Update 2.6.36 to 2.6.36.4wip-dissipation2-jerickso

604 files changed, 5819 insertions, 2754 deletions

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 8dd7248508a9..48128ed08006 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -879,6 +879,7 @@ and is between 256 and 4096 characters. It is defined in the file
                              controller
         i8042.nopnp     [HW] Don't use ACPIPnP / PnPBIOS to discover KBD/AUX
                              controllers
+        i8042.notimeout [HW] Ignore timeout condition signalled by conroller
         i8042.reset     [HW] Reset the controller during init and cleanup
         i8042.unlock    [HW] Unlock (ignore) the keylock
 
@@ -1745,7 +1746,7 @@ and is between 256 and 4096 characters. It is defined in the file
 
         nousb           [USB] Disable the USB subsystem
 
-        nowatchdog      [KNL] Disable the lockup detector.
+        nowatchdog      [KNL] Disable the lockup detector (NMI watchdog).
 
         nowb            [ARM]
 
diff --git a/Documentation/power/runtime_pm.txt b/Documentation/power/runtime_pm.txt
index 55b859b3bc72..506d9d916e41 100644
--- a/Documentation/power/runtime_pm.txt
+++ b/Documentation/power/runtime_pm.txt
@@ -336,8 +336,8 @@ drivers/base/power/runtime.c and include/linux/pm_runtime.h:
       zero)
 
   bool pm_runtime_suspended(struct device *dev);
-    - return true if the device's runtime PM status is 'suspended', or false
-      otherwise
+    - return true if the device's runtime PM status is 'suspended' and its
+      'power.disable_depth' field is equal to zero, or false otherwise
 
   void pm_runtime_allow(struct device *dev);
     - set the power.runtime_auto flag for the device and decrease its usage
diff --git a/Makefile b/Makefile
index 8e53f47a311b..77a7eb5908dc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 36
-EXTRAVERSION =-litmus2010
+EXTRAVERSION =.4-litmus2010
 NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 6e8f05c8a1c8..d7575554e407 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -215,7 +215,7 @@
         @ Slightly optimised to avoid incrementing the pointer twice
         usraccoff \instr, \reg, \ptr, \inc, 0, \cond, \abort
         .if     \rept == 2
-        usraccoff \instr, \reg, \ptr, \inc, 4, \cond, \abort
+        usraccoff \instr, \reg, \ptr, \inc, \inc, \cond, \abort
         .endif
 
         add\cond \ptr, #\rept * \inc
diff --git a/arch/arm/include/asm/kgdb.h b/arch/arm/include/asm/kgdb.h
index 08265993227f..48066ce9ea34 100644
--- a/arch/arm/include/asm/kgdb.h
+++ b/arch/arm/include/asm/kgdb.h
@@ -70,7 +70,8 @@ extern int kgdb_fault_expected;
 #define _GP_REGS                16
 #define _FP_REGS                8
 #define _EXTRA_REGS             2
-#define DBG_MAX_REG_NUM         (_GP_REGS + (_FP_REGS * 3) + _EXTRA_REGS)
+#define GDB_MAX_REGS            (_GP_REGS + (_FP_REGS * 3) + _EXTRA_REGS)
+#define DBG_MAX_REG_NUM         (_GP_REGS + _FP_REGS + _EXTRA_REGS)
 
 #define KGDB_MAX_NO_CPUS        1
 #define BUFMAX                  400
@@ -93,7 +94,7 @@ extern int kgdb_fault_expected;
 #define _SPT                    13
 #define _LR                     14
 #define _PC                     15
-#define _CPSR                   (DBG_MAX_REG_NUM - 1)
+#define _CPSR                   (GDB_MAX_REGS - 1)
 
 /*
  * So that we can denote the end of a frame for tracing,
diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c
index d6e8b4d2e60d..778c2f7024ff 100644
--- a/arch/arm/kernel/kgdb.c
+++ b/arch/arm/kernel/kgdb.c
@@ -79,7 +79,7 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
                 return;
 
         /* Initialize to zero */
-        for (regno = 0; regno < DBG_MAX_REG_NUM; regno++)
+        for (regno = 0; regno < GDB_MAX_REGS; regno++)
                 gdb_regs[regno] = 0;
 
         /* Otherwise, we have only some registers from switch_to() */
diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S
index 1e4cbd4e7be9..64f6bc1a9132 100644
--- a/arch/arm/lib/findbit.S
+++ b/arch/arm/lib/findbit.S
@@ -174,8 +174,8 @@ ENDPROC(_find_next_bit_be)
  */
 .L_found:
 #if __LINUX_ARM_ARCH__ >= 5
-                rsb     r1, r3, #0
-                and     r3, r3, r1
+                rsb     r0, r3, #0
+                and     r3, r3, r0
                 clz     r3, r3
                 rsb     r3, r3, #31
                 add     r0, r2, r3
@@ -190,5 +190,7 @@ ENDPROC(_find_next_bit_be)
                 addeq   r2, r2, #1
                 mov     r0, r2
 #endif
+                cmp     r1, r0                  @ Clamp to maxbit
+                movlo   r0, r1
                 mov     pc, lr
 
diff --git a/arch/arm/mach-at91/include/mach/at91_mci.h b/arch/arm/mach-at91/include/mach/at91_mci.h
index 57f8ee154943..27ac6f550fe3 100644
--- a/arch/arm/mach-at91/include/mach/at91_mci.h
+++ b/arch/arm/mach-at91/include/mach/at91_mci.h
@@ -74,6 +74,8 @@
 #define                 AT91_MCI_TRTYP_BLOCK    (0 << 19)
 #define                 AT91_MCI_TRTYP_MULTIPLE (1 << 19)
 #define                 AT91_MCI_TRTYP_STREAM   (2 << 19)
+#define                 AT91_MCI_TRTYP_SDIO_BYTE        (4 << 19)
+#define                 AT91_MCI_TRTYP_SDIO_BLOCK       (5 << 19)
 
 #define AT91_MCI_BLKR           0x18            /* Block Register */
 #define         AT91_MCI_BLKR_BCNT(n)   ((0xffff & (n)) << 0)   /* Block count */
diff --git a/arch/arm/mach-cns3xxx/include/mach/debug-macro.S b/arch/arm/mach-cns3xxx/include/mach/debug-macro.S
index d16ce7eb00e9..9b50442d4b9b 100644
--- a/arch/arm/mach-cns3xxx/include/mach/debug-macro.S
+++ b/arch/arm/mach-cns3xxx/include/mach/debug-macro.S
@@ -10,7 +10,7 @@
  * published by the Free Software Foundation.
  */
 
-                .macro  addruart,rx
+                .macro  addruart,rx,rtmp
                 mrc     p15, 0, \rx, c1, c0
                 tst     \rx, #1                 @ MMU enabled?
                 moveq   \rx,      #0x10000000
diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
index 38088c36936c..78defd71a829 100644
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -369,7 +369,7 @@ static int __init cns3xxx_pcie_init(void)
 {
         int i;
 
-        hook_fault_code(16 + 6, cns3xxx_pcie_abort_handler, SIGBUS,
+        hook_fault_code(16 + 6, cns3xxx_pcie_abort_handler, SIGBUS, 0,
                         "imprecise external abort");
 
         for (i = 0; i < ARRAY_SIZE(cns3xxx_pcie); i++) {
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index 86aa689ef1aa..47010d8114b0 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -196,6 +196,10 @@ ENTRY(v6_flush_kern_dcache_area)
  *      - end     - virtual end address of region
  */
 v6_dma_inv_range:
+#ifdef CONFIG_DMA_CACHE_RWFO
+        ldrb    r2, [r0]                        @ read for ownership
+        strb    r2, [r0]                        @ write for ownership
+#endif
         tst     r0, #D_CACHE_LINE_SIZE - 1
         bic     r0, r0, #D_CACHE_LINE_SIZE - 1
 #ifdef HARVARD_CACHE
@@ -204,6 +208,10 @@ v6_dma_inv_range:
         mcrne   p15, 0, r0, c7, c11, 1          @ clean unified line
 #endif
         tst     r1, #D_CACHE_LINE_SIZE - 1
+#ifdef CONFIG_DMA_CACHE_RWFO
+        ldrneb  r2, [r1, #-1]                   @ read for ownership
+        strneb  r2, [r1, #-1]                   @ write for ownership
+#endif
         bic     r1, r1, #D_CACHE_LINE_SIZE - 1
 #ifdef HARVARD_CACHE
         mcrne   p15, 0, r1, c7, c14, 1          @ clean & invalidate D line
@@ -211,10 +219,6 @@ v6_dma_inv_range:
         mcrne   p15, 0, r1, c7, c15, 1          @ clean & invalidate unified line
 #endif
 1:
-#ifdef CONFIG_DMA_CACHE_RWFO
-        ldr     r2, [r0]                        @ read for ownership
-        str     r2, [r0]                        @ write for ownership
-#endif
 #ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c6, 1           @ invalidate D line
 #else
@@ -222,6 +226,10 @@ v6_dma_inv_range:
 #endif
         add     r0, r0, #D_CACHE_LINE_SIZE
         cmp     r0, r1
+#ifdef CONFIG_DMA_CACHE_RWFO
+        ldrlo   r2, [r0]                        @ read for ownership
+        strlo   r2, [r0]                        @ write for ownership
+#endif
         blo     1b
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
@@ -256,12 +264,12 @@ v6_dma_clean_range:
  *      - end     - virtual end address of region
  */
 ENTRY(v6_dma_flush_range)
-        bic     r0, r0, #D_CACHE_LINE_SIZE - 1
-1:
 #ifdef CONFIG_DMA_CACHE_RWFO
-        ldr     r2, [r0]                        @ read for ownership
-        str     r2, [r0]                        @ write for ownership
+        ldrb    r2, [r0]                @ read for ownership
+        strb    r2, [r0]                @ write for ownership
 #endif
+        bic     r0, r0, #D_CACHE_LINE_SIZE - 1
+1:
 #ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c14, 1          @ clean & invalidate D line
 #else
@@ -269,6 +277,10 @@ ENTRY(v6_dma_flush_range)
 #endif
         add     r0, r0, #D_CACHE_LINE_SIZE
         cmp     r0, r1
+#ifdef CONFIG_DMA_CACHE_RWFO
+        ldrlob  r2, [r0]                        @ read for ownership
+        strlob  r2, [r0]                        @ write for ownership
+#endif
         blo     1b
         mov     r0, #0
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
diff --git a/arch/arm/mm/fault-armv.c b/arch/arm/mm/fault-armv.c
index 9b906dec1ca1..56036ff04deb 100644
--- a/arch/arm/mm/fault-armv.c
+++ b/arch/arm/mm/fault-armv.c
@@ -65,6 +65,30 @@ static int do_adjust_pte(struct vm_area_struct *vma, unsigned long address,
         return ret;
 }
 
+#if USE_SPLIT_PTLOCKS
+/*
+ * If we are using split PTE locks, then we need to take the page
+ * lock here.  Otherwise we are using shared mm->page_table_lock
+ * which is already locked, thus cannot take it.
+ */
+static inline void do_pte_lock(spinlock_t *ptl)
+{
+        /*
+         * Use nested version here to indicate that we are already
+         * holding one similar spinlock.
+         */
+        spin_lock_nested(ptl, SINGLE_DEPTH_NESTING);
+}
+
+static inline void do_pte_unlock(spinlock_t *ptl)
+{
+        spin_unlock(ptl);
+}
+#else /* !USE_SPLIT_PTLOCKS */
+static inline void do_pte_lock(spinlock_t *ptl) {}
+static inline void do_pte_unlock(spinlock_t *ptl) {}
+#endif /* USE_SPLIT_PTLOCKS */
+
 static int adjust_pte(struct vm_area_struct *vma, unsigned long address,
         unsigned long pfn)
 {
@@ -89,11 +113,11 @@ static int adjust_pte(struct vm_area_struct *vma, unsigned long address,
          */
         ptl = pte_lockptr(vma->vm_mm, pmd);
         pte = pte_offset_map_nested(pmd, address);
-        spin_lock(ptl);
+        do_pte_lock(ptl);
 
         ret = do_adjust_pte(vma, address, pfn, pte);
 
-        spin_unlock(ptl);
+        do_pte_unlock(ptl);
         pte_unmap_nested(pte);
 
         return ret;
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 7185b00650fe..4e2f620de09b 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -282,6 +282,12 @@ void __init arm_memblock_init(struct meminfo *mi, struct machine_desc *mdesc)
         memblock_reserve(__pa(_stext), _end - _stext);
 #endif
 #ifdef CONFIG_BLK_DEV_INITRD
+        if (phys_initrd_size &&
+            memblock_is_region_reserved(phys_initrd_start, phys_initrd_size)) {
+                pr_err("INITRD: 0x%08lx+0x%08lx overlaps in-use memory region - disabling initrd\n",
+                       phys_initrd_start, phys_initrd_size);
+                phys_initrd_start = phys_initrd_size = 0;
+        }
         if (phys_initrd_size) {
                 memblock_reserve(phys_initrd_start, phys_initrd_size);
 
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index ec7eddf9e525..f5c5b8da9a87 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -30,6 +30,7 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/slab.h>
+#include <linux/delay.h>
 
 #include <asm/system.h>
 #include <mach/hardware.h>
@@ -996,11 +997,17 @@ void omap_start_dma(int lch)
         l = dma_read(CCR(lch));
 
         /*
-         * Errata: On ES2.0 BUFFERING disable must be set.
-         * This will always fail on ES1.0
+         * Errata: Inter Frame DMA buffering issue (All OMAP2420 and
+         * OMAP2430ES1.0): DMA will wrongly buffer elements if packing and
+         * bursting is enabled. This might result in data gets stalled in
+         * FIFO at the end of the block.
+         * Workaround: DMA channels must have BUFFERING_DISABLED bit set to
+         * guarantee no data will stay in the DMA FIFO in case inter frame
+         * buffering occurs.
          */
-        if (cpu_is_omap24xx())
-                l |= OMAP_DMA_CCR_EN;
+        if (cpu_is_omap2420() ||
+            (cpu_is_omap2430() && (omap_type() == OMAP2430_REV_ES1_0)))
+                l |= OMAP_DMA_CCR_BUFFERING_DISABLE;
 
         l |= OMAP_DMA_CCR_EN;
         dma_write(l, CCR(lch));
@@ -1018,8 +1025,39 @@ void omap_stop_dma(int lch)
                 dma_write(0, CICR(lch));
 
         l = dma_read(CCR(lch));
-        l &= ~OMAP_DMA_CCR_EN;
-        dma_write(l, CCR(lch));
+        /* OMAP3 Errata i541: sDMA FIFO draining does not finish */
+        if (cpu_is_omap34xx() && (l & OMAP_DMA_CCR_SEL_SRC_DST_SYNC)) {
+                int i = 0;
+                u32 sys_cf;
+
+                /* Configure No-Standby */
+                l = dma_read(OCP_SYSCONFIG);
+                sys_cf = l;
+                l &= ~DMA_SYSCONFIG_MIDLEMODE_MASK;
+                l |= DMA_SYSCONFIG_MIDLEMODE(DMA_IDLEMODE_NO_IDLE);
+                dma_write(l , OCP_SYSCONFIG);
+
+                l = dma_read(CCR(lch));
+                l &= ~OMAP_DMA_CCR_EN;
+                dma_write(l, CCR(lch));
+
+                /* Wait for sDMA FIFO drain */
+                l = dma_read(CCR(lch));
+                while (i < 100 && (l & (OMAP_DMA_CCR_RD_ACTIVE |
+                                        OMAP_DMA_CCR_WR_ACTIVE))) {
+                        udelay(5);
+                        i++;
+                        l = dma_read(CCR(lch));
+                }
+                if (i >= 100)
+                        printk(KERN_ERR "DMA drain did not complete on "
+                                        "lch %d\n", lch);
+                /* Restore OCP_SYSCONFIG */
+                dma_write(sys_cf, OCP_SYSCONFIG);
+        } else {
+                l &= ~OMAP_DMA_CCR_EN;
+                dma_write(l, CCR(lch));
+        }
 
         if (!omap_dma_in_1510_mode() && dma_chan[lch].next_lch != -1) {
                 int next_lch, cur_lch = lch;
diff --git a/arch/arm/plat-omap/include/plat/dma.h b/arch/arm/plat-omap/include/plat/dma.h
index af3a03941add..cf66f85a011c 100644
--- a/arch/arm/plat-omap/include/plat/dma.h
+++ b/arch/arm/plat-omap/include/plat/dma.h
@@ -335,6 +335,10 @@
 #define OMAP2_DMA_MISALIGNED_ERR_IRQ    (1 << 11)
 
 #define OMAP_DMA_CCR_EN                 (1 << 7)
+#define OMAP_DMA_CCR_RD_ACTIVE          (1 << 9)
+#define OMAP_DMA_CCR_WR_ACTIVE          (1 << 10)
+#define OMAP_DMA_CCR_SEL_SRC_DST_SYNC   (1 << 24)
+#define OMAP_DMA_CCR_BUFFERING_DISABLE  (1 << 25)
 
 #define OMAP_DMA_DATA_TYPE_S8           0x00
 #define OMAP_DMA_DATA_TYPE_S16          0x01
diff --git a/arch/avr32/include/asm/syscalls.h b/arch/avr32/include/asm/syscalls.h
index ab608b70b24d..730a461c606f 100644
--- a/arch/avr32/include/asm/syscalls.h
+++ b/arch/avr32/include/asm/syscalls.h
@@ -16,18 +16,9 @@
 #include <linux/signal.h>
 
 /* kernel/process.c */
-asmlinkage int sys_fork(struct pt_regs *);
 asmlinkage int sys_clone(unsigned long, unsigned long,
                          unsigned long, unsigned long,
                          struct pt_regs *);
-asmlinkage int sys_vfork(struct pt_regs *);
-asmlinkage int sys_execve(const char __user *, char __user *__user *,
-                          char __user *__user *, struct pt_regs *);
-
-/* kernel/signal.c */
-asmlinkage int sys_sigaltstack(const stack_t __user *, stack_t __user *,
-                               struct pt_regs *);
-asmlinkage int sys_rt_sigreturn(struct pt_regs *);
 
 /* mm/cache.c */
 asmlinkage int sys_cacheflush(int, void __user *, size_t);
diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
index 592c7079de88..b07d990bbed8 100644
--- a/arch/microblaze/Makefile
+++ b/arch/microblaze/Makefile
@@ -72,12 +72,16 @@ export MMU DTB
 
 all: linux.bin
 
-BOOT_TARGETS = linux.bin linux.bin.gz simpleImage.%
+# With make 3.82 we cannot mix normal and wildcard targets
+BOOT_TARGETS1 = linux.bin linux.bin.gz
+BOOT_TARGETS2 = simpleImage.%
 
 archclean:
         $(Q)$(MAKE) $(clean)=$(boot)
 
-$(BOOT_TARGETS): vmlinux
+$(BOOT_TARGETS1): vmlinux
+        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+$(BOOT_TARGETS2): vmlinux
         $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
 
 define archhelp
diff --git a/arch/mips/jz4740/board-qi_lb60.c b/arch/mips/jz4740/board-qi_lb60.c
index 5742bb4d78f4..5c0a3575877c 100644
--- a/arch/mips/jz4740/board-qi_lb60.c
+++ b/arch/mips/jz4740/board-qi_lb60.c
@@ -5,7 +5,7 @@
  *
  * Copyright (c) 2009 Qi Hardware inc.,
  * Author: Xiangfu Liu <xiangfu@qi-hardware.com>
- * Copyright 2010, Lars-Petrer Clausen <lars@metafoo.de>
+ * Copyright 2010, Lars-Peter Clausen <lars@metafoo.de>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 or later
@@ -235,7 +235,7 @@ static const unsigned int qi_lb60_keypad_rows[] = {
         QI_LB60_GPIO_KEYIN(3),
         QI_LB60_GPIO_KEYIN(4),
         QI_LB60_GPIO_KEYIN(5),
-        QI_LB60_GPIO_KEYIN(7),
+        QI_LB60_GPIO_KEYIN(6),
         QI_LB60_GPIO_KEYIN8,
 };
 
diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
index df971fa0c32f..4896ed090585 100644
--- a/arch/parisc/kernel/firmware.c
+++ b/arch/parisc/kernel/firmware.c
@@ -1126,15 +1126,13 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
         unsigned int i;
         unsigned long flags;
 
-        for (i = 0; i < count && i < 79;) {
+        for (i = 0; i < count;) {
                 switch(str[i]) {
                 case '\n':
                         iodc_dbuf[i+0] = '\r';
                         iodc_dbuf[i+1] = '\n';
                         i += 2;
                         goto print;
-                case '\b':      /* BS */
-                        i--; /* overwrite last */
                 default:
                         iodc_dbuf[i] = str[i];
                         i++;
@@ -1142,15 +1140,6 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
                 }
         }
 
-        /* if we're at the end of line, and not already inserting a newline,
-         * insert one anyway. iodc console doesn't claim to support >79 char
-         * lines. don't account for this in the return value.
-         */
-        if (i == 79 && iodc_dbuf[i-1] != '\n') {
-                iodc_dbuf[i+0] = '\r';
-                iodc_dbuf[i+1] = '\n';
-        }
-
 print:
         spin_lock_irqsave(&pdc_lock, flags);
         real32_call(PAGE0->mem_cons.iodc_io,
diff --git a/arch/powerpc/boot/dts/p1022ds.dts b/arch/powerpc/boot/dts/p1022ds.dts
index 8bcb10b92677..d086e0f8bbd3 100644
--- a/arch/powerpc/boot/dts/p1022ds.dts
+++ b/arch/powerpc/boot/dts/p1022ds.dts
@@ -280,13 +280,13 @@
                         ranges = <0x0 0xc100 0x200>;
                         cell-index = <1>;
                         dma00: dma-channel@0 {
-                                compatible = "fsl,eloplus-dma-channel";
+                                compatible = "fsl,ssi-dma-channel";
                                 reg = <0x0 0x80>;
                                 cell-index = <0>;
                                 interrupts = <76 2>;
                         };
                         dma01: dma-channel@80 {
-                                compatible = "fsl,eloplus-dma-channel";
+                                compatible = "fsl,ssi-dma-channel";
                                 reg = <0x80 0x80>;
                                 cell-index = <1>;
                                 interrupts = <77 2>;
diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S
index 55cba4a8a959..f8cd9fba4d35 100644
--- a/arch/powerpc/kernel/cpu_setup_6xx.S
+++ b/arch/powerpc/kernel/cpu_setup_6xx.S
@@ -18,7 +18,7 @@
 #include <asm/mmu.h>
 
 _GLOBAL(__setup_cpu_603)
-        mflr    r4
+        mflr    r5
 BEGIN_MMU_FTR_SECTION
         li      r10,0
         mtspr   SPRN_SPRG_603_LRU,r10           /* init SW LRU tracking */
@@ -27,60 +27,60 @@ BEGIN_FTR_SECTION
         bl      __init_fpu_registers
 END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE)
         bl      setup_common_caches
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_604)
-        mflr    r4
+        mflr    r5
         bl      setup_common_caches
         bl      setup_604_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750cx)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         bl      setup_750cx
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750fx)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         bl      setup_750fx
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_7400)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_7400_workarounds
         bl      setup_common_caches
         bl      setup_750_7400_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_7410)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_7410_workarounds
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         li      r3,0
         mtspr   SPRN_L2CR2,r3
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_745x)
-        mflr    r4
+        mflr    r5
         bl      setup_common_caches
         bl      setup_745x_specifics
-        mtlr    r4
+        mtlr    r5
         blr
 
 /* Enable caches for 603's, 604, 750 & 7400 */
@@ -194,10 +194,10 @@ setup_750cx:
         cror    4*cr0+eq,4*cr0+eq,4*cr1+eq
         cror    4*cr0+eq,4*cr0+eq,4*cr2+eq
         bnelr
-        lwz     r6,CPU_SPEC_FEATURES(r5)
+        lwz     r6,CPU_SPEC_FEATURES(r4)
         li      r7,CPU_FTR_CAN_NAP
         andc    r6,r6,r7
-        stw     r6,CPU_SPEC_FEATURES(r5)
+        stw     r6,CPU_SPEC_FEATURES(r4)
         blr
 
 /* 750fx specific
@@ -225,12 +225,12 @@ BEGIN_FTR_SECTION
         andis.  r11,r11,L3CR_L3E@h
         beq     1f
 END_FTR_SECTION_IFSET(CPU_FTR_L3CR)
-        lwz     r6,CPU_SPEC_FEATURES(r5)
+        lwz     r6,CPU_SPEC_FEATURES(r4)
         andi.   r0,r6,CPU_FTR_L3_DISABLE_NAP
         beq     1f
         li      r7,CPU_FTR_CAN_NAP
         andc    r6,r6,r7
-        stw     r6,CPU_SPEC_FEATURES(r5)
+        stw     r6,CPU_SPEC_FEATURES(r4)
 1:
         mfspr   r11,SPRN_HID0
 
diff --git a/arch/powerpc/kernel/ppc970-pmu.c b/arch/powerpc/kernel/ppc970-pmu.c
index 8eff48e20dba..3fee685de4df 100644
--- a/arch/powerpc/kernel/ppc970-pmu.c
+++ b/arch/powerpc/kernel/ppc970-pmu.c
@@ -169,9 +169,11 @@ static int p970_marked_instr_event(u64 event)
         switch (unit) {
         case PM_VPU:
                 mask = 0x4c;            /* byte 0 bits 2,3,6 */
+                break;
         case PM_LSU0:
                 /* byte 2 bits 0,2,3,4,6; all of byte 1 */
                 mask = 0x085dff00;
+                break;
         case PM_LSU1L:
                 mask = 0x50 << 24;      /* byte 3 bits 4,6 */
                 break;
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 09dffe6efa46..1eb64ba43a08 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -1122,7 +1122,7 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
         else
 #endif /* CONFIG_PPC_HAS_HASH_64K */
                 rc = __hash_page_4K(ea, access, vsid, ptep, trap, local, ssize,
-                                    subpage_protection(pgdir, ea));
+                                    subpage_protection(mm, ea));
 
         /* Dump some info in case of hash insertion failure, they should
          * never happen so it is really useful to know if/when they do
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 002878ccf90b..1537ab31880b 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -181,7 +181,7 @@ static void unmap_cpu_from_node(unsigned long cpu)
         dbg("removing cpu %lu from node %d\n", cpu, node);
 
         if (cpumask_test_cpu(cpu, node_to_cpumask_map[node])) {
-                cpumask_set_cpu(cpu, node_to_cpumask_map[node]);
+                cpumask_clear_cpu(cpu, node_to_cpumask_map[node]);
         } else {
                 printk(KERN_ERR "WARNING: cpu %lu not found in node %d\n",
                        cpu, node);
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index cf79b46d8f88..568b503d68bd 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -680,6 +680,13 @@ EXPORT_SYMBOL(arch_free_page);
 /* NB: reg/unreg are called while guarded with the tracepoints_mutex */
 extern long hcall_tracepoint_refcount;
 
+/*
+ * Since the tracing code might execute hcalls we need to guard against
+ * recursion. One example of this are spinlocks calling H_YIELD on
+ * shared processor partitions.
+ */
+static DEFINE_PER_CPU(unsigned int, hcall_trace_depth);
+
 void hcall_tracepoint_regfunc(void)
 {
         hcall_tracepoint_refcount++;
@@ -692,12 +699,42 @@ void hcall_tracepoint_unregfunc(void)
 
 void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
 {
+        unsigned long flags;
+        unsigned int *depth;
+
+        local_irq_save(flags);
+
+        depth = &__get_cpu_var(hcall_trace_depth);
+
+        if (*depth)
+                goto out;
+
+        (*depth)++;
         trace_hcall_entry(opcode, args);
+        (*depth)--;
+
+out:
+        local_irq_restore(flags);
 }
 
 void __trace_hcall_exit(long opcode, unsigned long retval,
                         unsigned long *retbuf)
 {
+        unsigned long flags;
+        unsigned int *depth;
+
+        local_irq_save(flags);
+
+        depth = &__get_cpu_var(hcall_trace_depth);
+
+        if (*depth)
+                goto out;
+
+        (*depth)++;
         trace_hcall_exit(opcode, retval, retbuf);
+        (*depth)--;
+
+out:
+        local_irq_restore(flags);
 }
 #endif
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 3017532319c8..b7f02a484e54 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -954,7 +954,6 @@ fsl_rio_dbell_handler(int irq, void *dev_instance)
         if (dsr & DOORBELL_DSR_QFI) {
                 pr_info("RIO: doorbell queue full\n");
                 out_be32(&priv->msg_regs->dsr, DOORBELL_DSR_QFI);
-                goto out;
         }
 
         /* XXX Need to check/dispatch until queue empty */
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index ac151399ef34..1995c1712fc8 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -95,7 +95,6 @@ EXPORT_SYMBOL_GPL(s390_handle_mcck);
 static int notrace s390_revalidate_registers(struct mci *mci)
 {
         int kill_task;
-        u64 tmpclock;
         u64 zero;
         void *fpt_save_area, *fpt_creg_save_area;
 
@@ -214,11 +213,10 @@ static int notrace s390_revalidate_registers(struct mci *mci)
                         : "0", "cc");
 #endif
         /* Revalidate clock comparator register */
-        asm volatile(
-                "       stck    0(%1)\n"
-                "       sckc    0(%1)"
-                : "=m" (tmpclock) : "a" (&(tmpclock)) : "cc", "memory");
-
+        if (S390_lowcore.clock_comparator == -1)
+                set_clock_comparator(S390_lowcore.mcck_clock);
+        else
+                set_clock_comparator(S390_lowcore.clock_comparator);
         /* Check if old PSW is valid */
         if (!mci->wp)
                 /*
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index 3479f1b0d4e0..c1e326cedea5 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -19,6 +19,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/rcupdate.h>
 #include <linux/posix-timers.h>
+#include <linux/cpu.h>
 
 #include <asm/s390_ext.h>
 #include <asm/timer.h>
@@ -565,6 +566,23 @@ void init_cpu_vtimer(void)
         __ctl_set_bit(0,10);
 }
 
+static int __cpuinit s390_nohz_notify(struct notifier_block *self,
+                                      unsigned long action, void *hcpu)
+{
+        struct s390_idle_data *idle;
+        long cpu = (long) hcpu;
+
+        idle = &per_cpu(s390_idle, cpu);
+        switch (action) {
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                idle->nohz_delay = 0;
+        default:
+                break;
+        }
+        return NOTIFY_OK;
+}
+
 void __init vtime_init(void)
 {
         /* request the cpu timer external interrupt */
@@ -573,5 +591,6 @@ void __init vtime_init(void)
 
         /* Enable cpu timer interrupts on the boot cpu. */
         init_cpu_vtimer();
+        cpu_notifier(s390_nohz_notify, 0);
 }
 
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index 752b362bf651..7c37ec359ec2 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -29,17 +29,21 @@ static void __udelay_disabled(unsigned long long usecs)
 {
         unsigned long mask, cr0, cr0_saved;
         u64 clock_saved;
+        u64 end;
 
+        mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
+        end = get_clock() + (usecs << 12);
         clock_saved = local_tick_disable();
-        set_clock_comparator(get_clock() + (usecs << 12));
         __ctl_store(cr0_saved, 0, 0);
         cr0 = (cr0_saved & 0xffff00e0) | 0x00000800;
         __ctl_load(cr0 , 0, 0);
-        mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
         lockdep_off();
-        trace_hardirqs_on();
-        __load_psw_mask(mask);
-        local_irq_disable();
+        do {
+                set_clock_comparator(end);
+                trace_hardirqs_on();
+                __load_psw_mask(mask);
+                local_irq_disable();
+        } while (get_clock() < end);
         lockdep_on();
         __ctl_load(cr0_saved, 0, 0);
         local_tick_enable(clock_saved);
diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h
index b237d525d592..34ba197880dd 100644
--- a/arch/sh/include/asm/io.h
+++ b/arch/sh/include/asm/io.h
@@ -322,7 +322,15 @@ __ioremap_29bit(phys_addr_t offset, unsigned long size, pgprot_t prot)
          * mapping must be done by the PMB or by using page tables.
          */
         if (likely(PXSEG(offset) < P3SEG && PXSEG(last_addr) < P3SEG)) {
-                if (unlikely(pgprot_val(prot) & _PAGE_CACHABLE))
+                u64 flags = pgprot_val(prot);
+
+                /*
+                 * Anything using the legacy PTEA space attributes needs
+                 * to be kicked down to page table mappings.
+                 */
+                if (unlikely(flags & _PAGE_PCC_MASK))
+                        return NULL;
+                if (unlikely(flags & _PAGE_CACHABLE))
                         return (void __iomem *)P1SEGADDR(offset);
 
                 return (void __iomem *)P2SEGADDR(offset);
diff --git a/arch/sh/include/asm/pgtable_32.h b/arch/sh/include/asm/pgtable_32.h
index e172d696e52b..45743bffe865 100644
--- a/arch/sh/include/asm/pgtable_32.h
+++ b/arch/sh/include/asm/pgtable_32.h
@@ -76,6 +76,10 @@
 /* Wrapper for extended mode pgprot twiddling */
 #define _PAGE_EXT(x)            ((unsigned long long)(x) << 32)
 
+#ifdef CONFIG_X2TLB
+#define _PAGE_PCC_MASK  0x00000000      /* No legacy PTEA support */
+#else
+
 /* software: moves to PTEA.TC (Timing Control) */
 #define _PAGE_PCC_AREA5 0x00000000      /* use BSC registers for area5 */
 #define _PAGE_PCC_AREA6 0x80000000      /* use BSC registers for area6 */
@@ -89,7 +93,8 @@
 #define _PAGE_PCC_ATR8  0x60000000      /* Attribute Memory space, 8 bit bus */
 #define _PAGE_PCC_ATR16 0x60000001      /* Attribute Memory space, 6 bit bus */
 
-#ifndef CONFIG_X2TLB
+#define _PAGE_PCC_MASK  0xe0000001
+
 /* copy the ptea attributes */
 static inline unsigned long copy_ptea_attributes(unsigned long x)
 {
diff --git a/arch/sh/include/asm/syscalls_32.h b/arch/sh/include/asm/syscalls_32.h
index be201fdc97aa..ae717e3c26d6 100644
--- a/arch/sh/include/asm/syscalls_32.h
+++ b/arch/sh/include/asm/syscalls_32.h
@@ -19,9 +19,10 @@ asmlinkage int sys_clone(unsigned long clone_flags, unsigned long newsp,
 asmlinkage int sys_vfork(unsigned long r4, unsigned long r5,
                          unsigned long r6, unsigned long r7,
                          struct pt_regs __regs);
-asmlinkage int sys_execve(const char __user *ufilename, char __user * __user *uargv,
-                          char __user * __user *uenvp, unsigned long r7,
-                          struct pt_regs __regs);
+asmlinkage int sys_execve(const char __user *ufilename,
+                          const char __user *const __user *uargv,
+                          const char __user *const __user *uenvp,
+                          unsigned long r7, struct pt_regs __regs);
 asmlinkage int sys_sigsuspend(old_sigset_t mask, unsigned long r5,
                               unsigned long r6, unsigned long r7,
                               struct pt_regs __regs);
diff --git a/arch/sparc/include/asm/openprom.h b/arch/sparc/include/asm/openprom.h
index 963e1a45c35f..f61a5017878f 100644
--- a/arch/sparc/include/asm/openprom.h
+++ b/arch/sparc/include/asm/openprom.h
@@ -37,7 +37,7 @@ struct linux_dev_v2_funcs {
         int (*v2_dev_open)(char *devpath);
         void (*v2_dev_close)(int d);
         int (*v2_dev_read)(int d, char *buf, int nbytes);
-        int (*v2_dev_write)(int d, char *buf, int nbytes);
+        int (*v2_dev_write)(int d, const char *buf, int nbytes);
         int (*v2_dev_seek)(int d, int hi, int lo);
 
         /* Never issued (multistage load support) */
diff --git a/arch/sparc/include/asm/oplib_32.h b/arch/sparc/include/asm/oplib_32.h
index 33e31ce6b31f..618a5bd4660d 100644
--- a/arch/sparc/include/asm/oplib_32.h
+++ b/arch/sparc/include/asm/oplib_32.h
@@ -60,25 +60,6 @@ extern char *prom_getbootargs(void);
 extern char *prom_mapio(char *virt_hint, int io_space, unsigned int phys_addr, unsigned int num_bytes);
 extern void prom_unmapio(char *virt_addr, unsigned int num_bytes);
 
-/* Device operations. */
-
-/* Open the device described by the passed string.  Note, that the format
- * of the string is different on V0 vs. V2->higher proms.  The caller must
- * know what he/she is doing!  Returns the device descriptor, an int.
- */
-extern int prom_devopen(char *device_string);
-
-/* Close a previously opened device described by the passed integer
- * descriptor.
- */
-extern int prom_devclose(int device_handle);
-
-/* Do a seek operation on the device described by the passed integer
- * descriptor.
- */
-extern void prom_seek(int device_handle, unsigned int seek_hival,
-                      unsigned int seek_lowval);
-
 /* Miscellaneous routines, don't really fit in any category per se. */
 
 /* Reboot the machine with the command line passed. */
@@ -121,19 +102,8 @@ extern int prom_getrev(void);
 /* Get the prom firmware revision. */
 extern int prom_getprev(void);
 
-/* Character operations to/from the console.... */
-
-/* Non-blocking get character from console. */
-extern int prom_nbgetchar(void);
-
-/* Non-blocking put character to console. */
-extern int prom_nbputchar(char character);
-
-/* Blocking get character from console. */
-extern char prom_getchar(void);
-
-/* Blocking put character to console. */
-extern void prom_putchar(char character);
+/* Write a buffer of characters to the console. */
+extern void prom_console_write_buf(const char *buf, int len);
 
 /* Prom's internal routines, don't use in kernel/boot code. */
 extern void prom_printf(const char *fmt, ...);
@@ -238,7 +208,6 @@ extern int prom_node_has_property(int node, char *property);
 extern int prom_setprop(int node, const char *prop_name, char *prop_value,
                         int value_size);
 
-extern int prom_pathtoinode(char *path);
 extern int prom_inst2pkg(int);
 
 /* Dorking with Bus ranges... */
diff --git a/arch/sparc/include/asm/oplib_64.h b/arch/sparc/include/asm/oplib_64.h
index 3e0b2d62303d..209463d62626 100644
--- a/arch/sparc/include/asm/oplib_64.h
+++ b/arch/sparc/include/asm/oplib_64.h
@@ -67,27 +67,6 @@ extern void prom_init(void *cif_handler, void *cif_stack);
 /* Boot argument acquisition, returns the boot command line string. */
 extern char *prom_getbootargs(void);
 
-/* Device utilities. */
-
-/* Device operations. */
-
-/* Open the device described by the passed string.  Note, that the format
- * of the string is different on V0 vs. V2->higher proms.  The caller must
- * know what he/she is doing!  Returns the device descriptor, an int.
- */
-extern int prom_devopen(const char *device_string);
-
-/* Close a previously opened device described by the passed integer
- * descriptor.
- */
-extern int prom_devclose(int device_handle);
-
-/* Do a seek operation on the device described by the passed integer
- * descriptor.
- */
-extern void prom_seek(int device_handle, unsigned int seek_hival,
-                      unsigned int seek_lowval);
-
 /* Miscellaneous routines, don't really fit in any category per se. */
 
 /* Reboot the machine with the command line passed. */
@@ -109,33 +88,14 @@ extern void prom_halt(void) __attribute__ ((noreturn));
 /* Halt and power-off the machine. */
 extern void prom_halt_power_off(void) __attribute__ ((noreturn));
 
-/* Set the PROM 'sync' callback function to the passed function pointer.
- * When the user gives the 'sync' command at the prom prompt while the
- * kernel is still active, the prom will call this routine.
- *
- */
-typedef int (*callback_func_t)(long *cmd);
-extern void prom_setcallback(callback_func_t func_ptr);
-
 /* Acquire the IDPROM of the root node in the prom device tree.  This
  * gets passed a buffer where you would like it stuffed.  The return value
  * is the format type of this idprom or 0xff on error.
  */
 extern unsigned char prom_get_idprom(char *idp_buffer, int idpbuf_size);
 
-/* Character operations to/from the console.... */
-
-/* Non-blocking get character from console. */
-extern int prom_nbgetchar(void);
-
-/* Non-blocking put character to console. */
-extern int prom_nbputchar(char character);
-
-/* Blocking get character from console. */
-extern char prom_getchar(void);
-
-/* Blocking put character to console. */
-extern void prom_putchar(char character);
+/* Write a buffer of characters to the console. */
+extern void prom_console_write_buf(const char *buf, int len);
 
 /* Prom's internal routines, don't use in kernel/boot code. */
 extern void prom_printf(const char *fmt, ...);
@@ -278,9 +238,7 @@ extern int prom_finddevice(const char *name);
 extern int prom_setprop(int node, const char *prop_name, char *prop_value,
                         int value_size);
 
-extern int prom_pathtoinode(const char *path);
 extern int prom_inst2pkg(int);
-extern int prom_service_exists(const char *service_name);
 extern void prom_sun4v_guest_soft_state(void);
 
 extern int prom_ihandle2path(int handle, char *buffer, int bufsize);
diff --git a/arch/sparc/kernel/leon_kernel.c b/arch/sparc/kernel/leon_kernel.c
index 6a7b4dbc8e09..dcefd2211552 100644
--- a/arch/sparc/kernel/leon_kernel.c
+++ b/arch/sparc/kernel/leon_kernel.c
@@ -114,7 +114,7 @@ void __init leon_init_timers(irq_handler_t counter_fn)
         if (leon3_gptimer_regs && leon3_irqctrl_regs) {
                 LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].val, 0);
                 LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].rld,
-                                      (((1000000 / 100) - 1)));
+                                      (((1000000 / HZ) - 1)));
                 LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[0].ctrl, 0);
 
 #ifdef CONFIG_SMP
@@ -128,7 +128,7 @@ void __init leon_init_timers(irq_handler_t counter_fn)
                 }
 
                 LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].val, 0);
-                LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].rld, (((1000000/100) - 1)));
+                LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].rld, (((1000000/HZ) - 1)));
                 LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[1].ctrl, 0);
 # endif
 
diff --git a/arch/sparc/prom/Makefile b/arch/sparc/prom/Makefile
index 1b8c073adb44..816c0fa12dc0 100644
--- a/arch/sparc/prom/Makefile
+++ b/arch/sparc/prom/Makefile
@@ -6,7 +6,6 @@ ccflags := -Werror
 
 lib-y                 := bootstr_$(BITS).o
 lib-$(CONFIG_SPARC32) += devmap.o
-lib-y                 += devops_$(BITS).o
 lib-y                 += init_$(BITS).o
 lib-$(CONFIG_SPARC32) += memory.o
 lib-y                 += misc_$(BITS).o
diff --git a/arch/sparc/prom/console_32.c b/arch/sparc/prom/console_32.c
index 5340264b78f5..48863108a44c 100644
--- a/arch/sparc/prom/console_32.c
+++ b/arch/sparc/prom/console_32.c
@@ -16,63 +16,26 @@
 
 extern void restore_current(void);
 
-/* Non blocking get character from console input device, returns -1
- * if no input was taken.  This can be used for polling.
- */
-int
-prom_nbgetchar(void)
-{
-        static char inc;
-        int i = -1;
-        unsigned long flags;
-
-        spin_lock_irqsave(&prom_lock, flags);
-        switch(prom_vers) {
-        case PROM_V0:
-                i = (*(romvec->pv_nbgetchar))();
-                break;
-        case PROM_V2:
-        case PROM_V3:
-                if( (*(romvec->pv_v2devops).v2_dev_read)(*romvec->pv_v2bootargs.fd_stdin , &inc, 0x1) == 1) {
-                        i = inc;
-                } else {
-                        i = -1;
-                }
-                break;
-        default:
-                i = -1;
-                break;
-        };
-        restore_current();
-        spin_unlock_irqrestore(&prom_lock, flags);
-        return i; /* Ugh, we could spin forever on unsupported proms ;( */
-}
-
 /* Non blocking put character to console device, returns -1 if
  * unsuccessful.
  */
-int
-prom_nbputchar(char c)
+static int prom_nbputchar(const char *buf)
 {
-        static char outc;
         unsigned long flags;
         int i = -1;
 
         spin_lock_irqsave(&prom_lock, flags);
         switch(prom_vers) {
         case PROM_V0:
-                i = (*(romvec->pv_nbputchar))(c);
+                i = (*(romvec->pv_nbputchar))(*buf);
                 break;
         case PROM_V2:
         case PROM_V3:
-                outc = c;
-                if( (*(romvec->pv_v2devops).v2_dev_write)(*romvec->pv_v2bootargs.fd_stdout, &outc, 0x1) == 1)
+                if ((*(romvec->pv_v2devops).v2_dev_write)(*romvec->pv_v2bootargs.fd_stdout,
+                                                          buf, 0x1) == 1)
                         i = 0;
-                else
-                        i = -1;
                 break;
         default:
-                i = -1;
                 break;
         };
         restore_current();
@@ -80,18 +43,14 @@ prom_nbputchar(char c)
         return i; /* Ugh, we could spin forever on unsupported proms ;( */
 }
 
-/* Blocking version of get character routine above. */
-char
-prom_getchar(void)
+void prom_console_write_buf(const char *buf, int len)
 {
-        int character;
-        while((character = prom_nbgetchar()) == -1) ;
-        return (char) character;
+        while (len) {
+                int n = prom_nbputchar(buf);
+                if (n)
+                        continue;
+                len--;
+                buf++;
+        }
 }
 
-/* Blocking version of put character routine above. */
-void
-prom_putchar(char c)
-{
-        while(prom_nbputchar(c) == -1) ;
-}
diff --git a/arch/sparc/prom/console_64.c b/arch/sparc/prom/console_64.c
index 10322dc2f557..ed39e75828bd 100644
--- a/arch/sparc/prom/console_64.c
+++ b/arch/sparc/prom/console_64.c
@@ -15,85 +15,34 @@
 
 extern int prom_stdin, prom_stdout;
 
-/* Non blocking get character from console input device, returns -1
- * if no input was taken.  This can be used for polling.
- */
-inline int
-prom_nbgetchar(void)
-{
-        unsigned long args[7];
-        char inc;
-
-        args[0] = (unsigned long) "read";
-        args[1] = 3;
-        args[2] = 1;
-        args[3] = (unsigned int) prom_stdin;
-        args[4] = (unsigned long) &inc;
-        args[5] = 1;
-        args[6] = (unsigned long) -1;
-
-        p1275_cmd_direct(args);
-
-        if (args[6] == 1)
-                return inc;
-        return -1;
-}
-
-/* Non blocking put character to console device, returns -1 if
- * unsuccessful.
- */
-inline int
-prom_nbputchar(char c)
+static int __prom_console_write_buf(const char *buf, int len)
 {
         unsigned long args[7];
-        char outc;
-        
-        outc = c;
+        int ret;
 
         args[0] = (unsigned long) "write";
         args[1] = 3;
         args[2] = 1;
         args[3] = (unsigned int) prom_stdout;
-        args[4] = (unsigned long) &outc;
-        args[5] = 1;
+        args[4] = (unsigned long) buf;
+        args[5] = (unsigned int) len;
         args[6] = (unsigned long) -1;
 
         p1275_cmd_direct(args);
 
-        if (args[6] == 1)
-                return 0;
-        else
+        ret = (int) args[6];
+        if (ret < 0)
                 return -1;
+        return ret;
 }
 
-/* Blocking version of get character routine above. */
-char
-prom_getchar(void)
-{
-        int character;
-        while((character = prom_nbgetchar()) == -1) ;
-        return (char) character;
-}
-
-/* Blocking version of put character routine above. */
-void
-prom_putchar(char c)
+void prom_console_write_buf(const char *buf, int len)
 {
-        prom_nbputchar(c);
-}
-
-void
-prom_puts(const char *s, int len)
-{
-        unsigned long args[7];
-
-        args[0] = (unsigned long) "write";
-        args[1] = 3;
-        args[2] = 1;
-        args[3] = (unsigned int) prom_stdout;
-        args[4] = (unsigned long) s;
-        args[5] = len;
-        args[6] = (unsigned long) -1;
-
-        p1275_cmd_direct(args);
+        while (len) {
+                int n = __prom_console_write_buf(buf, len);
+                if (n < 0)
+                        continue;
+                len -= n;
+                buf += len;
+        }
 }
diff --git a/arch/sparc/prom/misc_64.c b/arch/sparc/prom/misc_64.c
index 6cb1581d6aef..2fdcebf9a5df 100644
--- a/arch/sparc/prom/misc_64.c
+++ b/arch/sparc/prom/misc_64.c
@@ -18,7 +18,7 @@
 #include <asm/system.h>
 #include <asm/ldc.h>
 
-int prom_service_exists(const char *service_name)
+static int prom_service_exists(const char *service_name)
 {
         unsigned long args[5];
 
@@ -150,20 +150,6 @@ void prom_halt_power_off(void)
         prom_halt();
 }
 
-/* Set prom sync handler to call function 'funcp'. */
-void prom_setcallback(callback_func_t funcp)
-{
-        unsigned long args[5];
-        if (!funcp)
-                return;
-        args[0] = (unsigned long) "set-callback";
-        args[1] = 1;
-        args[2] = 1;
-        args[3] = (unsigned long) funcp;
-        args[4] = (unsigned long) -1;
-        p1275_cmd_direct(args);
-}
-
 /* Get the idprom and stuff it into buffer 'idbuf'.  Returns the
  * format type.  'num_bytes' is the number of bytes that your idbuf
  * has space for.  Returns 0xff on error.
diff --git a/arch/sparc/prom/printf.c b/arch/sparc/prom/printf.c
index ca869266b9f3..d9682f06b3b0 100644
--- a/arch/sparc/prom/printf.c
+++ b/arch/sparc/prom/printf.c
@@ -15,22 +15,45 @@
 
 #include <linux/kernel.h>
 #include <linux/compiler.h>
+#include <linux/spinlock.h>
 
 #include <asm/openprom.h>
 #include <asm/oplib.h>
 
+#define CONSOLE_WRITE_BUF_SIZE  1024
+
 static char ppbuf[1024];
+static char console_write_buf[CONSOLE_WRITE_BUF_SIZE];
+static DEFINE_RAW_SPINLOCK(console_write_lock);
 
 void notrace prom_write(const char *buf, unsigned int n)
 {
-        char ch;
+        unsigned int dest_len;
+        unsigned long flags;
+        char *dest;
+
+        dest = console_write_buf;
+        raw_spin_lock_irqsave(&console_write_lock, flags);
 
-        while (n != 0) {
-                --n;
-                if ((ch = *buf++) == '\n')
-                        prom_putchar('\r');
-                prom_putchar(ch);
+        dest_len = 0;
+        while (n-- != 0) {
+                char ch = *buf++;
+                if (ch == '\n') {
+                        *dest++ = '\r';
+                        dest_len++;
+                }
+                *dest++ = ch;
+                dest_len++;
+                if (dest_len >= CONSOLE_WRITE_BUF_SIZE - 1) {
+                        prom_console_write_buf(console_write_buf, dest_len);
+                        dest = console_write_buf;
+                        dest_len = 0;
+                }
         }
+        if (dest_len)
+                prom_console_write_buf(console_write_buf, dest_len);
+
+        raw_spin_unlock_irqrestore(&console_write_lock, flags);
 }
 
 void notrace prom_printf(const char *fmt, ...)
diff --git a/arch/sparc/prom/tree_32.c b/arch/sparc/prom/tree_32.c
index b21592f8e3fe..71e7f080a576 100644
--- a/arch/sparc/prom/tree_32.c
+++ b/arch/sparc/prom/tree_32.c
@@ -341,18 +341,3 @@ int prom_inst2pkg(int inst)
         if (node == -1) return 0;
         return node;
 }
-
-/* Return 'node' assigned to a particular prom 'path'
- * FIXME: Should work for v0 as well
- */
-int prom_pathtoinode(char *path)
-{
-        int node, inst;
-        
-        inst = prom_devopen (path);
-        if (inst == -1) return 0;
-        node = prom_inst2pkg (inst);
-        prom_devclose (inst);
-        if (node == -1) return 0;
-        return node;
-}
diff --git a/arch/sparc/prom/tree_64.c b/arch/sparc/prom/tree_64.c
index 9d3f9137a43a..8327b1b68f4b 100644
--- a/arch/sparc/prom/tree_64.c
+++ b/arch/sparc/prom/tree_64.c
@@ -374,24 +374,6 @@ inline int prom_inst2pkg(int inst)
         return node;
 }
 
-/* Return 'node' assigned to a particular prom 'path'
- * FIXME: Should work for v0 as well
- */
-int
-prom_pathtoinode(const char *path)
-{
-        int node, inst;
-
-        inst = prom_devopen (path);
-        if (inst == 0)
-                return 0;
-        node = prom_inst2pkg(inst);
-        prom_devclose(inst);
-        if (node == -1)
-                return 0;
-        return node;
-}
-
 int prom_ihandle2path(int handle, char *buffer, int bufsize)
 {
         unsigned long args[7];
diff --git a/arch/tile/kernel/process.c b/arch/tile/kernel/process.c
index 84c29111756c..aaf6282bacc3 100644
--- a/arch/tile/kernel/process.c
+++ b/arch/tile/kernel/process.c
@@ -212,6 +212,13 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
         childregs->sp = sp;  /* override with new user stack pointer */
 
         /*
+         * If CLONE_SETTLS is set, set "tp" in the new task to "r4",
+         * which is passed in as arg #5 to sys_clone().
+         */
+        if (clone_flags & CLONE_SETTLS)
+                childregs->tp = regs->regs[4];
+
+        /*
          * Copy the callee-saved registers from the passed pt_regs struct
          * into the context-switch callee-saved registers area.
          * We have to restore the callee-saved registers since we may
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 7f7338c90784..1664cce7b0ac 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -727,6 +727,9 @@ struct winch {
 
 static void free_winch(struct winch *winch, int free_irq_ok)
 {
+        if (free_irq_ok)
+                free_irq(WINCH_IRQ, winch);
+
         list_del(&winch->list);
 
         if (winch->pid != -1)
@@ -735,8 +738,6 @@ static void free_winch(struct winch *winch, int free_irq_ok)
                 os_close_file(winch->fd);
         if (winch->stack != 0)
                 free_stack(winch->stack, 0);
-        if (free_irq_ok)
-                free_irq(WINCH_IRQ, winch);
         kfree(winch);
 }
 
diff --git a/arch/um/kernel/uml.lds.S b/arch/um/kernel/uml.lds.S
index ec6378550671..9a873d765615 100644
--- a/arch/um/kernel/uml.lds.S
+++ b/arch/um/kernel/uml.lds.S
@@ -22,7 +22,7 @@ SECTIONS
   _text = .;
   _stext = .;
   __init_begin = .;
-  INIT_TEXT_SECTION(PAGE_SIZE)
+  INIT_TEXT_SECTION(0)
   . = ALIGN(PAGE_SIZE);
 
   .text      :
diff --git a/arch/um/os-Linux/time.c b/arch/um/os-Linux/time.c
index dec5678fc17f..6e3359d6a839 100644
--- a/arch/um/os-Linux/time.c
+++ b/arch/um/os-Linux/time.c
@@ -60,7 +60,7 @@ static inline long long timeval_to_ns(const struct timeval *tv)
 long long disable_timer(void)
 {
         struct itimerval time = ((struct itimerval) { { 0, 0 }, { 0, 0 } });
-        int remain, max = UM_NSEC_PER_SEC / UM_HZ;
+        long long remain, max = UM_NSEC_PER_SEC / UM_HZ;
 
         if (setitimer(ITIMER_VIRTUAL, &time, &time) < 0)
                 printk(UM_KERN_ERR "disable_timer - setitimer failed, "
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 3f76523589af..f857bd39cdfb 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -152,7 +152,7 @@
 #define X86_FEATURE_3DNOWPREFETCH (6*32+ 8) /* 3DNow prefetch instructions */
 #define X86_FEATURE_OSVW        (6*32+ 9) /* OS Visible Workaround */
 #define X86_FEATURE_IBS         (6*32+10) /* Instruction Based Sampling */
-#define X86_FEATURE_SSE5        (6*32+11) /* SSE-5 */
+#define X86_FEATURE_XOP         (6*32+11) /* extended AVX instructions */
 #define X86_FEATURE_SKINIT      (6*32+12) /* SKINIT/STGI instructions */
 #define X86_FEATURE_WDT         (6*32+13) /* Watchdog timer */
 #define X86_FEATURE_NODEID_MSR  (6*32+19) /* NodeId MSR */
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 30a3e9776123..6a45ec41ec26 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -206,6 +206,7 @@ static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
 
 extern void iounmap(volatile void __iomem *addr);
 
+extern void set_iounmap_nonlazy(void);
 
 #ifdef __KERNEL__
 
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index c52e2eb40a1e..6986312bb670 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -79,7 +79,7 @@
 #define KVM_NUM_MMU_PAGES (1 << KVM_MMU_HASH_SHIFT)
 #define KVM_MIN_FREE_MMU_PAGES 5
 #define KVM_REFILL_PAGES 25
-#define KVM_MAX_CPUID_ENTRIES 40
+#define KVM_MAX_CPUID_ENTRIES 80
 #define KVM_NR_FIXED_MTRR_REGION 88
 #define KVM_NR_VAR_MTRR 8
 
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 4a2d4e0c18d9..8b5393ec1080 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -36,8 +36,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
         unsigned cpu = smp_processor_id();
 
         if (likely(prev != next)) {
-                /* stop flush ipis for the previous mm */
-                cpumask_clear_cpu(cpu, mm_cpumask(prev));
 #ifdef CONFIG_SMP
                 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
                 percpu_write(cpu_tlbstate.active_mm, next);
@@ -47,6 +45,9 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                 /* Re-load page tables */
                 load_cr3(next->pgd);
 
+                /* stop flush ipis for the previous mm */
+                cpumask_clear_cpu(cpu, mm_cpumask(prev));
+
                 /*
                  * load the LDT, if the LDT is different:
                  */
diff --git a/arch/x86/include/asm/mrst.h b/arch/x86/include/asm/mrst.h
index 16350740edf6..33fc2966beb7 100644
--- a/arch/x86/include/asm/mrst.h
+++ b/arch/x86/include/asm/mrst.h
@@ -26,7 +26,7 @@ enum mrst_cpu_type {
 };
 
 extern enum mrst_cpu_type __mrst_cpu_chip;
-static enum mrst_cpu_type mrst_identify_cpu(void)
+static inline enum mrst_cpu_type mrst_identify_cpu(void)
 {
         return __mrst_cpu_chip;
 }
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index ebaa04a8d3af..37ea41c63b49 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -768,29 +768,6 @@ extern unsigned long		idle_halt;
 extern unsigned long            idle_nomwait;
 extern bool                     c1e_detected;
 
-/*
- * on systems with caches, caches must be flashed as the absolute
- * last instruction before going into a suspended halt.  Otherwise,
- * dirty data can linger in the cache and become stale on resume,
- * leading to strange errors.
- *
- * perform a variety of operations to guarantee that the compiler
- * will not reorder instructions.  wbinvd itself is serializing
- * so the processor will not reorder.
- *
- * Systems without cache can just go into halt.
- */
-static inline void wbinvd_halt(void)
-{
-        mb();
-        /* check for clflush to determine if wbinvd is legal */
-        if (cpu_has_clflush)
-                asm volatile("cli; wbinvd; 1: hlt; jmp 1b" : : : "memory");
-        else
-                while (1)
-                        halt();
-}
-
 extern void enable_sep_cpu(void);
 extern int sysenter_setup(void);
 
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 4cfc90824068..4c2f63c7fc1b 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -50,7 +50,7 @@ struct smp_ops {
         void (*smp_prepare_cpus)(unsigned max_cpus);
         void (*smp_cpus_done)(unsigned max_cpus);
 
-        void (*smp_send_stop)(void);
+        void (*stop_other_cpus)(int wait);
         void (*smp_send_reschedule)(int cpu);
 
         int (*cpu_up)(unsigned cpu);
@@ -73,7 +73,12 @@ extern struct smp_ops smp_ops;
 
 static inline void smp_send_stop(void)
 {
-        smp_ops.smp_send_stop();
+        smp_ops.stop_other_cpus(0);
+}
+
+static inline void stop_other_cpus(void)
+{
+        smp_ops.stop_other_cpus(1);
 }
 
 static inline void smp_prepare_boot_cpu(void)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index e3b534cda49a..e0f220e158c1 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1340,6 +1340,14 @@ void __cpuinit end_local_APIC_setup(void)
 
         setup_apic_nmi_watchdog(NULL);
         apic_pm_activate();
+
+        /*
+         * Now that local APIC setup is completed for BP, configure the fault
+         * handling for interrupt remapping.
+         */
+        if (!smp_processor_id() && intr_remapping_enabled)
+                enable_drhd_fault_handling();
+
 }
 
 #ifdef CONFIG_X86_X2APIC
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 5c5b8f3dddb5..4d90327853b7 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1397,6 +1397,7 @@ int setup_ioapic_entry(int apic_id, int irq,
                 irte.dlvry_mode = apic->irq_delivery_mode;
                 irte.vector = vector;
                 irte.dest_id = IRTE_DEST(destination);
+                irte.redir_hint = 1;
 
                 /* Set source-id of interrupt request */
                 set_ioapic_sid(&irte, apic_id);
@@ -3348,6 +3349,7 @@ static int msi_compose_msg(struct pci_dev *pdev, unsigned int irq,
                 irte.dlvry_mode = apic->irq_delivery_mode;
                 irte.vector = cfg->vector;
                 irte.dest_id = IRTE_DEST(dest);
+                irte.redir_hint = 1;
 
                 /* Set source-id of interrupt request */
                 if (pdev)
@@ -3624,6 +3626,7 @@ static int dmar_msi_set_affinity(unsigned int irq, const struct cpumask *mask)
         msg.data |= MSI_DATA_VECTOR(cfg->vector);
         msg.address_lo &= ~MSI_ADDR_DEST_ID_MASK;
         msg.address_lo |= MSI_ADDR_DEST_ID(dest);
+        msg.address_hi = MSI_ADDR_BASE_HI | MSI_ADDR_EXT_DEST_ID(dest);
 
         dmar_msi_write(irq, &msg);
 
diff --git a/arch/x86/kernel/apic/probe_64.c b/arch/x86/kernel/apic/probe_64.c
index 83e9be4778e2..fac49a845064 100644
--- a/arch/x86/kernel/apic/probe_64.c
+++ b/arch/x86/kernel/apic/probe_64.c
@@ -76,13 +76,6 @@ void __init default_setup_apic_routing(void)
                 /* need to update phys_pkg_id */
                 apic->phys_pkg_id = apicid_phys_pkg_id;
         }
-
-        /*
-         * Now that apic routing model is selected, configure the
-         * fault handling for intr remapping.
-         */
-        if (intr_remapping_enabled)
-                enable_drhd_fault_handling();
 }
 
 /* Same for both flat and physical. */
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index ba5f62f45f01..81fa3cb12f39 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -305,8 +305,7 @@ static void __cpuinit amd_detect_cmp(struct cpuinfo_x86 *c)
         /* use socket ID also for last level cache */
         per_cpu(cpu_llc_id, cpu) = c->phys_proc_id;
         /* fixup topology information on multi-node processors */
-        if ((c->x86 == 0x10) && (c->x86_model == 9))
-                amd_fixup_dcm(c);
+        amd_fixup_dcm(c);
 #endif
 }
 
diff --git a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
index cd8da247dda1..a2baafb2fe6d 100644
--- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -701,6 +701,7 @@ static int acpi_cpufreq_cpu_exit(struct cpufreq_policy *policy)
                 per_cpu(acfreq_data, policy->cpu) = NULL;
                 acpi_processor_unregister_performance(data->acpi_data,
                                                       policy->cpu);
+                kfree(data->freq_table);
                 kfree(data);
         }
 
diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
index c5f59d071425..ac140c7be396 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -827,7 +827,7 @@ int __init amd_special_default_mtrr(void)
 
         if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
                 return 0;
-        if (boot_cpu_data.x86 < 0xf || boot_cpu_data.x86 > 0x11)
+        if (boot_cpu_data.x86 < 0xf)
                 return 0;
         /* In case some hypervisor doesn't pass SYSCFG through: */
         if (rdmsr_safe(MSR_K8_SYSCFG, &l, &h) < 0)
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 01c0f3ee6cc3..bebabec5b448 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -793,13 +793,21 @@ void set_mtrr_aps_delayed_init(void)
 }
 
 /*
- * MTRR initialization for all AP's
+ * Delayed MTRR initialization for all AP's
  */
 void mtrr_aps_init(void)
 {
         if (!use_intel())
                 return;
 
+        /*
+         * Check if someone has requested the delay of AP MTRR initialization,
+         * by doing set_mtrr_aps_delayed_init(), prior to this point. If not,
+         * then we are done.
+         */
+        if (!mtrr_aps_delayed_init)
+                return;
+
         set_mtrr(~0U, 0, 0, 0);
         mtrr_aps_delayed_init = false;
 }
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index c2897b7b4a3b..46d58448c3af 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -52,7 +52,7 @@ static __initconst const u64 amd_hw_cache_event_ids
  [ C(DTLB) ] = {
         [ C(OP_READ) ] = {
                 [ C(RESULT_ACCESS) ] = 0x0040, /* Data Cache Accesses        */
-                [ C(RESULT_MISS)   ] = 0x0046, /* L1 DTLB and L2 DLTB Miss   */
+                [ C(RESULT_MISS)   ] = 0x0746, /* L1_DTLB_AND_L2_DLTB_MISS.ALL */
         },
         [ C(OP_WRITE) ] = {
                 [ C(RESULT_ACCESS) ] = 0,
@@ -66,7 +66,7 @@ static __initconst const u64 amd_hw_cache_event_ids
  [ C(ITLB) ] = {
         [ C(OP_READ) ] = {
                 [ C(RESULT_ACCESS) ] = 0x0080, /* Instruction fecthes        */
-                [ C(RESULT_MISS)   ] = 0x0085, /* Instr. fetch ITLB misses   */
+                [ C(RESULT_MISS)   ] = 0x0385, /* L1_ITLB_AND_L2_ITLB_MISS.ALL */
         },
         [ C(OP_WRITE) ] = {
                 [ C(RESULT_ACCESS) ] = -1,
diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c
index 045b36cada65..994828899e09 100644
--- a/arch/x86/kernel/crash_dump_64.c
+++ b/arch/x86/kernel/crash_dump_64.c
@@ -34,7 +34,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
         if (!csize)
                 return 0;
 
-        vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
+        vaddr = ioremap_cache(pfn << PAGE_SHIFT, PAGE_SIZE);
         if (!vaddr)
                 return -ENOMEM;
 
@@ -46,6 +46,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
         } else
                 memcpy(buf, vaddr + offset, csize);
 
+        set_iounmap_nonlazy();
         iounmap(vaddr);
         return csize;
 }
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index ff15c9dcc25d..42c594254507 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -433,6 +433,10 @@ static int __kprobes hw_breakpoint_handler(struct die_args *args)
         dr6_p = (unsigned long *)ERR_PTR(args->err);
         dr6 = *dr6_p;
 
+        /* If it's a single step, TRAP bits are random */
+        if (dr6 & DR_STEP)
+                return NOTIFY_DONE;
+
         /* Do an early return if no trap bits are set in DR6 */
         if ((dr6 & DR_TRAP_BITS) == 0)
                 return NOTIFY_DONE;
diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
index 356170262a93..2573689bda77 100644
--- a/arch/x86/kernel/microcode_intel.c
+++ b/arch/x86/kernel/microcode_intel.c
@@ -364,8 +364,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
 
                 /* For performance reasons, reuse mc area when possible */
                 if (!mc || mc_size > curr_mc_size) {
-                        if (mc)
-                                vfree(mc);
+                        vfree(mc);
                         mc = vmalloc(mc_size);
                         if (!mc)
                                 break;
@@ -374,13 +373,11 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
 
                 if (get_ucode_data(mc, ucode_ptr, mc_size) ||
                     microcode_sanity_check(mc) < 0) {
-                        vfree(mc);
                         break;
                 }
 
                 if (get_matching_microcode(&uci->cpu_sig, mc, new_rev)) {
-                        if (new_mc)
-                                vfree(new_mc);
+                        vfree(new_mc);
                         new_rev = mc_header.rev;
                         new_mc  = mc;
                         mc = NULL;      /* trigger new vmalloc */
@@ -390,12 +387,10 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
                 leftover  -= mc_size;
         }
 
-        if (mc)
-                vfree(mc);
+        vfree(mc);
 
         if (leftover) {
-                if (new_mc)
-                        vfree(new_mc);
+                vfree(new_mc);
                 state = UCODE_ERROR;
                 goto out;
         }
@@ -405,8 +400,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
                 goto out;
         }
 
-        if (uci->mc)
-                vfree(uci->mc);
+        vfree(uci->mc);
         uci->mc = (struct microcode_intel *)new_mc;
 
         pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n",
diff --git a/arch/x86/kernel/olpc.c b/arch/x86/kernel/olpc.c
index 0e0cdde519be..a2bd899b2b83 100644
--- a/arch/x86/kernel/olpc.c
+++ b/arch/x86/kernel/olpc.c
@@ -114,6 +114,7 @@ int olpc_ec_cmd(unsigned char cmd, unsigned char *inbuf, size_t inlen,
         unsigned long flags;
         int ret = -EIO;
         int i;
+        int restarts = 0;
 
         spin_lock_irqsave(&ec_lock, flags);
 
@@ -169,7 +170,9 @@ restart:
                         if (wait_on_obf(0x6c, 1)) {
                                 printk(KERN_ERR "olpc-ec:  timeout waiting for"
                                                 " EC to provide data!\n");
-                                goto restart;
+                                if (restarts++ < 10)
+                                        goto restart;
+                                goto err;
                         }
                         outbuf[i] = inb(0x68);
                         pr_devel("olpc-ec:  received 0x%x\n", outbuf[i]);
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index e3af342fe83a..76a0d715a031 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -641,7 +641,7 @@ void native_machine_shutdown(void)
         /* O.K Now that I'm on the appropriate processor,
          * stop all of the others.
          */
-        smp_send_stop();
+        stop_other_cpus();
 #endif
 
         lapic_shutdown();
diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
index 74cca6014c0e..96af3a8e7326 100644
--- a/arch/x86/kernel/smp.c
+++ b/arch/x86/kernel/smp.c
@@ -174,10 +174,10 @@ asmlinkage void smp_reboot_interrupt(void)
         irq_exit();
 }
 
-static void native_smp_send_stop(void)
+static void native_stop_other_cpus(int wait)
 {
         unsigned long flags;
-        unsigned long wait;
+        unsigned long timeout;
 
         if (reboot_force)
                 return;
@@ -194,9 +194,12 @@ static void native_smp_send_stop(void)
         if (num_online_cpus() > 1) {
                 apic->send_IPI_allbutself(REBOOT_VECTOR);
 
-                /* Don't wait longer than a second */
-                wait = USEC_PER_SEC;
-                while (num_online_cpus() > 1 && wait--)
+                /*
+                 * Don't wait longer than a second if the caller
+                 * didn't ask us to wait.
+                 */
+                timeout = USEC_PER_SEC;
+                while (num_online_cpus() > 1 && (wait || timeout--))
                         udelay(1);
         }
 
@@ -254,7 +257,7 @@ struct smp_ops smp_ops = {
         .smp_prepare_cpus       = native_smp_prepare_cpus,
         .smp_cpus_done          = native_smp_cpus_done,
 
-        .smp_send_stop          = native_smp_send_stop,
+        .stop_other_cpus        = native_stop_other_cpus,
         .smp_send_reschedule    = native_smp_send_reschedule,
 
         .cpu_up                 = native_cpu_up,
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 8b3bfc4dd708..016179e5ba09 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1383,11 +1383,94 @@ void play_dead_common(void)
         local_irq_disable();
 }
 
+#define MWAIT_SUBSTATE_MASK             0xf
+#define MWAIT_SUBSTATE_SIZE             4
+
+#define CPUID_MWAIT_LEAF                5
+#define CPUID5_ECX_EXTENSIONS_SUPPORTED 0x1
+
+/*
+ * We need to flush the caches before going to sleep, lest we have
+ * dirty data in our caches when we come back up.
+ */
+static inline void mwait_play_dead(void)
+{
+        unsigned int eax, ebx, ecx, edx;
+        unsigned int highest_cstate = 0;
+        unsigned int highest_subcstate = 0;
+        int i;
+        void *mwait_ptr;
+
+        if (!cpu_has(&current_cpu_data, X86_FEATURE_MWAIT))
+                return;
+        if (!cpu_has(&current_cpu_data, X86_FEATURE_CLFLSH))
+                return;
+        if (current_cpu_data.cpuid_level < CPUID_MWAIT_LEAF)
+                return;
+
+        eax = CPUID_MWAIT_LEAF;
+        ecx = 0;
+        native_cpuid(&eax, &ebx, &ecx, &edx);
+
+        /*
+         * eax will be 0 if EDX enumeration is not valid.
+         * Initialized below to cstate, sub_cstate value when EDX is valid.
+         */
+        if (!(ecx & CPUID5_ECX_EXTENSIONS_SUPPORTED)) {
+                eax = 0;
+        } else {
+                edx >>= MWAIT_SUBSTATE_SIZE;
+                for (i = 0; i < 7 && edx; i++, edx >>= MWAIT_SUBSTATE_SIZE) {
+                        if (edx & MWAIT_SUBSTATE_MASK) {
+                                highest_cstate = i;
+                                highest_subcstate = edx & MWAIT_SUBSTATE_MASK;
+                        }
+                }
+                eax = (highest_cstate << MWAIT_SUBSTATE_SIZE) |
+                        (highest_subcstate - 1);
+        }
+
+        /*
+         * This should be a memory location in a cache line which is
+         * unlikely to be touched by other processors.  The actual
+         * content is immaterial as it is not actually modified in any way.
+         */
+        mwait_ptr = &current_thread_info()->flags;
+
+        wbinvd();
+
+        while (1) {
+                /*
+                 * The CLFLUSH is a workaround for erratum AAI65 for
+                 * the Xeon 7400 series.  It's not clear it is actually
+                 * needed, but it should be harmless in either case.
+                 * The WBINVD is insufficient due to the spurious-wakeup
+                 * case where we return around the loop.
+                 */
+                clflush(mwait_ptr);
+                __monitor(mwait_ptr, 0, 0);
+                mb();
+                __mwait(eax, 0);
+        }
+}
+
+static inline void hlt_play_dead(void)
+{
+        if (current_cpu_data.x86 >= 4)
+                wbinvd();
+
+        while (1) {
+                native_halt();
+        }
+}
+
 void native_play_dead(void)
 {
         play_dead_common();
         tboot_shutdown(TB_SHUTDOWN_WFS);
-        wbinvd_halt();
+
+        mwait_play_dead();      /* Only returns on failure */
+        hlt_play_dead();
 }
 
 #else /* ... !CONFIG_HOTPLUG_CPU */
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 60788dee0f8a..9f4edeb21323 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -575,6 +575,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
         if (regs->flags & X86_VM_MASK) {
                 handle_vm86_trap((struct kernel_vm86_regs *) regs,
                                 error_code, 1);
+                preempt_conditional_cli(regs);
                 return;
         }
 
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index 5ffb5622f793..61fb98519622 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -551,8 +551,14 @@ cannot_handle:
 int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
 {
         if (VMPI.is_vm86pus) {
-                if ((trapno == 3) || (trapno == 1))
-                        return_to_32bit(regs, VM86_TRAP + (trapno << 8));
+                if ((trapno == 3) || (trapno == 1)) {
+                        KVM86->regs32->ax = VM86_TRAP + (trapno << 8);
+                        /* setting this flag forces the code in entry_32.S to
+                           call save_v86_state() and change the stack pointer
+                           to KVM86->regs32 */
+                        set_thread_flag(TIF_IRET);
+                        return 0;
+                }
                 do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
                 return 0;
         }
diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
index 9c253bd65e24..547128546cc3 100644
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -394,7 +394,8 @@ static void __init setup_xstate_init(void)
          * Setup init_xstate_buf to represent the init state of
          * all the features managed by the xsave
          */
-        init_xstate_buf = alloc_bootmem(xstate_size);
+        init_xstate_buf = alloc_bootmem_align(xstate_size,
+                                              __alignof__(struct xsave_struct));
         init_xstate_buf->i387.mxcsr = MXCSR_DEFAULT;
 
         clts();
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index 4b7b73ce2098..9f163e61283c 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -570,6 +570,8 @@ struct kvm_pic *kvm_create_pic(struct kvm *kvm)
         s->pics[1].elcr_mask = 0xde;
         s->pics[0].pics_state = s;
         s->pics[1].pics_state = s;
+        s->pics[0].isr_ack = 0xff;
+        s->pics[1].isr_ack = 0xff;
 
         /*
          * Initialize PIO device
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 311f6dad8951..7fed5b793faf 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2254,6 +2254,10 @@ static int mmu_alloc_roots(struct kvm_vcpu *vcpu)
                 return 0;
         }
         direct = !is_paging(vcpu);
+
+        if (mmu_check_root(vcpu, root_gfn))
+                return 1;
+
         for (i = 0; i < 4; ++i) {
                 hpa_t root = vcpu->arch.mmu.pae_root[i];
 
@@ -2265,13 +2269,13 @@ static int mmu_alloc_roots(struct kvm_vcpu *vcpu)
                                 continue;
                         }
                         root_gfn = pdptr >> PAGE_SHIFT;
+                        if (mmu_check_root(vcpu, root_gfn))
+                                return 1;
                 } else if (vcpu->arch.mmu.root_level == 0)
                         root_gfn = 0;
-                if (mmu_check_root(vcpu, root_gfn))
-                        return 1;
                 if (tdp_enabled) {
                         direct = 1;
-                        root_gfn = i << 30;
+                        root_gfn = i << (30 - PAGE_SHIFT);
                 }
                 spin_lock(&vcpu->kvm->mmu_lock);
                 kvm_mmu_free_some_pages(vcpu);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 8a3f9f64f86f..e7c3f3bd08fc 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -88,6 +88,14 @@ struct nested_state {
         /* A VMEXIT is required but not yet emulated */
         bool exit_required;
 
+        /*
+         * If we vmexit during an instruction emulation we need this to restore
+         * the l1 guest rip after the emulation
+         */
+        unsigned long vmexit_rip;
+        unsigned long vmexit_rsp;
+        unsigned long vmexit_rax;
+
         /* cache for intercepts of the guest */
         u16 intercept_cr_read;
         u16 intercept_cr_write;
@@ -1206,8 +1214,12 @@ static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
                 if (old == new) {
                         /* cr0 write with ts and mp unchanged */
                         svm->vmcb->control.exit_code = SVM_EXIT_CR0_SEL_WRITE;
-                        if (nested_svm_exit_handled(svm) == NESTED_EXIT_DONE)
+                        if (nested_svm_exit_handled(svm) == NESTED_EXIT_DONE) {
+                                svm->nested.vmexit_rip = kvm_rip_read(vcpu);
+                                svm->nested.vmexit_rsp = kvm_register_read(vcpu, VCPU_REGS_RSP);
+                                svm->nested.vmexit_rax = kvm_register_read(vcpu, VCPU_REGS_RAX);
                                 return;
+                        }
                 }
         }
 
@@ -2399,6 +2411,23 @@ static int emulate_on_interception(struct vcpu_svm *svm)
         return emulate_instruction(&svm->vcpu, 0, 0, 0) == EMULATE_DONE;
 }
 
+static int cr0_write_interception(struct vcpu_svm *svm)
+{
+        struct kvm_vcpu *vcpu = &svm->vcpu;
+        int r;
+
+        r = emulate_instruction(&svm->vcpu, 0, 0, 0);
+
+        if (svm->nested.vmexit_rip) {
+                kvm_register_write(vcpu, VCPU_REGS_RIP, svm->nested.vmexit_rip);
+                kvm_register_write(vcpu, VCPU_REGS_RSP, svm->nested.vmexit_rsp);
+                kvm_register_write(vcpu, VCPU_REGS_RAX, svm->nested.vmexit_rax);
+                svm->nested.vmexit_rip = 0;
+        }
+
+        return r == EMULATE_DONE;
+}
+
 static int cr8_write_interception(struct vcpu_svm *svm)
 {
         struct kvm_run *kvm_run = svm->vcpu.run;
@@ -2672,7 +2701,7 @@ static int (*svm_exit_handlers[])(struct vcpu_svm *svm) = {
         [SVM_EXIT_READ_CR4]                     = emulate_on_interception,
         [SVM_EXIT_READ_CR8]                     = emulate_on_interception,
         [SVM_EXIT_CR0_SEL_WRITE]                = emulate_on_interception,
-        [SVM_EXIT_WRITE_CR0]                    = emulate_on_interception,
+        [SVM_EXIT_WRITE_CR0]                    = cr0_write_interception,
         [SVM_EXIT_WRITE_CR3]                    = emulate_on_interception,
         [SVM_EXIT_WRITE_CR4]                    = emulate_on_interception,
         [SVM_EXIT_WRITE_CR8]                    = cr8_write_interception,
@@ -3252,6 +3281,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
         vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
 
         load_host_msrs(vcpu);
+        kvm_load_ldt(ldt_selector);
         loadsegment(fs, fs_selector);
 #ifdef CONFIG_X86_64
         load_gs_index(gs_selector);
@@ -3259,7 +3289,6 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
 #else
         loadsegment(gs, gs_selector);
 #endif
-        kvm_load_ldt(ldt_selector);
 
         reload_tss(vcpu);
 
@@ -3354,6 +3383,14 @@ static void svm_cpuid_update(struct kvm_vcpu *vcpu)
 static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
 {
         switch (func) {
+        case 0x00000001:
+                /* Mask out xsave bit as long as it is not supported by SVM */
+                entry->ecx &= ~(bit(X86_FEATURE_XSAVE));
+                break;
+        case 0x80000001:
+                if (nested)
+                        entry->ecx |= (1 << 2); /* Set SVM bit */
+                break;
         case 0x8000000A:
                 entry->eax = 1; /* SVM revision 1 */
                 entry->ebx = 8; /* Lets support 8 ASIDs in case we add proper
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 7bddfab12013..b3986fec7e68 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -828,10 +828,9 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
 #endif
 
 #ifdef CONFIG_X86_64
-        if (is_long_mode(&vmx->vcpu)) {
-                rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
+        rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
+        if (is_long_mode(&vmx->vcpu))
                 wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
-        }
 #endif
         for (i = 0; i < vmx->save_nmsrs; ++i)
                 kvm_set_shared_msr(vmx->guest_msrs[i].index,
@@ -846,23 +845,23 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx)
 
         ++vmx->vcpu.stat.host_state_reload;
         vmx->host_state.loaded = 0;
-        if (vmx->host_state.fs_reload_needed)
-                loadsegment(fs, vmx->host_state.fs_sel);
+#ifdef CONFIG_X86_64
+        if (is_long_mode(&vmx->vcpu))
+                rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+#endif
         if (vmx->host_state.gs_ldt_reload_needed) {
                 kvm_load_ldt(vmx->host_state.ldt_sel);
 #ifdef CONFIG_X86_64
                 load_gs_index(vmx->host_state.gs_sel);
-                wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gs);
 #else
                 loadsegment(gs, vmx->host_state.gs_sel);
 #endif
         }
+        if (vmx->host_state.fs_reload_needed)
+                loadsegment(fs, vmx->host_state.fs_sel);
         reload_tss();
 #ifdef CONFIG_X86_64
-        if (is_long_mode(&vmx->vcpu)) {
-                rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
-                wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
-        }
+        wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
 #endif
         if (current_thread_info()->status & TS_USEDFPU)
                 clts();
@@ -4249,11 +4248,6 @@ static int vmx_get_lpage_level(void)
                 return PT_PDPE_LEVEL;
 }
 
-static inline u32 bit(int bitno)
-{
-        return 1 << (bitno & 31);
-}
-
 static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
 {
         struct kvm_cpuid_entry2 *best;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3a09c625d526..a5746de6f402 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -153,11 +153,6 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
 
 u64 __read_mostly host_xcr0;
 
-static inline u32 bit(int bitno)
-{
-        return 1 << (bitno & 31);
-}
-
 static void kvm_on_user_return(struct user_return_notifier *urn)
 {
         unsigned slot;
@@ -1994,9 +1989,9 @@ static void do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                 0 /* Reserved, AES */ | F(XSAVE) | 0 /* OSXSAVE */ | F(AVX);
         /* cpuid 0x80000001.ecx */
         const u32 kvm_supported_word6_x86_features =
-                F(LAHF_LM) | F(CMP_LEGACY) | F(SVM) | 0 /* ExtApicSpace */ |
+                F(LAHF_LM) | F(CMP_LEGACY) | 0 /*SVM*/ | 0 /* ExtApicSpace */ |
                 F(CR8_LEGACY) | F(ABM) | F(SSE4A) | F(MISALIGNSSE) |
-                F(3DNOWPREFETCH) | 0 /* OSVW */ | 0 /* IBS */ | F(SSE5) |
+                F(3DNOWPREFETCH) | 0 /* OSVW */ | 0 /* IBS */ | F(XOP) |
                 0 /* SKINIT */ | 0 /* WDT */;
 
         /* all calls to cpuid_count() should be made on the same cpu */
@@ -2305,6 +2300,7 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
                 !kvm_exception_is_soft(vcpu->arch.exception.nr);
         events->exception.nr = vcpu->arch.exception.nr;
         events->exception.has_error_code = vcpu->arch.exception.has_error_code;
+        events->exception.pad = 0;
         events->exception.error_code = vcpu->arch.exception.error_code;
 
         events->interrupt.injected =
@@ -2318,12 +2314,14 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
         events->nmi.injected = vcpu->arch.nmi_injected;
         events->nmi.pending = vcpu->arch.nmi_pending;
         events->nmi.masked = kvm_x86_ops->get_nmi_mask(vcpu);
+        events->nmi.pad = 0;
 
         events->sipi_vector = vcpu->arch.sipi_vector;
 
         events->flags = (KVM_VCPUEVENT_VALID_NMI_PENDING
                          | KVM_VCPUEVENT_VALID_SIPI_VECTOR
                          | KVM_VCPUEVENT_VALID_SHADOW);
+        memset(&events->reserved, 0, sizeof(events->reserved));
 }
 
 static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
@@ -2366,6 +2364,7 @@ static void kvm_vcpu_ioctl_x86_get_debugregs(struct kvm_vcpu *vcpu,
         dbgregs->dr6 = vcpu->arch.dr6;
         dbgregs->dr7 = vcpu->arch.dr7;
         dbgregs->flags = 0;
+        memset(&dbgregs->reserved, 0, sizeof(dbgregs->reserved));
 }
 
 static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
@@ -2849,6 +2848,7 @@ static int kvm_vm_ioctl_get_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
                 sizeof(ps->channels));
         ps->flags = kvm->arch.vpit->pit_state.flags;
         mutex_unlock(&kvm->arch.vpit->pit_state.lock);
+        memset(&ps->reserved, 0, sizeof(ps->reserved));
         return r;
 }
 
@@ -2912,10 +2912,6 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
                 struct kvm_memslots *slots, *old_slots;
                 unsigned long *dirty_bitmap;
 
-                spin_lock(&kvm->mmu_lock);
-                kvm_mmu_slot_remove_write_access(kvm, log->slot);
-                spin_unlock(&kvm->mmu_lock);
-
                 r = -ENOMEM;
                 dirty_bitmap = vmalloc(n);
                 if (!dirty_bitmap)
@@ -2937,6 +2933,10 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
                 dirty_bitmap = old_slots->memslots[log->slot].dirty_bitmap;
                 kfree(old_slots);
 
+                spin_lock(&kvm->mmu_lock);
+                kvm_mmu_slot_remove_write_access(kvm, log->slot);
+                spin_unlock(&kvm->mmu_lock);
+
                 r = -EFAULT;
                 if (copy_to_user(log->dirty_bitmap, dirty_bitmap, n)) {
                         vfree(dirty_bitmap);
@@ -3229,6 +3229,7 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 now_ns = timespec_to_ns(&now);
                 user_ns.clock = kvm->arch.kvmclock_offset + now_ns;
                 user_ns.flags = 0;
+                memset(&user_ns.pad, 0, sizeof(user_ns.pad));
 
                 r = -EFAULT;
                 if (copy_to_user(argp, &user_ns, sizeof(user_ns)))
@@ -5111,6 +5112,8 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
 
         mmu_reset_needed |= kvm_read_cr4(vcpu) != sregs->cr4;
         kvm_x86_ops->set_cr4(vcpu, sregs->cr4);
+        if (sregs->cr4 & X86_CR4_OSXSAVE)
+                update_cpuid(vcpu);
         if (!is_long_mode(vcpu) && is_pae(vcpu)) {
                 load_pdptrs(vcpu, vcpu->arch.cr3);
                 mmu_reset_needed = 1;
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index b7a404722d2b..0bf327453499 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -65,6 +65,11 @@ static inline int is_paging(struct kvm_vcpu *vcpu)
         return kvm_read_cr0_bits(vcpu, X86_CR0_PG);
 }
 
+static inline u32 bit(int bitno)
+{
+        return 1 << (bitno & 31);
+}
+
 void kvm_before_handle_nmi(struct kvm_vcpu *vcpu);
 void kvm_after_handle_nmi(struct kvm_vcpu *vcpu);
 
diff --git a/arch/x86/oprofile/op_model_amd.c b/arch/x86/oprofile/op_model_amd.c
index b67a6b5aa8d4..42623310c968 100644
--- a/arch/x86/oprofile/op_model_amd.c
+++ b/arch/x86/oprofile/op_model_amd.c
@@ -484,21 +484,29 @@ static int __init_ibs_nmi(void)
         return 0;
 }
 
-/* initialize the APIC for the IBS interrupts if available */
+/*
+ * check and reserve APIC extended interrupt LVT offset for IBS if
+ * available
+ *
+ * init_ibs() preforms implicitly cpu-local operations, so pin this
+ * thread to its current CPU
+ */
+
 static void init_ibs(void)
 {
-        ibs_caps = get_ibs_caps();
+        preempt_disable();
 
+        ibs_caps = get_ibs_caps();
         if (!ibs_caps)
-                return;
+                goto out;
 
-        if (__init_ibs_nmi()) {
+        if (__init_ibs_nmi() < 0)
                 ibs_caps = 0;
-                return;
-        }
+        else
+                printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps);
 
-        printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n",
-               (unsigned)ibs_caps);
+out:
+        preempt_enable();
 }
 
 static int (*create_arch_files)(struct super_block *sb, struct dentry *root);
diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
index 4a2afa1bac51..b6552b189bcd 100644
--- a/arch/x86/vdso/Makefile
+++ b/arch/x86/vdso/Makefile
@@ -25,7 +25,7 @@ targets += vdso.so vdso.so.dbg vdso.lds $(vobjs-y)
 
 export CPPFLAGS_vdso.lds += -P -C
 
-VDSO_LDFLAGS_vdso.lds = -m elf_x86_64 -Wl,-soname=linux-vdso.so.1 \
+VDSO_LDFLAGS_vdso.lds = -m64 -Wl,-soname=linux-vdso.so.1 \
                         -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096
 
 $(obj)/vdso.o: $(src)/vdso.S $(obj)/vdso.so
@@ -69,7 +69,7 @@ vdso32.so-$(VDSO32-y)		+= sysenter
 vdso32-images                   = $(vdso32.so-y:%=vdso32-%.so)
 
 CPPFLAGS_vdso32.lds = $(CPPFLAGS_vdso.lds)
-VDSO_LDFLAGS_vdso32.lds = -m elf_i386 -Wl,-soname=linux-gate.so.1
+VDSO_LDFLAGS_vdso32.lds = -m32 -Wl,-soname=linux-gate.so.1
 
 # This makes sure the $(obj) subdirectory exists even though vdso32/
 # is not a kbuild sub-make subdirectory.
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 7d46c8441418..0f6cd146f1ee 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1017,10 +1017,6 @@ static void xen_reboot(int reason)
 {
         struct sched_shutdown r = { .reason = reason };
 
-#ifdef CONFIG_SMP
-        smp_send_stop();
-#endif
-
         if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
                 BUG();
 }
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 25f232b18a82..f4d010031465 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -400,9 +400,9 @@ static void stop_self(void *v)
         BUG();
 }
 
-static void xen_smp_send_stop(void)
+static void xen_stop_other_cpus(int wait)
 {
-        smp_call_function(stop_self, NULL, 0);
+        smp_call_function(stop_self, NULL, wait);
 }
 
 static void xen_smp_send_reschedule(int cpu)
@@ -470,7 +470,7 @@ static const struct smp_ops xen_smp_ops __initdata = {
         .cpu_disable = xen_cpu_disable,
         .play_dead = xen_play_dead,
 
-        .smp_send_stop = xen_smp_send_stop,
+        .stop_other_cpus = xen_stop_other_cpus,
         .smp_send_reschedule = xen_smp_send_reschedule,
 
         .send_call_func_ipi = xen_smp_send_call_function_ipi,
diff --git a/block/blk-map.c b/block/blk-map.c
index ade0a08c9099..267a57b77099 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -205,6 +205,8 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
                         unaligned = 1;
                         break;
                 }
+                if (!iov[i].iov_len)
+                        return -EINVAL;
         }
 
         if (unaligned || (q->dma_pad_mask & len) || map_data)
diff --git a/block/blk-merge.c b/block/blk-merge.c
index eafc94f68d79..c24bf43d51f0 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -21,7 +21,7 @@ static unsigned int __blk_recalc_rq_segments(struct request_queue *q,
                 return 0;
 
         fbio = bio;
-        cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
+        cluster = blk_queue_cluster(q);
         seg_size = 0;
         nr_phys_segs = 0;
         for_each_bio(bio) {
@@ -87,7 +87,7 @@ EXPORT_SYMBOL(blk_recount_segments);
 static int blk_phys_contig_segment(struct request_queue *q, struct bio *bio,
                                    struct bio *nxt)
 {
-        if (!test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags))
+        if (!blk_queue_cluster(q))
                 return 0;
 
         if (bio->bi_seg_back_size + nxt->bi_seg_front_size >
@@ -123,7 +123,7 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq,
         int nsegs, cluster;
 
         nsegs = 0;
-        cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
+        cluster = blk_queue_cluster(q);
 
         /*
          * for each bio in rq
diff --git a/block/blk-settings.c b/block/blk-settings.c
index a234f4bf1d6f..ea9430d3d7d2 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -125,7 +125,7 @@ void blk_set_default_limits(struct queue_limits *lim)
         lim->alignment_offset = 0;
         lim->io_opt = 0;
         lim->misaligned = 0;
-        lim->no_cluster = 0;
+        lim->cluster = 1;
 }
 EXPORT_SYMBOL(blk_set_default_limits);
 
@@ -343,7 +343,7 @@ EXPORT_SYMBOL(blk_queue_logical_block_size);
  *   hardware can operate on without reverting to read-modify-write
  *   operations.
  */
-void blk_queue_physical_block_size(struct request_queue *q, unsigned short size)
+void blk_queue_physical_block_size(struct request_queue *q, unsigned int size)
 {
         q->limits.physical_block_size = size;
 
@@ -468,15 +468,6 @@ EXPORT_SYMBOL(blk_queue_io_opt);
 void blk_queue_stack_limits(struct request_queue *t, struct request_queue *b)
 {
         blk_stack_limits(&t->limits, &b->limits, 0);
-
-        if (!t->queue_lock)
-                WARN_ON_ONCE(1);
-        else if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags)) {
-                unsigned long flags;
-                spin_lock_irqsave(t->queue_lock, flags);
-                queue_flag_clear(QUEUE_FLAG_CLUSTER, t);
-                spin_unlock_irqrestore(t->queue_lock, flags);
-        }
 }
 EXPORT_SYMBOL(blk_queue_stack_limits);
 
@@ -547,7 +538,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
         t->io_min = max(t->io_min, b->io_min);
         t->io_opt = lcm(t->io_opt, b->io_opt);
 
-        t->no_cluster |= b->no_cluster;
+        t->cluster &= b->cluster;
         t->discard_zeroes_data &= b->discard_zeroes_data;
 
         /* Physical block size a multiple of the logical block size? */
@@ -643,7 +634,6 @@ void disk_stack_limits(struct gendisk *disk, struct block_device *bdev,
                        sector_t offset)
 {
         struct request_queue *t = disk->queue;
-        struct request_queue *b = bdev_get_queue(bdev);
 
         if (bdev_stack_limits(&t->limits, bdev, offset >> 9) < 0) {
                 char top[BDEVNAME_SIZE], bottom[BDEVNAME_SIZE];
@@ -654,17 +644,6 @@ void disk_stack_limits(struct gendisk *disk, struct block_device *bdev,
                 printk(KERN_NOTICE "%s: Warning: Device %s is misaligned\n",
                        top, bottom);
         }
-
-        if (!t->queue_lock)
-                WARN_ON_ONCE(1);
-        else if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags)) {
-                unsigned long flags;
-
-                spin_lock_irqsave(t->queue_lock, flags);
-                if (!test_bit(QUEUE_FLAG_CLUSTER, &b->queue_flags))
-                        queue_flag_clear(QUEUE_FLAG_CLUSTER, t);
-                spin_unlock_irqrestore(t->queue_lock, flags);
-        }
 }
 EXPORT_SYMBOL(disk_stack_limits);
 
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 0749b89c6885..a26c930db346 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -114,7 +114,7 @@ static ssize_t queue_max_segments_show(struct request_queue *q, char *page)
 
 static ssize_t queue_max_segment_size_show(struct request_queue *q, char *page)
 {
-        if (test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags))
+        if (blk_queue_cluster(q))
                 return queue_var_show(queue_max_segment_size(q), (page));
 
         return queue_var_show(PAGE_CACHE_SIZE, (page));
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 9eba291eb6fd..909479cfa0af 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -3402,6 +3402,10 @@ static bool cfq_should_wait_busy(struct cfq_data *cfqd, struct cfq_queue *cfqq)
 {
         struct cfq_io_context *cic = cfqd->active_cic;
 
+        /* If the queue already has requests, don't wait */
+        if (!RB_EMPTY_ROOT(&cfqq->sort_list))
+                return false;
+
         /* If there are other queues in the group, don't wait */
         if (cfqq->cfqg->nr_cfqq > 1)
                 return false;
diff --git a/block/genhd.c b/block/genhd.c
index 59a2db6fecef..315afd2f2088 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -541,13 +541,15 @@ void add_disk(struct gendisk *disk)
         disk->major = MAJOR(devt);
         disk->first_minor = MINOR(devt);
 
+        /* Register BDI before referencing it from bdev */
+        bdi = &disk->queue->backing_dev_info;
+        bdi_register_dev(bdi, disk_devt(disk));
+
         blk_register_region(disk_devt(disk), disk->minors, NULL,
                             exact_match, exact_lock, disk);
         register_disk(disk);
         blk_register_queue(disk);
 
-        bdi = &disk->queue->backing_dev_info;
-        bdi_register_dev(bdi, disk_devt(disk));
         retval = sysfs_create_link(&disk_to_dev(disk)->kobj, &bdi->dev->kobj,
                                    "bdi");
         WARN_ON(retval);
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index a8b5a10eb5b0..4f4230b79bb6 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -321,33 +321,47 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
         if (hdr->iovec_count) {
                 const int size = sizeof(struct sg_iovec) * hdr->iovec_count;
                 size_t iov_data_len;
-                struct sg_iovec *iov;
+                struct sg_iovec *sg_iov;
+                struct iovec *iov;
+                int i;
 
-                iov = kmalloc(size, GFP_KERNEL);
-                if (!iov) {
+                sg_iov = kmalloc(size, GFP_KERNEL);
+                if (!sg_iov) {
                         ret = -ENOMEM;
                         goto out;
                 }
 
-                if (copy_from_user(iov, hdr->dxferp, size)) {
-                        kfree(iov);
+                if (copy_from_user(sg_iov, hdr->dxferp, size)) {
+                        kfree(sg_iov);
                         ret = -EFAULT;
                         goto out;
                 }
 
+                /*
+                 * Sum up the vecs, making sure they don't overflow
+                 */
+                iov = (struct iovec *) sg_iov;
+                iov_data_len = 0;
+                for (i = 0; i < hdr->iovec_count; i++) {
+                        if (iov_data_len + iov[i].iov_len < iov_data_len) {
+                                kfree(sg_iov);
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        iov_data_len += iov[i].iov_len;
+                }
+
                 /* SG_IO howto says that the shorter of the two wins */
-                iov_data_len = iov_length((struct iovec *)iov,
-                                          hdr->iovec_count);
                 if (hdr->dxfer_len < iov_data_len) {
-                        hdr->iovec_count = iov_shorten((struct iovec *)iov,
+                        hdr->iovec_count = iov_shorten(iov,
                                                        hdr->iovec_count,
                                                        hdr->dxfer_len);
                         iov_data_len = hdr->dxfer_len;
                 }
 
-                ret = blk_rq_map_user_iov(q, rq, NULL, iov, hdr->iovec_count,
+                ret = blk_rq_map_user_iov(q, rq, NULL, sg_iov, hdr->iovec_count,
                                           iov_data_len, GFP_KERNEL);
-                kfree(iov);
+                kfree(sg_iov);
         } else if (hdr->dxfer_len)
                 ret = blk_rq_map_user(q, rq, NULL, hdr->dxferp, hdr->dxfer_len,
                                       GFP_KERNEL);
diff --git a/drivers/acpi/acpica/dswexec.c b/drivers/acpi/acpica/dswexec.c
index d555b374e314..6b0b5d08d97a 100644
--- a/drivers/acpi/acpica/dswexec.c
+++ b/drivers/acpi/acpica/dswexec.c
@@ -300,10 +300,25 @@ acpi_ds_exec_begin_op(struct acpi_walk_state *walk_state,
                          * we must enter this object into the namespace.  The created
                          * object is temporary and will be deleted upon completion of
                          * the execution of this method.
+                         *
+                         * Note 10/2010: Except for the Scope() op. This opcode does
+                         * not actually create a new object, it refers to an existing
+                         * object. However, for Scope(), we want to indeed open a
+                         * new scope.
                          */
-                        status = acpi_ds_load2_begin_op(walk_state, NULL);
+                        if (op->common.aml_opcode != AML_SCOPE_OP) {
+                                status =
+                                    acpi_ds_load2_begin_op(walk_state, NULL);
+                        } else {
+                                status =
+                                    acpi_ds_scope_stack_push(op->named.node,
+                                                             op->named.node->
+                                                             type, walk_state);
+                                if (ACPI_FAILURE(status)) {
+                                        return_ACPI_STATUS(status);
+                                }
+                        }
                 }
-
                 break;
 
         case AML_CLASS_EXECUTE:
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 98417201e9ce..4c0a0a37d46e 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -98,6 +98,7 @@ enum {
          * due to bad math.
          */
         ACPI_BATTERY_QUIRK_SIGNED16_CURRENT,
+        ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY,
 };
 
 struct acpi_battery {
@@ -412,6 +413,8 @@ static int acpi_battery_get_info(struct acpi_battery *battery)
                 result = extract_package(battery, buffer.pointer,
                                 info_offsets, ARRAY_SIZE(info_offsets));
         kfree(buffer.pointer);
+        if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags))
+                battery->full_charge_capacity = battery->design_capacity;
         return result;
 }
 
@@ -448,6 +451,10 @@ static int acpi_battery_get_state(struct acpi_battery *battery)
             battery->rate_now != -1)
                 battery->rate_now = abs((s16)battery->rate_now);
 
+        if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags)
+            && battery->capacity_now >= 0 && battery->capacity_now <= 100)
+                battery->capacity_now = (battery->capacity_now *
+                                battery->full_charge_capacity) / 100;
         return result;
 }
 
@@ -561,6 +568,33 @@ static void acpi_battery_quirks(struct acpi_battery *battery)
         }
 }
 
+/*
+ * According to the ACPI spec, some kinds of primary batteries can
+ * report percentage battery remaining capacity directly to OS.
+ * In this case, it reports the Last Full Charged Capacity == 100
+ * and BatteryPresentRate == 0xFFFFFFFF.
+ *
+ * Now we found some battery reports percentage remaining capacity
+ * even if it's rechargeable.
+ * https://bugzilla.kernel.org/show_bug.cgi?id=15979
+ *
+ * Handle this correctly so that they won't break userspace.
+ */
+static void acpi_battery_quirks2(struct acpi_battery *battery)
+{
+        if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags))
+                return ;
+
+        if (battery->full_charge_capacity == 100 &&
+            battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN &&
+            battery->capacity_now >=0 && battery->capacity_now <= 100) {
+                set_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags);
+                battery->full_charge_capacity = battery->design_capacity;
+                battery->capacity_now = (battery->capacity_now *
+                                battery->full_charge_capacity) / 100;
+        }
+}
+
 static int acpi_battery_update(struct acpi_battery *battery)
 {
         int result, old_present = acpi_battery_present(battery);
@@ -586,7 +620,9 @@ static int acpi_battery_update(struct acpi_battery *battery)
         if (!battery->bat.dev)
                 sysfs_add_battery(battery);
 #endif
-        return acpi_battery_get_state(battery);
+        result = acpi_battery_get_state(battery);
+        acpi_battery_quirks2(battery);
+        return result;
 }
 
 /* --------------------------------------------------------------------------
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 310e3b9749cb..d68bd61072bb 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -935,6 +935,12 @@ static int __init acpi_bus_init(void)
                 goto error1;
         }
 
+        /*
+         * _PDC control method may load dynamic SSDT tables,
+         * and we need to install the table handler before that.
+         */
+        acpi_sysfs_init();
+
         acpi_early_processor_set_pdc();
 
         /*
@@ -1026,7 +1032,6 @@ static int __init acpi_init(void)
         acpi_scan_init();
         acpi_ec_init();
         acpi_power_init();
-        acpi_sysfs_init();
         acpi_debugfs_init();
         acpi_sleep_proc_init();
         acpi_wakeup_device_init();
diff --git a/drivers/acpi/debugfs.c b/drivers/acpi/debugfs.c
index 7de27d49c4b9..74c4a398604a 100644
--- a/drivers/acpi/debugfs.c
+++ b/drivers/acpi/debugfs.c
@@ -79,7 +79,7 @@ int __init acpi_debugfs_init(void)
         if (!acpi_dir)
                 goto err;
 
-        cm_dentry = debugfs_create_file("custom_method", S_IWUGO,
+        cm_dentry = debugfs_create_file("custom_method", S_IWUSR,
                                         acpi_dir, NULL, &cm_fops);
         if (!cm_dentry)
                 goto err;
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index f31291ba94d0..7bff18b33089 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -929,6 +929,9 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
         ec_flag_msi, "MSI hardware", {
         DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-Star")}, NULL},
         {
+        ec_flag_msi, "MSI hardware", {
+        DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-STAR")}, NULL},
+        {
         ec_validate_ecdt, "ASUS hardware", {
         DMI_MATCH(DMI_BIOS_VENDOR, "ASUS") }, NULL},
         {},
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index e5fdeebf9ef0..d1a0f5bfdfeb 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -72,6 +72,7 @@ enum {
         AHCI_CMD_RESET          = (1 << 8),
         AHCI_CMD_CLR_BUSY       = (1 << 10),
 
+        RX_FIS_PIO_SETUP        = 0x20, /* offset of PIO Setup FIS data */
         RX_FIS_D2H_REG          = 0x40, /* offset of D2H Register FIS data */
         RX_FIS_SDB              = 0x58, /* offset of SDB FIS data */
         RX_FIS_UNK              = 0x60, /* offset of Unknown FIS data */
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 8eea309ea212..137514dbbf65 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1830,12 +1830,24 @@ static unsigned int ahci_qc_issue(struct ata_queued_cmd *qc)
 static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc)
 {
         struct ahci_port_priv *pp = qc->ap->private_data;
-        u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
+        u8 *rx_fis = pp->rx_fis;
 
         if (pp->fbs_enabled)
-                d2h_fis += qc->dev->link->pmp * AHCI_RX_FIS_SZ;
+                rx_fis += qc->dev->link->pmp * AHCI_RX_FIS_SZ;
+
+        /*
+         * After a successful execution of an ATA PIO data-in command,
+         * the device doesn't send D2H Reg FIS to update the TF and
+         * the host should take TF and E_Status from the preceding PIO
+         * Setup FIS.
+         */
+        if (qc->tf.protocol == ATA_PROT_PIO && qc->dma_dir == DMA_FROM_DEVICE &&
+            !(qc->flags & ATA_QCFLAG_FAILED)) {
+                ata_tf_from_fis(rx_fis + RX_FIS_PIO_SETUP, &qc->result_tf);
+                qc->result_tf.command = (rx_fis + RX_FIS_PIO_SETUP)[15];
+        } else
+                ata_tf_from_fis(rx_fis + RX_FIS_D2H_REG, &qc->result_tf);
 
-        ata_tf_from_fis(d2h_fis, &qc->result_tf);
         return true;
 }
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index a89172c100f5..7bb6787de550 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2577,8 +2577,11 @@ static void atapi_qc_complete(struct ata_queued_cmd *qc)
                  *
                  * If door lock fails, always clear sdev->locked to
                  * avoid this infinite loop.
+                 *
+                 * This may happen before SCSI scan is complete.  Make
+                 * sure qc->dev->sdev isn't NULL before dereferencing.
                  */
-                if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL)
+                if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL && qc->dev->sdev)
                         qc->dev->sdev->locked = 0;
 
                 qc->scsicmd->result = SAM_STAT_CHECK_CONDITION;
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index e30c537cce32..c55988b4f900 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1532,11 +1532,10 @@ static unsigned int __ata_sff_port_intr(struct ata_port *ap,
                 if (!(qc->dev->flags & ATA_DFLAG_CDB_INTR))
                         return ata_sff_idle_irq(ap);
                 break;
-        case HSM_ST:
-        case HSM_ST_LAST:
-                break;
-        default:
+        case HSM_ST_IDLE:
                 return ata_sff_idle_irq(ap);
+        default:
+                break;
         }
 
         /* check main status, clearing INTRQ if needed */
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index 8cc536e49a0a..d7d8026cde99 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -610,7 +610,7 @@ static struct scsi_host_template mpc52xx_ata_sht = {
 };
 
 static struct ata_port_operations mpc52xx_ata_port_ops = {
-        .inherits               = &ata_sff_port_ops,
+        .inherits               = &ata_bmdma_port_ops,
         .sff_dev_select         = mpc52xx_ata_dev_select,
         .set_piomode            = mpc52xx_ata_set_piomode,
         .set_dmamode            = mpc52xx_ata_set_dmamode,
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 4730c42a5ee5..c51b8d25cfa8 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -538,7 +538,7 @@ static int vt8251_prepare_host(struct pci_dev *pdev, struct ata_host **r_host)
         return 0;
 }
 
-static void svia_configure(struct pci_dev *pdev)
+static void svia_configure(struct pci_dev *pdev, int board_id)
 {
         u8 tmp8;
 
@@ -577,7 +577,7 @@ static void svia_configure(struct pci_dev *pdev)
         }
 
         /*
-         * vt6421 has problems talking to some drives.  The following
+         * vt6420/1 has problems talking to some drives.  The following
          * is the fix from Joseph Chan <JosephChan@via.com.tw>.
          *
          * When host issues HOLD, device may send up to 20DW of data
@@ -596,8 +596,9 @@ static void svia_configure(struct pci_dev *pdev)
          *
          * https://bugzilla.kernel.org/show_bug.cgi?id=15173
          * http://article.gmane.org/gmane.linux.ide/46352
+         * http://thread.gmane.org/gmane.linux.kernel/1062139
          */
-        if (pdev->device == 0x3249) {
+        if (board_id == vt6420 || board_id == vt6421) {
                 pci_read_config_byte(pdev, 0x52, &tmp8);
                 tmp8 |= 1 << 2;
                 pci_write_config_byte(pdev, 0x52, tmp8);
@@ -652,7 +653,7 @@ static int svia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 return rc;
 
-        svia_configure(pdev);
+        svia_configure(pdev, board_id);
 
         pci_set_master(pdev);
         return ata_host_activate(host, pdev->irq, ata_bmdma_interrupt,
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index ab735a605cf3..d773397575db 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -71,7 +71,7 @@ struct blk_shadow {
 
 static const struct block_device_operations xlvbd_block_fops;
 
-#define BLK_RING_SIZE __RING_SIZE((struct blkif_sring *)0, PAGE_SIZE)
+#define BLK_RING_SIZE __CONST_RING_SIZE(blkif, PAGE_SIZE)
 
 /*
  * We have one of these per vbd, whether ide, scsi or 'other'.  They
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 998833d93c13..17361bad46dd 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -256,9 +256,16 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 
         BT_DBG("tty %p", tty);
 
+        /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
+           the pointer */
         if (hu)
                 return -EEXIST;
 
+        /* Error if the tty has no write op instead of leaving an exploitable
+           hole */
+        if (tty->ops->write == NULL)
+                return -EOPNOTSUPP;
+
         if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
                 BT_ERR("Can't allocate control structure");
                 return -ENFILE;
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index cd18493c9527..aa5c782bf015 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -927,20 +927,14 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
         dev_info(&pdev->dev, "Intel %s Chipset\n", intel_agp_chipsets[i].name);
 
         /*
-        * If the device has not been properly setup, the following will catch
-        * the problem and should stop the system from crashing.
-        * 20030610 - hamish@zot.org
-        */
-        if (pci_enable_device(pdev)) {
-                dev_err(&pdev->dev, "can't enable PCI device\n");
-                agp_put_bridge(bridge);
-                return -ENODEV;
-        }
-
-        /*
         * The following fixes the case where the BIOS has "forgotten" to
         * provide an address range for the GART.
         * 20030610 - hamish@zot.org
+        * This happens before pci_enable_device() intentionally;
+        * calling pci_enable_device() before assigning the resource
+        * will result in the GART being disabled on machines with such
+        * BIOSs (the GART ends up with a BAR starting at 0, which
+        * conflicts a lot of other devices).
         */
         r = &pdev->resource[0];
         if (!r->start && r->end) {
@@ -951,6 +945,17 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                 }
         }
 
+        /*
+        * If the device has not been properly setup, the following will catch
+        * the problem and should stop the system from crashing.
+        * 20030610 - hamish@zot.org
+        */
+        if (pci_enable_device(pdev)) {
+                dev_err(&pdev->dev, "can't enable PCI device\n");
+                agp_put_bridge(bridge);
+                return -ENODEV;
+        }
+
         /* Fill in the mode register */
         if (cap_ptr) {
                 pci_read_config_dword(pdev,
@@ -1049,6 +1054,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_G45_HB),
         ID(PCI_DEVICE_ID_INTEL_G41_HB),
         ID(PCI_DEVICE_ID_INTEL_B43_HB),
+        ID(PCI_DEVICE_ID_INTEL_B43_1_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 75e0a3497888..6ea3bf6e5b1a 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -534,7 +534,7 @@ static void intel_i830_init_gtt_entries(void)
 
         pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
 
-        if (IS_I965) {
+        if (IS_G33 || IS_I965) {
                 u32 pgetbl_ctl;
                 pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
 
@@ -567,22 +567,6 @@ static void intel_i830_init_gtt_entries(void)
                         size = 512;
                 }
                 size += 4; /* add in BIOS popup space */
-        } else if (IS_G33 && !IS_PINEVIEW) {
-        /* G33's GTT size defined in gmch_ctrl */
-                switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
-                case G33_PGETBL_SIZE_1M:
-                        size = 1024;
-                        break;
-                case G33_PGETBL_SIZE_2M:
-                        size = 2048;
-                        break;
-                default:
-                        dev_info(&agp_bridge->dev->dev,
-                                 "unknown page table size 0x%x, assuming 512KB\n",
-                                (gmch_ctrl & G33_PGETBL_SIZE_MASK));
-                        size = 512;
-                }
-                size += 4;
         } else if (IS_G4X || IS_PINEVIEW) {
                 /* On 4 series hardware, GTT stolen is separate from graphics
                  * stolen, ignore it in stolen gtt entries counting.  However,
@@ -1257,24 +1241,31 @@ static int intel_i915_get_gtt_size(void)
         int size;
 
         if (IS_G33) {
-                u16 gmch_ctrl;
+                u32 pgetbl_ctl;
+                pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
 
-                /* G33's GTT size defined in gmch_ctrl */
-                pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
-                switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
-                case I830_GMCH_GMS_STOLEN_512:
+                switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) {
+                case I965_PGETBL_SIZE_128KB:
+                        size = 128;
+                        break;
+                case I965_PGETBL_SIZE_256KB:
+                        size = 256;
+                        break;
+                case I965_PGETBL_SIZE_512KB:
                         size = 512;
                         break;
-                case I830_GMCH_GMS_STOLEN_1024:
+                case I965_PGETBL_SIZE_1MB:
                         size = 1024;
                         break;
-                case I830_GMCH_GMS_STOLEN_8192:
-                        size = 8*1024;
+                case I965_PGETBL_SIZE_2MB:
+                        size = 2048;
+                        break;
+                case I965_PGETBL_SIZE_1_5MB:
+                        size = 1024 + 512;
                         break;
                 default:
-                        dev_info(&agp_bridge->dev->dev,
-                                 "unknown page table size 0x%x, assuming 512KB\n",
-                                (gmch_ctrl & I830_GMCH_GMS_MASK));
+                        dev_info(&intel_private.pcidev->dev,
+                                 "unknown page table size, assuming 512KB\n");
                         size = 512;
                 }
         } else {
@@ -1306,14 +1297,6 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
         pci_read_config_dword(intel_private.pcidev, I915_MMADDR, &temp);
         pci_read_config_dword(intel_private.pcidev, I915_PTEADDR, &temp2);
 
-        gtt_map_size = intel_i915_get_gtt_size();
-
-        intel_private.gtt = ioremap(temp2, gtt_map_size);
-        if (!intel_private.gtt)
-                return -ENOMEM;
-
-        intel_private.gtt_total_size = gtt_map_size / 4;
-
         temp &= 0xfff80000;
 
         intel_private.registers = ioremap(temp, 128 * 4096);
@@ -1322,6 +1305,14 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
                 return -ENOMEM;
         }
 
+        gtt_map_size = intel_i915_get_gtt_size();
+
+        intel_private.gtt = ioremap(temp2, gtt_map_size);
+        if (!intel_private.gtt)
+                return -ENOMEM;
+
+        intel_private.gtt_total_size = gtt_map_size / 4;
+
         temp = readl(intel_private.registers+I810_PGETBL_CTL) & 0xfffff000;
         global_cache_flush();   /* FIXME: ? */
 
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index a0a1829d3198..f8e7d89ceb2c 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -479,6 +479,21 @@ static int hpet_ioctl_ieon(struct hpet_dev *devp)
         if (irq) {
                 unsigned long irq_flags;
 
+                if (devp->hd_flags & HPET_SHARED_IRQ) {
+                        /*
+                         * To prevent the interrupt handler from seeing an
+                         * unwanted interrupt status bit, program the timer
+                         * so that it will not fire in the near future ...
+                         */
+                        writel(readl(&timer->hpet_config) & ~Tn_TYPE_CNF_MASK,
+                               &timer->hpet_config);
+                        write_counter(read_counter(&hpet->hpet_mc),
+                                      &timer->hpet_compare);
+                        /* ... and clear any left-over status. */
+                        isr = 1 << (devp - devp->hd_hpets->hp_dev);
+                        writel(isr, &hpet->hpet_isr);
+                }
+
                 sprintf(devp->hd_name, "hpet%d", (int)(devp - hpetp->hp_dev));
                 irq_flags = devp->hd_flags & HPET_SHARED_IRQ
                                                 ? IRQF_SHARED : IRQF_DISABLED;
@@ -970,6 +985,8 @@ static int hpet_acpi_add(struct acpi_device *device)
                 return -ENODEV;
 
         if (!data.hd_address || !data.hd_nirqs) {
+                if (data.hd_address)
+                        iounmap(data.hd_address);
                 printk("%s: no address or irqs in _CRS\n", __func__);
                 return -ENODEV;
         }
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 7bd7c45b53ef..22abd188fe12 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -320,6 +320,7 @@ static int unload_when_empty = 1;
 static int add_smi(struct smi_info *smi);
 static int try_smi_init(struct smi_info *smi);
 static void cleanup_one_si(struct smi_info *to_clean);
+static void cleanup_ipmi_si(void);
 
 static ATOMIC_NOTIFIER_HEAD(xaction_notifier_list);
 static int register_xaction_notifier(struct notifier_block *nb)
@@ -1665,6 +1666,17 @@ static int check_hotmod_int_op(const char *curr, const char *option,
         return 0;
 }
 
+static struct smi_info *smi_info_alloc(void)
+{
+        struct smi_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
+
+        if (info) {
+                spin_lock_init(&info->si_lock);
+                spin_lock_init(&info->msg_lock);
+        }
+        return info;
+}
+
 static int hotmod_handler(const char *val, struct kernel_param *kp)
 {
         char *str = kstrdup(val, GFP_KERNEL);
@@ -1779,7 +1791,7 @@ static int hotmod_handler(const char *val, struct kernel_param *kp)
                 }
 
                 if (op == HM_ADD) {
-                        info = kzalloc(sizeof(*info), GFP_KERNEL);
+                        info = smi_info_alloc();
                         if (!info) {
                                 rv = -ENOMEM;
                                 goto out;
@@ -1844,7 +1856,7 @@ static __devinit void hardcode_find_bmc(void)
                 if (!ports[i] && !addrs[i])
                         continue;
 
-                info = kzalloc(sizeof(*info), GFP_KERNEL);
+                info = smi_info_alloc();
                 if (!info)
                         return;
 
@@ -2028,7 +2040,7 @@ static __devinit int try_init_spmi(struct SPMITable *spmi)
                 return -ENODEV;
         }
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info) {
                 printk(KERN_ERR PFX "Could not allocate SI data (3)\n");
                 return -ENOMEM;
@@ -2138,7 +2150,7 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
         if (!acpi_dev)
                 return -ENODEV;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info)
                 return -ENOMEM;
 
@@ -2319,7 +2331,7 @@ static __devinit void try_init_dmi(struct dmi_ipmi_data *ipmi_data)
 {
         struct smi_info *info;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info) {
                 printk(KERN_ERR PFX "Could not allocate SI data\n");
                 return;
@@ -2426,7 +2438,7 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
         int class_type = pdev->class & PCI_ERMC_CLASSCODE_TYPE_MASK;
         struct smi_info *info;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
         if (!info)
                 return -ENOMEM;
 
@@ -2567,7 +2579,7 @@ static int __devinit ipmi_of_probe(struct platform_device *dev,
                 return -EINVAL;
         }
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = smi_info_alloc();
 
         if (!info) {
                 dev_err(&dev->dev,
@@ -3014,7 +3026,7 @@ static __devinit void default_find_bmc(void)
                 if (check_legacy_ioport(ipmi_defaults[i].port))
                         continue;
 #endif
-                info = kzalloc(sizeof(*info), GFP_KERNEL);
+                info = smi_info_alloc();
                 if (!info)
                         return;
 
@@ -3139,9 +3151,6 @@ static int try_smi_init(struct smi_info *new_smi)
                 goto out_err;
         }
 
-        spin_lock_init(&(new_smi->si_lock));
-        spin_lock_init(&(new_smi->msg_lock));
-
         /* Do low-level detection first. */
         if (new_smi->handlers->detect(new_smi->si_sm)) {
                 if (new_smi->addr_source)
@@ -3428,16 +3437,7 @@ static __devinit int init_ipmi_si(void)
         mutex_lock(&smi_infos_lock);
         if (unload_when_empty && list_empty(&smi_infos)) {
                 mutex_unlock(&smi_infos_lock);
-#ifdef CONFIG_PCI
-                if (pci_registered)
-                        pci_unregister_driver(&ipmi_pci_driver);
-#endif
-
-#ifdef CONFIG_PPC_OF
-                if (of_registered)
-                        of_unregister_platform_driver(&ipmi_of_platform_driver);
-#endif
-                driver_unregister(&ipmi_driver.driver);
+                cleanup_ipmi_si();
                 printk(KERN_WARNING PFX
                        "Unable to find any System Interface(s)\n");
                 return -ENODEV;
diff --git a/drivers/char/n_gsm.c b/drivers/char/n_gsm.c
index 04ef3ef0a422..0e62674072eb 100644
--- a/drivers/char/n_gsm.c
+++ b/drivers/char/n_gsm.c
@@ -716,8 +716,8 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
                 if (msg->len < 128)
                         *--dp = (msg->len << 1) | EA;
                 else {
-                        *--dp = (msg->len >> 6) | EA;
-                        *--dp = (msg->len & 127) << 1;
+                        *--dp = (msg->len >> 7);        /* bits 7 - 15 */
+                        *--dp = (msg->len & 127) << 1;  /* bits 0 - 6 */
                 }
         }
 
@@ -968,6 +968,8 @@ static void gsm_control_reply(struct gsm_mux *gsm, int cmd, u8 *data,
 {
         struct gsm_msg *msg;
         msg = gsm_data_alloc(gsm, 0, dlen + 2, gsm->ftype);
+        if (msg == NULL)
+                return;
         msg->data[0] = (cmd & 0xFE) << 1 | EA;  /* Clear C/R */
         msg->data[1] = (dlen << 1) | EA;
         memcpy(msg->data + 2, data, dlen);
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 9ecd6bef5d3b..45f9fad4f5dc 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -4127,6 +4127,8 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         if (cmd != SIOCWANDEV)
                 return hdlc_ioctl(dev, ifr, cmd);
 
+        memset(&new_line, 0, size);
+
         switch(ifr->ifr_settings.type) {
         case IF_GET_IFACE: /* return current sync_serial_settings */
 
diff --git a/drivers/char/ramoops.c b/drivers/char/ramoops.c
index 74f00b5ffa36..9445f48c692f 100644
--- a/drivers/char/ramoops.c
+++ b/drivers/char/ramoops.c
@@ -27,7 +27,6 @@
 #include <linux/ioport.h>
 
 #define RAMOOPS_KERNMSG_HDR "===="
-#define RAMOOPS_HEADER_SIZE   (5 + sizeof(struct timeval))
 
 #define RECORD_SIZE 4096
 
@@ -63,8 +62,8 @@ static void ramoops_do_dump(struct kmsg_dumper *dumper,
                         struct ramoops_context, dump);
         unsigned long s1_start, s2_start;
         unsigned long l1_cpy, l2_cpy;
-        int res;
-        char *buf;
+        int res, hdr_size;
+        char *buf, *buf_orig;
         struct timeval timestamp;
 
         /* Only dump oopses if dump_oops is set */
@@ -72,6 +71,8 @@ static void ramoops_do_dump(struct kmsg_dumper *dumper,
                 return;
 
         buf = (char *)(cxt->virt_addr + (cxt->count * RECORD_SIZE));
+        buf_orig = buf;
+
         memset(buf, '\0', RECORD_SIZE);
         res = sprintf(buf, "%s", RAMOOPS_KERNMSG_HDR);
         buf += res;
@@ -79,8 +80,9 @@ static void ramoops_do_dump(struct kmsg_dumper *dumper,
         res = sprintf(buf, "%lu.%lu\n", (long)timestamp.tv_sec, (long)timestamp.tv_usec);
         buf += res;
 
-        l2_cpy = min(l2, (unsigned long)(RECORD_SIZE - RAMOOPS_HEADER_SIZE));
-        l1_cpy = min(l1, (unsigned long)(RECORD_SIZE - RAMOOPS_HEADER_SIZE) - l2_cpy);
+        hdr_size = buf - buf_orig;
+        l2_cpy = min(l2, (unsigned long)(RECORD_SIZE - hdr_size));
+        l1_cpy = min(l1, (unsigned long)(RECORD_SIZE - hdr_size) - l2_cpy);
 
         s2_start = l2 - l2_cpy;
         s1_start = l1 - l1_cpy;
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 05ad4a17a28f..2ec5f33cdbd0 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -354,12 +354,14 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
                     tpm_protected_ordinal_duration[ordinal &
                                                    TPM_PROTECTED_ORDINAL_MASK];
 
-        if (duration_idx != TPM_UNDEFINED)
+        if (duration_idx != TPM_UNDEFINED) {
                 duration = chip->vendor.duration[duration_idx];
-        if (duration <= 0)
+                /* if duration is 0, it's because chip->vendor.duration wasn't */
+                /* filled yet, so we set the lowest timeout just to give enough */
+                /* time for tpm_get_timeouts() to succeed */
+                return (duration <= 0 ? HZ : duration);
+        } else
                 return 2 * 60 * HZ;
-        else
-                return duration;
 }
 EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
 
@@ -565,9 +567,11 @@ duration:
         if (rc)
                 return;
 
-        if (be32_to_cpu(tpm_cmd.header.out.return_code)
-            != 3 * sizeof(u32))
+        if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
+            be32_to_cpu(tpm_cmd.header.out.length)
+            != sizeof(tpm_cmd.header.out) + sizeof(u32) + 3 * sizeof(u32))
                 return;
+
         duration_cap = &tpm_cmd.params.getcap_out.cap.duration;
         chip->vendor.duration[TPM_SHORT] =
             usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_short));
@@ -911,6 +915,18 @@ ssize_t tpm_show_caps_1_2(struct device * dev,
 }
 EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
 
+ssize_t tpm_show_timeouts(struct device *dev, struct device_attribute *attr,
+                          char *buf)
+{
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%d %d %d\n",
+                       jiffies_to_usecs(chip->vendor.duration[TPM_SHORT]),
+                       jiffies_to_usecs(chip->vendor.duration[TPM_MEDIUM]),
+                       jiffies_to_usecs(chip->vendor.duration[TPM_LONG]));
+}
+EXPORT_SYMBOL_GPL(tpm_show_timeouts);
+
 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 792868d24f2a..ba1779c2cffd 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -56,6 +56,8 @@ extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
                                 char *);
 extern ssize_t tpm_show_temp_deactivated(struct device *,
                                          struct device_attribute *attr, char *);
+extern ssize_t tpm_show_timeouts(struct device *,
+                                 struct device_attribute *attr, char *);
 
 struct tpm_chip;
 
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 1030f8420137..3e1f2bbeec11 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/wait.h>
+#include <linux/acpi.h>
 #include "tpm.h"
 
 #define TPM_HEADER_SIZE 10
@@ -78,6 +79,26 @@ enum tis_defaults {
 static LIST_HEAD(tis_chips);
 static DEFINE_SPINLOCK(tis_lock);
 
+#ifdef CONFIG_ACPI
+static int is_itpm(struct pnp_dev *dev)
+{
+        struct acpi_device *acpi = pnp_acpi_device(dev);
+        struct acpi_hardware_id *id;
+
+        list_for_each_entry(id, &acpi->pnp.ids, list) {
+                if (!strcmp("INTC0102", id->id))
+                        return 1;
+        }
+
+        return 0;
+}
+#else
+static int is_itpm(struct pnp_dev *dev)
+{
+        return 0;
+}
+#endif
+
 static int check_locality(struct tpm_chip *chip, int l)
 {
         if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
@@ -355,6 +376,7 @@ static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
                    NULL);
 static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
 
 static struct attribute *tis_attrs[] = {
         &dev_attr_pubek.attr,
@@ -364,7 +386,8 @@ static struct attribute *tis_attrs[] = {
         &dev_attr_owned.attr,
         &dev_attr_temp_deactivated.attr,
         &dev_attr_caps.attr,
-        &dev_attr_cancel.attr, NULL,
+        &dev_attr_cancel.attr,
+        &dev_attr_timeouts.attr, NULL,
 };
 
 static struct attribute_group tis_attr_grp = {
@@ -472,6 +495,9 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
                  "1.2 TPM (device-id 0x%X, rev-id %d)\n",
                  vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
 
+        if (is_itpm(to_pnp_dev(dev)))
+                itpm = 1;
+
         if (itpm)
                 dev_info(dev, "Intel iTPM workaround enabled\n");
 
diff --git a/drivers/char/tty_buffer.c b/drivers/char/tty_buffer.c
index cc1e9850d655..d8210ca00720 100644
--- a/drivers/char/tty_buffer.c
+++ b/drivers/char/tty_buffer.c
@@ -413,7 +413,8 @@ static void flush_to_ldisc(struct work_struct *work)
         spin_lock_irqsave(&tty->buf.lock, flags);
 
         if (!test_and_set_bit(TTY_FLUSHING, &tty->flags)) {
-                struct tty_buffer *head;
+                struct tty_buffer *head, *tail = tty->buf.tail;
+                int seen_tail = 0;
                 while ((head = tty->buf.head) != NULL) {
                         int count;
                         char *char_buf;
@@ -423,6 +424,15 @@ static void flush_to_ldisc(struct work_struct *work)
                         if (!count) {
                                 if (head->next == NULL)
                                         break;
+                                /*
+                                  There's a possibility tty might get new buffer
+                                  added during the unlock window below. We could
+                                  end up spinning in here forever hogging the CPU
+                                  completely. To avoid this let's have a rest each
+                                  time we processed the tail buffer.
+                                */
+                                if (tail == head)
+                                        seen_tail = 1;
                                 tty->buf.head = head->next;
                                 tty_buffer_free(tty, head);
                                 continue;
@@ -432,7 +442,7 @@ static void flush_to_ldisc(struct work_struct *work)
                            line discipline as we want to empty the queue */
                         if (test_bit(TTY_FLUSHPENDING, &tty->flags))
                                 break;
-                        if (!tty->receive_room) {
+                        if (!tty->receive_room || seen_tail) {
                                 schedule_delayed_work(&tty->buf.work, 1);
                                 break;
                         }
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 613c852ee0fe..e0f7f4b8c286 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -553,6 +553,9 @@ void __tty_hangup(struct tty_struct *tty)
 
         tty_lock();
 
+        /* some functions below drop BTM, so we need this bit */
+        set_bit(TTY_HUPPING, &tty->flags);
+
         /* inuse_filps is protected by the single tty lock,
            this really needs to change if we want to flush the
            workqueue with the lock held */
@@ -572,6 +575,10 @@ void __tty_hangup(struct tty_struct *tty)
         }
         spin_unlock(&tty_files_lock);
 
+        /*
+         * it drops BTM and thus races with reopen
+         * we protect the race by TTY_HUPPING
+         */
         tty_ldisc_hangup(tty);
 
         read_lock(&tasklist_lock);
@@ -609,7 +616,6 @@ void __tty_hangup(struct tty_struct *tty)
         tty->session = NULL;
         tty->pgrp = NULL;
         tty->ctrl_status = 0;
-        set_bit(TTY_HUPPED, &tty->flags);
         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 
         /* Account for the p->signal references we killed */
@@ -635,6 +641,7 @@ void __tty_hangup(struct tty_struct *tty)
          * can't yet guarantee all that.
          */
         set_bit(TTY_HUPPED, &tty->flags);
+        clear_bit(TTY_HUPPING, &tty->flags);
         tty_ldisc_enable(tty);
 
         tty_unlock();
@@ -1304,7 +1311,9 @@ static int tty_reopen(struct tty_struct *tty)
 {
         struct tty_driver *driver = tty->driver;
 
-        if (test_bit(TTY_CLOSING, &tty->flags))
+        if (test_bit(TTY_CLOSING, &tty->flags) ||
+                        test_bit(TTY_HUPPING, &tty->flags) ||
+                        test_bit(TTY_LDISC_CHANGING, &tty->flags))
                 return -EIO;
 
         if (driver->type == TTY_DRIVER_TYPE_PTY &&
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index 412f9775d19c..4214d58276f7 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -47,6 +47,7 @@
 
 static DEFINE_SPINLOCK(tty_ldisc_lock);
 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
+static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_idle);
 /* Line disc dispatch table */
 static struct tty_ldisc_ops *tty_ldiscs[NR_LDISCS];
 
@@ -83,6 +84,7 @@ static void put_ldisc(struct tty_ldisc *ld)
                 return;
         }
         local_irq_restore(flags);
+        wake_up(&tty_ldisc_idle);
 }
 
 /**
@@ -452,6 +454,8 @@ static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
                 /* BTM here locks versus a hangup event */
                 WARN_ON(!tty_locked());
                 ret = ld->ops->open(tty);
+                if (ret)
+                        clear_bit(TTY_LDISC_OPEN, &tty->flags);
                 return ret;
         }
         return 0;
@@ -531,6 +535,23 @@ static int tty_ldisc_halt(struct tty_struct *tty)
 }
 
 /**
+ *      tty_ldisc_wait_idle     -       wait for the ldisc to become idle
+ *      @tty: tty to wait for
+ *
+ *      Wait for the line discipline to become idle. The discipline must
+ *      have been halted for this to guarantee it remains idle.
+ */
+static int tty_ldisc_wait_idle(struct tty_struct *tty)
+{
+        int ret;
+        ret = wait_event_interruptible_timeout(tty_ldisc_idle,
+                        atomic_read(&tty->ldisc->users) == 1, 5 * HZ);
+        if (ret < 0)
+                return ret;
+        return ret > 0 ? 0 : -EBUSY;
+}
+
+/**
  *      tty_set_ldisc           -       set line discipline
  *      @tty: the terminal to set
  *      @ldisc: the line discipline
@@ -634,8 +655,17 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         flush_scheduled_work();
 
+        retval = tty_ldisc_wait_idle(tty);
+
         tty_lock();
         mutex_lock(&tty->ldisc_mutex);
+
+        /* handle wait idle failure locked */
+        if (retval) {
+                tty_ldisc_put(new_ldisc);
+                goto enable;
+        }
+
         if (test_bit(TTY_HUPPED, &tty->flags)) {
                 /* We were raced by the hangup method. It will have stomped
                    the ldisc data and closed the ldisc down */
@@ -669,6 +699,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         tty_ldisc_put(o_ldisc);
 
+enable:
         /*
          *      Allow ldisc referencing to occur again
          */
@@ -714,9 +745,12 @@ static void tty_reset_termios(struct tty_struct *tty)
  *      state closed
  */
 
-static void tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
+static int tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
 {
-        struct tty_ldisc *ld;
+        struct tty_ldisc *ld = tty_ldisc_get(ldisc);
+
+        if (IS_ERR(ld))
+                return -1;
 
         tty_ldisc_close(tty, tty->ldisc);
         tty_ldisc_put(tty->ldisc);
@@ -724,10 +758,10 @@ static void tty_ldisc_reinit(struct tty_struct *tty, int ldisc)
         /*
          *      Switch the line discipline back
          */
-        ld = tty_ldisc_get(ldisc);
-        BUG_ON(IS_ERR(ld));
         tty_ldisc_assign(tty, ld);
         tty_set_termios_ldisc(tty, ldisc);
+
+        return 0;
 }
 
 /**
@@ -802,13 +836,16 @@ void tty_ldisc_hangup(struct tty_struct *tty)
            a FIXME */
         if (tty->ldisc) {       /* Not yet closed */
                 if (reset == 0) {
-                        tty_ldisc_reinit(tty, tty->termios->c_line);
-                        err = tty_ldisc_open(tty, tty->ldisc);
+
+                        if (!tty_ldisc_reinit(tty, tty->termios->c_line))
+                                err = tty_ldisc_open(tty, tty->ldisc);
+                        else
+                                err = 1;
                 }
                 /* If the re-open fails or we reset then go to N_TTY. The
                    N_TTY open cannot fail */
                 if (reset || err) {
-                        tty_ldisc_reinit(tty, N_TTY);
+                        BUG_ON(tty_ldisc_reinit(tty, N_TTY));
                         WARN_ON(tty_ldisc_open(tty, tty->ldisc));
                 }
                 tty_ldisc_enable(tty);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 0f69c5ec0ecd..7dc855b074d3 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1314,6 +1314,17 @@ static void control_work_handler(struct work_struct *work)
         spin_unlock(&portdev->cvq_lock);
 }
 
+static void out_intr(struct virtqueue *vq)
+{
+        struct port *port;
+
+        port = find_port_by_vq(vq->vdev->priv, vq);
+        if (!port)
+                return;
+
+        wake_up_interruptible(&port->waitqueue);
+}
+
 static void in_intr(struct virtqueue *vq)
 {
         struct port *port;
@@ -1430,7 +1441,7 @@ static int init_vqs(struct ports_device *portdev)
          */
         j = 0;
         io_callbacks[j] = in_intr;
-        io_callbacks[j + 1] = NULL;
+        io_callbacks[j + 1] = out_intr;
         io_names[j] = "input";
         io_names[j + 1] = "output";
         j += 2;
@@ -1444,7 +1455,7 @@ static int init_vqs(struct ports_device *portdev)
                 for (i = 1; i < nr_ports; i++) {
                         j += 2;
                         io_callbacks[j] = in_intr;
-                        io_callbacks[j + 1] = NULL;
+                        io_callbacks[j + 1] = out_intr;
                         io_names[j] = "input";
                         io_names[j + 1] = "output";
                 }
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 38df8c19e74c..6b68a0fb4611 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -503,6 +503,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         struct kbd_struct * kbd;
         unsigned int console;
         unsigned char ucval;
+        unsigned int uival;
         void __user *up = (void __user *)arg;
         int i, perm;
         int ret = 0;
@@ -657,7 +658,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGETMODE:
-                ucval = vc->vc_mode;
+                uival = vc->vc_mode;
                 goto setint;
 
         case KDMAPDISP:
@@ -695,7 +696,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGKBMODE:
-                ucval = ((kbd->kbdmode == VC_RAW) ? K_RAW :
+                uival = ((kbd->kbdmode == VC_RAW) ? K_RAW :
                                  (kbd->kbdmode == VC_MEDIUMRAW) ? K_MEDIUMRAW :
                                  (kbd->kbdmode == VC_UNICODE) ? K_UNICODE :
                                  K_XLATE);
@@ -717,9 +718,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 break;
 
         case KDGKBMETA:
-                ucval = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
+                uival = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
         setint:
-                ret = put_user(ucval, (int __user *)arg);
+                ret = put_user(uival, (int __user *)arg);
                 break;
 
         case KDGETKEYCODE:
@@ -949,7 +950,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 for (i = 0; i < MAX_NR_CONSOLES; ++i)
                         if (! VT_IS_IN_USE(i))
                                 break;
-                ucval = i < MAX_NR_CONSOLES ? (i+1) : -1;
+                uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
                 goto setint;             
 
         /*
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index a50710843378..97df791c74cb 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -154,6 +154,45 @@ void cpuidle_resume_and_unlock(void)
 
 EXPORT_SYMBOL_GPL(cpuidle_resume_and_unlock);
 
+#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
+{
+        ktime_t t1, t2;
+        s64 diff;
+        int ret;
+
+        t1 = ktime_get();
+        local_irq_enable();
+        while (!need_resched())
+                cpu_relax();
+
+        t2 = ktime_get();
+        diff = ktime_to_us(ktime_sub(t2, t1));
+        if (diff > INT_MAX)
+                diff = INT_MAX;
+
+        ret = (int) diff;
+        return ret;
+}
+
+static void poll_idle_init(struct cpuidle_device *dev)
+{
+        struct cpuidle_state *state = &dev->states[0];
+
+        cpuidle_set_statedata(state, NULL);
+
+        snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
+        snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
+        state->exit_latency = 0;
+        state->target_residency = 0;
+        state->power_usage = -1;
+        state->flags = CPUIDLE_FLAG_POLL;
+        state->enter = poll_idle;
+}
+#else
+static void poll_idle_init(struct cpuidle_device *dev) {}
+#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
+
 /**
  * cpuidle_enable_device - enables idle PM for a CPU
  * @dev: the CPU
@@ -178,6 +217,8 @@ int cpuidle_enable_device(struct cpuidle_device *dev)
                         return ret;
         }
 
+        poll_idle_init(dev);
+
         if ((ret = cpuidle_add_state_sysfs(dev)))
                 return ret;
 
@@ -232,45 +273,6 @@ void cpuidle_disable_device(struct cpuidle_device *dev)
 
 EXPORT_SYMBOL_GPL(cpuidle_disable_device);
 
-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
-static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
-{
-        ktime_t t1, t2;
-        s64 diff;
-        int ret;
-
-        t1 = ktime_get();
-        local_irq_enable();
-        while (!need_resched())
-                cpu_relax();
-
-        t2 = ktime_get();
-        diff = ktime_to_us(ktime_sub(t2, t1));
-        if (diff > INT_MAX)
-                diff = INT_MAX;
-
-        ret = (int) diff;
-        return ret;
-}
-
-static void poll_idle_init(struct cpuidle_device *dev)
-{
-        struct cpuidle_state *state = &dev->states[0];
-
-        cpuidle_set_statedata(state, NULL);
-
-        snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
-        snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
-        state->exit_latency = 0;
-        state->target_residency = 0;
-        state->power_usage = -1;
-        state->flags = CPUIDLE_FLAG_POLL;
-        state->enter = poll_idle;
-}
-#else
-static void poll_idle_init(struct cpuidle_device *dev) {}
-#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
-
 /**
  * __cpuidle_register_device - internal register function called before register
  * and enable routines
@@ -291,8 +293,6 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
 
         init_completion(&dev->kobj_unregister);
 
-        poll_idle_init(dev);
-
         /*
          * cpuidle driver should set the dev->power_specified bit
          * before registering the device if the driver provides
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 2e992bc8015b..8a515baa38f7 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -286,7 +286,7 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key,
         if (initial)
                 asm volatile (".byte 0xf3,0x0f,0xa7,0xd0"       /* rep xcryptcbc */
                               : "+S" (input), "+D" (output), "+a" (iv)
-                              : "d" (control_word), "b" (key), "c" (count));
+                              : "d" (control_word), "b" (key), "c" (initial));
 
         asm volatile (".byte 0xf3,0x0f,0xa7,0xd0"       /* rep xcryptcbc */
                       : "+S" (input), "+D" (output), "+a" (iv)
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 411d5bf50fc4..a25f5f61e0e0 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -449,7 +449,7 @@ mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
 static void mv_xor_tasklet(unsigned long data)
 {
         struct mv_xor_chan *chan = (struct mv_xor_chan *) data;
-        __mv_xor_slot_cleanup(chan);
+        mv_xor_slot_cleanup(chan);
 }
 
 static struct mv_xor_desc_slot *
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index e7d5d6b5dcf6..33780d856acb 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -1572,7 +1572,7 @@ static int f10_match_to_this_node(struct amd64_pvt *pvt, int dram_range,
         debugf1("   HoleOffset=0x%x  HoleValid=0x%x IntlvSel=0x%x\n",
                         hole_off, hole_valid, intlv_sel);
 
-        if (intlv_en ||
+        if (intlv_en &&
             (intlv_sel != ((sys_addr >> 12) & intlv_en)))
                 return -EINVAL;
 
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 6b21e25f7a84..6d2e34d0f52a 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -578,14 +578,16 @@ struct mem_ctl_info *edac_mc_del_mc(struct device *dev)
                 return NULL;
         }
 
-        /* marking MCI offline */
-        mci->op_state = OP_OFFLINE;
-
         del_mc_from_global_list(mci);
         mutex_unlock(&mem_ctls_mutex);
 
-        /* flush workq processes and remove sysfs */
+        /* flush workq processes */
         edac_mc_workq_teardown(mci);
+
+        /* marking MCI offline */
+        mci->op_state = OP_OFFLINE;
+
+        /* remove from sysfs */
         edac_remove_sysfs_mci_device(mci);
 
         edac_printk(KERN_INFO, EDAC_MC,
diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index be0492398ef9..24ff35511e2b 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -75,6 +75,8 @@ static size_t config_rom_length = 1 + 4 + 1 + 1;
 #define BIB_IRMC                ((1) << 31)
 #define NODE_CAPABILITIES       0x0c0083c0 /* per IEEE 1394 clause 8.3.2.6.5.2 */
 
+#define CANON_OUI               0x000085
+
 static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
 {
         struct fw_descriptor *desc;
@@ -284,6 +286,7 @@ static void bm_work(struct work_struct *work)
         bool root_device_is_running;
         bool root_device_is_cmc;
         bool irm_is_1394_1995_only;
+        bool keep_this_irm;
 
         spin_lock_irq(&card->lock);
 
@@ -305,6 +308,10 @@ static void bm_work(struct work_struct *work)
         irm_is_1394_1995_only = irm_device && irm_device->config_rom &&
                         (irm_device->config_rom[2] & 0x000000f0) == 0;
 
+        /* Canon MV5i works unreliably if it is not root node. */
+        keep_this_irm = irm_device && irm_device->config_rom &&
+                        irm_device->config_rom[3] >> 8 == CANON_OUI;
+
         root_id  = root_node->node_id;
         irm_id   = card->irm_node->node_id;
         local_id = card->local_node->node_id;
@@ -333,7 +340,7 @@ static void bm_work(struct work_struct *work)
                         goto pick_me;
                 }
 
-                if (irm_is_1394_1995_only) {
+                if (irm_is_1394_1995_only && !keep_this_irm) {
                         new_root_id = local_id;
                         fw_notify("%s, making local node (%02x) root.\n",
                                   "IRM is not 1394a compliant", new_root_id);
@@ -382,7 +389,7 @@ static void bm_work(struct work_struct *work)
 
                 spin_lock_irq(&card->lock);
 
-                if (rcode != RCODE_COMPLETE) {
+                if (rcode != RCODE_COMPLETE && !keep_this_irm) {
                         /*
                          * The lock request failed, maybe the IRM
                          * isn't really IRM capable after all. Let's
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 9dcb17d51aee..a03cb6acaeda 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -242,6 +242,7 @@ static inline struct fw_ohci *fw_ohci(struct fw_card *card)
 
 static char ohci_driver_name[] = KBUILD_MODNAME;
 
+#define PCI_DEVICE_ID_AGERE_FW643       0x5901
 #define PCI_DEVICE_ID_JMICRON_JMB38X_FW 0x2380
 #define PCI_DEVICE_ID_TI_TSB12LV22      0x8009
 
@@ -253,18 +254,34 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
 
 /* In case of multiple matches in ohci_quirks[], only the first one is used. */
 static const struct {
-        unsigned short vendor, device, flags;
+        unsigned short vendor, device, revision, flags;
 } ohci_quirks[] = {
-        {PCI_VENDOR_ID_TI,      PCI_DEVICE_ID_TI_TSB12LV22, QUIRK_CYCLE_TIMER |
-                                                            QUIRK_RESET_PACKET |
-                                                            QUIRK_NO_1394A},
-        {PCI_VENDOR_ID_TI,      PCI_ANY_ID,     QUIRK_RESET_PACKET},
-        {PCI_VENDOR_ID_AL,      PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
-        {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, QUIRK_NO_MSI},
-        {PCI_VENDOR_ID_NEC,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
-        {PCI_VENDOR_ID_VIA,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
-        {PCI_VENDOR_ID_RICOH,   PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
-        {PCI_VENDOR_ID_APPLE,   PCI_DEVICE_ID_APPLE_UNI_N_FW, QUIRK_BE_HEADERS},
+        {PCI_VENDOR_ID_AL, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER},
+
+        {PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_UNI_N_FW, PCI_ANY_ID,
+                QUIRK_BE_HEADERS},
+
+        {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
+                QUIRK_NO_MSI},
+
+        {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, PCI_ANY_ID,
+                QUIRK_NO_MSI},
+
+        {PCI_VENDOR_ID_NEC, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER},
+
+        {PCI_VENDOR_ID_RICOH, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER},
+
+        {PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_TSB12LV22, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER | QUIRK_RESET_PACKET | QUIRK_NO_1394A},
+
+        {PCI_VENDOR_ID_TI, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_RESET_PACKET},
+
+        {PCI_VENDOR_ID_VIA, PCI_ANY_ID, PCI_ANY_ID,
+                QUIRK_CYCLE_TIMER | QUIRK_NO_MSI},
 };
 
 /* This overrides anything that was found in ohci_quirks[]. */
@@ -739,7 +756,7 @@ static void ar_context_tasklet(unsigned long data)
         d = &ab->descriptor;
 
         if (d->res_count == 0) {
-                size_t size, rest, offset;
+                size_t size, size2, rest, pktsize, size3, offset;
                 dma_addr_t start_bus;
                 void *start;
 
@@ -750,25 +767,61 @@ static void ar_context_tasklet(unsigned long data)
                  */
 
                 offset = offsetof(struct ar_buffer, data);
-                start = buffer = ab;
+                start = ab;
                 start_bus = le32_to_cpu(ab->descriptor.data_address) - offset;
+                buffer = ab->data;
 
                 ab = ab->next;
                 d = &ab->descriptor;
-                size = buffer + PAGE_SIZE - ctx->pointer;
+                size = start + PAGE_SIZE - ctx->pointer;
+                /* valid buffer data in the next page */
                 rest = le16_to_cpu(d->req_count) - le16_to_cpu(d->res_count);
+                /* what actually fits in this page */
+                size2 = min(rest, (size_t)PAGE_SIZE - offset - size);
                 memmove(buffer, ctx->pointer, size);
-                memcpy(buffer + size, ab->data, rest);
-                ctx->current_buffer = ab;
-                ctx->pointer = (void *) ab->data + rest;
-                end = buffer + size + rest;
+                memcpy(buffer + size, ab->data, size2);
+
+                while (size > 0) {
+                        void *next = handle_ar_packet(ctx, buffer);
+                        pktsize = next - buffer;
+                        if (pktsize >= size) {
+                                /*
+                                 * We have handled all the data that was
+                                 * originally in this page, so we can now
+                                 * continue in the next page.
+                                 */
+                                buffer = next;
+                                break;
+                        }
+                        /* move the next packet to the start of the buffer */
+                        memmove(buffer, next, size + size2 - pktsize);
+                        size -= pktsize;
+                        /* fill up this page again */
+                        size3 = min(rest - size2,
+                                    (size_t)PAGE_SIZE - offset - size - size2);
+                        memcpy(buffer + size + size2,
+                               (void *) ab->data + size2, size3);
+                        size2 += size3;
+                }
 
-                while (buffer < end)
-                        buffer = handle_ar_packet(ctx, buffer);
+                if (rest > 0) {
+                        /* handle the packets that are fully in the next page */
+                        buffer = (void *) ab->data +
+                                        (buffer - (start + offset + size));
+                        end = (void *) ab->data + rest;
+
+                        while (buffer < end)
+                                buffer = handle_ar_packet(ctx, buffer);
 
-                dma_free_coherent(ohci->card.device, PAGE_SIZE,
-                                  start, start_bus);
-                ar_context_add_page(ctx);
+                        ctx->current_buffer = ab;
+                        ctx->pointer = end;
+
+                        dma_free_coherent(ohci->card.device, PAGE_SIZE,
+                                          start, start_bus);
+                        ar_context_add_page(ctx);
+                } else {
+                        ctx->pointer = start + PAGE_SIZE;
+                }
         } else {
                 buffer = ctx->pointer;
                 ctx->pointer = end =
@@ -2885,9 +2938,11 @@ static int __devinit pci_probe(struct pci_dev *dev,
         }
 
         for (i = 0; i < ARRAY_SIZE(ohci_quirks); i++)
-                if (ohci_quirks[i].vendor == dev->vendor &&
-                    (ohci_quirks[i].device == dev->device ||
-                     ohci_quirks[i].device == (unsigned short)PCI_ANY_ID)) {
+                if ((ohci_quirks[i].vendor == dev->vendor) &&
+                    (ohci_quirks[i].device == (unsigned short)PCI_ANY_ID ||
+                     ohci_quirks[i].device == dev->device) &&
+                    (ohci_quirks[i].revision == (unsigned short)PCI_ANY_ID ||
+                     ohci_quirks[i].revision >= dev->revision)) {
                         ohci->quirks = ohci_quirks[i].flags;
                         break;
                 }
diff --git a/drivers/gpio/cs5535-gpio.c b/drivers/gpio/cs5535-gpio.c
index e23c06893d19..d3e55a0ae92b 100644
--- a/drivers/gpio/cs5535-gpio.c
+++ b/drivers/gpio/cs5535-gpio.c
@@ -56,6 +56,29 @@ static struct cs5535_gpio_chip {
  * registers, see include/linux/cs5535.h.
  */
 
+static void errata_outl(struct cs5535_gpio_chip *chip, u32 val,
+                unsigned int reg)
+{
+        unsigned long addr = chip->base + 0x80 + reg;
+
+        /*
+         * According to the CS5536 errata (#36), after suspend
+         * a write to the high bank GPIO register will clear all
+         * non-selected bits; the recommended workaround is a
+         * read-modify-write operation.
+         *
+         * Don't apply this errata to the edge status GPIOs, as writing
+         * to their lower bits will clear them.
+         */
+        if (reg != GPIO_POSITIVE_EDGE_STS && reg != GPIO_NEGATIVE_EDGE_STS) {
+                if (val & 0xffff)
+                        val |= (inl(addr) & 0xffff); /* ignore the high bits */
+                else
+                        val |= (inl(addr) ^ (val >> 16));
+        }
+        outl(val, addr);
+}
+
 static void __cs5535_gpio_set(struct cs5535_gpio_chip *chip, unsigned offset,
                 unsigned int reg)
 {
@@ -64,7 +87,7 @@ static void __cs5535_gpio_set(struct cs5535_gpio_chip *chip, unsigned offset,
                 outl(1 << offset, chip->base + reg);
         else
                 /* high bank register */
-                outl(1 << (offset - 16), chip->base + 0x80 + reg);
+                errata_outl(chip, 1 << (offset - 16), reg);
 }
 
 void cs5535_gpio_set(unsigned offset, unsigned int reg)
@@ -86,7 +109,7 @@ static void __cs5535_gpio_clear(struct cs5535_gpio_chip *chip, unsigned offset,
                 outl(1 << (offset + 16), chip->base + reg);
         else
                 /* high bank register */
-                outl(1 << offset, chip->base + 0x80 + reg);
+                errata_outl(chip, 1 << offset, reg);
 }
 
 void cs5535_gpio_clear(unsigned offset, unsigned int reg)
diff --git a/drivers/gpio/rdc321x-gpio.c b/drivers/gpio/rdc321x-gpio.c
index 2762698e0204..897e0577e65e 100644
--- a/drivers/gpio/rdc321x-gpio.c
+++ b/drivers/gpio/rdc321x-gpio.c
@@ -135,7 +135,7 @@ static int __devinit rdc321x_gpio_probe(struct platform_device *pdev)
         struct rdc321x_gpio *rdc321x_gpio_dev;
         struct rdc321x_gpio_pdata *pdata;
 
-        pdata = pdev->dev.platform_data;
+        pdata = platform_get_drvdata(pdev);
         if (!pdata) {
                 dev_err(&pdev->dev, "no platform data supplied\n");
                 return -ENODEV;
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 4cab0c6397e3..aa17594a674a 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -97,7 +97,10 @@ config DRM_I830
 config DRM_I915
         tristate "i915 driver"
         depends on AGP_INTEL
+        # we need shmfs for the swappable backing store, and in particular
+        # the shmem_readpage() which depends upon tmpfs
         select SHMEM
+        select TMPFS
         select DRM_KMS_HELPER
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 37e0b4fa482a..dfc635884619 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -156,12 +156,12 @@ static struct drm_conn_prop_enum_list drm_connector_enum_list[] =
         { DRM_MODE_CONNECTOR_SVIDEO, "SVIDEO", 0 },
         { DRM_MODE_CONNECTOR_LVDS, "LVDS", 0 },
         { DRM_MODE_CONNECTOR_Component, "Component", 0 },
-        { DRM_MODE_CONNECTOR_9PinDIN, "9-pin DIN", 0 },
-        { DRM_MODE_CONNECTOR_DisplayPort, "DisplayPort", 0 },
-        { DRM_MODE_CONNECTOR_HDMIA, "HDMI Type A", 0 },
-        { DRM_MODE_CONNECTOR_HDMIB, "HDMI Type B", 0 },
+        { DRM_MODE_CONNECTOR_9PinDIN, "DIN", 0 },
+        { DRM_MODE_CONNECTOR_DisplayPort, "DP", 0 },
+        { DRM_MODE_CONNECTOR_HDMIA, "HDMI-A", 0 },
+        { DRM_MODE_CONNECTOR_HDMIB, "HDMI-B", 0 },
         { DRM_MODE_CONNECTOR_TV, "TV", 0 },
-        { DRM_MODE_CONNECTOR_eDP, "Embedded DisplayPort", 0 },
+        { DRM_MODE_CONNECTOR_eDP, "eDP", 0 },
 };
 
 static struct drm_prop_enum_list drm_encoder_enum_list[] =
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index dcbeb98f195a..ae9fb7a3afd6 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -649,6 +649,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                                                       old_fb)) {
                                 DRM_ERROR("failed to set mode on [CRTC:%d]\n",
                                           set->crtc->base.id);
+                                set->crtc->fb = old_fb;
                                 ret = -EINVAL;
                                 goto fail;
                         }
@@ -663,8 +664,10 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                         set->crtc->fb = set->fb;
                 ret = crtc_funcs->mode_set_base(set->crtc,
                                                 set->x, set->y, old_fb);
-                if (ret != 0)
+                if (ret != 0) {
+                        set->crtc->fb = old_fb;
                         goto fail;
+                }
         }
 
         kfree(save_connectors);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 2dd2c93ebfa3..e6fc48ea55a9 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -34,6 +34,7 @@
 #include "i915_drm.h"
 #include "i915_drv.h"
 #include "i915_trace.h"
+#include "../../../platform/x86/intel_ips.h"
 #include <linux/pci.h>
 #include <linux/vgaarb.h>
 #include <linux/acpi.h>
@@ -1418,9 +1419,15 @@ static int i915_load_modeset_init(struct drm_device *dev,
         if (ret)
                 DRM_INFO("failed to find VBIOS tables\n");
 
-        /* if we have > 1 VGA cards, then disable the radeon VGA resources */
+        /* If we have > 1 VGA cards, then we need to arbitrate access
+         * to the common VGA resources.
+         *
+         * If we are a secondary display controller (!PCI_DISPLAY_CLASS_VGA),
+         * then we do not take part in VGA arbitration and the
+         * vga_client_register() fails with -ENODEV.
+         */
         ret = vga_client_register(dev->pdev, dev, NULL, i915_vga_set_decode);
-        if (ret)
+        if (ret && ret != -ENODEV)
                 goto cleanup_ringbuffer;
 
         ret = vga_switcheroo_register_client(dev->pdev,
@@ -2047,6 +2054,26 @@ out_unlock:
 EXPORT_SYMBOL_GPL(i915_gpu_turbo_disable);
 
 /**
+ * Tells the intel_ips driver that the i915 driver is now loaded, if
+ * IPS got loaded first.
+ *
+ * This awkward dance is so that neither module has to depend on the
+ * other in order for IPS to do the appropriate communication of
+ * GPU turbo limits to i915.
+ */
+static void
+ips_ping_for_i915_load(void)
+{
+        void (*link)(void);
+
+        link = symbol_get(ips_link_to_i915_driver);
+        if (link) {
+                link();
+                symbol_put(ips_link_to_i915_driver);
+        }
+}
+
+/**
  * i915_driver_load - setup chip and create an initial config
  * @dev: DRM device
  * @flags: startup flags
@@ -2234,6 +2261,8 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         /* XXX Prevent module unload due to memory corruption bugs. */
         __module_get(THIS_MODULE);
 
+        ips_ping_for_i915_load();
+
         return 0;
 
 out_workqueue_free:
@@ -2306,6 +2335,9 @@ int i915_driver_unload(struct drm_device *dev)
                 i915_gem_lastclose(dev);
 
                 intel_cleanup_overlay(dev);
+
+                if (!I915_NEED_GFX_HWS(dev))
+                        i915_free_hws(dev);
         }
 
         intel_teardown_mchbar(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 6dbe14cc4f74..7792c8f7c6dd 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -53,7 +53,7 @@ extern int intel_agp_enabled;
 
 #define INTEL_VGA_DEVICE(id, info) {            \
         .class = PCI_CLASS_DISPLAY_VGA << 8,    \
-        .class_mask = 0xffff00,                 \
+        .class_mask = 0xff0000,                 \
         .vendor = 0x8086,                       \
         .device = id,                           \
         .subvendor = PCI_ANY_ID,                \
@@ -414,6 +414,14 @@ int i965_reset(struct drm_device *dev, u8 flags)
 static int __devinit
 i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
+        /* Only bind to function 0 of the device. Early generations
+         * used function 1 as a placeholder for multi-head. This causes
+         * us confusion instead, especially on the systems where both
+         * functions have the same PCI-ID!
+         */
+        if (PCI_FUNC(pdev->devfn))
+                return -ENODEV;
+
         return drm_get_pci_dev(pdev, ent, &driver);
 }
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 744225ebb4b2..477e4ac66639 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -310,6 +310,7 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         int ret = IRQ_NONE;
         u32 de_iir, gt_iir, de_ier, pch_iir;
+        u32 hotplug_mask;
         struct drm_i915_master_private *master_priv;
         struct intel_ring_buffer *render_ring = &dev_priv->render_ring;
 
@@ -325,6 +326,11 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
         if (de_iir == 0 && gt_iir == 0 && pch_iir == 0)
                 goto done;
 
+        if (HAS_PCH_CPT(dev))
+                hotplug_mask = SDE_HOTPLUG_MASK_CPT;
+        else
+                hotplug_mask = SDE_HOTPLUG_MASK;
+
         ret = IRQ_HANDLED;
 
         if (dev->primary->master) {
@@ -366,10 +372,8 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
                 drm_handle_vblank(dev, 1);
 
         /* check event from PCH */
-        if ((de_iir & DE_PCH_EVENT) &&
-            (pch_iir & SDE_HOTPLUG_MASK)) {
+        if ((de_iir & DE_PCH_EVENT) && (pch_iir & hotplug_mask))
                 queue_work(dev_priv->wq, &dev_priv->hotplug_work);
-        }
 
         if (de_iir & DE_PCU_EVENT) {
                 I915_WRITE16(MEMINTRSTS, I915_READ(MEMINTRSTS));
@@ -1424,8 +1428,7 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
         u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
                            DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
         u32 render_mask = GT_PIPE_NOTIFY | GT_BSD_USER_INTERRUPT;
-        u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
-                           SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
+        u32 hotplug_mask;
 
         dev_priv->irq_mask_reg = ~display_mask;
         dev_priv->de_irq_enable_reg = display_mask | DE_PIPEA_VBLANK | DE_PIPEB_VBLANK;
@@ -1450,6 +1453,14 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
         I915_WRITE(GTIER, dev_priv->gt_irq_enable_reg);
         (void) I915_READ(GTIER);
 
+        if (HAS_PCH_CPT(dev)) {
+                hotplug_mask = SDE_CRT_HOTPLUG_CPT | SDE_PORTB_HOTPLUG_CPT  |
+                               SDE_PORTC_HOTPLUG_CPT | SDE_PORTD_HOTPLUG_CPT ;
+        } else {
+                hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
+                               SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
+        }
+
         dev_priv->pch_irq_mask_reg = ~hotplug_mask;
         dev_priv->pch_irq_enable_reg = hotplug_mask;
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 4f5e15577e89..7103d24c8213 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2551,6 +2551,10 @@
 #define SDE_PORTD_HOTPLUG_CPT   (1 << 23)
 #define SDE_PORTC_HOTPLUG_CPT   (1 << 22)
 #define SDE_PORTB_HOTPLUG_CPT   (1 << 21)
+#define SDE_HOTPLUG_MASK_CPT    (SDE_CRT_HOTPLUG_CPT |          \
+                                 SDE_PORTD_HOTPLUG_CPT |        \
+                                 SDE_PORTC_HOTPLUG_CPT |        \
+                                 SDE_PORTB_HOTPLUG_CPT)
 
 #define SDEISR  0xc4000
 #define SDEIMR  0xc4004
@@ -2722,6 +2726,9 @@
 #define FDI_RXB_CHICKEN         0xc2010
 #define  FDI_RX_PHASE_SYNC_POINTER_ENABLE       (1)
 
+#define SOUTH_DSPCLK_GATE_D     0xc2020
+#define  PCH_DPLSUNIT_CLOCK_GATE_DISABLE (1<<29)
+
 /* CPU: FDI_TX */
 #define FDI_TXA_CTL             0x60100
 #define FDI_TXB_CTL             0x61100
@@ -2946,6 +2953,7 @@
 #define  TRANS_DP_10BPC         (1<<9)
 #define  TRANS_DP_6BPC          (2<<9)
 #define  TRANS_DP_12BPC         (3<<9)
+#define  TRANS_DP_BPC_MASK      (3<<9)
 #define  TRANS_DP_VSYNC_ACTIVE_HIGH     (1<<4)
 #define  TRANS_DP_VSYNC_ACTIVE_LOW      0
 #define  TRANS_DP_HSYNC_ACTIVE_HIGH     (1<<3)
@@ -2959,10 +2967,11 @@
 #define  EDP_LINK_TRAIN_600MV_3_5DB_SNB_A       (0x01<<22)
 #define  EDP_LINK_TRAIN_800MV_0DB_SNB_A         (0x0<<22)
 /* SNB B-stepping */
-#define  EDP_LINK_TRAIN_400MV_0DB_SNB_B         (0x0<<22)
-#define  EDP_LINK_TRAIN_400MV_6DB_SNB_B         (0x3a<<22)
-#define  EDP_LINK_TRAIN_600MV_3_5DB_SNB_B       (0x39<<22)
-#define  EDP_LINK_TRAIN_800MV_0DB_SNB_B         (0x38<<22)
+#define  EDP_LINK_TRAIN_400_600MV_0DB_SNB_B     (0x0<<22)
+#define  EDP_LINK_TRAIN_400MV_3_5DB_SNB_B       (0x1<<22)
+#define  EDP_LINK_TRAIN_400_600MV_6DB_SNB_B     (0x3a<<22)
+#define  EDP_LINK_TRAIN_600_800MV_3_5DB_SNB_B   (0x39<<22)
+#define  EDP_LINK_TRAIN_800_1200MV_0DB_SNB_B    (0x38<<22)
 #define  EDP_LINK_TRAIN_VOL_EMP_MASK_SNB        (0x3f<<22)
 
 #endif /* _I915_REG_H_ */
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 31f08581e93a..2df5b9aadd5b 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -862,8 +862,10 @@ int i915_restore_state(struct drm_device *dev)
         /* Clock gating state */
         intel_init_clock_gating(dev);
 
-        if (HAS_PCH_SPLIT(dev))
+        if (HAS_PCH_SPLIT(dev)) {
                 ironlake_enable_drps(dev);
+                intel_init_emon(dev);
+        }
 
         /* Cache mode state */
         I915_WRITE (CACHE_MODE_0, dev_priv->saveCACHE_MODE_0 | 0xffff0000);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 197d4f32585a..0f950e74db3c 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -191,7 +191,8 @@ static bool intel_ironlake_crt_detect_hotplug(struct drm_connector *connector)
                 DRM_DEBUG_KMS("timed out waiting for FORCE_TRIGGER");
 
         if (turn_off_dac) {
-                I915_WRITE(PCH_ADPA, temp);
+                /* Make sure hotplug is enabled */
+                I915_WRITE(PCH_ADPA, temp | ADPA_CRT_HOTPLUG_ENABLE);
                 (void)I915_READ(PCH_ADPA);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 979228594599..932a061f28d0 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2044,9 +2044,11 @@ static void ironlake_crtc_dpms(struct drm_crtc *crtc, int mode)
 
                                 reg = I915_READ(trans_dp_ctl);
                                 reg &= ~(TRANS_DP_PORT_SEL_MASK |
-                                         TRANS_DP_SYNC_MASK);
+                                         TRANS_DP_SYNC_MASK |
+                                         TRANS_DP_BPC_MASK);
                                 reg |= (TRANS_DP_OUTPUT_ENABLE |
                                         TRANS_DP_ENH_FRAMING);
+                                reg |= TRANS_DP_8BPC;
 
                                 if (crtc->mode.flags & DRM_MODE_FLAG_PHSYNC)
                                       reg |= TRANS_DP_HSYNC_ACTIVE_HIGH;
@@ -5674,6 +5676,13 @@ void intel_init_clock_gating(struct drm_device *dev)
                 I915_WRITE(PCH_DSPCLK_GATE_D, dspclk_gate);
 
                 /*
+                 * On Ibex Peak and Cougar Point, we need to disable clock
+                 * gating for the panel power sequencer or it will fail to
+                 * start up when no ports are active.
+                 */
+                I915_WRITE(SOUTH_DSPCLK_GATE_D, PCH_DPLSUNIT_CLOCK_GATE_DISABLE);
+
+                /*
                  * According to the spec the following bits should be set in
                  * order to enable memory self-refresh
                  * The bit 22/21 of 0x42004
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 9ab8708ac6ba..0aa77f318790 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -425,6 +425,7 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
         uint16_t address = algo_data->address;
         uint8_t msg[5];
         uint8_t reply[2];
+        unsigned retry;
         int msg_bytes;
         int reply_bytes;
         int ret;
@@ -459,14 +460,33 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
                 break;
         }
 
-        for (;;) {
-          ret = intel_dp_aux_ch(intel_dp,
-                                msg, msg_bytes,
-                                reply, reply_bytes);
+        for (retry = 0; retry < 5; retry++) {
+                ret = intel_dp_aux_ch(intel_dp,
+                                      msg, msg_bytes,
+                                      reply, reply_bytes);
                 if (ret < 0) {
                         DRM_DEBUG_KMS("aux_ch failed %d\n", ret);
                         return ret;
                 }
+
+                switch (reply[0] & AUX_NATIVE_REPLY_MASK) {
+                case AUX_NATIVE_REPLY_ACK:
+                        /* I2C-over-AUX Reply field is only valid
+                         * when paired with AUX ACK.
+                         */
+                        break;
+                case AUX_NATIVE_REPLY_NACK:
+                        DRM_DEBUG_KMS("aux_ch native nack\n");
+                        return -EREMOTEIO;
+                case AUX_NATIVE_REPLY_DEFER:
+                        udelay(100);
+                        continue;
+                default:
+                        DRM_ERROR("aux_ch invalid native reply 0x%02x\n",
+                                  reply[0]);
+                        return -EREMOTEIO;
+                }
+
                 switch (reply[0] & AUX_I2C_REPLY_MASK) {
                 case AUX_I2C_REPLY_ACK:
                         if (mode == MODE_I2C_READ) {
@@ -474,17 +494,20 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
                         }
                         return reply_bytes - 1;
                 case AUX_I2C_REPLY_NACK:
-                        DRM_DEBUG_KMS("aux_ch nack\n");
+                        DRM_DEBUG_KMS("aux_i2c nack\n");
                         return -EREMOTEIO;
                 case AUX_I2C_REPLY_DEFER:
-                        DRM_DEBUG_KMS("aux_ch defer\n");
+                        DRM_DEBUG_KMS("aux_i2c defer\n");
                         udelay(100);
                         break;
                 default:
-                        DRM_ERROR("aux_ch invalid reply 0x%02x\n", reply[0]);
+                        DRM_ERROR("aux_i2c invalid reply 0x%02x\n", reply[0]);
                         return -EREMOTEIO;
                 }
         }
+
+        DRM_ERROR("too many retries, giving up\n");
+        return -EREMOTEIO;
 }
 
 static int
@@ -1070,18 +1093,27 @@ intel_dp_signal_levels(uint8_t train_set, int lane_count)
 static uint32_t
 intel_gen6_edp_signal_levels(uint8_t train_set)
 {
-        switch (train_set & (DP_TRAIN_VOLTAGE_SWING_MASK|DP_TRAIN_PRE_EMPHASIS_MASK)) {
+        int signal_levels = train_set & (DP_TRAIN_VOLTAGE_SWING_MASK |
+                                         DP_TRAIN_PRE_EMPHASIS_MASK);
+        switch (signal_levels) {
         case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_0:
-                return EDP_LINK_TRAIN_400MV_0DB_SNB_B;
+        case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_0:
+                return EDP_LINK_TRAIN_400_600MV_0DB_SNB_B;
+        case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_3_5:
+                return EDP_LINK_TRAIN_400MV_3_5DB_SNB_B;
         case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_6:
-                return EDP_LINK_TRAIN_400MV_6DB_SNB_B;
+        case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_6:
+                return EDP_LINK_TRAIN_400_600MV_6DB_SNB_B;
         case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_3_5:
-                return EDP_LINK_TRAIN_600MV_3_5DB_SNB_B;
+        case DP_TRAIN_VOLTAGE_SWING_800 | DP_TRAIN_PRE_EMPHASIS_3_5:
+                return EDP_LINK_TRAIN_600_800MV_3_5DB_SNB_B;
         case DP_TRAIN_VOLTAGE_SWING_800 | DP_TRAIN_PRE_EMPHASIS_0:
-                return EDP_LINK_TRAIN_800MV_0DB_SNB_B;
+        case DP_TRAIN_VOLTAGE_SWING_1200 | DP_TRAIN_PRE_EMPHASIS_0:
+                return EDP_LINK_TRAIN_800_1200MV_0DB_SNB_B;
         default:
-                DRM_DEBUG_KMS("Unsupported voltage swing/pre-emphasis level\n");
-                return EDP_LINK_TRAIN_400MV_0DB_SNB_B;
+                DRM_DEBUG_KMS("Unsupported voltage swing/pre-emphasis level:"
+                              "0x%x\n", signal_levels);
+                return EDP_LINK_TRAIN_400_600MV_0DB_SNB_B;
         }
 }
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 8828b3ac6414..2b161375a38d 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -250,6 +250,7 @@ extern void intel_crtc_fb_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
 extern void intel_init_clock_gating(struct drm_device *dev);
 extern void ironlake_enable_drps(struct drm_device *dev);
 extern void ironlake_disable_drps(struct drm_device *dev);
+extern void intel_init_emon(struct drm_device *dev);
 
 extern int intel_pin_and_fence_fb_obj(struct drm_device *dev,
                                       struct drm_gem_object *obj);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 6ec39a86ed06..c3b2208508fb 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -701,6 +701,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
         },
         {
                 .callback = intel_no_lvds_dmi_callback,
+                .ident = "AOpen i915GMm-HFS",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
+                        DMI_MATCH(DMI_BOARD_NAME, "i915GMm-HFS"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
                 .ident = "Aopen i945GTt-VFA",
                 .matches = {
                         DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index 1d306a458be6..743664187fef 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -1367,6 +1367,12 @@ void intel_setup_overlay(struct drm_device *dev)
                         goto out_free_bo;
                 }
                 overlay->flip_addr = overlay->reg_bo->gtt_offset;
+
+                ret = i915_gem_object_set_to_gtt_domain(reg_bo, true);
+                if (ret) {
+                        DRM_ERROR("failed to move overlay register bo into the GTT\n");
+                        goto out_unpin_bo;
+                }
         } else {
                 ret = i915_gem_attach_phys_object(dev, reg_bo,
                                                   I915_GEM_PHYS_OVERLAY_REGS,
@@ -1399,6 +1405,8 @@ void intel_setup_overlay(struct drm_device *dev)
         DRM_INFO("initialized overlay support\n");
         return;
 
+out_unpin_bo:
+        i915_gem_object_unpin(reg_bo);
 out_free_bo:
         drm_gem_object_unreference(reg_bo);
 out_free:
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index ee73e428a84a..b60652bfd1a3 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1498,10 +1498,12 @@ intel_sdvo_detect(struct drm_connector *connector, bool force)
         if (!intel_sdvo_write_cmd(intel_sdvo,
                              SDVO_CMD_GET_ATTACHED_DISPLAYS, NULL, 0))
                 return connector_status_unknown;
-        if (intel_sdvo->is_tv) {
-                /* add 30ms delay when the output type is SDVO-TV */
+
+        /* add 30ms delay when the output type might be TV */
+        if (intel_sdvo->caps.output_flags &
+            (SDVO_OUTPUT_SVID0 | SDVO_OUTPUT_CVBS0))
                 mdelay(30);
-        }
+
         if (!intel_sdvo_read_response(intel_sdvo, &response, 2))
                 return connector_status_unknown;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index b1be617373b6..c926d8891a46 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -531,6 +531,12 @@ struct drm_nouveau_private {
         struct work_struct irq_work;
         struct work_struct hpd_work;
 
+        struct {
+                spinlock_t lock;
+                uint32_t hpd0_bits;
+                uint32_t hpd1_bits;
+        } hpd_state;
+
         struct list_head vbl_waiting;
 
         struct {
diff --git a/drivers/gpu/drm/nouveau/nouveau_irq.c b/drivers/gpu/drm/nouveau/nouveau_irq.c
index 794b0ee30cf6..b62a601737a4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_irq.c
+++ b/drivers/gpu/drm/nouveau/nouveau_irq.c
@@ -52,6 +52,7 @@ nouveau_irq_preinstall(struct drm_device *dev)
         if (dev_priv->card_type >= NV_50) {
                 INIT_WORK(&dev_priv->irq_work, nv50_display_irq_handler_bh);
                 INIT_WORK(&dev_priv->hpd_work, nv50_display_irq_hotplug_bh);
+                spin_lock_init(&dev_priv->hpd_state.lock);
                 INIT_LIST_HEAD(&dev_priv->vbl_waiting);
         }
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 612fa6d6a0cb..d967cb65d641 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -1012,11 +1012,18 @@ nv50_display_irq_hotplug_bh(struct work_struct *work)
         struct drm_connector *connector;
         const uint32_t gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
         uint32_t unplug_mask, plug_mask, change_mask;
-        uint32_t hpd0, hpd1 = 0;
+        uint32_t hpd0, hpd1;
 
-        hpd0 = nv_rd32(dev, 0xe054) & nv_rd32(dev, 0xe050);
+        spin_lock_irq(&dev_priv->hpd_state.lock);
+        hpd0 = dev_priv->hpd_state.hpd0_bits;
+        dev_priv->hpd_state.hpd0_bits = 0;
+        hpd1 = dev_priv->hpd_state.hpd1_bits;
+        dev_priv->hpd_state.hpd1_bits = 0;
+        spin_unlock_irq(&dev_priv->hpd_state.lock);
+
+        hpd0 &= nv_rd32(dev, 0xe050);
         if (dev_priv->chipset >= 0x90)
-                hpd1 = nv_rd32(dev, 0xe074) & nv_rd32(dev, 0xe070);
+                hpd1 &= nv_rd32(dev, 0xe070);
 
         plug_mask   = (hpd0 & 0x0000ffff) | (hpd1 << 16);
         unplug_mask = (hpd0 >> 16) | (hpd1 & 0xffff0000);
@@ -1058,10 +1065,6 @@ nv50_display_irq_hotplug_bh(struct work_struct *work)
                         helper->dpms(connector->encoder, DRM_MODE_DPMS_OFF);
         }
 
-        nv_wr32(dev, 0xe054, nv_rd32(dev, 0xe054));
-        if (dev_priv->chipset >= 0x90)
-                nv_wr32(dev, 0xe074, nv_rd32(dev, 0xe074));
-
         drm_helper_hpd_irq_event(dev);
 }
 
@@ -1072,8 +1075,22 @@ nv50_display_irq_handler(struct drm_device *dev)
         uint32_t delayed = 0;
 
         if (nv_rd32(dev, NV50_PMC_INTR_0) & NV50_PMC_INTR_0_HOTPLUG) {
-                if (!work_pending(&dev_priv->hpd_work))
-                        queue_work(dev_priv->wq, &dev_priv->hpd_work);
+                uint32_t hpd0_bits, hpd1_bits = 0;
+
+                hpd0_bits = nv_rd32(dev, 0xe054);
+                nv_wr32(dev, 0xe054, hpd0_bits);
+
+                if (dev_priv->chipset >= 0x90) {
+                        hpd1_bits = nv_rd32(dev, 0xe074);
+                        nv_wr32(dev, 0xe074, hpd1_bits);
+                }
+
+                spin_lock(&dev_priv->hpd_state.lock);
+                dev_priv->hpd_state.hpd0_bits |= hpd0_bits;
+                dev_priv->hpd_state.hpd1_bits |= hpd1_bits;
+                spin_unlock(&dev_priv->hpd_state.lock);
+
+                queue_work(dev_priv->wq, &dev_priv->hpd_work);
         }
 
         while (nv_rd32(dev, NV50_PMC_INTR_0) & NV50_PMC_INTR_0_DISPLAY) {
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 8e421f644a54..05efb5b9f13e 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -112,6 +112,7 @@ static uint32_t atom_iio_execute(struct atom_context *ctx, int base,
                         base += 3;
                         break;
                 case ATOM_IIO_WRITE:
+                        (void)ctx->card->ioreg_read(ctx->card, CU16(base + 1));
                         ctx->card->ioreg_write(ctx->card, CU16(base + 1), temp);
                         base += 3;
                         break;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index cd0290f946cf..e226f47b497c 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -253,7 +253,8 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
         case DRM_MODE_DPMS_SUSPEND:
         case DRM_MODE_DPMS_OFF:
                 drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
-                atombios_blank_crtc(crtc, ATOM_ENABLE);
+                if (radeon_crtc->enabled)
+                        atombios_blank_crtc(crtc, ATOM_ENABLE);
                 if (ASIC_IS_DCE3(rdev))
                         atombios_enable_crtc_memreq(crtc, ATOM_DISABLE);
                 atombios_enable_crtc(crtc, ATOM_DISABLE);
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 4e7778d44b8d..695de9a38506 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -187,9 +187,9 @@ static int dp_link_clock_for_mode_clock(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
 int dp_mode_valid(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
 {
         int lanes = dp_lanes_for_mode_clock(dpcd, mode_clock);
-        int bw = dp_lanes_for_mode_clock(dpcd, mode_clock);
+        int dp_clock = dp_link_clock_for_mode_clock(dpcd, mode_clock);
 
-        if ((lanes == 0) || (bw == 0))
+        if ((lanes == 0) || (dp_clock == 0))
                 return MODE_CLOCK_HIGH;
 
         return MODE_OK;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 2f93d46ae69a..9e3dd2fd2766 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1423,7 +1423,6 @@ bool evergreen_gpu_is_lockup(struct radeon_device *rdev)
 static int evergreen_gpu_soft_reset(struct radeon_device *rdev)
 {
         struct evergreen_mc_save save;
-        u32 srbm_reset = 0;
         u32 grbm_reset = 0;
 
         dev_info(rdev->dev, "GPU softreset \n");
@@ -1462,16 +1461,6 @@ static int evergreen_gpu_soft_reset(struct radeon_device *rdev)
         udelay(50);
         WREG32(GRBM_SOFT_RESET, 0);
         (void)RREG32(GRBM_SOFT_RESET);
-
-        /* reset all the system blocks */
-        srbm_reset = SRBM_SOFT_RESET_ALL_MASK;
-
-        dev_info(rdev->dev, "  SRBM_SOFT_RESET=0x%08X\n", srbm_reset);
-        WREG32(SRBM_SOFT_RESET, srbm_reset);
-        (void)RREG32(SRBM_SOFT_RESET);
-        udelay(50);
-        WREG32(SRBM_SOFT_RESET, 0);
-        (void)RREG32(SRBM_SOFT_RESET);
         /* Wait a little for things to settle down */
         udelay(50);
         dev_info(rdev->dev, "  GRBM_STATUS=0x%08X\n",
@@ -1482,10 +1471,6 @@ static int evergreen_gpu_soft_reset(struct radeon_device *rdev)
                 RREG32(GRBM_STATUS_SE1));
         dev_info(rdev->dev, "  SRBM_STATUS=0x%08X\n",
                 RREG32(SRBM_STATUS));
-        /* After reset we need to reinit the asic as GPU often endup in an
-         * incoherent state.
-         */
-        atom_asic_init(rdev->mode_info.atom_context);
         evergreen_mc_resume(rdev, &save);
         return 0;
 }
@@ -2097,6 +2082,11 @@ int evergreen_resume(struct radeon_device *rdev)
 {
         int r;
 
+        /* reset the asic, the gfx blocks are often in a bad state
+         * after the driver is unloaded or after a resume
+         */
+        if (radeon_asic_reset(rdev))
+                dev_warn(rdev->dev, "GPU reset failed !\n");
         /* Do not reset GPU before posting, on rv770 hw unlike on r500 hw,
          * posting will perform necessary task to bring back GPU into good
          * shape.
@@ -2193,6 +2183,11 @@ int evergreen_init(struct radeon_device *rdev)
         r = radeon_atombios_init(rdev);
         if (r)
                 return r;
+        /* reset the asic, the gfx blocks are often in a bad state
+         * after the driver is unloaded or after a resume
+         */
+        if (radeon_asic_reset(rdev))
+                dev_warn(rdev->dev, "GPU reset failed !\n");
         /* Post card if necessary */
         if (!evergreen_card_posted(rdev)) {
                 if (!rdev->bios) {
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index e59422320bb6..0ba4163ee0a4 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2318,6 +2318,9 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
                 /* Fix for RN50, M6, M7 with 8/16/32(??) MBs of VRAM - 
                  * Novell bug 204882 + along with lots of ubuntu ones
                  */
+                if (rdev->mc.aper_size > config_aper_size)
+                        config_aper_size = rdev->mc.aper_size;
+
                 if (config_aper_size > rdev->mc.real_vram_size)
                         rdev->mc.mc_vram_size = config_aper_size;
                 else
@@ -3225,6 +3228,8 @@ static int r100_cs_track_texture_check(struct radeon_device *rdev,
         for (u = 0; u < track->num_texture; u++) {
                 if (!track->textures[u].enabled)
                         continue;
+                if (track->textures[u].lookup_disable)
+                        continue;
                 robj = track->textures[u].robj;
                 if (robj == NULL) {
                         DRM_ERROR("No texture bound to unit %u\n", u);
@@ -3459,6 +3464,7 @@ void r100_cs_track_clear(struct radeon_device *rdev, struct r100_cs_track *track
                 track->textures[i].robj = NULL;
                 /* CS IB emission code makes sure texture unit are disabled */
                 track->textures[i].enabled = false;
+                track->textures[i].lookup_disable = false;
                 track->textures[i].roundup_w = true;
                 track->textures[i].roundup_h = true;
                 if (track->separate_cube)
diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h
index f47cdca1c004..af65600e6564 100644
--- a/drivers/gpu/drm/radeon/r100_track.h
+++ b/drivers/gpu/drm/radeon/r100_track.h
@@ -46,6 +46,7 @@ struct r100_cs_track_texture {
         unsigned                height_11;
         bool                    use_pitch;
         bool                    enabled;
+        bool                    lookup_disable;
         bool                    roundup_w;
         bool                    roundup_h;
         unsigned                compress_format;
diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index 0266d72e0a4c..d2408c395619 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -447,6 +447,8 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                         track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK);
                         track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK);
                 }
+                if (idx_value & R200_TXFORMAT_LOOKUP_DISABLE)
+                        track->textures[i].lookup_disable = true;
                 switch ((idx_value & RADEON_TXFORMAT_FORMAT_MASK)) {
                 case R200_TXFORMAT_I8:
                 case R200_TXFORMAT_RGB332:
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 7b65e4efe8af..74b9fb7a71df 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -97,14 +97,8 @@ u32 rv6xx_get_temp(struct radeon_device *rdev)
 {
         u32 temp = (RREG32(CG_THERMAL_STATUS) & ASIC_T_MASK) >>
                 ASIC_T_SHIFT;
-        u32 actual_temp = 0;
 
-        if ((temp >> 7) & 1)
-                actual_temp = 0;
-        else
-                actual_temp = (temp >> 1) & 0xff;
-
-        return actual_temp * 1000;
+        return temp * 1000;
 }
 
 void r600_pm_get_dynpm_state(struct radeon_device *rdev)
@@ -884,12 +878,15 @@ void r600_pcie_gart_tlb_flush(struct radeon_device *rdev)
         u32 tmp;
 
         /* flush hdp cache so updates hit vram */
-        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
+        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
+            !(rdev->flags & RADEON_IS_AGP)) {
                 void __iomem *ptr = (void *)rdev->gart.table.vram.ptr;
                 u32 tmp;
 
                 /* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
                  * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
+                 * This seems to cause problems on some AGP cards. Just use the old
+                 * method for them.
                  */
                 WREG32(HDP_DEBUG1, 0);
                 tmp = readl((void __iomem *)ptr);
@@ -1201,8 +1198,10 @@ void r600_vram_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
                                 mc->vram_end, mc->real_vram_size >> 20);
         } else {
                 u64 base = 0;
-                if (rdev->flags & RADEON_IS_IGP)
-                        base = (RREG32(MC_VM_FB_LOCATION) & 0xFFFF) << 24;
+                if (rdev->flags & RADEON_IS_IGP) {
+                        base = RREG32(MC_VM_FB_LOCATION) & 0xFFFF;
+                        base <<= 24;
+                }
                 radeon_vram_location(rdev, &rdev->mc, base);
                 rdev->mc.gtt_base_align = 0;
                 radeon_gtt_location(rdev, mc);
@@ -1608,8 +1607,11 @@ void r600_gpu_init(struct radeon_device *rdev)
         rdev->config.r600.tiling_npipes = rdev->config.r600.max_tile_pipes;
         rdev->config.r600.tiling_nbanks = 4 << ((ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT);
         tiling_config |= BANK_TILING((ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT);
-        tiling_config |= GROUP_SIZE(0);
-        rdev->config.r600.tiling_group_size = 256;
+        tiling_config |= GROUP_SIZE((ramcfg & BURSTLENGTH_MASK) >> BURSTLENGTH_SHIFT);
+        if ((ramcfg & BURSTLENGTH_MASK) >> BURSTLENGTH_SHIFT)
+                rdev->config.r600.tiling_group_size = 512;
+        else
+                rdev->config.r600.tiling_group_size = 256;
         tmp = (ramcfg & NOOFROWS_MASK) >> NOOFROWS_SHIFT;
         if (tmp > 3) {
                 tiling_config |= ROW_TILING(3);
@@ -3528,10 +3530,12 @@ int r600_debugfs_mc_info_init(struct radeon_device *rdev)
 void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
 {
         /* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
-         * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
+         * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL.
+         * This seems to cause problems on some AGP cards. Just use the old
+         * method for them.
          */
         if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
-            rdev->vram_scratch.ptr) {
+            rdev->vram_scratch.ptr && !(rdev->flags & RADEON_IS_AGP)) {
                 void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
                 u32 tmp;
 
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 3473c00781ff..e5d4928fd2dc 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -650,8 +650,8 @@ void r600_kms_blit_copy(struct radeon_device *rdev,
                         int src_x = src_gpu_addr & 255;
                         int dst_x = dst_gpu_addr & 255;
                         int h = 1;
-                        src_gpu_addr = src_gpu_addr & ~255;
-                        dst_gpu_addr = dst_gpu_addr & ~255;
+                        src_gpu_addr = src_gpu_addr & ~255ULL;
+                        dst_gpu_addr = dst_gpu_addr & ~255ULL;
 
                         if (!src_x && !dst_x) {
                                 h = (cur_size / max_bytes);
@@ -744,8 +744,8 @@ void r600_kms_blit_copy(struct radeon_device *rdev,
                         int src_x = (src_gpu_addr & 255);
                         int dst_x = (dst_gpu_addr & 255);
                         int h = 1;
-                        src_gpu_addr = src_gpu_addr & ~255;
-                        dst_gpu_addr = dst_gpu_addr & ~255;
+                        src_gpu_addr = src_gpu_addr & ~255ULL;
+                        dst_gpu_addr = dst_gpu_addr & ~255ULL;
 
                         if (!src_x && !dst_x) {
                                 h = (cur_size / max_bytes);
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 250a3a918193..478fddf08f9a 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -228,7 +228,7 @@ static inline int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
                                 __func__, __LINE__, pitch);
                         return -EINVAL;
                 }
-                if (!IS_ALIGNED((height / 8), track->nbanks)) {
+                if (!IS_ALIGNED((height / 8), track->npipes)) {
                         dev_warn(p->dev, "%s:%d cb height (%d) invalid\n",
                                  __func__, __LINE__, height);
                         return -EINVAL;
@@ -367,7 +367,7 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
                                                  __func__, __LINE__, pitch);
                                         return -EINVAL;
                                 }
-                                if ((height / 8) & (track->nbanks - 1)) {
+                                if (!IS_ALIGNED((height / 8), track->npipes)) {
                                         dev_warn(p->dev, "%s:%d db height (%d) invalid\n",
                                                  __func__, __LINE__, height);
                                         return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/r600_reg.h b/drivers/gpu/drm/radeon/r600_reg.h
index d84612ae47e0..33cda016b083 100644
--- a/drivers/gpu/drm/radeon/r600_reg.h
+++ b/drivers/gpu/drm/radeon/r600_reg.h
@@ -86,6 +86,7 @@
 #define R600_HDP_NONSURFACE_BASE                                0x2c04
 
 #define R600_BUS_CNTL                                           0x5420
+#       define R600_BIOS_ROM_DIS                                (1 << 1)
 #define R600_CONFIG_CNTL                                        0x5424
 #define R600_CONFIG_MEMSIZE                                     0x5428
 #define R600_CONFIG_F0_BASE                                     0x542C
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 8e43ddae70cc..85a0d9f1f82b 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -98,6 +98,14 @@ static inline struct radeon_i2c_bus_rec radeon_lookup_i2c_gpio(struct radeon_dev
                                 }
                         }
 
+                        /* some DCE3 boards have bad data for this entry */
+                        if (ASIC_IS_DCE3(rdev)) {
+                                if ((i == 4) &&
+                                    (gpio->usClkMaskRegisterIndex == 0x1fda) &&
+                                    (gpio->sucI2cId.ucAccess == 0x94))
+                                        gpio->sucI2cId.ucAccess = 0x14;
+                        }
+
                         if (gpio->sucI2cId.ucAccess == id) {
                                 i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4;
                                 i2c.mask_data_reg = le16_to_cpu(gpio->usDataMaskRegisterIndex) * 4;
@@ -174,6 +182,14 @@ void radeon_atombios_i2c_init(struct radeon_device *rdev)
                                 }
                         }
 
+                        /* some DCE3 boards have bad data for this entry */
+                        if (ASIC_IS_DCE3(rdev)) {
+                                if ((i == 4) &&
+                                    (gpio->usClkMaskRegisterIndex == 0x1fda) &&
+                                    (gpio->sucI2cId.ucAccess == 0x94))
+                                        gpio->sucI2cId.ucAccess = 0x14;
+                        }
+
                         i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4;
                         i2c.mask_data_reg = le16_to_cpu(gpio->usDataMaskRegisterIndex) * 4;
                         i2c.en_clk_reg = le16_to_cpu(gpio->usClkEnRegisterIndex) * 4;
@@ -297,7 +313,6 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                                      uint16_t *line_mux,
                                      struct radeon_hpd *hpd)
 {
-        struct radeon_device *rdev = dev->dev_private;
 
         /* Asus M2A-VM HDMI board lists the DVI port as HDMI */
         if ((dev->pdev->device == 0x791e) &&
@@ -372,6 +387,13 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                         *line_mux = 0x90;
         }
 
+        /* mac rv630, rv730, others */
+        if ((supported_device == ATOM_DEVICE_TV1_SUPPORT) &&
+            (*connector_type == DRM_MODE_CONNECTOR_DVII)) {
+                *connector_type = DRM_MODE_CONNECTOR_9PinDIN;
+                *line_mux = CONNECTOR_7PIN_DIN_ENUM_ID1;
+        }
+
         /* ASUS HD 3600 XT board lists the DVI port as HDMI */
         if ((dev->pdev->device == 0x9598) &&
             (dev->pdev->subsystem_vendor == 0x1043) &&
@@ -409,21 +431,23 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                 }
         }
 
-        /* Acer laptop reports DVI-D as DVI-I and hpd pins reversed */
+        /* Acer laptop (Acer TravelMate 5730G) has an HDMI port
+         * on the laptop and a DVI port on the docking station and
+         * both share the same encoder, hpd pin, and ddc line.
+         * So while the bios table is technically correct,
+         * we drop the DVI port here since xrandr has no concept of
+         * encoders and will try and drive both connectors
+         * with different crtcs which isn't possible on the hardware
+         * side and leaves no crtcs for LVDS or VGA.
+         */
         if ((dev->pdev->device == 0x95c4) &&
             (dev->pdev->subsystem_vendor == 0x1025) &&
             (dev->pdev->subsystem_device == 0x013c)) {
-                struct radeon_gpio_rec gpio;
-
                 if ((*connector_type == DRM_MODE_CONNECTOR_DVII) &&
                     (supported_device == ATOM_DEVICE_DFP1_SUPPORT)) {
-                        gpio = radeon_lookup_gpio(rdev, 6);
-                        *hpd = radeon_atom_get_hpd_info_from_gpio(rdev, &gpio);
+                        /* actually it's a DVI-D port not DVI-I */
                         *connector_type = DRM_MODE_CONNECTOR_DVID;
-                } else if ((*connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
-                           (supported_device == ATOM_DEVICE_DFP1_SUPPORT)) {
-                        gpio = radeon_lookup_gpio(rdev, 7);
-                        *hpd = radeon_atom_get_hpd_info_from_gpio(rdev, &gpio);
+                        return false;
                 }
         }
 
@@ -2279,7 +2303,7 @@ void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev)
         bios_2_scratch &= ~ATOM_S2_VRI_BRIGHT_ENABLE;
 
         /* tell the bios not to handle mode switching */
-        bios_6_scratch |= (ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH | ATOM_S6_ACC_MODE);
+        bios_6_scratch |= ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH;
 
         if (rdev->family >= CHIP_R600) {
                 WREG32(R600_BIOS_2_SCRATCH, bios_2_scratch);
@@ -2330,10 +2354,13 @@ void radeon_atom_output_lock(struct drm_encoder *encoder, bool lock)
         else
                 bios_6_scratch = RREG32(RADEON_BIOS_6_SCRATCH);
 
-        if (lock)
+        if (lock) {
                 bios_6_scratch |= ATOM_S6_CRITICAL_STATE;
-        else
+                bios_6_scratch &= ~ATOM_S6_ACC_MODE;
+        } else {
                 bios_6_scratch &= ~ATOM_S6_CRITICAL_STATE;
+                bios_6_scratch |= ATOM_S6_ACC_MODE;
+        }
 
         if (rdev->family >= CHIP_R600)
                 WREG32(R600_BIOS_6_SCRATCH, bios_6_scratch);
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 654787ec43f4..8f2c7b50dcf5 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -130,6 +130,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
         }
         return true;
 }
+
 static bool r700_read_disabled_bios(struct radeon_device *rdev)
 {
         uint32_t viph_control;
@@ -143,7 +144,7 @@ static bool r700_read_disabled_bios(struct radeon_device *rdev)
         bool r;
 
         viph_control = RREG32(RADEON_VIPH_CONTROL);
-        bus_cntl = RREG32(RADEON_BUS_CNTL);
+        bus_cntl = RREG32(R600_BUS_CNTL);
         d1vga_control = RREG32(AVIVO_D1VGA_CONTROL);
         d2vga_control = RREG32(AVIVO_D2VGA_CONTROL);
         vga_render_control = RREG32(AVIVO_VGA_RENDER_CONTROL);
@@ -152,7 +153,7 @@ static bool r700_read_disabled_bios(struct radeon_device *rdev)
         /* disable VIP */
         WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
         /* enable the rom */
-        WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
+        WREG32(R600_BUS_CNTL, (bus_cntl & ~R600_BIOS_ROM_DIS));
         /* Disable VGA mode */
         WREG32(AVIVO_D1VGA_CONTROL,
                (d1vga_control & ~(AVIVO_DVGA_CONTROL_MODE_ENABLE |
@@ -191,7 +192,7 @@ static bool r700_read_disabled_bios(struct radeon_device *rdev)
                         cg_spll_status = RREG32(R600_CG_SPLL_STATUS);
         }
         WREG32(RADEON_VIPH_CONTROL, viph_control);
-        WREG32(RADEON_BUS_CNTL, bus_cntl);
+        WREG32(R600_BUS_CNTL, bus_cntl);
         WREG32(AVIVO_D1VGA_CONTROL, d1vga_control);
         WREG32(AVIVO_D2VGA_CONTROL, d2vga_control);
         WREG32(AVIVO_VGA_RENDER_CONTROL, vga_render_control);
@@ -216,7 +217,7 @@ static bool r600_read_disabled_bios(struct radeon_device *rdev)
         bool r;
 
         viph_control = RREG32(RADEON_VIPH_CONTROL);
-        bus_cntl = RREG32(RADEON_BUS_CNTL);
+        bus_cntl = RREG32(R600_BUS_CNTL);
         d1vga_control = RREG32(AVIVO_D1VGA_CONTROL);
         d2vga_control = RREG32(AVIVO_D2VGA_CONTROL);
         vga_render_control = RREG32(AVIVO_VGA_RENDER_CONTROL);
@@ -231,7 +232,7 @@ static bool r600_read_disabled_bios(struct radeon_device *rdev)
         /* disable VIP */
         WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
         /* enable the rom */
-        WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
+        WREG32(R600_BUS_CNTL, (bus_cntl & ~R600_BIOS_ROM_DIS));
         /* Disable VGA mode */
         WREG32(AVIVO_D1VGA_CONTROL,
                (d1vga_control & ~(AVIVO_DVGA_CONTROL_MODE_ENABLE |
@@ -262,7 +263,7 @@ static bool r600_read_disabled_bios(struct radeon_device *rdev)
 
         /* restore regs */
         WREG32(RADEON_VIPH_CONTROL, viph_control);
-        WREG32(RADEON_BUS_CNTL, bus_cntl);
+        WREG32(R600_BUS_CNTL, bus_cntl);
         WREG32(AVIVO_D1VGA_CONTROL, d1vga_control);
         WREG32(AVIVO_D2VGA_CONTROL, d2vga_control);
         WREG32(AVIVO_VGA_RENDER_CONTROL, vga_render_control);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 7b7ea269549c..137b8075f6e7 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -571,6 +571,7 @@ static struct radeon_i2c_bus_rec combios_setup_i2c_bus(struct radeon_device *rde
         }
 
         if (clk_mask && data_mask) {
+                /* system specific masks */
                 i2c.mask_clk_mask = clk_mask;
                 i2c.mask_data_mask = data_mask;
                 i2c.a_clk_mask = clk_mask;
@@ -579,7 +580,19 @@ static struct radeon_i2c_bus_rec combios_setup_i2c_bus(struct radeon_device *rde
                 i2c.en_data_mask = data_mask;
                 i2c.y_clk_mask = clk_mask;
                 i2c.y_data_mask = data_mask;
+        } else if ((ddc_line == RADEON_GPIOPAD_MASK) ||
+                   (ddc_line == RADEON_MDGPIO_MASK)) {
+                /* default gpiopad masks */
+                i2c.mask_clk_mask = (0x20 << 8);
+                i2c.mask_data_mask = 0x80;
+                i2c.a_clk_mask = (0x20 << 8);
+                i2c.a_data_mask = 0x80;
+                i2c.en_clk_mask = (0x20 << 8);
+                i2c.en_data_mask = 0x80;
+                i2c.y_clk_mask = (0x20 << 8);
+                i2c.y_data_mask = 0x80;
         } else {
+                /* default masks for ddc pads */
                 i2c.mask_clk_mask = RADEON_GPIO_EN_1;
                 i2c.mask_data_mask = RADEON_GPIO_EN_0;
                 i2c.a_clk_mask = RADEON_GPIO_A_1;
@@ -716,7 +729,7 @@ void radeon_combios_i2c_init(struct radeon_device *rdev)
                                         clk = RBIOS8(offset + 3 + (i * 5) + 3);
                                         data = RBIOS8(offset + 3 + (i * 5) + 4);
                                         i2c = combios_setup_i2c_bus(rdev, DDC_MONID,
-                                                                    clk, data);
+                                                                    (1 << clk), (1 << data));
                                         rdev->i2c_bus[4] = radeon_i2c_create(dev, &i2c, "GPIOPAD_MASK");
                                         break;
                                 }
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index ecc1a8fafbfd..5e222c9739c7 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1119,6 +1119,8 @@ radeon_add_atom_connector(struct drm_device *dev,
                 /* no HPD on analog connectors */
                 radeon_connector->hpd.hpd = RADEON_HPD_NONE;
                 connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+                connector->interlace_allowed = true;
+                connector->doublescan_allowed = true;
                 break;
         case DRM_MODE_CONNECTOR_DVIA:
                 drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
@@ -1134,6 +1136,8 @@ radeon_add_atom_connector(struct drm_device *dev,
                                               1);
                 /* no HPD on analog connectors */
                 radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+                connector->interlace_allowed = true;
+                connector->doublescan_allowed = true;
                 break;
         case DRM_MODE_CONNECTOR_DVII:
         case DRM_MODE_CONNECTOR_DVID:
@@ -1163,6 +1167,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                       rdev->mode_info.load_detect_property,
                                                       1);
                 }
+                connector->interlace_allowed = true;
+                if (connector_type == DRM_MODE_CONNECTOR_DVII)
+                        connector->doublescan_allowed = true;
+                else
+                        connector->doublescan_allowed = false;
                 break;
         case DRM_MODE_CONNECTOR_HDMIA:
         case DRM_MODE_CONNECTOR_HDMIB:
@@ -1186,6 +1195,11 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                       rdev->mode_info.underscan_property,
                                                       UNDERSCAN_AUTO);
                 subpixel_order = SubPixelHorizontalRGB;
+                connector->interlace_allowed = true;
+                if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
+                        connector->doublescan_allowed = true;
+                else
+                        connector->doublescan_allowed = false;
                 break;
         case DRM_MODE_CONNECTOR_DisplayPort:
         case DRM_MODE_CONNECTOR_eDP:
@@ -1216,6 +1230,9 @@ radeon_add_atom_connector(struct drm_device *dev,
                         drm_connector_attach_property(&radeon_connector->base,
                                                       rdev->mode_info.underscan_property,
                                                       UNDERSCAN_AUTO);
+                connector->interlace_allowed = true;
+                /* in theory with a DP to VGA converter... */
+                connector->doublescan_allowed = false;
                 break;
         case DRM_MODE_CONNECTOR_SVIDEO:
         case DRM_MODE_CONNECTOR_Composite:
@@ -1231,6 +1248,8 @@ radeon_add_atom_connector(struct drm_device *dev,
                                               radeon_atombios_get_tv_info(rdev));
                 /* no HPD on analog connectors */
                 radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+                connector->interlace_allowed = false;
+                connector->doublescan_allowed = false;
                 break;
         case DRM_MODE_CONNECTOR_LVDS:
                 radeon_dig_connector = kzalloc(sizeof(struct radeon_connector_atom_dig), GFP_KERNEL);
@@ -1249,6 +1268,8 @@ radeon_add_atom_connector(struct drm_device *dev,
                                               dev->mode_config.scaling_mode_property,
                                               DRM_MODE_SCALE_FULLSCREEN);
                 subpixel_order = SubPixelHorizontalRGB;
+                connector->interlace_allowed = false;
+                connector->doublescan_allowed = false;
                 break;
         }
 
@@ -1326,6 +1347,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                 /* no HPD on analog connectors */
                 radeon_connector->hpd.hpd = RADEON_HPD_NONE;
                 connector->polled = DRM_CONNECTOR_POLL_CONNECT;
+                connector->interlace_allowed = true;
+                connector->doublescan_allowed = true;
                 break;
         case DRM_MODE_CONNECTOR_DVIA:
                 drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
@@ -1341,6 +1364,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                               1);
                 /* no HPD on analog connectors */
                 radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+                connector->interlace_allowed = true;
+                connector->doublescan_allowed = true;
                 break;
         case DRM_MODE_CONNECTOR_DVII:
         case DRM_MODE_CONNECTOR_DVID:
@@ -1358,6 +1383,11 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                                       1);
                 }
                 subpixel_order = SubPixelHorizontalRGB;
+                connector->interlace_allowed = true;
+                if (connector_type == DRM_MODE_CONNECTOR_DVII)
+                        connector->doublescan_allowed = true;
+                else
+                        connector->doublescan_allowed = false;
                 break;
         case DRM_MODE_CONNECTOR_SVIDEO:
         case DRM_MODE_CONNECTOR_Composite:
@@ -1380,6 +1410,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                               radeon_combios_get_tv_info(rdev));
                 /* no HPD on analog connectors */
                 radeon_connector->hpd.hpd = RADEON_HPD_NONE;
+                connector->interlace_allowed = false;
+                connector->doublescan_allowed = false;
                 break;
         case DRM_MODE_CONNECTOR_LVDS:
                 drm_connector_init(dev, &radeon_connector->base, &radeon_lvds_connector_funcs, connector_type);
@@ -1393,6 +1425,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                               dev->mode_config.scaling_mode_property,
                                               DRM_MODE_SCALE_FULLSCREEN);
                 subpixel_order = SubPixelHorizontalRGB;
+                connector->interlace_allowed = false;
+                connector->doublescan_allowed = false;
                 break;
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 256d204a6d24..ed5e153384ac 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -829,11 +829,6 @@ int radeon_resume_kms(struct drm_device *dev)
         radeon_pm_resume(rdev);
         radeon_restore_bios_scratch_regs(rdev);
 
-        /* turn on display hw */
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-        }
-
         radeon_fbdev_set_suspend(rdev, 0);
         release_console_sem();
 
@@ -841,6 +836,10 @@ int radeon_resume_kms(struct drm_device *dev)
         radeon_hpd_init(rdev);
         /* blat the mode back in */
         drm_helper_resume_force_mode(dev);
+        /* turn on display hw */
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+        }
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index b92d2f2fcbed..4da243ac79d7 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -629,6 +629,10 @@ static void radeon_compute_pll_legacy(struct radeon_pll *pll,
         *frac_fb_div_p = best_frac_feedback_div;
         *ref_div_p = best_ref_div;
         *post_div_p = best_post_div;
+        DRM_DEBUG_KMS("%d %d, pll dividers - fb: %d.%d ref: %d, post %d\n",
+                      freq, best_freq / 1000, best_feedback_div, best_frac_feedback_div,
+                      best_ref_div, best_post_div);
+
 }
 
 static bool
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 2c293e8304d6..b82015e148e6 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -595,6 +595,7 @@ atombios_digital_setup(struct drm_encoder *encoder, int action)
 int
 atombios_get_encoder_mode(struct drm_encoder *encoder)
 {
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct drm_device *dev = encoder->dev;
         struct radeon_device *rdev = dev->dev_private;
         struct drm_connector *connector;
@@ -602,9 +603,20 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         struct radeon_connector_atom_dig *dig_connector;
 
         connector = radeon_get_connector_for_encoder(encoder);
-        if (!connector)
-                return 0;
-
+        if (!connector) {
+                switch (radeon_encoder->encoder_id) {
+                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1:
+                        return ATOM_ENCODER_MODE_DVI;
+                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC1:
+                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC2:
+                default:
+                        return ATOM_ENCODER_MODE_CRT;
+                }
+        }
         radeon_connector = to_radeon_connector(connector);
 
         switch (connector->connector_type) {
@@ -1547,6 +1559,23 @@ static void radeon_atom_encoder_disable(struct drm_encoder *encoder)
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig;
+
+        /* check for pre-DCE3 cards with shared encoders;
+         * can't really use the links individually, so don't disable
+         * the encoder if it's in use by another connector
+         */
+        if (!ASIC_IS_DCE3(rdev)) {
+                struct drm_encoder *other_encoder;
+                struct radeon_encoder *other_radeon_encoder;
+
+                list_for_each_entry(other_encoder, &dev->mode_config.encoder_list, head) {
+                        other_radeon_encoder = to_radeon_encoder(other_encoder);
+                        if ((radeon_encoder->encoder_id == other_radeon_encoder->encoder_id) &&
+                            drm_helper_encoder_in_use(other_encoder))
+                                goto disable_done;
+                }
+        }
+
         radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
 
         switch (radeon_encoder->encoder_id) {
@@ -1586,6 +1615,7 @@ static void radeon_atom_encoder_disable(struct drm_encoder *encoder)
                 break;
         }
 
+disable_done:
         if (radeon_encoder_is_digital(encoder)) {
                 if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_HDMI)
                         r600_hdmi_disable(encoder);
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index 6a13ee38a5b9..acae80ee91a2 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -946,6 +946,7 @@ struct radeon_i2c_chan *radeon_i2c_create_dp(struct drm_device *dev,
         i2c->rec = *rec;
         i2c->adapter.owner = THIS_MODULE;
         i2c->dev = dev;
+        sprintf(i2c->adapter.name, "Radeon aux bus %s", name);
         i2c_set_adapdata(&i2c->adapter, i2c);
         i2c->adapter.algo_data = &i2c->algo.dp;
         i2c->algo.dp.aux_ch = radeon_dp_i2c_aux_ch;
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index b3b5306bb578..25d345ecee8e 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -102,6 +102,8 @@ int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj,
                 type = ttm_bo_type_device;
         }
         *bo_ptr = NULL;
+
+retry:
         bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
         if (bo == NULL)
                 return -ENOMEM;
@@ -109,8 +111,6 @@ int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj,
         bo->gobj = gobj;
         bo->surface_reg = -1;
         INIT_LIST_HEAD(&bo->list);
-
-retry:
         radeon_ttm_placement_from_domain(bo, domain);
         /* Kernel allocation are uninterruptible */
         mutex_lock(&rdev->vram_mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index c332f46340d5..64928814de53 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -2836,6 +2836,7 @@
 #       define R200_TXFORMAT_ST_ROUTE_STQ5      (5 << 24)
 #       define R200_TXFORMAT_ST_ROUTE_MASK      (7 << 24)
 #       define R200_TXFORMAT_ST_ROUTE_SHIFT     24
+#       define R200_TXFORMAT_LOOKUP_DISABLE     (1 << 27)
 #       define R200_TXFORMAT_ALPHA_MASK_ENABLE  (1 << 28)
 #       define R200_TXFORMAT_CHROMA_KEY_ENABLE  (1 << 29)
 #       define R200_TXFORMAT_CUBIC_MAP_ENABLE           (1 << 30)
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 9490da700749..b88353d6ed2e 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -643,10 +643,11 @@ static void rv770_gpu_init(struct radeon_device *rdev)
         else
                 gb_tiling_config |= BANK_TILING((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT);
         rdev->config.rv770.tiling_nbanks = 4 << ((gb_tiling_config >> 4) & 0x3);
-
-        gb_tiling_config |= GROUP_SIZE(0);
-        rdev->config.rv770.tiling_group_size = 256;
-
+        gb_tiling_config |= GROUP_SIZE((mc_arb_ramcfg & BURSTLENGTH_MASK) >> BURSTLENGTH_SHIFT);
+        if ((mc_arb_ramcfg & BURSTLENGTH_MASK) >> BURSTLENGTH_SHIFT)
+                rdev->config.rv770.tiling_group_size = 512;
+        else
+                rdev->config.rv770.tiling_group_size = 256;
         if (((mc_arb_ramcfg & NOOFROWS_MASK) >> NOOFROWS_SHIFT) > 3) {
                 gb_tiling_config |= ROW_TILING(3);
                 gb_tiling_config |= SAMPLE_SPLIT(3);
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index f366f968155a..d7def1790b41 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -636,7 +636,7 @@ int vga_client_register(struct pci_dev *pdev, void *cookie,
                         void (*irq_set_state)(void *cookie, bool state),
                         unsigned int (*set_vga_decode)(void *cookie, bool decode))
 {
-        int ret = -1;
+        int ret = -ENODEV;
         struct vga_device *vgadev;
         unsigned long flags;
 
diff --git a/drivers/hid/hid-egalax.c b/drivers/hid/hid-egalax.c
index 8ca7f65cf2f8..54b017ad258d 100644
--- a/drivers/hid/hid-egalax.c
+++ b/drivers/hid/hid-egalax.c
@@ -31,7 +31,7 @@ struct egalax_data {
         bool first;             /* is this the first finger in the frame? */
         bool valid;             /* valid finger data, or just placeholder? */
         bool activity;          /* at least one active finger previously? */
-        __u16 lastx, lasty;     /* latest valid (x, y) in the frame */
+        __u16 lastx, lasty, lastz;      /* latest valid (x, y, z) in the frame */
 };
 
 static int egalax_input_mapping(struct hid_device *hdev, struct hid_input *hi,
@@ -79,6 +79,10 @@ static int egalax_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                 case HID_DG_TIPPRESSURE:
                         hid_map_usage(hi, usage, bit, max,
                                         EV_ABS, ABS_MT_PRESSURE);
+                        /* touchscreen emulation */
+                        input_set_abs_params(hi->input, ABS_PRESSURE,
+                                                field->logical_minimum,
+                                                field->logical_maximum, 0, 0);
                         return 1;
                 }
                 return 0;
@@ -109,8 +113,8 @@ static void egalax_filter_event(struct egalax_data *td, struct input_dev *input)
         if (td->valid) {
                 /* emit multitouch events */
                 input_event(input, EV_ABS, ABS_MT_TRACKING_ID, td->id);
-                input_event(input, EV_ABS, ABS_MT_POSITION_X, td->x);
-                input_event(input, EV_ABS, ABS_MT_POSITION_Y, td->y);
+                input_event(input, EV_ABS, ABS_MT_POSITION_X, td->x >> 3);
+                input_event(input, EV_ABS, ABS_MT_POSITION_Y, td->y >> 3);
                 input_event(input, EV_ABS, ABS_MT_PRESSURE, td->z);
 
                 input_mt_sync(input);
@@ -121,6 +125,7 @@ static void egalax_filter_event(struct egalax_data *td, struct input_dev *input)
                  */
                 td->lastx = td->x;
                 td->lasty = td->y;
+                td->lastz = td->z;
         }
 
         /*
@@ -129,8 +134,9 @@ static void egalax_filter_event(struct egalax_data *td, struct input_dev *input)
          * the oldest on the panel, the one we want for single touch
          */
         if (!td->first && td->activity) {
-                input_event(input, EV_ABS, ABS_X, td->lastx);
-                input_event(input, EV_ABS, ABS_Y, td->lasty);
+                input_event(input, EV_ABS, ABS_X, td->lastx >> 3);
+                input_event(input, EV_ABS, ABS_Y, td->lasty >> 3);
+                input_event(input, EV_ABS, ABS_PRESSURE, td->lastz);
         }
 
         if (!td->valid) {
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index f0260c699adb..859ee7e39f5b 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -34,7 +34,6 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ALPS, USB_DEVICE_ID_IBM_GAMEPAD, HID_QUIRK_BADPAD },
         { USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD, HID_QUIRK_BADPAD },
         { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
-        { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hwmon/adm1026.c b/drivers/hwmon/adm1026.c
index 65335b268fa9..9975bbfb1b31 100644
--- a/drivers/hwmon/adm1026.c
+++ b/drivers/hwmon/adm1026.c
@@ -916,27 +916,27 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
         int nr = sensor_attr->index;
         struct i2c_client *client = to_i2c_client(dev);
         struct adm1026_data *data = i2c_get_clientdata(client);
-        int val, orig_div, new_div, shift;
+        int val, orig_div, new_div;
 
         val = simple_strtol(buf, NULL, 10);
         new_div = DIV_TO_REG(val);
-        if (new_div == 0) {
-                return -EINVAL;
-        }
+
         mutex_lock(&data->update_lock);
         orig_div = data->fan_div[nr];
         data->fan_div[nr] = DIV_FROM_REG(new_div);
 
         if (nr < 4) { /* 0 <= nr < 4 */
-                shift = 2 * nr;
                 adm1026_write_value(client, ADM1026_REG_FAN_DIV_0_3,
-                        ((DIV_TO_REG(orig_div) & (~(0x03 << shift))) |
-                        (new_div << shift)));
+                                    (DIV_TO_REG(data->fan_div[0]) << 0) |
+                                    (DIV_TO_REG(data->fan_div[1]) << 2) |
+                                    (DIV_TO_REG(data->fan_div[2]) << 4) |
+                                    (DIV_TO_REG(data->fan_div[3]) << 6));
         } else { /* 3 < nr < 8 */
-                shift = 2 * (nr - 4);
                 adm1026_write_value(client, ADM1026_REG_FAN_DIV_4_7,
-                        ((DIV_TO_REG(orig_div) & (~(0x03 << (2 * shift)))) |
-                        (new_div << shift)));
+                                    (DIV_TO_REG(data->fan_div[4]) << 0) |
+                                    (DIV_TO_REG(data->fan_div[5]) << 2) |
+                                    (DIV_TO_REG(data->fan_div[6]) << 4) |
+                                    (DIV_TO_REG(data->fan_div[7]) << 6));
         }
 
         if (data->fan_div[nr] != orig_div) {
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index b6598aa557a0..87a5fd51dd5e 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -162,6 +162,10 @@ static const char *temperature_sensors_sets[][41] = {
 /* Set 22: MacBook Pro 7,1 */
         { "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S",
           "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL },
+/* Set 23: MacBook Air 3,1 */
+        { "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3",
+          "TCZ4", "TCZ5", "TG0E", "TG1E", "TG2E", "TGZ3", "TGZ4", "TGZ5",
+          "TH0F", "TH0O", "TM0P" },
 };
 
 /* List of keys used to read/write fan speeds */
@@ -444,38 +448,22 @@ static int applesmc_read_motion_sensor(int index, s16* value)
 }
 
 /*
- * applesmc_device_init - initialize the accelerometer.  Returns zero on success
- * and negative error code on failure.  Can sleep.
+ * applesmc_device_init - initialize the accelerometer.  Can sleep.
  */
-static int applesmc_device_init(void)
+static void applesmc_device_init(void)
 {
-        int total, ret = -ENXIO;
+        int total;
         u8 buffer[2];
 
         if (!applesmc_accelerometer)
-                return 0;
+                return;
 
         mutex_lock(&applesmc_lock);
 
         for (total = INIT_TIMEOUT_MSECS; total > 0; total -= INIT_WAIT_MSECS) {
-                if (debug)
-                        printk(KERN_DEBUG "applesmc try %d\n", total);
                 if (!applesmc_read_key(MOTION_SENSOR_KEY, buffer, 2) &&
-                                (buffer[0] != 0x00 || buffer[1] != 0x00)) {
-                        if (total == INIT_TIMEOUT_MSECS) {
-                                printk(KERN_DEBUG "applesmc: device has"
-                                                " already been initialized"
-                                                " (0x%02x, 0x%02x).\n",
-                                                buffer[0], buffer[1]);
-                        } else {
-                                printk(KERN_DEBUG "applesmc: device"
-                                                " successfully initialized"
-                                                " (0x%02x, 0x%02x).\n",
-                                                buffer[0], buffer[1]);
-                        }
-                        ret = 0;
+                                (buffer[0] != 0x00 || buffer[1] != 0x00))
                         goto out;
-                }
                 buffer[0] = 0xe0;
                 buffer[1] = 0x00;
                 applesmc_write_key(MOTION_SENSOR_KEY, buffer, 2);
@@ -486,7 +474,6 @@ static int applesmc_device_init(void)
 
 out:
         mutex_unlock(&applesmc_lock);
-        return ret;
 }
 
 /*
@@ -512,13 +499,8 @@ static int applesmc_get_fan_count(void)
 /* Device model stuff */
 static int applesmc_probe(struct platform_device *dev)
 {
-        int ret;
-
-        ret = applesmc_device_init();
-        if (ret)
-                return ret;
+        applesmc_device_init();
 
-        printk(KERN_INFO "applesmc: device successfully initialized.\n");
         return 0;
 }
 
@@ -535,9 +517,7 @@ static int applesmc_pm_resume(struct device *dev)
 /* Reinitialize device on resume from hibernation */
 static int applesmc_pm_restore(struct device *dev)
 {
-        int ret = applesmc_device_init();
-        if (ret)
-                return ret;
+        applesmc_device_init();
         return applesmc_pm_resume(dev);
 }
 
@@ -1524,11 +1504,17 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
         { .accelerometer = 1, .light = 1, .temperature_set = 21 },
 /* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */
         { .accelerometer = 1, .light = 1, .temperature_set = 22 },
+/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */
+        { .accelerometer = 0, .light = 0, .temperature_set = 23 },
 };
 
 /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
  * So we need to put "Apple MacBook Pro" before "Apple MacBook". */
 static __initdata struct dmi_system_id applesmc_whitelist[] = {
+        { applesmc_dmi_match, "Apple MacBook Air 3", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") },
+                &applesmc_dmi_data[23]},
         { applesmc_dmi_match, "Apple MacBook Air 2", {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") },
diff --git a/drivers/hwmon/lm63.c b/drivers/hwmon/lm63.c
index 776aeb3019d2..508cb291f71b 100644
--- a/drivers/hwmon/lm63.c
+++ b/drivers/hwmon/lm63.c
@@ -98,6 +98,9 @@ static const unsigned short normal_i2c[] = { 0x18, 0x4c, 0x4e, I2C_CLIENT_END };
  * value, it uses signed 8-bit values with LSB = 1 degree Celsius.
  * For remote temperature, low and high limits, it uses signed 11-bit values
  * with LSB = 0.125 degree Celsius, left-justified in 16-bit registers.
+ * For LM64 the actual remote diode temperature is 16 degree Celsius higher
+ * than the register reading. Remote temperature setpoints have to be
+ * adapted accordingly.
  */
 
 #define FAN_FROM_REG(reg)       ((reg) == 0xFFFC || (reg) == 0 ? 0 : \
@@ -165,6 +168,8 @@ struct lm63_data {
         struct mutex update_lock;
         char valid; /* zero until following fields are valid */
         unsigned long last_updated; /* in jiffies */
+        int kind;
+        int temp2_offset;
 
         /* registers values */
         u8 config, config_fan;
@@ -247,16 +252,34 @@ static ssize_t show_pwm1_enable(struct device *dev, struct device_attribute *dum
         return sprintf(buf, "%d\n", data->config_fan & 0x20 ? 1 : 2);
 }
 
-static ssize_t show_temp8(struct device *dev, struct device_attribute *devattr,
-                          char *buf)
+/*
+ * There are 8bit registers for both local(temp1) and remote(temp2) sensor.
+ * For remote sensor registers temp2_offset has to be considered,
+ * for local sensor it must not.
+ * So we need separate 8bit accessors for local and remote sensor.
+ */
+static ssize_t show_local_temp8(struct device *dev,
+                                struct device_attribute *devattr,
+                                char *buf)
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
         struct lm63_data *data = lm63_update_device(dev);
         return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[attr->index]));
 }
 
-static ssize_t set_temp8(struct device *dev, struct device_attribute *dummy,
-                         const char *buf, size_t count)
+static ssize_t show_remote_temp8(struct device *dev,
+                                 struct device_attribute *devattr,
+                                 char *buf)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct lm63_data *data = lm63_update_device(dev);
+        return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[attr->index])
+                       + data->temp2_offset);
+}
+
+static ssize_t set_local_temp8(struct device *dev,
+                               struct device_attribute *dummy,
+                               const char *buf, size_t count)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct lm63_data *data = i2c_get_clientdata(client);
@@ -274,7 +297,8 @@ static ssize_t show_temp11(struct device *dev, struct device_attribute *devattr,
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
         struct lm63_data *data = lm63_update_device(dev);
-        return sprintf(buf, "%d\n", TEMP11_FROM_REG(data->temp11[attr->index]));
+        return sprintf(buf, "%d\n", TEMP11_FROM_REG(data->temp11[attr->index])
+                       + data->temp2_offset);
 }
 
 static ssize_t set_temp11(struct device *dev, struct device_attribute *devattr,
@@ -294,7 +318,7 @@ static ssize_t set_temp11(struct device *dev, struct device_attribute *devattr,
         int nr = attr->index;
 
         mutex_lock(&data->update_lock);
-        data->temp11[nr] = TEMP11_TO_REG(val);
+        data->temp11[nr] = TEMP11_TO_REG(val - data->temp2_offset);
         i2c_smbus_write_byte_data(client, reg[(nr - 1) * 2],
                                   data->temp11[nr] >> 8);
         i2c_smbus_write_byte_data(client, reg[(nr - 1) * 2 + 1],
@@ -310,6 +334,7 @@ static ssize_t show_temp2_crit_hyst(struct device *dev, struct device_attribute
 {
         struct lm63_data *data = lm63_update_device(dev);
         return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[2])
+                       + data->temp2_offset
                        - TEMP8_FROM_REG(data->temp2_crit_hyst));
 }
 
@@ -324,7 +349,7 @@ static ssize_t set_temp2_crit_hyst(struct device *dev, struct device_attribute *
         long hyst;
 
         mutex_lock(&data->update_lock);
-        hyst = TEMP8_FROM_REG(data->temp8[2]) - val;
+        hyst = TEMP8_FROM_REG(data->temp8[2]) + data->temp2_offset - val;
         i2c_smbus_write_byte_data(client, LM63_REG_REMOTE_TCRIT_HYST,
                                   HYST_TO_REG(hyst));
         mutex_unlock(&data->update_lock);
@@ -355,16 +380,21 @@ static SENSOR_DEVICE_ATTR(fan1_min, S_IWUSR | S_IRUGO, show_fan,
 static DEVICE_ATTR(pwm1, S_IWUSR | S_IRUGO, show_pwm1, set_pwm1);
 static DEVICE_ATTR(pwm1_enable, S_IRUGO, show_pwm1_enable, NULL);
 
-static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_temp8, NULL, 0);
-static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO, show_temp8,
-        set_temp8, 1);
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_local_temp8, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO, show_local_temp8,
+        set_local_temp8, 1);
 
 static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO, show_temp11, NULL, 0);
 static SENSOR_DEVICE_ATTR(temp2_min, S_IWUSR | S_IRUGO, show_temp11,
         set_temp11, 1);
 static SENSOR_DEVICE_ATTR(temp2_max, S_IWUSR | S_IRUGO, show_temp11,
         set_temp11, 2);
-static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO, show_temp8, NULL, 2);
+/*
+ * On LM63, temp2_crit can be set only once, which should be job
+ * of the bootloader.
+ */
+static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO, show_remote_temp8,
+        NULL, 2);
 static DEVICE_ATTR(temp2_crit_hyst, S_IWUSR | S_IRUGO, show_temp2_crit_hyst,
         set_temp2_crit_hyst);
 
@@ -479,7 +509,12 @@ static int lm63_probe(struct i2c_client *new_client,
         data->valid = 0;
         mutex_init(&data->update_lock);
 
-        /* Initialize the LM63 chip */
+        /* Set the device type */
+        data->kind = id->driver_data;
+        if (data->kind == lm64)
+                data->temp2_offset = 16000;
+
+        /* Initialize chip */
         lm63_init_client(new_client);
 
         /* Register sysfs hooks */
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index b3841a615595..2e8f0c9458d4 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1259,6 +1259,7 @@ static int lm85_probe(struct i2c_client *client,
         switch (data->type) {
         case adm1027:
         case adt7463:
+        case adt7468:
         case emc6d100:
         case emc6d102:
                 data->freq_map = adm1027_freq_map;
diff --git a/drivers/hwmon/via686a.c b/drivers/hwmon/via686a.c
index f397ce7ad598..b2074e3ba2f1 100644
--- a/drivers/hwmon/via686a.c
+++ b/drivers/hwmon/via686a.c
@@ -687,6 +687,13 @@ static int __devexit via686a_remove(struct platform_device *pdev)
         return 0;
 }
 
+static void via686a_update_fan_div(struct via686a_data *data)
+{
+        int reg = via686a_read_value(data, VIA686A_REG_FANDIV);
+        data->fan_div[0] = (reg >> 4) & 0x03;
+        data->fan_div[1] = reg >> 6;
+}
+
 static void __devinit via686a_init_device(struct via686a_data *data)
 {
         u8 reg;
@@ -700,6 +707,9 @@ static void __devinit via686a_init_device(struct via686a_data *data)
         via686a_write_value(data, VIA686A_REG_TEMP_MODE,
                             (reg & ~VIA686A_TEMP_MODE_MASK)
                             | VIA686A_TEMP_MODE_CONTINUOUS);
+
+        /* Pre-read fan clock divisor values */
+        via686a_update_fan_div(data);
 }
 
 static struct via686a_data *via686a_update_device(struct device *dev)
@@ -751,9 +761,7 @@ static struct via686a_data *via686a_update_device(struct device *dev)
                     (via686a_read_value(data, VIA686A_REG_TEMP_LOW23) &
                      0xc0) >> 6;
 
-                i = via686a_read_value(data, VIA686A_REG_FANDIV);
-                data->fan_div[0] = (i >> 4) & 0x03;
-                data->fan_div[1] = i >> 6;
+                via686a_update_fan_div(data);
                 data->alarms =
                     via686a_read_value(data,
                                        VIA686A_REG_ALARM1) |
diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
index 5f6d7f89e225..ace67995d7de 100644
--- a/drivers/i2c/busses/i2c-pca-platform.c
+++ b/drivers/i2c/busses/i2c-pca-platform.c
@@ -224,7 +224,7 @@ static int __devinit i2c_pca_pf_probe(struct platform_device *pdev)
 
         if (irq) {
                 ret = request_irq(irq, i2c_pca_pf_handler,
-                        IRQF_TRIGGER_FALLING, i2c->adap.name, i2c);
+                        IRQF_TRIGGER_FALLING, pdev->name, i2c);
                 if (ret)
                         goto e_reqirq;
         }
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index bea4c5021d26..c16a448dfd0d 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1005,6 +1005,14 @@ static int i2c_do_del_adapter(struct i2c_driver *driver,
 static int __unregister_client(struct device *dev, void *dummy)
 {
         struct i2c_client *client = i2c_verify_client(dev);
+        if (client && strcmp(client->name, "dummy"))
+                i2c_unregister_device(client);
+        return 0;
+}
+
+static int __unregister_dummy(struct device *dev, void *dummy)
+{
+        struct i2c_client *client = i2c_verify_client(dev);
         if (client)
                 i2c_unregister_device(client);
         return 0;
@@ -1059,8 +1067,12 @@ int i2c_del_adapter(struct i2c_adapter *adap)
         mutex_unlock(&adap->userspace_clients_lock);
 
         /* Detach any active clients. This can't fail, thus we do not
-           checking the returned value. */
+         * check the returned value. This is a two-pass process, because
+         * we can't remove the dummy devices during the first pass: they
+         * could have been instantiated by real devices wishing to clean
+         * them up properly, so we give them a chance to do that first. */
         res = device_for_each_child(&adap->dev, NULL, __unregister_client);
+        res = device_for_each_child(&adap->dev, NULL, __unregister_dummy);
 
 #ifdef CONFIG_I2C_COMPAT
         class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index c37ef64d1465..cf88588a8e80 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -276,7 +276,7 @@ static int intel_idle_probe(void)
 
         case 0x1C:      /* 28 - Atom Processor */
         case 0x26:      /* 38 - Lincroft Atom Processor */
-                lapic_timer_reliable_states = (1 << 2) | (1 << 1); /* C2, C1 */
+                lapic_timer_reliable_states = (1 << 1); /* C1 */
                 cpuidle_state_table = atom_cstates;
                 break;
 #ifdef FUTURE_USE
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 6fcfbeb24a23..abb87140f29f 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -891,68 +891,81 @@ out:
         return ret ? ret : in_len;
 }
 
+static int copy_wc_to_user(void __user *dest, struct ib_wc *wc)
+{
+        struct ib_uverbs_wc tmp;
+
+        tmp.wr_id               = wc->wr_id;
+        tmp.status              = wc->status;
+        tmp.opcode              = wc->opcode;
+        tmp.vendor_err          = wc->vendor_err;
+        tmp.byte_len            = wc->byte_len;
+        tmp.ex.imm_data         = (__u32 __force) wc->ex.imm_data;
+        tmp.qp_num              = wc->qp->qp_num;
+        tmp.src_qp              = wc->src_qp;
+        tmp.wc_flags            = wc->wc_flags;
+        tmp.pkey_index          = wc->pkey_index;
+        tmp.slid                = wc->slid;
+        tmp.sl                  = wc->sl;
+        tmp.dlid_path_bits      = wc->dlid_path_bits;
+        tmp.port_num            = wc->port_num;
+        tmp.reserved            = 0;
+
+        if (copy_to_user(dest, &tmp, sizeof tmp))
+                return -EFAULT;
+
+        return 0;
+}
+
 ssize_t ib_uverbs_poll_cq(struct ib_uverbs_file *file,
                           const char __user *buf, int in_len,
                           int out_len)
 {
         struct ib_uverbs_poll_cq       cmd;
-        struct ib_uverbs_poll_cq_resp *resp;
+        struct ib_uverbs_poll_cq_resp  resp;
+        u8 __user                     *header_ptr;
+        u8 __user                     *data_ptr;
         struct ib_cq                  *cq;
-        struct ib_wc                  *wc;
-        int                            ret = 0;
-        int                            i;
-        int                            rsize;
+        struct ib_wc                   wc;
+        int                            ret;
 
         if (copy_from_user(&cmd, buf, sizeof cmd))
                 return -EFAULT;
 
-        wc = kmalloc(cmd.ne * sizeof *wc, GFP_KERNEL);
-        if (!wc)
-                return -ENOMEM;
-
-        rsize = sizeof *resp + cmd.ne * sizeof(struct ib_uverbs_wc);
-        resp = kmalloc(rsize, GFP_KERNEL);
-        if (!resp) {
-                ret = -ENOMEM;
-                goto out_wc;
-        }
-
         cq = idr_read_cq(cmd.cq_handle, file->ucontext, 0);
-        if (!cq) {
-                ret = -EINVAL;
-                goto out;
-        }
+        if (!cq)
+                return -EINVAL;
 
-        resp->count = ib_poll_cq(cq, cmd.ne, wc);
+        /* we copy a struct ib_uverbs_poll_cq_resp to user space */
+        header_ptr = (void __user *)(unsigned long) cmd.response;
+        data_ptr = header_ptr + sizeof resp;
 
-        put_cq_read(cq);
+        memset(&resp, 0, sizeof resp);
+        while (resp.count < cmd.ne) {
+                ret = ib_poll_cq(cq, 1, &wc);
+                if (ret < 0)
+                        goto out_put;
+                if (!ret)
+                        break;
+
+                ret = copy_wc_to_user(data_ptr, &wc);
+                if (ret)
+                        goto out_put;
 
-        for (i = 0; i < resp->count; i++) {
-                resp->wc[i].wr_id          = wc[i].wr_id;
-                resp->wc[i].status         = wc[i].status;
-                resp->wc[i].opcode         = wc[i].opcode;
-                resp->wc[i].vendor_err     = wc[i].vendor_err;
-                resp->wc[i].byte_len       = wc[i].byte_len;
-                resp->wc[i].ex.imm_data    = (__u32 __force) wc[i].ex.imm_data;
-                resp->wc[i].qp_num         = wc[i].qp->qp_num;
-                resp->wc[i].src_qp         = wc[i].src_qp;
-                resp->wc[i].wc_flags       = wc[i].wc_flags;
-                resp->wc[i].pkey_index     = wc[i].pkey_index;
-                resp->wc[i].slid           = wc[i].slid;
-                resp->wc[i].sl             = wc[i].sl;
-                resp->wc[i].dlid_path_bits = wc[i].dlid_path_bits;
-                resp->wc[i].port_num       = wc[i].port_num;
+                data_ptr += sizeof(struct ib_uverbs_wc);
+                ++resp.count;
         }
 
-        if (copy_to_user((void __user *) (unsigned long) cmd.response, resp, rsize))
+        if (copy_to_user(header_ptr, &resp, sizeof resp)) {
                 ret = -EFAULT;
+                goto out_put;
+        }
 
-out:
-        kfree(resp);
+        ret = in_len;
 
-out_wc:
-        kfree(wc);
-        return ret ? ret : in_len;
+out_put:
+        put_cq_read(cq);
+        return ret;
 }
 
 ssize_t ib_uverbs_req_notify_cq(struct ib_uverbs_file *file,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 32d352a88d50..081d06110e33 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -383,7 +383,7 @@ static void send_flowc(struct c4iw_ep *ep, struct sk_buff *skb)
                                           16)) | FW_WR_FLOWID(ep->hwtid));
 
         flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
-        flowc->mnemval[0].val = cpu_to_be32(0);
+        flowc->mnemval[0].val = cpu_to_be32(PCI_FUNC(ep->com.dev->rdev.lldi.pdev->devfn) << 8);
         flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
         flowc->mnemval[1].val = cpu_to_be32(ep->tx_chan);
         flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index b95231763911..ee82851afe3e 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -55,6 +55,14 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI    0x0236
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO     0x0237
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS     0x0238
+/* MacbookAir3,2 (unibody), aka wellspring5 */
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI    0x023f
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO     0x0240
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS     0x0241
+/* MacbookAir3,1 (unibody), aka wellspring4 */
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI   0x0242
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO    0x0243
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS    0x0244
 
 #define BCM5974_DEVICE(prod) {                                  \
         .match_flags = (USB_DEVICE_ID_MATCH_DEVICE |            \
@@ -80,6 +88,14 @@ static const struct usb_device_id bcm5974_table[] = {
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI),
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_ISO),
         BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
+        /* MacbookAir3,2 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_JIS),
+        /* MacbookAir3,1 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS),
         /* Terminating entry */
         {}
 };
@@ -234,6 +250,30 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                 { DIM_X, DIM_X / SN_COORD, -4460, 5166 },
                 { DIM_Y, DIM_Y / SN_COORD, -75, 6700 }
         },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING4_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING4_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0x84, sizeof(struct bt_data),
+                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
+                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+        },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0x84, sizeof(struct bt_data),
+                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+                { DIM_X, DIM_X / SN_COORD, -4616, 5112 },
+                { DIM_Y, DIM_Y / SN_COORD, -142, 5234 }
+        },
         {}
 };
 
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index b6aa7d20d8a3..298c8e505cc2 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -51,7 +51,8 @@
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
-#define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100100)
+#define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100000) /* 1-button ClickPad */
+#define SYN_CAP_CLICKPAD2BTN(ex0c)      ((ex0c) & 0x000100) /* 2-button ClickPad */
 #define SYN_CAP_MAX_DIMENSIONS(ex0c)    ((ex0c) & 0x020000)
 
 /* synaptics modes query bits */
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index ed7ad7416b24..a0730fdd31c4 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -333,6 +333,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                 },
         },
         {
+                /* Sony Vaio VPCZ122GX */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VPCZ122GX"),
+                },
+        },
+        {
                 /* Sony Vaio FS-115b */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
@@ -413,6 +420,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                         DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
                 },
         },
+        {
+                /* Dell Vostro V13 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
+                },
+        },
         { }
 };
 
@@ -534,6 +548,17 @@ static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
 };
 #endif
 
+static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
+        {
+                /* Dell Vostro V13 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
+                },
+        },
+        { }
+};
+
 /*
  * Some Wistron based laptops need us to explicitly enable the 'Dritek
  * keyboard extension' to make their extra keys start generating scancodes.
@@ -886,6 +911,9 @@ static int __init i8042_platform_init(void)
         if (dmi_check_system(i8042_dmi_nomux_table))
                 i8042_nomux = true;
 
+        if (dmi_check_system(i8042_dmi_notimeout_table))
+                i8042_notimeout = true;
+
         if (dmi_check_system(i8042_dmi_dritek_table))
                 i8042_dritek = true;
 #endif /* CONFIG_X86 */
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index f58513160480..9e486502c03f 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -61,6 +61,10 @@ static bool i8042_noloop;
 module_param_named(noloop, i8042_noloop, bool, 0);
 MODULE_PARM_DESC(noloop, "Disable the AUX Loopback command while probing for the AUX port");
 
+static bool i8042_notimeout;
+module_param_named(notimeout, i8042_notimeout, bool, 0);
+MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
+
 #ifdef CONFIG_X86
 static bool i8042_dritek;
 module_param_named(dritek, i8042_dritek, bool, 0);
@@ -503,7 +507,7 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id)
         } else {
 
                 dfl = ((str & I8042_STR_PARITY) ? SERIO_PARITY : 0) |
-                      ((str & I8042_STR_TIMEOUT) ? SERIO_TIMEOUT : 0);
+                      ((str & I8042_STR_TIMEOUT && !i8042_notimeout) ? SERIO_TIMEOUT : 0);
 
                 port_no = (str & I8042_STR_AUXDATA) ?
                                 I8042_AUX_PORT_NO : I8042_KBD_PORT_NO;
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 707d9c94cf9e..131976d880d0 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -438,23 +438,27 @@ static void cmd_in_timeout(unsigned long data)
                 return;
         }
 
-        if (ucs->retry_cmd_in++ < BAS_RETRY) {
-                dev_notice(cs->dev, "control read: timeout, retry %d\n",
-                           ucs->retry_cmd_in);
-                rc = atread_submit(cs, BAS_TIMEOUT);
-                if (rc >= 0 || rc == -ENODEV)
-                        /* resubmitted or disconnected */
-                        /* - bypass regular exit block */
-                        return;
-        } else {
+        if (ucs->retry_cmd_in++ >= BAS_RETRY) {
                 dev_err(cs->dev,
                         "control read: timeout, giving up after %d tries\n",
                         ucs->retry_cmd_in);
+                kfree(ucs->rcvbuf);
+                ucs->rcvbuf = NULL;
+                ucs->rcvbuf_size = 0;
+                error_reset(cs);
+                return;
+        }
+
+        gig_dbg(DEBUG_USBREQ, "%s: timeout, retry %d",
+                __func__, ucs->retry_cmd_in);
+        rc = atread_submit(cs, BAS_TIMEOUT);
+        if (rc < 0) {
+                kfree(ucs->rcvbuf);
+                ucs->rcvbuf = NULL;
+                ucs->rcvbuf_size = 0;
+                if (rc != -ENODEV)
+                        error_reset(cs);
         }
-        kfree(ucs->rcvbuf);
-        ucs->rcvbuf = NULL;
-        ucs->rcvbuf_size = 0;
-        error_reset(cs);
 }
 
 /* read_ctrl_callback
@@ -470,18 +474,11 @@ static void read_ctrl_callback(struct urb *urb)
         struct cardstate *cs = inbuf->cs;
         struct bas_cardstate *ucs = cs->hw.bas;
         int status = urb->status;
-        int have_data = 0;
         unsigned numbytes;
         int rc;
 
         update_basstate(ucs, 0, BS_ATRDPEND);
         wake_up(&ucs->waitqueue);
-
-        if (!ucs->rcvbuf_size) {
-                dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
-                return;
-        }
-
         del_timer(&ucs->timer_cmd_in);
 
         switch (status) {
@@ -495,19 +492,10 @@ static void read_ctrl_callback(struct urb *urb)
                                 numbytes = ucs->rcvbuf_size;
                 }
 
-                /* copy received bytes to inbuf */
-                have_data = gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes);
-
-                if (unlikely(numbytes < ucs->rcvbuf_size)) {
-                        /* incomplete - resubmit for remaining bytes */
-                        ucs->rcvbuf_size -= numbytes;
-                        ucs->retry_cmd_in = 0;
-                        rc = atread_submit(cs, BAS_TIMEOUT);
-                        if (rc >= 0 || rc == -ENODEV)
-                                /* resubmitted or disconnected */
-                                /* - bypass regular exit block */
-                                return;
-                        error_reset(cs);
+                /* copy received bytes to inbuf, notify event layer */
+                if (gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes)) {
+                        gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
+                        gigaset_schedule_event(cs);
                 }
                 break;
 
@@ -516,37 +504,32 @@ static void read_ctrl_callback(struct urb *urb)
         case -EINPROGRESS:              /* pending */
         case -ENODEV:                   /* device removed */
         case -ESHUTDOWN:                /* device shut down */
-                /* no action necessary */
+                /* no further action necessary */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(status));
                 break;
 
-        default:                        /* severe trouble */
-                dev_warn(cs->dev, "control read: %s\n",
-                         get_usb_statmsg(status));
+        default:                        /* other errors: retry */
                 if (ucs->retry_cmd_in++ < BAS_RETRY) {
-                        dev_notice(cs->dev, "control read: retry %d\n",
-                                   ucs->retry_cmd_in);
+                        gig_dbg(DEBUG_USBREQ, "%s: %s, retry %d", __func__,
+                                get_usb_statmsg(status), ucs->retry_cmd_in);
                         rc = atread_submit(cs, BAS_TIMEOUT);
-                        if (rc >= 0 || rc == -ENODEV)
-                                /* resubmitted or disconnected */
-                                /* - bypass regular exit block */
+                        if (rc >= 0)
+                                /* successfully resubmitted, skip freeing */
                                 return;
-                } else {
-                        dev_err(cs->dev,
-                                "control read: giving up after %d tries\n",
-                                ucs->retry_cmd_in);
+                        if (rc == -ENODEV)
+                                /* disconnect, no further action necessary */
+                                break;
                 }
+                dev_err(cs->dev, "control read: %s, giving up after %d tries\n",
+                        get_usb_statmsg(status), ucs->retry_cmd_in);
                 error_reset(cs);
         }
 
+        /* read finished, free buffer */
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
-        if (have_data) {
-                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
-                gigaset_schedule_event(cs);
-        }
 }
 
 /* atread_submit
@@ -1598,13 +1581,13 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
 
         ret = starturbs(bcs);
         if (ret < 0) {
+                spin_unlock_irqrestore(&cs->lock, flags);
                 dev_err(cs->dev,
                         "could not start isochronous I/O for channel B%d: %s\n",
                         bcs->channel + 1,
                         ret == -EFAULT ? "null URB" : get_usb_rcmsg(ret));
                 if (ret != -ENODEV)
                         error_hangup(bcs);
-                spin_unlock_irqrestore(&cs->lock, flags);
                 return ret;
         }
 
@@ -1614,11 +1597,11 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
                 dev_err(cs->dev, "could not open channel B%d\n",
                         bcs->channel + 1);
                 stopurbs(bcs->hw.bas);
-                if (ret != -ENODEV)
-                        error_hangup(bcs);
         }
 
         spin_unlock_irqrestore(&cs->lock, flags);
+        if (ret < 0 && ret != -ENODEV)
+                error_hangup(bcs);
         return ret;
 }
 
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 2dfd346fc889..f39ccdf87a17 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -842,13 +842,14 @@ static inline void trans_receive(unsigned char *src, unsigned count,
 
         if (unlikely(bcs->ignore)) {
                 bcs->ignore--;
-                hdlc_flush(bcs);
                 return;
         }
         skb = bcs->rx_skb;
-        if (skb == NULL)
+        if (skb == NULL) {
                 skb = gigaset_new_rx_skb(bcs);
-        bcs->hw.bas->goodbytes += skb->len;
+                if (skb == NULL)
+                        return;
+        }
         dobytes = bcs->rx_bufsize - skb->len;
         while (count > 0) {
                 dst = skb_put(skb, count < dobytes ? count : dobytes);
@@ -860,6 +861,7 @@ static inline void trans_receive(unsigned char *src, unsigned count,
                 if (dobytes == 0) {
                         dump_bytes(DEBUG_STREAM_DUMP,
                                    "rcv data", skb->data, skb->len);
+                        bcs->hw.bas->goodbytes += skb->len;
                         gigaset_skb_rcvd(bcs, skb);
                         skb = gigaset_new_rx_skb(bcs);
                         if (skb == NULL)
diff --git a/drivers/leds/leds-ss4200.c b/drivers/leds/leds-ss4200.c
index a688293abd0b..614ebebaaa28 100644
--- a/drivers/leds/leds-ss4200.c
+++ b/drivers/leds/leds-ss4200.c
@@ -102,6 +102,7 @@ static struct dmi_system_id __initdata nas_led_whitelist[] = {
                         DMI_MATCH(DMI_PRODUCT_VERSION, "1.00.00")
                 }
         },
+        {}
 };
 
 /*
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 487ecda90ad4..406091f9692b 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -33,7 +33,6 @@ struct pgpath {
         unsigned fail_count;            /* Cumulative failure count */
 
         struct dm_path path;
-        struct work_struct deactivate_path;
         struct work_struct activate_path;
 };
 
@@ -116,7 +115,6 @@ static struct workqueue_struct *kmultipathd, *kmpath_handlerd;
 static void process_queued_ios(struct work_struct *work);
 static void trigger_event(struct work_struct *work);
 static void activate_path(struct work_struct *work);
-static void deactivate_path(struct work_struct *work);
 
 
 /*-----------------------------------------------
@@ -129,7 +127,6 @@ static struct pgpath *alloc_pgpath(void)
 
         if (pgpath) {
                 pgpath->is_active = 1;
-                INIT_WORK(&pgpath->deactivate_path, deactivate_path);
                 INIT_WORK(&pgpath->activate_path, activate_path);
         }
 
@@ -141,14 +138,6 @@ static void free_pgpath(struct pgpath *pgpath)
         kfree(pgpath);
 }
 
-static void deactivate_path(struct work_struct *work)
-{
-        struct pgpath *pgpath =
-                container_of(work, struct pgpath, deactivate_path);
-
-        blk_abort_queue(pgpath->path.dev->bdev->bd_disk->queue);
-}
-
 static struct priority_group *alloc_priority_group(void)
 {
         struct priority_group *pg;
@@ -995,7 +984,6 @@ static int fail_path(struct pgpath *pgpath)
                       pgpath->path.dev->name, m->nr_valid_paths);
 
         schedule_work(&m->trigger_event);
-        queue_work(kmultipathd, &pgpath->deactivate_path);
 
 out:
         spin_unlock_irqrestore(&m->lock, flags);
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index f9fc07d7a4b9..87e4e78790c0 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1136,11 +1136,6 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
          */
         q->limits = *limits;
 
-        if (limits->no_cluster)
-                queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
-        else
-                queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, q);
-
         if (!dm_table_supports_discards(t))
                 queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, q);
         else
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index ac384b2a6a33..a173db5fc76a 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2111,13 +2111,14 @@ static void event_callback(void *context)
         wake_up(&md->eventq);
 }
 
+/*
+ * Protected by md->suspend_lock obtained by dm_swap_table().
+ */
 static void __set_size(struct mapped_device *md, sector_t size)
 {
         set_capacity(md->disk, size);
 
-        mutex_lock(&md->bdev->bd_inode->i_mutex);
         i_size_write(md->bdev->bd_inode, (loff_t)size << SECTOR_SHIFT);
-        mutex_unlock(&md->bdev->bd_inode->i_mutex);
 }
 
 /*
diff --git a/drivers/md/md.c b/drivers/md/md.c
index f20d13e717d5..012859708a1b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -220,11 +220,14 @@ static int md_make_request(struct request_queue *q, struct bio *bio)
         mddev_t *mddev = q->queuedata;
         int rv;
         int cpu;
+        unsigned int sectors;
 
-        if (mddev == NULL || mddev->pers == NULL) {
+        if (mddev == NULL || mddev->pers == NULL
+            || !mddev->ready) {
                 bio_io_error(bio);
                 return 0;
         }
+        smp_rmb(); /* Ensure implications of  'active' are visible */
         rcu_read_lock();
         if (mddev->suspended || mddev->barrier) {
                 DEFINE_WAIT(__wait);
@@ -242,12 +245,16 @@ static int md_make_request(struct request_queue *q, struct bio *bio)
         atomic_inc(&mddev->active_io);
         rcu_read_unlock();
 
+        /*
+         * save the sectors now since our bio can
+         * go away inside make_request
+         */
+        sectors = bio_sectors(bio);
         rv = mddev->pers->make_request(mddev, bio);
 
         cpu = part_stat_lock();
         part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
-        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
-                      bio_sectors(bio));
+        part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw], sectors);
         part_stat_unlock();
 
         if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
@@ -1329,7 +1336,7 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
         md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
                        rdev->sb_page);
         md_super_wait(rdev->mddev);
-        return num_sectors / 2; /* kB for sysfs */
+        return num_sectors;
 }
 
 
@@ -1697,7 +1704,7 @@ super_1_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
         md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
                        rdev->sb_page);
         md_super_wait(rdev->mddev);
-        return num_sectors / 2; /* kB for sysfs */
+        return num_sectors;
 }
 
 static struct super_type super_types[] = {
@@ -2172,6 +2179,8 @@ repeat:
         if (!mddev->persistent) {
                 clear_bit(MD_CHANGE_CLEAN, &mddev->flags);
                 clear_bit(MD_CHANGE_DEVS, &mddev->flags);
+                if (!mddev->external)
+                        clear_bit(MD_CHANGE_PENDING, &mddev->flags);
                 wake_up(&mddev->sb_wait);
                 return;
         }
@@ -3107,7 +3116,7 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
                 char nm[20];
                 if (rdev->raid_disk < 0)
                         continue;
-                if (rdev->new_raid_disk > mddev->raid_disks)
+                if (rdev->new_raid_disk >= mddev->raid_disks)
                         rdev->new_raid_disk = -1;
                 if (rdev->new_raid_disk == rdev->raid_disk)
                         continue;
@@ -4287,9 +4296,6 @@ static int md_alloc(dev_t dev, char *name)
                 goto abort;
         mddev->queue->queuedata = mddev;
 
-        /* Can be unlocked because the queue is new: no concurrency */
-        queue_flag_set_unlocked(QUEUE_FLAG_CLUSTER, mddev->queue);
-
         blk_queue_make_request(mddev->queue, md_make_request);
 
         disk = alloc_disk(1 << shift);
@@ -4555,7 +4561,8 @@ int md_run(mddev_t *mddev)
         mddev->safemode_timer.data = (unsigned long) mddev;
         mddev->safemode_delay = (200 * HZ)/1000 +1; /* 200 msec delay */
         mddev->in_sync = 1;
-
+        smp_wmb();
+        mddev->ready = 1;
         list_for_each_entry(rdev, &mddev->disks, same_set)
                 if (rdev->raid_disk >= 0) {
                         char nm[20];
@@ -4717,6 +4724,7 @@ EXPORT_SYMBOL_GPL(md_stop_writes);
 
 void md_stop(mddev_t *mddev)
 {
+        mddev->ready = 0;
         mddev->pers->stop(mddev);
         if (mddev->pers->sync_request && mddev->to_remove == NULL)
                 mddev->to_remove = &md_redundancy_group;
@@ -5148,17 +5156,21 @@ static int add_new_disk(mddev_t * mddev, mdu_disk_info_t *info)
                                 PTR_ERR(rdev));
                         return PTR_ERR(rdev);
                 }
-                /* set save_raid_disk if appropriate */
+                /* set saved_raid_disk if appropriate */
                 if (!mddev->persistent) {
                         if (info->state & (1<<MD_DISK_SYNC)  &&
-                            info->raid_disk < mddev->raid_disks)
+                            info->raid_disk < mddev->raid_disks) {
                                 rdev->raid_disk = info->raid_disk;
-                        else
+                                set_bit(In_sync, &rdev->flags);
+                        } else
                                 rdev->raid_disk = -1;
                 } else
                         super_types[mddev->major_version].
                                 validate_super(mddev, rdev);
-                rdev->saved_raid_disk = rdev->raid_disk;
+                if (test_bit(In_sync, &rdev->flags))
+                        rdev->saved_raid_disk = rdev->raid_disk;
+                else
+                        rdev->saved_raid_disk = -1;
 
                 clear_bit(In_sync, &rdev->flags); /* just to be sure */
                 if (info->state & (1<<MD_DISK_WRITEMOSTLY))
@@ -6036,8 +6048,8 @@ static int md_thread(void * arg)
                          thread->timeout);
 
                 clear_bit(THREAD_WAKEUP, &thread->flags);
-
-                thread->run(thread->mddev);
+                if (!kthread_should_stop())
+                        thread->run(thread->mddev);
         }
 
         return 0;
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 3931299788dc..563ede31d5fc 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -149,7 +149,8 @@ struct mddev_s
                                                        * are happening, so run/
                                                        * takeover/stop are not safe
                                                        */
-
+        int                             ready; /* See when safe to pass
+                                                * IO requests down */
         struct gendisk                  *gendisk;
 
         struct kobject                  kobj;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 0b830bbe1d8b..d8b2d7b0c3be 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1210,6 +1210,7 @@ static int raid1_remove_disk(mddev_t *mddev, int number)
                  * is not possible.
                  */
                 if (!test_bit(Faulty, &rdev->flags) &&
+                    !mddev->recovery_disabled &&
                     mddev->degraded < conf->raid_disks) {
                         err = -EBUSY;
                         goto abort;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 84718383124d..838c275fd3c8 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2396,13 +2396,13 @@ static int run(mddev_t *mddev)
         return 0;
 
 out_free_conf:
+        md_unregister_thread(mddev->thread);
         if (conf->r10bio_pool)
                 mempool_destroy(conf->r10bio_pool);
         safe_put_page(conf->tmppage);
         kfree(conf->mirrors);
         kfree(conf);
         mddev->private = NULL;
-        md_unregister_thread(mddev->thread);
 out:
         return -EIO;
 }
diff --git a/drivers/media/common/saa7146_hlp.c b/drivers/media/common/saa7146_hlp.c
index 05bde9ccb770..1d1d8d200755 100644
--- a/drivers/media/common/saa7146_hlp.c
+++ b/drivers/media/common/saa7146_hlp.c
@@ -558,7 +558,7 @@ static void saa7146_set_window(struct saa7146_dev *dev, int width, int height, e
 static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int w_height, enum v4l2_field field, u32 pixelformat)
 {
         struct saa7146_vv *vv = dev->vv_data;
-        struct saa7146_format *sfmt = format_by_fourcc(dev, pixelformat);
+        struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev, pixelformat);
 
         int b_depth = vv->ov_fmt->depth;
         int b_bpl = vv->ov_fb.fmt.bytesperline;
@@ -702,7 +702,7 @@ static int calculate_video_dma_grab_packed(struct saa7146_dev* dev, struct saa71
         struct saa7146_vv *vv = dev->vv_data;
         struct saa7146_video_dma vdma1;
 
-        struct saa7146_format *sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+        struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
 
         int width = buf->fmt->width;
         int height = buf->fmt->height;
@@ -827,7 +827,7 @@ static int calculate_video_dma_grab_planar(struct saa7146_dev* dev, struct saa71
         struct saa7146_video_dma vdma2;
         struct saa7146_video_dma vdma3;
 
-        struct saa7146_format *sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+        struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
 
         int width = buf->fmt->width;
         int height = buf->fmt->height;
@@ -994,7 +994,7 @@ static void program_capture_engine(struct saa7146_dev *dev, int planar)
 
 void saa7146_set_capture(struct saa7146_dev *dev, struct saa7146_buf *buf, struct saa7146_buf *next)
 {
-        struct saa7146_format *sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+        struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
         struct saa7146_vv *vv = dev->vv_data;
         u32 vdma1_prot_addr;
 
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index a212a91a30f0..5f01da182aff 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -84,7 +84,7 @@ static struct saa7146_format formats[] = {
 
 static int NUM_FORMATS = sizeof(formats)/sizeof(struct saa7146_format);
 
-struct saa7146_format* format_by_fourcc(struct saa7146_dev *dev, int fourcc)
+struct saa7146_format* saa7146_format_by_fourcc(struct saa7146_dev *dev, int fourcc)
 {
         int i, j = NUM_FORMATS;
 
@@ -266,7 +266,7 @@ static int saa7146_pgtable_build(struct saa7146_dev *dev, struct saa7146_buf *bu
         struct videobuf_dmabuf *dma=videobuf_to_dma(&buf->vb);
         struct scatterlist *list = dma->sglist;
         int length = dma->sglen;
-        struct saa7146_format *sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+        struct saa7146_format *sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
 
         DEB_EE(("dev:%p, buf:%p, sg_len:%d\n",dev,buf,length));
 
@@ -408,7 +408,7 @@ static int video_begin(struct saa7146_fh *fh)
                 }
         }
 
-        fmt = format_by_fourcc(dev,fh->video_fmt.pixelformat);
+        fmt = saa7146_format_by_fourcc(dev,fh->video_fmt.pixelformat);
         /* we need to have a valid format set here */
         BUG_ON(NULL == fmt);
 
@@ -460,7 +460,7 @@ static int video_end(struct saa7146_fh *fh, struct file *file)
                 return -EBUSY;
         }
 
-        fmt = format_by_fourcc(dev,fh->video_fmt.pixelformat);
+        fmt = saa7146_format_by_fourcc(dev,fh->video_fmt.pixelformat);
         /* we need to have a valid format set here */
         BUG_ON(NULL == fmt);
 
@@ -536,7 +536,7 @@ static int vidioc_s_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *f
                 return -EPERM;
 
         /* check args */
-        fmt = format_by_fourcc(dev, fb->fmt.pixelformat);
+        fmt = saa7146_format_by_fourcc(dev, fb->fmt.pixelformat);
         if (NULL == fmt)
                 return -EINVAL;
 
@@ -760,7 +760,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *fh, struct v4l2_forma
 
         DEB_EE(("V4L2_BUF_TYPE_VIDEO_CAPTURE: dev:%p, fh:%p\n", dev, fh));
 
-        fmt = format_by_fourcc(dev, f->fmt.pix.pixelformat);
+        fmt = saa7146_format_by_fourcc(dev, f->fmt.pix.pixelformat);
         if (NULL == fmt)
                 return -EINVAL;
 
@@ -1264,7 +1264,7 @@ static int buffer_prepare(struct videobuf_queue *q,
                 buf->fmt       = &fh->video_fmt;
                 buf->vb.field  = fh->video_fmt.field;
 
-                sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
+                sfmt = saa7146_format_by_fourcc(dev,buf->fmt->pixelformat);
 
                 release_all_pagetables(dev, buf);
                 if( 0 != IS_PLANAR(sfmt->trans)) {
@@ -1378,7 +1378,7 @@ static int video_open(struct saa7146_dev *dev, struct file *file)
         fh->video_fmt.pixelformat = V4L2_PIX_FMT_BGR24;
         fh->video_fmt.bytesperline = 0;
         fh->video_fmt.field = V4L2_FIELD_ANY;
-        sfmt = format_by_fourcc(dev,fh->video_fmt.pixelformat);
+        sfmt = saa7146_format_by_fourcc(dev,fh->video_fmt.pixelformat);
         fh->video_fmt.sizeimage = (fh->video_fmt.width * fh->video_fmt.height * sfmt->depth)/8;
 
         videobuf_queue_sg_init(&fh->video_q, &video_qops,
diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
index 5bf4985daede..19448144eb3a 100644
--- a/drivers/media/radio/radio-aimslab.c
+++ b/drivers/media/radio/radio-aimslab.c
@@ -31,7 +31,6 @@
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
 #include <linux/ioport.h>       /* request_region               */
-#include <linux/delay.h>        /* udelay                       */
 #include <linux/videodev2.h>    /* kernel radio structs         */
 #include <linux/version.h>      /* for KERNEL_VERSION MACRO     */
 #include <linux/io.h>           /* outb, outb_p                 */
@@ -71,27 +70,17 @@ static struct rtrack rtrack_card;
 
 /* local things */
 
-static void sleep_delay(long n)
-{
-        /* Sleep nicely for 'n' uS */
-        int d = n / msecs_to_jiffies(1000);
-        if (!d)
-                udelay(n);
-        else
-                msleep(jiffies_to_msecs(d));
-}
-
 static void rt_decvol(struct rtrack *rt)
 {
         outb(0x58, rt->io);             /* volume down + sigstr + on    */
-        sleep_delay(100000);
+        msleep(100);
         outb(0xd8, rt->io);             /* volume steady + sigstr + on  */
 }
 
 static void rt_incvol(struct rtrack *rt)
 {
         outb(0x98, rt->io);             /* volume up + sigstr + on      */
-        sleep_delay(100000);
+        msleep(100);
         outb(0xd8, rt->io);             /* volume steady + sigstr + on  */
 }
 
@@ -120,7 +109,7 @@ static int rt_setvol(struct rtrack *rt, int vol)
 
         if (vol == 0) {                 /* volume = 0 means mute the card */
                 outb(0x48, rt->io);     /* volume down but still "on"   */
-                sleep_delay(2000000);   /* make sure it's totally down  */
+                msleep(2000);   /* make sure it's totally down  */
                 outb(0xd0, rt->io);     /* volume steady, off           */
                 rt->curvol = 0;         /* track the volume state!      */
                 mutex_unlock(&rt->lock);
@@ -155,7 +144,7 @@ static void send_0_byte(struct rtrack *rt)
                 outb_p(128+64+16+8+  1, rt->io);  /* on + wr-enable + data low */
                 outb_p(128+64+16+8+2+1, rt->io);  /* clock */
         }
-        sleep_delay(1000);
+        msleep(1);
 }
 
 static void send_1_byte(struct rtrack *rt)
@@ -169,7 +158,7 @@ static void send_1_byte(struct rtrack *rt)
                 outb_p(128+64+16+8+4+2+1, rt->io); /* clock */
         }
 
-        sleep_delay(1000);
+        msleep(1);
 }
 
 static int rt_setfreq(struct rtrack *rt, unsigned long freq)
@@ -427,7 +416,7 @@ static int __init rtrack_init(void)
 
         /* this ensures that the volume is all the way down  */
         outb(0x48, rt->io);             /* volume down but still "on"   */
-        sleep_delay(2000000);   /* make sure it's totally down  */
+        msleep(2000);   /* make sure it's totally down  */
         outb(0xc0, rt->io);             /* steady volume, mute card     */
 
         return 0;
diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
index f6b62e7398af..11c987eb6df9 100644
--- a/drivers/media/video/cx23885/cx23885-core.c
+++ b/drivers/media/video/cx23885/cx23885-core.c
@@ -815,6 +815,7 @@ static void cx23885_dev_checkrevision(struct cx23885_dev *dev)
         case 0x0e:
                 /* CX23887-15Z */
                 dev->hwrevision = 0xc0;
+                break;
         case 0x0f:
                 /* CX23887-14Z */
                 dev->hwrevision = 0xb1;
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index e7efb4bffabd..6e80376b8410 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -1621,11 +1621,11 @@ struct em28xx_board em28xx_boards[] = {
                 .input           = { {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = SAA7115_COMPOSITE0,
-                        .amux     = EM28XX_AMUX_VIDEO2,
+                        .amux     = EM28XX_AMUX_LINE_IN,
                 }, {
                         .type     = EM28XX_VMUX_SVIDEO,
                         .vmux     = SAA7115_SVIDEO3,
-                        .amux     = EM28XX_AMUX_VIDEO2,
+                        .amux     = EM28XX_AMUX_LINE_IN,
                 } },
         },
         [EM2860_BOARD_TERRATEC_AV350] = {
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 78abc1c1f9d5..a50bf65de06e 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -652,7 +652,7 @@ static struct usb_host_endpoint *get_ep(struct gspca_dev *gspca_dev)
                                    : USB_ENDPOINT_XFER_ISOC;
         i = gspca_dev->alt;                     /* previous alt setting */
         if (gspca_dev->cam.reverse_alts) {
-                if (gspca_dev->audio)
+                if (gspca_dev->audio && i < gspca_dev->nbalt - 2)
                         i++;
                 while (++i < gspca_dev->nbalt) {
                         ep = alt_xfer(&intf->altsetting[i], xfer);
@@ -660,7 +660,7 @@ static struct usb_host_endpoint *get_ep(struct gspca_dev *gspca_dev)
                                 break;
                 }
         } else {
-                if (gspca_dev->audio)
+                if (gspca_dev->audio && i > 1)
                         i--;
                 while (--i >= 0) {
                         ep = alt_xfer(&intf->altsetting[i], xfer);
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index 370544361be2..248c2e62b278 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -56,6 +56,7 @@ struct sd {
         u8 jpegqual;                    /* webcam quality */
 
         u8 reg18;
+        u8 flags;
 
         s8 ag_cnt;
 #define AG_CNT_START 13
@@ -87,6 +88,9 @@ enum sensors {
         SENSOR_SP80708,
 };
 
+/* device flags */
+#define PDN_INV 1               /* inverse pin S_PWR_DN / sn_xxx tables */
+
 /* V4L2 controls supported by the driver */
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val);
@@ -1777,7 +1781,8 @@ static int sd_config(struct gspca_dev *gspca_dev,
         struct cam *cam;
 
         sd->bridge = id->driver_info >> 16;
-        sd->sensor = id->driver_info;
+        sd->sensor = id->driver_info >> 8;
+        sd->flags = id->driver_info;
 
         cam = &gspca_dev->cam;
         if (sd->sensor == SENSOR_ADCM1700) {
@@ -2474,8 +2479,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
                 reg1 = 0x44;
                 reg17 = 0xa2;
                 break;
-        default:
-/*      case SENSOR_SP80708: */
+        case SENSOR_SP80708:
                 init = sp80708_sensor_param1;
                 if (mode) {
 /*??                    reg1 = 0x04;     * 320 clk 48Mhz */
@@ -2985,14 +2989,18 @@ static const struct sd_desc sd_desc = {
 /* -- module initialisation -- */
 #define BS(bridge, sensor) \
         .driver_info = (BRIDGE_ ## bridge << 16) \
-                        | SENSOR_ ## sensor
+                        | (SENSOR_ ## sensor << 8)
+#define BSF(bridge, sensor, flags) \
+        .driver_info = (BRIDGE_ ## bridge << 16) \
+                        | (SENSOR_ ## sensor << 8) \
+                        | (flags)
 static const __devinitdata struct usb_device_id device_table[] = {
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
         {USB_DEVICE(0x0458, 0x7025), BS(SN9C120, MI0360)},
         {USB_DEVICE(0x0458, 0x702e), BS(SN9C120, OV7660)},
 #endif
-        {USB_DEVICE(0x045e, 0x00f5), BS(SN9C105, OV7660)},
-        {USB_DEVICE(0x045e, 0x00f7), BS(SN9C105, OV7660)},
+        {USB_DEVICE(0x045e, 0x00f5), BSF(SN9C105, OV7660, PDN_INV)},
+        {USB_DEVICE(0x045e, 0x00f7), BSF(SN9C105, OV7660, PDN_INV)},
         {USB_DEVICE(0x0471, 0x0327), BS(SN9C105, MI0360)},
         {USB_DEVICE(0x0471, 0x0328), BS(SN9C105, MI0360)},
         {USB_DEVICE(0x0471, 0x0330), BS(SN9C105, MI0360)},
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index 4863a21b1f24..93f795960a94 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -157,6 +157,7 @@ int hdpvr_alloc_buffers(struct hdpvr_device *dev, uint count)
                                   mem, dev->bulk_in_size,
                                   hdpvr_read_bulk_callback, buf);
 
+                buf->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
                 buf->status = BUFSTAT_AVAILABLE;
                 list_add_tail(&buf->buff_list, &dev->free_buff_list);
         }
diff --git a/drivers/media/video/msp3400-driver.c b/drivers/media/video/msp3400-driver.c
index 0e412131da7c..4897d90f6a25 100644
--- a/drivers/media/video/msp3400-driver.c
+++ b/drivers/media/video/msp3400-driver.c
@@ -382,7 +382,12 @@ static int msp_s_ctrl(struct v4l2_ctrl *ctrl)
 
 void msp_update_volume(struct msp_state *state)
 {
-        v4l2_ctrl_s_ctrl(state->volume, v4l2_ctrl_g_ctrl(state->volume));
+        /* Force an update of the volume/mute cluster */
+        v4l2_ctrl_lock(state->volume);
+        state->volume->val = state->volume->cur.val;
+        state->muted->val = state->muted->cur.val;
+        msp_s_ctrl(state->volume);
+        v4l2_ctrl_unlock(state->volume);
 }
 
 /* --- v4l2 ioctls --- */
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c
index b6ea67221d1d..15cb5b3f8ac2 100644
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -791,8 +791,6 @@ static int mx2_camera_set_bus_param(struct soc_camera_device *icd,
 
         if (common_flags & SOCAM_PCLK_SAMPLE_RISING)
                 csicr1 |= CSICR1_REDGE;
-        if (common_flags & SOCAM_PCLK_SAMPLE_FALLING)
-                csicr1 |= CSICR1_INV_PCLK;
         if (common_flags & SOCAM_VSYNC_ACTIVE_HIGH)
                 csicr1 |= CSICR1_SOF_POL;
         if (common_flags & SOCAM_HSYNC_ACTIVE_HIGH)
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index bb8d83d8ddaf..7c74751d299e 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -6661,6 +6661,18 @@ struct pci_device_id saa7134_pci_tbl[] = {
                 .subdevice    = 0x2804,
                 .driver_data  = SAA7134_BOARD_TECHNOTREND_BUDGET_T3000,
         }, {
+                .vendor       = PCI_VENDOR_ID_PHILIPS,
+                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
+                .subvendor    = 0x5ace, /* Beholder Intl. Ltd. */
+                .subdevice    = 0x7190,
+                .driver_data  = SAA7134_BOARD_BEHOLD_H7,
+        }, {
+                .vendor       = PCI_VENDOR_ID_PHILIPS,
+                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
+                .subvendor    = 0x5ace, /* Beholder Intl. Ltd. */
+                .subdevice    = 0x7090,
+                .driver_data  = SAA7134_BOARD_BEHOLD_A7,
+        }, {
                 /* --- boards without eeprom + subsystem ID --- */
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7134,
@@ -6698,18 +6710,6 @@ struct pci_device_id saa7134_pci_tbl[] = {
                 .subvendor    = PCI_ANY_ID,
                 .subdevice    = PCI_ANY_ID,
                 .driver_data  = SAA7134_BOARD_UNKNOWN,
-        }, {
-                .vendor       = PCI_VENDOR_ID_PHILIPS,
-                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
-                .subvendor    = 0x5ace, /* Beholder Intl. Ltd. */
-                .subdevice    = 0x7190,
-                .driver_data  = SAA7134_BOARD_BEHOLD_H7,
-        }, {
-                .vendor       = PCI_VENDOR_ID_PHILIPS,
-                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
-                .subvendor    = 0x5ace, /* Beholder Intl. Ltd. */
-                .subdevice    = 0x7090,
-                .driver_data  = SAA7134_BOARD_BEHOLD_A7,
         },{
                 /* --- end of list --- */
         }
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index 1e7aaaf6cc6f..b5347167aa72 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -1464,7 +1464,11 @@ static int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
                 dev_err(wm831x->dev, "Failed to read parent ID: %d\n", ret);
                 goto err;
         }
-        if (ret != 0x6204) {
+        switch (ret) {
+        case 0x6204:
+        case 0x6246:
+                break;
+        default:
                 dev_err(wm831x->dev, "Device is not a WM831x: ID %x\n", ret);
                 ret = -EINVAL;
                 goto err;
@@ -1617,7 +1621,7 @@ static int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
         case WM8321:
                 ret = mfd_add_devices(wm831x->dev, -1,
                                       wm8320_devs, ARRAY_SIZE(wm8320_devs),
-                                      NULL, 0);
+                                      NULL, wm831x->irq_base);
                 break;
 
         default:
diff --git a/drivers/misc/ad525x_dpot-spi.c b/drivers/misc/ad525x_dpot-spi.c
index b8c6df9c8437..6cfcb636577a 100644
--- a/drivers/misc/ad525x_dpot-spi.c
+++ b/drivers/misc/ad525x_dpot-spi.c
@@ -53,13 +53,13 @@ static int write8(void *client, u8 val)
 static int write16(void *client, u8 reg, u8 val)
 {
         u8 data[2] = {reg, val};
-        return spi_write(client, data, 1);
+        return spi_write(client, data, 2);
 }
 
 static int write24(void *client, u8 reg, u16 val)
 {
         u8 data[3] = {reg, val >> 8, val};
-        return spi_write(client, data, 1);
+        return spi_write(client, data, 3);
 }
 
 static int read8(void *client)
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index d551f09ccb79..6956f7e7d439 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -439,18 +439,23 @@ xpc_discovery(void)
          * nodes that can comprise an access protection grouping. The access
          * protection is in regards to memory, IOI and IPI.
          */
-        max_regions = 64;
         region_size = xp_region_size;
 
-        switch (region_size) {
-        case 128:
-                max_regions *= 2;
-        case 64:
-                max_regions *= 2;
-        case 32:
-                max_regions *= 2;
-                region_size = 16;
-                DBUG_ON(!is_shub2());
+        if (is_uv())
+                max_regions = 256;
+        else {
+                max_regions = 64;
+
+                switch (region_size) {
+                case 128:
+                        max_regions *= 2;
+                case 64:
+                        max_regions *= 2;
+                case 32:
+                        max_regions *= 2;
+                        region_size = 16;
+                        DBUG_ON(!is_shub2());
+                }
         }
 
         for (region = 0; region < max_regions; region++) {
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index 1f59ee2226ca..17bbacb1b4b1 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -417,6 +417,7 @@ xpc_process_activate_IRQ_rcvd_uv(void)
 static void
 xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
                               struct xpc_activate_mq_msghdr_uv *msg_hdr,
+                              int part_setup,
                               int *wakeup_hb_checker)
 {
         unsigned long irq_flags;
@@ -481,6 +482,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREQUEST_UV: {
                 struct xpc_activate_mq_msg_chctl_closerequest_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                    xpc_activate_mq_msg_chctl_closerequest_uv,
                                    hdr);
@@ -497,6 +501,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREPLY_UV: {
                 struct xpc_activate_mq_msg_chctl_closereply_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                    xpc_activate_mq_msg_chctl_closereply_uv,
                                    hdr);
@@ -511,6 +518,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREQUEST_UV: {
                 struct xpc_activate_mq_msg_chctl_openrequest_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                    xpc_activate_mq_msg_chctl_openrequest_uv,
                                    hdr);
@@ -528,6 +538,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREPLY_UV: {
                 struct xpc_activate_mq_msg_chctl_openreply_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                    xpc_activate_mq_msg_chctl_openreply_uv, hdr);
                 args = &part->remote_openclose_args[msg->ch_number];
@@ -545,6 +558,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENCOMPLETE_UV: {
                 struct xpc_activate_mq_msg_chctl_opencomplete_uv *msg;
 
+                if (!part_setup)
+                        break;
+
                 msg = container_of(msg_hdr, struct
                                 xpc_activate_mq_msg_chctl_opencomplete_uv, hdr);
                 spin_lock_irqsave(&part->chctl_lock, irq_flags);
@@ -621,6 +637,7 @@ xpc_handle_activate_IRQ_uv(int irq, void *dev_id)
 
                         part_referenced = xpc_part_ref(part);
                         xpc_handle_activate_mq_msg_uv(part, msg_hdr,
+                                                      part_referenced,
                                                       &wakeup_hb_checker);
                         if (part_referenced)
                                 xpc_part_deref(part);
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 09eee6df0653..994454295184 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1514,7 +1514,7 @@ void mmc_stop_host(struct mmc_host *host)
 
         if (host->caps & MMC_CAP_DISABLE)
                 cancel_delayed_work(&host->disable);
-        cancel_delayed_work(&host->detect);
+        cancel_delayed_work_sync(&host->detect);
         mmc_flush_scheduled_work();
 
         /* clear pm flags now and let card drivers set them as needed */
@@ -1720,6 +1720,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
 
         case PM_POST_SUSPEND:
         case PM_POST_HIBERNATION:
+        case PM_POST_RESTORE:
 
                 spin_lock_irqsave(&host->lock, flags);
                 host->rescan_disable = 0;
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index 87226cd202a5..57bb421ba1b2 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -69,6 +69,7 @@
 #include <linux/highmem.h>
 
 #include <linux/mmc/host.h>
+#include <linux/mmc/sdio.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -493,10 +494,14 @@ static void at91_mci_send_command(struct at91mci_host *host, struct mmc_command
                 else if (data->flags & MMC_DATA_WRITE)
                         cmdr |= AT91_MCI_TRCMD_START;
 
-                if (data->flags & MMC_DATA_STREAM)
-                        cmdr |= AT91_MCI_TRTYP_STREAM;
-                if (data->blocks > 1)
-                        cmdr |= AT91_MCI_TRTYP_MULTIPLE;
+                if (cmd->opcode == SD_IO_RW_EXTENDED) {
+                        cmdr |= AT91_MCI_TRTYP_SDIO_BLOCK;
+                } else {
+                        if (data->flags & MMC_DATA_STREAM)
+                                cmdr |= AT91_MCI_TRTYP_STREAM;
+                        if (data->blocks > 1)
+                                cmdr |= AT91_MCI_TRTYP_MULTIPLE;
+                }
         }
         else {
                 block_length = 0;
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 95ef864ad8f9..3a569bfe3886 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -26,6 +26,7 @@
 #include <linux/stat.h>
 
 #include <linux/mmc/host.h>
+#include <linux/mmc/sdio.h>
 
 #include <mach/atmel-mci.h>
 #include <linux/atmel-mci.h>
@@ -532,12 +533,17 @@ static u32 atmci_prepare_command(struct mmc_host *mmc,
         data = cmd->data;
         if (data) {
                 cmdr |= MCI_CMDR_START_XFER;
-                if (data->flags & MMC_DATA_STREAM)
-                        cmdr |= MCI_CMDR_STREAM;
-                else if (data->blocks > 1)
-                        cmdr |= MCI_CMDR_MULTI_BLOCK;
-                else
-                        cmdr |= MCI_CMDR_BLOCK;
+
+                if (cmd->opcode == SD_IO_RW_EXTENDED) {
+                        cmdr |= MCI_CMDR_SDIO_BLOCK;
+                } else {
+                        if (data->flags & MMC_DATA_STREAM)
+                                cmdr |= MCI_CMDR_STREAM;
+                        else if (data->blocks > 1)
+                                cmdr |= MCI_CMDR_MULTI_BLOCK;
+                        else
+                                cmdr |= MCI_CMDR_BLOCK;
+                }
 
                 if (data->flags & MMC_DATA_READ)
                         cmdr |= MCI_CMDR_TRDIR_READ;
diff --git a/drivers/mmc/host/bfin_sdh.c b/drivers/mmc/host/bfin_sdh.c
index 4b0e677d7295..5164edfeabdd 100644
--- a/drivers/mmc/host/bfin_sdh.c
+++ b/drivers/mmc/host/bfin_sdh.c
@@ -462,7 +462,7 @@ static int __devinit sdh_probe(struct platform_device *pdev)
                 goto out;
         }
 
-        mmc = mmc_alloc_host(sizeof(*mmc), &pdev->dev);
+        mmc = mmc_alloc_host(sizeof(struct sdh_host), &pdev->dev);
         if (!mmc) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 4a4f6b81e32d..70609eefc2de 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -490,13 +490,11 @@ static inline unsigned int cp_rx_csum_ok (u32 status)
 {
         unsigned int protocol = (status >> 16) & 0x3;
 
-        if (likely((protocol == RxProtoTCP) && (!(status & TCPFail))))
+        if (((protocol == RxProtoTCP) && !(status & TCPFail)) ||
+            ((protocol == RxProtoUDP) && !(status & UDPFail)))
                 return 1;
-        else if ((protocol == RxProtoUDP) && (!(status & UDPFail)))
-                return 1;
-        else if ((protocol == RxProtoIP) && (!(status & IPFail)))
-                return 1;
-        return 0;
+        else
+                return 0;
 }
 
 static int cp_rx_poll(struct napi_struct *napi, int budget)
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index c73be2848319..67f75c17919c 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -3503,6 +3503,8 @@ static int atl1_set_ringparam(struct net_device *netdev,
         struct atl1_rfd_ring rfd_old, rfd_new;
         struct atl1_rrd_ring rrd_old, rrd_new;
         struct atl1_ring_header rhdr_old, rhdr_new;
+        struct atl1_smb smb;
+        struct atl1_cmb cmb;
         int err;
 
         tpd_old = adapter->tpd_ring;
@@ -3543,11 +3545,19 @@ static int atl1_set_ringparam(struct net_device *netdev,
                 adapter->rrd_ring = rrd_old;
                 adapter->tpd_ring = tpd_old;
                 adapter->ring_header = rhdr_old;
+                /*
+                 * Save SMB and CMB, since atl1_free_ring_resources
+                 * will clear them.
+                 */
+                smb = adapter->smb;
+                cmb = adapter->cmb;
                 atl1_free_ring_resources(adapter);
                 adapter->rfd_ring = rfd_new;
                 adapter->rrd_ring = rrd_new;
                 adapter->tpd_ring = tpd_new;
                 adapter->ring_header = rhdr_new;
+                adapter->smb = smb;
+                adapter->cmb = cmb;
 
                 err = atl1_up(adapter);
                 if (err)
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 34abcc9403d6..dc913b986795 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1179,7 +1179,7 @@ int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
 
                 i = 0;
                 netdev_for_each_mc_addr(ha, netdev)
-                        memcpy(req->mac[i].byte, ha->addr, ETH_ALEN);
+                        memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN);
         } else {
                 req->promiscuous = 1;
         }
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index c6fdd851579a..c867cf901f9f 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -240,11 +240,11 @@ static inline struct slave *bond_get_slave_by_dev(struct bonding *bond, struct n
 
         bond_for_each_slave(bond, slave, i) {
                 if (slave->dev == slave_dev) {
-                        break;
+                        return slave;
                 }
         }
 
-        return slave;
+        return 0;
 }
 
 static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 5cc39ed289c6..71324286b1e7 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.21-k6-NAPI"
+#define DRV_VERSION "7.3.21-k8-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -483,9 +483,6 @@ void e1000_down(struct e1000_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
         u32 rctl, tctl;
 
-        /* signal that we're down so the interrupt handler does not
-         * reschedule our watchdog timer */
-        set_bit(__E1000_DOWN, &adapter->flags);
 
         /* disable receives in the hardware */
         rctl = er32(RCTL);
@@ -506,6 +503,13 @@ void e1000_down(struct e1000_adapter *adapter)
 
         e1000_irq_disable(adapter);
 
+        /*
+         * Setting DOWN must be after irq_disable to prevent
+         * a screaming interrupt.  Setting DOWN also prevents
+         * timers and tasks from rescheduling.
+         */
+        set_bit(__E1000_DOWN, &adapter->flags);
+
         del_timer_sync(&adapter->tx_fifo_stall_timer);
         del_timer_sync(&adapter->watchdog_timer);
         del_timer_sync(&adapter->phy_info_timer);
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index cce32d43175f..52e9ca8de4b2 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -651,8 +651,8 @@ static int fec_enet_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
         fep->mii_timeout = 0;
         init_completion(&fep->mdio_done);
 
-        /* start a read op */
-        writel(FEC_MMFR_ST | FEC_MMFR_OP_READ |
+        /* start a write op */
+        writel(FEC_MMFR_ST | FEC_MMFR_OP_WRITE |
                 FEC_MMFR_PA(mii_id) | FEC_MMFR_RA(regnum) |
                 FEC_MMFR_TA | FEC_MMFR_DATA(value),
                 fep->hwp + FEC_MII_DATA);
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index ab9f675c5b8b..fe337bd121aa 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -104,6 +104,8 @@ static void ri_tasklet(unsigned long dev)
                         rcu_read_unlock();
                         dev_kfree_skb(skb);
                         stats->tx_dropped++;
+                        if (skb_queue_len(&dp->tq) != 0)
+                                goto resched;
                         break;
                 }
                 rcu_read_unlock();
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e32af434cc9d..0e7f086d28db 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2651,9 +2651,16 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         int rx_buf_len;
 
         /* Decide whether to use packet split mode or not */
+        /* On by default */
+        adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+
         /* Do not use packet split if we're in SR-IOV Mode */
-        if (!adapter->num_vfs)
-                adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+        if (adapter->num_vfs)
+                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
+
+        /* Disable packet split due to 82599 erratum #45 */
+        if (hw->mac.type == ixgbe_mac_82599EB)
+                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
 
         /* Set the RX buffer length according to the mode */
         if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 99f24f5cac53..f0643ac4aff1 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -1575,6 +1575,16 @@ jme_free_irq(struct jme_adapter *jme)
         }
 }
 
+static inline void
+jme_phy_on(struct jme_adapter *jme)
+{
+        u32 bmcr;
+
+        bmcr = jme_mdio_read(jme->dev, jme->mii_if.phy_id, MII_BMCR);
+        bmcr &= ~BMCR_PDOWN;
+        jme_mdio_write(jme->dev, jme->mii_if.phy_id, MII_BMCR, bmcr);
+}
+
 static int
 jme_open(struct net_device *netdev)
 {
@@ -1595,10 +1605,12 @@ jme_open(struct net_device *netdev)
 
         jme_start_irq(jme);
 
-        if (test_bit(JME_FLAG_SSET, &jme->flags))
+        if (test_bit(JME_FLAG_SSET, &jme->flags)) {
+                jme_phy_on(jme);
                 jme_set_settings(netdev, &jme->old_ecmd);
-        else
+        } else {
                 jme_reset_phy_processor(jme);
+        }
 
         jme_reset_link(jme);
 
@@ -3006,10 +3018,12 @@ jme_resume(struct pci_dev *pdev)
         jme_clear_pm(jme);
         pci_restore_state(pdev);
 
-        if (test_bit(JME_FLAG_SSET, &jme->flags))
+        if (test_bit(JME_FLAG_SSET, &jme->flags)) {
+                jme_phy_on(jme);
                 jme_set_settings(netdev, &jme->old_ecmd);
-        else
+        } else {
                 jme_reset_phy_processor(jme);
+        }
 
         jme_start_irq(jme);
         netif_device_attach(netdev);
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index f9b509a6b09a..b12553bb5ecc 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1622,6 +1622,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("COMPU-SHACK", "FASTline PCMCIA 10/100 Fast-Ethernet", 0xfa2e424d, 0x3953d9b9),
         PCMCIA_DEVICE_PROD_ID12("CONTEC", "C-NET(PC)C-10L", 0x21cab552, 0xf6f90722),
         PCMCIA_DEVICE_PROD_ID12("corega", "FEther PCC-TXF", 0x0a21501a, 0xa51564a2),
+        PCMCIA_DEVICE_PROD_ID12("corega", "Ether CF-TD", 0x0a21501a, 0x6589340a),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-T", 0x5261440f, 0xfa9d85bd),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-TD", 0x5261440f, 0xc49bd73d),
         PCMCIA_DEVICE_PROD_ID12("Corega K.K.", "corega EtherII PCC-TD", 0xd4fdcbd8, 0xc49bd73d),
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 0101f2bdf400..c1ba49b772ff 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -196,20 +196,27 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
                         MII_88E1121_PHY_MSCR_PAGE);
         if (err < 0)
                 return err;
-        mscr = phy_read(phydev, MII_88E1121_PHY_MSCR_REG) &
-                MII_88E1121_PHY_MSCR_DELAY_MASK;
 
-        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
-                mscr |= (MII_88E1121_PHY_MSCR_RX_DELAY |
-                         MII_88E1121_PHY_MSCR_TX_DELAY);
-        else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
-                mscr |= MII_88E1121_PHY_MSCR_RX_DELAY;
-        else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
-                mscr |= MII_88E1121_PHY_MSCR_TX_DELAY;
+        if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)) {
 
-        err = phy_write(phydev, MII_88E1121_PHY_MSCR_REG, mscr);
-        if (err < 0)
-                return err;
+                mscr = phy_read(phydev, MII_88E1121_PHY_MSCR_REG) &
+                        MII_88E1121_PHY_MSCR_DELAY_MASK;
+
+                if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
+                        mscr |= (MII_88E1121_PHY_MSCR_RX_DELAY |
+                                 MII_88E1121_PHY_MSCR_TX_DELAY);
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
+                        mscr |= MII_88E1121_PHY_MSCR_RX_DELAY;
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
+                        mscr |= MII_88E1121_PHY_MSCR_TX_DELAY;
+
+                err = phy_write(phydev, MII_88E1121_PHY_MSCR_REG, mscr);
+                if (err < 0)
+                        return err;
+        }
 
         phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
 
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index c07de359dc07..6a3eae2407c1 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -948,7 +948,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
 
 abort:
         kfree_skb(skb);
-        return 0;
+        return 1;
 }
 
 /************************************************************************
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 142c381e1d73..80666f097ce6 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -893,16 +893,18 @@ static void r6040_multicast_list(struct net_device *dev)
         /* Multicast Address 1~4 case */
         i = 0;
         netdev_for_each_mc_addr(ha, dev) {
-                if (i < MCAST_MAX) {
-                        adrp = (u16 *) ha->addr;
-                        iowrite16(adrp[0], ioaddr + MID_1L + 8 * i);
-                        iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
-                        iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
-                } else {
-                        iowrite16(0xffff, ioaddr + MID_1L + 8 * i);
-                        iowrite16(0xffff, ioaddr + MID_1M + 8 * i);
-                        iowrite16(0xffff, ioaddr + MID_1H + 8 * i);
-                }
+                if (i >= MCAST_MAX)
+                        break;
+                adrp = (u16 *) ha->addr;
+                iowrite16(adrp[0], ioaddr + MID_1L + 8 * i);
+                iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
+                iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
+                i++;
+        }
+        while (i < MCAST_MAX) {
+                iowrite16(0xffff, ioaddr + MID_1L + 8 * i);
+                iowrite16(0xffff, ioaddr + MID_1M + 8 * i);
+                iowrite16(0xffff, ioaddr + MID_1H + 8 * i);
                 i++;
         }
 }
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 992db2fa136e..ed65e4a473ec 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -855,10 +855,10 @@ static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         else
                 tp->features &= ~RTL_FEATURE_WOL;
         __rtl8169_set_wol(tp, wol->wolopts);
-        device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts);
-
         spin_unlock_irq(&tp->lock);
 
+        device_set_wakeup_enable(&tp->pci_dev->dev, wol->wolopts);
+
         return 0;
 }
 
@@ -2936,7 +2936,7 @@ static const struct rtl_cfg_info {
                 .hw_start       = rtl_hw_start_8168,
                 .region         = 2,
                 .align          = 8,
-                .intr_event     = SYSErr | RxFIFOOver | LinkChg | RxOverflow |
+                .intr_event     = SYSErr | LinkChg | RxOverflow |
                                   TxErr | TxOK | RxOK | RxErr,
                 .napi_event     = TxErr | TxOK | RxOK | RxOverflow,
                 .features       = RTL_FEATURE_GMII | RTL_FEATURE_MSI,
@@ -4455,14 +4455,12 @@ static inline int rtl8169_fragmented_frame(u32 status)
         return (status & (FirstFrag | LastFrag)) != (FirstFrag | LastFrag);
 }
 
-static inline void rtl8169_rx_csum(struct sk_buff *skb, struct RxDesc *desc)
+static inline void rtl8169_rx_csum(struct sk_buff *skb, u32 opts1)
 {
-        u32 opts1 = le32_to_cpu(desc->opts1);
         u32 status = opts1 & RxProtoMask;
 
         if (((status == RxProtoTCP) && !(opts1 & TCPFail)) ||
-            ((status == RxProtoUDP) && !(opts1 & UDPFail)) ||
-            ((status == RxProtoIP) && !(opts1 & IPFail)))
+            ((status == RxProtoUDP) && !(opts1 & UDPFail)))
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         else
                 skb->ip_summed = CHECKSUM_NONE;
@@ -4551,8 +4549,6 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                                 continue;
                         }
 
-                        rtl8169_rx_csum(skb, desc);
-
                         if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) {
                                 dma_sync_single_for_device(&pdev->dev, addr,
                                         pkt_size, PCI_DMA_FROMDEVICE);
@@ -4563,6 +4559,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                                 tp->Rx_skbuff[entry] = NULL;
                         }
 
+                        rtl8169_rx_csum(skb, status);
                         skb_put(skb, pkt_size);
                         skb->protocol = eth_type_trans(skb, dev);
 
@@ -4630,7 +4627,8 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                 }
 
                 /* Work around for rx fifo overflow */
-                if (unlikely(status & RxFIFOOver)) {
+                if (unlikely(status & RxFIFOOver) &&
+                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
                         netif_stop_queue(dev);
                         rtl8169_tx_timeout(dev);
                         break;
@@ -4891,6 +4889,9 @@ static int rtl8169_resume(struct device *device)
 {
         struct pci_dev *pdev = to_pci_dev(device);
         struct net_device *dev = pci_get_drvdata(pdev);
+        struct rtl8169_private *tp = netdev_priv(dev);
+
+        rtl8169_init_phy(dev, tp);
 
         if (netif_running(dev))
                 __rtl8169_resume(dev);
@@ -4931,6 +4932,8 @@ static int rtl8169_runtime_resume(struct device *device)
         tp->saved_wolopts = 0;
         spin_unlock_irq(&tp->lock);
 
+        rtl8169_init_phy(dev, tp);
+
         __rtl8169_resume(dev);
 
         return 0;
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index 737df6032bbc..2ce585a511d9 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -324,7 +324,7 @@ static int bdx_fw_load(struct bdx_priv *priv)
         ENTER;
         master = READ_REG(priv, regINIT_SEMAPHORE);
         if (!READ_REG(priv, regINIT_STATUS) && master) {
-                rc = request_firmware(&fw, "tehuti/firmware.bin", &priv->pdev->dev);
+                rc = request_firmware(&fw, "tehuti/bdx.bin", &priv->pdev->dev);
                 if (rc)
                         goto out;
                 bdx_tx_push_desc_safe(priv, (char *)fw->data, fw->size);
@@ -2516,4 +2516,4 @@ module_exit(bdx_module_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(BDX_DRV_DESC);
-MODULE_FIRMWARE("tehuti/firmware.bin");
+MODULE_FIRMWARE("tehuti/bdx.bin");
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index ca7fc9df1ccf..c04d49e31f81 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -45,6 +45,7 @@
 #include <linux/usb/usbnet.h>
 #include <linux/slab.h>
 #include <linux/kernel.h>
+#include <linux/pm_runtime.h>
 
 #define DRIVER_VERSION          "22-Aug-2005"
 
@@ -1273,6 +1274,16 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
         struct usb_device               *xdev;
         int                             status;
         const char                      *name;
+        struct usb_driver       *driver = to_usb_driver(udev->dev.driver);
+
+        /* usbnet already took usb runtime pm, so have to enable the feature
+         * for usb interface, otherwise usb_autopm_get_interface may return
+         * failure if USB_SUSPEND(RUNTIME_PM) is enabled.
+         */
+        if (!driver->supports_autosuspend) {
+                driver->supports_autosuspend = 1;
+                pm_runtime_enable(&udev->dev);
+        }
 
         name = udev->dev.driver->name;
         info = (struct driver_info *) prod->driver_info;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 4598e9d2608f..65d3d801a258 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -446,6 +446,20 @@ static void skb_recv_done(struct virtqueue *rvq)
         }
 }
 
+static void virtnet_napi_enable(struct virtnet_info *vi)
+{
+        napi_enable(&vi->napi);
+
+        /* If all buffers were filled by other side before we napi_enabled, we
+         * won't get another interrupt, so process any outstanding packets
+         * now.  virtnet_poll wants re-enable the queue, so we disable here.
+         * We synchronize against interrupts via NAPI_STATE_SCHED */
+        if (napi_schedule_prep(&vi->napi)) {
+                virtqueue_disable_cb(vi->rvq);
+                __napi_schedule(&vi->napi);
+        }
+}
+
 static void refill_work(struct work_struct *work)
 {
         struct virtnet_info *vi;
@@ -454,7 +468,7 @@ static void refill_work(struct work_struct *work)
         vi = container_of(work, struct virtnet_info, refill.work);
         napi_disable(&vi->napi);
         still_empty = !try_fill_recv(vi, GFP_KERNEL);
-        napi_enable(&vi->napi);
+        virtnet_napi_enable(vi);
 
         /* In theory, this can happen: if we don't get any buffers in
          * we will *never* try to fill again. */
@@ -638,16 +652,7 @@ static int virtnet_open(struct net_device *dev)
 {
         struct virtnet_info *vi = netdev_priv(dev);
 
-        napi_enable(&vi->napi);
-
-        /* If all buffers were filled by other side before we napi_enabled, we
-         * won't get another interrupt, so process any outstanding packets
-         * now.  virtnet_poll wants re-enable the queue, so we disable here.
-         * We synchronize against interrupts via NAPI_STATE_SCHED */
-        if (napi_schedule_prep(&vi->napi)) {
-                virtqueue_disable_cb(vi->rvq);
-                __napi_schedule(&vi->napi);
-        }
+        virtnet_napi_enable(vi);
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index d32f2828b098..a706202fa67c 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -119,6 +119,7 @@ struct ath_common {
 
         u32 keymax;
         DECLARE_BITMAP(keymap, ATH_KEYMAX);
+        DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
         u8 splitmic;
 
         struct ath_regulatory regulatory;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index fe7418aefc4a..d4ee07084c4d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -710,10 +710,6 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
 
         /* Do NF cal only at longer intervals */
         if (longcal || nfcal_pending) {
-                /* Do periodic PAOffset Cal */
-                ar9002_hw_pa_cal(ah, false);
-                ar9002_hw_olc_temp_compensation(ah);
-
                 /*
                  * Get the value from the previous NF cal and update
                  * history buffer.
@@ -728,8 +724,12 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
                         ath9k_hw_loadnf(ah, ah->curchan);
                 }
 
-                if (longcal)
+                if (longcal) {
                         ath9k_hw_start_nfcal(ah, false);
+                        /* Do periodic PAOffset Cal */
+                        ar9002_hw_pa_cal(ah, false);
+                        ar9002_hw_olc_temp_compensation(ah);
+                }
         }
 
         return iscaldone;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 303c63da5ea3..ab1c50b8326d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -411,6 +411,9 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                         val &= ~(AR_WA_BIT6 | AR_WA_BIT7);
                 }
 
+                if (AR_SREV_9280(ah))
+                        val |= AR_WA_BIT22;
+
                 if (AR_SREV_9285E_20(ah))
                         val |= AR_WA_BIT23;
 
@@ -442,9 +445,8 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                 }
 
                 /* WAR for ASPM system hang */
-                if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
+                if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
                         val |= (AR_WA_BIT6 | AR_WA_BIT7);
-                }
 
                 if (AR_SREV_9285E_20(ah))
                         val |= AR_WA_BIT23;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index ec98ab50748a..a14a5e43cf56 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -34,6 +34,10 @@ static const u32 ar9300_2p2_radio_postamble[][5] = {
 
 static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
@@ -99,6 +103,30 @@ static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a5f4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
         {0x0000a5f8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
         {0x0000a5fc, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02008802, 0x02008802, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03810c03, 0x03810c03, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
         {0x00016048, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -118,7 +146,7 @@ static const u32 ar9300Modes_fast_clock_2p2[][3] = {
         {0x00008014, 0x044c044c, 0x08980898},
         {0x0000801c, 0x148ec02b, 0x148ec057},
         {0x00008318, 0x000044c0, 0x00008980},
-        {0x00009e00, 0x03721821, 0x03721821},
+        {0x00009e00, 0x0372131c, 0x0372131c},
         {0x0000a230, 0x0000000b, 0x00000016},
         {0x0000a254, 0x00000898, 0x00001130},
 };
@@ -595,15 +623,16 @@ static const u32 ar9300_2p2_baseband_postamble[][5] = {
         {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
         {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
         {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
-        {0x00009e00, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0},
-        {0x00009e04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
         {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
         {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
-        {0x00009e14, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcf946222, 0xcf946222},
         {0x00009e44, 0x02321e27, 0x02321e27, 0x02291e27, 0x02291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -624,16 +653,16 @@ static const u32 ar9300_2p2_baseband_postamble[][5] = {
         {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
         {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
         {0x0000a2d0, 0x00071981, 0x00071981, 0x00071981, 0x00071982},
-        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
+        {0x0000a2d8, 0x7999a83a, 0x7999a83a, 0x7999a83a, 0x7999a83a},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
         {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
         {0x0000b284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
         {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000be04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000be04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
         {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
         {0x0000be20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
@@ -649,13 +678,13 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x00009814, 0x9280c00a},
         {0x00009818, 0x00000000},
         {0x0000981c, 0x00020028},
-        {0x00009834, 0x5f3ca3de},
+        {0x00009834, 0x6400a290},
         {0x00009838, 0x0108ecff},
         {0x0000983c, 0x14750600},
         {0x00009880, 0x201fff00},
         {0x00009884, 0x00001042},
         {0x000098a4, 0x00200400},
-        {0x000098b0, 0x52440bbe},
+        {0x000098b0, 0x32840bbe},
         {0x000098d0, 0x004b6a8e},
         {0x000098d4, 0x00000820},
         {0x000098dc, 0x00000000},
@@ -681,7 +710,6 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e3c, 0xcf946222},
         {0x00009e40, 0x0d261820},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
@@ -694,7 +722,7 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a220, 0x00000000},
         {0x0000a224, 0x00000000},
         {0x0000a228, 0x10002310},
-        {0x0000a22c, 0x01036a1e},
+        {0x0000a22c, 0x01036a27},
         {0x0000a23c, 0x00000000},
         {0x0000a244, 0x0c000000},
         {0x0000a2a0, 0x00000001},
@@ -702,10 +730,6 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a2c8, 0x00000000},
         {0x0000a2cc, 0x18c43433},
         {0x0000a2d4, 0x00000000},
-        {0x0000a2dc, 0x00000000},
-        {0x0000a2e0, 0x00000000},
-        {0x0000a2e4, 0x00000000},
-        {0x0000a2e8, 0x00000000},
         {0x0000a2ec, 0x00000000},
         {0x0000a2f0, 0x00000000},
         {0x0000a2f4, 0x00000000},
@@ -753,33 +777,17 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a430, 0x1ce739ce},
         {0x0000a434, 0x00000000},
         {0x0000a438, 0x00001801},
-        {0x0000a43c, 0x00000000},
+        {0x0000a43c, 0x00100000},
         {0x0000a440, 0x00000000},
         {0x0000a444, 0x00000000},
         {0x0000a448, 0x06000080},
         {0x0000a44c, 0x00000001},
         {0x0000a450, 0x00010000},
         {0x0000a458, 0x00000000},
-        {0x0000a600, 0x00000000},
-        {0x0000a604, 0x00000000},
-        {0x0000a608, 0x00000000},
-        {0x0000a60c, 0x00000000},
-        {0x0000a610, 0x00000000},
-        {0x0000a614, 0x00000000},
-        {0x0000a618, 0x00000000},
-        {0x0000a61c, 0x00000000},
-        {0x0000a620, 0x00000000},
-        {0x0000a624, 0x00000000},
-        {0x0000a628, 0x00000000},
-        {0x0000a62c, 0x00000000},
-        {0x0000a630, 0x00000000},
-        {0x0000a634, 0x00000000},
-        {0x0000a638, 0x00000000},
-        {0x0000a63c, 0x00000000},
         {0x0000a640, 0x00000000},
         {0x0000a644, 0x3fad9d74},
         {0x0000a648, 0x0048060a},
-        {0x0000a64c, 0x00000637},
+        {0x0000a64c, 0x00003c37},
         {0x0000a670, 0x03020100},
         {0x0000a674, 0x09080504},
         {0x0000a678, 0x0d0c0b0a},
@@ -802,10 +810,6 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a8f4, 0x00000000},
         {0x0000b2d0, 0x00000080},
         {0x0000b2d4, 0x00000000},
-        {0x0000b2dc, 0x00000000},
-        {0x0000b2e0, 0x00000000},
-        {0x0000b2e4, 0x00000000},
-        {0x0000b2e8, 0x00000000},
         {0x0000b2ec, 0x00000000},
         {0x0000b2f0, 0x00000000},
         {0x0000b2f4, 0x00000000},
@@ -820,10 +824,6 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000b8f4, 0x00000000},
         {0x0000c2d0, 0x00000080},
         {0x0000c2d4, 0x00000000},
-        {0x0000c2dc, 0x00000000},
-        {0x0000c2e0, 0x00000000},
-        {0x0000c2e4, 0x00000000},
-        {0x0000c2e8, 0x00000000},
         {0x0000c2ec, 0x00000000},
         {0x0000c2f0, 0x00000000},
         {0x0000c2f4, 0x00000000},
@@ -835,6 +835,10 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
 
 static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
@@ -855,7 +859,7 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
         {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
         {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
+        {0x0000a54c, 0x59025eb2, 0x59025eb2, 0x42001a83, 0x42001a83},
         {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
         {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
         {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
@@ -900,6 +904,30 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00016044, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
         {0x00016048, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
         {0x00016068, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
@@ -913,6 +941,10 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
 
 static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
+        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
+        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
@@ -933,7 +965,7 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
         {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
         {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb5, 0x59025eb5, 0x42001a83, 0x42001a83},
+        {0x0000a54c, 0x59025eb2, 0x59025eb2, 0x42001a83, 0x42001a83},
         {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
         {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
         {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
@@ -978,6 +1010,30 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
         {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
+        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
+        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000c2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
+        {0x0000c2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
+        {0x0000c2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00016044, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
         {0x00016048, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -1151,14 +1207,14 @@ static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
         {0x0000b074, 0x00000000},
         {0x0000b078, 0x00000000},
         {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x32323232},
-        {0x0000b084, 0x2f2f3232},
-        {0x0000b088, 0x23282a2d},
-        {0x0000b08c, 0x1c1e2123},
-        {0x0000b090, 0x14171919},
-        {0x0000b094, 0x0e0e1214},
-        {0x0000b098, 0x03050707},
-        {0x0000b09c, 0x00030303},
+        {0x0000b080, 0x2a2d2f32},
+        {0x0000b084, 0x21232328},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
         {0x0000b0a0, 0x00000000},
         {0x0000b0a4, 0x00000000},
         {0x0000b0a8, 0x00000000},
@@ -1251,6 +1307,10 @@ static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
 
 static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
@@ -1316,6 +1376,30 @@ static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a5f4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
         {0x0000a5f8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
         {0x0000a5fc, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02008802, 0x02008802, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03810c03, 0x03810c03, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
+        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
+        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
         {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -1414,15 +1498,10 @@ static const u32 ar9300_2p2_mac_core[][2] = {
         {0x00008144, 0xffffffff},
         {0x00008168, 0x00000000},
         {0x0000816c, 0x00000000},
-        {0x00008170, 0x18486200},
-        {0x00008174, 0x33332210},
-        {0x00008178, 0x00000000},
-        {0x0000817c, 0x00020000},
         {0x000081c0, 0x00000000},
         {0x000081c4, 0x33332210},
         {0x000081c8, 0x00000000},
         {0x000081cc, 0x00000000},
-        {0x000081d4, 0x00000000},
         {0x000081ec, 0x00000000},
         {0x000081f0, 0x00000000},
         {0x000081f4, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 057fb69ddf7f..5f03c534af6e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -22,12 +22,14 @@
 #define COMP_CKSUM_LEN 2
 
 #define AR_CH0_TOP (0x00016288)
-#define AR_CH0_TOP_XPABIASLVL (0x3)
+#define AR_CH0_TOP_XPABIASLVL (0x300)
 #define AR_CH0_TOP_XPABIASLVL_S (8)
 
 #define AR_CH0_THERM (0x00016290)
-#define AR_CH0_THERM_SPARE (0x3f)
-#define AR_CH0_THERM_SPARE_S (0)
+#define AR_CH0_THERM_XPABIASLVL_MSB 0x3
+#define AR_CH0_THERM_XPABIASLVL_MSB_S 0
+#define AR_CH0_THERM_XPASHORT2GND 0x4
+#define AR_CH0_THERM_XPASHORT2GND_S 2
 
 #define AR_SWITCH_TABLE_COM_ALL (0xffff)
 #define AR_SWITCH_TABLE_COM_ALL_S (0)
@@ -55,6 +57,8 @@
 #define SUB_NUM_CTL_MODES_AT_5G_40 2    /* excluding HT40, EXT-OFDM */
 #define SUB_NUM_CTL_MODES_AT_2G_40 3    /* excluding HT40, EXT-OFDM, EXT-CCK */
 
+#define CTL(_tpower, _flag) ((_tpower) | ((_flag) << 6))
+
 static const struct ar9300_eeprom ar9300_default = {
         .eepromVersion = 2,
         .templateVersion = 2,
@@ -290,20 +294,21 @@ static const struct ar9300_eeprom ar9300_default = {
                 }
          },
         .ctlPowerData_2G = {
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
          },
         .modalHeader5G = {
                 /* 4 idle,t1,t2,b (4 bits per setting) */
@@ -568,56 +573,56 @@ static const struct ar9300_eeprom ar9300_default = {
         .ctlPowerData_5G = {
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
                         }
                 },
          }
@@ -992,9 +997,9 @@ static s32 ar9003_hw_xpa_bias_level_get(struct ath_hw *ah, bool is2ghz)
 static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
 {
         int bias = ar9003_hw_xpa_bias_level_get(ah, is2ghz);
-        REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, (bias & 0x3));
-        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_SPARE,
-                      ((bias >> 2) & 0x3));
+        REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
+        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPABIASLVL_MSB, bias >> 2);
+        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPASHORT2GND, 1);
 }
 
 static u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
@@ -1827,9 +1832,9 @@ static u16 ar9003_hw_get_direct_edge_power(struct ar9300_eeprom *eep,
         struct cal_ctl_data_5g *ctl_5g = eep->ctlPowerData_5G;
 
         if (is2GHz)
-                return ctl_2g[idx].ctlEdges[edge].tPower;
+                return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge]);
         else
-                return ctl_5g[idx].ctlEdges[edge].tPower;
+                return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge]);
 }
 
 static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
@@ -1847,12 +1852,12 @@ static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
 
         if (is2GHz) {
                 if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 1) < freq &&
-                    ctl_2g[idx].ctlEdges[edge - 1].flag)
-                        return ctl_2g[idx].ctlEdges[edge - 1].tPower;
+                    CTL_EDGE_FLAGS(ctl_2g[idx].ctlEdges[edge - 1]))
+                        return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge - 1]);
         } else {
                 if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 0) < freq &&
-                    ctl_5g[idx].ctlEdges[edge - 1].flag)
-                        return ctl_5g[idx].ctlEdges[edge - 1].tPower;
+                    CTL_EDGE_FLAGS(ctl_5g[idx].ctlEdges[edge - 1]))
+                        return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge - 1]);
         }
 
         return AR9300_MAX_RATE_POWER;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 3c533bb983c7..655b3033396c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -261,17 +261,12 @@ struct cal_tgt_pow_ht {
         u8 tPow2x[14];
 } __packed;
 
-struct cal_ctl_edge_pwr {
-        u8 tPower:6,
-           flag:2;
-} __packed;
-
 struct cal_ctl_data_2g {
-        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_2G];
+        u8 ctlEdges[AR9300_NUM_BAND_EDGES_2G];
 } __packed;
 
 struct cal_ctl_data_5g {
-        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_5G];
+        u8 ctlEdges[AR9300_NUM_BAND_EDGES_5G];
 } __packed;
 
 struct ar9300_eeprom {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 5b995bee70ae..1a0ab706a18f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -616,7 +616,8 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
                         rxs->rs_status |= ATH9K_RXERR_DECRYPT;
                 } else if (rxsp->status11 & AR_MichaelErr) {
                         rxs->rs_status |= ATH9K_RXERR_MIC;
-                }
+                } else if (rxsp->status11 & AR_KeyMiss)
+                        rxs->rs_status |= ATH9K_RXERR_DECRYPT;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 7c38229ba670..716db414c258 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -347,6 +347,10 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
             (((Y[6] - Y[3]) * 1 << scale_factor) +
              (x_est[6] - x_est[3])) / (x_est[6] - x_est[3]);
 
+        /* prevent division by zero */
+        if (G_fxp == 0)
+                return false;
+
         Y_intercept =
             (G_fxp * (x_est[0] - x_est[3]) +
              (1 << scale_factor)) / (1 << scale_factor) + Y[3];
@@ -356,14 +360,12 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
 
         for (i = 0; i <= 3; i++) {
                 y_est[i] = i * 32;
-
-                /* prevent division by zero */
-                if (G_fxp == 0)
-                        return false;
-
                 x_est[i] = ((y_est[i] * 1 << scale_factor) + G_fxp) / G_fxp;
         }
 
+        if (y_est[max_index] == 0)
+                return false;
+
         x_est_fxp1_nonlin =
             x_est[max_index] - ((1 << scale_factor) * y_est[max_index] +
                                 G_fxp) / G_fxp;
@@ -457,6 +459,8 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
 
         Q_scale_B = find_proper_scale(find_expn(abs(scale_B)), 10);
         scale_B = scale_B / (1 << Q_scale_B);
+        if (scale_B == 0)
+                return false;
         Q_beta = find_proper_scale(find_expn(abs(beta_raw)), 10);
         Q_alpha = find_proper_scale(find_expn(abs(alpha_raw)), 10);
         beta_raw = beta_raw / (1 << Q_beta);
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 07f26ee7a723..852745c2b752 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -177,8 +177,8 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
 
 /* returns delimiter padding required given the packet length */
 #define ATH_AGGR_GET_NDELIM(_len)                                       \
-        (((((_len) + ATH_AGGR_DELIM_SZ) < ATH_AGGR_MINPLEN) ?           \
-          (ATH_AGGR_MINPLEN - (_len) - ATH_AGGR_DELIM_SZ) : 0) >> 2)
+       (((_len) >= ATH_AGGR_MINPLEN) ? 0 :                             \
+        DIV_ROUND_UP(ATH_AGGR_MINPLEN - (_len), ATH_AGGR_DELIM_SZ))
 
 #define BAW_WITHIN(_start, _bawsz, _seqno) \
         ((((_seqno) - (_start)) & 4095) < (_bawsz))
@@ -312,7 +312,6 @@ struct ath_rx {
         u8 rxotherant;
         u32 *rxlink;
         unsigned int rxfilter;
-        spinlock_t rxflushlock;
         spinlock_t rxbuflock;
         struct list_head rxbuf;
         struct ath_descdma rxdma;
@@ -346,8 +345,8 @@ void ath_tx_tasklet(struct ath_softc *sc);
 void ath_tx_edma_tasklet(struct ath_softc *sc);
 void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb);
 bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an, u8 tidno);
-void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-                       u16 tid, u16 *ssn);
+int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+                      u16 tid, u16 *ssn);
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath9k_enable_ps(struct ath_softc *sc);
@@ -516,7 +515,6 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define SC_OP_RXFLUSH                BIT(7)
 #define SC_OP_LED_ASSOCIATED         BIT(8)
 #define SC_OP_LED_ON                 BIT(9)
-#define SC_OP_SCANNING               BIT(10)
 #define SC_OP_TSF_RESET              BIT(11)
 #define SC_OP_BT_PRIORITY_DETECTED   BIT(12)
 #define SC_OP_BT_SCAN                BIT(13)
@@ -558,9 +556,9 @@ struct ath_softc {
         struct ath_hw *sc_ah;
         void __iomem *mem;
         int irq;
-        spinlock_t sc_resetlock;
         spinlock_t sc_serial_rw;
         spinlock_t sc_pm_lock;
+        spinlock_t sc_pcu_lock;
         struct mutex mutex;
         struct work_struct paprd_work;
         struct work_struct hw_check_work;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 4d4b22d52dfd..20cf2d4e58b9 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -366,7 +366,7 @@ void ath_beacon_tasklet(unsigned long data)
                         ath_print(common, ATH_DBG_BEACON,
                                   "beacon is officially stuck\n");
                         sc->sc_flags |= SC_OP_TSF_RESET;
-                        ath_reset(sc, false);
+                        ath_reset(sc, true);
                 }
 
                 return;
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index c86f7d3593ab..108b43369f7c 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -366,9 +366,13 @@ int ath9k_cmn_key_config(struct ath_common *common,
         set_bit(idx, common->keymap);
         if (key->alg == ALG_TKIP) {
                 set_bit(idx + 64, common->keymap);
+                set_bit(idx, common->tkip_keymap);
+                set_bit(idx + 64, common->tkip_keymap);
                 if (common->splitmic) {
                         set_bit(idx + 32, common->keymap);
                         set_bit(idx + 64 + 32, common->keymap);
+                        set_bit(idx + 32, common->tkip_keymap);
+                        set_bit(idx + 64 + 32, common->tkip_keymap);
                 }
         }
 
@@ -393,10 +397,17 @@ void ath9k_cmn_key_delete(struct ath_common *common,
                 return;
 
         clear_bit(key->hw_key_idx + 64, common->keymap);
+
+        clear_bit(key->hw_key_idx, common->tkip_keymap);
+        clear_bit(key->hw_key_idx + 64, common->tkip_keymap);
+
         if (common->splitmic) {
                 ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
                 clear_bit(key->hw_key_idx + 32, common->keymap);
                 clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
+
+                clear_bit(key->hw_key_idx + 32, common->tkip_keymap);
+                clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap);
         }
 }
 EXPORT_SYMBOL(ath9k_cmn_key_delete);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index 1266333f586d..2bbf94d0191e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -240,16 +240,16 @@ u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
         for (i = 0; (i < num_band_edges) &&
                      (pRdEdgesPower[i].bChannel != AR5416_BCHAN_UNUSED); i++) {
                 if (freq == ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel, is2GHz)) {
-                        twiceMaxEdgePower = pRdEdgesPower[i].tPower;
+                        twiceMaxEdgePower = CTL_EDGE_TPOWER(pRdEdgesPower[i].ctl);
                         break;
                 } else if ((i > 0) &&
                            (freq < ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel,
                                                       is2GHz))) {
                         if (ath9k_hw_fbin2freq(pRdEdgesPower[i - 1].bChannel,
                                                is2GHz) < freq &&
-                            pRdEdgesPower[i - 1].flag) {
+                            CTL_EDGE_FLAGS(pRdEdgesPower[i - 1].ctl)) {
                                 twiceMaxEdgePower =
-                                        pRdEdgesPower[i - 1].tPower;
+                                        CTL_EDGE_TPOWER(pRdEdgesPower[i - 1].ctl);
                         }
                         break;
                 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 0b09db0f8e7d..17068f9c026e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -233,6 +233,9 @@
 
 #define AR9287_CHECKSUM_LOCATION (AR9287_EEP_START_LOC + 1)
 
+#define CTL_EDGE_TPOWER(_ctl) ((_ctl) & 0x3f)
+#define CTL_EDGE_FLAGS(_ctl) (((_ctl) >> 6) & 0x03)
+
 enum eeprom_param {
         EEP_NFTHRESH_5,
         EEP_NFTHRESH_2,
@@ -533,18 +536,10 @@ struct cal_target_power_ht {
         u8 tPow2x[8];
 } __packed;
 
-
-#ifdef __BIG_ENDIAN_BITFIELD
-struct cal_ctl_edges {
-        u8 bChannel;
-        u8 flag:2, tPower:6;
-} __packed;
-#else
 struct cal_ctl_edges {
         u8 bChannel;
-        u8 tPower:6, flag:2;
+        u8 ctl;
 } __packed;
-#endif
 
 struct cal_data_op_loop_ar9287 {
         u8 pwrPdg[2][5];
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index dff2da777312..7cb356e8a531 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -37,7 +37,7 @@ static bool ath9k_hw_ar9287_fill_eeprom(struct ath_hw *ah)
         int addr, eep_start_loc;
         eep_data = (u16 *)eep;
 
-        if (ah->hw_version.devid == 0x7015)
+        if (AR9287_HTC_DEVID(ah))
                 eep_start_loc = AR9287_HTC_EEP_START_LOC;
         else
                 eep_start_loc = AR9287_EEP_START_LOC;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index afa2b73ddbdd..a48eb570a47c 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1062,15 +1062,19 @@ static void ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
         case 1:
                 break;
         case 2:
-                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                else
+                        scaledPower = 0;
                 break;
         case 3:
-                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                else
+                        scaledPower = 0;
                 break;
         }
 
-        scaledPower = max((u16)0, scaledPower);
-
         if (IS_CHAN_2GHZ(chan)) {
                 numCtlModes = ARRAY_SIZE(ctlModesFor11g) -
                         SUB_NUM_CTL_MODES_AT_2G_40;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 17e7a9a367e7..0e9bbb13ba66 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -35,8 +35,14 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
         { USB_DEVICE(0x07D1, 0x3A10) }, /* Dlink Wireless 150 */
         { USB_DEVICE(0x13D3, 0x3327) }, /* Azurewave */
         { USB_DEVICE(0x13D3, 0x3328) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3346) }, /* IMC Networks */
+        { USB_DEVICE(0x13D3, 0x3348) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3349) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3350) }, /* Azurewave */
         { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
         { USB_DEVICE(0x083A, 0xA704) }, /* SMC Networks */
+        { USB_DEVICE(0x040D, 0x3801) }, /* VIA */
+        { USB_DEVICE(0x1668, 0x1200) }, /* Verizon */
         { },
 };
 
@@ -138,16 +144,36 @@ static void hif_usb_tx_cb(struct urb *urb)
         case -ENODEV:
         case -ESHUTDOWN:
                 /*
-                 * The URB has been killed, free the SKBs
-                 * and return.
+                 * The URB has been killed, free the SKBs.
                  */
                 ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
-                return;
+
+                /*
+                 * If the URBs are being flushed, no need to add this
+                 * URB to the free list.
+                 */
+                spin_lock(&hif_dev->tx.tx_lock);
+                if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
+                        spin_unlock(&hif_dev->tx.tx_lock);
+                        return;
+                }
+                spin_unlock(&hif_dev->tx.tx_lock);
+
+                /*
+                 * In the stop() case, this URB has to be added to
+                 * the free list.
+                 */
+                goto add_free;
         default:
                 break;
         }
 
-        /* Check if TX has been stopped */
+        /*
+         * Check if TX has been stopped, this is needed because
+         * this CB could have been invoked just after the TX lock
+         * was released in hif_stop() and kill_urb() hasn't been
+         * called yet.
+         */
         spin_lock(&hif_dev->tx.tx_lock);
         if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
                 spin_unlock(&hif_dev->tx.tx_lock);
@@ -299,6 +325,7 @@ static void hif_usb_start(void *hif_handle, u8 pipe_id)
 static void hif_usb_stop(void *hif_handle, u8 pipe_id)
 {
         struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
+        struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
         unsigned long flags;
 
         spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
@@ -306,6 +333,12 @@ static void hif_usb_stop(void *hif_handle, u8 pipe_id)
         hif_dev->tx.tx_skb_cnt = 0;
         hif_dev->tx.flags |= HIF_USB_TX_STOP;
         spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+        /* The pending URBs have to be canceled. */
+        list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+                                 &hif_dev->tx.tx_pending, list) {
+                usb_kill_urb(tx_buf->urb);
+        }
 }
 
 static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
@@ -571,6 +604,7 @@ free:
 static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
 {
         struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
+        unsigned long flags;
 
         list_for_each_entry_safe(tx_buf, tx_buf_tmp,
                                  &hif_dev->tx.tx_buf, list) {
@@ -581,6 +615,10 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
                 kfree(tx_buf);
         }
 
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+        hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
         list_for_each_entry_safe(tx_buf, tx_buf_tmp,
                                  &hif_dev->tx.tx_pending, list) {
                 usb_kill_urb(tx_buf->urb);
@@ -799,10 +837,18 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
         }
         kfree(buf);
 
-        if ((hif_dev->device_id == 0x7010) || (hif_dev->device_id == 0x7015))
+        switch (hif_dev->device_id) {
+        case 0x7010:
+        case 0x7015:
+        case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 firm_offset = AR7010_FIRMWARE_TEXT;
-        else
+                break;
+        default:
                 firm_offset = AR9271_FIRMWARE_TEXT;
+                break;
+        }
 
         /*
          * Issue FW download complete command to firmware.
@@ -903,6 +949,8 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
         case 0x7010:
         case 0x7015:
         case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x0202)
                         hif_dev->fw_name = FIRMWARE_AR7010_1_1;
                 else
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
index 2daf97b11c08..30d09389d437 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -62,6 +62,7 @@ struct tx_buf {
 };
 
 #define HIF_USB_TX_STOP  BIT(0)
+#define HIF_USB_TX_FLUSH BIT(1)
 
 struct hif_usb_tx {
         u8 flags;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 2d4279191d7a..e5a0122fc341 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -247,6 +247,8 @@ static int ath9k_init_htc_services(struct ath9k_htc_priv *priv, u16 devid)
         case 0x7010:
         case 0x7015:
         case 0x9018:
+        case 0xA704:
+        case 0x1200:
                 priv->htc->credits = 45;
                 break;
         default:
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 2a6e45a293a9..f06eeab2a572 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -121,7 +121,7 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
                         tx_hdr.data_type = ATH9K_HTC_NORMAL;
                 }
 
-                if (ieee80211_is_data(fc)) {
+                if (ieee80211_is_data_qos(fc)) {
                         qc = ieee80211_get_qos_ctl(hdr);
                         tx_hdr.tidno = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
                 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 3384ca164562..5250c8dc83e1 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -387,6 +387,9 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         else
                 ah->config.ht_enable = 0;
 
+        /* PAPRD needs some more work to be enabled */
+        ah->config.paprd_disable = 1;
+
         ah->config.rx_intr_mitigation = true;
         ah->config.pcieSerDesWrite = true;
 
@@ -486,6 +489,7 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
                 ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
                           "Failed allocating banks for "
                           "external radio\n");
+                ath9k_hw_rf_free_ext_banks(ah);
                 return ecode;
         }
 
@@ -2263,7 +2267,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->rx_status_len = sizeof(struct ar9003_rxs);
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
-                if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                if (!ah->config.paprd_disable &&
+                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
@@ -2350,7 +2355,8 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
                 val = REG_READ(ah, AR7010_GPIO_IN);
                 return (MS(val, AR7010_GPIO_IN_VAL) & AR_GPIO_BIT(gpio)) == 0;
         } else if (AR_SREV_9300_20_OR_LATER(ah))
-                return MS_REG_READ(AR9300, gpio) != 0;
+                return (MS(REG_READ(ah, AR_GPIO_IN), AR9300_GPIO_IN_VAL) &
+                        AR_GPIO_BIT(gpio)) != 0;
         else if (AR_SREV_9271(ah))
                 return MS_REG_READ(AR9271, gpio) != 0;
         else if (AR_SREV_9287_10_OR_LATER(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 399f7c1283cd..e58ff11cb85c 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -240,6 +240,7 @@ struct ath9k_ops_config {
         u32 pcie_waen;
         u8 analog_shiftreg;
         u8 ht_enable;
+        u8 paprd_disable;
         u32 ofdm_trig_low;
         u32 ofdm_trig_high;
         u32 cck_trig_high;
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 243c1775f343..2e4724f1c662 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -56,7 +56,7 @@ MODULE_PARM_DESC(blink, "Enable LED blink on activity");
  * on 5 MHz steps, we support the channels which we know
  * we have calibration data for all cards though to make
  * this static */
-static struct ieee80211_channel ath9k_2ghz_chantable[] = {
+static const struct ieee80211_channel ath9k_2ghz_chantable[] = {
         CHAN2G(2412, 0), /* Channel 1 */
         CHAN2G(2417, 1), /* Channel 2 */
         CHAN2G(2422, 2), /* Channel 3 */
@@ -77,7 +77,7 @@ static struct ieee80211_channel ath9k_2ghz_chantable[] = {
  * on 5 MHz steps, we support the channels which we know
  * we have calibration data for all cards though to make
  * this static */
-static struct ieee80211_channel ath9k_5ghz_chantable[] = {
+static const struct ieee80211_channel ath9k_5ghz_chantable[] = {
         /* _We_ call this UNII 1 */
         CHAN5G(5180, 14), /* Channel 36 */
         CHAN5G(5200, 15), /* Channel 40 */
@@ -477,10 +477,17 @@ err:
         return -EIO;
 }
 
-static void ath9k_init_channels_rates(struct ath_softc *sc)
+static int ath9k_init_channels_rates(struct ath_softc *sc)
 {
+        void *channels;
+
         if (test_bit(ATH9K_MODE_11G, sc->sc_ah->caps.wireless_modes)) {
-                sc->sbands[IEEE80211_BAND_2GHZ].channels = ath9k_2ghz_chantable;
+                channels = kmemdup(ath9k_2ghz_chantable,
+                        sizeof(ath9k_2ghz_chantable), GFP_KERNEL);
+                if (!channels)
+                    return -ENOMEM;
+
+                sc->sbands[IEEE80211_BAND_2GHZ].channels = channels;
                 sc->sbands[IEEE80211_BAND_2GHZ].band = IEEE80211_BAND_2GHZ;
                 sc->sbands[IEEE80211_BAND_2GHZ].n_channels =
                         ARRAY_SIZE(ath9k_2ghz_chantable);
@@ -490,7 +497,15 @@ static void ath9k_init_channels_rates(struct ath_softc *sc)
         }
 
         if (test_bit(ATH9K_MODE_11A, sc->sc_ah->caps.wireless_modes)) {
-                sc->sbands[IEEE80211_BAND_5GHZ].channels = ath9k_5ghz_chantable;
+                channels = kmemdup(ath9k_5ghz_chantable,
+                        sizeof(ath9k_5ghz_chantable), GFP_KERNEL);
+                if (!channels) {
+                        if (sc->sbands[IEEE80211_BAND_2GHZ].channels)
+                                kfree(sc->sbands[IEEE80211_BAND_2GHZ].channels);
+                        return -ENOMEM;
+                }
+
+                sc->sbands[IEEE80211_BAND_5GHZ].channels = channels;
                 sc->sbands[IEEE80211_BAND_5GHZ].band = IEEE80211_BAND_5GHZ;
                 sc->sbands[IEEE80211_BAND_5GHZ].n_channels =
                         ARRAY_SIZE(ath9k_5ghz_chantable);
@@ -499,6 +514,7 @@ static void ath9k_init_channels_rates(struct ath_softc *sc)
                 sc->sbands[IEEE80211_BAND_5GHZ].n_bitrates =
                         ARRAY_SIZE(ath9k_legacy_rates) - 4;
         }
+        return 0;
 }
 
 static void ath9k_init_misc(struct ath_softc *sc)
@@ -558,7 +574,6 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
         common->debug_mask = ath9k_debug;
 
         spin_lock_init(&sc->wiphy_lock);
-        spin_lock_init(&sc->sc_resetlock);
         spin_lock_init(&sc->sc_serial_rw);
         spin_lock_init(&sc->sc_pm_lock);
         mutex_init(&sc->mutex);
@@ -593,8 +608,11 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
         if (ret)
                 goto err_btcoex;
 
+        ret = ath9k_init_channels_rates(sc);
+        if (ret)
+                goto err_btcoex;
+
         ath9k_init_crypto(sc);
-        ath9k_init_channels_rates(sc);
         ath9k_init_misc(sc);
 
         return 0;
@@ -641,7 +659,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_MESH_POINT);
 
-        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        if (AR_SREV_5416(sc->sc_ah))
+                hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         hw->queues = 4;
         hw->max_rates = 4;
@@ -751,6 +770,12 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
 {
         int i = 0;
 
+        if (sc->sbands[IEEE80211_BAND_2GHZ].channels)
+                kfree(sc->sbands[IEEE80211_BAND_2GHZ].channels);
+
+        if (sc->sbands[IEEE80211_BAND_5GHZ].channels)
+                kfree(sc->sbands[IEEE80211_BAND_5GHZ].channels);
+
         if ((sc->btcoex.no_stomp_timer) &&
             sc->sc_ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
                 ath_gen_timer_free(sc->sc_ah, sc->btcoex.no_stomp_timer);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index e955bb9d98cb..79302b1e0910 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -713,6 +713,8 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                         rs->rs_status |= ATH9K_RXERR_DECRYPT;
                 else if (ads.ds_rxstatus8 & AR_MichaelErr)
                         rs->rs_status |= ATH9K_RXERR_MIC;
+                else if (ads.ds_rxstatus8 & AR_KeyMiss)
+                        rs->rs_status |= ATH9K_RXERR_DECRYPT;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 3caa32316e7b..9790d3a86535 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -213,6 +213,9 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
          */
         ath9k_hw_set_interrupts(ah, 0);
         ath_drain_all_txq(sc, false);
+
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         stopped = ath_stoprecv(sc);
 
         /* XXX: do not flush receive queue here. We don't want
@@ -230,34 +233,35 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
                   sc->sc_ah->curchan->channel,
                   channel->center_freq, conf_is_ht40(conf));
 
-        spin_lock_bh(&sc->sc_resetlock);
-
         r = ath9k_hw_reset(ah, hchan, caldata, fastcc);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset channel (%u MHz), "
                           "reset status %d\n",
                           channel->center_freq, r);
-                spin_unlock_bh(&sc->sc_resetlock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto ps_restore;
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         if (ath_startrecv(sc) != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to restart recv logic\n");
                 r = -EIO;
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto ps_restore;
         }
 
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         ath_cache_conf_rate(sc, &hw->conf);
         ath_update_txpow(sc);
         ath9k_hw_set_interrupts(ah, ah->imask);
 
-        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL | SC_OP_SCANNING))) {
-                ath_start_ani(common);
+        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL))) {
+                if (sc->sc_flags & SC_OP_BEACONS)
+                        ath_beacon_config(sc, NULL);
                 ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
-                ath_beacon_config(sc, NULL);
+                ath_start_ani(common);
         }
 
  ps_restore:
@@ -269,6 +273,7 @@ static void ath_paprd_activate(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
+        struct ath_common *common = ath9k_hw_common(ah);
         int chain;
 
         if (!caldata || !caldata->paprd_done)
@@ -277,7 +282,7 @@ static void ath_paprd_activate(struct ath_softc *sc)
         ath9k_ps_wakeup(sc);
         ar9003_paprd_enable(ah, false);
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
-                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                if (!(common->tx_chainmask & BIT(chain)))
                         continue;
 
                 ar9003_paprd_populate_single_table(ah, caldata, chain);
@@ -299,6 +304,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         struct ieee80211_supported_band *sband = &sc->sbands[band];
         struct ath_tx_control txctl;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
+        struct ath_common *common = ath9k_hw_common(ah);
         int qnum, ftype;
         int chain_ok = 0;
         int chain;
@@ -332,7 +338,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         ath9k_ps_wakeup(sc);
         ar9003_paprd_init_table(ah);
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
-                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                if (!(common->tx_chainmask & BIT(chain)))
                         continue;
 
                 chain_ok = 0;
@@ -550,7 +556,7 @@ void ath_hw_check(struct work_struct *work)
 
                 msleep(1);
         }
-        ath_reset(sc, false);
+        ath_reset(sc, true);
 
 out:
         ath9k_ps_restore(sc);
@@ -568,7 +574,7 @@ void ath9k_tasklet(unsigned long data)
         ath9k_ps_wakeup(sc);
 
         if (status & ATH9K_INT_FATAL) {
-                ath_reset(sc, false);
+                ath_reset(sc, true);
                 ath9k_ps_restore(sc);
                 return;
         }
@@ -583,7 +589,7 @@ void ath9k_tasklet(unsigned long data)
                 rxmask = (ATH9K_INT_RX | ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
 
         if (status & rxmask) {
-                spin_lock_bh(&sc->rx.rxflushlock);
+                spin_lock_bh(&sc->sc_pcu_lock);
 
                 /* Check for high priority Rx first */
                 if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
@@ -591,7 +597,7 @@ void ath9k_tasklet(unsigned long data)
                         ath_rx_tasklet(sc, 0, true);
 
                 ath_rx_tasklet(sc, 0, false);
-                spin_unlock_bh(&sc->rx.rxflushlock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
         }
 
         if (status & ATH9K_INT_TX) {
@@ -838,7 +844,7 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
         if (!ah->curchan)
                 ah->curchan = ath_get_curchannel(sc, sc->hw);
 
-        spin_lock_bh(&sc->sc_resetlock);
+        spin_lock_bh(&sc->sc_pcu_lock);
         r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
@@ -846,14 +852,15 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
                           "reset status %d\n",
                           channel->center_freq, r);
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         ath_update_txpow(sc);
         if (ath_startrecv(sc) != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to restart recv logic\n");
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 return;
         }
+        spin_unlock_bh(&sc->sc_pcu_lock);
 
         if (sc->sc_flags & SC_OP_BEACONS)
                 ath_beacon_config(sc, NULL);    /* restart beacons */
@@ -892,13 +899,15 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
         ath9k_hw_set_interrupts(ah, 0);
 
         ath_drain_all_txq(sc, false);   /* clear pending tx frames */
+
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         ath_stoprecv(sc);               /* turn off frame recv */
         ath_flushrecv(sc);              /* flush recv queue */
 
         if (!ah->curchan)
                 ah->curchan = ath_get_curchannel(sc, hw);
 
-        spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (r) {
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
@@ -906,9 +915,11 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
                           "reset status %d\n",
                           channel->center_freq, r);
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         ath9k_hw_phy_disable(ah);
+
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         ath9k_hw_configpcipowersave(ah, 1, 1);
         ath9k_ps_restore(sc);
         ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
@@ -928,20 +939,23 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
 
         ath9k_hw_set_interrupts(ah, 0);
         ath_drain_all_txq(sc, retry_tx);
+
+        spin_lock_bh(&sc->sc_pcu_lock);
+
         ath_stoprecv(sc);
         ath_flushrecv(sc);
 
-        spin_lock_bh(&sc->sc_resetlock);
         r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
         if (r)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d\n", r);
-        spin_unlock_bh(&sc->sc_resetlock);
 
         if (ath_startrecv(sc) != 0)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to start recv logic\n");
 
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
         /*
          * We may be doing a reset in response to a request
          * that changes the channel so update any state that
@@ -951,7 +965,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
 
         ath_update_txpow(sc);
 
-        if (sc->sc_flags & SC_OP_BEACONS)
+        if ((sc->sc_flags & SC_OP_BEACONS) || !(sc->sc_flags & (SC_OP_OFFCHANNEL)))
                 ath_beacon_config(sc, NULL);    /* restart beacons */
 
         ath9k_hw_set_interrupts(ah, ah->imask);
@@ -1106,17 +1120,16 @@ static int ath9k_start(struct ieee80211_hw *hw)
          * be followed by initialization of the appropriate bits
          * and then setup of the interrupt mask.
          */
-        spin_lock_bh(&sc->sc_resetlock);
+        spin_lock_bh(&sc->sc_pcu_lock);
         r = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
                           "(freq %u MHz)\n", r,
                           curchan->center_freq);
-                spin_unlock_bh(&sc->sc_resetlock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto mutex_unlock;
         }
-        spin_unlock_bh(&sc->sc_resetlock);
 
         /*
          * This is needed only to setup initial state
@@ -1135,8 +1148,10 @@ static int ath9k_start(struct ieee80211_hw *hw)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to start recv logic\n");
                 r = -EIO;
+                spin_unlock_bh(&sc->sc_pcu_lock);
                 goto mutex_unlock;
         }
+        spin_unlock_bh(&sc->sc_pcu_lock);
 
         /* Setup our intr mask. */
         ah->imask = ATH9K_INT_TX | ATH9K_INT_RXEOL |
@@ -1340,18 +1355,24 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         if (!(sc->sc_flags & SC_OP_INVALID)) {
                 ath_drain_all_txq(sc, false);
+                spin_lock_bh(&sc->sc_pcu_lock);
                 ath_stoprecv(sc);
                 ath9k_hw_phy_disable(ah);
-        } else
+                spin_unlock_bh(&sc->sc_pcu_lock);
+        } else {
+                spin_lock_bh(&sc->sc_pcu_lock);
                 sc->rx.rxlink = NULL;
+                spin_unlock_bh(&sc->sc_pcu_lock);
+        }
 
         /* disable HAL and put h/w to sleep */
         ath9k_hw_disable(ah);
         ath9k_hw_configpcipowersave(ah, 1, 1);
         ath9k_ps_restore(sc);
 
-        /* Finally, put the chip in FULL SLEEP mode */
-        ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
+        sc->ps_idle = true;
+        ath9k_set_wiphy_idle(aphy, true);
+        ath_radio_disable(sc, hw);
 
         sc->sc_flags |= SC_OP_INVALID;
 
@@ -1455,6 +1476,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
+        bool bs_valid = false;
         int i;
 
         ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
@@ -1483,7 +1505,15 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
                                "slot\n", __func__);
                         sc->beacon.bslot[i] = NULL;
                         sc->beacon.bslot_aphy[i] = NULL;
-                }
+                } else if (sc->beacon.bslot[i])
+                        bs_valid = true;
+        }
+        if (!bs_valid && (sc->sc_ah->imask & ATH9K_INT_SWBA)) {
+                /* Disable SWBA interrupt */
+                sc->sc_ah->imask &= ~ATH9K_INT_SWBA;
+                ath9k_ps_wakeup(sc);
+                ath9k_hw_set_interrupts(sc->sc_ah, sc->sc_ah->imask);
+                ath9k_ps_restore(sc);
         }
 
         sc->nvifs--;
@@ -1556,6 +1586,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
          * IEEE80211_CONF_CHANGE_PS is only passed by mac80211 for STA mode.
          */
         if (changed & IEEE80211_CONF_CHANGE_PS) {
+                unsigned long flags;
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 if (conf->flags & IEEE80211_CONF_PS) {
                         sc->ps_flags |= PS_ENABLED;
                         /*
@@ -1570,7 +1602,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                         sc->ps_enabled = false;
                         sc->ps_flags &= ~(PS_ENABLED |
                                           PS_NULLFUNC_COMPLETED);
-                        ath9k_setpower(sc, ATH9K_PM_AWAKE);
+                        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
                         if (!(ah->caps.hw_caps &
                               ATH9K_HW_CAP_AUTOSLEEP)) {
                                 ath9k_hw_setrxabort(sc->sc_ah, 0);
@@ -1585,6 +1617,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                                 }
                         }
                 }
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
         }
 
         if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
@@ -1968,8 +2001,9 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                 break;
         case IEEE80211_AMPDU_TX_START:
                 ath9k_ps_wakeup(sc);
-                ath_tx_aggr_start(sc, sta, tid, ssn);
-                ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ret = ath_tx_aggr_start(sc, sta, tid, ssn);
+                if (!ret)
+                        ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_STOP:
@@ -2032,7 +2066,6 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 
         aphy->state = ATH_WIPHY_SCAN;
         ath9k_wiphy_pause_all_forced(sc, aphy);
-        sc->sc_flags |= SC_OP_SCANNING;
         mutex_unlock(&sc->mutex);
 }
 
@@ -2047,7 +2080,6 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 
         mutex_lock(&sc->mutex);
         aphy->state = ATH_WIPHY_ACTIVE;
-        sc->sc_flags &= ~SC_OP_SCANNING;
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index b5b651413e77..894ebadbb1d3 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -290,6 +290,10 @@ static int ath_pci_resume(struct pci_dev *pdev)
                             AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
         ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
 
+        sc->ps_idle = true;
+        ath9k_set_wiphy_idle(aphy, true);
+        ath_radio_disable(sc, hw);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index e49be733d546..5f825cec5b4d 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -538,7 +538,7 @@ static u8 ath_rc_setvalid_rates(struct ath_rate_priv *ath_rc_priv,
         for (i = 0; i < rateset->rs_nrates; i++) {
                 for (j = 0; j < rate_table->rate_cnt; j++) {
                         u32 phy = rate_table->info[j].phy;
-                        u16 rate_flags = rate_table->info[i].rate_flags;
+                        u16 rate_flags = rate_table->info[j].rate_flags;
                         u8 rate = rateset->rs_rates[i];
                         u8 dot11rate = rate_table->info[j].dot11rate;
 
@@ -1359,6 +1359,12 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
         if (tx_info->flags & IEEE80211_TX_STAT_TX_FILTERED)
                 return;
 
+        if (!(tx_info->flags & IEEE80211_TX_STAT_AMPDU)) {
+                tx_info->status.ampdu_ack_len =
+                        (tx_info->flags & IEEE80211_TX_STAT_ACK ? 1 : 0);
+                tx_info->status.ampdu_len = 1;
+        }
+
         /*
          * If an underrun error is seen assume it as an excessive retry only
          * if max frame trigger level has been reached (2 KB for singel stream,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a3fc987ebab0..912f747593cd 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -288,19 +288,17 @@ static void ath_edma_start_recv(struct ath_softc *sc)
         ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_LP,
                               sc->rx.rx_edma[ATH9K_RX_QUEUE_LP].rx_fifo_hwsize);
 
-        spin_unlock_bh(&sc->rx.rxbuflock);
-
         ath_opmode_init(sc);
 
-        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_SCANNING));
+        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
+
+        spin_unlock_bh(&sc->rx.rxbuflock);
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
 {
-        spin_lock_bh(&sc->rx.rxbuflock);
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
-        spin_unlock_bh(&sc->rx.rxbuflock);
 }
 
 int ath_rx_init(struct ath_softc *sc, int nbufs)
@@ -310,7 +308,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         struct ath_buf *bf;
         int error = 0;
 
-        spin_lock_init(&sc->rx.rxflushlock);
+        spin_lock_init(&sc->sc_pcu_lock);
         sc->sc_flags &= ~SC_OP_RXFLUSH;
         spin_lock_init(&sc->rx.rxbuflock);
 
@@ -496,9 +494,10 @@ int ath_startrecv(struct ath_softc *sc)
         ath9k_hw_rxena(ah);
 
 start_recv:
-        spin_unlock_bh(&sc->rx.rxbuflock);
         ath_opmode_init(sc);
-        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_SCANNING));
+        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
+
+        spin_unlock_bh(&sc->rx.rxbuflock);
 
         return 0;
 }
@@ -508,7 +507,8 @@ bool ath_stoprecv(struct ath_softc *sc)
         struct ath_hw *ah = sc->sc_ah;
         bool stopped;
 
-        ath9k_hw_stoppcurecv(ah);
+        spin_lock_bh(&sc->rx.rxbuflock);
+        ath9k_hw_abortpcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah);
 
@@ -516,19 +516,18 @@ bool ath_stoprecv(struct ath_softc *sc)
                 ath_edma_stop_recv(sc);
         else
                 sc->rx.rxlink = NULL;
+        spin_unlock_bh(&sc->rx.rxbuflock);
 
         return stopped;
 }
 
 void ath_flushrecv(struct ath_softc *sc)
 {
-        spin_lock_bh(&sc->rx.rxflushlock);
         sc->sc_flags |= SC_OP_RXFLUSH;
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ath_rx_tasklet(sc, 1, true);
         ath_rx_tasklet(sc, 1, false);
         sc->sc_flags &= ~SC_OP_RXFLUSH;
-        spin_unlock_bh(&sc->rx.rxflushlock);
 }
 
 static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
@@ -631,7 +630,7 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb)
                  * No more broadcast/multicast frames to be received at this
                  * point.
                  */
-                sc->ps_flags &= ~PS_WAIT_FOR_CAB;
+                sc->ps_flags &= ~(PS_WAIT_FOR_CAB | PS_WAIT_FOR_BEACON);
                 ath_print(common, ATH_DBG_PS,
                           "All PS CAB frames received, back to sleep\n");
         } else if ((sc->ps_flags & PS_WAIT_FOR_PSPOLL_DATA) &&
@@ -870,15 +869,18 @@ static bool ath9k_rx_accept(struct ath_common *common,
                 if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
                         *decrypt_error = true;
                 } else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
-                        if (ieee80211_is_ctl(fc))
-                                /*
-                                 * Sometimes, we get invalid
-                                 * MIC failures on valid control frames.
-                                 * Remove these mic errors.
-                                 */
-                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
-                        else
+                        /*
+                         * The MIC error bit is only valid if the frame
+                         * is not a control frame or fragment, and it was
+                         * decrypted using a valid TKIP key.
+                         */
+                        if (!ieee80211_is_ctl(fc) &&
+                            !ieee80211_has_morefrags(fc) &&
+                            !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
+                            test_bit(rx_stats->rs_keyix, common->tkip_keymap))
                                 rxs->flag |= RX_FLAG_MMIC_ERROR;
+                        else
+                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
                 }
                 /*
                  * Reject error frames with the exception of
@@ -1033,9 +1035,11 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
         int hdrlen, padpos, padsize;
         u8 keyix;
         __le16 fc;
+        bool is_mc;
 
         /* see if any padding is done by the hw and remove it */
         hdr = (struct ieee80211_hdr *) skb->data;
+        is_mc = !!is_multicast_ether_addr(hdr->addr1);
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
         fc = hdr->frame_control;
         padpos = ath9k_cmn_padpos(hdr->frame_control);
@@ -1056,7 +1060,7 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
 
         keyix = rx_stats->rs_keyix;
 
-        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
+        if ((is_mc || !(keyix == ATH9K_RXKEYIX_INVALID)) && !decrypt_error &&
             ieee80211_has_protected(fc)) {
                 rxs->flag |= RX_FLAG_DECRYPTED;
         } else if (ieee80211_has_protected(fc)
@@ -1096,6 +1100,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         u8 rx_status_len = ah->caps.rx_status_len;
         u64 tsf = 0;
         u32 tsf_lower = 0;
+        unsigned long flags;
 
         if (edma)
                 dma_type = DMA_BIDIRECTIONAL;
@@ -1204,11 +1209,13 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         sc->rx.rxotherant = 0;
                 }
 
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 if (unlikely(ath9k_check_auto_sleep(sc) ||
                              (sc->ps_flags & (PS_WAIT_FOR_BEACON |
                                               PS_WAIT_FOR_CAB |
                                               PS_WAIT_FOR_PSPOLL_DATA))))
                         ath_rx_ps(sc, skb);
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
                 ath_rx_send_to_mac80211(hw, sc, skb, rxs);
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index d01c4adab8d6..86b0a4b1a72f 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -709,6 +709,7 @@
 #define AR_WA_RESET_EN                  (1 << 18) /* Sw Control to enable PCI-Reset to POR (bit 15) */
 #define AR_WA_ANALOG_SHIFT              (1 << 20)
 #define AR_WA_POR_SHORT                 (1 << 21) /* PCI-E Phy reset control */
+#define AR_WA_BIT22                     (1 << 22)
 #define AR9285_WA_DEFAULT               0x004a050b
 #define AR9280_WA_DEFAULT               0x0040073b
 #define AR_WA_DEFAULT                   0x0000073f
@@ -900,7 +901,13 @@
 #define AR_DEVID_7010(_ah) \
         (((_ah)->hw_version.devid == 0x7010) || \
          ((_ah)->hw_version.devid == 0x7015) || \
-         ((_ah)->hw_version.devid == 0x9018))
+         ((_ah)->hw_version.devid == 0x9018) || \
+         ((_ah)->hw_version.devid == 0xA704) || \
+         ((_ah)->hw_version.devid == 0x1200))
+
+#define AR9287_HTC_DEVID(_ah) \
+        (((_ah)->hw_version.devid == 0x7015) || \
+         ((_ah)->hw_version.devid == 0x1200))
 
 #define AR_RADIO_SREV_MAJOR                   0xf0
 #define AR_RAD5133_SREV_MAJOR                 0xc0
@@ -1012,11 +1019,13 @@ enum {
 #define AR9287_GPIO_IN_VAL_S                     11
 #define AR9271_GPIO_IN_VAL                       0xFFFF0000
 #define AR9271_GPIO_IN_VAL_S                     16
-#define AR9300_GPIO_IN_VAL                       0x0001FFFF
-#define AR9300_GPIO_IN_VAL_S                     0
 #define AR7010_GPIO_IN_VAL                       0x0000FFFF
 #define AR7010_GPIO_IN_VAL_S                     0
 
+#define AR_GPIO_IN                               0x404c
+#define AR9300_GPIO_IN_VAL                       0x0001FFFF
+#define AR9300_GPIO_IN_VAL_S                     0
+
 #define AR_GPIO_OE_OUT                           (AR_SREV_9300_20_OR_LATER(ah) ? 0x4050 : 0x404c)
 #define AR_GPIO_OE_OUT_DRV                       0x3
 #define AR_GPIO_OE_OUT_DRV_NO                    0x0
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 4dda14e36227..8f00c6c13979 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -61,6 +61,8 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
                               struct ath_tx_status *ts, int txok);
 static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                              int nbad, int txok, bool update_rc);
+static void ath_tx_update_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
+                              int seqno);
 
 enum {
         MCS_HT20,
@@ -143,18 +145,23 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
         struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
         struct ath_buf *bf;
         struct list_head bf_head;
-        INIT_LIST_HEAD(&bf_head);
+        struct ath_tx_status ts;
 
-        WARN_ON(!tid->paused);
+        INIT_LIST_HEAD(&bf_head);
 
+        memset(&ts, 0, sizeof(ts));
         spin_lock_bh(&txq->axq_lock);
-        tid->paused = false;
 
         while (!list_empty(&tid->buf_q)) {
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
-                BUG_ON(bf_isretried(bf));
                 list_move_tail(&bf->list, &bf_head);
-                ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+
+                if (bf_isretried(bf)) {
+                        ath_tx_update_baw(sc, tid, bf->bf_seqno);
+                        ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
+                } else {
+                        ath_tx_send_ht_normal(sc, txq, tid, &bf_head);
+                }
         }
 
         spin_unlock_bh(&txq->axq_lock);
@@ -312,6 +319,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
         bool rc_update = true;
         struct ieee80211_tx_rate rates[4];
+        int nframes;
 
         skb = bf->bf_mpdu;
         hdr = (struct ieee80211_hdr *)skb->data;
@@ -320,6 +328,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         hw = bf->aphy->hw;
 
         memcpy(rates, tx_info->control.rates, sizeof(rates));
+        nframes = bf->bf_nframes;
 
         rcu_read_lock();
 
@@ -337,7 +346,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                             !bf->bf_stale || bf_next != NULL)
                                 list_move_tail(&bf->list, &bf_head);
 
-                        ath_tx_rc_status(bf, ts, 0, 0, false);
+                        ath_tx_rc_status(bf, ts, 1, 0, false);
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
                                 0, 0);
 
@@ -431,7 +440,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         list_move_tail(&bf->list, &bf_head);
                 }
 
-                if (!txpending) {
+                if (!txpending || (tid->state & AGGR_CLEANUP)) {
                         /*
                          * complete the acked-ones/xretried ones; update
                          * block-ack window
@@ -442,6 +451,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
 
                         if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
                                 memcpy(tx_info->control.rates, rates, sizeof(rates));
+                                bf->bf_nframes = nframes;
                                 ath_tx_rc_status(bf, ts, nbad, txok, true);
                                 rc_update = false;
                         } else {
@@ -510,15 +520,12 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         }
 
         if (tid->state & AGGR_CLEANUP) {
+                ath_tx_flush_tid(sc, tid);
+
                 if (tid->baw_head == tid->baw_tail) {
                         tid->state &= ~AGGR_ADDBA_COMPLETE;
                         tid->state &= ~AGGR_CLEANUP;
-
-                        /* send buffered frames as singles */
-                        ath_tx_flush_tid(sc, tid);
                 }
-                rcu_read_unlock();
-                return;
         }
 
         rcu_read_unlock();
@@ -785,17 +792,23 @@ static void ath_tx_sched_aggr(struct ath_softc *sc, struct ath_txq *txq,
                  status != ATH_AGGR_BAW_CLOSED);
 }
 
-void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
-                       u16 tid, u16 *ssn)
+int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
+                      u16 tid, u16 *ssn)
 {
         struct ath_atx_tid *txtid;
         struct ath_node *an;
 
         an = (struct ath_node *)sta->drv_priv;
         txtid = ATH_AN_2_TID(an, tid);
+
+        if (txtid->state & (AGGR_CLEANUP | AGGR_ADDBA_COMPLETE))
+                return -EAGAIN;
+
         txtid->state |= AGGR_ADDBA_PROGRESS;
         txtid->paused = true;
         *ssn = txtid->seq_start;
+
+        return 0;
 }
 
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
@@ -803,12 +816,6 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
         struct ath_node *an = (struct ath_node *)sta->drv_priv;
         struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
         struct ath_txq *txq = &sc->tx.txq[txtid->ac->qnum];
-        struct ath_tx_status ts;
-        struct ath_buf *bf;
-        struct list_head bf_head;
-
-        memset(&ts, 0, sizeof(ts));
-        INIT_LIST_HEAD(&bf_head);
 
         if (txtid->state & AGGR_CLEANUP)
                 return;
@@ -818,31 +825,22 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
                 return;
         }
 
-        /* drop all software retried frames and mark this TID */
         spin_lock_bh(&txq->axq_lock);
         txtid->paused = true;
-        while (!list_empty(&txtid->buf_q)) {
-                bf = list_first_entry(&txtid->buf_q, struct ath_buf, list);
-                if (!bf_isretried(bf)) {
-                        /*
-                         * NB: it's based on the assumption that
-                         * software retried frame will always stay
-                         * at the head of software queue.
-                         */
-                        break;
-                }
-                list_move_tail(&bf->list, &bf_head);
-                ath_tx_update_baw(sc, txtid, bf->bf_seqno);
-                ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
-        }
-        spin_unlock_bh(&txq->axq_lock);
 
-        if (txtid->baw_head != txtid->baw_tail) {
+        /*
+         * If frames are still being transmitted for this TID, they will be
+         * cleaned up during tx completion. To prevent race conditions, this
+         * TID can only be reused after all in-progress subframes have been
+         * completed.
+         */
+        if (txtid->baw_head != txtid->baw_tail)
                 txtid->state |= AGGR_CLEANUP;
-        } else {
+        else
                 txtid->state &= ~AGGR_ADDBA_COMPLETE;
-                ath_tx_flush_tid(sc, txtid);
-        }
+        spin_unlock_bh(&txq->axq_lock);
+
+        ath_tx_flush_tid(sc, txtid);
 }
 
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
@@ -1103,15 +1101,6 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
         txq->axq_tx_inprogress = false;
         spin_unlock_bh(&txq->axq_lock);
 
-        /* flush any pending frames if aggregation is enabled */
-        if (sc->sc_flags & SC_OP_TXAGGR) {
-                if (!retry_tx) {
-                        spin_lock_bh(&txq->axq_lock);
-                        ath_txq_drain_pending_buffers(sc, txq);
-                        spin_unlock_bh(&txq->axq_lock);
-                }
-        }
-
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
                 spin_lock_bh(&txq->axq_lock);
                 while (!list_empty(&txq->txq_fifo_pending)) {
@@ -1132,6 +1121,15 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
                 }
                 spin_unlock_bh(&txq->axq_lock);
         }
+
+        /* flush any pending frames if aggregation is enabled */
+        if (sc->sc_flags & SC_OP_TXAGGR) {
+                if (!retry_tx) {
+                        spin_lock_bh(&txq->axq_lock);
+                        ath_txq_drain_pending_buffers(sc, txq);
+                        spin_unlock_bh(&txq->axq_lock);
+                }
+        }
 }
 
 void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
@@ -1162,13 +1160,13 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
                 ath_print(common, ATH_DBG_FATAL,
                           "Failed to stop TX DMA. Resetting hardware!\n");
 
-                spin_lock_bh(&sc->sc_resetlock);
+                spin_lock_bh(&sc->sc_pcu_lock);
                 r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
                 if (r)
                         ath_print(common, ATH_DBG_FATAL,
                                   "Unable to reset hardware; reset status %d\n",
                                   r);
-                spin_unlock_bh(&sc->sc_resetlock);
+                spin_unlock_bh(&sc->sc_pcu_lock);
         }
 
         for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
@@ -2024,9 +2022,15 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
 
         if (ts->ts_status & ATH9K_TXERR_FILT)
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
-        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && update_rc)
+        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && update_rc) {
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
 
+                BUG_ON(nbad > bf->bf_nframes);
+
+                tx_info->status.ampdu_len = bf->bf_nframes;
+                tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
+        }
+
         if ((ts->ts_status & ATH9K_TXERR_FILT) == 0 &&
             (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0 && update_rc) {
                 if (ieee80211_is_data(hdr->frame_control)) {
@@ -2036,8 +2040,6 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                         if ((ts->ts_status & ATH9K_TXERR_XRETRY) ||
                             (ts->ts_status & ATH9K_TXERR_FIFO))
                                 tx_info->pad[0] |= ATH_TX_INFO_XRETRY;
-                        tx_info->status.ampdu_len = bf->bf_nframes;
-                        tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
                 }
         }
 
@@ -2159,7 +2161,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                          */
                         if (ts.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, &ts, 0, txok, true);
+                        ath_tx_rc_status(bf, &ts, txok ? 0 : 1, txok, true);
                 }
 
                 if (bf_isampdu(bf))
@@ -2204,7 +2206,7 @@ static void ath_tx_complete_poll_work(struct work_struct *work)
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
                           "tx hung, resetting the chip\n");
                 ath9k_ps_wakeup(sc);
-                ath_reset(sc, false);
+                ath_reset(sc, true);
                 ath9k_ps_restore(sc);
         }
 
@@ -2288,7 +2290,7 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
                 if (!bf_isampdu(bf)) {
                         if (txs.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, &txs, 0, txok, true);
+                        ath_tx_rc_status(bf, &txs, txok ? 0 : 1, txok, true);
                 }
 
                 if (bf_isampdu(bf))
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 45933cf8e8c2..09e2dfd7b175 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_func *func,
 err_free_ssb:
         kfree(sdio);
 err_disable_func:
+        sdio_claim_host(func);
         sdio_disable_func(func);
 err_release_host:
         sdio_release_host(func);
@@ -175,7 +176,9 @@ static void b43_sdio_remove(struct sdio_func *func)
         struct b43_sdio *sdio = sdio_get_drvdata(func);
 
         ssb_bus_unregister(&sdio->ssb);
+        sdio_claim_host(func);
         sdio_disable_func(func);
+        sdio_release_host(func);
         kfree(sdio);
         sdio_set_drvdata(func, NULL);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 10d7b9b7f064..f735117d8fc2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1234,6 +1234,9 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         /* only Re-enable if diabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
@@ -1449,6 +1452,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         /* only Re-enable if diabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 }
 
 /* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
@@ -3260,9 +3266,10 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
 
         flush_workqueue(priv->workqueue);
 
-        /* enable interrupts again in order to receive rfkill changes */
+        /* User space software may expect getting rfkill changes
+         * even if interface is down */
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
-        iwl_enable_interrupts(priv);
+        iwl_enable_rfkill_int(priv);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
@@ -4103,14 +4110,14 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * 8. Enable interrupts and read RFKILL state
          *********************************************/
 
-        /* enable interrupts if needed: hw bug w/a */
+        /* enable rfkill interrupt: hw bug w/a */
         pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
         if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
                 pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
                 pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
         }
 
-        iwl_enable_interrupts(priv);
+        iwl_enable_rfkill_int(priv);
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 621abe3c5afc..1c6add90b5b4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -168,6 +168,12 @@ static inline void iwl_disable_interrupts(struct iwl_priv *priv)
         IWL_DEBUG_ISR(priv, "Disabled interrupts\n");
 }
 
+static inline void iwl_enable_rfkill_int(struct iwl_priv *priv)
+{
+        IWL_DEBUG_ISR(priv, "Enabling rfkill interrupt\n");
+        iwl_write32(priv, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
+}
+
 static inline void iwl_enable_interrupts(struct iwl_priv *priv)
 {
         IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index e8e2d0f4763d..f800ef4e6554 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -1813,6 +1813,12 @@ static int __orinoco_commit(struct orinoco_private *priv)
         struct net_device *dev = priv->ndev;
         int err = 0;
 
+        /* If we've called commit, we are reconfiguring or bringing the
+         * interface up. Maintaining countermeasures across this would
+         * be confusing, so note that we've disabled them. The port will
+         * be enabled later in orinoco_commit or __orinoco_up. */
+        priv->tkip_cm_active = 0;
+
         err = orinoco_hw_program_rids(priv);
 
         /* FIXME: what about netif_tx_lock */
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index ef46a2d88539..083999faaa98 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -248,20 +248,20 @@ orinoco_cs_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        ret = pcmcia_request_irq(link, orinoco_interrupt);
-        if (ret)
-                goto failed;
-
-        /* We initialize the hermes structure before completing PCMCIA
-         * configuration just in case the interrupt handler gets
-         * called. */
         mem = ioport_map(link->resource[0]->start,
                         resource_size(link->resource[0]));
         if (!mem)
                 goto failed;
 
+        /* We initialize the hermes structure before completing PCMCIA
+         * configuration just in case the interrupt handler gets
+         * called. */
         hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
 
+        ret = pcmcia_request_irq(link, orinoco_interrupt);
+        if (ret)
+                goto failed;
+
         /*
          * This actually configures the PCMCIA socket -- setting up
          * the I/O windows and the interrupt mapping, and putting the
diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
index 873877e17e1b..93070a3a5233 100644
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -310,21 +310,21 @@ spectrum_cs_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        ret = pcmcia_request_irq(link, orinoco_interrupt);
-        if (ret)
-                goto failed;
-
-        /* We initialize the hermes structure before completing PCMCIA
-         * configuration just in case the interrupt handler gets
-         * called. */
         mem = ioport_map(link->resource[0]->start,
                         resource_size(link->resource[0]));
         if (!mem)
                 goto failed;
 
+        /* We initialize the hermes structure before completing PCMCIA
+         * configuration just in case the interrupt handler gets
+         * called. */
         hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
         hw->eeprom_pda = true;
 
+        ret = pcmcia_request_irq(link, orinoco_interrupt);
+        if (ret)
+                goto failed;
+
         /*
          * This actually configures the PCMCIA socket -- setting up
          * the I/O windows and the interrupt mapping, and putting the
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index cf7be1eb6124..56aab61fd4cb 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -904,10 +904,10 @@ static int orinoco_ioctl_set_auth(struct net_device *dev,
                  */
                 if (param->value) {
                         priv->tkip_cm_active = 1;
-                        ret = hermes_enable_port(hw, 0);
+                        ret = hermes_disable_port(hw, 0);
                 } else {
                         priv->tkip_cm_active = 0;
-                        ret = hermes_disable_port(hw, 0);
+                        ret = hermes_enable_port(hw, 0);
                 }
                 break;
 
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 78347041ec40..0a7ce37aa628 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -260,8 +260,10 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
         list->max_entries = max_channel_num;
         list->channels = kzalloc(sizeof(struct p54_channel_entry) *
                                  max_channel_num, GFP_KERNEL);
-        if (!list->channels)
+        if (!list->channels) {
+                ret = -ENOMEM;
                 goto free;
+        }
 
         for (i = 0; i < max_channel_num; i++) {
                 if (i < priv->iq_autocal_len) {
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index ad595958b7df..2325e56a9b0b 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -33,8 +33,18 @@ MODULE_ALIAS("prism54usb");
 MODULE_FIRMWARE("isl3886usb");
 MODULE_FIRMWARE("isl3887usb");
 
+/*
+ * Note:
+ *
+ * Always update our wiki's device list (located at:
+ * http://wireless.kernel.org/en/users/Drivers/p54/devices ),
+ * whenever you add a new device.
+ */
+
 static struct usb_device_id p54u_table[] __devinitdata = {
         /* Version 1 devices (pci chip + net2280) */
+        {USB_DEVICE(0x0411, 0x0050)},   /* Buffalo WLI2-USB2-G54 */
+        {USB_DEVICE(0x045e, 0x00c2)},   /* Microsoft MN-710 */
         {USB_DEVICE(0x0506, 0x0a11)},   /* 3COM 3CRWE254G72 */
         {USB_DEVICE(0x06b9, 0x0120)},   /* Thomson SpeedTouch 120g */
         {USB_DEVICE(0x0707, 0xee06)},   /* SMC 2862W-G */
@@ -47,7 +57,13 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x0846, 0x4220)},   /* Netgear WG111 */
         {USB_DEVICE(0x09aa, 0x1000)},   /* Spinnaker Proto board */
         {USB_DEVICE(0x0cde, 0x0006)},   /* Medion 40900, Roper Europe */
+        {USB_DEVICE(0x0db0, 0x6826)},   /* MSI UB54G (MS-6826) */
+        {USB_DEVICE(0x107b, 0x55f2)},   /* Gateway WGU-210 (Gemtek) */
         {USB_DEVICE(0x124a, 0x4023)},   /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
+        {USB_DEVICE(0x1435, 0x0210)},   /* Inventel UR054G */
+        {USB_DEVICE(0x15a9, 0x0002)},   /* Gemtek WUBI-100GW 802.11g */
+        {USB_DEVICE(0x1630, 0x0005)},   /* 2Wire 802.11g USB (v1) / Z-Com */
+        {USB_DEVICE(0x182d, 0x096b)},   /* Sitecom WL-107 */
         {USB_DEVICE(0x1915, 0x2234)},   /* Linksys WUSB54G OEM */
         {USB_DEVICE(0x1915, 0x2235)},   /* Linksys WUSB54G Portable OEM */
         {USB_DEVICE(0x2001, 0x3701)},   /* DLink DWL-G120 Spinnaker */
@@ -60,6 +76,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
         {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
         {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
+        {USB_DEVICE(0x06a9, 0x000e)},   /* Westell 802.11g USB (A90-211WG-01) */
         {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
@@ -80,7 +97,9 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x13B1, 0x000C)},   /* Linksys WUSB54AG */
         {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
         {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
+        {USB_DEVICE(0x1668, 0x1050)},   /* Actiontec 802UIG-1 */
         {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
+        {USB_DEVICE(0x2001, 0x3705)},   /* D-Link DWL-G120 rev C1 */
         {USB_DEVICE(0x413c, 0x5513)},   /* Dell WLA3310 USB Wireless Adapter */
         {USB_DEVICE(0x413c, 0x8102)},   /* Spinnaker DUT */
         {USB_DEVICE(0x413c, 0x8104)},   /* Cohiba Proto board */
@@ -930,8 +949,8 @@ static int __devinit p54u_probe(struct usb_interface *intf,
 #ifdef CONFIG_PM
                 /* ISL3887 needs a full reset on resume */
                 udev->reset_resume = 1;
+#endif /* CONFIG_PM */
                 err = p54u_device_reset(dev);
-#endif
 
                 priv->hw_type = P54U_3887;
                 dev->extra_tx_headroom += sizeof(struct lm87_tx_hdr);
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 0e937dc0c9c4..3d5311330b4a 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -618,7 +618,7 @@ static void p54_tx_80211_header(struct p54_common *priv, struct sk_buff *skb,
         else
                 *burst_possible = false;
 
-        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
+        if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
                 *flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
 
         if (info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE)
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 5063e01410e5..6a6cd7142e31 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1488,8 +1488,10 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = TXPOWER_FROM_DEV(MAX_TXPOWER);
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         return 0;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index c2a555d5376b..ec3e8b329a67 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1802,12 +1802,16 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = DEFAULT_TXPOWER;
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = DEFAULT_TXPOWER;
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index cdaf93f48263..ed4de3f02d40 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1705,12 +1705,16 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = DEFAULT_TXPOWER;
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = DEFAULT_TXPOWER;
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index ed4ebcdde7c9..616b71a4ad1f 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -1841,6 +1841,13 @@ struct mac_iveiv_entry {
 #define EEPROM_RSSI_A2_LNA_A2           FIELD16(0xff00)
 
 /*
+ * EEPROM Maximum TX power values
+ */
+#define EEPROM_MAX_TX_POWER             0x0027
+#define EEPROM_MAX_TX_POWER_24GHZ       FIELD16(0x00ff)
+#define EEPROM_MAX_TX_POWER_5GHZ        FIELD16(0xff00)
+
+/*
  * EEPROM TXpower delta: 20MHZ AND 40 MHZ use different power.
  *      This is delta in 40MHZ.
  * VALUE: Tx Power dalta value (MAX=4)
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index b66e0fd8f0fa..60039d3fe0a0 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1120,27 +1120,27 @@ static void rt2800_config_channel_rf2xxx(struct rt2x00_dev *rt2x00dev,
                  * double meaning, and we should set a 7DBm boost flag.
                  */
                 rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A_7DBM_BOOST,
-                                   (info->tx_power1 >= 0));
+                                   (info->default_power1 >= 0));
 
-                if (info->tx_power1 < 0)
-                        info->tx_power1 += 7;
+                if (info->default_power1 < 0)
+                        info->default_power1 += 7;
 
                 rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A,
-                                   TXPOWER_A_TO_DEV(info->tx_power1));
+                                   TXPOWER_A_TO_DEV(info->default_power1));
 
                 rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A_7DBM_BOOST,
-                                   (info->tx_power2 >= 0));
+                                   (info->default_power2 >= 0));
 
-                if (info->tx_power2 < 0)
-                        info->tx_power2 += 7;
+                if (info->default_power2 < 0)
+                        info->default_power2 += 7;
 
                 rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A,
-                                   TXPOWER_A_TO_DEV(info->tx_power2));
+                                   TXPOWER_A_TO_DEV(info->default_power2));
         } else {
                 rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G,
-                                   TXPOWER_G_TO_DEV(info->tx_power1));
+                                   TXPOWER_G_TO_DEV(info->default_power1));
                 rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G,
-                                   TXPOWER_G_TO_DEV(info->tx_power2));
+                                   TXPOWER_G_TO_DEV(info->default_power2));
         }
 
         rt2x00_set_field32(&rf->rf4, RF4_HT40, conf_is_ht40(conf));
@@ -1180,13 +1180,11 @@ static void rt2800_config_channel_rf3xxx(struct rt2x00_dev *rt2x00dev,
         rt2800_rfcsr_write(rt2x00dev, 6, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 12, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER,
-                          TXPOWER_G_TO_DEV(info->tx_power1));
+        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER, info->default_power1);
         rt2800_rfcsr_write(rt2x00dev, 12, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 13, &rfcsr);
-        rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER,
-                          TXPOWER_G_TO_DEV(info->tx_power2));
+        rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER, info->default_power2);
         rt2800_rfcsr_write(rt2x00dev, 13, rfcsr);
 
         rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
@@ -2516,6 +2514,13 @@ int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                                    default_lna_gain);
         rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
 
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_MAX_TX_POWER, &word);
+        if (rt2x00_get_field16(word, EEPROM_MAX_TX_POWER_24GHZ) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_MAX_TX_POWER_24GHZ, MAX_G_TXPOWER);
+        if (rt2x00_get_field16(word, EEPROM_MAX_TX_POWER_5GHZ) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_MAX_TX_POWER_5GHZ, MAX_A_TXPOWER);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_MAX_TX_POWER, word);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(rt2800_validate_eeprom);
@@ -2755,9 +2760,10 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 {
         struct hw_mode_spec *spec = &rt2x00dev->spec;
         struct channel_info *info;
-        char *tx_power1;
-        char *tx_power2;
+        char *default_power1;
+        char *default_power2;
         unsigned int i;
+        unsigned short max_power;
         u16 eeprom;
 
         /*
@@ -2871,21 +2877,26 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 
         spec->channels_info = info;
 
-        tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
-        tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_MAX_TX_POWER, &eeprom);
+        max_power = rt2x00_get_field16(eeprom, EEPROM_MAX_TX_POWER_24GHZ);
+        default_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
+        default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
 
         for (i = 0; i < 14; i++) {
-                info[i].tx_power1 = TXPOWER_G_FROM_DEV(tx_power1[i]);
-                info[i].tx_power2 = TXPOWER_G_FROM_DEV(tx_power2[i]);
+                info[i].max_power = max_power;
+                info[i].default_power1 = TXPOWER_G_FROM_DEV(default_power1[i]);
+                info[i].default_power2 = TXPOWER_G_FROM_DEV(default_power2[i]);
         }
 
         if (spec->num_channels > 14) {
-                tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
-                tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+                max_power = rt2x00_get_field16(eeprom, EEPROM_MAX_TX_POWER_5GHZ);
+                default_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
+                default_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
 
                 for (i = 14; i < spec->num_channels; i++) {
-                        info[i].tx_power1 = TXPOWER_A_FROM_DEV(tx_power1[i]);
-                        info[i].tx_power2 = TXPOWER_A_FROM_DEV(tx_power2[i]);
+                        info[i].max_power = max_power;
+                        info[i].default_power1 = TXPOWER_A_FROM_DEV(default_power1[i]);
+                        info[i].default_power2 = TXPOWER_A_FROM_DEV(default_power2[i]);
                 }
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index c21af38cc5af..6b2b92bfbc6b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -212,8 +212,9 @@ struct channel_info {
         unsigned int flags;
 #define GEOGRAPHY_ALLOWED       0x00000001
 
-        short tx_power1;
-        short tx_power2;
+        short max_power;
+        short default_power1;
+        short default_power2;
 };
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 585e8166f22a..19f86ce13df5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -710,7 +710,7 @@ static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
         for (i = 0; i < spec->num_channels; i++) {
                 rt2x00lib_channel(&channels[i],
                                   spec->channels[i].channel,
-                                  spec->channels_info[i].tx_power1, i);
+                                  spec->channels_info[i].max_power, i);
         }
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index e539c6cb636f..73d6382663b4 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2661,13 +2661,17 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
                 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                }
         }
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index aa9de18fd410..c457d65f81a7 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2091,13 +2091,17 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         spec->channels_info = info;
 
         tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
-        for (i = 0; i < 14; i++)
-                info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        for (i = 0; i < 14; i++) {
+                info[i].max_power = MAX_TXPOWER;
+                info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+        }
 
         if (spec->num_channels > 14) {
                 tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
-                for (i = 14; i < spec->num_channels; i++)
-                        info[i].tx_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].max_power = MAX_TXPOWER;
+                        info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                }
         }
 
         return 0;
@@ -2391,6 +2395,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index b50fedcef8ac..42dad59cadb0 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -66,8 +66,8 @@ struct netfront_cb {
 
 #define GRANT_INVALID_REF       0
 
-#define NET_TX_RING_SIZE __RING_SIZE((struct xen_netif_tx_sring *)0, PAGE_SIZE)
-#define NET_RX_RING_SIZE __RING_SIZE((struct xen_netif_rx_sring *)0, PAGE_SIZE)
+#define NET_TX_RING_SIZE __CONST_RING_SIZE(xen_netif_tx, PAGE_SIZE)
+#define NET_RX_RING_SIZE __CONST_RING_SIZE(xen_netif_rx, PAGE_SIZE)
 #define TX_MAX_TARGET min_t(int, NET_RX_RING_SIZE, 256)
 
 struct netfront_info {
diff --git a/drivers/oprofile/timer_int.c b/drivers/oprofile/timer_int.c
index dc0ae4d14dff..010725117dbb 100644
--- a/drivers/oprofile/timer_int.c
+++ b/drivers/oprofile/timer_int.c
@@ -21,6 +21,7 @@
 #include "oprof.h"
 
 static DEFINE_PER_CPU(struct hrtimer, oprofile_hrtimer);
+static int ctr_running;
 
 static enum hrtimer_restart oprofile_hrtimer_notify(struct hrtimer *hrtimer)
 {
@@ -33,6 +34,9 @@ static void __oprofile_hrtimer_start(void *unused)
 {
         struct hrtimer *hrtimer = &__get_cpu_var(oprofile_hrtimer);
 
+        if (!ctr_running)
+                return;
+
         hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         hrtimer->function = oprofile_hrtimer_notify;
 
@@ -42,7 +46,10 @@ static void __oprofile_hrtimer_start(void *unused)
 
 static int oprofile_hrtimer_start(void)
 {
+        get_online_cpus();
+        ctr_running = 1;
         on_each_cpu(__oprofile_hrtimer_start, NULL, 1);
+        put_online_cpus();
         return 0;
 }
 
@@ -50,6 +57,9 @@ static void __oprofile_hrtimer_stop(int cpu)
 {
         struct hrtimer *hrtimer = &per_cpu(oprofile_hrtimer, cpu);
 
+        if (!ctr_running)
+                return;
+
         hrtimer_cancel(hrtimer);
 }
 
@@ -57,8 +67,11 @@ static void oprofile_hrtimer_stop(void)
 {
         int cpu;
 
+        get_online_cpus();
         for_each_online_cpu(cpu)
                 __oprofile_hrtimer_stop(cpu);
+        ctr_running = 0;
+        put_online_cpus();
 }
 
 static int __cpuinit oprofile_cpu_notify(struct notifier_block *self,
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index 0a19708074c2..a286959db67e 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -1414,6 +1414,11 @@ int __init enable_drhd_fault_handling(void)
                                (unsigned long long)drhd->reg_base_addr, ret);
                         return -1;
                 }
+
+                /*
+                 * Clear any previous faults.
+                 */
+                dmar_fault(iommu->irq, iommu);
         }
 
         return 0;
diff --git a/drivers/pci/pci-stub.c b/drivers/pci/pci-stub.c
index f7b68ca6cc98..4ae494bb1d50 100644
--- a/drivers/pci/pci-stub.c
+++ b/drivers/pci/pci-stub.c
@@ -54,6 +54,9 @@ static int __init pci_stub_init(void)
                         subdevice = PCI_ANY_ID, class=0, class_mask=0;
                 int fields;
 
+                if (!strlen(id))
+                        continue;
+
                 fields = sscanf(id, "%x:%x:%x:%x:%x:%x",
                                 &vendor, &device, &subvendor, &subdevice,
                                 &class, &class_mask);
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index b5a7d9bfcb24..4835a02ec017 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -705,17 +705,21 @@ void pci_remove_legacy_files(struct pci_bus *b)
 
 #ifdef HAVE_PCI_MMAP
 
-int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma)
+int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma,
+                  enum pci_mmap_api mmap_api)
 {
-        unsigned long nr, start, size;
+        unsigned long nr, start, size, pci_start;
 
+        if (pci_resource_len(pdev, resno) == 0)
+                return 0;
         nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
         start = vma->vm_pgoff;
         size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1;
-        if (start < size && size - start >= nr)
+        pci_start = (mmap_api == PCI_MMAP_PROCFS) ?
+                        pci_resource_start(pdev, resno) >> PAGE_SHIFT : 0;
+        if (start >= pci_start && start < pci_start + size &&
+                        start + nr <= pci_start + size)
                 return 1;
-        WARN(1, "process \"%s\" tried to map 0x%08lx-0x%08lx on %s BAR %d (size 0x%08lx)\n",
-                current->comm, start, start+nr, pci_name(pdev), resno, size);
         return 0;
 }
 
@@ -745,8 +749,14 @@ pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
         if (i >= PCI_ROM_RESOURCE)
                 return -ENODEV;
 
-        if (!pci_mmap_fits(pdev, i, vma))
+        if (!pci_mmap_fits(pdev, i, vma, PCI_MMAP_SYSFS)) {
+                WARN(1, "process \"%s\" tried to map 0x%08lx bytes "
+                        "at page 0x%08lx on %s BAR %d (start 0x%16Lx, size 0x%16Lx)\n",
+                        current->comm, vma->vm_end-vma->vm_start, vma->vm_pgoff,
+                        pci_name(pdev), i,
+                        pci_resource_start(pdev, i), pci_resource_len(pdev, i));
                 return -EINVAL;
+        }
 
         /* pci_mmap_page_range() expects the same kind of entry as coming
          * from /proc/bus/pci/ which is a "user visible" value. If this is
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 6beb11b617a9..1001b1d7e041 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -22,8 +22,13 @@ extern void pci_remove_firmware_label_files(struct pci_dev *pdev);
 #endif
 extern void pci_cleanup_rom(struct pci_dev *dev);
 #ifdef HAVE_PCI_MMAP
+enum pci_mmap_api {
+        PCI_MMAP_SYSFS, /* mmap on /sys/bus/pci/devices/<BDF>/resource<N> */
+        PCI_MMAP_PROCFS /* mmap on /proc/bus/pci/<BDF> */
+};
 extern int pci_mmap_fits(struct pci_dev *pdev, int resno,
-                         struct vm_area_struct *vma);
+                         struct vm_area_struct *vmai,
+                         enum pci_mmap_api mmap_api);
 #endif
 int pci_probe_reset_function(struct pci_dev *dev);
 
diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
index 01f0306525a5..4aae016c79d0 100644
--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -260,7 +260,7 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma)
 
         /* Make sure the caller is mapping a real resource for this device */
         for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-                if (pci_mmap_fits(dev, i, vma))
+                if (pci_mmap_fits(dev, i, vma,  PCI_MMAP_PROCFS))
                         break;
         }
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 857ae01734a6..32ae8188c094 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2714,6 +2714,29 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_m
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
 #endif /*CONFIG_MMC_RICOH_MMC*/
 
+#if defined(CONFIG_DMAR) || defined(CONFIG_INTR_REMAP)
+#define VTUNCERRMSK_REG 0x1ac
+#define VTD_MSK_SPEC_ERRORS     (1 << 31)
+/*
+ * This is a quirk for masking vt-d spec defined errors to platform error
+ * handling logic. With out this, platforms using Intel 7500, 5500 chipsets
+ * (and the derivative chipsets like X58 etc) seem to generate NMI/SMI (based
+ * on the RAS config settings of the platform) when a vt-d fault happens.
+ * The resulting SMI caused the system to hang.
+ *
+ * VT-d spec related errors are already handled by the VT-d OS code, so no
+ * need to report the same error through other channels.
+ */
+static void vtd_mask_spec_errors(struct pci_dev *dev)
+{
+        u32 word;
+
+        pci_read_config_dword(dev, VTUNCERRMSK_REG, &word);
+        pci_write_config_dword(dev, VTUNCERRMSK_REG, word | VTD_MSK_SPEC_ERRORS);
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x342e, vtd_mask_spec_errors);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors);
+#endif
 
 static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
                           struct pci_fixup *end)
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index 6f1a86b43c60..fd4c25ac18ec 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -65,6 +65,7 @@ void soc_pcmcia_debug(struct soc_pcmcia_socket *skt, const char *func,
                 va_end(args);
         }
 }
+EXPORT_SYMBOL(soc_pcmcia_debug);
 
 #endif
 
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index b756e07d41b4..e8acb1c7b194 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -1065,9 +1065,9 @@ static ssize_t store_gps(struct device *dev, struct device_attribute *attr,
  */
 static int asus_gps_rfkill_set(void *data, bool blocked)
 {
-        acpi_handle handle = data;
+        struct asus_laptop *asus = data;
 
-        return asus_gps_switch(handle, !blocked);
+        return asus_gps_switch(asus, !blocked);
 }
 
 static const struct rfkill_ops asus_gps_rfkill_ops = {
@@ -1094,7 +1094,7 @@ static int asus_rfkill_init(struct asus_laptop *asus)
 
         asus->gps_rfkill = rfkill_alloc("asus-gps", &asus->platform_device->dev,
                                         RFKILL_TYPE_GPS,
-                                        &asus_gps_rfkill_ops, NULL);
+                                        &asus_gps_rfkill_ops, asus);
         if (!asus->gps_rfkill)
                 return -EINVAL;
 
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index c44a5e8b8b82..f0b3ad13c273 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -75,6 +75,7 @@
 #include <drm/i915_drm.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
+#include "intel_ips.h"
 
 #define PCI_DEVICE_ID_INTEL_THERMAL_SENSOR 0x3b32
 
@@ -245,6 +246,7 @@
 #define thm_writel(off, val) writel((val), ips->regmap + (off))
 
 static const int IPS_ADJUST_PERIOD = 5000; /* ms */
+static bool late_i915_load = false;
 
 /* For initial average collection */
 static const int IPS_SAMPLE_PERIOD = 200; /* ms */
@@ -339,6 +341,9 @@ struct ips_driver {
         u64 orig_turbo_ratios;
 };
 
+static bool
+ips_gpu_turbo_enabled(struct ips_driver *ips);
+
 /**
  * ips_cpu_busy - is CPU busy?
  * @ips: IPS driver struct
@@ -517,7 +522,7 @@ static void ips_disable_cpu_turbo(struct ips_driver *ips)
  */
 static bool ips_gpu_busy(struct ips_driver *ips)
 {
-        if (!ips->gpu_turbo_enabled)
+        if (!ips_gpu_turbo_enabled(ips))
                 return false;
 
         return ips->gpu_busy();
@@ -532,7 +537,7 @@ static bool ips_gpu_busy(struct ips_driver *ips)
  */
 static void ips_gpu_raise(struct ips_driver *ips)
 {
-        if (!ips->gpu_turbo_enabled)
+        if (!ips_gpu_turbo_enabled(ips))
                 return;
 
         if (!ips->gpu_raise())
@@ -549,7 +554,7 @@ static void ips_gpu_raise(struct ips_driver *ips)
  */
 static void ips_gpu_lower(struct ips_driver *ips)
 {
-        if (!ips->gpu_turbo_enabled)
+        if (!ips_gpu_turbo_enabled(ips))
                 return;
 
         if (!ips->gpu_lower())
@@ -1454,6 +1459,31 @@ out_err:
         return false;
 }
 
+static bool
+ips_gpu_turbo_enabled(struct ips_driver *ips)
+{
+        if (!ips->gpu_busy && late_i915_load) {
+                if (ips_get_i915_syms(ips)) {
+                        dev_info(&ips->dev->dev,
+                                 "i915 driver attached, reenabling gpu turbo\n");
+                        ips->gpu_turbo_enabled = !(thm_readl(THM_HTS) & HTS_GTD_DIS);
+                }
+        }
+
+        return ips->gpu_turbo_enabled;
+}
+
+void
+ips_link_to_i915_driver()
+{
+        /* We can't cleanly get at the various ips_driver structs from
+         * this caller (the i915 driver), so just set a flag saying
+         * that it's time to try getting the symbols again.
+         */
+        late_i915_load = true;
+}
+EXPORT_SYMBOL_GPL(ips_link_to_i915_driver);
+
 static DEFINE_PCI_DEVICE_TABLE(ips_id_table) = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL,
                      PCI_DEVICE_ID_INTEL_THERMAL_SENSOR), },
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index b2978a04317f..677783475d84 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -801,7 +801,7 @@ static bool guid_already_parsed(const char *guid_string)
                 wblock = list_entry(p, struct wmi_block, list);
                 gblock = &wblock->gblock;
 
-                if (strncmp(gblock->guid, guid_string, 16) == 0)
+                if (memcmp(gblock->guid, guid_string, 16) == 0)
                         return true;
         }
         return false;
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index dc4e32e031e9..0d943eea1c2d 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -28,7 +28,7 @@
 #include "../base.h"
 #include "pnpacpi.h"
 
-static int num = 0;
+static int num;
 
 /* We need only to blacklist devices that have already an acpi driver that
  * can't use pnp layer. We don't need to blacklist device that are directly
@@ -180,11 +180,24 @@ struct pnp_protocol pnpacpi_protocol = {
 };
 EXPORT_SYMBOL(pnpacpi_protocol);
 
+static char *pnpacpi_get_id(struct acpi_device *device)
+{
+        struct acpi_hardware_id *id;
+
+        list_for_each_entry(id, &device->pnp.ids, list) {
+                if (ispnpidacpi(id->id))
+                        return id->id;
+        }
+
+        return NULL;
+}
+
 static int __init pnpacpi_add_device(struct acpi_device *device)
 {
         acpi_handle temp = NULL;
         acpi_status status;
         struct pnp_dev *dev;
+        char *pnpid;
         struct acpi_hardware_id *id;
 
         /*
@@ -192,11 +205,17 @@ static int __init pnpacpi_add_device(struct acpi_device *device)
          * driver should not be loaded.
          */
         status = acpi_get_handle(device->handle, "_CRS", &temp);
-        if (ACPI_FAILURE(status) || !ispnpidacpi(acpi_device_hid(device)) ||
-            is_exclusive_device(device) || (!device->status.present))
+        if (ACPI_FAILURE(status))
+                return 0;
+
+        pnpid = pnpacpi_get_id(device);
+        if (!pnpid)
+                return 0;
+
+        if (is_exclusive_device(device) || !device->status.present)
                 return 0;
 
-        dev = pnp_alloc_dev(&pnpacpi_protocol, num, acpi_device_hid(device));
+        dev = pnp_alloc_dev(&pnpacpi_protocol, num, pnpid);
         if (!dev)
                 return -ENOMEM;
 
@@ -227,7 +246,7 @@ static int __init pnpacpi_add_device(struct acpi_device *device)
                 pnpacpi_parse_resource_option_data(dev);
 
         list_for_each_entry(id, &device->pnp.ids, list) {
-                if (!strcmp(id->id, acpi_device_hid(device)))
+                if (!strcmp(id->id, pnpid))
                         continue;
                 if (!ispnpidacpi(id->id))
                         continue;
diff --git a/drivers/power/ds2760_battery.c b/drivers/power/ds2760_battery.c
index 4d3b27228a2e..c8d26df9f145 100644
--- a/drivers/power/ds2760_battery.c
+++ b/drivers/power/ds2760_battery.c
@@ -212,7 +212,7 @@ static int ds2760_battery_read_status(struct ds2760_device_info *di)
         if (di->rem_capacity > 100)
                 di->rem_capacity = 100;
 
-        if (di->current_uA >= 100L)
+        if (di->current_uA < -100L)
                 di->life_sec = -((di->accum_current_uAh - di->empty_uAh) * 36L)
                                         / (di->current_uA / 100L);
         else
diff --git a/drivers/power/jz4740-battery.c b/drivers/power/jz4740-battery.c
index 20c4b952e9bd..a74cb0ac3d48 100644
--- a/drivers/power/jz4740-battery.c
+++ b/drivers/power/jz4740-battery.c
@@ -47,6 +47,8 @@ struct jz_battery {
 
         struct power_supply battery;
         struct delayed_work work;
+
+        struct mutex lock;
 };
 
 static inline struct jz_battery *psy_to_jz_battery(struct power_supply *psy)
@@ -68,6 +70,8 @@ static long jz_battery_read_voltage(struct jz_battery *battery)
         unsigned long val;
         long voltage;
 
+        mutex_lock(&battery->lock);
+
         INIT_COMPLETION(battery->read_completion);
 
         enable_irq(battery->irq);
@@ -91,6 +95,8 @@ static long jz_battery_read_voltage(struct jz_battery *battery)
         battery->cell->disable(battery->pdev);
         disable_irq(battery->irq);
 
+        mutex_unlock(&battery->lock);
+
         return voltage;
 }
 
@@ -291,6 +297,7 @@ static int __devinit jz_battery_probe(struct platform_device *pdev)
         jz_battery->pdev = pdev;
 
         init_completion(&jz_battery->read_completion);
+        mutex_init(&jz_battery->lock);
 
         INIT_DELAYED_WORK(&jz_battery->work, jz_battery_work);
 
diff --git a/drivers/power/olpc_battery.c b/drivers/power/olpc_battery.c
index aafc1c506eda..5bc1dcf7785e 100644
--- a/drivers/power/olpc_battery.c
+++ b/drivers/power/olpc_battery.c
@@ -271,14 +271,14 @@ static int olpc_bat_get_property(struct power_supply *psy,
                 if (ret)
                         return ret;
 
-                val->intval = (int)be16_to_cpu(ec_word) * 9760L / 32;
+                val->intval = (s16)be16_to_cpu(ec_word) * 9760L / 32;
                 break;
         case POWER_SUPPLY_PROP_CURRENT_AVG:
                 ret = olpc_ec_cmd(EC_BAT_CURRENT, NULL, 0, (void *)&ec_word, 2);
                 if (ret)
                         return ret;
 
-                val->intval = (int)be16_to_cpu(ec_word) * 15625L / 120;
+                val->intval = (s16)be16_to_cpu(ec_word) * 15625L / 120;
                 break;
         case POWER_SUPPLY_PROP_CAPACITY:
                 ret = olpc_ec_cmd(EC_BAT_SOC, NULL, 0, &ec_byte, 1);
@@ -299,7 +299,7 @@ static int olpc_bat_get_property(struct power_supply *psy,
                 if (ret)
                         return ret;
 
-                val->intval = (int)be16_to_cpu(ec_word) * 100 / 256;
+                val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256;
                 break;
         case POWER_SUPPLY_PROP_TEMP_AMBIENT:
                 ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2);
@@ -313,7 +313,7 @@ static int olpc_bat_get_property(struct power_supply *psy,
                 if (ret)
                         return ret;
 
-                val->intval = (int)be16_to_cpu(ec_word) * 6250 / 15;
+                val->intval = (s16)be16_to_cpu(ec_word) * 6250 / 15;
                 break;
         case POWER_SUPPLY_PROP_SERIAL_NUMBER:
                 ret = olpc_ec_cmd(EC_BAT_SERIAL, NULL, 0, (void *)&ser_buf, 8);
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index 5856167a0c90..dd8242d489b8 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -36,6 +36,7 @@
 #include <linux/platform_device.h>
 #include <linux/mod_devicetable.h>
 #include <linux/log2.h>
+#include <linux/pm.h>
 
 /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */
 #include <asm-generic/rtc.h>
@@ -850,7 +851,7 @@ static void __exit cmos_do_remove(struct device *dev)
 
 #ifdef  CONFIG_PM
 
-static int cmos_suspend(struct device *dev, pm_message_t mesg)
+static int cmos_suspend(struct device *dev)
 {
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         unsigned char   tmp;
@@ -898,7 +899,7 @@ static int cmos_suspend(struct device *dev, pm_message_t mesg)
  */
 static inline int cmos_poweroff(struct device *dev)
 {
-        return cmos_suspend(dev, PMSG_HIBERNATE);
+        return cmos_suspend(dev);
 }
 
 static int cmos_resume(struct device *dev)
@@ -945,9 +946,9 @@ static int cmos_resume(struct device *dev)
         return 0;
 }
 
+static SIMPLE_DEV_PM_OPS(cmos_pm_ops, cmos_suspend, cmos_resume);
+
 #else
-#define cmos_suspend    NULL
-#define cmos_resume     NULL
 
 static inline int cmos_poweroff(struct device *dev)
 {
@@ -1077,7 +1078,7 @@ static void __exit cmos_pnp_remove(struct pnp_dev *pnp)
 
 static int cmos_pnp_suspend(struct pnp_dev *pnp, pm_message_t mesg)
 {
-        return cmos_suspend(&pnp->dev, mesg);
+        return cmos_suspend(&pnp->dev);
 }
 
 static int cmos_pnp_resume(struct pnp_dev *pnp)
@@ -1157,8 +1158,9 @@ static struct platform_driver cmos_platform_driver = {
         .shutdown       = cmos_platform_shutdown,
         .driver = {
                 .name           = (char *) driver_name,
-                .suspend        = cmos_suspend,
-                .resume         = cmos_resume,
+#ifdef CONFIG_PM
+                .pm             = &cmos_pm_ops,
+#endif
         }
 };
 
diff --git a/drivers/rtc/rtc-rs5c372.c b/drivers/rtc/rtc-rs5c372.c
index 90cf0a6ff23e..dd14e202c2c8 100644
--- a/drivers/rtc/rtc-rs5c372.c
+++ b/drivers/rtc/rtc-rs5c372.c
@@ -207,7 +207,7 @@ static int rs5c372_get_datetime(struct i2c_client *client, struct rtc_time *tm)
 static int rs5c372_set_datetime(struct i2c_client *client, struct rtc_time *tm)
 {
         struct rs5c372  *rs5c = i2c_get_clientdata(client);
-        unsigned char   buf[8];
+        unsigned char   buf[7];
         int             addr;
 
         dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d "
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index f0037eefd44e..142af5bc3a4f 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -91,6 +91,12 @@ enum qdio_irq_states {
 #define AC1_SC_QEBSM_AVAILABLE          0x02    /* available for subchannel */
 #define AC1_SC_QEBSM_ENABLED            0x01    /* enabled for subchannel */
 
+/* SIGA flags */
+#define QDIO_SIGA_WRITE         0x00
+#define QDIO_SIGA_READ          0x01
+#define QDIO_SIGA_SYNC          0x02
+#define QDIO_SIGA_QEBSM_FLAG    0x80
+
 #ifdef CONFIG_64BIT
 static inline int do_sqbs(u64 token, unsigned char state, int queue,
                           int *start, int *count)
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 00520f9a7a8e..1763afcd89ec 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -29,11 +29,12 @@ MODULE_AUTHOR("Utz Bacher <utz.bacher@de.ibm.com>,"\
 MODULE_DESCRIPTION("QDIO base support");
 MODULE_LICENSE("GPL");
 
-static inline int do_siga_sync(struct subchannel_id schid,
-                               unsigned int out_mask, unsigned int in_mask)
+static inline int do_siga_sync(unsigned long schid,
+                               unsigned int out_mask, unsigned int in_mask,
+                               unsigned int fc)
 {
-        register unsigned long __fc asm ("0") = 2;
-        register struct subchannel_id __schid asm ("1") = schid;
+        register unsigned long __fc asm ("0") = fc;
+        register unsigned long __schid asm ("1") = schid;
         register unsigned long out asm ("2") = out_mask;
         register unsigned long in asm ("3") = in_mask;
         int cc;
@@ -47,10 +48,11 @@ static inline int do_siga_sync(struct subchannel_id schid,
         return cc;
 }
 
-static inline int do_siga_input(struct subchannel_id schid, unsigned int mask)
+static inline int do_siga_input(unsigned long schid, unsigned int mask,
+                                unsigned int fc)
 {
-        register unsigned long __fc asm ("0") = 1;
-        register struct subchannel_id __schid asm ("1") = schid;
+        register unsigned long __fc asm ("0") = fc;
+        register unsigned long __schid asm ("1") = schid;
         register unsigned long __mask asm ("2") = mask;
         int cc;
 
@@ -279,6 +281,8 @@ void qdio_init_buf_states(struct qdio_irq *irq_ptr)
 static inline int qdio_siga_sync(struct qdio_q *q, unsigned int output,
                           unsigned int input)
 {
+        unsigned long schid = *((u32 *) &q->irq_ptr->schid);
+        unsigned int fc = QDIO_SIGA_SYNC;
         int cc;
 
         if (!need_siga_sync(q))
@@ -287,7 +291,12 @@ static inline int qdio_siga_sync(struct qdio_q *q, unsigned int output,
         DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-s:%1d", q->nr);
         qperf_inc(q, siga_sync);
 
-        cc = do_siga_sync(q->irq_ptr->schid, output, input);
+        if (is_qebsm(q)) {
+                schid = q->irq_ptr->sch_token;
+                fc |= QDIO_SIGA_QEBSM_FLAG;
+        }
+
+        cc = do_siga_sync(schid, output, input, fc);
         if (cc)
                 DBF_ERROR("%4x SIGA-S:%2d", SCH_NO(q), cc);
         return cc;
@@ -313,8 +322,8 @@ static inline int qdio_siga_sync_all(struct qdio_q *q)
 
 static int qdio_siga_output(struct qdio_q *q, unsigned int *busy_bit)
 {
-        unsigned long schid;
-        unsigned int fc = 0;
+        unsigned long schid = *((u32 *) &q->irq_ptr->schid);
+        unsigned int fc = QDIO_SIGA_WRITE;
         u64 start_time = 0;
         int cc;
 
@@ -323,11 +332,8 @@ static int qdio_siga_output(struct qdio_q *q, unsigned int *busy_bit)
 
         if (is_qebsm(q)) {
                 schid = q->irq_ptr->sch_token;
-                fc |= 0x80;
+                fc |= QDIO_SIGA_QEBSM_FLAG;
         }
-        else
-                schid = *((u32 *)&q->irq_ptr->schid);
-
 again:
         cc = do_siga_output(schid, q->mask, busy_bit, fc);
 
@@ -347,12 +353,19 @@ again:
 
 static inline int qdio_siga_input(struct qdio_q *q)
 {
+        unsigned long schid = *((u32 *) &q->irq_ptr->schid);
+        unsigned int fc = QDIO_SIGA_READ;
         int cc;
 
         DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-r:%1d", q->nr);
         qperf_inc(q, siga_read);
 
-        cc = do_siga_input(q->irq_ptr->schid, q->mask);
+        if (is_qebsm(q)) {
+                schid = q->irq_ptr->sch_token;
+                fc |= QDIO_SIGA_QEBSM_FLAG;
+        }
+
+        cc = do_siga_input(schid, q->mask, fc);
         if (cc)
                 DBF_ERROR("%4x SIGA-R:%2d", SCH_NO(q), cc);
         return cc;
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index b860d650a563..4cf7ffa2dad3 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -4175,6 +4175,14 @@ static int ioc_general(void __user *arg, char *cmnd)
     ha = gdth_find_ha(gen.ionode);
     if (!ha)
         return -EFAULT;
+
+    if (gen.data_len > INT_MAX)
+        return -EINVAL;
+    if (gen.sense_len > INT_MAX)
+        return -EINVAL;
+    if (gen.data_len + gen.sense_len > INT_MAX)
+        return -EINVAL;
+
     if (gen.data_len + gen.sense_len != 0) {
         if (!(buf = gdth_ioctl_alloc(ha, gen.data_len + gen.sense_len,
                                      FALSE, &paddr)))
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 042153cbbde1..ddbade7beec9 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -347,6 +347,7 @@ static int sas_ata_scr_read(struct ata_link *link, unsigned int sc_reg_in,
 static struct ata_port_operations sas_sata_ops = {
         .phy_reset              = sas_ata_phy_reset,
         .post_internal_cmd      = sas_ata_post_internal,
+        .qc_defer               = ata_std_qc_defer,
         .qc_prep                = ata_noop_qc_prep,
         .qc_issue               = sas_ata_qc_issue,
         .qc_fill_rtf            = sas_ata_qc_fill_rtf,
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index f0cfba9a1fc8..baf2b6039952 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -649,6 +649,7 @@ void sas_scsi_recover_host(struct Scsi_Host *shost)
 
         spin_lock_irqsave(shost->host_lock, flags);
         list_splice_init(&shost->eh_cmd_q, &eh_work_q);
+        shost->host_eh_scheduled = 0;
         spin_unlock_irqrestore(shost->host_lock, flags);
 
         SAS_DPRINTK("Enter %s\n", __func__);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 57bcd5c9dcff..9e590265a020 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -2057,9 +2057,9 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
                 /* adjust hba_queue_depth, reply_free_queue_depth,
                  * and queue_size
                  */
-                ioc->hba_queue_depth -= queue_diff;
-                ioc->reply_free_queue_depth -= queue_diff;
-                queue_size -= queue_diff;
+                ioc->hba_queue_depth -= (queue_diff / 2);
+                ioc->reply_free_queue_depth -= (queue_diff / 2);
+                queue_size = facts->MaxReplyDescriptorPostQueueDepth;
         }
         ioc->reply_post_queue_depth = queue_size;
 
@@ -3662,6 +3662,11 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
         ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
         mutex_init(&ioc->scsih_cmds.mutex);
 
+        /* scsih internal command bits */
+        ioc->scsih_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL);
+        ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
+        mutex_init(&ioc->scsih_cmds.mutex);
+
         /* task management internal command bits */
         ioc->tm_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL);
         ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
@@ -3786,6 +3791,8 @@ mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc)
 static void
 _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
 {
+        mpt2sas_scsih_reset_handler(ioc, reset_phase);
+        mpt2sas_ctl_reset_handler(ioc, reset_phase);
         switch (reset_phase) {
         case MPT2_IOC_PRE_RESET:
                 dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: "
@@ -3816,8 +3823,6 @@ _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
                     "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
                 break;
         }
-        mpt2sas_scsih_reset_handler(ioc, reset_phase);
-        mpt2sas_ctl_reset_handler(ioc, reset_phase);
 }
 
 /**
@@ -3871,6 +3876,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
 {
         int r;
         unsigned long flags;
+        u8 pe_complete = ioc->wait_for_port_enable_to_complete;
 
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
             __func__));
@@ -3913,6 +3919,14 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
         if (r)
                 goto out;
         _base_reset_handler(ioc, MPT2_IOC_AFTER_RESET);
+
+        /* If this hard reset is called while port enable is active, then
+         * there is no reason to call make_ioc_operational
+         */
+        if (pe_complete) {
+                r = -EFAULT;
+                goto out;
+        }
         r = _base_make_ioc_operational(ioc, sleep_flag);
         if (!r)
                 _base_reset_handler(ioc, MPT2_IOC_DONE_RESET);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 16e99b686354..794d927f70c1 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -819,7 +819,7 @@ _scsih_is_end_device(u32 device_info)
 }
 
 /**
- * mptscsih_get_scsi_lookup - returns scmd entry
+ * _scsih_scsi_lookup_get - returns scmd entry
  * @ioc: per adapter object
  * @smid: system request message index
  *
@@ -832,6 +832,28 @@ _scsih_scsi_lookup_get(struct MPT2SAS_ADAPTER *ioc, u16 smid)
 }
 
 /**
+ * _scsih_scsi_lookup_get_clear - returns scmd entry
+ * @ioc: per adapter object
+ * @smid: system request message index
+ *
+ * Returns the smid stored scmd pointer.
+ * Then will derefrence the stored scmd pointer.
+ */
+static inline struct scsi_cmnd *
+_scsih_scsi_lookup_get_clear(struct MPT2SAS_ADAPTER *ioc, u16 smid)
+{
+        unsigned long flags;
+        struct scsi_cmnd *scmd;
+
+        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+        scmd = ioc->scsi_lookup[smid - 1].scmd;
+        ioc->scsi_lookup[smid - 1].scmd = NULL;
+        spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+
+        return scmd;
+}
+
+/**
  * _scsih_scsi_lookup_find_by_scmd - scmd lookup
  * @ioc: per adapter object
  * @smid: system request message index
@@ -2957,9 +2979,6 @@ _scsih_check_topo_delete_events(struct MPT2SAS_ADAPTER *ioc,
         u16 handle;
 
         for (i = 0 ; i < event_data->NumEntries; i++) {
-                if (event_data->PHY[i].PhyStatus &
-                    MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT)
-                        continue;
                 handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
                 if (!handle)
                         continue;
@@ -3186,7 +3205,7 @@ _scsih_flush_running_cmds(struct MPT2SAS_ADAPTER *ioc)
         u16 count = 0;
 
         for (smid = 1; smid <= ioc->scsiio_depth; smid++) {
-                scmd = _scsih_scsi_lookup_get(ioc, smid);
+                scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
                 if (!scmd)
                         continue;
                 count++;
@@ -3778,7 +3797,7 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         u32 response_code = 0;
 
         mpi_reply = mpt2sas_base_get_reply_virt_addr(ioc, reply);
-        scmd = _scsih_scsi_lookup_get(ioc, smid);
+        scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
         if (scmd == NULL)
                 return 1;
 
@@ -4940,6 +4959,12 @@ _scsih_sas_device_status_change_event(struct MPT2SAS_ADAPTER *ioc,
                      event_data);
 #endif
 
+        /* In MPI Revision K (0xC), the internal device reset complete was
+         * implemented, so avoid setting tm_busy flag for older firmware.
+         */
+        if ((ioc->facts.HeaderVersion >> 8) < 0xC)
+                return;
+
         if (event_data->ReasonCode !=
             MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET &&
            event_data->ReasonCode !=
@@ -5034,6 +5059,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
     struct fw_event_work *fw_event)
 {
         struct scsi_cmnd *scmd;
+        struct scsi_device *sdev;
         u16 smid, handle;
         u32 lun;
         struct MPT2SAS_DEVICE *sas_device_priv_data;
@@ -5044,12 +5070,17 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
         Mpi2EventDataSasBroadcastPrimitive_t *event_data = fw_event->event_data;
 #endif
         u16 ioc_status;
+        unsigned long flags;
+        int r;
+
         dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "broadcast primative: "
             "phy number(%d), width(%d)\n", ioc->name, event_data->PhyNum,
             event_data->PortWidth));
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
             __func__));
 
+        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+        ioc->broadcast_aen_busy = 0;
         termination_count = 0;
         query_count = 0;
         mpi_reply = ioc->tm_cmds.reply;
@@ -5057,7 +5088,8 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                 scmd = _scsih_scsi_lookup_get(ioc, smid);
                 if (!scmd)
                         continue;
-                sas_device_priv_data = scmd->device->hostdata;
+                sdev = scmd->device;
+                sas_device_priv_data = sdev->hostdata;
                 if (!sas_device_priv_data || !sas_device_priv_data->sas_target)
                         continue;
                  /* skip hidden raid components */
@@ -5073,6 +5105,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                 lun = sas_device_priv_data->lun;
                 query_count++;
 
+                spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
                 mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
                     MPI2_SCSITASKMGMT_TASKTYPE_QUERY_TASK, smid, 30, NULL);
                 ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
@@ -5082,14 +5115,20 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                     (mpi_reply->ResponseCode ==
                      MPI2_SCSITASKMGMT_RSP_TM_SUCCEEDED ||
                      mpi_reply->ResponseCode ==
-                     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC))
+                     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC)) {
+                        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
                         continue;
-
-                mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
-                    MPI2_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET, 0, 30, NULL);
+                }
+                r = mpt2sas_scsih_issue_tm(ioc, handle, sdev->channel, sdev->id,
+                    sdev->lun, MPI2_SCSITASKMGMT_TASKTYPE_ABORT_TASK, smid, 30,
+                    scmd);
+                if (r == FAILED)
+                        sdev_printk(KERN_WARNING, sdev, "task abort: FAILED "
+                            "scmd(%p)\n", scmd);
                 termination_count += le32_to_cpu(mpi_reply->TerminationCount);
+                spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
         }
-        ioc->broadcast_aen_busy = 0;
+        spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
 
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT
             "%s - exit, query_count = %d termination_count = %d\n",
@@ -6685,6 +6724,7 @@ _scsih_remove(struct pci_dev *pdev)
                 destroy_workqueue(wq);
 
         /* release all the volumes */
+        _scsih_ir_shutdown(ioc);
         list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list,
             list) {
                 if (raid_device->starget) {
diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
index 6cfa0145a1d7..dd78f9e8eb9b 100644
--- a/drivers/scsi/pmcraid.h
+++ b/drivers/scsi/pmcraid.h
@@ -568,7 +568,6 @@ struct pmcraid_cmd {
         struct pmcraid_control_block *ioa_cb;
         dma_addr_t ioa_cb_bus_addr;
         dma_addr_t dma_handle;
-        u8 *sense_buffer;
 
         /* pointer to mid layer structure of SCSI commands */
         struct scsi_cmnd *scsi_cmd;
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index 1a1b281cea33..16df82ac1b26 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -92,6 +92,7 @@ extern int ql2xshiftctondsd;
 extern int ql2xdbwr;
 extern int ql2xdontresethba;
 extern int ql2xasynctmfenable;
+extern int ql2xgffidenable;
 extern int ql2xenabledif;
 extern int ql2xenablehba_err_chk;
 extern int ql2xtargetreset;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 9c383baebe27..49e7b0916364 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -3258,8 +3258,9 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                         continue;
 
                 /* Bypass ports whose FCP-4 type is not FCP_SCSI */
-                if (new_fcport->fc4_type != FC4_TYPE_FCP_SCSI &&
-                    new_fcport->fc4_type != FC4_TYPE_UNKNOWN)
+                if (ql2xgffidenable &&
+                    (new_fcport->fc4_type != FC4_TYPE_FCP_SCSI &&
+                    new_fcport->fc4_type != FC4_TYPE_UNKNOWN))
                         continue;
 
                 /* Locate matching device in database. */
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 579f02854665..de844996743c 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -1061,6 +1061,7 @@ qla24xx_build_scsi_crc_2_iocbs(srb_t *sp, struct cmd_type_crc_2 *cmd_pkt,
                 fcp_cmnd->additional_cdb_len |= 2;
 
         int_to_scsilun(sp->cmd->device->lun, &fcp_cmnd->lun);
+        host_to_fcp_swap((uint8_t *)&fcp_cmnd->lun, sizeof(fcp_cmnd->lun));
         memcpy(fcp_cmnd->cdb, cmd->cmnd, cmd->cmd_len);
         cmd_pkt->fcp_cmnd_dseg_len = cpu_to_le16(fcp_cmnd_len);
         cmd_pkt->fcp_cmnd_dseg_address[0] = cpu_to_le32(
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 0a71cc71eab2..424cf189af27 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -2740,6 +2740,7 @@ sufficient_dsds:
                         goto queuing_error_fcp_cmnd;
 
                 int_to_scsilun(sp->cmd->device->lun, &cmd_pkt->lun);
+                host_to_fcp_swap((uint8_t *)&cmd_pkt->lun, sizeof(cmd_pkt->lun));
 
                 /* build FCP_CMND IU */
                 memset(ctx->fcp_cmnd, 0, sizeof(struct fcp_cmnd));
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 1e4bff695254..202a31ab2f18 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -160,6 +160,11 @@ MODULE_PARM_DESC(ql2xtargetreset,
                  "Enable target reset."
                  "Default is 1 - use hw defaults.");
 
+int ql2xgffidenable;
+module_param(ql2xgffidenable, int, S_IRUGO|S_IRUSR);
+MODULE_PARM_DESC(ql2xgffidenable,
+                "Enables GFF_ID checks of port type. "
+                "Default is 0 - Do not use GFF_ID information.");
 
 int ql2xasynctmfenable;
 module_param(ql2xasynctmfenable, int, S_IRUGO|S_IRUSR);
@@ -2090,6 +2095,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 ha->init_cb_size = sizeof(struct mid_init_cb_81xx);
                 ha->gid_list_info_size = 8;
                 ha->optrom_size = OPTROM_SIZE_82XX;
+                ha->nvram_npiv_size = QLA_MAX_VPORTS_QLA25XX;
                 ha->isp_ops = &qla82xx_isp_ops;
                 ha->flash_conf_off = FARX_ACCESS_FLASH_CONF;
                 ha->flash_data_off = FARX_ACCESS_FLASH_DATA;
diff --git a/drivers/scsi/qla4xxx/ql4_nx.c b/drivers/scsi/qla4xxx/ql4_nx.c
index 5d4a3822382d..449256f2c5f8 100644
--- a/drivers/scsi/qla4xxx/ql4_nx.c
+++ b/drivers/scsi/qla4xxx/ql4_nx.c
@@ -5,6 +5,7 @@
  * See LICENSE.qla4xxx for copyright and licensing details.
  */
 #include <linux/delay.h>
+#include <linux/io.h>
 #include <linux/pci.h>
 #include "ql4_def.h"
 #include "ql4_glbl.h"
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ee02d3838a0a..5bff8a2396e4 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1632,9 +1632,8 @@ struct request_queue *__scsi_alloc_queue(struct Scsi_Host *shost,
 
         blk_queue_max_segment_size(q, dma_get_max_seg_size(dev));
 
-        /* New queue, no concurrency on queue_flags */
         if (!shost->use_clustering)
-                queue_flag_clear_unlocked(QUEUE_FLAG_CLUSTER, q);
+                q->limits.cluster = 0;
 
         /*
          * set a reasonable default alignment on word boundaries: the
@@ -2428,7 +2427,8 @@ scsi_internal_device_unblock(struct scsi_device *sdev)
                 sdev->sdev_state = SDEV_RUNNING;
         else if (sdev->sdev_state == SDEV_CREATED_BLOCK)
                 sdev->sdev_state = SDEV_CREATED;
-        else
+        else if (sdev->sdev_state != SDEV_CANCEL &&
+                 sdev->sdev_state != SDEV_OFFLINE)
                 return -EINVAL;
 
         spin_lock_irqsave(q->queue_lock, flags);
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index c3f67373a4f8..7a0ca6fdbd79 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -962,10 +962,11 @@ static void __scsi_remove_target(struct scsi_target *starget)
         list_for_each_entry(sdev, &shost->__devices, siblings) {
                 if (sdev->channel != starget->channel ||
                     sdev->id != starget->id ||
-                    sdev->sdev_state == SDEV_DEL)
+                    scsi_device_get(sdev))
                         continue;
                 spin_unlock_irqrestore(shost->host_lock, flags);
                 scsi_remove_device(sdev);
+                scsi_device_put(sdev);
                 spin_lock_irqsave(shost->host_lock, flags);
                 goto restart;
         }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index ffa0689ee840..c52273c1327a 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1153,6 +1153,12 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
         u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
         u64 bad_lba;
         int info_valid;
+        /*
+         * resid is optional but mostly filled in.  When it's unused,
+         * its value is zero, so we assume the whole buffer transferred
+         */
+        unsigned int transferred = scsi_bufflen(scmd) - scsi_get_resid(scmd);
+        unsigned int good_bytes;
 
         if (scmd->request->cmd_type != REQ_TYPE_FS)
                 return 0;
@@ -1186,7 +1192,8 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
         /* This computation should always be done in terms of
          * the resolution of the device's medium.
          */
-        return (bad_lba - start_lba) * scmd->device->sector_size;
+        good_bytes = (bad_lba - start_lba) * scmd->device->sector_size;
+        return min(good_bytes, transferred);
 }
 
 /**
@@ -2252,11 +2259,10 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
         index = sdkp->index;
         dev = &sdp->sdev_gendev;
 
-        if (index < SD_MAX_DISKS) {
-                gd->major = sd_major((index & 0xf0) >> 4);
-                gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
-                gd->minors = SD_MINORS;
-        }
+        gd->major = sd_major((index & 0xf0) >> 4);
+        gd->first_minor = ((index & 0xf) << 4) | (index & 0xfff00);
+        gd->minors = SD_MINORS;
+
         gd->fops = &sd_fops;
         gd->private_data = &sdkp->driver;
         gd->queue = sdkp->device->request_queue;
@@ -2346,6 +2352,12 @@ static int sd_probe(struct device *dev)
         if (error)
                 goto out_put;
 
+        if (index >= SD_MAX_DISKS) {
+                error = -ENODEV;
+                sdev_printk(KERN_WARNING, sdp, "SCSI disk (sd) name space exhausted.\n");
+                goto out_free_index;
+        }
+
         error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);
         if (error)
                 goto out_free_index;
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 24110f6f61e0..c9e86deba5e3 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -241,7 +241,8 @@ static const struct serial8250_config uart_config[] = {
                 .fifo_size      = 128,
                 .tx_loadsz      = 128,
                 .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
-                .flags          = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
+                /* UART_CAP_EFR breaks billionon CF bluetooth card. */
+                .flags          = UART_CAP_FIFO | UART_CAP_SLEEP,
         },
         [PORT_16654] = {
                 .name           = "ST16654",
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
index 5dff45c76d32..f083f7c90c29 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/serial/mfd.c
@@ -892,8 +892,7 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
         unsigned char cval, fcr = 0;
         unsigned long flags;
         unsigned int baud, quot;
-        u32 mul = 0x3600;
-        u32 ps = 0x10;
+        u32 ps, mul;
 
         switch (termios->c_cflag & CSIZE) {
         case CS5:
@@ -937,20 +936,19 @@ serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
                 ps = 0xC;
                 quot = 1;
                 break;
-        case 2500000:
-                mul = 0x2710;
-                ps = 0x10;
-                quot = 1;
-                break;
         case 18432000:
                 mul = 0x2400;
                 ps = 0x10;
                 quot = 1;
                 break;
+        case 3000000:
+        case 2500000:
+        case 2000000:
         case 1500000:
-                mul = 0x1D4C;
-                ps = 0xc;
-                quot = 1;
+        case 1000000:
+        case 500000:
+                /* mul/ps/quot = 0x9C4/0x10/0x1 will make a 500000 bps */
+                mul = baud / 500000 * 0x9C4;
                 break;
         default:
                 ;
diff --git a/drivers/ssb/b43_pci_bridge.c b/drivers/ssb/b43_pci_bridge.c
index ef9c6a04ad8f..744d3f6e4709 100644
--- a/drivers/ssb/b43_pci_bridge.c
+++ b/drivers/ssb/b43_pci_bridge.c
@@ -24,6 +24,7 @@ static const struct pci_device_id b43_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4315) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4318) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BCM_GVC,  0x4318) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
diff --git a/drivers/ssb/pcmcia.c b/drivers/ssb/pcmcia.c
index 526682d68de8..17053a5eb258 100644
--- a/drivers/ssb/pcmcia.c
+++ b/drivers/ssb/pcmcia.c
@@ -734,7 +734,7 @@ int ssb_pcmcia_get_invariants(struct ssb_bus *bus,
 
         /* Fetch the vendor specific tuples. */
         res = pcmcia_loop_tuple(bus->host_pcmcia, SSB_PCMCIA_CIS,
-                                ssb_pcmcia_do_get_invariants, sprom);
+                                ssb_pcmcia_do_get_invariants, iv);
         if ((res == 0) || (res == -ENOSPC))
                 return 0;
 
diff --git a/drivers/staging/asus_oled/asus_oled.c b/drivers/staging/asus_oled/asus_oled.c
index 5b279fb30f3f..62445551eecf 100644
--- a/drivers/staging/asus_oled/asus_oled.c
+++ b/drivers/staging/asus_oled/asus_oled.c
@@ -620,13 +620,13 @@ static ssize_t class_set_picture(struct device *device,
 
 #define ASUS_OLED_DEVICE_ATTR(_file)            dev_attr_asus_oled_##_file
 
-static DEVICE_ATTR(asus_oled_enabled, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(asus_oled_enabled, S_IWUSR | S_IRUGO,
                    get_enabled, set_enabled);
-static DEVICE_ATTR(asus_oled_picture, S_IWUGO , NULL, set_picture);
+static DEVICE_ATTR(asus_oled_picture, S_IWUSR , NULL, set_picture);
 
-static DEVICE_ATTR(enabled, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(enabled, S_IWUSR | S_IRUGO,
                    class_get_enabled, class_set_enabled);
-static DEVICE_ATTR(picture, S_IWUGO, NULL, class_set_picture);
+static DEVICE_ATTR(picture, S_IWUSR, NULL, class_set_picture);
 
 static int asus_oled_probe(struct usb_interface *interface,
                            const struct usb_device_id *id)
diff --git a/drivers/staging/batman-adv/soft-interface.c b/drivers/staging/batman-adv/soft-interface.c
index 2ea97de435ce..876be5a2913d 100644
--- a/drivers/staging/batman-adv/soft-interface.c
+++ b/drivers/staging/batman-adv/soft-interface.c
@@ -246,6 +246,10 @@ void interface_rx(struct sk_buff *skb, int hdr_size)
         skb_pull_rcsum(skb, hdr_size);
 /*      skb_set_mac_header(skb, -sizeof(struct ethhdr));*/
 
+        if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) {
+                kfree_skb(skb);
+                return;
+        }
         skb->dev = dev;
         skb->protocol = eth_type_trans(skb, dev);
 
diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c
index 8b383ee959b2..5c6c72744167 100644
--- a/drivers/staging/comedi/drivers/jr3_pci.c
+++ b/drivers/staging/comedi/drivers/jr3_pci.c
@@ -54,6 +54,7 @@ Devices: [JR3] PCI force sensor board (jr3_pci)
 
 #define PCI_VENDOR_ID_JR3 0x1762
 #define PCI_DEVICE_ID_JR3_1_CHANNEL 0x3111
+#define PCI_DEVICE_ID_JR3_1_CHANNEL_NEW 0x1111
 #define PCI_DEVICE_ID_JR3_2_CHANNEL 0x3112
 #define PCI_DEVICE_ID_JR3_3_CHANNEL 0x3113
 #define PCI_DEVICE_ID_JR3_4_CHANNEL 0x3114
@@ -73,6 +74,8 @@ static DEFINE_PCI_DEVICE_TABLE(jr3_pci_pci_table) = {
         {
         PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_1_CHANNEL,
                     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
+        PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_1_CHANNEL_NEW,
+                    PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
         PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_2_CHANNEL,
                     PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
         PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_3_CHANNEL,
@@ -807,6 +810,10 @@ static int jr3_pci_attach(struct comedi_device *dev,
                                         devpriv->n_channels = 1;
                                 }
                                 break;
+                        case PCI_DEVICE_ID_JR3_1_CHANNEL_NEW:{
+                                        devpriv->n_channels = 1;
+                                }
+                                break;
                         case PCI_DEVICE_ID_JR3_2_CHANNEL:{
                                         devpriv->n_channels = 2;
                                 }
diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
index 3acf7e62bec4..681312d1911c 100644
--- a/drivers/staging/comedi/drivers/ni_labpc.c
+++ b/drivers/staging/comedi/drivers/ni_labpc.c
@@ -572,7 +572,8 @@ int labpc_common_attach(struct comedi_device *dev, unsigned long iobase,
         /* grab our IRQ */
         if (irq) {
                 isr_flags = 0;
-                if (thisboard->bustype == pci_bustype)
+                if (thisboard->bustype == pci_bustype
+                    || thisboard->bustype == pcmcia_bustype)
                         isr_flags |= IRQF_SHARED;
                 if (request_irq(irq, labpc_interrupt, isr_flags,
                                 driver_labpc.driver_name, dev)) {
diff --git a/drivers/staging/cx25821/cx25821-video.c b/drivers/staging/cx25821/cx25821-video.c
index 1d5e8796d383..0d318c739528 100644
--- a/drivers/staging/cx25821/cx25821-video.c
+++ b/drivers/staging/cx25821/cx25821-video.c
@@ -92,7 +92,7 @@ int cx25821_get_format_size(void)
         return ARRAY_SIZE(formats);
 }
 
-struct cx25821_fmt *format_by_fourcc(unsigned int fourcc)
+struct cx25821_fmt *cx25821_format_by_fourcc(unsigned int fourcc)
 {
         unsigned int i;
 
@@ -848,7 +848,7 @@ static int video_open(struct file *file)
        pix_format =
            (dev->channels[ch_id].pixel_formats ==
             PIXEL_FRMT_411) ? V4L2_PIX_FMT_Y41P : V4L2_PIX_FMT_YUYV;
-       fh->fmt = format_by_fourcc(pix_format);
+       fh->fmt = cx25821_format_by_fourcc(pix_format);
 
        v4l2_prio_open(&dev->channels[ch_id].prio, &fh->prio);
 
@@ -1009,7 +1009,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
        if (0 != err)
                return err;
 
-       fh->fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+       fh->fmt = cx25821_format_by_fourcc(f->fmt.pix.pixelformat);
        fh->vidq.field = f->fmt.pix.field;
 
        /* check if width and height is valid based on set standard */
@@ -1117,7 +1117,7 @@ int cx25821_vidioc_try_fmt_vid_cap(struct file *file, void *priv, struct v4l2_fo
         enum v4l2_field field;
         unsigned int maxw, maxh;
 
-        fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+        fmt = cx25821_format_by_fourcc(f->fmt.pix.pixelformat);
         if (NULL == fmt)
                 return -EINVAL;
 
diff --git a/drivers/staging/cx25821/cx25821-video.h b/drivers/staging/cx25821/cx25821-video.h
index cc6034b1a95d..a2415d33235b 100644
--- a/drivers/staging/cx25821/cx25821-video.h
+++ b/drivers/staging/cx25821/cx25821-video.h
@@ -87,7 +87,7 @@ extern unsigned int vid_limit;
 
 #define FORMAT_FLAGS_PACKED       0x01
 extern struct cx25821_fmt formats[];
-extern struct cx25821_fmt *format_by_fourcc(unsigned int fourcc);
+extern struct cx25821_fmt *cx25821_format_by_fourcc(unsigned int fourcc);
 extern struct cx25821_data timeout_data[MAX_VID_CHANNEL_NUM];
 
 extern void cx25821_dump_video_queue(struct cx25821_dev *dev,
diff --git a/drivers/staging/frontier/tranzport.c b/drivers/staging/frontier/tranzport.c
index eed74f0fe0b6..f21a0e8d8d9b 100644
--- a/drivers/staging/frontier/tranzport.c
+++ b/drivers/staging/frontier/tranzport.c
@@ -204,7 +204,7 @@ static void usb_tranzport_abort_transfers(struct usb_tranzport *dev)
     t->value = temp;                                                    \
     return count;                                                       \
   }                                                                     \
-  static DEVICE_ATTR(value, S_IWUGO | S_IRUGO, show_##value, set_##value);
+  static DEVICE_ATTR(value, S_IWUSR | S_IRUGO, show_##value, set_##value);
 
 show_int(enable);
 show_int(offline);
diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
index ff1d24720f11..26d3677755d1 100644
--- a/drivers/staging/hv/blkvsc_drv.c
+++ b/drivers/staging/hv/blkvsc_drv.c
@@ -369,6 +369,7 @@ static int blkvsc_probe(struct device *device)
                 blkdev->gd->first_minor = 0;
         blkdev->gd->fops = &block_ops;
         blkdev->gd->private_data = blkdev;
+        blkdev->gd->driverfs_dev = &(blkdev->device_ctx->device);
         sprintf(blkdev->gd->disk_name, "hd%c", 'a' + devnum);
 
         blkvsc_do_inquiry(blkdev);
diff --git a/drivers/staging/hv/netvsc.c b/drivers/staging/hv/netvsc.c
index 1d2ebbe17e2c..95dee473d81d 100644
--- a/drivers/staging/hv/netvsc.c
+++ b/drivers/staging/hv/netvsc.c
@@ -1250,7 +1250,7 @@ static void NetVscOnChannelCallback(void *Context)
         /* ASSERT(device); */
 
         packet = kzalloc(NETVSC_PACKET_SIZE * sizeof(unsigned char),
-                         GFP_KERNEL);
+                         GFP_ATOMIC);
         if (!packet)
                 return;
         buffer = packet;
diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
index 64a01147ecae..d2d5608b5eb4 100644
--- a/drivers/staging/hv/netvsc_drv.c
+++ b/drivers/staging/hv/netvsc_drv.c
@@ -233,6 +233,7 @@ static void netvsc_linkstatus_callback(struct hv_device *device_obj,
         if (status == 1) {
                 netif_carrier_on(net);
                 netif_wake_queue(net);
+                netif_notify_peers(net);
         } else {
                 netif_carrier_off(net);
                 netif_stop_queue(net);
diff --git a/drivers/staging/iio/accel/adis16220_core.c b/drivers/staging/iio/accel/adis16220_core.c
index bb7d76539cd7..ab2d5fa0349f 100644
--- a/drivers/staging/iio/accel/adis16220_core.c
+++ b/drivers/staging/iio/accel/adis16220_core.c
@@ -506,7 +506,7 @@ static IIO_DEVICE_ATTR(reset, S_IWUSR, NULL,
                 adis16220_write_reset, 0);
 
 #define IIO_DEV_ATTR_CAPTURE(_store)                            \
-        IIO_DEVICE_ATTR(capture, S_IWUGO, NULL, _store, 0)
+        IIO_DEVICE_ATTR(capture, S_IWUSR, NULL, _store, 0)
 
 static IIO_DEV_ATTR_CAPTURE(adis16220_write_capture);
 
diff --git a/drivers/staging/line6/control.c b/drivers/staging/line6/control.c
index 0b598526de62..e414571938a3 100644
--- a/drivers/staging/line6/control.c
+++ b/drivers/staging/line6/control.c
@@ -268,210 +268,210 @@ VARIAX_PARAM_R(float, mix2);
 VARIAX_PARAM_R(float, mix1);
 VARIAX_PARAM_R(int, pickup_wiring);
 
-static DEVICE_ATTR(tweak, S_IWUGO | S_IRUGO, pod_get_tweak, pod_set_tweak);
-static DEVICE_ATTR(wah_position, S_IWUGO | S_IRUGO, pod_get_wah_position,
+static DEVICE_ATTR(tweak, S_IWUSR | S_IRUGO, pod_get_tweak, pod_set_tweak);
+static DEVICE_ATTR(wah_position, S_IWUSR | S_IRUGO, pod_get_wah_position,
                    pod_set_wah_position);
-static DEVICE_ATTR(compression_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(compression_gain, S_IWUSR | S_IRUGO,
                    pod_get_compression_gain, pod_set_compression_gain);
-static DEVICE_ATTR(vol_pedal_position, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(vol_pedal_position, S_IWUSR | S_IRUGO,
                    pod_get_vol_pedal_position, pod_set_vol_pedal_position);
-static DEVICE_ATTR(compression_threshold, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(compression_threshold, S_IWUSR | S_IRUGO,
                    pod_get_compression_threshold,
                    pod_set_compression_threshold);
-static DEVICE_ATTR(pan, S_IWUGO | S_IRUGO, pod_get_pan, pod_set_pan);
-static DEVICE_ATTR(amp_model_setup, S_IWUGO | S_IRUGO, pod_get_amp_model_setup,
+static DEVICE_ATTR(pan, S_IWUSR | S_IRUGO, pod_get_pan, pod_set_pan);
+static DEVICE_ATTR(amp_model_setup, S_IWUSR | S_IRUGO, pod_get_amp_model_setup,
                    pod_set_amp_model_setup);
-static DEVICE_ATTR(amp_model, S_IWUGO | S_IRUGO, pod_get_amp_model,
+static DEVICE_ATTR(amp_model, S_IWUSR | S_IRUGO, pod_get_amp_model,
                    pod_set_amp_model);
-static DEVICE_ATTR(drive, S_IWUGO | S_IRUGO, pod_get_drive, pod_set_drive);
-static DEVICE_ATTR(bass, S_IWUGO | S_IRUGO, pod_get_bass, pod_set_bass);
-static DEVICE_ATTR(mid, S_IWUGO | S_IRUGO, pod_get_mid, pod_set_mid);
-static DEVICE_ATTR(lowmid, S_IWUGO | S_IRUGO, pod_get_lowmid, pod_set_lowmid);
-static DEVICE_ATTR(treble, S_IWUGO | S_IRUGO, pod_get_treble, pod_set_treble);
-static DEVICE_ATTR(highmid, S_IWUGO | S_IRUGO, pod_get_highmid,
+static DEVICE_ATTR(drive, S_IWUSR | S_IRUGO, pod_get_drive, pod_set_drive);
+static DEVICE_ATTR(bass, S_IWUSR | S_IRUGO, pod_get_bass, pod_set_bass);
+static DEVICE_ATTR(mid, S_IWUSR | S_IRUGO, pod_get_mid, pod_set_mid);
+static DEVICE_ATTR(lowmid, S_IWUSR | S_IRUGO, pod_get_lowmid, pod_set_lowmid);
+static DEVICE_ATTR(treble, S_IWUSR | S_IRUGO, pod_get_treble, pod_set_treble);
+static DEVICE_ATTR(highmid, S_IWUSR | S_IRUGO, pod_get_highmid,
                    pod_set_highmid);
-static DEVICE_ATTR(chan_vol, S_IWUGO | S_IRUGO, pod_get_chan_vol,
+static DEVICE_ATTR(chan_vol, S_IWUSR | S_IRUGO, pod_get_chan_vol,
                    pod_set_chan_vol);
-static DEVICE_ATTR(reverb_mix, S_IWUGO | S_IRUGO, pod_get_reverb_mix,
+static DEVICE_ATTR(reverb_mix, S_IWUSR | S_IRUGO, pod_get_reverb_mix,
                    pod_set_reverb_mix);
-static DEVICE_ATTR(effect_setup, S_IWUGO | S_IRUGO, pod_get_effect_setup,
+static DEVICE_ATTR(effect_setup, S_IWUSR | S_IRUGO, pod_get_effect_setup,
                    pod_set_effect_setup);
-static DEVICE_ATTR(band_1_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_1_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_1_frequency, pod_set_band_1_frequency);
-static DEVICE_ATTR(presence, S_IWUGO | S_IRUGO, pod_get_presence,
+static DEVICE_ATTR(presence, S_IWUSR | S_IRUGO, pod_get_presence,
                    pod_set_presence);
-static DEVICE_ATTR2(treble__bass, treble, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(treble__bass, treble, S_IWUSR | S_IRUGO,
                     pod_get_treble__bass, pod_set_treble__bass);
-static DEVICE_ATTR(noise_gate_enable, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(noise_gate_enable, S_IWUSR | S_IRUGO,
                    pod_get_noise_gate_enable, pod_set_noise_gate_enable);
-static DEVICE_ATTR(gate_threshold, S_IWUGO | S_IRUGO, pod_get_gate_threshold,
+static DEVICE_ATTR(gate_threshold, S_IWUSR | S_IRUGO, pod_get_gate_threshold,
                    pod_set_gate_threshold);
-static DEVICE_ATTR(gate_decay_time, S_IWUGO | S_IRUGO, pod_get_gate_decay_time,
+static DEVICE_ATTR(gate_decay_time, S_IWUSR | S_IRUGO, pod_get_gate_decay_time,
                    pod_set_gate_decay_time);
-static DEVICE_ATTR(stomp_enable, S_IWUGO | S_IRUGO, pod_get_stomp_enable,
+static DEVICE_ATTR(stomp_enable, S_IWUSR | S_IRUGO, pod_get_stomp_enable,
                    pod_set_stomp_enable);
-static DEVICE_ATTR(comp_enable, S_IWUGO | S_IRUGO, pod_get_comp_enable,
+static DEVICE_ATTR(comp_enable, S_IWUSR | S_IRUGO, pod_get_comp_enable,
                    pod_set_comp_enable);
-static DEVICE_ATTR(stomp_time, S_IWUGO | S_IRUGO, pod_get_stomp_time,
+static DEVICE_ATTR(stomp_time, S_IWUSR | S_IRUGO, pod_get_stomp_time,
                    pod_set_stomp_time);
-static DEVICE_ATTR(delay_enable, S_IWUGO | S_IRUGO, pod_get_delay_enable,
+static DEVICE_ATTR(delay_enable, S_IWUSR | S_IRUGO, pod_get_delay_enable,
                    pod_set_delay_enable);
-static DEVICE_ATTR(mod_param_1, S_IWUGO | S_IRUGO, pod_get_mod_param_1,
+static DEVICE_ATTR(mod_param_1, S_IWUSR | S_IRUGO, pod_get_mod_param_1,
                    pod_set_mod_param_1);
-static DEVICE_ATTR(delay_param_1, S_IWUGO | S_IRUGO, pod_get_delay_param_1,
+static DEVICE_ATTR(delay_param_1, S_IWUSR | S_IRUGO, pod_get_delay_param_1,
                    pod_set_delay_param_1);
-static DEVICE_ATTR(delay_param_1_note_value, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_param_1_note_value, S_IWUSR | S_IRUGO,
                    pod_get_delay_param_1_note_value,
                    pod_set_delay_param_1_note_value);
-static DEVICE_ATTR2(band_2_frequency__bass, band_2_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_2_frequency__bass, band_2_frequency, S_IWUSR | S_IRUGO,
                     pod_get_band_2_frequency__bass,
                     pod_set_band_2_frequency__bass);
-static DEVICE_ATTR(delay_param_2, S_IWUGO | S_IRUGO, pod_get_delay_param_2,
+static DEVICE_ATTR(delay_param_2, S_IWUSR | S_IRUGO, pod_get_delay_param_2,
                    pod_set_delay_param_2);
-static DEVICE_ATTR(delay_volume_mix, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_volume_mix, S_IWUSR | S_IRUGO,
                    pod_get_delay_volume_mix, pod_set_delay_volume_mix);
-static DEVICE_ATTR(delay_param_3, S_IWUGO | S_IRUGO, pod_get_delay_param_3,
+static DEVICE_ATTR(delay_param_3, S_IWUSR | S_IRUGO, pod_get_delay_param_3,
                    pod_set_delay_param_3);
-static DEVICE_ATTR(reverb_enable, S_IWUGO | S_IRUGO, pod_get_reverb_enable,
+static DEVICE_ATTR(reverb_enable, S_IWUSR | S_IRUGO, pod_get_reverb_enable,
                    pod_set_reverb_enable);
-static DEVICE_ATTR(reverb_type, S_IWUGO | S_IRUGO, pod_get_reverb_type,
+static DEVICE_ATTR(reverb_type, S_IWUSR | S_IRUGO, pod_get_reverb_type,
                    pod_set_reverb_type);
-static DEVICE_ATTR(reverb_decay, S_IWUGO | S_IRUGO, pod_get_reverb_decay,
+static DEVICE_ATTR(reverb_decay, S_IWUSR | S_IRUGO, pod_get_reverb_decay,
                    pod_set_reverb_decay);
-static DEVICE_ATTR(reverb_tone, S_IWUGO | S_IRUGO, pod_get_reverb_tone,
+static DEVICE_ATTR(reverb_tone, S_IWUSR | S_IRUGO, pod_get_reverb_tone,
                    pod_set_reverb_tone);
-static DEVICE_ATTR(reverb_pre_delay, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(reverb_pre_delay, S_IWUSR | S_IRUGO,
                    pod_get_reverb_pre_delay, pod_set_reverb_pre_delay);
-static DEVICE_ATTR(reverb_pre_post, S_IWUGO | S_IRUGO, pod_get_reverb_pre_post,
+static DEVICE_ATTR(reverb_pre_post, S_IWUSR | S_IRUGO, pod_get_reverb_pre_post,
                    pod_set_reverb_pre_post);
-static DEVICE_ATTR(band_2_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_2_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_2_frequency, pod_set_band_2_frequency);
-static DEVICE_ATTR2(band_3_frequency__bass, band_3_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_3_frequency__bass, band_3_frequency, S_IWUSR | S_IRUGO,
                     pod_get_band_3_frequency__bass,
                     pod_set_band_3_frequency__bass);
-static DEVICE_ATTR(wah_enable, S_IWUGO | S_IRUGO, pod_get_wah_enable,
+static DEVICE_ATTR(wah_enable, S_IWUSR | S_IRUGO, pod_get_wah_enable,
                    pod_set_wah_enable);
-static DEVICE_ATTR(modulation_lo_cut, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(modulation_lo_cut, S_IWUSR | S_IRUGO,
                    pod_get_modulation_lo_cut, pod_set_modulation_lo_cut);
-static DEVICE_ATTR(delay_reverb_lo_cut, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_reverb_lo_cut, S_IWUSR | S_IRUGO,
                    pod_get_delay_reverb_lo_cut, pod_set_delay_reverb_lo_cut);
-static DEVICE_ATTR(volume_pedal_minimum, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(volume_pedal_minimum, S_IWUSR | S_IRUGO,
                    pod_get_volume_pedal_minimum, pod_set_volume_pedal_minimum);
-static DEVICE_ATTR(eq_pre_post, S_IWUGO | S_IRUGO, pod_get_eq_pre_post,
+static DEVICE_ATTR(eq_pre_post, S_IWUSR | S_IRUGO, pod_get_eq_pre_post,
                    pod_set_eq_pre_post);
-static DEVICE_ATTR(volume_pre_post, S_IWUGO | S_IRUGO, pod_get_volume_pre_post,
+static DEVICE_ATTR(volume_pre_post, S_IWUSR | S_IRUGO, pod_get_volume_pre_post,
                    pod_set_volume_pre_post);
-static DEVICE_ATTR(di_model, S_IWUGO | S_IRUGO, pod_get_di_model,
+static DEVICE_ATTR(di_model, S_IWUSR | S_IRUGO, pod_get_di_model,
                    pod_set_di_model);
-static DEVICE_ATTR(di_delay, S_IWUGO | S_IRUGO, pod_get_di_delay,
+static DEVICE_ATTR(di_delay, S_IWUSR | S_IRUGO, pod_get_di_delay,
                    pod_set_di_delay);
-static DEVICE_ATTR(mod_enable, S_IWUGO | S_IRUGO, pod_get_mod_enable,
+static DEVICE_ATTR(mod_enable, S_IWUSR | S_IRUGO, pod_get_mod_enable,
                    pod_set_mod_enable);
-static DEVICE_ATTR(mod_param_1_note_value, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(mod_param_1_note_value, S_IWUSR | S_IRUGO,
                    pod_get_mod_param_1_note_value,
                    pod_set_mod_param_1_note_value);
-static DEVICE_ATTR(mod_param_2, S_IWUGO | S_IRUGO, pod_get_mod_param_2,
+static DEVICE_ATTR(mod_param_2, S_IWUSR | S_IRUGO, pod_get_mod_param_2,
                    pod_set_mod_param_2);
-static DEVICE_ATTR(mod_param_3, S_IWUGO | S_IRUGO, pod_get_mod_param_3,
+static DEVICE_ATTR(mod_param_3, S_IWUSR | S_IRUGO, pod_get_mod_param_3,
                    pod_set_mod_param_3);
-static DEVICE_ATTR(mod_param_4, S_IWUGO | S_IRUGO, pod_get_mod_param_4,
+static DEVICE_ATTR(mod_param_4, S_IWUSR | S_IRUGO, pod_get_mod_param_4,
                    pod_set_mod_param_4);
-static DEVICE_ATTR(mod_param_5, S_IWUGO | S_IRUGO, pod_get_mod_param_5,
+static DEVICE_ATTR(mod_param_5, S_IWUSR | S_IRUGO, pod_get_mod_param_5,
                    pod_set_mod_param_5);
-static DEVICE_ATTR(mod_volume_mix, S_IWUGO | S_IRUGO, pod_get_mod_volume_mix,
+static DEVICE_ATTR(mod_volume_mix, S_IWUSR | S_IRUGO, pod_get_mod_volume_mix,
                    pod_set_mod_volume_mix);
-static DEVICE_ATTR(mod_pre_post, S_IWUGO | S_IRUGO, pod_get_mod_pre_post,
+static DEVICE_ATTR(mod_pre_post, S_IWUSR | S_IRUGO, pod_get_mod_pre_post,
                    pod_set_mod_pre_post);
-static DEVICE_ATTR(modulation_model, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(modulation_model, S_IWUSR | S_IRUGO,
                    pod_get_modulation_model, pod_set_modulation_model);
-static DEVICE_ATTR(band_3_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_3_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_3_frequency, pod_set_band_3_frequency);
-static DEVICE_ATTR2(band_4_frequency__bass, band_4_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_4_frequency__bass, band_4_frequency, S_IWUSR | S_IRUGO,
                     pod_get_band_4_frequency__bass,
                     pod_set_band_4_frequency__bass);
-static DEVICE_ATTR(mod_param_1_double_precision, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(mod_param_1_double_precision, S_IWUSR | S_IRUGO,
                    pod_get_mod_param_1_double_precision,
                    pod_set_mod_param_1_double_precision);
-static DEVICE_ATTR(delay_param_1_double_precision, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_param_1_double_precision, S_IWUSR | S_IRUGO,
                    pod_get_delay_param_1_double_precision,
                    pod_set_delay_param_1_double_precision);
-static DEVICE_ATTR(eq_enable, S_IWUGO | S_IRUGO, pod_get_eq_enable,
+static DEVICE_ATTR(eq_enable, S_IWUSR | S_IRUGO, pod_get_eq_enable,
                    pod_set_eq_enable);
-static DEVICE_ATTR(tap, S_IWUGO | S_IRUGO, pod_get_tap, pod_set_tap);
-static DEVICE_ATTR(volume_tweak_pedal_assign, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(tap, S_IWUSR | S_IRUGO, pod_get_tap, pod_set_tap);
+static DEVICE_ATTR(volume_tweak_pedal_assign, S_IWUSR | S_IRUGO,
                    pod_get_volume_tweak_pedal_assign,
                    pod_set_volume_tweak_pedal_assign);
-static DEVICE_ATTR(band_5_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_5_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_5_frequency, pod_set_band_5_frequency);
-static DEVICE_ATTR(tuner, S_IWUGO | S_IRUGO, pod_get_tuner, pod_set_tuner);
-static DEVICE_ATTR(mic_selection, S_IWUGO | S_IRUGO, pod_get_mic_selection,
+static DEVICE_ATTR(tuner, S_IWUSR | S_IRUGO, pod_get_tuner, pod_set_tuner);
+static DEVICE_ATTR(mic_selection, S_IWUSR | S_IRUGO, pod_get_mic_selection,
                    pod_set_mic_selection);
-static DEVICE_ATTR(cabinet_model, S_IWUGO | S_IRUGO, pod_get_cabinet_model,
+static DEVICE_ATTR(cabinet_model, S_IWUSR | S_IRUGO, pod_get_cabinet_model,
                    pod_set_cabinet_model);
-static DEVICE_ATTR(stomp_model, S_IWUGO | S_IRUGO, pod_get_stomp_model,
+static DEVICE_ATTR(stomp_model, S_IWUSR | S_IRUGO, pod_get_stomp_model,
                    pod_set_stomp_model);
-static DEVICE_ATTR(roomlevel, S_IWUGO | S_IRUGO, pod_get_roomlevel,
+static DEVICE_ATTR(roomlevel, S_IWUSR | S_IRUGO, pod_get_roomlevel,
                    pod_set_roomlevel);
-static DEVICE_ATTR(band_4_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_4_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_4_frequency, pod_set_band_4_frequency);
-static DEVICE_ATTR(band_6_frequency, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(band_6_frequency, S_IWUSR | S_IRUGO,
                    pod_get_band_6_frequency, pod_set_band_6_frequency);
-static DEVICE_ATTR(stomp_param_1_note_value, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(stomp_param_1_note_value, S_IWUSR | S_IRUGO,
                    pod_get_stomp_param_1_note_value,
                    pod_set_stomp_param_1_note_value);
-static DEVICE_ATTR(stomp_param_2, S_IWUGO | S_IRUGO, pod_get_stomp_param_2,
+static DEVICE_ATTR(stomp_param_2, S_IWUSR | S_IRUGO, pod_get_stomp_param_2,
                    pod_set_stomp_param_2);
-static DEVICE_ATTR(stomp_param_3, S_IWUGO | S_IRUGO, pod_get_stomp_param_3,
+static DEVICE_ATTR(stomp_param_3, S_IWUSR | S_IRUGO, pod_get_stomp_param_3,
                    pod_set_stomp_param_3);
-static DEVICE_ATTR(stomp_param_4, S_IWUGO | S_IRUGO, pod_get_stomp_param_4,
+static DEVICE_ATTR(stomp_param_4, S_IWUSR | S_IRUGO, pod_get_stomp_param_4,
                    pod_set_stomp_param_4);
-static DEVICE_ATTR(stomp_param_5, S_IWUGO | S_IRUGO, pod_get_stomp_param_5,
+static DEVICE_ATTR(stomp_param_5, S_IWUSR | S_IRUGO, pod_get_stomp_param_5,
                    pod_set_stomp_param_5);
-static DEVICE_ATTR(stomp_param_6, S_IWUGO | S_IRUGO, pod_get_stomp_param_6,
+static DEVICE_ATTR(stomp_param_6, S_IWUSR | S_IRUGO, pod_get_stomp_param_6,
                    pod_set_stomp_param_6);
-static DEVICE_ATTR(amp_switch_select, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(amp_switch_select, S_IWUSR | S_IRUGO,
                    pod_get_amp_switch_select, pod_set_amp_switch_select);
-static DEVICE_ATTR(delay_param_4, S_IWUGO | S_IRUGO, pod_get_delay_param_4,
+static DEVICE_ATTR(delay_param_4, S_IWUSR | S_IRUGO, pod_get_delay_param_4,
                    pod_set_delay_param_4);
-static DEVICE_ATTR(delay_param_5, S_IWUGO | S_IRUGO, pod_get_delay_param_5,
+static DEVICE_ATTR(delay_param_5, S_IWUSR | S_IRUGO, pod_get_delay_param_5,
                    pod_set_delay_param_5);
-static DEVICE_ATTR(delay_pre_post, S_IWUGO | S_IRUGO, pod_get_delay_pre_post,
+static DEVICE_ATTR(delay_pre_post, S_IWUSR | S_IRUGO, pod_get_delay_pre_post,
                    pod_set_delay_pre_post);
-static DEVICE_ATTR(delay_model, S_IWUGO | S_IRUGO, pod_get_delay_model,
+static DEVICE_ATTR(delay_model, S_IWUSR | S_IRUGO, pod_get_delay_model,
                    pod_set_delay_model);
-static DEVICE_ATTR(delay_verb_model, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(delay_verb_model, S_IWUSR | S_IRUGO,
                    pod_get_delay_verb_model, pod_set_delay_verb_model);
-static DEVICE_ATTR(tempo_msb, S_IWUGO | S_IRUGO, pod_get_tempo_msb,
+static DEVICE_ATTR(tempo_msb, S_IWUSR | S_IRUGO, pod_get_tempo_msb,
                    pod_set_tempo_msb);
-static DEVICE_ATTR(tempo_lsb, S_IWUGO | S_IRUGO, pod_get_tempo_lsb,
+static DEVICE_ATTR(tempo_lsb, S_IWUSR | S_IRUGO, pod_get_tempo_lsb,
                    pod_set_tempo_lsb);
-static DEVICE_ATTR(wah_model, S_IWUGO | S_IRUGO, pod_get_wah_model,
+static DEVICE_ATTR(wah_model, S_IWUSR | S_IRUGO, pod_get_wah_model,
                    pod_set_wah_model);
-static DEVICE_ATTR(bypass_volume, S_IWUGO | S_IRUGO, pod_get_bypass_volume,
+static DEVICE_ATTR(bypass_volume, S_IWUSR | S_IRUGO, pod_get_bypass_volume,
                    pod_set_bypass_volume);
-static DEVICE_ATTR(fx_loop_on_off, S_IWUGO | S_IRUGO, pod_get_fx_loop_on_off,
+static DEVICE_ATTR(fx_loop_on_off, S_IWUSR | S_IRUGO, pod_get_fx_loop_on_off,
                    pod_set_fx_loop_on_off);
-static DEVICE_ATTR(tweak_param_select, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(tweak_param_select, S_IWUSR | S_IRUGO,
                    pod_get_tweak_param_select, pod_set_tweak_param_select);
-static DEVICE_ATTR(amp1_engage, S_IWUGO | S_IRUGO, pod_get_amp1_engage,
+static DEVICE_ATTR(amp1_engage, S_IWUSR | S_IRUGO, pod_get_amp1_engage,
                    pod_set_amp1_engage);
-static DEVICE_ATTR(band_1_gain, S_IWUGO | S_IRUGO, pod_get_band_1_gain,
+static DEVICE_ATTR(band_1_gain, S_IWUSR | S_IRUGO, pod_get_band_1_gain,
                    pod_set_band_1_gain);
-static DEVICE_ATTR2(band_2_gain__bass, band_2_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_2_gain__bass, band_2_gain, S_IWUSR | S_IRUGO,
                     pod_get_band_2_gain__bass, pod_set_band_2_gain__bass);
-static DEVICE_ATTR(band_2_gain, S_IWUGO | S_IRUGO, pod_get_band_2_gain,
+static DEVICE_ATTR(band_2_gain, S_IWUSR | S_IRUGO, pod_get_band_2_gain,
                    pod_set_band_2_gain);
-static DEVICE_ATTR2(band_3_gain__bass, band_3_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_3_gain__bass, band_3_gain, S_IWUSR | S_IRUGO,
                     pod_get_band_3_gain__bass, pod_set_band_3_gain__bass);
-static DEVICE_ATTR(band_3_gain, S_IWUGO | S_IRUGO, pod_get_band_3_gain,
+static DEVICE_ATTR(band_3_gain, S_IWUSR | S_IRUGO, pod_get_band_3_gain,
                    pod_set_band_3_gain);
-static DEVICE_ATTR2(band_4_gain__bass, band_4_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_4_gain__bass, band_4_gain, S_IWUSR | S_IRUGO,
                     pod_get_band_4_gain__bass, pod_set_band_4_gain__bass);
-static DEVICE_ATTR2(band_5_gain__bass, band_5_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_5_gain__bass, band_5_gain, S_IWUSR | S_IRUGO,
                     pod_get_band_5_gain__bass, pod_set_band_5_gain__bass);
-static DEVICE_ATTR(band_4_gain, S_IWUGO | S_IRUGO, pod_get_band_4_gain,
+static DEVICE_ATTR(band_4_gain, S_IWUSR | S_IRUGO, pod_get_band_4_gain,
                    pod_set_band_4_gain);
-static DEVICE_ATTR2(band_6_gain__bass, band_6_gain, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR2(band_6_gain__bass, band_6_gain, S_IWUSR | S_IRUGO,
                     pod_get_band_6_gain__bass, pod_set_band_6_gain__bass);
 static DEVICE_ATTR(body, S_IRUGO, variax_get_body, line6_nop_write);
 static DEVICE_ATTR(pickup1_enable, S_IRUGO, variax_get_pickup1_enable,
diff --git a/drivers/staging/line6/midi.c b/drivers/staging/line6/midi.c
index 32b6ca75cadb..9b42e34763f1 100644
--- a/drivers/staging/line6/midi.c
+++ b/drivers/staging/line6/midi.c
@@ -362,8 +362,8 @@ static ssize_t midi_set_midi_mask_receive(struct device *dev,
         return count;
 }
 
-static DEVICE_ATTR(midi_mask_transmit, S_IWUGO | S_IRUGO, midi_get_midi_mask_transmit, midi_set_midi_mask_transmit);
-static DEVICE_ATTR(midi_mask_receive, S_IWUGO | S_IRUGO, midi_get_midi_mask_receive, midi_set_midi_mask_receive);
+static DEVICE_ATTR(midi_mask_transmit, S_IWUSR | S_IRUGO, midi_get_midi_mask_transmit, midi_set_midi_mask_transmit);
+static DEVICE_ATTR(midi_mask_receive, S_IWUSR | S_IRUGO, midi_get_midi_mask_receive, midi_set_midi_mask_receive);
 
 /* MIDI device destructor */
 static int snd_line6_midi_free(struct snd_device *device)
diff --git a/drivers/staging/line6/pod.c b/drivers/staging/line6/pod.c
index 28f514611abc..63318d717cd7 100644
--- a/drivers/staging/line6/pod.c
+++ b/drivers/staging/line6/pod.c
@@ -952,33 +952,33 @@ POD_GET_SYSTEM_PARAM(tuner_pitch, 1, 1);
 #undef GET_SYSTEM_PARAM
 
 /* POD special files: */
-static DEVICE_ATTR(channel, S_IWUGO | S_IRUGO, pod_get_channel, pod_set_channel);
+static DEVICE_ATTR(channel, S_IWUSR | S_IRUGO, pod_get_channel, pod_set_channel);
 static DEVICE_ATTR(clip, S_IRUGO, pod_wait_for_clip, line6_nop_write);
 static DEVICE_ATTR(device_id, S_IRUGO, pod_get_device_id, line6_nop_write);
 static DEVICE_ATTR(dirty, S_IRUGO, pod_get_dirty, line6_nop_write);
-static DEVICE_ATTR(dump, S_IWUGO | S_IRUGO, pod_get_dump, pod_set_dump);
-static DEVICE_ATTR(dump_buf, S_IWUGO | S_IRUGO, pod_get_dump_buf, pod_set_dump_buf);
-static DEVICE_ATTR(finish, S_IWUGO, line6_nop_read, pod_set_finish);
+static DEVICE_ATTR(dump, S_IWUSR | S_IRUGO, pod_get_dump, pod_set_dump);
+static DEVICE_ATTR(dump_buf, S_IWUSR | S_IRUGO, pod_get_dump_buf, pod_set_dump_buf);
+static DEVICE_ATTR(finish, S_IWUSR, line6_nop_read, pod_set_finish);
 static DEVICE_ATTR(firmware_version, S_IRUGO, pod_get_firmware_version, line6_nop_write);
-static DEVICE_ATTR(midi_postprocess, S_IWUGO | S_IRUGO, pod_get_midi_postprocess, pod_set_midi_postprocess);
-static DEVICE_ATTR(monitor_level, S_IWUGO | S_IRUGO, pod_get_monitor_level, pod_set_monitor_level);
+static DEVICE_ATTR(midi_postprocess, S_IWUSR | S_IRUGO, pod_get_midi_postprocess, pod_set_midi_postprocess);
+static DEVICE_ATTR(monitor_level, S_IWUSR | S_IRUGO, pod_get_monitor_level, pod_set_monitor_level);
 static DEVICE_ATTR(name, S_IRUGO, pod_get_name, line6_nop_write);
 static DEVICE_ATTR(name_buf, S_IRUGO, pod_get_name_buf, line6_nop_write);
-static DEVICE_ATTR(retrieve_amp_setup, S_IWUGO, line6_nop_read, pod_set_retrieve_amp_setup);
-static DEVICE_ATTR(retrieve_channel, S_IWUGO, line6_nop_read, pod_set_retrieve_channel);
-static DEVICE_ATTR(retrieve_effects_setup, S_IWUGO, line6_nop_read, pod_set_retrieve_effects_setup);
-static DEVICE_ATTR(routing, S_IWUGO | S_IRUGO, pod_get_routing, pod_set_routing);
+static DEVICE_ATTR(retrieve_amp_setup, S_IWUSR, line6_nop_read, pod_set_retrieve_amp_setup);
+static DEVICE_ATTR(retrieve_channel, S_IWUSR, line6_nop_read, pod_set_retrieve_channel);
+static DEVICE_ATTR(retrieve_effects_setup, S_IWUSR, line6_nop_read, pod_set_retrieve_effects_setup);
+static DEVICE_ATTR(routing, S_IWUSR | S_IRUGO, pod_get_routing, pod_set_routing);
 static DEVICE_ATTR(serial_number, S_IRUGO, pod_get_serial_number, line6_nop_write);
-static DEVICE_ATTR(store_amp_setup, S_IWUGO, line6_nop_read, pod_set_store_amp_setup);
-static DEVICE_ATTR(store_channel, S_IWUGO, line6_nop_read, pod_set_store_channel);
-static DEVICE_ATTR(store_effects_setup, S_IWUGO, line6_nop_read, pod_set_store_effects_setup);
-static DEVICE_ATTR(tuner_freq, S_IWUGO | S_IRUGO, pod_get_tuner_freq, pod_set_tuner_freq);
-static DEVICE_ATTR(tuner_mute, S_IWUGO | S_IRUGO, pod_get_tuner_mute, pod_set_tuner_mute);
+static DEVICE_ATTR(store_amp_setup, S_IWUSR, line6_nop_read, pod_set_store_amp_setup);
+static DEVICE_ATTR(store_channel, S_IWUSR, line6_nop_read, pod_set_store_channel);
+static DEVICE_ATTR(store_effects_setup, S_IWUSR, line6_nop_read, pod_set_store_effects_setup);
+static DEVICE_ATTR(tuner_freq, S_IWUSR | S_IRUGO, pod_get_tuner_freq, pod_set_tuner_freq);
+static DEVICE_ATTR(tuner_mute, S_IWUSR | S_IRUGO, pod_get_tuner_mute, pod_set_tuner_mute);
 static DEVICE_ATTR(tuner_note, S_IRUGO, pod_get_tuner_note, line6_nop_write);
 static DEVICE_ATTR(tuner_pitch, S_IRUGO, pod_get_tuner_pitch, line6_nop_write);
 
 #if CREATE_RAW_FILE
-static DEVICE_ATTR(raw, S_IWUGO, line6_nop_read, line6_set_raw);
+static DEVICE_ATTR(raw, S_IWUSR, line6_nop_read, line6_set_raw);
 #endif
 
 /*
diff --git a/drivers/staging/line6/toneport.c b/drivers/staging/line6/toneport.c
index e6770ea17936..db421781d550 100644
--- a/drivers/staging/line6/toneport.c
+++ b/drivers/staging/line6/toneport.c
@@ -124,9 +124,9 @@ static ssize_t toneport_set_led_green(struct device *dev,
         return count;
 }
 
-static DEVICE_ATTR(led_red, S_IWUGO | S_IRUGO, line6_nop_read,
+static DEVICE_ATTR(led_red, S_IWUSR | S_IRUGO, line6_nop_read,
                    toneport_set_led_red);
-static DEVICE_ATTR(led_green, S_IWUGO | S_IRUGO, line6_nop_read,
+static DEVICE_ATTR(led_green, S_IWUSR | S_IRUGO, line6_nop_read,
                    toneport_set_led_green);
 
 static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2)
diff --git a/drivers/staging/line6/variax.c b/drivers/staging/line6/variax.c
index 58ddbe6393ff..b2fc09b05939 100644
--- a/drivers/staging/line6/variax.c
+++ b/drivers/staging/line6/variax.c
@@ -389,17 +389,17 @@ static ssize_t variax_set_raw2(struct device *dev,
 #endif
 
 /* Variax workbench special files: */
-static DEVICE_ATTR(model, S_IWUGO | S_IRUGO, variax_get_model, variax_set_model);
-static DEVICE_ATTR(volume, S_IWUGO | S_IRUGO, variax_get_volume, variax_set_volume);
-static DEVICE_ATTR(tone, S_IWUGO | S_IRUGO, variax_get_tone, variax_set_tone);
+static DEVICE_ATTR(model, S_IWUSR | S_IRUGO, variax_get_model, variax_set_model);
+static DEVICE_ATTR(volume, S_IWUSR | S_IRUGO, variax_get_volume, variax_set_volume);
+static DEVICE_ATTR(tone, S_IWUSR | S_IRUGO, variax_get_tone, variax_set_tone);
 static DEVICE_ATTR(name, S_IRUGO, variax_get_name, line6_nop_write);
 static DEVICE_ATTR(bank, S_IRUGO, variax_get_bank, line6_nop_write);
 static DEVICE_ATTR(dump, S_IRUGO, variax_get_dump, line6_nop_write);
-static DEVICE_ATTR(active, S_IWUGO | S_IRUGO, variax_get_active, variax_set_active);
+static DEVICE_ATTR(active, S_IWUSR | S_IRUGO, variax_get_active, variax_set_active);
 
 #if CREATE_RAW_FILE
-static DEVICE_ATTR(raw, S_IWUGO, line6_nop_read, line6_set_raw);
-static DEVICE_ATTR(raw2, S_IWUGO, line6_nop_read, variax_set_raw2);
+static DEVICE_ATTR(raw, S_IWUSR, line6_nop_read, line6_set_raw);
+static DEVICE_ATTR(raw2, S_IWUSR, line6_nop_read, variax_set_raw2);
 #endif
 
 
diff --git a/drivers/staging/phison/phison.c b/drivers/staging/phison/phison.c
index 42783d7367e3..677152044f45 100644
--- a/drivers/staging/phison/phison.c
+++ b/drivers/staging/phison/phison.c
@@ -62,7 +62,7 @@ static int phison_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         const struct ata_port_info *ppi[] = { &info, NULL };
 
-        ret = ata_pci_sff_init_one(pdev, ppi, &phison_sht, NULL, 0);
+        ret = ata_pci_bmdma_init_one(pdev, ppi, &phison_sht, NULL, 0);
 
         dev_dbg(&pdev->dev, "phison_init_one(), ret = %x\n", ret);
 
diff --git a/drivers/staging/rt2860/chips/rt3090.c b/drivers/staging/rt2860/chips/rt3090.c
index c2933c69bc04..cbc59f8a7c24 100644
--- a/drivers/staging/rt2860/chips/rt3090.c
+++ b/drivers/staging/rt2860/chips/rt3090.c
@@ -51,7 +51,8 @@ void NICInitRT3090RFRegisters(struct rt_rtmp_adapter *pAd)
         if (IS_RT3090(pAd)) {
                 /* Init RF calibration */
                 /* Driver should toggle RF R30 bit7 before init RF registers */
-                u32 RfReg = 0, data;
+                u8 RfReg;
+                u32 data;
 
                 RT30xxReadRFRegister(pAd, RF_R30, (u8 *)&RfReg);
                 RfReg |= 0x80;
diff --git a/drivers/staging/rt2860/chips/rt30xx.c b/drivers/staging/rt2860/chips/rt30xx.c
index 4367a196aeff..88eba5192edc 100644
--- a/drivers/staging/rt2860/chips/rt30xx.c
+++ b/drivers/staging/rt2860/chips/rt30xx.c
@@ -53,7 +53,7 @@ struct rt_reg_pair RT30xx_RFRegTable[] = {
         ,
         {RF_R06, 0x02}
         ,
-        {RF_R07, 0x70}
+        {RF_R07, 0x60}
         ,
         {RF_R09, 0x0F}
         ,
@@ -441,7 +441,7 @@ void RT30xxReverseRFSleepModeSetup(struct rt_rtmp_adapter *pAd)
 
                 /* VCO_IC, RF R7 register Bit 4 & Bit 5 to 1 */
                 RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
-                RFValue |= 0x30;
+                RFValue |= 0x20;
                 RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
 
                 /* Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 1 */
diff --git a/drivers/staging/rt2860/rt_main_dev.c b/drivers/staging/rt2860/rt_main_dev.c
index ad60ceaf4b88..caf8b7623cb1 100644
--- a/drivers/staging/rt2860/rt_main_dev.c
+++ b/drivers/staging/rt2860/rt_main_dev.c
@@ -483,8 +483,6 @@ struct net_device *RtmpPhyNetDevInit(struct rt_rtmp_adapter *pAd,
         net_dev->ml_priv = (void *)pAd;
         pAd->net_dev = net_dev;
 
-        netif_stop_queue(net_dev);
-
         return net_dev;
 
 }
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index ebf9074a9083..aca0c468fa6c 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -65,6 +65,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x14B2, 0x3C07)},   /* AL */
         {USB_DEVICE(0x050D, 0x8053)},   /* Belkin */
         {USB_DEVICE(0x050D, 0x825B)},   /* Belkin */
+        {USB_DEVICE(0x050D, 0x935A)},   /* Belkin F6D4050 v1 */
         {USB_DEVICE(0x050D, 0x935B)},   /* Belkin F6D4050 v2 */
         {USB_DEVICE(0x14B2, 0x3C23)},   /* Airlink */
         {USB_DEVICE(0x14B2, 0x3C27)},   /* Airlink */
@@ -105,6 +106,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x0411, 0x016f)},   /* MelCo.,Inc. WLI-UC-G301N */
         {USB_DEVICE(0x1737, 0x0070)},   /* Linksys WUSB100 */
         {USB_DEVICE(0x1737, 0x0071)},   /* Linksys WUSB600N */
+        {USB_DEVICE(0x1737, 0x0078)},   /* Linksys WUSB100v2 */
         {USB_DEVICE(0x0411, 0x00e8)},   /* Buffalo WLI-UC-G300N */
         {USB_DEVICE(0x050d, 0x815c)},   /* Belkin F5D8053 */
         {USB_DEVICE(0x100D, 0x9031)},   /* Motorola 2770 */
@@ -181,6 +183,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x2001, 0x3C09)},   /* D-Link */
         {USB_DEVICE(0x2001, 0x3C0A)},   /* D-Link 3072 */
         {USB_DEVICE(0x2019, 0xED14)},   /* Planex Communications, Inc. */
+        {USB_DEVICE(0x0411, 0x015D)},   /* Buffalo Airstation WLI-UC-GN */
         {}                      /* Terminating entry */
 };
 
diff --git a/drivers/staging/rtl8187se/r8185b_init.c b/drivers/staging/rtl8187se/r8185b_init.c
index a0ece1fd64a5..e7e8745c9478 100644
--- a/drivers/staging/rtl8187se/r8185b_init.c
+++ b/drivers/staging/rtl8187se/r8185b_init.c
@@ -268,8 +268,12 @@ HwHSSIThreeWire(
                         }
                         udelay(10);
                 }
-                if (TryCnt == TC_3W_POLL_MAX_TRY_CNT)
-                        panic("HwThreeWire(): CmdReg: %#X RE|WE bits are not clear!!\n", u1bTmp);
+                if (TryCnt == TC_3W_POLL_MAX_TRY_CNT) {
+                        printk(KERN_ERR "rtl8187se: HwThreeWire(): CmdReg:"
+                               " %#X RE|WE bits are not clear!!\n", u1bTmp);
+                        dump_stack();
+                        return 0;
+                }
 
                 // RTL8187S HSSI Read/Write Function
                 u1bTmp = read_nic_byte(dev, RF_SW_CONFIG);
@@ -309,13 +313,23 @@ HwHSSIThreeWire(
                                 int idx;
                                 int ByteCnt = nDataBufBitCnt / 8;
                                 //printk("%d\n",nDataBufBitCnt);
-                                if ((nDataBufBitCnt % 8) != 0)
-                                panic("HwThreeWire(): nDataBufBitCnt(%d) should be multiple of 8!!!\n",
-                                nDataBufBitCnt);
+                                if ((nDataBufBitCnt % 8) != 0) {
+                                        printk(KERN_ERR "rtl8187se: "
+                                               "HwThreeWire(): nDataBufBitCnt(%d)"
+                                               " should be multiple of 8!!!\n",
+                                               nDataBufBitCnt);
+                                        dump_stack();
+                                        nDataBufBitCnt += 8;
+                                        nDataBufBitCnt &= ~7;
+                                }
 
-                               if (nDataBufBitCnt > 64)
-                                panic("HwThreeWire(): nDataBufBitCnt(%d) should <= 64!!!\n",
-                                nDataBufBitCnt);
+                               if (nDataBufBitCnt > 64) {
+                                        printk(KERN_ERR "rtl8187se: HwThreeWire():"
+                                               " nDataBufBitCnt(%d) should <= 64!!!\n",
+                                               nDataBufBitCnt);
+                                        dump_stack();
+                                        nDataBufBitCnt = 64;
+                                }
 
                                 for(idx = 0; idx < ByteCnt; idx++)
                                 {
diff --git a/drivers/staging/samsung-laptop/samsung-laptop.c b/drivers/staging/samsung-laptop/samsung-laptop.c
index eb44b60e1eb5..ac2bf11e1119 100644
--- a/drivers/staging/samsung-laptop/samsung-laptop.c
+++ b/drivers/staging/samsung-laptop/samsung-laptop.c
@@ -356,7 +356,7 @@ static ssize_t set_silent_state(struct device *dev,
         }
         return count;
 }
-static DEVICE_ATTR(silent, S_IWUGO | S_IRUGO,
+static DEVICE_ATTR(silent, S_IWUSR | S_IRUGO,
                    get_silent_state, set_silent_state);
 
 
diff --git a/drivers/staging/udlfb/udlfb.c b/drivers/staging/udlfb/udlfb.c
index c7e061e5e04d..456cd5c95765 100644
--- a/drivers/staging/udlfb/udlfb.c
+++ b/drivers/staging/udlfb/udlfb.c
@@ -1143,7 +1143,7 @@ static struct device_attribute fb_device_attrs[] = {
         __ATTR_RO(metrics_bytes_sent),
         __ATTR_RO(metrics_cpu_kcycles_used),
         __ATTR_RO(metrics_misc),
-        __ATTR(metrics_reset, S_IWUGO, NULL, metrics_reset_store),
+        __ATTR(metrics_reset, S_IWUSR, NULL, metrics_reset_store),
         __ATTR_RW(use_defio),
 };
 
diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/staging/usbip/usbip_event.c
index a2566f1075d5..af3832b03e4b 100644
--- a/drivers/staging/usbip/usbip_event.c
+++ b/drivers/staging/usbip/usbip_event.c
@@ -38,21 +38,13 @@ static int event_handler(struct usbip_device *ud)
                         ud->eh_ops.shutdown(ud);
 
                         ud->event &= ~USBIP_EH_SHUTDOWN;
-
-                        break;
                 }
 
-                /* Stop the error handler. */
-                if (ud->event & USBIP_EH_BYE)
-                        return -1;
-
                 /* Reset the device. */
                 if (ud->event & USBIP_EH_RESET) {
                         ud->eh_ops.reset(ud);
 
                         ud->event &= ~USBIP_EH_RESET;
-
-                        break;
                 }
 
                 /* Mark the device as unusable. */
@@ -60,13 +52,11 @@ static int event_handler(struct usbip_device *ud)
                         ud->eh_ops.unusable(ud);
 
                         ud->event &= ~USBIP_EH_UNUSABLE;
-
-                        break;
                 }
 
-                /* NOTREACHED */
-                printk(KERN_ERR "%s: unknown event\n", __func__);
-                return -1;
+                /* Stop the error handler. */
+                if (ud->event & USBIP_EH_BYE)
+                        return -1;
         }
 
         return 0;
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 0574d848b900..08bd26a245d5 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -164,6 +164,8 @@ void rh_port_disconnect(int rhport)
          * spin_unlock(&vdev->ud.lock); */
 
         spin_unlock_irqrestore(&the_controller->lock, flags);
+
+        usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
 }
 
 
@@ -797,20 +799,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 spin_unlock_irqrestore(&vdev->priv_lock, flags2);
         }
 
-
-        if (!vdev->ud.tcp_socket) {
-                /* tcp connection is closed */
-                usbip_uinfo("vhci_hcd: vhci_urb_dequeue() gives back urb %p\n",
-                                                                        urb);
-
-                usb_hcd_unlink_urb_from_ep(hcd, urb);
-
-                spin_unlock_irqrestore(&the_controller->lock, flags);
-                usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
-                                                                urb->status);
-                spin_lock_irqsave(&the_controller->lock, flags);
-        }
-
         spin_unlock_irqrestore(&the_controller->lock, flags);
 
         usbip_dbg_vhci_hc("leave\n");
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index 722c840ac638..7e89383599e1 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -235,6 +235,7 @@ static int zram_read(struct zram *zram, struct bio *bio)
 
                 if (zram_test_flag(zram, index, ZRAM_ZERO)) {
                         handle_zero_page(page);
+                        index++;
                         continue;
                 }
 
@@ -243,12 +244,14 @@ static int zram_read(struct zram *zram, struct bio *bio)
                         pr_debug("Read before write: sector=%lu, size=%u",
                                 (ulong)(bio->bi_sector), bio->bi_size);
                         /* Do nothing */
+                        index++;
                         continue;
                 }
 
                 /* Page is stored uncompressed since it's incompressible */
                 if (unlikely(zram_test_flag(zram, index, ZRAM_UNCOMPRESSED))) {
                         handle_uncompressed_page(zram, page, index);
+                        index++;
                         continue;
                 }
 
@@ -324,6 +327,7 @@ static int zram_write(struct zram *zram, struct bio *bio)
                         mutex_unlock(&zram->lock);
                         zram_stat_inc(&zram->stats.pages_zero);
                         zram_set_flag(zram, index, ZRAM_ZERO);
+                        index++;
                         continue;
                 }
 
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index ea071a5b6eee..44447f54942f 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -2301,7 +2301,7 @@ out:
         return ret;
 }
 
-static DEVICE_ATTR(stat_status, S_IWUGO | S_IRUGO, read_status, reboot);
+static DEVICE_ATTR(stat_status, S_IWUSR | S_IRUGO, read_status, reboot);
 
 static ssize_t read_human_status(struct device *dev,
                         struct device_attribute *attr, char *buf)
@@ -2364,8 +2364,7 @@ out:
         return ret;
 }
 
-static DEVICE_ATTR(stat_human_status, S_IWUGO | S_IRUGO,
-                                read_human_status, NULL);
+static DEVICE_ATTR(stat_human_status, S_IRUGO, read_human_status, NULL);
 
 static ssize_t read_delin(struct device *dev, struct device_attribute *attr,
                 char *buf)
@@ -2397,7 +2396,7 @@ out:
         return ret;
 }
 
-static DEVICE_ATTR(stat_delin, S_IWUGO | S_IRUGO, read_delin, NULL);
+static DEVICE_ATTR(stat_delin, S_IRUGO, read_delin, NULL);
 
 #define UEA_ATTR(name, reset)                                   \
                                                                 \
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index bc62fae0680f..3ffa43477609 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1607,6 +1607,7 @@ static const struct usb_device_id acm_ids[] = {
         { NOKIA_PCSUITE_ACM_INFO(0x0154), }, /* Nokia 5800 XpressMusic */
         { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
         { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
+        { NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
         { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
 
         /* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index f1aaff6202a5..045bb4b823e1 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -965,10 +965,11 @@ static int proc_getdriver(struct dev_state *ps, void __user *arg)
 
 static int proc_connectinfo(struct dev_state *ps, void __user *arg)
 {
-        struct usbdevfs_connectinfo ci;
+        struct usbdevfs_connectinfo ci = {
+                .devnum = ps->dev->devnum,
+                .slow = ps->dev->speed == USB_SPEED_LOW
+        };
 
-        ci.devnum = ps->dev->devnum;
-        ci.slow = ps->dev->speed == USB_SPEED_LOW;
         if (copy_to_user(arg, &ci, sizeof(ci)))
                 return -EFAULT;
         return 0;
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 5cca00a6d09d..b5c965c031f9 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1945,7 +1945,6 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
 
         dev_dbg(&rhdev->dev, "usb %s%s\n",
                         (msg.event & PM_EVENT_AUTO ? "auto-" : ""), "resume");
-        clear_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
         if (!hcd->driver->bus_resume)
                 return -ENOENT;
         if (hcd->state == HC_STATE_RUNNING)
@@ -1953,6 +1952,7 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
 
         hcd->state = HC_STATE_RESUMING;
         status = hcd->driver->bus_resume(hcd);
+        clear_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
         if (status == 0) {
                 /* TRSMRCY = 10 msec */
                 msleep(10);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 84c1897188d2..6c16c4f2c741 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -677,6 +677,8 @@ static void hub_init_func3(struct work_struct *ws);
 static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 {
         struct usb_device *hdev = hub->hdev;
+        struct usb_hcd *hcd;
+        int ret;
         int port1;
         int status;
         bool need_debounce_delay = false;
@@ -715,6 +717,25 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         usb_autopm_get_interface_no_resume(
                                         to_usb_interface(hub->intfdev));
                         return;         /* Continues at init2: below */
+                } else if (type == HUB_RESET_RESUME) {
+                        /* The internal host controller state for the hub device
+                         * may be gone after a host power loss on system resume.
+                         * Update the device's info so the HW knows it's a hub.
+                         */
+                        hcd = bus_to_hcd(hdev->bus);
+                        if (hcd->driver->update_hub_device) {
+                                ret = hcd->driver->update_hub_device(hcd, hdev,
+                                                &hub->tt, GFP_NOIO);
+                                if (ret < 0) {
+                                        dev_err(hub->intfdev, "Host not "
+                                                        "accepting hub info "
+                                                        "update.\n");
+                                        dev_err(hub->intfdev, "LS/FS devices "
+                                                        "and hubs may not work "
+                                                        "under this hub\n.");
+                                }
+                        }
+                        hub_power_on(hub, true);
                 } else {
                         hub_power_on(hub, true);
                 }
@@ -2722,6 +2743,11 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
                 udev->ttport = hdev->ttport;
         } else if (udev->speed != USB_SPEED_HIGH
                         && hdev->speed == USB_SPEED_HIGH) {
+                if (!hub->tt.hub) {
+                        dev_err(&udev->dev, "parent hub has no TT\n");
+                        retval = -EINVAL;
+                        goto fail;
+                }
                 udev->tt = &hub->tt;
                 udev->ttport = port1;
         }
@@ -2860,13 +2886,16 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
         else
                 i = udev->descriptor.bMaxPacketSize0;
         if (le16_to_cpu(udev->ep0.desc.wMaxPacketSize) != i) {
-                if (udev->speed != USB_SPEED_FULL ||
+                if (udev->speed == USB_SPEED_LOW ||
                                 !(i == 8 || i == 16 || i == 32 || i == 64)) {
-                        dev_err(&udev->dev, "ep0 maxpacket = %d\n", i);
+                        dev_err(&udev->dev, "Invalid ep0 maxpacket: %d\n", i);
                         retval = -EMSGSIZE;
                         goto fail;
                 }
-                dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
+                if (udev->speed == USB_SPEED_FULL)
+                        dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
+                else
+                        dev_warn(&udev->dev, "Using ep0 maxpacket: %d\n", i);
                 udev->ep0.desc.wMaxPacketSize = cpu_to_le16(i);
                 usb_ep0_reinit(udev);
         }
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 9f0ce7de0e36..d6e3e410477e 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1140,13 +1140,6 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
 {
         int i;
 
-        dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
-                skip_ep0 ? "non-ep0" : "all");
-        for (i = skip_ep0; i < 16; ++i) {
-                usb_disable_endpoint(dev, i, true);
-                usb_disable_endpoint(dev, i + USB_DIR_IN, true);
-        }
-
         /* getting rid of interfaces will disconnect
          * any drivers bound to them (a key side effect)
          */
@@ -1176,6 +1169,13 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
                 if (dev->state == USB_STATE_CONFIGURED)
                         usb_set_device_state(dev, USB_STATE_ADDRESS);
         }
+
+        dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
+                skip_ep0 ? "non-ep0" : "all");
+        for (i = skip_ep0; i < 16; ++i) {
+                usb_disable_endpoint(dev, i, true);
+                usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+        }
 }
 
 /**
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index d623c7bda1f6..2d19d88846ef 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -2014,6 +2014,9 @@ static int __init usba_udc_probe(struct platform_device *pdev)
                         } else {
                                 disable_irq(gpio_to_irq(udc->vbus_pin));
                         }
+                } else {
+                        /* gpio_request fail so use -EINVAL for gpio_is_valid */
+                        udc->vbus_pin = -EINVAL;
                 }
         }
 
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 1160c55de7f2..67746b19ac54 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -901,7 +901,8 @@ unknown:
                  */
                 switch (ctrl->bRequestType & USB_RECIP_MASK) {
                 case USB_RECIP_INTERFACE:
-                        f = cdev->config->interface[intf];
+                        if (cdev->config)
+                                f = cdev->config->interface[intf];
                         break;
 
                 case USB_RECIP_ENDPOINT:
@@ -1082,14 +1083,6 @@ static int composite_bind(struct usb_gadget *gadget)
          */
         usb_ep_autoconfig_reset(cdev->gadget);
 
-        /* standardized runtime overrides for device ID data */
-        if (idVendor)
-                cdev->desc.idVendor = cpu_to_le16(idVendor);
-        if (idProduct)
-                cdev->desc.idProduct = cpu_to_le16(idProduct);
-        if (bcdDevice)
-                cdev->desc.bcdDevice = cpu_to_le16(bcdDevice);
-
         /* composite gadget needs to assign strings for whole device (like
          * serial number), register function drivers, potentially update
          * power state and consumption, etc
@@ -1101,6 +1094,14 @@ static int composite_bind(struct usb_gadget *gadget)
         cdev->desc = *composite->dev;
         cdev->desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
 
+        /* standardized runtime overrides for device ID data */
+        if (idVendor)
+                cdev->desc.idVendor = cpu_to_le16(idVendor);
+        if (idProduct)
+                cdev->desc.idProduct = cpu_to_le16(idProduct);
+        if (bcdDevice)
+                cdev->desc.bcdDevice = cpu_to_le16(bcdDevice);
+
         /* strings can't be assigned before bind() allocates the
          * releavnt identifiers
          */
diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
index d47a123f15ab..bd6226cbae86 100644
--- a/drivers/usb/gadget/f_acm.c
+++ b/drivers/usb/gadget/f_acm.c
@@ -111,7 +111,7 @@ acm_iad_descriptor = {
         .bInterfaceCount =      2,      // control + data
         .bFunctionClass =       USB_CLASS_COMM,
         .bFunctionSubClass =    USB_CDC_SUBCLASS_ACM,
-        .bFunctionProtocol =    USB_CDC_PROTO_NONE,
+        .bFunctionProtocol =    USB_CDC_ACM_PROTO_AT_V25TER,
         /* .iFunction =         DYNAMIC */
 };
 
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index a9474f8d5325..3c2f0a43c9c6 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -53,8 +53,8 @@ MODULE_AUTHOR("Michal Nazarewicz");
 MODULE_LICENSE("GPL");
 
 
-static unsigned short gfs_vendor_id    = 0x0525;        /* XXX NetChip */
-static unsigned short gfs_product_id   = 0xa4ac;        /* XXX */
+static unsigned short gfs_vendor_id    = 0x1d6b;        /* Linux Foundation */
+static unsigned short gfs_product_id   = 0x0105;        /* FunctionFS Gadget */
 
 static struct usb_device_descriptor gfs_dev_desc = {
         .bLength                = sizeof gfs_dev_desc,
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 795d76232167..36d67a32abef 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -74,8 +74,8 @@ MODULE_LICENSE("GPL");
 
 /***************************** Device Descriptor ****************************/
 
-#define MULTI_VENDOR_NUM        0x0525  /* XXX NetChip */
-#define MULTI_PRODUCT_NUM       0xa4ab  /* XXX */
+#define MULTI_VENDOR_NUM        0x1d6b  /* Linux Foundation */
+#define MULTI_PRODUCT_NUM       0x0104  /* Multifunction Composite Gadget */
 
 
 enum {
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index cf241c371a71..15222ebf3422 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -131,31 +131,31 @@ static struct printer_dev usb_printer_gadget;
  * parameters are in UTF-8 (superset of ASCII's 7 bit characters).
  */
 
-static ushort __initdata idVendor;
+static ushort idVendor;
 module_param(idVendor, ushort, S_IRUGO);
 MODULE_PARM_DESC(idVendor, "USB Vendor ID");
 
-static ushort __initdata idProduct;
+static ushort idProduct;
 module_param(idProduct, ushort, S_IRUGO);
 MODULE_PARM_DESC(idProduct, "USB Product ID");
 
-static ushort __initdata bcdDevice;
+static ushort bcdDevice;
 module_param(bcdDevice, ushort, S_IRUGO);
 MODULE_PARM_DESC(bcdDevice, "USB Device version (BCD)");
 
-static char *__initdata iManufacturer;
+static char *iManufacturer;
 module_param(iManufacturer, charp, S_IRUGO);
 MODULE_PARM_DESC(iManufacturer, "USB Manufacturer string");
 
-static char *__initdata iProduct;
+static char *iProduct;
 module_param(iProduct, charp, S_IRUGO);
 MODULE_PARM_DESC(iProduct, "USB Product string");
 
-static char *__initdata iSerialNum;
+static char *iSerialNum;
 module_param(iSerialNum, charp, S_IRUGO);
 MODULE_PARM_DESC(iSerialNum, "1");
 
-static char *__initdata iPNPstring;
+static char *iPNPstring;
 module_param(iPNPstring, charp, S_IRUGO);
 MODULE_PARM_DESC(iPNPstring, "MFG:linux;MDL:g_printer;CLS:PRINTER;SN:1;");
 
@@ -1596,13 +1596,12 @@ cleanup(void)
         int status;
 
         mutex_lock(&usb_printer_gadget.lock_printer_io);
-        class_destroy(usb_gadget_class);
-        unregister_chrdev_region(g_printer_devno, 2);
-
         status = usb_gadget_unregister_driver(&printer_driver);
         if (status)
                 ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
 
+        unregister_chrdev_region(g_printer_devno, 2);
+        class_destroy(usb_gadget_class);
         mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index 2baf8a849086..a869e3c103d3 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -227,8 +227,8 @@ static int ehci_hcd_au1xxx_drv_suspend(struct device *dev)
          * mark HW unaccessible.  The PM and USB cores make sure that
          * the root hub is either suspended or stopped.
          */
-        spin_lock_irqsave(&ehci->lock, flags);
         ehci_prepare_ports_for_controller_suspend(ehci, device_may_wakeup(dev));
+        spin_lock_irqsave(&ehci->lock, flags);
         ehci_writel(ehci, 0, &ehci->regs->intr_enable);
         (void)ehci_readl(ehci, &ehci->regs->intr_enable);
 
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index 76b7fd2d838a..b349021c052b 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -1063,7 +1063,7 @@ static inline void create_debug_files (struct ehci_hcd *ehci)
                                                     &debug_registers_fops))
                 goto file_error;
 
-        if (!debugfs_create_file("lpm", S_IRUGO|S_IWUGO, ehci->debug_dir, bus,
+        if (!debugfs_create_file("lpm", S_IRUGO|S_IWUSR, ehci->debug_dir, bus,
                                                     &debug_lpm_fops))
                 goto file_error;
 
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 34a928d3b7d2..597ed102d54f 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -114,6 +114,9 @@ MODULE_PARM_DESC(hird, "host initiated resume duration, +1 for each 75us\n");
 
 #define INTR_MASK (STS_IAA | STS_FATAL | STS_PCD | STS_ERR | STS_INT)
 
+/* for ASPM quirk of ISOC on AMD SB800 */
+static struct pci_dev *amd_nb_dev;
+
 /*-------------------------------------------------------------------------*/
 
 #include "ehci.h"
@@ -514,6 +517,11 @@ static void ehci_stop (struct usb_hcd *hcd)
         spin_unlock_irq (&ehci->lock);
         ehci_mem_cleanup (ehci);
 
+        if (amd_nb_dev) {
+                pci_dev_put(amd_nb_dev);
+                amd_nb_dev = NULL;
+        }
+
 #ifdef  EHCI_STATS
         ehci_dbg (ehci, "irq normal %ld err %ld reclaim %ld (lost %ld)\n",
                 ehci->stats.normal, ehci->stats.error, ehci->stats.reclaim,
@@ -549,6 +557,8 @@ static int ehci_init(struct usb_hcd *hcd)
         ehci->iaa_watchdog.function = ehci_iaa_watchdog;
         ehci->iaa_watchdog.data = (unsigned long) ehci;
 
+        hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
+
         /*
          * hw default: 1K periodic list heads, one per frame.
          * periodic_size can shrink by USBCMD update if hcc_params allows.
@@ -556,11 +566,20 @@ static int ehci_init(struct usb_hcd *hcd)
         ehci->periodic_size = DEFAULT_I_TDPS;
         INIT_LIST_HEAD(&ehci->cached_itd_list);
         INIT_LIST_HEAD(&ehci->cached_sitd_list);
+
+        if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
+                /* periodic schedule size can be smaller than default */
+                switch (EHCI_TUNE_FLS) {
+                case 0: ehci->periodic_size = 1024; break;
+                case 1: ehci->periodic_size = 512; break;
+                case 2: ehci->periodic_size = 256; break;
+                default:        BUG();
+                }
+        }
         if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
                 return retval;
 
         /* controllers may cache some of the periodic schedule ... */
-        hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
         if (HCC_ISOC_CACHE(hcc_params))         // full frame cache
                 ehci->i_thresh = 2 + 8;
         else                                    // N microframes cached
@@ -614,12 +633,6 @@ static int ehci_init(struct usb_hcd *hcd)
                 /* periodic schedule size can be smaller than default */
                 temp &= ~(3 << 2);
                 temp |= (EHCI_TUNE_FLS << 2);
-                switch (EHCI_TUNE_FLS) {
-                case 0: ehci->periodic_size = 1024; break;
-                case 1: ehci->periodic_size = 512; break;
-                case 2: ehci->periodic_size = 256; break;
-                default:        BUG();
-                }
         }
         if (HCC_LPM(hcc_params)) {
                 /* support link power management EHCI 1.1 addendum */
@@ -1048,10 +1061,11 @@ rescan:
                                 tmp && tmp != qh;
                                 tmp = tmp->qh_next.qh)
                         continue;
-                /* periodic qh self-unlinks on empty */
-                if (!tmp)
-                        goto nogood;
-                unlink_async (ehci, qh);
+                /* periodic qh self-unlinks on empty, and a COMPLETING qh
+                 * may already be unlinked.
+                 */
+                if (tmp)
+                        unlink_async(ehci, qh);
                 /* FALL THROUGH */
         case QH_STATE_UNLINK:           /* wait for hw to finish? */
         case QH_STATE_UNLINK_WAIT:
@@ -1068,7 +1082,6 @@ idle_timeout:
                 }
                 /* else FALL THROUGH */
         default:
-nogood:
                 /* caller was supposed to have unlinked any requests;
                  * that's not our job.  just leak this memory.
                  */
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 796ea0c8900f..8a515f0d5988 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -111,6 +111,7 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
 {
         int             port;
         u32             temp;
+        unsigned long   flags;
 
         /* If remote wakeup is enabled for the root hub but disabled
          * for the controller, we must adjust all the port wakeup flags
@@ -120,6 +121,8 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
         if (!ehci_to_hcd(ehci)->self.root_hub->do_remote_wakeup || do_wakeup)
                 return;
 
+        spin_lock_irqsave(&ehci->lock, flags);
+
         /* clear phy low-power mode before changing wakeup flags */
         if (ehci->has_hostpc) {
                 port = HCS_N_PORTS(ehci->hcs_params);
@@ -131,7 +134,9 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
                         temp = ehci_readl(ehci, hostpc_reg);
                         ehci_writel(ehci, temp & ~HOSTPC_PHCD, hostpc_reg);
                 }
+                spin_unlock_irqrestore(&ehci->lock, flags);
                 msleep(5);
+                spin_lock_irqsave(&ehci->lock, flags);
         }
 
         port = HCS_N_PORTS(ehci->hcs_params);
@@ -170,6 +175,8 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
         /* Does the root hub have a port wakeup pending? */
         if (!suspending && (ehci_readl(ehci, &ehci->regs->status) & STS_PCD))
                 usb_hcd_resume_root_hub(ehci_to_hcd(ehci));
+
+        spin_unlock_irqrestore(&ehci->lock, flags);
 }
 
 static int ehci_bus_suspend (struct usb_hcd *hcd)
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index a1e8d273103f..566791e04e8c 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -41,6 +41,42 @@ static int ehci_pci_reinit(struct ehci_hcd *ehci, struct pci_dev *pdev)
         return 0;
 }
 
+static int ehci_quirk_amd_hudson(struct ehci_hcd *ehci)
+{
+        struct pci_dev *amd_smbus_dev;
+        u8 rev = 0;
+
+        amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
+        if (amd_smbus_dev) {
+                pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+                if (rev < 0x40) {
+                        pci_dev_put(amd_smbus_dev);
+                        amd_smbus_dev = NULL;
+                        return 0;
+                }
+        } else {
+                amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x780b, NULL);
+                if (!amd_smbus_dev)
+                        return 0;
+                pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+                if (rev < 0x11 || rev > 0x18) {
+                        pci_dev_put(amd_smbus_dev);
+                        amd_smbus_dev = NULL;
+                        return 0;
+                }
+        }
+
+        if (!amd_nb_dev)
+                amd_nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x1510, NULL);
+
+        ehci_info(ehci, "QUIRK: Enable exception for AMD Hudson ASPM\n");
+
+        pci_dev_put(amd_smbus_dev);
+        amd_smbus_dev = NULL;
+
+        return 1;
+}
+
 /* called during probe() after chip reset completes */
 static int ehci_pci_setup(struct usb_hcd *hcd)
 {
@@ -99,6 +135,9 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
         /* cache this readonly data; minimize chip reads */
         ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
 
+        if (ehci_quirk_amd_hudson(ehci))
+                ehci->amd_l1_fix = 1;
+
         retval = ehci_halt(ehci);
         if (retval)
                 return retval;
@@ -148,6 +187,18 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                         if (pdev->revision < 0xa4)
                                 ehci->no_selective_suspend = 1;
                         break;
+
+                /* MCP89 chips on the MacBookAir3,1 give EPROTO when
+                 * fetching device descriptors unless LPM is disabled.
+                 * There are also intermittent problems enumerating
+                 * devices with PPCD enabled.
+                 */
+                case 0x0d9d:
+                        ehci_info(ehci, "disable lpm/ppcd for nvidia mcp89");
+                        ehci->has_lpm = 0;
+                        ehci->has_ppcd = 0;
+                        ehci->command &= ~CMD_PPCEE;
+                        break;
                 }
                 break;
         case PCI_VENDOR_ID_VIA:
@@ -296,8 +347,8 @@ static int ehci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
          * mark HW unaccessible.  The PM and USB cores make sure that
          * the root hub is either suspended or stopped.
          */
-        spin_lock_irqsave (&ehci->lock, flags);
         ehci_prepare_ports_for_controller_suspend(ehci, do_wakeup);
+        spin_lock_irqsave (&ehci->lock, flags);
         ehci_writel(ehci, 0, &ehci->regs->intr_enable);
         (void)ehci_readl(ehci, &ehci->regs->intr_enable);
 
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index a92526d6e5ae..724ba7133c4f 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1583,6 +1583,63 @@ itd_link (struct ehci_hcd *ehci, unsigned frame, struct ehci_itd *itd)
         *hw_p = cpu_to_hc32(ehci, itd->itd_dma | Q_TYPE_ITD);
 }
 
+#define AB_REG_BAR_LOW 0xe0
+#define AB_REG_BAR_HIGH 0xe1
+#define AB_INDX(addr) ((addr) + 0x00)
+#define AB_DATA(addr) ((addr) + 0x04)
+#define NB_PCIE_INDX_ADDR 0xe0
+#define NB_PCIE_INDX_DATA 0xe4
+#define NB_PIF0_PWRDOWN_0 0x01100012
+#define NB_PIF0_PWRDOWN_1 0x01100013
+
+static void ehci_quirk_amd_L1(struct ehci_hcd *ehci, int disable)
+{
+        u32 addr, addr_low, addr_high, val;
+
+        outb_p(AB_REG_BAR_LOW, 0xcd6);
+        addr_low = inb_p(0xcd7);
+        outb_p(AB_REG_BAR_HIGH, 0xcd6);
+        addr_high = inb_p(0xcd7);
+        addr = addr_high << 8 | addr_low;
+        outl_p(0x30, AB_INDX(addr));
+        outl_p(0x40, AB_DATA(addr));
+        outl_p(0x34, AB_INDX(addr));
+        val = inl_p(AB_DATA(addr));
+
+        if (disable) {
+                val &= ~0x8;
+                val |= (1 << 4) | (1 << 9);
+        } else {
+                val |= 0x8;
+                val &= ~((1 << 4) | (1 << 9));
+        }
+        outl_p(val, AB_DATA(addr));
+
+        if (amd_nb_dev) {
+                addr = NB_PIF0_PWRDOWN_0;
+                pci_write_config_dword(amd_nb_dev, NB_PCIE_INDX_ADDR, addr);
+                pci_read_config_dword(amd_nb_dev, NB_PCIE_INDX_DATA, &val);
+                if (disable)
+                        val &= ~(0x3f << 7);
+                else
+                        val |= 0x3f << 7;
+
+                pci_write_config_dword(amd_nb_dev, NB_PCIE_INDX_DATA, val);
+
+                addr = NB_PIF0_PWRDOWN_1;
+                pci_write_config_dword(amd_nb_dev, NB_PCIE_INDX_ADDR, addr);
+                pci_read_config_dword(amd_nb_dev, NB_PCIE_INDX_DATA, &val);
+                if (disable)
+                        val &= ~(0x3f << 7);
+                else
+                        val |= 0x3f << 7;
+
+                pci_write_config_dword(amd_nb_dev, NB_PCIE_INDX_DATA, val);
+        }
+
+        return;
+}
+
 /* fit urb's itds into the selected schedule slot; activate as needed */
 static int
 itd_link_urb (
@@ -1609,6 +1666,12 @@ itd_link_urb (
                         urb->interval,
                         next_uframe >> 3, next_uframe & 0x7);
         }
+
+        if (ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs == 0) {
+                if (ehci->amd_l1_fix == 1)
+                        ehci_quirk_amd_L1(ehci, 1);
+        }
+
         ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs++;
 
         /* fill iTDs uframe by uframe */
@@ -1733,6 +1796,11 @@ itd_complete (
         (void) disable_periodic(ehci);
         ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs--;
 
+        if (ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs == 0) {
+                if (ehci->amd_l1_fix == 1)
+                        ehci_quirk_amd_L1(ehci, 0);
+        }
+
         if (unlikely(list_is_singular(&stream->td_list))) {
                 ehci_to_hcd(ehci)->self.bandwidth_allocated
                                 -= stream->bandwidth;
@@ -2018,6 +2086,12 @@ sitd_link_urb (
                         (next_uframe >> 3) & (ehci->periodic_size - 1),
                         stream->interval, hc32_to_cpu(ehci, stream->splits));
         }
+
+        if (ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs == 0) {
+                if (ehci->amd_l1_fix == 1)
+                        ehci_quirk_amd_L1(ehci, 1);
+        }
+
         ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs++;
 
         /* fill sITDs frame by frame */
@@ -2118,6 +2192,11 @@ sitd_complete (
         (void) disable_periodic(ehci);
         ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs--;
 
+        if (ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs == 0) {
+                if (ehci->amd_l1_fix == 1)
+                        ehci_quirk_amd_L1(ehci, 0);
+        }
+
         if (list_is_singular(&stream->td_list)) {
                 ehci_to_hcd(ehci)->self.bandwidth_allocated
                                 -= stream->bandwidth;
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index bde823f704e9..fd1c53da89e4 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -130,6 +130,7 @@ struct ehci_hcd {			/* one per controller */
         unsigned                has_amcc_usb23:1;
         unsigned                need_io_watchdog:1;
         unsigned                broken_periodic:1;
+        unsigned                amd_l1_fix:1;
         unsigned                fs_i_thresh:1;  /* Intel iso scheduling */
 
         /* required for usb32 quirk */
diff --git a/drivers/usb/host/ohci-jz4740.c b/drivers/usb/host/ohci-jz4740.c
index 10e1872f3ab9..931d588c3fb5 100644
--- a/drivers/usb/host/ohci-jz4740.c
+++ b/drivers/usb/host/ohci-jz4740.c
@@ -273,4 +273,4 @@ static struct platform_driver ohci_hcd_jz4740_driver = {
         },
 };
 
-MODULE_ALIAS("platfrom:jz4740-ohci");
+MODULE_ALIAS("platform:jz4740-ohci");
diff --git a/drivers/usb/host/r8a66597.h b/drivers/usb/host/r8a66597.h
index 95d0f5adfdcf..25563e9a90bc 100644
--- a/drivers/usb/host/r8a66597.h
+++ b/drivers/usb/host/r8a66597.h
@@ -227,7 +227,7 @@ static inline void r8a66597_write_fifo(struct r8a66597 *r8a66597,
                 int odd = len & 0x0001;
 
                 len = len / 2;
-                ioread16_rep(fifoaddr, buf, len);
+                iowrite16_rep(fifoaddr, buf, len);
                 if (unlikely(odd)) {
                         buf = &buf[len];
                         iowrite8((unsigned char)*buf, fifoaddr);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index a1a7a9795536..480936a870ce 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -132,6 +132,13 @@ static u32 xhci_port_state_to_neutral(u32 state)
 static void xhci_disable_port(struct xhci_hcd *xhci, u16 wIndex,
                 u32 __iomem *addr, u32 port_status)
 {
+        /* Don't allow the USB core to disable SuperSpeed ports. */
+        if (xhci->port_array[wIndex] == 0x03) {
+                xhci_dbg(xhci, "Ignoring request to disable "
+                                "SuperSpeed port.\n");
+                return;
+        }
+
         /* Write 1 to disable the port */
         xhci_writel(xhci, port_status | PORT_PE, addr);
         port_status = xhci_readl(xhci, addr);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 4e51343ddffc..6627a956fa8e 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1043,7 +1043,7 @@ static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
         if (udev->speed == USB_SPEED_SUPER)
                 return ep->ss_ep_comp.wBytesPerInterval;
 
-        max_packet = ep->desc.wMaxPacketSize & 0x3ff;
+        max_packet = GET_MAX_PACKET(ep->desc.wMaxPacketSize);
         max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11;
         /* A 0 in max burst means 1 transfer per ESIT */
         return max_packet * (max_burst + 1);
@@ -1133,7 +1133,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
                 /* Fall through */
         case USB_SPEED_FULL:
         case USB_SPEED_LOW:
-                max_packet = ep->desc.wMaxPacketSize & 0x3ff;
+                max_packet = GET_MAX_PACKET(ep->desc.wMaxPacketSize);
                 ep_ctx->ep_info2 |= MAX_PACKET(max_packet);
                 break;
         default:
@@ -1441,6 +1441,13 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         xhci->dcbaa = NULL;
 
         scratchpad_free(xhci);
+
+        xhci->num_usb2_ports = 0;
+        xhci->num_usb3_ports = 0;
+        kfree(xhci->usb2_ports);
+        kfree(xhci->usb3_ports);
+        kfree(xhci->port_array);
+
         xhci->page_size = 0;
         xhci->page_shift = 0;
 }
@@ -1624,6 +1631,166 @@ static void xhci_set_hc_event_deq(struct xhci_hcd *xhci)
                         &xhci->ir_set->erst_dequeue);
 }
 
+static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
+                u32 __iomem *addr, u8 major_revision)
+{
+        u32 temp, port_offset, port_count;
+        int i;
+
+        if (major_revision > 0x03) {
+                xhci_warn(xhci, "Ignoring unknown port speed, "
+                                "Ext Cap %p, revision = 0x%x\n",
+                                addr, major_revision);
+                /* Ignoring port protocol we can't understand. FIXME */
+                return;
+        }
+
+        /* Port offset and count in the third dword, see section 7.2 */
+        temp = xhci_readl(xhci, addr + 2);
+        port_offset = XHCI_EXT_PORT_OFF(temp);
+        port_count = XHCI_EXT_PORT_COUNT(temp);
+        xhci_dbg(xhci, "Ext Cap %p, port offset = %u, "
+                        "count = %u, revision = 0x%x\n",
+                        addr, port_offset, port_count, major_revision);
+        /* Port count includes the current port offset */
+        if (port_offset == 0 || (port_offset + port_count - 1) > num_ports)
+                /* WTF? "Valid values are ‘1’ to MaxPorts" */
+                return;
+        port_offset--;
+        for (i = port_offset; i < (port_offset + port_count); i++) {
+                /* Duplicate entry.  Ignore the port if the revisions differ. */
+                if (xhci->port_array[i] != 0) {
+                        xhci_warn(xhci, "Duplicate port entry, Ext Cap %p,"
+                                        " port %u\n", addr, i);
+                        xhci_warn(xhci, "Port was marked as USB %u, "
+                                        "duplicated as USB %u\n",
+                                        xhci->port_array[i], major_revision);
+                        /* Only adjust the roothub port counts if we haven't
+                         * found a similar duplicate.
+                         */
+                        if (xhci->port_array[i] != major_revision &&
+                                xhci->port_array[i] != (u8) -1) {
+                                if (xhci->port_array[i] == 0x03)
+                                        xhci->num_usb3_ports--;
+                                else
+                                        xhci->num_usb2_ports--;
+                                xhci->port_array[i] = (u8) -1;
+                        }
+                        /* FIXME: Should we disable the port? */
+                        continue;
+                }
+                xhci->port_array[i] = major_revision;
+                if (major_revision == 0x03)
+                        xhci->num_usb3_ports++;
+                else
+                        xhci->num_usb2_ports++;
+        }
+        /* FIXME: Should we disable ports not in the Extended Capabilities? */
+}
+
+/*
+ * Scan the Extended Capabilities for the "Supported Protocol Capabilities" that
+ * specify what speeds each port is supposed to be.  We can't count on the port
+ * speed bits in the PORTSC register being correct until a device is connected,
+ * but we need to set up the two fake roothubs with the correct number of USB
+ * 3.0 and USB 2.0 ports at host controller initialization time.
+ */
+static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
+{
+        u32 __iomem *addr;
+        u32 offset;
+        unsigned int num_ports;
+        int i, port_index;
+
+        addr = &xhci->cap_regs->hcc_params;
+        offset = XHCI_HCC_EXT_CAPS(xhci_readl(xhci, addr));
+        if (offset == 0) {
+                xhci_err(xhci, "No Extended Capability registers, "
+                                "unable to set up roothub.\n");
+                return -ENODEV;
+        }
+
+        num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+        xhci->port_array = kzalloc(sizeof(*xhci->port_array)*num_ports, flags);
+        if (!xhci->port_array)
+                return -ENOMEM;
+
+        /*
+         * For whatever reason, the first capability offset is from the
+         * capability register base, not from the HCCPARAMS register.
+         * See section 5.3.6 for offset calculation.
+         */
+        addr = &xhci->cap_regs->hc_capbase + offset;
+        while (1) {
+                u32 cap_id;
+
+                cap_id = xhci_readl(xhci, addr);
+                if (XHCI_EXT_CAPS_ID(cap_id) == XHCI_EXT_CAPS_PROTOCOL)
+                        xhci_add_in_port(xhci, num_ports, addr,
+                                        (u8) XHCI_EXT_PORT_MAJOR(cap_id));
+                offset = XHCI_EXT_CAPS_NEXT(cap_id);
+                if (!offset || (xhci->num_usb2_ports + xhci->num_usb3_ports)
+                                == num_ports)
+                        break;
+                /*
+                 * Once you're into the Extended Capabilities, the offset is
+                 * always relative to the register holding the offset.
+                 */
+                addr += offset;
+        }
+
+        if (xhci->num_usb2_ports == 0 && xhci->num_usb3_ports == 0) {
+                xhci_warn(xhci, "No ports on the roothubs?\n");
+                return -ENODEV;
+        }
+        xhci_dbg(xhci, "Found %u USB 2.0 ports and %u USB 3.0 ports.\n",
+                        xhci->num_usb2_ports, xhci->num_usb3_ports);
+        /*
+         * Note we could have all USB 3.0 ports, or all USB 2.0 ports.
+         * Not sure how the USB core will handle a hub with no ports...
+         */
+        if (xhci->num_usb2_ports) {
+                xhci->usb2_ports = kmalloc(sizeof(*xhci->usb2_ports)*
+                                xhci->num_usb2_ports, flags);
+                if (!xhci->usb2_ports)
+                        return -ENOMEM;
+
+                port_index = 0;
+                for (i = 0; i < num_ports; i++) {
+                        if (xhci->port_array[i] == 0x03 ||
+                                        xhci->port_array[i] == 0 ||
+                                        xhci->port_array[i] == -1)
+                                continue;
+
+                        xhci->usb2_ports[port_index] =
+                                &xhci->op_regs->port_status_base +
+                                NUM_PORT_REGS*i;
+                        xhci_dbg(xhci, "USB 2.0 port at index %u, "
+                                        "addr = %p\n", i,
+                                        xhci->usb2_ports[port_index]);
+                        port_index++;
+                }
+        }
+        if (xhci->num_usb3_ports) {
+                xhci->usb3_ports = kmalloc(sizeof(*xhci->usb3_ports)*
+                                xhci->num_usb3_ports, flags);
+                if (!xhci->usb3_ports)
+                        return -ENOMEM;
+
+                port_index = 0;
+                for (i = 0; i < num_ports; i++)
+                        if (xhci->port_array[i] == 0x03) {
+                                xhci->usb3_ports[port_index] =
+                                        &xhci->op_regs->port_status_base +
+                                        NUM_PORT_REGS*i;
+                                xhci_dbg(xhci, "USB 3.0 port at index %u, "
+                                                "addr = %p\n", i,
+                                                xhci->usb3_ports[port_index]);
+                                port_index++;
+                        }
+        }
+        return 0;
+}
 
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 {
@@ -1804,6 +1971,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 
         if (scratchpad_alloc(xhci, flags))
                 goto fail;
+        if (xhci_setup_port_arrays(xhci, flags))
+                goto fail;
 
         return 0;
 
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 48e60d166ff0..e7547d8b3d67 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2028,7 +2028,6 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
 
         if (!(status & STS_EINT)) {
                 spin_unlock(&xhci->lock);
-                xhci_warn(xhci, "Spurious interrupt.\n");
                 return IRQ_NONE;
         }
         xhci_dbg(xhci, "op reg status = %08x\n", status);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index d5c550ea3e68..96ef552cfeb3 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -508,9 +508,10 @@ void xhci_stop(struct usb_hcd *hcd)
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
         xhci_reset(xhci);
-        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
+        xhci_cleanup_msix(xhci);
+
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
         /* Tell the event ring poll function not to reschedule */
         xhci->zombie = 1;
@@ -544,9 +545,10 @@ void xhci_shutdown(struct usb_hcd *hcd)
 
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
-        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
+        xhci_cleanup_msix(xhci);
+
         xhci_dbg(xhci, "xhci_shutdown completed - status = %x\n",
                     xhci_readl(xhci, &xhci->op_regs->status));
 }
@@ -1284,6 +1286,15 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
                 cmd_completion = command->completion;
                 cmd_status = &command->status;
                 command->command_trb = xhci->cmd_ring->enqueue;
+
+                /* Enqueue pointer can be left pointing to the link TRB,
+                 * we must handle that
+                 */
+                if ((command->command_trb->link.control & TRB_TYPE_BITMASK)
+                                == TRB_TYPE(TRB_LINK))
+                        command->command_trb =
+                                xhci->cmd_ring->enq_seg->next->trbs;
+
                 list_add_tail(&command->cmd_list, &virt_dev->cmd_list);
         } else {
                 in_ctx = virt_dev->in_ctx;
@@ -1993,6 +2004,15 @@ int xhci_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
         /* Attempt to submit the Reset Device command to the command ring */
         spin_lock_irqsave(&xhci->lock, flags);
         reset_device_cmd->command_trb = xhci->cmd_ring->enqueue;
+
+        /* Enqueue pointer can be left pointing to the link TRB,
+         * we must handle that
+         */
+        if ((reset_device_cmd->command_trb->link.control & TRB_TYPE_BITMASK)
+                        == TRB_TYPE(TRB_LINK))
+                reset_device_cmd->command_trb =
+                        xhci->cmd_ring->enq_seg->next->trbs;
+
         list_add_tail(&reset_device_cmd->cmd_list, &virt_dev->cmd_list);
         ret = xhci_queue_reset_device(xhci, slot_id);
         if (ret) {
@@ -2148,8 +2168,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
                 xhci_err(xhci, "Error while assigning device slot ID\n");
                 return 0;
         }
-        /* xhci_alloc_virt_device() does not touch rings; no need to lock */
-        if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_KERNEL)) {
+        /* xhci_alloc_virt_device() does not touch rings; no need to lock.
+         * Use GFP_NOIO, since this function can be called from
+         * xhci_discover_or_reset_device(), which may be called as part of
+         * mass storage driver error handling.
+         */
+        if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_NOIO)) {
                 /* Disable slot, if we can do it without mem alloc */
                 xhci_warn(xhci, "Could not allocate xHCI USB device data structures\n");
                 spin_lock_irqsave(&xhci->lock, flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 34a60d9f056a..404ecbce5128 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -448,6 +448,24 @@ struct xhci_doorbell_array {
 
 
 /**
+ * struct xhci_protocol_caps
+ * @revision:           major revision, minor revision, capability ID,
+ *                      and next capability pointer.
+ * @name_string:        Four ASCII characters to say which spec this xHC
+ *                      follows, typically "USB ".
+ * @port_info:          Port offset, count, and protocol-defined information.
+ */
+struct xhci_protocol_caps {
+        u32     revision;
+        u32     name_string;
+        u32     port_info;
+};
+
+#define XHCI_EXT_PORT_MAJOR(x)  (((x) >> 24) & 0xff)
+#define XHCI_EXT_PORT_OFF(x)    ((x) & 0xff)
+#define XHCI_EXT_PORT_COUNT(x)  (((x) >> 8) & 0xff)
+
+/**
  * struct xhci_container_ctx
  * @type: Type of context.  Used to calculated offsets to contained contexts.
  * @size: Size of the context data
@@ -614,6 +632,11 @@ struct xhci_ep_ctx {
 #define MAX_PACKET_MASK         (0xffff << 16)
 #define MAX_PACKET_DECODED(p)   (((p) >> 16) & 0xffff)
 
+/* Get max packet size from ep desc. Bit 10..0 specify the max packet size.
+ * USB2.0 spec 9.6.6.
+ */
+#define GET_MAX_PACKET(p)       ((p) & 0x7ff)
+
 /* tx_info bitmasks */
 #define AVG_TRB_LENGTH_FOR_EP(p)        ((p) & 0xffff)
 #define MAX_ESIT_PAYLOAD_FOR_EP(p)      (((p) & 0xffff) << 16)
@@ -1199,6 +1222,15 @@ struct xhci_hcd {
 #define XHCI_LINK_TRB_QUIRK     (1 << 0)
 #define XHCI_RESET_EP_QUIRK     (1 << 1)
 #define XHCI_NEC_HOST           (1 << 2)
+
+        /* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
+        u8                      *port_array;
+        /* Array of pointers to USB 3.0 PORTSC registers */
+        u32 __iomem             **usb3_ports;
+        unsigned int            num_usb3_ports;
+        /* Array of pointers to USB 2.0 PORTSC registers */
+        u32 __iomem             **usb2_ports;
+        unsigned int            num_usb2_ports;
 };
 
 /* For testing purposes */
diff --git a/drivers/usb/misc/cypress_cy7c63.c b/drivers/usb/misc/cypress_cy7c63.c
index 2f43c57743c9..9251773ecef4 100644
--- a/drivers/usb/misc/cypress_cy7c63.c
+++ b/drivers/usb/misc/cypress_cy7c63.c
@@ -196,11 +196,9 @@ static ssize_t get_port1_handler(struct device *dev,
         return read_port(dev, attr, buf, 1, CYPRESS_READ_PORT_ID1);
 }
 
-static DEVICE_ATTR(port0, S_IWUGO | S_IRUGO,
-                   get_port0_handler, set_port0_handler);
+static DEVICE_ATTR(port0, S_IRUGO | S_IWUSR, get_port0_handler, set_port0_handler);
 
-static DEVICE_ATTR(port1, S_IWUGO | S_IRUGO,
-                   get_port1_handler, set_port1_handler);
+static DEVICE_ATTR(port1, S_IRUGO | S_IWUSR, get_port1_handler, set_port1_handler);
 
 
 static int cypress_probe(struct usb_interface *interface,
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index bc88c79875a1..0db05b252e3b 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -553,6 +553,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
                         /* needed for power consumption */
                         struct usb_config_descriptor *cfg_descriptor = &dev->udev->actconfig->desc;
 
+                        memset(&info, 0, sizeof(info));
                         /* directly from the descriptor */
                         info.vendor = le16_to_cpu(dev->udev->descriptor.idVendor);
                         info.product = dev->product_id;
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 70d00e99a4b4..dd573abd2d1e 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3008,6 +3008,7 @@ sisusb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 #else
                         x.sisusb_conactive  = 0;
 #endif
+                        memset(x.sisusb_reserved, 0, sizeof(x.sisusb_reserved));
 
                         if (copy_to_user((void __user *)arg, &x, sizeof(x)))
                                 retval = -EFAULT;
diff --git a/drivers/usb/misc/trancevibrator.c b/drivers/usb/misc/trancevibrator.c
index d77aba46ae85..f63776a48e2a 100644
--- a/drivers/usb/misc/trancevibrator.c
+++ b/drivers/usb/misc/trancevibrator.c
@@ -86,7 +86,7 @@ static ssize_t set_speed(struct device *dev, struct device_attribute *attr,
         return count;
 }
 
-static DEVICE_ATTR(speed, S_IWUGO | S_IRUGO, show_speed, set_speed);
+static DEVICE_ATTR(speed, S_IRUGO | S_IWUSR, show_speed, set_speed);
 
 static int tv_probe(struct usb_interface *interface,
                     const struct usb_device_id *id)
diff --git a/drivers/usb/misc/usbled.c b/drivers/usb/misc/usbled.c
index 63da2c3c838f..c96f51de1696 100644
--- a/drivers/usb/misc/usbled.c
+++ b/drivers/usb/misc/usbled.c
@@ -94,7 +94,7 @@ static ssize_t set_##value(struct device *dev, struct device_attribute *attr, co
         change_color(led);                                              \
         return count;                                                   \
 }                                                                       \
-static DEVICE_ATTR(value, S_IWUGO | S_IRUGO, show_##value, set_##value);
+static DEVICE_ATTR(value, S_IRUGO | S_IWUSR, show_##value, set_##value);
 show_set(blue);
 show_set(red);
 show_set(green);
diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
index de8ef945b536..417b8f207e8b 100644
--- a/drivers/usb/misc/usbsevseg.c
+++ b/drivers/usb/misc/usbsevseg.c
@@ -192,7 +192,7 @@ static ssize_t set_attr_##name(struct device *dev, 		\
                                                                 \
         return count;                                           \
 }                                                               \
-static DEVICE_ATTR(name, S_IWUGO | S_IRUGO, show_attr_##name, set_attr_##name);
+static DEVICE_ATTR(name, S_IRUGO | S_IWUSR, show_attr_##name, set_attr_##name);
 
 static ssize_t show_attr_text(struct device *dev,
         struct device_attribute *attr, char *buf)
@@ -223,7 +223,7 @@ static ssize_t set_attr_text(struct device *dev,
         return count;
 }
 
-static DEVICE_ATTR(text, S_IWUGO | S_IRUGO, show_attr_text, set_attr_text);
+static DEVICE_ATTR(text, S_IRUGO | S_IWUSR, show_attr_text, set_attr_text);
 
 static ssize_t show_attr_decimals(struct device *dev,
         struct device_attribute *attr, char *buf)
@@ -272,8 +272,7 @@ static ssize_t set_attr_decimals(struct device *dev,
         return count;
 }
 
-static DEVICE_ATTR(decimals, S_IWUGO | S_IRUGO,
-        show_attr_decimals, set_attr_decimals);
+static DEVICE_ATTR(decimals, S_IRUGO | S_IWUSR, show_attr_decimals, set_attr_decimals);
 
 static ssize_t show_attr_textmode(struct device *dev,
         struct device_attribute *attr, char *buf)
@@ -319,8 +318,7 @@ static ssize_t set_attr_textmode(struct device *dev,
         return -EINVAL;
 }
 
-static DEVICE_ATTR(textmode, S_IWUGO | S_IRUGO,
-        show_attr_textmode, set_attr_textmode);
+static DEVICE_ATTR(textmode, S_IRUGO | S_IWUSR, show_attr_textmode, set_attr_textmode);
 
 
 MYDEV_ATTR_SIMPLE_UNSIGNED(powered, update_display_powered);
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index 796e2f68f749..4ff21587ab03 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -3,7 +3,7 @@
 /*
  *      uss720.c  --  USS720 USB Parport Cable.
  *
- *      Copyright (C) 1999, 2005
+ *      Copyright (C) 1999, 2005, 2010
  *          Thomas Sailer (t.sailer@alumni.ethz.ch)
  *
  *      This program is free software; you can redistribute it and/or modify
@@ -776,6 +776,8 @@ static const struct usb_device_id uss720_table[] = {
         { USB_DEVICE(0x0557, 0x2001) },
         { USB_DEVICE(0x0729, 0x1284) },
         { USB_DEVICE(0x1293, 0x0002) },
+        { USB_DEVICE(0x1293, 0x0002) },
+        { USB_DEVICE(0x050d, 0x0002) },
         { }                                             /* Terminating entry */
 };
 
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index b611420a8050..611a9d274363 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -342,8 +342,10 @@ int __init musb_platform_init(struct musb *musb, void *board_data)
 
         usb_nop_xceiv_register();
         musb->xceiv = otg_get_transceiver();
-        if (!musb->xceiv)
+        if (!musb->xceiv) {
+                gpio_free(musb->config->gpio_vrsel);
                 return -ENODEV;
+        }
 
         if (ANOMALY_05000346) {
                 bfin_write_USB_APHY_CALIB(ANOMALY_05000346_value);
@@ -394,8 +396,9 @@ int __init musb_platform_init(struct musb *musb, void *board_data)
 
 int musb_platform_exit(struct musb *musb)
 {
-
         gpio_free(musb->config->gpio_vrsel);
 
+        otg_put_transceiver(musb->xceiv);
+        usb_nop_xceiv_unregister();
         return 0;
 }
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 57624361c1de..6e67629f50cc 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -446,6 +446,7 @@ int __init musb_platform_init(struct musb *musb, void *board_data)
 fail:
         clk_disable(musb->clock);
 
+        otg_put_transceiver(musb->xceiv);
         usb_nop_xceiv_unregister();
         return -ENODEV;
 }
@@ -496,6 +497,7 @@ int musb_platform_exit(struct musb *musb)
 
         clk_disable(musb->clock);
 
+        otg_put_transceiver(musb->xceiv);
         usb_nop_xceiv_unregister();
 
         return 0;
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 540c766c4f86..0707b296cce4 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1921,10 +1921,6 @@ static void musb_free(struct musb *musb)
                 dma_controller_destroy(c);
         }
 
-#ifdef CONFIG_USB_MUSB_OTG
-        put_device(musb->xceiv->dev);
-#endif
-
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
         usb_put_hcd(musb_to_hcd(musb));
 #else
@@ -2247,7 +2243,6 @@ static int __exit musb_remove(struct platform_device *pdev)
 #endif
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
         musb_platform_exit(musb);
-        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
 
         musb_free(musb);
         iounmap(ctrl_base);
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 2111a241dd03..ed618bde1eec 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -320,5 +320,6 @@ int musb_platform_exit(struct musb *musb)
 
         musb_platform_suspend(musb);
 
+        otg_put_transceiver(musb->xceiv);
         return 0;
 }
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 3c48e77a0aa2..bde40efc7046 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1152,6 +1152,8 @@ done:
         if (ret < 0) {
                 if (sync)
                         iounmap(sync);
+
+                otg_put_transceiver(musb->xceiv);
                 usb_nop_xceiv_unregister();
         }
         return ret;
@@ -1166,6 +1168,8 @@ int musb_platform_exit(struct musb *musb)
                 musb->board_set_power(0);
 
         iounmap(musb->sync_va);
+
+        otg_put_transceiver(musb->xceiv);
         usb_nop_xceiv_unregister();
         return 0;
 }
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 63f7cc45bcac..7b8815ddf368 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -486,12 +486,22 @@ static void ch341_read_int_callback(struct urb *urb)
         if (actual_length >= 4) {
                 struct ch341_private *priv = usb_get_serial_port_data(port);
                 unsigned long flags;
+                u8 prev_line_status = priv->line_status;
 
                 spin_lock_irqsave(&priv->lock, flags);
                 priv->line_status = (~(data[2])) & CH341_BITS_MODEM_STAT;
                 if ((data[1] & CH341_MULT_STAT))
                         priv->multi_status_change = 1;
                 spin_unlock_irqrestore(&priv->lock, flags);
+
+                if ((priv->line_status ^ prev_line_status) & CH341_BIT_DCD) {
+                        struct tty_struct *tty = tty_port_tty_get(&port->port);
+                        if (tty)
+                                usb_serial_handle_dcd_change(port, tty,
+                                            priv->line_status & CH341_BIT_DCD);
+                        tty_kref_put(tty);
+                }
+
                 wake_up_interruptible(&priv->delta_msr_wait);
         }
 
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 4f1744c5871f..735ea03157ab 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -49,11 +49,11 @@ static int cp210x_tiocmset_port(struct usb_serial_port *port, struct file *,
 static void cp210x_break_ctl(struct tty_struct *, int);
 static int cp210x_startup(struct usb_serial *);
 static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
-static int cp210x_carrier_raised(struct usb_serial_port *p);
 
 static int debug;
 
 static const struct usb_device_id id_table[] = {
+        { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */
         { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
         { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
         { USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
@@ -86,7 +86,6 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */
         { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
         { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */
-        { USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */
         { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
         { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
         { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
@@ -109,7 +108,9 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
         { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
         { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
+        { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
         { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
+        { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
         { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
         { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
@@ -132,6 +133,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
         { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+        { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
         { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
         { } /* Terminating Entry */
 };
@@ -163,8 +165,7 @@ static struct usb_serial_driver cp210x_device = {
         .tiocmget               = cp210x_tiocmget,
         .tiocmset               = cp210x_tiocmset,
         .attach                 = cp210x_startup,
-        .dtr_rts                = cp210x_dtr_rts,
-        .carrier_raised         = cp210x_carrier_raised
+        .dtr_rts                = cp210x_dtr_rts
 };
 
 /* Config request types */
@@ -763,15 +764,6 @@ static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
         return result;
 }
 
-static int cp210x_carrier_raised(struct usb_serial_port *p)
-{
-        unsigned int control;
-        cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
-        if (control & CONTROL_DCD)
-                return 1;
-        return 0;
-}
-
 static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
 {
         struct usb_serial_port *port = tty->driver_data;
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index b92070c103cd..666e5a6edd82 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -455,7 +455,6 @@ static int digi_write_room(struct tty_struct *tty);
 static int digi_chars_in_buffer(struct tty_struct *tty);
 static int digi_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void digi_close(struct usb_serial_port *port);
-static int digi_carrier_raised(struct usb_serial_port *port);
 static void digi_dtr_rts(struct usb_serial_port *port, int on);
 static int digi_startup_device(struct usb_serial *serial);
 static int digi_startup(struct usb_serial *serial);
@@ -511,7 +510,6 @@ static struct usb_serial_driver digi_acceleport_2_device = {
         .open =                         digi_open,
         .close =                        digi_close,
         .dtr_rts =                      digi_dtr_rts,
-        .carrier_raised =               digi_carrier_raised,
         .write =                        digi_write,
         .write_room =                   digi_write_room,
         .write_bulk_callback =          digi_write_bulk_callback,
@@ -1339,14 +1337,6 @@ static void digi_dtr_rts(struct usb_serial_port *port, int on)
         digi_set_modem_signals(port, on * (TIOCM_DTR|TIOCM_RTS), 1);
 }
 
-static int digi_carrier_raised(struct usb_serial_port *port)
-{
-        struct digi_port *priv = usb_get_serial_port_data(port);
-        if (priv->dp_modem_signals & TIOCM_CD)
-                return 1;
-        return 0;
-}
-
 static int digi_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         int ret;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 97cc87d654ce..88bef0276876 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -99,6 +99,7 @@ struct ftdi_sio_quirk {
 static int   ftdi_jtag_probe(struct usb_serial *serial);
 static int   ftdi_mtxorb_hack_setup(struct usb_serial *serial);
 static int   ftdi_NDI_device_setup(struct usb_serial *serial);
+static int   ftdi_stmclite_probe(struct usb_serial *serial);
 static void  ftdi_USB_UIRT_setup(struct ftdi_private *priv);
 static void  ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
 
@@ -122,6 +123,10 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
         .port_probe = ftdi_HE_TIRA1_setup,
 };
 
+static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
+        .probe  = ftdi_stmclite_probe,
+};
+
 /*
  * The 8U232AM has the same API as the sio except for:
  * - it can support MUCH higher baudrates; up to:
@@ -177,6 +182,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_SNIFFER_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) },
         { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
         { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
@@ -200,6 +206,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) },
+        { USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) },
         { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) },
@@ -613,6 +620,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_OCEANIC_PID) },
         { USB_DEVICE(TTI_VID, TTI_QL355P_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_RM_CANVIEW_PID) },
+        { USB_DEVICE(ACTON_VID, ACTON_SPECTRAPRO_PID) },
         { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
         { USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) },
         { USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
@@ -673,8 +681,17 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
-        { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
-        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C2_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2D_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2VT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2VR_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVR_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVR_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
@@ -696,6 +713,7 @@ static struct usb_device_id id_table_combined [] = {
                 .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
         { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
         { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
         { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
@@ -715,8 +733,37 @@ static struct usb_device_id id_table_combined [] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
         { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
+
+        /* Papouch devices based on FTDI chip */
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AP485_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB422_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485_2_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AP485_2_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB422_2_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485S_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB485C_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_LEC_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SB232_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_IRAMP_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_DRAK5_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO8x8_PID) },
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO2x2_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO10x1_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO30x3_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO60x3_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO2x16_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO3x32_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_DRAK6_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_UPSUSB_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_MU_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_SIMUKEY_PID) },
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AD4USB_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_GMUX_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_GMSR_PID) },
+
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DGQG_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
         { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
@@ -751,6 +798,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) },
+        { USB_DEVICE(FTDI_VID, ACCESIO_COM4SM_PID) },
         { USB_DEVICE(IONICS_VID, IONICS_PLUGCOMPUTER_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_24_MASTER_WING_PID) },
@@ -761,6 +809,14 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_MAXI_WING_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_MEDIA_WING_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_WING_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LOGBOOKML_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
+        { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -1642,6 +1698,25 @@ static int ftdi_jtag_probe(struct usb_serial *serial)
 }
 
 /*
+ * First and second port on STMCLiteadaptors is reserved for JTAG interface
+ * and the forth port for pio
+ */
+static int ftdi_stmclite_probe(struct usb_serial *serial)
+{
+        struct usb_device *udev = serial->dev;
+        struct usb_interface *interface = serial->interface;
+
+        dbg("%s", __func__);
+
+        if (interface == udev->actconfig->interface[2])
+                return 0;
+
+        dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
+
+        return -ENODEV;
+}
+
+/*
  * The Matrix Orbital VK204-25-USB has an invalid IN endpoint.
  * We have to correct it if we want to read from it.
  */
@@ -2028,8 +2103,6 @@ static void ftdi_set_termios(struct tty_struct *tty,
                                 "urb failed to set to rts/cts flow control\n");
                 }
 
-                /* raise DTR/RTS */
-                set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
         } else {
                 /*
                  * Xon/Xoff code
@@ -2077,8 +2150,6 @@ static void ftdi_set_termios(struct tty_struct *tty,
                         }
                 }
 
-                /* lower DTR/RTS */
-                clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
         }
         return;
 }
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 15a4583775ad..3523df534a27 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -61,6 +61,7 @@
 #define FTDI_OPENDCC_SNIFFER_PID        0xBFD9
 #define FTDI_OPENDCC_THROTTLE_PID       0xBFDA
 #define FTDI_OPENDCC_GATEWAY_PID        0xBFDB
+#define FTDI_OPENDCC_GBM_PID    0xBFDC
 
 /*
  * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
@@ -113,6 +114,9 @@
 /* Lenz LI-USB Computer Interface. */
 #define FTDI_LENZ_LIUSB_PID     0xD780
 
+/* Vardaan Enterprises Serial Interface VEUSB422R3 */
+#define FTDI_VARDAAN_PID        0xF070
+
 /*
  * Xsens Technologies BV products (http://www.xsens.com).
  */
@@ -514,6 +518,12 @@
 #define RATOC_PRODUCT_ID_USB60F 0xb020
 
 /*
+ * Acton Research Corp.
+ */
+#define ACTON_VID               0x0647  /* Vendor ID */
+#define ACTON_SPECTRAPRO_PID    0x0100
+
+/*
  * Contec products (http://www.contec.com)
  * Submitted by Daniel Sangorrin
  */
@@ -565,11 +575,23 @@
 #define OCT_US101_PID           0x0421  /* OCT US101 USB to RS-232 */
 
 /*
- * Icom ID-1 digital transceiver
+ * Definitions for Icom Inc. devices
  */
-
-#define ICOM_ID1_VID            0x0C26
-#define ICOM_ID1_PID            0x0004
+#define ICOM_VID                0x0C26 /* Icom vendor ID */
+/* Note: ID-1 is a communications tranceiver for HAM-radio operators */
+#define ICOM_ID_1_PID           0x0004 /* ID-1 USB to RS-232 */
+/* Note: OPC is an Optional cable to connect an Icom Tranceiver */
+#define ICOM_OPC_U_UC_PID       0x0018 /* OPC-478UC, OPC-1122U cloning cable */
+/* Note: ID-RP* devices are Icom Repeater Devices for HAM-radio */
+#define ICOM_ID_RP2C1_PID       0x0009 /* ID-RP2C Asset 1 to RS-232 */
+#define ICOM_ID_RP2C2_PID       0x000A /* ID-RP2C Asset 2 to RS-232 */
+#define ICOM_ID_RP2D_PID        0x000B /* ID-RP2D configuration port*/
+#define ICOM_ID_RP2VT_PID       0x000C /* ID-RP2V Transmit config port */
+#define ICOM_ID_RP2VR_PID       0x000D /* ID-RP2V Receive config port */
+#define ICOM_ID_RP4KVT_PID      0x0010 /* ID-RP4000V Transmit config port */
+#define ICOM_ID_RP4KVR_PID      0x0011 /* ID-RP4000V Receive config port */
+#define ICOM_ID_RP2KVT_PID      0x0012 /* ID-RP2000V Transmit config port */
+#define ICOM_ID_RP2KVR_PID      0x0013 /* ID-RP2000V Receive config port */
 
 /*
  * GN Otometrics (http://www.otometrics.com)
@@ -720,6 +742,7 @@
  */
 #define RTSYSTEMS_VID                   0x2100  /* Vendor ID */
 #define RTSYSTEMS_SERIAL_VX7_PID        0x9e52  /* Serial converter for VX-7 Radios using FT232RL */
+#define RTSYSTEMS_CT29B_PID             0x9e54  /* CT29B Radio Cable */
 
 /*
  * Bayer Ascensia Contour blood glucose meter USB-converter cable.
@@ -1017,14 +1040,45 @@
 #define WHT_PID                 0x0004 /* Wireless Handheld Terminal */
 
 /*
+ * STMicroelectonics
+ */
+#define ST_VID                  0x0483
+#define ST_STMCLT1030_PID       0x3747 /* ST Micro Connect Lite STMCLT1030 */
+
+/*
  * Papouch products (http://www.papouch.com/)
  * Submitted by Folkert van Heusden
  */
 
 #define PAPOUCH_VID                     0x5050  /* Vendor ID */
+#define PAPOUCH_SB485_PID               0x0100  /* Papouch SB485 USB-485/422 Converter */
+#define PAPOUCH_AP485_PID               0x0101  /* AP485 USB-RS485 Converter */
+#define PAPOUCH_SB422_PID               0x0102  /* Papouch SB422 USB-RS422 Converter  */
+#define PAPOUCH_SB485_2_PID             0x0103  /* Papouch SB485 USB-485/422 Converter */
+#define PAPOUCH_AP485_2_PID             0x0104  /* AP485 USB-RS485 Converter */
+#define PAPOUCH_SB422_2_PID             0x0105  /* Papouch SB422 USB-RS422 Converter  */
+#define PAPOUCH_SB485S_PID              0x0106  /* Papouch SB485S USB-485/422 Converter */
+#define PAPOUCH_SB485C_PID              0x0107  /* Papouch SB485C USB-485/422 Converter */
+#define PAPOUCH_LEC_PID                 0x0300  /* LEC USB Converter */
+#define PAPOUCH_SB232_PID               0x0301  /* Papouch SB232 USB-RS232 Converter */
 #define PAPOUCH_TMU_PID                 0x0400  /* TMU USB Thermometer */
-#define PAPOUCH_QUIDO4x4_PID            0x0900  /* Quido 4/4 Module */
+#define PAPOUCH_IRAMP_PID               0x0500  /* Papouch IRAmp Duplex */
+#define PAPOUCH_DRAK5_PID               0x0700  /* Papouch DRAK5 */
+#define PAPOUCH_QUIDO8x8_PID            0x0800  /* Papouch Quido 8/8 Module */
+#define PAPOUCH_QUIDO4x4_PID            0x0900  /* Papouch Quido 4/4 Module */
+#define PAPOUCH_QUIDO2x2_PID            0x0a00  /* Papouch Quido 2/2 Module */
+#define PAPOUCH_QUIDO10x1_PID           0x0b00  /* Papouch Quido 10/1 Module */
+#define PAPOUCH_QUIDO30x3_PID           0x0c00  /* Papouch Quido 30/3 Module */
+#define PAPOUCH_QUIDO60x3_PID           0x0d00  /* Papouch Quido 60(100)/3 Module */
+#define PAPOUCH_QUIDO2x16_PID           0x0e00  /* Papouch Quido 2/16 Module */
+#define PAPOUCH_QUIDO3x32_PID           0x0f00  /* Papouch Quido 3/32 Module */
+#define PAPOUCH_DRAK6_PID               0x1000  /* Papouch DRAK6 */
+#define PAPOUCH_UPSUSB_PID              0x8000  /* Papouch UPS-USB adapter */
+#define PAPOUCH_MU_PID                  0x8001  /* MU controller */
+#define PAPOUCH_SIMUKEY_PID             0x8002  /* Papouch SimuKey */
 #define PAPOUCH_AD4USB_PID              0x8003  /* AD4USB Measurement Module */
+#define PAPOUCH_GMUX_PID                0x8004  /* Papouch GOLIATH MUX */
+#define PAPOUCH_GMSR_PID                0x8005  /* Papouch GOLIATH MSR */
 
 /*
  * Marvell SheevaPlug
@@ -1051,6 +1105,11 @@
 #define MJSG_HD_RADIO_PID       0x937C
 
 /*
+ * D.O.Tec products (http://www.directout.eu)
+ */
+#define FTDI_DOTEC_PID 0x9868
+
+/*
  * Xverve Signalyzer tools (http://www.signalyzer.com/)
  */
 #define XVERVE_SIGNALYZER_ST_PID        0xBCA0
@@ -1063,3 +1122,21 @@
  * Submitted by John G. Rogers
  */
 #define SEGWAY_RMP200_PID       0xe729
+
+
+/*
+ * Accesio USB Data Acquisition products (http://www.accesio.com/)
+ */
+#define ACCESIO_COM4SM_PID      0xD578
+
+/* www.sciencescope.co.uk educational dataloggers */
+#define FTDI_SCIENCESCOPE_LOGBOOKML_PID         0xFF18
+#define FTDI_SCIENCESCOPE_LS_LOGBOOK_PID        0xFF1C
+#define FTDI_SCIENCESCOPE_HS_LOGBOOK_PID        0xFF1D
+
+/*
+ * Milkymist One JTAG/Serial
+ */
+#define QIHARDWARE_VID                  0x20B7
+#define MILKYMISTONE_JTAGSERIAL_PID     0x0713
+
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index e6833e216fc9..e4db5ad2bc55 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -479,6 +479,26 @@ int usb_serial_handle_break(struct usb_serial_port *port)
 }
 EXPORT_SYMBOL_GPL(usb_serial_handle_break);
 
+/**
+ *      usb_serial_handle_dcd_change - handle a change of carrier detect state
+ *      @port: usb_serial_port structure for the open port
+ *      @tty: tty_struct structure for the port
+ *      @status: new carrier detect status, nonzero if active
+ */
+void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
+                                struct tty_struct *tty, unsigned int status)
+{
+        struct tty_port *port = &usb_port->port;
+
+        dbg("%s - port %d, status %d", __func__, usb_port->number, status);
+
+        if (status)
+                wake_up_interruptible(&port->open_wait);
+        else if (tty && !C_CLOCAL(tty))
+                tty_hangup(tty);
+}
+EXPORT_SYMBOL_GPL(usb_serial_handle_dcd_change);
+
 int usb_serial_generic_resume(struct usb_serial *serial)
 {
         struct usb_serial_port *port;
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index 76e6fb3aab7a..db0e3fe4acf5 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -2894,8 +2894,8 @@ static void load_application_firmware(struct edgeport_serial *edge_serial)
 
         dbg("%s %d.%d.%d", fw_info, rec->data[0], rec->data[1], build);
 
-        edge_serial->product_info.FirmwareMajorVersion = fw->data[0];
-        edge_serial->product_info.FirmwareMinorVersion = fw->data[1];
+        edge_serial->product_info.FirmwareMajorVersion = rec->data[0];
+        edge_serial->product_info.FirmwareMinorVersion = rec->data[1];
         edge_serial->product_info.FirmwareBuildNumber = cpu_to_le16(build);
 
         for (rec = ihex_next_binrec(rec); rec;
diff --git a/drivers/usb/serial/io_tables.h b/drivers/usb/serial/io_tables.h
index feb56a4ca799..1021a2c1c927 100644
--- a/drivers/usb/serial/io_tables.h
+++ b/drivers/usb/serial/io_tables.h
@@ -196,6 +196,7 @@ static struct usb_serial_driver epic_device = {
                 .name           = "epic",
         },
         .description            = "EPiC device",
+        .usb_driver             = &io_driver,
         .id_table               = Epic_port_id_table,
         .num_ports              = 1,
         .open                   = edge_open,
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index efc72113216b..7d26e3558721 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -1276,6 +1276,7 @@ static struct usb_serial_driver iuu_device = {
                    .name = "iuu_phoenix",
                    },
         .id_table = id_table,
+        .usb_driver = &iuu_driver,
         .num_ports = 1,
         .bulk_in_size = 512,
         .bulk_out_size = 512,
diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h
index bf3297ddd186..1ab6ea8c4602 100644
--- a/drivers/usb/serial/keyspan.h
+++ b/drivers/usb/serial/keyspan.h
@@ -546,6 +546,7 @@ static struct usb_serial_driver keyspan_pre_device = {
                 .name           = "keyspan_no_firm",
         },
         .description            = "Keyspan - (without firmware)",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_pre_ids,
         .num_ports              = 1,
         .attach                 = keyspan_fake_startup,
@@ -557,6 +558,7 @@ static struct usb_serial_driver keyspan_1port_device = {
                 .name           = "keyspan_1",
         },
         .description            = "Keyspan 1 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_1port_ids,
         .num_ports              = 1,
         .open                   = keyspan_open,
@@ -579,6 +581,7 @@ static struct usb_serial_driver keyspan_2port_device = {
                 .name           = "keyspan_2",
         },
         .description            = "Keyspan 2 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_2port_ids,
         .num_ports              = 2,
         .open                   = keyspan_open,
@@ -601,6 +604,7 @@ static struct usb_serial_driver keyspan_4port_device = {
                 .name           = "keyspan_4",
         },
         .description            = "Keyspan 4 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_4port_ids,
         .num_ports              = 4,
         .open                   = keyspan_open,
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 185fe9a7d4e0..2cbd661a92f7 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -680,22 +680,6 @@ static void keyspan_pda_dtr_rts(struct usb_serial_port *port, int on)
         }
 }
 
-static int keyspan_pda_carrier_raised(struct usb_serial_port *port)
-{
-        struct usb_serial *serial = port->serial;
-        unsigned char modembits;
-
-        /* If we can read the modem status and the DCD is low then
-           carrier is not raised yet */
-        if (keyspan_pda_get_modem_info(serial, &modembits) >= 0) {
-                if (!(modembits & (1>>6)))
-                        return 0;
-        }
-        /* Carrier raised, or we failed (eg disconnected) so
-           progress accordingly */
-        return 1;
-}
-
 
 static int keyspan_pda_open(struct tty_struct *tty,
                                         struct usb_serial_port *port)
@@ -882,7 +866,6 @@ static struct usb_serial_driver keyspan_pda_device = {
         .id_table =             id_table_std,
         .num_ports =            1,
         .dtr_rts =              keyspan_pda_dtr_rts,
-        .carrier_raised =       keyspan_pda_carrier_raised,
         .open =                 keyspan_pda_open,
         .close =                keyspan_pda_close,
         .write =                keyspan_pda_write,
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index 7aa01b95b1d4..2849f8c32015 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -549,9 +549,12 @@ static void mct_u232_close(struct usb_serial_port *port)
 {
         dbg("%s port %d", __func__, port->number);
 
-        usb_serial_generic_close(port);
-        if (port->serial->dev)
+        if (port->serial->dev) {
+                /* shutdown our urbs */
+                usb_kill_urb(port->write_urb);
+                usb_kill_urb(port->read_urb);
                 usb_kill_urb(port->interrupt_in_urb);
+        }
 } /* mct_u232_close */
 
 
diff --git a/drivers/usb/serial/moto_modem.c b/drivers/usb/serial/moto_modem.c
index cf1718394e18..653465f61d4a 100644
--- a/drivers/usb/serial/moto_modem.c
+++ b/drivers/usb/serial/moto_modem.c
@@ -44,6 +44,7 @@ static struct usb_serial_driver moto_device = {
                 .name =         "moto-modem",
         },
         .id_table =             id_table,
+        .usb_driver =           &moto_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index ed01f3b2de8c..9ff19c8a122e 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -96,8 +96,8 @@ static void opticon_bulk_callback(struct urb *urb)
                         /* real data, send it to the tty layer */
                         tty = tty_port_tty_get(&port->port);
                         if (tty) {
-                                tty_insert_flip_string(tty, data,
-                                                               data_length);
+                                tty_insert_flip_string(tty, data + 2,
+                                                       data_length);
                                 tty_flip_buffer_push(tty);
                                 tty_kref_put(tty);
                         }
@@ -130,7 +130,7 @@ exit:
                                                   priv->bulk_address),
                                   priv->bulk_in_buffer, priv->buffer_size,
                                   opticon_bulk_callback, priv);
-                result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+                result = usb_submit_urb(priv->bulk_read_urb, GFP_ATOMIC);
                 if (result)
                         dev_err(&port->dev,
                             "%s - failed resubmitting read urb, error %d\n",
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c46911af282f..0dbcf124689d 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -382,7 +382,16 @@ static void option_instat_callback(struct urb *urb);
 #define HAIER_VENDOR_ID                         0x201e
 #define HAIER_PRODUCT_CE100                     0x2009
 
-#define CINTERION_VENDOR_ID                     0x0681
+/* Cinterion (formerly Siemens) products */
+#define SIEMENS_VENDOR_ID                               0x0681
+#define CINTERION_VENDOR_ID                             0x1e2d
+#define CINTERION_PRODUCT_HC25_MDM              0x0047
+#define CINTERION_PRODUCT_HC25_MDMNET   0x0040
+#define CINTERION_PRODUCT_HC28_MDM              0x004C
+#define CINTERION_PRODUCT_HC28_MDMNET   0x004A /* same for HC28J */
+#define CINTERION_PRODUCT_EU3_E                 0x0051
+#define CINTERION_PRODUCT_EU3_P                 0x0052
+#define CINTERION_PRODUCT_PH8                   0x0053
 
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID                      0x0b3c
@@ -512,7 +521,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC, 0xff, 0xff, 0xff) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) },
@@ -622,6 +631,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0011, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff) },
@@ -633,38 +643,52 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0023, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) },
+        /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) }, */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0034, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0037, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0038, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0039, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0040, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0042, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0043, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0044, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0048, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0049, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0050, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff) },
+        /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0053, 0xff, 0xff, 0xff) }, */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0056, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0064, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0065, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0067, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0069, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0076, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0077, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0078, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0079, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0082, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0083, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0087, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) },
@@ -880,6 +904,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
@@ -922,7 +948,17 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) },
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
-        { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
+        /* Cinterion */
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
         { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
         { } /* Terminating entry */
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index e199b0f4f99c..1c46a863295b 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -157,6 +157,7 @@ static struct usb_serial_driver oti6858_device = {
                 .name =         "oti6858",
         },
         .id_table =             id_table,
+        .usb_driver =           &oti6858_driver,
         .num_ports =            1,
         .open =                 oti6858_open,
         .close =                oti6858_close,
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 8ae4c6cbc38a..08c9181b8e48 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -50,6 +50,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
@@ -677,9 +678,11 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
 {
 
         struct pl2303_private *priv = usb_get_serial_port_data(port);
+        struct tty_struct *tty;
         unsigned long flags;
         u8 status_idx = UART_STATE;
         u8 length = UART_STATE + 1;
+        u8 prev_line_status;
         u16 idv, idp;
 
         idv = le16_to_cpu(port->serial->dev->descriptor.idVendor);
@@ -701,11 +704,20 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
 
         /* Save off the uart status for others to look at */
         spin_lock_irqsave(&priv->lock, flags);
+        prev_line_status = priv->line_status;
         priv->line_status = data[status_idx];
         spin_unlock_irqrestore(&priv->lock, flags);
         if (priv->line_status & UART_BREAK_ERROR)
                 usb_serial_handle_break(port);
         wake_up_interruptible(&priv->delta_msr_wait);
+
+        tty = tty_port_tty_get(&port->port);
+        if (!tty)
+                return;
+        if ((priv->line_status ^ prev_line_status) & UART_DCD)
+                usb_serial_handle_dcd_change(port, tty,
+                                priv->line_status & UART_DCD);
+        tty_kref_put(tty);
 }
 
 static void pl2303_read_int_callback(struct urb *urb)
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 43eb9bdad422..1b025f75dafd 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -21,6 +21,7 @@
 #define PL2303_PRODUCT_ID_MMX           0x0612
 #define PL2303_PRODUCT_ID_GPRS          0x0609
 #define PL2303_PRODUCT_ID_HCR331        0x331a
+#define PL2303_PRODUCT_ID_MOTOROLA      0x0307
 
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
index 214a3e504292..30b73e68a904 100644
--- a/drivers/usb/serial/qcaux.c
+++ b/drivers/usb/serial/qcaux.c
@@ -36,6 +36,7 @@
 #define UTSTARCOM_PRODUCT_UM175_V1              0x3712
 #define UTSTARCOM_PRODUCT_UM175_V2              0x3714
 #define UTSTARCOM_PRODUCT_UM175_ALLTEL          0x3715
+#define PANTECH_PRODUCT_UML290_VZW              0x3718
 
 /* CMOTECH devices */
 #define CMOTECH_VENDOR_ID                       0x16d8
@@ -66,6 +67,7 @@ static struct usb_device_id id_table[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
@@ -84,6 +86,7 @@ static struct usb_serial_driver qcaux_device = {
                 .name =         "qcaux",
         },
         .id_table =             id_table,
+        .usb_driver =           &qcaux_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/siemens_mpi.c b/drivers/usb/serial/siemens_mpi.c
index cb8195cabfde..74cd4ccdb3fc 100644
--- a/drivers/usb/serial/siemens_mpi.c
+++ b/drivers/usb/serial/siemens_mpi.c
@@ -42,6 +42,7 @@ static struct usb_serial_driver siemens_usb_mpi_device = {
                 .name =         "siemens_mpi",
         },
         .id_table =             id_table,
+        .usb_driver =           &siemens_usb_mpi_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 329d311a35d9..f88bc511da65 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -133,7 +133,7 @@ struct spcp8x5_usb_ctrl_arg {
 
 /* how come ??? */
 #define UART_STATE                      0x08
-#define UART_STATE_TRANSIENT_MASK       0x74
+#define UART_STATE_TRANSIENT_MASK       0x75
 #define UART_DCD                        0x01
 #define UART_DSR                        0x02
 #define UART_BREAK_ERROR                0x04
@@ -526,6 +526,10 @@ static void spcp8x5_process_read_urb(struct urb *urb)
                 /* overrun is special, not associated with a char */
                 if (status & UART_OVERRUN_ERROR)
                         tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+
+                if (status & UART_DCD)
+                        usb_serial_handle_dcd_change(port, tty,
+                                   priv->line_status & MSR_STATUS_LINE_DCD);
         }
 
         tty_insert_flip_string_fixed_flag(tty, data, tty_flag,
@@ -646,6 +650,7 @@ static struct usb_serial_driver spcp8x5_device = {
                 .name =         "SPCP8x5",
         },
         .id_table               = id_table,
+        .usb_driver             = &spcp8x5_driver,
         .num_ports              = 1,
         .open                   = spcp8x5_open,
         .dtr_rts                = spcp8x5_dtr_rts,
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 90979a1f5311..c58ef5434733 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -365,9 +365,9 @@ failed_1port:
 
 static void __exit ti_exit(void)
 {
+        usb_deregister(&ti_usb_driver);
         usb_serial_deregister(&ti_1port_device);
         usb_serial_deregister(&ti_2port_device);
-        usb_deregister(&ti_usb_driver);
 }
 
 
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 7a2177c79bde..6afd8e848117 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -52,6 +52,7 @@ static struct usb_driver usb_serial_driver = {
         .suspend =      usb_serial_suspend,
         .resume =       usb_serial_resume,
         .no_dynamic_id =        1,
+        .supports_autosuspend = 1,
 };
 
 /* There is no MODULE_DEVICE_TABLE for usbserial.c.  Instead
@@ -1334,6 +1335,12 @@ int usb_serial_register(struct usb_serial_driver *driver)
 
         if (!driver->description)
                 driver->description = driver->driver.name;
+        if (!driver->usb_driver) {
+                WARN(1, "Serial driver %s has no usb_driver\n",
+                                driver->description);
+                return -EINVAL;
+        }
+        driver->usb_driver->supports_autosuspend = 1;
 
         /* Add this device to our list of devices */
         mutex_lock(&table_lock);
diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
index f2ed6a31be77..95a82148ee81 100644
--- a/drivers/usb/serial/usb_debug.c
+++ b/drivers/usb/serial/usb_debug.c
@@ -75,6 +75,7 @@ static struct usb_serial_driver debug_device = {
                 .name =         "debug",
         },
         .id_table =             id_table,
+        .usb_driver =           &debug_driver,
         .num_ports =            1,
         .bulk_out_size =        USB_DEBUG_MAX_PACKET_SIZE,
         .break_ctl =            usb_debug_break_ctl,
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index eb76aaef4268..15a5d89b7f39 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -606,6 +606,10 @@ static int treo_attach(struct usb_serial *serial)
 
 static int clie_5_attach(struct usb_serial *serial)
 {
+        struct usb_serial_port *port;
+        unsigned int pipe;
+        int j;
+
         dbg("%s", __func__);
 
         /* TH55 registers 2 ports.
@@ -621,9 +625,14 @@ static int clie_5_attach(struct usb_serial *serial)
                 return -1;
 
         /* port 0 now uses the modified endpoint Address */
-        serial->port[0]->bulk_out_endpointAddress =
+        port = serial->port[0];
+        port->bulk_out_endpointAddress =
                                 serial->port[1]->bulk_out_endpointAddress;
 
+        pipe = usb_sndbulkpipe(serial->dev, port->bulk_out_endpointAddress);
+        for (j = 0; j < ARRAY_SIZE(port->write_urbs); ++j)
+                port->write_urbs[j]->pipe = pipe;
+
         return 0;
 }
 
diff --git a/drivers/usb/storage/sierra_ms.c b/drivers/usb/storage/sierra_ms.c
index 57fc2f532cab..ceba512f84d0 100644
--- a/drivers/usb/storage/sierra_ms.c
+++ b/drivers/usb/storage/sierra_ms.c
@@ -121,7 +121,7 @@ static ssize_t show_truinst(struct device *dev, struct device_attribute *attr,
         }
         return result;
 }
-static DEVICE_ATTR(truinst, S_IWUGO | S_IRUGO, show_truinst, NULL);
+static DEVICE_ATTR(truinst, S_IRUGO, show_truinst, NULL);
 
 int sierra_ms_init(struct us_data *us)
 {
diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
index 44be6d75dab6..fba2824085b4 100644
--- a/drivers/usb/storage/unusual_cypress.h
+++ b/drivers/usb/storage/unusual_cypress.h
@@ -31,4 +31,9 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x9999,
                 "Cypress ISD-300LP",
                 US_SC_CYP_ATACB, US_PR_DEVICE, NULL, 0),
 
+UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999,
+                "Super Top",
+                "USB 2.0  SATA BRIDGE",
+                US_SC_CYP_ATACB, US_PR_DEVICE, NULL, 0),
+
 #endif /* defined(CONFIG_USB_STORAGE_CYPRESS_ATACB) || ... */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 2c897eefadde..b0c0a33910e8 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -481,6 +481,13 @@ UNUSUAL_DEV(  0x04e8, 0x507c, 0x0220, 0x0220,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_MAX_SECTORS_64),
 
+/* Reported by Vitaly Kuznetsov <vitty@altlinux.ru> */
+UNUSUAL_DEV(  0x04e8, 0x5122, 0x0000, 0x9999,
+                "Samsung",
+                "YP-CP3",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+
 /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
  * Device uses standards-violating 32-byte Bulk Command Block Wrappers and
  * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
@@ -1036,6 +1043,15 @@ UNUSUAL_DEV(  0x084d, 0x0011, 0x0110, 0x0110,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_BULK32),
 
+/* Reported by <ttkspam@free.fr>
+ * The device reports a vendor-specific device class, requiring an
+ * explicit vendor/product match.
+ */
+UNUSUAL_DEV(  0x0851, 0x1542, 0x0002, 0x0002,
+                "MagicPixel",
+                "FW_Omega2",
+                US_SC_DEVICE, US_PR_DEVICE, NULL, 0),
+
 /* Andrew Lunn <andrew@lunn.ch>
  * PanDigital Digital Picture Frame. Does not like ALLOW_MEDIUM_REMOVAL
  * on LUN 4.
@@ -1380,6 +1396,13 @@ UNUSUAL_DEV(  0x0f19, 0x0105, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* Submitted by Nick Holloway */
+UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0100,
+                "VTech",
+                "Kidizoom",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY ),
+
 /* Reported by Michael Stattmann <michael@stattmann.com> */
 UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
                 "Sony Ericsson",
@@ -1859,6 +1882,22 @@ UNUSUAL_DEV( 0x1908, 0x1320, 0x0000, 0x0000,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_BAD_SENSE ),
 
+/* Patch by Richard Schütz <r.schtz@t-online.de>
+ * This external hard drive enclosure uses a JMicron chip which
+ * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
+UNUSUAL_DEV(  0x1e68, 0x001b, 0x0000, 0x0000,
+                "TrekStor GmbH & Co. KG",
+                "DataStation maxi g.u",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
+/* Reported by Jasper Mackenzie <scarletpimpernal@hotmail.com> */
+UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0000,
+                "Coby Electronics",
+                "MP3 Player",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+
 UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
                 "ST",
                 "2A",
diff --git a/drivers/video/backlight/88pm860x_bl.c b/drivers/video/backlight/88pm860x_bl.c
index 38ffc3fbcbe4..c06c667e9ca9 100644
--- a/drivers/video/backlight/88pm860x_bl.c
+++ b/drivers/video/backlight/88pm860x_bl.c
@@ -21,7 +21,7 @@
 #define MAX_BRIGHTNESS          (0xFF)
 #define MIN_BRIGHTNESS          (0)
 
-#define CURRENT_MASK            (0x1F << 1)
+#define CURRENT_BITMASK         (0x1F << 1)
 
 struct pm860x_backlight_data {
         struct pm860x_chip *chip;
@@ -85,7 +85,7 @@ static int pm860x_backlight_set(struct backlight_device *bl, int brightness)
         if ((data->current_brightness == 0) && brightness) {
                 if (data->iset) {
                         ret = pm860x_set_bits(data->i2c, wled_idc(data->port),
-                                              CURRENT_MASK, data->iset);
+                                              CURRENT_BITMASK, data->iset);
                         if (ret < 0)
                                 goto out;
                 }
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index e207810bba3c..08703299ef61 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -197,12 +197,12 @@ static int backlight_suspend(struct device *dev, pm_message_t state)
 {
         struct backlight_device *bd = to_backlight_device(dev);
 
-        if (bd->ops->options & BL_CORE_SUSPENDRESUME) {
-                mutex_lock(&bd->ops_lock);
+        mutex_lock(&bd->ops_lock);
+        if (bd->ops && bd->ops->options & BL_CORE_SUSPENDRESUME) {
                 bd->props.state |= BL_CORE_SUSPENDED;
                 backlight_update_status(bd);
-                mutex_unlock(&bd->ops_lock);
         }
+        mutex_unlock(&bd->ops_lock);
 
         return 0;
 }
@@ -211,12 +211,12 @@ static int backlight_resume(struct device *dev)
 {
         struct backlight_device *bd = to_backlight_device(dev);
 
-        if (bd->ops->options & BL_CORE_SUSPENDRESUME) {
-                mutex_lock(&bd->ops_lock);
+        mutex_lock(&bd->ops_lock);
+        if (bd->ops && bd->ops->options & BL_CORE_SUSPENDRESUME) {
                 bd->props.state &= ~BL_CORE_SUSPENDED;
                 backlight_update_status(bd);
-                mutex_unlock(&bd->ops_lock);
         }
+        mutex_unlock(&bd->ops_lock);
 
         return 0;
 }
diff --git a/drivers/video/via/accel.c b/drivers/video/via/accel.c
index e44893ea590d..c2f4e6e166f1 100644
--- a/drivers/video/via/accel.c
+++ b/drivers/video/via/accel.c
@@ -283,11 +283,12 @@ static int hw_bitblt_2(void __iomem *engine, u8 op, u32 width, u32 height,
                 writel(tmp, engine + 0x1C);
         }
 
-        if (op != VIA_BITBLT_COLOR)
+        if (op == VIA_BITBLT_FILL) {
+                writel(fg_color, engine + 0x58);
+        } else if (op == VIA_BITBLT_MONO) {
                 writel(fg_color, engine + 0x4C);
-
-        if (op == VIA_BITBLT_MONO)
                 writel(bg_color, engine + 0x50);
+        }
 
         if (op == VIA_BITBLT_FILL)
                 ge_cmd |= fill_rop << 24 | 0x00002000 | 0x00000001;
diff --git a/drivers/video/via/via_i2c.c b/drivers/video/via/via_i2c.c
index da9e4ca94b17..021112e279de 100644
--- a/drivers/video/via/via_i2c.c
+++ b/drivers/video/via/via_i2c.c
@@ -114,6 +114,7 @@ static void via_i2c_setsda(void *data, int state)
 
 int viafb_i2c_readbyte(u8 adap, u8 slave_addr, u8 index, u8 *pdata)
 {
+        int ret;
         u8 mm1[] = {0x00};
         struct i2c_msg msgs[2];
 
@@ -126,11 +127,18 @@ int viafb_i2c_readbyte(u8 adap, u8 slave_addr, u8 index, u8 *pdata)
         mm1[0] = index;
         msgs[0].len = 1; msgs[1].len = 1;
         msgs[0].buf = mm1; msgs[1].buf = pdata;
-        return i2c_transfer(&via_i2c_par[adap].adapter, msgs, 2);
+        ret = i2c_transfer(&via_i2c_par[adap].adapter, msgs, 2);
+        if (ret == 2)
+                ret = 0;
+        else if (ret >= 0)
+                ret = -EIO;
+
+        return ret;
 }
 
 int viafb_i2c_writebyte(u8 adap, u8 slave_addr, u8 index, u8 data)
 {
+        int ret;
         u8 msg[2] = { index, data };
         struct i2c_msg msgs;
 
@@ -140,11 +148,18 @@ int viafb_i2c_writebyte(u8 adap, u8 slave_addr, u8 index, u8 data)
         msgs.addr = slave_addr / 2;
         msgs.len = 2;
         msgs.buf = msg;
-        return i2c_transfer(&via_i2c_par[adap].adapter, &msgs, 1);
+        ret = i2c_transfer(&via_i2c_par[adap].adapter, &msgs, 1);
+        if (ret == 1)
+                ret = 0;
+        else if (ret >= 0)
+                ret = -EIO;
+
+        return ret;
 }
 
 int viafb_i2c_readbytes(u8 adap, u8 slave_addr, u8 index, u8 *buff, int buff_len)
 {
+        int ret;
         u8 mm1[] = {0x00};
         struct i2c_msg msgs[2];
 
@@ -156,7 +171,13 @@ int viafb_i2c_readbytes(u8 adap, u8 slave_addr, u8 index, u8 *buff, int buff_len
         mm1[0] = index;
         msgs[0].len = 1; msgs[1].len = buff_len;
         msgs[0].buf = mm1; msgs[1].buf = buff;
-        return i2c_transfer(&via_i2c_par[adap].adapter, msgs, 2);
+        ret = i2c_transfer(&via_i2c_par[adap].adapter, msgs, 2);
+        if (ret == 2)
+                ret = 0;
+        else if (ret >= 0)
+                ret = -EIO;
+
+        return ret;
 }
 
 /*
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index ef8d9d558fc7..4fb5b2bf2348 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -96,11 +96,6 @@ static struct pci_device_id virtio_pci_id_table[] = {
 
 MODULE_DEVICE_TABLE(pci, virtio_pci_id_table);
 
-/* A PCI device has it's own struct device and so does a virtio device so
- * we create a place for the virtio devices to show up in sysfs.  I think it
- * would make more sense for virtio to not insist on having it's own device. */
-static struct device *virtio_pci_root;
-
 /* Convert a generic virtio device to our structure */
 static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
 {
@@ -629,7 +624,7 @@ static int __devinit virtio_pci_probe(struct pci_dev *pci_dev,
         if (vp_dev == NULL)
                 return -ENOMEM;
 
-        vp_dev->vdev.dev.parent = virtio_pci_root;
+        vp_dev->vdev.dev.parent = &pci_dev->dev;
         vp_dev->vdev.dev.release = virtio_pci_release_dev;
         vp_dev->vdev.config = &virtio_pci_config_ops;
         vp_dev->pci_dev = pci_dev;
@@ -717,17 +712,7 @@ static struct pci_driver virtio_pci_driver = {
 
 static int __init virtio_pci_init(void)
 {
-        int err;
-
-        virtio_pci_root = root_device_register("virtio-pci");
-        if (IS_ERR(virtio_pci_root))
-                return PTR_ERR(virtio_pci_root);
-
-        err = pci_register_driver(&virtio_pci_driver);
-        if (err)
-                root_device_unregister(virtio_pci_root);
-
-        return err;
+        return pci_register_driver(&virtio_pci_driver);
 }
 
 module_init(virtio_pci_init);
@@ -735,7 +720,6 @@ module_init(virtio_pci_init);
 static void __exit virtio_pci_exit(void)
 {
         pci_unregister_driver(&virtio_pci_driver);
-        root_device_unregister(virtio_pci_root);
 }
 
 module_exit(virtio_pci_exit);
diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
index 428f8a1583e8..3939e53f5f98 100644
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -231,7 +231,7 @@ static int __devinit rdc321x_wdt_probe(struct platform_device *pdev)
         struct resource *r;
         struct rdc321x_wdt_pdata *pdata;
 
-        pdata = pdev->dev.platform_data;
+        pdata = platform_get_drvdata(pdev);
         if (!pdata) {
                 dev_err(&pdev->dev, "no platform data supplied\n");
                 return -ENODEV;
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 13365ba35218..a68cc62574ed 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -261,7 +261,7 @@ static void init_evtchn_cpu_bindings(void)
         }
 #endif
 
-        memset(cpu_evtchn_mask(0), ~0, sizeof(cpu_evtchn_mask(0)));
+        memset(cpu_evtchn_mask(0), ~0, sizeof(struct cpu_evtchn_s));
 }
 
 static inline void clear_evtchn(int port)
diff --git a/fs/bio.c b/fs/bio.c
index 8abb2dfb2e7c..4bd454fa844e 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -370,6 +370,9 @@ struct bio *bio_kmalloc(gfp_t gfp_mask, int nr_iovecs)
 {
         struct bio *bio;
 
+        if (nr_iovecs > UIO_MAXIOV)
+                return NULL;
+
         bio = kmalloc(sizeof(struct bio) + nr_iovecs * sizeof(struct bio_vec),
                       gfp_mask);
         if (unlikely(!bio))
@@ -697,8 +700,12 @@ static void bio_free_map_data(struct bio_map_data *bmd)
 static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count,
                                                gfp_t gfp_mask)
 {
-        struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask);
+        struct bio_map_data *bmd;
 
+        if (iov_count > UIO_MAXIOV)
+                return NULL;
+
+        bmd = kmalloc(sizeof(*bmd), gfp_mask);
         if (!bmd)
                 return NULL;
 
@@ -827,6 +834,12 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
                 end = (uaddr + iov[i].iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT;
                 start = uaddr >> PAGE_SHIFT;
 
+                /*
+                 * Overflow, abort
+                 */
+                if (end < start)
+                        return ERR_PTR(-EINVAL);
+
                 nr_pages += end - start;
                 len += iov[i].iov_len;
         }
@@ -955,6 +968,12 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
                 unsigned long end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
                 unsigned long start = uaddr >> PAGE_SHIFT;
 
+                /*
+                 * Overflow, abort
+                 */
+                if (end < start)
+                        return ERR_PTR(-EINVAL);
+
                 nr_pages += end - start;
                 /*
                  * buffer must be aligned to at least hardsector size for now
@@ -982,7 +1001,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
                 unsigned long start = uaddr >> PAGE_SHIFT;
                 const int local_nr_pages = end - start;
                 const int page_limit = cur_page + local_nr_pages;
-                
+
                 ret = get_user_pages_fast(uaddr, local_nr_pages,
                                 write_to_vm, &pages[cur_page]);
                 if (ret < local_nr_pages) {
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 1d60c655e3e0..f110e0e7e947 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -107,7 +107,8 @@ extern struct timespec cnvrtDosUnixTm(__le16 le_date, __le16 le_time,
 
 extern struct cifsFileInfo *cifs_new_fileinfo(struct inode *newinode,
                                 __u16 fileHandle, struct file *file,
-                                struct vfsmount *mnt, unsigned int oflags);
+                                struct vfsmount *mnt, unsigned int oflags,
+                                __u32 oplock);
 extern int cifs_posix_open(char *full_path, struct inode **pinode,
                                 struct super_block *sb,
                                 int mode, int oflags,
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index f9ed0751cc12..0f947bf73f8e 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -132,9 +132,9 @@ cifs_bp_rename_retry:
 
 struct cifsFileInfo *
 cifs_new_fileinfo(struct inode *newinode, __u16 fileHandle,
-                  struct file *file, struct vfsmount *mnt, unsigned int oflags)
+                  struct file *file, struct vfsmount *mnt, unsigned int oflags,
+                  __u32 oplock)
 {
-        int oplock = 0;
         struct cifsFileInfo *pCifsFile;
         struct cifsInodeInfo *pCifsInode;
         struct cifs_sb_info *cifs_sb = CIFS_SB(mnt->mnt_sb);
@@ -143,9 +143,6 @@ cifs_new_fileinfo(struct inode *newinode, __u16 fileHandle,
         if (pCifsFile == NULL)
                 return pCifsFile;
 
-        if (oplockEnabled)
-                oplock = REQ_OPLOCK;
-
         pCifsFile->netfid = fileHandle;
         pCifsFile->pid = current->tgid;
         pCifsFile->pInode = igrab(newinode);
@@ -468,7 +465,7 @@ cifs_create_set_dentry:
                 }
 
                 pfile_info = cifs_new_fileinfo(newinode, fileHandle, filp,
-                                               nd->path.mnt, oflags);
+                                               nd->path.mnt, oflags, oplock);
                 if (pfile_info == NULL) {
                         fput(filp);
                         CIFSSMBClose(xid, tcon, fileHandle);
@@ -729,7 +726,8 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
 
                         cfile = cifs_new_fileinfo(newInode, fileHandle, filp,
                                                   nd->path.mnt,
-                                                  nd->intent.open.flags);
+                                                  nd->intent.open.flags,
+                                                  oplock);
                         if (cfile == NULL) {
                                 fput(filp);
                                 CIFSSMBClose(xid, pTcon, fileHandle);
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 0eb87026cad3..548f06230a6d 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -66,7 +66,7 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
         /* Search for server name delimiter */
         sep = memchr(hostname, '\\', len);
         if (sep)
-                len = sep - unc;
+                len = sep - hostname;
         else
                 cFYI(1, "%s: probably server name is whole unc: %s",
                      __func__, unc);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index de748c652d11..681761c3e90c 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -277,7 +277,7 @@ int cifs_open(struct inode *inode, struct file *file)
 
                         pCifsFile = cifs_new_fileinfo(inode, netfid, file,
                                                         file->f_path.mnt,
-                                                        oflags);
+                                                        oflags, oplock);
                         if (pCifsFile == NULL) {
                                 CIFSSMBClose(xid, tcon, netfid);
                                 rc = -ENOMEM;
@@ -370,7 +370,7 @@ int cifs_open(struct inode *inode, struct file *file)
                 goto out;
 
         pCifsFile = cifs_new_fileinfo(inode, netfid, file, file->f_path.mnt,
-                                        file->f_flags);
+                                        file->f_flags, oplock);
         if (pCifsFile == NULL) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 53cce8cc2224..00d1ff339ae6 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -835,8 +835,10 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino)
                 rc = cifs_get_inode_info(&inode, full_path, NULL, sb,
                                                 xid, NULL);
 
-        if (!inode)
-                return ERR_PTR(rc);
+        if (!inode) {
+                inode = ERR_PTR(rc);
+                goto out;
+        }
 
 #ifdef CONFIG_CIFS_FSCACHE
         /* populate tcon->resource_id */
@@ -852,13 +854,11 @@ struct inode *cifs_root_iget(struct super_block *sb, unsigned long ino)
                 inode->i_uid = cifs_sb->mnt_uid;
                 inode->i_gid = cifs_sb->mnt_gid;
         } else if (rc) {
-                kfree(full_path);
-                _FreeXid(xid);
                 iget_failed(inode);
-                return ERR_PTR(rc);
+                inode = ERR_PTR(rc);
         }
 
-
+out:
         kfree(full_path);
         /* can not call macro FreeXid here since in a void func
          * TODO: This is no longer true
diff --git a/fs/compat.c b/fs/compat.c
index 0644a154672b..8b41dcdcdc67 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1378,6 +1378,10 @@ static int compat_count(compat_uptr_t __user *argv, int max)
                         argv++;
                         if (i++ >= max)
                                 return -E2BIG;
+
+                        if (fatal_signal_pending(current))
+                                return -ERESTARTNOHAND;
+                        cond_resched();
                 }
         }
         return i;
@@ -1419,6 +1423,12 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
                 while (len > 0) {
                         int offset, bytes_to_copy;
 
+                        if (fatal_signal_pending(current)) {
+                                ret = -ERESTARTNOHAND;
+                                goto out;
+                        }
+                        cond_resched();
+
                         offset = pos % PAGE_SIZE;
                         if (offset == 0)
                                 offset = PAGE_SIZE;
@@ -1435,18 +1445,8 @@ static int compat_copy_strings(int argc, compat_uptr_t __user *argv,
                         if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
                                 struct page *page;
 
-#ifdef CONFIG_STACK_GROWSUP
-                                ret = expand_stack_downwards(bprm->vma, pos);
-                                if (ret < 0) {
-                                        /* We've exceed the stack rlimit. */
-                                        ret = -E2BIG;
-                                        goto out;
-                                }
-#endif
-                                ret = get_user_pages(current, bprm->mm, pos,
-                                                     1, 1, 1, &page, NULL);
-                                if (ret <= 0) {
-                                        /* We've exceed the stack rlimit. */
+                                page = get_arg_page(bprm, pos, 1);
+                                if (!page) {
                                         ret = -E2BIG;
                                         goto out;
                                 }
@@ -1567,8 +1567,10 @@ int compat_do_execve(char * filename,
         return retval;
 
 out:
-        if (bprm->mm)
+        if (bprm->mm) {
+                acct_arg_size(bprm, 0);
                 mmput(bprm->mm);
+        }
 
 out_file:
         if (bprm->file) {
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 48d74c7391d1..92030e371a94 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -325,12 +325,16 @@ void dio_end_io(struct bio *bio, int error)
 }
 EXPORT_SYMBOL_GPL(dio_end_io);
 
-static int
+static void
 dio_bio_alloc(struct dio *dio, struct block_device *bdev,
                 sector_t first_sector, int nr_vecs)
 {
         struct bio *bio;
 
+        /*
+         * bio_alloc() is guaranteed to return a bio when called with
+         * __GFP_WAIT and we request a valid number of vectors.
+         */
         bio = bio_alloc(GFP_KERNEL, nr_vecs);
 
         bio->bi_bdev = bdev;
@@ -342,7 +346,6 @@ dio_bio_alloc(struct dio *dio, struct block_device *bdev,
 
         dio->bio = bio;
         dio->logical_offset_in_bio = dio->cur_page_fs_offset;
-        return 0;
 }
 
 /*
@@ -583,8 +586,9 @@ static int dio_new_bio(struct dio *dio, sector_t start_sector)
                 goto out;
         sector = start_sector << (dio->blkbits - 9);
         nr_pages = min(dio->pages_in_io, bio_get_nr_vecs(dio->map_bh.b_bdev));
+        nr_pages = min(nr_pages, BIO_MAX_PAGES);
         BUG_ON(nr_pages <= 0);
-        ret = dio_bio_alloc(dio, dio->map_bh.b_bdev, sector, nr_pages);
+        dio_bio_alloc(dio, dio->map_bh.b_bdev, sector, nr_pages);
         dio->boundary = 0;
 out:
         return ret;
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 3fbc94203380..9d1a22d62765 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -32,6 +32,7 @@
 #include <linux/crypto.h>
 #include <linux/fs_stack.h>
 #include <linux/slab.h>
+#include <linux/xattr.h>
 #include <asm/unaligned.h>
 #include "ecryptfs_kernel.h"
 
@@ -70,15 +71,19 @@ ecryptfs_create_underlying_file(struct inode *lower_dir_inode,
         struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
         struct dentry *dentry_save;
         struct vfsmount *vfsmount_save;
+        unsigned int flags_save;
         int rc;
 
         dentry_save = nd->path.dentry;
         vfsmount_save = nd->path.mnt;
+        flags_save = nd->flags;
         nd->path.dentry = lower_dentry;
         nd->path.mnt = lower_mnt;
+        nd->flags &= ~LOOKUP_OPEN;
         rc = vfs_create(lower_dir_inode, lower_dentry, mode, nd);
         nd->path.dentry = dentry_save;
         nd->path.mnt = vfsmount_save;
+        nd->flags = flags_save;
         return rc;
 }
 
@@ -1108,10 +1113,8 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
                 rc = -EOPNOTSUPP;
                 goto out;
         }
-        mutex_lock(&lower_dentry->d_inode->i_mutex);
-        rc = lower_dentry->d_inode->i_op->setxattr(lower_dentry, name, value,
-                                                   size, flags);
-        mutex_unlock(&lower_dentry->d_inode->i_mutex);
+
+        rc = vfs_setxattr(lower_dentry, name, value, size, flags);
 out:
         return rc;
 }
diff --git a/fs/exec.c b/fs/exec.c
index 56536ad0e7cc..4b8f716b786d 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -159,7 +159,26 @@ out:
 
 #ifdef CONFIG_MMU
 
-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
+{
+        struct mm_struct *mm = current->mm;
+        long diff = (long)(pages - bprm->vma_pages);
+
+        if (!mm || !diff)
+                return;
+
+        bprm->vma_pages = pages;
+
+#ifdef SPLIT_RSS_COUNTING
+        add_mm_counter(mm, MM_ANONPAGES, diff);
+#else
+        spin_lock(&mm->page_table_lock);
+        add_mm_counter(mm, MM_ANONPAGES, diff);
+        spin_unlock(&mm->page_table_lock);
+#endif
+}
+
+struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                 int write)
 {
         struct page *page;
@@ -181,6 +200,8 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                 unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
                 struct rlimit *rlim;
 
+                acct_arg_size(bprm, size / PAGE_SIZE);
+
                 /*
                  * We've historically supported up to 32 pages (ARG_MAX)
                  * of argument strings even with small stacks
@@ -249,6 +270,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
         vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
         vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
         INIT_LIST_HEAD(&vma->anon_vma_chain);
+
+        err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
+        if (err)
+                goto err;
+
         err = insert_vm_struct(mm, vma);
         if (err)
                 goto err;
@@ -271,7 +297,11 @@ static bool valid_arg_len(struct linux_binprm *bprm, long len)
 
 #else
 
-static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+void acct_arg_size(struct linux_binprm *bprm, unsigned long pages)
+{
+}
+
+struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                 int write)
 {
         struct page *page;
@@ -994,6 +1024,7 @@ int flush_old_exec(struct linux_binprm * bprm)
         /*
          * Release all of the old mmap stuff
          */
+        acct_arg_size(bprm, 0);
         retval = exec_mmap(bprm->mm);
         if (retval)
                 goto out;
@@ -1419,8 +1450,10 @@ int do_execve(const char * filename,
         return retval;
 
 out:
-        if (bprm->mm)
-                mmput (bprm->mm);
+        if (bprm->mm) {
+                acct_arg_size(bprm, 0);
+                mmput(bprm->mm);
+        }
 
 out_file:
         if (bprm->file) {
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 4b8debeb3965..8705e36f32d6 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4530,6 +4530,7 @@ static void ext4_free_branches(handle_t *handle, struct inode *inode,
                                         (__le32 *) bh->b_data,
                                         (__le32 *) bh->b_data + addr_per_block,
                                         depth);
+                        brelse(bh);
 
                         /*
                          * Everything below this this pointer has been
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 26147746c272..751997d2cefe 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -719,6 +719,7 @@ static void ext4_put_super(struct super_block *sb)
                         ext4_abort(sb, "Couldn't clean up the journal");
         }
 
+        del_timer(&sbi->s_err_report);
         ext4_release_system_zone(sb);
         ext4_mb_release(sb);
         ext4_ext_release(sb);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c8224587123f..6c2717d421e8 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/module.h>
+#include <linux/compat.h>
 
 static const struct file_operations fuse_direct_io_file_operations;
 
@@ -134,6 +135,7 @@ EXPORT_SYMBOL_GPL(fuse_do_open);
 void fuse_finish_open(struct inode *inode, struct file *file)
 {
         struct fuse_file *ff = file->private_data;
+        struct fuse_conn *fc = get_fuse_conn(inode);
 
         if (ff->open_flags & FOPEN_DIRECT_IO)
                 file->f_op = &fuse_direct_io_file_operations;
@@ -141,6 +143,15 @@ void fuse_finish_open(struct inode *inode, struct file *file)
                 invalidate_inode_pages2(inode->i_mapping);
         if (ff->open_flags & FOPEN_NONSEEKABLE)
                 nonseekable_open(inode, file);
+        if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
+                struct fuse_inode *fi = get_fuse_inode(inode);
+
+                spin_lock(&fc->lock);
+                fi->attr_version = ++fc->attr_version;
+                i_size_write(inode, 0);
+                spin_unlock(&fc->lock);
+                fuse_invalidate_attr(inode);
+        }
 }
 
 int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
@@ -1617,6 +1628,58 @@ static int fuse_ioctl_copy_user(struct page **pages, struct iovec *iov,
         return 0;
 }
 
+/* Make sure iov_length() won't overflow */
+static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
+{
+        size_t n;
+        u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
+
+        for (n = 0; n < count; n++) {
+                if (iov->iov_len > (size_t) max)
+                        return -ENOMEM;
+                max -= iov->iov_len;
+        }
+        return 0;
+}
+
+/*
+ * CUSE servers compiled on 32bit broke on 64bit kernels because the
+ * ABI was defined to be 'struct iovec' which is different on 32bit
+ * and 64bit.  Fortunately we can determine which structure the server
+ * used from the size of the reply.
+ */
+static int fuse_copy_ioctl_iovec(struct iovec *dst, void *src,
+                                 size_t transferred, unsigned count,
+                                 bool is_compat)
+{
+#ifdef CONFIG_COMPAT
+        if (count * sizeof(struct compat_iovec) == transferred) {
+                struct compat_iovec *ciov = src;
+                unsigned i;
+
+                /*
+                 * With this interface a 32bit server cannot support
+                 * non-compat (i.e. ones coming from 64bit apps) ioctl
+                 * requests
+                 */
+                if (!is_compat)
+                        return -EINVAL;
+
+                for (i = 0; i < count; i++) {
+                        dst[i].iov_base = compat_ptr(ciov[i].iov_base);
+                        dst[i].iov_len = ciov[i].iov_len;
+                }
+                return 0;
+        }
+#endif
+
+        if (count * sizeof(struct iovec) != transferred)
+                return -EIO;
+
+        memcpy(dst, src, transferred);
+        return 0;
+}
+
 /*
  * For ioctls, there is no generic way to determine how much memory
  * needs to be read and/or written.  Furthermore, ioctls are allowed
@@ -1798,18 +1861,25 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
                     in_iovs + out_iovs > FUSE_IOCTL_MAX_IOV)
                         goto out;
 
-                err = -EIO;
-                if ((in_iovs + out_iovs) * sizeof(struct iovec) != transferred)
-                        goto out;
-
-                /* okay, copy in iovs and retry */
                 vaddr = kmap_atomic(pages[0], KM_USER0);
-                memcpy(page_address(iov_page), vaddr, transferred);
+                err = fuse_copy_ioctl_iovec(page_address(iov_page), vaddr,
+                                            transferred, in_iovs + out_iovs,
+                                            (flags & FUSE_IOCTL_COMPAT) != 0);
                 kunmap_atomic(vaddr, KM_USER0);
+                if (err)
+                        goto out;
 
                 in_iov = page_address(iov_page);
                 out_iov = in_iov + in_iovs;
 
+                err = fuse_verify_ioctl_iov(in_iov, in_iovs);
+                if (err)
+                        goto out;
+
+                err = fuse_verify_ioctl_iov(out_iov, out_iovs);
+                if (err)
+                        goto out;
+
                 goto retry;
         }
 
diff --git a/fs/hostfs/hostfs.h b/fs/hostfs/hostfs.h
index 6bbd75c5589b..3ccb4e45b8dc 100644
--- a/fs/hostfs/hostfs.h
+++ b/fs/hostfs/hostfs.h
@@ -96,7 +96,6 @@ extern int rename_file(char *from, char *to);
 extern int do_statfs(char *root, long *bsize_out, long long *blocks_out,
                      long long *bfree_out, long long *bavail_out,
                      long long *files_out, long long *ffree_out,
-                     void *fsid_out, int fsid_size, long *namelen_out,
-                     long *spare_out);
+                     void *fsid_out, int fsid_size, long *namelen_out);
 
 #endif
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index f7dc9b5f9ef8..cd7c93917cc7 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -217,7 +217,7 @@ int hostfs_statfs(struct dentry *dentry, struct kstatfs *sf)
         err = do_statfs(dentry->d_sb->s_fs_info,
                         &sf->f_bsize, &f_blocks, &f_bfree, &f_bavail, &f_files,
                         &f_ffree, &sf->f_fsid, sizeof(sf->f_fsid),
-                        &sf->f_namelen, sf->f_spare);
+                        &sf->f_namelen);
         if (err)
                 return err;
         sf->f_blocks = f_blocks;
diff --git a/fs/hostfs/hostfs_user.c b/fs/hostfs/hostfs_user.c
index 6777aa06ce2c..8d02683585e0 100644
--- a/fs/hostfs/hostfs_user.c
+++ b/fs/hostfs/hostfs_user.c
@@ -364,8 +364,7 @@ int rename_file(char *from, char *to)
 int do_statfs(char *root, long *bsize_out, long long *blocks_out,
               long long *bfree_out, long long *bavail_out,
               long long *files_out, long long *ffree_out,
-              void *fsid_out, int fsid_size, long *namelen_out,
-              long *spare_out)
+              void *fsid_out, int fsid_size, long *namelen_out)
 {
         struct statfs64 buf;
         int err;
@@ -384,10 +383,6 @@ int do_statfs(char *root, long *bsize_out, long long *blocks_out,
                sizeof(buf.f_fsid) > fsid_size ? fsid_size :
                sizeof(buf.f_fsid));
         *namelen_out = buf.f_namelen;
-        spare_out[0] = buf.f_spare[0];
-        spare_out[1] = buf.f_spare[1];
-        spare_out[2] = buf.f_spare[2];
-        spare_out[3] = buf.f_spare[3];
-        spare_out[4] = buf.f_spare[4];
+
         return 0;
 }
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index b9c3c43cea1d..98e8e35c4408 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -24,8 +24,6 @@
 
 static void nfs_do_free_delegation(struct nfs_delegation *delegation)
 {
-        if (delegation->cred)
-                put_rpccred(delegation->cred);
         kfree(delegation);
 }
 
@@ -38,6 +36,10 @@ static void nfs_free_delegation_callback(struct rcu_head *head)
 
 static void nfs_free_delegation(struct nfs_delegation *delegation)
 {
+        if (delegation->cred) {
+                put_rpccred(delegation->cred);
+                delegation->cred = NULL;
+        }
         call_rcu(&delegation->rcu, nfs_free_delegation_callback);
 }
 
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 064a80961677..e0e9d49773bd 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -407,15 +407,18 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
                 pos += vec->iov_len;
         }
 
+        /*
+         * If no bytes were started, return the error, and let the
+         * generic layer handle the completion.
+         */
+        if (requested_bytes == 0) {
+                nfs_direct_req_release(dreq);
+                return result < 0 ? result : -EIO;
+        }
+
         if (put_dreq(dreq))
                 nfs_direct_complete(dreq);
-
-        if (requested_bytes != 0)
-                return 0;
-
-        if (result < 0)
-                return result;
-        return -EIO;
+        return 0;
 }
 
 static ssize_t nfs_direct_read(struct kiocb *iocb, const struct iovec *iov,
@@ -841,15 +844,18 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
                 pos += vec->iov_len;
         }
 
+        /*
+         * If no bytes were started, return the error, and let the
+         * generic layer handle the completion.
+         */
+        if (requested_bytes == 0) {
+                nfs_direct_req_release(dreq);
+                return result < 0 ? result : -EIO;
+        }
+
         if (put_dreq(dreq))
                 nfs_direct_write_complete(dreq, dreq->inode);
-
-        if (requested_bytes != 0)
-                return 0;
-
-        if (result < 0)
-                return result;
-        return -EIO;
+        return 0;
 }
 
 static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
@@ -873,7 +879,7 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
         dreq->inode = inode;
         dreq->ctx = get_nfs_open_context(nfs_file_open_context(iocb->ki_filp));
         dreq->l_ctx = nfs_get_lock_context(dreq->ctx);
-        if (dreq->l_ctx != NULL)
+        if (dreq->l_ctx == NULL)
                 goto out_release;
         if (!is_sync_kiocb(iocb))
                 dreq->iocb = iocb;
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 05bf3c0dc751..22a185b328ef 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -551,7 +551,7 @@ static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         struct file *filp = vma->vm_file;
         struct dentry *dentry = filp->f_path.dentry;
         unsigned pagelen;
-        int ret = -EINVAL;
+        int ret = VM_FAULT_NOPAGE;
         struct address_space *mapping;
 
         dfprintk(PAGECACHE, "NFS: vm_page_mkwrite(%s/%s(%ld), offset %lld)\n",
@@ -567,21 +567,20 @@ static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         if (mapping != dentry->d_inode->i_mapping)
                 goto out_unlock;
 
-        ret = 0;
         pagelen = nfs_page_length(page);
         if (pagelen == 0)
                 goto out_unlock;
 
-        ret = nfs_flush_incompatible(filp, page);
-        if (ret != 0)
-                goto out_unlock;
+        ret = VM_FAULT_LOCKED;
+        if (nfs_flush_incompatible(filp, page) == 0 &&
+            nfs_updatepage(filp, page, 0, pagelen) == 0)
+                goto out;
 
-        ret = nfs_updatepage(filp, page, 0, pagelen);
+        ret = VM_FAULT_SIGBUS;
 out_unlock:
-        if (!ret)
-                return VM_FAULT_LOCKED;
         unlock_page(page);
-        return VM_FAULT_SIGBUS;
+out:
+        return ret;
 }
 
 static const struct vm_operations_struct nfs_file_vm_ops = {
@@ -688,6 +687,7 @@ static int do_getlk(struct file *filp, int cmd, struct file_lock *fl)
 {
         struct inode *inode = filp->f_mapping->host;
         int status = 0;
+        unsigned int saved_type = fl->fl_type;
 
         /* Try local locking first */
         posix_test_lock(filp, fl);
@@ -695,6 +695,7 @@ static int do_getlk(struct file *filp, int cmd, struct file_lock *fl)
                 /* found a conflict */
                 goto out;
         }
+        fl->fl_type = saved_type;
 
         if (nfs_have_delegation(inode, FMODE_READ))
                 goto out_noconflict;
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 59047f8d7d72..3dde50c093b5 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -503,13 +503,13 @@ static struct rpc_procinfo mnt3_procedures[] = {
 
 static struct rpc_version mnt_version1 = {
         .number         = 1,
-        .nrprocs        = 2,
+        .nrprocs        = ARRAY_SIZE(mnt_procedures),
         .procs          = mnt_procedures,
 };
 
 static struct rpc_version mnt_version3 = {
         .number         = 3,
-        .nrprocs        = 2,
+        .nrprocs        = ARRAY_SIZE(mnt3_procedures),
         .procs          = mnt3_procedures,
 };
 
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 089da5b5d20a..74aa54e1712e 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -255,9 +255,6 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                         nfs4_state_mark_reclaim_nograce(clp, state);
                         goto do_state_recovery;
                 case -NFS4ERR_STALE_STATEID:
-                        if (state == NULL)
-                                break;
-                        nfs4_state_mark_reclaim_reboot(clp, state);
                 case -NFS4ERR_STALE_CLIENTID:
                 case -NFS4ERR_EXPIRED:
                         goto do_state_recovery;
@@ -1120,6 +1117,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
         clear_bit(NFS_DELEGATED_STATE, &state->flags);
         smp_rmb();
         if (state->n_rdwr != 0) {
+                clear_bit(NFS_O_RDWR_STATE, &state->flags);
                 ret = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE, &newstate);
                 if (ret != 0)
                         return ret;
@@ -1127,6 +1125,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
                         return -ESTALE;
         }
         if (state->n_wronly != 0) {
+                clear_bit(NFS_O_WRONLY_STATE, &state->flags);
                 ret = nfs4_open_recover_helper(opendata, FMODE_WRITE, &newstate);
                 if (ret != 0)
                         return ret;
@@ -1134,6 +1133,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
                         return -ESTALE;
         }
         if (state->n_rdonly != 0) {
+                clear_bit(NFS_O_RDONLY_STATE, &state->flags);
                 ret = nfs4_open_recover_helper(opendata, FMODE_READ, &newstate);
                 if (ret != 0)
                         return ret;
@@ -3490,9 +3490,6 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                         nfs4_state_mark_reclaim_nograce(clp, state);
                         goto do_state_recovery;
                 case -NFS4ERR_STALE_STATEID:
-                        if (state == NULL)
-                                break;
-                        nfs4_state_mark_reclaim_reboot(clp, state);
                 case -NFS4ERR_STALE_CLIENTID:
                 case -NFS4ERR_EXPIRED:
                         goto do_state_recovery;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 3e2f19b04c06..940cf7c070af 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1138,16 +1138,14 @@ static void nfs4_reclaim_complete(struct nfs_client *clp,
                 (void)ops->reclaim_complete(clp);
 }
 
-static void nfs4_state_end_reclaim_reboot(struct nfs_client *clp)
+static int nfs4_state_clear_reclaim_reboot(struct nfs_client *clp)
 {
         struct nfs4_state_owner *sp;
         struct rb_node *pos;
         struct nfs4_state *state;
 
         if (!test_and_clear_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state))
-                return;
-
-        nfs4_reclaim_complete(clp, clp->cl_mvops->reboot_recovery_ops);
+                return 0;
 
         for (pos = rb_first(&clp->cl_state_owners); pos != NULL; pos = rb_next(pos)) {
                 sp = rb_entry(pos, struct nfs4_state_owner, so_client_node);
@@ -1161,6 +1159,14 @@ static void nfs4_state_end_reclaim_reboot(struct nfs_client *clp)
         }
 
         nfs_delegation_reap_unclaimed(clp);
+        return 1;
+}
+
+static void nfs4_state_end_reclaim_reboot(struct nfs_client *clp)
+{
+        if (!nfs4_state_clear_reclaim_reboot(clp))
+                return;
+        nfs4_reclaim_complete(clp, clp->cl_mvops->reboot_recovery_ops);
 }
 
 static void nfs_delegation_clear_all(struct nfs_client *clp)
@@ -1187,7 +1193,7 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
                 case -NFS4ERR_STALE_CLIENTID:
                 case -NFS4ERR_LEASE_MOVED:
                         set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
-                        nfs4_state_end_reclaim_reboot(clp);
+                        nfs4_state_clear_reclaim_reboot(clp);
                         nfs4_state_start_reclaim_reboot(clp);
                         break;
                 case -NFS4ERR_EXPIRED:
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 919490232e17..137b549e63db 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -65,6 +65,13 @@ nfs_create_request(struct nfs_open_context *ctx, struct inode *inode,
         if (req == NULL)
                 return ERR_PTR(-ENOMEM);
 
+        /* get lock context early so we can deal with alloc failures */
+        req->wb_lock_context = nfs_get_lock_context(ctx);
+        if (req->wb_lock_context == NULL) {
+                nfs_page_free(req);
+                return ERR_PTR(-ENOMEM);
+        }
+
         /* Initialize the request struct. Initially, we assume a
          * long write-back delay. This will be adjusted in
          * update_nfs_request below if the region is not locked. */
@@ -79,7 +86,6 @@ nfs_create_request(struct nfs_open_context *ctx, struct inode *inode,
         req->wb_pgbase  = offset;
         req->wb_bytes   = count;
         req->wb_context = get_nfs_open_context(ctx);
-        req->wb_lock_context = nfs_get_lock_context(ctx);
         kref_init(&req->wb_kref);
         return req;
 }
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 2a533a0af2a9..7e84a852cdae 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -260,9 +260,11 @@ void fill_post_wcc(struct svc_fh *fhp)
         err = vfs_getattr(fhp->fh_export->ex_path.mnt, fhp->fh_dentry,
                         &fhp->fh_post_attr);
         fhp->fh_post_change = fhp->fh_dentry->d_inode->i_version;
-        if (err)
+        if (err) {
                 fhp->fh_post_saved = 0;
-        else
+                /* Grab the ctime anyway - set_change_info might use it */
+                fhp->fh_post_attr.ctime = fhp->fh_dentry->d_inode->i_ctime;
+        } else
                 fhp->fh_post_saved = 1;
 }
 
diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h
index 4d476ff08ae6..60fce3dc5cb5 100644
--- a/fs/nfsd/xdr4.h
+++ b/fs/nfsd/xdr4.h
@@ -484,18 +484,17 @@ static inline bool nfsd4_not_cached(struct nfsd4_compoundres *resp)
 static inline void
 set_change_info(struct nfsd4_change_info *cinfo, struct svc_fh *fhp)
 {
-        BUG_ON(!fhp->fh_pre_saved || !fhp->fh_post_saved);
-        cinfo->atomic = 1;
+        BUG_ON(!fhp->fh_pre_saved);
+        cinfo->atomic = fhp->fh_post_saved;
         cinfo->change_supported = IS_I_VERSION(fhp->fh_dentry->d_inode);
-        if (cinfo->change_supported) {
-                cinfo->before_change = fhp->fh_pre_change;
-                cinfo->after_change = fhp->fh_post_change;
-        } else {
-                cinfo->before_ctime_sec = fhp->fh_pre_ctime.tv_sec;
-                cinfo->before_ctime_nsec = fhp->fh_pre_ctime.tv_nsec;
-                cinfo->after_ctime_sec = fhp->fh_post_attr.ctime.tv_sec;
-                cinfo->after_ctime_nsec = fhp->fh_post_attr.ctime.tv_nsec;
-        }
+
+        cinfo->before_change = fhp->fh_pre_change;
+        cinfo->after_change = fhp->fh_post_change;
+        cinfo->before_ctime_sec = fhp->fh_pre_ctime.tv_sec;
+        cinfo->before_ctime_nsec = fhp->fh_pre_ctime.tv_nsec;
+        cinfo->after_ctime_sec = fhp->fh_post_attr.ctime.tv_sec;
+        cinfo->after_ctime_nsec = fhp->fh_post_attr.ctime.tv_nsec;
+
 }
 
 int nfs4svc_encode_voidres(struct svc_rqst *, __be32 *, void *);
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 922263393c76..57878bd94411 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -733,7 +733,8 @@ static int nilfs_setup_super(struct nilfs_sb_info *sbi)
                 cpu_to_le16(le16_to_cpu(sbp[0]->s_state) & ~NILFS_VALID_FS);
         sbp[0]->s_mtime = cpu_to_le64(get_seconds());
         /* synchronize sbp[1] with sbp[0] */
-        memcpy(sbp[1], sbp[0], nilfs->ns_sbsize);
+        if (sbp[1])
+                memcpy(sbp[1], sbp[0], nilfs->ns_sbsize);
         return nilfs_commit_super(sbi, NILFS_SB_COMMIT_ALL);
 }
 
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index bf7f6d776c31..5b7c6fe7fb61 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -751,6 +751,7 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
         if (ret >= 0)
                 return ret;
 
+        fsnotify_put_group(group);
         atomic_dec(&user->inotify_devs);
 out_free_uid:
         free_uid(user);
diff --git a/fs/pipe.c b/fs/pipe.c
index 279eef96c51c..a58d7ee7ad18 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -382,7 +382,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
                         error = ops->confirm(pipe, buf);
                         if (error) {
                                 if (!ret)
-                                        error = ret;
+                                        ret = error;
                                 break;
                         }
 
@@ -1197,12 +1197,24 @@ int pipe_proc_fn(struct ctl_table *table, int write, void __user *buf,
         return ret;
 }
 
+/*
+ * After the inode slimming patch, i_pipe/i_bdev/i_cdev share the same
+ * location, so checking ->i_pipe is not enough to verify that this is a
+ * pipe.
+ */
+struct pipe_inode_info *get_pipe_info(struct file *file)
+{
+        struct inode *i = file->f_path.dentry->d_inode;
+
+        return S_ISFIFO(i->i_mode) ? i->i_pipe : NULL;
+}
+
 long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         struct pipe_inode_info *pipe;
         long ret;
 
-        pipe = file->f_path.dentry->d_inode->i_pipe;
+        pipe = get_pipe_info(file);
         if (!pipe)
                 return -EBADF;
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8e4addaa5424..632b9071ad2e 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1526,7 +1526,7 @@ static int do_proc_readlink(struct path *path, char __user *buffer, int buflen)
         if (!tmp)
                 return -ENOMEM;
 
-        pathname = d_path_with_unreachable(path, tmp, PAGE_SIZE);
+        pathname = d_path(path, tmp, PAGE_SIZE);
         len = PTR_ERR(pathname);
         if (IS_ERR(pathname))
                 goto out;
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index 6f37c391468d..d245cb23dd72 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -558,7 +558,7 @@ static int open_kcore(struct inode *inode, struct file *filp)
 static const struct file_operations proc_kcore_operations = {
         .read           = read_kcore,
         .open           = open_kcore,
-        .llseek         = generic_file_llseek,
+        .llseek         = default_llseek,
 };
 
 #ifdef CONFIG_MEMORY_HOTPLUG
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index 5cbb81e134ac..4131f4a49391 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -186,12 +186,11 @@ int reiserfs_unpack(struct inode *inode, struct file *filp)
                 return 0;
         }
 
-        /* we need to make sure nobody is changing the file size beneath
-         ** us
-         */
-        reiserfs_mutex_lock_safe(&inode->i_mutex, inode->i_sb);
         depth = reiserfs_write_lock_once(inode->i_sb);
 
+        /* we need to make sure nobody is changing the file size beneath us */
+        reiserfs_mutex_lock_safe(&inode->i_mutex, inode->i_sb);
+
         write_from = inode->i_size & (blocksize - 1);
         /* if we are on a block boundary, we are already unpacked.  */
         if (write_from == 0) {
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index 536d697a8a28..90d2fcb67a31 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -472,7 +472,9 @@ int reiserfs_acl_chmod(struct inode *inode)
                 struct reiserfs_transaction_handle th;
                 size_t size = reiserfs_xattr_nblocks(inode,
                                              reiserfs_acl_size(clone->a_count));
-                reiserfs_write_lock(inode->i_sb);
+                int depth;
+
+                depth = reiserfs_write_lock_once(inode->i_sb);
                 error = journal_begin(&th, inode->i_sb, size * 2);
                 if (!error) {
                         int error2;
@@ -482,7 +484,7 @@ int reiserfs_acl_chmod(struct inode *inode)
                         if (error2)
                                 error = error2;
                 }
-                reiserfs_write_unlock(inode->i_sb);
+                reiserfs_write_unlock_once(inode->i_sb, depth);
         }
         posix_acl_release(clone);
         return error;
diff --git a/fs/splice.c b/fs/splice.c
index 8f1dfaecc8f0..ce2f02579e35 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1311,18 +1311,6 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
 static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
                                struct pipe_inode_info *opipe,
                                size_t len, unsigned int flags);
-/*
- * After the inode slimming patch, i_pipe/i_bdev/i_cdev share the same
- * location, so checking ->i_pipe is not enough to verify that this is a
- * pipe.
- */
-static inline struct pipe_inode_info *pipe_info(struct inode *inode)
-{
-        if (S_ISFIFO(inode->i_mode))
-                return inode->i_pipe;
-
-        return NULL;
-}
 
 /*
  * Determine where to splice to/from.
@@ -1336,8 +1324,8 @@ static long do_splice(struct file *in, loff_t __user *off_in,
         loff_t offset, *off;
         long ret;
 
-        ipipe = pipe_info(in->f_path.dentry->d_inode);
-        opipe = pipe_info(out->f_path.dentry->d_inode);
+        ipipe = get_pipe_info(in);
+        opipe = get_pipe_info(out);
 
         if (ipipe && opipe) {
                 if (off_in || off_out)
@@ -1555,7 +1543,7 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
         int error;
         long ret;
 
-        pipe = pipe_info(file->f_path.dentry->d_inode);
+        pipe = get_pipe_info(file);
         if (!pipe)
                 return -EBADF;
 
@@ -1642,7 +1630,7 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
         };
         long ret;
 
-        pipe = pipe_info(file->f_path.dentry->d_inode);
+        pipe = get_pipe_info(file);
         if (!pipe)
                 return -EBADF;
 
@@ -2022,8 +2010,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
 static long do_tee(struct file *in, struct file *out, size_t len,
                    unsigned int flags)
 {
-        struct pipe_inode_info *ipipe = pipe_info(in->f_path.dentry->d_inode);
-        struct pipe_inode_info *opipe = pipe_info(out->f_path.dentry->d_inode);
+        struct pipe_inode_info *ipipe = get_pipe_info(in);
+        struct pipe_inode_info *opipe = get_pipe_info(out);
         int ret = -EINVAL;
 
         /*
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 883c1d439899..40b1f0e14963 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -28,7 +28,6 @@
         {0x1002, 0x4156, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x4237, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP}, \
         {0x1002, 0x4242, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x4243, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x4336, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4337, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4437, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index a065612fc928..64a7114a9394 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -29,6 +29,7 @@ struct linux_binprm{
         char buf[BINPRM_BUF_SIZE];
 #ifdef CONFIG_MMU
         struct vm_area_struct *vma;
+        unsigned long vma_pages;
 #else
 # define MAX_ARG_PAGES  32
         struct page *page[MAX_ARG_PAGES];
@@ -59,6 +60,10 @@ struct linux_binprm{
         unsigned long loader, exec;
 };
 
+extern void acct_arg_size(struct linux_binprm *bprm, unsigned long pages);
+extern struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+                                        int write);
+
 #define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
 #define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 2c54906f678f..f142a7f300f8 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -246,7 +246,7 @@ struct queue_limits {
 
         unsigned char           misaligned;
         unsigned char           discard_misaligned;
-        unsigned char           no_cluster;
+        unsigned char           cluster;
         signed char             discard_zeroes_data;
 };
 
@@ -369,7 +369,6 @@ struct request_queue
 #endif
 };
 
-#define QUEUE_FLAG_CLUSTER      0       /* cluster several segments into 1 */
 #define QUEUE_FLAG_QUEUED       1       /* uses generic tag queueing */
 #define QUEUE_FLAG_STOPPED      2       /* queue is stopped */
 #define QUEUE_FLAG_SYNCFULL     3       /* read queue has been filled */
@@ -392,7 +391,6 @@ struct request_queue
 #define QUEUE_FLAG_SECDISCARD  19       /* supports SECDISCARD */
 
 #define QUEUE_FLAG_DEFAULT      ((1 << QUEUE_FLAG_IO_STAT) |            \
-                                 (1 << QUEUE_FLAG_CLUSTER) |            \
                                  (1 << QUEUE_FLAG_STACKABLE)    |       \
                                  (1 << QUEUE_FLAG_SAME_COMP)    |       \
                                  (1 << QUEUE_FLAG_ADD_RANDOM))
@@ -550,6 +548,11 @@ enum {
 
 #define rq_data_dir(rq)         ((rq)->cmd_flags & 1)
 
+static inline unsigned int blk_queue_cluster(struct request_queue *q)
+{
+        return q->limits.cluster;
+}
+
 /*
  * We regard a request as sync, if either a read or a sync write
  */
@@ -851,7 +854,7 @@ extern void blk_queue_max_segment_size(struct request_queue *, unsigned int);
 extern void blk_queue_max_discard_sectors(struct request_queue *q,
                 unsigned int max_discard_sectors);
 extern void blk_queue_logical_block_size(struct request_queue *, unsigned short);
-extern void blk_queue_physical_block_size(struct request_queue *, unsigned short);
+extern void blk_queue_physical_block_size(struct request_queue *, unsigned int);
 extern void blk_queue_alignment_offset(struct request_queue *q,
                                        unsigned int alignment);
 extern void blk_limits_io_min(struct queue_limits *limits, unsigned int min);
@@ -1004,7 +1007,7 @@ static inline unsigned int queue_physical_block_size(struct request_queue *q)
         return q->limits.physical_block_size;
 }
 
-static inline int bdev_physical_block_size(struct block_device *bdev)
+static inline unsigned int bdev_physical_block_size(struct block_device *bdev)
 {
         return queue_physical_block_size(bdev_get_queue(bdev));
 }
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index 266ab9291232..499dfe982a0e 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -105,6 +105,8 @@ extern void *__alloc_bootmem_low_node(pg_data_t *pgdat,
 
 #define alloc_bootmem(x) \
         __alloc_bootmem(x, SMP_CACHE_BYTES, __pa(MAX_DMA_ADDRESS))
+#define alloc_bootmem_align(x, align) \
+        __alloc_bootmem(x, align, __pa(MAX_DMA_ADDRESS))
 #define alloc_bootmem_nopanic(x) \
         __alloc_bootmem_nopanic(x, SMP_CACHE_BYTES, __pa(MAX_DMA_ADDRESS))
 #define alloc_bootmem_pages(x) \
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 975609cb8548..81483c20735f 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -339,7 +339,7 @@ void drain_local_pages(void *dummy);
 
 extern gfp_t gfp_allowed_mask;
 
-extern void set_gfp_allowed_mask(gfp_t mask);
-extern gfp_t clear_gfp_allowed_mask(gfp_t mask);
+extern void pm_restrict_gfp_mask(void);
+extern void pm_restore_gfp_mask(void);
 
 #endif /* __LINUX_GFP_H */
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 97b2eae6a22c..731854ccb840 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -959,7 +959,7 @@ struct ieee80211_ht_info {
 /* block-ack parameters */
 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
 
diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h
index 62dbee554f60..c238ad2f82ea 100644
--- a/include/linux/kfifo.h
+++ b/include/linux/kfifo.h
@@ -171,11 +171,8 @@ struct kfifo_rec_ptr_2 __STRUCT_KFIFO_PTR(unsigned char, 2, void);
         }
 
 
-static inline unsigned int __must_check
-__kfifo_must_check_helper(unsigned int val)
-{
-        return val;
-}
+/* __kfifo_must_check_helper() is temporarily disabled because it was faulty */
+#define __kfifo_must_check_helper(x) (x)
 
 /**
  * kfifo_initialized - Check if the fifo is initialized
diff --git a/include/linux/klist.h b/include/linux/klist.h
index e91a4e59b771..a370ce57cf1d 100644
--- a/include/linux/klist.h
+++ b/include/linux/klist.h
@@ -22,7 +22,7 @@ struct klist {
         struct list_head        k_list;
         void                    (*get)(struct klist_node *);
         void                    (*put)(struct klist_node *);
-} __attribute__ ((aligned (4)));
+} __attribute__ ((aligned (sizeof(void *))));
 
 #define KLIST_INIT(_name, _get, _put)                                   \
         { .k_lock       = __SPIN_LOCK_UNLOCKED(_name.k_lock),           \
diff --git a/include/linux/mfd/wm8994/pdata.h b/include/linux/mfd/wm8994/pdata.h
index 5c51f367c061..add8a1b8bcf0 100644
--- a/include/linux/mfd/wm8994/pdata.h
+++ b/include/linux/mfd/wm8994/pdata.h
@@ -29,7 +29,7 @@ struct wm8994_ldo_pdata {
 #define WM8994_CONFIGURE_GPIO 0x8000
 
 #define WM8994_DRC_REGS 5
-#define WM8994_EQ_REGS  19
+#define WM8994_EQ_REGS  20
 
 /**
  * DRC configurations are specified with a label and a set of register
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 3984c4eb41fd..8d789d732e87 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -448,12 +448,6 @@ static inline int zone_is_oom_locked(const struct zone *zone)
         return test_bit(ZONE_OOM_LOCKED, &zone->flags);
 }
 
-#ifdef CONFIG_SMP
-unsigned long zone_nr_free_pages(struct zone *zone);
-#else
-#define zone_nr_free_pages(zone) zone_page_state(zone, NR_FREE_PAGES)
-#endif /* CONFIG_SMP */
-
 /*
  * The "priority" of VM scanning is how much of the queues we will scan in one
  * go. A value of 12 for DEF_PRIORITY implies that we will scan 1/4096th of the
@@ -651,7 +645,9 @@ typedef struct pglist_data {
 extern struct mutex zonelists_mutex;
 void build_all_zonelists(void *data);
 void wakeup_kswapd(struct zone *zone, int order);
-int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
+bool zone_watermark_ok(struct zone *z, int order, unsigned long mark,
+                int classzone_idx, int alloc_flags);
+bool zone_watermark_ok_safe(struct zone *z, int order, unsigned long mark,
                 int classzone_idx, int alloc_flags);
 enum memmap_context {
         MEMMAP_EARLY,
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 89341c32631a..03317c8d4077 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -215,7 +215,7 @@ NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb,
         int ret;
 
         if (!cond ||
-            (ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN) == 1))
+            ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1))
                 ret = okfn(skb);
         return ret;
 }
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 570fddeb0388..db8aa93ce494 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2041,6 +2041,7 @@
 #define PCI_DEVICE_ID_AFAVLAB_P030      0x2182
 #define PCI_SUBDEVICE_ID_AFAVLAB_P061           0x2150
 
+#define PCI_VENDOR_ID_BCM_GVC          0x14a4
 #define PCI_VENDOR_ID_BROADCOM          0x14e4
 #define PCI_DEVICE_ID_TIGON3_5752       0x1600
 #define PCI_DEVICE_ID_TIGON3_5752M      0x1601
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 716f99b682c1..1d42c6ecd00a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -788,6 +788,7 @@ struct perf_event_context {
         int                             nr_active;
         int                             is_active;
         int                             nr_stat;
+        int                             rotate_disable;
         atomic_t                        refcount;
         struct task_struct              *task;
 
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 445796945ac9..bb27d7ec2fb9 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -160,5 +160,6 @@ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
 
 /* for F_SETPIPE_SZ and F_GETPIPE_SZ */
 long pipe_fcntl(struct file *, unsigned int, unsigned long arg);
+struct pipe_inode_info *get_pipe_info(struct file *file);
 
 #endif
diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index 6e81888c6222..5ea4b1582b07 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -67,7 +67,8 @@ static inline void device_set_run_wake(struct device *dev, bool enable)
 
 static inline bool pm_runtime_suspended(struct device *dev)
 {
-        return dev->power.runtime_status == RPM_SUSPENDED;
+        return dev->power.runtime_status == RPM_SUSPENDED
+                && !dev->power.disable_depth;
 }
 
 #else /* !CONFIG_PM_RUNTIME */
diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index 634b8e674ac5..9f38fe50217e 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -36,17 +36,6 @@
  * RCU.
  */
 #define RADIX_TREE_INDIRECT_PTR 1
-#define RADIX_TREE_RETRY ((void *)-1UL)
-
-static inline void *radix_tree_ptr_to_indirect(void *ptr)
-{
-        return (void *)((unsigned long)ptr | RADIX_TREE_INDIRECT_PTR);
-}
-
-static inline void *radix_tree_indirect_to_ptr(void *ptr)
-{
-        return (void *)((unsigned long)ptr & ~RADIX_TREE_INDIRECT_PTR);
-}
 
 static inline int radix_tree_is_indirect_ptr(void *ptr)
 {
@@ -138,16 +127,29 @@ do {									\
  *              removed.
  *
  * For use with radix_tree_lookup_slot().  Caller must hold tree at least read
- * locked across slot lookup and dereference.  More likely, will be used with
- * radix_tree_replace_slot(), as well, so caller will hold tree write locked.
+ * locked across slot lookup and dereference. Not required if write lock is
+ * held (ie. items cannot be concurrently inserted).
+ *
+ * radix_tree_deref_retry must be used to confirm validity of the pointer if
+ * only the read lock is held.
  */
 static inline void *radix_tree_deref_slot(void **pslot)
 {
-        void *ret = rcu_dereference(*pslot);
-        if (unlikely(radix_tree_is_indirect_ptr(ret)))
-                ret = RADIX_TREE_RETRY;
-        return ret;
+        return rcu_dereference(*pslot);
 }
+
+/**
+ * radix_tree_deref_retry       - check radix_tree_deref_slot
+ * @arg:        pointer returned by radix_tree_deref_slot
+ * Returns:     0 if retry is not required, otherwise retry is required
+ *
+ * radix_tree_deref_retry must be used with radix_tree_deref_slot.
+ */
+static inline int radix_tree_deref_retry(void *arg)
+{
+        return unlikely((unsigned long)arg & RADIX_TREE_INDIRECT_PTR);
+}
+
 /**
  * radix_tree_replace_slot      - replace item in a slot
  * @pslot:      pointer to slot, returned by radix_tree_lookup_slot
diff --git a/include/linux/sched.h b/include/linux/sched.h
index c9ac4fc837ba..cdb9672a11ea 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -147,7 +147,7 @@ extern unsigned long nr_iowait_cpu(int cpu);
 extern unsigned long this_cpu_load(void);
 
 
-extern void calc_global_load(void);
+extern void calc_global_load(unsigned long ticks);
 
 extern unsigned long get_parent_ip(unsigned long addr);
 
diff --git a/include/linux/socket.h b/include/linux/socket.h
index a8f56e1ec760..a2fada9becb6 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -322,7 +322,7 @@ extern int csum_partial_copy_fromiovecend(unsigned char *kdata,
                                           int offset, 
                                           unsigned int len, __wsum *csump);
 
-extern long verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode);
+extern int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode);
 extern int memcpy_toiovec(struct iovec *v, unsigned char *kdata, int len);
 extern int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
                              int offset, int len);
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 67d64e6efe7a..6f62c3055819 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -365,6 +365,7 @@ struct tty_file_private {
 #define TTY_HUPPED              18      /* Post driver->hangup() */
 #define TTY_FLUSHING            19      /* Flushing to ldisc in progress */
 #define TTY_FLUSHPENDING        20      /* Queued buffer flush pending */
+#define TTY_HUPPING             21      /* ->hangup() in progress */
 
 #define TTY_WRITE_FLUSH(tty) tty_write_flush((tty))
 
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index 55675b1efb28..e02848c55bd6 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -345,6 +345,9 @@ extern int usb_serial_generic_prepare_write_buffer(struct usb_serial_port *port,
 extern int usb_serial_handle_sysrq_char(struct usb_serial_port *port,
                                         unsigned int ch);
 extern int usb_serial_handle_break(struct usb_serial_port *port);
+extern void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
+                                         struct tty_struct *tty,
+                                         unsigned int status);
 
 
 extern int usb_serial_bus_register(struct usb_serial_driver *device);
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index eaaea37b3b75..e4cc21cf5870 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -254,6 +254,8 @@ extern void dec_zone_state(struct zone *, enum zone_stat_item);
 extern void __dec_zone_state(struct zone *, enum zone_stat_item);
 
 void refresh_cpu_vm_stats(int);
+void reduce_pgdat_percpu_threshold(pg_data_t *pgdat);
+void restore_pgdat_percpu_threshold(pg_data_t *pgdat);
 #else /* CONFIG_SMP */
 
 /*
@@ -298,6 +300,9 @@ static inline void __dec_zone_page_state(struct page *page,
 #define dec_zone_page_state __dec_zone_page_state
 #define mod_zone_page_state __mod_zone_page_state
 
+static inline void reduce_pgdat_percpu_threshold(pg_data_t *pgdat) { }
+static inline void restore_pgdat_percpu_threshold(pg_data_t *pgdat) { }
+
 static inline void refresh_cpu_vm_stats(int cpu) { }
 #endif
 
diff --git a/include/media/saa7146.h b/include/media/saa7146.h
index 7a9f76ecbbbd..ac7ce00f39cf 100644
--- a/include/media/saa7146.h
+++ b/include/media/saa7146.h
@@ -161,7 +161,7 @@ extern struct list_head saa7146_devices;
 extern struct mutex saa7146_devices_lock;
 int saa7146_register_extension(struct saa7146_extension*);
 int saa7146_unregister_extension(struct saa7146_extension*);
-struct saa7146_format* format_by_fourcc(struct saa7146_dev *dev, int fourcc);
+struct saa7146_format* saa7146_format_by_fourcc(struct saa7146_dev *dev, int fourcc);
 int saa7146_pgtable_alloc(struct pci_dev *pci, struct saa7146_pgtable *pt);
 void saa7146_pgtable_free(struct pci_dev *pci, struct saa7146_pgtable *pt);
 int saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *pt, struct scatterlist *list, int length );
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 90c9e2872f27..18e5c3f67580 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *fp);
 extern void unix_notinflight(struct file *fp);
 extern void unix_gc(void);
 extern void wait_for_unix_gc(void);
+extern struct sock *unix_get_socket(struct file *filp);
 
 #define UNIX_HASH_SIZE  256
 
@@ -56,6 +57,7 @@ struct unix_sock {
         spinlock_t              lock;
         unsigned int            gc_candidate : 1;
         unsigned int            gc_maybe_cycle : 1;
+        unsigned char           recursion_level;
         struct socket_wq        peer_wq;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 2fd06c60ffbb..a1662a52fb7d 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1201,13 +1201,14 @@ struct cfg80211_ops {
  *      initiator is %REGDOM_SET_BY_CORE).
  * @WIPHY_FLAG_STRICT_REGULATORY: tells us the driver for this device will
  *      ignore regulatory domain settings until it gets its own regulatory
- *      domain via its regulatory_hint(). After its gets its own regulatory
- *      domain it will only allow further regulatory domain settings to
- *      further enhance compliance. For example if channel 13 and 14 are
- *      disabled by this regulatory domain no user regulatory domain can
- *      enable these channels at a later time. This can be used for devices
- *      which do not have calibration information gauranteed for frequencies
- *      or settings outside of its regulatory domain.
+ *      domain via its regulatory_hint() unless the regulatory hint is
+ *      from a country IE. After its gets its own regulatory domain it will
+ *      only allow further regulatory domain settings to further enhance
+ *      compliance. For example if channel 13 and 14 are disabled by this
+ *      regulatory domain no user regulatory domain can enable these channels
+ *      at a later time. This can be used for devices which do not have
+ *      calibration information guaranteed for frequencies or settings
+ *      outside of its regulatory domain.
  * @WIPHY_FLAG_DISABLE_BEACON_HINTS: enable this if your driver needs to ensure
  *      that passive scan flags and beaconing flags may not be lifted by
  *      cfg80211 due to regulatory beacon hints. For more information on beacon
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b0787a1dea90..05aaa8789848 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -315,6 +315,9 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_LDPC: tells the driver to use LDPC for this frame
  * @IEEE80211_TX_CTL_STBC: Enables Space-Time Block Coding (STBC) for this
  *      frame and selects the maximum number of streams that it can use.
+ *
+ * Note: If you have to add new flags to the enumeration, then don't
+ *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -344,6 +347,19 @@ enum mac80211_tx_control_flags {
 
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
 
+/*
+ * This definition is used as a mask to clear all temporary flags, which are
+ * set by the tx handlers for each transmission attempt by the mac80211 stack.
+ */
+#define IEEE80211_TX_TEMPORARY_FLAGS (IEEE80211_TX_CTL_NO_ACK |               \
+        IEEE80211_TX_CTL_CLEAR_PS_FILT | IEEE80211_TX_CTL_FIRST_FRAGMENT |    \
+        IEEE80211_TX_CTL_SEND_AFTER_DTIM | IEEE80211_TX_CTL_AMPDU |           \
+        IEEE80211_TX_STAT_TX_FILTERED | IEEE80211_TX_STAT_ACK |               \
+        IEEE80211_TX_STAT_AMPDU | IEEE80211_TX_STAT_AMPDU_NO_BACK |           \
+        IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_PSPOLL_RESPONSE | \
+        IEEE80211_TX_CTL_MORE_FRAMES | IEEE80211_TX_CTL_LDPC |                \
+        IEEE80211_TX_CTL_STBC)
+
 /**
  * enum mac80211_rate_control_flags - per-rate flags set by the
  *      Rate Control algorithm.
diff --git a/include/net/sock.h b/include/net/sock.h
index adab9dc58183..6892a5e89c23 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1155,6 +1155,8 @@ extern void sk_common_release(struct sock *sk);
 /* Initialise core socket variables */
 extern void sock_init_data(struct socket *sock, struct sock *sk);
 
+extern void sk_filter_release_rcu(struct rcu_head *rcu);
+
 /**
  *      sk_filter_release - release a socket filter
  *      @fp: filter to remove
@@ -1165,7 +1167,7 @@ extern void sock_init_data(struct socket *sock, struct sock *sk);
 static inline void sk_filter_release(struct sk_filter *fp)
 {
         if (atomic_dec_and_test(&fp->refcnt))
-                kfree(fp);
+                call_rcu_bh(&fp->rcu, sk_filter_release_rcu);
 }
 
 static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
index 8fcb6e0e9e72..d38b58e735dc 100644
--- a/include/scsi/scsi.h
+++ b/include/scsi/scsi.h
@@ -9,6 +9,7 @@
 #define _SCSI_SCSI_H
 
 #include <linux/types.h>
+#include <linux/scatterlist.h>
 
 struct scsi_cmnd;
 
diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h
index e8cbf431c8cc..75271b9a8f61 100644
--- a/include/xen/interface/io/ring.h
+++ b/include/xen/interface/io/ring.h
@@ -24,8 +24,15 @@ typedef unsigned int RING_IDX;
  * A ring contains as many entries as will fit, rounded down to the nearest
  * power of two (so we can mask with (size-1) to loop around).
  */
-#define __RING_SIZE(_s, _sz) \
-    (__RD32(((_sz) - (long)&(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0])))
+#define __CONST_RING_SIZE(_s, _sz)                              \
+        (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) /   \
+                sizeof(((struct _s##_sring *)0)->ring[0])))
+
+/*
+ * The same for passing in an actual pointer instead of a name tag.
+ */
+#define __RING_SIZE(_s, _sz)                                            \
+        (__RD32(((_sz) - (long)&(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0])))
 
 /*
  * Macros to make the correct C datatypes for a new kind of ring.
diff --git a/init/calibrate.c b/init/calibrate.c
index 6eb48e53d61c..24fe022c55f9 100644
--- a/init/calibrate.c
+++ b/init/calibrate.c
@@ -66,7 +66,7 @@ static unsigned long __cpuinit calibrate_delay_direct(void)
                 pre_start = 0;
                 read_current_timer(&start);
                 start_jiffies = jiffies;
-                while (jiffies <= (start_jiffies + 1)) {
+                while (time_before_eq(jiffies, start_jiffies + 1)) {
                         pre_start = start;
                         read_current_timer(&start);
                 }
@@ -74,8 +74,8 @@ static unsigned long __cpuinit calibrate_delay_direct(void)
 
                 pre_end = 0;
                 end = post_start;
-                while (jiffies <=
-                       (start_jiffies + 1 + DELAY_CALIBRATION_TICKS)) {
+                while (time_before_eq(jiffies, start_jiffies + 1 +
+                                               DELAY_CALIBRATION_TICKS)) {
                         pre_end = end;
                         read_current_timer(&end);
                 }
diff --git a/ipc/compat.c b/ipc/compat.c
index 9dc2c7d3c9e6..845a28738d3a 100644
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -241,6 +241,8 @@ long compat_sys_semctl(int first, int second, int third, void __user *uptr)
         struct semid64_ds __user *up64;
         int version = compat_ipc_parse_version(&third);
 
+        memset(&s64, 0, sizeof(s64));
+
         if (!uptr)
                 return -EINVAL;
         if (get_user(pad, (u32 __user *) uptr))
@@ -421,6 +423,8 @@ long compat_sys_msgctl(int first, int second, void __user *uptr)
         int version = compat_ipc_parse_version(&second);
         void __user *p;
 
+        memset(&m64, 0, sizeof(m64));
+
         switch (second & (~IPC_64)) {
         case IPC_INFO:
         case IPC_RMID:
@@ -594,6 +598,8 @@ long compat_sys_shmctl(int first, int second, void __user *uptr)
         int err, err2;
         int version = compat_ipc_parse_version(&second);
 
+        memset(&s64, 0, sizeof(s64));
+
         switch (second & (~IPC_64)) {
         case IPC_RMID:
         case SHM_LOCK:
diff --git a/ipc/compat_mq.c b/ipc/compat_mq.c
index d8d1e9ff4e88..380ea4fe08e7 100644
--- a/ipc/compat_mq.c
+++ b/ipc/compat_mq.c
@@ -53,6 +53,9 @@ asmlinkage long compat_sys_mq_open(const char __user *u_name,
         void __user *p = NULL;
         if (u_attr && oflag & O_CREAT) {
                 struct mq_attr attr;
+
+                memset(&attr, 0, sizeof(attr));
+
                 p = compat_alloc_user_space(sizeof(attr));
                 if (get_compat_mq_attr(&attr, u_attr) ||
                     copy_to_user(p, &attr, sizeof(attr)))
@@ -127,6 +130,8 @@ asmlinkage long compat_sys_mq_getsetattr(mqd_t mqdes,
         struct mq_attr __user *p = compat_alloc_user_space(2 * sizeof(*p));
         long ret;
 
+        memset(&mqstat, 0, sizeof(mqstat));
+
         if (u_mqstat) {
                 if (get_compat_mq_attr(&mqstat, u_mqstat) ||
                     copy_to_user(p, &mqstat, sizeof(mqstat)))
diff --git a/ipc/shm.c b/ipc/shm.c
index 52ed77eb9713..b42738067146 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -473,6 +473,7 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_
             {
                 struct shmid_ds out;
 
+                memset(&out, 0, sizeof(out));
                 ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
                 out.shm_segsz   = in->shm_segsz;
                 out.shm_atime   = in->shm_atime;
diff --git a/kernel/exit.c b/kernel/exit.c
index b9d3bc6c21ec..ad7e51488291 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -97,6 +97,14 @@ static void __exit_signal(struct task_struct *tsk)
                 sig->tty = NULL;
         } else {
                 /*
+                 * This can only happen if the caller is de_thread().
+                 * FIXME: this is the temporary hack, we should teach
+                 * posix-cpu-timers to handle this case correctly.
+                 */
+                if (unlikely(has_group_leader_pid(tsk)))
+                        posix_cpu_timers_exit_group(tsk);
+
+                /*
                  * If there is any task waiting for the group exit
                  * then notify it:
                  */
@@ -905,6 +913,15 @@ NORET_TYPE void do_exit(long code)
         if (unlikely(!tsk->pid))
                 panic("Attempted to kill the idle task!");
 
+        /*
+         * If do_exit is called because this processes oopsed, it's possible
+         * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
+         * continuing. Amongst other possible reasons, this is to prevent
+         * mm_release()->clear_child_tid() from writing to a user-controlled
+         * kernel address.
+         */
+        set_fs(USER_DS);
+
         tracehook_report_exit(&code);
 
         validate_creds_for_do_exit(tsk);
diff --git a/kernel/fork.c b/kernel/fork.c
index ab7f29d906c7..d01a7514125b 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -279,6 +279,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
 
         setup_thread_stack(tsk, orig);
         clear_user_return_notifier(tsk);
+        clear_tsk_need_resched(tsk);
         stackend = end_of_stack(tsk);
         *stackend = STACK_END_MAGIC;    /* for overflow detection */
 
diff --git a/kernel/futex.c b/kernel/futex.c
index 6a3a5fa1526d..e328f574c97c 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1363,7 +1363,6 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
 {
         struct futex_hash_bucket *hb;
 
-        get_futex_key_refs(&q->key);
         hb = hash_futex(&q->key);
         q->lock_ptr = &hb->lock;
 
@@ -1375,7 +1374,6 @@ static inline void
 queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
 {
         spin_unlock(&hb->lock);
-        drop_futex_key_refs(&q->key);
 }
 
 /**
@@ -1480,8 +1478,6 @@ static void unqueue_me_pi(struct futex_q *q)
         q->pi_state = NULL;
 
         spin_unlock(q->lock_ptr);
-
-        drop_futex_key_refs(&q->key);
 }
 
 /*
@@ -1812,7 +1808,10 @@ static int futex_wait(u32 __user *uaddr, int fshared,
         }
 
 retry:
-        /* Prepare to wait on uaddr. */
+        /*
+         * Prepare to wait on uaddr. On success, holds hb lock and increments
+         * q.key refs.
+         */
         ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
         if (ret)
                 goto out;
@@ -1822,24 +1821,23 @@ retry:
 
         /* If we were woken (and unqueued), we succeeded, whatever. */
         ret = 0;
+        /* unqueue_me() drops q.key ref */
         if (!unqueue_me(&q))
-                goto out_put_key;
+                goto out;
         ret = -ETIMEDOUT;
         if (to && !to->task)
-                goto out_put_key;
+                goto out;
 
         /*
          * We expect signal_pending(current), but we might be the
          * victim of a spurious wakeup as well.
          */
-        if (!signal_pending(current)) {
-                put_futex_key(fshared, &q.key);
+        if (!signal_pending(current))
                 goto retry;
-        }
 
         ret = -ERESTARTSYS;
         if (!abs_time)
-                goto out_put_key;
+                goto out;
 
         restart = &current_thread_info()->restart_block;
         restart->fn = futex_wait_restart;
@@ -1856,8 +1854,6 @@ retry:
 
         ret = -ERESTART_RESTARTBLOCK;
 
-out_put_key:
-        put_futex_key(fshared, &q.key);
 out:
         if (to) {
                 hrtimer_cancel(&to->timer);
@@ -2236,7 +2232,10 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
         q.rt_waiter = &rt_waiter;
         q.requeue_pi_key = &key2;
 
-        /* Prepare to wait on uaddr. */
+        /*
+         * Prepare to wait on uaddr. On success, increments q.key (key1) ref
+         * count.
+         */
         ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
         if (ret)
                 goto out_key2;
@@ -2254,7 +2253,9 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared,
          * In order for us to be here, we know our q.key == key2, and since
          * we took the hb->lock above, we also know that futex_requeue() has
          * completed and we no longer have to concern ourselves with a wakeup
-         * race with the atomic proxy lock acquition by the requeue code.
+         * race with the atomic proxy lock acquisition by the requeue code. The
+         * futex_requeue dropped our key1 reference and incremented our key2
+         * reference count.
          */
 
         /* Check if the requeue code acquired the second futex for us. */
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 09a2ee540bd2..345e0b75fe1e 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -214,7 +214,7 @@ static int irq_spurious_proc_show(struct seq_file *m, void *v)
 
 static int irq_spurious_proc_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, irq_spurious_proc_show, NULL);
+        return single_open(file, irq_spurious_proc_show, PDE(inode)->data);
 }
 
 static const struct file_operations irq_spurious_proc_fops = {
diff --git a/kernel/latencytop.c b/kernel/latencytop.c
index 877fb306d415..17110a4a4fc2 100644
--- a/kernel/latencytop.c
+++ b/kernel/latencytop.c
@@ -194,14 +194,7 @@ __account_scheduler_latency(struct task_struct *tsk, int usecs, int inter)
 
         account_global_scheduler_latency(tsk, &lat);
 
-        /*
-         * short term hack; if we're > 32 we stop; future we recycle:
-         */
-        tsk->latency_record_count++;
-        if (tsk->latency_record_count >= LT_SAVECOUNT)
-                goto out_unlock;
-
-        for (i = 0; i < LT_SAVECOUNT; i++) {
+        for (i = 0; i < tsk->latency_record_count; i++) {
                 struct latency_record *mylat;
                 int same = 1;
 
@@ -227,8 +220,14 @@ __account_scheduler_latency(struct task_struct *tsk, int usecs, int inter)
                 }
         }
 
+        /*
+         * short term hack; if we're > 32 we stop; future we recycle:
+         */
+        if (tsk->latency_record_count >= LT_SAVECOUNT)
+                goto out_unlock;
+
         /* Allocated a new one: */
-        i = tsk->latency_record_count;
+        i = tsk->latency_record_count++;
         memcpy(&tsk->latency_record[i], &lat, sizeof(struct latency_record));
 
 out_unlock:
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index b98bed3d8182..65b09a836cc3 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -1620,8 +1620,12 @@ static void rotate_ctx(struct perf_event_context *ctx)
 {
         raw_spin_lock(&ctx->lock);
 
-        /* Rotate the first entry last of non-pinned groups */
-        list_rotate_left(&ctx->flexible_groups);
+        /*
+         * Rotate the first entry last of non-pinned groups. Rotation might be
+         * disabled by the inheritance code.
+         */
+        if (!ctx->rotate_disable)
+                list_rotate_left(&ctx->flexible_groups);
 
         raw_spin_unlock(&ctx->lock);
 }
@@ -1773,7 +1777,13 @@ static u64 perf_event_read(struct perf_event *event)
                 unsigned long flags;
 
                 raw_spin_lock_irqsave(&ctx->lock, flags);
-                update_context_time(ctx);
+                /*
+                 * may read while context is not active
+                 * (e.g., thread is blocked), in that case
+                 * we cannot update context time
+                 */
+                if (ctx->is_active)
+                        update_context_time(ctx);
                 update_event_times(event);
                 raw_spin_unlock_irqrestore(&ctx->lock, flags);
         }
@@ -5616,6 +5626,7 @@ int perf_event_init_task(struct task_struct *child)
         struct perf_event *event;
         struct task_struct *parent = current;
         int inherited_all = 1;
+        unsigned long flags;
         int ret = 0;
 
         child->perf_event_ctxp = NULL;
@@ -5656,6 +5667,15 @@ int perf_event_init_task(struct task_struct *child)
                         break;
         }
 
+        /*
+         * We can't hold ctx->lock when iterating the ->flexible_group list due
+         * to allocations, but we need to prevent rotation because
+         * rotate_ctx() will change the list from interrupt context.
+         */
+        raw_spin_lock_irqsave(&parent_ctx->lock, flags);
+        parent_ctx->rotate_disable = 1;
+        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
+
         list_for_each_entry(event, &parent_ctx->flexible_groups, group_entry) {
                 ret = inherit_task_group(event, parent, parent_ctx, child,
                                          &inherited_all);
@@ -5663,6 +5683,10 @@ int perf_event_init_task(struct task_struct *child)
                         break;
         }
 
+        raw_spin_lock_irqsave(&parent_ctx->lock, flags);
+        parent_ctx->rotate_disable = 0;
+        raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
+
         child_ctx = child->perf_event_ctxp;
 
         if (child_ctx && inherited_all) {
diff --git a/kernel/pm_qos_params.c b/kernel/pm_qos_params.c
index 645e541a45f6..0da2837416eb 100644
--- a/kernel/pm_qos_params.c
+++ b/kernel/pm_qos_params.c
@@ -120,10 +120,10 @@ static inline int pm_qos_get_value(struct pm_qos_object *o)
 
         switch (o->type) {
         case PM_QOS_MIN:
-                return plist_last(&o->requests)->prio;
+                return plist_first(&o->requests)->prio;
 
         case PM_QOS_MAX:
-                return plist_first(&o->requests)->prio;
+                return plist_last(&o->requests)->prio;
 
         default:
                 /* runtime check for not using enum */
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 8dc31e02ae12..7a931a90e4a2 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -326,7 +326,6 @@ static int create_image(int platform_mode)
 int hibernation_snapshot(int platform_mode)
 {
         int error;
-        gfp_t saved_mask;
 
         error = platform_begin(platform_mode);
         if (error)
@@ -338,7 +337,7 @@ int hibernation_snapshot(int platform_mode)
                 goto Close;
 
         suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
         error = dpm_suspend_start(PMSG_FREEZE);
         if (error)
                 goto Recover_platform;
@@ -347,7 +346,10 @@ int hibernation_snapshot(int platform_mode)
                 goto Recover_platform;
 
         error = create_image(platform_mode);
-        /* Control returns here after successful restore */
+        /*
+         * Control returns here (1) after the image has been created or the
+         * image creation has failed and (2) after a successful restore.
+         */
 
  Resume_devices:
         /* We may need to release the preallocated image pages here. */
@@ -356,7 +358,10 @@ int hibernation_snapshot(int platform_mode)
 
         dpm_resume_end(in_suspend ?
                 (error ? PMSG_RECOVER : PMSG_THAW) : PMSG_RESTORE);
-        set_gfp_allowed_mask(saved_mask);
+
+        if (error || !in_suspend)
+                pm_restore_gfp_mask();
+
         resume_console();
  Close:
         platform_end(platform_mode);
@@ -451,17 +456,16 @@ static int resume_target_kernel(bool platform_mode)
 int hibernation_restore(int platform_mode)
 {
         int error;
-        gfp_t saved_mask;
 
         pm_prepare_console();
         suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
         error = dpm_suspend_start(PMSG_QUIESCE);
         if (!error) {
                 error = resume_target_kernel(platform_mode);
                 dpm_resume_end(PMSG_RECOVER);
         }
-        set_gfp_allowed_mask(saved_mask);
+        pm_restore_gfp_mask();
         resume_console();
         pm_restore_console();
         return error;
@@ -475,7 +479,6 @@ int hibernation_restore(int platform_mode)
 int hibernation_platform_enter(void)
 {
         int error;
-        gfp_t saved_mask;
 
         if (!hibernation_ops)
                 return -ENOSYS;
@@ -491,7 +494,6 @@ int hibernation_platform_enter(void)
 
         entering_platform_hibernation = true;
         suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
         error = dpm_suspend_start(PMSG_HIBERNATE);
         if (error) {
                 if (hibernation_ops->recover)
@@ -535,7 +537,6 @@ int hibernation_platform_enter(void)
  Resume_devices:
         entering_platform_hibernation = false;
         dpm_resume_end(PMSG_RESTORE);
-        set_gfp_allowed_mask(saved_mask);
         resume_console();
 
  Close:
@@ -643,6 +644,7 @@ int hibernate(void)
                 swsusp_free();
                 if (!error)
                         power_down();
+                pm_restore_gfp_mask();
         } else {
                 pr_debug("PM: Image restored successfully.\n");
         }
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 7335952ee473..ecf770509d0d 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -197,7 +197,6 @@ static int suspend_enter(suspend_state_t state)
 int suspend_devices_and_enter(suspend_state_t state)
 {
         int error;
-        gfp_t saved_mask;
 
         if (!suspend_ops)
                 return -ENOSYS;
@@ -208,7 +207,7 @@ int suspend_devices_and_enter(suspend_state_t state)
                         goto Close;
         }
         suspend_console();
-        saved_mask = clear_gfp_allowed_mask(GFP_IOFS);
+        pm_restrict_gfp_mask();
         suspend_test_start();
         error = dpm_suspend_start(PMSG_SUSPEND);
         if (error) {
@@ -225,7 +224,7 @@ int suspend_devices_and_enter(suspend_state_t state)
         suspend_test_start();
         dpm_resume_end(PMSG_RESUME);
         suspend_test_finish("resume devices");
-        set_gfp_allowed_mask(saved_mask);
+        pm_restore_gfp_mask();
         resume_console();
  Close:
         if (suspend_ops->end)
diff --git a/kernel/power/user.c b/kernel/power/user.c
index e819e17877ca..c36c3b9e8a84 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -137,7 +137,7 @@ static int snapshot_release(struct inode *inode, struct file *filp)
         free_all_swap_pages(data->swap);
         if (data->frozen)
                 thaw_processes();
-        pm_notifier_call_chain(data->mode == O_WRONLY ?
+        pm_notifier_call_chain(data->mode == O_RDONLY ?
                         PM_POST_HIBERNATION : PM_POST_RESTORE);
         atomic_inc(&snapshot_device_available);
 
@@ -263,6 +263,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
         case SNAPSHOT_UNFREEZE:
                 if (!data->frozen || data->ready)
                         break;
+                pm_restore_gfp_mask();
                 thaw_processes();
                 usermodehelper_enable();
                 data->frozen = 0;
@@ -275,6 +276,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                         error = -EPERM;
                         break;
                 }
+                pm_restore_gfp_mask();
                 error = hibernation_snapshot(data->platform_support);
                 if (!error)
                         error = put_user(in_suspend, (int __user *)arg);
diff --git a/kernel/printk.c b/kernel/printk.c
index 9dc8ea140426..2dc36b49d2d2 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1072,13 +1072,15 @@ void printk_tick(void)
 
 int printk_needs_cpu(int cpu)
 {
+        if (unlikely(cpu_is_offline(cpu)))
+                printk_tick();
         return per_cpu(printk_pending, cpu);
 }
 
 void wake_up_klogd(void)
 {
         if (!trace_override && waitqueue_active(&log_wait))
-                __raw_get_cpu_var(printk_pending) = 1;
+                this_cpu_write(printk_pending, 1);
 }
 
 /**
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index f34d798ef4a2..bf768d739e7d 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -313,7 +313,7 @@ int ptrace_detach(struct task_struct *child, unsigned int data)
                 child->exit_code = data;
                 dead = __ptrace_detach(current, child);
                 if (!child->exit_state)
-                        wake_up_process(child);
+                        wake_up_state(child, TASK_TRACED | TASK_STOPPED);
         }
         write_unlock_irq(&tasklist_lock);
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 093df593e45d..b3f2b4187859 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -583,7 +583,7 @@ void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags)
          * cases. LITMUS^RT amplifies the effects of this problem. Hence, we
          * turn it off to avoid stalling clocks. */
         /*
-        if (test_tsk_need_resched(p))
+        if (rq->curr->se.on_rq && test_tsk_need_resched(p))
                 rq->skip_clock_update = 1;
         */
 }
@@ -741,7 +741,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
                 size_t cnt, loff_t *ppos)
 {
         char buf[64];
-        char *cmp = buf;
+        char *cmp;
         int neg = 0;
         int i;
 
@@ -752,6 +752,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
                 return -EFAULT;
 
         buf[cnt] = 0;
+        cmp = strstrip(buf);
 
         if (strncmp(buf, "NO_", 3) == 0) {
                 neg = 1;
@@ -759,9 +760,7 @@ sched_feat_write(struct file *filp, const char __user *ubuf,
         }
 
         for (i = 0; sched_feat_names[i]; i++) {
-                int len = strlen(sched_feat_names[i]);
-
-                if (strncmp(cmp, sched_feat_names[i], len) == 0) {
+                if (strcmp(cmp, sched_feat_names[i]) == 0) {
                         if (neg)
                                 sysctl_sched_features &= ~(1UL << i);
                         else
@@ -1877,12 +1876,6 @@ static void dec_nr_running(struct rq *rq)
 
 static void set_load_weight(struct task_struct *p)
 {
-        if (task_has_rt_policy(p)) {
-                p->se.load.weight = 0;
-                p->se.load.inv_weight = WMULT_CONST;
-                return;
-        }
-
         /*
          * SCHED_IDLE tasks get minimal weight:
          */
@@ -3011,6 +3004,15 @@ static long calc_load_fold_active(struct rq *this_rq)
         return delta;
 }
 
+static unsigned long
+calc_load(unsigned long load, unsigned long exp, unsigned long active)
+{
+        load *= exp;
+        load += active * (FIXED_1 - exp);
+        load += 1UL << (FSHIFT - 1);
+        return load >> FSHIFT;
+}
+
 #ifdef CONFIG_NO_HZ
 /*
  * For NO_HZ we delay the active fold to the next LOAD_FREQ update.
@@ -3040,6 +3042,128 @@ static long calc_load_fold_idle(void)
 
         return delta;
 }
+
+/**
+ * fixed_power_int - compute: x^n, in O(log n) time
+ *
+ * @x:         base of the power
+ * @frac_bits: fractional bits of @x
+ * @n:         power to raise @x to.
+ *
+ * By exploiting the relation between the definition of the natural power
+ * function: x^n := x*x*...*x (x multiplied by itself for n times), and
+ * the binary encoding of numbers used by computers: n := \Sum n_i * 2^i,
+ * (where: n_i \elem {0, 1}, the binary vector representing n),
+ * we find: x^n := x^(\Sum n_i * 2^i) := \Prod x^(n_i * 2^i), which is
+ * of course trivially computable in O(log_2 n), the length of our binary
+ * vector.
+ */
+static unsigned long
+fixed_power_int(unsigned long x, unsigned int frac_bits, unsigned int n)
+{
+        unsigned long result = 1UL << frac_bits;
+
+        if (n) for (;;) {
+                if (n & 1) {
+                        result *= x;
+                        result += 1UL << (frac_bits - 1);
+                        result >>= frac_bits;
+                }
+                n >>= 1;
+                if (!n)
+                        break;
+                x *= x;
+                x += 1UL << (frac_bits - 1);
+                x >>= frac_bits;
+        }
+
+        return result;
+}
+
+/*
+ * a1 = a0 * e + a * (1 - e)
+ *
+ * a2 = a1 * e + a * (1 - e)
+ *    = (a0 * e + a * (1 - e)) * e + a * (1 - e)
+ *    = a0 * e^2 + a * (1 - e) * (1 + e)
+ *
+ * a3 = a2 * e + a * (1 - e)
+ *    = (a0 * e^2 + a * (1 - e) * (1 + e)) * e + a * (1 - e)
+ *    = a0 * e^3 + a * (1 - e) * (1 + e + e^2)
+ *
+ *  ...
+ *
+ * an = a0 * e^n + a * (1 - e) * (1 + e + ... + e^n-1) [1]
+ *    = a0 * e^n + a * (1 - e) * (1 - e^n)/(1 - e)
+ *    = a0 * e^n + a * (1 - e^n)
+ *
+ * [1] application of the geometric series:
+ *
+ *              n         1 - x^(n+1)
+ *     S_n := \Sum x^i = -------------
+ *             i=0          1 - x
+ */
+static unsigned long
+calc_load_n(unsigned long load, unsigned long exp,
+            unsigned long active, unsigned int n)
+{
+
+        return calc_load(load, fixed_power_int(exp, FSHIFT, n), active);
+}
+
+/*
+ * NO_HZ can leave us missing all per-cpu ticks calling
+ * calc_load_account_active(), but since an idle CPU folds its delta into
+ * calc_load_tasks_idle per calc_load_account_idle(), all we need to do is fold
+ * in the pending idle delta if our idle period crossed a load cycle boundary.
+ *
+ * Once we've updated the global active value, we need to apply the exponential
+ * weights adjusted to the number of cycles missed.
+ */
+static void calc_global_nohz(unsigned long ticks)
+{
+        long delta, active, n;
+
+        if (time_before(jiffies, calc_load_update))
+                return;
+
+        /*
+         * If we crossed a calc_load_update boundary, make sure to fold
+         * any pending idle changes, the respective CPUs might have
+         * missed the tick driven calc_load_account_active() update
+         * due to NO_HZ.
+         */
+        delta = calc_load_fold_idle();
+        if (delta)
+                atomic_long_add(delta, &calc_load_tasks);
+
+        /*
+         * If we were idle for multiple load cycles, apply them.
+         */
+        if (ticks >= LOAD_FREQ) {
+                n = ticks / LOAD_FREQ;
+
+                active = atomic_long_read(&calc_load_tasks);
+                active = active > 0 ? active * FIXED_1 : 0;
+
+                avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
+                avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
+                avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
+
+                calc_load_update += n * LOAD_FREQ;
+        }
+
+        /*
+         * Its possible the remainder of the above division also crosses
+         * a LOAD_FREQ period, the regular check in calc_global_load()
+         * which comes after this will take care of that.
+         *
+         * Consider us being 11 ticks before a cycle completion, and us
+         * sleeping for 4*LOAD_FREQ + 22 ticks, then the above code will
+         * age us 4 cycles, and the test in calc_global_load() will
+         * pick up the final one.
+         */
+}
 #else
 static void calc_load_account_idle(struct rq *this_rq)
 {
@@ -3049,6 +3173,10 @@ static inline long calc_load_fold_idle(void)
 {
         return 0;
 }
+
+static void calc_global_nohz(unsigned long ticks)
+{
+}
 #endif
 
 /**
@@ -3066,24 +3194,17 @@ void get_avenrun(unsigned long *loads, unsigned long offset, int shift)
         loads[2] = (avenrun[2] + offset) << shift;
 }
 
-static unsigned long
-calc_load(unsigned long load, unsigned long exp, unsigned long active)
-{
-        load *= exp;
-        load += active * (FIXED_1 - exp);
-        return load >> FSHIFT;
-}
-
 /*
  * calc_load - update the avenrun load estimates 10 ticks after the
  * CPUs have updated calc_load_tasks.
  */
-void calc_global_load(void)
+void calc_global_load(unsigned long ticks)
 {
-        unsigned long upd = calc_load_update + 10;
         long active;
 
-        if (time_before(jiffies, upd))
+        calc_global_nohz(ticks);
+
+        if (time_before(jiffies, calc_load_update + 10))
                 return;
 
         active = atomic_long_read(&calc_load_tasks);
@@ -3745,7 +3866,6 @@ static void put_prev_task(struct rq *rq, struct task_struct *prev)
 {
         if (prev->se.on_rq)
                 update_rq_clock(rq);
-        rq->skip_clock_update = 0;
         prev->sched_class->put_prev_task(rq, prev);
 }
 
@@ -3821,7 +3941,6 @@ need_resched_nonpreemptible:
                 hrtick_clear(rq);
 
         raw_spin_lock_irq(&rq->lock);
-        clear_tsk_need_resched(prev);
 
         switch_count = &prev->nivcsw;
         if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
@@ -3853,6 +3972,8 @@ need_resched_nonpreemptible:
 
         put_prev_task(rq, prev);
         next = pick_next_task(rq);
+        clear_tsk_need_resched(prev);
+        rq->skip_clock_update = 0;
 
         if (likely(prev != next)) {
                 sched_info_switch(prev, next);
@@ -5439,7 +5560,19 @@ void __cpuinit init_idle(struct task_struct *idle, int cpu)
         idle->se.exec_start = sched_clock();
 
         cpumask_copy(&idle->cpus_allowed, cpumask_of(cpu));
+        /*
+         * We're having a chicken and egg problem, even though we are
+         * holding rq->lock, the cpu isn't yet set to this cpu so the
+         * lockdep check in task_group() will fail.
+         *
+         * Similar case to sched_fork(). / Alternatively we could
+         * use task_rq_lock() here and obtain the other rq->lock.
+         *
+         * Silence PROVE_RCU
+         */
+        rcu_read_lock();
         __set_task_cpu(idle, cpu);
+        rcu_read_unlock();
 
         rq->curr = rq->idle = idle;
 #if defined(CONFIG_SMP) && defined(__ARCH_WANT_UNLOCKED_CTXSW)
diff --git a/kernel/smp.c b/kernel/smp.c
index ed6aacfcb7ef..1ba1ba4b42f8 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -194,6 +194,24 @@ void generic_smp_call_function_interrupt(void)
         list_for_each_entry_rcu(data, &call_function.queue, csd.list) {
                 int refs;
 
+                /*
+                 * Since we walk the list without any locks, we might
+                 * see an entry that was completed, removed from the
+                 * list and is in the process of being reused.
+                 *
+                 * We must check that the cpu is in the cpumask before
+                 * checking the refs, and both must be set before
+                 * executing the callback on this cpu.
+                 */
+
+                if (!cpumask_test_cpu(cpu, data->cpumask))
+                        continue;
+
+                smp_rmb();
+
+                if (atomic_read(&data->refs) == 0)
+                        continue;
+
                 if (!cpumask_test_and_clear_cpu(cpu, data->cpumask))
                         continue;
 
@@ -202,6 +220,8 @@ void generic_smp_call_function_interrupt(void)
                 refs = atomic_dec_return(&data->refs);
                 WARN_ON(refs < 0);
                 if (!refs) {
+                        WARN_ON(!cpumask_empty(data->cpumask));
+
                         raw_spin_lock(&call_function.lock);
                         list_del_rcu(&data->csd.list);
                         raw_spin_unlock(&call_function.lock);
@@ -453,11 +473,21 @@ void smp_call_function_many(const struct cpumask *mask,
 
         data = &__get_cpu_var(cfd_data);
         csd_lock(&data->csd);
+        BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
 
         data->csd.func = func;
         data->csd.info = info;
         cpumask_and(data->cpumask, mask, cpu_online_mask);
         cpumask_clear_cpu(this_cpu, data->cpumask);
+
+        /*
+         * To ensure the interrupt handler gets an complete view
+         * we order the cpumask and refs writes and order the read
+         * of them in the interrupt handler.  In addition we may
+         * only clear our own cpu bit from the mask.
+         */
+        smp_wmb();
+
         atomic_set(&data->refs, cpumask_weight(data->cpumask));
 
         raw_spin_lock_irqsave(&call_function.lock, flags);
diff --git a/kernel/sys.c b/kernel/sys.c
index 7f5a0cd296a9..66136ca33a7b 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1377,7 +1377,8 @@ static int check_prlimit_permission(struct task_struct *task)
         const struct cred *cred = current_cred(), *tcred;
 
         tcred = __task_cred(task);
-        if ((cred->uid != tcred->euid ||
+        if (current != task &&
+            (cred->uid != tcred->euid ||
              cred->uid != tcred->suid ||
              cred->uid != tcred->uid  ||
              cred->gid != tcred->egid ||
diff --git a/kernel/timer.c b/kernel/timer.c
index 97bf05baade7..102ad370dddb 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1252,6 +1252,12 @@ unsigned long get_next_timer_interrupt(unsigned long now)
         struct tvec_base *base = __get_cpu_var(tvec_bases);
         unsigned long expires;
 
+        /*
+         * Pretend that there is no timer pending if the cpu is offline.
+         * Possible pending timers will be migrated later to an active cpu.
+         */
+        if (cpu_is_offline(smp_processor_id()))
+                return now + NEXT_TIMER_MAX_DELTA;
         spin_lock(&base->lock);
         if (time_before_eq(base->next_timer, base->timer_jiffies))
                 base->next_timer = __next_timer_interrupt(base);
@@ -1316,7 +1322,7 @@ void do_timer(unsigned long ticks)
 {
         jiffies_64 += ticks;
         update_wall_time();
-        calc_global_load();
+        calc_global_load(ticks);
 }
 
 #ifdef __ARCH_WANT_SYS_ALARM
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 9ec59f541156..7702f5aecd07 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2320,11 +2320,19 @@ tracing_write_stub(struct file *filp, const char __user *ubuf,
         return count;
 }
 
+static loff_t tracing_seek(struct file *file, loff_t offset, int origin)
+{
+        if (file->f_mode & FMODE_READ)
+                return seq_lseek(file, offset, origin);
+        else
+                return 0;
+}
+
 static const struct file_operations tracing_fops = {
         .open           = tracing_open,
         .read           = seq_read,
         .write          = tracing_write_stub,
-        .llseek         = seq_lseek,
+        .llseek         = tracing_seek,
         .release        = tracing_release,
 };
 
diff --git a/kernel/user.c b/kernel/user.c
index 7e72614b736d..8ce395f74d47 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -157,6 +157,7 @@ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
                 spin_lock_irq(&uidhash_lock);
                 up = uid_hash_find(uid, hashent);
                 if (up) {
+                        put_user_ns(ns);
                         key_put(new->uid_keyring);
                         key_put(new->session_keyring);
                         kmem_cache_free(uid_cachep, new);
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 7f9c3c52ecc1..e359b2e7e7d5 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -377,7 +377,8 @@ static int watchdog_nmi_enable(int cpu)
                 goto out_save;
         }
 
-        printk(KERN_ERR "NMI watchdog failed to create perf event on cpu%i: %p\n", cpu, event);
+        printk(KERN_ERR "NMI watchdog disabled for cpu%i: unable to create perf event: %ld\n",
+               cpu, PTR_ERR(event));
         return -1;
 
         /* success path */
@@ -440,9 +441,6 @@ static int watchdog_enable(int cpu)
                 wake_up_process(p);
         }
 
-        /* if any cpu succeeds, watchdog is considered enabled for the system */
-        watchdog_enabled = 1;
-
         return 0;
 }
 
@@ -470,12 +468,16 @@ static void watchdog_disable(int cpu)
 static void watchdog_enable_all_cpus(void)
 {
         int cpu;
-        int result = 0;
+
+        watchdog_enabled = 0;
 
         for_each_online_cpu(cpu)
-                result += watchdog_enable(cpu);
+                if (!watchdog_enable(cpu))
+                        /* if any cpu succeeds, watchdog is considered
+                           enabled for the system */
+                        watchdog_enabled = 1;
 
-        if (result)
+        if (!watchdog_enabled)
                 printk(KERN_ERR "watchdog: failed to be enabled on some cpus\n");
 
 }
@@ -503,10 +505,12 @@ int proc_dowatchdog_enabled(struct ctl_table *table, int write,
 {
         proc_dointvec(table, write, buffer, length, ppos);
 
-        if (watchdog_enabled)
-                watchdog_enable_all_cpus();
-        else
-                watchdog_disable_all_cpus();
+        if (write) {
+                if (watchdog_enabled)
+                        watchdog_enable_all_cpus();
+                else
+                        watchdog_disable_all_cpus();
+        }
         return 0;
 }
 
diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index ec9048e74f44..209448e1d2b9 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -76,6 +76,7 @@ int __percpu_counter_init(struct percpu_counter *fbc, s64 amount,
         if (!fbc->counters)
                 return -ENOMEM;
 #ifdef CONFIG_HOTPLUG_CPU
+        INIT_LIST_HEAD(&fbc->list);
         mutex_lock(&percpu_counters_lock);
         list_add(&fbc->list, &percpu_counters);
         mutex_unlock(&percpu_counters_lock);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index efd16fa80b1c..296eb8105cec 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -82,6 +82,16 @@ struct radix_tree_preload {
 };
 static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
 
+static inline void *ptr_to_indirect(void *ptr)
+{
+        return (void *)((unsigned long)ptr | RADIX_TREE_INDIRECT_PTR);
+}
+
+static inline void *indirect_to_ptr(void *ptr)
+{
+        return (void *)((unsigned long)ptr & ~RADIX_TREE_INDIRECT_PTR);
+}
+
 static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
 {
         return root->gfp_mask & __GFP_BITS_MASK;
@@ -265,7 +275,7 @@ static int radix_tree_extend(struct radix_tree_root *root, unsigned long index)
                         return -ENOMEM;
 
                 /* Increase the height.  */
-                node->slots[0] = radix_tree_indirect_to_ptr(root->rnode);
+                node->slots[0] = indirect_to_ptr(root->rnode);
 
                 /* Propagate the aggregated tag info into the new root */
                 for (tag = 0; tag < RADIX_TREE_MAX_TAGS; tag++) {
@@ -276,7 +286,7 @@ static int radix_tree_extend(struct radix_tree_root *root, unsigned long index)
                 newheight = root->height+1;
                 node->height = newheight;
                 node->count = 1;
-                node = radix_tree_ptr_to_indirect(node);
+                node = ptr_to_indirect(node);
                 rcu_assign_pointer(root->rnode, node);
                 root->height = newheight;
         } while (height > root->height);
@@ -309,7 +319,7 @@ int radix_tree_insert(struct radix_tree_root *root,
                         return error;
         }
 
-        slot = radix_tree_indirect_to_ptr(root->rnode);
+        slot = indirect_to_ptr(root->rnode);
 
         height = root->height;
         shift = (height-1) * RADIX_TREE_MAP_SHIFT;
@@ -325,8 +335,7 @@ int radix_tree_insert(struct radix_tree_root *root,
                                 rcu_assign_pointer(node->slots[offset], slot);
                                 node->count++;
                         } else
-                                rcu_assign_pointer(root->rnode,
-                                        radix_tree_ptr_to_indirect(slot));
+                                rcu_assign_pointer(root->rnode, ptr_to_indirect(slot));
                 }
 
                 /* Go a level down */
@@ -374,7 +383,7 @@ static void *radix_tree_lookup_element(struct radix_tree_root *root,
                         return NULL;
                 return is_slot ? (void *)&root->rnode : node;
         }
-        node = radix_tree_indirect_to_ptr(node);
+        node = indirect_to_ptr(node);
 
         height = node->height;
         if (index > radix_tree_maxindex(height))
@@ -393,7 +402,7 @@ static void *radix_tree_lookup_element(struct radix_tree_root *root,
                 height--;
         } while (height > 0);
 
-        return is_slot ? (void *)slot:node;
+        return is_slot ? (void *)slot : indirect_to_ptr(node);
 }
 
 /**
@@ -455,7 +464,7 @@ void *radix_tree_tag_set(struct radix_tree_root *root,
         height = root->height;
         BUG_ON(index > radix_tree_maxindex(height));
 
-        slot = radix_tree_indirect_to_ptr(root->rnode);
+        slot = indirect_to_ptr(root->rnode);
         shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
 
         while (height > 0) {
@@ -509,7 +518,7 @@ void *radix_tree_tag_clear(struct radix_tree_root *root,
 
         shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
         pathp->node = NULL;
-        slot = radix_tree_indirect_to_ptr(root->rnode);
+        slot = indirect_to_ptr(root->rnode);
 
         while (height > 0) {
                 int offset;
@@ -579,7 +588,7 @@ int radix_tree_tag_get(struct radix_tree_root *root,
 
         if (!radix_tree_is_indirect_ptr(node))
                 return (index == 0);
-        node = radix_tree_indirect_to_ptr(node);
+        node = indirect_to_ptr(node);
 
         height = node->height;
         if (index > radix_tree_maxindex(height))
@@ -666,7 +675,7 @@ unsigned long radix_tree_range_tag_if_tagged(struct radix_tree_root *root,
         }
 
         shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
-        slot = radix_tree_indirect_to_ptr(root->rnode);
+        slot = indirect_to_ptr(root->rnode);
 
         /*
          * we fill the path from (root->height - 2) to 0, leaving the index at
@@ -897,7 +906,7 @@ radix_tree_gang_lookup(struct radix_tree_root *root, void **results,
                 results[0] = node;
                 return 1;
         }
-        node = radix_tree_indirect_to_ptr(node);
+        node = indirect_to_ptr(node);
 
         max_index = radix_tree_maxindex(node->height);
 
@@ -916,7 +925,8 @@ radix_tree_gang_lookup(struct radix_tree_root *root, void **results,
                         slot = *(((void ***)results)[ret + i]);
                         if (!slot)
                                 continue;
-                        results[ret + nr_found] = rcu_dereference_raw(slot);
+                        results[ret + nr_found] =
+                                indirect_to_ptr(rcu_dereference_raw(slot));
                         nr_found++;
                 }
                 ret += nr_found;
@@ -965,7 +975,7 @@ radix_tree_gang_lookup_slot(struct radix_tree_root *root, void ***results,
                 results[0] = (void **)&root->rnode;
                 return 1;
         }
-        node = radix_tree_indirect_to_ptr(node);
+        node = indirect_to_ptr(node);
 
         max_index = radix_tree_maxindex(node->height);
 
@@ -1090,7 +1100,7 @@ radix_tree_gang_lookup_tag(struct radix_tree_root *root, void **results,
                 results[0] = node;
                 return 1;
         }
-        node = radix_tree_indirect_to_ptr(node);
+        node = indirect_to_ptr(node);
 
         max_index = radix_tree_maxindex(node->height);
 
@@ -1109,7 +1119,8 @@ radix_tree_gang_lookup_tag(struct radix_tree_root *root, void **results,
                         slot = *(((void ***)results)[ret + i]);
                         if (!slot)
                                 continue;
-                        results[ret + nr_found] = rcu_dereference_raw(slot);
+                        results[ret + nr_found] =
+                                indirect_to_ptr(rcu_dereference_raw(slot));
                         nr_found++;
                 }
                 ret += nr_found;
@@ -1159,7 +1170,7 @@ radix_tree_gang_lookup_tag_slot(struct radix_tree_root *root, void ***results,
                 results[0] = (void **)&root->rnode;
                 return 1;
         }
-        node = radix_tree_indirect_to_ptr(node);
+        node = indirect_to_ptr(node);
 
         max_index = radix_tree_maxindex(node->height);
 
@@ -1195,7 +1206,7 @@ static inline void radix_tree_shrink(struct radix_tree_root *root)
                 void *newptr;
 
                 BUG_ON(!radix_tree_is_indirect_ptr(to_free));
-                to_free = radix_tree_indirect_to_ptr(to_free);
+                to_free = indirect_to_ptr(to_free);
 
                 /*
                  * The candidate node has more than one child, or its child
@@ -1208,16 +1219,39 @@ static inline void radix_tree_shrink(struct radix_tree_root *root)
 
                 /*
                  * We don't need rcu_assign_pointer(), since we are simply
-                 * moving the node from one part of the tree to another. If
-                 * it was safe to dereference the old pointer to it
+                 * moving the node from one part of the tree to another: if it
+                 * was safe to dereference the old pointer to it
                  * (to_free->slots[0]), it will be safe to dereference the new
-                 * one (root->rnode).
+                 * one (root->rnode) as far as dependent read barriers go.
                  */
                 newptr = to_free->slots[0];
                 if (root->height > 1)
-                        newptr = radix_tree_ptr_to_indirect(newptr);
+                        newptr = ptr_to_indirect(newptr);
                 root->rnode = newptr;
                 root->height--;
+
+                /*
+                 * We have a dilemma here. The node's slot[0] must not be
+                 * NULLed in case there are concurrent lookups expecting to
+                 * find the item. However if this was a bottom-level node,
+                 * then it may be subject to the slot pointer being visible
+                 * to callers dereferencing it. If item corresponding to
+                 * slot[0] is subsequently deleted, these callers would expect
+                 * their slot to become empty sooner or later.
+                 *
+                 * For example, lockless pagecache will look up a slot, deref
+                 * the page pointer, and if the page is 0 refcount it means it
+                 * was concurrently deleted from pagecache so try the deref
+                 * again. Fortunately there is already a requirement for logic
+                 * to retry the entire slot lookup -- the indirect pointer
+                 * problem (replacing direct root node with an indirect pointer
+                 * also results in a stale slot). So tag the slot as indirect
+                 * to force callers to retry.
+                 */
+                if (root->height == 0)
+                        *((unsigned long *)&to_free->slots[0]) |=
+                                                RADIX_TREE_INDIRECT_PTR;
+
                 radix_tree_node_free(to_free);
         }
 }
@@ -1254,7 +1288,7 @@ void *radix_tree_delete(struct radix_tree_root *root, unsigned long index)
                 root->rnode = NULL;
                 goto out;
         }
-        slot = radix_tree_indirect_to_ptr(slot);
+        slot = indirect_to_ptr(slot);
 
         shift = (height - 1) * RADIX_TREE_MAP_SHIFT;
         pathp->node = NULL;
@@ -1296,8 +1330,7 @@ void *radix_tree_delete(struct radix_tree_root *root, unsigned long index)
                         radix_tree_node_free(to_free);
 
                 if (pathp->node->count) {
-                        if (pathp->node ==
-                                        radix_tree_indirect_to_ptr(root->rnode))
+                        if (pathp->node == indirect_to_ptr(root->rnode))
                                 radix_tree_shrink(root);
                         goto out;
                 }
diff --git a/mm/filemap.c b/mm/filemap.c
index 3d4df44e4221..9701a501f769 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -631,7 +631,9 @@ repeat:
         pagep = radix_tree_lookup_slot(&mapping->page_tree, offset);
         if (pagep) {
                 page = radix_tree_deref_slot(pagep);
-                if (unlikely(!page || page == RADIX_TREE_RETRY))
+                if (unlikely(!page))
+                        goto out;
+                if (radix_tree_deref_retry(page))
                         goto repeat;
 
                 if (!page_cache_get_speculative(page))
@@ -647,6 +649,7 @@ repeat:
                         goto repeat;
                 }
         }
+out:
         rcu_read_unlock();
 
         return page;
@@ -764,12 +767,11 @@ repeat:
                 page = radix_tree_deref_slot((void **)pages[i]);
                 if (unlikely(!page))
                         continue;
-                /*
-                 * this can only trigger if nr_found == 1, making livelock
-                 * a non issue.
-                 */
-                if (unlikely(page == RADIX_TREE_RETRY))
+                if (radix_tree_deref_retry(page)) {
+                        if (ret)
+                                start = pages[ret-1]->index;
                         goto restart;
+                }
 
                 if (!page_cache_get_speculative(page))
                         goto repeat;
@@ -817,11 +819,7 @@ repeat:
                 page = radix_tree_deref_slot((void **)pages[i]);
                 if (unlikely(!page))
                         continue;
-                /*
-                 * this can only trigger if nr_found == 1, making livelock
-                 * a non issue.
-                 */
-                if (unlikely(page == RADIX_TREE_RETRY))
+                if (radix_tree_deref_retry(page))
                         goto restart;
 
                 if (page->mapping == NULL || page->index != index)
@@ -874,11 +872,7 @@ repeat:
                 page = radix_tree_deref_slot((void **)pages[i]);
                 if (unlikely(!page))
                         continue;
-                /*
-                 * this can only trigger if nr_found == 1, making livelock
-                 * a non issue.
-                 */
-                if (unlikely(page == RADIX_TREE_RETRY))
+                if (radix_tree_deref_retry(page))
                         goto restart;
 
                 if (!page_cache_get_speculative(page))
@@ -1016,6 +1010,9 @@ find_page:
                                 goto page_not_up_to_date;
                         if (!trylock_page(page))
                                 goto page_not_up_to_date;
+                        /* Did it get truncated before we got the lock? */
+                        if (!page->mapping)
+                                goto page_not_up_to_date_locked;
                         if (!mapping->a_ops->is_partially_uptodate(page,
                                                                 desc, offset))
                                 goto page_not_up_to_date_locked;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index c03273807182..2697806746d0 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2380,8 +2380,11 @@ retry_avoidcopy:
          * When the original hugepage is shared one, it does not have
          * anon_vma prepared.
          */
-        if (unlikely(anon_vma_prepare(vma)))
+        if (unlikely(anon_vma_prepare(vma))) {
+                /* Caller expects lock to be held */
+                spin_lock(&mm->page_table_lock);
                 return VM_FAULT_OOM;
+        }
 
         copy_huge_page(new_page, old_page, address, vma);
         __SetPageUptodate(new_page);
@@ -2665,7 +2668,8 @@ out_page_table_lock:
                 unlock_page(pagecache_page);
                 put_page(pagecache_page);
         }
-        unlock_page(page);
+        if (page != pagecache_page)
+                unlock_page(page);
 
 out_mutex:
         mutex_unlock(&hugetlb_instantiation_mutex);
diff --git a/mm/internal.h b/mm/internal.h
index 6a697bb97fc5..dedb0aff673f 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -62,7 +62,7 @@ extern bool is_free_buddy_page(struct page *page);
  */
 static inline unsigned long page_order(struct page *page)
 {
-        VM_BUG_ON(!PageBuddy(page));
+        /* PageBuddy() must be checked by the caller */
         return page_private(page);
 }
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9be3cf8a5da4..a9a534a38ac0 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -269,13 +269,14 @@ enum move_type {
 
 /* "mc" and its members are protected by cgroup_mutex */
 static struct move_charge_struct {
-        spinlock_t        lock; /* for from, to, moving_task */
+        spinlock_t        lock; /* for from, to */
         struct mem_cgroup *from;
         struct mem_cgroup *to;
         unsigned long precharge;
         unsigned long moved_charge;
         unsigned long moved_swap;
         struct task_struct *moving_task;        /* a task moving charges */
+        struct mm_struct *mm;
         wait_queue_head_t waitq;                /* a waitq for other context */
 } mc = {
         .lock = __SPIN_LOCK_UNLOCKED(mc.lock),
@@ -1646,6 +1647,7 @@ static int __mem_cgroup_do_charge(struct mem_cgroup *mem, gfp_t gfp_mask,
                 if (likely(!ret))
                         return CHARGE_OK;
 
+                res_counter_uncharge(&mem->res, csize);
                 mem_over_limit = mem_cgroup_from_res_counter(fail_res, memsw);
                 flags |= MEM_CGROUP_RECLAIM_NOSWAP;
         } else
@@ -1729,19 +1731,18 @@ again:
 
                 rcu_read_lock();
                 p = rcu_dereference(mm->owner);
-                VM_BUG_ON(!p);
                 /*
-                 * because we don't have task_lock(), "p" can exit while
-                 * we're here. In that case, "mem" can point to root
-                 * cgroup but never be NULL. (and task_struct itself is freed
-                 * by RCU, cgroup itself is RCU safe.) Then, we have small
-                 * risk here to get wrong cgroup. But such kind of mis-account
-                 * by race always happens because we don't have cgroup_mutex().
-                 * It's overkill and we allow that small race, here.
+                 * Because we don't have task_lock(), "p" can exit.
+                 * In that case, "mem" can point to root or p can be NULL with
+                 * race with swapoff. Then, we have small risk of mis-accouning.
+                 * But such kind of mis-account by race always happens because
+                 * we don't have cgroup_mutex(). It's overkill and we allo that
+                 * small race, here.
+                 * (*) swapoff at el will charge against mm-struct not against
+                 * task-struct. So, mm->owner can be NULL.
                  */
                 mem = mem_cgroup_from_task(p);
-                VM_BUG_ON(!mem);
-                if (mem_cgroup_is_root(mem)) {
+                if (!mem || mem_cgroup_is_root(mem)) {
                         rcu_read_unlock();
                         goto done;
                 }
@@ -4445,7 +4446,7 @@ static unsigned long mem_cgroup_count_precharge(struct mm_struct *mm)
         unsigned long precharge;
         struct vm_area_struct *vma;
 
-        down_read(&mm->mmap_sem);
+        /* We've already held the mmap_sem */
         for (vma = mm->mmap; vma; vma = vma->vm_next) {
                 struct mm_walk mem_cgroup_count_precharge_walk = {
                         .pmd_entry = mem_cgroup_count_precharge_pte_range,
@@ -4457,7 +4458,6 @@ static unsigned long mem_cgroup_count_precharge(struct mm_struct *mm)
                 walk_page_range(vma->vm_start, vma->vm_end,
                                         &mem_cgroup_count_precharge_walk);
         }
-        up_read(&mm->mmap_sem);
 
         precharge = mc.precharge;
         mc.precharge = 0;
@@ -4508,11 +4508,16 @@ static void mem_cgroup_clear_mc(void)
 
                 mc.moved_swap = 0;
         }
+        if (mc.mm) {
+                up_read(&mc.mm->mmap_sem);
+                mmput(mc.mm);
+        }
         spin_lock(&mc.lock);
         mc.from = NULL;
         mc.to = NULL;
-        mc.moving_task = NULL;
         spin_unlock(&mc.lock);
+        mc.moving_task = NULL;
+        mc.mm = NULL;
         memcg_oom_recover(from);
         memcg_oom_recover(to);
         wake_up_all(&mc.waitq);
@@ -4537,26 +4542,37 @@ static int mem_cgroup_can_attach(struct cgroup_subsys *ss,
                         return 0;
                 /* We move charges only when we move a owner of the mm */
                 if (mm->owner == p) {
+                        /*
+                         * We do all the move charge works under one mmap_sem to
+                         * avoid deadlock with down_write(&mmap_sem)
+                         * -> try_charge() -> if (mc.moving_task) -> sleep.
+                         */
+                        down_read(&mm->mmap_sem);
+
                         VM_BUG_ON(mc.from);
                         VM_BUG_ON(mc.to);
                         VM_BUG_ON(mc.precharge);
                         VM_BUG_ON(mc.moved_charge);
                         VM_BUG_ON(mc.moved_swap);
                         VM_BUG_ON(mc.moving_task);
+                        VM_BUG_ON(mc.mm);
+
                         spin_lock(&mc.lock);
                         mc.from = from;
                         mc.to = mem;
                         mc.precharge = 0;
                         mc.moved_charge = 0;
                         mc.moved_swap = 0;
-                        mc.moving_task = current;
                         spin_unlock(&mc.lock);
+                        mc.moving_task = current;
+                        mc.mm = mm;
 
                         ret = mem_cgroup_precharge_mc(mm);
                         if (ret)
                                 mem_cgroup_clear_mc();
-                }
-                mmput(mm);
+                        /* We call up_read() and mmput() in clear_mc(). */
+                } else
+                        mmput(mm);
         }
         return ret;
 }
@@ -4644,7 +4660,7 @@ static void mem_cgroup_move_charge(struct mm_struct *mm)
         struct vm_area_struct *vma;
 
         lru_add_drain_all();
-        down_read(&mm->mmap_sem);
+        /* We've already held the mmap_sem */
         for (vma = mm->mmap; vma; vma = vma->vm_next) {
                 int ret;
                 struct mm_walk mem_cgroup_move_charge_walk = {
@@ -4663,7 +4679,6 @@ static void mem_cgroup_move_charge(struct mm_struct *mm)
                          */
                         break;
         }
-        up_read(&mm->mmap_sem);
 }
 
 static void mem_cgroup_move_task(struct cgroup_subsys *ss,
@@ -4672,17 +4687,11 @@ static void mem_cgroup_move_task(struct cgroup_subsys *ss,
                                 struct task_struct *p,
                                 bool threadgroup)
 {
-        struct mm_struct *mm;
-
-        if (!mc.to)
+        if (!mc.mm)
                 /* no need to move charge */
                 return;
 
-        mm = get_task_mm(p);
-        if (mm) {
-                mem_cgroup_move_charge(mm);
-                mmput(mm);
-        }
+        mem_cgroup_move_charge(mc.mm);
         mem_cgroup_clear_mc();
 }
 #else   /* !CONFIG_MMU */
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index dd186c1a5d53..6345dfe78d2c 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -659,7 +659,7 @@ static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
  * Scanning pfn is much easier than scanning lru list.
  * Scan pfn from start to end and Find LRU page.
  */
-int scan_lru_pages(unsigned long start, unsigned long end)
+unsigned long scan_lru_pages(unsigned long start, unsigned long end)
 {
         unsigned long pfn;
         struct page *page;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index f969da5dd8a2..c1002c68d617 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1588,7 +1588,7 @@ unsigned slab_node(struct mempolicy *policy)
                 (void)first_zones_zonelist(zonelist, highest_zoneidx,
                                                         &policy->v.nodes,
                                                         &zone);
-                return zone->node;
+                return zone ? zone->node : numa_node_id();
         }
 
         default:
diff --git a/mm/migrate.c b/mm/migrate.c
index 38e7cad782f4..2cfa9bf1f0d4 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -553,7 +553,6 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         int *result = NULL;
         struct page *newpage = get_new_page(page, private, &result);
         int remap_swapcache = 1;
-        int rcu_locked = 0;
         int charge = 0;
         struct mem_cgroup *mem = NULL;
         struct anon_vma *anon_vma = NULL;
@@ -605,20 +604,26 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         /*
          * By try_to_unmap(), page->mapcount goes down to 0 here. In this case,
          * we cannot notice that anon_vma is freed while we migrates a page.
-         * This rcu_read_lock() delays freeing anon_vma pointer until the end
+         * This get_anon_vma() delays freeing anon_vma pointer until the end
          * of migration. File cache pages are no problem because of page_lock()
          * File Caches may use write_page() or lock_page() in migration, then,
          * just care Anon page here.
          */
         if (PageAnon(page)) {
-                rcu_read_lock();
-                rcu_locked = 1;
-
-                /* Determine how to safely use anon_vma */
-                if (!page_mapped(page)) {
-                        if (!PageSwapCache(page))
-                                goto rcu_unlock;
-
+                /*
+                 * Only page_lock_anon_vma() understands the subtleties of
+                 * getting a hold on an anon_vma from outside one of its mms.
+                 */
+                anon_vma = page_lock_anon_vma(page);
+                if (anon_vma) {
+                        /*
+                         * Take a reference count on the anon_vma if the
+                         * page is mapped so that it is guaranteed to
+                         * exist when the page is remapped later
+                         */
+                        get_anon_vma(anon_vma);
+                        page_unlock_anon_vma(anon_vma);
+                } else if (PageSwapCache(page)) {
                         /*
                          * We cannot be sure that the anon_vma of an unmapped
                          * swapcache page is safe to use because we don't
@@ -633,13 +638,7 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
                          */
                         remap_swapcache = 0;
                 } else {
-                        /*
-                         * Take a reference count on the anon_vma if the
-                         * page is mapped so that it is guaranteed to
-                         * exist when the page is remapped later
-                         */
-                        anon_vma = page_anon_vma(page);
-                        get_anon_vma(anon_vma);
+                        goto uncharge;
                 }
         }
 
@@ -656,16 +655,10 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
          * free the metadata, so the page can be freed.
          */
         if (!page->mapping) {
-                if (!PageAnon(page) && page_has_private(page)) {
-                        /*
-                         * Go direct to try_to_free_buffers() here because
-                         * a) that's what try_to_release_page() would do anyway
-                         * b) we may be under rcu_read_lock() here, so we can't
-                         *    use GFP_KERNEL which is what try_to_release_page()
-                         *    needs to be effective.
-                         */
+                VM_BUG_ON(PageAnon(page));
+                if (page_has_private(page)) {
                         try_to_free_buffers(page);
-                        goto rcu_unlock;
+                        goto uncharge;
                 }
                 goto skip_unmap;
         }
@@ -679,14 +672,11 @@ skip_unmap:
 
         if (rc && remap_swapcache)
                 remove_migration_ptes(page, page);
-rcu_unlock:
 
         /* Drop an anon_vma reference if we took one */
         if (anon_vma)
                 drop_anon_vma(anon_vma);
 
-        if (rcu_locked)
-                rcu_read_unlock();
 uncharge:
         if (!charge)
                 mem_cgroup_end_migration(mem, page, newpage);
diff --git a/mm/mmap.c b/mm/mmap.c
index 00161a48a451..283a0a84ea2c 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2460,6 +2460,7 @@ int install_special_mapping(struct mm_struct *mm,
                             unsigned long addr, unsigned long len,
                             unsigned long vm_flags, struct page **pages)
 {
+        int ret;
         struct vm_area_struct *vma;
 
         vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
@@ -2477,16 +2478,23 @@ int install_special_mapping(struct mm_struct *mm,
         vma->vm_ops = &special_mapping_vmops;
         vma->vm_private_data = pages;
 
-        if (unlikely(insert_vm_struct(mm, vma))) {
-                kmem_cache_free(vm_area_cachep, vma);
-                return -ENOMEM;
-        }
+        ret = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
+        if (ret)
+                goto out;
+
+        ret = insert_vm_struct(mm, vma);
+        if (ret)
+                goto out;
 
         mm->total_vm += len >> PAGE_SHIFT;
 
         perf_event_mmap(vma);
 
         return 0;
+
+out:
+        kmem_cache_free(vm_area_cachep, vma);
+        return ret;
 }
 
 static DEFINE_MUTEX(mm_all_locks_mutex);
diff --git a/mm/mmzone.c b/mm/mmzone.c
index e35bfb82c855..f5b7d1760213 100644
--- a/mm/mmzone.c
+++ b/mm/mmzone.c
@@ -87,24 +87,3 @@ int memmap_valid_within(unsigned long pfn,
         return 1;
 }
 #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
-
-#ifdef CONFIG_SMP
-/* Called when a more accurate view of NR_FREE_PAGES is needed */
-unsigned long zone_nr_free_pages(struct zone *zone)
-{
-        unsigned long nr_free_pages = zone_page_state(zone, NR_FREE_PAGES);
-
-        /*
-         * While kswapd is awake, it is considered the zone is under some
-         * memory pressure. Under pressure, there is a risk that
-         * per-cpu-counter-drift will allow the min watermark to be breached
-         * potentially causing a live-lock. While kswapd is awake and
-         * free pages are low, get a better estimate for free pages
-         */
-        if (nr_free_pages < zone->percpu_drift_mark &&
-                        !waitqueue_active(&zone->zone_pgdat->kswapd_wait))
-                return zone_page_state_snapshot(zone, NR_FREE_PAGES);
-
-        return nr_free_pages;
-}
-#endif /* CONFIG_SMP */
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 2d1bf7cf8851..4c5133873097 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -211,6 +211,7 @@ success:
         mmu_notifier_invalidate_range_end(mm, start, end);
         vm_stat_account(mm, oldflags, vma->vm_file, -nrpages);
         vm_stat_account(mm, newflags, vma->vm_file, nrpages);
+        perf_event_mmap(vma);
         return 0;
 
 fail:
@@ -299,7 +300,6 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
                 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
                 if (error)
                         goto out;
-                perf_event_mmap(vma);
                 nstart = tmp;
 
                 if (nstart < prev->vm_end)
diff --git a/mm/nommu.c b/mm/nommu.c
index 88ff091eb07a..acb3bd3c1cb9 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1668,6 +1668,7 @@ void exit_mmap(struct mm_struct *mm)
                 mm->mmap = vma->vm_next;
                 delete_vma_from_mm(vma);
                 delete_vma(mm, vma);
+                cond_resched();
         }
 
         kleave("");
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index f12ad1836abe..985e072a3dd9 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -103,19 +103,24 @@ gfp_t gfp_allowed_mask __read_mostly = GFP_BOOT_MASK;
  * only be modified with pm_mutex held, unless the suspend/hibernate code is
  * guaranteed not to run in parallel with that modification).
  */
-void set_gfp_allowed_mask(gfp_t mask)
+
+static gfp_t saved_gfp_mask;
+
+void pm_restore_gfp_mask(void)
 {
         WARN_ON(!mutex_is_locked(&pm_mutex));
-        gfp_allowed_mask = mask;
+        if (saved_gfp_mask) {
+                gfp_allowed_mask = saved_gfp_mask;
+                saved_gfp_mask = 0;
+        }
 }
 
-gfp_t clear_gfp_allowed_mask(gfp_t mask)
+void pm_restrict_gfp_mask(void)
 {
-        gfp_t ret = gfp_allowed_mask;
-
         WARN_ON(!mutex_is_locked(&pm_mutex));
-        gfp_allowed_mask &= ~mask;
-        return ret;
+        WARN_ON(saved_gfp_mask);
+        saved_gfp_mask = gfp_allowed_mask;
+        gfp_allowed_mask &= ~GFP_IOFS;
 }
 #endif /* CONFIG_PM_SLEEP */
 
@@ -530,7 +535,7 @@ static inline void __free_one_page(struct page *page,
          * so it's less likely to be used soon and more likely to be merged
          * as a higher order page
          */
-        if ((order < MAX_ORDER-1) && pfn_valid_within(page_to_pfn(buddy))) {
+        if ((order < MAX_ORDER-2) && pfn_valid_within(page_to_pfn(buddy))) {
                 struct page *higher_page, *higher_buddy;
                 combined_idx = __find_combined_index(page_idx, order);
                 higher_page = page + combined_idx - page_idx;
@@ -1454,24 +1459,24 @@ static inline int should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
 #endif /* CONFIG_FAIL_PAGE_ALLOC */
 
 /*
- * Return 1 if free pages are above 'mark'. This takes into account the order
+ * Return true if free pages are above 'mark'. This takes into account the order
  * of the allocation.
  */
-int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
-                      int classzone_idx, int alloc_flags)
+static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark,
+                      int classzone_idx, int alloc_flags, long free_pages)
 {
         /* free_pages my go negative - that's OK */
         long min = mark;
-        long free_pages = zone_nr_free_pages(z) - (1 << order) + 1;
         int o;
 
+        free_pages -= (1 << order) + 1;
         if (alloc_flags & ALLOC_HIGH)
                 min -= min / 2;
         if (alloc_flags & ALLOC_HARDER)
                 min -= min / 4;
 
         if (free_pages <= min + z->lowmem_reserve[classzone_idx])
-                return 0;
+                return false;
         for (o = 0; o < order; o++) {
                 /* At the next order, this order's pages become unavailable */
                 free_pages -= z->free_area[o].nr_free << o;
@@ -1480,9 +1485,28 @@ int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
                 min >>= 1;
 
                 if (free_pages <= min)
-                        return 0;
+                        return false;
         }
-        return 1;
+        return true;
+}
+
+bool zone_watermark_ok(struct zone *z, int order, unsigned long mark,
+                      int classzone_idx, int alloc_flags)
+{
+        return __zone_watermark_ok(z, order, mark, classzone_idx, alloc_flags,
+                                        zone_page_state(z, NR_FREE_PAGES));
+}
+
+bool zone_watermark_ok_safe(struct zone *z, int order, unsigned long mark,
+                      int classzone_idx, int alloc_flags)
+{
+        long free_pages = zone_page_state(z, NR_FREE_PAGES);
+
+        if (z->percpu_drift_mark && free_pages < z->percpu_drift_mark)
+                free_pages = zone_page_state_snapshot(z, NR_FREE_PAGES);
+
+        return __zone_watermark_ok(z, order, mark, classzone_idx, alloc_flags,
+                                                                free_pages);
 }
 
 #ifdef CONFIG_NUMA
@@ -2436,7 +2460,7 @@ void show_free_areas(void)
                         " all_unreclaimable? %s"
                         "\n",
                         zone->name,
-                        K(zone_nr_free_pages(zone)),
+                        K(zone_page_state(zone, NR_FREE_PAGES)),
                         K(min_wmark_pages(zone)),
                         K(low_wmark_pages(zone)),
                         K(high_wmark_pages(zone)),
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 6b8889da69a6..d8087f0db507 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -517,6 +517,15 @@ static atomic_t vmap_lazy_nr = ATOMIC_INIT(0);
 static void purge_fragmented_blocks_allcpus(void);
 
 /*
+ * called before a call to iounmap() if the caller wants vm_area_struct's
+ * immediately freed.
+ */
+void set_iounmap_nonlazy(void)
+{
+        atomic_set(&vmap_lazy_nr, lazy_max_pages()+1);
+}
+
+/*
  * Purges all lazily-freed vmap areas.
  *
  * If sync is 0 then don't purge if there is already a purge in progress.
diff --git a/mm/vmscan.c b/mm/vmscan.c
index c5dfabf25f11..3e71cb1ee28c 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2082,7 +2082,7 @@ static int sleeping_prematurely(pg_data_t *pgdat, int order, long remaining)
                 if (zone->all_unreclaimable)
                         continue;
 
-                if (!zone_watermark_ok(zone, order, high_wmark_pages(zone),
+                if (!zone_watermark_ok_safe(zone, order, high_wmark_pages(zone),
                                                                 0, 0))
                         return 1;
         }
@@ -2169,7 +2169,7 @@ loop_again:
                                 shrink_active_list(SWAP_CLUSTER_MAX, zone,
                                                         &sc, priority, 0);
 
-                        if (!zone_watermark_ok(zone, order,
+                        if (!zone_watermark_ok_safe(zone, order,
                                         high_wmark_pages(zone), 0, 0)) {
                                 end_zone = i;
                                 break;
@@ -2215,7 +2215,7 @@ loop_again:
                          * We put equal pressure on every zone, unless one
                          * zone has way too many pages free already.
                          */
-                        if (!zone_watermark_ok(zone, order,
+                        if (!zone_watermark_ok_safe(zone, order,
                                         8*high_wmark_pages(zone), end_zone, 0))
                                 shrink_zone(priority, zone, &sc);
                         reclaim_state->reclaimed_slab = 0;
@@ -2236,7 +2236,7 @@ loop_again:
                             total_scanned > sc.nr_reclaimed + sc.nr_reclaimed / 2)
                                 sc.may_writepage = 1;
 
-                        if (!zone_watermark_ok(zone, order,
+                        if (!zone_watermark_ok_safe(zone, order,
                                         high_wmark_pages(zone), end_zone, 0)) {
                                 all_zones_ok = 0;
                                 /*
@@ -2244,7 +2244,7 @@ loop_again:
                                  * means that we have a GFP_ATOMIC allocation
                                  * failure risk. Hurry up!
                                  */
-                                if (!zone_watermark_ok(zone, order,
+                                if (!zone_watermark_ok_safe(zone, order,
                                             min_wmark_pages(zone), end_zone, 0))
                                         has_under_min_watermark_zone = 1;
                         }
@@ -2378,7 +2378,9 @@ static int kswapd(void *p)
                                  */
                                 if (!sleeping_prematurely(pgdat, order, remaining)) {
                                         trace_mm_vmscan_kswapd_sleep(pgdat->node_id);
+                                        restore_pgdat_percpu_threshold(pgdat);
                                         schedule();
+                                        reduce_pgdat_percpu_threshold(pgdat);
                                 } else {
                                         if (remaining)
                                                 count_vm_event(KSWAPD_LOW_WMARK_HIT_QUICKLY);
@@ -2417,16 +2419,17 @@ void wakeup_kswapd(struct zone *zone, int order)
         if (!populated_zone(zone))
                 return;
 
-        pgdat = zone->zone_pgdat;
-        if (zone_watermark_ok(zone, order, low_wmark_pages(zone), 0, 0))
+        if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
                 return;
+        pgdat = zone->zone_pgdat;
         if (pgdat->kswapd_max_order < order)
                 pgdat->kswapd_max_order = order;
-        trace_mm_vmscan_wakeup_kswapd(pgdat->node_id, zone_idx(zone), order);
-        if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
-                return;
         if (!waitqueue_active(&pgdat->kswapd_wait))
                 return;
+        if (zone_watermark_ok_safe(zone, order, low_wmark_pages(zone), 0, 0))
+                return;
+
+        trace_mm_vmscan_wakeup_kswapd(pgdat->node_id, zone_idx(zone), order);
         wake_up_interruptible(&pgdat->kswapd_wait);
 }
 
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 355a9e669aaa..4d7faebb9b70 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -81,6 +81,30 @@ EXPORT_SYMBOL(vm_stat);
 
 #ifdef CONFIG_SMP
 
+static int calculate_pressure_threshold(struct zone *zone)
+{
+        int threshold;
+        int watermark_distance;
+
+        /*
+         * As vmstats are not up to date, there is drift between the estimated
+         * and real values. For high thresholds and a high number of CPUs, it
+         * is possible for the min watermark to be breached while the estimated
+         * value looks fine. The pressure threshold is a reduced value such
+         * that even the maximum amount of drift will not accidentally breach
+         * the min watermark
+         */
+        watermark_distance = low_wmark_pages(zone) - min_wmark_pages(zone);
+        threshold = max(1, (int)(watermark_distance / num_online_cpus()));
+
+        /*
+         * Maximum threshold is 125
+         */
+        threshold = min(125, threshold);
+
+        return threshold;
+}
+
 static int calculate_threshold(struct zone *zone)
 {
         int threshold;
@@ -159,6 +183,48 @@ static void refresh_zone_stat_thresholds(void)
         }
 }
 
+void reduce_pgdat_percpu_threshold(pg_data_t *pgdat)
+{
+        struct zone *zone;
+        int cpu;
+        int threshold;
+        int i;
+
+        get_online_cpus();
+        for (i = 0; i < pgdat->nr_zones; i++) {
+                zone = &pgdat->node_zones[i];
+                if (!zone->percpu_drift_mark)
+                        continue;
+
+                threshold = calculate_pressure_threshold(zone);
+                for_each_online_cpu(cpu)
+                        per_cpu_ptr(zone->pageset, cpu)->stat_threshold
+                                                        = threshold;
+        }
+        put_online_cpus();
+}
+
+void restore_pgdat_percpu_threshold(pg_data_t *pgdat)
+{
+        struct zone *zone;
+        int cpu;
+        int threshold;
+        int i;
+
+        get_online_cpus();
+        for (i = 0; i < pgdat->nr_zones; i++) {
+                zone = &pgdat->node_zones[i];
+                if (!zone->percpu_drift_mark)
+                        continue;
+
+                threshold = calculate_threshold(zone);
+                for_each_online_cpu(cpu)
+                        per_cpu_ptr(zone->pageset, cpu)->stat_threshold
+                                                        = threshold;
+        }
+        put_online_cpus();
+}
+
 /*
  * For use when we know that interrupts are disabled.
  */
@@ -826,7 +892,7 @@ static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat,
                    "\n        scanned  %lu"
                    "\n        spanned  %lu"
                    "\n        present  %lu",
-                   zone_nr_free_pages(zone),
+                   zone_page_state(zone, NR_FREE_PAGES),
                    min_wmark_pages(zone),
                    low_wmark_pages(zone),
                    high_wmark_pages(zone),
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 0eb96f7e44be..2dcff0be8acb 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -43,6 +43,9 @@ int vlan_hwaccel_do_receive(struct sk_buff *skb)
         struct net_device *dev = skb->dev;
         struct vlan_rx_stats     *rx_stats;
 
+        if (unlikely(!is_vlan_dev(dev)))
+                return 0;
+
         skb->dev = vlan_dev_info(dev)->real_dev;
         netif_nit_deliver(skb);
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index cfdfd7e2a172..6e2371a493b7 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1392,6 +1392,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
         ax25_cb *ax25;
         int err = 0;
 
+        memset(fsa, 0, sizeof(fsa));
         lock_sock(sk);
         ax25 = ax25_sk(sk);
 
@@ -1403,7 +1404,6 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
 
                 fsa->fsa_ax25.sax25_family = AF_AX25;
                 fsa->fsa_ax25.sax25_call   = ax25->dest_addr;
-                fsa->fsa_ax25.sax25_ndigis = 0;
 
                 if (ax25->digipeat != NULL) {
                         ndigi = ax25->digipeat->ndigi;
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 0b54b7dd8401..dc6020570a32 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2891,7 +2891,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         struct l2cap_chan_list *list = &conn->chan_list;
         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
         struct l2cap_conn_rsp rsp;
-        struct sock *parent, *uninitialized_var(sk);
+        struct sock *parent, *sk = NULL;
         int result, status = L2CAP_CS_NO_INFO;
 
         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
@@ -3000,7 +3000,7 @@ sendresp:
                                         L2CAP_INFO_REQ, sizeof(info), &info);
         }
 
-        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
+        if (sk && !(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
                                 result == L2CAP_CR_SUCCESS) {
                 u8 buf[128];
                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index eb5b256ffc88..f19e347f56f6 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -437,7 +437,7 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         ip6h = ipv6_hdr(skb);
 
         *(__force __be32 *)ip6h = htonl(0x60000000);
-        ip6h->payload_len = 8 + sizeof(*mldq);
+        ip6h->payload_len = htons(8 + sizeof(*mldq));
         ip6h->nexthdr = IPPROTO_HOPOPTS;
         ip6h->hop_limit = 1;
         ipv6_addr_set(&ip6h->saddr, 0, 0, 0, 0);
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 08ffe9e4be20..6faa8256e10c 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -125,7 +125,7 @@ struct bcm_sock {
         struct list_head tx_ops;
         unsigned long dropped_usr_msgs;
         struct proc_dir_entry *bcm_proc_read;
-        char procname [9]; /* pointer printed in ASCII with \0 */
+        char procname [20]; /* pointer printed in ASCII with \0 */
 };
 
 static inline struct bcm_sock *bcm_sk(const struct sock *sk)
diff --git a/net/compat.c b/net/compat.c
index 63d260e81472..3649d5895361 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -41,10 +41,12 @@ static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
                 compat_size_t len;
 
                 if (get_user(len, &uiov32->iov_len) ||
-                   get_user(buf, &uiov32->iov_base)) {
-                        tot_len = -EFAULT;
-                        break;
-                }
+                    get_user(buf, &uiov32->iov_base))
+                        return -EFAULT;
+
+                if (len > INT_MAX - tot_len)
+                        len = INT_MAX - tot_len;
+
                 tot_len += len;
                 kiov->iov_base = compat_ptr(buf);
                 kiov->iov_len = (__kernel_size_t) len;
diff --git a/net/core/dev.c b/net/core/dev.c
index 660dd41aaaa6..1dad6c0926f2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1648,10 +1648,10 @@ EXPORT_SYMBOL(netif_device_attach);
 
 static bool can_checksum_protocol(unsigned long features, __be16 protocol)
 {
-        return ((features & NETIF_F_GEN_CSUM) ||
-                ((features & NETIF_F_IP_CSUM) &&
+        return ((features & NETIF_F_NO_CSUM) ||
+                ((features & NETIF_F_V4_CSUM) &&
                  protocol == htons(ETH_P_IP)) ||
-                ((features & NETIF_F_IPV6_CSUM) &&
+                ((features & NETIF_F_V6_CSUM) &&
                  protocol == htons(ETH_P_IPV6)) ||
                 ((features & NETIF_F_FCOE_CRC) &&
                  protocol == htons(ETH_P_FCOE)));
@@ -2891,6 +2891,15 @@ static int __netif_receive_skb(struct sk_buff *skb)
 ncls:
 #endif
 
+        /* If we got this far with a hardware accelerated VLAN tag, it means
+         * that we were put in promiscuous mode but nobody is interested in
+         * this vid. Drop the packet now to prevent it from getting propagated
+         * to other parts of the stack that won't know how to deal with packets
+         * tagged in this manner.
+         */
+        if (unlikely(vlan_tx_tag_present(skb)))
+                goto bypass;
+
         /* Handle special case of bridge or macvlan */
         rx_handler = rcu_dereference(skb->dev->rx_handler);
         if (rx_handler) {
@@ -2927,6 +2936,7 @@ ncls:
                 }
         }
 
+bypass:
         if (pt_prev) {
                 ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
         } else {
diff --git a/net/core/dst.c b/net/core/dst.c
index 6c41b1fac3db..2844639dfb79 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -343,6 +343,7 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event,
 
 static struct notifier_block dst_dev_notifier = {
         .notifier_call  = dst_dev_event,
+        .priority = -10, /* must be called after other network notifiers */
 };
 
 void __init dst_init(void)
diff --git a/net/core/filter.c b/net/core/filter.c
index 52b051f82a01..71a433cdf7d3 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -112,39 +112,41 @@ EXPORT_SYMBOL(sk_filter);
  */
 unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
 {
-        struct sock_filter *fentry;     /* We walk down these */
         void *ptr;
         u32 A = 0;                      /* Accumulator */
         u32 X = 0;                      /* Index Register */
         u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
+        unsigned long memvalid = 0;
         u32 tmp;
         int k;
         int pc;
 
+        BUILD_BUG_ON(BPF_MEMWORDS > BITS_PER_LONG);
         /*
          * Process array of filter instructions.
          */
         for (pc = 0; pc < flen; pc++) {
-                fentry = &filter[pc];
+                const struct sock_filter *fentry = &filter[pc];
+                u32 f_k = fentry->k;
 
                 switch (fentry->code) {
                 case BPF_S_ALU_ADD_X:
                         A += X;
                         continue;
                 case BPF_S_ALU_ADD_K:
-                        A += fentry->k;
+                        A += f_k;
                         continue;
                 case BPF_S_ALU_SUB_X:
                         A -= X;
                         continue;
                 case BPF_S_ALU_SUB_K:
-                        A -= fentry->k;
+                        A -= f_k;
                         continue;
                 case BPF_S_ALU_MUL_X:
                         A *= X;
                         continue;
                 case BPF_S_ALU_MUL_K:
-                        A *= fentry->k;
+                        A *= f_k;
                         continue;
                 case BPF_S_ALU_DIV_X:
                         if (X == 0)
@@ -152,49 +154,49 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
                         A /= X;
                         continue;
                 case BPF_S_ALU_DIV_K:
-                        A /= fentry->k;
+                        A /= f_k;
                         continue;
                 case BPF_S_ALU_AND_X:
                         A &= X;
                         continue;
                 case BPF_S_ALU_AND_K:
-                        A &= fentry->k;
+                        A &= f_k;
                         continue;
                 case BPF_S_ALU_OR_X:
                         A |= X;
                         continue;
                 case BPF_S_ALU_OR_K:
-                        A |= fentry->k;
+                        A |= f_k;
                         continue;
                 case BPF_S_ALU_LSH_X:
                         A <<= X;
                         continue;
                 case BPF_S_ALU_LSH_K:
-                        A <<= fentry->k;
+                        A <<= f_k;
                         continue;
                 case BPF_S_ALU_RSH_X:
                         A >>= X;
                         continue;
                 case BPF_S_ALU_RSH_K:
-                        A >>= fentry->k;
+                        A >>= f_k;
                         continue;
                 case BPF_S_ALU_NEG:
                         A = -A;
                         continue;
                 case BPF_S_JMP_JA:
-                        pc += fentry->k;
+                        pc += f_k;
                         continue;
                 case BPF_S_JMP_JGT_K:
-                        pc += (A > fentry->k) ? fentry->jt : fentry->jf;
+                        pc += (A > f_k) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JGE_K:
-                        pc += (A >= fentry->k) ? fentry->jt : fentry->jf;
+                        pc += (A >= f_k) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JEQ_K:
-                        pc += (A == fentry->k) ? fentry->jt : fentry->jf;
+                        pc += (A == f_k) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JSET_K:
-                        pc += (A & fentry->k) ? fentry->jt : fentry->jf;
+                        pc += (A & f_k) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_JMP_JGT_X:
                         pc += (A > X) ? fentry->jt : fentry->jf;
@@ -209,7 +211,7 @@ unsigned int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int
                         pc += (A & X) ? fentry->jt : fentry->jf;
                         continue;
                 case BPF_S_LD_W_ABS:
-                        k = fentry->k;
+                        k = f_k;
 load_w:
                         ptr = load_pointer(skb, k, 4, &tmp);
                         if (ptr != NULL) {
@@ -218,7 +220,7 @@ load_w:
                         }
                         break;
                 case BPF_S_LD_H_ABS:
-                        k = fentry->k;
+                        k = f_k;
 load_h:
                         ptr = load_pointer(skb, k, 2, &tmp);
                         if (ptr != NULL) {
@@ -227,7 +229,7 @@ load_h:
                         }
                         break;
                 case BPF_S_LD_B_ABS:
-                        k = fentry->k;
+                        k = f_k;
 load_b:
                         ptr = load_pointer(skb, k, 1, &tmp);
                         if (ptr != NULL) {
@@ -242,32 +244,34 @@ load_b:
                         X = skb->len;
                         continue;
                 case BPF_S_LD_W_IND:
-                        k = X + fentry->k;
+                        k = X + f_k;
                         goto load_w;
                 case BPF_S_LD_H_IND:
-                        k = X + fentry->k;
+                        k = X + f_k;
                         goto load_h;
                 case BPF_S_LD_B_IND:
-                        k = X + fentry->k;
+                        k = X + f_k;
                         goto load_b;
                 case BPF_S_LDX_B_MSH:
-                        ptr = load_pointer(skb, fentry->k, 1, &tmp);
+                        ptr = load_pointer(skb, f_k, 1, &tmp);
                         if (ptr != NULL) {
                                 X = (*(u8 *)ptr & 0xf) << 2;
                                 continue;
                         }
                         return 0;
                 case BPF_S_LD_IMM:
-                        A = fentry->k;
+                        A = f_k;
                         continue;
                 case BPF_S_LDX_IMM:
-                        X = fentry->k;
+                        X = f_k;
                         continue;
                 case BPF_S_LD_MEM:
-                        A = mem[fentry->k];
+                        A = (memvalid & (1UL << f_k)) ?
+                                mem[f_k] : 0;
                         continue;
                 case BPF_S_LDX_MEM:
-                        X = mem[fentry->k];
+                        X = (memvalid & (1UL << f_k)) ?
+                                mem[f_k] : 0;
                         continue;
                 case BPF_S_MISC_TAX:
                         X = A;
@@ -276,14 +280,16 @@ load_b:
                         A = X;
                         continue;
                 case BPF_S_RET_K:
-                        return fentry->k;
+                        return f_k;
                 case BPF_S_RET_A:
                         return A;
                 case BPF_S_ST:
-                        mem[fentry->k] = A;
+                        memvalid |= 1UL << f_k;
+                        mem[f_k] = A;
                         continue;
                 case BPF_S_STX:
-                        mem[fentry->k] = X;
+                        memvalid |= 1UL << f_k;
+                        mem[f_k] = X;
                         continue;
                 default:
                         WARN_ON(1);
@@ -583,23 +589,16 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
 EXPORT_SYMBOL(sk_chk_filter);
 
 /**
- *      sk_filter_rcu_release: Release a socket filter by rcu_head
+ *      sk_filter_release_rcu - Release a socket filter by rcu_head
  *      @rcu: rcu_head that contains the sk_filter to free
  */
-static void sk_filter_rcu_release(struct rcu_head *rcu)
+void sk_filter_release_rcu(struct rcu_head *rcu)
 {
         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
 
-        sk_filter_release(fp);
-}
-
-static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
-{
-        unsigned int size = sk_filter_len(fp);
-
-        atomic_sub(size, &sk->sk_omem_alloc);
-        call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
+        kfree(fp);
 }
+EXPORT_SYMBOL(sk_filter_release_rcu);
 
 /**
  *      sk_attach_filter - attach a socket filter
@@ -644,7 +643,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         rcu_read_unlock_bh();
 
         if (old_fp)
-                sk_filter_delayed_uncharge(sk, old_fp);
+                sk_filter_uncharge(sk, old_fp);
         return 0;
 }
 EXPORT_SYMBOL_GPL(sk_attach_filter);
@@ -658,7 +657,7 @@ int sk_detach_filter(struct sock *sk)
         filter = rcu_dereference_bh(sk->sk_filter);
         if (filter) {
                 rcu_assign_pointer(sk->sk_filter, NULL);
-                sk_filter_delayed_uncharge(sk, filter);
+                sk_filter_uncharge(sk, filter);
                 ret = 0;
         }
         rcu_read_unlock_bh();
diff --git a/net/core/iovec.c b/net/core/iovec.c
index e6b133b77ccb..58eb9999f89d 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -35,10 +35,9 @@
  *      in any case.
  */
 
-long verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode)
+int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode)
 {
-        int size, ct;
-        long err;
+        int size, ct, err;
 
         if (m->msg_namelen) {
                 if (mode == VERIFY_READ) {
@@ -60,14 +59,13 @@ long verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
         err = 0;
 
         for (ct = 0; ct < m->msg_iovlen; ct++) {
-                err += iov[ct].iov_len;
-                /*
-                 * Goal is not to verify user data, but to prevent returning
-                 * negative value, which is interpreted as errno.
-                 * Overflow is still possible, but it is harmless.
-                 */
-                if (err < 0)
-                        return -EMSGSIZE;
+                size_t len = iov[ct].iov_len;
+
+                if (len > INT_MAX - err) {
+                        len = INT_MAX - err;
+                        iov[ct].iov_len = len;
+                }
+                err += len;
         }
 
         return err;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f78d821bd935..29d7bce933f2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1546,6 +1546,9 @@ replay:
                         snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
 
                 dest_net = rtnl_link_get_net(net, tb);
+                if (IS_ERR(dest_net))
+                        return PTR_ERR(dest_net);
+
                 dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
 
                 if (IS_ERR(dev))
diff --git a/net/core/timestamping.c b/net/core/timestamping.c
index 0ae6c22da85b..c19bb4ee405e 100644
--- a/net/core/timestamping.c
+++ b/net/core/timestamping.c
@@ -96,11 +96,13 @@ bool skb_defer_rx_timestamp(struct sk_buff *skb)
         struct phy_device *phydev;
         unsigned int type;
 
-        skb_push(skb, ETH_HLEN);
+        if (skb_headroom(skb) < ETH_HLEN)
+                return false;
+        __skb_push(skb, ETH_HLEN);
 
         type = classify(skb);
 
-        skb_pull(skb, ETH_HLEN);
+        __skb_pull(skb, ETH_HLEN);
 
         switch (type) {
         case PTP_CLASS_V1_IPV4:
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index d6b93d19790f..cf38f52be4f7 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1556,6 +1556,8 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                         if (r_len > sizeof(struct linkinfo_dn))
                                 r_len = sizeof(struct linkinfo_dn);
 
+                        memset(&link, 0, sizeof(link));
+
                         switch(sock->state) {
                                 case SS_CONNECTING:
                                         link.idn_linkstate = LL_CONNECTING;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index dc54bd0d083b..172a6a91a214 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -31,6 +31,7 @@
 #include <linux/skbuff.h>
 #include <linux/udp.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <net/sock.h>
 #include <net/inet_common.h>
 #include <linux/stat.h>
@@ -276,12 +277,12 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 #endif
 #ifdef CONFIG_ECONET_AUNUDP
         struct msghdr udpmsg;
-        struct iovec iov[msg->msg_iovlen+1];
+        struct iovec iov[2];
         struct aunhdr ah;
         struct sockaddr_in udpdest;
         __kernel_size_t size;
-        int i;
         mm_segment_t oldfs;
+        char *userbuf;
 #endif
 
         /*
@@ -297,23 +298,14 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         mutex_lock(&econet_mutex);
 
-        if (saddr == NULL) {
-                struct econet_sock *eo = ec_sk(sk);
-
-                addr.station = eo->station;
-                addr.net     = eo->net;
-                port         = eo->port;
-                cb           = eo->cb;
-        } else {
-                if (msg->msg_namelen < sizeof(struct sockaddr_ec)) {
-                        mutex_unlock(&econet_mutex);
-                        return -EINVAL;
-                }
-                addr.station = saddr->addr.station;
-                addr.net = saddr->addr.net;
-                port = saddr->port;
-                cb = saddr->cb;
-        }
+        if (saddr == NULL || msg->msg_namelen < sizeof(struct sockaddr_ec)) {
+                mutex_unlock(&econet_mutex);
+                return -EINVAL;
+        }
+        addr.station = saddr->addr.station;
+        addr.net = saddr->addr.net;
+        port = saddr->port;
+        cb = saddr->cb;
 
         /* Look for a device with the right network number. */
         dev = net2dev_map[addr.net];
@@ -328,17 +320,17 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 }
         }
 
-        if (len + 15 > dev->mtu) {
-                mutex_unlock(&econet_mutex);
-                return -EMSGSIZE;
-        }
-
         if (dev->type == ARPHRD_ECONET) {
                 /* Real hardware Econet.  We're not worthy etc. */
 #ifdef CONFIG_ECONET_NATIVE
                 unsigned short proto = 0;
                 int res;
 
+                if (len + 15 > dev->mtu) {
+                        mutex_unlock(&econet_mutex);
+                        return -EMSGSIZE;
+                }
+
                 dev_hold(dev);
 
                 skb = sock_alloc_send_skb(sk, len+LL_ALLOCATED_SPACE(dev),
@@ -351,7 +343,6 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
                 eb = (struct ec_cb *)&skb->cb;
 
-                /* BUG: saddr may be NULL */
                 eb->cookie = saddr->cookie;
                 eb->sec = *saddr;
                 eb->sent = ec_tx_done;
@@ -415,6 +406,11 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 return -ENETDOWN;               /* No socket - can't send */
         }
 
+        if (len > 32768) {
+                err = -E2BIG;
+                goto error;
+        }
+
         /* Make up a UDP datagram and hand it off to some higher intellect. */
 
         memset(&udpdest, 0, sizeof(udpdest));
@@ -446,36 +442,26 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         /* tack our header on the front of the iovec */
         size = sizeof(struct aunhdr);
-        /*
-         * XXX: that is b0rken.  We can't mix userland and kernel pointers
-         * in iovec, since on a lot of platforms copy_from_user() will
-         * *not* work with the kernel and userland ones at the same time,
-         * regardless of what we do with set_fs().  And we are talking about
-         * econet-over-ethernet here, so "it's only ARM anyway" doesn't
-         * apply.  Any suggestions on fixing that code?         -- AV
-         */
         iov[0].iov_base = (void *)&ah;
         iov[0].iov_len = size;
-        for (i = 0; i < msg->msg_iovlen; i++) {
-                void __user *base = msg->msg_iov[i].iov_base;
-                size_t iov_len = msg->msg_iov[i].iov_len;
-                /* Check it now since we switch to KERNEL_DS later. */
-                if (!access_ok(VERIFY_READ, base, iov_len)) {
-                        mutex_unlock(&econet_mutex);
-                        return -EFAULT;
-                }
-                iov[i+1].iov_base = base;
-                iov[i+1].iov_len = iov_len;
-                size += iov_len;
+
+        userbuf = vmalloc(len);
+        if (userbuf == NULL) {
+                err = -ENOMEM;
+                goto error;
         }
 
+        iov[1].iov_base = userbuf;
+        iov[1].iov_len = len;
+        err = memcpy_fromiovec(userbuf, msg->msg_iov, len);
+        if (err)
+                goto error_free_buf;
+
         /* Get a skbuff (no data, just holds our cb information) */
         if ((skb = sock_alloc_send_skb(sk, 0,
                                        msg->msg_flags & MSG_DONTWAIT,
-                                       &err)) == NULL) {
-                mutex_unlock(&econet_mutex);
-                return err;
-        }
+                                       &err)) == NULL)
+                goto error_free_buf;
 
         eb = (struct ec_cb *)&skb->cb;
 
@@ -491,7 +477,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
         udpmsg.msg_name = (void *)&udpdest;
         udpmsg.msg_namelen = sizeof(udpdest);
         udpmsg.msg_iov = &iov[0];
-        udpmsg.msg_iovlen = msg->msg_iovlen + 1;
+        udpmsg.msg_iovlen = 2;
         udpmsg.msg_control = NULL;
         udpmsg.msg_controllen = 0;
         udpmsg.msg_flags=0;
@@ -499,9 +485,13 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
         oldfs = get_fs(); set_fs(KERNEL_DS);    /* More privs :-) */
         err = sock_sendmsg(udpsock, &udpmsg, size);
         set_fs(oldfs);
+
+error_free_buf:
+        vfree(userbuf);
 #else
         err = -EPROTOTYPE;
 #endif
+        error:
         mutex_unlock(&econet_mutex);
 
         return err;
@@ -671,6 +661,11 @@ static int ec_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
         err = 0;
         switch (cmd) {
         case SIOCSIFADDR:
+                if (!capable(CAP_NET_ADMIN)) {
+                        err = -EPERM;
+                        break;
+                }
+
                 edev = dev->ec_ptr;
                 if (edev == NULL) {
                         /* Magic up a new one. */
@@ -856,9 +851,13 @@ static void aun_incoming(struct sk_buff *skb, struct aunhdr *ah, size_t len)
 {
         struct iphdr *ip = ip_hdr(skb);
         unsigned char stn = ntohl(ip->saddr) & 0xff;
+        struct dst_entry *dst = skb_dst(skb);
+        struct ec_device *edev = NULL;
         struct sock *sk = NULL;
         struct sk_buff *newskb;
-        struct ec_device *edev = skb->dev->ec_ptr;
+
+        if (dst)
+                edev = dst->dev->ec_ptr;
 
         if (! edev)
                 goto bad;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f115ea68a4ef..6adb1abf05e0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 /* Values greater than interface MTU won't take effect. However
                  * at the point when this call is done we typically don't yet
                  * know which interface is going to be used */
-                if (val < 8 || val > MAX_TCP_WINDOW) {
+                if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) {
                         err = -EINVAL;
                         break;
                 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 020766292bb0..cb8d305cb5b4 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -415,6 +415,9 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                     !icsk->icsk_backoff)
                         break;
 
+                if (sock_owned_by_user(sk))
+                        break;
+
                 icsk->icsk_backoff--;
                 inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
                                          icsk->icsk_backoff;
@@ -429,11 +432,6 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                 if (remaining) {
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                                                   remaining, TCP_RTO_MAX);
-                } else if (sock_owned_by_user(sk)) {
-                        /* RTO revert clocked out retransmission,
-                         * but socket is locked. Will defer. */
-                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-                                                  HZ/20, TCP_RTO_MAX);
                 } else {
                         /* RTO revert clocked out retransmission.
                          * Will retransmit now */
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index de3bd8458588..7abecf73add9 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -237,11 +237,10 @@ void tcp_select_initial_window(int __space, __u32 mss,
                 /* when initializing use the value from init_rcv_wnd
                  * rather than the default from above
                  */
-                if (init_rcv_wnd &&
-                    (*rcv_wnd > init_rcv_wnd * mss))
-                        *rcv_wnd = init_rcv_wnd * mss;
-                else if (*rcv_wnd > init_cwnd * mss)
-                        *rcv_wnd = init_cwnd * mss;
+                if (init_rcv_wnd)
+                        *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
+                else
+                        *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
         }
 
         /* Set the clamp no higher than max representable value */
@@ -392,27 +391,30 @@ struct tcp_out_options {
  */
 static u8 tcp_cookie_size_check(u8 desired)
 {
-        if (desired > 0) {
+        int cookie_size;
+
+        if (desired > 0)
                 /* previously specified */
                 return desired;
-        }
-        if (sysctl_tcp_cookie_size <= 0) {
+
+        cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
+        if (cookie_size <= 0)
                 /* no default specified */
                 return 0;
-        }
-        if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
+
+        if (cookie_size <= TCP_COOKIE_MIN)
                 /* value too small, specify minimum */
                 return TCP_COOKIE_MIN;
-        }
-        if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
+
+        if (cookie_size >= TCP_COOKIE_MAX)
                 /* value too large, specify maximum */
                 return TCP_COOKIE_MAX;
-        }
-        if (0x1 & sysctl_tcp_cookie_size) {
+
+        if (cookie_size & 1)
                 /* 8-bit multiple, illegal, fix it */
-                return (u8)(sysctl_tcp_cookie_size + 0x1);
-        }
-        return (u8)sysctl_tcp_cookie_size;
+                cookie_size++;
+
+        return (u8)cookie_size;
 }
 
 /* Write previously computed TCP options to the packet.
@@ -1519,6 +1521,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 send_win, cong_win, limit, in_flight;
+        int win_divisor;
 
         if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN)
                 goto send_now;
@@ -1550,13 +1553,14 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
                 goto send_now;
 
-        if (sysctl_tcp_tso_win_divisor) {
+        win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
+        if (win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
                 /* If at least some fraction of a window is available,
                  * just use it.
                  */
-                chunk /= sysctl_tcp_tso_win_divisor;
+                chunk /= win_divisor;
                 if (limit >= chunk)
                         goto send_now;
         } else {
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index fce364c6c71a..5b743bdd89ba 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -502,7 +502,8 @@ static void iriap_getvaluebyclass_confirm(struct iriap_cb *self,
                 IRDA_DEBUG(4, "%s(), strlen=%d\n", __func__, value_len);
 
                 /* Make sure the string is null-terminated */
-                fp[n+value_len] = 0x00;
+                if (n + value_len < skb->len)
+                        fp[n + value_len] = 0x00;
                 IRDA_DEBUG(4, "Got string %s\n", fp+n);
 
                 /* Will truncate to IAS_MAX_STRING bytes */
diff --git a/net/irda/parameters.c b/net/irda/parameters.c
index fc1a20565e2d..71cd38c1a67f 100644
--- a/net/irda/parameters.c
+++ b/net/irda/parameters.c
@@ -298,6 +298,8 @@ static int irda_extract_string(void *self, __u8 *buf, int len, __u8 pi,
 
         p.pi = pi;     /* In case handler needs to know */
         p.pl = buf[1]; /* Extract length of value */
+        if (p.pl > 32)
+                p.pl = 32;
 
         IRDA_DEBUG(2, "%s(), pi=%#x, pl=%d\n", __func__,
                    p.pi, p.pl);
@@ -318,7 +320,7 @@ static int irda_extract_string(void *self, __u8 *buf, int len, __u8 pi,
                    (__u8) str[0], (__u8) str[1]);
 
         /* Null terminate string */
-        str[p.pl+1] = '\0';
+        str[p.pl] = '\0';
 
         p.pv.c = str; /* Handler will need to take a copy */
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 226a0ae3bcfd..a2cec796a321 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -676,4 +676,8 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("L2TP over IP");
 MODULE_VERSION("1.0");
-MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, SOCK_DGRAM, IPPROTO_L2TP);
+
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
+ * enums
+ */
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 582612998211..e35dbe55f520 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -317,8 +317,9 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 goto out;
         rc = -ENODEV;
         rtnl_lock();
+        rcu_read_lock();
         if (sk->sk_bound_dev_if) {
-                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
                 if (llc->dev) {
                         if (!addr->sllc_arphrd)
                                 addr->sllc_arphrd = llc->dev->type;
@@ -329,13 +330,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                             !llc_mac_match(addr->sllc_mac,
                                            llc->dev->dev_addr)) {
                                 rc = -EINVAL;
-                                dev_put(llc->dev);
                                 llc->dev = NULL;
                         }
                 }
         } else
                 llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd,
                                            addr->sllc_mac);
+        rcu_read_unlock();
         rtnl_unlock();
         if (!llc->dev)
                 goto out;
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 965b272499fd..2f6903e48dd9 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -172,8 +172,6 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                                      struct ieee80211_mgmt *mgmt,
                                      size_t len)
 {
-        struct ieee80211_hw *hw = &local->hw;
-        struct ieee80211_conf *conf = &hw->conf;
         struct tid_ampdu_rx *tid_agg_rx;
         u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
         u8 dialog_token;
@@ -218,13 +216,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                 goto end_no_lock;
         }
         /* determine default buffer size */
-        if (buf_size == 0) {
-                struct ieee80211_supported_band *sband;
-
-                sband = local->hw.wiphy->bands[conf->channel->band];
-                buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << sband->ht_cap.ampdu_factor;
-        }
+        if (buf_size == 0)
+                buf_size = IEEE80211_MAX_AMPDU_BUF;
 
 
         /* examine state machine */
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 29ac8e1a509e..2095602dcc3a 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -634,6 +634,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                                  struct sta_info *sta,
                                  struct station_parameters *params)
 {
+        unsigned long flags;
         u32 rates;
         int i, j;
         struct ieee80211_supported_band *sband;
@@ -642,7 +643,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 
         sband = local->hw.wiphy->bands[local->oper_channel->band];
 
-        spin_lock_bh(&sta->lock);
+        spin_lock_irqsave(&sta->flaglock, flags);
         mask = params->sta_flags_mask;
         set = params->sta_flags_set;
 
@@ -669,7 +670,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 if (set & BIT(NL80211_STA_FLAG_MFP))
                         sta->flags |= WLAN_STA_MFP;
         }
-        spin_unlock_bh(&sta->lock);
+        spin_unlock_irqrestore(&sta->flaglock, flags);
 
         /*
          * cfg80211 validates this (1-2007) and allows setting the AID
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index c691780725a7..45c99f096c7b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -435,6 +435,7 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
+        sta->last_rx = jiffies;
         set_sta_flags(sta, WLAN_STA_AUTHORIZED);
 
         /* make sure mandatory rates are always added */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 65e0ed6c2975..3546054505ab 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1003,6 +1003,8 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                   struct sk_buff *skb);
+void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 1b9d87ed143a..3f76484221a2 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -323,6 +323,12 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
         if (!key)
                 return;
 
+        /*
+         * Synchronize so the TX path can no longer be using
+         * this key before we free/remove it.
+         */
+        synchronize_rcu();
+
         if (key->local)
                 ieee80211_key_disable_hw_accel(key);
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index ded5c3843e06..e8acdb2fb2ca 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -108,7 +108,8 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
                 chan = scan_chan;
                 channel_type = NL80211_CHAN_NO_HT;
                 local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
-        } else if (local->tmp_channel) {
+        } else if (local->tmp_channel &&
+                   local->oper_channel != local->tmp_channel) {
                 chan = scan_chan = local->tmp_channel;
                 channel_type = local->tmp_channel_type;
                 local->hw.conf.flags |= IEEE80211_CONF_OFFCHANNEL;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index ea13a80a476c..1c91f0f3c307 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -412,7 +412,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         enum plink_event event;
         enum plink_frame_type ftype;
         size_t baselen;
-        bool deactivated;
+        bool deactivated, matches_local = true;
         u8 ie_len;
         u8 *baseaddr;
         __le16 plid, llid, reason;
@@ -487,6 +487,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         /* Now we will figure out the appropriate event... */
         event = PLINK_UNDEFINED;
         if (ftype != PLINK_CLOSE && (!mesh_matches_local(&elems, sdata))) {
+                matches_local = false;
                 switch (ftype) {
                 case PLINK_OPEN:
                         event = OPN_RJCT;
@@ -498,7 +499,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         /* avoid warning */
                         break;
                 }
-                spin_lock_bh(&sta->lock);
+        }
+
+        if (!sta && !matches_local) {
+                rcu_read_unlock();
+                reason = cpu_to_le16(MESH_CAPABILITY_POLICY_VIOLATION);
+                llid = 0;
+                mesh_plink_frame_tx(sdata, PLINK_CLOSE, mgmt->sa, llid,
+                                    plid, reason);
+                return;
         } else if (!sta) {
                 /* ftype == PLINK_OPEN */
                 u32 rates;
@@ -522,7 +531,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
                 event = OPN_ACPT;
                 spin_lock_bh(&sta->lock);
-        } else {
+        } else if (matches_local) {
                 spin_lock_bh(&sta->lock);
                 switch (ftype) {
                 case PLINK_OPEN:
@@ -564,6 +573,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         rcu_read_unlock();
                         return;
                 }
+        } else {
+                spin_lock_bh(&sta->lock);
         }
 
         mpl_dbg("Mesh plink (peer, state, llid, plid, event): %pM %s %d %d %d\n",
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index b6c163ac22da..4c5eed9446f4 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -109,7 +109,7 @@ static void run_again(struct ieee80211_if_managed *ifmgd,
                 mod_timer(&ifmgd->timer, timeout);
 }
 
-static void mod_beacon_timer(struct ieee80211_sub_if_data *sdata)
+void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
 {
         if (sdata->local->hw.flags & IEEE80211_HW_BEACON_FILTER)
                 return;
@@ -118,6 +118,19 @@ static void mod_beacon_timer(struct ieee80211_sub_if_data *sdata)
                   round_jiffies_up(jiffies + IEEE80211_BEACON_LOSS_TIME));
 }
 
+void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                return;
+
+        mod_timer(&sdata->u.mgd.conn_mon_timer,
+                  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
+
+        ifmgd->probe_send_count = 0;
+}
+
 static int ecw2cw(int ecw)
 {
         return (1 << ecw) - 1;
@@ -1006,21 +1019,26 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         if (is_multicast_ether_addr(hdr->addr1))
                 return;
 
-        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
-                return;
-
-        mod_timer(&sdata->u.mgd.conn_mon_timer,
-                  round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
+        ieee80211_sta_reset_conn_monitor(sdata);
 }
 
 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *ssid;
+        u8 *dst = ifmgd->associated->bssid;
+        u8 unicast_limit = max(1, IEEE80211_MAX_PROBE_TRIES - 3);
+
+        /*
+         * Try sending broadcast probe requests for the last three
+         * probe requests after the first ones failed since some
+         * buggy APs only support broadcast probe requests.
+         */
+        if (ifmgd->probe_send_count >= unicast_limit)
+                dst = NULL;
 
         ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
-        ieee80211_send_probe_req(sdata, ifmgd->associated->bssid,
-                                 ssid + 2, ssid[1], NULL, 0);
+        ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid[1], NULL, 0);
 
         ifmgd->probe_send_count++;
         ifmgd->probe_timeout = jiffies + IEEE80211_PROBE_WAIT;
@@ -1262,7 +1280,7 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
 
         rates = 0;
         basic_rates = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[wk->chan->band];
 
         for (i = 0; i < elems.supp_rates_len; i++) {
                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
@@ -1298,11 +1316,11 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                 }
         }
 
-        sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
+        sta->sta.supp_rates[wk->chan->band] = rates;
         sdata->vif.bss_conf.basic_rates = basic_rates;
 
         /* cf. IEEE 802.11 9.2.12 */
-        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+        if (wk->chan->band == IEEE80211_BAND_2GHZ &&
             have_higher_than_11mbit)
                 sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
         else
@@ -1362,7 +1380,7 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
          * Also start the timer that will detect beacon loss.
          */
         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
-        mod_beacon_timer(sdata);
+        ieee80211_sta_reset_beacon_monitor(sdata);
 
         return true;
 }
@@ -1465,7 +1483,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                  * we have or will be receiving any beacons or data, so let's
                  * schedule the timers again, just in case.
                  */
-                mod_beacon_timer(sdata);
+                ieee80211_sta_reset_beacon_monitor(sdata);
 
                 mod_timer(&ifmgd->conn_mon_timer,
                           round_jiffies_up(jiffies +
@@ -1540,7 +1558,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ifmgd->last_beacon_signal = rx_status->signal;
         if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
                 ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
-                ifmgd->ave_beacon_signal = rx_status->signal;
+                ifmgd->ave_beacon_signal = rx_status->signal * 16;
                 ifmgd->last_cqm_event_signal = 0;
         } else {
                 ifmgd->ave_beacon_signal =
@@ -1588,7 +1606,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
          * Push the beacon loss detection into the future since
          * we are processing a beacon from the AP just now.
          */
-        mod_beacon_timer(sdata);
+        ieee80211_sta_reset_beacon_monitor(sdata);
 
         ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
         ncrc = ieee802_11_parse_elems_crc(mgmt->u.beacon.variable,
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index c36b1911987a..cf5ee305785b 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -22,12 +22,16 @@
 static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
         local->offchannel_ps_enabled = false;
 
         /* FIXME: what to do when local->pspolling is true? */
 
         del_timer_sync(&local->dynamic_ps_timer);
+        del_timer_sync(&ifmgd->bcn_mon_timer);
+        del_timer_sync(&ifmgd->conn_mon_timer);
+
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
@@ -85,6 +89,9 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
                 mod_timer(&local->dynamic_ps_timer, jiffies +
                           msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
         }
+
+        ieee80211_sta_reset_beacon_monitor(sdata);
+        ieee80211_sta_reset_conn_monitor(sdata);
 }
 
 void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index be04d46110fe..82d5750a110a 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -328,6 +328,9 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                  * if needed.
                  */
                 for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                        /* Skip invalid rates */
+                        if (info->control.rates[i].idx < 0)
+                                break;
                         /* Rate masking supports only legacy rates for now */
                         if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS)
                                 continue;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index c5b465904e3b..2a18d6602d4a 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -397,8 +397,9 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
             !(info->flags & IEEE80211_TX_STAT_AMPDU))
                 return;
 
-        if (!info->status.ampdu_len) {
-                info->status.ampdu_ack_len = 1;
+        if (!(info->flags & IEEE80211_TX_STAT_AMPDU)) {
+                info->status.ampdu_ack_len =
+                        (info->flags & IEEE80211_TX_STAT_ACK ? 1 : 0);
                 info->status.ampdu_len = 1;
         }
 
@@ -426,7 +427,7 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
                 group = minstrel_ht_get_group_idx(&ar[i]);
                 rate = &mi->groups[group].rates[ar[i].idx % 8];
 
-                if (last && (info->flags & IEEE80211_TX_STAT_ACK))
+                if (last)
                         rate->success += info->status.ampdu_ack_len;
 
                 rate->attempts += ar[i].count * info->status.ampdu_len;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 28624282c5f3..2bec9b9dba09 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1715,6 +1715,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                         if (!fwd_skb && net_ratelimit())
                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
                                                    sdata->name);
+                        if (!fwd_skb)
+                                goto out;
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
                         memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
@@ -1752,6 +1754,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 }
         }
 
+ out:
         if (is_multicast_ether_addr(hdr->addr1) ||
             sdata->dev->flags & IFF_PROMISC)
                 return RX_CONTINUE;
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 34da67995d94..6ffa26a9de39 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -58,6 +58,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         info->control.vif = &sta->sdata->vif;
         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING |
                        IEEE80211_TX_INTFL_RETRANSMISSION;
+        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
 
         sta->tx_filtered_count++;
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c54db966926b..9d5af5dd0d98 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1694,7 +1694,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_tx_info *info;
         int ret = NETDEV_TX_BUSY, head_need;
         u16 ethertype, hdrlen,  meshhdrlen = 0;
         __le16 fc;
@@ -1705,15 +1705,13 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         int nh_pos, h_pos;
         struct sta_info *sta = NULL;
         u32 sta_flags = 0;
+        struct sk_buff *tmp_skb;
 
         if (unlikely(skb->len < ETH_HLEN)) {
                 ret = NETDEV_TX_OK;
                 goto fail;
         }
 
-        nh_pos = skb_network_header(skb) - skb->data;
-        h_pos = skb_transport_header(skb) - skb->data;
-
         /* convert Ethernet header to proper 802.11 header (based on
          * operation mode) */
         ethertype = (skb->data[12] << 8) | skb->data[13];
@@ -1885,6 +1883,20 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
+        /*
+         * If the skb is shared we need to obtain our own copy.
+         */
+        if (skb_shared(skb)) {
+                tmp_skb = skb;
+                skb = skb_copy(skb, GFP_ATOMIC);
+                kfree_skb(tmp_skb);
+
+                if (!skb) {
+                        ret = NETDEV_TX_OK;
+                        goto fail;
+                }
+        }
+
         hdr.frame_control = fc;
         hdr.duration_id = 0;
         hdr.seq_ctrl = 0;
@@ -1903,6 +1915,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 encaps_len = 0;
         }
 
+        nh_pos = skb_network_header(skb) - skb->data;
+        h_pos = skb_transport_header(skb) - skb->data;
+
         skb_pull(skb, skip_header_bytes);
         nh_pos -= skip_header_bytes;
         h_pos -= skip_header_bytes;
@@ -1969,6 +1984,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         skb_set_network_header(skb, nh_pos);
         skb_set_transport_header(skb, h_pos);
 
+        info = IEEE80211_SKB_CB(skb);
         memset(info, 0, sizeof(*info));
 
         dev->trans_start = jiffies;
@@ -2160,6 +2176,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
         sdata = vif_to_sdata(vif);
 
+        if (!ieee80211_sdata_running(sdata))
+                goto out;
+
         if (tim_offset)
                 *tim_offset = 0;
         if (tim_length)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index df3eedb142ff..a37a6b188eda 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1260,7 +1260,8 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced, int nulls)
         if (!hash) {
                 *vmalloced = 1;
                 printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
-                hash = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+                hash = __vmalloc(sz, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
+                                 PAGE_KERNEL);
         }
 
         if (hash && nulls)
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 23b2d6c486b5..364ad1600129 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -101,7 +101,7 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
         switch (info->mode) {
         case SECMARK_MODE_SEL:
                 err = checkentry_selinux(info);
-                if (err <= 0)
+                if (err)
                         return err;
                 break;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9a17f28b1253..9ba70146a4fe 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1610,9 +1610,11 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 err = -EINVAL;
                 vnet_hdr_len = sizeof(vnet_hdr);
-                if ((len -= vnet_hdr_len) < 0)
+                if (len < vnet_hdr_len)
                         goto out_free;
 
+                len -= vnet_hdr_len;
+
                 if (skb_is_gso(skb)) {
                         struct skb_shared_info *sinfo = skb_shinfo(skb);
 
@@ -1719,7 +1721,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
         rcu_read_lock();
         dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
         if (dev)
-                strlcpy(uaddr->sa_data, dev->name, 15);
+                strncpy(uaddr->sa_data, dev->name, 14);
         else
                 memset(uaddr->sa_data, 0, 14);
         rcu_read_unlock();
@@ -1742,6 +1744,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         sll->sll_family = AF_PACKET;
         sll->sll_ifindex = po->ifindex;
         sll->sll_protocol = po->num;
+        sll->sll_pkttype = 0;
         rcu_read_lock();
         dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex);
         if (dev) {
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 75fd13bb631b..39989678c2d2 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -474,7 +474,7 @@ static struct rds_rdma_op *rds_rdma_prepare(struct rds_sock *rs,
                 goto out;
         }
 
-        if (args->nr_local > (u64)UINT_MAX) {
+        if (args->nr_local > UIO_MAXIOV) {
                 ret = -EMSGSIZE;
                 goto out;
         }
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 78ef2c5e130b..08be223fb3dc 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -34,8 +34,6 @@ struct cgroup_subsys net_cls_subsys = {
         .populate       = cgrp_populate,
 #ifdef CONFIG_NET_CLS_CGROUP
         .subsys_id      = net_cls_subsys_id,
-#else
-#define net_cls_subsys_id net_cls_subsys.subsys_id
 #endif
         .module         = THIS_MODULE,
 };
diff --git a/net/socket.c b/net/socket.c
index 2270b941bcc7..58dfc915a3a5 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1651,6 +1651,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
         struct iovec iov;
         int fput_needed;
 
+        if (len > INT_MAX)
+                len = INT_MAX;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
@@ -1708,6 +1710,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
         int err, err2;
         int fput_needed;
 
+        if (size > INT_MAX)
+                size = INT_MAX;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index fa5549079d79..cbc5b8ccc8be 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1675,7 +1675,7 @@ rpc_verify_header(struct rpc_task *task)
                         rpcauth_invalcred(task);
                         /* Ensure we obtain a new XID! */
                         xprt_release(task);
-                        task->tk_action = call_refresh;
+                        task->tk_action = call_reserve;
                         goto out_retry;
                 case RPC_AUTH_BADCRED:
                 case RPC_AUTH_BADVERF:
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index cbc084939dd8..2f5fb71854d3 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -212,6 +212,7 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
         spin_lock(&svc_xprt_class_lock);
         list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
                 struct svc_xprt *newxprt;
+                unsigned short newport;
 
                 if (strcmp(xprt_name, xcl->xcl_name))
                         continue;
@@ -230,8 +231,9 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
                 spin_lock_bh(&serv->sv_lock);
                 list_add(&newxprt->xpt_list, &serv->sv_permsocks);
                 spin_unlock_bh(&serv->sv_lock);
+                newport = svc_xprt_local_port(newxprt);
                 clear_bit(XPT_BUSY, &newxprt->xpt_flags);
-                return svc_xprt_local_port(newxprt);
+                return newport;
         }
  err:
         spin_unlock(&svc_xprt_class_lock);
@@ -431,8 +433,13 @@ void svc_xprt_received(struct svc_xprt *xprt)
 {
         BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags));
         xprt->xpt_pool = NULL;
+        /* As soon as we clear busy, the xprt could be closed and
+         * 'put', so we need a reference to call svc_xprt_enqueue with:
+         */
+        svc_xprt_get(xprt);
         clear_bit(XPT_BUSY, &xprt->xpt_flags);
         svc_xprt_enqueue(xprt);
+        svc_xprt_put(xprt);
 }
 EXPORT_SYMBOL_GPL(svc_xprt_received);
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 0b39b2451ea5..b4cfe207a6ac 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1343,9 +1343,25 @@ static void unix_destruct_scm(struct sk_buff *skb)
         sock_wfree(skb);
 }
 
+#define MAX_RECURSION_LEVEL 4
+
 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 {
         int i;
+        unsigned char max_level = 0;
+        int unix_sock_count = 0;
+
+        for (i = scm->fp->count - 1; i >= 0; i--) {
+                struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+                if (sk) {
+                        unix_sock_count++;
+                        max_level = max(max_level,
+                                        unix_sk(sk)->recursion_level);
+                }
+        }
+        if (unlikely(max_level > MAX_RECURSION_LEVEL))
+                return -ETOOMANYREFS;
 
         /*
          * Need to duplicate file references for the sake of garbage
@@ -1356,9 +1372,11 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         if (!UNIXCB(skb).fp)
                 return -ENOMEM;
 
-        for (i = scm->fp->count-1; i >= 0; i--)
-                unix_inflight(scm->fp->fp[i]);
-        return 0;
+        if (unix_sock_count) {
+                for (i = scm->fp->count - 1; i >= 0; i--)
+                        unix_inflight(scm->fp->fp[i]);
+        }
+        return max_level;
 }
 
 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
@@ -1393,6 +1411,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sk_buff *skb;
         long timeo;
         struct scm_cookie tmp_scm;
+        int max_level;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1431,8 +1450,9 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 goto out;
 
         err = unix_scm_to_skb(siocb->scm, skb, true);
-        if (err)
+        if (err < 0)
                 goto out_free;
+        max_level = err + 1;
         unix_get_secdata(siocb->scm, skb);
 
         skb_reset_transport_header(skb);
@@ -1512,6 +1532,8 @@ restart:
         }
 
         skb_queue_tail(&other->sk_receive_queue, skb);
+        if (max_level > unix_sk(other)->recursion_level)
+                unix_sk(other)->recursion_level = max_level;
         unix_state_unlock(other);
         other->sk_data_ready(other, len);
         sock_put(other);
@@ -1542,6 +1564,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         int sent = 0;
         struct scm_cookie tmp_scm;
         bool fds_sent = false;
+        int max_level;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1605,10 +1628,11 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
                 /* Only send the fds in the first buffer */
                 err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
-                if (err) {
+                if (err < 0) {
                         kfree_skb(skb);
                         goto out_err;
                 }
+                max_level = err + 1;
                 fds_sent = true;
 
                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
@@ -1624,6 +1648,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                         goto pipe_err_free;
 
                 skb_queue_tail(&other->sk_receive_queue, skb);
+                if (max_level > unix_sk(other)->recursion_level)
+                        unix_sk(other)->recursion_level = max_level;
                 unix_state_unlock(other);
                 other->sk_data_ready(other, size);
                 sent += size;
@@ -1840,6 +1866,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 unix_state_lock(sk);
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 if (skb == NULL) {
+                        unix_sk(sk)->recursion_level = 0;
                         if (copied >= target)
                                 goto unlock;
 
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index c8df6fda0b1f..f89f83bf828e 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -96,7 +96,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 unsigned int unix_tot_inflight;
 
 
-static struct sock *unix_get_socket(struct file *filp)
+struct sock *unix_get_socket(struct file *filp)
 {
         struct sock *u_sock = NULL;
         struct inode *inode = filp->f_path.dentry->d_inode;
@@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
 }
 
 static bool gc_in_progress = false;
+#define UNIX_INFLIGHT_TRIGGER_GC 16000
 
 void wait_for_unix_gc(void)
 {
+        /*
+         * If number of inflight sockets is insane,
+         * force a garbage collect right now.
+         */
+        if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
+                unix_gc();
         wait_event(unix_gc_wait, gc_in_progress == false);
 }
 
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index d0c92dddb26b..d8f443b70b08 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -44,6 +44,36 @@ rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
         return chan;
 }
 
+static bool can_beacon_sec_chan(struct wiphy *wiphy,
+                                struct ieee80211_channel *chan,
+                                enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *sec_chan;
+        int diff;
+
+        switch (channel_type) {
+        case NL80211_CHAN_HT40PLUS:
+                diff = 20;
+        case NL80211_CHAN_HT40MINUS:
+                diff = -20;
+        default:
+                return false;
+        }
+
+        sec_chan = ieee80211_get_channel(wiphy, chan->center_freq + diff);
+        if (!sec_chan)
+                return false;
+
+        /* we'll need a DFS capability later */
+        if (sec_chan->flags & (IEEE80211_CHAN_DISABLED |
+                               IEEE80211_CHAN_PASSIVE_SCAN |
+                               IEEE80211_CHAN_NO_IBSS |
+                               IEEE80211_CHAN_RADAR))
+                return false;
+
+        return true;
+}
+
 int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, int freq,
                       enum nl80211_channel_type channel_type)
@@ -68,6 +98,27 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
         if (!chan)
                 return -EINVAL;
 
+        /* Both channels should be able to initiate communication */
+        if (wdev && (wdev->iftype == NL80211_IFTYPE_ADHOC ||
+                     wdev->iftype == NL80211_IFTYPE_AP ||
+                     wdev->iftype == NL80211_IFTYPE_AP_VLAN ||
+                     wdev->iftype == NL80211_IFTYPE_MESH_POINT)) {
+                switch (channel_type) {
+                case NL80211_CHAN_HT40PLUS:
+                case NL80211_CHAN_HT40MINUS:
+                        if (!can_beacon_sec_chan(&rdev->wiphy, chan,
+                                                 channel_type)) {
+                                printk(KERN_DEBUG
+                                       "cfg80211: Secondary channel not "
+                                       "allowed to initiate communication\n");
+                                return -EINVAL;
+                        }
+                        break;
+                default:
+                        break;
+                }
+        }
+
         result = rdev->ops->set_channel(&rdev->wiphy,
                                         wdev ? wdev->netdev : NULL,
                                         chan, channel_type);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 37902a54e9c1..9a8cde999955 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -761,11 +761,13 @@ static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 
         result = get_rdev_dev_by_info_ifindex(info, &rdev, &netdev);
         if (result)
-                goto unlock;
+                goto unlock_rtnl;
 
         result = __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
 
- unlock:
+        dev_put(netdev);
+        cfg80211_unlock_rdev(rdev);
+ unlock_rtnl:
         rtnl_unlock();
 
         return result;
@@ -4996,7 +4998,7 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
 
         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
-                goto unlock_rdev;
+                goto unlock_rtnl;
 
         wdev = dev->ieee80211_ptr;
 
@@ -5013,9 +5015,10 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
         err = rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
                                              threshold, hysteresis);
 
-unlock_rdev:
+ unlock_rdev:
         cfg80211_unlock_rdev(rdev);
         dev_put(dev);
+ unlock_rtnl:
         rtnl_unlock();
 
         return err;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f180db0de66c..edccc093e71b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -723,7 +723,9 @@ EXPORT_SYMBOL(freq_reg_info);
  * on the wiphy with the target_bw specified. Then we can simply use
  * that below for the desired_bw_khz below.
  */
-static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
+static void handle_channel(struct wiphy *wiphy,
+                           enum nl80211_reg_initiator initiator,
+                           enum ieee80211_band band,
                            unsigned int chan_idx)
 {
         int r;
@@ -787,7 +789,9 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                 chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
-static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
+static void handle_band(struct wiphy *wiphy,
+                        enum ieee80211_band band,
+                        enum nl80211_reg_initiator initiator)
 {
         unsigned int i;
         struct ieee80211_supported_band *sband;
@@ -796,7 +800,7 @@ static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
         sband = wiphy->bands[band];
 
         for (i = 0; i < sband->n_channels; i++)
-                handle_channel(wiphy, band, i);
+                handle_channel(wiphy, initiator, band, i);
 }
 
 static bool ignore_reg_update(struct wiphy *wiphy,
@@ -812,6 +816,7 @@ static bool ignore_reg_update(struct wiphy *wiphy,
          * desired regulatory domain set
          */
         if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
+            initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
             !is_world_regdom(last_request->alpha2))
                 return true;
         return false;
@@ -1033,7 +1038,7 @@ void wiphy_update_regulatory(struct wiphy *wiphy,
                 goto out;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
-                        handle_band(wiphy, band);
+                        handle_band(wiphy, band, initiator);
         }
 out:
         reg_process_beacons(wiphy);
@@ -1170,7 +1175,7 @@ static int ignore_request(struct wiphy *wiphy,
                                 return 0;
                         return -EALREADY;
                 }
-                return REG_INTERSECT;
+                return 0;
         case NL80211_REGDOM_SET_BY_DRIVER:
                 if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE) {
                         if (regdom_changes(pending_request->alpha2))
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 5ca8c7180141..503ebb86ba18 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -650,14 +650,14 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 
         spin_lock_bh(&dev->bss_lock);
+        if (!list_empty(&bss->list)) {
+                list_del_init(&bss->list);
+                dev->bss_generation++;
+                rb_erase(&bss->rbn, &dev->bss_tree);
 
-        list_del(&bss->list);
-        dev->bss_generation++;
-        rb_erase(&bss->rbn, &dev->bss_tree);
-
+                kref_put(&bss->ref, bss_release);
+        }
         spin_unlock_bh(&dev->bss_lock);
-
-        kref_put(&bss->ref, bss_release);
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 771bab00754b..55187c8f6420 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -61,6 +61,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
         while (len > 0) {
                 switch (*p & X25_FAC_CLASS_MASK) {
                 case X25_FAC_CLASS_A:
+                        if (len < 2)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_REVERSE:
                                 if((p[1] & 0x81) == 0x81) {
@@ -104,6 +106,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 2;
                         break;
                 case X25_FAC_CLASS_B:
+                        if (len < 3)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_PACKET_SIZE:
                                 facilities->pacsize_in  = p[1];
@@ -125,6 +129,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 3;
                         break;
                 case X25_FAC_CLASS_C:
+                        if (len < 4)
+                                return 0;
                         printk(KERN_DEBUG "X.25: unknown facility %02X, "
                                "values %02X, %02X, %02X\n",
                                p[0], p[1], p[2], p[3]);
@@ -132,26 +138,26 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         len -= 4;
                         break;
                 case X25_FAC_CLASS_D:
+                        if (len < p[1] + 2)
+                                return 0;
                         switch (*p) {
                         case X25_FAC_CALLING_AE:
-                                if (p[1] > X25_MAX_DTE_FACIL_LEN)
-                                        break;
+                                if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+                                        return 0;
                                 dte_facs->calling_len = p[2];
                                 memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLING_AE;
                                 break;
                         case X25_FAC_CALLED_AE:
-                                if (p[1] > X25_MAX_DTE_FACIL_LEN)
-                                        break;
+                                if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+                                        return 0;
                                 dte_facs->called_len = p[2];
                                 memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLED_AE;
                                 break;
                         default:
                                 printk(KERN_DEBUG "X.25: unknown facility %02X,"
-                                        "length %d, values %02X, %02X, "
-                                        "%02X, %02X\n",
-                                        p[0], p[1], p[2], p[3], p[4], p[5]);
+                                        "length %d\n", p[0], p[1]);
                                 break;
                         }
                         len -= p[1] + 2;
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 63178961efac..f729f022be69 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -119,6 +119,8 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                                                 &x25->vc_facil_mask);
                         if (len > 0)
                                 skb_pull(skb, len);
+                        else
+                                return -1;
                         /*
                          *      Copy any Call User Data.
                          */
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index 73e7b954ad28..b25c6463c3e9 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -394,6 +394,7 @@ void __exit x25_link_free(void)
         list_for_each_safe(entry, tmp, &x25_neigh_list) {
                 nb = list_entry(entry, struct x25_neigh, node);
                 __x25_remove_neigh(nb);
+                dev_put(nb->dev);
         }
         write_unlock_bh(&x25_neigh_list_lock);
 }
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 7ef429cd5cb3..6968f5b6569a 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -466,7 +466,7 @@ int main(int ac, char **av)
         bindtextdomain(PACKAGE, LOCALEDIR);
         textdomain(PACKAGE);
 
-        while ((opt = getopt_long_only(ac, av, "", long_opts, NULL)) != -1) {
+        while ((opt = getopt_long(ac, av, "", long_opts, NULL)) != -1) {
                 input_mode = (enum input_mode)opt;
                 switch (opt) {
                 case silentoldconfig:
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index aef8c0a923ab..d661afbe474c 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -253,6 +253,8 @@ static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry,
         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
                                            Audit_equal, args,
                                            &entry->lsm[lsm_rule].rule);
+        if (!entry->lsm[lsm_rule].rule)
+                return -EINVAL;
         return result;
 }
 
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 0088dd8bf68a..0ea52d25a6bd 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -403,7 +403,6 @@ link_check_failed:
         return ret;
 
 link_prealloc_failed:
-        up_write(&dest_keyring->sem);
         mutex_unlock(&user->cons_lock);
         kleave(" = %d [prelink]", ret);
         return ret;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4796ddd4e721..a6238281186a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2529,7 +2529,10 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
         sid = tsec->sid;
         newsid = tsec->create_sid;
 
-        if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
+        if ((sbsec->flags & SE_SBINITIALIZED) &&
+            (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
+                newsid = sbsec->mntpoint_sid;
+        else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
                 rc = security_transition_sid(sid, dsec->sid,
                                              inode_mode_to_security_class(inode->i_mode),
                                              &newsid);
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 75ec0c6ebacd..8b02b2137da2 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -65,6 +65,8 @@ static struct nlmsg_perm nlmsg_route_perms[] =
         { RTM_NEWADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
         { RTM_DELADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
         { RTM_GETADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_READ  },
+        { RTM_GETDCB,           NETLINK_ROUTE_SOCKET__NLMSG_READ  },
+        { RTM_SETDCB,           NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
 };
 
 static struct nlmsg_perm nlmsg_firewall_perms[] =
diff --git a/sound/atmel/ac97c.c b/sound/atmel/ac97c.c
index 10c3a871a12d..b310702c646e 100644
--- a/sound/atmel/ac97c.c
+++ b/sound/atmel/ac97c.c
@@ -33,9 +33,12 @@
 #include <linux/dw_dmac.h>
 
 #include <mach/cpu.h>
-#include <mach/hardware.h>
 #include <mach/gpio.h>
 
+#ifdef CONFIG_ARCH_AT91
+#include <mach/hardware.h>
+#endif
+
 #include "ac97c.h"
 
 enum {
diff --git a/sound/core/hrtimer.c b/sound/core/hrtimer.c
index 7730575bfadd..07efa29dfd4a 100644
--- a/sound/core/hrtimer.c
+++ b/sound/core/hrtimer.c
@@ -45,12 +45,13 @@ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
 {
         struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt);
         struct snd_timer *t = stime->timer;
+        unsigned long oruns;
 
         if (!atomic_read(&stime->running))
                 return HRTIMER_NORESTART;
 
-        hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
-        snd_timer_interrupt(stime->timer, t->sticks);
+        oruns = hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
+        snd_timer_interrupt(stime->timer, t->sticks * oruns);
 
         if (!atomic_read(&stime->running))
                 return HRTIMER_NORESTART;
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index f50ebf20df96..8442a088677d 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -618,8 +618,10 @@ static void snd_mixer_oss_put_volume1_vol(struct snd_mixer_oss_file *fmixer,
         if (numid == ID_UNKNOWN)
                 return;
         down_read(&card->controls_rwsem);
-        if ((kctl = snd_ctl_find_numid(card, numid)) == NULL)
+        if ((kctl = snd_ctl_find_numid(card, numid)) == NULL) {
+                up_read(&card->controls_rwsem);
                 return;
+        }
         uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
         uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL)
@@ -658,7 +660,7 @@ static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer,
                 return;
         down_read(&card->controls_rwsem);
         if ((kctl = snd_ctl_find_numid(card, numid)) == NULL) {
-                up_read(&fmixer->card->controls_rwsem);
+                up_read(&card->controls_rwsem);
                 return;
         }
         uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
@@ -797,7 +799,7 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
         uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL) {
                 err = -ENOMEM;
-                goto __unlock;
+                goto __free_only;
         }
         down_read(&card->controls_rwsem);
         kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
@@ -826,6 +828,7 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
         err = 0;
       __unlock:
         up_read(&card->controls_rwsem);
+      __free_only:
         kfree(uctl);
         kfree(uinfo);
         return err;
@@ -847,7 +850,7 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
         uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL) {
                 err = -ENOMEM;
-                goto __unlock;
+                goto __free_only;
         }
         down_read(&card->controls_rwsem);
         kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
@@ -880,6 +883,7 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
         err = 0;
       __unlock:
         up_read(&card->controls_rwsem);
+      __free_only:
         kfree(uctl);
         kfree(uinfo);
         return err;
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 5c8c7dff8ede..aed06c90a96a 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1510,16 +1510,19 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
 static int snd_pcm_oss_reset(struct snd_pcm_oss_file *pcm_oss_file)
 {
         struct snd_pcm_substream *substream;
+        struct snd_pcm_runtime *runtime;
+        int i;
 
-        substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
-        if (substream != NULL) {
-                snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
-                substream->runtime->oss.prepare = 1;
-        }
-        substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
-        if (substream != NULL) {
+        for (i = 0; i < 2; i++) {
+                substream = pcm_oss_file->streams[i];
+                if (!substream)
+                        continue;
+                runtime = substream->runtime;
                 snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
-                substream->runtime->oss.prepare = 1;
+                runtime->oss.prepare = 1;
+                runtime->oss.buffer_used = 0;
+                runtime->oss.prev_hw_ptr_period = 0;
+                runtime->oss.period_ptr = 0;
         }
         return 0;
 }
diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c
index 07f803e6d203..3f420ff273f8 100644
--- a/sound/oss/soundcard.c
+++ b/sound/oss/soundcard.c
@@ -86,7 +86,7 @@ int *load_mixer_volumes(char *name, int *levels, int present)
         int             i, n;
 
         for (i = 0; i < num_mixer_volumes; i++) {
-                if (strcmp(name, mixer_vols[i].name) == 0) {
+                if (strncmp(name, mixer_vols[i].name, 32) == 0) {
                         if (present)
                                 mixer_vols[i].num = i;
                         return mixer_vols[i].levels;
@@ -98,7 +98,7 @@ int *load_mixer_volumes(char *name, int *levels, int present)
         }
         n = num_mixer_volumes++;
 
-        strcpy(mixer_vols[n].name, name);
+        strncpy(mixer_vols[n].name, name, 32);
 
         if (present)
                 mixer_vols[n].num = n;
diff --git a/sound/pci/au88x0/au88x0_pcm.c b/sound/pci/au88x0/au88x0_pcm.c
index b9d2f202cf9b..5439d662d104 100644
--- a/sound/pci/au88x0/au88x0_pcm.c
+++ b/sound/pci/au88x0/au88x0_pcm.c
@@ -42,11 +42,7 @@ static struct snd_pcm_hardware snd_vortex_playback_hw_adb = {
         .rate_min = 5000,
         .rate_max = 48000,
         .channels_min = 1,
-#ifdef CHIP_AU8830
-        .channels_max = 4,
-#else
         .channels_max = 2,
-#endif
         .buffer_bytes_max = 0x10000,
         .period_bytes_min = 0x1,
         .period_bytes_max = 0x1000,
@@ -115,6 +111,17 @@ static struct snd_pcm_hardware snd_vortex_playback_hw_wt = {
         .periods_max = 64,
 };
 #endif
+#ifdef CHIP_AU8830
+static unsigned int au8830_channels[3] = {
+        1, 2, 4,
+};
+
+static struct snd_pcm_hw_constraint_list hw_constraints_au8830_channels = {
+        .count = ARRAY_SIZE(au8830_channels),
+        .list = au8830_channels,
+        .mask = 0,
+};
+#endif
 /* open callback */
 static int snd_vortex_pcm_open(struct snd_pcm_substream *substream)
 {
@@ -156,6 +163,15 @@ static int snd_vortex_pcm_open(struct snd_pcm_substream *substream)
                 if (VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_ADB
                     || VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_I2S)
                         runtime->hw = snd_vortex_playback_hw_adb;
+#ifdef CHIP_AU8830
+                if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
+                        VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_ADB) {
+                        runtime->hw.channels_max = 4;
+                        snd_pcm_hw_constraint_list(runtime, 0,
+                                SNDRV_PCM_HW_PARAM_CHANNELS,
+                                &hw_constraints_au8830_channels);
+                }
+#endif
                 substream->runtime->private_data = NULL;
         }
 #ifndef CHIP_AU8810
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 14829210ef0b..b959c9f1e6fb 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1216,6 +1216,7 @@ void snd_hda_codec_setup_stream(struct hda_codec *codec, hda_nid_t nid,
         struct hda_codec *c;
         struct hda_cvt_setup *p;
         unsigned int oldval, newval;
+        int type;
         int i;
 
         if (!nid)
@@ -1254,10 +1255,12 @@ void snd_hda_codec_setup_stream(struct hda_codec *codec, hda_nid_t nid,
         p->dirty = 0;
 
         /* make other inactive cvts with the same stream-tag dirty */
+        type = get_wcaps_type(get_wcaps(codec, nid));
         list_for_each_entry(c, &codec->bus->codec_list, list) {
                 for (i = 0; i < c->cvt_setups.used; i++) {
                         p = snd_array_elem(&c->cvt_setups, i);
-                        if (!p->active && p->stream_tag == stream_tag)
+                        if (!p->active && p->stream_tag == stream_tag &&
+                            get_wcaps_type(get_wcaps(codec, p->nid)) == type)
                                 p->dirty = 1;
                 }
         }
@@ -1281,6 +1284,9 @@ void __snd_hda_codec_cleanup_stream(struct hda_codec *codec, hda_nid_t nid,
         if (!nid)
                 return;
 
+        if (codec->no_sticky_stream)
+                do_now = 1;
+
         snd_printdd("hda_codec_cleanup_stream: NID=0x%x\n", nid);
         p = get_hda_cvt_setup(codec, nid);
         if (p) {
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 62c702240108..c3ad37470f8f 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -850,6 +850,7 @@ struct hda_codec {
         unsigned int pin_amp_workaround:1; /* pin out-amp takes index
                                             * (e.g. Conexant codecs)
                                             */
+        unsigned int no_sticky_stream:1; /* no sticky-PCM stream assignment */
         unsigned int pins_shutup:1;     /* pins are shut up */
         unsigned int no_trigger_sense:1; /* don't trigger at pin-sensing */
 #ifdef CONFIG_SND_HDA_POWER_SAVE
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index 26c3ade73583..3c17a0a5ea81 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -381,7 +381,7 @@ static void hdmi_show_short_audio_desc(struct cea_sad *a)
         snd_print_pcm_rates(a->rates, buf, sizeof(buf));
 
         if (a->format == AUDIO_CODING_TYPE_LPCM)
-                snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2 - 8));
+                snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2) - 8);
         else if (a->max_bitrate)
                 snprintf(buf2, sizeof(buf2),
                                 ", max bitrate = %d", a->max_bitrate);
@@ -604,24 +604,19 @@ void hdmi_eld_update_pcm_info(struct hdmi_eld *eld, struct hda_pcm_stream *pcm,
 {
         int i;
 
-        pcm->rates = 0;
-        pcm->formats = 0;
-        pcm->maxbps = 0;
-        pcm->channels_min = -1;
-        pcm->channels_max = 0;
+        /* assume basic audio support (the basic audio flag is not in ELD;
+         * however, all audio capable sinks are required to support basic
+         * audio) */
+        pcm->rates = SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000;
+        pcm->formats = SNDRV_PCM_FMTBIT_S16_LE;
+        pcm->maxbps = 16;
+        pcm->channels_max = 2;
         for (i = 0; i < eld->sad_count; i++) {
                 struct cea_sad *a = &eld->sad[i];
                 pcm->rates |= a->rates;
-                if (a->channels < pcm->channels_min)
-                        pcm->channels_min = a->channels;
                 if (a->channels > pcm->channels_max)
                         pcm->channels_max = a->channels;
                 if (a->format == AUDIO_CODING_TYPE_LPCM) {
-                        if (a->sample_bits & AC_SUPPCM_BITS_16) {
-                                pcm->formats |= SNDRV_PCM_FMTBIT_S16_LE;
-                                if (pcm->maxbps < 16)
-                                        pcm->maxbps = 16;
-                        }
                         if (a->sample_bits & AC_SUPPCM_BITS_20) {
                                 pcm->formats |= SNDRV_PCM_FMTBIT_S32_LE;
                                 if (pcm->maxbps < 20)
@@ -641,7 +636,6 @@ void hdmi_eld_update_pcm_info(struct hdmi_eld *eld, struct hda_pcm_stream *pcm,
         /* restrict the parameters by the values the codec provides */
         pcm->rates &= codec_pars->rates;
         pcm->formats &= codec_pars->formats;
-        pcm->channels_min = max(pcm->channels_min, codec_pars->channels_min);
         pcm->channels_max = min(pcm->channels_max, codec_pars->channels_max);
         pcm->maxbps = min(pcm->maxbps, codec_pars->maxbps);
 }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 34940a079051..a8c6f3420344 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -458,6 +458,7 @@ enum {
         AZX_DRIVER_ULI,
         AZX_DRIVER_NVIDIA,
         AZX_DRIVER_TERA,
+        AZX_DRIVER_CTX,
         AZX_DRIVER_GENERIC,
         AZX_NUM_DRIVERS, /* keep this as last entry */
 };
@@ -473,6 +474,7 @@ static char *driver_short_names[] __devinitdata = {
         [AZX_DRIVER_ULI] = "HDA ULI M5461",
         [AZX_DRIVER_NVIDIA] = "HDA NVidia",
         [AZX_DRIVER_TERA] = "HDA Teradici", 
+        [AZX_DRIVER_CTX] = "HDA Creative",
         [AZX_DRIVER_GENERIC] = "HD-Audio Generic",
 };
 
@@ -563,7 +565,10 @@ static void azx_init_cmd_io(struct azx *chip)
         /* reset the rirb hw write pointer */
         azx_writew(chip, RIRBWP, ICH6_RIRBWP_RST);
         /* set N=1, get RIRB response interrupt for new entry */
-        azx_writew(chip, RINTCNT, 1);
+        if (chip->driver_type == AZX_DRIVER_CTX)
+                azx_writew(chip, RINTCNT, 0xc0);
+        else
+                azx_writew(chip, RINTCNT, 1);
         /* enable rirb dma and response irq */
         azx_writeb(chip, RIRBCTL, ICH6_RBCTL_DMA_EN | ICH6_RBCTL_IRQ_EN);
         spin_unlock_irq(&chip->reg_lock);
@@ -1136,8 +1141,11 @@ static irqreturn_t azx_interrupt(int irq, void *dev_id)
         /* clear rirb int */
         status = azx_readb(chip, RIRBSTS);
         if (status & RIRB_INT_MASK) {
-                if (status & RIRB_INT_RESPONSE)
+                if (status & RIRB_INT_RESPONSE) {
+                        if (chip->driver_type == AZX_DRIVER_CTX)
+                                udelay(80);
                         azx_update_rirb(chip);
+                }
                 azx_writeb(chip, RIRBSTS, RIRB_INT_MASK);
         }
 
@@ -1647,7 +1655,7 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
         struct azx_dev *azx_dev = get_azx_dev(substream);
         struct hda_pcm_stream *hinfo = apcm->hinfo[substream->stream];
         struct snd_pcm_runtime *runtime = substream->runtime;
-        unsigned int bufsize, period_bytes, format_val;
+        unsigned int bufsize, period_bytes, format_val, stream_tag;
         int err;
 
         azx_stream_reset(chip, azx_dev);
@@ -1689,7 +1697,12 @@ static int azx_pcm_prepare(struct snd_pcm_substream *substream)
         else
                 azx_dev->fifo_size = 0;
 
-        return snd_hda_codec_prepare(apcm->codec, hinfo, azx_dev->stream_tag,
+        stream_tag = azx_dev->stream_tag;
+        /* CA-IBG chips need the playback stream starting from 1 */
+        if (chip->driver_type == AZX_DRIVER_CTX &&
+            stream_tag > chip->capture_streams)
+                stream_tag -= chip->capture_streams;
+        return snd_hda_codec_prepare(apcm->codec, hinfo, stream_tag,
                                      azx_dev->format_val, substream);
 }
 
@@ -2285,9 +2298,11 @@ static int azx_dev_free(struct snd_device *device)
  */
 static struct snd_pci_quirk position_fix_list[] __devinitdata = {
         SND_PCI_QUIRK(0x1025, 0x009f, "Acer Aspire 5110", POS_FIX_LPIB),
+        SND_PCI_QUIRK(0x1025, 0x026f, "Acer Aspire 5538", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1028, 0x01f6, "Dell Latitude 131L", POS_FIX_LPIB),
+        SND_PCI_QUIRK(0x1028, 0x0470, "Dell Inspiron 1120", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
@@ -2794,10 +2809,10 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
         { PCI_DEVICE(PCI_VENDOR_ID_CREATIVE, PCI_ANY_ID),
           .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
           .class_mask = 0xffffff,
-          .driver_data = AZX_DRIVER_GENERIC },
+          .driver_data = AZX_DRIVER_CTX },
 #else
         /* this entry seems still valid -- i.e. without emu20kx chip */
-        { PCI_DEVICE(0x1102, 0x0009), .driver_data = AZX_DRIVER_GENERIC },
+        { PCI_DEVICE(0x1102, 0x0009), .driver_data = AZX_DRIVER_CTX },
 #endif
         /* AMD/ATI Generic, PCI class code and Vendor ID for HD Audio */
         { PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_ANY_ID),
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 10bbbaf6ebc3..0da636d28fb4 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -1276,6 +1276,7 @@ static int patch_ad1986a(struct hda_codec *codec)
         spec->multiout.no_share_stream = 1;
 
         codec->no_trigger_sense = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
@@ -1463,6 +1464,7 @@ static int patch_ad1983(struct hda_codec *codec)
         codec->patch_ops = ad198x_patch_ops;
 
         codec->no_trigger_sense = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
@@ -1917,6 +1919,7 @@ static int patch_ad1981(struct hda_codec *codec)
         }
 
         codec->no_trigger_sense = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
@@ -3235,6 +3238,7 @@ static int patch_ad1988(struct hda_codec *codec)
         spec->vmaster_nid = 0x04;
 
         codec->no_trigger_sense = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
@@ -3449,6 +3453,7 @@ static int patch_ad1884(struct hda_codec *codec)
         codec->patch_ops = ad198x_patch_ops;
 
         codec->no_trigger_sense = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
@@ -4422,6 +4427,7 @@ static int patch_ad1884a(struct hda_codec *codec)
         }
 
         codec->no_trigger_sense = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
@@ -4761,6 +4767,7 @@ static int patch_ad1882(struct hda_codec *codec)
         }
 
         codec->no_trigger_sense = 1;
+        codec->no_sticky_stream = 1;
 
         return 0;
 }
diff --git a/sound/pci/hda/patch_ca0110.c b/sound/pci/hda/patch_ca0110.c
index af478019088e..9544463cf862 100644
--- a/sound/pci/hda/patch_ca0110.c
+++ b/sound/pci/hda/patch_ca0110.c
@@ -489,7 +489,7 @@ static void parse_digital(struct hda_codec *codec)
         if (cfg->dig_outs &&
             snd_hda_get_connections(codec, cfg->dig_out_pins[0],
                                     &spec->dig_out, 1) == 1)
-                spec->multiout.dig_out_nid = cfg->dig_out_pins[0];
+                spec->multiout.dig_out_nid = spec->dig_out;
 }
 
 static int ca0110_parse_auto_config(struct hda_codec *codec)
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 972e7c453b3d..5dbff4507a93 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -393,10 +393,16 @@ static int conexant_add_jack(struct hda_codec *codec,
         struct conexant_spec *spec;
         struct conexant_jack *jack;
         const char *name;
-        int err;
+        int i, err;
 
         spec = codec->spec;
         snd_array_init(&spec->jacks, sizeof(*jack), 32);
+
+        jack = spec->jacks.list;
+        for (i = 0; i < spec->jacks.used; i++, jack++)
+                if (jack->nid == nid)
+                        return 0 ; /* already present */
+
         jack = snd_array_new(&spec->jacks);
         name = (type == SND_JACK_HEADPHONE) ? "Headphone" : "Mic" ;
 
@@ -3085,13 +3091,13 @@ static const char *cxt5066_models[CXT5066_MODELS] = {
 static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x14f1, 0x0101, "Conexant Reference board",
                       CXT5066_LAPTOP),
-        SND_PCI_QUIRK(0x1028, 0x02f5, "Dell",
-                      CXT5066_DELL_LAPTOP),
+        SND_PCI_QUIRK(0x1028, 0x02f5, "Dell Vostro 320", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x1028, 0x02d8, "Dell Vostro", CXT5066_DELL_VOSTO),
         SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTO),
         SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
+        SND_PCI_QUIRK(0x1043, 0x13f3, "Asus A52J", CXT5066_HP_LAPTOP),
         SND_PCI_QUIRK(0x1179, 0xff1e, "Toshiba Satellite C650D", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
@@ -3099,6 +3105,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x21b2, "Thinkpad X100e", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x21b3, "Thinkpad Edge 13 (197)", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x21b4, "Thinkpad Edge", CXT5066_IDEAPAD),
+        SND_PCI_QUIRK(0x17aa, 0x21c8, "Thinkpad Edge 11", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
         SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G series", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x390a, "Lenovo S10-3t", CXT5066_IDEAPAD),
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index afd6022a96a7..4ab7c5c80838 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -779,7 +779,6 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
                         return -ENODEV;
         } else {
                 /* fallback to the codec default */
-                hinfo->channels_min = codec_pars->channels_min;
                 hinfo->channels_max = codec_pars->channels_max;
                 hinfo->rates = codec_pars->rates;
                 hinfo->formats = codec_pars->formats;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a432e6efd19b..52b07fb942d4 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1438,6 +1438,7 @@ do_sku:
                 spec->init_amp = ALC_INIT_GPIO3;
                 break;
         case 5:
+        default:
                 spec->init_amp = ALC_INIT_DEFAULT;
                 break;
         }
@@ -4388,6 +4389,7 @@ static struct snd_pci_quirk alc880_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1734, 0x10b0, "Fujitsu", ALC880_FUJITSU),
         SND_PCI_QUIRK(0x1854, 0x0018, "LG LW20", ALC880_LG_LW),
         SND_PCI_QUIRK(0x1854, 0x003b, "LG", ALC880_LG),
+        SND_PCI_QUIRK(0x1854, 0x005f, "LG P1 Express", ALC880_LG),
         SND_PCI_QUIRK(0x1854, 0x0068, "LG w1", ALC880_LG),
         SND_PCI_QUIRK(0x1854, 0x0077, "LG LW25", ALC880_LG_LW),
         SND_PCI_QUIRK(0x19db, 0x4188, "TCL S700", ALC880_TCL_S700),
@@ -9664,7 +9666,6 @@ static struct snd_pci_quirk alc882_cfg_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x3bfc, "Lenovo NB0763", ALC883_LENOVO_NB0763),
         SND_PCI_QUIRK(0x17aa, 0x3bfd, "Lenovo NB0763", ALC883_LENOVO_NB0763),
         SND_PCI_QUIRK(0x17aa, 0x101d, "Lenovo Sky", ALC888_LENOVO_SKY),
-        SND_PCI_QUIRK(0x17c0, 0x4071, "MEDION MD2", ALC883_MEDION_MD2),
         SND_PCI_QUIRK(0x17c0, 0x4085, "MEDION MD96630", ALC888_LENOVO_MS7195_DIG),
         SND_PCI_QUIRK(0x17f2, 0x5000, "Albatron KI690-AM2", ALC883_6ST_DIG),
         SND_PCI_QUIRK(0x1991, 0x5625, "Haier W66", ALC883_HAIER_W66),
@@ -16557,7 +16558,7 @@ static struct alc_config_preset alc861vd_presets[] = {
 static int alc861vd_auto_create_input_ctls(struct hda_codec *codec,
                                                 const struct auto_pin_cfg *cfg)
 {
-        return alc_auto_create_input_ctls(codec, cfg, 0x15, 0x09, 0);
+        return alc_auto_create_input_ctls(codec, cfg, 0x0b, 0x22, 0);
 }
 
 
@@ -18612,6 +18613,8 @@ static inline hda_nid_t alc662_mix_to_dac(hda_nid_t nid)
                 return 0x02;
         else if (nid >= 0x0c && nid <= 0x0e)
                 return nid - 0x0c + 0x02;
+        else if (nid == 0x26) /* ALC887-VD has this DAC too */
+                return 0x25;
         else
                 return 0;
 }
@@ -18620,7 +18623,7 @@ static inline hda_nid_t alc662_mix_to_dac(hda_nid_t nid)
 static hda_nid_t alc662_dac_to_mix(struct hda_codec *codec, hda_nid_t pin,
                                    hda_nid_t dac)
 {
-        hda_nid_t mix[4];
+        hda_nid_t mix[5];
         int i, num;
 
         num = snd_hda_get_connections(codec, pin, mix, ARRAY_SIZE(mix));
@@ -18935,6 +18938,37 @@ static void alc662_auto_init(struct hda_codec *codec)
                 alc_inithook(codec);
 }
 
+enum {
+        ALC662_FIXUP_ASPIRE,
+        ALC662_FIXUP_IDEAPAD,
+};
+
+static const struct alc_fixup alc662_fixups[] = {
+        [ALC662_FIXUP_ASPIRE] = {
+                .pins = (const struct alc_pincfg[]) {
+                        { 0x15, 0x99130112 }, /* subwoofer */
+                        { }
+                }
+        },
+        [ALC662_FIXUP_IDEAPAD] = {
+                .pins = (const struct alc_pincfg[]) {
+                        { 0x17, 0x99130112 }, /* subwoofer */
+                        { }
+                }
+        },
+};
+
+static struct snd_pci_quirk alc662_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+        SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
+        SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
+        SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+        SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+        {}
+};
+
+
+
 static int patch_alc662(struct hda_codec *codec)
 {
         struct alc_spec *spec;
@@ -18967,6 +19001,7 @@ static int patch_alc662(struct hda_codec *codec)
         }
 
         if (board_config == ALC662_AUTO) {
+                alc_pick_fixup(codec, alc662_fixup_tbl, alc662_fixups, 1);
                 /* automatic parse from the BIOS config */
                 err = alc662_parse_auto_config(codec);
                 if (err < 0) {
@@ -19025,8 +19060,11 @@ static int patch_alc662(struct hda_codec *codec)
         spec->vmaster_nid = 0x02;
 
         codec->patch_ops = alc_patch_ops;
-        if (board_config == ALC662_AUTO)
+        if (board_config == ALC662_AUTO) {
                 spec->init_hook = alc662_auto_init;
+                alc_pick_fixup(codec, alc662_fixup_tbl, alc662_fixups, 0);
+        }
+
 #ifdef CONFIG_SND_HDA_POWER_SAVE
         if (!spec->loopback.amplist)
                 spec->loopback.amplist = alc662_loopbacks;
@@ -19039,7 +19077,10 @@ static int patch_alc888(struct hda_codec *codec)
 {
         if ((alc_read_coef_idx(codec, 0) & 0x00f0)==0x0030){
                 kfree(codec->chip_name);
-                codec->chip_name = kstrdup("ALC888-VD", GFP_KERNEL);
+                if (codec->vendor_id == 0x10ec0887)
+                        codec->chip_name = kstrdup("ALC887-VD", GFP_KERNEL);
+                else
+                        codec->chip_name = kstrdup("ALC888-VD", GFP_KERNEL);
                 if (!codec->chip_name) {
                         alc_free(codec);
                         return -ENOMEM;
@@ -19521,7 +19562,7 @@ static struct hda_codec_preset snd_hda_preset_realtek[] = {
         { .id = 0x10ec0885, .rev = 0x100103, .name = "ALC889A",
           .patch = patch_alc882 },
         { .id = 0x10ec0885, .name = "ALC885", .patch = patch_alc882 },
-        { .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc882 },
+        { .id = 0x10ec0887, .name = "ALC887", .patch = patch_alc888 },
         { .id = 0x10ec0888, .rev = 0x100101, .name = "ALC1200",
           .patch = patch_alc882 },
         { .id = 0x10ec0888, .name = "ALC888", .patch = patch_alc888 },
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index c16c5ba0fda0..78f12064b2bf 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -93,6 +93,7 @@ enum {
         STAC_92HD83XXX_REF,
         STAC_92HD83XXX_PWR_REF,
         STAC_DELL_S14,
+        STAC_DELL_E6410,
         STAC_92HD83XXX_HP,
         STAC_HP_DV7_4000,
         STAC_92HD83XXX_MODELS
@@ -1618,6 +1619,8 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
 static struct snd_pci_quirk stac92hd73xx_codec_id_cfg_tbl[] = {
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02a1,
                       "Alienware M17x", STAC_ALIENWARE_M17X),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x043a,
+                      "Alienware M17x", STAC_ALIENWARE_M17X),
         {} /* terminator */
 };
 
@@ -1633,6 +1636,13 @@ static unsigned int dell_s14_pin_configs[10] = {
         0x40f000f0, 0x40f000f0,
 };
 
+/* Deliberately turn off 0x0f (Dock Mic) to make it choose Int Mic instead */
+static unsigned int dell_e6410_pin_configs[10] = {
+        0x04a11020, 0x0421101f, 0x400000f0, 0x90170110,
+        0x23011050, 0x40f000f0, 0x400000f0, 0x90a60130,
+        0x40f000f0, 0x40f000f0,
+};
+
 static unsigned int hp_dv7_4000_pin_configs[10] = {
         0x03a12050, 0x0321201f, 0x40f000f0, 0x90170110,
         0x40f000f0, 0x40f000f0, 0x90170110, 0xd5a30140,
@@ -1643,6 +1653,7 @@ static unsigned int *stac92hd83xxx_brd_tbl[STAC_92HD83XXX_MODELS] = {
         [STAC_92HD83XXX_REF] = ref92hd83xxx_pin_configs,
         [STAC_92HD83XXX_PWR_REF] = ref92hd83xxx_pin_configs,
         [STAC_DELL_S14] = dell_s14_pin_configs,
+        [STAC_DELL_E6410] = dell_e6410_pin_configs,
         [STAC_HP_DV7_4000] = hp_dv7_4000_pin_configs,
 };
 
@@ -1651,6 +1662,7 @@ static const char *stac92hd83xxx_models[STAC_92HD83XXX_MODELS] = {
         [STAC_92HD83XXX_REF] = "ref",
         [STAC_92HD83XXX_PWR_REF] = "mic-ref",
         [STAC_DELL_S14] = "dell-s14",
+        [STAC_DELL_E6410] = "dell-e6410",
         [STAC_92HD83XXX_HP] = "hp",
         [STAC_HP_DV7_4000] = "hp-dv7-4000",
 };
@@ -1663,6 +1675,10 @@ static struct snd_pci_quirk stac92hd83xxx_cfg_tbl[] = {
                       "DFI LanParty", STAC_92HD83XXX_REF),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02ba,
                       "unknown Dell", STAC_DELL_S14),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x040a,
+                      "Dell E6410", STAC_DELL_E6410),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x040b,
+                      "Dell E6510", STAC_DELL_E6410),
         SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xff00, 0x3600,
                       "HP", STAC_92HD83XXX_HP),
         {} /* terminator */
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 467749249576..ebfa1f8b70c1 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -1866,6 +1866,12 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
         },
         {
                 .subvendor = 0x1028,
+                .subdevice = 0x0182,
+                .name = "Dell Latitude D610",   /* STAC9750/51 */
+                .type = AC97_TUNE_HP_ONLY
+        },
+        {
+                .subvendor = 0x1028,
                 .subdevice = 0x0186,
                 .name = "Dell Latitude D810", /* cf. Malone #41015 */
                 .type = AC97_TUNE_HP_MUTE_LED
diff --git a/sound/soc/blackfin/bf5xx-ac97.c b/sound/soc/blackfin/bf5xx-ac97.c
index c0eba5109980..d91f2e44e7e6 100644
--- a/sound/soc/blackfin/bf5xx-ac97.c
+++ b/sound/soc/blackfin/bf5xx-ac97.c
@@ -260,9 +260,9 @@ static int bf5xx_ac97_suspend(struct snd_soc_dai *dai)
         pr_debug("%s : sport %d\n", __func__, dai->id);
         if (!dai->active)
                 return 0;
-        if (dai->capture.active)
+        if (dai->capture_active)
                 sport_rx_stop(sport);
-        if (dai->playback.active)
+        if (dai->playback_active)
                 sport_tx_stop(sport);
         return 0;
 }
diff --git a/sound/soc/blackfin/bf5xx-tdm.c b/sound/soc/blackfin/bf5xx-tdm.c
index 24c14269f4bc..25037789ddb6 100644
--- a/sound/soc/blackfin/bf5xx-tdm.c
+++ b/sound/soc/blackfin/bf5xx-tdm.c
@@ -210,7 +210,7 @@ static int bf5xx_tdm_set_channel_map(struct snd_soc_dai *dai,
 #ifdef CONFIG_PM
 static int bf5xx_tdm_suspend(struct snd_soc_dai *dai)
 {
-        struct sport_device *sport = dai->private_data;
+        struct sport_device *sport = snd_soc_dai_get_drvdata(dai);
 
         if (!dai->active)
                 return 0;
diff --git a/sound/soc/codecs/wm8580.c b/sound/soc/codecs/wm8580.c
index 72deeabef4fe..a961fc6f0c5f 100644
--- a/sound/soc/codecs/wm8580.c
+++ b/sound/soc/codecs/wm8580.c
@@ -171,7 +171,7 @@
 static const u16 wm8580_reg[] = {
         0x0121, 0x017e, 0x007d, 0x0014, /*R3*/
         0x0121, 0x017e, 0x007d, 0x0194, /*R7*/
-        0x001c, 0x0002, 0x0002, 0x00c2, /*R11*/
+        0x0010, 0x0002, 0x0002, 0x00c2, /*R11*/
         0x0182, 0x0082, 0x000a, 0x0024, /*R15*/
         0x0009, 0x0000, 0x00ff, 0x0000, /*R19*/
         0x00ff, 0x00ff, 0x00ff, 0x00ff, /*R23*/
diff --git a/sound/soc/codecs/wm8900.c b/sound/soc/codecs/wm8900.c
index 5da17a704e5a..4b8ffc2ea71d 100644
--- a/sound/soc/codecs/wm8900.c
+++ b/sound/soc/codecs/wm8900.c
@@ -188,7 +188,6 @@ static int wm8900_volatile_register(unsigned int reg)
 {
         switch (reg) {
         case WM8900_REG_ID:
-        case WM8900_REG_POWER1:
                 return 1;
         default:
                 return 0;
@@ -1236,11 +1235,6 @@ static __devinit int wm8900_i2c_probe(struct i2c_client *i2c,
                 goto err;
         }
 
-        /* Read back from the chip */
-        reg = snd_soc_read(codec, WM8900_REG_POWER1);
-        reg = (reg >> 12) & 0xf;
-        dev_info(&i2c->dev, "WM8900 revision %d\n", reg);
-
         wm8900_reset(codec);
 
         /* Turn the chip on */
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index f7dcabf6283c..f0897d8f444e 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -820,7 +820,8 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
         struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
 
-        return wm8904->deemph;
+        ucontrol->value.enumerated.item[0] = wm8904->deemph;
+        return 0;
 }
 
 static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
index 5f025593d84d..004e83765642 100644
--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -384,7 +384,8 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
         struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
 
-        return wm8955->deemph;
+        ucontrol->value.enumerated.item[0] = wm8955->deemph;
+        return 0;
 }
 
 static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index 3c6ee61f6c95..2331f51b0d11 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -137,7 +137,8 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
         struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
 
-        return wm8960->deemph;
+        ucontrol->value.enumerated.item[0] = wm8960->deemph;
+        return 0;
 }
 
 static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
diff --git a/sound/soc/codecs/wm8961.c b/sound/soc/codecs/wm8961.c
index 2549d3a297ab..3bd65c88d4a0 100644
--- a/sound/soc/codecs/wm8961.c
+++ b/sound/soc/codecs/wm8961.c
@@ -711,7 +711,7 @@ static int wm8961_hw_params(struct snd_pcm_substream *substream,
         if (fs <= 24000)
                 reg |= WM8961_DACSLOPE;
         else
-                reg &= WM8961_DACSLOPE;
+                reg &= ~WM8961_DACSLOPE;
         snd_soc_write(codec, WM8961_ADC_DAC_CONTROL_2, reg);
 
         return 0;
@@ -736,7 +736,7 @@ static int wm8961_set_sysclk(struct snd_soc_dai *dai, int clk_id,
                 freq /= 2;
         } else {
                 dev_dbg(codec->dev, "Using MCLK/1 for %dHz MCLK\n", freq);
-                reg &= WM8961_MCLKDIV;
+                reg &= ~WM8961_MCLKDIV;
         }
 
         snd_soc_write(codec, WM8961_CLOCKING1, reg);
diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
index dd8d909788c1..0022c7adb893 100644
--- a/sound/soc/codecs/wm8990.c
+++ b/sound/soc/codecs/wm8990.c
@@ -1183,7 +1183,7 @@ static int wm8990_set_bias_level(struct snd_soc_codec *codec,
                                      WM8990_VMIDTOG);
 
                         /* Delay to allow output caps to discharge */
-                        msleep(msecs_to_jiffies(300));
+                        msleep(300);
 
                         /* Disable VMIDTOG */
                         snd_soc_write(codec, WM8990_ANTIPOP2, WM8990_SOFTST |
@@ -1195,17 +1195,17 @@ static int wm8990_set_bias_level(struct snd_soc_codec *codec,
                         /* Enable outputs */
                         snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1b00);
 
-                        msleep(msecs_to_jiffies(50));
+                        msleep(50);
 
                         /* Enable VMID at 2x50k */
                         snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f02);
 
-                        msleep(msecs_to_jiffies(100));
+                        msleep(100);
 
                         /* Enable VREF */
                         snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f03);
 
-                        msleep(msecs_to_jiffies(600));
+                        msleep(600);
 
                         /* Enable BUFIOEN */
                         snd_soc_write(codec, WM8990_ANTIPOP2, WM8990_SOFTST |
@@ -1250,7 +1250,7 @@ static int wm8990_set_bias_level(struct snd_soc_codec *codec,
                 /* Disable VMID */
                 snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f01);
 
-                msleep(msecs_to_jiffies(300));
+                msleep(300);
 
                 /* Enable all output discharge bits */
                 snd_soc_write(codec, WM8990_ANTIPOP1, WM8990_DIS_LLINE |
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 522249d5c2b4..f3732c20806f 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -2519,18 +2519,18 @@ SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_CLOCKING_1, 1, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
 
-SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", "AIF1 Capture",
+SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
                      0, WM8994_POWER_MANAGEMENT_4, 9, 0),
-SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", "AIF1 Capture",
+SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
                      0, WM8994_POWER_MANAGEMENT_4, 8, 0),
 SND_SOC_DAPM_AIF_IN("AIF1DAC1L", NULL, 0,
                     WM8994_POWER_MANAGEMENT_5, 9, 0),
 SND_SOC_DAPM_AIF_IN("AIF1DAC1R", NULL, 0,
                     WM8994_POWER_MANAGEMENT_5, 8, 0),
 
-SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", "AIF1 Capture",
+SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
                      0, WM8994_POWER_MANAGEMENT_4, 11, 0),
-SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", "AIF1 Capture",
+SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
                      0, WM8994_POWER_MANAGEMENT_4, 10, 0),
 SND_SOC_DAPM_AIF_IN("AIF1DAC2L", NULL, 0,
                     WM8994_POWER_MANAGEMENT_5, 11, 0),
@@ -2571,6 +2571,7 @@ SND_SOC_DAPM_AIF_IN("AIF2DACR", NULL, 0,
 
 SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
 SND_SOC_DAPM_AIF_IN("AIF2DACDAT", "AIF2 Playback", 0, SND_SOC_NOPM, 0, 0),
+SND_SOC_DAPM_AIF_OUT("AIF1ADCDAT", "AIF1 Capture", 0, SND_SOC_NOPM, 0, 0),
 SND_SOC_DAPM_AIF_OUT("AIF2ADCDAT", "AIF2 Capture", 0, SND_SOC_NOPM, 0, 0),
 
 SND_SOC_DAPM_MUX("AIF1DAC Mux", SND_SOC_NOPM, 0, 0, &aif1dac_mux),
@@ -2766,6 +2767,11 @@ static const struct snd_soc_dapm_route intercon[] = {
         { "AIF2DAC2R Mixer", "Left Sidetone Switch", "Left Sidetone" },
         { "AIF2DAC2R Mixer", "Right Sidetone Switch", "Right Sidetone" },
 
+        { "AIF1ADCDAT", NULL, "AIF1ADC1L" },
+        { "AIF1ADCDAT", NULL, "AIF1ADC1R" },
+        { "AIF1ADCDAT", NULL, "AIF1ADC2L" },
+        { "AIF1ADCDAT", NULL, "AIF1ADC2R" },
+
         { "AIF2ADCDAT", NULL, "AIF2ADC Mux" },
 
         /* AIF3 output */
@@ -2914,6 +2920,7 @@ static int wm8994_set_fll(struct snd_soc_dai *dai, int id, int src,
                 /* Allow no source specification when stopping */
                 if (freq_out)
                         return -EINVAL;
+                src = wm8994->fll[id].src;
                 break;
         case WM8994_FLL_SRC_MCLK1:
         case WM8994_FLL_SRC_MCLK2:
@@ -3485,7 +3492,7 @@ static int wm8994_set_tristate(struct snd_soc_dai *codec_dai, int tristate)
         else
                 val = 0;
 
-        return snd_soc_update_bits(codec, reg, mask, reg);
+        return snd_soc_update_bits(codec, reg, mask, val);
 }
 
 #define WM8994_RATES SNDRV_PCM_RATE_8000_96000
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index 2cb81538cd91..359ad8869349 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -92,6 +92,7 @@ static void wait_for_dc_servo(struct snd_soc_codec *codec, unsigned int op)
 static void calibrate_dc_servo(struct snd_soc_codec *codec)
 {
         struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
+        s8 offset;
         u16 reg, reg_l, reg_r, dcs_cfg;
 
         /* Set for 32 series updates */
@@ -130,16 +131,14 @@ static void calibrate_dc_servo(struct snd_soc_codec *codec)
                 dev_dbg(codec->dev, "DCS input: %x %x\n", reg_l, reg_r);
 
                 /* HPOUT1L */
-                if (reg_l + hubs->dcs_codes > 0 &&
-                    reg_l + hubs->dcs_codes < 0xff)
-                        reg_l += hubs->dcs_codes;
-                dcs_cfg = reg_l << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
+                offset = reg_l;
+                offset += hubs->dcs_codes;
+                dcs_cfg = (u8)offset << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
 
                 /* HPOUT1R */
-                if (reg_r + hubs->dcs_codes > 0 &&
-                    reg_r + hubs->dcs_codes < 0xff)
-                        reg_r += hubs->dcs_codes;
-                dcs_cfg |= reg_r;
+                offset = reg_r;
+                offset += hubs->dcs_codes;
+                dcs_cfg |= (u8)offset;
 
                 dev_dbg(codec->dev, "DCS result: %x\n", dcs_cfg);
 
@@ -293,7 +292,7 @@ SOC_DOUBLE_R("Speaker Switch",
 SOC_DOUBLE_R("Speaker ZC Switch",
              WM8993_SPEAKER_VOLUME_LEFT, WM8993_SPEAKER_VOLUME_RIGHT,
              7, 1, 0),
-SOC_DOUBLE_TLV("Speaker Boost Volume", WM8993_SPKOUT_BOOST, 0, 3, 7, 0,
+SOC_DOUBLE_TLV("Speaker Boost Volume", WM8993_SPKOUT_BOOST, 3, 0, 7, 0,
                spkboost_tlv),
 SOC_ENUM("Speaker Reference", speaker_ref),
 SOC_ENUM("Speaker Mode", speaker_mode),
diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index b9c2bc65f51a..0eb1ade87345 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -843,8 +843,8 @@ static void snd_usbmidi_us122l_output(struct snd_usb_midi_out_endpoint *ep,
                 return;
         }
 
-        memset(urb->transfer_buffer + count, 0xFD, 9 - count);
-        urb->transfer_buffer_length = count;
+        memset(urb->transfer_buffer + count, 0xFD, ep->max_transfer - count);
+        urb->transfer_buffer_length = ep->max_transfer;
 }
 
 static struct usb_protocol_ops snd_usbmidi_122l_ops = {
@@ -1288,6 +1288,13 @@ static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi* umidi,
         case USB_ID(0x1a86, 0x752d): /* QinHeng CH345 "USB2.0-MIDI" */
                 ep->max_transfer = 4;
                 break;
+                /*
+                 * Some devices only work with 9 bytes packet size:
+                 */
+        case USB_ID(0x0644, 0x800E): /* Tascam US-122L */
+        case USB_ID(0x0644, 0x800F): /* Tascam US-144 */
+                ep->max_transfer = 9;
+                break;
         }
         for (i = 0; i < OUTPUT_URBS; ++i) {
                 buffer = usb_alloc_coherent(umidi->dev,
diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index 6ef68e42138e..084e6fc8d5bf 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -273,29 +273,26 @@ static unsigned int usb_stream_hwdep_poll(struct snd_hwdep *hw,
                                           struct file *file, poll_table *wait)
 {
         struct us122l   *us122l = hw->private_data;
-        struct usb_stream *s = us122l->sk.s;
         unsigned        *polled;
         unsigned int    mask;
 
         poll_wait(file, &us122l->sk.sleep, wait);
 
-        switch (s->state) {
-        case usb_stream_ready:
-                if (us122l->first == file)
-                        polled = &s->periods_polled;
-                else
-                        polled = &us122l->second_periods_polled;
-                if (*polled != s->periods_done) {
-                        *polled = s->periods_done;
-                        mask = POLLIN | POLLOUT | POLLWRNORM;
-                        break;
+        mask = POLLIN | POLLOUT | POLLWRNORM | POLLERR;
+        if (mutex_trylock(&us122l->mutex)) {
+                struct usb_stream *s = us122l->sk.s;
+                if (s && s->state == usb_stream_ready) {
+                        if (us122l->first == file)
+                                polled = &s->periods_polled;
+                        else
+                                polled = &us122l->second_periods_polled;
+                        if (*polled != s->periods_done) {
+                                *polled = s->periods_done;
+                                mask = POLLIN | POLLOUT | POLLWRNORM;
+                        } else
+                                mask = 0;
                 }
-                /* Fall through */
-                mask = 0;
-                break;
-        default:
-                mask = POLLIN | POLLOUT | POLLWRNORM | POLLERR;
-                break;
+                mutex_unlock(&us122l->mutex);
         }
         return mask;
 }
@@ -381,6 +378,7 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
 {
         struct usb_stream_config *cfg;
         struct us122l *us122l = hw->private_data;
+        struct usb_stream *s;
         unsigned min_period_frames;
         int err = 0;
         bool high_speed;
@@ -426,18 +424,18 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
         snd_power_wait(hw->card, SNDRV_CTL_POWER_D0);
 
         mutex_lock(&us122l->mutex);
+        s = us122l->sk.s;
         if (!us122l->master)
                 us122l->master = file;
         else if (us122l->master != file) {
-                if (memcmp(cfg, &us122l->sk.s->cfg, sizeof(*cfg))) {
+                if (!s || memcmp(cfg, &s->cfg, sizeof(*cfg))) {
                         err = -EIO;
                         goto unlock;
                 }
                 us122l->slave = file;
         }
-        if (!us122l->sk.s ||
-            memcmp(cfg, &us122l->sk.s->cfg, sizeof(*cfg)) ||
-            us122l->sk.s->state == usb_stream_xrun) {
+        if (!s || memcmp(cfg, &s->cfg, sizeof(*cfg)) ||
+            s->state == usb_stream_xrun) {
                 us122l_stop(us122l);
                 if (!us122l_start(us122l, cfg->sample_rate, cfg->period_frames))
                         err = -EIO;
@@ -448,6 +446,7 @@ unlock:
         mutex_unlock(&us122l->mutex);
 free:
         kfree(cfg);
+        wake_up_all(&us122l->sk.sleep);
         return err;
 }