tlink_tcon(cifs_file->tlink);
         struct cifsInodeInfo *cifsi = CIFS_I(inode);
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
         struct cifsLockInfo *li, *tmp;
 
         spin_lock(&cifs_file_list_lock);
@@ -302,6 +303,13 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
         if (list_empty(&cifsi->openFileList)) {
                 cFYI(1, "closing last open instance for inode %p",
                         cifs_file->dentry->d_inode);
+
+                /* in strict cache mode we need invalidate mapping on the last
+                   close  because it may cause a error when we open this file
+                   again and get at least level II oplock */
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_STRICT_IO)
+                        CIFS_I(inode)->invalid_mapping = true;
+
                 cifs_set_oplock_level(cifsi, 0);
         }
         spin_unlock(&cifs_file_list_lock);
@@ -338,7 +346,6 @@ int cifs_open(struct inode *inode, struct file *file)
         struct cifsTconInfo *tcon;
         struct tcon_link *tlink;
         struct cifsFileInfo *pCifsFile = NULL;
-        struct cifsInodeInfo *pCifsInode;
         char *full_path = NULL;
         bool posix_open_ok = false;
         __u16 netfid;
@@ -353,8 +360,6 @@ int cifs_open(struct inode *inode, struct file *file)
         }
         tcon = tlink_tcon(tlink);
 
-        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-
         full_path = build_path_from_dentry(file->f_path.dentry);
         if (full_path == NULL) {
                 rc = -ENOMEM;
@@ -726,12 +731,12 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
 
                 /* BB we could chain these into one lock request BB */
                 rc = CIFSSMBLock(xid, tcon, netfid, length, pfLock->fl_start,
-                                 0, 1, lockType, 0 /* wait flag */ );
+                                 0, 1, lockType, 0 /* wait flag */, 0);
                 if (rc == 0) {
                         rc = CIFSSMBLock(xid, tcon, netfid, length,
                                          pfLock->fl_start, 1 /* numUnlock */ ,
                                          0 /* numLock */ , lockType,
-                                         0 /* wait flag */ );
+                                         0 /* wait flag */, 0);
                         pfLock->fl_type = F_UNLCK;
                         if (rc != 0)
                                 cERROR(1, "Error unlocking previously locked "
@@ -748,13 +753,13 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                                 rc = CIFSSMBLock(xid, tcon, netfid, length,
                                         pfLock->fl_start, 0, 1,
                                         lockType | LOCKING_ANDX_SHARED_LOCK,
-                                        0 /* wait flag */);
+                                        0 /* wait flag */, 0);
                                 if (rc == 0) {
                                         rc = CIFSSMBLock(xid, tcon, netfid,
                                                 length, pfLock->fl_start, 1, 0,
                                                 lockType |
                                                 LOCKING_ANDX_SHARED_LOCK,
-                                                0 /* wait flag */);
+                                                0 /* wait flag */, 0);
                                         pfLock->fl_type = F_RDLCK;
                                         if (rc != 0)
                                                 cERROR(1, "Error unlocking "
@@ -797,8 +802,8 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
 
                 if (numLock) {
                         rc = CIFSSMBLock(xid, tcon, netfid, length,
-                                        pfLock->fl_start,
-                                        0, numLock, lockType, wait_flag);
+                                         pfLock->fl_start, 0, numLock, lockType,
+                                         wait_flag, 0);
 
                         if (rc == 0) {
                                 /* For Windows locks we must store them. */
@@ -818,9 +823,9 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                                                 (pfLock->fl_start + length) >=
                                                 (li->offset + li->length)) {
                                         stored_rc = CIFSSMBLock(xid, tcon,
-                                                        netfid,
-                                                        li->length, li->offset,
-                                                        1, 0, li->type, false);
+                                                        netfid, li->length,
+                                                        li->offset, 1, 0,
+                                                        li->type, false, 0);
                                         if (stored_rc)
                                                 rc = stored_rc;
                                         else {
@@ -839,31 +844,8 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
         return rc;
 }
 
-/*
- * Set the timeout on write requests past EOF. For some servers (Windows)
- * these calls can be very long.
- *
- * If we're writing >10M past the EOF we give a 180s timeout. Anything less
- * than that gets a 45s timeout. Writes not past EOF get 15s timeouts.
- * The 10M cutoff is totally arbitrary. A better scheme for this would be
- * welcome if someone wants to suggest one.
- *
- * We may be able to do a better job with this if there were some way to
- * declare that a file should be sparse.
- */
-static int
-cifs_write_timeout(struct cifsInodeInfo *cifsi, loff_t offset)
-{
-        if (offset <= cifsi->server_eof)
-                return CIFS_STD_OP;
-        else if (offset > (cifsi->server_eof + (10 * 1024 * 1024)))
-                return CIFS_VLONG_OP;
-        else
-                return CIFS_LONG_OP;
-}
-
 /* update the file size (if needed) after a write */
-static void
+void
 cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset,
                       unsigned int bytes_written)
 {
@@ -882,7 +864,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
         unsigned int total_written;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
-        int xid, long_op;
+        int xid;
         struct cifsFileInfo *open_file;
         struct cifsInodeInfo *cifsi = CIFS_I(inode);
 
@@ -903,7 +885,6 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
 
         xid = GetXid();
 
-        long_op = cifs_write_timeout(cifsi, *poffset);
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
                 rc = -EAGAIN;
@@ -931,7 +912,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
                                 min_t(const int, cifs_sb->wsize,
                                       write_size - total_written),
                                 *poffset, &bytes_written,
-                                NULL, write_data + total_written, long_op);
+                                NULL, write_data + total_written, 0);
                 }
                 if (rc || (bytes_written == 0)) {
                         if (total_written)
@@ -944,8 +925,6 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
                         cifs_update_eof(cifsi, *poffset, bytes_written);
                         *poffset += bytes_written;
                 }
-                long_op = CIFS_STD_OP; /* subsequent writes fast -
-                                    15 seconds is plenty */
         }
 
         cifs_stats_bytes_written(pTcon, total_written);
@@ -974,7 +953,7 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
         unsigned int total_written;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
-        int xid, long_op;
+        int xid;
         struct dentry *dentry = open_file->dentry;
         struct cifsInodeInfo *cifsi = CIFS_I(dentry->d_inode);
 
@@ -987,7 +966,6 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
 
         xid = GetXid();
 
-        long_op = cifs_write_timeout(cifsi, *poffset);
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
                 rc = -EAGAIN;
@@ -1017,7 +995,7 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
                                 rc = CIFSSMBWrite2(xid, pTcon,
                                                 open_file->netfid, len,
                                                 *poffset, &bytes_written,
-                                                iov, 1, long_op);
+                                                iov, 1, 0);
                         } else
                                 rc = CIFSSMBWrite(xid, pTcon,
                                          open_file->netfid,
@@ -1025,7 +1003,7 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
                                                write_size - total_written),
                                          *poffset, &bytes_written,
                                          write_data + total_written,
-                                         NULL, long_op);
+                                         NULL, 0);
                 }
                 if (rc || (bytes_written == 0)) {
                         if (total_written)
@@ -1038,8 +1016,6 @@ static ssize_t cifs_write(struct cifsFileInfo *open_file,
                         cifs_update_eof(cifsi, *poffset, bytes_written);
                         *poffset += bytes_written;
                 }
-                long_op = CIFS_STD_OP; /* subsequent writes fast -
-                                    15 seconds is plenty */
         }
 
         cifs_stats_bytes_written(pTcon, total_written);
@@ -1167,7 +1143,6 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to)
         char *write_data;
         int rc = -EFAULT;
         int bytes_written = 0;
-        struct cifs_sb_info *cifs_sb;
         struct inode *inode;
         struct cifsFileInfo *open_file;
 
@@ -1175,7 +1150,6 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to)
                 return -EFAULT;
 
         inode = page->mapping->host;
-        cifs_sb = CIFS_SB(inode->i_sb);
 
         offset += (loff_t)from;
         write_data = kmap(page);
@@ -1239,7 +1213,7 @@ static int cifs_writepages(struct address_space *mapping,
         struct pagevec pvec;
         int rc = 0;
         int scanned = 0;
-        int xid, long_op;
+        int xid;
 
         cifs_sb = CIFS_SB(mapping->host->i_sb);
 
@@ -1377,43 +1351,67 @@ retry:
                                 break;
                 }
                 if (n_iov) {
+retry_write:
                         open_file = find_writable_file(CIFS_I(mapping->host),
                                                         false);
                         if (!open_file) {
                                 cERROR(1, "No writable handles for inode");
                                 rc = -EBADF;
                         } else {
-                                long_op = cifs_write_timeout(cifsi, offset);
                                 rc = CIFSSMBWrite2(xid, tcon, open_file->netfid,
                                                    bytes_to_write, offset,
                                                    &bytes_written, iov, n_iov,
-                                                   long_op);
+                                                   0);
                                 cifsFileInfo_put(open_file);
-                                cifs_update_eof(cifsi, offset, bytes_written);
                         }
 
-                        if (rc || bytes_written < bytes_to_write) {
-                                cERROR(1, "Write2 ret %d, wrote %d",
-                                          rc, bytes_written);
-                                mapping_set_error(mapping, rc);
-                        } else {
+                        cFYI(1, "Write2 rc=%d, wrote=%u", rc, bytes_written);
+
+                        /*
+                         * For now, treat a short write as if nothing got
+                         * written. A zero length write however indicates
+                         * ENOSPC or EFBIG. We have no way to know which
+                         * though, so call it ENOSPC for now. EFBIG would
+                         * get translated to AS_EIO anyway.
+                         *
+                         * FIXME: make it take into account the data that did
+                         *        get written
+                         */
+                        if (rc == 0) {
+                                if (bytes_written == 0)
+                                        rc = -ENOSPC;
+                                else if (bytes_written < bytes_to_write)
+                                        rc = -EAGAIN;
+                        }
+
+                        /* retry on data-integrity flush */
+                        if (wbc->sync_mode == WB_SYNC_ALL && rc == -EAGAIN)
+                                goto retry_write;
+
+                        /* fix the stats and EOF */
+                        if (bytes_written > 0) {
                                 cifs_stats_bytes_written(tcon, bytes_written);
+                                cifs_update_eof(cifsi, offset, bytes_written);
                         }
 
                         for (i = 0; i < n_iov; i++) {
                                 page = pvec.pages[first + i];
-                                /* Should we also set page error on
-                                success rc but too little data written? */
-                                /* BB investigate retry logic on temporary
-                                server crash cases and how recovery works
-                                when page marked as error */
-                                if (rc)
+                                /* on retryable write error, redirty page */
+                                if (rc == -EAGAIN)
+                                        redirty_page_for_writepage(wbc, page);
+                                else if (rc != 0)
                                         SetPageError(page);
                                 kunmap(page);
                                 unlock_page(page);
                                 end_page_writeback(page);
                                 page_cache_release(page);
                         }
+
+                        if (rc != -EAGAIN)
+                                mapping_set_error(mapping, rc);
+                        else
+                                rc = 0;
+
                         if ((wbc->nr_to_write -= n_iov) <= 0)
                                 done = 1;
                         index = next;
@@ -1525,27 +1523,47 @@ static int cifs_write_end(struct file *file, struct address_space *mapping,
         return rc;
 }
 
-int cifs_fsync(struct file *file, int datasync)
+int cifs_strict_fsync(struct file *file, int datasync)
 {
         int xid;
         int rc = 0;
         struct cifsTconInfo *tcon;
         struct cifsFileInfo *smbfile = file->private_data;
         struct inode *inode = file->f_path.dentry->d_inode;
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
 
         xid = GetXid();
 
         cFYI(1, "Sync file - name: %s datasync: 0x%x",
                 file->f_path.dentry->d_name.name, datasync);
 
-        rc = filemap_write_and_wait(inode->i_mapping);
-        if (rc == 0) {
-                struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+        if (!CIFS_I(inode)->clientCanCacheRead)
+                cifs_invalidate_mapping(inode);
 
-                tcon = tlink_tcon(smbfile->tlink);
-                if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOSSYNC))
-                        rc = CIFSSMBFlush(xid, tcon, smbfile->netfid);
-        }
+        tcon = tlink_tcon(smbfile->tlink);
+        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOSSYNC))
+                rc = CIFSSMBFlush(xid, tcon, smbfile->netfid);
+
+        FreeXid(xid);
+        return rc;
+}
+
+int cifs_fsync(struct file *file, int datasync)
+{
+        int xid;
+        int rc = 0;
+        struct cifsTconInfo *tcon;
+        struct cifsFileInfo *smbfile = file->private_data;
+        struct cifs_sb_info *cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
+
+        xid = GetXid();
+
+        cFYI(1, "Sync file - name: %s datasync: 0x%x",
+                file->f_path.dentry->d_name.name, datasync);
+
+        tcon = tlink_tcon(smbfile->tlink);
+        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOSSYNC))
+                rc = CIFSSMBFlush(xid, tcon, smbfile->netfid);
 
         FreeXid(xid);
         return rc;
@@ -1596,42 +1614,244 @@ int cifs_flush(struct file *file, fl_owner_t id)
         return rc;
 }
 
-ssize_t cifs_user_read(struct file *file, char __user *read_data,
-        size_t read_size, loff_t *poffset)
+static int
+cifs_write_allocate_pages(struct page **pages, unsigned long num_pages)
 {
-        int rc = -EACCES;
+        int rc = 0;
+        unsigned long i;
+
+        for (i = 0; i < num_pages; i++) {
+                pages[i] = alloc_page(__GFP_HIGHMEM);
+                if (!pages[i]) {
+                        /*
+                         * save number of pages we have already allocated and
+                         * return with ENOMEM error
+                         */
+                        num_pages = i;
+                        rc = -ENOMEM;
+                        goto error;
+                }
+        }
+
+        return rc;
+
+error:
+        for (i = 0; i < num_pages; i++)
+                put_page(pages[i]);
+        return rc;
+}
+
+static inline
+size_t get_numpages(const size_t wsize, const size_t len, size_t *cur_len)
+{
+        size_t num_pages;
+        size_t clen;
+
+        clen = min_t(const size_t, len, wsize);
+        num_pages = clen / PAGE_CACHE_SIZE;
+        if (clen % PAGE_CACHE_SIZE)
+                num_pages++;
+
+        if (cur_len)
+                *cur_len = clen;
+
+        return num_pages;
+}
+
+static ssize_t
+cifs_iovec_write(struct file *file, const struct iovec *iov,
+                 unsigned long nr_segs, loff_t *poffset)
+{
+        unsigned int written;
+        unsigned long num_pages, npages, i;
+        size_t copied, len, cur_len;
+        ssize_t total_written = 0;
+        struct kvec *to_send;
+        struct page **pages;
+        struct iov_iter it;
+        struct inode *inode;
+        struct cifsFileInfo *open_file;
+        struct cifsTconInfo *pTcon;
+        struct cifs_sb_info *cifs_sb;
+        int xid, rc;
+
+        len = iov_length(iov, nr_segs);
+        if (!len)
+                return 0;
+
+        rc = generic_write_checks(file, poffset, &len, 0);
+        if (rc)
+                return rc;
+
+        cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
+        num_pages = get_numpages(cifs_sb->wsize, len, &cur_len);
+
+        pages = kmalloc(sizeof(struct pages *)*num_pages, GFP_KERNEL);
+        if (!pages)
+                return -ENOMEM;
+
+        to_send = kmalloc(sizeof(struct kvec)*(num_pages + 1), GFP_KERNEL);
+        if (!to_send) {
+                kfree(pages);
+                return -ENOMEM;
+        }
+
+        rc = cifs_write_allocate_pages(pages, num_pages);
+        if (rc) {
+                kfree(pages);
+                kfree(to_send);
+                return rc;
+        }
+
+        xid = GetXid();
+        open_file = file->private_data;
+        pTcon = tlink_tcon(open_file->tlink);
+        inode = file->f_path.dentry->d_inode;
+
+        iov_iter_init(&it, iov, nr_segs, len, 0);
+        npages = num_pages;
+
+        do {
+                size_t save_len = cur_len;
+                for (i = 0; i < npages; i++) {
+                        copied = min_t(const size_t, cur_len, PAGE_CACHE_SIZE);
+                        copied = iov_iter_copy_from_user(pages[i], &it, 0,
+                                                         copied);
+                        cur_len -= copied;
+                        iov_iter_advance(&it, copied);
+                        to_send[i+1].iov_base = kmap(pages[i]);
+                        to_send[i+1].iov_len = copied;
+                }
+
+                cur_len = save_len - cur_len;
+
+                do {
+                        if (open_file->invalidHandle) {
+                                rc = cifs_reopen_file(open_file, false);
+                                if (rc != 0)
+                                        break;
+                        }
+                        rc = CIFSSMBWrite2(xid, pTcon, open_file->netfid,
+                                           cur_len, *poffset, &written,
+                                           to_send, npages, 0);
+                } while (rc == -EAGAIN);
+
+                for (i = 0; i < npages; i++)
+                        kunmap(pages[i]);
+
+                if (written) {
+                        len -= written;
+                        total_written += written;
+                        cifs_update_eof(CIFS_I(inode), *poffset, written);
+                        *poffset += written;
+                } else if (rc < 0) {
+                        if (!total_written)
+                                total_written = rc;
+                        break;
+                }
+
+                /* get length and number of kvecs of the next write */
+                npages = get_numpages(cifs_sb->wsize, len, &cur_len);
+        } while (len > 0);
+
+        if (total_written > 0) {
+                spin_lock(&inode->i_lock);
+                if (*poffset > inode->i_size)
+                        i_size_write(inode, *poffset);
+                spin_unlock(&inode->i_lock);
+        }
+
+        cifs_stats_bytes_written(pTcon, total_written);
+        mark_inode_dirty_sync(inode);
+
+        for (i = 0; i < num_pages; i++)
+                put_page(pages[i]);
+        kfree(to_send);
+        kfree(pages);
+        FreeXid(xid);
+        return total_written;
+}
+
+static ssize_t cifs_user_writev(struct kiocb *iocb, const struct iovec *iov,
+                                unsigned long nr_segs, loff_t pos)
+{
+        ssize_t written;
+        struct inode *inode;
+
+        inode = iocb->ki_filp->f_path.dentry->d_inode;
+
+        /*
+         * BB - optimize the way when signing is disabled. We can drop this
+         * extra memory-to-memory copying and use iovec buffers for constructing
+         * write request.
+         */
+
+        written = cifs_iovec_write(iocb->ki_filp, iov, nr_segs, &pos);
+        if (written > 0) {
+                CIFS_I(inode)->invalid_mapping = true;
+                iocb->ki_pos = pos;
+        }
+
+        return written;
+}
+
+ssize_t cifs_strict_writev(struct kiocb *iocb, const struct iovec *iov,
+                           unsigned long nr_segs, loff_t pos)
+{
+        struct inode *inode;
+
+        inode = iocb->ki_filp->f_path.dentry->d_inode;
+
+        if (CIFS_I(inode)->clientCanCacheAll)
+                return generic_file_aio_write(iocb, iov, nr_segs, pos);
+
+        /*
+         * In strict cache mode we need to write the data to the server exactly
+         * from the pos to pos+len-1 rather than flush all affected pages
+         * because it may cause a error with mandatory locks on these pages but
+         * not on the region from pos to ppos+len-1.
+         */
+
+        return cifs_user_writev(iocb, iov, nr_segs, pos);
+}
+
+static ssize_t
+cifs_iovec_read(struct file *file, const struct iovec *iov,
+                 unsigned long nr_segs, loff_t *poffset)
+{
+        int rc;
+        int xid;
+        ssize_t total_read;
         unsigned int bytes_read = 0;
-        unsigned int total_read = 0;
-        unsigned int current_read_size;
+        size_t len, cur_len;
+        int iov_offset = 0;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
-        int xid;
         struct cifsFileInfo *open_file;
-        char *smb_read_data;
-        char __user *current_offset;
         struct smb_com_read_rsp *pSMBr;
+        char *read_data;
+
+        if (!nr_segs)
+                return 0;
+
+        len = iov_length(iov, nr_segs);
+        if (!len)
+                return 0;
 
         xid = GetXid();
         cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
 
-        if (file->private_data == NULL) {
-                rc = -EBADF;
-                FreeXid(xid);
-                return rc;
-        }
         open_file = file->private_data;
         pTcon = tlink_tcon(open_file->tlink);
 
         if ((file->f_flags & O_ACCMODE) == O_WRONLY)
                 cFYI(1, "attempting read on write only file instance");
 
-        for (total_read = 0, current_offset = read_data;
-             read_size > total_read;
-             total_read += bytes_read, current_offset += bytes_read) {
-                current_read_size = min_t(const int, read_size - total_read,
-                                          cifs_sb->rsize);
+        for (total_read = 0; total_read < len; total_read += bytes_read) {
+                cur_len = min_t(const size_t, len - total_read, cifs_sb->rsize);
                 rc = -EAGAIN;
-                smb_read_data = NULL;
+                read_data = NULL;
+
                 while (rc == -EAGAIN) {
                         int buf_type = CIFS_NO_BUFFER;
                         if (open_file->invalidHandle) {
@@ -1639,27 +1859,25 @@ ssize_t cifs_user_read(struct file *file, char __user *read_data,
                                 if (rc != 0)
                                         break;
                         }
-                        rc = CIFSSMBRead(xid, pTcon,
-                                         open_file->netfid,
-                                         current_read_size, *poffset,
-                                         &bytes_read, &smb_read_data,
-                                         &buf_type);
-                        pSMBr = (struct smb_com_read_rsp *)smb_read_data;
-                        if (smb_read_data) {
-                                if (copy_to_user(current_offset,
-                                                smb_read_data +
-                                                4 /* RFC1001 length field */ +
-                                                le16_to_cpu(pSMBr->DataOffset),
-                                                bytes_read))
+                        rc = CIFSSMBRead(xid, pTcon, open_file->netfid,
+                                         cur_len, *poffset, &bytes_read,
+                                         &read_data, &buf_type);
+                        pSMBr = (struct smb_com_read_rsp *)read_data;
+                        if (read_data) {
+                                char *data_offset = read_data + 4 +
+                                                le16_to_cpu(pSMBr->DataOffset);
+                                if (memcpy_toiovecend(iov, data_offset,
+                                                      iov_offset, bytes_read))
                                         rc = -EFAULT;
-
                                 if (buf_type == CIFS_SMALL_BUFFER)
-                                        cifs_small_buf_release(smb_read_data);
+                                        cifs_small_buf_release(read_data);
                                 else if (buf_type == CIFS_LARGE_BUFFER)
-                                        cifs_buf_release(smb_read_data);
-                                smb_read_data = NULL;
+                                        cifs_buf_release(read_data);
+                                read_data = NULL;
+                                iov_offset += bytes_read;
                         }
                 }
+
                 if (rc || (bytes_read == 0)) {
                         if (total_read) {
                                 break;
@@ -1672,13 +1890,57 @@ ssize_t cifs_user_read(struct file *file, char __user *read_data,
                         *poffset += bytes_read;
                 }
         }
+
         FreeXid(xid);
         return total_read;
 }
 
+ssize_t cifs_user_read(struct file *file, char __user *read_data,
+                       size_t read_size, loff_t *poffset)
+{
+        struct iovec iov;
+        iov.iov_base = read_data;
+        iov.iov_len = read_size;
+
+        return cifs_iovec_read(file, &iov, 1, poffset);
+}
+
+static ssize_t cifs_user_readv(struct kiocb *iocb, const struct iovec *iov,
+                               unsigned long nr_segs, loff_t pos)
+{
+        ssize_t read;
+
+        read = cifs_iovec_read(iocb->ki_filp, iov, nr_segs, &pos);
+        if (read > 0)
+                iocb->ki_pos = pos;
+
+        return read;
+}
+
+ssize_t cifs_strict_readv(struct kiocb *iocb, const struct iovec *iov,
+                          unsigned long nr_segs, loff_t pos)
+{
+        struct inode *inode;
+
+        inode = iocb->ki_filp->f_path.dentry->d_inode;
+
+        if (CIFS_I(inode)->clientCanCacheRead)
+                return generic_file_aio_read(iocb, iov, nr_segs, pos);
+
+        /*
+         * In strict cache mode we need to read from the server all the time
+         * if we don't have level II oplock because the server can delay mtime
+         * change - so we can't make a decision about inode invalidating.
+         * And we can also fail with pagereading if there are mandatory locks
+         * on pages affected by this read but not on the region from pos to
+         * pos+len-1.
+         */
+
+        return cifs_user_readv(iocb, iov, nr_segs, pos);
+}
 
 static ssize_t cifs_read(struct file *file, char *read_data, size_t read_size,
-        loff_t *poffset)
+                         loff_t *poffset)
 {
         int rc = -EACCES;
         unsigned int bytes_read = 0;
@@ -1746,6 +2008,21 @@ static ssize_t cifs_read(struct file *file, char *read_data, size_t read_size,
         return total_read;
 }
 
+int cifs_file_strict_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        int rc, xid;
+        struct inode *inode = file->f_path.dentry->d_inode;
+
+        xid = GetXid();
+
+        if (!CIFS_I(inode)->clientCanCacheRead)
+                cifs_invalidate_mapping(inode);
+
+        rc = generic_file_mmap(file, vma);
+        FreeXid(xid);
+        return rc;
+}
+
 int cifs_file_mmap(struct file *file, struct vm_area_struct *vma)
 {
         int rc, xid;
@@ -2192,7 +2469,8 @@ void cifs_oplock_break(struct work_struct *work)
          */
         if (!cfile->oplock_break_cancelled) {
                 rc = CIFSSMBLock(0, tlink_tcon(cfile->tlink), cfile->netfid, 0,
-                                 0, 0, 0, LOCKING_ANDX_OPLOCK_RELEASE, false);
+                                 0, 0, 0, LOCKING_ANDX_OPLOCK_RELEASE, false,
+                                 cinode->clientCanCacheRead ? 1 : 0);
                 cFYI(1, "Oplock release rc = %d", rc);
         }
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 6c9ee8014ff..8852470b4fb 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -44,13 +44,17 @@ static void cifs_set_ops(struct inode *inode)
                                 inode->i_fop = &cifs_file_direct_nobrl_ops;
                         else
                                 inode->i_fop = &cifs_file_direct_ops;
+                } else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_STRICT_IO) {
+                        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_BRL)
+                                inode->i_fop = &cifs_file_strict_nobrl_ops;
+                        else
+                                inode->i_fop = &cifs_file_strict_ops;
                 } else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_BRL)
                         inode->i_fop = &cifs_file_nobrl_ops;
                 else { /* not direct, send byte range locks */
                         inode->i_fop = &cifs_file_ops;
                 }
 
-
                 /* check if server can support readpages */
                 if (cifs_sb_master_tcon(cifs_sb)->ses->server->maxBuf <
                                 PAGE_CACHE_SIZE + MAX_CIFS_HDR_SIZE)
@@ -1679,7 +1683,7 @@ cifs_inode_needs_reval(struct inode *inode)
 /*
  * Zap the cache. Called when invalid_mapping flag is set.
  */
-static void
+void
 cifs_invalidate_mapping(struct inode *inode)
 {
         int rc;
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 306769de2fb..e8804d37340 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -28,7 +28,6 @@
 #include "cifsproto.h"
 #include "cifs_debug.h"
 #include "cifs_fs_sb.h"
-#include "md5.h"
 
 #define CIFS_MF_SYMLINK_LEN_OFFSET (4+1)
 #define CIFS_MF_SYMLINK_MD5_OFFSET (CIFS_MF_SYMLINK_LEN_OFFSET+(4+1))
@@ -47,6 +46,45 @@
         md5_hash[12], md5_hash[13], md5_hash[14], md5_hash[15]
 
 static int
+symlink_hash(unsigned int link_len, const char *link_str, u8 *md5_hash)
+{
+        int rc;
+        unsigned int size;
+        struct crypto_shash *md5;
+        struct sdesc *sdescmd5;
+
+        md5 = crypto_alloc_shash("md5", 0, 0);
+        if (IS_ERR(md5)) {
+                rc = PTR_ERR(md5);
+                cERROR(1, "%s: Crypto md5 allocation error %d\n", __func__, rc);
+                return rc;
+        }
+        size = sizeof(struct shash_desc) + crypto_shash_descsize(md5);
+        sdescmd5 = kmalloc(size, GFP_KERNEL);
+        if (!sdescmd5) {
+                rc = -ENOMEM;
+                cERROR(1, "%s: Memory allocation failure\n", __func__);
+                goto symlink_hash_err;
+        }
+        sdescmd5->shash.tfm = md5;
+        sdescmd5->shash.flags = 0x0;
+
+        rc = crypto_shash_init(&sdescmd5->shash);
+        if (rc) {
+                cERROR(1, "%s: Could not init md5 shash\n", __func__);
+                goto symlink_hash_err;
+        }
+        crypto_shash_update(&sdescmd5->shash, link_str, link_len);
+        rc = crypto_shash_final(&sdescmd5->shash, md5_hash);
+
+symlink_hash_err:
+        crypto_free_shash(md5);
+        kfree(sdescmd5);
+
+        return rc;
+}
+
+static int
 CIFSParseMFSymlink(const u8 *buf,
                    unsigned int buf_len,
                    unsigned int *_link_len,
@@ -56,7 +94,6 @@ CIFSParseMFSymlink(const u8 *buf,
         unsigned int link_len;
         const char *md5_str1;
         const char *link_str;
-        struct MD5Context md5_ctx;
         u8 md5_hash[16];
         char md5_str2[34];
 
@@ -70,9 +107,11 @@ CIFSParseMFSymlink(const u8 *buf,
         if (rc != 1)
                 return -EINVAL;
 
-        cifs_MD5_init(&md5_ctx);
-        cifs_MD5_update(&md5_ctx, (const u8 *)link_str, link_len);
-        cifs_MD5_final(md5_hash, &md5_ctx);
+        rc = symlink_hash(link_len, link_str, md5_hash);
+        if (rc) {
+                cFYI(1, "%s: MD5 hash failure: %d\n", __func__, rc);
+                return rc;
+        }
 
         snprintf(md5_str2, sizeof(md5_str2),
                  CIFS_MF_SYMLINK_MD5_FORMAT,
@@ -94,9 +133,9 @@ CIFSParseMFSymlink(const u8 *buf,
 static int
 CIFSFormatMFSymlink(u8 *buf, unsigned int buf_len, const char *link_str)
 {
+        int rc;
         unsigned int link_len;
         unsigned int ofs;
-        struct MD5Context md5_ctx;
         u8 md5_hash[16];
 
         if (buf_len != CIFS_MF_SYMLINK_FILE_SIZE)
@@ -107,9 +146,11 @@ CIFSFormatMFSymlink(u8 *buf, unsigned int buf_len, const char *link_str)
         if (link_len > CIFS_MF_SYMLINK_LINK_MAXLEN)
                 return -ENAMETOOLONG;
 
-        cifs_MD5_init(&md5_ctx);
-        cifs_MD5_update(&md5_ctx, (const u8 *)link_str, link_len);
-        cifs_MD5_final(md5_hash, &md5_ctx);
+        rc = symlink_hash(link_len, link_str, md5_hash);
+        if (rc) {
+                cFYI(1, "%s: MD5 hash failure: %d\n", __func__, rc);
+                return rc;
+        }
 
         snprintf(buf, buf_len,
                  CIFS_MF_SYMLINK_LEN_FORMAT CIFS_MF_SYMLINK_MD5_FORMAT,
diff --git a/fs/cifs/md4.c b/fs/cifs/md4.c
deleted file mode 100644
index a725c2609d6..00000000000
--- a/fs/cifs/md4.c
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
-   Unix SMB/Netbios implementation.
-   Version 1.9.
-   a implementation of MD4 designed for use in the SMB authentication protocol
-   Copyright (C) Andrew Tridgell 1997-1998.
-   Modified by Steve French (sfrench@us.ibm.com) 2002-2003
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-#include <linux/module.h>
-#include <linux/fs.h>
-#include "cifsencrypt.h"
-
-/* NOTE: This code makes no attempt to be fast! */
-
-static __u32
-F(__u32 X, __u32 Y, __u32 Z)
-{
-        return (X & Y) | ((~X) & Z);
-}
-
-static __u32
-G(__u32 X, __u32 Y, __u32 Z)
-{
-        return (X & Y) | (X & Z) | (Y & Z);
-}
-
-static __u32
-H(__u32 X, __u32 Y, __u32 Z)
-{
-        return X ^ Y ^ Z;
-}
-
-static __u32
-lshift(__u32 x, int s)
-{
-        x &= 0xFFFFFFFF;
-        return ((x << s) & 0xFFFFFFFF) | (x >> (32 - s));
-}
-
-#define ROUND1(a,b,c,d,k,s) (*a) = lshift((*a) + F(*b,*c,*d) + X[k], s)
-#define ROUND2(a,b,c,d,k,s) (*a) = lshift((*a) + G(*b,*c,*d) + X[k] + (__u32)0x5A827999,s)
-#define ROUND3(a,b,c,d,k,s) (*a) = lshift((*a) + H(*b,*c,*d) + X[k] + (__u32)0x6ED9EBA1,s)
-
-/* this applies md4 to 64 byte chunks */
-static void
-mdfour64(__u32 *M, __u32 *A, __u32 *B, __u32 *C, __u32 *D)
-{
-        int j;
-        __u32 AA, BB, CC, DD;
-        __u32 X[16];
-
-
-        for (j = 0; j < 16; j++)
-                X[j] = M[j];
-
-        AA = *A;
-        BB = *B;
-        CC = *C;
-        DD = *D;
-
-        ROUND1(A, B, C, D, 0, 3);
-        ROUND1(D, A, B, C, 1, 7);
-        ROUND1(C, D, A, B, 2, 11);
-        ROUND1(B, C, D, A, 3, 19);
-        ROUND1(A, B, C, D, 4, 3);
-        ROUND1(D, A, B, C, 5, 7);
-        ROUND1(C, D, A, B, 6, 11);
-        ROUND1(B, C, D, A, 7, 19);
-        ROUND1(A, B, C, D, 8, 3);
-        ROUND1(D, A, B, C, 9, 7);
-        ROUND1(C, D, A, B, 10, 11);
-        ROUND1(B, C, D, A, 11, 19);
-        ROUND1(A, B, C, D, 12, 3);
-        ROUND1(D, A, B, C, 13, 7);
-        ROUND1(C, D, A, B, 14, 11);
-        ROUND1(B, C, D, A, 15, 19);
-
-        ROUND2(A, B, C, D, 0, 3);
-        ROUND2(D, A, B, C, 4, 5);
-        ROUND2(C, D, A, B, 8, 9);
-        ROUND2(B, C, D, A, 12, 13);
-        ROUND2(A, B, C, D, 1, 3);
-        ROUND2(D, A, B, C, 5, 5);
-        ROUND2(C, D, A, B, 9, 9);
-        ROUND2(B, C, D, A, 13, 13);
-        ROUND2(A, B, C, D, 2, 3);
-        ROUND2(D, A, B, C, 6, 5);
-        ROUND2(C, D, A, B, 10, 9);
-        ROUND2(B, C, D, A, 14, 13);
-        ROUND2(A, B, C, D, 3, 3);
-        ROUND2(D, A, B, C, 7, 5);
-        ROUND2(C, D, A, B, 11, 9);
-        ROUND2(B, C, D, A, 15, 13);
-
-        ROUND3(A, B, C, D, 0, 3);
-        ROUND3(D, A, B, C, 8, 9);
-        ROUND3(C, D, A, B, 4, 11);
-        ROUND3(B, C, D, A, 12, 15);
-        ROUND3(A, B, C, D, 2, 3);
-        ROUND3(D, A, B, C, 10, 9);
-        ROUND3(C, D, A, B, 6, 11);
-        ROUND3(B, C, D, A, 14, 15);
-        ROUND3(A, B, C, D, 1, 3);
-        ROUND3(D, A, B, C, 9, 9);
-        ROUND3(C, D, A, B, 5, 11);
-        ROUND3(B, C, D, A, 13, 15);
-        ROUND3(A, B, C, D, 3, 3);
-        ROUND3(D, A, B, C, 11, 9);
-        ROUND3(C, D, A, B, 7, 11);
-        ROUND3(B, C, D, A, 15, 15);
-
-        *A += AA;
-        *B += BB;
-        *C += CC;
-        *D += DD;
-
-        *A &= 0xFFFFFFFF;
-        *B &= 0xFFFFFFFF;
-        *C &= 0xFFFFFFFF;
-        *D &= 0xFFFFFFFF;
-
-        for (j = 0; j < 16; j++)
-                X[j] = 0;
-}
-
-static void
-copy64(__u32 *M, unsigned char *in)
-{
-        int i;
-
-        for (i = 0; i < 16; i++)
-                M[i] = (in[i * 4 + 3] << 24) | (in[i * 4 + 2] << 16) |
-                    (in[i * 4 + 1] << 8) | (in[i * 4 + 0] << 0);
-}
-
-static void
-copy4(unsigned char *out, __u32 x)
-{
-        out[0] = x & 0xFF;
-        out[1] = (x >> 8) & 0xFF;
-        out[2] = (x >> 16) & 0xFF;
-        out[3] = (x >> 24) & 0xFF;
-}
-
-/* produce a md4 message digest from data of length n bytes */
-void
-mdfour(unsigned char *out, unsigned char *in, int n)
-{
-        unsigned char buf[128];
-        __u32 M[16];
-        __u32 b = n * 8;
-        int i;
-        __u32 A = 0x67452301;
-        __u32 B = 0xefcdab89;
-        __u32 C = 0x98badcfe;
-        __u32 D = 0x10325476;
-
-        while (n > 64) {
-                copy64(M, in);
-                mdfour64(M, &A, &B, &C, &D);
-                in += 64;
-                n -= 64;
-        }
-
-        for (i = 0; i < 128; i++)
-                buf[i] = 0;
-        memcpy(buf, in, n);
-        buf[n] = 0x80;
-
-        if (n <= 55) {
-                copy4(buf + 56, b);
-                copy64(M, buf);
-                mdfour64(M, &A, &B, &C, &D);
-        } else {
-                copy4(buf + 120, b);
-                copy64(M, buf);
-                mdfour64(M, &A, &B, &C, &D);
-                copy64(M, buf + 64);
-                mdfour64(M, &A, &B, &C, &D);
-        }
-
-        for (i = 0; i < 128; i++)
-                buf[i] = 0;
-        copy64(M, buf);
-
-        copy4(out, A);
-        copy4(out + 4, B);
-        copy4(out + 8, C);
-        copy4(out + 12, D);
-
-        A = B = C = D = 0;
-}
diff --git a/fs/cifs/md5.c b/fs/cifs/md5.c
deleted file mode 100644
index 98b66a54c31..00000000000
--- a/fs/cifs/md5.c
+++ /dev/null
@@ -1,366 +0,0 @@
-/*
- * This code implements the MD5 message-digest algorithm.
- * The algorithm is due to Ron Rivest.  This code was
- * written by Colin Plumb in 1993, no copyright is claimed.
- * This code is in the public domain; do with it what you wish.
- *
- * Equivalent code is available from RSA Data Security, Inc.
- * This code has been tested against that, and is equivalent,
- * except that you don't need to include two pages of legalese
- * with every copy.
- *
- * To compute the message digest of a chunk of bytes, declare an
- * MD5Context structure, pass it to cifs_MD5_init, call cifs_MD5_update as
- * needed on buffers full of bytes, and then call cifs_MD5_final, which
- * will fill a supplied 16-byte array with the digest.
- */
-
-/* This code slightly modified to fit into Samba by
-   abartlet@samba.org Jun 2001
-   and to fit the cifs vfs by
-   Steve French sfrench@us.ibm.com */
-
-#include <linux/string.h>
-#include "md5.h"
-
-static void MD5Transform(__u32 buf[4], __u32 const in[16]);
-
-/*
- * Note: this code is harmless on little-endian machines.
- */
-static void
-byteReverse(unsigned char *buf, unsigned longs)
-{
-        __u32 t;
-        do {
-                t = (__u32) ((unsigned) buf[3] << 8 | buf[2]) << 16 |
-                    ((unsigned) buf[1] << 8 | buf[0]);
-                *(__u32 *) buf = t;
-                buf += 4;
-        } while (--longs);
-}
-
-/*
- * Start MD5 accumulation.  Set bit count to 0 and buffer to mysterious
- * initialization constants.
- */
-void
-cifs_MD5_init(struct MD5Context *ctx)
-{
-        ctx->buf[0] = 0x67452301;
-        ctx->buf[1] = 0xefcdab89;
-        ctx->buf[2] = 0x98badcfe;
-        ctx->buf[3] = 0x10325476;
-
-        ctx->bits[0] = 0;
-        ctx->bits[1] = 0;
-}
-
-/*
- * Update context to reflect the concatenation of another buffer full
- * of bytes.
- */
-void
-cifs_MD5_update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
-{
-        register __u32 t;
-
-        /* Update bitcount */
-
-        t = ctx->bits[0];
-        if ((ctx->bits[0] = t + ((__u32) len << 3)) < t)
-                ctx->bits[1]++; /* Carry from low to high */
-        ctx->bits[1] += len >> 29;
-
-        t = (t >> 3) & 0x3f;    /* Bytes already in shsInfo->data */
-
-        /* Handle any leading odd-sized chunks */
-
-        if (t) {
-                unsigned char *p = (unsigned char *) ctx->in + t;
-
-                t = 64 - t;
-                if (len < t) {
-                        memmove(p, buf, len);
-                        return;
-                }
-                memmove(p, buf, t);
-                byteReverse(ctx->in, 16);
-                MD5Transform(ctx->buf, (__u32 *) ctx->in);
-                buf += t;
-                len -= t;
-        }
-        /* Process data in 64-byte chunks */
-
-        while (len >= 64) {
-                memmove(ctx->in, buf, 64);
-                byteReverse(ctx->in, 16);
-                MD5Transform(ctx->buf, (__u32 *) ctx->in);
-                buf += 64;
-                len -= 64;
-        }
-
-        /* Handle any remaining bytes of data. */
-
-        memmove(ctx->in, buf, len);
-}
-
-/*
- * Final wrapup - pad to 64-byte boundary with the bit pattern
- * 1 0* (64-bit count of bits processed, MSB-first)
- */
-void
-cifs_MD5_final(unsigned char digest[16], struct MD5Context *ctx)
-{
-        unsigned int count;
-        unsigned char *p;
-
-        /* Compute number of bytes mod 64 */
-        count = (ctx->bits[0] >> 3) & 0x3F;
-
-        /* Set the first char of padding to 0x80.  This is safe since there is
-           always at least one byte free */
-        p = ctx->in + count;
-        *p++ = 0x80;
-
-        /* Bytes of padding needed to make 64 bytes */
-        count = 64 - 1 - count;
-
-        /* Pad out to 56 mod 64 */
-        if (count < 8) {
-                /* Two lots of padding:  Pad the first block to 64 bytes */
-                memset(p, 0, count);
-                byteReverse(ctx->in, 16);
-                MD5Transform(ctx->buf, (__u32 *) ctx->in);
-
-                /* Now fill the next block with 56 bytes */
-                memset(ctx->in, 0, 56);
-        } else {
-                /* Pad block to 56 bytes */
-                memset(p, 0, count - 8);
-        }
-        byteReverse(ctx->in, 14);
-
-        /* Append length in bits and transform */
-        ((__u32 *) ctx->in)[14] = ctx->bits[0];
-        ((__u32 *) ctx->in)[15] = ctx->bits[1];
-
-        MD5Transform(ctx->buf, (__u32 *) ctx->in);
-        byteReverse((unsigned char *) ctx->buf, 4);
-        memmove(digest, ctx->buf, 16);
-        memset(ctx, 0, sizeof(*ctx));   /* In case it's sensitive */
-}
-
-/* The four core functions - F1 is optimized somewhat */
-
-/* #define F1(x, y, z) (x & y | ~x & z) */
-#define F1(x, y, z) (z ^ (x & (y ^ z)))
-#define F2(x, y, z) F1(z, x, y)
-#define F3(x, y, z) (x ^ y ^ z)
-#define F4(x, y, z) (y ^ (x | ~z))
-
-/* This is the central step in the MD5 algorithm. */
-#define MD5STEP(f, w, x, y, z, data, s) \
-        (w += f(x, y, z) + data,  w = w<<s | w>>(32-s),  w += x)
-
-/*
- * The core of the MD5 algorithm, this alters an existing MD5 hash to
- * reflect the addition of 16 longwords of new data.  cifs_MD5_update blocks
- * the data and converts bytes into longwords for this routine.
- */
-static void
-MD5Transform(__u32 buf[4], __u32 const in[16])
-{
-        register __u32 a, b, c, d;
-
-        a = buf[0];
-        b = buf[1];
-        c = buf[2];
-        d = buf[3];
-
-        MD5STEP(F1, a, b, c, d, in[0] + 0xd76aa478, 7);
-        MD5STEP(F1, d, a, b, c, in[1] + 0xe8c7b756, 12);
-        MD5STEP(F1, c, d, a, b, in[2] + 0x242070db, 17);
-        MD5STEP(F1, b, c, d, a, in[3] + 0xc1bdceee, 22);
-        MD5STEP(F1, a, b, c, d, in[4] + 0xf57c0faf, 7);
-        MD5STEP(F1, d, a, b, c, in[5] + 0x4787c62a, 12);
-        MD5STEP(F1, c, d, a, b, in[6] + 0xa8304613, 17);
-        MD5STEP(F1, b, c, d, a, in[7] + 0xfd469501, 22);
-        MD5STEP(F1, a, b, c, d, in[8] + 0x698098d8, 7);
-        MD5STEP(F1, d, a, b, c, in[9] + 0x8b44f7af, 12);
-        MD5STEP(F1, c, d, a, b, in[10] + 0xffff5bb1, 17);
-        MD5STEP(F1, b, c, d, a, in[11] + 0x895cd7be, 22);
-        MD5STEP(F1, a, b, c, d, in[12] + 0x6b901122, 7);
-        MD5STEP(F1, d, a, b, c, in[13] + 0xfd987193, 12);
-        MD5STEP(F1, c, d, a, b, in[14] + 0xa679438e, 17);
-        MD5STEP(F1, b, c, d, a, in[15] + 0x49b40821, 22);
-
-        MD5STEP(F2, a, b, c, d, in[1] + 0xf61e2562, 5);
-        MD5STEP(F2, d, a, b, c, in[6] + 0xc040b340, 9);
-        MD5STEP(F2, c, d, a, b, in[11] + 0x265e5a51, 14);
-        MD5STEP(F2, b, c, d, a, in[0] + 0xe9b6c7aa, 20);
-        MD5STEP(F2, a, b, c, d, in[5] + 0xd62f105d, 5);
-        MD5STEP(F2, d, a, b, c, in[10] + 0x02441453, 9);
-        MD5STEP(F2, c, d, a, b, in[15] + 0xd8a1e681, 14);
-        MD5STEP(F2, b, c, d, a, in[4] + 0xe7d3fbc8, 20);
-        MD5STEP(F2, a, b, c, d, in[9] + 0x21e1cde6, 5);
-        MD5STEP(F2, d, a, b, c, in[14] + 0xc33707d6, 9);
-        MD5STEP(F2, c, d, a, b, in[3] + 0xf4d50d87, 14);
-        MD5STEP(F2, b, c, d, a, in[8] + 0x455a14ed, 20);
-        MD5STEP(F2, a, b, c, d, in[13] + 0xa9e3e905, 5);
-        MD5STEP(F2, d, a, b, c, in[2] + 0xfcefa3f8, 9);
-        MD5STEP(F2, c, d, a, b, in[7] + 0x676f02d9, 14);
-        MD5STEP(F2, b, c, d, a, in[12] + 0x8d2a4c8a, 20);
-
-        MD5STEP(F3, a, b, c, d, in[5] + 0xfffa3942, 4);
-        MD5STEP(F3, d, a, b, c, in[8] + 0x8771f681, 11);
-        MD5STEP(F3, c, d, a, b, in[11] + 0x6d9d6122, 16);
-        MD5STEP(F3, b, c, d, a, in[14] + 0xfde5380c, 23);
-        MD5STEP(F3, a, b, c, d, in[1] + 0xa4beea44, 4);
-        MD5STEP(F3, d, a, b, c, in[4] + 0x4bdecfa9, 11);
-        MD5STEP(F3, c, d, a, b, in[7] + 0xf6bb4b60, 16);
-        MD5STEP(F3, b, c, d, a, in[10] + 0xbebfbc70, 23);
-        MD5STEP(F3, a, b, c, d, in[13] + 0x289b7ec6, 4);
-        MD5STEP(F3, d, a, b, c, in[0] + 0xeaa127fa, 11);
-        MD5STEP(F3, c, d, a, b, in[3] + 0xd4ef3085, 16);
-        MD5STEP(F3, b, c, d, a, in[6] + 0x04881d05, 23);
-        MD5STEP(F3, a, b, c, d, in[9] + 0xd9d4d039, 4);
-        MD5STEP(F3, d, a, b, c, in[12] + 0xe6db99e5, 11);
-        MD5STEP(F3, c, d, a, b, in[15] + 0x1fa27cf8, 16);
-        MD5STEP(F3, b, c, d, a, in[2] + 0xc4ac5665, 23);
-
-        MD5STEP(F4, a, b, c, d, in[0] + 0xf4292244, 6);
-        MD5STEP(F4, d, a, b, c, in[7] + 0x432aff97, 10);
-        MD5STEP(F4, c, d, a, b, in[14] + 0xab9423a7, 15);
-        MD5STEP(F4, b, c, d, a, in[5] + 0xfc93a039, 21);
-        MD5STEP(F4, a, b, c, d, in[12] + 0x655b59c3, 6);
-        MD5STEP(F4, d, a, b, c, in[3] + 0x8f0ccc92, 10);
-        MD5STEP(F4, c, d, a, b, in[10] + 0xffeff47d, 15);
-        MD5STEP(F4, b, c, d, a, in[1] + 0x85845dd1, 21);
-        MD5STEP(F4, a, b, c, d, in[8] + 0x6fa87e4f, 6);
-        MD5STEP(F4, d, a, b, c, in[15] + 0xfe2ce6e0, 10);
-        MD5STEP(F4, c, d, a, b, in[6] + 0xa3014314, 15);
-        MD5STEP(F4, b, c, d, a, in[13] + 0x4e0811a1, 21);
-        MD5STEP(F4, a, b, c, d, in[4] + 0xf7537e82, 6);
-        MD5STEP(F4, d, a, b, c, in[11] + 0xbd3af235, 10);
-        MD5STEP(F4, c, d, a, b, in[2] + 0x2ad7d2bb, 15);
-        MD5STEP(F4, b, c, d, a, in[9] + 0xeb86d391, 21);
-
-        buf[0] += a;
-        buf[1] += b;
-        buf[2] += c;
-        buf[3] += d;
-}
-
-#if 0   /* currently unused */
-/***********************************************************************
- the rfc 2104 version of hmac_md5 initialisation.
-***********************************************************************/
-static void
-hmac_md5_init_rfc2104(unsigned char *key, int key_len,
-                      struct HMACMD5Context *ctx)
-{
-        int i;
-
-        /* if key is longer than 64 bytes reset it to key=MD5(key) */
-        if (key_len > 64) {
-                unsigned char tk[16];
-                struct MD5Context tctx;
-
-                cifs_MD5_init(&tctx);
-                cifs_MD5_update(&tctx, key, key_len);
-                cifs_MD5_final(tk, &tctx);
-
-                key = tk;
-                key_len = 16;
-        }
-
-        /* start out by storing key in pads */
-        memset(ctx->k_ipad, 0, sizeof(ctx->k_ipad));
-        memset(ctx->k_opad, 0, sizeof(ctx->k_opad));
-        memcpy(ctx->k_ipad, key, key_len);
-        memcpy(ctx->k_opad, key, key_len);
-
-        /* XOR key with ipad and opad values */
-        for (i = 0; i < 64; i++) {
-                ctx->k_ipad[i] ^= 0x36;
-                ctx->k_opad[i] ^= 0x5c;
-        }
-
-        cifs_MD5_init(&ctx->ctx);
-        cifs_MD5_update(&ctx->ctx, ctx->k_ipad, 64);
-}
-#endif
-
-/***********************************************************************
- the microsoft version of hmac_md5 initialisation.
-***********************************************************************/
-void
-hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
-                         struct HMACMD5Context *ctx)
-{
-        int i;
-
-        /* if key is longer than 64 bytes truncate it */
-        if (key_len > 64)
-                key_len = 64;
-
-        /* start out by storing key in pads */
-        memset(ctx->k_ipad, 0, sizeof(ctx->k_ipad));
-        memset(ctx->k_opad, 0, sizeof(ctx->k_opad));
-        memcpy(ctx->k_ipad, key, key_len);
-        memcpy(ctx->k_opad, key, key_len);
-
-        /* XOR key with ipad and opad values */
-        for (i = 0; i < 64; i++) {
-                ctx->k_ipad[i] ^= 0x36;
-                ctx->k_opad[i] ^= 0x5c;
-        }
-
-        cifs_MD5_init(&ctx->ctx);
-        cifs_MD5_update(&ctx->ctx, ctx->k_ipad, 64);
-}
-
-/***********************************************************************
- update hmac_md5 "inner" buffer
-***********************************************************************/
-void
-hmac_md5_update(const unsigned char *text, int text_len,
-                struct HMACMD5Context *ctx)
-{
-        cifs_MD5_update(&ctx->ctx, text, text_len);     /* then text of datagram */
-}
-
-/***********************************************************************
- finish off hmac_md5 "inner" buffer and generate outer one.
-***********************************************************************/
-void
-hmac_md5_final(unsigned char *digest, struct HMACMD5Context *ctx)
-{
-        struct MD5Context ctx_o;
-
-        cifs_MD5_final(digest, &ctx->ctx);
-
-        cifs_MD5_init(&ctx_o);
-        cifs_MD5_update(&ctx_o, ctx->k_opad, 64);
-        cifs_MD5_update(&ctx_o, digest, 16);
-        cifs_MD5_final(digest, &ctx_o);
-}
-
-/***********************************************************
- single function to calculate an HMAC MD5 digest from data.
- use the microsoft hmacmd5 init method because the key is 16 bytes.
-************************************************************/
-#if 0 /* currently unused */
-static void
-hmac_md5(unsigned char key[16], unsigned char *data, int data_len,
-         unsigned char *digest)
-{
-        struct HMACMD5Context ctx;
-        hmac_md5_init_limK_to_64(key, 16, &ctx);
-        if (data_len != 0)
-                hmac_md5_update(data, data_len, &ctx);
-
-        hmac_md5_final(digest, &ctx);
-}
-#endif
diff --git a/fs/cifs/md5.h b/fs/cifs/md5.h
deleted file mode 100644
index 6fba8cb402f..00000000000
--- a/fs/cifs/md5.h
+++ /dev/null
@@ -1,38 +0,0 @@
-#ifndef MD5_H
-#define MD5_H
-#ifndef HEADER_MD5_H
-/* Try to avoid clashes with OpenSSL */
-#define HEADER_MD5_H
-#endif
-
-struct MD5Context {
-        __u32 buf[4];
-        __u32 bits[2];
-        unsigned char in[64];
-};
-#endif                          /* !MD5_H */
-
-#ifndef _HMAC_MD5_H
-struct HMACMD5Context {
-        struct MD5Context ctx;
-        unsigned char k_ipad[65];
-        unsigned char k_opad[65];
-};
-#endif                          /* _HMAC_MD5_H */
-
-void cifs_MD5_init(struct MD5Context *context);
-void cifs_MD5_update(struct MD5Context *context, unsigned char const *buf,
-                        unsigned len);
-void cifs_MD5_final(unsigned char digest[16], struct MD5Context *context);
-
-/* The following definitions come from lib/hmacmd5.c  */
-
-/* void hmac_md5_init_rfc2104(unsigned char *key, int key_len,
-                        struct HMACMD5Context *ctx);*/
-void hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
-                        struct HMACMD5Context *ctx);
-void hmac_md5_update(const unsigned char *text, int text_len,
-                        struct HMACMD5Context *ctx);
-void hmac_md5_final(unsigned char *digest, struct HMACMD5Context *ctx);
-/* void hmac_md5(unsigned char key[16], unsigned char *data, int data_len,
-                        unsigned char *digest);*/
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 43f10281bc1..2a930a752a7 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -236,10 +236,7 @@ __u16 GetNextMid(struct TCP_Server_Info *server)
 {
         __u16 mid = 0;
         __u16 last_mid;
-        int   collision;
-
-        if (server == NULL)
-                return mid;
+        bool collision;
 
         spin_lock(&GlobalMid_Lock);
         last_mid = server->CurrentMid; /* we do not want to loop forever */
@@ -252,24 +249,38 @@ __u16 GetNextMid(struct TCP_Server_Info *server)
         (and it would also have to have been a request that
          did not time out) */
         while (server->CurrentMid != last_mid) {
-                struct list_head *tmp;
                 struct mid_q_entry *mid_entry;
+                unsigned int num_mids;
 
-                collision = 0;
+                collision = false;
                 if (server->CurrentMid == 0)
                         server->CurrentMid++;
 
-                list_for_each(tmp, &server->pending_mid_q) {
-                        mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
-
-                        if ((mid_entry->mid == server->CurrentMid) &&
-                            (mid_entry->midState == MID_REQUEST_SUBMITTED)) {
+                num_mids = 0;
+                list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
+                        ++num_mids;
+                        if (mid_entry->mid == server->CurrentMid &&
+                            mid_entry->midState == MID_REQUEST_SUBMITTED) {
                                 /* This mid is in use, try a different one */
-                                collision = 1;
+                                collision = true;
                                 break;
                         }
                 }
-                if (collision == 0) {
+
+                /*
+                 * if we have more than 32k mids in the list, then something
+                 * is very wrong. Possibly a local user is trying to DoS the
+                 * box by issuing long-running calls and SIGKILL'ing them. If
+                 * we get to 2^16 mids then we're in big trouble as this
+                 * function could loop forever.
+                 *
+                 * Go ahead and assign out the mid in this situation, but force
+                 * an eventual reconnect to clean out the pending_mid_q.
+                 */
+                if (num_mids > 32768)
+                        server->tcpStatus = CifsNeedReconnect;
+
+                if (!collision) {
                         mid = server->CurrentMid;
                         break;
                 }
@@ -381,29 +392,31 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
 }
 
 static int
-checkSMBhdr(struct smb_hdr *smb, __u16 mid)
+check_smb_hdr(struct smb_hdr *smb, __u16 mid)
 {
-        /* Make sure that this really is an SMB, that it is a response,
-           and that the message ids match */
-        if ((*(__le32 *) smb->Protocol == cpu_to_le32(0x424d53ff)) &&
-                (mid == smb->Mid)) {
-                if (smb->Flags & SMBFLG_RESPONSE)
-                        return 0;
-                else {
-                /* only one valid case where server sends us request */
-                        if (smb->Command == SMB_COM_LOCKING_ANDX)
-                                return 0;
-                        else
-                                cERROR(1, "Received Request not response");
-                }
-        } else { /* bad signature or mid */
-                if (*(__le32 *) smb->Protocol != cpu_to_le32(0x424d53ff))
-                        cERROR(1, "Bad protocol string signature header %x",
-                                *(unsigned int *) smb->Protocol);
-                if (mid != smb->Mid)
-                        cERROR(1, "Mids do not match");
+        /* does it have the right SMB "signature" ? */
+        if (*(__le32 *) smb->Protocol != cpu_to_le32(0x424d53ff)) {
+                cERROR(1, "Bad protocol string signature header 0x%x",
+                        *(unsigned int *)smb->Protocol);
+                return 1;
         }
-        cERROR(1, "bad smb detected. The Mid=%d", smb->Mid);
+
+        /* Make sure that message ids match */
+        if (mid != smb->Mid) {
+                cERROR(1, "Mids do not match. received=%u expected=%u",
+                        smb->Mid, mid);
+                return 1;
+        }
+
+        /* if it's a response then accept */
+        if (smb->Flags & SMBFLG_RESPONSE)
+                return 0;
+
+        /* only one valid case where server sends us request */
+        if (smb->Command == SMB_COM_LOCKING_ANDX)
+                return 0;
+
+        cERROR(1, "Server sent request, not response. mid=%u", smb->Mid);
         return 1;
 }
 
@@ -448,7 +461,7 @@ checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
                 return 1;
         }
 
-        if (checkSMBhdr(smb, mid))
+        if (check_smb_hdr(smb, mid))
                 return 1;
         clc_len = smbCalcSize_LE(smb);
 
@@ -465,25 +478,26 @@ checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
                         if (((4 + len) & 0xFFFF) == (clc_len & 0xFFFF))
                                 return 0; /* bcc wrapped */
                 }
-                cFYI(1, "Calculated size %d vs length %d mismatch for mid %d",
+                cFYI(1, "Calculated size %u vs length %u mismatch for mid=%u",
                                 clc_len, 4 + len, smb->Mid);
-                /* Windows XP can return a few bytes too much, presumably
-                an illegal pad, at the end of byte range lock responses
-                so we allow for that three byte pad, as long as actual
-                received length is as long or longer than calculated length */
-                /* We have now had to extend this more, since there is a
-                case in which it needs to be bigger still to handle a
-                malformed response to transact2 findfirst from WinXP when
-                access denied is returned and thus bcc and wct are zero
-                but server says length is 0x21 bytes too long as if the server
-                forget to reset the smb rfc1001 length when it reset the
-                wct and bcc to minimum size and drop the t2 parms and data */
-                if ((4+len > clc_len) && (len <= clc_len + 512))
-                        return 0;
-                else {
-                        cERROR(1, "RFC1001 size %d bigger than SMB for Mid=%d",
+
+                if (4 + len < clc_len) {
+                        cERROR(1, "RFC1001 size %u smaller than SMB for mid=%u",
                                         len, smb->Mid);
                         return 1;
+                } else if (len > clc_len + 512) {
+                        /*
+                         * Some servers (Windows XP in particular) send more
+                         * data than the lengths in the SMB packet would
+                         * indicate on certain calls (byte range locks and
+                         * trans2 find first calls in particular). While the
+                         * client can handle such a frame by ignoring the
+                         * trailing data, we choose limit the amount of extra
+                         * data to 512 bytes.
+                         */
+                        cERROR(1, "RFC1001 size %u more than 512 bytes larger "
+                                  "than SMB for mid=%u", len, smb->Mid);
+                        return 1;
                 }
         }
         return 0;
@@ -571,7 +585,7 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                                 pCifsInode = CIFS_I(netfile->dentry->d_inode);
 
                                 cifs_set_oplock_level(pCifsInode,
-                                                      pSMB->OplockLevel);
+                                        pSMB->OplockLevel ? OPLOCK_READ : 0);
                                 /*
                                  * cifs_oplock_break_put() can't be called
                                  * from here.  Get reference after queueing
@@ -637,77 +651,6 @@ dump_smb(struct smb_hdr *smb_buf, int smb_buf_length)
         return;
 }
 
-/* Convert 16 bit Unicode pathname to wire format from string in current code
-   page.  Conversion may involve remapping up the seven characters that are
-   only legal in POSIX-like OS (if they are present in the string). Path
-   names are little endian 16 bit Unicode on the wire */
-int
-cifsConvertToUCS(__le16 *target, const char *source, int maxlen,
-                 const struct nls_table *cp, int mapChars)
-{
-        int i, j, charlen;
-        int len_remaining = maxlen;
-        char src_char;
-        __u16 temp;
-
-        if (!mapChars)
-                return cifs_strtoUCS(target, source, PATH_MAX, cp);
-
-        for (i = 0, j = 0; i < maxlen; j++) {
-                src_char = source[i];
-                switch (src_char) {
-                        case 0:
-                                target[j] = 0;
-                                goto ctoUCS_out;
-                        case ':':
-                                target[j] = cpu_to_le16(UNI_COLON);
-                                break;
-                        case '*':
-                                target[j] = cpu_to_le16(UNI_ASTERIK);
-                                break;
-                        case '?':
-                                target[j] = cpu_to_le16(UNI_QUESTION);
-                                break;
-                        case '<':
-                                target[j] = cpu_to_le16(UNI_LESSTHAN);
-                                break;
-                        case '>':
-                                target[j] = cpu_to_le16(UNI_GRTRTHAN);
-                                break;
-                        case '|':
-                                target[j] = cpu_to_le16(UNI_PIPE);
-                                break;
-                        /* BB We can not handle remapping slash until
-                           all the calls to build_path_from_dentry
-                           are modified, as they use slash as separator BB */
-                        /* case '\\':
-                                target[j] = cpu_to_le16(UNI_SLASH);
-                                break;*/
-                        default:
-                                charlen = cp->char2uni(source+i,
-                                        len_remaining, &temp);
-                                /* if no match, use question mark, which
-                                at least in some cases servers as wild card */
-                                if (charlen < 1) {
-                                        target[j] = cpu_to_le16(0x003f);
-                                        charlen = 1;
-                                } else
-                                        target[j] = cpu_to_le16(temp);
-                                len_remaining -= charlen;
-                                /* character may take more than one byte in the
-                                   the source string, but will take exactly two
-                                   bytes in the target string */
-                                i += charlen;
-                                continue;
-                }
-                i++; /* move to next char in source string */
-                len_remaining--;
-        }
-
-ctoUCS_out:
-        return i;
-}
-
 void
 cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
 {
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index 6783ce6cdc8..8d9189f6447 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -916,14 +916,14 @@ unsigned int
 smbCalcSize(struct smb_hdr *ptr)
 {
         return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
-                2 /* size of the bcc field */ + BCC(ptr));
+                2 /* size of the bcc field */ + get_bcc(ptr));
 }
 
 unsigned int
 smbCalcSize_LE(struct smb_hdr *ptr)
 {
         return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
-                2 /* size of the bcc field */ + le16_to_cpu(BCC_LE(ptr)));
+                2 /* size of the bcc field */ + get_bcc_le(ptr));
 }
 
 /* The following are taken from fs/ntfs/util.c */
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 7f25cc3d225..f8e4cd2a791 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -764,7 +764,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
 {
         int rc = 0;
         int xid, i;
-        struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
         struct cifsFileInfo *cifsFile = NULL;
         char *current_entry;
@@ -775,8 +774,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
 
         xid = GetXid();
 
-        cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
-
         /*
          * Ensure FindFirst doesn't fail before doing filldir() for '.' and
          * '..'. Otherwise we won't be able to notify VFS in case of failure.
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index eb746486e49..1adc9625a34 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -277,7 +277,7 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
 }
 
 static void
-decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifsSesInfo *ses,
+decode_unicode_ssetup(char **pbcc_area, __u16 bleft, struct cifsSesInfo *ses,
                       const struct nls_table *nls_cp)
 {
         int len;
@@ -323,7 +323,7 @@ decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifsSesInfo *ses,
         return;
 }
 
-static int decode_ascii_ssetup(char **pbcc_area, int bleft,
+static int decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
                                struct cifsSesInfo *ses,
                                const struct nls_table *nls_cp)
 {
@@ -575,12 +575,11 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses,
         char *str_area;
         SESSION_SETUP_ANDX *pSMB;
         __u32 capabilities;
-        int count;
+        __u16 count;
         int resp_buf_type;
         struct kvec iov[3];
         enum securityEnum type;
-        __u16 action;
-        int bytes_remaining;
+        __u16 action, bytes_remaining;
         struct key *spnego_key = NULL;
         __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */
         u16 blob_len;
@@ -876,10 +875,10 @@ ssetup_ntlmssp_authenticate:
         count = iov[1].iov_len + iov[2].iov_len;
         smb_buf->smb_buf_length += count;
 
-        BCC_LE(smb_buf) = cpu_to_le16(count);
+        put_bcc_le(count, smb_buf);
 
         rc = SendReceive2(xid, ses, iov, 3 /* num_iovecs */, &resp_buf_type,
-                          CIFS_STD_OP /* not long */ | CIFS_LOG_ERROR);
+                          CIFS_LOG_ERROR);
         /* SMB request buf freed in SendReceive2 */
 
         pSMB = (SESSION_SETUP_ANDX *)iov[0].iov_base;
@@ -910,7 +909,7 @@ ssetup_ntlmssp_authenticate:
         cFYI(1, "UID = %d ", ses->Suid);
         /* response can have either 3 or 4 word count - Samba sends 3 */
         /* and lanman response is 3 */
-        bytes_remaining = BCC(smb_buf);
+        bytes_remaining = get_bcc(smb_buf);
         bcc_ptr = pByteArea(smb_buf);
 
         if (smb_buf->WordCount == 4) {
diff --git a/fs/cifs/smbdes.c b/fs/cifs/smbdes.c
index b6b6dcb500b..04721485925 100644
--- a/fs/cifs/smbdes.c
+++ b/fs/cifs/smbdes.c
@@ -45,7 +45,6 @@
    up with a different answer to the one above)
 */
 #include <linux/slab.h>
-#include "cifsencrypt.h"
 #define uchar unsigned char
 
 static uchar perm1[56] = { 57, 49, 41, 33, 25, 17, 9,
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 192ea51af20..b5041c84998 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -32,9 +32,8 @@
 #include "cifs_unicode.h"
 #include "cifspdu.h"
 #include "cifsglob.h"
-#include "md5.h"
 #include "cifs_debug.h"
-#include "cifsencrypt.h"
+#include "cifsproto.h"
 
 #ifndef false
 #define false 0
@@ -48,14 +47,58 @@
 #define SSVALX(buf,pos,val) (CVAL(buf,pos)=(val)&0xFF,CVAL(buf,pos+1)=(val)>>8)
 #define SSVAL(buf,pos,val) SSVALX((buf),(pos),((__u16)(val)))
 
-/*The following definitions come from  libsmb/smbencrypt.c  */
+/* produce a md4 message digest from data of length n bytes */
+int
+mdfour(unsigned char *md4_hash, unsigned char *link_str, int link_len)
+{
+        int rc;
+        unsigned int size;
+        struct crypto_shash *md4;
+        struct sdesc *sdescmd4;
+
+        md4 = crypto_alloc_shash("md4", 0, 0);
+        if (IS_ERR(md4)) {
+                rc = PTR_ERR(md4);
+                cERROR(1, "%s: Crypto md4 allocation error %d\n", __func__, rc);
+                return rc;
+        }
+        size = sizeof(struct shash_desc) + crypto_shash_descsize(md4);
+        sdescmd4 = kmalloc(size, GFP_KERNEL);
+        if (!sdescmd4) {
+                rc = -ENOMEM;
+                cERROR(1, "%s: Memory allocation failure\n", __func__);
+                goto mdfour_err;
+        }
+        sdescmd4->shash.tfm = md4;
+        sdescmd4->shash.flags = 0x0;
+
+        rc = crypto_shash_init(&sdescmd4->shash);
+        if (rc) {
+                cERROR(1, "%s: Could not init md4 shash\n", __func__);
+                goto mdfour_err;
+        }
+        crypto_shash_update(&sdescmd4->shash, link_str, link_len);
+        rc = crypto_shash_final(&sdescmd4->shash, md4_hash);
 
-void SMBencrypt(unsigned char *passwd, const unsigned char *c8,
-                unsigned char *p24);
-void E_md4hash(const unsigned char *passwd, unsigned char *p16);
-static void SMBOWFencrypt(unsigned char passwd[16], const unsigned char *c8,
-                   unsigned char p24[24]);
-void SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24);
+mdfour_err:
+        crypto_free_shash(md4);
+        kfree(sdescmd4);
+
+        return rc;
+}
+
+/* Does the des encryption from the NT or LM MD4 hash. */
+static void
+SMBOWFencrypt(unsigned char passwd[16], const unsigned char *c8,
+              unsigned char p24[24])
+{
+        unsigned char p21[21];
+
+        memset(p21, '\0', 21);
+
+        memcpy(p21, passwd, 16);
+        E_P24(p21, c8, p24);
+}
 
 /*
    This implements the X/Open SMB password encryption
@@ -118,9 +161,10 @@ _my_mbstowcs(__u16 *dst, const unsigned char *src, int len)
  * Creates the MD4 Hash of the users password in NT UNICODE.
  */
 
-void
+int
 E_md4hash(const unsigned char *passwd, unsigned char *p16)
 {
+        int rc;
         int len;
         __u16 wpwd[129];
 
@@ -139,8 +183,10 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16)
         /* Calculate length in bytes */
         len = _my_wcslen(wpwd) * sizeof(__u16);
 
-        mdfour(p16, (unsigned char *) wpwd, len);
+        rc = mdfour(p16, (unsigned char *) wpwd, len);
         memset(wpwd, 0, 129 * 2);
+
+        return rc;
 }
 
 #if 0 /* currently unused */
@@ -212,19 +258,6 @@ ntv2_owf_gen(const unsigned char owf[16], const char *user_n,
 }
 #endif
 
-/* Does the des encryption from the NT or LM MD4 hash. */
-static void
-SMBOWFencrypt(unsigned char passwd[16], const unsigned char *c8,
-              unsigned char p24[24])
-{
-        unsigned char p21[21];
-
-        memset(p21, '\0', 21);
-
-        memcpy(p21, passwd, 16);
-        E_P24(p21, c8, p24);
-}
-
 /* Does the des encryption from the FIRST 8 BYTES of the NT or LM MD4 hash. */
 #if 0 /* currently unused */
 static void
@@ -242,16 +275,21 @@ NTLMSSPOWFencrypt(unsigned char passwd[8],
 #endif
 
 /* Does the NT MD4 hash then des encryption. */
-
-void
+int
 SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 {
+        int rc;
         unsigned char p21[21];
 
         memset(p21, '\0', 21);
 
-        E_md4hash(passwd, p21);
+        rc = E_md4hash(passwd, p21);
+        if (rc) {
+                cFYI(1, "%s Can't generate NT hash, error: %d", __func__, rc);
+                return rc;
+        }
         SMBOWFencrypt(p21, c8, p24);
+        return rc;
 }
 
 
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 59ca81b1691..fbc5aace54b 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -36,7 +36,13 @@
 
 extern mempool_t *cifs_mid_poolp;
 
-static struct mid_q_entry *
+static void
+wake_up_task(struct mid_q_entry *mid)
+{
+        wake_up_process(mid->callback_data);
+}
+
+struct mid_q_entry *
 AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server)
 {
         struct mid_q_entry *temp;
@@ -58,28 +64,28 @@ AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server)
         /*      do_gettimeofday(&temp->when_sent);*/ /* easier to use jiffies */
                 /* when mid allocated can be before when sent */
                 temp->when_alloc = jiffies;
-                temp->tsk = current;
+
+                /*
+                 * The default is for the mid to be synchronous, so the
+                 * default callback just wakes up the current task.
+                 */
+                temp->callback = wake_up_task;
+                temp->callback_data = current;
         }
 
-        spin_lock(&GlobalMid_Lock);
-        list_add_tail(&temp->qhead, &server->pending_mid_q);
         atomic_inc(&midCount);
         temp->midState = MID_REQUEST_ALLOCATED;
-        spin_unlock(&GlobalMid_Lock);
         return temp;
 }
 
-static void
+void
 DeleteMidQEntry(struct mid_q_entry *midEntry)
 {
 #ifdef CONFIG_CIFS_STATS2
         unsigned long now;
 #endif
-        spin_lock(&GlobalMid_Lock);
         midEntry->midState = MID_FREE;
-        list_del(&midEntry->qhead);
         atomic_dec(&midCount);
-        spin_unlock(&GlobalMid_Lock);
         if (midEntry->largeBuf)
                 cifs_buf_release(midEntry->resp_buf);
         else
@@ -103,6 +109,16 @@ DeleteMidQEntry(struct mid_q_entry *midEntry)
         mempool_free(midEntry, cifs_mid_poolp);
 }
 
+static void
+delete_mid(struct mid_q_entry *mid)
+{
+        spin_lock(&GlobalMid_Lock);
+        list_del(&mid->qhead);
+        spin_unlock(&GlobalMid_Lock);
+
+        DeleteMidQEntry(mid);
+}
+
 static int
 smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
 {
@@ -220,9 +236,9 @@ smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
                 server->tcpStatus = CifsNeedReconnect;
         }
 
-        if (rc < 0) {
+        if (rc < 0 && rc != -EINTR)
                 cERROR(1, "Error %d sending data on socket to server", rc);
-        } else
+        else
                 rc = 0;
 
         /* Don't want to modify the buffer as a
@@ -244,31 +260,31 @@ smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
         return smb_sendv(server, &iov, 1);
 }
 
-static int wait_for_free_request(struct cifsSesInfo *ses, const int long_op)
+static int wait_for_free_request(struct TCP_Server_Info *server,
+                                 const int long_op)
 {
         if (long_op == CIFS_ASYNC_OP) {
                 /* oplock breaks must not be held up */
-                atomic_inc(&ses->server->inFlight);
+                atomic_inc(&server->inFlight);
                 return 0;
         }
 
         spin_lock(&GlobalMid_Lock);
         while (1) {
-                if (atomic_read(&ses->server->inFlight) >=
-                                cifs_max_pending){
+                if (atomic_read(&server->inFlight) >= cifs_max_pending) {
                         spin_unlock(&GlobalMid_Lock);
 #ifdef CONFIG_CIFS_STATS2
-                        atomic_inc(&ses->server->num_waiters);
+                        atomic_inc(&server->num_waiters);
 #endif
-                        wait_event(ses->server->request_q,
-                                   atomic_read(&ses->server->inFlight)
+                        wait_event(server->request_q,
+                                   atomic_read(&server->inFlight)
                                      < cifs_max_pending);
 #ifdef CONFIG_CIFS_STATS2
-                        atomic_dec(&ses->server->num_waiters);
+                        atomic_dec(&server->num_waiters);
 #endif
                         spin_lock(&GlobalMid_Lock);
                 } else {
-                        if (ses->server->tcpStatus == CifsExiting) {
+                        if (server->tcpStatus == CifsExiting) {
                                 spin_unlock(&GlobalMid_Lock);
                                 return -ENOENT;
                         }
@@ -278,7 +294,7 @@ static int wait_for_free_request(struct cifsSesInfo *ses, const int long_op)
 
                         /* update # of requests on the wire to server */
                         if (long_op != CIFS_BLOCKING_OP)
-                                atomic_inc(&ses->server->inFlight);
+                                atomic_inc(&server->inFlight);
                         spin_unlock(&GlobalMid_Lock);
                         break;
                 }
@@ -308,53 +324,85 @@ static int allocate_mid(struct cifsSesInfo *ses, struct smb_hdr *in_buf,
         *ppmidQ = AllocMidQEntry(in_buf, ses->server);
         if (*ppmidQ == NULL)
                 return -ENOMEM;
+        spin_lock(&GlobalMid_Lock);
+        list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q);
+        spin_unlock(&GlobalMid_Lock);
         return 0;
 }
 
-static int wait_for_response(struct cifsSesInfo *ses,
-                        struct mid_q_entry *midQ,
-                        unsigned long timeout,
-                        unsigned long time_to_wait)
+static int
+wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
 {
-        unsigned long curr_timeout;
+        int error;
 
-        for (;;) {
-                curr_timeout = timeout + jiffies;
-                wait_event_timeout(ses->server->response_q,
-                        midQ->midState != MID_REQUEST_SUBMITTED, timeout);
+        error = wait_event_killable(server->response_q,
+                                    midQ->midState != MID_REQUEST_SUBMITTED);
+        if (error < 0)
+                return -ERESTARTSYS;
 
-                if (time_after(jiffies, curr_timeout) &&
-                        (midQ->midState == MID_REQUEST_SUBMITTED) &&
-                        ((ses->server->tcpStatus == CifsGood) ||
-                         (ses->server->tcpStatus == CifsNew))) {
+        return 0;
+}
 
-                        unsigned long lrt;
 
-                        /* We timed out. Is the server still
-                           sending replies ? */
-                        spin_lock(&GlobalMid_Lock);
-                        lrt = ses->server->lstrp;
-                        spin_unlock(&GlobalMid_Lock);
+/*
+ * Send a SMB request and set the callback function in the mid to handle
+ * the result. Caller is responsible for dealing with timeouts.
+ */
+int
+cifs_call_async(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
+                mid_callback_t *callback, void *cbdata)
+{
+        int rc;
+        struct mid_q_entry *mid;
 
-                        /* Calculate time_to_wait past last receive time.
-                         Although we prefer not to time out if the
-                         server is still responding - we will time
-                         out if the server takes more than 15 (or 45
-                         or 180) seconds to respond to this request
-                         and has not responded to any request from
-                         other threads on the client within 10 seconds */
-                        lrt += time_to_wait;
-                        if (time_after(jiffies, lrt)) {
-                                /* No replies for time_to_wait. */
-                                cERROR(1, "server not responding");
-                                return -1;
-                        }
-                } else {
-                        return 0;
-                }
+        rc = wait_for_free_request(server, CIFS_ASYNC_OP);
+        if (rc)
+                return rc;
+
+        /* enable signing if server requires it */
+        if (server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+                in_buf->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
+
+        mutex_lock(&server->srv_mutex);
+        mid = AllocMidQEntry(in_buf, server);
+        if (mid == NULL) {
+                mutex_unlock(&server->srv_mutex);
+                return -ENOMEM;
         }
-}
 
+        /* put it on the pending_mid_q */
+        spin_lock(&GlobalMid_Lock);
+        list_add_tail(&mid->qhead, &server->pending_mid_q);
+        spin_unlock(&GlobalMid_Lock);
+
+        rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
+        if (rc) {
+                mutex_unlock(&server->srv_mutex);
+                goto out_err;
+        }
+
+        mid->callback = callback;
+        mid->callback_data = cbdata;
+        mid->midState = MID_REQUEST_SUBMITTED;
+#ifdef CONFIG_CIFS_STATS2
+        atomic_inc(&server->inSend);
+#endif
+        rc = smb_send(server, in_buf, in_buf->smb_buf_length);
+#ifdef CONFIG_CIFS_STATS2
+        atomic_dec(&server->inSend);
+        mid->when_sent = jiffies;
+#endif
+        mutex_unlock(&server->srv_mutex);
+        if (rc)
+                goto out_err;
+
+        return rc;
+out_err:
+        delete_mid(mid);
+        atomic_dec(&server->inFlight);
+        wake_up(&server->request_q);
+        return rc;
+}
 
 /*
  *
@@ -382,6 +430,81 @@ SendReceiveNoRsp(const unsigned int xid, struct cifsSesInfo *ses,
         return rc;
 }
 
+static int
+sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
+{
+        int rc = 0;
+
+        cFYI(1, "%s: cmd=%d mid=%d state=%d", __func__, mid->command,
+                mid->mid, mid->midState);
+
+        spin_lock(&GlobalMid_Lock);
+        /* ensure that it's no longer on the pending_mid_q */
+        list_del_init(&mid->qhead);
+
+        switch (mid->midState) {
+        case MID_RESPONSE_RECEIVED:
+                spin_unlock(&GlobalMid_Lock);
+                return rc;
+        case MID_REQUEST_SUBMITTED:
+                /* socket is going down, reject all calls */
+                if (server->tcpStatus == CifsExiting) {
+                        cERROR(1, "%s: canceling mid=%d cmd=0x%x state=%d",
+                               __func__, mid->mid, mid->command, mid->midState);
+                        rc = -EHOSTDOWN;
+                        break;
+                }
+        case MID_RETRY_NEEDED:
+                rc = -EAGAIN;
+                break;
+        default:
+                cERROR(1, "%s: invalid mid state mid=%d state=%d", __func__,
+                        mid->mid, mid->midState);
+                rc = -EIO;
+        }
+        spin_unlock(&GlobalMid_Lock);
+
+        DeleteMidQEntry(mid);
+        return rc;
+}
+
+/*
+ * An NT cancel request header looks just like the original request except:
+ *
+ * The Command is SMB_COM_NT_CANCEL
+ * The WordCount is zeroed out
+ * The ByteCount is zeroed out
+ *
+ * This function mangles an existing request buffer into a
+ * SMB_COM_NT_CANCEL request and then sends it.
+ */
+static int
+send_nt_cancel(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
+                struct mid_q_entry *mid)
+{
+        int rc = 0;
+
+        /* -4 for RFC1001 length and +2 for BCC field */
+        in_buf->smb_buf_length = sizeof(struct smb_hdr) - 4  + 2;
+        in_buf->Command = SMB_COM_NT_CANCEL;
+        in_buf->WordCount = 0;
+        put_bcc_le(0, in_buf);
+
+        mutex_lock(&server->srv_mutex);
+        rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
+        if (rc) {
+                mutex_unlock(&server->srv_mutex);
+                return rc;
+        }
+        rc = smb_send(server, in_buf, in_buf->smb_buf_length);
+        mutex_unlock(&server->srv_mutex);
+
+        cFYI(1, "issued NT_CANCEL for mid %u, rc = %d",
+                in_buf->Mid, rc);
+
+        return rc;
+}
+
 int
 SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
              struct kvec *iov, int n_vec, int *pRespBufType /* ret */,
@@ -390,7 +513,6 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
         int rc = 0;
         int long_op;
         unsigned int receive_len;
-        unsigned long timeout;
         struct mid_q_entry *midQ;
         struct smb_hdr *in_buf = iov[0].iov_base;
 
@@ -413,7 +535,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
            to the same server. We may make this configurable later or
            use ses->maxReq */
 
-        rc = wait_for_free_request(ses, long_op);
+        rc = wait_for_free_request(ses->server, long_op);
         if (rc) {
                 cifs_small_buf_release(in_buf);
                 return rc;
@@ -452,70 +574,41 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
 #endif
 
         mutex_unlock(&ses->server->srv_mutex);
-        cifs_small_buf_release(in_buf);
 
-        if (rc < 0)
-                goto out;
-
-        if (long_op == CIFS_STD_OP)
-                timeout = 15 * HZ;
-        else if (long_op == CIFS_VLONG_OP) /* e.g. slow writes past EOF */
-                timeout = 180 * HZ;
-        else if (long_op == CIFS_LONG_OP)
-                timeout = 45 * HZ; /* should be greater than
-                        servers oplock break timeout (about 43 seconds) */
-        else if (long_op == CIFS_ASYNC_OP)
-                goto out;
-        else if (long_op == CIFS_BLOCKING_OP)
-                timeout = 0x7FFFFFFF; /*  large, but not so large as to wrap */
-        else {
-                cERROR(1, "unknown timeout flag %d", long_op);
-                rc = -EIO;
+        if (rc < 0) {
+                cifs_small_buf_release(in_buf);
                 goto out;
         }
 
-        /* wait for 15 seconds or until woken up due to response arriving or
-           due to last connection to this server being unmounted */
-        if (signal_pending(current)) {
-                /* if signal pending do not hold up user for full smb timeout
-                but we still give response a chance to complete */
-                timeout = 2 * HZ;
+        if (long_op == CIFS_ASYNC_OP) {
+                cifs_small_buf_release(in_buf);
+                goto out;
         }
 
-        /* No user interrupts in wait - wreaks havoc with performance */
-        wait_for_response(ses, midQ, timeout, 10 * HZ);
-
-        spin_lock(&GlobalMid_Lock);
-
-        if (midQ->resp_buf == NULL) {
-                cERROR(1, "No response to cmd %d mid %d",
-                        midQ->command, midQ->mid);
+        rc = wait_for_response(ses->server, midQ);
+        if (rc != 0) {
+                send_nt_cancel(ses->server, in_buf, midQ);
+                spin_lock(&GlobalMid_Lock);
                 if (midQ->midState == MID_REQUEST_SUBMITTED) {
-                        if (ses->server->tcpStatus == CifsExiting)
-                                rc = -EHOSTDOWN;
-                        else {
-                                ses->server->tcpStatus = CifsNeedReconnect;
-                                midQ->midState = MID_RETRY_NEEDED;
-                        }
-                }
-
-                if (rc != -EHOSTDOWN) {
-                        if (midQ->midState == MID_RETRY_NEEDED) {
-                                rc = -EAGAIN;
-                                cFYI(1, "marking request for retry");
-                        } else {
-                                rc = -EIO;
-                        }
+                        midQ->callback = DeleteMidQEntry;
+                        spin_unlock(&GlobalMid_Lock);
+                        cifs_small_buf_release(in_buf);
+                        atomic_dec(&ses->server->inFlight);
+                        wake_up(&ses->server->request_q);
+                        return rc;
                 }
                 spin_unlock(&GlobalMid_Lock);
-                DeleteMidQEntry(midQ);
-                /* Update # of requests on wire to server */
+        }
+
+        cifs_small_buf_release(in_buf);
+
+        rc = sync_mid_result(midQ, ses->server);
+        if (rc != 0) {
                 atomic_dec(&ses->server->inFlight);
                 wake_up(&ses->server->request_q);
                 return rc;
         }
 
-        spin_unlock(&GlobalMid_Lock);
         receive_len = midQ->resp_buf->smb_buf_length;
 
         if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
@@ -559,19 +652,18 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
                 if (receive_len >= sizeof(struct smb_hdr) - 4
                     /* do not count RFC1001 header */  +
                     (2 * midQ->resp_buf->WordCount) + 2 /* bcc */ )
-                        BCC(midQ->resp_buf) =
-                                le16_to_cpu(BCC_LE(midQ->resp_buf));
+                        put_bcc(get_bcc_le(midQ->resp_buf), midQ->resp_buf);
                 if ((flags & CIFS_NO_RESP) == 0)
                         midQ->resp_buf = NULL;  /* mark it so buf will
                                                    not be freed by
-                                                   DeleteMidQEntry */
+                                                   delete_mid */
         } else {
                 rc = -EIO;
                 cFYI(1, "Bad MID state?");
         }
 
 out:
-        DeleteMidQEntry(midQ);
+        delete_mid(midQ);
         atomic_dec(&ses->server->inFlight);
         wake_up(&ses->server->request_q);
 
@@ -585,7 +677,6 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
 {
         int rc = 0;
         unsigned int receive_len;
-        unsigned long timeout;
         struct mid_q_entry *midQ;
 
         if (ses == NULL) {
@@ -610,7 +701,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                 return -EIO;
         }
 
-        rc = wait_for_free_request(ses, long_op);
+        rc = wait_for_free_request(ses->server, long_op);
         if (rc)
                 return rc;
 
@@ -649,64 +740,31 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
         if (rc < 0)
                 goto out;
 
-        if (long_op == CIFS_STD_OP)
-                timeout = 15 * HZ;
-        /* wait for 15 seconds or until woken up due to response arriving or
-           due to last connection to this server being unmounted */
-        else if (long_op == CIFS_ASYNC_OP)
-                goto out;
-        else if (long_op == CIFS_VLONG_OP) /* writes past EOF can be slow */
-                timeout = 180 * HZ;
-        else if (long_op == CIFS_LONG_OP)
-                timeout = 45 * HZ; /* should be greater than
-                        servers oplock break timeout (about 43 seconds) */
-        else if (long_op == CIFS_BLOCKING_OP)
-                timeout = 0x7FFFFFFF; /* large but no so large as to wrap */
-        else {
-                cERROR(1, "unknown timeout flag %d", long_op);
-                rc = -EIO;
+        if (long_op == CIFS_ASYNC_OP)
                 goto out;
-        }
-
-        if (signal_pending(current)) {
-                /* if signal pending do not hold up user for full smb timeout
-                but we still give response a chance to complete */
-                timeout = 2 * HZ;
-        }
-
-        /* No user interrupts in wait - wreaks havoc with performance */
-        wait_for_response(ses, midQ, timeout, 10 * HZ);
 
-        spin_lock(&GlobalMid_Lock);
-        if (midQ->resp_buf == NULL) {
-                cERROR(1, "No response for cmd %d mid %d",
-                          midQ->command, midQ->mid);
+        rc = wait_for_response(ses->server, midQ);
+        if (rc != 0) {
+                send_nt_cancel(ses->server, in_buf, midQ);
+                spin_lock(&GlobalMid_Lock);
                 if (midQ->midState == MID_REQUEST_SUBMITTED) {
-                        if (ses->server->tcpStatus == CifsExiting)
-                                rc = -EHOSTDOWN;
-                        else {
-                                ses->server->tcpStatus = CifsNeedReconnect;
-                                midQ->midState = MID_RETRY_NEEDED;
-                        }
-                }
-
-                if (rc != -EHOSTDOWN) {
-                        if (midQ->midState == MID_RETRY_NEEDED) {
-                                rc = -EAGAIN;
-                                cFYI(1, "marking request for retry");
-                        } else {
-                                rc = -EIO;
-                        }
+                        /* no longer considered to be "in-flight" */
+                        midQ->callback = DeleteMidQEntry;
+                        spin_unlock(&GlobalMid_Lock);
+                        atomic_dec(&ses->server->inFlight);
+                        wake_up(&ses->server->request_q);
+                        return rc;
                 }
                 spin_unlock(&GlobalMid_Lock);
-                DeleteMidQEntry(midQ);
-                /* Update # of requests on wire to server */
+        }
+
+        rc = sync_mid_result(midQ, ses->server);
+        if (rc != 0) {
                 atomic_dec(&ses->server->inFlight);
                 wake_up(&ses->server->request_q);
                 return rc;
         }
 
-        spin_unlock(&GlobalMid_Lock);
         receive_len = midQ->resp_buf->smb_buf_length;
 
         if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
@@ -748,43 +806,20 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                 if (receive_len >= sizeof(struct smb_hdr) - 4
                     /* do not count RFC1001 header */  +
                     (2 * out_buf->WordCount) + 2 /* bcc */ )
-                        BCC(out_buf) = le16_to_cpu(BCC_LE(out_buf));
+                        put_bcc(get_bcc_le(midQ->resp_buf), midQ->resp_buf);
         } else {
                 rc = -EIO;
                 cERROR(1, "Bad MID state?");
         }
 
 out:
-        DeleteMidQEntry(midQ);
+        delete_mid(midQ);
         atomic_dec(&ses->server->inFlight);
         wake_up(&ses->server->request_q);
 
         return rc;
 }
 
-/* Send an NT_CANCEL SMB to cause the POSIX blocking lock to return. */
-
-static int
-send_nt_cancel(struct cifsTconInfo *tcon, struct smb_hdr *in_buf,
-                struct mid_q_entry *midQ)
-{
-        int rc = 0;
-        struct cifsSesInfo *ses = tcon->ses;
-        __u16 mid = in_buf->Mid;
-
-        header_assemble(in_buf, SMB_COM_NT_CANCEL, tcon, 0);
-        in_buf->Mid = mid;
-        mutex_lock(&ses->server->srv_mutex);
-        rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
-        if (rc) {
-                mutex_unlock(&ses->server->srv_mutex);
-                return rc;
-        }
-        rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
-        mutex_unlock(&ses->server->srv_mutex);
-        return rc;
-}
-
 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows
    blocking lock to return. */
 
@@ -807,7 +842,7 @@ send_lock_cancel(const unsigned int xid, struct cifsTconInfo *tcon,
         pSMB->hdr.Mid = GetNextMid(ses->server);
 
         return SendReceive(xid, ses, in_buf, out_buf,
-                        &bytes_returned, CIFS_STD_OP);
+                        &bytes_returned, 0);
 }
 
 int
@@ -845,7 +880,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
                 return -EIO;
         }
 
-        rc = wait_for_free_request(ses, CIFS_BLOCKING_OP);
+        rc = wait_for_free_request(ses->server, CIFS_BLOCKING_OP);
         if (rc)
                 return rc;
 
@@ -863,7 +898,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
 
         rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
         if (rc) {
-                DeleteMidQEntry(midQ);
+                delete_mid(midQ);
                 mutex_unlock(&ses->server->srv_mutex);
                 return rc;
         }
@@ -880,7 +915,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
         mutex_unlock(&ses->server->srv_mutex);
 
         if (rc < 0) {
-                DeleteMidQEntry(midQ);
+                delete_mid(midQ);
                 return rc;
         }
 
@@ -899,10 +934,9 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
                 if (in_buf->Command == SMB_COM_TRANSACTION2) {
                         /* POSIX lock. We send a NT_CANCEL SMB to cause the
                            blocking lock to return. */
-
-                        rc = send_nt_cancel(tcon, in_buf, midQ);
+                        rc = send_nt_cancel(ses->server, in_buf, midQ);
                         if (rc) {
-                                DeleteMidQEntry(midQ);
+                                delete_mid(midQ);
                                 return rc;
                         }
                 } else {
@@ -914,47 +948,33 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
                         /* If we get -ENOLCK back the lock may have
                            already been removed. Don't exit in this case. */
                         if (rc && rc != -ENOLCK) {
-                                DeleteMidQEntry(midQ);
+                                delete_mid(midQ);
                                 return rc;
                         }
                 }
 
-                /* Wait 5 seconds for the response. */
-                if (wait_for_response(ses, midQ, 5 * HZ, 5 * HZ) == 0) {
-                        /* We got the response - restart system call. */
-                        rstart = 1;
-                }
-        }
-
-        spin_lock(&GlobalMid_Lock);
-        if (midQ->resp_buf) {
-                spin_unlock(&GlobalMid_Lock);
-                receive_len = midQ->resp_buf->smb_buf_length;
-        } else {
-                cERROR(1, "No response for cmd %d mid %d",
-                          midQ->command, midQ->mid);
-                if (midQ->midState == MID_REQUEST_SUBMITTED) {
-                        if (ses->server->tcpStatus == CifsExiting)
-                                rc = -EHOSTDOWN;
-                        else {
-                                ses->server->tcpStatus = CifsNeedReconnect;
-                                midQ->midState = MID_RETRY_NEEDED;
+                rc = wait_for_response(ses->server, midQ);
+                if (rc) {
+                        send_nt_cancel(ses->server, in_buf, midQ);
+                        spin_lock(&GlobalMid_Lock);
+                        if (midQ->midState == MID_REQUEST_SUBMITTED) {
+                                /* no longer considered to be "in-flight" */
+                                midQ->callback = DeleteMidQEntry;
+                                spin_unlock(&GlobalMid_Lock);
+                                return rc;
                         }
+                        spin_unlock(&GlobalMid_Lock);
                 }
 
-                if (rc != -EHOSTDOWN) {
-                        if (midQ->midState == MID_RETRY_NEEDED) {
-                                rc = -EAGAIN;
-                                cFYI(1, "marking request for retry");
-                        } else {
-                                rc = -EIO;
-                        }
-                }
-                spin_unlock(&GlobalMid_Lock);
-                DeleteMidQEntry(midQ);
-                return rc;
+                /* We got the response - restart system call. */
+                rstart = 1;
         }
 
+        rc = sync_mid_result(midQ, ses->server);
+        if (rc != 0)
+                return rc;
+
+        receive_len = midQ->resp_buf->smb_buf_length;
         if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
                 cERROR(1, "Frame too large received.  Length: %d  Xid: %d",
                         receive_len, xid);
@@ -998,10 +1018,10 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
         if (receive_len >= sizeof(struct smb_hdr) - 4
             /* do not count RFC1001 header */  +
             (2 * out_buf->WordCount) + 2 /* bcc */ )
-                BCC(out_buf) = le16_to_cpu(BCC_LE(out_buf));
+                put_bcc(get_bcc_le(out_buf), out_buf);
 
 out:
-        DeleteMidQEntry(midQ);
+        delete_mid(midQ);
         if (rstart && rc == -EACCES)
                 return -ERESTARTSYS;
         return rc;
diff --git a/fs/dcache.c b/fs/dcache.c
index 9f493ee4dcb..2a6bd9a4ae9 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -176,6 +176,7 @@ static void d_free(struct dentry *dentry)
 
 /**
  * dentry_rcuwalk_barrier - invalidate in-progress rcu-walk lookups
+ * @dentry: the target dentry
  * After this call, in-progress rcu-walk path lookup will fail. This
  * should be called after unhashing, and after changing d_inode (if
  * the dentry has not already been unhashed).
@@ -281,6 +282,7 @@ static void dentry_lru_move_tail(struct dentry *dentry)
 /**
  * d_kill - kill dentry and return parent
  * @dentry: dentry to kill
+ * @parent: parent dentry
  *
  * The dentry must already be unhashed and removed from the LRU.
  *
@@ -1973,7 +1975,7 @@ out:
 /**
  * d_validate - verify dentry provided from insecure source (deprecated)
  * @dentry: The dentry alleged to be valid child of @dparent
- * @parent: The parent dentry (known to be valid)
+ * @dparent: The parent dentry (known to be valid)
  *
  * An insecure source has sent us a dentry, here we verify it and dget() it.
  * This is used by ncpfs in its readdir implementation.
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 85882f6ba5f..b044705eedd 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -325,12 +325,16 @@ void dio_end_io(struct bio *bio, int error)
 }
 EXPORT_SYMBOL_GPL(dio_end_io);
 
-static int
+static void
 dio_bio_alloc(struct dio *dio, struct block_device *bdev,
                 sector_t first_sector, int nr_vecs)
 {
         struct bio *bio;
 
+        /*
+         * bio_alloc() is guaranteed to return a bio when called with
+         * __GFP_WAIT and we request a valid number of vectors.
+         */
         bio = bio_alloc(GFP_KERNEL, nr_vecs);
 
         bio->bi_bdev = bdev;
@@ -342,7 +346,6 @@ dio_bio_alloc(struct dio *dio, struct block_device *bdev,
 
         dio->bio = bio;
         dio->logical_offset_in_bio = dio->cur_page_fs_offset;
-        return 0;
 }
 
 /*
@@ -583,8 +586,9 @@ static int dio_new_bio(struct dio *dio, sector_t start_sector)
                 goto out;
         sector = start_sector << (dio->blkbits - 9);
         nr_pages = min(dio->pages_in_io, bio_get_nr_vecs(dio->map_bh.b_bdev));
+        nr_pages = min(nr_pages, BIO_MAX_PAGES);
         BUG_ON(nr_pages <= 0);
-        ret = dio_bio_alloc(dio, dio->map_bh.b_bdev, sector, nr_pages);
+        dio_bio_alloc(dio, dio->map_bh.b_bdev, sector, nr_pages);
         dio->boundary = 0;
 out:
         return ret;
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index cc8a9b7d606..267d0ada454 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1114,6 +1114,17 @@ static int ep_send_events(struct eventpoll *ep,
         return ep_scan_ready_list(ep, ep_send_events_proc, &esed);
 }
 
+static inline struct timespec ep_set_mstimeout(long ms)
+{
+        struct timespec now, ts = {
+                .tv_sec = ms / MSEC_PER_SEC,
+                .tv_nsec = NSEC_PER_MSEC * (ms % MSEC_PER_SEC),
+        };
+
+        ktime_get_ts(&now);
+        return timespec_add_safe(now, ts);
+}
+
 static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
                    int maxevents, long timeout)
 {
@@ -1121,12 +1132,11 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
         unsigned long flags;
         long slack;
         wait_queue_t wait;
-        struct timespec end_time;
         ktime_t expires, *to = NULL;
 
         if (timeout > 0) {
-                ktime_get_ts(&end_time);
-                timespec_add_ns(&end_time, (u64)timeout * NSEC_PER_MSEC);
+                struct timespec end_time = ep_set_mstimeout(timeout);
+
                 slack = select_estimate_accuracy(&end_time);
                 to = &expires;
                 *to = timespec_to_ktime(end_time);
diff --git a/fs/exec.c b/fs/exec.c
index c62efcb959c..52a447d9b6a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -120,7 +120,7 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
                 goto out;
 
         file = do_filp_open(AT_FDCWD, tmp,
-                                O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                                O_LARGEFILE | O_RDONLY | __FMODE_EXEC, 0,
                                 MAY_READ | MAY_EXEC | MAY_OPEN);
         putname(tmp);
         error = PTR_ERR(file);
@@ -723,7 +723,7 @@ struct file *open_exec(const char *name)
         int err;
 
         file = do_filp_open(AT_FDCWD, name,
-                                O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                                O_LARGEFILE | O_RDONLY | __FMODE_EXEC, 0,
                                 MAY_EXEC | MAY_OPEN);
         if (IS_ERR(file))
                 goto out;
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 42685424817..a7555238c41 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -1030,7 +1030,6 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
                 memcpy(oi->i_data, fcb.i_data, sizeof(fcb.i_data));
         }
 
-        inode->i_mapping->backing_dev_info = sb->s_bdi;
         if (S_ISREG(inode->i_mode)) {
                 inode->i_op = &exofs_file_inode_operations;
                 inode->i_fop = &exofs_file_operations;
@@ -1131,7 +1130,6 @@ struct inode *exofs_new_inode(struct inode *dir, int mode)
 
         sbi = sb->s_fs_info;
 
-        inode->i_mapping->backing_dev_info = sb->s_bdi;
         sb->s_dirt = 1;
         inode_init_owner(inode, dir, mode);
         inode->i_ino = sbi->s_nextid++;
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 7aa767d4f06..85c8cc8f247 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -754,7 +754,7 @@ static int ext3_release_dquot(struct dquot *dquot);
 static int ext3_mark_dquot_dirty(struct dquot *dquot);
 static int ext3_write_info(struct super_block *sb, int type);
 static int ext3_quota_on(struct super_block *sb, int type, int format_id,
-                                char *path);
+                         struct path *path);
 static int ext3_quota_on_mount(struct super_block *sb, int type);
 static ssize_t ext3_quota_read(struct super_block *sb, int type, char *data,
                                size_t len, loff_t off);
@@ -2877,27 +2877,20 @@ static int ext3_quota_on_mount(struct super_block *sb, int type)
  * Standard function to be called on quota_on
  */
 static int ext3_quota_on(struct super_block *sb, int type, int format_id,
-                         char *name)
+                         struct path *path)
 {
         int err;
-        struct path path;
 
         if (!test_opt(sb, QUOTA))
                 return -EINVAL;
 
-        err = kern_path(name, LOOKUP_FOLLOW, &path);
-        if (err)
-                return err;
-
         /* Quotafile not on the same filesystem? */
-        if (path.mnt->mnt_sb != sb) {
-                path_put(&path);
+        if (path->mnt->mnt_sb != sb)
                 return -EXDEV;
-        }
         /* Journaling quota? */
         if (EXT3_SB(sb)->s_qf_names[type]) {
                 /* Quotafile not of fs root? */
-                if (path.dentry->d_parent != sb->s_root)
+                if (path->dentry->d_parent != sb->s_root)
                         ext3_msg(sb, KERN_WARNING,
                                 "warning: Quota file not on filesystem root. "
                                 "Journaled quota will not work.");
@@ -2907,7 +2900,7 @@ static int ext3_quota_on(struct super_block *sb, int type, int format_id,
          * When we journal data on quota file, we have to flush journal to see
          * all updates to the file when we bypass pagecache...
          */
-        if (ext3_should_journal_data(path.dentry->d_inode)) {
+        if (ext3_should_journal_data(path->dentry->d_inode)) {
                 /*
                  * We don't need to lock updates but journal_flush() could
                  * otherwise be livelocked...
@@ -2915,15 +2908,11 @@ static int ext3_quota_on(struct super_block *sb, int type, int format_id,
                 journal_lock_updates(EXT3_SB(sb)->s_journal);
                 err = journal_flush(EXT3_SB(sb)->s_journal);
                 journal_unlock_updates(EXT3_SB(sb)->s_journal);
-                if (err) {
-                        path_put(&path);
+                if (err)
                         return err;
-                }
         }
 
-        err = dquot_quota_on_path(sb, type, format_id, &path);
-        path_put(&path);
-        return err;
+        return dquot_quota_on(sb, type, format_id, path);
 }
 
 /* Read data from quotafile - avoid pagecache and such because we cannot afford
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cb10a06775e..48ce561fafa 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1161,7 +1161,7 @@ static int ext4_release_dquot(struct dquot *dquot);
 static int ext4_mark_dquot_dirty(struct dquot *dquot);
 static int ext4_write_info(struct super_block *sb, int type);
 static int ext4_quota_on(struct super_block *sb, int type, int format_id,
-                                char *path);
+                         struct path *path);
 static int ext4_quota_off(struct super_block *sb, int type);
 static int ext4_quota_on_mount(struct super_block *sb, int type);
 static ssize_t ext4_quota_read(struct super_block *sb, int type, char *data,
@@ -4558,27 +4558,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type)
  * Standard function to be called on quota_on
  */
 static int ext4_quota_on(struct super_block *sb, int type, int format_id,
-                         char *name)
+                         struct path *path)
 {
         int err;
-        struct path path;
 
         if (!test_opt(sb, QUOTA))
                 return -EINVAL;
 
-        err = kern_path(name, LOOKUP_FOLLOW, &path);
-        if (err)
-                return err;
-
         /* Quotafile not on the same filesystem? */
-        if (path.mnt->mnt_sb != sb) {
-                path_put(&path);
+        if (path->mnt->mnt_sb != sb)
                 return -EXDEV;
-        }
         /* Journaling quota? */
         if (EXT4_SB(sb)->s_qf_names[type]) {
                 /* Quotafile not in fs root? */
-                if (path.dentry->d_parent != sb->s_root)
+                if (path->dentry->d_parent != sb->s_root)
                         ext4_msg(sb, KERN_WARNING,
                                 "Quota file not on filesystem root. "
                                 "Journaled quota will not work");
@@ -4589,7 +4582,7 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
          * all updates to the file when we bypass pagecache...
          */
         if (EXT4_SB(sb)->s_journal &&
-            ext4_should_journal_data(path.dentry->d_inode)) {
+            ext4_should_journal_data(path->dentry->d_inode)) {
                 /*
                  * We don't need to lock updates but journal_flush() could
                  * otherwise be livelocked...
@@ -4597,15 +4590,11 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
                 jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
                 err = jbd2_journal_flush(EXT4_SB(sb)->s_journal);
                 jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
-                if (err) {
-                        path_put(&path);
+                if (err)
                         return err;
-                }
         }
 
-        err = dquot_quota_on_path(sb, type, format_id, &path);
-        path_put(&path);
-        return err;
+        return dquot_quota_on(sb, type, format_id, path);
 }
 
 static int ext4_quota_off(struct super_block *sb, int type)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index ecc8b3954ed..cb1026181bd 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -815,7 +815,7 @@ static int __init fcntl_init(void)
                 __O_SYNC        | O_DSYNC       | FASYNC        |
                 O_DIRECT        | O_LARGEFILE   | O_DIRECTORY   |
                 O_NOFOLLOW      | O_NOATIME     | O_CLOEXEC     |
-                FMODE_EXEC
+                __FMODE_EXEC
                 ));
 
         fasync_cache = kmem_cache_create("fasync_cache",
diff --git a/fs/file_table.c b/fs/file_table.c
index c3e89adf53c..eb36b6b17e2 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -125,13 +125,13 @@ struct file *get_empty_filp(void)
                 goto fail;
 
         percpu_counter_inc(&nr_files);
+        f->f_cred = get_cred(cred);
         if (security_file_alloc(f))
                 goto fail_sec;
 
         INIT_LIST_HEAD(&f->f_u.fu_list);
         atomic_long_set(&f->f_count, 1);
         rwlock_init(&f->f_owner.lock);
-        f->f_cred = get_cred(cred);
         spin_lock_init(&f->f_lock);
         eventpoll_init_file(f);
         /* f->f_version: 0 */
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 2232b3c780b..7aa7d4f8984 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -74,16 +74,14 @@ static struct inode *gfs2_iget(struct super_block *sb, u64 no_addr)
 }
 
 /**
- * GFS2 lookup code fills in vfs inode contents based on info obtained
- * from directory entry inside gfs2_inode_lookup(). This has caused issues
- * with NFS code path since its get_dentry routine doesn't have the relevant
- * directory entry when gfs2_inode_lookup() is invoked. Part of the code
- * segment inside gfs2_inode_lookup code needs to get moved around.
+ * gfs2_set_iop - Sets inode operations
+ * @inode: The inode with correct i_mode filled in
  *
- * Clears I_NEW as well.
- **/
+ * GFS2 lookup code fills in vfs inode contents based on info obtained
+ * from directory entry inside gfs2_inode_lookup().
+ */
 
-void gfs2_set_iop(struct inode *inode)
+static void gfs2_set_iop(struct inode *inode)
 {
         struct gfs2_sbd *sdp = GFS2_SB(inode);
         umode_t mode = inode->i_mode;
@@ -106,8 +104,6 @@ void gfs2_set_iop(struct inode *inode)
                 inode->i_op = &gfs2_file_iops;
                 init_special_inode(inode, inode->i_mode, inode->i_rdev);
         }
-
-        unlock_new_inode(inode);
 }
 
 /**
@@ -119,10 +115,8 @@ void gfs2_set_iop(struct inode *inode)
  * Returns: A VFS inode, or an error
  */
 
-struct inode *gfs2_inode_lookup(struct super_block *sb,
-                                unsigned int type,
-                                u64 no_addr,
-                                u64 no_formal_ino)
+struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned int type,
+                                u64 no_addr, u64 no_formal_ino)
 {
         struct inode *inode;
         struct gfs2_inode *ip;
@@ -152,51 +146,37 @@ struct inode *gfs2_inode_lookup(struct super_block *sb,
                 error = gfs2_glock_nq_init(io_gl, LM_ST_SHARED, GL_EXACT, &ip->i_iopen_gh);
                 if (unlikely(error))
                         goto fail_iopen;
-                ip->i_iopen_gh.gh_gl->gl_object = ip;
 
+                ip->i_iopen_gh.gh_gl->gl_object = ip;
                 gfs2_glock_put(io_gl);
                 io_gl = NULL;
 
-                if ((type == DT_UNKNOWN) && (no_formal_ino == 0))
-                        goto gfs2_nfsbypass;
-
-                inode->i_mode = DT2IF(type);
-
-                /*
-                 * We must read the inode in order to work out its type in
-                 * this case. Note that this doesn't happen often as we normally
-                 * know the type beforehand. This code path only occurs during
-                 * unlinked inode recovery (where it is safe to do this glock,
-                 * which is not true in the general case).
-                 */
                 if (type == DT_UNKNOWN) {
-                        struct gfs2_holder gh;
-                        error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
-                        if (unlikely(error))
-                                goto fail_glock;
-                        /* Inode is now uptodate */
-                        gfs2_glock_dq_uninit(&gh);
+                        /* Inode glock must be locked already */
+                        error = gfs2_inode_refresh(GFS2_I(inode));
+                        if (error)
+                                goto fail_refresh;
+                } else {
+                        inode->i_mode = DT2IF(type);
                 }
 
                 gfs2_set_iop(inode);
+                unlock_new_inode(inode);
         }
 
-gfs2_nfsbypass:
         return inode;
-fail_glock:
-        gfs2_glock_dq(&ip->i_iopen_gh);
+
+fail_refresh:
+        ip->i_iopen_gh.gh_gl->gl_object = NULL;
+        gfs2_glock_dq_uninit(&ip->i_iopen_gh);
 fail_iopen:
         if (io_gl)
                 gfs2_glock_put(io_gl);
 fail_put:
-        if (inode->i_state & I_NEW)
-                ip->i_gl->gl_object = NULL;
+        ip->i_gl->gl_object = NULL;
         gfs2_glock_put(ip->i_gl);
 fail:
-        if (inode->i_state & I_NEW)
-                iget_failed(inode);
-        else
-                iput(inode);
+        iget_failed(inode);
         return ERR_PTR(error);
 }
 
@@ -221,14 +201,6 @@ struct inode *gfs2_lookup_by_inum(struct gfs2_sbd *sdp, u64 no_addr,
         if (IS_ERR(inode))
                 goto fail;
 
-        error = gfs2_inode_refresh(GFS2_I(inode));
-        if (error)
-                goto fail_iput;
-
-        /* Pick up the works we bypass in gfs2_inode_lookup */
-        if (inode->i_state & I_NEW) 
-                gfs2_set_iop(inode);
-
         /* Two extra checks for NFS only */
         if (no_formal_ino) {
                 error = -ESTALE;
diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h
index 732a183efdb..3e00a66e7cb 100644
--- a/fs/gfs2/inode.h
+++ b/fs/gfs2/inode.h
@@ -96,7 +96,6 @@ err:
         return -EIO;
 }
 
-extern void gfs2_set_iop(struct inode *inode);
 extern struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned type, 
                                        u64 no_addr, u64 no_formal_ino);
 extern struct inode *gfs2_lookup_by_inum(struct gfs2_sbd *sdp, u64 no_addr,
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 16c2ecac7eb..ec73ed70bae 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1336,6 +1336,7 @@ static void gfs2_evict_inode(struct inode *inode)
         if (error)
                 goto out_truncate;
 
+        ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
         gfs2_glock_dq_wait(&ip->i_iopen_gh);
         gfs2_holder_reinit(LM_ST_EXCLUSIVE, LM_FLAG_TRY_1CB | GL_NOCACHE, &ip->i_iopen_gh);
         error = gfs2_glock_nq(&ip->i_iopen_gh);
diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
index 52a0bcaa7b6..b1991a2a08e 100644
--- a/fs/hfsplus/extents.c
+++ b/fs/hfsplus/extents.c
@@ -397,8 +397,8 @@ int hfsplus_file_extend(struct inode *inode)
         u32 start, len, goal;
         int res;
 
-        if (sbi->total_blocks - sbi->free_blocks + 8 >
-                        sbi->alloc_file->i_size * 8) {
+        if (sbi->alloc_file->i_size * 8 <
+            sbi->total_blocks - sbi->free_blocks + 8) {
                 /* extend alloc file */
                 printk(KERN_ERR "hfs: extend alloc file! "
                                 "(%llu,%u,%u)\n",
diff --git a/fs/hfsplus/part_tbl.c b/fs/hfsplus/part_tbl.c
index d66ad113b1c..40ad88c12c6 100644
--- a/fs/hfsplus/part_tbl.c
+++ b/fs/hfsplus/part_tbl.c
@@ -134,7 +134,7 @@ int hfs_part_find(struct super_block *sb,
         res = hfsplus_submit_bio(sb->s_bdev, *part_start + HFS_PMAP_BLK,
                                  data, READ);
         if (res)
-                return res;
+                goto out;
 
         switch (be16_to_cpu(*((__be16 *)data))) {
         case HFS_OLD_PMAP_MAGIC:
@@ -147,7 +147,7 @@ int hfs_part_find(struct super_block *sb,
                 res = -ENOENT;
                 break;
         }
-
+out:
         kfree(data);
         return res;
 }
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 9a3b4795f43..b49b55584c8 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -338,20 +338,22 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         struct inode *root, *inode;
         struct qstr str;
         struct nls_table *nls = NULL;
-        int err = -EINVAL;
+        int err;
 
+        err = -EINVAL;
         sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
         if (!sbi)
-                return -ENOMEM;
+                goto out;
 
         sb->s_fs_info = sbi;
         mutex_init(&sbi->alloc_mutex);
         mutex_init(&sbi->vh_mutex);
         hfsplus_fill_defaults(sbi);
+
+        err = -EINVAL;
         if (!hfsplus_parse_options(data, sbi)) {
                 printk(KERN_ERR "hfs: unable to parse mount options\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
 
         /* temporarily use utf8 to correctly find the hidden dir below */
@@ -359,16 +361,14 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         sbi->nls = load_nls("utf8");
         if (!sbi->nls) {
                 printk(KERN_ERR "hfs: unable to load nls for utf8\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
 
         /* Grab the volume header */
         if (hfsplus_read_wrapper(sb)) {
                 if (!silent)
                         printk(KERN_WARNING "hfs: unable to find HFS+ superblock\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
         vhdr = sbi->s_vhdr;
 
@@ -377,7 +377,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (be16_to_cpu(vhdr->version) < HFSPLUS_MIN_VERSION ||
             be16_to_cpu(vhdr->version) > HFSPLUS_CURRENT_VERSION) {
                 printk(KERN_ERR "hfs: wrong filesystem version\n");
-                goto cleanup;
+                goto out_free_vhdr;
         }
         sbi->total_blocks = be32_to_cpu(vhdr->total_blocks);
         sbi->free_blocks = be32_to_cpu(vhdr->free_blocks);
@@ -421,19 +421,19 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         sbi->ext_tree = hfs_btree_open(sb, HFSPLUS_EXT_CNID);
         if (!sbi->ext_tree) {
                 printk(KERN_ERR "hfs: failed to load extents file\n");
-                goto cleanup;
+                goto out_free_vhdr;
         }
         sbi->cat_tree = hfs_btree_open(sb, HFSPLUS_CAT_CNID);
         if (!sbi->cat_tree) {
                 printk(KERN_ERR "hfs: failed to load catalog file\n");
-                goto cleanup;
+                goto out_close_ext_tree;
         }
 
         inode = hfsplus_iget(sb, HFSPLUS_ALLOC_CNID);
         if (IS_ERR(inode)) {
                 printk(KERN_ERR "hfs: failed to load allocation file\n");
                 err = PTR_ERR(inode);
-                goto cleanup;
+                goto out_close_cat_tree;
         }
         sbi->alloc_file = inode;
 
@@ -442,14 +442,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (IS_ERR(root)) {
                 printk(KERN_ERR "hfs: failed to load root directory\n");
                 err = PTR_ERR(root);
-                goto cleanup;
-        }
-        sb->s_d_op = &hfsplus_dentry_operations;
-        sb->s_root = d_alloc_root(root);
-        if (!sb->s_root) {
-                iput(root);
-                err = -ENOMEM;
-                goto cleanup;
+                goto out_put_alloc_file;
         }
 
         str.len = sizeof(HFSP_HIDDENDIR_NAME) - 1;
@@ -459,46 +452,69 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
                 hfs_find_exit(&fd);
                 if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))
-                        goto cleanup;
+                        goto out_put_root;
                 inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id));
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
-                        goto cleanup;
+                        goto out_put_root;
                 }
                 sbi->hidden_dir = inode;
         } else
                 hfs_find_exit(&fd);
 
-        if (sb->s_flags & MS_RDONLY)
-                goto out;
+        if (!(sb->s_flags & MS_RDONLY)) {
+                /*
+                 * H+LX == hfsplusutils, H+Lx == this driver, H+lx is unused
+                 * all three are registered with Apple for our use
+                 */
+                vhdr->last_mount_vers = cpu_to_be32(HFSP_MOUNT_VERSION);
+                vhdr->modify_date = hfsp_now2mt();
+                be32_add_cpu(&vhdr->write_count, 1);
+                vhdr->attributes &= cpu_to_be32(~HFSPLUS_VOL_UNMNT);
+                vhdr->attributes |= cpu_to_be32(HFSPLUS_VOL_INCNSTNT);
+                hfsplus_sync_fs(sb, 1);
 
-        /* H+LX == hfsplusutils, H+Lx == this driver, H+lx is unused
-         * all three are registered with Apple for our use
-         */
-        vhdr->last_mount_vers = cpu_to_be32(HFSP_MOUNT_VERSION);
-        vhdr->modify_date = hfsp_now2mt();
-        be32_add_cpu(&vhdr->write_count, 1);
-        vhdr->attributes &= cpu_to_be32(~HFSPLUS_VOL_UNMNT);
-        vhdr->attributes |= cpu_to_be32(HFSPLUS_VOL_INCNSTNT);
-        hfsplus_sync_fs(sb, 1);
-
-        if (!sbi->hidden_dir) {
-                mutex_lock(&sbi->vh_mutex);
-                sbi->hidden_dir = hfsplus_new_inode(sb, S_IFDIR);
-                hfsplus_create_cat(sbi->hidden_dir->i_ino, sb->s_root->d_inode,
-                                   &str, sbi->hidden_dir);
-                mutex_unlock(&sbi->vh_mutex);
-
-                hfsplus_mark_inode_dirty(sbi->hidden_dir, HFSPLUS_I_CAT_DIRTY);
+                if (!sbi->hidden_dir) {
+                        mutex_lock(&sbi->vh_mutex);
+                        sbi->hidden_dir = hfsplus_new_inode(sb, S_IFDIR);
+                        hfsplus_create_cat(sbi->hidden_dir->i_ino, root, &str,
+                                           sbi->hidden_dir);
+                        mutex_unlock(&sbi->vh_mutex);
+
+                        hfsplus_mark_inode_dirty(sbi->hidden_dir,
+                                                 HFSPLUS_I_CAT_DIRTY);
+                }
         }
-out:
+
+        sb->s_d_op = &hfsplus_dentry_operations;
+        sb->s_root = d_alloc_root(root);
+        if (!sb->s_root) {
+                err = -ENOMEM;
+                goto out_put_hidden_dir;
+        }
+
         unload_nls(sbi->nls);
         sbi->nls = nls;
         return 0;
 
-cleanup:
-        hfsplus_put_super(sb);
+out_put_hidden_dir:
+        iput(sbi->hidden_dir);
+out_put_root:
+        iput(sbi->alloc_file);
+out_put_alloc_file:
+        iput(sbi->alloc_file);
+out_close_cat_tree:
+        hfs_btree_close(sbi->cat_tree);
+out_close_ext_tree:
+        hfs_btree_close(sbi->ext_tree);
+out_free_vhdr:
+        kfree(sbi->s_vhdr);
+        kfree(sbi->s_backup_vhdr);
+out_unload_nls:
+        unload_nls(sbi->nls);
         unload_nls(nls);
+        kfree(sbi);
+out:
         return err;
 }
 
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 196231794f6..3031d81f5f0 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -167,7 +167,7 @@ reread:
                 break;
         case cpu_to_be16(HFSP_WRAP_MAGIC):
                 if (!hfsplus_read_mdb(sbi->s_vhdr, &wd))
-                        goto out;
+                        goto out_free_backup_vhdr;
                 wd.ablk_size >>= HFSPLUS_SECTOR_SHIFT;
                 part_start += wd.ablk_start + wd.embed_start * wd.ablk_size;
                 part_size = wd.embed_count * wd.ablk_size;
@@ -179,7 +179,7 @@ reread:
                  * (should do this only for cdrom/loop though)
                  */
                 if (hfs_part_find(sb, &part_start, &part_size))
-                        goto out;
+                        goto out_free_backup_vhdr;
                 goto reread;
         }
 
diff --git a/fs/ioctl.c b/fs/ioctl.c
index a59635e295f..1eebeb72b20 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -273,6 +273,13 @@ int __generic_block_fiemap(struct inode *inode,
                 len = isize;
         }
 
+        /*
+         * Some filesystems can't deal with being asked to map less than
+         * blocksize, so make sure our len is at least block length.
+         */
+        if (logical_to_blk(inode, len) == 0)
+                len = blk_to_logical(inode, 1);
+
         start_blk = logical_to_blk(inode, start);
         last_blk = logical_to_blk(inode, start + len - 1);
 
diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 5f1bcb2f06f..b7c99bfb3da 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -520,7 +520,7 @@ static struct nlm_host *next_host_state(struct hlist_head *cache,
                                         struct nsm_handle *nsm,
                                         const struct nlm_reboot *info)
 {
-        struct nlm_host *host = NULL;
+        struct nlm_host *host;
         struct hlist_head *chain;
         struct hlist_node *pos;
 
@@ -532,12 +532,13 @@ static struct nlm_host *next_host_state(struct hlist_head *cache,
                         host->h_state++;
 
                         nlm_get_host(host);
-                        goto out;
+                        mutex_unlock(&nlm_host_mutex);
+                        return host;
                 }
         }
-out:
+
         mutex_unlock(&nlm_host_mutex);
-        return host;
+        return NULL;
 }
 
 /**
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 199016528fc..e3d29426905 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -135,33 +135,6 @@ out_err:
 
 #if defined(CONFIG_NFS_V4_1)
 /*
- *  * CB_SEQUENCE operations will fail until the callback sessionid is set.
- *   */
-int nfs4_set_callback_sessionid(struct nfs_client *clp)
-{
-        struct svc_serv *serv = clp->cl_rpcclient->cl_xprt->bc_serv;
-        struct nfs4_sessionid *bc_sid;
-
-        if (!serv->sv_bc_xprt)
-                return -EINVAL;
-
-        /* on success freed in xprt_free */
-        bc_sid = kmalloc(sizeof(struct nfs4_sessionid), GFP_KERNEL);
-        if (!bc_sid)
-                return -ENOMEM;
-        memcpy(bc_sid->data, &clp->cl_session->sess_id.data,
-                NFS4_MAX_SESSIONID_LEN);
-        spin_lock_bh(&serv->sv_cb_lock);
-        serv->sv_bc_xprt->xpt_bc_sid = bc_sid;
-        spin_unlock_bh(&serv->sv_cb_lock);
-        dprintk("%s set xpt_bc_sid=%u:%u:%u:%u for sv_bc_xprt %p\n", __func__,
-                ((u32 *)bc_sid->data)[0], ((u32 *)bc_sid->data)[1],
-                ((u32 *)bc_sid->data)[2], ((u32 *)bc_sid->data)[3],
-                serv->sv_bc_xprt);
-        return 0;
-}
-
-/*
  * The callback service for NFSv4.1 callbacks
  */
 static int
@@ -266,10 +239,6 @@ static inline void nfs_callback_bc_serv(u32 minorversion, struct rpc_xprt *xprt,
                 struct nfs_callback_data *cb_info)
 {
 }
-int nfs4_set_callback_sessionid(struct nfs_client *clp)
-{
-        return 0;
-}
 #endif /* CONFIG_NFS_V4_1 */
 
 /*
@@ -359,78 +328,58 @@ void nfs_callback_down(int minorversion)
         mutex_unlock(&nfs_callback_mutex);
 }
 
-static int check_gss_callback_principal(struct nfs_client *clp,
-                                        struct svc_rqst *rqstp)
+/* Boolean check of RPC_AUTH_GSS principal */
+int
+check_gss_callback_principal(struct nfs_client *clp, struct svc_rqst *rqstp)
 {
         struct rpc_clnt *r = clp->cl_rpcclient;
         char *p = svc_gss_principal(rqstp);
 
+        if (rqstp->rq_authop->flavour != RPC_AUTH_GSS)
+                return 1;
+
         /* No RPC_AUTH_GSS on NFSv4.1 back channel yet */
         if (clp->cl_minorversion != 0)
-                return SVC_DROP;
+                return 0;
         /*
          * It might just be a normal user principal, in which case
          * userspace won't bother to tell us the name at all.
          */
         if (p == NULL)
-                return SVC_DENIED;
+                return 0;
 
         /* Expect a GSS_C_NT_HOSTBASED_NAME like "nfs@serverhostname" */
 
         if (memcmp(p, "nfs@", 4) != 0)
-                return SVC_DENIED;
+                return 0;
         p += 4;
         if (strcmp(p, r->cl_server) != 0)
-                return SVC_DENIED;
-        return SVC_OK;
+                return 0;
+        return 1;
 }
 
-/* pg_authenticate method helper */
-static struct nfs_client *nfs_cb_find_client(struct svc_rqst *rqstp)
-{
-        struct nfs4_sessionid *sessionid = bc_xprt_sid(rqstp);
-        int is_cb_compound = rqstp->rq_proc == CB_COMPOUND ? 1 : 0;
-
-        dprintk("--> %s rq_proc %d\n", __func__, rqstp->rq_proc);
-        if (svc_is_backchannel(rqstp))
-                /* Sessionid (usually) set after CB_NULL ping */
-                return nfs4_find_client_sessionid(svc_addr(rqstp), sessionid,
-                                                  is_cb_compound);
-        else
-                /* No callback identifier in pg_authenticate */
-                return nfs4_find_client_no_ident(svc_addr(rqstp));
-}
-
-/* pg_authenticate method for nfsv4 callback threads. */
+/*
+ * pg_authenticate method for nfsv4 callback threads.
+ *
+ * The authflavor has been negotiated, so an incorrect flavor is a server
+ * bug. Drop packets with incorrect authflavor.
+ *
+ * All other checking done after NFS decoding where the nfs_client can be
+ * found in nfs4_callback_compound
+ */
 static int nfs_callback_authenticate(struct svc_rqst *rqstp)
 {
-        struct nfs_client *clp;
-        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
-        int ret = SVC_OK;
-
-        /* Don't talk to strangers */
-        clp = nfs_cb_find_client(rqstp);
-        if (clp == NULL)
-                return SVC_DROP;
-
-        dprintk("%s: %s NFSv4 callback!\n", __func__,
-                        svc_print_addr(rqstp, buf, sizeof(buf)));
-
         switch (rqstp->rq_authop->flavour) {
-                case RPC_AUTH_NULL:
-                        if (rqstp->rq_proc != CB_NULL)
-                                ret = SVC_DENIED;
-                        break;
-                case RPC_AUTH_UNIX:
-                        break;
-                case RPC_AUTH_GSS:
-                        ret = check_gss_callback_principal(clp, rqstp);
-                        break;
-                default:
-                        ret = SVC_DENIED;
+        case RPC_AUTH_NULL:
+                if (rqstp->rq_proc != CB_NULL)
+                        return SVC_DROP;
+                break;
+        case RPC_AUTH_GSS:
+                /* No RPC_AUTH_GSS support yet in NFSv4.1 */
+                 if (svc_is_backchannel(rqstp))
+                        return SVC_DROP;
         }
-        nfs_put_client(clp);
-        return ret;
+        return SVC_OK;
 }
 
 /*
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index d3b44f9bd74..46d93ce7311 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -7,6 +7,7 @@
  */
 #ifndef __LINUX_FS_NFS_CALLBACK_H
 #define __LINUX_FS_NFS_CALLBACK_H
+#include <linux/sunrpc/svc.h>
 
 #define NFS4_CALLBACK 0x40000000
 #define NFS4_CALLBACK_XDRSIZE 2048
@@ -37,7 +38,6 @@ enum nfs4_callback_opnum {
 struct cb_process_state {
         __be32                  drc_status;
         struct nfs_client       *clp;
-        struct nfs4_sessionid   *svc_sid; /* v4.1 callback service sessionid */
 };
 
 struct cb_compound_hdr_arg {
@@ -168,7 +168,7 @@ extern unsigned nfs4_callback_layoutrecall(
 extern void nfs4_check_drain_bc_complete(struct nfs4_session *ses);
 extern void nfs4_cb_take_slot(struct nfs_client *clp);
 #endif /* CONFIG_NFS_V4_1 */
-
+extern int check_gss_callback_principal(struct nfs_client *, struct svc_rqst *);
 extern __be32 nfs4_callback_getattr(struct cb_getattrargs *args,
                                     struct cb_getattrres *res,
                                     struct cb_process_state *cps);
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 4bb91cb2620..89587573fe5 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -373,17 +373,11 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
 {
         struct nfs_client *clp;
         int i;
-        __be32 status;
+        __be32 status = htonl(NFS4ERR_BADSESSION);
 
         cps->clp = NULL;
 
-        status = htonl(NFS4ERR_BADSESSION);
-        /* Incoming session must match the callback session */
-        if (memcmp(&args->csa_sessionid, cps->svc_sid, NFS4_MAX_SESSIONID_LEN))
-                goto out;
-
-        clp = nfs4_find_client_sessionid(args->csa_addr,
-                                         &args->csa_sessionid, 1);
+        clp = nfs4_find_client_sessionid(args->csa_addr, &args->csa_sessionid);
         if (clp == NULL)
                 goto out;
 
@@ -414,9 +408,9 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
         res->csr_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
         res->csr_target_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
         nfs4_cb_take_slot(clp);
-        cps->clp = clp; /* put in nfs4_callback_compound */
 
 out:
+        cps->clp = clp; /* put in nfs4_callback_compound */
         for (i = 0; i < args->csa_nrclists; i++)
                 kfree(args->csa_rclists[i].rcl_refcalls);
         kfree(args->csa_rclists);
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 23112c263f8..14e0f9371d1 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -794,10 +794,9 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
 
         if (hdr_arg.minorversion == 0) {
                 cps.clp = nfs4_find_client_ident(hdr_arg.cb_ident);
-                if (!cps.clp)
+                if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
                         return rpc_drop_reply;
-        } else
-                cps.svc_sid = bc_xprt_sid(rqstp);
+        }
 
         hdr_res.taglen = hdr_arg.taglen;
         hdr_res.tag = hdr_arg.tag;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 192f2f86026..bd3ca32879e 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1206,16 +1206,11 @@ nfs4_find_client_ident(int cb_ident)
  * For CB_COMPOUND calls, find a client by IP address, protocol version,
  * minorversion, and sessionID
  *
- * CREATE_SESSION triggers a CB_NULL ping from servers. The callback service
- * sessionid can only be set after the CREATE_SESSION return, so a CB_NULL
- * can arrive before the callback sessionid is set. For CB_NULL calls,
- * find a client by IP address protocol version, and minorversion.
- *
  * Returns NULL if no such client
  */
 struct nfs_client *
 nfs4_find_client_sessionid(const struct sockaddr *addr,
-                           struct nfs4_sessionid *sid, int is_cb_compound)
+                           struct nfs4_sessionid *sid)
 {
         struct nfs_client *clp;
 
@@ -1227,9 +1222,9 @@ nfs4_find_client_sessionid(const struct sockaddr *addr,
                 if (!nfs4_has_session(clp))
                         continue;
 
-                /* Match sessionid unless cb_null call*/
-                if (is_cb_compound && (memcmp(clp->cl_session->sess_id.data,
-                    sid->data, NFS4_MAX_SESSIONID_LEN) != 0))
+                /* Match sessionid*/
+                if (memcmp(clp->cl_session->sess_id.data,
+                    sid->data, NFS4_MAX_SESSIONID_LEN) != 0)
                         continue;
 
                 atomic_inc(&clp->cl_count);
@@ -1244,7 +1239,7 @@ nfs4_find_client_sessionid(const struct sockaddr *addr,
 
 struct nfs_client *
 nfs4_find_client_sessionid(const struct sockaddr *addr,
-                           struct nfs4_sessionid *sid, int is_cb_compound)
+                           struct nfs4_sessionid *sid)
 {
         return NULL;
 }
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 364e4328f39..bbbc6bf5cb2 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -23,8 +23,6 @@
 
 static void nfs_do_free_delegation(struct nfs_delegation *delegation)
 {
-        if (delegation->cred)
-                put_rpccred(delegation->cred);
         kfree(delegation);
 }
 
@@ -37,6 +35,10 @@ static void nfs_free_delegation_callback(struct rcu_head *head)
 
 static void nfs_free_delegation(struct nfs_delegation *delegation)
 {
+        if (delegation->cred) {
+                put_rpccred(delegation->cred);
+                delegation->cred = NULL;
+        }
         call_rcu(&delegation->rcu, nfs_free_delegation_callback);
 }
 
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index e6ace0d93c7..9943a75bb6d 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -407,15 +407,18 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
                 pos += vec->iov_len;
         }
 
+        /*
+         * If no bytes were started, return the error, and let the
+         * generic layer handle the completion.
+         */
+        if (requested_bytes == 0) {
+                nfs_direct_req_release(dreq);
+                return result < 0 ? result : -EIO;
+        }
+
         if (put_dreq(dreq))
                 nfs_direct_complete(dreq);
-
-        if (requested_bytes != 0)
-                return 0;
-
-        if (result < 0)
-                return result;
-        return -EIO;
+        return 0;
 }
 
 static ssize_t nfs_direct_read(struct kiocb *iocb, const struct iovec *iov,
@@ -841,15 +844,18 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
                 pos += vec->iov_len;
         }
 
+        /*
+         * If no bytes were started, return the error, and let the
+         * generic layer handle the completion.
+         */
+        if (requested_bytes == 0) {
+                nfs_direct_req_release(dreq);
+                return result < 0 ? result : -EIO;
+        }
+
         if (put_dreq(dreq))
                 nfs_direct_write_complete(dreq, dreq->inode);
-
-        if (requested_bytes != 0)
-                return 0;
-
-        if (result < 0)
-                return result;
-        return -EIO;
+        return 0;
 }
 
 static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index d8512423ba7..1cc600e77bb 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -881,9 +881,10 @@ out:
         return ret;
 }
 
-static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
+        unsigned long ret = 0;
 
         if ((fattr->valid & NFS_ATTR_FATTR_PRECHANGE)
                         && (fattr->valid & NFS_ATTR_FATTR_CHANGE)
@@ -891,25 +892,32 @@ static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 nfsi->change_attr = fattr->change_attr;
                 if (S_ISDIR(inode->i_mode))
                         nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                ret |= NFS_INO_INVALID_ATTR;
         }
         /* If we have atomic WCC data, we may update some attributes */
         if ((fattr->valid & NFS_ATTR_FATTR_PRECTIME)
                         && (fattr->valid & NFS_ATTR_FATTR_CTIME)
-                        && timespec_equal(&inode->i_ctime, &fattr->pre_ctime))
-                        memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+                        && timespec_equal(&inode->i_ctime, &fattr->pre_ctime)) {
+                memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+                ret |= NFS_INO_INVALID_ATTR;
+        }
 
         if ((fattr->valid & NFS_ATTR_FATTR_PREMTIME)
                         && (fattr->valid & NFS_ATTR_FATTR_MTIME)
                         && timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
-                        memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
-                        if (S_ISDIR(inode->i_mode))
-                                nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
+                if (S_ISDIR(inode->i_mode))
+                        nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                ret |= NFS_INO_INVALID_ATTR;
         }
         if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
                         && (fattr->valid & NFS_ATTR_FATTR_SIZE)
                         && i_size_read(inode) == nfs_size_to_loff_t(fattr->pre_size)
-                        && nfsi->npages == 0)
-                        i_size_write(inode, nfs_size_to_loff_t(fattr->size));
+                        && nfsi->npages == 0) {
+                i_size_write(inode, nfs_size_to_loff_t(fattr->size));
+                ret |= NFS_INO_INVALID_ATTR;
+        }
+        return ret;
 }
 
 /**
@@ -1223,7 +1231,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                         | NFS_INO_REVAL_PAGECACHE);
 
         /* Do atomic weak cache consistency updates */
-        nfs_wcc_update_inode(inode, fattr);
+        invalid |= nfs_wcc_update_inode(inode, fattr);
 
         /* More cache consistency checks */
         if (fattr->valid & NFS_ATTR_FATTR_CHANGE) {
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 4644f04b4b4..cf9fdbdabc6 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -133,8 +133,7 @@ extern void nfs_put_client(struct nfs_client *);
 extern struct nfs_client *nfs4_find_client_no_ident(const struct sockaddr *);
 extern struct nfs_client *nfs4_find_client_ident(int);
 extern struct nfs_client *
-nfs4_find_client_sessionid(const struct sockaddr *, struct nfs4_sessionid *,
-                           int);
+nfs4_find_client_sessionid(const struct sockaddr *, struct nfs4_sessionid *);
 extern struct nfs_server *nfs_create_server(
                                         const struct nfs_parsed_mount_data *,
                                         struct nfs_fh *);
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index 9f88c5f4c7e..27434277165 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -311,8 +311,8 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
         if (!nfs_server_capable(inode, NFS_CAP_ACLS))
                 goto out;
 
-        /* We are doing this here, because XDR marshalling can only
-           return -ENOMEM. */
+        /* We are doing this here because XDR marshalling does not
+         * return any results, it BUGs. */
         status = -ENOSPC;
         if (acl != NULL && acl->a_count > NFS_ACL_MAX_ENTRIES)
                 goto out;
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 01c5e8b1941..183c6b123d0 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -1328,10 +1328,13 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
 
         encode_nfs_fh3(xdr, NFS_FH(args->inode));
         encode_uint32(xdr, args->mask);
+
+        base = req->rq_slen;
         if (args->npages != 0)
                 xdr_write_pages(xdr, args->pages, 0, args->len);
+        else
+                xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
 
-        base = req->rq_slen;
         error = nfsacl_encode(xdr->buf, base, args->inode,
                             (args->mask & NFS_ACL) ?
                             args->acl_access : NULL, 1, 0);
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index 51fe64ace55..f5c9b125e8c 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -214,7 +214,7 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
 
         /* ipv6 length plus port is legal */
         if (rlen > INET6_ADDRSTRLEN + 8) {
-                dprintk("%s Invalid address, length %d\n", __func__,
+                dprintk("%s: Invalid address, length %d\n", __func__,
                         rlen);
                 goto out_err;
         }
@@ -225,6 +225,11 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
         /* replace the port dots with dashes for the in4_pton() delimiter*/
         for (i = 0; i < 2; i++) {
                 char *res = strrchr(buf, '.');
+                if (!res) {
+                        dprintk("%s: Failed finding expected dots in port\n",
+                                __func__);
+                        goto out_free;
+                }
                 *res = '-';
         }
 
@@ -240,7 +245,7 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
         port = htons((tmp[0] << 8) | (tmp[1]));
 
         ds = nfs4_pnfs_ds_add(inode, ip_addr, port);
-        dprintk("%s Decoded address and port %s\n", __func__, buf);
+        dprintk("%s: Decoded address and port %s\n", __func__, buf);
 out_free:
         kfree(buf);
 out_err:
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 9d992b0346e..78936a8f40a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -50,6 +50,7 @@
 #include <linux/module.h>
 #include <linux/sunrpc/bc_xprt.h>
 #include <linux/xattr.h>
+#include <linux/utsname.h>
 
 #include "nfs4_fs.h"
 #include "delegation.h"
@@ -4572,27 +4573,16 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
         *p = htonl((u32)clp->cl_boot_time.tv_nsec);
         args.verifier = &verifier;
 
-        while (1) {
-                args.id_len = scnprintf(args.id, sizeof(args.id),
-                                        "%s/%s %u",
-                                        clp->cl_ipaddr,
-                                        rpc_peeraddr2str(clp->cl_rpcclient,
-                                                         RPC_DISPLAY_ADDR),
-                                        clp->cl_id_uniquifier);
-
-                status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
-
-                if (status != -NFS4ERR_CLID_INUSE)
-                        break;
-
-                if (signalled())
-                        break;
-
-                if (++clp->cl_id_uniquifier == 0)
-                        break;
-        }
+        args.id_len = scnprintf(args.id, sizeof(args.id),
+                                "%s/%s.%s/%u",
+                                clp->cl_ipaddr,
+                                init_utsname()->nodename,
+                                init_utsname()->domainname,
+                                clp->cl_rpcclient->cl_auth->au_flavor);
 
-        status = nfs4_check_cl_exchange_flags(clp->cl_exchange_flags);
+        status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+        if (!status)
+                status = nfs4_check_cl_exchange_flags(clp->cl_exchange_flags);
         dprintk("<-- %s status= %d\n", __func__, status);
         return status;
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 2336d532cf6..e6742b57a04 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -232,12 +232,6 @@ int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
         status = nfs4_proc_create_session(clp);
         if (status != 0)
                 goto out;
-        status = nfs4_set_callback_sessionid(clp);
-        if (status != 0) {
-                printk(KERN_WARNING "Sessionid not set. No callback service\n");
-                nfs_callback_down(1);
-                status = 0;
-        }
         nfs41_setup_state_renewal(clp);
         nfs_mark_client_ready(clp, NFS_CS_READY);
 out:
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 2ab8e5cb8f5..4e2c168b6ee 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -6086,11 +6086,11 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
         __be32 *p = xdr_inline_decode(xdr, 4);
         if (unlikely(!p))
                 goto out_overflow;
-        if (!ntohl(*p++)) {
+        if (*p == xdr_zero) {
                 p = xdr_inline_decode(xdr, 4);
                 if (unlikely(!p))
                         goto out_overflow;
-                if (!ntohl(*p++))
+                if (*p == xdr_zero)
                         return -EAGAIN;
                 entry->eof = 1;
                 return -EBADCOOKIE;
@@ -6101,7 +6101,7 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
                 goto out_overflow;
         entry->prev_cookie = entry->cookie;
         p = xdr_decode_hyper(p, &entry->cookie);
-        entry->len = ntohl(*p++);
+        entry->len = be32_to_cpup(p);
 
         p = xdr_inline_decode(xdr, entry->len);
         if (unlikely(!p))
@@ -6132,9 +6132,6 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
         if (entry->fattr->valid & NFS_ATTR_FATTR_TYPE)
                 entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
 
-        if (verify_attr_len(xdr, p, len) < 0)
-                goto out_overflow;
-
         return 0;
 
 out_overflow:
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index bc408976973..1b1bc1a0fb0 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -951,7 +951,7 @@ pnfs_put_deviceid_cache(struct nfs_client *clp)
 {
         struct pnfs_deviceid_cache *local = clp->cl_devid_cache;
 
-        dprintk("--> %s cl_devid_cache %p\n", __func__, clp->cl_devid_cache);
+        dprintk("--> %s ({%d})\n", __func__, atomic_read(&local->dc_ref));
         if (atomic_dec_and_lock(&local->dc_ref, &clp->cl_lock)) {
                 int i;
                 /* Verify cache is empty */
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 10d648ea128..c8278f4046c 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -932,7 +932,7 @@ out_bad:
         while (!list_empty(&list)) {
                 data = list_entry(list.next, struct nfs_write_data, pages);
                 list_del(&data->pages);
-                nfs_writedata_release(data);
+                nfs_writedata_free(data);
         }
         nfs_redirty_request(req);
         return -ENOMEM;
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index fc1c52571c0..84c27d69d42 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -42,6 +42,11 @@ struct nfsacl_encode_desc {
         gid_t gid;
 };
 
+struct nfsacl_simple_acl {
+        struct posix_acl acl;
+        struct posix_acl_entry ace[4];
+};
+
 static int
 xdr_nfsace_encode(struct xdr_array2_desc *desc, void *elem)
 {
@@ -72,9 +77,20 @@ xdr_nfsace_encode(struct xdr_array2_desc *desc, void *elem)
         return 0;
 }
 
-unsigned int
-nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
-              struct posix_acl *acl, int encode_entries, int typeflag)
+/**
+ * nfsacl_encode - Encode an NFSv3 ACL
+ *
+ * @buf: destination xdr_buf to contain XDR encoded ACL
+ * @base: byte offset in xdr_buf where XDR'd ACL begins
+ * @inode: inode of file whose ACL this is
+ * @acl: posix_acl to encode
+ * @encode_entries: whether to encode ACEs as well
+ * @typeflag: ACL type: NFS_ACL_DEFAULT or zero
+ *
+ * Returns size of encoded ACL in bytes or a negative errno value.
+ */
+int nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
+                  struct posix_acl *acl, int encode_entries, int typeflag)
 {
         int entries = (acl && acl->a_count) ? max_t(int, acl->a_count, 4) : 0;
         struct nfsacl_encode_desc nfsacl_desc = {
@@ -88,17 +104,22 @@ nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
                 .uid = inode->i_uid,
                 .gid = inode->i_gid,
         };
+        struct nfsacl_simple_acl aclbuf;
         int err;
-        struct posix_acl *acl2 = NULL;
 
         if (entries > NFS_ACL_MAX_ENTRIES ||
             xdr_encode_word(buf, base, entries))
                 return -EINVAL;
         if (encode_entries && acl && acl->a_count == 3) {
-                /* Fake up an ACL_MASK entry. */
-                acl2 = posix_acl_alloc(4, GFP_KERNEL);
-                if (!acl2)
-                        return -ENOMEM;
+                struct posix_acl *acl2 = &aclbuf.acl;
+
+                /* Avoid the use of posix_acl_alloc().  nfsacl_encode() is
+                 * invoked in contexts where a memory allocation failure is
+                 * fatal.  Fortunately this fake ACL is small enough to
+                 * construct on the stack. */
+                memset(acl2, 0, sizeof(acl2));
+                posix_acl_init(acl2, 4);
+
                 /* Insert entries in canonical order: other orders seem
                  to confuse Solaris VxFS. */
                 acl2->a_entries[0] = acl->a_entries[0];  /* ACL_USER_OBJ */
@@ -109,8 +130,6 @@ nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
                 nfsacl_desc.acl = acl2;
         }
         err = xdr_encode_array2(buf, base + 4, &nfsacl_desc.desc);
-        if (acl2)
-                posix_acl_release(acl2);
         if (!err)
                 err = 8 + nfsacl_desc.desc.elem_size *
                           nfsacl_desc.desc.array_len;
@@ -224,9 +243,18 @@ posix_acl_from_nfsacl(struct posix_acl *acl)
         return 0;
 }
 
-unsigned int
-nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
-              struct posix_acl **pacl)
+/**
+ * nfsacl_decode - Decode an NFSv3 ACL
+ *
+ * @buf: xdr_buf containing XDR'd ACL data to decode
+ * @base: byte offset in xdr_buf where XDR'd ACL begins
+ * @aclcnt: count of ACEs in decoded posix_acl
+ * @pacl: buffer in which to place decoded posix_acl
+ *
+ * Returns the length of the decoded ACL in bytes, or a negative errno value.
+ */
+int nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
+                  struct posix_acl **pacl)
 {
         struct nfsacl_decode_desc nfsacl_desc = {
                 .desc = {
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 0994f6a76c0..58fd707174e 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -704,7 +704,8 @@ skip_mount_setup:
         sbp[0]->s_state =
                 cpu_to_le16(le16_to_cpu(sbp[0]->s_state) & ~NILFS_VALID_FS);
         /* synchronize sbp[1] with sbp[0] */
-        memcpy(sbp[1], sbp[0], nilfs->ns_sbsize);
+        if (sbp[1])
+                memcpy(sbp[1], sbp[0], nilfs->ns_sbsize);
         return nilfs_commit_super(sbi, NILFS_SB_COMMIT_ALL);
 }
 
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index b572b672718..326e7475a22 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1,7 +1,7 @@
 /**
  * mft.c - NTFS kernel mft record operations. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2006 Anton Altaparmakov
+ * Copyright (c) 2001-2011 Anton Altaparmakov and Tuxera Inc.
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -2576,6 +2576,8 @@ mft_rec_already_initialized:
         flush_dcache_page(page);
         SetPageUptodate(page);
         if (base_ni) {
+                MFT_RECORD *m_tmp;
+
                 /*
                  * Setup the base mft record in the extent mft record.  This
                  * completes initialization of the allocated extent mft record
@@ -2588,11 +2590,11 @@ mft_rec_already_initialized:
                  * attach it to the base inode @base_ni and map, pin, and lock
                  * its, i.e. the allocated, mft record.
                  */
-                m = map_extent_mft_record(base_ni, bit, &ni);
-                if (IS_ERR(m)) {
+                m_tmp = map_extent_mft_record(base_ni, bit, &ni);
+                if (IS_ERR(m_tmp)) {
                         ntfs_error(vol->sb, "Failed to map allocated extent "
                                         "mft record 0x%llx.", (long long)bit);
-                        err = PTR_ERR(m);
+                        err = PTR_ERR(m_tmp);
                         /* Set the mft record itself not in use. */
                         m->flags &= cpu_to_le16(
                                         ~le16_to_cpu(MFT_RECORD_IN_USE));
@@ -2603,6 +2605,7 @@ mft_rec_already_initialized:
                         ntfs_unmap_page(page);
                         goto undo_mftbmp_alloc;
                 }
+                BUG_ON(m != m_tmp);
                 /*
                  * Make sure the allocated mft record is written out to disk.
                  * No need to set the inode dirty because the caller is going
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 06d1f749ca8..38f986d2447 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -993,8 +993,7 @@ static void ocfs2_disable_quotas(struct ocfs2_super *osb)
 }
 
 /* Handle quota on quotactl */
-static int ocfs2_quota_on(struct super_block *sb, int type, int format_id,
-                          char *path)
+static int ocfs2_quota_on(struct super_block *sb, int type, int format_id)
 {
         unsigned int feature[MAXQUOTAS] = { OCFS2_FEATURE_RO_COMPAT_USRQUOTA,
                                              OCFS2_FEATURE_RO_COMPAT_GRPQUOTA};
@@ -1013,7 +1012,7 @@ static int ocfs2_quota_off(struct super_block *sb, int type)
 }
 
 static const struct quotactl_ops ocfs2_quotactl_ops = {
-        .quota_on       = ocfs2_quota_on,
+        .quota_on_meta  = ocfs2_quota_on,
         .quota_off      = ocfs2_quota_off,
         .quota_sync     = dquot_quota_sync,
         .get_info       = dquot_get_dqinfo,
diff --git a/fs/pipe.c b/fs/pipe.c
index 89e9e19b1b2..da42f7db50d 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -441,7 +441,7 @@ redo:
                         break;
                 }
                 if (do_wakeup) {
-                        wake_up_interruptible_sync_poll(&pipe->wait, POLLOUT);
+                        wake_up_interruptible_sync_poll(&pipe->wait, POLLOUT | POLLWRNORM);
                         kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
                 }
                 pipe_wait(pipe);
@@ -450,7 +450,7 @@ redo:
 
         /* Signal writers asynchronously that there is more room. */
         if (do_wakeup) {
-                wake_up_interruptible_sync_poll(&pipe->wait, POLLOUT);
+                wake_up_interruptible_sync_poll(&pipe->wait, POLLOUT | POLLWRNORM);
                 kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
         }
         if (ret > 0)
@@ -612,7 +612,7 @@ redo2:
                         break;
                 }
                 if (do_wakeup) {
-                        wake_up_interruptible_sync_poll(&pipe->wait, POLLIN);
+                        wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLRDNORM);
                         kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
                         do_wakeup = 0;
                 }
@@ -623,7 +623,7 @@ redo2:
 out:
         mutex_unlock(&inode->i_mutex);
         if (do_wakeup) {
-                wake_up_interruptible_sync_poll(&pipe->wait, POLLIN);
+                wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLRDNORM);
                 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
         }
         if (ret > 0)
@@ -715,7 +715,7 @@ pipe_release(struct inode *inode, int decr, int decw)
         if (!pipe->readers && !pipe->writers) {
                 free_pipe_info(inode);
         } else {
-                wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT);
+                wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
                 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
                 kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
         }
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 39df95a0ec2..b1cf6bf4b41 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -22,6 +22,7 @@
 
 #include <linux/errno.h>
 
+EXPORT_SYMBOL(posix_acl_init);
 EXPORT_SYMBOL(posix_acl_alloc);
 EXPORT_SYMBOL(posix_acl_clone);
 EXPORT_SYMBOL(posix_acl_valid);
@@ -32,6 +33,16 @@ EXPORT_SYMBOL(posix_acl_chmod_masq);
 EXPORT_SYMBOL(posix_acl_permission);
 
 /*
+ * Init a fresh posix_acl
+ */
+void
+posix_acl_init(struct posix_acl *acl, int count)
+{
+        atomic_set(&acl->a_refcount, 1);
+        acl->a_count = count;
+}
+
+/*
  * Allocate a new ACL with the specified number of entries.
  */
 struct posix_acl *
@@ -40,10 +51,8 @@ posix_acl_alloc(int count, gfp_t flags)
         const size_t size = sizeof(struct posix_acl) +
                             count * sizeof(struct posix_acl_entry);
         struct posix_acl *acl = kmalloc(size, flags);
-        if (acl) {
-                atomic_set(&acl->a_refcount, 1);
-                acl->a_count = count;
-        }
+        if (acl)
+                posix_acl_init(acl, count);
         return acl;
 }
 
diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
index 6a0068841d9..15af6222f8a 100644
--- a/fs/proc/Kconfig
+++ b/fs/proc/Kconfig
@@ -1,5 +1,5 @@
 config PROC_FS
-        bool "/proc file system support" if EMBEDDED
+        bool "/proc file system support" if EXPERT
         default y
         help
           This is a virtual file system providing information about the status
@@ -40,7 +40,7 @@ config PROC_VMCORE
         Exports the dump image of crashed kernel in ELF format.
 
 config PROC_SYSCTL
-        bool "Sysctl support (/proc/sys)" if EMBEDDED
+        bool "Sysctl support (/proc/sys)" if EXPERT
         depends on PROC_FS
         select SYSCTL
         default y
@@ -61,7 +61,7 @@ config PROC_SYSCTL
 config PROC_PAGE_MONITOR
         default y
         depends on PROC_FS && MMU
-        bool "Enable /proc page monitoring" if EMBEDDED
+        bool "Enable /proc page monitoring" if EXPERT
         help
           Various /proc files exist to monitor process memory utilization:
           /proc/pid/smaps, /proc/pid/clear_refs, /proc/pid/pagemap,
diff --git a/fs/proc/consoles.c b/fs/proc/consoles.c
index eafc22ab1fd..b701eaa482b 100644
--- a/fs/proc/consoles.c
+++ b/fs/proc/consoles.c
@@ -67,7 +67,7 @@ static void *c_start(struct seq_file *m, loff_t *pos)
         struct console *con;
         loff_t off = 0;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(con)
                 if (off++ == *pos)
                         break;
@@ -84,7 +84,7 @@ static void *c_next(struct seq_file *m, void *v, loff_t *pos)
 
 static void c_stop(struct seq_file *m, void *v)
 {
-        release_console_sem();
+        console_unlock();
 }
 
 static const struct seq_operations consoles_op = {
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 84becd3e477..a2a622e079f 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2189,8 +2189,8 @@ int dquot_resume(struct super_block *sb, int type)
 }
 EXPORT_SYMBOL(dquot_resume);
 
-int dquot_quota_on_path(struct super_block *sb, int type, int format_id,
-                      struct path *path)
+int dquot_quota_on(struct super_block *sb, int type, int format_id,
+                   struct path *path)
 {
         int error = security_quota_on(path->dentry);
         if (error)
@@ -2204,20 +2204,6 @@ int dquot_quota_on_path(struct super_block *sb, int type, int format_id,
                                              DQUOT_LIMITS_ENABLED);
         return error;
 }
-EXPORT_SYMBOL(dquot_quota_on_path);
-
-int dquot_quota_on(struct super_block *sb, int type, int format_id, char *name)
-{
-        struct path path;
-        int error;
-
-        error = kern_path(name, LOOKUP_FOLLOW, &path);
-        if (!error) {
-                error = dquot_quota_on_path(sb, type, format_id, &path);
-                path_put(&path);
-        }
-        return error;
-}
 EXPORT_SYMBOL(dquot_quota_on);
 
 /*
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index b299961e1ed..b34bdb25490 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -64,18 +64,15 @@ static int quota_sync_all(int type)
 }
 
 static int quota_quotaon(struct super_block *sb, int type, int cmd, qid_t id,
-                         void __user *addr)
+                         struct path *path)
 {
-        char *pathname;
-        int ret = -ENOSYS;
-
-        pathname = getname(addr);
-        if (IS_ERR(pathname))
-                return PTR_ERR(pathname);
-        if (sb->s_qcop->quota_on)
-                ret = sb->s_qcop->quota_on(sb, type, id, pathname);
-        putname(pathname);
-        return ret;
+        if (!sb->s_qcop->quota_on && !sb->s_qcop->quota_on_meta)
+                return -ENOSYS;
+        if (sb->s_qcop->quota_on_meta)
+                return sb->s_qcop->quota_on_meta(sb, type, id);
+        if (IS_ERR(path))
+                return PTR_ERR(path);
+        return sb->s_qcop->quota_on(sb, type, id, path);
 }
 
 static int quota_getfmt(struct super_block *sb, int type, void __user *addr)
@@ -241,7 +238,7 @@ static int quota_getxquota(struct super_block *sb, int type, qid_t id,
 
 /* Copy parameters and call proper function */
 static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
-                       void __user *addr)
+                       void __user *addr, struct path *path)
 {
         int ret;
 
@@ -256,7 +253,7 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
 
         switch (cmd) {
         case Q_QUOTAON:
-                return quota_quotaon(sb, type, cmd, id, addr);
+                return quota_quotaon(sb, type, cmd, id, path);
         case Q_QUOTAOFF:
                 if (!sb->s_qcop->quota_off)
                         return -ENOSYS;
@@ -335,6 +332,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
 {
         uint cmds, type;
         struct super_block *sb = NULL;
+        struct path path, *pathp = NULL;
         int ret;
 
         cmds = cmd >> SUBCMDSHIFT;
@@ -351,12 +349,27 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
                 return -ENODEV;
         }
 
+        /*
+         * Path for quotaon has to be resolved before grabbing superblock
+         * because that gets s_umount sem which is also possibly needed by path
+         * resolution (think about autofs) and thus deadlocks could arise.
+         */
+        if (cmds == Q_QUOTAON) {
+                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW, &path);
+                if (ret)
+                        pathp = ERR_PTR(ret);
+                else
+                        pathp = &path;
+        }
+
         sb = quotactl_block(special);
         if (IS_ERR(sb))
                 return PTR_ERR(sb);
 
-        ret = do_quotactl(sb, type, cmds, id, addr);
+        ret = do_quotactl(sb, type, cmds, id, addr, pathp);
 
         drop_super(sb);
+        if (pathp && !IS_ERR(pathp))
+                path_put(pathp);
         return ret;
 }
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 2575682a9ea..0aab04f4682 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -632,7 +632,7 @@ static int reiserfs_acquire_dquot(struct dquot *);
 static int reiserfs_release_dquot(struct dquot *);
 static int reiserfs_mark_dquot_dirty(struct dquot *);
 static int reiserfs_write_info(struct super_block *, int);
-static int reiserfs_quota_on(struct super_block *, int, int, char *);
+static int reiserfs_quota_on(struct super_block *, int, int, struct path *);
 
 static const struct dquot_operations reiserfs_quota_operations = {
         .write_dquot = reiserfs_write_dquot,
@@ -2048,25 +2048,21 @@ static int reiserfs_quota_on_mount(struct super_block *sb, int type)
  * Standard function to be called on quota_on
  */
 static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
-                             char *name)
+                             struct path *path)
 {
         int err;
-        struct path path;
         struct inode *inode;
         struct reiserfs_transaction_handle th;
 
         if (!(REISERFS_SB(sb)->s_mount_opt & (1 << REISERFS_QUOTA)))
                 return -EINVAL;
 
-        err = kern_path(name, LOOKUP_FOLLOW, &path);
-        if (err)
-                return err;
         /* Quotafile not on the same filesystem? */
-        if (path.mnt->mnt_sb != sb) {
+        if (path->mnt->mnt_sb != sb) {
                 err = -EXDEV;
                 goto out;
         }
-        inode = path.dentry->d_inode;
+        inode = path->dentry->d_inode;
         /* We must not pack tails for quota files on reiserfs for quota IO to work */
         if (!(REISERFS_I(inode)->i_flags & i_nopack_mask)) {
                 err = reiserfs_unpack(inode, NULL);
@@ -2082,7 +2078,7 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
         /* Journaling quota? */
         if (REISERFS_SB(sb)->s_qf_names[type]) {
                 /* Quotafile not of fs root? */
-                if (path.dentry->d_parent != sb->s_root)
+                if (path->dentry->d_parent != sb->s_root)
                         reiserfs_warning(sb, "super-6521",
                                  "Quota file not on filesystem root. "
                                  "Journalled quota will not work.");
@@ -2101,9 +2097,8 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
                 if (err)
                         goto out;
         }
-        err = dquot_quota_on_path(sb, type, format_id, &path);
+        err = dquot_quota_on(sb, type, format_id, path);
 out:
-        path_put(&path);
         return err;
 }
 
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 2fb2882f0fa..8ab48bc2fa7 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -63,6 +63,14 @@ static struct buffer_head *get_block_length(struct super_block *sb,
                 *length = (unsigned char) bh->b_data[*offset] |
                         (unsigned char) bh->b_data[*offset + 1] << 8;
                 *offset += 2;
+
+                if (*offset == msblk->devblksize) {
+                        put_bh(bh);
+                        bh = sb_bread(sb, ++(*cur_index));
+                        if (bh == NULL)
+                                return NULL;
+                        *offset = 0;
+                }
         }
 
         return bh;
diff --git a/fs/squashfs/xz_wrapper.c b/fs/squashfs/xz_wrapper.c
index 856756ca5ee..c4eb4001825 100644
--- a/fs/squashfs/xz_wrapper.c
+++ b/fs/squashfs/xz_wrapper.c
@@ -95,12 +95,6 @@ static int squashfs_xz_uncompress(struct squashfs_sb_info *msblk, void **buffer,
                         if (!buffer_uptodate(bh[k]))
                                 goto release_mutex;
 
-                        if (avail == 0) {
-                                offset = 0;
-                                put_bh(bh[k++]);
-                                continue;
-                        }
-
                         stream->buf.in = bh[k]->b_data + offset;
                         stream->buf.in_size = avail;
                         stream->buf.in_pos = 0;
diff --git a/fs/squashfs/zlib_wrapper.c b/fs/squashfs/zlib_wrapper.c
index 818a5e063fa..4661ae2b1ce 100644
--- a/fs/squashfs/zlib_wrapper.c
+++ b/fs/squashfs/zlib_wrapper.c
@@ -82,12 +82,6 @@ static int zlib_uncompress(struct squashfs_sb_info *msblk, void **buffer,
                         if (!buffer_uptodate(bh[k]))
                                 goto release_mutex;
 
-                        if (avail == 0) {
-                                offset = 0;
-                                put_bh(bh[k++]);
-                                continue;
-                        }
-
                         stream->next_in = bh[k]->b_data + offset;
                         stream->avail_in = avail;
                         offset = 0;
diff --git a/fs/sysfs/Kconfig b/fs/sysfs/Kconfig
index f4b67588b9d..8c41feacbac 100644
--- a/fs/sysfs/Kconfig
+++ b/fs/sysfs/Kconfig
@@ -1,5 +1,5 @@
 config SYSFS
-        bool "sysfs file system support" if EMBEDDED
+        bool "sysfs file system support" if EXPERT
         default y
         help
         The sysfs filesystem is a virtual filesystem that the kernel uses to
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index b06ede1d0be..f5e2a19e0f8 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -985,10 +985,22 @@ xfs_ioctl_setattr(
 
                 /*
                  * Extent size must be a multiple of the appropriate block
-                 * size, if set at all.
+                 * size, if set at all. It must also be smaller than the
+                 * maximum extent size supported by the filesystem.
+                 *
+                 * Also, for non-realtime files, limit the extent size hint to
+                 * half the size of the AGs in the filesystem so alignment
+                 * doesn't result in extents larger than an AG.
                  */
                 if (fa->fsx_extsize != 0) {
-                        xfs_extlen_t    size;
+                        xfs_extlen_t    size;
+                        xfs_fsblock_t   extsize_fsb;
+
+                        extsize_fsb = XFS_B_TO_FSB(mp, fa->fsx_extsize);
+                        if (extsize_fsb > MAXEXTLEN) {
+                                code = XFS_ERROR(EINVAL);
+                                goto error_return;
+                        }
 
                         if (XFS_IS_REALTIME_INODE(ip) ||
                             ((mask & FSX_XFLAGS) &&
@@ -997,6 +1009,10 @@ xfs_ioctl_setattr(
                                        mp->m_sb.sb_blocklog;
                         } else {
                                 size = mp->m_sb.sb_blocksize;
+                                if (extsize_fsb > mp->m_sb.sb_agblocks / 2) {
+                                        code = XFS_ERROR(EINVAL);
+                                        goto error_return;
+                                }
                         }
 
                         if (fa->fsx_extsize % size) {
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index f8e854b4fde..206a2815ced 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1863,12 +1863,14 @@ xfs_qm_dqreclaim_one(void)
         xfs_dquot_t     *dqpout;
         xfs_dquot_t     *dqp;
         int             restarts;
+        int             startagain;
 
         restarts = 0;
         dqpout = NULL;
 
         /* lockorder: hashchainlock, freelistlock, mplistlock, dqlock, dqflock */
-startagain:
+again:
+        startagain = 0;
         mutex_lock(&xfs_Gqm->qm_dqfrlist_lock);
 
         list_for_each_entry(dqp, &xfs_Gqm->qm_dqfrlist, q_freelist) {
@@ -1885,13 +1887,10 @@ startagain:
                         ASSERT(! (dqp->dq_flags & XFS_DQ_INACTIVE));
 
                         trace_xfs_dqreclaim_want(dqp);
-
-                        xfs_dqunlock(dqp);
-                        mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
-                        if (++restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
-                                return NULL;
                         XQM_STATS_INC(xqmstats.xs_qm_dqwants);
-                        goto startagain;
+                        restarts++;
+                        startagain = 1;
+                        goto dqunlock;
                 }
 
                 /*
@@ -1906,23 +1905,20 @@ startagain:
                         ASSERT(list_empty(&dqp->q_mplist));
                         list_del_init(&dqp->q_freelist);
                         xfs_Gqm->qm_dqfrlist_cnt--;
-                        xfs_dqunlock(dqp);
                         dqpout = dqp;
                         XQM_STATS_INC(xqmstats.xs_qm_dqinact_reclaims);
-                        break;
+                        goto dqunlock;
                 }
 
                 ASSERT(dqp->q_hash);
                 ASSERT(!list_empty(&dqp->q_mplist));
 
                 /*
-                 * Try to grab the flush lock. If this dquot is in the process of
-                 * getting flushed to disk, we don't want to reclaim it.
+                 * Try to grab the flush lock. If this dquot is in the process
+                 * of getting flushed to disk, we don't want to reclaim it.
                  */
-                if (!xfs_dqflock_nowait(dqp)) {
-                        xfs_dqunlock(dqp);
-                        continue;
-                }
+                if (!xfs_dqflock_nowait(dqp))
+                        goto dqunlock;
 
                 /*
                  * We have the flush lock so we know that this is not in the
@@ -1944,8 +1940,7 @@ startagain:
                                 xfs_fs_cmn_err(CE_WARN, mp,
                         "xfs_qm_dqreclaim: dquot %p flush failed", dqp);
                         }
-                        xfs_dqunlock(dqp); /* dqflush unlocks dqflock */
-                        continue;
+                        goto dqunlock;
                 }
 
                 /*
@@ -1967,13 +1962,8 @@ startagain:
                  */
                 if (!mutex_trylock(&mp->m_quotainfo->qi_dqlist_lock)) {
                         restarts++;
-                        mutex_unlock(&dqp->q_hash->qh_lock);
-                        xfs_dqfunlock(dqp);
-                        xfs_dqunlock(dqp);
-                        mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
-                        if (restarts++ >= XFS_QM_RECLAIM_MAX_RESTARTS)
-                                return NULL;
-                        goto startagain;
+                        startagain = 1;
+                        goto qhunlock;
                 }
 
                 ASSERT(dqp->q_nrefs == 0);
@@ -1986,14 +1976,20 @@ startagain:
                 xfs_Gqm->qm_dqfrlist_cnt--;
                 dqpout = dqp;
                 mutex_unlock(&mp->m_quotainfo->qi_dqlist_lock);
+qhunlock:
                 mutex_unlock(&dqp->q_hash->qh_lock);
 dqfunlock:
                 xfs_dqfunlock(dqp);
+dqunlock:
                 xfs_dqunlock(dqp);
                 if (dqpout)
                         break;
                 if (restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
-                        return NULL;
+                        break;
+                if (startagain) {
+                        mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+                        goto again;
+                }
         }
         mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
         return dqpout;
diff --git a/fs/xfs/xfs_alloc.h b/fs/xfs/xfs_alloc.h
index 0ab56b32c7e..d0b3bc72005 100644
--- a/fs/xfs/xfs_alloc.h
+++ b/fs/xfs/xfs_alloc.h
@@ -75,6 +75,22 @@ typedef unsigned int xfs_alloctype_t;
 #define XFS_ALLOC_SET_ASIDE(mp)  (4 + ((mp)->m_sb.sb_agcount * 4))
 
 /*
+ * When deciding how much space to allocate out of an AG, we limit the
+ * allocation maximum size to the size the AG. However, we cannot use all the
+ * blocks in the AG - some are permanently used by metadata. These
+ * blocks are generally:
+ *      - the AG superblock, AGF, AGI and AGFL
+ *      - the AGF (bno and cnt) and AGI btree root blocks
+ *      - 4 blocks on the AGFL according to XFS_ALLOC_SET_ASIDE() limits
+ *
+ * The AG headers are sector sized, so the amount of space they take up is
+ * dependent on filesystem geometry. The others are all single blocks.
+ */
+#define XFS_ALLOC_AG_MAX_USABLE(mp)     \
+        ((mp)->m_sb.sb_agblocks - XFS_BB_TO_FSB(mp, XFS_FSS_TO_BB(mp, 4)) - 7)
+
+
+/*
  * Argument structure for xfs_alloc routines.
  * This is turned into a structure to avoid having 20 arguments passed
  * down several levels of the stack.
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 4111cd3966c..dc3afd7739f 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -1038,17 +1038,34 @@ xfs_bmap_add_extent_delay_real(
                  * Filling in the middle part of a previous delayed allocation.
                  * Contiguity is impossible here.
                  * This case is avoided almost all the time.
+                 *
+                 * We start with a delayed allocation:
+                 *
+                 * +ddddddddddddddddddddddddddddddddddddddddddddddddddddddd+
+                 *  PREV @ idx
+                 *
+                 * and we are allocating:
+                 *                     +rrrrrrrrrrrrrrrrr+
+                 *                            new
+                 *
+                 * and we set it up for insertion as:
+                 * +ddddddddddddddddddd+rrrrrrrrrrrrrrrrr+ddddddddddddddddd+
+                 *                            new
+                 *  PREV @ idx          LEFT              RIGHT
+                 *                      inserted at idx + 1
                  */
                 temp = new->br_startoff - PREV.br_startoff;
-                trace_xfs_bmap_pre_update(ip, idx, 0, _THIS_IP_);
-                xfs_bmbt_set_blockcount(ep, temp);
-                r[0] = *new;
-                r[1].br_state = PREV.br_state;
-                r[1].br_startblock = 0;
-                r[1].br_startoff = new_endoff;
                 temp2 = PREV.br_startoff + PREV.br_blockcount - new_endoff;
-                r[1].br_blockcount = temp2;
-                xfs_iext_insert(ip, idx + 1, 2, &r[0], state);
+                trace_xfs_bmap_pre_update(ip, idx, 0, _THIS_IP_);
+                xfs_bmbt_set_blockcount(ep, temp);      /* truncate PREV */
+                LEFT = *new;
+                RIGHT.br_state = PREV.br_state;
+                RIGHT.br_startblock = nullstartblock(
+                                (int)xfs_bmap_worst_indlen(ip, temp2));
+                RIGHT.br_startoff = new_endoff;
+                RIGHT.br_blockcount = temp2;
+                /* insert LEFT (r[0]) and RIGHT (r[1]) at the same time */
+                xfs_iext_insert(ip, idx + 1, 2, &LEFT, state);
                 ip->i_df.if_lastex = idx + 1;
                 ip->i_d.di_nextents++;
                 if (cur == NULL)
@@ -2430,7 +2447,7 @@ xfs_bmap_btalloc_nullfb(
                 startag = ag = 0;
 
         pag = xfs_perag_get(mp, ag);
-        while (*blen < ap->alen) {
+        while (*blen < args->maxlen) {
                 if (!pag->pagf_init) {
                         error = xfs_alloc_pagf_init(mp, args->tp, ag,
                                                     XFS_ALLOC_FLAG_TRYLOCK);
@@ -2452,7 +2469,7 @@ xfs_bmap_btalloc_nullfb(
                         notinit = 1;
 
                 if (xfs_inode_is_filestream(ap->ip)) {
-                        if (*blen >= ap->alen)
+                        if (*blen >= args->maxlen)
                                 break;
 
                         if (ap->userdata) {
@@ -2498,14 +2515,14 @@ xfs_bmap_btalloc_nullfb(
          * If the best seen length is less than the request
          * length, use the best as the minimum.
          */
-        else if (*blen < ap->alen)
+        else if (*blen < args->maxlen)
                 args->minlen = *blen;
         /*
-         * Otherwise we've seen an extent as big as alen,
+         * Otherwise we've seen an extent as big as maxlen,
          * use that as the minimum.
          */
         else
-                args->minlen = ap->alen;
+                args->minlen = args->maxlen;
 
         /*
          * set the failure fallback case to look in the selected
@@ -2573,7 +2590,9 @@ xfs_bmap_btalloc(
         args.tp = ap->tp;
         args.mp = mp;
         args.fsbno = ap->rval;
-        args.maxlen = MIN(ap->alen, mp->m_sb.sb_agblocks);
+
+        /* Trim the allocation back to the maximum an AG can fit. */
+        args.maxlen = MIN(ap->alen, XFS_ALLOC_AG_MAX_USABLE(mp));
         args.firstblock = ap->firstblock;
         blen = 0;
         if (nullfb) {
@@ -2621,7 +2640,7 @@ xfs_bmap_btalloc(
                         /*
                          * Adjust for alignment
                          */
-                        if (blen > args.alignment && blen <= ap->alen)
+                        if (blen > args.alignment && blen <= args.maxlen)
                                 args.minlen = blen - args.alignment;
                         args.minalignslop = 0;
                 } else {
@@ -2640,7 +2659,7 @@ xfs_bmap_btalloc(
                          * of minlen+alignment+slop doesn't go up
                          * between the calls.
                          */
-                        if (blen > mp->m_dalign && blen <= ap->alen)
+                        if (blen > mp->m_dalign && blen <= args.maxlen)
                                 nextminlen = blen - mp->m_dalign;
                         else
                                 nextminlen = args.minlen;
@@ -4485,6 +4504,16 @@ xfs_bmapi(
                                 /* Figure out the extent size, adjust alen */
                                 extsz = xfs_get_extsz_hint(ip);
                                 if (extsz) {
+                                        /*
+                                         * make sure we don't exceed a single
+                                         * extent length when we align the
+                                         * extent by reducing length we are
+                                         * going to allocate by the maximum
+                                         * amount extent size aligment may
+                                         * require.
+                                         */
+                                        alen = XFS_FILBLKS_MIN(len,
+                                                   MAXEXTLEN - (2 * extsz - 1));
                                         error = xfs_bmap_extsize_align(mp,
                                                         &got, &prev, extsz,
                                                         rt, eof,
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 98c6f73b675..6f8c21ce0d6 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -427,13 +427,15 @@ xfs_buf_item_unpin(
 
                 if (remove) {
                         /*
-                         * We have to remove the log item from the transaction
-                         * as we are about to release our reference to the
-                         * buffer.  If we don't, the unlock that occurs later
-                         * in xfs_trans_uncommit() will ry to reference the
+                         * If we are in a transaction context, we have to
+                         * remove the log item from the transaction as we are
+                         * about to release our reference to the buffer.  If we
+                         * don't, the unlock that occurs later in
+                         * xfs_trans_uncommit() will try to reference the
                          * buffer which we no longer have a hold on.
                          */
-                        xfs_trans_del_item(lip);
+                        if (lip->li_desc)
+                                xfs_trans_del_item(lip);
 
                         /*
                          * Since the transaction no longer refers to the buffer,
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 75f2ef60e57..d22e6262343 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -138,7 +138,8 @@ xfs_efi_item_unpin(
 
         if (remove) {
                 ASSERT(!(lip->li_flags & XFS_LI_IN_AIL));
-                xfs_trans_del_item(lip);
+                if (lip->li_desc)
+                        xfs_trans_del_item(lip);
                 xfs_efi_item_free(efip);
                 return;
         }
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 55582bd6665..8a0f044750c 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -337,7 +337,12 @@ xfs_iomap_prealloc_size(
                 int shift = 0;
                 int64_t freesp;
 
-                alloc_blocks = XFS_B_TO_FSB(mp, ip->i_size);
+                /*
+                 * rounddown_pow_of_two() returns an undefined result
+                 * if we pass in alloc_blocks = 0. Hence the "+ 1" to
+                 * ensure we always pass in a non-zero value.
+                 */
+                alloc_blocks = XFS_B_TO_FSB(mp, ip->i_size) + 1;
                 alloc_blocks = XFS_FILEOFF_MIN(MAXEXTLEN,
                                         rounddown_pow_of_two(alloc_blocks));
 
diff --git a/fs/xfs/xfs_log.h b/fs/xfs/xfs_log.h
index 916eb7db14d..3bd3291ef8d 100644
--- a/fs/xfs/xfs_log.h
+++ b/fs/xfs/xfs_log.h
@@ -191,7 +191,7 @@ void	  xfs_log_ticket_put(struct xlog_ticket *ticket);
 
 xlog_tid_t xfs_log_get_trans_ident(struct xfs_trans *tp);
 
-int     xfs_log_commit_cil(struct xfs_mount *mp, struct xfs_trans *tp,
+void    xfs_log_commit_cil(struct xfs_mount *mp, struct xfs_trans *tp,
                                 struct xfs_log_vec *log_vector,
                                 xfs_lsn_t *commit_lsn, int flags);
 bool    xfs_log_item_in_current_chkpt(struct xfs_log_item *lip);
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index 9dc8125d04e..9ca59be0897 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -543,7 +543,7 @@ xlog_cil_push(
 
         error = xlog_write(log, &lvhdr, tic, &ctx->start_lsn, NULL, 0);
         if (error)
-                goto out_abort;
+                goto out_abort_free_ticket;
 
         /*
          * now that we've written the checkpoint into the log, strictly
@@ -569,8 +569,9 @@ restart:
         }
         spin_unlock(&cil->xc_cil_lock);
 
+        /* xfs_log_done always frees the ticket on error. */
         commit_lsn = xfs_log_done(log->l_mp, tic, &commit_iclog, 0);
-        if (error || commit_lsn == -1)
+        if (commit_lsn == -1)
                 goto out_abort;
 
         /* attach all the transactions w/ busy extents to iclog */
@@ -600,6 +601,8 @@ out_free_ticket:
         kmem_free(new_ctx);
         return 0;
 
+out_abort_free_ticket:
+        xfs_log_ticket_put(tic);
 out_abort:
         xlog_cil_committed(ctx, XFS_LI_ABORTED);
         return XFS_ERROR(EIO);
@@ -622,7 +625,7 @@ out_abort:
  * background commit, returns without it held once background commits are
  * allowed again.
  */
-int
+void
 xfs_log_commit_cil(
         struct xfs_mount        *mp,
         struct xfs_trans        *tp,
@@ -637,11 +640,6 @@ xfs_log_commit_cil(
         if (flags & XFS_TRANS_RELEASE_LOG_RES)
                 log_flags = XFS_LOG_REL_PERM_RESERV;
 
-        if (XLOG_FORCED_SHUTDOWN(log)) {
-                xlog_cil_free_logvec(log_vector);
-                return XFS_ERROR(EIO);
-        }
-
         /*
          * do all the hard work of formatting items (including memory
          * allocation) outside the CIL context lock. This prevents stalling CIL
@@ -701,7 +699,6 @@ xfs_log_commit_cil(
          */
         if (push)
                 xlog_cil_push(log, 0);
-        return 0;
 }
 
 /*
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 33dbc4e0ad6..76922793f64 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -1446,6 +1446,14 @@ xfs_log_item_batch_insert(
  * Bulk operation version of xfs_trans_committed that takes a log vector of
  * items to insert into the AIL. This uses bulk AIL insertion techniques to
  * minimise lock traffic.
+ *
+ * If we are called with the aborted flag set, it is because a log write during
+ * a CIL checkpoint commit has failed. In this case, all the items in the
+ * checkpoint have already gone through IOP_COMMITED and IOP_UNLOCK, which
+ * means that checkpoint commit abort handling is treated exactly the same
+ * as an iclog write error even though we haven't started any IO yet. Hence in
+ * this case all we need to do is IOP_COMMITTED processing, followed by an
+ * IOP_UNPIN(aborted) call.
  */
 void
 xfs_trans_committed_bulk(
@@ -1472,6 +1480,16 @@ xfs_trans_committed_bulk(
                 if (XFS_LSN_CMP(item_lsn, (xfs_lsn_t)-1) == 0)
                         continue;
 
+                /*
+                 * if we are aborting the operation, no point in inserting the
+                 * object into the AIL as we are in a shutdown situation.
+                 */
+                if (aborted) {
+                        ASSERT(XFS_FORCED_SHUTDOWN(ailp->xa_mount));
+                        IOP_UNPIN(lip, 1);
+                        continue;
+                }
+
                 if (item_lsn != commit_lsn) {
 
                         /*
@@ -1503,20 +1521,24 @@ xfs_trans_committed_bulk(
 }
 
 /*
- * Called from the trans_commit code when we notice that
- * the filesystem is in the middle of a forced shutdown.
+ * Called from the trans_commit code when we notice that the filesystem is in
+ * the middle of a forced shutdown.
+ *
+ * When we are called here, we have already pinned all the items in the
+ * transaction. However, neither IOP_COMMITTING or IOP_UNLOCK has been called
+ * so we can simply walk the items in the transaction, unpin them with an abort
+ * flag and then free the items. Note that unpinning the items can result in
+ * them being freed immediately, so we need to use a safe list traversal method
+ * here.
  */
 STATIC void
 xfs_trans_uncommit(
         struct xfs_trans        *tp,
         uint                    flags)
 {
-        struct xfs_log_item_desc *lidp;
+        struct xfs_log_item_desc *lidp, *n;
 
-        list_for_each_entry(lidp, &tp->t_items, lid_trans) {
-                /*
-                 * Unpin all but those that aren't dirty.
-                 */
+        list_for_each_entry_safe(lidp, n, &tp->t_items, lid_trans) {
                 if (lidp->lid_flags & XFS_LID_DIRTY)
                         IOP_UNPIN(lidp->lid_item, 1);
         }
@@ -1733,7 +1755,6 @@ xfs_trans_commit_cil(
         int                     flags)
 {
         struct xfs_log_vec      *log_vector;
-        int                     error;
 
         /*
          * Get each log item to allocate a vector structure for
@@ -1744,9 +1765,7 @@ xfs_trans_commit_cil(
         if (!log_vector)
                 return ENOMEM;
 
-        error = xfs_log_commit_cil(mp, tp, log_vector, commit_lsn, flags);
-        if (error)
-                return error;
+        xfs_log_commit_cil(mp, tp, log_vector, commit_lsn, flags);
 
         current_restore_flags_nested(&tp->t_pflags, PF_FSTRANS);
         xfs_trans_free(tp);
diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h
index 17714beb868..5b6c391efc8 100644
--- a/include/acpi/acexcep.h
+++ b/include/acpi/acexcep.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/acnames.h b/include/acpi/acnames.h
index 9cf736ea469..fc1575fd459 100644
--- a/include/acpi/acnames.h
+++ b/include/acpi/acnames.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/acoutput.h b/include/acpi/acoutput.h
index bc4a6deb73b..ef1cef77d32 100644
--- a/include/acpi/acoutput.h
+++ b/include/acpi/acoutput.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/acpi.h b/include/acpi/acpi.h
index a091cabca4b..de39915f6b7 100644
--- a/include/acpi/acpi.h
+++ b/include/acpi/acpi.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h
index 65b3f5888f4..a3252a5ead6 100644
--- a/include/acpi/acpiosxf.h
+++ b/include/acpi/acpiosxf.h
@@ -8,7 +8,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index 241b8a04c83..e46ec95a8ad 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -6,7 +6,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -47,7 +47,7 @@
 
 /* Current ACPICA subsystem version in YYYYMMDD format */
 
-#define ACPI_CA_VERSION                 0x20101209
+#define ACPI_CA_VERSION                 0x20110112
 
 #include "actypes.h"
 #include "actbl.h"
diff --git a/include/acpi/acrestyp.h b/include/acpi/acrestyp.h
index e5526354ba5..0a66cc45dd6 100644
--- a/include/acpi/acrestyp.h
+++ b/include/acpi/acrestyp.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
index ad2001683ba..7e42bfee0e2 100644
--- a/include/acpi/actbl.h
+++ b/include/acpi/actbl.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/actbl1.h b/include/acpi/actbl1.h
index cd77aa75c96..7504bc99b29 100644
--- a/include/acpi/actbl1.h
+++ b/include/acpi/actbl1.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/actbl2.h b/include/acpi/actbl2.h
index d4136b28011..0fc15dfb2e2 100644
--- a/include/acpi/actbl2.h
+++ b/include/acpi/actbl2.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index 939a431a6ab..64f838beaab 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
index a3e334ab111..5af3ed52ef9 100644
--- a/include/acpi/platform/acenv.h
+++ b/include/acpi/platform/acenv.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/platform/acgcc.h b/include/acpi/platform/acgcc.h
index 5dcb9537343..e228893591a 100644
--- a/include/acpi/platform/acgcc.h
+++ b/include/acpi/platform/acgcc.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
index 572189e3713..5d2a5e9544d 100644
--- a/include/acpi/platform/aclinux.h
+++ b/include/acpi/platform/aclinux.h
@@ -5,7 +5,7 @@
  *****************************************************************************/
 
 /*
- * Copyright (C) 2000 - 2010, Intel Corp.
+ * Copyright (C) 2000 - 2011, Intel Corp.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 68649336c4a..fe77e3395b4 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -124,7 +124,8 @@
 #endif
 
 #ifdef CONFIG_EVENT_TRACING
-#define FTRACE_EVENTS() VMLINUX_SYMBOL(__start_ftrace_events) = .;      \
+#define FTRACE_EVENTS() . = ALIGN(8);                                   \
+                        VMLINUX_SYMBOL(__start_ftrace_events) = .;      \
                         *(_ftrace_events)                               \
                         VMLINUX_SYMBOL(__stop_ftrace_events) = .;
 #else
@@ -140,7 +141,8 @@
 #endif
 
 #ifdef CONFIG_FTRACE_SYSCALLS
-#define TRACE_SYSCALLS() VMLINUX_SYMBOL(__start_syscalls_metadata) = .; \
+#define TRACE_SYSCALLS() . = ALIGN(8);                                  \
+                         VMLINUX_SYMBOL(__start_syscalls_metadata) = .; \
                          *(__syscalls_metadata)                         \
                          VMLINUX_SYMBOL(__stop_syscalls_metadata) = .;
 #else
@@ -165,10 +167,8 @@
         CPU_KEEP(exit.data)                                             \
         MEM_KEEP(init.data)                                             \
         MEM_KEEP(exit.data)                                             \
-        . = ALIGN(32);                                                  \
-        VMLINUX_SYMBOL(__start___tracepoints) = .;                      \
+        STRUCT_ALIGN();                                                 \
         *(__tracepoints)                                                \
-        VMLINUX_SYMBOL(__stop___tracepoints) = .;                       \
         /* implement dynamic printk debug */                            \
         . = ALIGN(8);                                                   \
         VMLINUX_SYMBOL(__start___verbose) = .;                          \
@@ -176,13 +176,7 @@
         VMLINUX_SYMBOL(__stop___verbose) = .;                           \
         LIKELY_PROFILE()                                                \
         BRANCH_PROFILE()                                                \
-        TRACE_PRINTKS()                                                 \
-                                                                        \
-        STRUCT_ALIGN();                                                 \
-        FTRACE_EVENTS()                                                 \
-                                                                        \
-        STRUCT_ALIGN();                                                 \
-        TRACE_SYSCALLS()
+        TRACE_PRINTKS()
 
 /*
  * Data section helpers
@@ -220,6 +214,10 @@
                 VMLINUX_SYMBOL(__start_rodata) = .;                     \
                 *(.rodata) *(.rodata.*)                                 \
                 *(__vermagic)           /* Kernel version magic */      \
+                . = ALIGN(8);                                           \
+                VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .;         \
+                *(__tracepoints_ptrs)   /* Tracepoints: pointer array */\
+                VMLINUX_SYMBOL(__stop___tracepoints_ptrs) = .;          \
                 *(__markers_strings)    /* Markers: strings */          \
                 *(__tracepoints_strings)/* Tracepoints: strings */      \
         }                                                               \
@@ -364,6 +362,13 @@
                 VMLINUX_SYMBOL(__start___param) = .;                    \
                 *(__param)                                              \
                 VMLINUX_SYMBOL(__stop___param) = .;                     \
+        }                                                               \
+                                                                        \
+        /* Built-in module versions. */                                 \
+        __modver : AT(ADDR(__modver) - LOAD_OFFSET) {                   \
+                VMLINUX_SYMBOL(__start___modver) = .;                   \
+                *(__modver)                                             \
+                VMLINUX_SYMBOL(__stop___modver) = .;                    \
                 . = ALIGN((align));                                     \
                 VMLINUX_SYMBOL(__end_rodata) = .;                       \
         }                                                               \
@@ -475,6 +480,8 @@
         KERNEL_CTORS()                                                  \
         *(.init.rodata)                                                 \
         MCOUNT_REC()                                                    \
+        FTRACE_EVENTS()                                                 \
+        TRACE_SYSCALLS()                                                \
         DEV_DISCARD(init.rodata)                                        \
         CPU_DISCARD(init.rodata)                                        \
         MEM_DISCARD(init.rodata)                                        \
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index a4694c61033..fe29aadb129 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -1367,7 +1367,7 @@ extern int drm_vblank_wait(struct drm_device *dev, unsigned int *vbl_seq);
 extern u32 drm_vblank_count(struct drm_device *dev, int crtc);
 extern u32 drm_vblank_count_and_time(struct drm_device *dev, int crtc,
                                      struct timeval *vblanktime);
-extern void drm_handle_vblank(struct drm_device *dev, int crtc);
+extern bool drm_handle_vblank(struct drm_device *dev, int crtc);
 extern int drm_vblank_get(struct drm_device *dev, int crtc);
 extern void drm_vblank_put(struct drm_device *dev, int crtc);
 extern void drm_vblank_off(struct drm_device *dev, int crtc);
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index acd7fade160..801be59f4f1 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -275,6 +275,7 @@ struct drm_pending_vblank_event;
 
 /**
  * drm_crtc_funcs - control CRTCs for a given device
+ * @reset: reset CRTC after state has been invalidate (e.g. resume)
  * @dpms: control display power levels
  * @save: save CRTC state
  * @resore: restore CRTC state
@@ -302,6 +303,8 @@ struct drm_crtc_funcs {
         void (*save)(struct drm_crtc *crtc); /* suspend? */
         /* Restore CRTC state */
         void (*restore)(struct drm_crtc *crtc); /* resume? */
+        /* Reset CRTC state */
+        void (*reset)(struct drm_crtc *crtc);
 
         /* cursor controls */
         int (*cursor_set)(struct drm_crtc *crtc, struct drm_file *file_priv,
@@ -379,6 +382,7 @@ struct drm_crtc {
  * @dpms: set power state (see drm_crtc_funcs above)
  * @save: save connector state
  * @restore: restore connector state
+ * @reset: reset connector after state has been invalidate (e.g. resume)
  * @mode_valid: is this mode valid on the given connector?
  * @mode_fixup: try to fixup proposed mode for this connector
  * @mode_set: set this mode
@@ -396,6 +400,7 @@ struct drm_connector_funcs {
         void (*dpms)(struct drm_connector *connector, int mode);
         void (*save)(struct drm_connector *connector);
         void (*restore)(struct drm_connector *connector);
+        void (*reset)(struct drm_connector *connector);
 
         /* Check to see if anything is attached to the connector.
          * @force is set to false whilst polling, true when checking the
@@ -413,6 +418,7 @@ struct drm_connector_funcs {
 };
 
 struct drm_encoder_funcs {
+        void (*reset)(struct drm_encoder *encoder);
         void (*destroy)(struct drm_encoder *encoder);
 };
 
@@ -656,6 +662,7 @@ extern struct drm_display_mode *drm_mode_duplicate(struct drm_device *dev,
                                                    struct drm_display_mode *mode);
 extern void drm_mode_debug_printmodeline(struct drm_display_mode *mode);
 extern void drm_mode_config_init(struct drm_device *dev);
+extern void drm_mode_config_reset(struct drm_device *dev);
 extern void drm_mode_config_cleanup(struct drm_device *dev);
 extern void drm_mode_set_name(struct drm_display_mode *mode);
 extern bool drm_mode_equal(struct drm_display_mode *mode1, struct drm_display_mode *mode2);
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index fe29ae328bd..5ff1194dc2e 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -28,7 +28,6 @@
         {0x1002, 0x4156, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x4237, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP}, \
         {0x1002, 0x4242, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x4243, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x4336, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4337, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4437, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index e95a86b8b68..e5c607a02d5 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -907,6 +907,7 @@ struct drm_radeon_cs {
 #define RADEON_INFO_TILING_CONFIG       0x06
 #define RADEON_INFO_WANT_HYPERZ         0x07
 #define RADEON_INFO_WANT_CMASK          0x08 /* get access to CMASK on r300 */
+#define RADEON_INFO_CLOCK_CRYSTAL_FREQ  0x09 /* clock crystal frequency */
 
 struct drm_radeon_info {
         uint32_t                request;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 2296d8b1931..b0ada6f37dd 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -1,5 +1,6 @@
 header-y += byteorder/
 header-y += can/
+header-y += caif/
 header-y += dvb/
 header-y += hdlc/
 header-y += isdn/
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index eb176bb1b15..a2e910e0129 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -306,9 +306,6 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle,
                                              u32 *mask, u32 req);
 extern void acpi_early_init(void);
 
-int acpi_os_map_generic_address(struct acpi_generic_address *addr);
-void acpi_os_unmap_generic_address(struct acpi_generic_address *addr);
-
 #else   /* !CONFIG_ACPI */
 
 #define acpi_disabled 1
diff --git a/include/linux/acpi_io.h b/include/linux/acpi_io.h
new file mode 100644
index 00000000000..7180013a4a3
--- /dev/null
+++ b/include/linux/acpi_io.h
@@ -0,0 +1,16 @@
+#ifndef _ACPI_IO_H_
+#define _ACPI_IO_H_
+
+#include <linux/io.h>
+#include <acpi/acpi.h>
+
+static inline void __iomem *acpi_os_ioremap(acpi_physical_address phys,
+                                            acpi_size size)
+{
+       return ioremap_cache(phys, size);
+}
+
+int acpi_os_map_generic_address(struct acpi_generic_address *addr);
+void acpi_os_unmap_generic_address(struct acpi_generic_address *addr);
+
+#endif
diff --git a/include/linux/caif/Kbuild b/include/linux/caif/Kbuild
new file mode 100644
index 00000000000..a9cf250689d
--- /dev/null
+++ b/include/linux/caif/Kbuild
@@ -0,0 +1,2 @@
+header-y += caif_socket.h
+header-y += if_caif.h
diff --git a/include/linux/console.h b/include/linux/console.h
index 9774fe6a1a9..7453cfd593c 100644
--- a/include/linux/console.h
+++ b/include/linux/console.h
@@ -139,9 +139,9 @@ extern int update_console_cmdline(char *name, int idx, char *name_new, int idx_n
 extern void register_console(struct console *);
 extern int unregister_console(struct console *);
 extern struct console *console_drivers;
-extern void acquire_console_sem(void);
-extern int try_acquire_console_sem(void);
-extern void release_console_sem(void);
+extern void console_lock(void);
+extern int console_trylock(void);
+extern void console_unlock(void);
 extern void console_conditional_schedule(void);
 extern void console_unblank(void);
 extern struct tty_driver *console_device(int *);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 32b38cd829d..bd3215940c3 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2555,9 +2555,12 @@ int proc_nr_inodes(struct ctl_table *table, int write,
                    void __user *buffer, size_t *lenp, loff_t *ppos);
 int __init get_filesystem_list(char *buf);
 
+#define __FMODE_EXEC            ((__force int) FMODE_EXEC)
+#define __FMODE_NONOTIFY        ((__force int) FMODE_NONOTIFY)
+
 #define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE])
 #define OPEN_FMODE(flag) ((__force fmode_t)(((flag + 1) & O_ACCMODE) | \
-                                            (flag & FMODE_NONOTIFY)))
+                                            (flag & __FMODE_NONOTIFY)))
 
 #endif /* __KERNEL__ */
 #endif /* _LINUX_FS_H */
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index a3b148a9187..0b84c61607e 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -249,7 +249,7 @@ static inline enum zone_type gfp_zone(gfp_t flags)
                                          ((1 << ZONES_SHIFT) - 1);
 
         if (__builtin_constant_p(bit))
-                MAYBE_BUILD_BUG_ON((GFP_ZONE_BAD >> bit) & 1);
+                BUILD_BUG_ON((GFP_ZONE_BAD >> bit) & 1);
         else {
 #ifdef CONFIG_DEBUG_VM
                 BUG_ON((GFP_ZONE_BAD >> bit) & 1);
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 6042228954a..294169e3136 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -959,7 +959,7 @@ struct ieee80211_ht_info {
 /* block-ack parameters */
 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
 
diff --git a/include/linux/input/bu21013.h b/include/linux/input/bu21013.h
index e470d387dd4..05e03284b92 100644
--- a/include/linux/input/bu21013.h
+++ b/include/linux/input/bu21013.h
@@ -12,8 +12,6 @@
  * @cs_en:      pointer to the cs enable function
  * @cs_dis:     pointer to the cs disable function
  * @irq_read_val:    pointer to read the pen irq value function
- * @x_max_res: xmax resolution
- * @y_max_res: ymax resolution
  * @touch_x_max: touch x max
  * @touch_y_max: touch y max
  * @cs_pin: chip select pin
@@ -29,8 +27,6 @@ struct bu21013_platform_device {
         int (*cs_en)(int reset_pin);
         int (*cs_dis)(int reset_pin);
         int (*irq_read_val)(void);
-        int x_max_res;
-        int y_max_res;
         int touch_x_max;
         int touch_y_max;
         unsigned int cs_pin;
diff --git a/include/linux/irq.h b/include/linux/irq.h
index abde2527c69..80fcb53057b 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -74,7 +74,8 @@ typedef	void (*irq_flow_handler_t)(unsigned int irq,
 
 #define IRQF_MODIFY_MASK        \
         (IRQ_TYPE_SENSE_MASK | IRQ_NOPROBE | IRQ_NOREQUEST | \
-         IRQ_NOAUTOEN | IRQ_MOVE_PCNTXT | IRQ_LEVEL)
+         IRQ_NOAUTOEN | IRQ_MOVE_PCNTXT | IRQ_LEVEL | IRQ_NO_BALANCING | \
+         IRQ_PER_CPU)
 
 #ifdef CONFIG_IRQ_PER_CPU
 # define CHECK_IRQ_PER_CPU(var) ((var) & IRQ_PER_CPU)
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 6a64c6fa81a..c1a95b7b58d 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -101,13 +101,6 @@ static inline struct irq_desc *move_irq_desc(struct irq_desc *desc, int node)
 #define get_irq_desc_msi(desc)          ((desc)->irq_data.msi_desc)
 
 /*
- * Monolithic do_IRQ implementation.
- */
-#ifndef CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ
-extern unsigned int __do_IRQ(unsigned int irq);
-#endif
-
-/*
  * Architectures call this to let the generic IRQ layer
  * handle an interrupt. If the descriptor is attached to an
  * irqchip-style controller then we call the ->handle_irq() handler,
@@ -115,14 +108,7 @@ extern unsigned int __do_IRQ(unsigned int irq);
  */
 static inline void generic_handle_irq_desc(unsigned int irq, struct irq_desc *desc)
 {
-#ifdef CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ
         desc->handle_irq(irq, desc);
-#else
-        if (likely(desc->handle_irq))
-                desc->handle_irq(irq, desc);
-        else
-                __do_IRQ(irq);
-#endif
 }
 
 static inline void generic_handle_irq(unsigned int irq)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 5a9d9059520..2fe6e84894a 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -243,6 +243,8 @@ extern int test_taint(unsigned flag);
 extern unsigned long get_taint(void);
 extern int root_mountflags;
 
+extern bool early_boot_irqs_disabled;
+
 /* Values used for system_state */
 extern enum system_states {
         SYSTEM_BOOTING,
@@ -573,12 +575,6 @@ struct sysinfo {
         char _f[20-2*sizeof(long)-sizeof(int)]; /* Padding: libc5 uses this.. */
 };
 
-/* Force a compilation error if condition is true */
-#define BUILD_BUG_ON(condition) ((void)BUILD_BUG_ON_ZERO(condition))
-
-/* Force a compilation error if condition is constant and true */
-#define MAYBE_BUILD_BUG_ON(cond) ((void)sizeof(char[1 - 2 * !!(cond)]))
-
 /* Force a compilation error if a constant expression is not a power of 2 */
 #define BUILD_BUG_ON_NOT_POWER_OF_2(n)                  \
         BUILD_BUG_ON((n) == 0 || (((n) & ((n) - 1)) != 0))
@@ -590,6 +586,32 @@ struct sysinfo {
 #define BUILD_BUG_ON_ZERO(e) (sizeof(struct { int:-!!(e); }))
 #define BUILD_BUG_ON_NULL(e) ((void *)sizeof(struct { int:-!!(e); }))
 
+/**
+ * BUILD_BUG_ON - break compile if a condition is true.
+ * @condition: the condition which the compiler should know is false.
+ *
+ * If you have some code which relies on certain constants being equal, or
+ * other compile-time-evaluated condition, you should use BUILD_BUG_ON to
+ * detect if someone changes it.
+ *
+ * The implementation uses gcc's reluctance to create a negative array, but
+ * gcc (as of 4.4) only emits that error for obvious cases (eg. not arguments
+ * to inline functions).  So as a fallback we use the optimizer; if it can't
+ * prove the condition is false, it will cause a link error on the undefined
+ * "__build_bug_on_failed".  This error message can be harder to track down
+ * though, hence the two different methods.
+ */
+#ifndef __OPTIMIZE__
+#define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
+#else
+extern int __build_bug_on_failed;
+#define BUILD_BUG_ON(condition)                                 \
+        do {                                                    \
+                ((void)sizeof(char[1 - 2*!!(condition)]));      \
+                if (condition) __build_bug_on_failed = 1;       \
+        } while(0)
+#endif
+
 /* Trap pasters of __FUNCTION__ at compile-time */
 #define __FUNCTION__ (__func__)
 
diff --git a/include/linux/kmemcheck.h b/include/linux/kmemcheck.h
index 08d7dc4ddf4..39f8453239f 100644
--- a/include/linux/kmemcheck.h
+++ b/include/linux/kmemcheck.h
@@ -76,7 +76,7 @@ bool kmemcheck_is_obj_initialized(unsigned long addr, size_t size);
                                                                         \
                 _n = (long) &((ptr)->name##_end)                        \
                         - (long) &((ptr)->name##_begin);                \
-                MAYBE_BUILD_BUG_ON(_n < 0);                             \
+                BUILD_BUG_ON(_n < 0);                                   \
                                                                         \
                 kmemcheck_mark_initialized(&((ptr)->name##_begin), _n); \
         } while (0)
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index 71c09b26c75..4aef1dda640 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -436,16 +436,8 @@ do {								\
 #endif /* CONFIG_LOCKDEP */
 
 #ifdef CONFIG_TRACE_IRQFLAGS
-extern void early_boot_irqs_off(void);
-extern void early_boot_irqs_on(void);
 extern void print_irqtrace_events(struct task_struct *curr);
 #else
-static inline void early_boot_irqs_off(void)
-{
-}
-static inline void early_boot_irqs_on(void)
-{
-}
 static inline void print_irqtrace_events(struct task_struct *curr)
 {
 }
@@ -522,12 +514,15 @@ static inline void print_irqtrace_events(struct task_struct *curr)
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 # ifdef CONFIG_PROVE_LOCKING
 #  define lock_map_acquire(l)           lock_acquire(l, 0, 0, 0, 2, NULL, _THIS_IP_)
+#  define lock_map_acquire_read(l)      lock_acquire(l, 0, 0, 2, 2, NULL, _THIS_IP_)
 # else
 #  define lock_map_acquire(l)           lock_acquire(l, 0, 0, 0, 1, NULL, _THIS_IP_)
+#  define lock_map_acquire_read(l)      lock_acquire(l, 0, 0, 2, 1, NULL, _THIS_IP_)
 # endif
 # define lock_map_release(l)                    lock_release(l, 1, _THIS_IP_)
 #else
 # define lock_map_acquire(l)                    do { } while (0)
+# define lock_map_acquire_read(l)               do { } while (0)
 # define lock_map_release(l)                    do { } while (0)
 #endif
 
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 6a576f98943..f512e189be5 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -146,6 +146,10 @@ unsigned long mem_cgroup_soft_limit_reclaim(struct zone *zone, int order,
                                                 gfp_t gfp_mask);
 u64 mem_cgroup_get_limit(struct mem_cgroup *mem);
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+void mem_cgroup_split_huge_fixup(struct page *head, struct page *tail);
+#endif
+
 #else /* CONFIG_CGROUP_MEM_RES_CTLR */
 struct mem_cgroup;
 
@@ -335,6 +339,11 @@ u64 mem_cgroup_get_limit(struct mem_cgroup *mem)
         return 0;
 }
 
+static inline void mem_cgroup_split_huge_fixup(struct page *head,
+                                                struct page *tail)
+{
+}
+
 #endif /* CONFIG_CGROUP_MEM_CONT */
 
 #endif /* _LINUX_MEMCONTROL_H */
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 956a35532f4..f6385fc17ad 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -470,6 +470,7 @@ static inline void set_compound_order(struct page *page, unsigned long order)
         page[1].lru.prev = (void *)order;
 }
 
+#ifdef CONFIG_MMU
 /*
  * Do pte_mkwrite, but only if the vma says VM_WRITE.  We do this when
  * servicing faults for write access.  In the normal case, do always want
@@ -482,6 +483,7 @@ static inline pte_t maybe_mkwrite(pte_t pte, struct vm_area_struct *vma)
                 pte = pte_mkwrite(pte);
         return pte;
 }
+#endif
 
 /*
  * Multiple processes may "see" the same page. E.g. for untouched
diff --git a/include/linux/mmc/sh_mmcif.h b/include/linux/mmc/sh_mmcif.h
index bf173502d74..38d39309281 100644
--- a/include/linux/mmc/sh_mmcif.h
+++ b/include/linux/mmc/sh_mmcif.h
@@ -94,12 +94,12 @@ struct sh_mmcif_plat_data {
 
 static inline u32 sh_mmcif_readl(void __iomem *addr, int reg)
 {
-        return readl(addr + reg);
+        return __raw_readl(addr + reg);
 }
 
 static inline void sh_mmcif_writel(void __iomem *addr, int reg, u32 val)
 {
-        writel(val, addr + reg);
+        __raw_writel(val, addr + reg);
 }
 
 #define SH_MMCIF_BBS 512 /* boot block size */
diff --git a/include/linux/module.h b/include/linux/module.h
index 8b17fd8c790..9bdf27c7615 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -58,6 +58,12 @@ struct module_attribute {
         void (*free)(struct module *);
 };
 
+struct module_version_attribute {
+        struct module_attribute mattr;
+        const char *module_name;
+        const char *version;
+};
+
 struct module_kobject
 {
         struct kobject kobj;
@@ -161,7 +167,28 @@ extern struct module __this_module;
   Using this automatically adds a checksum of the .c files and the
   local headers in "srcversion".
 */
+
+#if defined(MODULE) || !defined(CONFIG_SYSFS)
 #define MODULE_VERSION(_version) MODULE_INFO(version, _version)
+#else
+#define MODULE_VERSION(_version)                                        \
+        extern ssize_t __modver_version_show(struct module_attribute *, \
+                                             struct module *, char *);  \
+        static struct module_version_attribute __modver_version_attr    \
+        __used                                                          \
+    __attribute__ ((__section__ ("__modver"),aligned(sizeof(void *)))) \
+        = {                                                             \
+                .mattr  = {                                             \
+                        .attr   = {                                     \
+                                .name   = "version",                    \
+                                .mode   = S_IRUGO,                      \
+                        },                                              \
+                        .show   = __modver_version_show,                \
+                },                                                      \
+                .module_name    = KBUILD_MODNAME,                       \
+                .version        = _version,                             \
+        }
+#endif
 
 /* Optional firmware file (or files) needed by the module
  * format is simply firmware file name.  Multiple firmware
@@ -350,7 +377,7 @@ struct module
            keeping pointers to this stuff */
         char *args;
 #ifdef CONFIG_TRACEPOINTS
-        struct tracepoint *tracepoints;
+        struct tracepoint * const *tracepoints_ptrs;
         unsigned int num_tracepoints;
 #endif
 #ifdef HAVE_JUMP_LABEL
@@ -362,7 +389,7 @@ struct module
         unsigned int num_trace_bprintk_fmt;
 #endif
 #ifdef CONFIG_EVENT_TRACING
-        struct ftrace_event_call *trace_events;
+        struct ftrace_event_call **trace_events;
         unsigned int num_trace_events;
 #endif
 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
index 112adf8bd47..07b41951e3f 100644
--- a/include/linux/moduleparam.h
+++ b/include/linux/moduleparam.h
@@ -16,15 +16,17 @@
 /* Chosen so that structs with an unsigned long line up. */
 #define MAX_PARAM_PREFIX_LEN (64 - sizeof(unsigned long))
 
-#ifdef MODULE
 #define ___module_cat(a,b) __mod_ ## a ## b
 #define __module_cat(a,b) ___module_cat(a,b)
+#ifdef MODULE
 #define __MODULE_INFO(tag, name, info)                                    \
 static const char __module_cat(name,__LINE__)[]                           \
   __used __attribute__((section(".modinfo"), unused, aligned(1)))         \
   = __stringify(tag) "=" info
 #else  /* !MODULE */
-#define __MODULE_INFO(tag, name, info)
+/* This struct is here for syntactic coherency, it is not used */
+#define __MODULE_INFO(tag, name, info)                                    \
+  struct __module_cat(name,__LINE__) {}
 #endif
 #define __MODULE_PARM_TYPE(name, _type)                                   \
   __MODULE_INFO(parmtype, name##type, #name ":" _type)
diff --git a/include/linux/mroute.h b/include/linux/mroute.h
index 0fa7a3a874c..b21d567692b 100644
--- a/include/linux/mroute.h
+++ b/include/linux/mroute.h
@@ -150,6 +150,7 @@ static inline int ip_mroute_opt(int opt)
 extern int ip_mroute_setsockopt(struct sock *, int, char __user *, unsigned int);
 extern int ip_mroute_getsockopt(struct sock *, int, char __user *, int __user *);
 extern int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg);
+extern int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
 extern int ip_mr_init(void);
 #else
 static inline
diff --git a/include/linux/mroute6.h b/include/linux/mroute6.h
index 6091ab77f38..9d2deb200f5 100644
--- a/include/linux/mroute6.h
+++ b/include/linux/mroute6.h
@@ -136,6 +136,7 @@ extern int ip6_mroute_setsockopt(struct sock *, int, char __user *, unsigned int
 extern int ip6_mroute_getsockopt(struct sock *, int, char __user *, int __user *);
 extern int ip6_mr_input(struct sk_buff *skb);
 extern int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg);
+extern int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
 extern int ip6_mr_init(void);
 extern void ip6_mr_cleanup(void);
 #else
diff --git a/include/linux/nfsacl.h b/include/linux/nfsacl.h
index f321b578ede..fabcb1e5c46 100644
--- a/include/linux/nfsacl.h
+++ b/include/linux/nfsacl.h
@@ -51,10 +51,10 @@ nfsacl_size(struct posix_acl *acl_access, struct posix_acl *acl_default)
         return w;
 }
 
-extern unsigned int
+extern int
 nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
               struct posix_acl *acl, int encode_entries, int typeflag);
-extern unsigned int
+extern int
 nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
               struct posix_acl **pacl);
 
diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
index d68283a898b..54211c1cd92 100644
--- a/include/linux/posix_acl.h
+++ b/include/linux/posix_acl.h
@@ -71,6 +71,7 @@ posix_acl_release(struct posix_acl *acl)
 
 /* posix_acl.c */
 
+extern void posix_acl_init(struct posix_acl *, int);
 extern struct posix_acl *posix_acl_alloc(int, gfp_t);
 extern struct posix_acl *posix_acl_clone(const struct posix_acl *, gfp_t);
 extern int posix_acl_valid(const struct posix_acl *);
diff --git a/include/linux/quota.h b/include/linux/quota.h
index 94c1f03b50e..9a85412e0db 100644
--- a/include/linux/quota.h
+++ b/include/linux/quota.h
@@ -322,9 +322,12 @@ struct dquot_operations {
         qsize_t *(*get_reserved_space) (struct inode *);
 };
 
+struct path;
+
 /* Operations handling requests from userspace */
 struct quotactl_ops {
-        int (*quota_on)(struct super_block *, int, int, char *);
+        int (*quota_on)(struct super_block *, int, int, struct path *);
+        int (*quota_on_meta)(struct super_block *, int, int);
         int (*quota_off)(struct super_block *, int);
         int (*quota_sync)(struct super_block *, int, int);
         int (*get_info)(struct super_block *, int, struct if_dqinfo *);
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index 223b14cd129..eb354f6f26b 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -76,11 +76,9 @@ int dquot_mark_dquot_dirty(struct dquot *dquot);
 
 int dquot_file_open(struct inode *inode, struct file *file);
 
-int dquot_quota_on(struct super_block *sb, int type, int format_id,
-        char *path);
 int dquot_enable(struct inode *inode, int type, int format_id,
         unsigned int flags);
-int dquot_quota_on_path(struct super_block *sb, int type, int format_id,
+int dquot_quota_on(struct super_block *sb, int type, int format_id,
         struct path *path);
 int dquot_quota_on_mount(struct super_block *sb, char *qf_name,
         int format_id, int type);
diff --git a/include/linux/res_counter.h b/include/linux/res_counter.h
index fcb9884df61..a5930cb6614 100644
--- a/include/linux/res_counter.h
+++ b/include/linux/res_counter.h
@@ -182,6 +182,26 @@ static inline bool res_counter_check_under_limit(struct res_counter *cnt)
         return ret;
 }
 
+/**
+ * res_counter_check_margin - check if the counter allows charging
+ * @cnt: the resource counter to check
+ * @bytes: the number of bytes to check the remaining space against
+ *
+ * Returns a boolean value on whether the counter can be charged
+ * @bytes or whether this would exceed the limit.
+ */
+static inline bool res_counter_check_margin(struct res_counter *cnt,
+                                            unsigned long bytes)
+{
+        bool ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&cnt->lock, flags);
+        ret = cnt->limit - cnt->usage >= bytes;
+        spin_unlock_irqrestore(&cnt->lock, flags);
+        return ret;
+}
+
 static inline bool res_counter_check_under_soft_limit(struct res_counter *cnt)
 {
         bool ret;
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index 3c995b4d742..a0b639f8e80 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -235,8 +235,6 @@ extern int rtc_irq_set_freq(struct rtc_device *rtc,
                                 struct rtc_task *task, int freq);
 extern int rtc_update_irq_enable(struct rtc_device *rtc, unsigned int enabled);
 extern int rtc_alarm_irq_enable(struct rtc_device *rtc, unsigned int enabled);
-extern int rtc_dev_update_irq_enable_emul(struct rtc_device *rtc,
-                                                unsigned int enabled);
 
 void rtc_aie_update_irq(void *private);
 void rtc_uie_update_irq(void *private);
@@ -246,8 +244,6 @@ int rtc_register(rtc_task_t *task);
 int rtc_unregister(rtc_task_t *task);
 int rtc_control(rtc_task_t *t, unsigned int cmd, unsigned long arg);
 
-void rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer);
-void rtc_timer_remove(struct rtc_device *rtc, struct rtc_timer *timer);
 void rtc_timer_init(struct rtc_timer *timer, void (*f)(void* p), void* data);
 int rtc_timer_start(struct rtc_device *rtc, struct rtc_timer* timer,
                         ktime_t expires, ktime_t period);
diff --git a/include/linux/sunrpc/bc_xprt.h b/include/linux/sunrpc/bc_xprt.h
index c50b458b8a3..082884295f8 100644
--- a/include/linux/sunrpc/bc_xprt.h
+++ b/include/linux/sunrpc/bc_xprt.h
@@ -47,14 +47,6 @@ static inline int svc_is_backchannel(const struct svc_rqst *rqstp)
                 return 1;
         return 0;
 }
-static inline struct nfs4_sessionid *bc_xprt_sid(struct svc_rqst *rqstp)
-{
-        if (svc_is_backchannel(rqstp))
-                return (struct nfs4_sessionid *)
-                        rqstp->rq_server->sv_bc_xprt->xpt_bc_sid;
-        return NULL;
-}
-
 #else /* CONFIG_NFS_V4_1 */
 static inline int xprt_setup_backchannel(struct rpc_xprt *xprt,
                                          unsigned int min_reqs)
@@ -67,11 +59,6 @@ static inline int svc_is_backchannel(const struct svc_rqst *rqstp)
         return 0;
 }
 
-static inline struct nfs4_sessionid *bc_xprt_sid(struct svc_rqst *rqstp)
-{
-        return NULL;
-}
-
 static inline void xprt_free_bc_request(struct rpc_rqst *req)
 {
 }
diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h
index 059877b4d85..7ad9751a0d8 100644
--- a/include/linux/sunrpc/svc_xprt.h
+++ b/include/linux/sunrpc/svc_xprt.h
@@ -77,7 +77,6 @@ struct svc_xprt {
         size_t                  xpt_remotelen;  /* length of address */
         struct rpc_wait_queue   xpt_bc_pending; /* backchannel wait queue */
         struct list_head        xpt_users;      /* callbacks on free */
-        void                    *xpt_bc_sid;    /* back channel session ID */
 
         struct net              *xpt_net;
         struct rpc_xprt         *xpt_bc_xprt;   /* NFSv4.1 backchannel */
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 18cd0684fc4..98664db1be4 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -125,39 +125,37 @@ extern struct trace_event_functions enter_syscall_print_funcs;
 extern struct trace_event_functions exit_syscall_print_funcs;
 
 #define SYSCALL_TRACE_ENTER_EVENT(sname)                                \
-        static struct syscall_metadata                                  \
-        __attribute__((__aligned__(4))) __syscall_meta_##sname;         \
+        static struct syscall_metadata __syscall_meta_##sname;          \
         static struct ftrace_event_call __used                          \
-          __attribute__((__aligned__(4)))                               \
-          __attribute__((section("_ftrace_events")))                    \
           event_enter_##sname = {                                       \
                 .name                   = "sys_enter"#sname,            \
                 .class                  = &event_class_syscall_enter,   \
                 .event.funcs            = &enter_syscall_print_funcs,   \
                 .data                   = (void *)&__syscall_meta_##sname,\
         };                                                              \
+        static struct ftrace_event_call __used                          \
+          __attribute__((section("_ftrace_events")))                    \
+         *__event_enter_##sname = &event_enter_##sname;                 \
         __TRACE_EVENT_FLAGS(enter_##sname, TRACE_EVENT_FL_CAP_ANY)
 
 #define SYSCALL_TRACE_EXIT_EVENT(sname)                                 \
-        static struct syscall_metadata                                  \
-        __attribute__((__aligned__(4))) __syscall_meta_##sname;         \
+        static struct syscall_metadata __syscall_meta_##sname;          \
         static struct ftrace_event_call __used                          \
-          __attribute__((__aligned__(4)))                               \
-          __attribute__((section("_ftrace_events")))                    \
           event_exit_##sname = {                                        \
                 .name                   = "sys_exit"#sname,             \
                 .class                  = &event_class_syscall_exit,    \
                 .event.funcs            = &exit_syscall_print_funcs,    \
                 .data                   = (void *)&__syscall_meta_##sname,\
         };                                                              \
+        static struct ftrace_event_call __used                          \
+          __attribute__((section("_ftrace_events")))                    \
+        *__event_exit_##sname = &event_exit_##sname;                    \
         __TRACE_EVENT_FLAGS(exit_##sname, TRACE_EVENT_FL_CAP_ANY)
 
 #define SYSCALL_METADATA(sname, nb)                             \
         SYSCALL_TRACE_ENTER_EVENT(sname);                       \
         SYSCALL_TRACE_EXIT_EVENT(sname);                        \
         static struct syscall_metadata __used                   \
-          __attribute__((__aligned__(4)))                       \
-          __attribute__((section("__syscalls_metadata")))       \
           __syscall_meta_##sname = {                            \
                 .name           = "sys"#sname,                  \
                 .nb_args        = nb,                           \
@@ -166,14 +164,15 @@ extern struct trace_event_functions exit_syscall_print_funcs;
                 .enter_event    = &event_enter_##sname,         \
                 .exit_event     = &event_exit_##sname,          \
                 .enter_fields   = LIST_HEAD_INIT(__syscall_meta_##sname.enter_fields), \
-        };
+        };                                                      \
+        static struct syscall_metadata __used                   \
+          __attribute__((section("__syscalls_metadata")))       \
+         *__p_syscall_meta_##sname = &__syscall_meta_##sname;
 
 #define SYSCALL_DEFINE0(sname)                                  \
         SYSCALL_TRACE_ENTER_EVENT(_##sname);                    \
         SYSCALL_TRACE_EXIT_EVENT(_##sname);                     \
         static struct syscall_metadata __used                   \
-          __attribute__((__aligned__(4)))                       \
-          __attribute__((section("__syscalls_metadata")))       \
           __syscall_meta__##sname = {                           \
                 .name           = "sys_"#sname,                 \
                 .nb_args        = 0,                            \
@@ -181,6 +180,9 @@ extern struct trace_event_functions exit_syscall_print_funcs;
                 .exit_event     = &event_exit__##sname,         \
                 .enter_fields   = LIST_HEAD_INIT(__syscall_meta__##sname.enter_fields), \
         };                                                      \
+        static struct syscall_metadata __used                   \
+          __attribute__((section("__syscalls_metadata")))       \
+         *__p_syscall_meta_##sname = &__syscall_meta__##sname;  \
         asmlinkage long sys_##sname(void)
 #else
 #define SYSCALL_DEFINE0(name)      asmlinkage long sys_##name(void)
diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
index 387fa7d05c9..7faf933cced 100644
--- a/include/linux/sysrq.h
+++ b/include/linux/sysrq.h
@@ -17,6 +17,9 @@
 #include <linux/errno.h>
 #include <linux/types.h>
 
+/* Enable/disable SYSRQ support by default (0==no, 1==yes). */
+#define SYSRQ_DEFAULT_ENABLE    1
+
 /* Possible values of bitmask for enabling sysrq functions */
 /* 0x0001 is reserved for enable everything */
 #define SYSRQ_ENABLE_LOG        0x0002
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index c6814616653..97c84a58efb 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -33,12 +33,7 @@ struct tracepoint {
         void (*regfunc)(void);
         void (*unregfunc)(void);
         struct tracepoint_func __rcu *funcs;
-} __attribute__((aligned(32)));         /*
-                                         * Aligned on 32 bytes because it is
-                                         * globally visible and gcc happily
-                                         * align these on the structure size.
-                                         * Keep in sync with vmlinux.lds.h.
-                                         */
+};
 
 /*
  * Connect a probe to a tracepoint.
@@ -61,15 +56,15 @@ extern void tracepoint_probe_update_all(void);
 
 struct tracepoint_iter {
         struct module *module;
-        struct tracepoint *tracepoint;
+        struct tracepoint * const *tracepoint;
 };
 
 extern void tracepoint_iter_start(struct tracepoint_iter *iter);
 extern void tracepoint_iter_next(struct tracepoint_iter *iter);
 extern void tracepoint_iter_stop(struct tracepoint_iter *iter);
 extern void tracepoint_iter_reset(struct tracepoint_iter *iter);
-extern int tracepoint_get_iter_range(struct tracepoint **tracepoint,
-        struct tracepoint *begin, struct tracepoint *end);
+extern int tracepoint_get_iter_range(struct tracepoint * const **tracepoint,
+        struct tracepoint * const *begin, struct tracepoint * const *end);
 
 /*
  * tracepoint_synchronize_unregister must be called between the last tracepoint
@@ -84,11 +79,13 @@ static inline void tracepoint_synchronize_unregister(void)
 #define PARAMS(args...) args
 
 #ifdef CONFIG_TRACEPOINTS
-extern void tracepoint_update_probe_range(struct tracepoint *begin,
-        struct tracepoint *end);
+extern
+void tracepoint_update_probe_range(struct tracepoint * const *begin,
+        struct tracepoint * const *end);
 #else
-static inline void tracepoint_update_probe_range(struct tracepoint *begin,
-        struct tracepoint *end)
+static inline
+void tracepoint_update_probe_range(struct tracepoint * const *begin,
+        struct tracepoint * const *end)
 { }
 #endif /* CONFIG_TRACEPOINTS */
 
@@ -174,12 +171,20 @@ do_trace:								\
         {                                                               \
         }
 
+/*
+ * We have no guarantee that gcc and the linker won't up-align the tracepoint
+ * structures, so we create an array of pointers that will be used for iteration
+ * on the tracepoints.
+ */
 #define DEFINE_TRACE_FN(name, reg, unreg)                               \
         static const char __tpstrtab_##name[]                           \
         __attribute__((section("__tracepoints_strings"))) = #name;      \
         struct tracepoint __tracepoint_##name                           \
-        __attribute__((section("__tracepoints"), aligned(32))) =        \
-                { __tpstrtab_##name, 0, reg, unreg, NULL }
+        __attribute__((section("__tracepoints"))) =                     \
+                { __tpstrtab_##name, 0, reg, unreg, NULL };             \
+        static struct tracepoint * const __tracepoint_ptr_##name __used \
+        __attribute__((section("__tracepoints_ptrs"))) =                \
+                &__tracepoint_##name;
 
 #define DEFINE_TRACE(name)                                              \
         DEFINE_TRACE_FN(name, NULL, NULL);
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index dd6ee49a084..a854fe89484 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -112,6 +112,7 @@ struct usb_hcd {
         /* Flags that get set only during HCD registration or removal. */
         unsigned                rh_registered:1;/* is root hub registered? */
         unsigned                rh_pollable:1;  /* may we poll the root hub? */
+        unsigned                msix_enabled:1; /* driver has MSI-X enabled? */
 
         /* The next flag is a stopgap, to be removed when all the HCDs
          * support the new root-hub polling mechanism. */
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index 16d682f4f7c..c9049139a7a 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -347,6 +347,9 @@ extern int usb_serial_generic_prepare_write_buffer(struct usb_serial_port *port,
 extern int usb_serial_handle_sysrq_char(struct usb_serial_port *port,
                                         unsigned int ch);
 extern int usb_serial_handle_break(struct usb_serial_port *port);
+extern void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
+                                         struct tty_struct *tty,
+                                         unsigned int status);
 
 
 extern int usb_serial_bus_register(struct usb_serial_driver *device);
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 0093dd7c1d6..800617b4ddd 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -109,7 +109,10 @@ static inline bool virtio_has_feature(const struct virtio_device *vdev,
                                       unsigned int fbit)
 {
         /* Did you forget to fix assumptions on max features? */
-        MAYBE_BUILD_BUG_ON(fbit >= 32);
+        if (__builtin_constant_p(fbit))
+                BUILD_BUG_ON(fbit >= 32);
+        else
+                BUG_ON(fbit >= 32);
 
         if (fbit < VIRTIO_TRANSPORT_F_START)
                 virtio_check_driver_offered_feature(vdev, fbit);
diff --git a/include/media/mt9v011.h b/include/media/mt9v011.h
new file mode 100644
index 00000000000..ea29fc74cd0
--- /dev/null
+++ b/include/media/mt9v011.h
@@ -0,0 +1,17 @@
+/* mt9v011 sensor
+ *
+ * Copyright (C) 2011 Hans Verkuil <hverkuil@xs4all.nl>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __MT9V011_H__
+#define __MT9V011_H__
+
+struct mt9v011_platform_data {
+        unsigned xtal;  /* Hz */
+};
+
+#endif
diff --git a/include/media/rc-core.h b/include/media/rc-core.h
index a23c1fc685a..2963263f31e 100644
--- a/include/media/rc-core.h
+++ b/include/media/rc-core.h
@@ -183,6 +183,9 @@ static inline void init_ir_raw_event(struct ir_raw_event *ev)
 }
 
 #define IR_MAX_DURATION         0xFFFFFFFF      /* a bit more than 4 seconds */
+#define US_TO_NS(usec)          ((usec) * 1000)
+#define MS_TO_US(msec)          ((msec) * 1000)
+#define MS_TO_NS(msec)          ((msec) * 1000 * 1000)
 
 void ir_raw_event_handle(struct rc_dev *dev);
 int ir_raw_event_store(struct rc_dev *dev, struct ir_raw_event *ev);
diff --git a/include/media/saa7146.h b/include/media/saa7146.h
index ac7ce00f39c..79827143d5a 100644
--- a/include/media/saa7146.h
+++ b/include/media/saa7146.h
@@ -115,7 +115,7 @@ struct saa7146_dev
 
         /* different device locks */
         spinlock_t                      slock;
-        struct mutex                    lock;
+        struct mutex                    v4l2_lock;
 
         unsigned char                   __iomem *mem;           /* pointer to mapped IO memory */
         u32                             revision;       /* chip revision; needed for bug-workarounds*/
diff --git a/include/media/v4l2-common.h b/include/media/v4l2-common.h
index 2d65b35cdab..a659319e858 100644
--- a/include/media/v4l2-common.h
+++ b/include/media/v4l2-common.h
@@ -138,21 +138,10 @@ struct v4l2_subdev_ops;
 
 /* Load an i2c module and return an initialized v4l2_subdev struct.
    The client_type argument is the name of the chip that's on the adapter. */
-struct v4l2_subdev *v4l2_i2c_new_subdev_cfg(struct v4l2_device *v4l2_dev,
+struct v4l2_subdev *v4l2_i2c_new_subdev(struct v4l2_device *v4l2_dev,
                 struct i2c_adapter *adapter, const char *client_type,
-                int irq, void *platform_data,
                 u8 addr, const unsigned short *probe_addrs);
 
-/* Load an i2c module and return an initialized v4l2_subdev struct.
-   The client_type argument is the name of the chip that's on the adapter. */
-static inline struct v4l2_subdev *v4l2_i2c_new_subdev(struct v4l2_device *v4l2_dev,
-                struct i2c_adapter *adapter, const char *client_type,
-                u8 addr, const unsigned short *probe_addrs)
-{
-        return v4l2_i2c_new_subdev_cfg(v4l2_dev, adapter, client_type, 0, NULL,
-                                       addr, probe_addrs);
-}
-
 struct i2c_board_info;
 
 struct v4l2_subdev *v4l2_i2c_new_subdev_board(struct v4l2_device *v4l2_dev,
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
index d69ab4aae03..97d063837b6 100644
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -23,6 +23,7 @@
 
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/videodev2.h>
 
 /* forward references */
 struct v4l2_ctrl_handler;
@@ -53,8 +54,10 @@ struct v4l2_ctrl_ops {
   * @handler:   The handler that owns the control.
   * @cluster:   Point to start of cluster array.
   * @ncontrols: Number of controls in cluster array.
-  * @has_new:   Internal flag: set when there is a valid new value.
   * @done:      Internal flag: set for each processed control.
+  * @is_new:    Set when the user specified a new value for this control. It
+  *             is also set when called from v4l2_ctrl_handler_setup. Drivers
+  *             should never set this flag.
   * @is_private: If set, then this control is private to its handler and it
   *             will not be added to any other handlers. Drivers can set
   *             this flag.
@@ -97,9 +100,9 @@ struct v4l2_ctrl {
         struct v4l2_ctrl_handler *handler;
         struct v4l2_ctrl **cluster;
         unsigned ncontrols;
-        unsigned int has_new:1;
         unsigned int done:1;
 
+        unsigned int is_new:1;
         unsigned int is_private:1;
         unsigned int is_volatile:1;
 
diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h
index b0316a7cf08..daf1e57d9b2 100644
--- a/include/media/v4l2-subdev.h
+++ b/include/media/v4l2-subdev.h
@@ -106,10 +106,7 @@ struct v4l2_subdev_io_pin_config {
         u8 strength;    /* Pin drive strength */
 };
 
-/* s_config: if set, then it is always called by the v4l2_i2c_new_subdev*
-        functions after the v4l2_subdev was registered. It is used to pass
-        platform data to the subdev which can be used during initialization.
-
+/*
    s_io_pin_config: configure one or more chip I/O pins for chips that
         multiplex different internal signal pads out to IO pins.  This function
         takes a pointer to an array of 'n' pin configuration entries, one for
@@ -141,7 +138,6 @@ struct v4l2_subdev_io_pin_config {
 struct v4l2_subdev_core_ops {
         int (*g_chip_ident)(struct v4l2_subdev *sd, struct v4l2_dbg_chip_ident *chip);
         int (*log_status)(struct v4l2_subdev *sd);
-        int (*s_config)(struct v4l2_subdev *sd, int irq, void *platform_data);
         int (*s_io_pin_config)(struct v4l2_subdev *sd, size_t n,
                                       struct v4l2_subdev_io_pin_config *pincfg);
         int (*init)(struct v4l2_subdev *sd, u32 val);
@@ -415,6 +411,21 @@ struct v4l2_subdev_ops {
         const struct v4l2_subdev_sensor_ops     *sensor;
 };
 
+/*
+ * Internal ops. Never call this from drivers, only the v4l2 framework can call
+ * these ops.
+ *
+ * registered: called when this subdev is registered. When called the v4l2_dev
+ *      field is set to the correct v4l2_device.
+ *
+ * unregistered: called when this subdev is unregistered. When called the
+ *      v4l2_dev field is still set to the correct v4l2_device.
+ */
+struct v4l2_subdev_internal_ops {
+        int (*registered)(struct v4l2_subdev *sd);
+        void (*unregistered)(struct v4l2_subdev *sd);
+};
+
 #define V4L2_SUBDEV_NAME_SIZE 32
 
 /* Set this flag if this subdev is a i2c device. */
@@ -431,6 +442,8 @@ struct v4l2_subdev {
         u32 flags;
         struct v4l2_device *v4l2_dev;
         const struct v4l2_subdev_ops *ops;
+        /* Never call these internal ops from within a driver! */
+        const struct v4l2_subdev_internal_ops *internal_ops;
         /* The control handler of this subdev. May be NULL. */
         struct v4l2_ctrl_handler *ctrl_handler;
         /* name must be unique */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index a29feb01854..d2cf8840769 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -184,6 +184,7 @@ struct hci_conn {
         __u32            link_mode;
         __u8             auth_type;
         __u8             sec_level;
+        __u8             pending_sec_level;
         __u8             power_save;
         __u16            disc_timeout;
         unsigned long    pend;
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 8a64b811a39..b4c7c1cbcf4 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -195,7 +195,8 @@ static inline int genlmsg_end(struct sk_buff *skb, void *hdr)
  */
 static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 {
-        nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
+        if (hdr)
+                nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
 }
 
 /**
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index 96ba5f7dcab..349cefedc9f 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -77,9 +77,6 @@ nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
         if (e == NULL)
                 return;
 
-        if (!(e->ctmask & (1 << event)))
-                return;
-
         set_bit(event, &e->cache);
 }
 
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index e9eee99d8b1..160a407c196 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -445,7 +445,6 @@ static inline int __qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch,
 {
         __skb_queue_tail(list, skb);
         sch->qstats.backlog += qdisc_pkt_len(skb);
-        qdisc_bstats_update(sch, skb);
 
         return NET_XMIT_SUCCESS;
 }
@@ -460,8 +459,10 @@ static inline struct sk_buff *__qdisc_dequeue_head(struct Qdisc *sch,
 {
         struct sk_buff *skb = __skb_dequeue(list);
 
-        if (likely(skb != NULL))
+        if (likely(skb != NULL)) {
                 sch->qstats.backlog -= qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
+        }
 
         return skb;
 }
@@ -474,10 +475,11 @@ static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch)
 static inline unsigned int __qdisc_queue_drop_head(struct Qdisc *sch,
                                               struct sk_buff_head *list)
 {
-        struct sk_buff *skb = __qdisc_dequeue_head(sch, list);
+        struct sk_buff *skb = __skb_dequeue(list);
 
         if (likely(skb != NULL)) {
                 unsigned int len = qdisc_pkt_len(skb);
+                sch->qstats.backlog -= len;
                 kfree_skb(skb);
                 return len;
         }
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 2a128c8c271..e73ebdae323 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -78,6 +78,7 @@ typedef __s32 sctp_assoc_t;
 #define SCTP_GET_PEER_ADDR_INFO 15
 #define SCTP_DELAYED_ACK_TIME   16
 #define SCTP_DELAYED_ACK SCTP_DELAYED_ACK_TIME
+#define SCTP_DELAYED_SACK SCTP_DELAYED_ACK_TIME
 #define SCTP_CONTEXT    17
 #define SCTP_FRAGMENT_INTERLEAVE        18
 #define SCTP_PARTIAL_DELIVERY_POINT     19 /* Set/Get partial delivery point */
diff --git a/include/net/sock.h b/include/net/sock.h
index d884d268c70..bc1cf7d88cc 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -753,6 +753,8 @@ struct proto {
                                         int level,
                                         int optname, char __user *optval,
                                         int __user *option);
+        int                     (*compat_ioctl)(struct sock *sk,
+                                        unsigned int cmd, unsigned long arg);
 #endif
         int                     (*sendmsg)(struct kiocb *iocb, struct sock *sk,
                                            struct msghdr *msg, size_t len);
diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
index 648d2335803..b76d4006e36 100644
--- a/include/scsi/scsi.h
+++ b/include/scsi/scsi.h
@@ -9,6 +9,7 @@
 #define _SCSI_SCSI_H
 
 #include <linux/types.h>
+#include <linux/scatterlist.h>
 
 struct scsi_cmnd;
 
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index e16610c208c..3e68366d485 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -446,14 +446,16 @@ static inline notrace int ftrace_get_offsets_##call(			\
  *      .reg                    = ftrace_event_reg,
  * };
  *
- * static struct ftrace_event_call __used
- * __attribute__((__aligned__(4)))
- * __attribute__((section("_ftrace_events"))) event_<call> = {
+ * static struct ftrace_event_call event_<call> = {
  *      .name                   = "<call>",
  *      .class                  = event_class_<template>,
  *      .event                  = &ftrace_event_type_<call>,
  *      .print_fmt              = print_fmt_<call>,
  * };
+ * // its only safe to use pointers when doing linker tricks to
+ * // create an array.
+ * static struct ftrace_event_call __used
+ * __attribute__((section("_ftrace_events"))) *__event_<call> = &event_<call>;
  *
  */
 
@@ -579,28 +581,28 @@ static struct ftrace_event_class __used event_class_##call = {		\
 #undef DEFINE_EVENT
 #define DEFINE_EVENT(template, call, proto, args)                       \
                                                                         \
-static struct ftrace_event_call __used                                  \
-__attribute__((__aligned__(4)))                                         \
-__attribute__((section("_ftrace_events"))) event_##call = {             \
+static struct ftrace_event_call __used event_##call = {                 \
         .name                   = #call,                                \
         .class                  = &event_class_##template,              \
         .event.funcs            = &ftrace_event_type_funcs_##template,  \
         .print_fmt              = print_fmt_##template,                 \
-};
+};                                                                      \
+static struct ftrace_event_call __used                                  \
+__attribute__((section("_ftrace_events"))) *__event_##call = &event_##call
 
 #undef DEFINE_EVENT_PRINT
 #define DEFINE_EVENT_PRINT(template, call, proto, args, print)          \
                                                                         \
 static const char print_fmt_##call[] = print;                           \
                                                                         \
-static struct ftrace_event_call __used                                  \
-__attribute__((__aligned__(4)))                                         \
-__attribute__((section("_ftrace_events"))) event_##call = {             \
+static struct ftrace_event_call __used event_##call = {                 \
         .name                   = #call,                                \
         .class                  = &event_class_##template,              \
         .event.funcs            = &ftrace_event_type_funcs_##call,      \
         .print_fmt              = print_fmt_##call,                     \
-}
+};                                                                      \
+static struct ftrace_event_call __used                                  \
+__attribute__((section("_ftrace_events"))) *__event_##call = &event_##call
 
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
 
diff --git a/init/Kconfig b/init/Kconfig
index 4e337906016..be788c0957d 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -745,8 +745,8 @@ config DEBUG_BLK_CGROUP
 endif # CGROUPS
 
 menuconfig NAMESPACES
-        bool "Namespaces support" if EMBEDDED
-        default !EMBEDDED
+        bool "Namespaces support" if EXPERT
+        default !EXPERT
         help
           Provides the way to make tasks work with different objects using
           the same id. For example same IPC id may refer to different objects
@@ -899,23 +899,31 @@ config SYSCTL
 config ANON_INODES
         bool
 
-menuconfig EMBEDDED
-        bool "Configure standard kernel features (for small systems)"
+menuconfig EXPERT
+        bool "Configure standard kernel features (expert users)"
         help
           This option allows certain base kernel options and settings
           to be disabled or tweaked. This is for specialized
           environments which can tolerate a "non-standard" kernel.
           Only use this if you really know what you are doing.
 
+config EMBEDDED
+        bool "Embedded system"
+        select EXPERT
+        help
+          This option should be enabled if compiling the kernel for
+          an embedded system so certain expert options are available
+          for configuration.
+
 config UID16
-        bool "Enable 16-bit UID system calls" if EMBEDDED
+        bool "Enable 16-bit UID system calls" if EXPERT
         depends on ARM || BLACKFIN || CRIS || FRV || H8300 || X86_32 || M68K || (S390 && !64BIT) || SUPERH || SPARC32 || (SPARC64 && COMPAT) || UML || (X86_64 && IA32_EMULATION)
         default y
         help
           This enables the legacy 16-bit UID syscall wrappers.
 
 config SYSCTL_SYSCALL
-        bool "Sysctl syscall support" if EMBEDDED
+        bool "Sysctl syscall support" if EXPERT
         depends on PROC_SYSCTL
         default y
         select SYSCTL
@@ -932,7 +940,7 @@ config SYSCTL_SYSCALL
           If unsure say Y here.
 
 config KALLSYMS
-         bool "Load all symbols for debugging/ksymoops" if EMBEDDED
+         bool "Load all symbols for debugging/ksymoops" if EXPERT
          default y
          help
            Say Y here to let the kernel print out symbolic crash information and
@@ -963,7 +971,7 @@ config KALLSYMS_EXTRA_PASS
 
 
 config HOTPLUG
-        bool "Support for hot-pluggable devices" if EMBEDDED
+        bool "Support for hot-pluggable devices" if EXPERT
         default y
         help
           This option is provided for the case where no hotplug or uevent
@@ -973,7 +981,7 @@ config HOTPLUG
 
 config PRINTK
         default y
-        bool "Enable support for printk" if EMBEDDED
+        bool "Enable support for printk" if EXPERT
         help
           This option enables normal printk support. Removing it
           eliminates most of the message strings from the kernel image
@@ -982,7 +990,7 @@ config PRINTK
           strongly discouraged.
 
 config BUG
-        bool "BUG() support" if EMBEDDED
+        bool "BUG() support" if EXPERT
         default y
         help
           Disabling this option eliminates support for BUG and WARN, reducing
@@ -993,12 +1001,12 @@ config BUG
 
 config ELF_CORE
         default y
-        bool "Enable ELF core dumps" if EMBEDDED
+        bool "Enable ELF core dumps" if EXPERT
         help
           Enable support for generating core dumps. Disabling saves about 4k.
 
 config PCSPKR_PLATFORM
-        bool "Enable PC-Speaker support" if EMBEDDED
+        bool "Enable PC-Speaker support" if EXPERT
         depends on ALPHA || X86 || MIPS || PPC_PREP || PPC_CHRP || PPC_PSERIES
         default y
         help
@@ -1007,14 +1015,14 @@ config PCSPKR_PLATFORM
 
 config BASE_FULL
         default y
-        bool "Enable full-sized data structures for core" if EMBEDDED
+        bool "Enable full-sized data structures for core" if EXPERT
         help
           Disabling this option reduces the size of miscellaneous core
           kernel data structures. This saves memory on small machines,
           but may reduce performance.
 
 config FUTEX
-        bool "Enable futex support" if EMBEDDED
+        bool "Enable futex support" if EXPERT
         default y
         select RT_MUTEXES
         help
@@ -1023,7 +1031,7 @@ config FUTEX
           run glibc-based applications correctly.
 
 config EPOLL
-        bool "Enable eventpoll support" if EMBEDDED
+        bool "Enable eventpoll support" if EXPERT
         default y
         select ANON_INODES
         help
@@ -1031,7 +1039,7 @@ config EPOLL
           support for epoll family of system calls.
 
 config SIGNALFD
-        bool "Enable signalfd() system call" if EMBEDDED
+        bool "Enable signalfd() system call" if EXPERT
         select ANON_INODES
         default y
         help
@@ -1041,7 +1049,7 @@ config SIGNALFD
           If unsure, say Y.
 
 config TIMERFD
-        bool "Enable timerfd() system call" if EMBEDDED
+        bool "Enable timerfd() system call" if EXPERT
         select ANON_INODES
         default y
         help
@@ -1051,7 +1059,7 @@ config TIMERFD
           If unsure, say Y.
 
 config EVENTFD
-        bool "Enable eventfd() system call" if EMBEDDED
+        bool "Enable eventfd() system call" if EXPERT
         select ANON_INODES
         default y
         help
@@ -1061,7 +1069,7 @@ config EVENTFD
           If unsure, say Y.
 
 config SHMEM
-        bool "Use full shmem filesystem" if EMBEDDED
+        bool "Use full shmem filesystem" if EXPERT
         default y
         depends on MMU
         help
@@ -1072,7 +1080,7 @@ config SHMEM
           which may be appropriate on small systems without swap.
 
 config AIO
-        bool "Enable AIO support" if EMBEDDED
+        bool "Enable AIO support" if EXPERT
         default y
         help
           This option enables POSIX asynchronous I/O which may by used
@@ -1149,16 +1157,16 @@ endmenu
 
 config VM_EVENT_COUNTERS
         default y
-        bool "Enable VM event counters for /proc/vmstat" if EMBEDDED
+        bool "Enable VM event counters for /proc/vmstat" if EXPERT
         help
           VM event counters are needed for event counts to be shown.
           This option allows the disabling of the VM event counters
-          on EMBEDDED systems.  /proc/vmstat will only show page counts
+          on EXPERT systems.  /proc/vmstat will only show page counts
           if VM event counters are disabled.
 
 config PCI_QUIRKS
         default y
-        bool "Enable PCI quirk workarounds" if EMBEDDED
+        bool "Enable PCI quirk workarounds" if EXPERT
         depends on PCI
         help
           This enables workarounds for various PCI chipset
@@ -1167,7 +1175,7 @@ config PCI_QUIRKS
 
 config SLUB_DEBUG
         default y
-        bool "Enable SLUB debugging support" if EMBEDDED
+        bool "Enable SLUB debugging support" if EXPERT
         depends on SLUB && SYSFS
         help
           SLUB has extensive debug support features. Disabling these can
@@ -1211,7 +1219,7 @@ config SLUB
            a slab allocator.
 
 config SLOB
-        depends on EMBEDDED
+        depends on EXPERT
         bool "SLOB (Simple Allocator)"
         help
            SLOB replaces the stock allocator with a drastically simpler
@@ -1222,7 +1230,7 @@ endchoice
 
 config MMAP_ALLOW_UNINITIALIZED
         bool "Allow mmapped anonymous memory to be uninitialized"
-        depends on EMBEDDED && !MMU
+        depends on EXPERT && !MMU
         default n
         help
           Normally, and according to the Linux spec, anonymous memory obtained
diff --git a/init/main.c b/init/main.c
index 00799c1d462..33c37c379e9 100644
--- a/init/main.c
+++ b/init/main.c
@@ -96,6 +96,15 @@ static inline void mark_rodata_ro(void) { }
 extern void tc_init(void);
 #endif
 
+/*
+ * Debug helper: via this flag we know that we are in 'early bootup code'
+ * where only the boot processor is running with IRQ disabled.  This means
+ * two things - IRQ must not be enabled before the flag is cleared and some
+ * operations which are not allowed with IRQ disabled are allowed while the
+ * flag is set.
+ */
+bool early_boot_irqs_disabled __read_mostly;
+
 enum system_states system_state __read_mostly;
 EXPORT_SYMBOL(system_state);
 
@@ -554,7 +563,7 @@ asmlinkage void __init start_kernel(void)
         cgroup_init_early();
 
         local_irq_disable();
-        early_boot_irqs_off();
+        early_boot_irqs_disabled = true;
 
 /*
  * Interrupts are still disabled. Do necessary setups, then
@@ -621,7 +630,7 @@ asmlinkage void __init start_kernel(void)
         if (!irqs_disabled())
                 printk(KERN_CRIT "start_kernel(): bug: interrupts were "
                                  "enabled early\n");
-        early_boot_irqs_on();
+        early_boot_irqs_disabled = false;
         local_irq_enable();
 
         /* Interrupts are enabled now so all GFP allocations are safe. */
diff --git a/kernel/cred.c b/kernel/cred.c
index 6a1aa004e37..3a9d6dd53a6 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -252,13 +252,13 @@ struct cred *cred_alloc_blank(void)
 #endif
 
         atomic_set(&new->usage, 1);
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        new->magic = CRED_MAGIC;
+#endif
 
         if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
                 goto error;
 
-#ifdef CONFIG_DEBUG_CREDENTIALS
-        new->magic = CRED_MAGIC;
-#endif
         return new;
 
 error:
@@ -657,6 +657,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         validate_creds(old);
 
         *new = *old;
+        atomic_set(&new->usage, 1);
+        set_cred_subscribers(new, 0);
         get_uid(new->user);
         get_group_info(new->group_info);
 
@@ -674,8 +676,6 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
                 goto error;
 
-        atomic_set(&new->usage, 1);
-        set_cred_subscribers(new, 0);
         put_cred(old);
         validate_creds(new);
         return new;
@@ -748,7 +748,11 @@ bool creds_are_invalid(const struct cred *cred)
         if (cred->magic != CRED_MAGIC)
                 return true;
 #ifdef CONFIG_SECURITY_SELINUX
-        if (selinux_is_enabled()) {
+        /*
+         * cred->security == NULL if security_cred_alloc_blank() or
+         * security_prepare_creds() returned an error.
+         */
+        if (selinux_is_enabled() && cred->security) {
                 if ((unsigned long) cred->security < PAGE_SIZE)
                         return true;
                 if ((*(u32 *)cred->security & 0xffffff00) ==
diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
index 31d766bf5d2..8e42fec7686 100644
--- a/kernel/irq/Kconfig
+++ b/kernel/irq/Kconfig
@@ -9,9 +9,6 @@ menu "IRQ subsystem"
 config GENERIC_HARDIRQS
        def_bool y
 
-config GENERIC_HARDIRQS_NO__DO_IRQ
-       def_bool y
-
 # Select this to disable the deprecated stuff
 config GENERIC_HARDIRQS_NO_DEPRECATED
        def_bool n
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index e2347eb6330..3540a719012 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -118,114 +118,3 @@ irqreturn_t handle_IRQ_event(unsigned int irq, struct irqaction *action)
 
         return retval;
 }
-
-#ifndef CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ
-
-#ifdef CONFIG_ENABLE_WARN_DEPRECATED
-# warning __do_IRQ is deprecated. Please convert to proper flow handlers
-#endif
-
-/**
- * __do_IRQ - original all in one highlevel IRQ handler
- * @irq:        the interrupt number
- *
- * __do_IRQ handles all normal device IRQ's (the special
- * SMP cross-CPU interrupts have their own specific
- * handlers).
- *
- * This is the original x86 implementation which is used for every
- * interrupt type.
- */
-unsigned int __do_IRQ(unsigned int irq)
-{
-        struct irq_desc *desc = irq_to_desc(irq);
-        struct irqaction *action;
-        unsigned int status;
-
-        kstat_incr_irqs_this_cpu(irq, desc);
-
-        if (CHECK_IRQ_PER_CPU(desc->status)) {
-                irqreturn_t action_ret;
-
-                /*
-                 * No locking required for CPU-local interrupts:
-                 */
-                if (desc->irq_data.chip->ack)
-                        desc->irq_data.chip->ack(irq);
-                if (likely(!(desc->status & IRQ_DISABLED))) {
-                        action_ret = handle_IRQ_event(irq, desc->action);
-                        if (!noirqdebug)
-                                note_interrupt(irq, desc, action_ret);
-                }
-                desc->irq_data.chip->end(irq);
-                return 1;
-        }
-
-        raw_spin_lock(&desc->lock);
-        if (desc->irq_data.chip->ack)
-                desc->irq_data.chip->ack(irq);
-        /*
-         * REPLAY is when Linux resends an IRQ that was dropped earlier
-         * WAITING is used by probe to mark irqs that are being tested
-         */
-        status = desc->status & ~(IRQ_REPLAY | IRQ_WAITING);
-        status |= IRQ_PENDING; /* we _want_ to handle it */
-
-        /*
-         * If the IRQ is disabled for whatever reason, we cannot
-         * use the action we have.
-         */
-        action = NULL;
-        if (likely(!(status & (IRQ_DISABLED | IRQ_INPROGRESS)))) {
-                action = desc->action;
-                status &= ~IRQ_PENDING; /* we commit to handling */
-                status |= IRQ_INPROGRESS; /* we are handling it */
-        }
-        desc->status = status;
-
-        /*
-         * If there is no IRQ handler or it was disabled, exit early.
-         * Since we set PENDING, if another processor is handling
-         * a different instance of this same irq, the other processor
-         * will take care of it.
-         */
-        if (unlikely(!action))
-                goto out;
-
-        /*
-         * Edge triggered interrupts need to remember
-         * pending events.
-         * This applies to any hw interrupts that allow a second
-         * instance of the same irq to arrive while we are in do_IRQ
-         * or in the handler. But the code here only handles the _second_
-         * instance of the irq, not the third or fourth. So it is mostly
-         * useful for irq hardware that does not mask cleanly in an
-         * SMP environment.
-         */
-        for (;;) {
-                irqreturn_t action_ret;
-
-                raw_spin_unlock(&desc->lock);
-
-                action_ret = handle_IRQ_event(irq, action);
-                if (!noirqdebug)
-                        note_interrupt(irq, desc, action_ret);
-
-                raw_spin_lock(&desc->lock);
-                if (likely(!(desc->status & IRQ_PENDING)))
-                        break;
-                desc->status &= ~IRQ_PENDING;
-        }
-        desc->status &= ~IRQ_INPROGRESS;
-
-out:
-        /*
-         * The ->end() handler has to deal with interrupts which got
-         * disabled while the handler was running.
-         */
-        desc->irq_data.chip->end(irq);
-        raw_spin_unlock(&desc->lock);
-
-        return 1;
-}
-#endif
diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
index 1d254194048..441fd629ff0 100644
--- a/kernel/irq/migration.c
+++ b/kernel/irq/migration.c
@@ -56,6 +56,7 @@ void move_masked_irq(int irq)
 void move_native_irq(int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
+        bool masked;
 
         if (likely(!(desc->status & IRQ_MOVE_PENDING)))
                 return;
@@ -63,8 +64,15 @@ void move_native_irq(int irq)
         if (unlikely(desc->status & IRQ_DISABLED))
                 return;
 
-        desc->irq_data.chip->irq_mask(&desc->irq_data);
+        /*
+         * Be careful vs. already masked interrupts. If this is a
+         * threaded interrupt with ONESHOT set, we can end up with an
+         * interrupt storm.
+         */
+        masked = desc->status & IRQ_MASKED;
+        if (!masked)
+                desc->irq_data.chip->irq_mask(&desc->irq_data);
         move_masked_irq(irq);
-        desc->irq_data.chip->irq_unmask(&desc->irq_data);
+        if (!masked)
+                desc->irq_data.chip->irq_unmask(&desc->irq_data);
 }
-
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 42ba65dff7d..0d2058da80f 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -2292,22 +2292,6 @@ mark_held_locks(struct task_struct *curr, enum mark_type mark)
 }
 
 /*
- * Debugging helper: via this flag we know that we are in
- * 'early bootup code', and will warn about any invalid irqs-on event:
- */
-static int early_boot_irqs_enabled;
-
-void early_boot_irqs_off(void)
-{
-        early_boot_irqs_enabled = 0;
-}
-
-void early_boot_irqs_on(void)
-{
-        early_boot_irqs_enabled = 1;
-}
-
-/*
  * Hardirqs will be enabled:
  */
 void trace_hardirqs_on_caller(unsigned long ip)
@@ -2319,7 +2303,7 @@ void trace_hardirqs_on_caller(unsigned long ip)
         if (unlikely(!debug_locks || current->lockdep_recursion))
                 return;
 
-        if (DEBUG_LOCKS_WARN_ON(unlikely(!early_boot_irqs_enabled)))
+        if (DEBUG_LOCKS_WARN_ON(unlikely(early_boot_irqs_disabled)))
                 return;
 
         if (unlikely(curr->hardirqs_enabled)) {
diff --git a/kernel/module.c b/kernel/module.c
index 34e00b708fa..efa290ea94b 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2460,9 +2460,9 @@ static void find_module_sections(struct module *mod, struct load_info *info)
 #endif
 
 #ifdef CONFIG_TRACEPOINTS
-        mod->tracepoints = section_objs(info, "__tracepoints",
-                                        sizeof(*mod->tracepoints),
-                                        &mod->num_tracepoints);
+        mod->tracepoints_ptrs = section_objs(info, "__tracepoints_ptrs",
+                                             sizeof(*mod->tracepoints_ptrs),
+                                             &mod->num_tracepoints);
 #endif
 #ifdef HAVE_JUMP_LABEL
         mod->jump_entries = section_objs(info, "__jump_table",
@@ -3393,7 +3393,7 @@ void module_layout(struct module *mod,
                    struct modversion_info *ver,
                    struct kernel_param *kp,
                    struct kernel_symbol *ks,
-                   struct tracepoint *tp)
+                   struct tracepoint * const *tp)
 {
 }
 EXPORT_SYMBOL(module_layout);
@@ -3407,8 +3407,8 @@ void module_update_tracepoints(void)
         mutex_lock(&module_mutex);
         list_for_each_entry(mod, &modules, list)
                 if (!mod->taints)
-                        tracepoint_update_probe_range(mod->tracepoints,
-                                mod->tracepoints + mod->num_tracepoints);
+                        tracepoint_update_probe_range(mod->tracepoints_ptrs,
+                                mod->tracepoints_ptrs + mod->num_tracepoints);
         mutex_unlock(&module_mutex);
 }
 
@@ -3432,8 +3432,8 @@ int module_get_iter_tracepoints(struct tracepoint_iter *iter)
                         else if (iter_mod > iter->module)
                                 iter->tracepoint = NULL;
                         found = tracepoint_get_iter_range(&iter->tracepoint,
-                                iter_mod->tracepoints,
-                                iter_mod->tracepoints
+                                iter_mod->tracepoints_ptrs,
+                                iter_mod->tracepoints_ptrs
                                         + iter_mod->num_tracepoints);
                         if (found) {
                                 iter->module = iter_mod;
diff --git a/kernel/params.c b/kernel/params.c
index 08107d18175..0da1411222b 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -719,9 +719,7 @@ void destroy_params(const struct kernel_param *params, unsigned num)
                         params[i].ops->free(params[i].arg);
 }
 
-static void __init kernel_add_sysfs_param(const char *name,
-                                          struct kernel_param *kparam,
-                                          unsigned int name_skip)
+static struct module_kobject * __init locate_module_kobject(const char *name)
 {
         struct module_kobject *mk;
         struct kobject *kobj;
@@ -729,10 +727,7 @@ static void __init kernel_add_sysfs_param(const char *name,
 
         kobj = kset_find_obj(module_kset, name);
         if (kobj) {
-                /* We already have one.  Remove params so we can add more. */
                 mk = to_module_kobject(kobj);
-                /* We need to remove it before adding parameters. */
-                sysfs_remove_group(&mk->kobj, &mk->mp->grp);
         } else {
                 mk = kzalloc(sizeof(struct module_kobject), GFP_KERNEL);
                 BUG_ON(!mk);
@@ -743,15 +738,36 @@ static void __init kernel_add_sysfs_param(const char *name,
                                            "%s", name);
                 if (err) {
                         kobject_put(&mk->kobj);
-                        printk(KERN_ERR "Module '%s' failed add to sysfs, "
-                               "error number %d\n", name, err);
-                        printk(KERN_ERR "The system will be unstable now.\n");
-                        return;
+                        printk(KERN_ERR
+                                "Module '%s' failed add to sysfs, error number %d\n",
+                                name, err);
+                        printk(KERN_ERR
+                                "The system will be unstable now.\n");
+                        return NULL;
                 }
-                /* So that exit path is even. */
+
+                /* So that we hold reference in both cases. */
                 kobject_get(&mk->kobj);
         }
 
+        return mk;
+}
+
+static void __init kernel_add_sysfs_param(const char *name,
+                                          struct kernel_param *kparam,
+                                          unsigned int name_skip)
+{
+        struct module_kobject *mk;
+        int err;
+
+        mk = locate_module_kobject(name);
+        if (!mk)
+                return;
+
+        /* We need to remove old parameters before adding more. */
+        if (mk->mp)
+                sysfs_remove_group(&mk->kobj, &mk->mp->grp);
+
         /* These should not fail at boot. */
         err = add_sysfs_param(mk, kparam, kparam->name + name_skip);
         BUG_ON(err);
@@ -796,6 +812,32 @@ static void __init param_sysfs_builtin(void)
         }
 }
 
+ssize_t __modver_version_show(struct module_attribute *mattr,
+                              struct module *mod, char *buf)
+{
+        struct module_version_attribute *vattr =
+                container_of(mattr, struct module_version_attribute, mattr);
+
+        return sprintf(buf, "%s\n", vattr->version);
+}
+
+extern struct module_version_attribute __start___modver[], __stop___modver[];
+
+static void __init version_sysfs_builtin(void)
+{
+        const struct module_version_attribute *vattr;
+        struct module_kobject *mk;
+        int err;
+
+        for (vattr = __start___modver; vattr < __stop___modver; vattr++) {
+                mk = locate_module_kobject(vattr->module_name);
+                if (mk) {
+                        err = sysfs_create_file(&mk->kobj, &vattr->mattr.attr);
+                        kobject_uevent(&mk->kobj, KOBJ_ADD);
+                        kobject_put(&mk->kobj);
+                }
+        }
+}
 
 /* module-related sysfs stuff */
 
@@ -875,6 +917,7 @@ static int __init param_sysfs_init(void)
         }
         module_sysfs_initialized = 1;
 
+        version_sysfs_builtin();
         param_sysfs_builtin();
 
         return 0;
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 05ebe841270..999835b6112 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -1901,11 +1901,12 @@ static void __perf_event_read(void *info)
                 return;
 
         raw_spin_lock(&ctx->lock);
-        update_context_time(ctx);
+        if (ctx->is_active)
+                update_context_time(ctx);
         update_event_times(event);
+        if (event->state == PERF_EVENT_STATE_ACTIVE)
+                event->pmu->read(event);
         raw_spin_unlock(&ctx->lock);
-
-        event->pmu->read(event);
 }
 
 static inline u64 perf_event_count(struct perf_event *event)
@@ -1999,8 +2000,7 @@ static int alloc_callchain_buffers(void)
          * accessed from NMI. Use a temporary manual per cpu allocation
          * until that gets sorted out.
          */
-        size = sizeof(*entries) + sizeof(struct perf_callchain_entry *) *
-                num_possible_cpus();
+        size = offsetof(struct callchain_cpus_entries, cpu_entries[nr_cpu_ids]);
 
         entries = kzalloc(size, GFP_KERNEL);
         if (!entries)
@@ -2201,13 +2201,6 @@ find_lively_task_by_vpid(pid_t vpid)
         if (!task)
                 return ERR_PTR(-ESRCH);
 
-        /*
-         * Can't attach events to a dying task.
-         */
-        err = -ESRCH;
-        if (task->flags & PF_EXITING)
-                goto errout;
-
         /* Reuse ptrace permission checks for now. */
         err = -EACCES;
         if (!ptrace_may_access(task, PTRACE_MODE_READ))
@@ -2228,14 +2221,11 @@ find_get_context(struct pmu *pmu, struct task_struct *task, int cpu)
         unsigned long flags;
         int ctxn, err;
 
-        if (!task && cpu != -1) {
+        if (!task) {
                 /* Must be root to operate on a CPU event: */
                 if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
                         return ERR_PTR(-EACCES);
 
-                if (cpu < 0 || cpu >= nr_cpumask_bits)
-                        return ERR_PTR(-EINVAL);
-
                 /*
                  * We could be clever and allow to attach a event to an
                  * offline CPU and activate it when the CPU comes up, but
@@ -2271,14 +2261,27 @@ retry:
 
                 get_ctx(ctx);
 
-                if (cmpxchg(&task->perf_event_ctxp[ctxn], NULL, ctx)) {
-                        /*
-                         * We raced with some other task; use
-                         * the context they set.
-                         */
+                err = 0;
+                mutex_lock(&task->perf_event_mutex);
+                /*
+                 * If it has already passed perf_event_exit_task().
+                 * we must see PF_EXITING, it takes this mutex too.
+                 */
+                if (task->flags & PF_EXITING)
+                        err = -ESRCH;
+                else if (task->perf_event_ctxp[ctxn])
+                        err = -EAGAIN;
+                else
+                        rcu_assign_pointer(task->perf_event_ctxp[ctxn], ctx);
+                mutex_unlock(&task->perf_event_mutex);
+
+                if (unlikely(err)) {
                         put_task_struct(task);
                         kfree(ctx);
-                        goto retry;
+
+                        if (err == -EAGAIN)
+                                goto retry;
+                        goto errout;
                 }
         }
 
@@ -5377,6 +5380,8 @@ free_dev:
         goto out;
 }
 
+static struct lock_class_key cpuctx_mutex;
+
 int perf_pmu_register(struct pmu *pmu, char *name, int type)
 {
         int cpu, ret;
@@ -5425,6 +5430,7 @@ skip_type:
 
                 cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
                 __perf_event_init_context(&cpuctx->ctx);
+                lockdep_set_class(&cpuctx->ctx.mutex, &cpuctx_mutex);
                 cpuctx->ctx.type = cpu_context;
                 cpuctx->ctx.pmu = pmu;
                 cpuctx->jiffies_interval = 1;
@@ -5541,6 +5547,11 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
         struct hw_perf_event *hwc;
         long err;
 
+        if ((unsigned)cpu >= nr_cpu_ids) {
+                if (!task || cpu != -1)
+                        return ERR_PTR(-EINVAL);
+        }
+
         event = kzalloc(sizeof(*event), GFP_KERNEL);
         if (!event)
                 return ERR_PTR(-ENOMEM);
@@ -5589,7 +5600,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
 
         if (!overflow_handler && parent_event)
                 overflow_handler = parent_event->overflow_handler;
-        
+
         event->overflow_handler = overflow_handler;
 
         if (attr->disabled)
@@ -6125,7 +6136,7 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
          * scheduled, so we are now safe from rescheduling changing
          * our context.
          */
-        child_ctx = child->perf_event_ctxp[ctxn];
+        child_ctx = rcu_dereference_raw(child->perf_event_ctxp[ctxn]);
         task_ctx_sched_out(child_ctx, EVENT_ALL);
 
         /*
@@ -6438,11 +6449,6 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
         unsigned long flags;
         int ret = 0;
 
-        child->perf_event_ctxp[ctxn] = NULL;
-
-        mutex_init(&child->perf_event_mutex);
-        INIT_LIST_HEAD(&child->perf_event_list);
-
         if (likely(!parent->perf_event_ctxp[ctxn]))
                 return 0;
 
@@ -6494,7 +6500,6 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
 
         raw_spin_lock_irqsave(&parent_ctx->lock, flags);
         parent_ctx->rotate_disable = 0;
-        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
 
         child_ctx = child->perf_event_ctxp[ctxn];
 
@@ -6502,12 +6507,11 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
                 /*
                  * Mark the child context as a clone of the parent
                  * context, or of whatever the parent is a clone of.
-                 * Note that if the parent is a clone, it could get
-                 * uncloned at any point, but that doesn't matter
-                 * because the list of events and the generation
-                 * count can't have changed since we took the mutex.
+                 *
+                 * Note that if the parent is a clone, the holding of
+                 * parent_ctx->lock avoids it from being uncloned.
                  */
-                cloned_ctx = rcu_dereference(parent_ctx->parent_ctx);
+                cloned_ctx = parent_ctx->parent_ctx;
                 if (cloned_ctx) {
                         child_ctx->parent_ctx = cloned_ctx;
                         child_ctx->parent_gen = parent_ctx->parent_gen;
@@ -6518,6 +6522,7 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
                 get_ctx(child_ctx->parent_ctx);
         }
 
+        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
         mutex_unlock(&parent_ctx->mutex);
 
         perf_unpin_context(parent_ctx);
@@ -6532,6 +6537,10 @@ int perf_event_init_task(struct task_struct *child)
 {
         int ctxn, ret;
 
+        memset(child->perf_event_ctxp, 0, sizeof(child->perf_event_ctxp));
+        mutex_init(&child->perf_event_mutex);
+        INIT_LIST_HEAD(&child->perf_event_list);
+
         for_each_task_context_nr(ctxn) {
                 ret = perf_event_init_context(child, ctxn);
                 if (ret)
diff --git a/kernel/printk.c b/kernel/printk.c
index 53d9a9ec88e..2ddbdc73aad 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -97,7 +97,7 @@ static int console_locked, console_suspended;
 /*
  * logbuf_lock protects log_buf, log_start, log_end, con_start and logged_chars
  * It is also used in interesting ways to provide interlocking in
- * release_console_sem().
+ * console_unlock();.
  */
 static DEFINE_SPINLOCK(logbuf_lock);
 
@@ -501,7 +501,7 @@ static void _call_console_drivers(unsigned start,
 /*
  * Call the console drivers, asking them to write out
  * log_buf[start] to log_buf[end - 1].
- * The console_sem must be held.
+ * The console_lock must be held.
  */
 static void call_console_drivers(unsigned start, unsigned end)
 {
@@ -604,11 +604,11 @@ static int have_callable_console(void)
  *
  * This is printk().  It can be called from any context.  We want it to work.
  *
- * We try to grab the console_sem.  If we succeed, it's easy - we log the output and
+ * We try to grab the console_lock.  If we succeed, it's easy - we log the output and
  * call the console drivers.  If we fail to get the semaphore we place the output
  * into the log buffer and return.  The current holder of the console_sem will
- * notice the new output in release_console_sem() and will send it to the
- * consoles before releasing the semaphore.
+ * notice the new output in console_unlock(); and will send it to the
+ * consoles before releasing the lock.
  *
  * One effect of this deferred printing is that code which calls printk() and
  * then changes console_loglevel may break. This is because console_loglevel
@@ -659,19 +659,19 @@ static inline int can_use_console(unsigned int cpu)
 /*
  * Try to get console ownership to actually show the kernel
  * messages from a 'printk'. Return true (and with the
- * console_semaphore held, and 'console_locked' set) if it
+ * console_lock held, and 'console_locked' set) if it
  * is successful, false otherwise.
  *
  * This gets called with the 'logbuf_lock' spinlock held and
  * interrupts disabled. It should return with 'lockbuf_lock'
  * released but interrupts still disabled.
  */
-static int acquire_console_semaphore_for_printk(unsigned int cpu)
+static int console_trylock_for_printk(unsigned int cpu)
         __releases(&logbuf_lock)
 {
         int retval = 0;
 
-        if (!try_acquire_console_sem()) {
+        if (console_trylock()) {
                 retval = 1;
 
                 /*
@@ -827,12 +827,12 @@ asmlinkage int vprintk(const char *fmt, va_list args)
          * actual magic (print out buffers, wake up klogd,
          * etc). 
          *
-         * The acquire_console_semaphore_for_printk() function
+         * The console_trylock_for_printk() function
          * will release 'logbuf_lock' regardless of whether it
          * actually gets the semaphore or not.
          */
-        if (acquire_console_semaphore_for_printk(this_cpu))
-                release_console_sem();
+        if (console_trylock_for_printk(this_cpu))
+                console_unlock();
 
         lockdep_on();
 out_restore_irqs:
@@ -993,7 +993,7 @@ void suspend_console(void)
         if (!console_suspend_enabled)
                 return;
         printk("Suspending console(s) (use no_console_suspend to debug)\n");
-        acquire_console_sem();
+        console_lock();
         console_suspended = 1;
         up(&console_sem);
 }
@@ -1004,7 +1004,7 @@ void resume_console(void)
                 return;
         down(&console_sem);
         console_suspended = 0;
-        release_console_sem();
+        console_unlock();
 }
 
 /**
@@ -1027,21 +1027,21 @@ static int __cpuinit console_cpu_notify(struct notifier_block *self,
         case CPU_DYING:
         case CPU_DOWN_FAILED:
         case CPU_UP_CANCELED:
-                acquire_console_sem();
-                release_console_sem();
+                console_lock();
+                console_unlock();
         }
         return NOTIFY_OK;
 }
 
 /**
- * acquire_console_sem - lock the console system for exclusive use.
+ * console_lock - lock the console system for exclusive use.
  *
- * Acquires a semaphore which guarantees that the caller has
+ * Acquires a lock which guarantees that the caller has
  * exclusive access to the console system and the console_drivers list.
  *
  * Can sleep, returns nothing.
  */
-void acquire_console_sem(void)
+void console_lock(void)
 {
         BUG_ON(in_interrupt());
         down(&console_sem);
@@ -1050,21 +1050,29 @@ void acquire_console_sem(void)
         console_locked = 1;
         console_may_schedule = 1;
 }
-EXPORT_SYMBOL(acquire_console_sem);
+EXPORT_SYMBOL(console_lock);
 
-int try_acquire_console_sem(void)
+/**
+ * console_trylock - try to lock the console system for exclusive use.
+ *
+ * Tried to acquire a lock which guarantees that the caller has
+ * exclusive access to the console system and the console_drivers list.
+ *
+ * returns 1 on success, and 0 on failure to acquire the lock.
+ */
+int console_trylock(void)
 {
         if (down_trylock(&console_sem))
-                return -1;
+                return 0;
         if (console_suspended) {
                 up(&console_sem);
-                return -1;
+                return 0;
         }
         console_locked = 1;
         console_may_schedule = 0;
-        return 0;
+        return 1;
 }
-EXPORT_SYMBOL(try_acquire_console_sem);
+EXPORT_SYMBOL(console_trylock);
 
 int is_console_locked(void)
 {
@@ -1095,20 +1103,20 @@ void wake_up_klogd(void)
 }
 
 /**
- * release_console_sem - unlock the console system
+ * console_unlock - unlock the console system
  *
- * Releases the semaphore which the caller holds on the console system
+ * Releases the console_lock which the caller holds on the console system
  * and the console driver list.
  *
- * While the semaphore was held, console output may have been buffered
- * by printk().  If this is the case, release_console_sem() emits
- * the output prior to releasing the semaphore.
+ * While the console_lock was held, console output may have been buffered
+ * by printk().  If this is the case, console_unlock(); emits
+ * the output prior to releasing the lock.
  *
  * If there is output waiting for klogd, we wake it up.
  *
- * release_console_sem() may be called from any context.
+ * console_unlock(); may be called from any context.
  */
-void release_console_sem(void)
+void console_unlock(void)
 {
         unsigned long flags;
         unsigned _con_start, _log_end;
@@ -1141,7 +1149,7 @@ void release_console_sem(void)
         if (wake_klogd)
                 wake_up_klogd();
 }
-EXPORT_SYMBOL(release_console_sem);
+EXPORT_SYMBOL(console_unlock);
 
 /**
  * console_conditional_schedule - yield the CPU if required
@@ -1150,7 +1158,7 @@ EXPORT_SYMBOL(release_console_sem);
  * if this CPU should yield the CPU to another task, do
  * so here.
  *
- * Must be called within acquire_console_sem().
+ * Must be called within console_lock();.
  */
 void __sched console_conditional_schedule(void)
 {
@@ -1171,14 +1179,14 @@ void console_unblank(void)
                 if (down_trylock(&console_sem) != 0)
                         return;
         } else
-                acquire_console_sem();
+                console_lock();
 
         console_locked = 1;
         console_may_schedule = 0;
         for_each_console(c)
                 if ((c->flags & CON_ENABLED) && c->unblank)
                         c->unblank();
-        release_console_sem();
+        console_unlock();
 }
 
 /*
@@ -1189,7 +1197,7 @@ struct tty_driver *console_device(int *index)
         struct console *c;
         struct tty_driver *driver = NULL;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(c) {
                 if (!c->device)
                         continue;
@@ -1197,7 +1205,7 @@ struct tty_driver *console_device(int *index)
                 if (driver)
                         break;
         }
-        release_console_sem();
+        console_unlock();
         return driver;
 }
 
@@ -1208,17 +1216,17 @@ struct tty_driver *console_device(int *index)
  */
 void console_stop(struct console *console)
 {
-        acquire_console_sem();
+        console_lock();
         console->flags &= ~CON_ENABLED;
-        release_console_sem();
+        console_unlock();
 }
 EXPORT_SYMBOL(console_stop);
 
 void console_start(struct console *console)
 {
-        acquire_console_sem();
+        console_lock();
         console->flags |= CON_ENABLED;
-        release_console_sem();
+        console_unlock();
 }
 EXPORT_SYMBOL(console_start);
 
@@ -1340,7 +1348,7 @@ void register_console(struct console *newcon)
          *      Put this console in the list - keep the
          *      preferred driver at the head of the list.
          */
-        acquire_console_sem();
+        console_lock();
         if ((newcon->flags & CON_CONSDEV) || console_drivers == NULL) {
                 newcon->next = console_drivers;
                 console_drivers = newcon;
@@ -1352,14 +1360,14 @@ void register_console(struct console *newcon)
         }
         if (newcon->flags & CON_PRINTBUFFER) {
                 /*
-                 * release_console_sem() will print out the buffered messages
+                 * console_unlock(); will print out the buffered messages
                  * for us.
                  */
                 spin_lock_irqsave(&logbuf_lock, flags);
                 con_start = log_start;
                 spin_unlock_irqrestore(&logbuf_lock, flags);
         }
-        release_console_sem();
+        console_unlock();
         console_sysfs_notify();
 
         /*
@@ -1396,7 +1404,7 @@ int unregister_console(struct console *console)
                 return braille_unregister_console(console);
 #endif
 
-        acquire_console_sem();
+        console_lock();
         if (console_drivers == console) {
                 console_drivers=console->next;
                 res = 0;
@@ -1418,7 +1426,7 @@ int unregister_console(struct console *console)
         if (console_drivers != NULL && console->flags & CON_CONSDEV)
                 console_drivers->flags |= CON_CONSDEV;
 
-        release_console_sem();
+        console_unlock();
         console_sysfs_notify();
         return res;
 }
diff --git a/kernel/sched.c b/kernel/sched.c
index ea3e5eff387..18d38e4ec7b 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -553,9 +553,6 @@ struct rq {
         /* try_to_wake_up() stats */
         unsigned int ttwu_count;
         unsigned int ttwu_local;
-
-        /* BKL stats */
-        unsigned int bkl_count;
 #endif
 };
 
@@ -609,6 +606,9 @@ static inline struct task_group *task_group(struct task_struct *p)
         struct task_group *tg;
         struct cgroup_subsys_state *css;
 
+        if (p->flags & PF_EXITING)
+                return &root_task_group;
+
         css = task_subsys_state_check(p, cpu_cgroup_subsys_id,
                         lockdep_is_held(&task_rq(p)->lock));
         tg = container_of(css, struct task_group, css);
@@ -3887,7 +3887,7 @@ static inline void schedule_debug(struct task_struct *prev)
         schedstat_inc(this_rq(), sched_count);
 #ifdef CONFIG_SCHEDSTATS
         if (unlikely(prev->lock_depth >= 0)) {
-                schedstat_inc(this_rq(), bkl_count);
+                schedstat_inc(this_rq(), rq_sched_info.bkl_count);
                 schedstat_inc(prev, sched_info.bkl_count);
         }
 #endif
@@ -4871,7 +4871,8 @@ recheck:
                  * assigned.
                  */
                 if (rt_bandwidth_enabled() && rt_policy(policy) &&
-                                task_group(p)->rt_bandwidth.rt_runtime == 0) {
+                                task_group(p)->rt_bandwidth.rt_runtime == 0 &&
+                                !task_group_is_autogroup(task_group(p))) {
                         __task_rq_unlock(rq);
                         raw_spin_unlock_irqrestore(&p->pi_lock, flags);
                         return -EPERM;
@@ -8882,6 +8883,20 @@ cpu_cgroup_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
         }
 }
 
+static void
+cpu_cgroup_exit(struct cgroup_subsys *ss, struct task_struct *task)
+{
+        /*
+         * cgroup_exit() is called in the copy_process() failure path.
+         * Ignore this case since the task hasn't ran yet, this avoids
+         * trying to poke a half freed task state from generic code.
+         */
+        if (!(task->flags & PF_EXITING))
+                return;
+
+        sched_move_task(task);
+}
+
 #ifdef CONFIG_FAIR_GROUP_SCHED
 static int cpu_shares_write_u64(struct cgroup *cgrp, struct cftype *cftype,
                                 u64 shareval)
@@ -8954,6 +8969,7 @@ struct cgroup_subsys cpu_cgroup_subsys = {
         .destroy        = cpu_cgroup_destroy,
         .can_attach     = cpu_cgroup_can_attach,
         .attach         = cpu_cgroup_attach,
+        .exit           = cpu_cgroup_exit,
         .populate       = cpu_cgroup_populate,
         .subsys_id      = cpu_cgroup_subsys_id,
         .early_init     = 1,
diff --git a/kernel/sched_autogroup.c b/kernel/sched_autogroup.c
index 32a723b8f84..9fb65628315 100644
--- a/kernel/sched_autogroup.c
+++ b/kernel/sched_autogroup.c
@@ -27,6 +27,11 @@ static inline void autogroup_destroy(struct kref *kref)
 {
         struct autogroup *ag = container_of(kref, struct autogroup, kref);
 
+#ifdef CONFIG_RT_GROUP_SCHED
+        /* We've redirected RT tasks to the root task group... */
+        ag->tg->rt_se = NULL;
+        ag->tg->rt_rq = NULL;
+#endif
         sched_destroy_group(ag->tg);
 }
 
@@ -55,6 +60,10 @@ static inline struct autogroup *autogroup_task_get(struct task_struct *p)
         return ag;
 }
 
+#ifdef CONFIG_RT_GROUP_SCHED
+static void free_rt_sched_group(struct task_group *tg);
+#endif
+
 static inline struct autogroup *autogroup_create(void)
 {
         struct autogroup *ag = kzalloc(sizeof(*ag), GFP_KERNEL);
@@ -72,6 +81,19 @@ static inline struct autogroup *autogroup_create(void)
         init_rwsem(&ag->lock);
         ag->id = atomic_inc_return(&autogroup_seq_nr);
         ag->tg = tg;
+#ifdef CONFIG_RT_GROUP_SCHED
+        /*
+         * Autogroup RT tasks are redirected to the root task group
+         * so we don't have to move tasks around upon policy change,
+         * or flail around trying to allocate bandwidth on the fly.
+         * A bandwidth exception in __sched_setscheduler() allows
+         * the policy change to proceed.  Thereafter, task_group()
+         * returns &root_task_group, so zero bandwidth is required.
+         */
+        free_rt_sched_group(tg);
+        tg->rt_se = root_task_group.rt_se;
+        tg->rt_rq = root_task_group.rt_rq;
+#endif
         tg->autogroup = ag;
 
         return ag;
@@ -106,6 +128,11 @@ task_wants_autogroup(struct task_struct *p, struct task_group *tg)
         return true;
 }
 
+static inline bool task_group_is_autogroup(struct task_group *tg)
+{
+        return tg != &root_task_group && tg->autogroup;
+}
+
 static inline struct task_group *
 autogroup_task_group(struct task_struct *p, struct task_group *tg)
 {
@@ -231,6 +258,11 @@ void proc_sched_autogroup_show_task(struct task_struct *p, struct seq_file *m)
 #ifdef CONFIG_SCHED_DEBUG
 static inline int autogroup_path(struct task_group *tg, char *buf, int buflen)
 {
+        int enabled = ACCESS_ONCE(sysctl_sched_autogroup_enabled);
+
+        if (!enabled || !tg->autogroup)
+                return 0;
+
         return snprintf(buf, buflen, "%s-%ld", "/autogroup", tg->autogroup->id);
 }
 #endif /* CONFIG_SCHED_DEBUG */
diff --git a/kernel/sched_autogroup.h b/kernel/sched_autogroup.h
index 5358e241cb2..7b859ffe5da 100644
--- a/kernel/sched_autogroup.h
+++ b/kernel/sched_autogroup.h
@@ -15,6 +15,10 @@ autogroup_task_group(struct task_struct *p, struct task_group *tg);
 
 static inline void autogroup_init(struct task_struct *init_task) {  }
 static inline void autogroup_free(struct task_group *tg) { }
+static inline bool task_group_is_autogroup(struct task_group *tg)
+{
+        return 0;
+}
 
 static inline struct task_group *
 autogroup_task_group(struct task_struct *p, struct task_group *tg)
diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
index 1dfae3d014b..eb6cb8edd07 100644
--- a/kernel/sched_debug.c
+++ b/kernel/sched_debug.c
@@ -16,6 +16,8 @@
 #include <linux/kallsyms.h>
 #include <linux/utsname.h>
 
+static DEFINE_SPINLOCK(sched_debug_lock);
+
 /*
  * This allows printing both to /proc/sched_debug and
  * to the console
@@ -86,6 +88,26 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group
 }
 #endif
 
+#ifdef CONFIG_CGROUP_SCHED
+static char group_path[PATH_MAX];
+
+static char *task_group_path(struct task_group *tg)
+{
+        if (autogroup_path(tg, group_path, PATH_MAX))
+                return group_path;
+
+        /*
+         * May be NULL if the underlying cgroup isn't fully-created yet
+         */
+        if (!tg->css.cgroup) {
+                group_path[0] = '\0';
+                return group_path;
+        }
+        cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
+        return group_path;
+}
+#endif
+
 static void
 print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
 {
@@ -108,6 +130,9 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
         SEQ_printf(m, "%15Ld %15Ld %15Ld.%06ld %15Ld.%06ld %15Ld.%06ld",
                 0LL, 0LL, 0LL, 0L, 0LL, 0L, 0LL, 0L);
 #endif
+#ifdef CONFIG_CGROUP_SCHED
+        SEQ_printf(m, " %s", task_group_path(task_group(p)));
+#endif
 
         SEQ_printf(m, "\n");
 }
@@ -144,7 +169,11 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
         struct sched_entity *last;
         unsigned long flags;
 
+#ifdef CONFIG_FAIR_GROUP_SCHED
+        SEQ_printf(m, "\ncfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
+#else
         SEQ_printf(m, "\ncfs_rq[%d]:\n", cpu);
+#endif
         SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "exec_clock",
                         SPLIT_NS(cfs_rq->exec_clock));
 
@@ -191,7 +220,11 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
 
 void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq)
 {
+#ifdef CONFIG_RT_GROUP_SCHED
+        SEQ_printf(m, "\nrt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
+#else
         SEQ_printf(m, "\nrt_rq[%d]:\n", cpu);
+#endif
 
 #define P(x) \
         SEQ_printf(m, "  .%-30s: %Ld\n", #x, (long long)(rt_rq->x))
@@ -212,6 +245,7 @@ extern __read_mostly int sched_clock_running;
 static void print_cpu(struct seq_file *m, int cpu)
 {
         struct rq *rq = cpu_rq(cpu);
+        unsigned long flags;
 
 #ifdef CONFIG_X86
         {
@@ -262,14 +296,20 @@ static void print_cpu(struct seq_file *m, int cpu)
         P(ttwu_count);
         P(ttwu_local);
 
-        P(bkl_count);
+        SEQ_printf(m, "  .%-30s: %d\n", "bkl_count",
+                                rq->rq_sched_info.bkl_count);
 
 #undef P
+#undef P64
 #endif
+        spin_lock_irqsave(&sched_debug_lock, flags);
         print_cfs_stats(m, cpu);
         print_rt_stats(m, cpu);
 
+        rcu_read_lock();
         print_rq(m, rq, cpu);
+        rcu_read_unlock();
+        spin_unlock_irqrestore(&sched_debug_lock, flags);
 }
 
 static const char *sched_tunable_scaling_names[] = {
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index c62ebae65cf..0c26e2df450 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -699,7 +699,8 @@ account_entity_dequeue(struct cfs_rq *cfs_rq, struct sched_entity *se)
         cfs_rq->nr_running--;
 }
 
-#if defined CONFIG_SMP && defined CONFIG_FAIR_GROUP_SCHED
+#ifdef CONFIG_FAIR_GROUP_SCHED
+# ifdef CONFIG_SMP
 static void update_cfs_rq_load_contribution(struct cfs_rq *cfs_rq,
                                             int global_update)
 {
@@ -721,10 +722,10 @@ static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
         u64 now, delta;
         unsigned long load = cfs_rq->load.weight;
 
-        if (!cfs_rq)
+        if (cfs_rq->tg == &root_task_group)
                 return;
 
-        now = rq_of(cfs_rq)->clock;
+        now = rq_of(cfs_rq)->clock_task;
         delta = now - cfs_rq->load_stamp;
 
         /* truncate load history at 4 idle periods */
@@ -762,6 +763,51 @@ static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
                 list_del_leaf_cfs_rq(cfs_rq);
 }
 
+static long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg,
+                                long weight_delta)
+{
+        long load_weight, load, shares;
+
+        load = cfs_rq->load.weight + weight_delta;
+
+        load_weight = atomic_read(&tg->load_weight);
+        load_weight -= cfs_rq->load_contribution;
+        load_weight += load;
+
+        shares = (tg->shares * load);
+        if (load_weight)
+                shares /= load_weight;
+
+        if (shares < MIN_SHARES)
+                shares = MIN_SHARES;
+        if (shares > tg->shares)
+                shares = tg->shares;
+
+        return shares;
+}
+
+static void update_entity_shares_tick(struct cfs_rq *cfs_rq)
+{
+        if (cfs_rq->load_unacc_exec_time > sysctl_sched_shares_window) {
+                update_cfs_load(cfs_rq, 0);
+                update_cfs_shares(cfs_rq, 0);
+        }
+}
+# else /* CONFIG_SMP */
+static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
+{
+}
+
+static inline long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg,
+                                long weight_delta)
+{
+        return tg->shares;
+}
+
+static inline void update_entity_shares_tick(struct cfs_rq *cfs_rq)
+{
+}
+# endif /* CONFIG_SMP */
 static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
                             unsigned long weight)
 {
@@ -782,41 +828,20 @@ static void update_cfs_shares(struct cfs_rq *cfs_rq, long weight_delta)
 {
         struct task_group *tg;
         struct sched_entity *se;
-        long load_weight, load, shares;
-
-        if (!cfs_rq)
-                return;
+        long shares;
 
         tg = cfs_rq->tg;
         se = tg->se[cpu_of(rq_of(cfs_rq))];
         if (!se)
                 return;
-
-        load = cfs_rq->load.weight + weight_delta;
-
-        load_weight = atomic_read(&tg->load_weight);
-        load_weight -= cfs_rq->load_contribution;
-        load_weight += load;
-
-        shares = (tg->shares * load);
-        if (load_weight)
-                shares /= load_weight;
-
-        if (shares < MIN_SHARES)
-                shares = MIN_SHARES;
-        if (shares > tg->shares)
-                shares = tg->shares;
+#ifndef CONFIG_SMP
+        if (likely(se->load.weight == tg->shares))
+                return;
+#endif
+        shares = calc_cfs_shares(cfs_rq, tg, weight_delta);
 
         reweight_entity(cfs_rq_of(se), se, shares);
 }
-
-static void update_entity_shares_tick(struct cfs_rq *cfs_rq)
-{
-        if (cfs_rq->load_unacc_exec_time > sysctl_sched_shares_window) {
-                update_cfs_load(cfs_rq, 0);
-                update_cfs_shares(cfs_rq, 0);
-        }
-}
 #else /* CONFIG_FAIR_GROUP_SCHED */
 static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
 {
@@ -1062,6 +1087,9 @@ check_preempt_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr)
                 struct sched_entity *se = __pick_next_entity(cfs_rq);
                 s64 delta = curr->vruntime - se->vruntime;
 
+                if (delta < 0)
+                        return;
+
                 if (delta > ideal_runtime)
                         resched_task(rq_of(cfs_rq)->curr);
         }
@@ -1362,27 +1390,27 @@ static long effective_load(struct task_group *tg, int cpu, long wl, long wg)
                 return wl;
 
         for_each_sched_entity(se) {
-                long S, rw, s, a, b;
+                long lw, w;
 
-                S = se->my_q->tg->shares;
-                s = se->load.weight;
-                rw = se->my_q->load.weight;
+                tg = se->my_q->tg;
+                w = se->my_q->load.weight;
 
-                a = S*(rw + wl);
-                b = S*rw + s*wg;
+                /* use this cpu's instantaneous contribution */
+                lw = atomic_read(&tg->load_weight);
+                lw -= se->my_q->load_contribution;
+                lw += w + wg;
 
-                wl = s*(a-b);
+                wl += w;
 
-                if (likely(b))
-                        wl /= b;
+                if (lw > 0 && wl < lw)
+                        wl = (wl * tg->shares) / lw;
+                else
+                        wl = tg->shares;
 
-                /*
-                 * Assume the group is already running and will
-                 * thus already be accounted for in the weight.
-                 *
-                 * That is, moving shares between CPUs, does not
-                 * alter the group weight.
-                 */
+                /* zero point is MIN_SHARES */
+                if (wl < MIN_SHARES)
+                        wl = MIN_SHARES;
+                wl -= se->load.weight;
                 wg = 0;
         }
 
@@ -1401,7 +1429,7 @@ static inline unsigned long effective_load(struct task_group *tg, int cpu,
 
 static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
 {
-        unsigned long this_load, load;
+        s64 this_load, load;
         int idx, this_cpu, prev_cpu;
         unsigned long tl_per_task;
         struct task_group *tg;
@@ -1440,8 +1468,8 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
          * Otherwise check if either cpus are near enough in load to allow this
          * task to be woken on this_cpu.
          */
-        if (this_load) {
-                unsigned long this_eff_load, prev_eff_load;
+        if (this_load > 0) {
+                s64 this_eff_load, prev_eff_load;
 
                 this_eff_load = 100;
                 this_eff_load *= power_of(prev_cpu);
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index c914ec747ca..ad6267714c8 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -625,7 +625,7 @@ static void update_curr_rt(struct rq *rq)
         struct rt_rq *rt_rq = rt_rq_of_se(rt_se);
         u64 delta_exec;
 
-        if (!task_has_rt_policy(curr))
+        if (curr->sched_class != &rt_sched_class)
                 return;
 
         delta_exec = rq->clock_task - curr->se.exec_start;
diff --git a/kernel/smp.c b/kernel/smp.c
index 4ec30e06998..9910744f085 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -194,23 +194,52 @@ void generic_smp_call_function_interrupt(void)
          */
         list_for_each_entry_rcu(data, &call_function.queue, csd.list) {
                 int refs;
+                void (*func) (void *info);
 
-                if (!cpumask_test_and_clear_cpu(cpu, data->cpumask))
+                /*
+                 * Since we walk the list without any locks, we might
+                 * see an entry that was completed, removed from the
+                 * list and is in the process of being reused.
+                 *
+                 * We must check that the cpu is in the cpumask before
+                 * checking the refs, and both must be set before
+                 * executing the callback on this cpu.
+                 */
+
+                if (!cpumask_test_cpu(cpu, data->cpumask))
+                        continue;
+
+                smp_rmb();
+
+                if (atomic_read(&data->refs) == 0)
                         continue;
 
+                func = data->csd.func;                  /* for later warn */
                 data->csd.func(data->csd.info);
 
+                /*
+                 * If the cpu mask is not still set then it enabled interrupts,
+                 * we took another smp interrupt, and executed the function
+                 * twice on this cpu.  In theory that copy decremented refs.
+                 */
+                if (!cpumask_test_and_clear_cpu(cpu, data->cpumask)) {
+                        WARN(1, "%pS enabled interrupts and double executed\n",
+                             func);
+                        continue;
+                }
+
                 refs = atomic_dec_return(&data->refs);
                 WARN_ON(refs < 0);
-                if (!refs) {
-                        raw_spin_lock(&call_function.lock);
-                        list_del_rcu(&data->csd.list);
-                        raw_spin_unlock(&call_function.lock);
-                }
 
                 if (refs)
                         continue;
 
+                WARN_ON(!cpumask_empty(data->cpumask));
+
+                raw_spin_lock(&call_function.lock);
+                list_del_rcu(&data->csd.list);
+                raw_spin_unlock(&call_function.lock);
+
                 csd_unlock(&data->csd);
         }
 
@@ -430,7 +459,7 @@ void smp_call_function_many(const struct cpumask *mask,
          * can't happen.
          */
         WARN_ON_ONCE(cpu_online(this_cpu) && irqs_disabled()
-                     && !oops_in_progress);
+                     && !oops_in_progress && !early_boot_irqs_disabled);
 
         /* So, what's a CPU they want? Ignoring this one. */
         cpu = cpumask_first_and(mask, cpu_online_mask);
@@ -454,11 +483,21 @@ void smp_call_function_many(const struct cpumask *mask,
 
         data = &__get_cpu_var(cfd_data);
         csd_lock(&data->csd);
+        BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
 
         data->csd.func = func;
         data->csd.info = info;
         cpumask_and(data->cpumask, mask, cpu_online_mask);
         cpumask_clear_cpu(this_cpu, data->cpumask);
+
+        /*
+         * To ensure the interrupt handler gets an complete view
+         * we order the cpumask and refs writes and order the read
+         * of them in the interrupt handler.  In addition we may
+         * only clear our own cpu bit from the mask.
+         */
+        smp_wmb();
+
         atomic_set(&data->refs, cpumask_weight(data->cpumask));
 
         raw_spin_lock_irqsave(&call_function.lock, flags);
@@ -533,17 +572,20 @@ void ipi_call_unlock_irq(void)
 #endif /* USE_GENERIC_SMP_HELPERS */
 
 /*
- * Call a function on all processors
+ * Call a function on all processors.  May be used during early boot while
+ * early_boot_irqs_disabled is set.  Use local_irq_save/restore() instead
+ * of local_irq_disable/enable().
  */
 int on_each_cpu(void (*func) (void *info), void *info, int wait)
 {
+        unsigned long flags;
         int ret = 0;
 
         preempt_disable();
         ret = smp_call_function(func, info, wait);
-        local_irq_disable();
+        local_irq_save(flags);
         func(info);
-        local_irq_enable();
+        local_irq_restore(flags);
         preempt_enable();
         return ret;
 }
diff --git a/kernel/sys.c b/kernel/sys.c
index 31b71a276b4..18da702ec81 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1385,7 +1385,8 @@ static int check_prlimit_permission(struct task_struct *task)
         const struct cred *cred = current_cred(), *tcred;
 
         tcred = __task_cred(task);
-        if ((cred->uid != tcred->euid ||
+        if (current != task &&
+            (cred->uid != tcred->euid ||
              cred->uid != tcred->suid ||
              cred->uid != tcred->uid  ||
              cred->gid != tcred->egid ||
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index bc86bb32e12..0f1bd83db98 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -170,7 +170,8 @@ static int proc_taint(struct ctl_table *table, int write,
 #endif
 
 #ifdef CONFIG_MAGIC_SYSRQ
-static int __sysrq_enabled; /* Note: sysrq code ises it's own private copy */
+/* Note: sysrq code uses it's own private copy */
+static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
 
 static int sysrq_sysctl_handler(ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp,
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 3e216e01bbd..c55ea243347 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -642,8 +642,7 @@ static void tick_nohz_switch_to_nohz(void)
         }
         local_irq_enable();
 
-        printk(KERN_INFO "Switched to NOHz mode on CPU #%d\n",
-               smp_processor_id());
+        printk(KERN_INFO "Switched to NOHz mode on CPU #%d\n", smp_processor_id());
 }
 
 /*
@@ -795,8 +794,10 @@ void tick_setup_sched_timer(void)
         }
 
 #ifdef CONFIG_NO_HZ
-        if (tick_nohz_enabled)
+        if (tick_nohz_enabled) {
                 ts->nohz_mode = NOHZ_MODE_HIGHRES;
+                printk(KERN_INFO "Switched to NOHz mode on CPU #%d\n", smp_processor_id());
+        }
 #endif
 }
 #endif /* HIGH_RES_TIMERS */
diff --git a/kernel/timer.c b/kernel/timer.c
index 43ca9936f2d..d53ce66daea 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -969,10 +969,14 @@ EXPORT_SYMBOL(try_to_del_timer_sync);
 int del_timer_sync(struct timer_list *timer)
 {
 #ifdef CONFIG_LOCKDEP
+        unsigned long flags;
+
+        raw_local_irq_save(flags);
         local_bh_disable();
         lock_map_acquire(&timer->lockdep_map);
         lock_map_release(&timer->lockdep_map);
-        local_bh_enable();
+        _local_bh_enable();
+        raw_local_irq_restore(flags);
 #endif
         /*
          * don't use it in hardirq context, because it
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 35fde09b81d..5f499e0438a 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1284,7 +1284,7 @@ trace_create_file_ops(struct module *mod)
 static void trace_module_add_events(struct module *mod)
 {
         struct ftrace_module_file_ops *file_ops = NULL;
-        struct ftrace_event_call *call, *start, *end;
+        struct ftrace_event_call **call, **start, **end;
 
         start = mod->trace_events;
         end = mod->trace_events + mod->num_trace_events;
@@ -1297,7 +1297,7 @@ static void trace_module_add_events(struct module *mod)
                 return;
 
         for_each_event(call, start, end) {
-                __trace_add_event_call(call, mod,
+                __trace_add_event_call(*call, mod,
                                        &file_ops->id, &file_ops->enable,
                                        &file_ops->filter, &file_ops->format);
         }
@@ -1367,8 +1367,8 @@ static struct notifier_block trace_module_nb = {
         .priority = 0,
 };
 
-extern struct ftrace_event_call __start_ftrace_events[];
-extern struct ftrace_event_call __stop_ftrace_events[];
+extern struct ftrace_event_call *__start_ftrace_events[];
+extern struct ftrace_event_call *__stop_ftrace_events[];
 
 static char bootup_event_buf[COMMAND_LINE_SIZE] __initdata;
 
@@ -1384,7 +1384,7 @@ __setup("trace_event=", setup_trace_event);
 
 static __init int event_trace_init(void)
 {
-        struct ftrace_event_call *call;
+        struct ftrace_event_call **call;
         struct dentry *d_tracer;
         struct dentry *entry;
         struct dentry *d_events;
@@ -1430,7 +1430,7 @@ static __init int event_trace_init(void)
                 pr_warning("tracing: Failed to allocate common fields");
 
         for_each_event(call, __start_ftrace_events, __stop_ftrace_events) {
-                __trace_add_event_call(call, NULL, &ftrace_event_id_fops,
+                __trace_add_event_call(*call, NULL, &ftrace_event_id_fops,
                                        &ftrace_enable_fops,
                                        &ftrace_event_filter_fops,
                                        &ftrace_event_format_fops);
diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
index 4b74d71705c..bbeec31e0ae 100644
--- a/kernel/trace/trace_export.c
+++ b/kernel/trace/trace_export.c
@@ -161,13 +161,13 @@ struct ftrace_event_class event_class_ftrace_##call = {			\
         .fields                 = LIST_HEAD_INIT(event_class_ftrace_##call.fields),\
 };                                                                      \
                                                                         \
-struct ftrace_event_call __used                                         \
-__attribute__((__aligned__(4)))                                         \
-__attribute__((section("_ftrace_events"))) event_##call = {             \
+struct ftrace_event_call __used event_##call = {                        \
         .name                   = #call,                                \
         .event.type             = etype,                                \
         .class                  = &event_class_ftrace_##call,           \
         .print_fmt              = print,                                \
 };                                                                      \
+struct ftrace_event_call __used                                         \
+__attribute__((section("_ftrace_events"))) *__event_##call = &event_##call;
 
 #include "trace_entries.h"
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 5cf8c602b88..92b6e1e12d9 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -453,14 +453,6 @@ void time_hardirqs_off(unsigned long a0, unsigned long a1)
  * Stubs:
  */
 
-void early_boot_irqs_off(void)
-{
-}
-
-void early_boot_irqs_on(void)
-{
-}
-
 void trace_softirqs_on(unsigned long ip)
 {
 }
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index b706529b4fc..5c9fe08d209 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -55,20 +55,21 @@ struct ftrace_event_class event_class_syscall_exit = {
         .raw_init       = init_syscall_trace,
 };
 
-extern unsigned long __start_syscalls_metadata[];
-extern unsigned long __stop_syscalls_metadata[];
+extern struct syscall_metadata *__start_syscalls_metadata[];
+extern struct syscall_metadata *__stop_syscalls_metadata[];
 
 static struct syscall_metadata **syscalls_metadata;
 
-static struct syscall_metadata *find_syscall_meta(unsigned long syscall)
+static __init struct syscall_metadata *
+find_syscall_meta(unsigned long syscall)
 {
-        struct syscall_metadata *start;
-        struct syscall_metadata *stop;
+        struct syscall_metadata **start;
+        struct syscall_metadata **stop;
         char str[KSYM_SYMBOL_LEN];
 
 
-        start = (struct syscall_metadata *)__start_syscalls_metadata;
-        stop = (struct syscall_metadata *)__stop_syscalls_metadata;
+        start = __start_syscalls_metadata;
+        stop = __stop_syscalls_metadata;
         kallsyms_lookup(syscall, NULL, NULL, NULL, str);
 
         for ( ; start < stop; start++) {
@@ -78,8 +79,8 @@ static struct syscall_metadata *find_syscall_meta(unsigned long syscall)
                  * with "SyS" instead of "sys", leading to an unwanted
                  * mismatch.
                  */
-                if (start->name && !strcmp(start->name + 3, str + 3))
-                        return start;
+                if ((*start)->name && !strcmp((*start)->name + 3, str + 3))
+                        return *start;
         }
         return NULL;
 }
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index e95ee7f31d4..68187af4889 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -27,8 +27,8 @@
 #include <linux/sched.h>
 #include <linux/jump_label.h>
 
-extern struct tracepoint __start___tracepoints[];
-extern struct tracepoint __stop___tracepoints[];
+extern struct tracepoint * const __start___tracepoints_ptrs[];
+extern struct tracepoint * const __stop___tracepoints_ptrs[];
 
 /* Set to 1 to enable tracepoint debug output */
 static const int tracepoint_debug;
@@ -298,10 +298,10 @@ static void disable_tracepoint(struct tracepoint *elem)
  *
  * Updates the probe callback corresponding to a range of tracepoints.
  */
-void
-tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
+void tracepoint_update_probe_range(struct tracepoint * const *begin,
+                                   struct tracepoint * const *end)
 {
-        struct tracepoint *iter;
+        struct tracepoint * const *iter;
         struct tracepoint_entry *mark_entry;
 
         if (!begin)
@@ -309,12 +309,12 @@ tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
 
         mutex_lock(&tracepoints_mutex);
         for (iter = begin; iter < end; iter++) {
-                mark_entry = get_tracepoint(iter->name);
+                mark_entry = get_tracepoint((*iter)->name);
                 if (mark_entry) {
-                        set_tracepoint(&mark_entry, iter,
+                        set_tracepoint(&mark_entry, *iter,
                                         !!mark_entry->refcount);
                 } else {
-                        disable_tracepoint(iter);
+                        disable_tracepoint(*iter);
                 }
         }
         mutex_unlock(&tracepoints_mutex);
@@ -326,8 +326,8 @@ tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
 static void tracepoint_update_probes(void)
 {
         /* Core kernel tracepoints */
-        tracepoint_update_probe_range(__start___tracepoints,
-                __stop___tracepoints);
+        tracepoint_update_probe_range(__start___tracepoints_ptrs,
+                __stop___tracepoints_ptrs);
         /* tracepoints in modules. */
         module_update_tracepoints();
 }
@@ -514,8 +514,8 @@ EXPORT_SYMBOL_GPL(tracepoint_probe_update_all);
  * Will return the first tracepoint in the range if the input tracepoint is
  * NULL.
  */
-int tracepoint_get_iter_range(struct tracepoint **tracepoint,
-        struct tracepoint *begin, struct tracepoint *end)
+int tracepoint_get_iter_range(struct tracepoint * const **tracepoint,
+        struct tracepoint * const *begin, struct tracepoint * const *end)
 {
         if (!*tracepoint && begin != end) {
                 *tracepoint = begin;
@@ -534,7 +534,8 @@ static void tracepoint_get_iter(struct tracepoint_iter *iter)
         /* Core kernel tracepoints */
         if (!iter->module) {
                 found = tracepoint_get_iter_range(&iter->tracepoint,
-                                __start___tracepoints, __stop___tracepoints);
+                                __start___tracepoints_ptrs,
+                                __stop___tracepoints_ptrs);
                 if (found)
                         goto end;
         }
@@ -585,8 +586,8 @@ int tracepoint_module_notify(struct notifier_block *self,
         switch (val) {
         case MODULE_STATE_COMING:
         case MODULE_STATE_GOING:
-                tracepoint_update_probe_range(mod->tracepoints,
-                        mod->tracepoints + mod->num_tracepoints);
+                tracepoint_update_probe_range(mod->tracepoints_ptrs,
+                        mod->tracepoints_ptrs + mod->num_tracepoints);
                 break;
         }
         return 0;
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index d7ebdf4cea9..f37f974aa81 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -27,7 +27,7 @@
 #include <asm/irq_regs.h>
 #include <linux/perf_event.h>
 
-int watchdog_enabled;
+int watchdog_enabled = 1;
 int __read_mostly softlockup_thresh = 60;
 
 static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts);
@@ -43,9 +43,6 @@ static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
 #endif
 
-static int no_watchdog;
-
-
 /* boot commands */
 /*
  * Should we panic when a soft-lockup or hard-lockup occurs:
@@ -58,7 +55,7 @@ static int __init hardlockup_panic_setup(char *str)
         if (!strncmp(str, "panic", 5))
                 hardlockup_panic = 1;
         else if (!strncmp(str, "0", 1))
-                no_watchdog = 1;
+                watchdog_enabled = 0;
         return 1;
 }
 __setup("nmi_watchdog=", hardlockup_panic_setup);
@@ -77,7 +74,7 @@ __setup("softlockup_panic=", softlockup_panic_setup);
 
 static int __init nowatchdog_setup(char *str)
 {
-        no_watchdog = 1;
+        watchdog_enabled = 0;
         return 1;
 }
 __setup("nowatchdog", nowatchdog_setup);
@@ -85,7 +82,7 @@ __setup("nowatchdog", nowatchdog_setup);
 /* deprecated */
 static int __init nosoftlockup_setup(char *str)
 {
-        no_watchdog = 1;
+        watchdog_enabled = 0;
         return 1;
 }
 __setup("nosoftlockup", nosoftlockup_setup);
@@ -432,9 +429,6 @@ static int watchdog_enable(int cpu)
                 wake_up_process(p);
         }
 
-        /* if any cpu succeeds, watchdog is considered enabled for the system */
-        watchdog_enabled = 1;
-
         return 0;
 }
 
@@ -462,12 +456,16 @@ static void watchdog_disable(int cpu)
 static void watchdog_enable_all_cpus(void)
 {
         int cpu;
-        int result = 0;
+
+        watchdog_enabled = 0;
 
         for_each_online_cpu(cpu)
-                result += watchdog_enable(cpu);
+                if (!watchdog_enable(cpu))
+                        /* if any cpu succeeds, watchdog is considered
+                           enabled for the system */
+                        watchdog_enabled = 1;
 
-        if (result)
+        if (!watchdog_enabled)
                 printk(KERN_ERR "watchdog: failed to be enabled on some cpus\n");
 
 }
@@ -476,9 +474,6 @@ static void watchdog_disable_all_cpus(void)
 {
         int cpu;
 
-        if (no_watchdog)
-                return;
-
         for_each_online_cpu(cpu)
                 watchdog_disable(cpu);
 
@@ -498,10 +493,12 @@ int proc_dowatchdog_enabled(struct ctl_table *table, int write,
 {
         proc_dointvec(table, write, buffer, length, ppos);
 
-        if (watchdog_enabled)
-                watchdog_enable_all_cpus();
-        else
-                watchdog_disable_all_cpus();
+        if (write) {
+                if (watchdog_enabled)
+                        watchdog_enable_all_cpus();
+                else
+                        watchdog_disable_all_cpus();
+        }
         return 0;
 }
 
@@ -530,7 +527,8 @@ cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 break;
         case CPU_ONLINE:
         case CPU_ONLINE_FROZEN:
-                err = watchdog_enable(hotcpu);
+                if (watchdog_enabled)
+                        err = watchdog_enable(hotcpu);
                 break;
 #ifdef CONFIG_HOTPLUG_CPU
         case CPU_UP_CANCELED:
@@ -555,9 +553,6 @@ void __init lockup_detector_init(void)
         void *cpu = (void *)(long)smp_processor_id();
         int err;
 
-        if (no_watchdog)
-                return;
-
         err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
         WARN_ON(notifier_to_errno(err));
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 8ee6ec82f88..11869faa681 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -768,7 +768,11 @@ static inline void worker_clr_flags(struct worker *worker, unsigned int flags)
 
         worker->flags &= ~flags;
 
-        /* if transitioning out of NOT_RUNNING, increment nr_running */
+        /*
+         * If transitioning out of NOT_RUNNING, increment nr_running.  Note
+         * that the nested NOT_RUNNING is not a noop.  NOT_RUNNING is mask
+         * of multiple flags, not a single flag.
+         */
         if ((flags & WORKER_NOT_RUNNING) && (oflags & WORKER_NOT_RUNNING))
                 if (!(worker->flags & WORKER_NOT_RUNNING))
                         atomic_inc(get_gcwq_nr_running(gcwq->cpu));
@@ -1840,7 +1844,7 @@ __acquires(&gcwq->lock)
         spin_unlock_irq(&gcwq->lock);
 
         work_clear_pending(work);
-        lock_map_acquire(&cwq->wq->lockdep_map);
+        lock_map_acquire_read(&cwq->wq->lockdep_map);
         lock_map_acquire(&lockdep_map);
         trace_workqueue_execute_start(work);
         f(work);
@@ -2384,8 +2388,18 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr,
         insert_wq_barrier(cwq, barr, work, worker);
         spin_unlock_irq(&gcwq->lock);
 
-        lock_map_acquire(&cwq->wq->lockdep_map);
+        /*
+         * If @max_active is 1 or rescuer is in use, flushing another work
+         * item on the same workqueue may lead to deadlock.  Make sure the
+         * flusher is not running on the same workqueue by verifying write
+         * access.
+         */
+        if (cwq->wq->saved_max_active == 1 || cwq->wq->flags & WQ_RESCUER)
+                lock_map_acquire(&cwq->wq->lockdep_map);
+        else
+                lock_map_acquire_read(&cwq->wq->lockdep_map);
         lock_map_release(&cwq->wq->lockdep_map);
+
         return true;
 already_gone:
         spin_unlock_irq(&gcwq->lock);
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 2d05adb9840..3967c2356e3 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -657,7 +657,7 @@ config DEBUG_HIGHMEM
           Disable for production systems.
 
 config DEBUG_BUGVERBOSE
-        bool "Verbose BUG() reporting (adds 70K)" if DEBUG_KERNEL && EMBEDDED
+        bool "Verbose BUG() reporting (adds 70K)" if DEBUG_KERNEL && EXPERT
         depends on BUG
         depends on ARM || AVR32 || M32R || M68K || SPARC32 || SPARC64 || \
                    FRV || SUPERH || GENERIC_BUG || BLACKFIN || MN10300
@@ -729,8 +729,8 @@ config DEBUG_WRITECOUNT
           If unsure, say N.
 
 config DEBUG_MEMORY_INIT
-        bool "Debug memory initialisation" if EMBEDDED
-        default !EMBEDDED
+        bool "Debug memory initialisation" if EXPERT
+        default !EXPERT
         help
           Enable this for additional checks during memory initialisation.
           The sanity checks verify aspects of the VM such as the memory model
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 5086bb962b4..7ea2e033d71 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -736,10 +736,11 @@ next:
                 }
         }
         /*
-         * The iftag must have been set somewhere because otherwise
-         * we would return immediated at the beginning of the function
+         * We need not to tag the root tag if there is no tag which is set with
+         * settag within the range from *first_indexp to last_index.
          */
-        root_tag_set(root, settag);
+        if (tagged > 0)
+                root_tag_set(root, settag);
         *first_indexp = index;
 
         return tagged;
diff --git a/lib/rbtree.c b/lib/rbtree.c
index 4693f79195d..a16be19a130 100644
--- a/lib/rbtree.c
+++ b/lib/rbtree.c
@@ -315,6 +315,7 @@ void rb_augment_insert(struct rb_node *node, rb_augment_f func, void *data)
 
         rb_augment_path(node, func, data);
 }
+EXPORT_SYMBOL(rb_augment_insert);
 
 /*
  * before removing the node, find the deepest node on the rebalance path
@@ -340,6 +341,7 @@ struct rb_node *rb_augment_erase_begin(struct rb_node *node)
 
         return deepest;
 }
+EXPORT_SYMBOL(rb_augment_erase_begin);
 
 /*
  * after removal, update the tree to account for the removed entry
@@ -350,6 +352,7 @@ void rb_augment_erase_end(struct rb_node *node, rb_augment_f func, void *data)
         if (node)
                 rb_augment_path(node, func, data);
 }
+EXPORT_SYMBOL(rb_augment_erase_end);
 
 /*
  * This function returns the first node (in sort order) of the tree.
diff --git a/lib/textsearch.c b/lib/textsearch.c
index d608331b3e4..e0cc0146ae6 100644
--- a/lib/textsearch.c
+++ b/lib/textsearch.c
@@ -13,7 +13,7 @@
  *
  * INTRODUCTION
  *
- *   The textsearch infrastructure provides text searching facitilies for
+ *   The textsearch infrastructure provides text searching facilities for
  *   both linear and non-linear data. Individual search algorithms are
  *   implemented in modules and chosen by the user.
  *
@@ -43,7 +43,7 @@
  *       to the algorithm to store persistent variables.
  *   (4) Core eventually resets the search offset and forwards the find()
  *       request to the algorithm.
- *   (5) Algorithm calls get_next_block() provided by the user continously
+ *   (5) Algorithm calls get_next_block() provided by the user continuously
  *       to fetch the data to be searched in block by block.
  *   (6) Algorithm invokes finish() after the last call to get_next_block
  *       to clean up any leftovers from get_next_block. (Optional)
@@ -58,15 +58,15 @@
  *   the pattern to look for and flags. As a flag, you can set TS_IGNORECASE
  *   to perform case insensitive matching. But it might slow down
  *   performance of algorithm, so you should use it at own your risk.
- *   The returned configuration may then be used for an arbitary
+ *   The returned configuration may then be used for an arbitrary
  *   amount of times and even in parallel as long as a separate struct
  *   ts_state variable is provided to every instance.
  *
  *   The actual search is performed by either calling textsearch_find_-
  *   continuous() for linear data or by providing an own get_next_block()
  *   implementation and calling textsearch_find(). Both functions return
- *   the position of the first occurrence of the patern or UINT_MAX if
- *   no match was found. Subsequent occurences can be found by calling
+ *   the position of the first occurrence of the pattern or UINT_MAX if
+ *   no match was found. Subsequent occurrences can be found by calling
  *   textsearch_next() regardless of the linearity of the data.
  *
  *   Once you're done using a configuration it must be given back via
diff --git a/lib/xz/Kconfig b/lib/xz/Kconfig
index e3b6e18fdac..60a6088d0e5 100644
--- a/lib/xz/Kconfig
+++ b/lib/xz/Kconfig
@@ -7,37 +7,37 @@ config XZ_DEC
           CRC32 is supported. See Documentation/xz.txt for more information.
 
 config XZ_DEC_X86
-        bool "x86 BCJ filter decoder" if EMBEDDED
+        bool "x86 BCJ filter decoder" if EXPERT
         default y
         depends on XZ_DEC
         select XZ_DEC_BCJ
 
 config XZ_DEC_POWERPC
-        bool "PowerPC BCJ filter decoder" if EMBEDDED
+        bool "PowerPC BCJ filter decoder" if EXPERT
         default y
         depends on XZ_DEC
         select XZ_DEC_BCJ
 
 config XZ_DEC_IA64
-        bool "IA-64 BCJ filter decoder" if EMBEDDED
+        bool "IA-64 BCJ filter decoder" if EXPERT
         default y
         depends on XZ_DEC
         select XZ_DEC_BCJ
 
 config XZ_DEC_ARM
-        bool "ARM BCJ filter decoder" if EMBEDDED
+        bool "ARM BCJ filter decoder" if EXPERT
         default y
         depends on XZ_DEC
         select XZ_DEC_BCJ
 
 config XZ_DEC_ARMTHUMB
-        bool "ARM-Thumb BCJ filter decoder" if EMBEDDED
+        bool "ARM-Thumb BCJ filter decoder" if EXPERT
         default y
         depends on XZ_DEC
         select XZ_DEC_BCJ
 
 config XZ_DEC_SPARC
-        bool "SPARC BCJ filter decoder" if EMBEDDED
+        bool "SPARC BCJ filter decoder" if EXPERT
         default y
         depends on XZ_DEC
         select XZ_DEC_BCJ
diff --git a/mm/Kconfig b/mm/Kconfig
index 3ad483bdf50..e9c0c61f2dd 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -179,7 +179,7 @@ config SPLIT_PTLOCK_CPUS
 config COMPACTION
         bool "Allow for memory compaction"
         select MIGRATION
-        depends on EXPERIMENTAL && HUGETLB_PAGE && MMU
+        depends on MMU
         help
           Allows the compaction of memory for the allocation of huge pages.
 
diff --git a/mm/compaction.c b/mm/compaction.c
index 6d592a02107..8be430b812d 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -406,6 +406,10 @@ static int compact_finished(struct zone *zone,
         if (!zone_watermark_ok(zone, cc->order, watermark, 0, 0))
                 return COMPACT_CONTINUE;
 
+        /*
+         * order == -1 is expected when compacting via
+         * /proc/sys/vm/compact_memory
+         */
         if (cc->order == -1)
                 return COMPACT_CONTINUE;
 
@@ -454,6 +458,13 @@ unsigned long compaction_suitable(struct zone *zone, int order)
                 return COMPACT_SKIPPED;
 
         /*
+         * order == -1 is expected when compacting via
+         * /proc/sys/vm/compact_memory
+         */
+        if (order == -1)
+                return COMPACT_CONTINUE;
+
+        /*
          * fragmentation index determines if allocation failures are due to
          * low memory or external fragmentation
          *
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 004c9c2aac7..b6c1ce3c53b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1162,7 +1162,12 @@ static void __split_huge_page_refcount(struct page *page)
                 /* after clearing PageTail the gup refcount can be released */
                 smp_mb();
 
-                page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP;
+                /*
+                 * retain hwpoison flag of the poisoned tail page:
+                 *   fix for the unsuitable process killed on Guest Machine(KVM)
+                 *   by the memory-failure.
+                 */
+                page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP | __PG_HWPOISON;
                 page_tail->flags |= (page->flags &
                                      ((1L << PG_referenced) |
                                       (1L << PG_swapbacked) |
@@ -1203,6 +1208,8 @@ static void __split_huge_page_refcount(struct page *page)
                 BUG_ON(!PageDirty(page_tail));
                 BUG_ON(!PageSwapBacked(page_tail));
 
+                mem_cgroup_split_huge_fixup(page, page_tail);
+
                 lru_add_page_tail(zone, page, page_tail);
         }
 
@@ -1837,9 +1844,9 @@ static void collapse_huge_page(struct mm_struct *mm,
         spin_lock(ptl);
         isolated = __collapse_huge_page_isolate(vma, address, pte);
         spin_unlock(ptl);
-        pte_unmap(pte);
 
         if (unlikely(!isolated)) {
+                pte_unmap(pte);
                 spin_lock(&mm->page_table_lock);
                 BUG_ON(!pmd_none(*pmd));
                 set_pmd_at(mm, address, pmd, _pmd);
@@ -1856,6 +1863,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         anon_vma_unlock(vma->anon_vma);
 
         __collapse_huge_page_copy(pte, new_page, vma, address, ptl);
+        pte_unmap(pte);
         __SetPageUptodate(new_page);
         pgtable = pmd_pgtable(_pmd);
         VM_BUG_ON(page_count(pgtable) != 1);
diff --git a/mm/kmemleak-test.c b/mm/kmemleak-test.c
index 177a5169bbd..ff0d9779cec 100644
--- a/mm/kmemleak-test.c
+++ b/mm/kmemleak-test.c
@@ -75,13 +75,11 @@ static int __init kmemleak_test_init(void)
          * after the module is removed.
          */
         for (i = 0; i < 10; i++) {
-                elem = kmalloc(sizeof(*elem), GFP_KERNEL);
-                pr_info("kmemleak: kmalloc(sizeof(*elem)) = %p\n", elem);
+                elem = kzalloc(sizeof(*elem), GFP_KERNEL);
+                pr_info("kmemleak: kzalloc(sizeof(*elem)) = %p\n", elem);
                 if (!elem)
                         return -ENOMEM;
-                memset(elem, 0, sizeof(*elem));
                 INIT_LIST_HEAD(&elem->list);
-
                 list_add_tail(&elem->list, &test_list);
         }
 
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index bd9bc214091..84225f3b719 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -113,7 +113,9 @@
 #define BYTES_PER_POINTER       sizeof(void *)
 
 /* GFP bitmask for kmemleak internal allocations */
-#define GFP_KMEMLEAK_MASK       (GFP_KERNEL | GFP_ATOMIC)
+#define gfp_kmemleak_mask(gfp)  (((gfp) & (GFP_KERNEL | GFP_ATOMIC)) | \
+                                 __GFP_NORETRY | __GFP_NOMEMALLOC | \
+                                 __GFP_NOWARN)
 
 /* scanning area inside a memory block */
 struct kmemleak_scan_area {
@@ -511,9 +513,10 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
         struct kmemleak_object *object;
         struct prio_tree_node *node;
 
-        object = kmem_cache_alloc(object_cache, gfp & GFP_KMEMLEAK_MASK);
+        object = kmem_cache_alloc(object_cache, gfp_kmemleak_mask(gfp));
         if (!object) {
-                kmemleak_stop("Cannot allocate a kmemleak_object structure\n");
+                pr_warning("Cannot allocate a kmemleak_object structure\n");
+                kmemleak_disable();
                 return NULL;
         }
 
@@ -734,9 +737,9 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp)
                 return;
         }
 
-        area = kmem_cache_alloc(scan_area_cache, gfp & GFP_KMEMLEAK_MASK);
+        area = kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp));
         if (!area) {
-                kmemleak_warn("Cannot allocate a scan area\n");
+                pr_warning("Cannot allocate a scan area\n");
                 goto out;
         }
 
diff --git a/mm/memblock.c b/mm/memblock.c
index 400dc62697d..bdba245d8af 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -683,13 +683,13 @@ int __init_memblock memblock_is_memory(phys_addr_t addr)
 
 int __init_memblock memblock_is_region_memory(phys_addr_t base, phys_addr_t size)
 {
-        int idx = memblock_search(&memblock.reserved, base);
+        int idx = memblock_search(&memblock.memory, base);
 
         if (idx == -1)
                 return 0;
-        return memblock.reserved.regions[idx].base <= base &&
-                (memblock.reserved.regions[idx].base +
-                 memblock.reserved.regions[idx].size) >= (base + size);
+        return memblock.memory.regions[idx].base <= base &&
+                (memblock.memory.regions[idx].base +
+                 memblock.memory.regions[idx].size) >= (base + size);
 }
 
 int __init_memblock memblock_is_region_reserved(phys_addr_t base, phys_addr_t size)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 8ab84103143..da53a252b25 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -600,23 +600,24 @@ static void mem_cgroup_swap_statistics(struct mem_cgroup *mem,
 }
 
 static void mem_cgroup_charge_statistics(struct mem_cgroup *mem,
-                                         struct page_cgroup *pc,
-                                         bool charge)
+                                         bool file, int nr_pages)
 {
-        int val = (charge) ? 1 : -1;
-
         preempt_disable();
 
-        if (PageCgroupCache(pc))
-                __this_cpu_add(mem->stat->count[MEM_CGROUP_STAT_CACHE], val);
+        if (file)
+                __this_cpu_add(mem->stat->count[MEM_CGROUP_STAT_CACHE], nr_pages);
         else
-                __this_cpu_add(mem->stat->count[MEM_CGROUP_STAT_RSS], val);
+                __this_cpu_add(mem->stat->count[MEM_CGROUP_STAT_RSS], nr_pages);
 
-        if (charge)
+        /* pagein of a big page is an event. So, ignore page size */
+        if (nr_pages > 0)
                 __this_cpu_inc(mem->stat->count[MEM_CGROUP_STAT_PGPGIN_COUNT]);
-        else
+        else {
                 __this_cpu_inc(mem->stat->count[MEM_CGROUP_STAT_PGPGOUT_COUNT]);
-        __this_cpu_inc(mem->stat->count[MEM_CGROUP_EVENTS]);
+                nr_pages = -nr_pages; /* for event */
+        }
+
+        __this_cpu_add(mem->stat->count[MEM_CGROUP_EVENTS], nr_pages);
 
         preempt_enable();
 }
@@ -815,7 +816,8 @@ void mem_cgroup_del_lru_list(struct page *page, enum lru_list lru)
          * removed from global LRU.
          */
         mz = page_cgroup_zoneinfo(pc);
-        MEM_CGROUP_ZSTAT(mz, lru) -= 1;
+        /* huge page split is done under lru_lock. so, we have no races. */
+        MEM_CGROUP_ZSTAT(mz, lru) -= 1 << compound_order(page);
         if (mem_cgroup_is_root(pc->mem_cgroup))
                 return;
         VM_BUG_ON(list_empty(&pc->lru));
@@ -836,13 +838,12 @@ void mem_cgroup_rotate_lru_list(struct page *page, enum lru_list lru)
                 return;
 
         pc = lookup_page_cgroup(page);
-        /*
-         * Used bit is set without atomic ops but after smp_wmb().
-         * For making pc->mem_cgroup visible, insert smp_rmb() here.
-         */
-        smp_rmb();
         /* unused or root page is not rotated. */
-        if (!PageCgroupUsed(pc) || mem_cgroup_is_root(pc->mem_cgroup))
+        if (!PageCgroupUsed(pc))
+                return;
+        /* Ensure pc->mem_cgroup is visible after reading PCG_USED. */
+        smp_rmb();
+        if (mem_cgroup_is_root(pc->mem_cgroup))
                 return;
         mz = page_cgroup_zoneinfo(pc);
         list_move(&pc->lru, &mz->lists[lru]);
@@ -857,16 +858,13 @@ void mem_cgroup_add_lru_list(struct page *page, enum lru_list lru)
                 return;
         pc = lookup_page_cgroup(page);
         VM_BUG_ON(PageCgroupAcctLRU(pc));
-        /*
-         * Used bit is set without atomic ops but after smp_wmb().
-         * For making pc->mem_cgroup visible, insert smp_rmb() here.
-         */
-        smp_rmb();
         if (!PageCgroupUsed(pc))
                 return;
-
+        /* Ensure pc->mem_cgroup is visible after reading PCG_USED. */
+        smp_rmb();
         mz = page_cgroup_zoneinfo(pc);
-        MEM_CGROUP_ZSTAT(mz, lru) += 1;
+        /* huge page split is done under lru_lock. so, we have no races. */
+        MEM_CGROUP_ZSTAT(mz, lru) += 1 << compound_order(page);
         SetPageCgroupAcctLRU(pc);
         if (mem_cgroup_is_root(pc->mem_cgroup))
                 return;
@@ -1030,14 +1028,10 @@ mem_cgroup_get_reclaim_stat_from_page(struct page *page)
                 return NULL;
 
         pc = lookup_page_cgroup(page);
-        /*
-         * Used bit is set without atomic ops but after smp_wmb().
-         * For making pc->mem_cgroup visible, insert smp_rmb() here.
-         */
-        smp_rmb();
         if (!PageCgroupUsed(pc))
                 return NULL;
-
+        /* Ensure pc->mem_cgroup is visible after reading PCG_USED. */
+        smp_rmb();
         mz = page_cgroup_zoneinfo(pc);
         if (!mz)
                 return NULL;
@@ -1119,6 +1113,23 @@ static bool mem_cgroup_check_under_limit(struct mem_cgroup *mem)
         return false;
 }
 
+/**
+ * mem_cgroup_check_margin - check if the memory cgroup allows charging
+ * @mem: memory cgroup to check
+ * @bytes: the number of bytes the caller intends to charge
+ *
+ * Returns a boolean value on whether @mem can be charged @bytes or
+ * whether this would exceed the limit.
+ */
+static bool mem_cgroup_check_margin(struct mem_cgroup *mem, unsigned long bytes)
+{
+        if (!res_counter_check_margin(&mem->res, bytes))
+                return false;
+        if (do_swap_account && !res_counter_check_margin(&mem->memsw, bytes))
+                return false;
+        return true;
+}
+
 static unsigned int get_swappiness(struct mem_cgroup *memcg)
 {
         struct cgroup *cgrp = memcg->css.cgroup;
@@ -1615,7 +1626,7 @@ void mem_cgroup_update_page_stat(struct page *page,
         if (unlikely(!mem || !PageCgroupUsed(pc)))
                 goto out;
         /* pc->mem_cgroup is unstable ? */
-        if (unlikely(mem_cgroup_stealed(mem))) {
+        if (unlikely(mem_cgroup_stealed(mem)) || PageTransHuge(page)) {
                 /* take a lock against to access pc->mem_cgroup */
                 move_lock_page_cgroup(pc, &flags);
                 need_unlock = true;
@@ -1840,27 +1851,39 @@ static int __mem_cgroup_do_charge(struct mem_cgroup *mem, gfp_t gfp_mask,
                 if (likely(!ret))
                         return CHARGE_OK;
 
+                res_counter_uncharge(&mem->res, csize);
                 mem_over_limit = mem_cgroup_from_res_counter(fail_res, memsw);
                 flags |= MEM_CGROUP_RECLAIM_NOSWAP;
         } else
                 mem_over_limit = mem_cgroup_from_res_counter(fail_res, res);
-
-        if (csize > PAGE_SIZE) /* change csize and retry */
+        /*
+         * csize can be either a huge page (HPAGE_SIZE), a batch of
+         * regular pages (CHARGE_SIZE), or a single regular page
+         * (PAGE_SIZE).
+         *
+         * Never reclaim on behalf of optional batching, retry with a
+         * single page instead.
+         */
+        if (csize == CHARGE_SIZE)
                 return CHARGE_RETRY;
 
         if (!(gfp_mask & __GFP_WAIT))
                 return CHARGE_WOULDBLOCK;
 
         ret = mem_cgroup_hierarchical_reclaim(mem_over_limit, NULL,
-                                        gfp_mask, flags);
+                                              gfp_mask, flags);
+        if (mem_cgroup_check_margin(mem_over_limit, csize))
+                return CHARGE_RETRY;
         /*
-         * try_to_free_mem_cgroup_pages() might not give us a full
-         * picture of reclaim. Some pages are reclaimed and might be
-         * moved to swap cache or just unmapped from the cgroup.
-         * Check the limit again to see if the reclaim reduced the
-         * current usage of the cgroup before giving up
+         * Even though the limit is exceeded at this point, reclaim
+         * may have been able to free some pages.  Retry the charge
+         * before killing the task.
+         *
+         * Only for regular pages, though: huge pages are rather
+         * unlikely to succeed so close to the limit, and we fall back
+         * to regular pages anyway in case of failure.
          */
-        if (ret || mem_cgroup_check_under_limit(mem_over_limit))
+        if (csize == PAGE_SIZE && ret)
                 return CHARGE_RETRY;
 
         /*
@@ -2084,14 +2107,27 @@ struct mem_cgroup *try_get_mem_cgroup_from_page(struct page *page)
         return mem;
 }
 
-/*
- * commit a charge got by __mem_cgroup_try_charge() and makes page_cgroup to be
- * USED state. If already USED, uncharge and return.
- */
-static void ____mem_cgroup_commit_charge(struct mem_cgroup *mem,
-                                         struct page_cgroup *pc,
-                                         enum charge_type ctype)
+static void __mem_cgroup_commit_charge(struct mem_cgroup *mem,
+                                       struct page_cgroup *pc,
+                                       enum charge_type ctype,
+                                       int page_size)
 {
+        int nr_pages = page_size >> PAGE_SHIFT;
+
+        /* try_charge() can return NULL to *memcg, taking care of it. */
+        if (!mem)
+                return;
+
+        lock_page_cgroup(pc);
+        if (unlikely(PageCgroupUsed(pc))) {
+                unlock_page_cgroup(pc);
+                mem_cgroup_cancel_charge(mem, page_size);
+                return;
+        }
+        /*
+         * we don't need page_cgroup_lock about tail pages, becase they are not
+         * accessed by any other context at this point.
+         */
         pc->mem_cgroup = mem;
         /*
          * We access a page_cgroup asynchronously without lock_page_cgroup().
@@ -2115,43 +2151,57 @@ static void ____mem_cgroup_commit_charge(struct mem_cgroup *mem,
                 break;
         }
 
-        mem_cgroup_charge_statistics(mem, pc, true);
+        mem_cgroup_charge_statistics(mem, PageCgroupCache(pc), nr_pages);
+        unlock_page_cgroup(pc);
+        /*
+         * "charge_statistics" updated event counter. Then, check it.
+         * Insert ancestor (and ancestor's ancestors), to softlimit RB-tree.
+         * if they exceeds softlimit.
+         */
+        memcg_check_events(mem, pc->page);
 }
 
-static void __mem_cgroup_commit_charge(struct mem_cgroup *mem,
-                                       struct page_cgroup *pc,
-                                       enum charge_type ctype,
-                                       int page_size)
-{
-        int i;
-        int count = page_size >> PAGE_SHIFT;
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
 
-        /* try_charge() can return NULL to *memcg, taking care of it. */
-        if (!mem)
-                return;
+#define PCGF_NOCOPY_AT_SPLIT ((1 << PCG_LOCK) | (1 << PCG_MOVE_LOCK) |\
+                        (1 << PCG_ACCT_LRU) | (1 << PCG_MIGRATION))
+/*
+ * Because tail pages are not marked as "used", set it. We're under
+ * zone->lru_lock, 'splitting on pmd' and compund_lock.
+ */
+void mem_cgroup_split_huge_fixup(struct page *head, struct page *tail)
+{
+        struct page_cgroup *head_pc = lookup_page_cgroup(head);
+        struct page_cgroup *tail_pc = lookup_page_cgroup(tail);
+        unsigned long flags;
 
-        lock_page_cgroup(pc);
-        if (unlikely(PageCgroupUsed(pc))) {
-                unlock_page_cgroup(pc);
-                mem_cgroup_cancel_charge(mem, page_size);
+        if (mem_cgroup_disabled())
                 return;
-        }
-
         /*
-         * we don't need page_cgroup_lock about tail pages, becase they are not
-         * accessed by any other context at this point.
+         * We have no races with charge/uncharge but will have races with
+         * page state accounting.
          */
-        for (i = 0; i < count; i++)
-                ____mem_cgroup_commit_charge(mem, pc + i, ctype);
+        move_lock_page_cgroup(head_pc, &flags);
 
-        unlock_page_cgroup(pc);
-        /*
-         * "charge_statistics" updated event counter. Then, check it.
-         * Insert ancestor (and ancestor's ancestors), to softlimit RB-tree.
-         * if they exceeds softlimit.
-         */
-        memcg_check_events(mem, pc->page);
+        tail_pc->mem_cgroup = head_pc->mem_cgroup;
+        smp_wmb(); /* see __commit_charge() */
+        if (PageCgroupAcctLRU(head_pc)) {
+                enum lru_list lru;
+                struct mem_cgroup_per_zone *mz;
+
+                /*
+                 * LRU flags cannot be copied because we need to add tail
+                 *.page to LRU by generic call and our hook will be called.
+                 * We hold lru_lock, then, reduce counter directly.
+                 */
+                lru = page_lru(head);
+                mz = page_cgroup_zoneinfo(head_pc);
+                MEM_CGROUP_ZSTAT(mz, lru) -= 1;
+        }
+        tail_pc->flags = head_pc->flags & ~PCGF_NOCOPY_AT_SPLIT;
+        move_unlock_page_cgroup(head_pc, &flags);
 }
+#endif
 
 /**
  * __mem_cgroup_move_account - move account of the page
@@ -2171,8 +2221,11 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *mem,
  */
 
 static void __mem_cgroup_move_account(struct page_cgroup *pc,
-        struct mem_cgroup *from, struct mem_cgroup *to, bool uncharge)
+        struct mem_cgroup *from, struct mem_cgroup *to, bool uncharge,
+        int charge_size)
 {
+        int nr_pages = charge_size >> PAGE_SHIFT;
+
         VM_BUG_ON(from == to);
         VM_BUG_ON(PageLRU(pc->page));
         VM_BUG_ON(!page_is_cgroup_locked(pc));
@@ -2186,14 +2239,14 @@ static void __mem_cgroup_move_account(struct page_cgroup *pc,
                 __this_cpu_inc(to->stat->count[MEM_CGROUP_STAT_FILE_MAPPED]);
                 preempt_enable();
         }
-        mem_cgroup_charge_statistics(from, pc, false);
+        mem_cgroup_charge_statistics(from, PageCgroupCache(pc), -nr_pages);
         if (uncharge)
                 /* This is not "cancel", but cancel_charge does all we need. */
-                mem_cgroup_cancel_charge(from, PAGE_SIZE);
+                mem_cgroup_cancel_charge(from, charge_size);
 
         /* caller should have done css_get */
         pc->mem_cgroup = to;
-        mem_cgroup_charge_statistics(to, pc, true);
+        mem_cgroup_charge_statistics(to, PageCgroupCache(pc), nr_pages);
         /*
          * We charges against "to" which may not have any tasks. Then, "to"
          * can be under rmdir(). But in current implementation, caller of
@@ -2208,15 +2261,24 @@ static void __mem_cgroup_move_account(struct page_cgroup *pc,
  * __mem_cgroup_move_account()
  */
 static int mem_cgroup_move_account(struct page_cgroup *pc,
-                struct mem_cgroup *from, struct mem_cgroup *to, bool uncharge)
+                struct mem_cgroup *from, struct mem_cgroup *to,
+                bool uncharge, int charge_size)
 {
         int ret = -EINVAL;
         unsigned long flags;
+        /*
+         * The page is isolated from LRU. So, collapse function
+         * will not handle this page. But page splitting can happen.
+         * Do this check under compound_page_lock(). The caller should
+         * hold it.
+         */
+        if ((charge_size > PAGE_SIZE) && !PageTransHuge(pc->page))
+                return -EBUSY;
 
         lock_page_cgroup(pc);
         if (PageCgroupUsed(pc) && pc->mem_cgroup == from) {
                 move_lock_page_cgroup(pc, &flags);
-                __mem_cgroup_move_account(pc, from, to, uncharge);
+                __mem_cgroup_move_account(pc, from, to, uncharge, charge_size);
                 move_unlock_page_cgroup(pc, &flags);
                 ret = 0;
         }
@@ -2241,6 +2303,8 @@ static int mem_cgroup_move_parent(struct page_cgroup *pc,
         struct cgroup *cg = child->css.cgroup;
         struct cgroup *pcg = cg->parent;
         struct mem_cgroup *parent;
+        int page_size = PAGE_SIZE;
+        unsigned long flags;
         int ret;
 
         /* Is ROOT ? */
@@ -2253,15 +2317,24 @@ static int mem_cgroup_move_parent(struct page_cgroup *pc,
         if (isolate_lru_page(page))
                 goto put;
 
+        if (PageTransHuge(page))
+                page_size = HPAGE_SIZE;
+
         parent = mem_cgroup_from_cont(pcg);
-        ret = __mem_cgroup_try_charge(NULL, gfp_mask, &parent, false,
-                                      PAGE_SIZE);
+        ret = __mem_cgroup_try_charge(NULL, gfp_mask,
+                                &parent, false, page_size);
         if (ret || !parent)
                 goto put_back;
 
-        ret = mem_cgroup_move_account(pc, child, parent, true);
+        if (page_size > PAGE_SIZE)
+                flags = compound_lock_irqsave(page);
+
+        ret = mem_cgroup_move_account(pc, child, parent, true, page_size);
         if (ret)
-                mem_cgroup_cancel_charge(parent, PAGE_SIZE);
+                mem_cgroup_cancel_charge(parent, page_size);
+
+        if (page_size > PAGE_SIZE)
+                compound_unlock_irqrestore(page, flags);
 put_back:
         putback_lru_page(page);
 put:
@@ -2280,13 +2353,19 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
                                 gfp_t gfp_mask, enum charge_type ctype)
 {
         struct mem_cgroup *mem = NULL;
+        int page_size = PAGE_SIZE;
         struct page_cgroup *pc;
+        bool oom = true;
         int ret;
-        int page_size = PAGE_SIZE;
 
         if (PageTransHuge(page)) {
                 page_size <<= compound_order(page);
                 VM_BUG_ON(!PageTransHuge(page));
+                /*
+                 * Never OOM-kill a process for a huge page.  The
+                 * fault handler will fall back to regular pages.
+                 */
+                oom = false;
         }
 
         pc = lookup_page_cgroup(page);
@@ -2295,7 +2374,7 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
                 return 0;
         prefetchw(pc);
 
-        ret = __mem_cgroup_try_charge(mm, gfp_mask, &mem, true, page_size);
+        ret = __mem_cgroup_try_charge(mm, gfp_mask, &mem, oom, page_size);
         if (ret || !mem)
                 return ret;
 
@@ -2546,7 +2625,6 @@ direct_uncharge:
 static struct mem_cgroup *
 __mem_cgroup_uncharge_common(struct page *page, enum charge_type ctype)
 {
-        int i;
         int count;
         struct page_cgroup *pc;
         struct mem_cgroup *mem = NULL;
@@ -2596,8 +2674,7 @@ __mem_cgroup_uncharge_common(struct page *page, enum charge_type ctype)
                 break;
         }
 
-        for (i = 0; i < count; i++)
-                mem_cgroup_charge_statistics(mem, pc + i, false);
+        mem_cgroup_charge_statistics(mem, PageCgroupCache(pc), -count);
 
         ClearPageCgroupUsed(pc);
         /*
@@ -4844,7 +4921,7 @@ retry:
                                 goto put;
                         pc = lookup_page_cgroup(page);
                         if (!mem_cgroup_move_account(pc,
-                                                mc.from, mc.to, false)) {
+                                        mc.from, mc.to, false, PAGE_SIZE)) {
                                 mc.precharge--;
                                 /* we uncharge from mc.from later. */
                                 mc.moved_charge++;
@@ -4983,9 +5060,9 @@ struct cgroup_subsys mem_cgroup_subsys = {
 static int __init enable_swap_account(char *s)
 {
         /* consider enabled if no parameter or 1 is given */
-        if (!s || !strcmp(s, "1"))
+        if (!(*s) || !strcmp(s, "=1"))
                 really_do_swap_account = 1;
-        else if (!strcmp(s, "0"))
+        else if (!strcmp(s, "=0"))
                 really_do_swap_account = 0;
         return 1;
 }
@@ -4993,7 +5070,8 @@ __setup("swapaccount", enable_swap_account);
 
 static int __init disable_swap_account(char *s)
 {
-        enable_swap_account("0");
+        printk_once("noswapaccount is deprecated and will be removed in 2.6.40. Use swapaccount=0 instead\n");
+        enable_swap_account("=0");
         return 1;
 }
 __setup("noswapaccount", disable_swap_account);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 548fbd70f02..0207c2f6f8b 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -233,8 +233,8 @@ void shake_page(struct page *p, int access)
         }
 
         /*
-         * Only all shrink_slab here (which would also
-         * shrink other caches) if access is not potentially fatal.
+         * Only call shrink_slab here (which would also shrink other caches) if
+         * access is not potentially fatal.
          */
         if (access) {
                 int nr;
@@ -386,8 +386,6 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill,
         struct task_struct *tsk;
         struct anon_vma *av;
 
-        if (!PageHuge(page) && unlikely(split_huge_page(page)))
-                return;
         read_lock(&tasklist_lock);
         av = page_lock_anon_vma(page);
         if (av == NULL) /* Not actually mapped anymore */
@@ -856,6 +854,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
         int ret;
         int kill = 1;
         struct page *hpage = compound_head(p);
+        struct page *ppage;
 
         if (PageReserved(p) || PageSlab(p))
                 return SWAP_SUCCESS;
@@ -897,6 +896,44 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
         }
 
         /*
+         * ppage: poisoned page
+         *   if p is regular page(4k page)
+         *        ppage == real poisoned page;
+         *   else p is hugetlb or THP, ppage == head page.
+         */
+        ppage = hpage;
+
+        if (PageTransHuge(hpage)) {
+                /*
+                 * Verify that this isn't a hugetlbfs head page, the check for
+                 * PageAnon is just for avoid tripping a split_huge_page
+                 * internal debug check, as split_huge_page refuses to deal with
+                 * anything that isn't an anon page. PageAnon can't go away fro
+                 * under us because we hold a refcount on the hpage, without a
+                 * refcount on the hpage. split_huge_page can't be safely called
+                 * in the first place, having a refcount on the tail isn't
+                 * enough * to be safe.
+                 */
+                if (!PageHuge(hpage) && PageAnon(hpage)) {
+                        if (unlikely(split_huge_page(hpage))) {
+                                /*
+                                 * FIXME: if splitting THP is failed, it is
+                                 * better to stop the following operation rather
+                                 * than causing panic by unmapping. System might
+                                 * survive if the page is freed later.
+                                 */
+                                printk(KERN_INFO
+                                        "MCE %#lx: failed to split THP\n", pfn);
+
+                                BUG_ON(!PageHWPoison(p));
+                                return SWAP_FAIL;
+                        }
+                        /* THP is split, so ppage should be the real poisoned page. */
+                        ppage = p;
+                }
+        }
+
+        /*
          * First collect all the processes that have the page
          * mapped in dirty form.  This has to be done before try_to_unmap,
          * because ttu takes the rmap data structures down.
@@ -905,12 +942,18 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
          * there's nothing that can be done.
          */
         if (kill)
-                collect_procs(hpage, &tokill);
+                collect_procs(ppage, &tokill);
+
+        if (hpage != ppage)
+                lock_page_nosync(ppage);
 
-        ret = try_to_unmap(hpage, ttu);
+        ret = try_to_unmap(ppage, ttu);
         if (ret != SWAP_SUCCESS)
                 printk(KERN_ERR "MCE %#lx: failed to unmap page (mapcount=%d)\n",
-                                pfn, page_mapcount(hpage));
+                                pfn, page_mapcount(ppage));
+
+        if (hpage != ppage)
+                unlock_page(ppage);
 
         /*
          * Now that the dirty bit has been propagated to the
@@ -921,7 +964,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
          * use a more force-full uncatchable kill to prevent
          * any accesses to the poisoned memory.
          */
-        kill_procs_ao(&tokill, !!PageDirty(hpage), trapno,
+        kill_procs_ao(&tokill, !!PageDirty(ppage), trapno,
                       ret != SWAP_SUCCESS, p, pfn);
 
         return ret;
@@ -1022,19 +1065,22 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
          * The check (unnecessarily) ignores LRU pages being isolated and
          * walked by the page reclaim code, however that's not a big loss.
          */
-        if (!PageLRU(p) && !PageHuge(p))
-                shake_page(p, 0);
-        if (!PageLRU(p) && !PageHuge(p)) {
-                /*
-                 * shake_page could have turned it free.
-                 */
-                if (is_free_buddy_page(p)) {
-                        action_result(pfn, "free buddy, 2nd try", DELAYED);
-                        return 0;
+        if (!PageHuge(p) && !PageTransCompound(p)) {
+                if (!PageLRU(p))
+                        shake_page(p, 0);
+                if (!PageLRU(p)) {
+                        /*
+                         * shake_page could have turned it free.
+                         */
+                        if (is_free_buddy_page(p)) {
+                                action_result(pfn, "free buddy, 2nd try",
+                                                DELAYED);
+                                return 0;
+                        }
+                        action_result(pfn, "non LRU", IGNORED);
+                        put_page(p);
+                        return -EBUSY;
                 }
-                action_result(pfn, "non LRU", IGNORED);
-                put_page(p);
-                return -EBUSY;
         }
 
         /*
@@ -1064,7 +1110,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
          * For error on the tail page, we should set PG_hwpoison
          * on the head page to show that the hugepage is hwpoisoned
          */
-        if (PageTail(p) && TestSetPageHWPoison(hpage)) {
+        if (PageHuge(p) && PageTail(p) && TestSetPageHWPoison(hpage)) {
                 action_result(pfn, "hugepage already hardware poisoned",
                                 IGNORED);
                 unlock_page(hpage);
@@ -1295,7 +1341,10 @@ static int soft_offline_huge_page(struct page *page, int flags)
         ret = migrate_huge_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL, 0,
                                 true);
         if (ret) {
-                putback_lru_pages(&pagelist);
+                struct page *page1, *page2;
+                list_for_each_entry_safe(page1, page2, &pagelist, lru)
+                        put_page(page1);
+
                 pr_debug("soft offline: %#lx: migration failed %d, type %lx\n",
                          pfn, ret, page->flags);
                 if (ret > 0)
@@ -1419,6 +1468,7 @@ int soft_offline_page(struct page *page, int flags)
                 ret = migrate_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL,
                                                                 0, true);
                 if (ret) {
+                        putback_lru_pages(&pagelist);
                         pr_info("soft offline: %#lx: migration failed %d, type %lx\n",
                                 pfn, ret, page->flags);
                         if (ret > 0)
diff --git a/mm/migrate.c b/mm/migrate.c
index 46fe8cc13d6..76611525380 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -772,6 +772,7 @@ uncharge:
 unlock:
         unlock_page(page);
 
+move_newpage:
         if (rc != -EAGAIN) {
                 /*
                  * A page that has been migrated has all references
@@ -785,8 +786,6 @@ unlock:
                 putback_lru_page(page);
         }
 
-move_newpage:
-
         /*
          * Move the new page to the LRU. If migration was not successful
          * then this will free the page.
@@ -888,7 +887,7 @@ out:
  * are movable anymore because to has become empty
  * or no retryable pages exist anymore.
  * Caller should call putback_lru_pages to return pages to the LRU
- * or free list.
+ * or free list only if ret != 0.
  *
  * Return: Number of pages not migrated or error code.
  */
@@ -981,10 +980,6 @@ int migrate_huge_pages(struct list_head *from,
         }
         rc = 0;
 out:
-
-        list_for_each_entry_safe(page, page2, from, lru)
-                put_page(page);
-
         if (rc)
                 return rc;
 
diff --git a/mm/mlock.c b/mm/mlock.c
index 13e81ee8be9..c3924c7f00b 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -178,6 +178,13 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         if ((vma->vm_flags & (VM_WRITE | VM_SHARED)) == VM_WRITE)
                 gup_flags |= FOLL_WRITE;
 
+        /*
+         * We want mlock to succeed for regions that have any permissions
+         * other than PROT_NONE.
+         */
+        if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC))
+                gup_flags |= FOLL_FORCE;
+
         if (vma->vm_flags & VM_LOCKED)
                 gup_flags |= FOLL_MLOCK;
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 90c1439549f..a873e61e312 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1088,8 +1088,10 @@ static void drain_pages(unsigned int cpu)
                 pset = per_cpu_ptr(zone->pageset, cpu);
 
                 pcp = &pset->pcp;
-                free_pcppages_bulk(zone, pcp->count, pcp);
-                pcp->count = 0;
+                if (pcp->count) {
+                        free_pcppages_bulk(zone, pcp->count, pcp);
+                        pcp->count = 0;
+                }
                 local_irq_restore(flags);
         }
 }
@@ -2034,6 +2036,14 @@ restart:
          */
         alloc_flags = gfp_to_alloc_flags(gfp_mask);
 
+        /*
+         * Find the true preferred zone if the allocation is unconstrained by
+         * cpusets.
+         */
+        if (!(alloc_flags & ALLOC_CPUSET) && !nodemask)
+                first_zones_zonelist(zonelist, high_zoneidx, NULL,
+                                        &preferred_zone);
+
         /* This is the last chance, in general, before the goto nopage. */
         page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
                         high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
@@ -2192,7 +2202,9 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
 
         get_mems_allowed();
         /* The preferred zone is used for statistics later */
-        first_zones_zonelist(zonelist, high_zoneidx, nodemask, &preferred_zone);
+        first_zones_zonelist(zonelist, high_zoneidx,
+                                nodemask ? : &cpuset_current_mems_allowed,
+                                &preferred_zone);
         if (!preferred_zone) {
                 put_mems_allowed();
                 return NULL;
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index 0369f5b3ba1..eb663fb533e 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -6,6 +6,7 @@
  *  Copyright (C) 2010  Linus Torvalds
  */
 
+#include <linux/pagemap.h>
 #include <asm/tlb.h>
 #include <asm-generic/pgtable.h>
 
diff --git a/mm/truncate.c b/mm/truncate.c
index 3c2d5ddfa0d..49feb46e77b 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -549,13 +549,12 @@ EXPORT_SYMBOL(truncate_pagecache);
  * @inode: inode
  * @newsize: new file size
  *
- * truncate_setsize updastes i_size update and performs pagecache
- * truncation (if necessary) for a file size updates. It will be
- * typically be called from the filesystem's setattr function when
- * ATTR_SIZE is passed in.
+ * truncate_setsize updates i_size and performs pagecache truncation (if
+ * necessary) to @newsize. It will be typically be called from the filesystem's
+ * setattr function when ATTR_SIZE is passed in.
  *
- * Must be called with inode_mutex held and after all filesystem
- * specific block truncation has been performed.
+ * Must be called with inode_mutex held and before all filesystem specific
+ * block truncation has been performed.
  */
 void truncate_setsize(struct inode *inode, loff_t newsize)
 {
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 47a50962ce8..148c6e630df 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -41,7 +41,6 @@
 #include <linux/memcontrol.h>
 #include <linux/delayacct.h>
 #include <linux/sysctl.h>
-#include <linux/compaction.h>
 
 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -2084,7 +2083,8 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                         struct zone *preferred_zone;
 
                         first_zones_zonelist(zonelist, gfp_zone(sc->gfp_mask),
-                                                        NULL, &preferred_zone);
+                                                &cpuset_current_mems_allowed,
+                                                &preferred_zone);
                         wait_iff_congested(preferred_zone, BLK_RW_ASYNC, HZ/10);
                 }
         }
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index d4d9926c220..65106fb61b8 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -151,9 +151,9 @@ int debug_log(struct bat_priv *bat_priv, char *fmt, ...);
         }                                                       \
         while (0)
 #else /* !CONFIG_BATMAN_ADV_DEBUG */
-static inline void bat_dbg(char type __attribute__((unused)),
-                           struct bat_priv *bat_priv __attribute__((unused)),
-                           char *fmt __attribute__((unused)), ...)
+static inline void bat_dbg(char type __always_unused,
+                           struct bat_priv *bat_priv __always_unused,
+                           char *fmt __always_unused, ...)
 {
 }
 #endif
diff --git a/net/batman-adv/packet.h b/net/batman-adv/packet.h
index b49fdf70a6d..2284e8129cb 100644
--- a/net/batman-adv/packet.h
+++ b/net/batman-adv/packet.h
@@ -63,7 +63,7 @@ struct batman_packet {
         uint8_t  num_hna;
         uint8_t  gw_flags;  /* flags related to gateway class */
         uint8_t  align;
-} __attribute__((packed));
+} __packed;
 
 #define BAT_PACKET_LEN sizeof(struct batman_packet)
 
@@ -76,7 +76,7 @@ struct icmp_packet {
         uint8_t  orig[6];
         uint16_t seqno;
         uint8_t  uid;
-} __attribute__((packed));
+} __packed;
 
 #define BAT_RR_LEN 16
 
@@ -93,14 +93,14 @@ struct icmp_packet_rr {
         uint8_t  uid;
         uint8_t  rr_cur;
         uint8_t  rr[BAT_RR_LEN][ETH_ALEN];
-} __attribute__((packed));
+} __packed;
 
 struct unicast_packet {
         uint8_t  packet_type;
         uint8_t  version;  /* batman version field */
         uint8_t  dest[6];
         uint8_t  ttl;
-} __attribute__((packed));
+} __packed;
 
 struct unicast_frag_packet {
         uint8_t  packet_type;
@@ -110,7 +110,7 @@ struct unicast_frag_packet {
         uint8_t  flags;
         uint8_t  orig[6];
         uint16_t seqno;
-} __attribute__((packed));
+} __packed;
 
 struct bcast_packet {
         uint8_t  packet_type;
@@ -118,7 +118,7 @@ struct bcast_packet {
         uint8_t  orig[6];
         uint8_t  ttl;
         uint32_t seqno;
-} __attribute__((packed));
+} __packed;
 
 struct vis_packet {
         uint8_t  packet_type;
@@ -131,6 +131,6 @@ struct vis_packet {
                                   * neighbors */
         uint8_t  target_orig[6]; /* who should receive this packet */
         uint8_t  sender_orig[6]; /* who sent or rebroadcasted this packet */
-} __attribute__((packed));
+} __packed;
 
 #endif /* _NET_BATMAN_ADV_PACKET_H_ */
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 97cb23dd3e6..bf3f6f5a12c 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -246,13 +246,13 @@ struct vis_info {
         /* this packet might be part of the vis send queue. */
         struct sk_buff *skb_packet;
         /* vis_info may follow here*/
-} __attribute__((packed));
+} __packed;
 
 struct vis_info_entry {
         uint8_t  src[ETH_ALEN];
         uint8_t  dest[ETH_ALEN];
         uint8_t  quality;       /* quality = 0 means HNA */
-} __attribute__((packed));
+} __packed;
 
 struct recvlist_node {
         struct list_head list;
diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index dc2e28bed84..ee41fef04b2 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -229,10 +229,12 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
         if (!bat_priv->primary_if)
                 goto dropped;
 
-        unicast_packet = (struct unicast_packet *) skb->data;
+        frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len);
+        if (!frag_skb)
+                goto dropped;
 
+        unicast_packet = (struct unicast_packet *) skb->data;
         memcpy(&tmp_uc, unicast_packet, uc_hdr_len);
-        frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len);
         skb_split(skb, frag_skb, data_len / 2);
 
         if (my_skb_head_push(skb, ucf_hdr_len - uc_hdr_len) < 0 ||
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index cd4c4231fa4..de1022cacaf 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -64,6 +64,7 @@ static void free_info(struct kref *ref)
 
         spin_unlock_bh(&bat_priv->vis_list_lock);
         kfree_skb(info->skb_packet);
+        kfree(info);
 }
 
 /* Compare two vis packets, used by the hashing algorithm */
@@ -268,10 +269,10 @@ int vis_seq_print_text(struct seq_file *seq, void *offset)
                                 buff_pos += sprintf(buff + buff_pos, "%pM,",
                                                 entry->addr);
 
-                                for (i = 0; i < packet->entries; i++)
+                                for (j = 0; j < packet->entries; j++)
                                         buff_pos += vis_data_read_entry(
                                                         buff + buff_pos,
-                                                        &entries[i],
+                                                        &entries[j],
                                                         entry->addr,
                                                         entry->primary);
 
@@ -444,7 +445,7 @@ static struct vis_info *add_packet(struct bat_priv *bat_priv,
                               info);
         if (hash_added < 0) {
                 /* did not work (for some reason) */
-                kref_put(&old_info->refcount, free_info);
+                kref_put(&info->refcount, free_info);
                 info = NULL;
         }
 
@@ -815,7 +816,7 @@ static void send_vis_packets(struct work_struct *work)
                 container_of(work, struct delayed_work, work);
         struct bat_priv *bat_priv =
                 container_of(delayed_work, struct bat_priv, vis_work);
-        struct vis_info *info, *temp;
+        struct vis_info *info;
 
         spin_lock_bh(&bat_priv->vis_hash_lock);
         purge_vis_packets(bat_priv);
@@ -825,8 +826,9 @@ static void send_vis_packets(struct work_struct *work)
                 send_list_add(bat_priv, bat_priv->my_vis_info);
         }
 
-        list_for_each_entry_safe(info, temp, &bat_priv->vis_send_list,
-                                 send_list) {
+        while (!list_empty(&bat_priv->vis_send_list)) {
+                info = list_first_entry(&bat_priv->vis_send_list,
+                                        typeof(*info), send_list);
 
                 kref_get(&info->refcount);
                 spin_unlock_bh(&bat_priv->vis_hash_lock);
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6b90a419173..99cd8d9d891 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -379,14 +379,10 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         hci_conn_hold(acl);
 
         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
-                acl->sec_level = sec_level;
+                acl->sec_level = BT_SECURITY_LOW;
+                acl->pending_sec_level = sec_level;
                 acl->auth_type = auth_type;
                 hci_acl_connect(acl);
-        } else {
-                if (acl->sec_level < sec_level)
-                        acl->sec_level = sec_level;
-                if (acl->auth_type < auth_type)
-                        acl->auth_type = auth_type;
         }
 
         if (type == ACL_LINK)
@@ -442,11 +438,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
         BT_DBG("conn %p", conn);
 
+        if (conn->pending_sec_level > sec_level)
+                sec_level = conn->pending_sec_level;
+
         if (sec_level > conn->sec_level)
-                conn->sec_level = sec_level;
+                conn->pending_sec_level = sec_level;
         else if (conn->link_mode & HCI_LM_AUTH)
                 return 1;
 
+        /* Make sure we preserve an existing MITM requirement*/
+        auth_type |= (conn->auth_type & 0x01);
+
         conn->auth_type = auth_type;
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8b602d881fd..9c4541bc488 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1011,6 +1011,10 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
         destroy_workqueue(hdev->workqueue);
 
+        hci_dev_lock_bh(hdev);
+        hci_blacklist_clear(hdev);
+        hci_dev_unlock_bh(hdev);
+
         __hci_dev_put(hdev);
 
         return 0;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 38100170d38..a290854fdaa 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -692,13 +692,13 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
         if (conn->state != BT_CONFIG || !conn->out)
                 return 0;
 
-        if (conn->sec_level == BT_SECURITY_SDP)
+        if (conn->pending_sec_level == BT_SECURITY_SDP)
                 return 0;
 
         /* Only request authentication for SSP connections or non-SSP
          * devices with sec_level HIGH */
         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
-                                        conn->sec_level != BT_SECURITY_HIGH)
+                                conn->pending_sec_level != BT_SECURITY_HIGH)
                 return 0;
 
         return 1;
@@ -1095,9 +1095,10 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
         if (conn) {
-                if (!ev->status)
+                if (!ev->status) {
                         conn->link_mode |= HCI_LM_AUTH;
-                else
+                        conn->sec_level = conn->pending_sec_level;
+                } else
                         conn->sec_level = BT_SECURITY_LOW;
 
                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c791fcda7b2..7550abb0c96 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -305,33 +305,44 @@ static void l2cap_chan_del(struct sock *sk, int err)
         }
 }
 
-/* Service level security */
-static inline int l2cap_check_security(struct sock *sk)
+static inline u8 l2cap_get_auth_type(struct sock *sk)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        __u8 auth_type;
+        if (sk->sk_type == SOCK_RAW) {
+                switch (l2cap_pi(sk)->sec_level) {
+                case BT_SECURITY_HIGH:
+                        return HCI_AT_DEDICATED_BONDING_MITM;
+                case BT_SECURITY_MEDIUM:
+                        return HCI_AT_DEDICATED_BONDING;
+                default:
+                        return HCI_AT_NO_BONDING;
+                }
+        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
+                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
+                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 
-        if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
+                        return HCI_AT_NO_BONDING_MITM;
                 else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
+                        return HCI_AT_NO_BONDING;
         } else {
                 switch (l2cap_pi(sk)->sec_level) {
                 case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
+                        return HCI_AT_GENERAL_BONDING_MITM;
                 case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
+                        return HCI_AT_GENERAL_BONDING;
                 default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
+                        return HCI_AT_NO_BONDING;
                 }
         }
+}
+
+/* Service level security */
+static inline int l2cap_check_security(struct sock *sk)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        __u8 auth_type;
+
+        auth_type = l2cap_get_auth_type(sk);
 
         return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
                                                                 auth_type);
@@ -1068,39 +1079,7 @@ static int l2cap_do_connect(struct sock *sk)
 
         err = -ENOMEM;
 
-        if (sk->sk_type == SOCK_RAW) {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_DEDICATED_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_DEDICATED_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
-                else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        } else {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        }
+        auth_type = l2cap_get_auth_type(sk);
 
         hcon = hci_connect(hdev, ACL_LINK, dst,
                                         l2cap_pi(sk)->sec_level, auth_type);
@@ -1127,7 +1106,8 @@ static int l2cap_do_connect(struct sock *sk)
                 if (sk->sk_type != SOCK_SEQPACKET &&
                                 sk->sk_type != SOCK_STREAM) {
                         l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
+                        if (l2cap_check_security(sk))
+                                sk->sk_state = BT_CONNECTED;
                 } else
                         l2cap_do_start(sk);
         }
@@ -1893,8 +1873,8 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                 if (pi->mode == L2CAP_MODE_STREAMING) {
                         l2cap_streaming_send(sk);
                 } else {
-                        if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY &&
-                                        pi->conn_state && L2CAP_CONN_WAIT_F) {
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                        (pi->conn_state & L2CAP_CONN_WAIT_F)) {
                                 err = len;
                                 break;
                         }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ff8aaa73665..6b83776534f 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1164,7 +1164,8 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                          * initiator rfcomm_process_rx already calls
                          * rfcomm_session_put() */
                         if (s->sock->sk->sk_state != BT_CLOSED)
-                                rfcomm_session_put(s);
+                                if (list_empty(&s->dlcs))
+                                        rfcomm_session_put(s);
                         break;
                 }
         }
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 2872393b293..88485cc74dc 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -328,12 +328,12 @@ static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
         fdb = kmem_cache_alloc(br_fdb_cache, GFP_ATOMIC);
         if (fdb) {
                 memcpy(fdb->addr.addr, addr, ETH_ALEN);
-                hlist_add_head_rcu(&fdb->hlist, head);
-
                 fdb->dst = source;
                 fdb->is_local = is_local;
                 fdb->is_static = is_local;
                 fdb->ageing_timer = jiffies;
+
+                hlist_add_head_rcu(&fdb->hlist, head);
         }
         return fdb;
 }
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 21ede141018..c665de778b6 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -191,6 +191,7 @@ int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
         struct cflayer *servl = NULL;
         struct cfcnfg_phyinfo *phyinfo = NULL;
         u8 phyid = 0;
+
         caif_assert(adap_layer != NULL);
         channel_id = adap_layer->id;
         if (adap_layer->dn == NULL || channel_id == 0) {
@@ -199,16 +200,16 @@ int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
                 goto end;
         }
         servl = cfmuxl_remove_uplayer(cnfg->mux, channel_id);
-        if (servl == NULL)
-                goto end;
-        layer_set_up(servl, NULL);
-        ret = cfctrl_linkdown_req(cnfg->ctrl, channel_id, adap_layer);
         if (servl == NULL) {
                 pr_err("PROTOCOL ERROR - Error removing service_layer Channel_Id(%d)",
                        channel_id);
                 ret = -EINVAL;
                 goto end;
         }
+        layer_set_up(servl, NULL);
+        ret = cfctrl_linkdown_req(cnfg->ctrl, channel_id, adap_layer);
+        if (ret)
+                goto end;
         caif_assert(channel_id == servl->id);
         if (adap_layer->dn != NULL) {
                 phyid = cfsrvl_getphyid(adap_layer->dn);
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 9d5e8accfab..092dc88a7c6 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1256,6 +1256,9 @@ static int bcm_sendmsg(struct kiocb *iocb, struct socket *sock,
                 struct sockaddr_can *addr =
                         (struct sockaddr_can *)msg->msg_name;
 
+                if (msg->msg_namelen < sizeof(*addr))
+                        return -EINVAL;
+
                 if (addr->can_family != AF_CAN)
                         return -EINVAL;
 
diff --git a/net/can/raw.c b/net/can/raw.c
index e88f610fdb7..883e9d74fdd 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -649,6 +649,9 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
                 struct sockaddr_can *addr =
                         (struct sockaddr_can *)msg->msg_name;
 
+                if (msg->msg_namelen < sizeof(*addr))
+                        return -EINVAL;
+
                 if (addr->can_family != AF_CAN)
                         return -EINVAL;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 54277df0f73..b6d0bf875a8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -749,7 +749,8 @@ EXPORT_SYMBOL(dev_get_by_index);
  *      @ha: hardware address
  *
  *      Search for an interface by MAC address. Returns NULL if the device
- *      is not found or a pointer to the device. The caller must hold RCU
+ *      is not found or a pointer to the device.
+ *      The caller must hold RCU or RTNL.
  *      The returned device has not had its ref count increased
  *      and the caller must therefore be careful about locking
  *
@@ -2001,7 +2002,7 @@ static bool can_checksum_protocol(unsigned long features, __be16 protocol)
 
 static int harmonize_features(struct sk_buff *skb, __be16 protocol, int features)
 {
-        if (!can_checksum_protocol(protocol, features)) {
+        if (!can_checksum_protocol(features, protocol)) {
                 features &= ~NETIF_F_ALL_CSUM;
                 features &= ~NETIF_F_SG;
         } else if (illegal_highdma(skb->dev, skb)) {
@@ -2023,13 +2024,13 @@ int netif_skb_features(struct sk_buff *skb)
                 return harmonize_features(skb, protocol, features);
         }
 
-        features &= skb->dev->vlan_features;
+        features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_TX);
 
         if (protocol != htons(ETH_P_8021Q)) {
                 return harmonize_features(skb, protocol, features);
         } else {
                 features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST |
-                                NETIF_F_GEN_CSUM;
+                                NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_TX;
                 return harmonize_features(skb, protocol, features);
         }
 }
@@ -2562,7 +2563,8 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
 
         map = rcu_dereference(rxqueue->rps_map);
         if (map) {
-                if (map->len == 1) {
+                if (map->len == 1 &&
+                    !rcu_dereference_raw(rxqueue->rps_flow_table)) {
                         tcpu = map->cpus[0];
                         if (cpu_online(tcpu))
                                 cpu = tcpu;
@@ -3423,6 +3425,8 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         __skb_pull(skb, skb_headlen(skb));
         skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
         skb->vlan_tci = 0;
+        skb->dev = napi->dev;
+        skb->skb_iif = 0;
 
         napi->skb = skb;
 }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 17741782a34..ff2302910b5 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -817,7 +817,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = vmalloc(reglen);
+        regbuf = vzalloc(reglen);
         if (!regbuf)
                 return -ENOMEM;
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a5f7535aab5..2d65c6bb24c 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1121,8 +1121,7 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
                                 return -EOPNOTSUPP;
 
                         if (af_ops->validate_link_af) {
-                                err = af_ops->validate_link_af(dev,
-                                                        tb[IFLA_AF_SPEC]);
+                                err = af_ops->validate_link_af(dev, af);
                                 if (err < 0)
                                         return err;
                         }
@@ -1672,6 +1671,9 @@ replay:
                         snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
 
                 dest_net = rtnl_link_get_net(net, tb);
+                if (IS_ERR(dest_net))
+                        return PTR_ERR(dest_net);
+
                 dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
 
                 if (IS_ERR(dev))
@@ -1820,7 +1822,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (kind != 2 && security_netlink_recv(skb, CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (kind == 2 && (nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) {
                 struct sock *rtnl;
                 rtnl_dumpit_func dumpit;
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d31bb36ae0d..d883dcc78b6 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -210,6 +210,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         shinfo = skb_shinfo(skb);
         memset(shinfo, 0, offsetof(struct skb_shared_info, dataref));
         atomic_set(&shinfo->dataref, 1);
+        kmemcheck_annotate_variable(shinfo->destructor_arg);
 
         if (fclone) {
                 struct sk_buff *child = skb + 1;
@@ -2744,8 +2745,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
 merge:
         if (offset > headlen) {
-                skbinfo->frags[0].page_offset += offset - headlen;
-                skbinfo->frags[0].size -= offset - headlen;
+                unsigned int eat = offset - headlen;
+
+                skbinfo->frags[0].page_offset += eat;
+                skbinfo->frags[0].size -= eat;
+                skb->data_len -= eat;
+                skb->len -= eat;
                 offset = headlen;
         }
 
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d900ab99814..6b03f561cae 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -583,7 +583,7 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
         u8 up, idtype;
         int ret = -EINVAL;
 
-        if (!tb[DCB_ATTR_APP] || !netdev->dcbnl_ops->getapp)
+        if (!tb[DCB_ATTR_APP])
                 goto out;
 
         ret = nla_parse_nested(app_tb, DCB_APP_ATTR_MAX, tb[DCB_ATTR_APP],
@@ -604,7 +604,16 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
                 goto out;
 
         id = nla_get_u16(app_tb[DCB_APP_ATTR_ID]);
-        up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+
+        if (netdev->dcbnl_ops->getapp) {
+                up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+        } else {
+                struct dcb_app app = {
+                                        .selector = idtype,
+                                        .protocol = id,
+                                     };
+                up = dcb_getapp(netdev, &app);
+        }
 
         /* send this back */
         dcbnl_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 0c877a74e1f..3fb14b7c13c 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -428,7 +428,7 @@ static void __exit dsa_cleanup_module(void)
 }
 module_exit(dsa_cleanup_module);
 
-MODULE_AUTHOR("Lennert Buytenhek <buytenh@wantstofly.org>")
+MODULE_AUTHOR("Lennert Buytenhek <buytenh@wantstofly.org>");
 MODULE_DESCRIPTION("Driver for Distributed Switch Architecture switch chips");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:dsa");
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 15dcc1a586b..0c282633791 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -265,13 +265,13 @@ static void ec_tx_done(struct sk_buff *skb, int result)
 static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                           struct msghdr *msg, size_t len)
 {
-        struct sock *sk = sock->sk;
         struct sockaddr_ec *saddr=(struct sockaddr_ec *)msg->msg_name;
         struct net_device *dev;
         struct ec_addr addr;
         int err;
         unsigned char port, cb;
 #if defined(CONFIG_ECONET_AUNUDP) || defined(CONFIG_ECONET_NATIVE)
+        struct sock *sk = sock->sk;
         struct sk_buff *skb;
         struct ec_cb *eb;
 #endif
@@ -488,10 +488,10 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
 error_free_buf:
         vfree(userbuf);
+error:
 #else
         err = -EPROTOTYPE;
 #endif
-        error:
         mutex_unlock(&econet_mutex);
 
         return err;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f2b61107df6..45b89d7bda5 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -880,6 +880,19 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 }
 EXPORT_SYMBOL(inet_ioctl);
 
+#ifdef CONFIG_COMPAT
+int inet_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        struct sock *sk = sock->sk;
+        int err = -ENOIOCTLCMD;
+
+        if (sk->sk_prot->compat_ioctl)
+                err = sk->sk_prot->compat_ioctl(sk, cmd, arg);
+
+        return err;
+}
+#endif
+
 const struct proto_ops inet_stream_ops = {
         .family            = PF_INET,
         .owner             = THIS_MODULE,
@@ -903,6 +916,7 @@ const struct proto_ops inet_stream_ops = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_sock_common_setsockopt,
         .compat_getsockopt = compat_sock_common_getsockopt,
+        .compat_ioctl      = inet_compat_ioctl,
 #endif
 };
 EXPORT_SYMBOL(inet_stream_ops);
@@ -929,6 +943,7 @@ const struct proto_ops inet_dgram_ops = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_sock_common_setsockopt,
         .compat_getsockopt = compat_sock_common_getsockopt,
+        .compat_ioctl      = inet_compat_ioctl,
 #endif
 };
 EXPORT_SYMBOL(inet_dgram_ops);
@@ -959,6 +974,7 @@ static const struct proto_ops inet_sockraw_ops = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_sock_common_setsockopt,
         .compat_getsockopt = compat_sock_common_getsockopt,
+        .compat_ioctl      = inet_compat_ioctl,
 #endif
 };
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 04c8b69fd42..7927589813b 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1017,14 +1017,13 @@ static int arp_req_set_proxy(struct net *net, struct net_device *dev, int on)
                 IPV4_DEVCONF_ALL(net, PROXY_ARP) = on;
                 return 0;
         }
-        if (__in_dev_get_rcu(dev)) {
-                IN_DEV_CONF_SET(__in_dev_get_rcu(dev), PROXY_ARP, on);
+        if (__in_dev_get_rtnl(dev)) {
+                IN_DEV_CONF_SET(__in_dev_get_rtnl(dev), PROXY_ARP, on);
                 return 0;
         }
         return -ENXIO;
 }
 
-/* must be called with rcu_read_lock() */
 static int arp_req_set_public(struct net *net, struct arpreq *r,
                 struct net_device *dev)
 {
@@ -1233,10 +1232,10 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         if (!(r.arp_flags & ATF_NETMASK))
                 ((struct sockaddr_in *)&r.arp_netmask)->sin_addr.s_addr =
                                                            htonl(0xFFFFFFFFUL);
-        rcu_read_lock();
+        rtnl_lock();
         if (r.arp_dev[0]) {
                 err = -ENODEV;
-                dev = dev_get_by_name_rcu(net, r.arp_dev);
+                dev = __dev_get_by_name(net, r.arp_dev);
                 if (dev == NULL)
                         goto out;
 
@@ -1263,7 +1262,7 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 break;
         }
 out:
-        rcu_read_unlock();
+        rtnl_unlock();
         if (cmd == SIOCGARP && !err && copy_to_user(arg, &r, sizeof(r)))
                 err = -EFAULT;
         return err;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 2746c1fa641..2ada17129fc 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -858,7 +858,7 @@ static int inet_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
             nlmsg_len(nlh) < hdrlen)
                 return -EINVAL;
 
-        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 if (nlmsg_attrlen(nlh, hdrlen)) {
                         struct nlattr *attr;
 
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d9bc85751c7..a96e65674ac 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -475,7 +475,7 @@ static int cleanup_once(unsigned long ttl)
 struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
 {
         struct inet_peer __rcu **stack[PEER_MAXDEPTH], ***stackptr;
-        struct inet_peer_base *base = family_to_base(AF_INET);
+        struct inet_peer_base *base = family_to_base(daddr->family);
         struct inet_peer *p;
 
         /* Look up for the address quickly, lockless.
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 3f3a9afd73e..8b65a12654e 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -60,6 +60,7 @@
 #include <linux/notifier.h>
 #include <linux/if_arp.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/compat.h>
 #include <net/ipip.h>
 #include <net/checksum.h>
 #include <net/netlink.h>
@@ -1434,6 +1435,81 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
         }
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_sioc_sg_req {
+        struct in_addr src;
+        struct in_addr grp;
+        compat_ulong_t pktcnt;
+        compat_ulong_t bytecnt;
+        compat_ulong_t wrong_if;
+};
+
+struct compat_sioc_vif_req {
+        vifi_t  vifi;           /* Which iface */
+        compat_ulong_t icount;
+        compat_ulong_t ocount;
+        compat_ulong_t ibytes;
+        compat_ulong_t obytes;
+};
+
+int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+{
+        struct compat_sioc_sg_req sr;
+        struct compat_sioc_vif_req vr;
+        struct vif_device *vif;
+        struct mfc_cache *c;
+        struct net *net = sock_net(sk);
+        struct mr_table *mrt;
+
+        mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
+        if (mrt == NULL)
+                return -ENOENT;
+
+        switch (cmd) {
+        case SIOCGETVIFCNT:
+                if (copy_from_user(&vr, arg, sizeof(vr)))
+                        return -EFAULT;
+                if (vr.vifi >= mrt->maxvif)
+                        return -EINVAL;
+                read_lock(&mrt_lock);
+                vif = &mrt->vif_table[vr.vifi];
+                if (VIF_EXISTS(mrt, vr.vifi)) {
+                        vr.icount = vif->pkt_in;
+                        vr.ocount = vif->pkt_out;
+                        vr.ibytes = vif->bytes_in;
+                        vr.obytes = vif->bytes_out;
+                        read_unlock(&mrt_lock);
+
+                        if (copy_to_user(arg, &vr, sizeof(vr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                read_unlock(&mrt_lock);
+                return -EADDRNOTAVAIL;
+        case SIOCGETSGCNT:
+                if (copy_from_user(&sr, arg, sizeof(sr)))
+                        return -EFAULT;
+
+                rcu_read_lock();
+                c = ipmr_cache_find(mrt, sr.src.s_addr, sr.grp.s_addr);
+                if (c) {
+                        sr.pktcnt = c->mfc_un.res.pkt;
+                        sr.bytecnt = c->mfc_un.res.bytes;
+                        sr.wrong_if = c->mfc_un.res.wrong_if;
+                        rcu_read_unlock();
+
+                        if (copy_to_user(arg, &sr, sizeof(sr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                rcu_read_unlock();
+                return -EADDRNOTAVAIL;
+        default:
+                return -ENOIOCTLCMD;
+        }
+}
+#endif
+
 
 static int ipmr_device_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index b8ddcc480ed..a5e52a9f0a1 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -60,12 +60,12 @@ static int checkentry(const struct xt_tgchk_param *par)
 
         if (mangle->flags & ~ARPT_MANGLE_MASK ||
             !(mangle->flags & ARPT_MANGLE_MASK))
-                return false;
+                return -EINVAL;
 
         if (mangle->target != NF_DROP && mangle->target != NF_ACCEPT &&
            mangle->target != XT_CONTINUE)
-                return false;
-        return true;
+                return -EINVAL;
+        return 0;
 }
 
 static struct xt_target arpt_mangle_reg __read_mostly = {
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index a3d5ab786e8..6390ba299b3 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -76,6 +76,7 @@
 #include <linux/seq_file.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/compat.h>
 
 static struct raw_hashinfo raw_v4_hashinfo = {
         .lock = __RW_LOCK_UNLOCKED(raw_v4_hashinfo.lock),
@@ -838,6 +839,23 @@ static int raw_ioctl(struct sock *sk, int cmd, unsigned long arg)
         }
 }
 
+#ifdef CONFIG_COMPAT
+static int compat_raw_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case SIOCOUTQ:
+        case SIOCINQ:
+                return -ENOIOCTLCMD;
+        default:
+#ifdef CONFIG_IP_MROUTE
+                return ipmr_compat_ioctl(sk, cmd, compat_ptr(arg));
+#else
+                return -ENOIOCTLCMD;
+#endif
+        }
+}
+#endif
+
 struct proto raw_prot = {
         .name              = "RAW",
         .owner             = THIS_MODULE,
@@ -860,6 +878,7 @@ struct proto raw_prot = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_raw_setsockopt,
         .compat_getsockopt = compat_raw_getsockopt,
+        .compat_ioctl      = compat_raw_ioctl,
 #endif
 };
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 351dc4e8524..788a3e74834 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2707,6 +2707,11 @@ static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 coo
         return NULL;
 }
 
+static unsigned int ipv4_blackhole_default_mtu(const struct dst_entry *dst)
+{
+        return 0;
+}
+
 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
@@ -2716,6 +2721,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .protocol               =       cpu_to_be16(ETH_P_IP),
         .destroy                =       ipv4_dst_destroy,
         .check                  =       ipv4_blackhole_dst_check,
+        .default_mtu            =       ipv4_blackhole_default_mtu,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
 };
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2549b29b062..eb7f82ebf4a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4399,7 +4399,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
                         if (!skb_copy_datagram_iovec(skb, 0, tp->ucopy.iov, chunk)) {
                                 tp->ucopy.len -= chunk;
                                 tp->copied_seq += chunk;
-                                eaten = (chunk == skb->len && !th->fin);
+                                eaten = (chunk == skb->len);
                                 tcp_rcv_space_adjust(sk);
                         }
                         local_bh_disable();
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 856f68466d4..02f583b3744 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1994,7 +1994,6 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
                                 }
                                 req = req->dl_next;
                         }
-                        st->offset = 0;
                         if (++st->sbucket >= icsk->icsk_accept_queue.listen_opt->nr_table_entries)
                                 break;
 get_req:
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5b189c97c2f..fd6782e3a03 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -420,9 +420,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
             dev->type == ARPHRD_TUNNEL6 ||
             dev->type == ARPHRD_SIT ||
             dev->type == ARPHRD_NONE) {
-                printk(KERN_INFO
-                       "%s: Disabled Privacy Extensions\n",
-                       dev->name);
                 ndev->cnf.use_tempaddr = -1;
         } else {
                 in6_dev_hold(ndev);
@@ -2664,14 +2661,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         struct net *net = dev_net(dev);
         struct inet6_dev *idev;
         struct inet6_ifaddr *ifa;
-        LIST_HEAD(keep_list);
-        int state;
+        int state, i;
 
         ASSERT_RTNL();
 
-        /* Flush routes if device is being removed or it is not loopback */
-        if (how || !(dev->flags & IFF_LOOPBACK))
-                rt6_ifdown(net, dev);
+        rt6_ifdown(net, dev);
+        neigh_ifdown(&nd_tbl, dev);
 
         idev = __in6_dev_get(dev);
         if (idev == NULL)
@@ -2692,6 +2687,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
         }
 
+        /* Step 2: clear hash table */
+        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
+                struct hlist_head *h = &inet6_addr_lst[i];
+                struct hlist_node *n;
+
+                spin_lock_bh(&addrconf_hash_lock);
+        restart:
+                hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
+                        if (ifa->idev == idev) {
+                                hlist_del_init_rcu(&ifa->addr_lst);
+                                addrconf_del_timer(ifa);
+                                goto restart;
+                        }
+                }
+                spin_unlock_bh(&addrconf_hash_lock);
+        }
+
         write_lock_bh(&idev->lock);
 
         /* Step 2: clear flags for stateless addrconf */
@@ -2725,52 +2737,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                                        struct inet6_ifaddr, if_list);
                 addrconf_del_timer(ifa);
 
-                /* If just doing link down, and address is permanent
-                   and not link-local, then retain it. */
-                if (!how &&
-                    (ifa->flags&IFA_F_PERMANENT) &&
-                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
-                        list_move_tail(&ifa->if_list, &keep_list);
-
-                        /* If not doing DAD on this address, just keep it. */
-                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
-                            idev->cnf.accept_dad <= 0 ||
-                            (ifa->flags & IFA_F_NODAD))
-                                continue;
+                list_del(&ifa->if_list);
 
-                        /* If it was tentative already, no need to notify */
-                        if (ifa->flags & IFA_F_TENTATIVE)
-                                continue;
+                write_unlock_bh(&idev->lock);
 
-                        /* Flag it for later restoration when link comes up */
-                        ifa->flags |= IFA_F_TENTATIVE;
-                        ifa->state = INET6_IFADDR_STATE_DAD;
-                } else {
-                        list_del(&ifa->if_list);
-
-                        /* clear hash table */
-                        spin_lock_bh(&addrconf_hash_lock);
-                        hlist_del_init_rcu(&ifa->addr_lst);
-                        spin_unlock_bh(&addrconf_hash_lock);
-
-                        write_unlock_bh(&idev->lock);
-                        spin_lock_bh(&ifa->state_lock);
-                        state = ifa->state;
-                        ifa->state = INET6_IFADDR_STATE_DEAD;
-                        spin_unlock_bh(&ifa->state_lock);
-
-                        if (state != INET6_IFADDR_STATE_DEAD) {
-                                __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                                atomic_notifier_call_chain(&inet6addr_chain,
-                                                           NETDEV_DOWN, ifa);
-                        }
+                spin_lock_bh(&ifa->state_lock);
+                state = ifa->state;
+                ifa->state = INET6_IFADDR_STATE_DEAD;
+                spin_unlock_bh(&ifa->state_lock);
 
-                        in6_ifa_put(ifa);
-                        write_lock_bh(&idev->lock);
+                if (state != INET6_IFADDR_STATE_DEAD) {
+                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
                 }
-        }
+                in6_ifa_put(ifa);
 
-        list_splice(&keep_list, &idev->addr_list);
+                write_lock_bh(&idev->lock);
+        }
 
         write_unlock_bh(&idev->lock);
 
@@ -4159,8 +4142,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                 addrconf_leave_solict(ifp->idev, &ifp->addr);
                 dst_hold(&ifp->rt->dst);
 
-                if (ifp->state == INET6_IFADDR_STATE_DEAD &&
-                    ip6_del_rt(ifp->rt))
+                if (ip6_del_rt(ifp->rt))
                         dst_free(&ifp->rt->dst);
                 break;
         }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 9fab274019c..0e1d53bcf1e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -34,6 +34,7 @@
 #include <linux/seq_file.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/compat.h>
 #include <net/protocol.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
@@ -1804,6 +1805,80 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg)
         }
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_sioc_sg_req6 {
+        struct sockaddr_in6 src;
+        struct sockaddr_in6 grp;
+        compat_ulong_t pktcnt;
+        compat_ulong_t bytecnt;
+        compat_ulong_t wrong_if;
+};
+
+struct compat_sioc_mif_req6 {
+        mifi_t  mifi;
+        compat_ulong_t icount;
+        compat_ulong_t ocount;
+        compat_ulong_t ibytes;
+        compat_ulong_t obytes;
+};
+
+int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+{
+        struct compat_sioc_sg_req6 sr;
+        struct compat_sioc_mif_req6 vr;
+        struct mif_device *vif;
+        struct mfc6_cache *c;
+        struct net *net = sock_net(sk);
+        struct mr6_table *mrt;
+
+        mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
+        if (mrt == NULL)
+                return -ENOENT;
+
+        switch (cmd) {
+        case SIOCGETMIFCNT_IN6:
+                if (copy_from_user(&vr, arg, sizeof(vr)))
+                        return -EFAULT;
+                if (vr.mifi >= mrt->maxvif)
+                        return -EINVAL;
+                read_lock(&mrt_lock);
+                vif = &mrt->vif6_table[vr.mifi];
+                if (MIF_EXISTS(mrt, vr.mifi)) {
+                        vr.icount = vif->pkt_in;
+                        vr.ocount = vif->pkt_out;
+                        vr.ibytes = vif->bytes_in;
+                        vr.obytes = vif->bytes_out;
+                        read_unlock(&mrt_lock);
+
+                        if (copy_to_user(arg, &vr, sizeof(vr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                read_unlock(&mrt_lock);
+                return -EADDRNOTAVAIL;
+        case SIOCGETSGCNT_IN6:
+                if (copy_from_user(&sr, arg, sizeof(sr)))
+                        return -EFAULT;
+
+                read_lock(&mrt_lock);
+                c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr);
+                if (c) {
+                        sr.pktcnt = c->mfc_un.res.pkt;
+                        sr.bytecnt = c->mfc_un.res.bytes;
+                        sr.wrong_if = c->mfc_un.res.wrong_if;
+                        read_unlock(&mrt_lock);
+
+                        if (copy_to_user(arg, &sr, sizeof(sr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                read_unlock(&mrt_lock);
+                return -EADDRNOTAVAIL;
+        default:
+                return -ENOIOCTLCMD;
+        }
+}
+#endif
 
 static inline int ip6mr_forward2_finish(struct sk_buff *skb)
 {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 86c39526ba5..c5b0915d106 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -31,6 +31,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/skbuff.h>
+#include <linux/compat.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
 
@@ -1157,6 +1158,23 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
         }
 }
 
+#ifdef CONFIG_COMPAT
+static int compat_rawv6_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case SIOCOUTQ:
+        case SIOCINQ:
+                return -ENOIOCTLCMD;
+        default:
+#ifdef CONFIG_IPV6_MROUTE
+                return ip6mr_compat_ioctl(sk, cmd, compat_ptr(arg));
+#else
+                return -ENOIOCTLCMD;
+#endif
+        }
+}
+#endif
+
 static void rawv6_close(struct sock *sk, long timeout)
 {
         if (inet_sk(sk)->inet_num == IPPROTO_RAW)
@@ -1215,6 +1233,7 @@ struct proto rawv6_prot = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_rawv6_setsockopt,
         .compat_getsockopt = compat_rawv6_getsockopt,
+        .compat_ioctl      = compat_rawv6_ioctl,
 #endif
 };
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 373bd0416f6..1c29f95695d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -72,8 +72,6 @@
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
 
-#define CLONE_OFFLINK_ROUTE 0
-
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
@@ -115,6 +113,11 @@ static struct dst_ops ip6_dst_ops_template = {
         .local_out              =       __ip6_local_out,
 };
 
+static unsigned int ip6_blackhole_default_mtu(const struct dst_entry *dst)
+{
+        return 0;
+}
+
 static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
@@ -124,6 +127,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .protocol               =       cpu_to_be16(ETH_P_IPV6),
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
+        .default_mtu            =       ip6_blackhole_default_mtu,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
 };
 
@@ -196,7 +200,6 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                 in6_dev_put(idev);
         }
         if (peer) {
-                BUG_ON(!(rt->rt6i_flags & RTF_CACHE));
                 rt->rt6i_peer = NULL;
                 inet_putpeer(peer);
         }
@@ -206,9 +209,6 @@ void rt6_bind_peer(struct rt6_info *rt, int create)
 {
         struct inet_peer *peer;
 
-        if (WARN_ON(!(rt->rt6i_flags & RTF_CACHE)))
-                return;
-
         peer = inet_getpeer_v6(&rt->rt6i_dst.addr, create);
         if (peer && cmpxchg(&rt->rt6i_peer, NULL, peer) != NULL)
                 inet_putpeer(peer);
@@ -738,13 +738,8 @@ restart:
 
         if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
-        else {
-#if CLONE_OFFLINK_ROUTE
+        else
                 nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
-#else
-                goto out2;
-#endif
-        }
 
         dst_release(&rt->dst);
         rt = nrt ? : net->ipv6.ip6_null_entry;
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index fa1d8f4e005..7cb65ef79f9 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -15,6 +15,8 @@
 #include <net/addrconf.h>
 #include <net/inet_frag.h>
 
+static struct ctl_table empty[1];
+
 static ctl_table ipv6_table_template[] = {
         {
                 .procname       = "route",
@@ -35,6 +37,12 @@ static ctl_table ipv6_table_template[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
+        {
+                .procname       = "neigh",
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = empty,
+        },
         { }
 };
 
@@ -152,7 +160,6 @@ static struct ctl_table_header *ip6_base;
 
 int ipv6_static_sysctl_register(void)
 {
-        static struct ctl_table empty[1];
         ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
         if (ip6_base == NULL)
                 return -ENOMEM;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 7e74023ea6e..da87428681c 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -98,6 +98,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;
 
+        xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
+        if (rt->rt6i_peer)
+                atomic_inc(&rt->rt6i_peer->refcnt);
+
         /* Sheit... I remember I did this right. Apparently,
          * it was magically lost, so this code needs audit */
         xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
@@ -216,6 +220,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
 
         if (likely(xdst->u.rt6.rt6i_idev))
                 in6_dev_put(xdst->u.rt6.rt6i_idev);
+        if (likely(xdst->u.rt6.rt6i_peer))
+                inet_putpeer(xdst->u.rt6.rt6i_peer);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 9109262abd2..c766056d048 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -20,7 +20,7 @@ config MAC80211_HAS_RC
         def_bool n
 
 config MAC80211_RC_PID
-        bool "PID controller based rate control algorithm" if EMBEDDED
+        bool "PID controller based rate control algorithm" if EXPERT
         select MAC80211_HAS_RC
         ---help---
           This option enables a TX rate control algorithm for
@@ -28,14 +28,14 @@ config MAC80211_RC_PID
           rate.
 
 config MAC80211_RC_MINSTREL
-        bool "Minstrel" if EMBEDDED
+        bool "Minstrel" if EXPERT
         select MAC80211_HAS_RC
         default y
         ---help---
           This option enables the 'minstrel' TX rate control algorithm
 
 config MAC80211_RC_MINSTREL_HT
-        bool "Minstrel 802.11n support" if EMBEDDED
+        bool "Minstrel 802.11n support" if EXPERT
         depends on MAC80211_RC_MINSTREL
         default y
         ---help---
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index f138b195d65..227ca82eef7 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -185,8 +185,6 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
 {
-        struct ieee80211_hw *hw = &local->hw;
-        struct ieee80211_conf *conf = &hw->conf;
         struct tid_ampdu_rx *tid_agg_rx;
         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
         u8 dialog_token;
@@ -231,13 +229,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                 goto end_no_lock;
         }
         /* determine default buffer size */
-        if (buf_size == 0) {
-                struct ieee80211_supported_band *sband;
-
-                sband = local->hw.wiphy->bands[conf->channel->band];
-                buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << sband->ht_cap.ampdu_factor;
-        }
+        if (buf_size == 0)
+                buf_size = IEEE80211_MAX_AMPDU_BUF;
 
 
         /* examine state machine */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 485d36bc9a4..a46ff06d7cb 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -39,6 +39,8 @@ module_param(ieee80211_disable_40mhz_24ghz, bool, 0644);
 MODULE_PARM_DESC(ieee80211_disable_40mhz_24ghz,
                  "Disable 40MHz support in the 2.4GHz band");
 
+static struct lock_class_key ieee80211_rx_skb_queue_class;
+
 void ieee80211_configure_filter(struct ieee80211_local *local)
 {
         u64 mc;
@@ -569,7 +571,15 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         spin_lock_init(&local->filter_lock);
         spin_lock_init(&local->queue_stop_reason_lock);
 
-        skb_queue_head_init(&local->rx_skb_queue);
+        /*
+         * The rx_skb_queue is only accessed from tasklets,
+         * but other SKB queues are used from within IRQ
+         * context. Therefore, this one needs a different
+         * locking class so our direct, non-irq-safe use of
+         * the queue's lock doesn't throw lockdep warnings.
+         */
+        skb_queue_head_init_class(&local->rx_skb_queue,
+                                  &ieee80211_rx_skb_queue_class);
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5950e3abead..b64b42bc774 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2230,6 +2230,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
         sdata = vif_to_sdata(vif);
 
+        if (!ieee80211_sdata_running(sdata))
+                goto out;
+
         if (tim_offset)
                 *tim_offset = 0;
         if (tim_length)
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index 5702de35e2b..63a1b915a7e 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -63,6 +63,9 @@ void nf_ct_deliver_cached_events(struct nf_conn *ct)
                  * this does not harm and it happens very rarely. */
                 unsigned long missed = e->missed;
 
+                if (!((events | missed) & e->ctmask))
+                        goto out_unlock;
+
                 ret = notify->fcn(events | missed, &item);
                 if (unlikely(ret < 0 || missed)) {
                         spin_lock_bh(&ct->lock);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 2b7eef37875..eead9db6f89 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -667,6 +667,7 @@ restart:
                         if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
                                                 cb->nlh->nlmsg_seq,
                                                 IPCTNL_MSG_CT_NEW, ct) < 0) {
+                                nf_conntrack_get(&ct->ct_general);
                                 cb->args[1] = (unsigned long)ct;
                                 goto out;
                         }
@@ -924,7 +925,7 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         u16 zone;
         int err;
 
-        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP)
+        if (nlh->nlmsg_flags & NLM_F_DUMP)
                 return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
                                           ctnetlink_done);
 
@@ -1787,7 +1788,7 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         u16 zone;
         int err;
 
-        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 return netlink_dump_start(ctnl, skb, nlh,
                                           ctnetlink_exp_dump_table,
                                           ctnetlink_exp_done);
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index 88f7c3511c7..73c33a42f87 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -53,15 +53,13 @@ iprange_mt4(const struct sk_buff *skb, struct xt_action_param *par)
 }
 
 static inline int
-iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
+iprange_ipv6_lt(const struct in6_addr *a, const struct in6_addr *b)
 {
         unsigned int i;
-        int r;
 
         for (i = 0; i < 4; ++i) {
-                r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
-                if (r != 0)
-                        return r;
+                if (a->s6_addr32[i] != b->s6_addr32[i])
+                        return ntohl(a->s6_addr32[i]) < ntohl(b->s6_addr32[i]);
         }
 
         return 0;
@@ -75,15 +73,15 @@ iprange_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         bool m;
 
         if (info->flags & IPRANGE_SRC) {
-                m  = iprange_ipv6_sub(&iph->saddr, &info->src_min.in6) < 0;
-                m |= iprange_ipv6_sub(&iph->saddr, &info->src_max.in6) > 0;
+                m  = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6);
+                m |= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr);
                 m ^= !!(info->flags & IPRANGE_SRC_INV);
                 if (m)
                         return false;
         }
         if (info->flags & IPRANGE_DST) {
-                m  = iprange_ipv6_sub(&iph->daddr, &info->dst_min.in6) < 0;
-                m |= iprange_ipv6_sub(&iph->daddr, &info->dst_max.in6) > 0;
+                m  = iprange_ipv6_lt(&iph->daddr, &info->dst_min.in6);
+                m |= iprange_ipv6_lt(&info->dst_max.in6, &iph->daddr);
                 m ^= !!(info->flags & IPRANGE_DST_INV);
                 if (m)
                         return false;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index f83cb370292..1781d99145e 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -519,7 +519,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
             security_netlink_recv(skb, CAP_NET_ADMIN))
                 return -EPERM;
 
-        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 if (ops->dumpit == NULL)
                         return -EOPNOTSUPP;
 
diff --git a/net/rfkill/Kconfig b/net/rfkill/Kconfig
index eaf76587645..7fce6dfd218 100644
--- a/net/rfkill/Kconfig
+++ b/net/rfkill/Kconfig
@@ -18,7 +18,7 @@ config RFKILL_LEDS
         default y
 
 config RFKILL_INPUT
-        bool "RF switch input support" if EMBEDDED
+        bool "RF switch input support" if EXPERT
         depends on RFKILL
         depends on INPUT = y || RFKILL = INPUT
-        default y if !EMBEDDED
+        default y if !EXPERT
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index c80d1c210c5..5f63ec58942 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -390,7 +390,6 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         ret = qdisc_enqueue(skb, cl->q);
         if (ret == NET_XMIT_SUCCESS) {
                 sch->q.qlen++;
-                qdisc_bstats_update(sch, skb);
                 cbq_mark_toplevel(q, cl);
                 if (!cl->next_alive)
                         cbq_activate_class(cl);
@@ -649,7 +648,6 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
                 ret = qdisc_enqueue(skb, cl->q);
                 if (ret == NET_XMIT_SUCCESS) {
                         sch->q.qlen++;
-                        qdisc_bstats_update(sch, skb);
                         if (!cl->next_alive)
                                 cbq_activate_class(cl);
                         return 0;
@@ -971,6 +969,7 @@ cbq_dequeue(struct Qdisc *sch)
 
                 skb = cbq_dequeue_1(sch);
                 if (skb) {
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         sch->flags &= ~TCQ_F_THROTTLED;
                         return skb;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index de55e642eaf..6b7fe4a84f1 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -376,7 +376,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         bstats_update(&cl->bstats, skb);
-        qdisc_bstats_update(sch, skb);
 
         sch->q.qlen++;
         return err;
@@ -403,6 +402,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
                         skb = qdisc_dequeue_peeked(cl->qdisc);
                         if (cl->qdisc->q.qlen == 0)
                                 list_del(&cl->alist);
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 60f4bdd4408..0f7bf3fdfea 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -260,7 +260,6 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return err;
         }
 
-        qdisc_bstats_update(sch, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -283,6 +282,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
         if (skb == NULL)
                 return NULL;
 
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
 
         index = skb->tc_index & (p->indices - 1);
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index aa4d6337e43..d468b479aa9 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -46,17 +46,14 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
 static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 {
-        struct sk_buff *skb_head;
         struct fifo_sched_data *q = qdisc_priv(sch);
 
         if (likely(skb_queue_len(&sch->q) < q->limit))
                 return qdisc_enqueue_tail(skb, sch);
 
         /* queue full, remove one skb to fulfill the limit */
-        skb_head = qdisc_dequeue_head(sch);
+        __qdisc_queue_drop_head(sch, &sch->q);
         sch->qstats.drops++;
-        kfree_skb(skb_head);
-
         qdisc_enqueue_tail(skb, sch);
 
         return NET_XMIT_CN;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 2e45791d4f6..14a799de1c3 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1600,7 +1600,6 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 set_active(cl, qdisc_pkt_len(skb));
 
         bstats_update(&cl->bstats, skb);
-        qdisc_bstats_update(sch, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -1666,6 +1665,7 @@ hfsc_dequeue(struct Qdisc *sch)
         }
 
         sch->flags &= ~TCQ_F_THROTTLED;
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
 
         return skb;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 984c1b0c683..fc12fe6f559 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -574,7 +574,6 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         sch->q.qlen++;
-        qdisc_bstats_update(sch, skb);
         return NET_XMIT_SUCCESS;
 }
 
@@ -842,7 +841,7 @@ next:
 
 static struct sk_buff *htb_dequeue(struct Qdisc *sch)
 {
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         struct htb_sched *q = qdisc_priv(sch);
         int level;
         psched_time_t next_event;
@@ -851,6 +850,8 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
         /* try to dequeue direct packets as high prio (!) to minimize cpu work */
         skb = __skb_dequeue(&q->direct_queue);
         if (skb != NULL) {
+ok:
+                qdisc_bstats_update(sch, skb);
                 sch->flags &= ~TCQ_F_THROTTLED;
                 sch->q.qlen--;
                 return skb;
@@ -884,11 +885,8 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                         int prio = ffz(m);
                         m |= 1 << prio;
                         skb = htb_dequeue_tree(q, prio, level);
-                        if (likely(skb != NULL)) {
-                                sch->q.qlen--;
-                                sch->flags &= ~TCQ_F_THROTTLED;
-                                goto fin;
-                        }
+                        if (likely(skb != NULL))
+                                goto ok;
                 }
         }
         sch->qstats.overlimits++;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 21f13da2476..436a2e75b32 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -83,7 +83,6 @@ multiq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, qdisc);
         if (ret == NET_XMIT_SUCCESS) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
@@ -112,6 +111,7 @@ static struct sk_buff *multiq_dequeue(struct Qdisc *sch)
                         qdisc = q->queues[q->curband];
                         skb = qdisc->dequeue(qdisc);
                         if (skb) {
+                                qdisc_bstats_update(sch, skb);
                                 sch->q.qlen--;
                                 return skb;
                         }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 1c4bce86347..6a3006b38dc 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -240,7 +240,6 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         if (likely(ret == NET_XMIT_SUCCESS)) {
                 sch->q.qlen++;
-                qdisc_bstats_update(sch, skb);
         } else if (net_xmit_drop_count(ret)) {
                 sch->qstats.drops++;
         }
@@ -289,6 +288,7 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch)
                                 skb->tstamp.tv64 = 0;
 #endif
                         pr_debug("netem_dequeue: return skb=%p\n", skb);
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
@@ -476,7 +476,6 @@ static int tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
                 __skb_queue_after(list, skb, nskb);
 
                 sch->qstats.backlog += qdisc_pkt_len(nskb);
-                qdisc_bstats_update(sch, nskb);
 
                 return NET_XMIT_SUCCESS;
         }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 966158d49dd..fbd710d619b 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -84,7 +84,6 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, qdisc);
         if (ret == NET_XMIT_SUCCESS) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
@@ -116,6 +115,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc* sch)
                 struct Qdisc *qdisc = q->queues[prio];
                 struct sk_buff *skb = qdisc->dequeue(qdisc);
                 if (skb) {
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index a6009c5a2c9..9f98dbd32d4 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -94,7 +94,6 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
         ret = qdisc_enqueue(skb, child);
         if (likely(ret == NET_XMIT_SUCCESS)) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
         } else if (net_xmit_drop_count(ret)) {
                 q->stats.pdrop++;
@@ -114,11 +113,13 @@ static struct sk_buff * red_dequeue(struct Qdisc* sch)
         struct Qdisc *child = q->qdisc;
 
         skb = child->dequeue(child);
-        if (skb)
+        if (skb) {
+                qdisc_bstats_update(sch, skb);
                 sch->q.qlen--;
-        else if (!red_is_idling(&q->parms))
-                red_start_of_idle_period(&q->parms);
-
+        } else {
+                if (!red_is_idling(&q->parms))
+                        red_start_of_idle_period(&q->parms);
+        }
         return skb;
 }
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 239ec53a634..edea8cefec6 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -402,10 +402,8 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 q->tail = slot;
                 slot->allot = q->scaled_quantum;
         }
-        if (++sch->q.qlen <= q->limit) {
-                qdisc_bstats_update(sch, skb);
+        if (++sch->q.qlen <= q->limit)
                 return NET_XMIT_SUCCESS;
-        }
 
         sfq_drop(sch);
         return NET_XMIT_CN;
@@ -445,6 +443,7 @@ next_slot:
         }
         skb = slot_dequeue_head(slot);
         sfq_dec(q, a);
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
         sch->qstats.backlog -= qdisc_pkt_len(skb);
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 77565e72181..e93165820c3 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -134,7 +134,6 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         }
 
         sch->q.qlen++;
-        qdisc_bstats_update(sch, skb);
         return NET_XMIT_SUCCESS;
 }
 
@@ -187,6 +186,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
                         q->ptokens = ptoks;
                         sch->q.qlen--;
                         sch->flags &= ~TCQ_F_THROTTLED;
+                        qdisc_bstats_update(sch, skb);
                         return skb;
                 }
 
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 84ce48eadff..d84e7329660 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -87,7 +87,6 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
         if (q->q.qlen < dev->tx_queue_len) {
                 __skb_queue_tail(&q->q, skb);
-                qdisc_bstats_update(sch, skb);
                 return NET_XMIT_SUCCESS;
         }
 
@@ -111,6 +110,8 @@ teql_dequeue(struct Qdisc* sch)
                         dat->m->slaves = sch;
                         netif_wake_queue(m);
                 }
+        } else {
+                qdisc_bstats_update(sch, skb);
         }
         sch->q.qlen = dat->q.qlen + dat_queue->qdisc->q.qlen;
         return skb;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index a09b0dd25f5..8e02550ff3e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3428,7 +3428,7 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
                 retval = sctp_setsockopt_peer_addr_params(sk, optval, optlen);
                 break;
 
-        case SCTP_DELAYED_ACK:
+        case SCTP_DELAYED_SACK:
                 retval = sctp_setsockopt_delayed_ack(sk, optval, optlen);
                 break;
         case SCTP_PARTIAL_DELIVERY_POINT:
@@ -5333,7 +5333,7 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
                 retval = sctp_getsockopt_peer_addr_params(sk, len, optval,
                                                           optlen);
                 break;
-        case SCTP_DELAYED_ACK:
+        case SCTP_DELAYED_SACK:
                 retval = sctp_getsockopt_delayed_ack(sk, len, optval,
                                                           optlen);
                 break;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 7bd3bbba471..d802e941d36 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1609,9 +1609,7 @@ static struct svc_xprt *svc_bc_create_socket(struct svc_serv *serv,
  */
 static void svc_bc_sock_free(struct svc_xprt *xprt)
 {
-        if (xprt) {
-                kfree(xprt->xpt_bc_sid);
+        if (xprt)
                 kfree(container_of(xprt, struct svc_sock, sk_xprt));
-        }
 }
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index d0ee29063e5..1f1ef70f34f 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -95,7 +95,7 @@ config CFG80211_DEBUGFS
           If unsure, say N.
 
 config CFG80211_INTERNAL_REGDB
-        bool "use statically compiled regulatory rules database" if EMBEDDED
+        bool "use statically compiled regulatory rules database" if EXPERT
         default n
         depends on CFG80211
         ---help---
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d5e1e0b0889..61291965c5f 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2189,7 +2189,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
         if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
              type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
-            (nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+            (nlh->nlmsg_flags & NLM_F_DUMP)) {
                 if (link->dump == NULL)
                         return -EINVAL;
 
diff --git a/security/keys/Makefile b/security/keys/Makefile
index 6c941050f57..1bf090a885f 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -13,8 +13,8 @@ obj-y := \
         request_key_auth.o \
         user_defined.o
 
-obj-$(CONFIG_TRUSTED_KEYS) += trusted_defined.o
-obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted_defined.o
+obj-$(CONFIG_TRUSTED_KEYS) += trusted.o
+obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted.o
 obj-$(CONFIG_KEYS_COMPAT) += compat.o
 obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_SYSCTL) += sysctl.o
diff --git a/security/keys/compat.c b/security/keys/compat.c
index 792c0a611a6..07a5f35e397 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -1,4 +1,4 @@
-/* compat.c: 32-bit compatibility syscall for 64-bit systems
+/* 32-bit compatibility syscall for 64-bit systems
  *
  * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
@@ -14,13 +14,13 @@
 #include <linux/compat.h>
 #include "internal.h"
 
-/*****************************************************************************/
 /*
- * the key control system call, 32-bit compatibility version for 64-bit archs
- * - this should only be called if the 64-bit arch uses weird pointers in
- *   32-bit mode or doesn't guarantee that the top 32-bits of the argument
- *   registers on taking a 32-bit syscall are zero
- * - if you can, you should call sys_keyctl directly
+ * The key control system call, 32-bit compatibility version for 64-bit archs
+ *
+ * This should only be called if the 64-bit arch uses weird pointers in 32-bit
+ * mode or doesn't guarantee that the top 32-bits of the argument registers on
+ * taking a 32-bit syscall are zero.  If you can, you should call sys_keyctl()
+ * directly.
  */
 asmlinkage long compat_sys_keyctl(u32 option,
                                   u32 arg2, u32 arg3, u32 arg4, u32 arg5)
@@ -88,5 +88,4 @@ asmlinkage long compat_sys_keyctl(u32 option,
         default:
                 return -EOPNOTSUPP;
         }
-
-} /* end compat_sys_keyctl() */
+}
diff --git a/security/keys/encrypted_defined.c b/security/keys/encrypted.c
index 32d27c85838..9e7e4ce3fae 100644
--- a/security/keys/encrypted_defined.c
+++ b/security/keys/encrypted.c
@@ -30,7 +30,7 @@
 #include <crypto/sha.h>
 #include <crypto/aes.h>
 
-#include "encrypted_defined.h"
+#include "encrypted.h"
 
 static const char KEY_TRUSTED_PREFIX[] = "trusted:";
 static const char KEY_USER_PREFIX[] = "user:";
diff --git a/security/keys/encrypted_defined.h b/security/keys/encrypted.h
index cef5e2f2b7d..cef5e2f2b7d 100644
--- a/security/keys/encrypted_defined.h
+++ b/security/keys/encrypted.h
diff --git a/security/keys/gc.c b/security/keys/gc.c
index a46e825cbf0..89df6b5f203 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -32,8 +32,8 @@ static time_t key_gc_next_run = LONG_MAX;
 static time_t key_gc_new_timer;
 
 /*
- * Schedule a garbage collection run
- * - precision isn't particularly important
+ * Schedule a garbage collection run.
+ * - time precision isn't particularly important
  */
 void key_schedule_gc(time_t gc_at)
 {
@@ -61,8 +61,9 @@ static void key_gc_timer_func(unsigned long data)
 }
 
 /*
- * Garbage collect pointers from a keyring
- * - return true if we altered the keyring
+ * Garbage collect pointers from a keyring.
+ *
+ * Return true if we altered the keyring.
  */
 static bool key_gc_keyring(struct key *keyring, time_t limit)
         __releases(key_serial_lock)
@@ -107,9 +108,8 @@ do_gc:
 }
 
 /*
- * Garbage collector for keys
- * - this involves scanning the keyrings for dead, expired and revoked keys
- *   that have overstayed their welcome
+ * Garbage collector for keys.  This involves scanning the keyrings for dead,
+ * expired and revoked keys that have overstayed their welcome
  */
 static void key_garbage_collector(struct work_struct *work)
 {
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 56a133d8f37..a52aa7c88b4 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -1,4 +1,4 @@
-/* internal.h: authentication token and access key management internal defs
+/* Authentication token and access key management internal defs
  *
  * Copyright (C) 2003-5, 2007 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
@@ -35,10 +35,12 @@ extern struct key_type key_type_user;
 
 /*****************************************************************************/
 /*
- * keep track of keys for a user
- * - this needs to be separate to user_struct to avoid a refcount-loop
- *   (user_struct pins some keyrings which pin this struct)
- * - this also keeps track of keys under request from userspace for this UID
+ * Keep track of keys for a user.
+ *
+ * This needs to be separate to user_struct to avoid a refcount-loop
+ * (user_struct pins some keyrings which pin this struct).
+ *
+ * We also keep track of keys under request from userspace for this UID here.
  */
 struct key_user {
         struct rb_node          node;
@@ -62,7 +64,7 @@ extern struct key_user *key_user_lookup(uid_t uid,
 extern void key_user_put(struct key_user *user);
 
 /*
- * key quota limits
+ * Key quota limits.
  * - root has its own separate limits to everyone else
  */
 extern unsigned key_quota_root_maxkeys;
@@ -85,13 +87,13 @@ extern void key_type_put(struct key_type *ktype);
 extern int __key_link_begin(struct key *keyring,
                             const struct key_type *type,
                             const char *description,
-                            struct keyring_list **_prealloc);
+                            unsigned long *_prealloc);
 extern int __key_link_check_live_key(struct key *keyring, struct key *key);
 extern void __key_link(struct key *keyring, struct key *key,
-                       struct keyring_list **_prealloc);
+                       unsigned long *_prealloc);
 extern void __key_link_end(struct key *keyring,
                            struct key_type *type,
-                           struct keyring_list *prealloc);
+                           unsigned long prealloc);
 
 extern key_ref_t __keyring_search_one(key_ref_t keyring_ref,
                                       const struct key_type *type,
@@ -146,13 +148,13 @@ extern unsigned key_gc_delay;
 extern void keyring_gc(struct key *keyring, time_t limit);
 extern void key_schedule_gc(time_t expiry_at);
 
-/*
- * check to see whether permission is granted to use a key in the desired way
- */
 extern int key_task_permission(const key_ref_t key_ref,
                                const struct cred *cred,
                                key_perm_t perm);
 
+/*
+ * Check to see whether permission is granted to use a key in the desired way.
+ */
 static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
 {
         return key_task_permission(key_ref, current_cred(), perm);
@@ -168,7 +170,7 @@ static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
 #define KEY_ALL         0x3f    /* all the above permissions */
 
 /*
- * request_key authorisation
+ * Authorisation record for request_key().
  */
 struct request_key_auth {
         struct key              *target_key;
@@ -188,7 +190,7 @@ extern struct key *request_key_auth_new(struct key *target,
 extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
 
 /*
- * keyctl functions
+ * keyctl() functions
  */
 extern long keyctl_get_keyring_ID(key_serial_t, int);
 extern long keyctl_join_session_keyring(const char __user *);
@@ -214,7 +216,7 @@ extern long keyctl_get_security(key_serial_t keyid, char __user *buffer,
 extern long keyctl_session_to_parent(void);
 
 /*
- * debugging key validation
+ * Debugging key validation
  */
 #ifdef KEY_DEBUGGING
 extern void __key_check(const struct key *);
diff --git a/security/keys/key.c b/security/keys/key.c
index c1eac8084ad..1c2d43dc510 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -39,10 +39,10 @@ static DECLARE_RWSEM(key_types_sem);
 static void key_cleanup(struct work_struct *work);
 static DECLARE_WORK(key_cleanup_task, key_cleanup);
 
-/* we serialise key instantiation and link */
+/* We serialise key instantiation and link */
 DEFINE_MUTEX(key_construction_mutex);
 
-/* any key who's type gets unegistered will be re-typed to this */
+/* Any key who's type gets unegistered will be re-typed to this */
 static struct key_type key_type_dead = {
         .name           = "dead",
 };
@@ -56,10 +56,9 @@ void __key_check(const struct key *key)
 }
 #endif
 
-/*****************************************************************************/
 /*
- * get the key quota record for a user, allocating a new record if one doesn't
- * already exist
+ * Get the key quota record for a user, allocating a new record if one doesn't
+ * already exist.
  */
 struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
 {
@@ -67,7 +66,7 @@ struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
         struct rb_node *parent = NULL;
         struct rb_node **p;
 
- try_again:
+try_again:
         p = &key_user_tree.rb_node;
         spin_lock(&key_user_lock);
 
@@ -124,18 +123,16 @@ struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
         goto out;
 
         /* okay - we found a user record for this UID */
- found:
+found:
         atomic_inc(&user->usage);
         spin_unlock(&key_user_lock);
         kfree(candidate);
- out:
+out:
         return user;
+}
 
-} /* end key_user_lookup() */
-
-/*****************************************************************************/
 /*
- * dispose of a user structure
+ * Dispose of a user structure
  */
 void key_user_put(struct key_user *user)
 {
@@ -146,14 +143,11 @@ void key_user_put(struct key_user *user)
 
                 kfree(user);
         }
+}
 
-} /* end key_user_put() */
-
-/*****************************************************************************/
 /*
- * assign a key the next unique serial number
- * - these are assigned randomly to avoid security issues through covert
- *   channel problems
+ * Allocate a serial number for a key.  These are assigned randomly to avoid
+ * security issues through covert channel problems.
  */
 static inline void key_alloc_serial(struct key *key)
 {
@@ -211,18 +205,36 @@ serial_exists:
                 if (key->serial < xkey->serial)
                         goto attempt_insertion;
         }
+}
 
-} /* end key_alloc_serial() */
-
-/*****************************************************************************/
-/*
- * allocate a key of the specified type
- * - update the user's quota to reflect the existence of the key
- * - called from a key-type operation with key_types_sem read-locked by
- *   key_create_or_update()
- *   - this prevents unregistration of the key type
- * - upon return the key is as yet uninstantiated; the caller needs to either
- *   instantiate the key or discard it before returning
+/**
+ * key_alloc - Allocate a key of the specified type.
+ * @type: The type of key to allocate.
+ * @desc: The key description to allow the key to be searched out.
+ * @uid: The owner of the new key.
+ * @gid: The group ID for the new key's group permissions.
+ * @cred: The credentials specifying UID namespace.
+ * @perm: The permissions mask of the new key.
+ * @flags: Flags specifying quota properties.
+ *
+ * Allocate a key of the specified type with the attributes given.  The key is
+ * returned in an uninstantiated state and the caller needs to instantiate the
+ * key before returning.
+ *
+ * The user's key count quota is updated to reflect the creation of the key and
+ * the user's key data quota has the default for the key type reserved.  The
+ * instantiation function should amend this as necessary.  If insufficient
+ * quota is available, -EDQUOT will be returned.
+ *
+ * The LSM security modules can prevent a key being created, in which case
+ * -EACCES will be returned.
+ *
+ * Returns a pointer to the new key if successful and an error code otherwise.
+ *
+ * Note that the caller needs to ensure the key type isn't uninstantiated.
+ * Internally this can be done by locking key_types_sem.  Externally, this can
+ * be done by either never unregistering the key type, or making sure
+ * key_alloc() calls don't race with module unloading.
  */
 struct key *key_alloc(struct key_type *type, const char *desc,
                       uid_t uid, gid_t gid, const struct cred *cred,
@@ -344,14 +356,19 @@ no_quota:
         key_user_put(user);
         key = ERR_PTR(-EDQUOT);
         goto error;
-
-} /* end key_alloc() */
-
+}
 EXPORT_SYMBOL(key_alloc);
 
-/*****************************************************************************/
-/*
- * reserve an amount of quota for the key's payload
+/**
+ * key_payload_reserve - Adjust data quota reservation for the key's payload
+ * @key: The key to make the reservation for.
+ * @datalen: The amount of data payload the caller now wants.
+ *
+ * Adjust the amount of the owning user's key data quota that a key reserves.
+ * If the amount is increased, then -EDQUOT may be returned if there isn't
+ * enough free quota available.
+ *
+ * If successful, 0 is returned.
  */
 int key_payload_reserve(struct key *key, size_t datalen)
 {
@@ -384,22 +401,21 @@ int key_payload_reserve(struct key *key, size_t datalen)
                 key->datalen = datalen;
 
         return ret;
-
-} /* end key_payload_reserve() */
-
+}
 EXPORT_SYMBOL(key_payload_reserve);
 
-/*****************************************************************************/
 /*
- * instantiate a key and link it into the target keyring atomically
- * - called with the target keyring's semaphore writelocked
+ * Instantiate a key and link it into the target keyring atomically.  Must be
+ * called with the target keyring's semaphore writelocked.  The target key's
+ * semaphore need not be locked as instantiation is serialised by
+ * key_construction_mutex.
  */
 static int __key_instantiate_and_link(struct key *key,
                                       const void *data,
                                       size_t datalen,
                                       struct key *keyring,
                                       struct key *authkey,
-                                      struct keyring_list **_prealloc)
+                                      unsigned long *_prealloc)
 {
         int ret, awaken;
 
@@ -441,12 +457,23 @@ static int __key_instantiate_and_link(struct key *key,
                 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
 
         return ret;
+}
 
-} /* end __key_instantiate_and_link() */
-
-/*****************************************************************************/
-/*
- * instantiate a key and link it into the target keyring atomically
+/**
+ * key_instantiate_and_link - Instantiate a key and link it into the keyring.
+ * @key: The key to instantiate.
+ * @data: The data to use to instantiate the keyring.
+ * @datalen: The length of @data.
+ * @keyring: Keyring to create a link in on success (or NULL).
+ * @authkey: The authorisation token permitting instantiation.
+ *
+ * Instantiate a key that's in the uninstantiated state using the provided data
+ * and, if successful, link it in to the destination keyring if one is
+ * supplied.
+ *
+ * If successful, 0 is returned, the authorisation token is revoked and anyone
+ * waiting for the key is woken up.  If the key was already instantiated,
+ * -EBUSY will be returned.
  */
 int key_instantiate_and_link(struct key *key,
                              const void *data,
@@ -454,7 +481,7 @@ int key_instantiate_and_link(struct key *key,
                              struct key *keyring,
                              struct key *authkey)
 {
-        struct keyring_list *prealloc;
+        unsigned long prealloc;
         int ret;
 
         if (keyring) {
@@ -471,21 +498,35 @@ int key_instantiate_and_link(struct key *key,
                 __key_link_end(keyring, key->type, prealloc);
 
         return ret;
-
-} /* end key_instantiate_and_link() */
+}
 
 EXPORT_SYMBOL(key_instantiate_and_link);
 
-/*****************************************************************************/
-/*
- * negatively instantiate a key and link it into the target keyring atomically
+/**
+ * key_negate_and_link - Negatively instantiate a key and link it into the keyring.
+ * @key: The key to instantiate.
+ * @timeout: The timeout on the negative key.
+ * @keyring: Keyring to create a link in on success (or NULL).
+ * @authkey: The authorisation token permitting instantiation.
+ *
+ * Negatively instantiate a key that's in the uninstantiated state and, if
+ * successful, set its timeout and link it in to the destination keyring if one
+ * is supplied.  The key and any links to the key will be automatically garbage
+ * collected after the timeout expires.
+ *
+ * Negative keys are used to rate limit repeated request_key() calls by causing
+ * them to return -ENOKEY until the negative key expires.
+ *
+ * If successful, 0 is returned, the authorisation token is revoked and anyone
+ * waiting for the key is woken up.  If the key was already instantiated,
+ * -EBUSY will be returned.
  */
 int key_negate_and_link(struct key *key,
                         unsigned timeout,
                         struct key *keyring,
                         struct key *authkey)
 {
-        struct keyring_list *prealloc;
+        unsigned long prealloc;
         struct timespec now;
         int ret, awaken, link_ret = 0;
 
@@ -535,22 +576,23 @@ int key_negate_and_link(struct key *key,
                 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
 
         return ret == 0 ? link_ret : ret;
-
-} /* end key_negate_and_link() */
+}
 
 EXPORT_SYMBOL(key_negate_and_link);
 
-/*****************************************************************************/
 /*
- * do cleaning up in process context so that we don't have to disable
- * interrupts all over the place
+ * Garbage collect keys in process context so that we don't have to disable
+ * interrupts all over the place.
+ *
+ * key_put() schedules this rather than trying to do the cleanup itself, which
+ * means key_put() doesn't have to sleep.
  */
 static void key_cleanup(struct work_struct *work)
 {
         struct rb_node *_n;
         struct key *key;
 
- go_again:
+go_again:
         /* look for a dead key in the tree */
         spin_lock(&key_serial_lock);
 
@@ -564,7 +606,7 @@ static void key_cleanup(struct work_struct *work)
         spin_unlock(&key_serial_lock);
         return;
 
- found_dead_key:
+found_dead_key:
         /* we found a dead key - once we've removed it from the tree, we can
          * drop the lock */
         rb_erase(&key->serial_node, &key_serial_tree);
@@ -601,14 +643,15 @@ static void key_cleanup(struct work_struct *work)
 
         /* there may, of course, be more than one key to destroy */
         goto go_again;
+}
 
-} /* end key_cleanup() */
-
-/*****************************************************************************/
-/*
- * dispose of a reference to a key
- * - when all the references are gone, we schedule the cleanup task to come and
- *   pull it out of the tree in definite process context
+/**
+ * key_put - Discard a reference to a key.
+ * @key: The key to discard a reference from.
+ *
+ * Discard a reference to a key, and when all the references are gone, we
+ * schedule the cleanup task to come and pull it out of the tree in process
+ * context at some later time.
  */
 void key_put(struct key *key)
 {
@@ -618,14 +661,11 @@ void key_put(struct key *key)
                 if (atomic_dec_and_test(&key->usage))
                         schedule_work(&key_cleanup_task);
         }
-
-} /* end key_put() */
-
+}
 EXPORT_SYMBOL(key_put);
 
-/*****************************************************************************/
 /*
- * find a key by its serial number
+ * Find a key by its serial number.
  */
 struct key *key_lookup(key_serial_t id)
 {
@@ -647,11 +687,11 @@ struct key *key_lookup(key_serial_t id)
                         goto found;
         }
 
- not_found:
+not_found:
         key = ERR_PTR(-ENOKEY);
         goto error;
 
- found:
+found:
         /* pretend it doesn't exist if it is awaiting deletion */
         if (atomic_read(&key->usage) == 0)
                 goto not_found;
@@ -661,16 +701,16 @@ struct key *key_lookup(key_serial_t id)
          */
         atomic_inc(&key->usage);
 
- error:
+error:
         spin_unlock(&key_serial_lock);
         return key;
+}
 
-} /* end key_lookup() */
-
-/*****************************************************************************/
 /*
- * find and lock the specified key type against removal
- * - we return with the sem readlocked
+ * Find and lock the specified key type against removal.
+ *
+ * We return with the sem read-locked if successful.  If the type wasn't
+ * available -ENOKEY is returned instead.
  */
 struct key_type *key_type_lookup(const char *type)
 {
@@ -688,26 +728,23 @@ struct key_type *key_type_lookup(const char *type)
         up_read(&key_types_sem);
         ktype = ERR_PTR(-ENOKEY);
 
- found_kernel_type:
+found_kernel_type:
         return ktype;
+}
 
-} /* end key_type_lookup() */
-
-/*****************************************************************************/
 /*
- * unlock a key type
+ * Unlock a key type locked by key_type_lookup().
  */
 void key_type_put(struct key_type *ktype)
 {
         up_read(&key_types_sem);
+}
 
-} /* end key_type_put() */
-
-/*****************************************************************************/
 /*
- * attempt to update an existing key
- * - the key has an incremented refcount
- * - we need to put the key if we get an error
+ * Attempt to update an existing key.
+ *
+ * The key is given to us with an incremented refcount that we need to discard
+ * if we get an error.
  */
 static inline key_ref_t __key_update(key_ref_t key_ref,
                                      const void *payload, size_t plen)
@@ -742,13 +779,32 @@ error:
         key_put(key);
         key_ref = ERR_PTR(ret);
         goto out;
+}
 
-} /* end __key_update() */
-
-/*****************************************************************************/
-/*
- * search the specified keyring for a key of the same description; if one is
- * found, update it, otherwise add a new one
+/**
+ * key_create_or_update - Update or create and instantiate a key.
+ * @keyring_ref: A pointer to the destination keyring with possession flag.
+ * @type: The type of key.
+ * @description: The searchable description for the key.
+ * @payload: The data to use to instantiate or update the key.
+ * @plen: The length of @payload.
+ * @perm: The permissions mask for a new key.
+ * @flags: The quota flags for a new key.
+ *
+ * Search the destination keyring for a key of the same description and if one
+ * is found, update it, otherwise create and instantiate a new one and create a
+ * link to it from that keyring.
+ *
+ * If perm is KEY_PERM_UNDEF then an appropriate key permissions mask will be
+ * concocted.
+ *
+ * Returns a pointer to the new key if successful, -ENODEV if the key type
+ * wasn't available, -ENOTDIR if the keyring wasn't a keyring, -EACCES if the
+ * caller isn't permitted to modify the keyring or the LSM did not permit
+ * creation of the key.
+ *
+ * On success, the possession flag from the keyring ref will be tacked on to
+ * the key ref before it is returned.
  */
 key_ref_t key_create_or_update(key_ref_t keyring_ref,
                                const char *type,
@@ -758,7 +814,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                                key_perm_t perm,
                                unsigned long flags)
 {
-        struct keyring_list *prealloc;
+        unsigned long prealloc;
         const struct cred *cred = current_cred();
         struct key_type *ktype;
         struct key *keyring, *key = NULL;
@@ -855,14 +911,21 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
 
         key_ref = __key_update(key_ref, payload, plen);
         goto error;
-
-} /* end key_create_or_update() */
-
+}
 EXPORT_SYMBOL(key_create_or_update);
 
-/*****************************************************************************/
-/*
- * update a key
+/**
+ * key_update - Update a key's contents.
+ * @key_ref: The pointer (plus possession flag) to the key.
+ * @payload: The data to be used to update the key.
+ * @plen: The length of @payload.
+ *
+ * Attempt to update the contents of a key with the given payload data.  The
+ * caller must be granted Write permission on the key.  Negative keys can be
+ * instantiated by this method.
+ *
+ * Returns 0 on success, -EACCES if not permitted and -EOPNOTSUPP if the key
+ * type does not support updating.  The key type may return other errors.
  */
 int key_update(key_ref_t key_ref, const void *payload, size_t plen)
 {
@@ -891,14 +954,17 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
 
  error:
         return ret;
-
-} /* end key_update() */
-
+}
 EXPORT_SYMBOL(key_update);
 
-/*****************************************************************************/
-/*
- * revoke a key
+/**
+ * key_revoke - Revoke a key.
+ * @key: The key to be revoked.
+ *
+ * Mark a key as being revoked and ask the type to free up its resources.  The
+ * revocation timeout is set and the key and all its links will be
+ * automatically garbage collected after key_gc_delay amount of time if they
+ * are not manually dealt with first.
  */
 void key_revoke(struct key *key)
 {
@@ -926,14 +992,16 @@ void key_revoke(struct key *key)
         }
 
         up_write(&key->sem);
-
-} /* end key_revoke() */
-
+}
 EXPORT_SYMBOL(key_revoke);
 
-/*****************************************************************************/
-/*
- * register a type of key
+/**
+ * register_key_type - Register a type of key.
+ * @ktype: The new key type.
+ *
+ * Register a new key type.
+ *
+ * Returns 0 on success or -EEXIST if a type of this name already exists.
  */
 int register_key_type(struct key_type *ktype)
 {
@@ -953,17 +1021,19 @@ int register_key_type(struct key_type *ktype)
         list_add(&ktype->link, &key_types_list);
         ret = 0;
 
- out:
+out:
         up_write(&key_types_sem);
         return ret;
-
-} /* end register_key_type() */
-
+}
 EXPORT_SYMBOL(register_key_type);
 
-/*****************************************************************************/
-/*
- * unregister a type of key
+/**
+ * unregister_key_type - Unregister a type of key.
+ * @ktype: The key type.
+ *
+ * Unregister a key type and mark all the extant keys of this type as dead.
+ * Those keys of this type are then destroyed to get rid of their payloads and
+ * they and their links will be garbage collected as soon as possible.
  */
 void unregister_key_type(struct key_type *ktype)
 {
@@ -1010,14 +1080,11 @@ void unregister_key_type(struct key_type *ktype)
         up_write(&key_types_sem);
 
         key_schedule_gc(0);
-
-} /* end unregister_key_type() */
-
+}
 EXPORT_SYMBOL(unregister_key_type);
 
-/*****************************************************************************/
 /*
- * initialise the key management stuff
+ * Initialise the key management state.
  */
 void __init key_init(void)
 {
@@ -1037,5 +1104,4 @@ void __init key_init(void)
 
         rb_insert_color(&root_key_user.node,
                         &key_user_tree);
-
-} /* end key_init() */
+}
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 60924f6a52d..31a0fd8189f 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1,4 +1,4 @@
-/* keyctl.c: userspace keyctl operations
+/* Userspace key control operations
  *
  * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
@@ -31,28 +31,24 @@ static int key_get_type_from_user(char *type,
         int ret;
 
         ret = strncpy_from_user(type, _type, len);
-
         if (ret < 0)
                 return ret;
-
         if (ret == 0 || ret >= len)
                 return -EINVAL;
-
         if (type[0] == '.')
                 return -EPERM;
-
         type[len - 1] = '\0';
-
         return 0;
 }
 
-/*****************************************************************************/
 /*
- * extract the description of a new key from userspace and either add it as a
- * new key to the specified keyring or update a matching key in that keyring
- * - the keyring must be writable
- * - returns the new key's serial number
- * - implements add_key()
+ * Extract the description of a new key from userspace and either add it as a
+ * new key to the specified keyring or update a matching key in that keyring.
+ *
+ * The keyring must be writable so that we can attach the key to it.
+ *
+ * If successful, the new key's serial number is returned, otherwise an error
+ * code is returned.
  */
 SYSCALL_DEFINE5(add_key, const char __user *, _type,
                 const char __user *, _description,
@@ -132,19 +128,20 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
         kfree(description);
  error:
         return ret;
+}
 
-} /* end sys_add_key() */
-
-/*****************************************************************************/
 /*
- * search the process keyrings for a matching key
- * - nested keyrings may also be searched if they have Search permission
- * - if a key is found, it will be attached to the destination keyring if
- *   there's one specified
- * - /sbin/request-key will be invoked if _callout_info is non-NULL
- *   - the _callout_info string will be passed to /sbin/request-key
- *   - if the _callout_info string is empty, it will be rendered as "-"
- * - implements request_key()
+ * Search the process keyrings and keyring trees linked from those for a
+ * matching key.  Keyrings must have appropriate Search permission to be
+ * searched.
+ *
+ * If a key is found, it will be attached to the destination keyring if there's
+ * one specified and the serial number of the key will be returned.
+ *
+ * If no key is found, /sbin/request-key will be invoked if _callout_info is
+ * non-NULL in an attempt to create a key.  The _callout_info string will be
+ * passed to /sbin/request-key to aid with completing the request.  If the
+ * _callout_info string is "" then it will be changed to "-".
  */
 SYSCALL_DEFINE4(request_key, const char __user *, _type,
                 const char __user *, _description,
@@ -222,14 +219,14 @@ error2:
         kfree(description);
 error:
         return ret;
+}
 
-} /* end sys_request_key() */
-
-/*****************************************************************************/
 /*
- * get the ID of the specified process keyring
- * - the keyring must have search permission to be found
- * - implements keyctl(KEYCTL_GET_KEYRING_ID)
+ * Get the ID of the specified process keyring.
+ *
+ * The requested keyring must have search permission to be found.
+ *
+ * If successful, the ID of the requested keyring will be returned.
  */
 long keyctl_get_keyring_ID(key_serial_t id, int create)
 {
@@ -248,13 +245,17 @@ long keyctl_get_keyring_ID(key_serial_t id, int create)
         key_ref_put(key_ref);
 error:
         return ret;
+}
 
-} /* end keyctl_get_keyring_ID() */
-
-/*****************************************************************************/
 /*
- * join the session keyring
- * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING)
+ * Join a (named) session keyring.
+ *
+ * Create and join an anonymous session keyring or join a named session
+ * keyring, creating it if necessary.  A named session keyring must have Search
+ * permission for it to be joined.  Session keyrings without this permit will
+ * be skipped over.
+ *
+ * If successful, the ID of the joined session keyring will be returned.
  */
 long keyctl_join_session_keyring(const char __user *_name)
 {
@@ -277,14 +278,17 @@ long keyctl_join_session_keyring(const char __user *_name)
 
 error:
         return ret;
+}
 
-} /* end keyctl_join_session_keyring() */
-
-/*****************************************************************************/
 /*
- * update a key's data payload
- * - the key must be writable
- * - implements keyctl(KEYCTL_UPDATE)
+ * Update a key's data payload from the given data.
+ *
+ * The key must grant the caller Write permission and the key type must support
+ * updating for this to work.  A negative key can be positively instantiated
+ * with this call.
+ *
+ * If successful, 0 will be returned.  If the key type does not support
+ * updating, then -EOPNOTSUPP will be returned.
  */
 long keyctl_update_key(key_serial_t id,
                        const void __user *_payload,
@@ -326,14 +330,17 @@ error2:
         kfree(payload);
 error:
         return ret;
+}
 
-} /* end keyctl_update_key() */
-
-/*****************************************************************************/
 /*
- * revoke a key
- * - the key must be writable
- * - implements keyctl(KEYCTL_REVOKE)
+ * Revoke a key.
+ *
+ * The key must be grant the caller Write or Setattr permission for this to
+ * work.  The key type should give up its quota claim when revoked.  The key
+ * and any links to the key will be automatically garbage collected after a
+ * certain amount of time (/proc/sys/kernel/keys/gc_delay).
+ *
+ * If successful, 0 is returned.
  */
 long keyctl_revoke_key(key_serial_t id)
 {
@@ -358,14 +365,14 @@ long keyctl_revoke_key(key_serial_t id)
         key_ref_put(key_ref);
 error:
         return ret;
+}
 
-} /* end keyctl_revoke_key() */
-
-/*****************************************************************************/
 /*
- * clear the specified process keyring
- * - the keyring must be writable
- * - implements keyctl(KEYCTL_CLEAR)
+ * Clear the specified keyring, creating an empty process keyring if one of the
+ * special keyring IDs is used.
+ *
+ * The keyring must grant the caller Write permission for this to work.  If
+ * successful, 0 will be returned.
  */
 long keyctl_keyring_clear(key_serial_t ringid)
 {
@@ -383,15 +390,18 @@ long keyctl_keyring_clear(key_serial_t ringid)
         key_ref_put(keyring_ref);
 error:
         return ret;
+}
 
-} /* end keyctl_keyring_clear() */
-
-/*****************************************************************************/
 /*
- * link a key into a keyring
- * - the keyring must be writable
- * - the key must be linkable
- * - implements keyctl(KEYCTL_LINK)
+ * Create a link from a keyring to a key if there's no matching key in the
+ * keyring, otherwise replace the link to the matching key with a link to the
+ * new key.
+ *
+ * The key must grant the caller Link permission and the the keyring must grant
+ * the caller Write permission.  Furthermore, if an additional link is created,
+ * the keyring's quota will be extended.
+ *
+ * If successful, 0 will be returned.
  */
 long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
 {
@@ -417,15 +427,16 @@ error2:
         key_ref_put(keyring_ref);
 error:
         return ret;
+}
 
-} /* end keyctl_keyring_link() */
-
-/*****************************************************************************/
 /*
- * unlink the first attachment of a key from a keyring
- * - the keyring must be writable
- * - we don't need any permissions on the key
- * - implements keyctl(KEYCTL_UNLINK)
+ * Unlink a key from a keyring.
+ *
+ * The keyring must grant the caller Write permission for this to work; the key
+ * itself need not grant the caller anything.  If the last link to a key is
+ * removed then that key will be scheduled for destruction.
+ *
+ * If successful, 0 will be returned.
  */
 long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
 {
@@ -451,19 +462,20 @@ error2:
         key_ref_put(keyring_ref);
 error:
         return ret;
+}
 
-} /* end keyctl_keyring_unlink() */
-
-/*****************************************************************************/
 /*
- * describe a user key
- * - the key must have view permission
- * - if there's a buffer, we place up to buflen bytes of data into it
- * - unless there's an error, we return the amount of description available,
- *   irrespective of how much we may have copied
- * - the description is formatted thus:
+ * Return a description of a key to userspace.
+ *
+ * The key must grant the caller View permission for this to work.
+ *
+ * If there's a buffer, we place up to buflen bytes of data into it formatted
+ * in the following way:
+ *
  *      type;uid;gid;perm;description<NUL>
- * - implements keyctl(KEYCTL_DESCRIBE)
+ *
+ * If successful, we return the amount of description available, irrespective
+ * of how much we may have copied into the buffer.
  */
 long keyctl_describe_key(key_serial_t keyid,
                          char __user *buffer,
@@ -531,18 +543,17 @@ error2:
         key_ref_put(key_ref);
 error:
         return ret;
+}
 
-} /* end keyctl_describe_key() */
-
-/*****************************************************************************/
 /*
- * search the specified keyring for a matching key
- * - the start keyring must be searchable
- * - nested keyrings may also be searched if they are searchable
- * - only keys with search permission may be found
- * - if a key is found, it will be attached to the destination keyring if
- *   there's one specified
- * - implements keyctl(KEYCTL_SEARCH)
+ * Search the specified keyring and any keyrings it links to for a matching
+ * key.  Only keyrings that grant the caller Search permission will be searched
+ * (this includes the starting keyring).  Only keys with Search permission can
+ * be found.
+ *
+ * If successful, the found key will be linked to the destination keyring if
+ * supplied and the key has Link permission, and the found key ID will be
+ * returned.
  */
 long keyctl_keyring_search(key_serial_t ringid,
                            const char __user *_type,
@@ -626,18 +637,17 @@ error2:
         kfree(description);
 error:
         return ret;
+}
 
-} /* end keyctl_keyring_search() */
-
-/*****************************************************************************/
 /*
- * read a user key's payload
- * - the keyring must be readable or the key must be searchable from the
- *   process's keyrings
- * - if there's a buffer, we place up to buflen bytes of data into it
- * - unless there's an error, we return the amount of data in the key,
- *   irrespective of how much we may have copied
- * - implements keyctl(KEYCTL_READ)
+ * Read a key's payload.
+ *
+ * The key must either grant the caller Read permission, or it must grant the
+ * caller Search permission when searched for from the process keyrings.
+ *
+ * If successful, we place up to buflen bytes of data into the buffer, if one
+ * is provided, and return the amount of data that is available in the key,
+ * irrespective of how much we copied into the buffer.
  */
 long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 {
@@ -688,15 +698,22 @@ error2:
         key_put(key);
 error:
         return ret;
+}
 
-} /* end keyctl_read_key() */
-
-/*****************************************************************************/
 /*
- * change the ownership of a key
- * - the keyring owned by the changer
- * - if the uid or gid is -1, then that parameter is not changed
- * - implements keyctl(KEYCTL_CHOWN)
+ * Change the ownership of a key
+ *
+ * The key must grant the caller Setattr permission for this to work, though
+ * the key need not be fully instantiated yet.  For the UID to be changed, or
+ * for the GID to be changed to a group the caller is not a member of, the
+ * caller must have sysadmin capability.  If either uid or gid is -1 then that
+ * attribute is not changed.
+ *
+ * If the UID is to be changed, the new user must have sufficient quota to
+ * accept the key.  The quota deduction will be removed from the old user to
+ * the new user should the attribute be changed.
+ *
+ * If successful, 0 will be returned.
  */
 long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
 {
@@ -796,14 +813,14 @@ quota_overrun:
         zapowner = newowner;
         ret = -EDQUOT;
         goto error_put;
+}
 
-} /* end keyctl_chown_key() */
-
-/*****************************************************************************/
 /*
- * change the permission mask on a key
- * - the keyring owned by the changer
- * - implements keyctl(KEYCTL_SETPERM)
+ * Change the permission mask on a key.
+ *
+ * The key must grant the caller Setattr permission for this to work, though
+ * the key need not be fully instantiated yet.  If the caller does not have
+ * sysadmin capability, it may only change the permission on keys that it owns.
  */
 long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
 {
@@ -838,11 +855,11 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
         key_put(key);
 error:
         return ret;
-
-} /* end keyctl_setperm_key() */
+}
 
 /*
- * get the destination keyring for instantiation
+ * Get the destination keyring for instantiation and check that the caller has
+ * Write permission on it.
  */
 static long get_instantiation_keyring(key_serial_t ringid,
                                       struct request_key_auth *rka,
@@ -879,7 +896,7 @@ static long get_instantiation_keyring(key_serial_t ringid,
 }
 
 /*
- * change the request_key authorisation key on the current process
+ * Change the request_key authorisation key on the current process.
  */
 static int keyctl_change_reqkey_auth(struct key *key)
 {
@@ -895,10 +912,14 @@ static int keyctl_change_reqkey_auth(struct key *key)
         return commit_creds(new);
 }
 
-/*****************************************************************************/
 /*
- * instantiate the key with the specified payload, and, if one is given, link
- * the key into the keyring
+ * Instantiate a key with the specified payload and link the key into the
+ * destination keyring if one is given.
+ *
+ * The caller must have the appropriate instantiation permit set for this to
+ * work (see keyctl_assume_authority).  No other permissions are required.
+ *
+ * If successful, 0 will be returned.
  */
 long keyctl_instantiate_key(key_serial_t id,
                             const void __user *_payload,
@@ -973,13 +994,22 @@ error2:
                 vfree(payload);
 error:
         return ret;
+}
 
-} /* end keyctl_instantiate_key() */
-
-/*****************************************************************************/
 /*
- * negatively instantiate the key with the given timeout (in seconds), and, if
- * one is given, link the key into the keyring
+ * Negatively instantiate the key with the given timeout (in seconds) and link
+ * the key into the destination keyring if one is given.
+ *
+ * The caller must have the appropriate instantiation permit set for this to
+ * work (see keyctl_assume_authority).  No other permissions are required.
+ *
+ * The key and any links to the key will be automatically garbage collected
+ * after the timeout expires.
+ *
+ * Negative keys are used to rate limit repeated request_key() calls by causing
+ * them to return -ENOKEY until the negative key expires.
+ *
+ * If successful, 0 will be returned.
  */
 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 {
@@ -1020,13 +1050,14 @@ long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 
 error:
         return ret;
+}
 
-} /* end keyctl_negate_key() */
-
-/*****************************************************************************/
 /*
- * set the default keyring in which request_key() will cache keys
- * - return the old setting
+ * Read or set the default keyring in which request_key() will cache keys and
+ * return the old setting.
+ *
+ * If a process keyring is specified then this will be created if it doesn't
+ * yet exist.  The old setting will be returned if successful.
  */
 long keyctl_set_reqkey_keyring(int reqkey_defl)
 {
@@ -1079,12 +1110,19 @@ set:
 error:
         abort_creds(new);
         return ret;
+}
 
-} /* end keyctl_set_reqkey_keyring() */
-
-/*****************************************************************************/
 /*
- * set or clear the timeout for a key
+ * Set or clear the timeout on a key.
+ *
+ * Either the key must grant the caller Setattr permission or else the caller
+ * must hold an instantiation authorisation token for the key.
+ *
+ * The timeout is either 0 to clear the timeout, or a number of seconds from
+ * the current time.  The key and any links to the key will be automatically
+ * garbage collected after the timeout expires.
+ *
+ * If successful, 0 is returned.
  */
 long keyctl_set_timeout(key_serial_t id, unsigned timeout)
 {
@@ -1136,12 +1174,24 @@ okay:
         ret = 0;
 error:
         return ret;
+}
 
-} /* end keyctl_set_timeout() */
-
-/*****************************************************************************/
 /*
- * assume the authority to instantiate the specified key
+ * Assume (or clear) the authority to instantiate the specified key.
+ *
+ * This sets the authoritative token currently in force for key instantiation.
+ * This must be done for a key to be instantiated.  It has the effect of making
+ * available all the keys from the caller of the request_key() that created a
+ * key to request_key() calls made by the caller of this function.
+ *
+ * The caller must have the instantiation key in their process keyrings with a
+ * Search permission grant available to the caller.
+ *
+ * If the ID given is 0, then the setting will be cleared and 0 returned.
+ *
+ * If the ID given has a matching an authorisation key, then that key will be
+ * set and its ID will be returned.  The authorisation key can be read to get
+ * the callout information passed to request_key().
  */
 long keyctl_assume_authority(key_serial_t id)
 {
@@ -1178,16 +1228,17 @@ long keyctl_assume_authority(key_serial_t id)
         ret = authkey->serial;
 error:
         return ret;
-
-} /* end keyctl_assume_authority() */
+}
 
 /*
- * get the security label of a key
- * - the key must grant us view permission
- * - if there's a buffer, we place up to buflen bytes of data into it
- * - unless there's an error, we return the amount of information available,
- *   irrespective of how much we may have copied (including the terminal NUL)
- * - implements keyctl(KEYCTL_GET_SECURITY)
+ * Get a key's the LSM security label.
+ *
+ * The key must grant the caller View permission for this to work.
+ *
+ * If there's a buffer, then up to buflen bytes of data will be placed into it.
+ *
+ * If successful, the amount of information available will be returned,
+ * irrespective of how much was copied (including the terminal NUL).
  */
 long keyctl_get_security(key_serial_t keyid,
                          char __user *buffer,
@@ -1242,10 +1293,16 @@ long keyctl_get_security(key_serial_t keyid,
 }
 
 /*
- * attempt to install the calling process's session keyring on the process's
- * parent process
- * - the keyring must exist and must grant us LINK permission
- * - implements keyctl(KEYCTL_SESSION_TO_PARENT)
+ * Attempt to install the calling process's session keyring on the process's
+ * parent process.
+ *
+ * The keyring must exist and must grant the caller LINK permission, and the
+ * parent process must be single-threaded and must have the same effective
+ * ownership as this process and mustn't be SUID/SGID.
+ *
+ * The keyring will be emplaced on the parent when it next resumes userspace.
+ *
+ * If successful, 0 will be returned.
  */
 long keyctl_session_to_parent(void)
 {
@@ -1348,9 +1405,8 @@ error_keyring:
 #endif /* !TIF_NOTIFY_RESUME */
 }
 
-/*****************************************************************************/
 /*
- * the key control system call
+ * The key control system call
  */
 SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
                 unsigned long, arg4, unsigned long, arg5)
@@ -1439,5 +1495,4 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
         default:
                 return -EOPNOTSUPP;
         }
-
-} /* end sys_keyctl() */
+}
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d37f713e73c..5620f084ded 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -25,14 +25,16 @@
                 (keyring)->payload.subscriptions,                       \
                 rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
 
+#define KEY_LINK_FIXQUOTA 1UL
+
 /*
- * when plumbing the depths of the key tree, this sets a hard limit set on how
- * deep we're willing to go
+ * When plumbing the depths of the key tree, this sets a hard limit
+ * set on how deep we're willing to go.
  */
 #define KEYRING_SEARCH_MAX_DEPTH 6
 
 /*
- * we keep all named keyrings in a hash to speed looking them up
+ * We keep all named keyrings in a hash to speed looking them up.
  */
 #define KEYRING_NAME_HASH_SIZE  (1 << 5)
 
@@ -50,7 +52,9 @@ static inline unsigned keyring_hash(const char *desc)
 }
 
 /*
- * the keyring type definition
+ * The keyring key type definition.  Keyrings are simply keys of this type and
+ * can be treated as ordinary keys in addition to having their own special
+ * operations.
  */
 static int keyring_instantiate(struct key *keyring,
                                const void *data, size_t datalen);
@@ -71,19 +75,17 @@ struct key_type key_type_keyring = {
         .describe       = keyring_describe,
         .read           = keyring_read,
 };
-
 EXPORT_SYMBOL(key_type_keyring);
 
 /*
- * semaphore to serialise link/link calls to prevent two link calls in parallel
- * introducing a cycle
+ * Semaphore to serialise link/link calls to prevent two link calls in parallel
+ * introducing a cycle.
  */
 static DECLARE_RWSEM(keyring_serialise_link_sem);
 
-/*****************************************************************************/
 /*
- * publish the name of a keyring so that it can be found by name (if it has
- * one)
+ * Publish the name of a keyring so that it can be found by name (if it has
+ * one).
  */
 static void keyring_publish_name(struct key *keyring)
 {
@@ -102,13 +104,12 @@ static void keyring_publish_name(struct key *keyring)
 
                 write_unlock(&keyring_name_lock);
         }
+}
 
-} /* end keyring_publish_name() */
-
-/*****************************************************************************/
 /*
- * initialise a keyring
- * - we object if we were given any data
+ * Initialise a keyring.
+ *
+ * Returns 0 on success, -EINVAL if given any data.
  */
 static int keyring_instantiate(struct key *keyring,
                                const void *data, size_t datalen)
@@ -123,23 +124,20 @@ static int keyring_instantiate(struct key *keyring,
         }
 
         return ret;
+}
 
-} /* end keyring_instantiate() */
-
-/*****************************************************************************/
 /*
- * match keyrings on their name
+ * Match keyrings on their name
  */
 static int keyring_match(const struct key *keyring, const void *description)
 {
         return keyring->description &&
                 strcmp(keyring->description, description) == 0;
+}
 
-} /* end keyring_match() */
-
-/*****************************************************************************/
 /*
- * dispose of the data dangling from the corpse of a keyring
+ * Clean up a keyring when it is destroyed.  Unpublish its name if it had one
+ * and dispose of its data.
  */
 static void keyring_destroy(struct key *keyring)
 {
@@ -164,12 +162,10 @@ static void keyring_destroy(struct key *keyring)
                         key_put(klist->keys[loop]);
                 kfree(klist);
         }
+}
 
-} /* end keyring_destroy() */
-
-/*****************************************************************************/
 /*
- * describe the keyring
+ * Describe a keyring for /proc.
  */
 static void keyring_describe(const struct key *keyring, struct seq_file *m)
 {
@@ -187,13 +183,12 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
         else
                 seq_puts(m, ": empty");
         rcu_read_unlock();
+}
 
-} /* end keyring_describe() */
-
-/*****************************************************************************/
 /*
- * read a list of key IDs from the keyring's contents
- * - the keyring's semaphore is read-locked
+ * Read a list of key IDs from the keyring's contents in binary form
+ *
+ * The keyring's semaphore is read-locked by the caller.
  */
 static long keyring_read(const struct key *keyring,
                          char __user *buffer, size_t buflen)
@@ -241,12 +236,10 @@ static long keyring_read(const struct key *keyring,
 
 error:
         return ret;
+}
 
-} /* end keyring_read() */
-
-/*****************************************************************************/
 /*
- * allocate a keyring and link into the destination keyring
+ * Allocate a keyring and link into the destination keyring.
  */
 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
                           const struct cred *cred, unsigned long flags,
@@ -269,20 +262,42 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
         }
 
         return keyring;
+}
 
-} /* end keyring_alloc() */
-
-/*****************************************************************************/
-/*
- * search the supplied keyring tree for a key that matches the criterion
- * - perform a breadth-then-depth search up to the prescribed limit
- * - we only find keys on which we have search permission
- * - we use the supplied match function to see if the description (or other
- *   feature of interest) matches
- * - we rely on RCU to prevent the keyring lists from disappearing on us
- * - we return -EAGAIN if we didn't find any matching key
- * - we return -ENOKEY if we only found negative matching keys
- * - we propagate the possession attribute from the keyring ref to the key ref
+/**
+ * keyring_search_aux - Search a keyring tree for a key matching some criteria
+ * @keyring_ref: A pointer to the keyring with possession indicator.
+ * @cred: The credentials to use for permissions checks.
+ * @type: The type of key to search for.
+ * @description: Parameter for @match.
+ * @match: Function to rule on whether or not a key is the one required.
+ *
+ * Search the supplied keyring tree for a key that matches the criteria given.
+ * The root keyring and any linked keyrings must grant Search permission to the
+ * caller to be searchable and keys can only be found if they too grant Search
+ * to the caller. The possession flag on the root keyring pointer controls use
+ * of the possessor bits in permissions checking of the entire tree.  In
+ * addition, the LSM gets to forbid keyring searches and key matches.
+ *
+ * The search is performed as a breadth-then-depth search up to the prescribed
+ * limit (KEYRING_SEARCH_MAX_DEPTH).
+ *
+ * Keys are matched to the type provided and are then filtered by the match
+ * function, which is given the description to use in any way it sees fit.  The
+ * match function may use any attributes of a key that it wishes to to
+ * determine the match.  Normally the match function from the key type would be
+ * used.
+ *
+ * RCU is used to prevent the keyring key lists from disappearing without the
+ * need to take lots of locks.
+ *
+ * Returns a pointer to the found key and increments the key usage count if
+ * successful; -EAGAIN if no matching keys were found, or if expired or revoked
+ * keys were found; -ENOKEY if only negative keys were found; -ENOTDIR if the
+ * specified keyring wasn't a keyring.
+ *
+ * In the case of a successful return, the possession attribute from
+ * @keyring_ref is propagated to the returned key reference.
  */
 key_ref_t keyring_search_aux(key_ref_t keyring_ref,
                              const struct cred *cred,
@@ -444,17 +459,16 @@ error_2:
         rcu_read_unlock();
 error:
         return key_ref;
+}
 
-} /* end keyring_search_aux() */
-
-/*****************************************************************************/
-/*
- * search the supplied keyring tree for a key that matches the criterion
- * - perform a breadth-then-depth search up to the prescribed limit
- * - we only find keys on which we have search permission
- * - we readlock the keyrings as we search down the tree
- * - we return -EAGAIN if we didn't find any matching key
- * - we return -ENOKEY if we only found negative matching keys
+/**
+ * keyring_search - Search the supplied keyring tree for a matching key
+ * @keyring: The root of the keyring tree to be searched.
+ * @type: The type of keyring we want to find.
+ * @description: The name of the keyring we want to find.
+ *
+ * As keyring_search_aux() above, but using the current task's credentials and
+ * type's default matching function.
  */
 key_ref_t keyring_search(key_ref_t keyring,
                          struct key_type *type,
@@ -465,16 +479,23 @@ key_ref_t keyring_search(key_ref_t keyring,
 
         return keyring_search_aux(keyring, current->cred,
                                   type, description, type->match);
-
-} /* end keyring_search() */
-
+}
 EXPORT_SYMBOL(keyring_search);
 
-/*****************************************************************************/
 /*
- * search the given keyring only (no recursion)
- * - keyring must be locked by caller
- * - caller must guarantee that the keyring is a keyring
+ * Search the given keyring only (no recursion).
+ *
+ * The caller must guarantee that the keyring is a keyring and that the
+ * permission is granted to search the keyring as no check is made here.
+ *
+ * RCU is used to make it unnecessary to lock the keyring key list here.
+ *
+ * Returns a pointer to the found key with usage count incremented if
+ * successful and returns -ENOKEY if not found.  Revoked keys and keys not
+ * providing the requested permission are skipped over.
+ *
+ * If successful, the possession indicator is propagated from the keyring ref
+ * to the returned key reference.
  */
 key_ref_t __keyring_search_one(key_ref_t keyring_ref,
                                const struct key_type *ktype,
@@ -514,14 +535,18 @@ found:
         atomic_inc(&key->usage);
         rcu_read_unlock();
         return make_key_ref(key, possessed);
+}
 
-} /* end __keyring_search_one() */
-
-/*****************************************************************************/
 /*
- * find a keyring with the specified name
- * - all named keyrings are searched
- * - normally only finds keyrings with search permission for the current process
+ * Find a keyring with the specified name.
+ *
+ * All named keyrings in the current user namespace are searched, provided they
+ * grant Search permission directly to the caller (unless this check is
+ * skipped).  Keyrings whose usage points have reached zero or who have been
+ * revoked are skipped.
+ *
+ * Returns a pointer to the keyring with the keyring's refcount having being
+ * incremented on success.  -ENOKEY is returned if a key could not be found.
  */
 struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
 {
@@ -569,15 +594,14 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
 out:
         read_unlock(&keyring_name_lock);
         return keyring;
+}
 
-} /* end find_keyring_by_name() */
-
-/*****************************************************************************/
 /*
- * see if a cycle will will be created by inserting acyclic tree B in acyclic
- * tree A at the topmost level (ie: as a direct child of A)
- * - since we are adding B to A at the top level, checking for cycles should
- *   just be a matter of seeing if node A is somewhere in tree B
+ * See if a cycle will will be created by inserting acyclic tree B in acyclic
+ * tree A at the topmost level (ie: as a direct child of A).
+ *
+ * Since we are adding B to A at the top level, checking for cycles should just
+ * be a matter of seeing if node A is somewhere in tree B.
  */
 static int keyring_detect_cycle(struct key *A, struct key *B)
 {
@@ -657,11 +681,10 @@ too_deep:
 cycle_detected:
         ret = -EDEADLK;
         goto error;
-
-} /* end keyring_detect_cycle() */
+}
 
 /*
- * dispose of a keyring list after the RCU grace period, freeing the unlinked
+ * Dispose of a keyring list after the RCU grace period, freeing the unlinked
  * key
  */
 static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
@@ -675,14 +698,14 @@ static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
 }
 
 /*
- * preallocate memory so that a key can be linked into to a keyring
+ * Preallocate memory so that a key can be linked into to a keyring.
  */
 int __key_link_begin(struct key *keyring, const struct key_type *type,
-                     const char *description,
-                     struct keyring_list **_prealloc)
+                     const char *description, unsigned long *_prealloc)
         __acquires(&keyring->sem)
 {
         struct keyring_list *klist, *nklist;
+        unsigned long prealloc;
         unsigned max;
         size_t size;
         int loop, ret;
@@ -725,6 +748,7 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
 
                                 /* note replacement slot */
                                 klist->delkey = nklist->delkey = loop;
+                                prealloc = (unsigned long)nklist;
                                 goto done;
                         }
                 }
@@ -739,6 +763,7 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
         if (klist && klist->nkeys < klist->maxkeys) {
                 /* there's sufficient slack space to append directly */
                 nklist = NULL;
+                prealloc = KEY_LINK_FIXQUOTA;
         } else {
                 /* grow the key list */
                 max = 4;
@@ -773,8 +798,9 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
                 nklist->keys[nklist->delkey] = NULL;
         }
 
+        prealloc = (unsigned long)nklist | KEY_LINK_FIXQUOTA;
 done:
-        *_prealloc = nklist;
+        *_prealloc = prealloc;
         kleave(" = 0");
         return 0;
 
@@ -792,10 +818,10 @@ error_krsem:
 }
 
 /*
- * check already instantiated keys aren't going to be a problem
- * - the caller must have called __key_link_begin()
- * - don't need to call this for keys that were created since __key_link_begin()
- *   was called
+ * Check already instantiated keys aren't going to be a problem.
+ *
+ * The caller must have called __key_link_begin(). Don't need to call this for
+ * keys that were created since __key_link_begin() was called.
  */
 int __key_link_check_live_key(struct key *keyring, struct key *key)
 {
@@ -807,17 +833,20 @@ int __key_link_check_live_key(struct key *keyring, struct key *key)
 }
 
 /*
- * link a key into to a keyring
- * - must be called with __key_link_begin() having being called
- * - discard already extant link to matching key if there is one
+ * Link a key into to a keyring.
+ *
+ * Must be called with __key_link_begin() having being called.  Discards any
+ * already extant link to matching key if there is one, so that each keyring
+ * holds at most one link to any given key of a particular type+description
+ * combination.
  */
 void __key_link(struct key *keyring, struct key *key,
-                struct keyring_list **_prealloc)
+                unsigned long *_prealloc)
 {
         struct keyring_list *klist, *nklist;
 
-        nklist = *_prealloc;
-        *_prealloc = NULL;
+        nklist = (struct keyring_list *)(*_prealloc & ~KEY_LINK_FIXQUOTA);
+        *_prealloc = 0;
 
         kenter("%d,%d,%p", keyring->serial, key->serial, nklist);
 
@@ -852,34 +881,54 @@ void __key_link(struct key *keyring, struct key *key,
 }
 
 /*
- * finish linking a key into to a keyring
- * - must be called with __key_link_begin() having being called
+ * Finish linking a key into to a keyring.
+ *
+ * Must be called with __key_link_begin() having being called.
  */
 void __key_link_end(struct key *keyring, struct key_type *type,
-                    struct keyring_list *prealloc)
+                    unsigned long prealloc)
         __releases(&keyring->sem)
 {
         BUG_ON(type == NULL);
         BUG_ON(type->name == NULL);
-        kenter("%d,%s,%p", keyring->serial, type->name, prealloc);
+        kenter("%d,%s,%lx", keyring->serial, type->name, prealloc);
 
         if (type == &key_type_keyring)
                 up_write(&keyring_serialise_link_sem);
 
         if (prealloc) {
-                kfree(prealloc);
-                key_payload_reserve(keyring,
-                                    keyring->datalen - KEYQUOTA_LINK_BYTES);
+                if (prealloc & KEY_LINK_FIXQUOTA)
+                        key_payload_reserve(keyring,
+                                            keyring->datalen -
+                                            KEYQUOTA_LINK_BYTES);
+                kfree((struct keyring_list *)(prealloc & ~KEY_LINK_FIXQUOTA));
         }
         up_write(&keyring->sem);
 }
 
-/*
- * link a key to a keyring
+/**
+ * key_link - Link a key to a keyring
+ * @keyring: The keyring to make the link in.
+ * @key: The key to link to.
+ *
+ * Make a link in a keyring to a key, such that the keyring holds a reference
+ * on that key and the key can potentially be found by searching that keyring.
+ *
+ * This function will write-lock the keyring's semaphore and will consume some
+ * of the user's key data quota to hold the link.
+ *
+ * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring,
+ * -EKEYREVOKED if the keyring has been revoked, -ENFILE if the keyring is
+ * full, -EDQUOT if there is insufficient key data quota remaining to add
+ * another link or -ENOMEM if there's insufficient memory.
+ *
+ * It is assumed that the caller has checked that it is permitted for a link to
+ * be made (the keyring should have Write permission and the key Link
+ * permission).
  */
 int key_link(struct key *keyring, struct key *key)
 {
-        struct keyring_list *prealloc;
+        unsigned long prealloc;
         int ret;
 
         key_check(keyring);
@@ -895,12 +944,24 @@ int key_link(struct key *keyring, struct key *key)
 
         return ret;
 }
-
 EXPORT_SYMBOL(key_link);
 
-/*****************************************************************************/
-/*
- * unlink the first link to a key from a keyring
+/**
+ * key_unlink - Unlink the first link to a key from a keyring.
+ * @keyring: The keyring to remove the link from.
+ * @key: The key the link is to.
+ *
+ * Remove a link from a keyring to a key.
+ *
+ * This function will write-lock the keyring's semaphore.
+ *
+ * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring, -ENOENT if
+ * the key isn't linked to by the keyring or -ENOMEM if there's insufficient
+ * memory.
+ *
+ * It is assumed that the caller has checked that it is permitted for a link to
+ * be removed (the keyring should have Write permission; no permissions are
+ * required on the key).
  */
 int key_unlink(struct key *keyring, struct key *key)
 {
@@ -968,15 +1029,12 @@ nomem:
         ret = -ENOMEM;
         up_write(&keyring->sem);
         goto error;
-
-} /* end key_unlink() */
-
+}
 EXPORT_SYMBOL(key_unlink);
 
-/*****************************************************************************/
 /*
- * dispose of a keyring list after the RCU grace period, releasing the keys it
- * links to
+ * Dispose of a keyring list after the RCU grace period, releasing the keys it
+ * links to.
  */
 static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
 {
@@ -989,13 +1047,15 @@ static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
                 key_put(klist->keys[loop]);
 
         kfree(klist);
+}
 
-} /* end keyring_clear_rcu_disposal() */
-
-/*****************************************************************************/
-/*
- * clear the specified process keyring
- * - implements keyctl(KEYCTL_CLEAR)
+/**
+ * keyring_clear - Clear a keyring
+ * @keyring: The keyring to clear.
+ *
+ * Clear the contents of the specified keyring.
+ *
+ * Returns 0 if successful or -ENOTDIR if the keyring isn't a keyring.
  */
 int keyring_clear(struct key *keyring)
 {
@@ -1027,15 +1087,13 @@ int keyring_clear(struct key *keyring)
         }
 
         return ret;
-
-} /* end keyring_clear() */
-
+}
 EXPORT_SYMBOL(keyring_clear);
 
-/*****************************************************************************/
 /*
- * dispose of the links from a revoked keyring
- * - called with the key sem write-locked
+ * Dispose of the links from a revoked keyring.
+ *
+ * This is called with the key sem write-locked.
  */
 static void keyring_revoke(struct key *keyring)
 {
@@ -1050,11 +1108,10 @@ static void keyring_revoke(struct key *keyring)
                 rcu_assign_pointer(keyring->payload.subscriptions, NULL);
                 call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
         }
-
-} /* end keyring_revoke() */
+}
 
 /*
- * Determine whether a key is dead
+ * Determine whether a key is dead.
  */
 static bool key_is_dead(struct key *key, time_t limit)
 {
@@ -1063,7 +1120,12 @@ static bool key_is_dead(struct key *key, time_t limit)
 }
 
 /*
- * Collect garbage from the contents of a keyring
+ * Collect garbage from the contents of a keyring, replacing the old list with
+ * a new one with the pointers all shuffled down.
+ *
+ * Dead keys are classed as oned that are flagged as being dead or are revoked,
+ * expired or negative keys that were revoked or expired before the specified
+ * limit.
  */
 void keyring_gc(struct key *keyring, time_t limit)
 {
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 28645502cd0..c35b5229e3c 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -1,4 +1,4 @@
-/* permission.c: key permission determination
+/* Key permission checking
  *
  * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
@@ -13,18 +13,19 @@
 #include <linux/security.h>
 #include "internal.h"
 
-/*****************************************************************************/
 /**
  * key_task_permission - Check a key can be used
- * @key_ref: The key to check
- * @cred: The credentials to use
- * @perm: The permissions to check for
+ * @key_ref: The key to check.
+ * @cred: The credentials to use.
+ * @perm: The permissions to check for.
  *
  * Check to see whether permission is granted to use a key in the desired way,
  * but permit the security modules to override.
  *
- * The caller must hold either a ref on cred or must hold the RCU readlock or a
- * spinlock.
+ * The caller must hold either a ref on cred or must hold the RCU readlock.
+ *
+ * Returns 0 if successful, -EACCES if access is denied based on the
+ * permissions bits or the LSM check.
  */
 int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
                         key_perm_t perm)
@@ -79,14 +80,16 @@ use_these_perms:
 
         /* let LSM be the final arbiter */
         return security_key_permission(key_ref, cred, perm);
-
-} /* end key_task_permission() */
-
+}
 EXPORT_SYMBOL(key_task_permission);
 
-/*****************************************************************************/
-/*
- * validate a key
+/**
+ * key_validate - Validate a key.
+ * @key: The key to be validated.
+ *
+ * Check that a key is valid, returning 0 if the key is okay, -EKEYREVOKED if
+ * the key's type has been removed or if the key has been revoked or
+ * -EKEYEXPIRED if the key has expired.
  */
 int key_validate(struct key *key)
 {
@@ -111,7 +114,5 @@ int key_validate(struct key *key)
 
 error:
         return ret;
-
-} /* end key_validate() */
-
+}
 EXPORT_SYMBOL(key_validate);
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 70373966816..525cf8a29cd 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -1,4 +1,4 @@
-/* proc.c: proc files for key database enumeration
+/* procfs files for key database enumeration
  *
  * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
@@ -60,9 +60,8 @@ static const struct file_operations proc_key_users_fops = {
         .release        = seq_release,
 };
 
-/*****************************************************************************/
 /*
- * declare the /proc files
+ * Declare the /proc files.
  */
 static int __init key_proc_init(void)
 {
@@ -79,14 +78,13 @@ static int __init key_proc_init(void)
                 panic("Cannot create /proc/key-users\n");
 
         return 0;
-
-} /* end key_proc_init() */
+}
 
 __initcall(key_proc_init);
 
-/*****************************************************************************/
 /*
- * implement "/proc/keys" to provides a list of the keys on the system
+ * Implement "/proc/keys" to provide a list of the keys on the system that
+ * grant View permission to the caller.
  */
 #ifdef CONFIG_KEYS_DEBUG_PROC_KEYS
 
@@ -293,9 +291,9 @@ static struct rb_node *key_user_first(struct rb_root *r)
         return __key_user_next(n);
 }
 
-/*****************************************************************************/
 /*
- * implement "/proc/key-users" to provides a list of the key users
+ * Implement "/proc/key-users" to provides a list of the key users and their
+ * quotas.
  */
 static int proc_key_users_open(struct inode *inode, struct file *file)
 {
@@ -351,5 +349,4 @@ static int proc_key_users_show(struct seq_file *m, void *v)
                    maxbytes);
 
         return 0;
-
 }
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 504bdd2452b..930634e4514 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -1,4 +1,4 @@
-/* Management of a process's keyrings
+/* Manage a process's keyrings
  *
  * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
@@ -21,13 +21,13 @@
 #include <asm/uaccess.h>
 #include "internal.h"
 
-/* session keyring create vs join semaphore */
+/* Session keyring create vs join semaphore */
 static DEFINE_MUTEX(key_session_mutex);
 
-/* user keyring creation semaphore */
+/* User keyring creation semaphore */
 static DEFINE_MUTEX(key_user_keyring_mutex);
 
-/* the root user's tracking struct */
+/* The root user's tracking struct */
 struct key_user root_key_user = {
         .usage          = ATOMIC_INIT(3),
         .cons_lock      = __MUTEX_INITIALIZER(root_key_user.cons_lock),
@@ -38,9 +38,8 @@ struct key_user root_key_user = {
         .user_ns        = &init_user_ns,
 };
 
-/*****************************************************************************/
 /*
- * install user and user session keyrings for a particular UID
+ * Install the user and user session keyrings for the current process's UID.
  */
 int install_user_keyrings(void)
 {
@@ -122,7 +121,8 @@ error:
 }
 
 /*
- * install a fresh thread keyring directly to new credentials
+ * Install a fresh thread keyring directly to new credentials.  This keyring is
+ * allowed to overrun the quota.
  */
 int install_thread_keyring_to_cred(struct cred *new)
 {
@@ -138,7 +138,7 @@ int install_thread_keyring_to_cred(struct cred *new)
 }
 
 /*
- * install a fresh thread keyring, discarding the old one
+ * Install a fresh thread keyring, discarding the old one.
  */
 static int install_thread_keyring(void)
 {
@@ -161,9 +161,10 @@ static int install_thread_keyring(void)
 }
 
 /*
- * install a process keyring directly to a credentials struct
- * - returns -EEXIST if there was already a process keyring, 0 if one installed,
- *   and other -ve on any other error
+ * Install a process keyring directly to a credentials struct.
+ *
+ * Returns -EEXIST if there was already a process keyring, 0 if one installed,
+ * and other value on any other error
  */
 int install_process_keyring_to_cred(struct cred *new)
 {
@@ -192,8 +193,11 @@ int install_process_keyring_to_cred(struct cred *new)
 }
 
 /*
- * make sure a process keyring is installed
- * - we
+ * Make sure a process keyring is installed for the current process.  The
+ * existing process keyring is not replaced.
+ *
+ * Returns 0 if there is a process keyring by the end of this function, some
+ * error otherwise.
  */
 static int install_process_keyring(void)
 {
@@ -214,7 +218,7 @@ static int install_process_keyring(void)
 }
 
 /*
- * install a session keyring directly to a credentials struct
+ * Install a session keyring directly to a credentials struct.
  */
 int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 {
@@ -254,8 +258,8 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 }
 
 /*
- * install a session keyring, discarding the old one
- * - if a keyring is not supplied, an empty one is invented
+ * Install a session keyring, discarding the old one.  If a keyring is not
+ * supplied, an empty one is invented.
  */
 static int install_session_keyring(struct key *keyring)
 {
@@ -275,9 +279,8 @@ static int install_session_keyring(struct key *keyring)
         return commit_creds(new);
 }
 
-/*****************************************************************************/
 /*
- * the filesystem user ID changed
+ * Handle the fsuid changing.
  */
 void key_fsuid_changed(struct task_struct *tsk)
 {
@@ -288,12 +291,10 @@ void key_fsuid_changed(struct task_struct *tsk)
                 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
                 up_write(&tsk->cred->thread_keyring->sem);
         }
+}
 
-} /* end key_fsuid_changed() */
-
-/*****************************************************************************/
 /*
- * the filesystem group ID changed
+ * Handle the fsgid changing.
  */
 void key_fsgid_changed(struct task_struct *tsk)
 {
@@ -304,16 +305,28 @@ void key_fsgid_changed(struct task_struct *tsk)
                 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
                 up_write(&tsk->cred->thread_keyring->sem);
         }
+}
 
-} /* end key_fsgid_changed() */
-
-/*****************************************************************************/
 /*
- * search only my process keyrings for the first matching key
- * - we use the supplied match function to see if the description (or other
- *   feature of interest) matches
- * - we return -EAGAIN if we didn't find any matching key
- * - we return -ENOKEY if we found only negative matching keys
+ * Search the process keyrings attached to the supplied cred for the first
+ * matching key.
+ *
+ * The search criteria are the type and the match function.  The description is
+ * given to the match function as a parameter, but doesn't otherwise influence
+ * the search.  Typically the match function will compare the description
+ * parameter to the key's description.
+ *
+ * This can only search keyrings that grant Search permission to the supplied
+ * credentials.  Keyrings linked to searched keyrings will also be searched if
+ * they grant Search permission too.  Keys can only be found if they grant
+ * Search permission to the credentials.
+ *
+ * Returns a pointer to the key with the key usage count incremented if
+ * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only
+ * matched negative keys.
+ *
+ * In the case of a successful return, the possession attribute is set on the
+ * returned key reference.
  */
 key_ref_t search_my_process_keyrings(struct key_type *type,
                                      const void *description,
@@ -428,13 +441,13 @@ found:
         return key_ref;
 }
 
-/*****************************************************************************/
 /*
- * search the process keyrings for the first matching key
- * - we use the supplied match function to see if the description (or other
- *   feature of interest) matches
- * - we return -EAGAIN if we didn't find any matching key
- * - we return -ENOKEY if we found only negative matching keys
+ * Search the process keyrings attached to the supplied cred for the first
+ * matching key in the manner of search_my_process_keyrings(), but also search
+ * the keys attached to the assumed authorisation key using its credentials if
+ * one is available.
+ *
+ * Return same as search_my_process_keyrings().
  */
 key_ref_t search_process_keyrings(struct key_type *type,
                                   const void *description,
@@ -489,24 +502,33 @@ key_ref_t search_process_keyrings(struct key_type *type,
 
 found:
         return key_ref;
+}
 
-} /* end search_process_keyrings() */
-
-/*****************************************************************************/
 /*
- * see if the key we're looking at is the target key
+ * See if the key we're looking at is the target key.
  */
 int lookup_user_key_possessed(const struct key *key, const void *target)
 {
         return key == target;
+}
 
-} /* end lookup_user_key_possessed() */
-
-/*****************************************************************************/
 /*
- * lookup a key given a key ID from userspace with a given permissions mask
- * - don't create special keyrings unless so requested
- * - partially constructed keys aren't found unless requested
+ * Look up a key ID given us by userspace with a given permissions mask to get
+ * the key it refers to.
+ *
+ * Flags can be passed to request that special keyrings be created if referred
+ * to directly, to permit partially constructed keys to be found and to skip
+ * validity and permission checks on the found key.
+ *
+ * Returns a pointer to the key with an incremented usage count if successful;
+ * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond
+ * to a key or the best found key was a negative key; -EKEYREVOKED or
+ * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
+ * found key doesn't grant the requested permit or the LSM denied access to it;
+ * or -ENOMEM if a special keyring couldn't be created.
+ *
+ * In the case of a successful return, the possession attribute is set on the
+ * returned key reference.
  */
 key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
                           key_perm_t perm)
@@ -711,15 +733,18 @@ invalid_key:
 reget_creds:
         put_cred(cred);
         goto try_again;
+}
 
-} /* end lookup_user_key() */
-
-/*****************************************************************************/
 /*
- * join the named keyring as the session keyring if possible, or attempt to
- * create a new one of that name if not
- * - if the name is NULL, an empty anonymous keyring is installed instead
- * - named session keyring joining is done with a semaphore held
+ * Join the named keyring as the session keyring if possible else attempt to
+ * create a new one of that name and join that.
+ *
+ * If the name is NULL, an empty anonymous keyring will be installed as the
+ * session keyring.
+ *
+ * Named session keyrings are joined with a semaphore held to prevent the
+ * keyrings from going away whilst the attempt is made to going them and also
+ * to prevent a race in creating compatible session keyrings.
  */
 long join_session_keyring(const char *name)
 {
@@ -791,8 +816,8 @@ error:
 }
 
 /*
- * Replace a process's session keyring when that process resumes userspace on
- * behalf of one of its children
+ * Replace a process's session keyring on behalf of one of its children when
+ * the target  process is about to resume userspace execution.
  */
 void key_replace_session_keyring(void)
 {
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 0ea52d25a6b..a3dc0d460de 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -39,8 +39,14 @@ static int key_wait_bit_intr(void *flags)
         return signal_pending(current) ? -ERESTARTSYS : 0;
 }
 
-/*
- * call to complete the construction of a key
+/**
+ * complete_request_key - Complete the construction of a key.
+ * @cons: The key construction record.
+ * @error: The success or failute of the construction.
+ *
+ * Complete the attempt to construct a key.  The key will be negated
+ * if an error is indicated.  The authorisation key will be revoked
+ * unconditionally.
  */
 void complete_request_key(struct key_construction *cons, int error)
 {
@@ -58,23 +64,33 @@ void complete_request_key(struct key_construction *cons, int error)
 }
 EXPORT_SYMBOL(complete_request_key);
 
+/*
+ * Initialise a usermode helper that is going to have a specific session
+ * keyring.
+ *
+ * This is called in context of freshly forked kthread before kernel_execve(),
+ * so we can simply install the desired session_keyring at this point.
+ */
 static int umh_keys_init(struct subprocess_info *info)
 {
         struct cred *cred = (struct cred*)current_cred();
         struct key *keyring = info->data;
-        /*
-         * This is called in context of freshly forked kthread before
-         * kernel_execve(), we can just change our ->session_keyring.
-         */
+
         return install_session_keyring_to_cred(cred, keyring);
 }
 
+/*
+ * Clean up a usermode helper with session keyring.
+ */
 static void umh_keys_cleanup(struct subprocess_info *info)
 {
         struct key *keyring = info->data;
         key_put(keyring);
 }
 
+/*
+ * Call a usermode helper with a specific session keyring.
+ */
 static int call_usermodehelper_keys(char *path, char **argv, char **envp,
                          struct key *session_keyring, enum umh_wait wait)
 {
@@ -91,7 +107,7 @@ static int call_usermodehelper_keys(char *path, char **argv, char **envp,
 }
 
 /*
- * request userspace finish the construction of a key
+ * Request userspace finish the construction of a key
  * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
  */
 static int call_sbin_request_key(struct key_construction *cons,
@@ -198,8 +214,9 @@ error_alloc:
 }
 
 /*
- * call out to userspace for key construction
- * - we ignore program failure and go on key status instead
+ * Call out to userspace for key construction.
+ *
+ * Program failure is ignored in favour of key status.
  */
 static int construct_key(struct key *key, const void *callout_info,
                          size_t callout_len, void *aux,
@@ -246,9 +263,10 @@ static int construct_key(struct key *key, const void *callout_info,
 }
 
 /*
- * get the appropriate destination keyring for the request
- * - we return whatever keyring we select with an extra reference upon it which
- *   the caller must release
+ * Get the appropriate destination keyring for the request.
+ *
+ * The keyring selected is returned with an extra reference upon it which the
+ * caller must release.
  */
 static void construct_get_dest_keyring(struct key **_dest_keyring)
 {
@@ -321,9 +339,11 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
 }
 
 /*
- * allocate a new key in under-construction state and attempt to link it in to
- * the requested place
- * - may return a key that's already under construction instead
+ * Allocate a new key in under-construction state and attempt to link it in to
+ * the requested keyring.
+ *
+ * May return a key that's already under construction instead if there was a
+ * race between two thread calling request_key().
  */
 static int construct_alloc_key(struct key_type *type,
                                const char *description,
@@ -332,8 +352,8 @@ static int construct_alloc_key(struct key_type *type,
                                struct key_user *user,
                                struct key **_key)
 {
-        struct keyring_list *prealloc;
         const struct cred *cred = current_cred();
+        unsigned long prealloc;
         struct key *key;
         key_ref_t key_ref;
         int ret;
@@ -414,7 +434,7 @@ alloc_failed:
 }
 
 /*
- * commence key construction
+ * Commence key construction.
  */
 static struct key *construct_key_and_link(struct key_type *type,
                                           const char *description,
@@ -465,12 +485,32 @@ construction_failed:
         return ERR_PTR(ret);
 }
 
-/*
- * request a key
- * - search the process's keyrings
- * - check the list of keys being created or updated
- * - call out to userspace for a key if supplementary info was provided
- * - cache the key in an appropriate keyring
+/**
+ * request_key_and_link - Request a key and cache it in a keyring.
+ * @type: The type of key we want.
+ * @description: The searchable description of the key.
+ * @callout_info: The data to pass to the instantiation upcall (or NULL).
+ * @callout_len: The length of callout_info.
+ * @aux: Auxiliary data for the upcall.
+ * @dest_keyring: Where to cache the key.
+ * @flags: Flags to key_alloc().
+ *
+ * A key matching the specified criteria is searched for in the process's
+ * keyrings and returned with its usage count incremented if found.  Otherwise,
+ * if callout_info is not NULL, a key will be allocated and some service
+ * (probably in userspace) will be asked to instantiate it.
+ *
+ * If successfully found or created, the key will be linked to the destination
+ * keyring if one is provided.
+ *
+ * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
+ * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
+ * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
+ * if insufficient key quota was available to create a new key; or -ENOMEM if
+ * insufficient memory was available.
+ *
+ * If the returned key was created, then it may still be under construction,
+ * and wait_for_key_construction() should be used to wait for that to complete.
  */
 struct key *request_key_and_link(struct key_type *type,
                                  const char *description,
@@ -524,8 +564,16 @@ error:
         return key;
 }
 
-/*
- * wait for construction of a key to complete
+/**
+ * wait_for_key_construction - Wait for construction of a key to complete
+ * @key: The key being waited for.
+ * @intr: Whether to wait interruptibly.
+ *
+ * Wait for a key to finish being constructed.
+ *
+ * Returns 0 if successful; -ERESTARTSYS if the wait was interrupted; -ENOKEY
+ * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
+ * revoked or expired.
  */
 int wait_for_key_construction(struct key *key, bool intr)
 {
@@ -542,12 +590,19 @@ int wait_for_key_construction(struct key *key, bool intr)
 }
 EXPORT_SYMBOL(wait_for_key_construction);
 
-/*
- * request a key
- * - search the process's keyrings
- * - check the list of keys being created or updated
- * - call out to userspace for a key if supplementary info was provided
- * - waits uninterruptible for creation to complete
+/**
+ * request_key - Request a key and wait for construction
+ * @type: Type of key.
+ * @description: The searchable description of the key.
+ * @callout_info: The data to pass to the instantiation upcall (or NULL).
+ *
+ * As for request_key_and_link() except that it does not add the returned key
+ * to a keyring if found, new keys are always allocated in the user's quota,
+ * the callout_info must be a NUL-terminated string and no auxiliary data can
+ * be passed.
+ *
+ * Furthermore, it then works as wait_for_key_construction() to wait for the
+ * completion of keys undergoing construction with a non-interruptible wait.
  */
 struct key *request_key(struct key_type *type,
                         const char *description,
@@ -572,12 +627,19 @@ struct key *request_key(struct key_type *type,
 }
 EXPORT_SYMBOL(request_key);
 
-/*
- * request a key with auxiliary data for the upcaller
- * - search the process's keyrings
- * - check the list of keys being created or updated
- * - call out to userspace for a key if supplementary info was provided
- * - waits uninterruptible for creation to complete
+/**
+ * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
+ * @type: The type of key we want.
+ * @description: The searchable description of the key.
+ * @callout_info: The data to pass to the instantiation upcall (or NULL).
+ * @callout_len: The length of callout_info.
+ * @aux: Auxiliary data for the upcall.
+ *
+ * As for request_key_and_link() except that it does not add the returned key
+ * to a keyring if found and new keys are always allocated in the user's quota.
+ *
+ * Furthermore, it then works as wait_for_key_construction() to wait for the
+ * completion of keys undergoing construction with a non-interruptible wait.
  */
 struct key *request_key_with_auxdata(struct key_type *type,
                                      const char *description,
@@ -602,10 +664,18 @@ struct key *request_key_with_auxdata(struct key_type *type,
 EXPORT_SYMBOL(request_key_with_auxdata);
 
 /*
- * request a key (allow async construction)
- * - search the process's keyrings
- * - check the list of keys being created or updated
- * - call out to userspace for a key if supplementary info was provided
+ * request_key_async - Request a key (allow async construction)
+ * @type: Type of key.
+ * @description: The searchable description of the key.
+ * @callout_info: The data to pass to the instantiation upcall (or NULL).
+ * @callout_len: The length of callout_info.
+ *
+ * As for request_key_and_link() except that it does not add the returned key
+ * to a keyring if found, new keys are always allocated in the user's quota and
+ * no auxiliary data can be passed.
+ *
+ * The caller should call wait_for_key_construction() to wait for the
+ * completion of the returned key if it is still undergoing construction.
  */
 struct key *request_key_async(struct key_type *type,
                               const char *description,
@@ -620,9 +690,17 @@ EXPORT_SYMBOL(request_key_async);
 
 /*
  * request a key with auxiliary data for the upcaller (allow async construction)
- * - search the process's keyrings
- * - check the list of keys being created or updated
- * - call out to userspace for a key if supplementary info was provided
+ * @type: Type of key.
+ * @description: The searchable description of the key.
+ * @callout_info: The data to pass to the instantiation upcall (or NULL).
+ * @callout_len: The length of callout_info.
+ * @aux: Auxiliary data for the upcall.
+ *
+ * As for request_key_and_link() except that it does not add the returned key
+ * to a keyring if found and new keys are always allocated in the user's quota.
+ *
+ * The caller should call wait_for_key_construction() to wait for the
+ * completion of the returned key if it is still undergoing construction.
  */
 struct key *request_key_async_with_auxdata(struct key_type *type,
                                            const char *description,
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 86747151ee5..68164031a74 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -1,4 +1,4 @@
-/* request_key_auth.c: request key authorisation controlling key def
+/* Request key authorisation token key definition.
  *
  * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
@@ -26,7 +26,7 @@ static void request_key_auth_destroy(struct key *);
 static long request_key_auth_read(const struct key *, char __user *, size_t);
 
 /*
- * the request-key authorisation key type definition
+ * The request-key authorisation key type definition.
  */
 struct key_type key_type_request_key_auth = {
         .name           = ".request_key_auth",
@@ -38,9 +38,8 @@ struct key_type key_type_request_key_auth = {
         .read           = request_key_auth_read,
 };
 
-/*****************************************************************************/
 /*
- * instantiate a request-key authorisation key
+ * Instantiate a request-key authorisation key.
  */
 static int request_key_auth_instantiate(struct key *key,
                                         const void *data,
@@ -48,12 +47,10 @@ static int request_key_auth_instantiate(struct key *key,
 {
         key->payload.data = (struct request_key_auth *) data;
         return 0;
+}
 
-} /* end request_key_auth_instantiate() */
-
-/*****************************************************************************/
 /*
- * reading a request-key authorisation key retrieves the callout information
+ * Describe an authorisation token.
  */
 static void request_key_auth_describe(const struct key *key,
                                       struct seq_file *m)
@@ -63,12 +60,10 @@ static void request_key_auth_describe(const struct key *key,
         seq_puts(m, "key:");
         seq_puts(m, key->description);
         seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
+}
 
-} /* end request_key_auth_describe() */
-
-/*****************************************************************************/
 /*
- * read the callout_info data
+ * Read the callout_info data (retrieves the callout information).
  * - the key's semaphore is read-locked
  */
 static long request_key_auth_read(const struct key *key,
@@ -91,13 +86,12 @@ static long request_key_auth_read(const struct key *key,
         }
 
         return ret;
+}
 
-} /* end request_key_auth_read() */
-
-/*****************************************************************************/
 /*
- * handle revocation of an authorisation token key
- * - called with the key sem write-locked
+ * Handle revocation of an authorisation token key.
+ *
+ * Called with the key sem write-locked.
  */
 static void request_key_auth_revoke(struct key *key)
 {
@@ -109,12 +103,10 @@ static void request_key_auth_revoke(struct key *key)
                 put_cred(rka->cred);
                 rka->cred = NULL;
         }
+}
 
-} /* end request_key_auth_revoke() */
-
-/*****************************************************************************/
 /*
- * destroy an instantiation authorisation token key
+ * Destroy an instantiation authorisation token key.
  */
 static void request_key_auth_destroy(struct key *key)
 {
@@ -131,13 +123,11 @@ static void request_key_auth_destroy(struct key *key)
         key_put(rka->dest_keyring);
         kfree(rka->callout_info);
         kfree(rka);
+}
 
-} /* end request_key_auth_destroy() */
-
-/*****************************************************************************/
 /*
- * create an authorisation token for /sbin/request-key or whoever to gain
- * access to the caller's security data
+ * Create an authorisation token for /sbin/request-key or whoever to gain
+ * access to the caller's security data.
  */
 struct key *request_key_auth_new(struct key *target, const void *callout_info,
                                  size_t callout_len, struct key *dest_keyring)
@@ -228,12 +218,10 @@ error_alloc:
         kfree(rka);
         kleave("= %d", ret);
         return ERR_PTR(ret);
+}
 
-} /* end request_key_auth_new() */
-
-/*****************************************************************************/
 /*
- * see if an authorisation key is associated with a particular key
+ * See if an authorisation key is associated with a particular key.
  */
 static int key_get_instantiation_authkey_match(const struct key *key,
                                                const void *_id)
@@ -242,16 +230,11 @@ static int key_get_instantiation_authkey_match(const struct key *key,
         key_serial_t id = (key_serial_t)(unsigned long) _id;
 
         return rka->target_key->serial == id;
+}
 
-} /* end key_get_instantiation_authkey_match() */
-
-/*****************************************************************************/
 /*
- * get the authorisation key for instantiation of a specific key if attached to
- * the current process's keyrings
- * - this key is inserted into a keyring and that is set as /sbin/request-key's
- *   session keyring
- * - a target_id of zero specifies any valid token
+ * Search the current process's keyrings for the authorisation key for
+ * instantiation of a key.
  */
 struct key *key_get_instantiation_authkey(key_serial_t target_id)
 {
@@ -278,5 +261,4 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
 
 error:
         return authkey;
-
-} /* end key_get_instantiation_authkey() */
+}
diff --git a/security/keys/trusted_defined.c b/security/keys/trusted.c
index 975e9f29a52..83fc92e297c 100644
--- a/security/keys/trusted_defined.c
+++ b/security/keys/trusted.c
@@ -29,7 +29,7 @@
 #include <linux/tpm.h>
 #include <linux/tpm_command.h>
 
-#include "trusted_defined.h"
+#include "trusted.h"
 
 static const char hmac_alg[] = "hmac(sha1)";
 static const char hash_alg[] = "sha1";
@@ -101,11 +101,13 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
                 if (dlen == 0)
                         break;
                 data = va_arg(argp, unsigned char *);
-                if (data == NULL)
-                        return -EINVAL;
+                if (data == NULL) {
+                        ret = -EINVAL;
+                        break;
+                }
                 ret = crypto_shash_update(&sdesc->shash, data, dlen);
                 if (ret < 0)
-                        goto out;
+                        break;
         }
         va_end(argp);
         if (!ret)
@@ -146,14 +148,17 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key,
                 if (dlen == 0)
                         break;
                 data = va_arg(argp, unsigned char *);
-                ret = crypto_shash_update(&sdesc->shash, data, dlen);
-                if (ret < 0) {
-                        va_end(argp);
-                        goto out;
+                if (!data) {
+                        ret = -EINVAL;
+                        break;
                 }
+                ret = crypto_shash_update(&sdesc->shash, data, dlen);
+                if (ret < 0)
+                        break;
         }
         va_end(argp);
-        ret = crypto_shash_final(&sdesc->shash, paramdigest);
+        if (!ret)
+                ret = crypto_shash_final(&sdesc->shash, paramdigest);
         if (!ret)
                 ret = TSS_rawhmac(digest, key, keylen, SHA1_DIGEST_SIZE,
                                   paramdigest, TPM_NONCE_SIZE, h1,
@@ -222,13 +227,12 @@ static int TSS_checkhmac1(unsigned char *buffer,
                         break;
                 dpos = va_arg(argp, unsigned int);
                 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen);
-                if (ret < 0) {
-                        va_end(argp);
-                        goto out;
-                }
+                if (ret < 0)
+                        break;
         }
         va_end(argp);
-        ret = crypto_shash_final(&sdesc->shash, paramdigest);
+        if (!ret)
+                ret = crypto_shash_final(&sdesc->shash, paramdigest);
         if (ret < 0)
                 goto out;
 
@@ -316,13 +320,12 @@ static int TSS_checkhmac2(unsigned char *buffer,
                         break;
                 dpos = va_arg(argp, unsigned int);
                 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen);
-                if (ret < 0) {
-                        va_end(argp);
-                        goto out;
-                }
+                if (ret < 0)
+                        break;
         }
         va_end(argp);
-        ret = crypto_shash_final(&sdesc->shash, paramdigest);
+        if (!ret)
+                ret = crypto_shash_final(&sdesc->shash, paramdigest);
         if (ret < 0)
                 goto out;
 
@@ -511,7 +514,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
         /* get session for sealing key */
         ret = osap(tb, &sess, keyauth, keytype, keyhandle);
         if (ret < 0)
-                return ret;
+                goto out;
         dump_sess(&sess);
 
         /* calculate encrypted authorization value */
@@ -519,11 +522,11 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
         memcpy(td->xorwork + SHA1_DIGEST_SIZE, sess.enonce, SHA1_DIGEST_SIZE);
         ret = TSS_sha1(td->xorwork, SHA1_DIGEST_SIZE * 2, td->xorhash);
         if (ret < 0)
-                return ret;
+                goto out;
 
         ret = tpm_get_random(tb, td->nonceodd, TPM_NONCE_SIZE);
         if (ret < 0)
-                return ret;
+                goto out;
         ordinal = htonl(TPM_ORD_SEAL);
         datsize = htonl(datalen);
         pcrsize = htonl(pcrinfosize);
@@ -552,7 +555,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
                                    &datsize, datalen, data, 0, 0);
         }
         if (ret < 0)
-                return ret;
+                goto out;
 
         /* build and send the TPM request packet */
         INIT_BUF(tb);
@@ -572,7 +575,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
 
         ret = trusted_tpm_send(TPM_ANY_NUM, tb->data, MAX_BUF_SIZE);
         if (ret < 0)
-                return ret;
+                goto out;
 
         /* calculate the size of the returned Blob */
         sealinfosize = LOAD32(tb->data, TPM_DATA_OFFSET + sizeof(uint32_t));
@@ -591,6 +594,8 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
                 memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);
                 *bloblen = storedsize;
         }
+out:
+        kfree(td);
         return ret;
 }
 
@@ -1027,6 +1032,7 @@ static int trusted_update(struct key *key, const void *data, size_t datalen)
         ret = datablob_parse(datablob, new_p, new_o);
         if (ret != Opt_update) {
                 ret = -EINVAL;
+                kfree(new_p);
                 goto out;
         }
         /* copy old key values, and reseal with new pcrs */
diff --git a/security/keys/trusted_defined.h b/security/keys/trusted.h
index 3249fbd2b65..3249fbd2b65 100644
--- a/security/keys/trusted_defined.h
+++ b/security/keys/trusted.h
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index e9aa0792965..02807fb1634 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -35,7 +35,6 @@ struct key_type key_type_user = {
 
 EXPORT_SYMBOL_GPL(key_type_user);
 
-/*****************************************************************************/
 /*
  * instantiate a user defined key
  */
@@ -65,12 +64,10 @@ int user_instantiate(struct key *key, const void *data, size_t datalen)
 
 error:
         return ret;
-
-} /* end user_instantiate() */
+}
 
 EXPORT_SYMBOL_GPL(user_instantiate);
 
-/*****************************************************************************/
 /*
  * dispose of the old data from an updated user defined key
  */
@@ -81,10 +78,8 @@ static void user_update_rcu_disposal(struct rcu_head *rcu)
         upayload = container_of(rcu, struct user_key_payload, rcu);
 
         kfree(upayload);
+}
 
-} /* end user_update_rcu_disposal() */
-
-/*****************************************************************************/
 /*
  * update a user defined key
  * - the key's semaphore is write-locked
@@ -123,24 +118,20 @@ int user_update(struct key *key, const void *data, size_t datalen)
 
 error:
         return ret;
-
-} /* end user_update() */
+}
 
 EXPORT_SYMBOL_GPL(user_update);
 
-/*****************************************************************************/
 /*
  * match users on their name
  */
 int user_match(const struct key *key, const void *description)
 {
         return strcmp(key->description, description) == 0;
-
-} /* end user_match() */
+}
 
 EXPORT_SYMBOL_GPL(user_match);
 
-/*****************************************************************************/
 /*
  * dispose of the links from a revoked keyring
  * - called with the key sem write-locked
@@ -156,12 +147,10 @@ void user_revoke(struct key *key)
                 rcu_assign_pointer(key->payload.data, NULL);
                 call_rcu(&upayload->rcu, user_update_rcu_disposal);
         }
-
-} /* end user_revoke() */
+}
 
 EXPORT_SYMBOL(user_revoke);
 
-/*****************************************************************************/
 /*
  * dispose of the data dangling from the corpse of a user key
  */
@@ -170,12 +159,10 @@ void user_destroy(struct key *key)
         struct user_key_payload *upayload = key->payload.data;
 
         kfree(upayload);
-
-} /* end user_destroy() */
+}
 
 EXPORT_SYMBOL_GPL(user_destroy);
 
-/*****************************************************************************/
 /*
  * describe the user key
  */
@@ -184,12 +171,10 @@ void user_describe(const struct key *key, struct seq_file *m)
         seq_puts(m, key->description);
 
         seq_printf(m, ": %u", key->datalen);
-
-} /* end user_describe() */
+}
 
 EXPORT_SYMBOL_GPL(user_describe);
 
-/*****************************************************************************/
 /*
  * read the key data
  * - the key's semaphore is read-locked
@@ -213,7 +198,6 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
         }
 
         return ret;
-
-} /* end user_read() */
+}
 
 EXPORT_SYMBOL_GPL(user_read);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e276eb46853..c8d69927068 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3198,7 +3198,11 @@ static void selinux_cred_free(struct cred *cred)
 {
         struct task_security_struct *tsec = cred->security;
 
-        BUG_ON((unsigned long) cred->security < PAGE_SIZE);
+        /*
+         * cred->security == NULL if security_cred_alloc_blank() or
+         * security_prepare_creds() returned an error.
+         */
+        BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
         cred->security = (void *) 0x7UL;
         kfree(tsec);
 }
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index c3f845cbcd4..a53373207fb 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -178,7 +178,7 @@ int cond_init_bool_indexes(struct policydb *p)
         p->bool_val_to_struct = (struct cond_bool_datum **)
                 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
         if (!p->bool_val_to_struct)
-                return -1;
+                return -ENOMEM;
         return 0;
 }
 
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index be9de387283..57363562f0f 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -501,8 +501,8 @@ static int policydb_index(struct policydb *p)
         if (rc)
                 goto out;
 
-        rc = -ENOMEM;
-        if (cond_init_bool_indexes(p))
+        rc = cond_init_bool_indexes(p);
+        if (rc)
                 goto out;
 
         for (i = 0; i < SYM_NUM; i++) {
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 91acc9a243e..7c1fc64cb53 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -30,6 +30,8 @@
 
 #define DRIVER_NAME     "aaci-pl041"
 
+#define FRAME_PERIOD_US 21
+
 /*
  * PM support is not complete.  Turn it off.
  */
@@ -48,7 +50,11 @@ static void aaci_ac97_select_codec(struct aaci *aaci, struct snd_ac97 *ac97)
         if (v & SLFR_1RXV)
                 readl(aaci->base + AACI_SL1RX);
 
-        writel(maincr, aaci->base + AACI_MAINCR);
+        if (maincr != readl(aaci->base + AACI_MAINCR)) {
+                writel(maincr, aaci->base + AACI_MAINCR);
+                readl(aaci->base + AACI_MAINCR);
+                udelay(1);
+        }
 }
 
 /*
@@ -64,8 +70,8 @@ static void aaci_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
                             unsigned short val)
 {
         struct aaci *aaci = ac97->private_data;
+        int timeout;
         u32 v;
-        int timeout = 5000;
 
         if (ac97->num >= 4)
                 return;
@@ -81,14 +87,17 @@ static void aaci_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
         writel(val << 4, aaci->base + AACI_SL2TX);
         writel(reg << 12, aaci->base + AACI_SL1TX);
 
-        /*
-         * Wait for the transmission of both slots to complete.
-         */
+        /* Initially, wait one frame period */
+        udelay(FRAME_PERIOD_US);
+
+        /* And then wait an additional eight frame periods for it to be sent */
+        timeout = FRAME_PERIOD_US * 8;
         do {
+                udelay(1);
                 v = readl(aaci->base + AACI_SLFR);
         } while ((v & (SLFR_1TXB|SLFR_2TXB)) && --timeout);
 
-        if (!timeout)
+        if (v & (SLFR_1TXB|SLFR_2TXB))
                 dev_err(&aaci->dev->dev,
                         "timeout waiting for write to complete\n");
 
@@ -101,9 +110,8 @@ static void aaci_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
 static unsigned short aaci_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
 {
         struct aaci *aaci = ac97->private_data;
+        int timeout, retries = 10;
         u32 v;
-        int timeout = 5000;
-        int retries = 10;
 
         if (ac97->num >= 4)
                 return ~0;
@@ -117,35 +125,34 @@ static unsigned short aaci_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
          */
         writel((reg << 12) | (1 << 19), aaci->base + AACI_SL1TX);
 
-        /*
-         * Wait for the transmission to complete.
-         */
+        /* Initially, wait one frame period */
+        udelay(FRAME_PERIOD_US);
+
+        /* And then wait an additional eight frame periods for it to be sent */
+        timeout = FRAME_PERIOD_US * 8;
         do {
+                udelay(1);
                 v = readl(aaci->base + AACI_SLFR);
         } while ((v & SLFR_1TXB) && --timeout);
 
-        if (!timeout) {
+        if (v & SLFR_1TXB) {
                 dev_err(&aaci->dev->dev, "timeout on slot 1 TX busy\n");
                 v = ~0;
                 goto out;
         }
 
-        /*
-         * Give the AC'97 codec more than enough time
-         * to respond. (42us = ~2 frames at 48kHz.)
-         */
-        udelay(42);
+        /* Now wait for the response frame */
+        udelay(FRAME_PERIOD_US);
 
-        /*
-         * Wait for slot 2 to indicate data.
-         */
-        timeout = 5000;
+        /* And then wait an additional eight frame periods for data */
+        timeout = FRAME_PERIOD_US * 8;
         do {
+                udelay(1);
                 cond_resched();
                 v = readl(aaci->base + AACI_SLFR) & (SLFR_1RXV|SLFR_2RXV);
         } while ((v != (SLFR_1RXV|SLFR_2RXV)) && --timeout);
 
-        if (!timeout) {
+        if (v != (SLFR_1RXV|SLFR_2RXV)) {
                 dev_err(&aaci->dev->dev, "timeout on RX valid\n");
                 v = ~0;
                 goto out;
@@ -179,6 +186,7 @@ aaci_chan_wait_ready(struct aaci_runtime *aacirun, unsigned long mask)
         int timeout = 5000;
 
         do {
+                udelay(1);
                 val = readl(aacirun->base + AACI_SR);
         } while (val & mask && timeout--);
 }
@@ -874,7 +882,7 @@ static int __devinit aaci_probe_ac97(struct aaci *aaci)
          * Give the AC'97 codec more than enough time
          * to wake up. (42us = ~2 frames at 48kHz.)
          */
-        udelay(42);
+        udelay(FRAME_PERIOD_US * 2);
 
         ret = snd_ac97_bus(aaci->card, 0, &aaci_bus_ops, aaci, &ac97_bus);
         if (ret)
@@ -989,6 +997,8 @@ static unsigned int __devinit aaci_size_fifo(struct aaci *aaci)
          * disabling the channel doesn't clear the FIFO.
          */
         writel(aaci->maincr & ~MAINCR_IE, aaci->base + AACI_MAINCR);
+        readl(aaci->base + AACI_MAINCR);
+        udelay(1);
         writel(aaci->maincr, aaci->base + AACI_MAINCR);
 
         /*
diff --git a/sound/atmel/ac97c.c b/sound/atmel/ac97c.c
index 10c3a871a12..b310702c646 100644
--- a/sound/atmel/ac97c.c
+++ b/sound/atmel/ac97c.c
@@ -33,9 +33,12 @@
 #include <linux/dw_dmac.h>
 
 #include <mach/cpu.h>
-#include <mach/hardware.h>
 #include <mach/gpio.h>
 
+#ifdef CONFIG_ARCH_AT91
+#include <mach/hardware.h>
+#endif
+
 #include "ac97c.h"
 
 enum {
diff --git a/sound/drivers/mtpav.c b/sound/drivers/mtpav.c
index da03597fc89..5c426df8767 100644
--- a/sound/drivers/mtpav.c
+++ b/sound/drivers/mtpav.c
@@ -55,14 +55,13 @@
 #include <linux/err.h>
 #include <linux/platform_device.h>
 #include <linux/ioport.h>
+#include <linux/io.h>
 #include <linux/moduleparam.h>
 #include <sound/core.h>
 #include <sound/initval.h>
 #include <sound/rawmidi.h>
 #include <linux/delay.h>
 
-#include <asm/io.h>
-
 /*
  *      globals
  */
diff --git a/sound/oss/Makefile b/sound/oss/Makefile
index 96f14dcd0cd..90ffb99c6b1 100644
--- a/sound/oss/Makefile
+++ b/sound/oss/Makefile
@@ -87,7 +87,7 @@ ifeq ($(CONFIG_PSS_HAVE_BOOT),y)
         $(obj)/bin2hex pss_synth < $< > $@
 else
     $(obj)/pss_boot.h:
-        (                                                       \
+        $(Q)(                                                   \
             echo 'static unsigned char * pss_synth = NULL;';    \
             echo 'static int pss_synthLen = 0;';                \
         ) > $@
@@ -102,7 +102,7 @@ ifeq ($(CONFIG_TRIX_HAVE_BOOT),y)
         $(obj)/hex2hex -i trix_boot < $< > $@
 else
     $(obj)/trix_boot.h:
-        (                                                       \
+        $(Q)(                                                   \
             echo 'static unsigned char * trix_boot = NULL;';    \
             echo 'static int trix_boot_len = 0;';               \
         ) > $@
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 6117595fc07..573594bf322 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -979,31 +979,25 @@ snd_azf3328_codec_setfmt(struct snd_azf3328_codec_data *codec,
 
         snd_azf3328_dbgcallenter();
         switch (bitrate) {
-#define AZF_FMT_XLATE(in_freq, out_bits) \
-        do { \
-                case AZF_FREQ_ ## in_freq: \
-                        freq = SOUNDFORMAT_FREQ_ ## out_bits; \
-                        break; \
-        } while (0);
-        AZF_FMT_XLATE(4000, SUSPECTED_4000)
-        AZF_FMT_XLATE(4800, SUSPECTED_4800)
-        /* the AZF3328 names it "5510" for some strange reason: */
-        AZF_FMT_XLATE(5512, 5510)
-        AZF_FMT_XLATE(6620, 6620)
-        AZF_FMT_XLATE(8000, 8000)
-        AZF_FMT_XLATE(9600, 9600)
-        AZF_FMT_XLATE(11025, 11025)
-        AZF_FMT_XLATE(13240, SUSPECTED_13240)
-        AZF_FMT_XLATE(16000, 16000)
-        AZF_FMT_XLATE(22050, 22050)
-        AZF_FMT_XLATE(32000, 32000)
+        case AZF_FREQ_4000:  freq = SOUNDFORMAT_FREQ_SUSPECTED_4000; break;
+        case AZF_FREQ_4800:  freq = SOUNDFORMAT_FREQ_SUSPECTED_4800; break;
+        case AZF_FREQ_5512:
+                /* the AZF3328 names it "5510" for some strange reason */
+                             freq = SOUNDFORMAT_FREQ_5510; break;
+        case AZF_FREQ_6620:  freq = SOUNDFORMAT_FREQ_6620; break;
+        case AZF_FREQ_8000:  freq = SOUNDFORMAT_FREQ_8000; break;
+        case AZF_FREQ_9600:  freq = SOUNDFORMAT_FREQ_9600; break;
+        case AZF_FREQ_11025: freq = SOUNDFORMAT_FREQ_11025; break;
+        case AZF_FREQ_13240: freq = SOUNDFORMAT_FREQ_SUSPECTED_13240; break;
+        case AZF_FREQ_16000: freq = SOUNDFORMAT_FREQ_16000; break;
+        case AZF_FREQ_22050: freq = SOUNDFORMAT_FREQ_22050; break;
+        case AZF_FREQ_32000: freq = SOUNDFORMAT_FREQ_32000; break;
         default:
                 snd_printk(KERN_WARNING "unknown bitrate %d, assuming 44.1kHz!\n", bitrate);
                 /* fall-through */
-        AZF_FMT_XLATE(44100, 44100)
-        AZF_FMT_XLATE(48000, 48000)
-        AZF_FMT_XLATE(66200, SUSPECTED_66200)
-#undef AZF_FMT_XLATE
+        case AZF_FREQ_44100: freq = SOUNDFORMAT_FREQ_44100; break;
+        case AZF_FREQ_48000: freq = SOUNDFORMAT_FREQ_48000; break;
+        case AZF_FREQ_66200: freq = SOUNDFORMAT_FREQ_SUSPECTED_66200; break;
         }
         /* val = 0xff07; 3m27.993s (65301Hz; -> 64000Hz???) hmm, 66120, 65967, 66123 */
         /* val = 0xff09; 17m15.098s (13123,478Hz; -> 12000Hz???) hmm, 13237.2Hz? */
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index 4a663471dad..74b0560289c 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -381,7 +381,7 @@ static void hdmi_show_short_audio_desc(struct cea_sad *a)
         snd_print_pcm_rates(a->rates, buf, sizeof(buf));
 
         if (a->format == AUDIO_CODING_TYPE_LPCM)
-                snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2 - 8));
+                snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2) - 8);
         else if (a->max_bitrate)
                 snprintf(buf2, sizeof(buf2),
                                 ", max bitrate = %d", a->max_bitrate);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 9bb030a469c..fbe97d32140 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -85,6 +85,7 @@ struct conexant_spec {
         unsigned int auto_mic;
         int auto_mic_ext;               /* autocfg.inputs[] index for ext mic */
         unsigned int need_dac_fix;
+        hda_nid_t slave_dig_outs[2];
 
         /* capture */
         unsigned int num_adc_nids;
@@ -127,6 +128,7 @@ struct conexant_spec {
         unsigned int ideapad:1;
         unsigned int thinkpad:1;
         unsigned int hp_laptop:1;
+        unsigned int asus:1;
 
         unsigned int ext_mic_present;
         unsigned int recording;
@@ -352,6 +354,8 @@ static int conexant_build_pcms(struct hda_codec *codec)
                         info->stream[SNDRV_PCM_STREAM_CAPTURE].nid =
                                 spec->dig_in_nid;
                 }
+                if (spec->slave_dig_outs[0])
+                        codec->slave_dig_outs = spec->slave_dig_outs;
         }
 
         return 0;
@@ -403,10 +407,16 @@ static int conexant_add_jack(struct hda_codec *codec,
         struct conexant_spec *spec;
         struct conexant_jack *jack;
         const char *name;
-        int err;
+        int i, err;
 
         spec = codec->spec;
         snd_array_init(&spec->jacks, sizeof(*jack), 32);
+
+        jack = spec->jacks.list;
+        for (i = 0; i < spec->jacks.used; i++, jack++)
+                if (jack->nid == nid)
+                        return 0 ; /* already present */
+
         jack = snd_array_new(&spec->jacks);
         name = (type == SND_JACK_HEADPHONE) ? "Headphone" : "Mic" ;
 
@@ -2100,7 +2110,7 @@ static int patch_cxt5051(struct hda_codec *codec)
 static hda_nid_t cxt5066_dac_nids[1] = { 0x10 };
 static hda_nid_t cxt5066_adc_nids[3] = { 0x14, 0x15, 0x16 };
 static hda_nid_t cxt5066_capsrc_nids[1] = { 0x17 };
-#define CXT5066_SPDIF_OUT       0x21
+static hda_nid_t cxt5066_digout_pin_nids[2] = { 0x20, 0x22 };
 
 /* OLPC's microphone port is DC coupled for use with external sensors,
  * therefore we use a 50% mic bias in order to center the input signal with
@@ -2312,6 +2322,19 @@ static void cxt5066_ideapad_automic(struct hda_codec *codec)
         }
 }
 
+
+/* toggle input of built-in digital mic and mic jack appropriately */
+static void cxt5066_asus_automic(struct hda_codec *codec)
+{
+        unsigned int present;
+
+        present = snd_hda_jack_detect(codec, 0x1b);
+        snd_printdd("CXT5066: external microphone present=%d\n", present);
+        snd_hda_codec_write(codec, 0x17, 0, AC_VERB_SET_CONNECT_SEL,
+                            present ? 1 : 0);
+}
+
+
 /* toggle input of built-in digital mic and mic jack appropriately */
 static void cxt5066_hp_laptop_automic(struct hda_codec *codec)
 {
@@ -2387,79 +2410,55 @@ static void cxt5066_hp_automute(struct hda_codec *codec)
         cxt5066_update_speaker(codec);
 }
 
-/* unsolicited event for jack sensing */
-static void cxt5066_olpc_unsol_event(struct hda_codec *codec, unsigned int res)
+/* Dispatch the right mic autoswitch function */
+static void cxt5066_automic(struct hda_codec *codec)
 {
         struct conexant_spec *spec = codec->spec;
-        snd_printdd("CXT5066: unsol event %x (%x)\n", res, res >> 26);
-        switch (res >> 26) {
-        case CONEXANT_HP_EVENT:
-                cxt5066_hp_automute(codec);
-                break;
-        case CONEXANT_MIC_EVENT:
-                /* ignore mic events in DC mode; we're always using the jack */
-                if (!spec->dc_enable)
-                        cxt5066_olpc_automic(codec);
-                break;
-        }
-}
 
-/* unsolicited event for jack sensing */
-static void cxt5066_vostro_event(struct hda_codec *codec, unsigned int res)
-{
-        snd_printdd("CXT5066_vostro: unsol event %x (%x)\n", res, res >> 26);
-        switch (res >> 26) {
-        case CONEXANT_HP_EVENT:
-                cxt5066_hp_automute(codec);
-                break;
-        case CONEXANT_MIC_EVENT:
+        if (spec->dell_vostro)
                 cxt5066_vostro_automic(codec);
-                break;
-        }
-}
-
-/* unsolicited event for jack sensing */
-static void cxt5066_ideapad_event(struct hda_codec *codec, unsigned int res)
-{
-        snd_printdd("CXT5066_ideapad: unsol event %x (%x)\n", res, res >> 26);
-        switch (res >> 26) {
-        case CONEXANT_HP_EVENT:
-                cxt5066_hp_automute(codec);
-                break;
-        case CONEXANT_MIC_EVENT:
+        else if (spec->ideapad)
                 cxt5066_ideapad_automic(codec);
-                break;
-        }
+        else if (spec->thinkpad)
+                cxt5066_thinkpad_automic(codec);
+        else if (spec->hp_laptop)
+                cxt5066_hp_laptop_automic(codec);
+        else if (spec->asus)
+                cxt5066_asus_automic(codec);
 }
 
 /* unsolicited event for jack sensing */
-static void cxt5066_hp_laptop_event(struct hda_codec *codec, unsigned int res)
+static void cxt5066_olpc_unsol_event(struct hda_codec *codec, unsigned int res)
 {
-        snd_printdd("CXT5066_hp_laptop: unsol event %x (%x)\n", res, res >> 26);
+        struct conexant_spec *spec = codec->spec;
+        snd_printdd("CXT5066: unsol event %x (%x)\n", res, res >> 26);
         switch (res >> 26) {
         case CONEXANT_HP_EVENT:
                 cxt5066_hp_automute(codec);
                 break;
         case CONEXANT_MIC_EVENT:
-                cxt5066_hp_laptop_automic(codec);
+                /* ignore mic events in DC mode; we're always using the jack */
+                if (!spec->dc_enable)
+                        cxt5066_olpc_automic(codec);
                 break;
         }
 }
 
 /* unsolicited event for jack sensing */
-static void cxt5066_thinkpad_event(struct hda_codec *codec, unsigned int res)
+static void cxt5066_unsol_event(struct hda_codec *codec, unsigned int res)
 {
-        snd_printdd("CXT5066_thinkpad: unsol event %x (%x)\n", res, res >> 26);
+        snd_printdd("CXT5066: unsol event %x (%x)\n", res, res >> 26);
         switch (res >> 26) {
         case CONEXANT_HP_EVENT:
                 cxt5066_hp_automute(codec);
                 break;
         case CONEXANT_MIC_EVENT:
-                cxt5066_thinkpad_automic(codec);
+                cxt5066_automic(codec);
                 break;
         }
 }
 
+
 static const struct hda_input_mux cxt5066_analog_mic_boost = {
         .num_items = 5,
         .items = {
@@ -2633,6 +2632,27 @@ static void cxt5066_olpc_capture_cleanup(struct hda_codec *codec)
         spec->recording = 0;
 }
 
+static void conexant_check_dig_outs(struct hda_codec *codec,
+                                    hda_nid_t *dig_pins,
+                                    int num_pins)
+{
+        struct conexant_spec *spec = codec->spec;
+        hda_nid_t *nid_loc = &spec->multiout.dig_out_nid;
+        int i;
+
+        for (i = 0; i < num_pins; i++, dig_pins++) {
+                unsigned int cfg = snd_hda_codec_get_pincfg(codec, *dig_pins);
+                if (get_defcfg_connect(cfg) == AC_JACK_PORT_NONE)
+                        continue;
+                if (snd_hda_get_connections(codec, *dig_pins, nid_loc, 1) != 1)
+                        continue;
+                if (spec->slave_dig_outs[0])
+                        nid_loc++;
+                else
+                        nid_loc = spec->slave_dig_outs;
+        }
+}
+
 static struct hda_input_mux cxt5066_capture_source = {
         .num_items = 4,
         .items = {
@@ -3039,20 +3059,11 @@ static struct hda_verb cxt5066_init_verbs_hp_laptop[] = {
 /* initialize jack-sensing, too */
 static int cxt5066_init(struct hda_codec *codec)
 {
-        struct conexant_spec *spec = codec->spec;
-
         snd_printdd("CXT5066: init\n");
         conexant_init(codec);
         if (codec->patch_ops.unsol_event) {
                 cxt5066_hp_automute(codec);
-                if (spec->dell_vostro)
-                        cxt5066_vostro_automic(codec);
-                else if (spec->ideapad)
-                        cxt5066_ideapad_automic(codec);
-                else if (spec->thinkpad)
-                        cxt5066_thinkpad_automic(codec);
-                else if (spec->hp_laptop)
-                        cxt5066_hp_laptop_automic(codec);
+                cxt5066_automic(codec);
         }
         cxt5066_set_mic_boost(codec);
         return 0;
@@ -3080,6 +3091,7 @@ enum {
         CXT5066_DELL_VOSTRO,    /* Dell Vostro 1015i */
         CXT5066_IDEAPAD,        /* Lenovo IdeaPad U150 */
         CXT5066_THINKPAD,       /* Lenovo ThinkPad T410s, others? */
+        CXT5066_ASUS,           /* Asus K52JU, Lenovo G560 - Int mic at 0x1a and Ext mic at 0x1b */
         CXT5066_HP_LAPTOP,      /* HP Laptop */
         CXT5066_MODELS
 };
@@ -3091,6 +3103,7 @@ static const char * const cxt5066_models[CXT5066_MODELS] = {
         [CXT5066_DELL_VOSTRO]   = "dell-vostro",
         [CXT5066_IDEAPAD]       = "ideapad",
         [CXT5066_THINKPAD]      = "thinkpad",
+        [CXT5066_ASUS]          = "asus",
         [CXT5066_HP_LAPTOP]     = "hp-laptop",
 };
 
@@ -3102,7 +3115,9 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTRO),
         SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
-        SND_PCI_QUIRK(0x1043, 0x13f3, "Asus A52J", CXT5066_HP_LAPTOP),
+        SND_PCI_QUIRK(0x1043, 0x13f3, "Asus A52J", CXT5066_ASUS),
+        SND_PCI_QUIRK(0x1043, 0x1643, "Asus K52JU", CXT5066_ASUS),
+        SND_PCI_QUIRK(0x1043, 0x1993, "Asus U50F", CXT5066_ASUS),
         SND_PCI_QUIRK(0x1179, 0xff1e, "Toshiba Satellite C650D", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
@@ -3111,7 +3126,9 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400s", CXT5066_THINKPAD),
         SND_PCI_QUIRK(0x17aa, 0x21c5, "Thinkpad Edge 13", CXT5066_THINKPAD),
+        SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
+        SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS),
         SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */
         {}
 };
@@ -3133,7 +3150,8 @@ static int patch_cxt5066(struct hda_codec *codec)
         spec->multiout.max_channels = 2;
         spec->multiout.num_dacs = ARRAY_SIZE(cxt5066_dac_nids);
         spec->multiout.dac_nids = cxt5066_dac_nids;
-        spec->multiout.dig_out_nid = CXT5066_SPDIF_OUT;
+        conexant_check_dig_outs(codec, cxt5066_digout_pin_nids,
+            ARRAY_SIZE(cxt5066_digout_pin_nids));
         spec->num_adc_nids = 1;
         spec->adc_nids = cxt5066_adc_nids;
         spec->capsrc_nids = cxt5066_capsrc_nids;
@@ -3167,17 +3185,20 @@ static int patch_cxt5066(struct hda_codec *codec)
                 spec->num_init_verbs++;
                 spec->dell_automute = 1;
                 break;
+        case CXT5066_ASUS:
         case CXT5066_HP_LAPTOP:
                 codec->patch_ops.init = cxt5066_init;
-                codec->patch_ops.unsol_event = cxt5066_hp_laptop_event;
+                codec->patch_ops.unsol_event = cxt5066_unsol_event;
                 spec->init_verbs[spec->num_init_verbs] =
                         cxt5066_init_verbs_hp_laptop;
                 spec->num_init_verbs++;
-                spec->hp_laptop = 1;
+                spec->hp_laptop = board_config == CXT5066_HP_LAPTOP;
+                spec->asus = board_config == CXT5066_ASUS;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixer_master;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixers;
                 /* no S/PDIF out */
-                spec->multiout.dig_out_nid = 0;
+                if (board_config == CXT5066_HP_LAPTOP)
+                        spec->multiout.dig_out_nid = 0;
                 /* input source automatically selected */
                 spec->input_mux = NULL;
                 spec->port_d_mode = 0;
@@ -3207,7 +3228,7 @@ static int patch_cxt5066(struct hda_codec *codec)
                 break;
         case CXT5066_DELL_VOSTRO:
                 codec->patch_ops.init = cxt5066_init;
-                codec->patch_ops.unsol_event = cxt5066_vostro_event;
+                codec->patch_ops.unsol_event = cxt5066_unsol_event;
                 spec->init_verbs[0] = cxt5066_init_verbs_vostro;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixer_master_olpc;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixers;
@@ -3224,7 +3245,7 @@ static int patch_cxt5066(struct hda_codec *codec)
                 break;
         case CXT5066_IDEAPAD:
                 codec->patch_ops.init = cxt5066_init;
-                codec->patch_ops.unsol_event = cxt5066_ideapad_event;
+                codec->patch_ops.unsol_event = cxt5066_unsol_event;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixer_master;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixers;
                 spec->init_verbs[0] = cxt5066_init_verbs_ideapad;
@@ -3240,7 +3261,7 @@ static int patch_cxt5066(struct hda_codec *codec)
                 break;
         case CXT5066_THINKPAD:
                 codec->patch_ops.init = cxt5066_init;
-                codec->patch_ops.unsol_event = cxt5066_thinkpad_event;
+                codec->patch_ops.unsol_event = cxt5066_unsol_event;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixer_master;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixers;
                 spec->init_verbs[0] = cxt5066_init_verbs_thinkpad;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 269dbff70b9..2fa9ed99c32 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1721,7 +1721,9 @@ static void alc_apply_fixup(struct hda_codec *codec, int action)
 {
         struct alc_spec *spec = codec->spec;
         int id = spec->fixup_id;
+#ifdef CONFIG_SND_DEBUG_VERBOSE
         const char *modelname = spec->fixup_name;
+#endif
         int depth = 0;
 
         if (!spec->fixup_list)
@@ -10930,9 +10932,6 @@ static int alc_auto_add_mic_boost(struct hda_codec *codec)
         return 0;
 }
 
-static int alc861vd_auto_create_multi_out_ctls(struct alc_spec *spec,
-                                             const struct auto_pin_cfg *cfg);
-
 /* almost identical with ALC880 parser... */
 static int alc882_parse_auto_config(struct hda_codec *codec)
 {
@@ -10950,10 +10949,7 @@ static int alc882_parse_auto_config(struct hda_codec *codec)
         err = alc880_auto_fill_dac_nids(spec, &spec->autocfg);
         if (err < 0)
                 return err;
-        if (codec->vendor_id == 0x10ec0887)
-                err = alc861vd_auto_create_multi_out_ctls(spec, &spec->autocfg);
-        else
-                err = alc880_auto_create_multi_out_ctls(spec, &spec->autocfg);
+        err = alc880_auto_create_multi_out_ctls(spec, &spec->autocfg);
         if (err < 0)
                 return err;
         err = alc880_auto_create_extra_out(spec, spec->autocfg.hp_pins[0],
@@ -12635,6 +12631,8 @@ static struct snd_pci_quirk alc262_cfg_tbl[] = {
                            ALC262_HP_BPC),
         SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x1300, "HP xw series",
                            ALC262_HP_BPC),
+        SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x1500, "HP z series",
+                           ALC262_HP_BPC),
         SND_PCI_QUIRK_MASK(0x103c, 0xff00, 0x1700, "HP xw series",
                            ALC262_HP_BPC),
         SND_PCI_QUIRK(0x103c, 0x2800, "HP D7000", ALC262_HP_BPC_D7000_WL),
@@ -14956,8 +14954,11 @@ static struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
         SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
-        SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+        SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+        SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+        SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
+        SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
         SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
         {}
@@ -17134,7 +17135,7 @@ static void alc861vd_auto_init_analog_input(struct hda_codec *codec)
 #define alc861vd_idx_to_mixer_switch(nid)       ((nid) + 0x0c)
 
 /* add playback controls from the parsed DAC table */
-/* Based on ALC880 version. But ALC861VD and ALC887 have separate,
+/* Based on ALC880 version. But ALC861VD has separate,
  * different NIDs for mute/unmute switch and volume control */
 static int alc861vd_auto_create_multi_out_ctls(struct alc_spec *spec,
                                              const struct auto_pin_cfg *cfg)
@@ -19461,6 +19462,7 @@ enum {
         ALC662_FIXUP_ASPIRE,
         ALC662_FIXUP_IDEAPAD,
         ALC272_FIXUP_MARIO,
+        ALC662_FIXUP_CZC_P10T,
 };
 
 static const struct alc_fixup alc662_fixups[] = {
@@ -19481,7 +19483,14 @@ static const struct alc_fixup alc662_fixups[] = {
         [ALC272_FIXUP_MARIO] = {
                 .type = ALC_FIXUP_FUNC,
                 .v.func = alc272_fixup_mario,
-        }
+        },
+        [ALC662_FIXUP_CZC_P10T] = {
+                .type = ALC_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        {0x14, AC_VERB_SET_EAPD_BTLENABLE, 0},
+                        {}
+                }
+        },
 };
 
 static struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -19489,6 +19498,7 @@ static struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+        SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
         {}
 };
 
diff --git a/sound/pci/ice1712/delta.c b/sound/pci/ice1712/delta.c
index 7b62de089fe..20c6b079d0d 100644
--- a/sound/pci/ice1712/delta.c
+++ b/sound/pci/ice1712/delta.c
@@ -580,6 +580,7 @@ static int __devinit snd_ice1712_delta_init(struct snd_ice1712 *ice)
 {
         int err;
         struct snd_akm4xxx *ak;
+        unsigned char tmp;
 
         if (ice->eeprom.subvendor == ICE1712_SUBDEVICE_DELTA1010 &&
             ice->eeprom.gpiodir == 0x7b)
@@ -622,6 +623,12 @@ static int __devinit snd_ice1712_delta_init(struct snd_ice1712 *ice)
                 break;
         }
 
+        /* initialize the SPI clock to high */
+        tmp = snd_ice1712_read(ice, ICE1712_IREG_GPIO_DATA);
+        tmp |= ICE1712_DELTA_AP_CCLK;
+        snd_ice1712_write(ice, ICE1712_IREG_GPIO_DATA, tmp);
+        udelay(5);
+
         /* initialize spdif */
         switch (ice->eeprom.subvendor) {
         case ICE1712_SUBDEVICE_AUDIOPHILE:
diff --git a/sound/pci/oxygen/oxygen.h b/sound/pci/oxygen/oxygen.h
index c2ae63d17cd..f53897a708b 100644
--- a/sound/pci/oxygen/oxygen.h
+++ b/sound/pci/oxygen/oxygen.h
@@ -92,6 +92,8 @@ struct oxygen_model {
         void (*update_dac_volume)(struct oxygen *chip);
         void (*update_dac_mute)(struct oxygen *chip);
         void (*update_center_lfe_mix)(struct oxygen *chip, bool mixed);
+        unsigned int (*adjust_dac_routing)(struct oxygen *chip,
+                                           unsigned int play_routing);
         void (*gpio_changed)(struct oxygen *chip);
         void (*uart_input)(struct oxygen *chip);
         void (*ac97_switch)(struct oxygen *chip,
diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c
index 9bff14d5895..26c7e8bcb22 100644
--- a/sound/pci/oxygen/oxygen_mixer.c
+++ b/sound/pci/oxygen/oxygen_mixer.c
@@ -180,6 +180,8 @@ void oxygen_update_dac_routing(struct oxygen *chip)
                             (1 << OXYGEN_PLAY_DAC1_SOURCE_SHIFT) |
                             (2 << OXYGEN_PLAY_DAC2_SOURCE_SHIFT) |
                             (3 << OXYGEN_PLAY_DAC3_SOURCE_SHIFT);
+        if (chip->model.adjust_dac_routing)
+                reg_value = chip->model.adjust_dac_routing(chip, reg_value);
         oxygen_write16_masked(chip, OXYGEN_PLAY_ROUTING, reg_value,
                               OXYGEN_PLAY_DAC0_SOURCE_MASK |
                               OXYGEN_PLAY_DAC1_SOURCE_MASK |
diff --git a/sound/pci/oxygen/xonar_cs43xx.c b/sound/pci/oxygen/xonar_cs43xx.c
index 9f72d424969..252719101c4 100644
--- a/sound/pci/oxygen/xonar_cs43xx.c
+++ b/sound/pci/oxygen/xonar_cs43xx.c
@@ -392,7 +392,7 @@ static void dump_d1_registers(struct oxygen *chip,
         unsigned int i;
 
         snd_iprintf(buffer, "\nCS4398: 7?");
-        for (i = 2; i <= 8; ++i)
+        for (i = 2; i < 8; ++i)
                 snd_iprintf(buffer, " %02x", data->cs4398_regs[i]);
         snd_iprintf(buffer, "\n");
         dump_cs4362a_registers(data, buffer);
diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
index e1fa602eba7..bc6eb58be38 100644
--- a/sound/pci/oxygen/xonar_dg.c
+++ b/sound/pci/oxygen/xonar_dg.c
@@ -24,6 +24,11 @@
  *
  *   SPI 0 -> CS4245
  *
+ *   I²S 1 -> CS4245
+ *   I²S 2 -> CS4361 (center/LFE)
+ *   I²S 3 -> CS4361 (surround)
+ *   I²S 4 -> CS4361 (front)
+ *
  *   GPIO 3 <- ?
  *   GPIO 4 <- headphone detect
  *   GPIO 5 -> route input jack to line-in (0) or mic-in (1)
@@ -36,6 +41,7 @@
  *   input 1 <- aux
  *   input 2 <- front mic
  *   input 4 <- line/mic
+ *   DAC out -> headphones
  *   aux out -> front panel headphones
  */
 
@@ -207,6 +213,35 @@ static void set_cs4245_adc_params(struct oxygen *chip,
         cs4245_write_cached(chip, CS4245_ADC_CTRL, value);
 }
 
+static inline unsigned int shift_bits(unsigned int value,
+                                      unsigned int shift_from,
+                                      unsigned int shift_to,
+                                      unsigned int mask)
+{
+        if (shift_from < shift_to)
+                return (value << (shift_to - shift_from)) & mask;
+        else
+                return (value >> (shift_from - shift_to)) & mask;
+}
+
+static unsigned int adjust_dg_dac_routing(struct oxygen *chip,
+                                          unsigned int play_routing)
+{
+        return (play_routing & OXYGEN_PLAY_DAC0_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC0_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_MASK);
+}
+
 static int output_switch_info(struct snd_kcontrol *ctl,
                               struct snd_ctl_elem_info *info)
 {
@@ -557,6 +592,7 @@ struct oxygen_model model_xonar_dg = {
         .resume = dg_resume,
         .set_dac_params = set_cs4245_dac_params,
         .set_adc_params = set_cs4245_adc_params,
+        .adjust_dac_routing = adjust_dg_dac_routing,
         .dump_registers = dump_cs4245_registers,
         .model_data_size = sizeof(struct dg),
         .device_config = PLAYBACK_0_TO_I2S |
diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.h b/sound/pcmcia/pdaudiocf/pdaudiocf.h
index bd26e092aea..6ce9ad70029 100644
--- a/sound/pcmcia/pdaudiocf/pdaudiocf.h
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf.h
@@ -22,7 +22,7 @@
 #define __PDAUDIOCF_H
 
 #include <sound/pcm.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/interrupt.h>
 #include <pcmcia/cistpl.h>
 #include <pcmcia/ds.h>
diff --git a/sound/pcmcia/vx/vxp_ops.c b/sound/pcmcia/vx/vxp_ops.c
index 989e04abb52..fe33e122e37 100644
--- a/sound/pcmcia/vx/vxp_ops.c
+++ b/sound/pcmcia/vx/vxp_ops.c
@@ -23,8 +23,8 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/firmware.h>
+#include <linux/io.h>
 #include <sound/core.h>
-#include <asm/io.h>
 #include "vxpocket.h"
 
 
diff --git a/sound/soc/atmel/snd-soc-afeb9260.c b/sound/soc/atmel/snd-soc-afeb9260.c
index da2208e06b0..5e4d499d843 100644
--- a/sound/soc/atmel/snd-soc-afeb9260.c
+++ b/sound/soc/atmel/snd-soc-afeb9260.c
@@ -129,7 +129,7 @@ static struct snd_soc_dai_link afeb9260_dai = {
         .cpu_dai_name = "atmel-ssc-dai.0",
         .codec_dai_name = "tlv320aic23-hifi",
         .platform_name = "atmel_pcm-audio",
-        .codec_name = "tlv320aic23-codec.0-0x1a",
+        .codec_name = "tlv320aic23-codec.0-001a",
         .init = afeb9260_tlv320aic23_init,
         .ops = &afeb9260_ops,
 };
diff --git a/sound/soc/blackfin/Kconfig b/sound/soc/blackfin/Kconfig
index 3abeeddc67d..ae403597fd3 100644
--- a/sound/soc/blackfin/Kconfig
+++ b/sound/soc/blackfin/Kconfig
@@ -1,6 +1,7 @@
 config SND_BF5XX_I2S
         tristate "SoC I2S Audio for the ADI BF5xx chip"
         depends on BLACKFIN
+        select SND_BF5XX_SOC_SPORT
         help
           Say Y or M if you want to add support for codecs attached to
           the Blackfin SPORT (synchronous serial ports) interface in I2S
@@ -35,6 +36,7 @@ config SND_BFIN_AD73311_SE
 config SND_BF5XX_TDM
         tristate "SoC I2S(TDM mode) Audio for the ADI BF5xx chip"
         depends on (BLACKFIN && SND_SOC)
+        select SND_BF5XX_SOC_SPORT
         help
           Say Y or M if you want to add support for codecs attached to
           the Blackfin SPORT (synchronous serial ports) interface in TDM
@@ -61,6 +63,10 @@ config SND_BF5XX_SOC_AD193X
 config SND_BF5XX_AC97
         tristate "SoC AC97 Audio for the ADI BF5xx chip"
         depends on BLACKFIN
+        select AC97_BUS
+        select SND_SOC_AC97_BUS
+        select SND_BF5XX_SOC_SPORT
+        select SND_BF5XX_SOC_AC97
         help
           Say Y or M if you want to add support for codecs attached to
           the Blackfin SPORT (synchronous serial ports) interface in slot 16
@@ -122,17 +128,12 @@ config SND_BF5XX_SOC_SPORT
 
 config SND_BF5XX_SOC_I2S
         tristate
-        select SND_BF5XX_SOC_SPORT
 
 config SND_BF5XX_SOC_TDM
         tristate
-        select SND_BF5XX_SOC_SPORT
 
 config SND_BF5XX_SOC_AC97
         tristate
-        select AC97_BUS
-        select SND_SOC_AC97_BUS
-        select SND_BF5XX_SOC_SPORT
 
 config SND_BF5XX_SPORT_NUM
         int "Set a SPORT for Sound chip"
diff --git a/sound/soc/blackfin/bf5xx-ac97.c b/sound/soc/blackfin/bf5xx-ac97.c
index c5f856ec27c..ffbac26b9bc 100644
--- a/sound/soc/blackfin/bf5xx-ac97.c
+++ b/sound/soc/blackfin/bf5xx-ac97.c
@@ -260,9 +260,9 @@ static int bf5xx_ac97_suspend(struct snd_soc_dai *dai)
         pr_debug("%s : sport %d\n", __func__, dai->id);
         if (!dai->active)
                 return 0;
-        if (dai->capture.active)
+        if (dai->capture_active)
                 sport_rx_stop(sport);
-        if (dai->playback.active)
+        if (dai->playback_active)
                 sport_tx_stop(sport);
         return 0;
 }
diff --git a/sound/soc/blackfin/bf5xx-ssm2602.c b/sound/soc/blackfin/bf5xx-ssm2602.c
index e902b24c185..ad28663f5bb 100644
--- a/sound/soc/blackfin/bf5xx-ssm2602.c
+++ b/sound/soc/blackfin/bf5xx-ssm2602.c
@@ -119,7 +119,7 @@ static struct snd_soc_dai_link bf5xx_ssm2602_dai = {
         .cpu_dai_name = "bf5xx-i2s",
         .codec_dai_name = "ssm2602-hifi",
         .platform_name = "bf5xx-pcm-audio",
-        .codec_name = "ssm2602-codec.0-0x1b",
+        .codec_name = "ssm2602-codec.0-001b",
         .ops = &bf5xx_ssm2602_ops,
 };
 
diff --git a/sound/soc/blackfin/bf5xx-tdm.c b/sound/soc/blackfin/bf5xx-tdm.c
index 125123929f1..5515ac9e05c 100644
--- a/sound/soc/blackfin/bf5xx-tdm.c
+++ b/sound/soc/blackfin/bf5xx-tdm.c
@@ -210,7 +210,7 @@ static int bf5xx_tdm_set_channel_map(struct snd_soc_dai *dai,
 #ifdef CONFIG_PM
 static int bf5xx_tdm_suspend(struct snd_soc_dai *dai)
 {
-        struct sport_device *sport = dai->private_data;
+        struct sport_device *sport = snd_soc_dai_get_drvdata(dai);
 
         if (!dai->active)
                 return 0;
@@ -235,13 +235,13 @@ static int bf5xx_tdm_resume(struct snd_soc_dai *dai)
                 ret = -EBUSY;
         }
 
-        ret = sport_config_rx(sport, IRFS, 0x1F, 0, 0);
+        ret = sport_config_rx(sport, 0, 0x1F, 0, 0);
         if (ret) {
                 pr_err("SPORT is busy!\n");
                 ret = -EBUSY;
         }
 
-        ret = sport_config_tx(sport, ITFS, 0x1F, 0, 0);
+        ret = sport_config_tx(sport, 0, 0x1F, 0, 0);
         if (ret) {
                 pr_err("SPORT is busy!\n");
                 ret = -EBUSY;
@@ -303,14 +303,14 @@ static int __devinit bfin_tdm_probe(struct platform_device *pdev)
                 goto sport_config_err;
         }
 
-        ret = sport_config_rx(sport_handle, IRFS, 0x1F, 0, 0);
+        ret = sport_config_rx(sport_handle, 0, 0x1F, 0, 0);
         if (ret) {
                 pr_err("SPORT is busy!\n");
                 ret = -EBUSY;
                 goto sport_config_err;
         }
 
-        ret = sport_config_tx(sport_handle, ITFS, 0x1F, 0, 0);
+        ret = sport_config_tx(sport_handle, 0, 0x1F, 0, 0);
         if (ret) {
                 pr_err("SPORT is busy!\n");
                 ret = -EBUSY;
diff --git a/sound/soc/codecs/cq93vc.c b/sound/soc/codecs/cq93vc.c
index 46dbfd067f7..347a567b01e 100644
--- a/sound/soc/codecs/cq93vc.c
+++ b/sound/soc/codecs/cq93vc.c
@@ -153,7 +153,7 @@ static int cq93vc_resume(struct snd_soc_codec *codec)
 
 static int cq93vc_probe(struct snd_soc_codec *codec)
 {
-        struct davinci_vc *davinci_vc = codec->dev->platform_data;
+        struct davinci_vc *davinci_vc = snd_soc_codec_get_drvdata(codec);
 
         davinci_vc->cq93vc.codec = codec;
         codec->control_data = davinci_vc;
diff --git a/sound/soc/codecs/cx20442.c b/sound/soc/codecs/cx20442.c
index 03d1e860d22..bb4bf65b9e7 100644
--- a/sound/soc/codecs/cx20442.c
+++ b/sound/soc/codecs/cx20442.c
@@ -367,9 +367,12 @@ static int cx20442_codec_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
+static const u8 cx20442_reg = CX20442_TELOUT | CX20442_MIC;
+
 static struct snd_soc_codec_driver cx20442_codec_dev = {
         .probe =        cx20442_codec_probe,
         .remove =       cx20442_codec_remove,
+        .reg_cache_default = &cx20442_reg,
         .reg_cache_size = 1,
         .reg_word_size = sizeof(u8),
         .read = cx20442_read_reg_cache,
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 247a6a99feb..3351f77607b 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -2386,7 +2386,7 @@ static int wm8994_set_tristate(struct snd_soc_dai *codec_dai, int tristate)
         else
                 val = 0;
 
-        return snd_soc_update_bits(codec, reg, mask, reg);
+        return snd_soc_update_bits(codec, reg, mask, val);
 }
 
 #define WM8994_RATES SNDRV_PCM_RATE_8000_96000
diff --git a/sound/soc/codecs/wm8995.c b/sound/soc/codecs/wm8995.c
index 6045cbde492..608c84c5aa8 100644
--- a/sound/soc/codecs/wm8995.c
+++ b/sound/soc/codecs/wm8995.c
@@ -1223,7 +1223,7 @@ static int wm8995_set_tristate(struct snd_soc_dai *codec_dai, int tristate)
         else
                 val = 0;
 
-        return snd_soc_update_bits(codec, reg, mask, reg);
+        return snd_soc_update_bits(codec, reg, mask, val);
 }
 
 /* The size in bits of the FLL divide multiplied by 10
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index c466982eed2..613df5db0b3 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -91,6 +91,7 @@ static void wait_for_dc_servo(struct snd_soc_codec *codec, unsigned int op)
 static void calibrate_dc_servo(struct snd_soc_codec *codec)
 {
         struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
+        s8 offset;
         u16 reg, reg_l, reg_r, dcs_cfg;
 
         /* If we're using a digital only path and have a previously
@@ -149,16 +150,14 @@ static void calibrate_dc_servo(struct snd_soc_codec *codec)
                         hubs->dcs_codes);
 
                 /* HPOUT1L */
-                if (reg_l + hubs->dcs_codes > 0 &&
-                    reg_l + hubs->dcs_codes < 0xff)
-                        reg_l += hubs->dcs_codes;
-                dcs_cfg = reg_l << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
+                offset = reg_l;
+                offset += hubs->dcs_codes;
+                dcs_cfg = (u8)offset << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
 
                 /* HPOUT1R */
-                if (reg_r + hubs->dcs_codes > 0 &&
-                    reg_r + hubs->dcs_codes < 0xff)
-                        reg_r += hubs->dcs_codes;
-                dcs_cfg |= reg_r;
+                offset = reg_r;
+                offset += hubs->dcs_codes;
+                dcs_cfg |= (u8)offset;
 
                 dev_dbg(codec->dev, "DCS result: %x\n", dcs_cfg);
 
diff --git a/sound/soc/davinci/davinci-evm.c b/sound/soc/davinci/davinci-evm.c
index 0c2d6bacc68..b36f0b39b09 100644
--- a/sound/soc/davinci/davinci-evm.c
+++ b/sound/soc/davinci/davinci-evm.c
@@ -223,7 +223,7 @@ static struct snd_soc_dai_link da8xx_evm_dai = {
         .stream_name = "AIC3X",
         .cpu_dai_name= "davinci-mcasp.0",
         .codec_dai_name = "tlv320aic3x-hifi",
-        .codec_name = "tlv320aic3x-codec.0-001a",
+        .codec_name = "tlv320aic3x-codec.1-0018",
         .platform_name = "davinci-pcm-audio",
         .init = evm_aic3x_init,
         .ops = &evm_ops,
diff --git a/sound/soc/omap/ams-delta.c b/sound/soc/omap/ams-delta.c
index 2101bdcee21..3167be68962 100644
--- a/sound/soc/omap/ams-delta.c
+++ b/sound/soc/omap/ams-delta.c
@@ -507,8 +507,6 @@ static int ams_delta_cx20442_init(struct snd_soc_pcm_runtime *rtd)
         /* Set up digital mute if not provided by the codec */
         if (!codec_dai->driver->ops) {
                 codec_dai->driver->ops = &ams_delta_dai_ops;
-        } else if (!codec_dai->driver->ops->digital_mute) {
-                codec_dai->driver->ops->digital_mute = ams_delta_digital_mute;
         } else {
                 ams_delta_ops.startup = ams_delta_startup;
                 ams_delta_ops.shutdown = ams_delta_shutdown;
diff --git a/sound/soc/pxa/corgi.c b/sound/soc/pxa/corgi.c
index fc592f0d5fc..784cff5f67e 100644
--- a/sound/soc/pxa/corgi.c
+++ b/sound/soc/pxa/corgi.c
@@ -307,10 +307,10 @@ static int corgi_wm8731_init(struct snd_soc_pcm_runtime *rtd)
 static struct snd_soc_dai_link corgi_dai = {
         .name = "WM8731",
         .stream_name = "WM8731",
-        .cpu_dai_name = "pxa-is2-dai",
+        .cpu_dai_name = "pxa2xx-i2s",
         .codec_dai_name = "wm8731-hifi",
         .platform_name = "pxa-pcm-audio",
-        .codec_name = "wm8731-codec-0.001a",
+        .codec_name = "wm8731-codec-0.001b",
         .init = corgi_wm8731_init,
         .ops = &corgi_ops,
 };
diff --git a/sound/soc/pxa/poodle.c b/sound/soc/pxa/poodle.c
index 6298ee115e2..a7d4999f9b2 100644
--- a/sound/soc/pxa/poodle.c
+++ b/sound/soc/pxa/poodle.c
@@ -276,7 +276,7 @@ static struct snd_soc_dai_link poodle_dai = {
         .cpu_dai_name = "pxa2xx-i2s",
         .codec_dai_name = "wm8731-hifi",
         .platform_name = "pxa-pcm-audio",
-        .codec_name = "wm8731-codec.0-001a",
+        .codec_name = "wm8731-codec.0-001b",
         .init = poodle_wm8731_init,
         .ops = &poodle_ops,
 };
diff --git a/sound/soc/pxa/spitz.c b/sound/soc/pxa/spitz.c
index c2acb69b957..8e157135063 100644
--- a/sound/soc/pxa/spitz.c
+++ b/sound/soc/pxa/spitz.c
@@ -315,10 +315,10 @@ static int spitz_wm8750_init(struct snd_soc_pcm_runtime *rtd)
 static struct snd_soc_dai_link spitz_dai = {
         .name = "wm8750",
         .stream_name = "WM8750",
-        .cpu_dai_name = "pxa-is2",
+        .cpu_dai_name = "pxa2xx-i2s",
         .codec_dai_name = "wm8750-hifi",
         .platform_name = "pxa-pcm-audio",
-        .codec_name = "wm8750-codec.0-001a",
+        .codec_name = "wm8750-codec.0-001b",
         .init = spitz_wm8750_init,
         .ops = &spitz_ops,
 };
diff --git a/sound/soc/pxa/z2.c b/sound/soc/pxa/z2.c
index 2d4f896d7fe..3ceaef68e01 100644
--- a/sound/soc/pxa/z2.c
+++ b/sound/soc/pxa/z2.c
@@ -104,6 +104,7 @@ static struct snd_soc_jack_gpio hs_jack_gpios[] = {
                 .name           = "hsdet-gpio",
                 .report         = SND_JACK_HEADSET,
                 .debounce_time  = 200,
+                .invert         = 1,
         },
 };
 
@@ -192,7 +193,7 @@ static struct snd_soc_dai_link z2_dai = {
         .cpu_dai_name   = "pxa2xx-i2s",
         .codec_dai_name = "wm8750-hifi",
         .platform_name = "pxa-pcm-audio",
-        .codec_name     = "wm8750-codec.0-001a",
+        .codec_name     = "wm8750-codec.0-001b",
         .init           = z2_wm8750_init,
         .ops            = &z2_ops,
 };
diff --git a/sound/soc/samsung/neo1973_gta02_wm8753.c b/sound/soc/samsung/neo1973_gta02_wm8753.c
index 3eec610c10f..0d0ae2b9eef 100644
--- a/sound/soc/samsung/neo1973_gta02_wm8753.c
+++ b/sound/soc/samsung/neo1973_gta02_wm8753.c
@@ -397,11 +397,11 @@ static struct snd_soc_dai_link neo1973_gta02_dai[] = {
 { /* Hifi Playback - for similatious use with voice below */
         .name = "WM8753",
         .stream_name = "WM8753 HiFi",
-        .cpu_dai_name = "s3c24xx-i2s",
+        .cpu_dai_name = "s3c24xx-iis",
         .codec_dai_name = "wm8753-hifi",
         .init = neo1973_gta02_wm8753_init,
         .platform_name = "samsung-audio",
-        .codec_name = "wm8753-codec.0-0x1a",
+        .codec_name = "wm8753-codec.0-001a",
         .ops = &neo1973_gta02_hifi_ops,
 },
 { /* Voice via BT */
@@ -410,7 +410,7 @@ static struct snd_soc_dai_link neo1973_gta02_dai[] = {
         .cpu_dai_name = "bluetooth-dai",
         .codec_dai_name = "wm8753-voice",
         .ops = &neo1973_gta02_voice_ops,
-        .codec_name = "wm8753-codec.0-0x1a",
+        .codec_name = "wm8753-codec.0-001a",
         .platform_name = "samsung-audio",
 },
 };
diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c
index c7a24514beb..d20815d5ab2 100644
--- a/sound/soc/samsung/neo1973_wm8753.c
+++ b/sound/soc/samsung/neo1973_wm8753.c
@@ -559,9 +559,9 @@ static struct snd_soc_dai_link neo1973_dai[] = {
         .name = "WM8753",
         .stream_name = "WM8753 HiFi",
         .platform_name = "samsung-audio",
-        .cpu_dai_name = "s3c24xx-i2s",
+        .cpu_dai_name = "s3c24xx-iis",
         .codec_dai_name = "wm8753-hifi",
-        .codec_name = "wm8753-codec.0-0x1a",
+        .codec_name = "wm8753-codec.0-001a",
         .init = neo1973_wm8753_init,
         .ops = &neo1973_hifi_ops,
 },
@@ -571,7 +571,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
         .platform_name = "samsung-audio",
         .cpu_dai_name = "bluetooth-dai",
         .codec_dai_name = "wm8753-voice",
-        .codec_name = "wm8753-codec.0-0x1a",
+        .codec_name = "wm8753-codec.0-001a",
         .ops = &neo1973_voice_ops,
 },
 };
diff --git a/sound/soc/samsung/s3c24xx_simtec_hermes.c b/sound/soc/samsung/s3c24xx_simtec_hermes.c
index bb4292e3596..08fcaaa6690 100644
--- a/sound/soc/samsung/s3c24xx_simtec_hermes.c
+++ b/sound/soc/samsung/s3c24xx_simtec_hermes.c
@@ -94,8 +94,8 @@ static int simtec_hermes_init(struct snd_soc_pcm_runtime *rtd)
 static struct snd_soc_dai_link simtec_dai_aic33 = {
         .name           = "tlv320aic33",
         .stream_name    = "TLV320AIC33",
-        .codec_name     = "tlv320aic3x-codec.0-0x1a",
-        .cpu_dai_name   = "s3c24xx-i2s",
+        .codec_name     = "tlv320aic3x-codec.0-001a",
+        .cpu_dai_name   = "s3c24xx-iis",
         .codec_dai_name = "tlv320aic3x-hifi",
         .platform_name  = "samsung-audio",
         .init           = simtec_hermes_init,
diff --git a/sound/soc/samsung/s3c24xx_simtec_tlv320aic23.c b/sound/soc/samsung/s3c24xx_simtec_tlv320aic23.c
index fbba4e36772..116e3e67016 100644
--- a/sound/soc/samsung/s3c24xx_simtec_tlv320aic23.c
+++ b/sound/soc/samsung/s3c24xx_simtec_tlv320aic23.c
@@ -85,8 +85,8 @@ static int simtec_tlv320aic23_init(struct snd_soc_pcm_runtime *rtd)
 static struct snd_soc_dai_link simtec_dai_aic23 = {
         .name           = "tlv320aic23",
         .stream_name    = "TLV320AIC23",
-        .codec_name     = "tlv320aic3x-codec.0-0x1a",
-        .cpu_dai_name   = "s3c24xx-i2s",
+        .codec_name     = "tlv320aic3x-codec.0-001a",
+        .cpu_dai_name   = "s3c24xx-iis",
         .codec_dai_name = "tlv320aic3x-hifi",
         .platform_name  = "samsung-audio",
         .init           = simtec_tlv320aic23_init,
diff --git a/sound/soc/samsung/s3c24xx_uda134x.c b/sound/soc/samsung/s3c24xx_uda134x.c
index cdc8ecbcb8e..2c09e93dd56 100644
--- a/sound/soc/samsung/s3c24xx_uda134x.c
+++ b/sound/soc/samsung/s3c24xx_uda134x.c
@@ -228,7 +228,7 @@ static struct snd_soc_dai_link s3c24xx_uda134x_dai_link = {
         .stream_name = "UDA134X",
         .codec_name = "uda134x-hifi",
         .codec_dai_name = "uda134x-hifi",
-        .cpu_dai_name = "s3c24xx-i2s",
+        .cpu_dai_name = "s3c24xx-iis",
         .ops = &s3c24xx_uda134x_ops,
         .platform_name  = "samsung-audio",
 };
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index bac7291b6ff..c4b60610beb 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1664,9 +1664,6 @@ static int soc_probe_aux_dev(struct snd_soc_card *card, int num)
         goto out;
 
 found:
-        if (!try_module_get(codec->dev->driver->owner))
-                return -ENODEV;
-
         ret = soc_probe_codec(card, codec);
         if (ret < 0)
                 return ret;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 499730ab563..8194f150bab 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1742,7 +1742,7 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol,
         int max = mc->max;
         unsigned int mask = (1 << fls(max)) - 1;
         unsigned int invert = mc->invert;
-        unsigned int val, val_mask;
+        unsigned int val;
         int connect, change;
         struct snd_soc_dapm_update update;
 
@@ -1750,13 +1750,13 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol,
 
         if (invert)
                 val = max - val;
-        val_mask = mask << shift;
+        mask = mask << shift;
         val = val << shift;
 
         mutex_lock(&widget->codec->mutex);
         widget->value = val;
 
-        change = snd_soc_test_bits(widget->codec, reg, val_mask, val);
+        change = snd_soc_test_bits(widget->codec, reg, mask, val);
         if (change) {
                 if (val)
                         /* new connection */
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 2b5387d53ba..7141c42e146 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -204,13 +204,11 @@ EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wshadow
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Winit-self
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wpacked
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wredundant-decls
-EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wstack-protector
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wstrict-aliasing=3
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wswitch-default
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wswitch-enum
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wno-system-headers
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wundef
-EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wvolatile-register-var
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wwrite-strings
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wbad-function-cast
 EXTRA_WARNINGS := $(EXTRA_WARNINGS) -Wmissing-declarations
@@ -294,6 +292,13 @@ ifeq ($(call try-cc,$(SOURCE_HELLO),-Werror -fstack-protector-all),y)
         CFLAGS := $(CFLAGS) -fstack-protector-all
 endif
 
+ifeq ($(call try-cc,$(SOURCE_HELLO),-Werror -Wstack-protector),y)
+       CFLAGS := $(CFLAGS) -Wstack-protector
+endif
+
+ifeq ($(call try-cc,$(SOURCE_HELLO),-Werror -Wvolatile-register-var),y)
+       CFLAGS := $(CFLAGS) -Wvolatile-register-var
+endif
 
 ### --- END CONFIGURATION SECTION ---
 
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index c056cdc0691..8879463807e 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -212,7 +212,7 @@ get_source_line(struct hist_entry *he, int len, const char *filename)
                         continue;
 
                 offset = start + i;
-                sprintf(cmd, "addr2line -e %s %016llx", filename, offset);
+                sprintf(cmd, "addr2line -e %s %016" PRIx64, filename, offset);
                 fp = popen(cmd, "r");
                 if (!fp)
                         continue;
@@ -270,9 +270,9 @@ static void hist_entry__print_hits(struct hist_entry *self)
 
         for (offset = 0; offset < len; ++offset)
                 if (h->ip[offset] != 0)
-                        printf("%*Lx: %Lu\n", BITS_PER_LONG / 2,
+                        printf("%*" PRIx64 ": %" PRIu64 "\n", BITS_PER_LONG / 2,
                                sym->start + offset, h->ip[offset]);
-        printf("%*s: %Lu\n", BITS_PER_LONG / 2, "h->sum", h->sum);
+        printf("%*s: %" PRIu64 "\n", BITS_PER_LONG / 2, "h->sum", h->sum);
 }
 
 static int hist_entry__tty_annotate(struct hist_entry *he)
diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
index def7ddc2fd4..d97256d6598 100644
--- a/tools/perf/builtin-kmem.c
+++ b/tools/perf/builtin-kmem.c
@@ -371,10 +371,10 @@ static void __print_result(struct rb_root *root, struct perf_session *session,
                         addr = data->ptr;
 
                 if (sym != NULL)
-                        snprintf(buf, sizeof(buf), "%s+%Lx", sym->name,
+                        snprintf(buf, sizeof(buf), "%s+%" PRIx64 "", sym->name,
                                  addr - map->unmap_ip(map, sym->start));
                 else
-                        snprintf(buf, sizeof(buf), "%#Lx", addr);
+                        snprintf(buf, sizeof(buf), "%#" PRIx64 "", addr);
                 printf(" %-34s |", buf);
 
                 printf(" %9llu/%-5lu | %9llu/%-5lu | %8lu | %8lu | %6.3f%%\n",
diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
index b9c6e543297..2b36defc5d7 100644
--- a/tools/perf/builtin-lock.c
+++ b/tools/perf/builtin-lock.c
@@ -782,9 +782,9 @@ static void print_result(void)
                 pr_info("%10u ", st->nr_acquired);
                 pr_info("%10u ", st->nr_contended);
 
-                pr_info("%15llu ", st->wait_time_total);
-                pr_info("%15llu ", st->wait_time_max);
-                pr_info("%15llu ", st->wait_time_min == ULLONG_MAX ?
+                pr_info("%15" PRIu64 " ", st->wait_time_total);
+                pr_info("%15" PRIu64 " ", st->wait_time_max);
+                pr_info("%15" PRIu64 " ", st->wait_time_min == ULLONG_MAX ?
                        0 : st->wait_time_min);
                 pr_info("\n");
         }
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index fcd29e8af29..b2f729fdb31 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -817,7 +817,7 @@ static int __cmd_record(int argc, const char **argv)
          * Approximate RIP event size: 24 bytes.
          */
         fprintf(stderr,
-                "[ perf record: Captured and wrote %.3f MB %s (~%lld samples) ]\n",
+                "[ perf record: Captured and wrote %.3f MB %s (~%" PRIu64 " samples) ]\n",
                 (double)bytes_written / 1024.0 / 1024.0,
                 output_name,
                 bytes_written / 24);
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 75183a4518e..c27e31f289e 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -197,7 +197,7 @@ static int process_read_event(event_t *event, struct sample_data *sample __used,
                                            event->read.value);
         }
 
-        dump_printf(": %d %d %s %Lu\n", event->read.pid, event->read.tid,
+        dump_printf(": %d %d %s %" PRIu64 "\n", event->read.pid, event->read.tid,
                     attr ? __event_name(attr->type, attr->config) : "FAIL",
                     event->read.value);
 
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 29e7ffd8569..29acb894e03 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -193,7 +193,7 @@ static void calibrate_run_measurement_overhead(void)
         }
         run_measurement_overhead = min_delta;
 
-        printf("run measurement overhead: %Ld nsecs\n", min_delta);
+        printf("run measurement overhead: %" PRIu64 " nsecs\n", min_delta);
 }
 
 static void calibrate_sleep_measurement_overhead(void)
@@ -211,7 +211,7 @@ static void calibrate_sleep_measurement_overhead(void)
         min_delta -= 10000;
         sleep_measurement_overhead = min_delta;
 
-        printf("sleep measurement overhead: %Ld nsecs\n", min_delta);
+        printf("sleep measurement overhead: %" PRIu64 " nsecs\n", min_delta);
 }
 
 static struct sched_atom *
@@ -617,13 +617,13 @@ static void test_calibrations(void)
         burn_nsecs(1e6);
         T1 = get_nsecs();
 
-        printf("the run test took %Ld nsecs\n", T1-T0);
+        printf("the run test took %" PRIu64 " nsecs\n", T1 - T0);
 
         T0 = get_nsecs();
         sleep_nsecs(1e6);
         T1 = get_nsecs();
 
-        printf("the sleep test took %Ld nsecs\n", T1-T0);
+        printf("the sleep test took %" PRIu64 " nsecs\n", T1 - T0);
 }
 
 #define FILL_FIELD(ptr, field, event, data)     \
@@ -816,10 +816,10 @@ replay_switch_event(struct trace_switch_event *switch_event,
                 delta = 0;
 
         if (delta < 0)
-                die("hm, delta: %Ld < 0 ?\n", delta);
+                die("hm, delta: %" PRIu64 " < 0 ?\n", delta);
 
         if (verbose) {
-                printf(" ... switch from %s/%d to %s/%d [ran %Ld nsecs]\n",
+                printf(" ... switch from %s/%d to %s/%d [ran %" PRIu64 " nsecs]\n",
                         switch_event->prev_comm, switch_event->prev_pid,
                         switch_event->next_comm, switch_event->next_pid,
                         delta);
@@ -1048,7 +1048,7 @@ latency_switch_event(struct trace_switch_event *switch_event,
                 delta = 0;
 
         if (delta < 0)
-                die("hm, delta: %Ld < 0 ?\n", delta);
+                die("hm, delta: %" PRIu64 " < 0 ?\n", delta);
 
 
         sched_out = perf_session__findnew(session, switch_event->prev_pid);
@@ -1221,7 +1221,7 @@ static void output_lat_thread(struct work_atoms *work_list)
 
         avg = work_list->total_lat / work_list->nb_atoms;
 
-        printf("|%11.3f ms |%9llu | avg:%9.3f ms | max:%9.3f ms | max at: %9.6f s\n",
+        printf("|%11.3f ms |%9" PRIu64 " | avg:%9.3f ms | max:%9.3f ms | max at: %9.6f s\n",
               (double)work_list->total_runtime / 1e6,
                  work_list->nb_atoms, (double)avg / 1e6,
                  (double)work_list->max_lat / 1e6,
@@ -1423,7 +1423,7 @@ map_switch_event(struct trace_switch_event *switch_event,
                 delta = 0;
 
         if (delta < 0)
-                die("hm, delta: %Ld < 0 ?\n", delta);
+                die("hm, delta: %" PRIu64 " < 0 ?\n", delta);
 
 
         sched_out = perf_session__findnew(session, switch_event->prev_pid);
@@ -1713,7 +1713,7 @@ static void __cmd_lat(void)
         }
 
         printf(" -----------------------------------------------------------------------------------------\n");
-        printf("  TOTAL:                |%11.3f ms |%9Ld |\n",
+        printf("  TOTAL:                |%11.3f ms |%9" PRIu64 " |\n",
                 (double)all_runtime/1e6, all_count);
 
         printf(" ---------------------------------------------------\n");
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 150a606002e..b766c2a9ac9 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -77,8 +77,8 @@ static int process_sample_event(event_t *event, struct sample_data *sample,
         if (session->sample_type & PERF_SAMPLE_RAW) {
                 if (debug_mode) {
                         if (sample->time < last_timestamp) {
-                                pr_err("Samples misordered, previous: %llu "
-                                        "this: %llu\n", last_timestamp,
+                                pr_err("Samples misordered, previous: %" PRIu64
+                                        " this: %" PRIu64 "\n", last_timestamp,
                                         sample->time);
                                 nr_unordered++;
                         }
@@ -126,7 +126,7 @@ static int __cmd_script(struct perf_session *session)
         ret = perf_session__process_events(session, &event_ops);
 
         if (debug_mode)
-                pr_err("Misordered timestamps: %llu\n", nr_unordered);
+                pr_err("Misordered timestamps: %" PRIu64 "\n", nr_unordered);
 
         return ret;
 }
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 0ff11d9b13b..a482a191a0c 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -206,8 +206,8 @@ static int read_counter_aggr(struct perf_evsel *counter)
                 update_stats(&ps->res_stats[i], count[i]);
 
         if (verbose) {
-                fprintf(stderr, "%s: %Ld %Ld %Ld\n", event_name(counter),
-                                count[0], count[1], count[2]);
+                fprintf(stderr, "%s: %" PRIu64 " %" PRIu64 " %" PRIu64 "\n",
+                        event_name(counter), count[0], count[1], count[2]);
         }
 
         /*
diff --git a/tools/perf/builtin-test.c b/tools/perf/builtin-test.c
index ed5696198d3..5dcdba653d7 100644
--- a/tools/perf/builtin-test.c
+++ b/tools/perf/builtin-test.c
@@ -146,7 +146,7 @@ next_pair:
                                 if (llabs(skew) < page_size)
                                         continue;
 
-                                pr_debug("%#Lx: diff end addr for %s v: %#Lx k: %#Lx\n",
+                                pr_debug("%#" PRIx64 ": diff end addr for %s v: %#" PRIx64 " k: %#" PRIx64 "\n",
                                          sym->start, sym->name, sym->end, pair->end);
                         } else {
                                 struct rb_node *nnd;
@@ -168,11 +168,11 @@ detour:
                                         goto detour;
                                 }
 
-                                pr_debug("%#Lx: diff name v: %s k: %s\n",
+                                pr_debug("%#" PRIx64 ": diff name v: %s k: %s\n",
                                          sym->start, sym->name, pair->name);
                         }
                 } else
-                        pr_debug("%#Lx: %s not on kallsyms\n", sym->start, sym->name);
+                        pr_debug("%#" PRIx64 ": %s not on kallsyms\n", sym->start, sym->name);
 
                 err = -1;
         }
@@ -211,10 +211,10 @@ detour:
 
                 if (pair->start == pos->start) {
                         pair->priv = 1;
-                        pr_info(" %Lx-%Lx %Lx %s in kallsyms as",
+                        pr_info(" %" PRIx64 "-%" PRIx64 " %" PRIx64 " %s in kallsyms as",
                                 pos->start, pos->end, pos->pgoff, pos->dso->name);
                         if (pos->pgoff != pair->pgoff || pos->end != pair->end)
-                                pr_info(": \n*%Lx-%Lx %Lx",
+                                pr_info(": \n*%" PRIx64 "-%" PRIx64 " %" PRIx64 "",
                                         pair->start, pair->end, pair->pgoff);
                         pr_info(" %s\n", pair->dso->name);
                         pair->priv = 1;
@@ -307,7 +307,7 @@ static int test__open_syscall_event(void)
         }
 
         if (evsel->counts->cpu[0].val != nr_open_calls) {
-                pr_debug("perf_evsel__read_on_cpu: expected to intercept %d calls, got %Ld\n",
+                pr_debug("perf_evsel__read_on_cpu: expected to intercept %d calls, got %" PRIu64 "\n",
                          nr_open_calls, evsel->counts->cpu[0].val);
                 goto out_close_fd;
         }
@@ -332,8 +332,7 @@ static int test__open_syscall_event_on_all_cpus(void)
         struct perf_evsel *evsel;
         struct perf_event_attr attr;
         unsigned int nr_open_calls = 111, i;
-        cpu_set_t *cpu_set;
-        size_t cpu_set_size;
+        cpu_set_t cpu_set;
         int id = trace_event__id("sys_enter_open");
 
         if (id < 0) {
@@ -353,13 +352,8 @@ static int test__open_syscall_event_on_all_cpus(void)
                 return -1;
         }
 
-        cpu_set = CPU_ALLOC(cpus->nr);
 
-        if (cpu_set == NULL)
-                goto out_thread_map_delete;
-
-        cpu_set_size = CPU_ALLOC_SIZE(cpus->nr);
-        CPU_ZERO_S(cpu_set_size, cpu_set);
+        CPU_ZERO(&cpu_set);
 
         memset(&attr, 0, sizeof(attr));
         attr.type = PERF_TYPE_TRACEPOINT;
@@ -367,7 +361,7 @@ static int test__open_syscall_event_on_all_cpus(void)
         evsel = perf_evsel__new(&attr, 0);
         if (evsel == NULL) {
                 pr_debug("perf_evsel__new\n");
-                goto out_cpu_free;
+                goto out_thread_map_delete;
         }
 
         if (perf_evsel__open(evsel, cpus, threads) < 0) {
@@ -379,14 +373,29 @@ static int test__open_syscall_event_on_all_cpus(void)
 
         for (cpu = 0; cpu < cpus->nr; ++cpu) {
                 unsigned int ncalls = nr_open_calls + cpu;
+                /*
+                 * XXX eventually lift this restriction in a way that
+                 * keeps perf building on older glibc installations
+                 * without CPU_ALLOC. 1024 cpus in 2010 still seems
+                 * a reasonable upper limit tho :-)
+                 */
+                if (cpus->map[cpu] >= CPU_SETSIZE) {
+                        pr_debug("Ignoring CPU %d\n", cpus->map[cpu]);
+                        continue;
+                }
 
-                CPU_SET(cpu, cpu_set);
-                sched_setaffinity(0, cpu_set_size, cpu_set);
+                CPU_SET(cpus->map[cpu], &cpu_set);
+                if (sched_setaffinity(0, sizeof(cpu_set), &cpu_set) < 0) {
+                        pr_debug("sched_setaffinity() failed on CPU %d: %s ",
+                                 cpus->map[cpu],
+                                 strerror(errno));
+                        goto out_close_fd;
+                }
                 for (i = 0; i < ncalls; ++i) {
                         fd = open("/etc/passwd", O_RDONLY);
                         close(fd);
                 }
-                CPU_CLR(cpu, cpu_set);
+                CPU_CLR(cpus->map[cpu], &cpu_set);
         }
 
         /*
@@ -402,6 +411,9 @@ static int test__open_syscall_event_on_all_cpus(void)
         for (cpu = 0; cpu < cpus->nr; ++cpu) {
                 unsigned int expected;
 
+                if (cpus->map[cpu] >= CPU_SETSIZE)
+                        continue;
+
                 if (perf_evsel__read_on_cpu(evsel, cpu, 0) < 0) {
                         pr_debug("perf_evsel__open_read_on_cpu\n");
                         goto out_close_fd;
@@ -409,8 +421,8 @@ static int test__open_syscall_event_on_all_cpus(void)
 
                 expected = nr_open_calls + cpu;
                 if (evsel->counts->cpu[cpu].val != expected) {
-                        pr_debug("perf_evsel__read_on_cpu: expected to intercept %d calls on cpu %d, got %Ld\n",
-                                 expected, cpu, evsel->counts->cpu[cpu].val);
+                        pr_debug("perf_evsel__read_on_cpu: expected to intercept %d calls on cpu %d, got %" PRIu64 "\n",
+                                 expected, cpus->map[cpu], evsel->counts->cpu[cpu].val);
                         goto out_close_fd;
                 }
         }
@@ -420,8 +432,6 @@ out_close_fd:
         perf_evsel__close_fd(evsel, 1, threads->nr);
 out_evsel_delete:
         perf_evsel__delete(evsel);
-out_cpu_free:
-        CPU_FREE(cpu_set);
 out_thread_map_delete:
         thread_map__delete(threads);
         return err;
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 05344c6210a..b6998e05576 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -40,6 +40,7 @@
 #include <stdio.h>
 #include <termios.h>
 #include <unistd.h>
+#include <inttypes.h>
 
 #include <errno.h>
 #include <time.h>
@@ -214,7 +215,7 @@ static int parse_source(struct sym_entry *syme)
         len = sym->end - sym->start;
 
         sprintf(command,
-                "objdump --start-address=%#0*Lx --stop-address=%#0*Lx -dS %s",
+                "objdump --start-address=%#0*" PRIx64 " --stop-address=%#0*" PRIx64 " -dS %s",
                 BITS_PER_LONG / 4, map__rip_2objdump(map, sym->start),
                 BITS_PER_LONG / 4, map__rip_2objdump(map, sym->end), path);
 
@@ -308,7 +309,7 @@ static void lookup_sym_source(struct sym_entry *syme)
         struct source_line *line;
         char pattern[PATTERN_LEN + 1];
 
-        sprintf(pattern, "%0*Lx <", BITS_PER_LONG / 4,
+        sprintf(pattern, "%0*" PRIx64 " <", BITS_PER_LONG / 4,
                 map__rip_2objdump(syme->map, symbol->start));
 
         pthread_mutex_lock(&syme->src->lock);
@@ -537,7 +538,7 @@ static void print_sym_table(void)
         if (nr_counters == 1 || !display_weighted) {
                 struct perf_evsel *first;
                 first = list_entry(evsel_list.next, struct perf_evsel, node);
-                printf("%Ld", first->attr.sample_period);
+                printf("%" PRIu64, (uint64_t)first->attr.sample_period);
                 if (freq)
                         printf("Hz ");
                 else
@@ -640,7 +641,7 @@ static void print_sym_table(void)
 
                 percent_color_fprintf(stdout, "%4.1f%%", pcnt);
                 if (verbose)
-                        printf(" %016llx", sym->start);
+                        printf(" %016" PRIx64, sym->start);
                 printf(" %-*.*s", sym_width, sym_width, sym->name);
                 printf(" %-*.*s\n", dso_width, dso_width,
                        dso_width >= syme->map->dso->long_name_len ?
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 2302ec051bb..1478ab4ee22 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -459,7 +459,8 @@ int event__process_comm(event_t *self, struct sample_data *sample __used,
 int event__process_lost(event_t *self, struct sample_data *sample __used,
                         struct perf_session *session)
 {
-        dump_printf(": id:%Ld: lost:%Ld\n", self->lost.id, self->lost.lost);
+        dump_printf(": id:%" PRIu64 ": lost:%" PRIu64 "\n",
+                    self->lost.id, self->lost.lost);
         session->hists.stats.total_lost += self->lost.lost;
         return 0;
 }
@@ -575,7 +576,7 @@ int event__process_mmap(event_t *self, struct sample_data *sample __used,
         u8 cpumode = self->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
         int ret = 0;
 
-        dump_printf(" %d/%d: [%#Lx(%#Lx) @ %#Lx]: %s\n",
+        dump_printf(" %d/%d: [%#" PRIx64 "(%#" PRIx64 ") @ %#" PRIx64 "]: %s\n",
                         self->mmap.pid, self->mmap.tid, self->mmap.start,
                         self->mmap.len, self->mmap.pgoff, self->mmap.filename);
 
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index f5cfed60af9..d8575d31ee6 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -90,7 +90,7 @@ int __perf_evsel__read(struct perf_evsel *evsel,
         int cpu, thread;
         struct perf_counts_values *aggr = &evsel->counts->aggr, count;
 
-        aggr->val = 0;
+        aggr->val = aggr->ena = aggr->run = 0;
 
         for (cpu = 0; cpu < ncpus; cpu++) {
                 for (thread = 0; thread < nthreads; thread++) {
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 989fa2dee2f..f6a929e7498 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -798,8 +798,8 @@ static int perf_file_section__process(struct perf_file_section *self,
                                       int feat, int fd)
 {
         if (lseek(fd, self->offset, SEEK_SET) == (off_t)-1) {
-                pr_debug("Failed to lseek to %Ld offset for feature %d, "
-                         "continuing...\n", self->offset, feat);
+                pr_debug("Failed to lseek to %" PRIu64 " offset for feature "
+                          "%d, continuing...\n", self->offset, feat);
                 return 0;
         }
 
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index c749ba6136a..32f4f1f2f6e 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -636,13 +636,13 @@ int hist_entry__snprintf(struct hist_entry *self, char *s, size_t size,
                         }
                 }
         } else
-                ret = snprintf(s, size, sep ? "%lld" : "%12lld ", period);
+                ret = snprintf(s, size, sep ? "%" PRIu64 : "%12" PRIu64 " ", period);
 
         if (symbol_conf.show_nr_samples) {
                 if (sep)
-                        ret += snprintf(s + ret, size - ret, "%c%lld", *sep, period);
+                        ret += snprintf(s + ret, size - ret, "%c%" PRIu64, *sep, period);
                 else
-                        ret += snprintf(s + ret, size - ret, "%11lld", period);
+                        ret += snprintf(s + ret, size - ret, "%11" PRIu64, period);
         }
 
         if (pair_hists) {
@@ -971,7 +971,7 @@ int hist_entry__inc_addr_samples(struct hist_entry *self, u64 ip)
         sym_size = sym->end - sym->start;
         offset = ip - sym->start;
 
-        pr_debug3("%s: ip=%#Lx\n", __func__, self->ms.map->unmap_ip(self->ms.map, ip));
+        pr_debug3("%s: ip=%#" PRIx64 "\n", __func__, self->ms.map->unmap_ip(self->ms.map, ip));
 
         if (offset >= sym_size)
                 return 0;
@@ -980,8 +980,9 @@ int hist_entry__inc_addr_samples(struct hist_entry *self, u64 ip)
         h->sum++;
         h->ip[offset]++;
 
-        pr_debug3("%#Lx %s: period++ [ip: %#Lx, %#Lx] => %Ld\n", self->ms.sym->start,
-                  self->ms.sym->name, ip, ip - self->ms.sym->start, h->ip[offset]);
+        pr_debug3("%#" PRIx64 " %s: period++ [ip: %#" PRIx64 ", %#" PRIx64
+                  "] => %" PRIu64 "\n", self->ms.sym->start, self->ms.sym->name,
+                  ip, ip - self->ms.sym->start, h->ip[offset]);
         return 0;
 }
 
@@ -1132,7 +1133,7 @@ fallback:
                 goto out_free_filename;
         }
 
-        pr_debug("%s: filename=%s, sym=%s, start=%#Lx, end=%#Lx\n", __func__,
+        pr_debug("%s: filename=%s, sym=%s, start=%#" PRIx64 ", end=%#" PRIx64 "\n", __func__,
                  filename, sym->name, map->unmap_ip(map, sym->start),
                  map->unmap_ip(map, sym->end));
 
@@ -1142,7 +1143,7 @@ fallback:
                  dso, dso->long_name, sym, sym->name);
 
         snprintf(command, sizeof(command),
-                 "objdump --start-address=0x%016Lx --stop-address=0x%016Lx -dS -C %s|grep -v %s|expand",
+                 "objdump --start-address=0x%016" PRIx64 " --stop-address=0x%016" PRIx64 " -dS -C %s|grep -v %s|expand",
                  map__rip_2objdump(map, sym->start),
                  map__rip_2objdump(map, sym->end),
                  symfs_filename, filename);
diff --git a/tools/perf/util/include/linux/bitops.h b/tools/perf/util/include/linux/bitops.h
index 8be0b968ca0..305c8484f20 100644
--- a/tools/perf/util/include/linux/bitops.h
+++ b/tools/perf/util/include/linux/bitops.h
@@ -2,6 +2,7 @@
 #define _PERF_LINUX_BITOPS_H_
 
 #include <linux/kernel.h>
+#include <linux/compiler.h>
 #include <asm/hweight.h>
 
 #define BITS_PER_LONG __WORDSIZE
diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
index 3a7eb6ec0ee..a16ecab5229 100644
--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -1,5 +1,6 @@
 #include "symbol.h"
 #include <errno.h>
+#include <inttypes.h>
 #include <limits.h>
 #include <stdlib.h>
 #include <string.h>
@@ -195,7 +196,7 @@ int map__overlap(struct map *l, struct map *r)
 
 size_t map__fprintf(struct map *self, FILE *fp)
 {
-        return fprintf(fp, " %Lx-%Lx %Lx %s\n",
+        return fprintf(fp, " %" PRIx64 "-%" PRIx64 " %" PRIx64 " %s\n",
                        self->start, self->end, self->pgoff, self->dso->name);
 }
 
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index bc2732ee23e..135f69baf96 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -279,7 +279,7 @@ const char *__event_name(int type, u64 config)
         static char buf[32];
 
         if (type == PERF_TYPE_RAW) {
-                sprintf(buf, "raw 0x%llx", config);
+                sprintf(buf, "raw 0x%" PRIx64, config);
                 return buf;
         }
 
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index b82cafb8377..458e3ecf17a 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -23,7 +23,7 @@ struct tracepoint_path {
 };
 
 extern struct tracepoint_path *tracepoint_id_to_path(u64 config);
-extern bool have_tracepoints(struct list_head *evsel_list);
+extern bool have_tracepoints(struct list_head *evlist);
 
 extern int                      nr_counters;
 
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 128aaab0aed..6e29d9c9dcc 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -172,7 +172,7 @@ static int kprobe_convert_to_perf_probe(struct probe_trace_point *tp,
         sym = __find_kernel_function_by_name(tp->symbol, &map);
         if (sym) {
                 addr = map->unmap_ip(map, sym->start + tp->offset);
-                pr_debug("try to find %s+%ld@%llx\n", tp->symbol,
+                pr_debug("try to find %s+%ld@%" PRIx64 "\n", tp->symbol,
                          tp->offset, addr);
                 ret = find_perf_probe_point((unsigned long)addr, pp);
         }
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 313dac2d94c..105f00bfd55 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -652,10 +652,11 @@ static void callchain__printf(struct sample_data *sample)
 {
         unsigned int i;
 
-        printf("... chain: nr:%Lu\n", sample->callchain->nr);
+        printf("... chain: nr:%" PRIu64 "\n", sample->callchain->nr);
 
         for (i = 0; i < sample->callchain->nr; i++)
-                printf("..... %2d: %016Lx\n", i, sample->callchain->ips[i]);
+                printf("..... %2d: %016" PRIx64 "\n",
+                       i, sample->callchain->ips[i]);
 }
 
 static void perf_session__print_tstamp(struct perf_session *session,
@@ -672,7 +673,7 @@ static void perf_session__print_tstamp(struct perf_session *session,
                 printf("%u ", sample->cpu);
 
         if (session->sample_type & PERF_SAMPLE_TIME)
-                printf("%Lu ", sample->time);
+                printf("%" PRIu64 " ", sample->time);
 }
 
 static void dump_event(struct perf_session *session, event_t *event,
@@ -681,16 +682,16 @@ static void dump_event(struct perf_session *session, event_t *event,
         if (!dump_trace)
                 return;
 
-        printf("\n%#Lx [%#x]: event: %d\n", file_offset, event->header.size,
-               event->header.type);
+        printf("\n%#" PRIx64 " [%#x]: event: %d\n",
+               file_offset, event->header.size, event->header.type);
 
         trace_event(event);
 
         if (sample)
                 perf_session__print_tstamp(session, event, sample);
 
-        printf("%#Lx [%#x]: PERF_RECORD_%s", file_offset, event->header.size,
-               event__get_event_name(event->header.type));
+        printf("%#" PRIx64 " [%#x]: PERF_RECORD_%s", file_offset,
+               event->header.size, event__get_event_name(event->header.type));
 }
 
 static void dump_sample(struct perf_session *session, event_t *event,
@@ -699,8 +700,9 @@ static void dump_sample(struct perf_session *session, event_t *event,
         if (!dump_trace)
                 return;
 
-        printf("(IP, %d): %d/%d: %#Lx period: %Ld\n", event->header.misc,
-               sample->pid, sample->tid, sample->ip, sample->period);
+        printf("(IP, %d): %d/%d: %#" PRIx64 " period: %" PRIu64 "\n",
+               event->header.misc, sample->pid, sample->tid, sample->ip,
+               sample->period);
 
         if (session->sample_type & PERF_SAMPLE_CALLCHAIN)
                 callchain__printf(sample);
@@ -843,8 +845,8 @@ static void perf_session__warn_about_errors(const struct perf_session *session,
 {
         if (ops->lost == event__process_lost &&
             session->hists.stats.total_lost != 0) {
-                ui__warning("Processed %Lu events and LOST %Lu!\n\n"
-                            "Check IO/CPU overload!\n\n",
+                ui__warning("Processed %" PRIu64 " events and LOST %" PRIu64
+                            "!\n\nCheck IO/CPU overload!\n\n",
                             session->hists.stats.total_period,
                             session->hists.stats.total_lost);
         }
@@ -918,7 +920,7 @@ more:
 
         if (size == 0 ||
             (skip = perf_session__process_event(self, &event, ops, head)) < 0) {
-                dump_printf("%#Lx [%#x]: skipping unknown header type: %d\n",
+                dump_printf("%#" PRIx64 " [%#x]: skipping unknown header type: %d\n",
                             head, event.header.size, event.header.type);
                 /*
                  * assume we lost track of the stream, check alignment, and
@@ -1023,7 +1025,7 @@ more:
 
         if (size == 0 ||
             perf_session__process_event(session, event, ops, file_pos) < 0) {
-                dump_printf("%#Lx [%#x]: skipping unknown header type: %d\n",
+                dump_printf("%#" PRIx64 " [%#x]: skipping unknown header type: %d\n",
                             file_offset + head, event->header.size,
                             event->header.type);
                 /*
diff --git a/tools/perf/util/svghelper.c b/tools/perf/util/svghelper.c
index b3637db025a..fb737fe9be9 100644
--- a/tools/perf/util/svghelper.c
+++ b/tools/perf/util/svghelper.c
@@ -12,6 +12,7 @@
  * of the License.
  */
 
+#include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -43,11 +44,11 @@ static double cpu2y(int cpu)
         return cpu2slot(cpu) * SLOT_MULT;
 }
 
-static double time2pixels(u64 time)
+static double time2pixels(u64 __time)
 {
         double X;
 
-        X = 1.0 * svg_page_width * (time - first_time) / (last_time - first_time);
+        X = 1.0 * svg_page_width * (__time - first_time) / (last_time - first_time);
         return X;
 }
 
@@ -94,7 +95,7 @@ void open_svg(const char *filename, int cpus, int rows, u64 start, u64 end)
 
         total_height = (1 + rows + cpu2slot(cpus)) * SLOT_MULT;
         fprintf(svgfile, "<?xml version=\"1.0\" standalone=\"no\"?> \n");
-        fprintf(svgfile, "<svg width=\"%i\" height=\"%llu\" version=\"1.1\" xmlns=\"http://www.w3.org/2000/svg\">\n", svg_page_width, total_height);
+        fprintf(svgfile, "<svg width=\"%i\" height=\"%" PRIu64 "\" version=\"1.1\" xmlns=\"http://www.w3.org/2000/svg\">\n", svg_page_width, total_height);
 
         fprintf(svgfile, "<defs>\n  <style type=\"text/css\">\n    <![CDATA[\n");
 
@@ -483,7 +484,7 @@ void svg_time_grid(void)
                         color = 128;
                 }
 
-                fprintf(svgfile, "<line x1=\"%4.8f\" y1=\"%4.2f\" x2=\"%4.8f\" y2=\"%llu\" style=\"stroke:rgb(%i,%i,%i);stroke-width:%1.3f\"/>\n",
+                fprintf(svgfile, "<line x1=\"%4.8f\" y1=\"%4.2f\" x2=\"%4.8f\" y2=\"%" PRIu64 "\" style=\"stroke:rgb(%i,%i,%i);stroke-width:%1.3f\"/>\n",
                         time2pixels(i), SLOT_MULT/2, time2pixels(i), total_height, color, color, color, thickness);
 
                 i += 10000000;
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 15ccfba8cdf..7821d0e6866 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -11,6 +11,7 @@
 #include <sys/param.h>
 #include <fcntl.h>
 #include <unistd.h>
+#include <inttypes.h>
 #include "build-id.h"
 #include "debug.h"
 #include "symbol.h"
@@ -153,7 +154,7 @@ static struct symbol *symbol__new(u64 start, u64 len, u8 binding,
         self->binding = binding;
         self->namelen = namelen - 1;
 
-        pr_debug4("%s: %s %#Lx-%#Lx\n", __func__, name, start, self->end);
+        pr_debug4("%s: %s %#" PRIx64 "-%#" PRIx64 "\n", __func__, name, start, self->end);
 
         memcpy(self->name, name, namelen);
 
@@ -167,7 +168,7 @@ void symbol__delete(struct symbol *self)
 
 static size_t symbol__fprintf(struct symbol *self, FILE *fp)
 {
-        return fprintf(fp, " %llx-%llx %c %s\n",
+        return fprintf(fp, " %" PRIx64 "-%" PRIx64 " %c %s\n",
                        self->start, self->end,
                        self->binding == STB_GLOBAL ? 'g' :
                        self->binding == STB_LOCAL  ? 'l' : 'w',
@@ -1161,6 +1162,13 @@ static int dso__load_sym(struct dso *self, struct map *map, const char *name,
 
                 section_name = elf_sec__name(&shdr, secstrs);
 
+                /* On ARM, symbols for thumb functions have 1 added to
+                 * the symbol address as a flag - remove it */
+                if ((ehdr.e_machine == EM_ARM) &&
+                    (map->type == MAP__FUNCTION) &&
+                    (sym.st_value & 1))
+                        --sym.st_value;
+
                 if (self->kernel != DSO_TYPE_USER || kmodule) {
                         char dso_name[PATH_MAX];
 
@@ -1208,8 +1216,8 @@ static int dso__load_sym(struct dso *self, struct map *map, const char *name,
                 }
 
                 if (curr_dso->adjust_symbols) {
-                        pr_debug4("%s: adjusting symbol: st_value: %#Lx "
-                                  "sh_addr: %#Lx sh_offset: %#Lx\n", __func__,
+                        pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " "
+                                  "sh_addr: %#" PRIx64 " sh_offset: %#" PRIx64 "\n", __func__,
                                   (u64)sym.st_value, (u64)shdr.sh_addr,
                                   (u64)shdr.sh_offset);
                         sym.st_value -= shdr.sh_addr - shdr.sh_offset;
diff --git a/tools/perf/util/types.h b/tools/perf/util/types.h
index 7d6b8331f89..5f3689a3d08 100644
--- a/tools/perf/util/types.h
+++ b/tools/perf/util/types.h
@@ -1,12 +1,14 @@
 #ifndef __PERF_TYPES_H
 #define __PERF_TYPES_H
 
+#include <stdint.h>
+
 /*
- * We define u64 as unsigned long long for every architecture
- * so that we can print it with %Lx without getting warnings.
+ * We define u64 as uint64_t for every architecture
+ * so that we can print it with "%"PRIx64 without getting warnings.
  */
-typedef unsigned long long u64;
-typedef signed long long   s64;
+typedef uint64_t           u64;
+typedef int64_t            s64;
 typedef unsigned int       u32;
 typedef signed int         s32;
 typedef unsigned short     u16;
diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c
index ebda8c3fde9..60c463c1602 100644
--- a/tools/perf/util/ui/browsers/hists.c
+++ b/tools/perf/util/ui/browsers/hists.c
@@ -350,7 +350,7 @@ static char *callchain_list__sym_name(struct callchain_list *self,
         if (self->ms.sym)
                 return self->ms.sym->name;
 
-        snprintf(bf, bfsize, "%#Lx", self->ip);
+        snprintf(bf, bfsize, "%#" PRIx64, self->ip);
         return bf;
 }
 
diff --git a/tools/perf/util/ui/browsers/map.c b/tools/perf/util/ui/browsers/map.c
index e35437dfa5b..e5158369106 100644
--- a/tools/perf/util/ui/browsers/map.c
+++ b/tools/perf/util/ui/browsers/map.c
@@ -1,5 +1,6 @@
 #include "../libslang.h"
 #include <elf.h>
+#include <inttypes.h>
 #include <sys/ttydefaults.h>
 #include <ctype.h>
 #include <string.h>
@@ -57,7 +58,7 @@ static void map_browser__write(struct ui_browser *self, void *nd, int row)
         int width;
 
         ui_browser__set_percent_color(self, 0, current_entry);
-        slsmg_printf("%*llx %*llx %c ",
+        slsmg_printf("%*" PRIx64 " %*" PRIx64 " %c ",
                      mb->addrlen, sym->start, mb->addrlen, sym->end,
                      sym->binding == STB_GLOBAL ? 'g' :
                      sym->binding == STB_LOCAL  ? 'l' : 'w');
@@ -150,6 +151,6 @@ int map__browse(struct map *self)
                 ++mb.b.nr_entries;
         }
 
-        mb.addrlen = snprintf(tmp, sizeof(tmp), "%llx", maxaddr);
+        mb.addrlen = snprintf(tmp, sizeof(tmp), "%" PRIx64, maxaddr);
         return map_browser__run(&mb);
 }
diff --git a/tools/perf/util/values.c b/tools/perf/util/values.c
index cfa55d686e3..bdd33470b23 100644
--- a/tools/perf/util/values.c
+++ b/tools/perf/util/values.c
@@ -150,7 +150,7 @@ static void perf_read_values__display_pretty(FILE *fp,
                 if (width > tidwidth)
                         tidwidth = width;
                 for (j = 0; j < values->counters; j++) {
-                        width = snprintf(NULL, 0, "%Lu", values->value[i][j]);
+                        width = snprintf(NULL, 0, "%" PRIu64, values->value[i][j]);
                         if (width > counterwidth[j])
                                 counterwidth[j] = width;
                 }
@@ -165,7 +165,7 @@ static void perf_read_values__display_pretty(FILE *fp,
                 fprintf(fp, "  %*d  %*d", pidwidth, values->pid[i],
                         tidwidth, values->tid[i]);
                 for (j = 0; j < values->counters; j++)
-                        fprintf(fp, "  %*Lu",
+                        fprintf(fp, "  %*" PRIu64,
                                 counterwidth[j], values->value[i][j]);
                 fprintf(fp, "\n");
         }
@@ -196,13 +196,13 @@ static void perf_read_values__display_raw(FILE *fp,
                 width = strlen(values->countername[j]);
                 if (width > namewidth)
                         namewidth = width;
-                width = snprintf(NULL, 0, "%llx", values->counterrawid[j]);
+                width = snprintf(NULL, 0, "%" PRIx64, values->counterrawid[j]);
                 if (width > rawwidth)
                         rawwidth = width;
         }
         for (i = 0; i < values->threads; i++) {
                 for (j = 0; j < values->counters; j++) {
-                        width = snprintf(NULL, 0, "%Lu", values->value[i][j]);
+                        width = snprintf(NULL, 0, "%" PRIu64, values->value[i][j]);
                         if (width > countwidth)
                                 countwidth = width;
                 }
@@ -214,7 +214,7 @@ static void perf_read_values__display_raw(FILE *fp,
                 countwidth, "Count");
         for (i = 0; i < values->threads; i++)
                 for (j = 0; j < values->counters; j++)
-                        fprintf(fp, "  %*d  %*d  %*s  %*llx  %*Lu\n",
+                        fprintf(fp, "  %*d  %*d  %*s  %*" PRIx64 "  %*" PRIu64,
                                 pidwidth, values->pid[i],
                                 tidwidth, values->tid[i],
                                 namewidth, values->countername[j],
diff --git a/usr/Kconfig b/usr/Kconfig
index 4780deac597..65b845bd4e3 100644
--- a/usr/Kconfig
+++ b/usr/Kconfig
@@ -46,7 +46,7 @@ config INITRAMFS_ROOT_GID
           If you are not sure, leave it set to "0".
 
 config RD_GZIP
-        bool "Support initial ramdisks compressed using gzip" if EMBEDDED
+        bool "Support initial ramdisks compressed using gzip" if EXPERT
         default y
         depends on BLK_DEV_INITRD
         select DECOMPRESS_GZIP
@@ -55,8 +55,8 @@ config RD_GZIP
           If unsure, say Y.
 
 config RD_BZIP2
-        bool "Support initial ramdisks compressed using bzip2" if EMBEDDED
-        default !EMBEDDED
+        bool "Support initial ramdisks compressed using bzip2" if EXPERT
+        default !EXPERT
         depends on BLK_DEV_INITRD
         select DECOMPRESS_BZIP2
         help
@@ -64,8 +64,8 @@ config RD_BZIP2
           If unsure, say N.
 
 config RD_LZMA
-        bool "Support initial ramdisks compressed using LZMA" if EMBEDDED
-        default !EMBEDDED
+        bool "Support initial ramdisks compressed using LZMA" if EXPERT
+        default !EXPERT
         depends on BLK_DEV_INITRD
         select DECOMPRESS_LZMA
         help
@@ -73,8 +73,8 @@ config RD_LZMA
           If unsure, say N.
 
 config RD_XZ
-        bool "Support initial ramdisks compressed using XZ" if EMBEDDED
-        default !EMBEDDED
+        bool "Support initial ramdisks compressed using XZ" if EXPERT
+        default !EXPERT
         depends on BLK_DEV_INITRD
         select DECOMPRESS_XZ
         help
@@ -82,8 +82,8 @@ config RD_XZ
           If unsure, say N.
 
 config RD_LZO
-        bool "Support initial ramdisks compressed using LZO" if EMBEDDED
-        default !EMBEDDED
+        bool "Support initial ramdisks compressed using LZO" if EXPERT
+        default !EXPERT
         depends on BLK_DEV_INITRD
         select DECOMPRESS_LZO
         help